Added parameter to disable flush_all (nice to have on production)

3 files changed, 22 insertions, 1 deletions

diff --git a/memcached.c b/memcached.c
index c4537f0..59f9559 100644
--- a/memcached.c
+++ b/memcached.c
@@ -229,6 +229,7 @@ static void settings_init(void) {
     settings.slab_automove = 0;
     settings.shutdown_command = false;
     settings.tail_repair_time = TAIL_REPAIR_TIME_DEFAULT;
+    settings.flush_enabled = true;
 }
 
 /*
@@ -2150,6 +2151,12 @@ static void process_bin_flush(conn *c) {
     time_t exptime = 0;
     protocol_binary_request_flush* req = binary_get_request(c);
 
+    if (!settings.flush_enabled) {
+      // flush_all is not allowed but we log it on stats
+      write_bin_error(c, PROTOCOL_BINARY_RESPONSE_AUTH_ERROR, 0);
+      return;
+    }
+
     if (c->binary_header.request.extlen == sizeof(req->message.body)) {
         exptime = ntohl(req->message.body.expiration);
     }
@@ -2656,6 +2663,7 @@ static void process_stat_settings(ADD_STAT add_stats, void *c) {
     APPEND_STAT("slab_reassign", "%s", settings.slab_reassign ? "yes" : "no");
     APPEND_STAT("slab_automove", "%d", settings.slab_automove);
     APPEND_STAT("tail_repair_time", "%d", settings.tail_repair_time);
+    APPEND_STAT("flush_enabled", "%s", settings.flush_enabled ? "yes" : "no");
 }
 
 static void process_stat(conn *c, token_t *tokens, const size_t ntokens) {
@@ -3336,6 +3344,12 @@ static void process_command(conn *c, char *command) {
         c->thread->stats.flush_cmds++;
         pthread_mutex_unlock(&c->thread->stats.mutex);
 
+        if (!settings.flush_enabled) {
+            // flush_all is not allowed but we log it on stats
+            out_string(c, "CLIENT_ERROR flush_all not allowed");
+            return;
+        }
+
         if(ntokens == (c->noreply ? 3 : 2)) {
             settings.oldest_live = current_time - 1;
             item_flush_expired();
@@ -4581,6 +4595,7 @@ static void usage(void) {
 #ifdef ENABLE_SASL
     printf("-S            Turn on Sasl authentication\n");
 #endif
+    printf("-F            Disable flush_all command\n");
     printf("-o            Comma separated list of extended or experimental options\n"
            "              - (EXPERIMENTAL) maxconns_fast: immediately close new\n"
            "                connections if over maxconns limit\n"
@@ -4879,6 +4894,7 @@ int main (int argc, char **argv) {
           "B:"  /* Binding protocol */
           "I:"  /* Max item size */
           "S"   /* Sasl ON */
+          "F"   /* Disable flush_all */
           "o:"  /* Extended generic options */
         ))) {
         switch (c) {
@@ -5063,6 +5079,9 @@ int main (int argc, char **argv) {
 #endif
             settings.sasl = true;
             break;
+       case 'F' :
+            settings.flush_enabled = false;
+            break;
         case 'o': /* It's sub-opts time! */
             subopts = optarg;
 
diff --git a/memcached.h b/memcached.h
index 8c335c1..8d63634 100644
--- a/memcached.h
+++ b/memcached.h
@@ -310,6 +310,7 @@ struct settings {
     int hashpower_init;     /* Starting hash power level */
     bool shutdown_command; /* allow shutdown command */
     int tail_repair_time;   /* LRU tail refcount leak repair time */
+    bool flush_enabled;     /* flush_all enabled */
 };
 
 extern struct stats stats;
diff --git a/t/binary.t b/t/binary.t
index 2781af6..c1b595d 100755
--- a/t/binary.t
+++ b/t/binary.t
@@ -2,7 +2,7 @@
 
 use strict;
 use warnings;
-use Test::More tests => 3564;
+use Test::More tests => 3568;
 use FindBin qw($Bin);
 use lib "$Bin/lib";
 use MemcachedTest;
@@ -414,6 +414,7 @@ $mc->silent_mutation(::CMD_ADDQ, 'silentadd', 'silentaddval');
     is('NULL', $stats{'domain_socket'});
     is('on', $stats{'evictions'});
     is('yes', $stats{'cas_enabled'});
+    is('yes', $stats{'flush_enabled'});
 }
 
 # diag "Test quit commands.";