Custom authentication for Modules (#11659)

This change adds new module callbacks that can override the default password based authentication associated with ACLs. With this, Modules can register auth callbacks through which they can implement their own Authentication logic. When `AUTH` and `HELLO AUTH ...` commands are used, Module based authentication is attempted and then normal password based authentication is attempted if needed.
The new Module APIs added in this PR are - `RM_RegisterCustomAuthCallback` and `RM_BlockClientOnAuth` and `RedisModule_ACLAddLogEntryByUserName `.

Module based authentication will be attempted for all Redis users (created through the ACL SETUSER cmd or through Module APIs) even if the Redis user does not exist at the time of the command. This gives a chance for the Module to create the RedisModule user and then authenticate via the RedisModule API - from the custom auth callback.

For the AUTH command, we will support both variations - `AUTH <username> <password>` and `AUTH <password>`. In case of the `AUTH <password>` variation, the custom auth callbacks are triggered with “default” as the username and password as what is provided.


### RedisModule_RegisterCustomAuthCallback
```
void RM_RegisterCustomAuthCallback(RedisModuleCtx *ctx, RedisModuleCustomAuthCallback cb) {
```
This API registers a callback to execute to prior to normal password based authentication. Multiple callbacks can be registered across different modules. These callbacks are responsible for either handling the authentication, each authenticating the user or explicitly denying, or deferring it to other authentication mechanisms. Callbacks are triggered in the order they were registered. When a Module is unloaded, all the auth callbacks registered by it are unregistered. The callbacks are attempted, in the order of most recently registered callbacks, when the AUTH/HELLO (with AUTH field is provided) commands are called. The callbacks will be called with a module context along with a username and a password, and are expected to take one of the following actions:

 (1) Authenticate - Use the RM_Authenticate* API successfully and return `REDISMODULE_AUTH_HANDLED`. This will immediately end the auth chain as successful and add the OK reply.
(2) Block a client on authentication - Use the `RM_BlockClientOnAuth` API and return `REDISMODULE_AUTH_HANDLED`. Here, the client will be blocked until the `RM_UnblockClient `API is used which will trigger the auth reply callback (provided earlier through the `RM_BlockClientOnAuth`). In this reply callback, the Module should authenticate, deny or skip handling authentication.
(3) Deny Authentication - Return `REDISMODULE_AUTH_HANDLED` without authenticating or blocking the client. Optionally, `err` can be set to a custom error message. This will immediately end the auth chain as unsuccessful and add the ERR reply.
(4) Skip handling Authentication - Return `REDISMODULE_AUTH_NOT_HANDLED` without blocking the client. This will allow the engine to attempt the next custom auth callback.

If none of the callbacks authenticate or deny auth, then password based auth is attempted and will authenticate or add failure logs and reply to the clients accordingly.

### RedisModule_BlockClientOnAuth
```
RedisModuleBlockedClient *RM_BlockClientOnAuth(RedisModuleCtx *ctx, RedisModuleCustomAuthCallback reply_callback,
                                               void (*free_privdata)(RedisModuleCtx*,void*))
```
This API can only be used from a Module from the custom auth callback. If a client is not in the middle of custom module based authentication, ERROR is returned. Otherwise, the client is blocked and the `RedisModule_BlockedClient` is returned similar to the `RedisModule_BlockClient` API.

### RedisModule_ACLAddLogEntryByUserName
```
int RM_ACLAddLogEntryByUserName(RedisModuleCtx *ctx, RedisModuleString *username, RedisModuleString *object, RedisModuleACLLogEntryReason reason)
```
Adds a new entry in the ACL log with the `username` RedisModuleString provided. This simplifies the Module usage because now, developers do not need to create a Module User just to add an error ACL Log entry. Aside from accepting username (RedisModuleString) instead of a RedisModuleUser, it is the same as the existing `RedisModule_ACLAddLogEntry` API.


### Breaking changes
- HELLO command - Clients can now only set the client name and RESP protocol from the `HELLO` command if they are authenticated. Also, we now finish command arg validation first and return early with a ERR reply if any arg is invalid. This is to avoid mutating the client name / RESP from a command that would have failed on invalid arguments.

### Notable behaviors
- Module unblocking - Now, we will not allow Modules to block the client from inside the context of a reply callback (triggered from the Module unblock flow `moduleHandleBlockedClients`).

---------

Co-authored-by: Madelyn Olson <34459052+madolson@users.noreply.github.com>

3 files changed, 197 insertions, 1 deletions

diff --git a/tests/modules/Makefile b/tests/modules/Makefile
index 5c73ed0e3..a1f5b074b 100644
--- a/tests/modules/Makefile
+++ b/tests/modules/Makefile
@@ -60,7 +60,8 @@ TEST_MODULES = \
     moduleconfigstwo.so \
     publish.so \
     usercall.so \
-    postnotifications.so
+    postnotifications.so \
+    moduleauthtwo.so
 
 .PHONY: all
 
diff --git a/tests/modules/auth.c b/tests/modules/auth.c
index 612320dbc..9ef0626cb 100644
--- a/tests/modules/auth.c
+++ b/tests/modules/auth.c
@@ -1,5 +1,9 @@
 #include "redismodule.h"
 
+#include <string.h>
+#include <unistd.h>
+#include <pthread.h>
+
 #define UNUSED(V) ((void) V)
 
 // A simple global user
@@ -72,6 +76,146 @@ int Auth_ChangeCount(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
     return RedisModule_ReplyWithLongLong(ctx, result);
 }
 
+/* The Module functionality below validates that module authentication callbacks can be registered
+ * to support both non-blocking and blocking module based authentication. */
+
+/* Non Blocking Module Auth callback / implementation. */
+int auth_cb(RedisModuleCtx *ctx, RedisModuleString *username, RedisModuleString *password, RedisModuleString **err) {
+    const char *user = RedisModule_StringPtrLen(username, NULL);
+    const char *pwd = RedisModule_StringPtrLen(password, NULL);
+    if (!strcmp(user,"foo") && !strcmp(pwd,"allow")) {
+        RedisModule_AuthenticateClientWithACLUser(ctx, "foo", 3, NULL, NULL, NULL);
+        return REDISMODULE_AUTH_HANDLED;
+    }
+    else if (!strcmp(user,"foo") && !strcmp(pwd,"deny")) {
+        RedisModuleString *log = RedisModule_CreateString(ctx, "Module Auth", 11);
+        RedisModule_ACLAddLogEntryByUserName(ctx, username, log, REDISMODULE_ACL_LOG_AUTH);
+        RedisModule_FreeString(ctx, log);
+        const char *err_msg = "Auth denied by Misc Module.";
+        *err = RedisModule_CreateString(ctx, err_msg, strlen(err_msg));
+        return REDISMODULE_AUTH_HANDLED;
+    }
+    return REDISMODULE_AUTH_NOT_HANDLED;
+}
+
+int test_rm_register_auth_cb(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+    REDISMODULE_NOT_USED(argv);
+    REDISMODULE_NOT_USED(argc);
+    RedisModule_RegisterAuthCallback(ctx, auth_cb);
+    RedisModule_ReplyWithSimpleString(ctx, "OK");
+    return REDISMODULE_OK;
+}
+
+/*
+ * The thread entry point that actually executes the blocking part of the AUTH command.
+ * This function sleeps for 0.5 seconds and then unblocks the client which will later call
+ * `AuthBlock_Reply`.
+ * `arg` is expected to contain the RedisModuleBlockedClient, username, and password.
+ */
+void *AuthBlock_ThreadMain(void *arg) {
+    usleep(500000);
+    void **targ = arg;
+    RedisModuleBlockedClient *bc = targ[0];
+    int result = 2;
+    const char *user = RedisModule_StringPtrLen(targ[1], NULL);
+    const char *pwd = RedisModule_StringPtrLen(targ[2], NULL);
+    if (!strcmp(user,"foo") && !strcmp(pwd,"block_allow")) {
+        result = 1;
+    }
+    else if (!strcmp(user,"foo") && !strcmp(pwd,"block_deny")) {
+        result = 0;
+    }
+    else if (!strcmp(user,"foo") && !strcmp(pwd,"block_abort")) {
+        RedisModule_BlockedClientMeasureTimeEnd(bc);
+        RedisModule_AbortBlock(bc);
+        goto cleanup;
+    }
+    /* Provide the result to the blocking reply cb. */
+    void **replyarg = RedisModule_Alloc(sizeof(void*));
+    replyarg[0] = (void *) (uintptr_t) result;
+    RedisModule_BlockedClientMeasureTimeEnd(bc);
+    RedisModule_UnblockClient(bc, replyarg);
+cleanup:
+    /* Free the username and password and thread / arg data. */
+    RedisModule_FreeString(NULL, targ[1]);
+    RedisModule_FreeString(NULL, targ[2]);
+    RedisModule_Free(targ);
+    return NULL;
+}
+
+/*
+ * Reply callback for a blocking AUTH command. This is called when the client is unblocked.
+ */
+int AuthBlock_Reply(RedisModuleCtx *ctx, RedisModuleString *username, RedisModuleString *password, RedisModuleString **err) {
+    REDISMODULE_NOT_USED(password);
+    void **targ = RedisModule_GetBlockedClientPrivateData(ctx);
+    int result = (uintptr_t) targ[0];
+    size_t userlen = 0;
+    const char *user = RedisModule_StringPtrLen(username, &userlen);
+    /* Handle the success case by authenticating. */
+    if (result == 1) {
+        RedisModule_AuthenticateClientWithACLUser(ctx, user, userlen, NULL, NULL, NULL);
+        return REDISMODULE_AUTH_HANDLED;
+    }
+    /* Handle the Error case by denying auth */
+    else if (result == 0) {
+        RedisModuleString *log = RedisModule_CreateString(ctx, "Module Auth", 11);
+        RedisModule_ACLAddLogEntryByUserName(ctx, username, log, REDISMODULE_ACL_LOG_AUTH);
+        RedisModule_FreeString(ctx, log);
+        const char *err_msg = "Auth denied by Misc Module.";
+        *err = RedisModule_CreateString(ctx, err_msg, strlen(err_msg));
+        return REDISMODULE_AUTH_HANDLED;
+    }
+    /* "Skip" Authentication */
+    return REDISMODULE_AUTH_NOT_HANDLED;
+}
+
+/* Private data freeing callback for Module Auth. */
+void AuthBlock_FreeData(RedisModuleCtx *ctx, void *privdata) {
+    REDISMODULE_NOT_USED(ctx);
+    RedisModule_Free(privdata);
+}
+
+/* Callback triggered when the engine attempts module auth
+ * Return code here is one of the following: Auth succeeded, Auth denied,
+ * Auth not handled, Auth blocked.
+ * The Module can have auth succeed / denied here itself, but this is an example
+ * of blocking module auth.
+ */
+int blocking_auth_cb(RedisModuleCtx *ctx, RedisModuleString *username, RedisModuleString *password, RedisModuleString **err) {
+    REDISMODULE_NOT_USED(username);
+    REDISMODULE_NOT_USED(password);
+    REDISMODULE_NOT_USED(err);
+    /* Block the client from the Module. */
+    RedisModuleBlockedClient *bc = RedisModule_BlockClientOnAuth(ctx, AuthBlock_Reply, AuthBlock_FreeData);
+    int ctx_flags = RedisModule_GetContextFlags(ctx);
+    if (ctx_flags & REDISMODULE_CTX_FLAGS_MULTI || ctx_flags & REDISMODULE_CTX_FLAGS_LUA) {
+        /* Clean up by using RedisModule_UnblockClient since we attempted blocking the client. */
+        RedisModule_UnblockClient(bc, NULL);
+        return REDISMODULE_AUTH_HANDLED;
+    }
+    RedisModule_BlockedClientMeasureTimeStart(bc);
+    pthread_t tid;
+    /* Allocate memory for information needed. */
+    void **targ = RedisModule_Alloc(sizeof(void*)*3);
+    targ[0] = bc;
+    targ[1] = RedisModule_CreateStringFromString(NULL, username);
+    targ[2] = RedisModule_CreateStringFromString(NULL, password);
+    /* Create bg thread and pass the blockedclient, username and password to it. */
+    if (pthread_create(&tid, NULL, AuthBlock_ThreadMain, targ) != 0) {
+        RedisModule_AbortBlock(bc);
+    }
+    return REDISMODULE_AUTH_HANDLED;
+}
+
+int test_rm_register_blocking_auth_cb(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+    REDISMODULE_NOT_USED(argv);
+    REDISMODULE_NOT_USED(argc);
+    RedisModule_RegisterAuthCallback(ctx, blocking_auth_cb);
+    RedisModule_ReplyWithSimpleString(ctx, "OK");
+    return REDISMODULE_OK;
+}
+
 /* This function must be present on each Redis module. It is used in order to
  * register the commands into the Redis server. */
 int RedisModule_OnLoad(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
@@ -101,6 +245,14 @@ int RedisModule_OnLoad(RedisModuleCtx *ctx, RedisModuleString **argv, int argc)
         Auth_RedactedAPI,"",0,0,0) == REDISMODULE_ERR)
         return REDISMODULE_ERR;
 
+    if (RedisModule_CreateCommand(ctx,"testmoduleone.rm_register_auth_cb",
+        test_rm_register_auth_cb,"",0,0,0) == REDISMODULE_ERR)
+        return REDISMODULE_ERR;
+
+    if (RedisModule_CreateCommand(ctx,"testmoduleone.rm_register_blocking_auth_cb",
+        test_rm_register_blocking_auth_cb,"",0,0,0) == REDISMODULE_ERR)
+        return REDISMODULE_ERR;
+
     return REDISMODULE_OK;
 }
 
diff --git a/tests/modules/moduleauthtwo.c b/tests/modules/moduleauthtwo.c
new file mode 100644
index 000000000..0a4f56b65
--- /dev/null
+++ b/tests/modules/moduleauthtwo.c
@@ -0,0 +1,43 @@
+#include "redismodule.h"
+
+#include <string.h>
+
+/* This is a second sample module to validate that module authentication callbacks can be registered
+ * from multiple modules. */
+
+/* Non Blocking Module Auth callback / implementation. */
+int auth_cb(RedisModuleCtx *ctx, RedisModuleString *username, RedisModuleString *password, RedisModuleString **err) {
+    const char *user = RedisModule_StringPtrLen(username, NULL);
+    const char *pwd = RedisModule_StringPtrLen(password, NULL);
+    if (!strcmp(user,"foo") && !strcmp(pwd,"allow_two")) {
+        RedisModule_AuthenticateClientWithACLUser(ctx, "foo", 3, NULL, NULL, NULL);
+        return REDISMODULE_AUTH_HANDLED;
+    }
+    else if (!strcmp(user,"foo") && !strcmp(pwd,"deny_two")) {
+        RedisModuleString *log = RedisModule_CreateString(ctx, "Module Auth", 11);
+        RedisModule_ACLAddLogEntryByUserName(ctx, username, log, REDISMODULE_ACL_LOG_AUTH);
+        RedisModule_FreeString(ctx, log);
+        const char *err_msg = "Auth denied by Misc Module.";
+        *err = RedisModule_CreateString(ctx, err_msg, strlen(err_msg));
+        return REDISMODULE_AUTH_HANDLED;
+    }
+    return REDISMODULE_AUTH_NOT_HANDLED;
+}
+
+int test_rm_register_auth_cb(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+    REDISMODULE_NOT_USED(argv);
+    REDISMODULE_NOT_USED(argc);
+    RedisModule_RegisterAuthCallback(ctx, auth_cb);
+    RedisModule_ReplyWithSimpleString(ctx, "OK");
+    return REDISMODULE_OK;
+}
+
+int RedisModule_OnLoad(RedisModuleCtx *ctx, RedisModuleString **argv, int argc) {
+    REDISMODULE_NOT_USED(argv);
+    REDISMODULE_NOT_USED(argc);
+    if (RedisModule_Init(ctx,"moduleauthtwo",1,REDISMODULE_APIVER_1)== REDISMODULE_ERR)
+        return REDISMODULE_ERR;
+    if (RedisModule_CreateCommand(ctx,"testmoduletwo.rm_register_auth_cb", test_rm_register_auth_cb,"",0,0,0) == REDISMODULE_ERR)
+        return REDISMODULE_ERR;
+    return REDISMODULE_OK;
+}
\ No newline at end of file