summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
| * Updated HDR histogram from upsteam after they merged our fix in #10606. (#10755)yoav-steinberg2022-05-223-37/+83
| | | | | | | | | | | | The code is based on upstream https://github.com/HdrHistogram/HdrHistogram_c master branch latest commit (e4448cf6d1cd08fff519812d3b1e58bd5a94ac42). The reason to pull this in now is that their final version of our optimization is even faster. See: https://github.com/HdrHistogram/HdrHistogram_c/pull/107.
| * Remove ziplist dead code in object.c (#10751)Binbin2022-05-222-6/+3
| | | | | | | | | | | | | | | | | | | | | | Remove some dead code in object.c, ziplist is no longer used in 7.0 Some backgrounds: zipmap - hash: replaced by ziplist in #285 ziplist - hash: replaced by listpack in #8887 ziplist - zset: replaced by listpack in #9366 ziplist - list: replaced by quicklist (listpack) in #2143 / #9740 Moved the location of ziplist.h in the server.c
| * Fix memory leak in streamGetEdgeID (#10753)Yuuoniy2022-05-221-1/+1
| | | | | | | | | | | | si is initialized by streamIteratorStart(), we should call streamIteratorStop() on it when done. regression introduced in #9127 (redis 7.0)
| * Add SIGINT handler to redis-cli --bigkeys, --memkeys, --hotkeys, --scan (#10736)Ofir Luzon2022-05-221-12/+14
| | | | | | | | | | | | Finish current loop and display the scanned keys summery on SIGINT (Ctrl-C) signal. It will also prepend the current scanned percentage to the scanned keys summery 1st line. In this commit I've renamed and relocated `intrinsicLatencyModeStop` function as I'm using the exact same logic.
| * Fix typos in module comment / documentation (#10740)Binbin2022-05-182-11/+11
| | | | | | minor cleanup in redismodule.h and module.c
| * Add const qualifier to config name parameter in RM_RegisterBoolConfig() (#10733)Ozan Tezcan2022-05-161-1/+1
| | | | | | was present in the C file and missing in the header.
| * Replica fail and retry the PSYNC if the master is unresponsive (#10726)Qu Chen2022-05-161-2/+20
| | | | | | | | | | | | | | We observed from our replication testing that when the master becomes unresponsive, or the replication connection is broken during PSYNC so the replica doesn't get a response from the master, it was not able to recognize that condition as a failure and instead moved into the full-sync code path. This fix makes the replica fail and retry the PSYNC with the master in such scenarios.
| * Make the check for if script is running or not consistent (#10725)Qu Chen2022-05-154-8/+4
| | | | | | | | | | sometimes it is using `scriptIsRunning()` and other times it is using `server.in_script`. We should use the `scriptIsRunning()` method consistently throughout the code base. Removed server.in_script sine it's no longer used / needed.
| * Remove a redundant free in freeClient (#10721)Tian2022-05-141-1/+0
| |
| * re-add SENTINEL SLAVES command, missing in redis 7.0 (#10723)Stephen Sullivan2022-05-132-0/+42
| | | | | | Alias was mistakenly forgotten when the sub commands introduced as json files.
| * Update comments on command args, and a misleading error reply (#10645)Wen Hui2022-05-135-7/+10
| | | | | | | | | | | | | | | | | | | | | | Updated the comments for: info command lmpopCommand and blmpopCommand sinterGenericCommand Fix the missing "key" words in the srandmemberCommand function For LPOS command, when rank is 0, prompt user that rank could be positive number or negative number, and add a test for it
| * Fix race in module fork kill test (#10717)Binbin2022-05-122-16/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of the test is to kill the child while it is running. From the last two lines we can see the child exits before being killed. ``` - Module fork started pid: 56998 * <fork> fork child started - Killing running module fork child: 56998 * <fork> fork child exiting signal-handler (1652267501) Received SIGUSR1 in child, exiting now. ``` In this commit, we pass an argument to `fork.create` indicating how long it should sleep. For the fork kill test, we use a longer time to avoid the child exiting before being killed. Other changes: use wait_for_condition instead of hardcoded `after 250`. Unify the test for failing fork with the one for killing it (save time)
| * Fix possible regression around TLS config changes. Add VOLATILE_CONFIG flag ↵yoav-steinberg2022-05-122-12/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | for volatile configurations. (#10713) This fixes a possible regression in Redis 7.0.0, in which doing CONFIG SET on a TLS config would not reload the configuration in case the new config is the same file as before. A volatile configuration is a configuration value which is a reference to the configuration data and not the configuration data itself. In such a case Redis doesn't know if the config data changed under the hood and can't assume a change happens only when the config value changes. Therefore it needs to be applied even when setting a config value to the same value as it was before.
| * Update security page with supported versions. (#10712)Yossi Gottlieb2022-05-111-2/+2
| |
| * Fix Makefile.dep generation with ICC. (#10708)Yossi Gottlieb2022-05-111-1/+2
| | | | | | | | | | | | | | | | | | Before this commit, all source files including those that are not going to be compiled were used. Some of these files are platform specific and won't even pre-process on another platform. With GCC/Clang, that's not an issue and they'll simply ignore them, but ICC aborts in this case. This commit only attempts to generate Makefile.dep from the actual set of C source files that will be compiled.
| * redis-server command line arguments support take one bulk string with spaces ↵Binbin2022-05-113-5/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for MULTI_ARG configs parsing. And allow options value to use the -- prefix (#10660) ## Take one bulk string with spaces for MULTI_ARG configs parsing Currently redis-server looks for arguments that start with `--`, and anything in between them is considered arguments for the config. like: `src/redis-server --shutdown-on-sigint nosave force now --port 6380` MULTI_ARG configs behave differently for CONFIG command, vs the command line argument for redis-server. i.e. CONFIG command takes one bulk string with spaces in it, while the command line takes an argv array with multiple values. In this PR, in config.c, if `argc > 1` we can take them as is, and if the config is a `MULTI_ARG` and `argc == 1`, we will split it by spaces. So both of these will be the same: ``` redis-server --shutdown-on-sigint nosave force now --shutdown-on-sigterm nosave force redis-server --shutdown-on-sigint nosave "force now" --shutdown-on-sigterm nosave force redis-server --shutdown-on-sigint nosave "force now" --shutdown-on-sigterm "nosave force" ``` ## Allow options value to use the `--` prefix Currently it decides to switch to the next config, as soon as it sees `--`, even if there was not a single value provided yet to the last config, this makes it impossible to define a config value that has `--` prefix in it. For instance, if we want to set the logfile to `--my--log--file`, like `redis-server --logfile --my--log--file --loglevel verbose`, current code will handle that incorrectly. In this PR, now we allow a config value that has `--` prefix in it. **But note that** something like `redis-server --some-config --config-value1 --config-value2 --loglevel debug` would not work, because if you want to pass a value to a config starting with `--`, it can only be a single value. like: `redis-server --some-config "--config-value1 --config-value2" --loglevel debug` An example (using `--` prefix config value): ``` redis-server --logfile --my--log--file --loglevel verbose redis-cli config get logfile loglevel 1) "loglevel" 2) "verbose" 3) "logfile" 4) "--my--log--file" ``` ### Potentially breaking change `redis-server --save --loglevel verbose` used to work the same as `redis-server --save "" --loglevel verbose` now, it'll error!
| * FLUSHDB and FLUSHALL add call forceCommandPropagation / FLUSHALL reset dirty ↵Binbin2022-05-115-14/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | counter to 0 if we enable save (#10691) ## FLUSHALL We used to restore the dirty counter after `rdbSave` zeroed it if we enable save. Otherwise FLUSHALL will not be replicated nor put into the AOF. And then we do increment it again below. Without that extra dirty++, when db was already empty, FLUSHALL will not be replicated nor put into the AOF. We now gonna replace all that dirty counter magic with a call to forceCommandPropagation (REPL and AOF), instead of all the messing around with the dirty counter. Added tests to cover three part (dirty counter, REPL, AOF). One benefit other than cleaner code is that the `rdb_changes_since_last_save` is correct in this case. ## FLUSHDB FLUSHDB was not replicated nor put into the AOF when db was already empty. Unlike DEL on a non-existing key, FLUSHDB always does something, and that's to call the module hook. So basically FLUSHDB is never a NOP, and thus it should always be propagated. Not doing that, could mean that if a module does something in that hook, and wants to avoid issues of that hook being missing on the replica if the db is empty, it'll need to do complicated things. So now FLUSHDB add call forceCommandPropagation, we will always propagate FLUSHDB. Always propagating FLUSHDB seems like a safe approach that shouldn't have any drawbacks (other than looking odd) This was mentioned in #8972 ## Test section: We actually found it while solving a race condition in the BGSAVE test (other.tcl). It was found in extra_ci Daily Arm64 (test-libc-malloc). ``` [exception]: Executing test client: ERR Background save already in progress. ERR Background save already in progress ``` It look like `r flushdb` trigger (schedule) a bgsave right after `waitForBgsave r` and before `r save`. Changing flushdb to flushall, FLUSHALL will do a foreground save and then set the dirty counter to 0.
| * Dediacted member to hold RedisModuleCommand (#10681)guybe72022-05-104-24/+19
| | | | | | | | | | | | | | | | | | | | | | | | Fix #10552 We no longer piggyback getkeys_proc to hold the RedisModuleCommand struct, when exists Others: Use `doesCommandHaveKeys` in `RM_GetCommandKeysWithFlags` and `getKeysSubcommandImpl`. It causes a very minor behavioral change in commands that don't have actual keys, but have a spec with `CMD_KEY_NOT_KEY`. For example, before this command `COMMAND GETKEYS SPUBLISH` would return `Invalid arguments specified for command` but not it returns `The command has no key arguments`
| * Replace float zero comparison to FP_ZERO comparison (#10675)Mariya Markova2022-05-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | I suggest to use "[fpclassify](https://en.cppreference.com/w/cpp/numeric/math/fpclassify)" for float comparison with zero, because of expression "value == 0" with value very close to zero can be considered as true with some performance compiler optimizations. Note: this code was introduced by 9d520a7f to accept zset scores that get ERANGE in conversion due to precision loss near 0. But with Intel compilers, ICC and ICX, where optimizations for 0 check are more aggressive, "==0" is true for mentioned functions, however should not be. Behavior is seen starting from O2. This leads to a failure in the ZSCAN test in scan.tcl
| * CLUSTER SHARDS should returns slots as integers, not strings (#10683)Binbin2022-05-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It used to returns slots as strings, like: ``` redis> cluster shards 1) 1) "slots" 2) 1) "10923" 2) "16383" ``` CLUSTER SHARDS docs and the top comment of #10293 says that it returns integers. Note other commands like CLUSTER SLOTS, it returns slots as integers. Use addReplyLongLong instead of addReplyBulkLongLong, now it returns slots as integers: ``` redis> cluster shards 1) 1) "slots" 2) 1) (integer) 10923 2) (integer) 16383 ``` This is a small breaking change, introduced in 7.0.0 (7.0 RC3, #10293) Fixes #10680
| * Fix #10705, avoid relinking the same library twice. (#10706)Meir Shpilraien (Spielrein)2022-05-102-0/+18
| | | | | | | | | | | | | | Set `old_li` to NULL to avoid linking it again on error. Before the fix, loading an already existing library will cause the existing library to be added again. This cause not harm other then wrong statistics. The statistics that are effected by the issue are: * `libraries_count` and `functions_count` returned by `function stats` command * `used_memory_functions` returned on `info memory` command * `functions.caches` returned on `memory stats` command
| * Fix cursor type in RedisModuleScanCursor (#10698)Ozan Tezcan2022-05-091-1/+1
| | | | | | | | Changed cursor's type from `int` to `unsigned long` allows handling database or key with more than 2^31 elements
| * fix some typos in "t_zset.c" (#10670)Lu JJ2022-05-091-4/+4
| | | | | | | | | | fix some typo in "t_zset.c". 1. `zzlisinlexrange` the function name mentioned in the comment is misspelled. 2. fix typo in function name`zarndmemberReplyWithListpack` -> `zrandmemberReplyWithListpack`
| * Fix --save command line regression in redis 7.0.0 (#10690)Oran Agra2022-05-094-10/+36
| | | | | | | | | | | | | | Unintentional change in #9644 (since RC1) meant that an empty `--save ""` config from command line, wouldn't have clear any setting from the config file Added tests to cover that, and improved test infra to take additional command line args for redis-server
| * Bug fixes for enum configs with overlapping bit flags (module API) (#10661)Oran Agra2022-05-094-16/+38
| | | | | | | | | | | | | | If we want to support bits that can be overlapping, we need to make sure that: 1. we don't use the same bit for two return values. 2. values should be sorted so that prefer ones (matching more bits) come first.
| * Fix RM_Scan() documentation (#10693)Ozan Tezcan2022-05-091-4/+4
| | | | | | Fixed RM_Scan() usage example: `RedisModuleCursor` -> `RedisModuleScanCursor`
| * zmalloc_get_rss implementation for haiku. (#10687)David CARLIER2022-05-082-0/+19
| | | | | | | | | | also fixing already defined constants build warning while at it. Co-authored-by: Oran Agra <oran@redislabs.com>
| * update redismodule notify defines to be in sync with server (#10688)Shaya Potter2022-05-081-1/+2
| | | | | | | | this seems to have been an oversight. syncing the flags so that NOTIFY_NEW is available to modules. missing in #10512
| * Bump github/codeql-action from 1 to 2 (#10635)dependabot[bot]2022-05-041-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Bump github/codeql-action from 1 to 2 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 1 to 2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v1...v2) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Avoid CodeQL on push error. Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
| * Module API doc script: Mark unreleased API functions (#10674)Viktor Söderqvist2022-05-031-4/+3
| | | | | | | | | | | | | | * Module API doc script: Mark unreleased API functions * fix broken quotes in generate-module-api-doc.rb Co-authored-by: Oran Agra <oran@redislabs.com>
| * Expose Lua error in case of string error. (#10677)Meir Shpilraien (Spielrein)2022-05-031-2/+5
| | | | | | | | | | | | | | | | | | | | | | In general, our error handler make sure the error object is always a table. In some rare cases (such as OOM error), the error handler will not be called and the error object will be a string. The PR expose the error even if its a string and not a table. Currently there is no way to test it but if it'll ever happen, it is better to propagate this string upwards than just generate a generic error without any specific info.
| * fast path when SDIFF command has the same key as the first key (#10663)Lu JJ2022-05-022-1/+14
| | | | | | | | | | | | | | When user uses the same input key for SDIFF as the first one, the result must be empty, so we don't need to process the elements to test. This method is like the one done in zset‘s `zsetChooseDiffAlgorithm` Co-authored-by: Oran Agra <oran@redislabs.com>
| * cleanup: use ZIPLIST_ENTRY_END macro instead of 1 (#3672)wutao_water2022-05-021-1/+1
| | | | | | update macros ZIPLIST_ENTRY_END i think the right definition is ((zl)+intrev32ifbe(ZIPLIST_BYTES(zl))-ZIPLIST_END_SIZE)
| * support tcp-keepalive config interval on macOs (#10667)David CARLIER2022-05-021-0/+7
| | | | | | | | | | Till now, on MacOS we only used to enable SO_KEEPALIVE, but we didn't set the interval which is configurable via the `tcp-keepalive` config. This adds support for that on MacOS, to match what we already do on Linux.
| * fix typo in 'setTypeRandomElement' (#10662)Lu JJ2022-05-011-1/+1
| | | | | | | | `the redis object pointer was populated.` -> `the sds pointer was populated.` We don't populate the redis object pointer in this function.
| * add comment to 'container' in 'quicklist.h' (#10656)Lu JJ2022-04-281-1/+1
| | | | | | | | | | | | | | add a comment to `container` in `quicklist.h`. Because `PLAIN` and `PACKED` are not as easy to understand as `NONE` and `LISTPACK` and we don't have a detailed comment on it. Co-authored-by: Oran Agra <oran@redislabs.com>
| * Injects Hugo FrontMatter to module-api.md (#10658)Itamar Haber2022-04-281-1/+10
| |
| * Update the comments of commands introduced or updated in redis 7.0 (#10659)Wen Hui2022-04-284-6/+9
| |
* | Merge pull request #10652 from oranagra/redis-7.0.07.0.0Oran Agra2022-04-27124-1376/+3062
|\ \ | | | | | | Redis 7.0.0
| * | Redis 7.0.0 GAOran Agra2022-04-272-14/+104
| | |
| * | Merge remote-tracking branch 'origin/unstable' into 7.0Oran Agra2022-04-27122-1362/+2958
| |\ \ |/ / / | | _
| * Merge pull request #10651 from oranagra/meir_lua_readonly_tablesOran Agra2022-04-2712-240/+449
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # Lua readonly tables The PR adds support for readonly tables on Lua to prevent security vulnerabilities: * (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. This issue affects all versions of Redis. * (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The PR is spitted into 4 commits. ### Change Lua to support readonly tables This PR modifies the Lua interpreter code to support a new flag on tables. The new flag indicating that the table is readonly and any attempt to perform any writes on such a table will result in an error. The new feature can be turned off and on using the new `lua_enablereadonlytable` Lua API. The new API can be used **only** from C code. Changes to support this feature was taken from https://luau-lang.org/ ### Change eval script to set user code on Lua registry Today, Redis wrap the user Lua code with a Lua function. For example, assuming the user code is: ``` return redis.call('ping') ``` The actual code that would have sent to the Lua interpreter was: ``` f_b3a02c833904802db9c34a3cf1292eee3246df3c() return redis.call('ping') end ``` The warped code would have been saved on the global dictionary with the following name: `f_<script sha>` (in our example `f_b3a02c833904802db9c34a3cf1292eee3246df3c`). This approach allows one user to easily override the implementation of another user code, example: ``` f_b3a02c833904802db9c34a3cf1292eee3246df3c = function() return 'hacked' end ``` Running the above code will cause `evalsha b3a02c833904802db9c34a3cf1292eee3246df3c 0` to return `hacked` although it should have returned `pong`. Another disadvantage is that Redis basically runs code on the loading (compiling) phase without been aware of it. User can do code injection like this: ``` return 1 end <run code on compling phase> function() return 1 ``` The warped code will look like this and the entire `<run code on compiling phase>` block will run outside of eval or evalsha context: ``` f_<sha>() return 1 end <run code on compling phase> function() return 1 end ``` The commits puts the user code on a special Lua table called the registry. This table is not accessible to the user so it can not be manipulated by him. Also there is no longer a need to warp the user code so there is no risk in code injection which will cause running code in the wrong context. ### Use `lua_enablereadonlytable` to protect global tables on eval and function The commit uses the new `lua_enablereadonlytable` Lua API to protect the global tables of both evals scripts and functions. For eval scripts, the implementation is easy, We simply call `lua_enablereadonlytable` on the global table to turn it into a readonly table. On functions its more complected, we want to be able to switch globals between load run and function run. To achieve this, we create a new empty table that acts as the globals table for function, we control the actual globals using metatable manipulations. Notice that even if the user gets a pointer to the original tables, all the tables are set to be readonly (using `lua_enablereadonlytable` Lua API) so he can not change them. The following better explains the solution: ``` Global table {} <- global table metatable {.__index = __real_globals__} ``` The `__real_globals__` is depends on the run context (function load or function call). Why is this solution needed and its not enough to simply switch globals? When we run in the context of function load and create our functions, our function gets the current globals that was set when they were created. Replacing the globals after the creation will not effect them. This is why this trick it mandatory. ### Protect the rest of the global API and add an allowed list to the provided API The allowed list is done by setting a metatable on the global table before initialising any library. The metatable set the `__newindex` field to a function that check the allowed list before adding the field to the table. Fields which is not on the allowed list are simply ignored. After initialisation phase is done we protect the global table and each table that might be reachable from the global table. For each table we also protect the table metatable if exists. ### Performance Performance tests was done on a private computer and its only purpose is to show that this fix is not causing any performance regression. case 1: `return redis.call('ping')` case 2: `for i=1,10000000 do redis.call('ping') end` | | Unstable eval | Unstable function | lua_readonly_tables eval | lua_readonly_tables function | |-----------------------------|---------------|-------------------|--------------------------|------------------------------| | case1 ops/sec | 235904.70 | 236406.62 | 232180.16 | 230574.14 | | case1 avg latency ms | 0.175 | 0.164 | 0.178 | 0.149 | | case2 total time in seconds | 3.373 | 3.444s | 3.268 | 3.278 | ### Breaking changes * `print` function was removed from Lua because it can potentially cause the Redis processes to get stuck (if no one reads from stdout). Users should use redis.log. An alternative is to override the `print` implementation and print the message to the log file. All the work by @MeirShpilraien, i'm just publishing it.
| | * Protect any table which is reachable from globals and added globals white list.meir2022-04-277-37/+270
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The white list is done by setting a metatable on the global table before initializing any library. The metatable set the `__newindex` field to a function that check the white list before adding the field to the table. Fields which is not on the white list are simply ignored. After initialization phase is done we protect the global table and each table that might be reachable from the global table. For each table we also protect the table metatable if exists.
| | * Protect globals of both evals scripts and functions.meir2022-04-276-193/+165
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use the new `lua_enablereadonlytable` Lua API to protect the global tables of both evals scripts and functions. For eval scripts, the implemetation is easy, We simply call `lua_enablereadonlytable` on the global table to turn it into a readonly table. On functions its more complecated, we want to be able to switch globals between load run and function run. To achieve this, we create a new empty table that acts as the globals table for function, we control the actual globals using metatable manipulation. Notice that even if the user gets a pointer to the original tables, all the tables are set to be readonly (using `lua_enablereadonlytable` Lua API) so he can not change them. The following inlustration better explain the solution: ``` Global table {} <- global table metatable {.__index = __real_globals__} ``` The `__real_globals__` is set depends on the run context (function load or function call). Why this solution is needed and its not enough to simply switch globals? When we run in the context of function load and create our functions, our function gets the current globals that was set when they were created. Replacing the globals after the creation will not effect them. This is why this trick it mandatory.
| | * Move user eval function to be located on Lua registry.meir2022-04-273-25/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Today, Redis wrap the user Lua code with a Lua function. For example, assuming the user code is: ``` return redis.call('ping') ``` The actual code that would have sent to the Lua interpreter was: ``` f_b3a02c833904802db9c34a3cf1292eee3246df3c() return redis.call('ping') end ``` The wraped code would have been saved on the global dictionary with the following name: `f_<script sha>` (in our example `f_b3a02c833904802db9c34a3cf1292eee3246df3c`). This approach allows one user to easily override the implementation a another user code, example: ``` f_b3a02c833904802db9c34a3cf1292eee3246df3c = function() return 'hacked' end ``` Running the above code will cause `evalsha b3a02c833904802db9c34a3cf1292eee3246df3c 0` to return hacked although it should have returned `pong`. Another disadventage is that Redis basically runs code on the loading (compiling) phase without been aware of it. User can do code injection like this: ``` return 1 end <run code on compling phase> function() return 1 ``` The wraped code will look like this and the entire `<run code on compling phase>` block will run outside of eval or evalsha context: ``` f_<sha>() return 1 end <run code on compling phase> function() return 1 end ```
| | * Added support for Lua readonly tables.meir2022-04-276-2/+21
| | | | | | | | | | | | The new feature can be turned off and on using the new `lua_enablereadonlytable` Lua API.
| * | Delete renamed new incr when write manifest failed (#10649)chenyang80942022-04-271-5/+10
| |/ | | | | Followup fix for #10616
| * Add module API flag for using enum configs as bit flags (#10643)Oran Agra2022-04-265-7/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables registration of an enum config that'll let the user pass multiple keywords that will be combined with `|` as flags into the integer config value. ``` const char *enum_vals[] = {"none", "one", "two", "three"}; const int int_vals[] = {0, 1, 2, 4}; if (RedisModule_RegisterEnumConfig(ctx, "flags", 3, REDISMODULE_CONFIG_DEFAULT | REDISMODULE_CONFIG_BITFLAGS, enum_vals, int_vals, 4, getFlagsConfigCommand, setFlagsConfigCommand, NULL, NULL) == REDISMODULE_ERR) { return REDISMODULE_ERR; } ``` doing: `config set moduleconfigs.flags "two three"` will result in 6 being passed to`setFlagsConfigCommand`.
| * Fix bug when AOF enabled after startup. put the new incr file in the ↵chenyang80942022-04-264-32/+270
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | manifest only when AOFRW is done. (#10616) Changes: - When AOF is enabled **after** startup, the data accumulated during `AOF_WAIT_REWRITE` will only be stored in a temp INCR AOF file. Only after the first AOFRW is successful, we will add it to manifest file. Before this fix, the manifest referred to the temp file which could cause a restart during that time to load it without it's base. - Add `aof_rewrites_consecutive_failures` info field for aofrw limiting implementation. Now we can guarantee that these behaviors of MP-AOF are the same as before (past redis releases): - When AOF is enabled after startup, the data accumulated during `AOF_WAIT_REWRITE` will only be stored in a visible place. Only after the first AOFRW is successful, we will add it to manifest file. - When disable AOF, we did not delete the AOF file in the past so there's no need to change that behavior now (yet). - When toggling AOF off and then on (could be as part of a full-sync), a crash or restart before the first rewrite is completed, would result with the previous version being loaded (might not be right thing, but that's what we always had).
| * Allow configuring signaled shutdown flags (#10594)Eduardo Semprebon2022-04-267-34/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SHUTDOWN command has various flags to change it's default behavior, but in some cases establishing a connection to redis is complicated and it's easier for the management software to use signals. however, so far the signals could only trigger the default shutdown behavior. Here we introduce the option to control shutdown arguments for SIGTERM and SIGINT. New config options: `shutdown-on-sigint [nosave | save] [now] [force]` `shutdown-on-sigterm [nosave | save] [now] [force]` Implementation: Support MULTI_ARG_CONFIG on createEnumConfig to support multiple enums to be applied as bit flags. Co-authored-by: Oran Agra <oran@redislabs.com>