Unverified Commit 2968d8e3 authored by Salvatore Sanfilippo's avatar Salvatore Sanfilippo Committed by GitHub
Browse files

Merge branch 'unstable' into ModuleSecurity

parents ff682d79 c6fb9d09
...@@ -166,7 +166,11 @@ start_server {tags {"other"}} { ...@@ -166,7 +166,11 @@ start_server {tags {"other"}} {
tags {protocol} { tags {protocol} {
test {PIPELINING stresser (also a regression for the old epoll bug)} { test {PIPELINING stresser (also a regression for the old epoll bug)} {
if {$::tls} {
set fd2 [::tls::socket $::host $::port]
} else {
set fd2 [socket $::host $::port] set fd2 [socket $::host $::port]
}
fconfigure $fd2 -encoding binary -translation binary fconfigure $fd2 -encoding binary -translation binary
puts -nonewline $fd2 "SELECT 9\r\n" puts -nonewline $fd2 "SELECT 9\r\n"
flush $fd2 flush $fd2
......
...@@ -72,7 +72,11 @@ start_server {tags {"protocol"}} { ...@@ -72,7 +72,11 @@ start_server {tags {"protocol"}} {
foreach seq [list "\x00" "*\x00" "$\x00"] { foreach seq [list "\x00" "*\x00" "$\x00"] {
incr c incr c
test "Protocol desync regression test #$c" { test "Protocol desync regression test #$c" {
if {$::tls} {
set s [::tls::socket [srv 0 host] [srv 0 port]]
} else {
set s [socket [srv 0 host] [srv 0 port]] set s [socket [srv 0 host] [srv 0 port]]
}
puts -nonewline $s $seq puts -nonewline $s $seq
set payload [string repeat A 1024]"\n" set payload [string repeat A 1024]"\n"
set test_start [clock seconds] set test_start [clock seconds]
......
...@@ -536,7 +536,7 @@ foreach cmdrepl {0 1} { ...@@ -536,7 +536,7 @@ foreach cmdrepl {0 1} {
start_server {tags {"scripting repl"}} { start_server {tags {"scripting repl"}} {
start_server {} { start_server {} {
if {$cmdrepl == 1} { if {$cmdrepl == 1} {
set rt "(commmands replication)" set rt "(commands replication)"
} else { } else {
set rt "(scripts replication)" set rt "(scripts replication)"
r debug lua-always-replicate-commands 1 r debug lua-always-replicate-commands 1
......
start_server {tags {"tls"}} {
if {$::tls} {
package require tls
test {TLS: Not accepting non-TLS connections on a TLS port} {
set s [redis [srv 0 host] [srv 0 port]]
catch {$s PING} e
set e
} {*I/O error*}
test {TLS: Verify tls-auth-clients behaves as expected} {
set s [redis [srv 0 host] [srv 0 port]]
::tls::import [$s channel]
catch {$s PING} e
assert_match {*error*} $e
r CONFIG SET tls-auth-clients no
set s [redis [srv 0 host] [srv 0 port]]
::tls::import [$s channel]
catch {$s PING} e
assert_match {PONG} $e
r CONFIG SET tls-auth-clients yes
}
test {TLS: Verify tls-protocols behaves as expected} {
r CONFIG SET tls-protocols TLSv1
set s [redis [srv 0 host] [srv 0 port] 0 1 {-tls1 0}]
catch {$s PING} e
assert_match {*I/O error*} $e
set s [redis [srv 0 host] [srv 0 port] 0 1 {-tls1 1}]
catch {$s PING} e
assert_match {PONG} $e
r CONFIG SET tls-protocols TLSv1.1
set s [redis [srv 0 host] [srv 0 port] 0 1 {-tls1.1 0}]
catch {$s PING} e
assert_match {*I/O error*} $e
set s [redis [srv 0 host] [srv 0 port] 0 1 {-tls1.1 1}]
catch {$s PING} e
assert_match {PONG} $e
r CONFIG SET tls-protocols TLSv1.2
set s [redis [srv 0 host] [srv 0 port] 0 1 {-tls1.2 0}]
catch {$s PING} e
assert_match {*I/O error*} $e
set s [redis [srv 0 host] [srv 0 port] 0 1 {-tls1.2 1}]
catch {$s PING} e
assert_match {PONG} $e
r CONFIG SET tls-protocols ""
}
test {TLS: Verify tls-ciphers behaves as expected} {
r CONFIG SET tls-protocols TLSv1.2
r CONFIG SET tls-ciphers "DEFAULT:-AES128-SHA256"
set s [redis [srv 0 host] [srv 0 port] 0 1 {-cipher "-ALL:AES128-SHA256"}]
catch {$s PING} e
assert_match {*I/O error*} $e
set s [redis [srv 0 host] [srv 0 port] 0 1 {-cipher "-ALL:AES256-SHA256"}]
catch {$s PING} e
assert_match {PONG} $e
r CONFIG SET tls-ciphers "DEFAULT"
set s [redis [srv 0 host] [srv 0 port] 0 1 {-cipher "-ALL:AES128-SHA256"}]
catch {$s PING} e
assert_match {PONG} $e
r CONFIG SET tls-protocols ""
r CONFIG SET tls-ciphers "DEFAULT"
}
test {TLS: Verify tls-prefer-server-ciphers behaves as expected} {
r CONFIG SET tls-protocols TLSv1.2
r CONFIG SET tls-ciphers "AES128-SHA256:AES256-SHA256"
set s [redis [srv 0 host] [srv 0 port] 0 1 {-cipher "AES256-SHA256:AES128-SHA256"}]
catch {$s PING} e
assert_match {PONG} $e
assert_equal "AES256-SHA256" [dict get [::tls::status [$s channel]] cipher]
r CONFIG SET tls-prefer-server-ciphers yes
set s [redis [srv 0 host] [srv 0 port] 0 1 {-cipher "AES256-SHA256:AES128-SHA256"}]
catch {$s PING} e
assert_match {PONG} $e
assert_equal "AES128-SHA256" [dict get [::tls::status [$s channel]] cipher]
r CONFIG SET tls-protocols ""
r CONFIG SET tls-ciphers "DEFAULT"
}
}
}
...@@ -79,6 +79,12 @@ start_server { ...@@ -79,6 +79,12 @@ start_server {
assert {[streamCompareID $id2 $id3] == -1} assert {[streamCompareID $id2 $id3] == -1}
} }
test {XADD IDs correctly report an error when overflowing} {
r DEL mystream
r xadd mystream 18446744073709551615-18446744073709551615 a b
assert_error ERR* {r xadd mystream * c d}
}
test {XADD with MAXLEN option} { test {XADD with MAXLEN option} {
r DEL mystream r DEL mystream
for {set j 0} {$j < 1000} {incr j} { for {set j 0} {$j < 1000} {incr j} {
...@@ -117,6 +123,12 @@ start_server { ...@@ -117,6 +123,12 @@ start_server {
assert {[r xlen mystream] == $j} assert {[r xlen mystream] == $j}
} }
test {XADD with ID 0-0} {
r DEL otherstream
catch {r XADD otherstream 0-0 k v} err
assert {[r EXISTS otherstream] == 0}
}
test {XRANGE COUNT works as expected} { test {XRANGE COUNT works as expected} {
assert {[llength [r xrange mystream - + COUNT 10]] == 10} assert {[llength [r xrange mystream - + COUNT 10]] == 10}
} }
...@@ -355,12 +367,12 @@ start_server {tags {"stream"} overrides {appendonly yes stream-node-max-entries ...@@ -355,12 +367,12 @@ start_server {tags {"stream"} overrides {appendonly yes stream-node-max-entries
r XADD mystream * xitem v r XADD mystream * xitem v
} }
r XTRIM mystream MAXLEN ~ 85 r XTRIM mystream MAXLEN ~ 85
assert {[r xlen mystream] == 89} assert {[r xlen mystream] == 90}
r config set stream-node-max-entries 1 r config set stream-node-max-entries 1
r debug loadaof r debug loadaof
r XADD mystream * xitem v r XADD mystream * xitem v
incr j incr j
assert {[r xlen mystream] == 90} assert {[r xlen mystream] == 91}
} }
} }
......
source tests/support/cli.tcl
start_server {tags {"wait"}} { start_server {tags {"wait"}} {
start_server {} { start_server {} {
set slave [srv 0 client] set slave [srv 0 client]
...@@ -31,7 +33,8 @@ start_server {} { ...@@ -31,7 +33,8 @@ start_server {} {
} }
test {WAIT should not acknowledge 1 additional copy if slave is blocked} { test {WAIT should not acknowledge 1 additional copy if slave is blocked} {
exec src/redis-cli -h $slave_host -p $slave_port debug sleep 5 > /dev/null 2> /dev/null & set cmd [rediscli $slave_port "-h $slave_host debug sleep 5"]
exec {*}$cmd > /dev/null 2> /dev/null &
after 1000 ;# Give redis-cli the time to execute the command. after 1000 ;# Give redis-cli the time to execute the command.
$master set foo 0 $master set foo 0
$master incr foo $master incr foo
......
...@@ -16,7 +16,7 @@ To create a cluster, follow these steps: ...@@ -16,7 +16,7 @@ To create a cluster, follow these steps:
number of instances you want to create. number of instances you want to create.
2. Use "./create-cluster start" in order to run the instances. 2. Use "./create-cluster start" in order to run the instances.
3. Use "./create-cluster create" in order to execute redis-cli --cluster create, so that 3. Use "./create-cluster create" in order to execute redis-cli --cluster create, so that
an actual Redis cluster will be created. an actual Redis cluster will be created. (If you're accessing your setup via a local container, ensure that the CLUSTER_HOST value is changed to your local IP)
4. Now you are ready to play with the cluster. AOF files and logs for each instances are created in the current directory. 4. Now you are ready to play with the cluster. AOF files and logs for each instances are created in the current directory.
In order to stop a cluster: In order to stop a cluster:
......
#!/bin/bash #!/bin/bash
# Settings # Settings
CLUSTER_HOST=127.0.0.1
PORT=30000 PORT=30000
TIMEOUT=2000 TIMEOUT=2000
NODES=6 NODES=6
REPLICAS=1 REPLICAS=1
PROTECTED_MODE=yes
ADDITIONAL_OPTIONS=""
# You may want to put the above config parameters into config.sh in order to # You may want to put the above config parameters into config.sh in order to
# override the defaults without modifying this script. # override the defaults without modifying this script.
...@@ -22,7 +25,7 @@ then ...@@ -22,7 +25,7 @@ then
while [ $((PORT < ENDPORT)) != "0" ]; do while [ $((PORT < ENDPORT)) != "0" ]; do
PORT=$((PORT+1)) PORT=$((PORT+1))
echo "Starting $PORT" echo "Starting $PORT"
../../src/redis-server --port $PORT --cluster-enabled yes --cluster-config-file nodes-${PORT}.conf --cluster-node-timeout $TIMEOUT --appendonly yes --appendfilename appendonly-${PORT}.aof --dbfilename dump-${PORT}.rdb --logfile ${PORT}.log --daemonize yes ../../src/redis-server --port $PORT --protected-mode $PROTECTED_MODE --cluster-enabled yes --cluster-config-file nodes-${PORT}.conf --cluster-node-timeout $TIMEOUT --appendonly yes --appendfilename appendonly-${PORT}.aof --dbfilename dump-${PORT}.rdb --logfile ${PORT}.log --daemonize yes ${ADDITIONAL_OPTIONS}
done done
exit 0 exit 0
fi fi
...@@ -32,7 +35,7 @@ then ...@@ -32,7 +35,7 @@ then
HOSTS="" HOSTS=""
while [ $((PORT < ENDPORT)) != "0" ]; do while [ $((PORT < ENDPORT)) != "0" ]; do
PORT=$((PORT+1)) PORT=$((PORT+1))
HOSTS="$HOSTS 127.0.0.1:$PORT" HOSTS="$HOSTS $CLUSTER_HOST:$PORT"
done done
../../src/redis-cli --cluster create $HOSTS --cluster-replicas $REPLICAS ../../src/redis-cli --cluster create $HOSTS --cluster-replicas $REPLICAS
exit 0 exit 0
...@@ -68,6 +71,12 @@ then ...@@ -68,6 +71,12 @@ then
exit 0 exit 0
fi fi
if [ "$1" == "tailall" ]
then
tail -f *.log
exit 0
fi
if [ "$1" == "call" ] if [ "$1" == "call" ]
then then
while [ $((PORT < ENDPORT)) != "0" ]; do while [ $((PORT < ENDPORT)) != "0" ]; do
...@@ -98,5 +107,6 @@ echo "create -- Create a cluster using redis-cli --cluster create." ...@@ -98,5 +107,6 @@ echo "create -- Create a cluster using redis-cli --cluster create."
echo "stop -- Stop Redis Cluster instances." echo "stop -- Stop Redis Cluster instances."
echo "watch -- Show CLUSTER NODES output (first 30 lines) of first node." echo "watch -- Show CLUSTER NODES output (first 30 lines) of first node."
echo "tail <id> -- Run tail -f of instance at base port + ID." echo "tail <id> -- Run tail -f of instance at base port + ID."
echo "tailall -- Run tail -f for all the log files at once."
echo "clean -- Remove all instances data, logs, configs." echo "clean -- Remove all instances data, logs, configs."
echo "clean-logs -- Remove just instances logs." echo "clean-logs -- Remove just instances logs."
#!/bin/bash
mkdir -p tests/tls
openssl genrsa -out tests/tls/ca.key 4096
openssl req \
-x509 -new -nodes -sha256 \
-key tests/tls/ca.key \
-days 3650 \
-subj '/O=Redis Test/CN=Certificate Authority' \
-out tests/tls/ca.crt
openssl genrsa -out tests/tls/redis.key 2048
openssl req \
-new -sha256 \
-key tests/tls/redis.key \
-subj '/O=Redis Test/CN=Server' | \
openssl x509 \
-req -sha256 \
-CA tests/tls/ca.crt \
-CAkey tests/tls/ca.key \
-CAserial tests/tls/ca.txt \
-CAcreateserial \
-days 365 \
-out tests/tls/redis.crt
openssl dhparam -out tests/tls/redis.dh 2048
/* This is a small program used in order to understand the collison rate
* of CRC64 (ISO version) VS other stronger hashing functions in the context
* of hashing keys for the Redis "tracking" feature (client side caching
* assisted by the server).
*
* The program attempts to hash keys with common names in the form of
*
* prefix:<counter>
*
* And counts the resulting collisons generated in the 24 bits of output
* needed for the tracking feature invalidation table (16 millions + entries)
*
* Compile with:
*
* cc -O2 ./tracking_collisions.c ../src/crc64.c ../src/sha1.c
* ./a.out
*
* --------------------------------------------------------------------------
*
* Copyright (C) 2019 Salvatore Sanfilippo
* This code is released under the BSD 2 clause license.
*/
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <stdio.h>
#include "../src/crc64.h"
#include "../src/sha1.h"
#define TABLE_SIZE (1<<24)
int Table[TABLE_SIZE];
uint64_t crc64Hash(char *key, size_t len) {
return crc64(0,(unsigned char*)key,len);
}
uint64_t sha1Hash(char *key, size_t len) {
SHA1_CTX ctx;
unsigned char hash[20];
SHA1Init(&ctx);
SHA1Update(&ctx,(unsigned char*)key,len);
SHA1Final(hash,&ctx);
uint64_t hash64;
memcpy(&hash64,hash,sizeof(hash64));
return hash64;
}
/* Test the hashing function provided as callback and return the
* number of collisions found. */
unsigned long testHashingFunction(uint64_t (*hash)(char *, size_t)) {
unsigned long collisions = 0;
memset(Table,0,sizeof(Table));
char *prefixes[] = {"object", "message", "user", NULL};
for (int i = 0; prefixes[i] != NULL; i++) {
for (int j = 0; j < TABLE_SIZE/2; j++) {
char keyname[128];
size_t keylen = snprintf(keyname,sizeof(keyname),"%s:%d",
prefixes[i],j);
uint64_t bucket = hash(keyname,keylen) % TABLE_SIZE;
if (Table[bucket]) {
collisions++;
} else {
Table[bucket] = 1;
}
}
}
return collisions;
}
int main(void) {
printf("SHA1 : %lu\n", testHashingFunction(sha1Hash));
printf("CRC64: %lu\n", testHashingFunction(crc64Hash));
return 0;
}
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment