Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
61dffd86
Commit
61dffd86
authored
Jan 28, 2020
by
antirez
Browse files
ACL LOG: actually emit entries.
parent
e8d00577
Changes
3
Hide whitespace changes
Inline
Side-by-side
src/acl.c
View file @
61dffd86
...
@@ -1467,7 +1467,7 @@ void ACLLoadUsersAtStartup(void) {
...
@@ -1467,7 +1467,7 @@ void ACLLoadUsersAtStartup(void) {
#define ACL_LOG_CTX_MULTI 2
#define ACL_LOG_CTX_MULTI 2
/* This structure defines an entry inside the ACL log. */
/* This structure defines an entry inside the ACL log. */
typedef
struct
acl
LogEntry
{
typedef
struct
ACL
LogEntry
{
uint64_t
count
;
/* Number of times this happened recently. */
uint64_t
count
;
/* Number of times this happened recently. */
int
reason
;
/* Reason for denying the command. ACL_DENIED_*. */
int
reason
;
/* Reason for denying the command. ACL_DENIED_*. */
int
context
;
/* Toplevel, Lua or MULTI/EXEC? ACL_LOG_CTX_*. */
int
context
;
/* Toplevel, Lua or MULTI/EXEC? ACL_LOG_CTX_*. */
...
@@ -1475,7 +1475,7 @@ typedef struct aclLogEntry {
...
@@ -1475,7 +1475,7 @@ typedef struct aclLogEntry {
sds
username
;
/* User the client is authenticated with. */
sds
username
;
/* User the client is authenticated with. */
mstime_t
ctime
;
/* Milliseconds time of last update to this entry. */
mstime_t
ctime
;
/* Milliseconds time of last update to this entry. */
sds
cinfo
;
/* Client info (last client if updated). */
sds
cinfo
;
/* Client info (last client if updated). */
}
acl
LogEntry
;
}
ACL
LogEntry
;
/* Adds a new entry in the ACL log, making sure to delete the old entry
/* Adds a new entry in the ACL log, making sure to delete the old entry
* if we reach the maximum length allowed for the log. This function attempts
* if we reach the maximum length allowed for the log. This function attempts
...
@@ -1484,8 +1484,9 @@ typedef struct aclLogEntry {
...
@@ -1484,8 +1484,9 @@ typedef struct aclLogEntry {
* rules issues. */
* rules issues. */
void
addACLLogEntry
(
client
*
c
,
int
reason
,
int
keypos
)
{
void
addACLLogEntry
(
client
*
c
,
int
reason
,
int
keypos
)
{
/* Create a new entry. */
/* Create a new entry. */
struct
acl
LogEntry
*
le
=
zmalloc
(
sizeof
(
*
le
));
struct
ACL
LogEntry
*
le
=
zmalloc
(
sizeof
(
*
le
));
le
->
count
=
1
;
le
->
count
=
1
;
le
->
reason
=
reason
;
le
->
object
=
(
reason
==
ACL_DENIED_CMD
)
?
sdsnew
(
c
->
cmd
->
name
)
:
le
->
object
=
(
reason
==
ACL_DENIED_CMD
)
?
sdsnew
(
c
->
cmd
->
name
)
:
sdsdup
(
c
->
argv
[
keypos
]
->
ptr
);
sdsdup
(
c
->
argv
[
keypos
]
->
ptr
);
le
->
username
=
sdsdup
(
c
->
user
->
name
);
le
->
username
=
sdsdup
(
c
->
user
->
name
);
...
@@ -1737,8 +1738,33 @@ void aclCommand(client *c) {
...
@@ -1737,8 +1738,33 @@ void aclCommand(client *c) {
listIter
li
;
listIter
li
;
listNode
*
ln
;
listNode
*
ln
;
listRewind
(
ACLLog
,
&
li
);
listRewind
(
ACLLog
,
&
li
);
mstime_t
now
=
mstime
();
while
(
count
--
&&
(
ln
=
listNext
(
&
li
))
!=
NULL
)
{
while
(
count
--
&&
(
ln
=
listNext
(
&
li
))
!=
NULL
)
{
addReplyLongLong
(
c
,
1234
);
ACLLogEntry
*
le
=
listNodeValue
(
ln
);
addReplyMapLen
(
c
,
7
);
addReplyBulkCString
(
c
,
"count"
);
addReplyLongLong
(
c
,
le
->
count
);
addReplyBulkCString
(
c
,
"reason"
);
addReplyBulkCString
(
c
,(
le
->
reason
==
ACL_DENIED_CMD
)
?
"command"
:
"key"
);
char
*
ctxstr
;
switch
(
le
->
context
)
{
case
ACL_LOG_CTX_TOPLEVEL
:
ctxstr
=
"toplevel"
;
break
;
case
ACL_LOG_CTX_MULTI
:
ctxstr
=
"multi"
;
break
;
case
ACL_LOG_CTX_LUA
:
ctxstr
=
"lua"
;
break
;
default:
ctxstr
=
"unknown"
;
}
addReplyBulkCString
(
c
,
"context"
);
addReplyBulkCString
(
c
,
ctxstr
);
addReplyBulkCString
(
c
,
"object"
);
addReplyBulkCBuffer
(
c
,
le
->
object
,
sdslen
(
le
->
object
));
addReplyBulkCString
(
c
,
"username"
);
addReplyBulkCBuffer
(
c
,
le
->
username
,
sdslen
(
le
->
username
));
addReplyBulkCString
(
c
,
"age-seconds"
);
double
age
=
(
double
)(
now
-
le
->
ctime
)
/
1000
;
addReplyDouble
(
c
,
age
);
addReplyBulkCString
(
c
,
"client-info"
);
addReplyBulkCBuffer
(
c
,
le
->
cinfo
,
sdslen
(
le
->
cinfo
));
}
}
}
else
if
(
!
strcasecmp
(
sub
,
"help"
))
{
}
else
if
(
!
strcasecmp
(
sub
,
"help"
))
{
const
char
*
help
[]
=
{
const
char
*
help
[]
=
{
...
...
src/server.c
View file @
61dffd86
...
@@ -3377,8 +3377,10 @@ int processCommand(client *c) {
...
@@ -3377,8 +3377,10 @@ int processCommand(client *c) {
/* Check if the user can run this command according to the current
/* Check if the user can run this command according to the current
* ACLs. */
* ACLs. */
int
acl_retval
=
ACLCheckCommandPerm
(
c
,
NULL
);
int
acl_keypos
;
int
acl_retval
=
ACLCheckCommandPerm
(
c
,
&
acl_keypos
);
if
(
acl_retval
!=
ACL_OK
)
{
if
(
acl_retval
!=
ACL_OK
)
{
addACLLogEntry
(
c
,
acl_retval
,
acl_keypos
);
flagTransaction
(
c
);
flagTransaction
(
c
);
if
(
acl_retval
==
ACL_DENIED_CMD
)
if
(
acl_retval
==
ACL_DENIED_CMD
)
addReplyErrorFormat
(
c
,
addReplyErrorFormat
(
c
,
...
...
src/server.h
View file @
61dffd86
...
@@ -1836,6 +1836,7 @@ void ACLLoadUsersAtStartup(void);
...
@@ -1836,6 +1836,7 @@ void ACLLoadUsersAtStartup(void);
void
addReplyCommandCategories
(
client
*
c
,
struct
redisCommand
*
cmd
);
void
addReplyCommandCategories
(
client
*
c
,
struct
redisCommand
*
cmd
);
user
*
ACLCreateUnlinkedUser
();
user
*
ACLCreateUnlinkedUser
();
void
ACLFreeUserAndKillClients
(
user
*
u
);
void
ACLFreeUserAndKillClients
(
user
*
u
);
void
addACLLogEntry
(
client
*
c
,
int
reason
,
int
keypos
);
/* Sorted sets data type */
/* Sorted sets data type */
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment