1. 18 Oct, 2023 1 commit
    • Oran Agra's avatar
      Fix issue of listen before chmod on Unix sockets (CVE-2023-45145) (#12671) · 03345ddc
      Oran Agra authored
      Before this commit, Unix socket setup performed chmod(2) on the socket
      file after calling listen(2). Depending on what umask is used, this
      could leave the file with the wrong permissions for a short period of
      time. As a result, another process could exploit this race condition and
      establish a connection that would otherwise not be possible.
      
      We now make sure the socket permissions are set up prior to calling
      listen(2).
      
      (cherry picked from commit 1119ecae
      
      )
      Co-authored-by: default avatarYossi Gottlieb <yossigo@gmail.com>
      03345ddc
  2. 17 Apr, 2023 1 commit
    • Joe Hu's avatar
      Fix RDB check regression caused by PR 12022 (#12051) · 644d9455
      Joe Hu authored
      The nightly tests showed that the recent PR #12022 caused random failures
      in aof.tcl on checking RDB preamble inside an AOF file.
      
      Root cause:
      When checking RDB preamble in an AOF file, what's passed into redis_check_rdb is
      aof_filename, not aof_filepath. The newly introduced isFifo function does not check return
      status of the stat call and hence uses the uninitailized stat_p object.
      
      Fix:
      1. Fix isFifo by checking stat call's return code.
      2. Pass aof_filepath instead of aof_filename to redis_check_rdb.
      3. move the FIFO check to rdb.c since the limitation is the re-opening of the file, and not
        anything specific about redis-check-rdb.
      644d9455
  3. 22 Aug, 2022 2 commits
    • zhenwei pi's avatar
      Introduce connAddr · bff7ecc7
      zhenwei pi authored
      
      
      Originally, connPeerToString is designed to get the address info from
      socket only(for both TCP & TLS), and the API 'connPeerToString' is
      oriented to operate a FD like:
      int connPeerToString(connection *conn, char *ip, size_t ip_len, int *port) {
          return anetFdToString(conn ? conn->fd : -1, ip, ip_len, port, FD_TO_PEER_NAME);
      }
      
      Introduce connAddr and implement .addr method for socket and TLS,
      thus the API 'connAddr' and 'connFormatAddr' become oriented to a
      connection like:
      static inline int connAddr(connection *conn, char *ip, size_t ip_len, int *port, int remote) {
          if (conn && conn->type->addr) {
              return conn->type->addr(conn, ip, ip_len, port, remote);
          }
      
          return -1;
      }
      
      Also remove 'FD_TO_PEER_NAME' & 'FD_TO_SOCK_NAME', use a boolean type
      'remote' to get local/remote address of a connection.
      
      With these changes, it's possible to support the other connection
      types which does not use socket(Ex, RDMA).
      
      Thanks to Oran for suggestions!
      Signed-off-by: default avatarzhenwei pi <pizhenwei@bytedance.com>
      bff7ecc7
    • zhenwei pi's avatar
      Move 'connGetSocketError' to 'anetGetError' · 8045e26e
      zhenwei pi authored
      
      
      getsockopt is part of TCP, rename 'connGetSocketError' to
      'anetGetError', and move it into anet.c.
      Signed-off-by: default avatarzhenwei pi <pizhenwei@bytedance.com>
      8045e26e
  4. 18 Jul, 2022 1 commit
    • ranshid's avatar
      Avoid using unsafe C functions (#10932) · eacca729
      ranshid authored
      replace use of:
      sprintf --> snprintf
      strcpy/strncpy  --> redis_strlcpy
      strcat/strncat  --> redis_strlcat
      
      **why are we making this change?**
      Much of the code uses some unsafe variants or deprecated buffer handling
      functions.
      While most cases are probably not presenting any issue on the known path
      programming errors and unterminated strings might lead to potential
      buffer overflows which are not covered by tests.
      
      **As part of this PR we change**
      1. added implementation for redis_strlcpy and redis_strlcat based on the strl implementation: https://linux.die.net/man/3/strl
      2. change all occurrences of use of sprintf with use of snprintf
      3. change occurrences of use of  strcpy/strncpy with redis_strlcpy
      4. change occurrences of use of strcat/strncat with redis_strlcat
      5. change the behavior of ll2string/ull2string/ld2string so that it will always place null
        termination ('\0') on the output buffer in the first index. this was done in order to make
        the use of these functions more safe in cases were the user will not check the output
        returned by them (for example in rdbRemoveTempFile)
      6. we added a compiler directive to issue a deprecation error in case a use of
        sprintf/strcpy/strcat is found during compilation which will result in error during compile time.
        However keep in mind that since the deprecation attribute is not supported on all compilers,
        this is expected to fail during push workflows.
      
      
      **NOTE:** while this is only an initial milestone. We might also consider
      using the *_s implementation provided by the C11 Extensions (however not
      yet widly supported). I would also suggest to start
      looking at static code analyzers to track unsafe use cases.
      For example LLVM clang checker supports security.insecureAPI.DeprecatedOrUnsafeBufferHandling
      which can help locate unsafe function usage.
      https://clang.llvm.org/docs/analyzer/checkers.html#security-insecureapi-deprecatedorunsafebufferhandling-c
      The main reason not to onboard it at this stage is that the alternative
      excepted by clang is to use the C11 extensions which are not always
      supported by stdlib.
      eacca729
  5. 02 May, 2022 1 commit
  6. 20 Apr, 2022 1 commit
  7. 19 Dec, 2021 1 commit
    • Binbin's avatar
      Fix some nonsense came from LGTM (#9962) · 0fb1aa06
      Binbin authored
      1. Local variable 's' hides a parameter of the same name.
      ```
      int anetTcpAccept(char *err, int s, char *ip, size_t ip_len, int *port) {
          if ((fd = anetGenericAccept(err,s,(struct sockaddr*)&sa,&salen)) == ANET_ERR){}
      }
      ```
      Change the parameter name from `s` to `serversock`,
      also unified with the header file definition.
      
      2. Comparison is always false because i <= 48.
      ```
      for (i = 0; i < DICT_STATS_VECTLEN-1; i++) {  // i < 49
          (i == DICT_STATS_VECTLEN-1)?">= ":"",  // i == 49
      }
      ```
      `i == DICT_STATS_VECTLEN-1` always result false, it is a dead code.
      
      3. Empty block without comment.
      `else if (!strcasecmp(opt,"ch")) {}`, add a comment to avoid warnings.
      
      4. Bit field fill of type int should have explicitly unsigned integral, explicitly signed integral, or enumeration type.
      Modify `int fill: QL_FILL_BITS;` to `unsigned int fill: QL_FILL_BITS;`
      
      5. The result of this call to reconnectingRedisCommand is not checked for null, but 80% of calls to reconnectingRedisCommand check for null.
      Just a cleanup job like others.
      0fb1aa06
  8. 16 Dec, 2021 1 commit
  9. 06 Oct, 2021 1 commit
  10. 05 Jul, 2021 1 commit
    • Oran Agra's avatar
      Use accept4 on linux instead of fcntl to make a client socket non-blocking (#9177) · 5a3de819
      Oran Agra authored
      
      
      This reduces system calls on linux when a new connection is made / accepted.
      
      Changes:
      * Add the SOCK_CLOEXEC option to the accept4() call
        This  ensure that a fork/exec call does not leak a file descriptor.
      * Move anetCloexec and connNonBlock info anetGenericAccept
      * Moving connNonBlock from accept handlers to anetGenericAccept
      
      Moving connNonBlock from createClient, is safe because createClient is
      used in the following ways:
      1. without a connection (fake client)
      2. on an accepted connection (see above)
      3. creating the master client by using connConnect (see below)
      
      The third case, can either use anetTcpNonBlockConnect, or connTLSConnect
      which is by default non-blocking.
      Co-authored-by: default avatarRajiv Kurian <geetasen@gmail.com>
      Co-authored-by: default avatarOran Agra <oran@redislabs.com>
      Co-authored-by: default avatarYoav Steinberg <yoav@redislabs.com>
      5a3de819
  11. 11 May, 2021 1 commit
  12. 21 Apr, 2021 2 commits
  13. 17 Mar, 2021 1 commit
    • Yossi Gottlieb's avatar
      Cleanup: remove dead code from anet. (#8660) · f657315e
      Yossi Gottlieb authored
      In the long term we may want to move away from anet completely and have
      everything implemented natively in connection.c, instead of having an
      extra layer.
      
      For now, just get rid of unused code.
      f657315e
  14. 28 Jan, 2021 1 commit
    • Yossi Gottlieb's avatar
      Add hostname support in Sentinel. (#8282) · bb7cd974
      Yossi Gottlieb authored
      
      
      This is both a bugfix and an enhancement.
      
      Internally, Sentinel relies entirely on IP addresses to identify
      instances. When configured with a new master, it also requires users to
      specify and IP and not hostname.
      
      However, replicas may use the replica-announce-ip configuration to
      announce a hostname. When that happens, Sentinel fails to match the
      announced hostname with the expected IP and considers that a different
      instance, triggering reconfiguration, etc.
      
      Another use case is where TLS is used and clients are expected to match
      the hostname to connect to with the certificate's SAN attribute. To
      properly implement this configuration, it is necessary for Sentinel to
      redirect clients to a hostname rather than an IP address.
      
      The new 'resolve-hostnames' configuration parameter determines if
      Sentinel is willing to accept hostnames. It is set by default to no,
      which maintains backwards compatibility and avoids unexpected DNS
      resolution delays on systems with DNS configuration issues.
      
      Internally, Sentinel continues to identify instances by their resolved
      IP address and will also report the IP by default. The new
      'announce-hostnames' parameter determines if Sentinel should prefer to
      announce a hostname, when available, rather than an IP address. This
      applies to addresses returned to clients, as well as their
      representation in the configuration file, REPLICAOF configuration
      commands, etc.
      
      This commit also introduces SENTINEL CONFIG GET and SENTINEL CONFIG SET
      which can be used to introspect or configure global Sentinel
      configuration that was previously was only possible by directly
      accessing the configuration file and possibly restarting the instance.
      Co-authored-by: default avatarmyl1024 <myl92916@qq.com>
      Co-authored-by: default avatarsundb <sundbcn@gmail.com>
      bb7cd974
  15. 19 Jan, 2021 2 commits
  16. 09 Dec, 2020 1 commit
  17. 28 Oct, 2020 2 commits
    • yoav-steinberg's avatar
      Add local address to CLIENT LIST, and a CLIENT KILL filter. (#7913) · 84b3c18f
      yoav-steinberg authored
      Useful when you want to know through which bind address the client connected to
      the server in case of multiple bind addresses.
      
      - Adding `laddr` field to CLIENT list showing the local (bind) address.
      - Adding `LADDR` option to CLIENT KILL to kill all the clients connected
        to a specific local address.
      - Refactoring to share code.
      84b3c18f
    • Oran Agra's avatar
      Optionally (default) fail to start if requested bind address is not available (#7936) · 441bfa2d
      Oran Agra authored
      Background:
      #3467 (redis 4.0.0), started ignoring ENOPROTOOPT, but did that only for
      the default bind (in case bind config wasn't explicitly set).
      #5598 (redis 5.0.3), added that for bind addresses explicitly set
      (following bug reports in Debian for redis 4.0.9 and 5.0.1), it
      also ignored a bunch of other errors like EPROTONOSUPPORT which was
      requested in #3894, and also added EADDRNOTAVAIL (wasn't clear why).
      
      This (ignoring EADDRNOTAVAIL) makes redis start successfully, even if a
      certain network interface isn't up yet , in which case we rather redis
      fail and will be re-tried when the NIC is up, see #7933.
      
      However, it turns out that when IPv6 is disabled (supported but unused),
      the error we're getting is EADDRNOTAVAIL. and in many systems the
      default config file tries to bind to localhost for both v4 and v6 and
      would like to silently ignore the error on v6 if disabled.
      This means that we sometimes want to ignore EADDRNOTAVAIL and other times
      we wanna fail.
      
      So this commit changes these main things:
      1. Ignore all the errors we ignore for both explicitly requested bind
         address and a default implicit one.
      2. Add a '-' prefix to allow EADDRNOTAVAIL be ignored (by default that's
         different than the previous behavior).
      3. Restructure that function in a more readable and maintainable way see
         below.
      4. Make the default behavior of listening to all achievable by setting
        a bind config directive to * (previously only possible by omitting
        it)
      5. document everything.
      
      The old structure of this function was that even if there are no bind
      addresses requested, the loop that runs though the bind addresses runs
      at least once anyway!
      In that one iteration of the loop it binds to both v4 and v6 addresses,
      handles errors for each of them separately, and then eventually at the
      if-else chain, handles the error of the last bind attempt again!
      This was very hard to read and very error prone to maintain, instead now
      when the bind info is missing we create one with two entries, and run
      the simple loop twice.
      441bfa2d
  18. 07 Oct, 2019 1 commit
    • Yossi Gottlieb's avatar
      TLS: Connections refactoring and TLS support. · b087dd1d
      Yossi Gottlieb authored
      * Introduce a connection abstraction layer for all socket operations and
      integrate it across the code base.
      * Provide an optional TLS connections implementation based on OpenSSL.
      * Pull a newer version of hiredis with TLS support.
      * Tests, redis-cli updates for TLS support.
      b087dd1d
  19. 08 Jul, 2019 1 commit
    • Oran Agra's avatar
      diskless replication on slave side (don't store rdb to file), plus some other related fixes · 2de544cf
      Oran Agra authored
      The implementation of the diskless replication was currently diskless only on the master side.
      The slave side was still storing the received rdb file to the disk before loading it back in and parsing it.
      
      This commit adds two modes to load rdb directly from socket:
      1) when-empty
      2) using "swapdb"
      the third mode of using diskless slave by flushdb is risky and currently not included.
      
      other changes:
      --------------
      distinguish between aof configuration and state so that we can re-enable aof only when sync eventually
      succeeds (and not when exiting from readSyncBulkPayload after a failed attempt)
      also a CONFIG GET and INFO during rdb loading would have lied
      
      When loading rdb from the network, don't kill the server on short read (that can be a network error)
      
      Fix rdb check when performed on preamble AOF
      
      tests:
      run replication tests for diskless slave too
      make replication test a bit more aggressive
      Add test for diskless load swapdb
      2de544cf
  20. 21 Mar, 2018 2 commits
  21. 08 Aug, 2017 1 commit
  22. 18 Apr, 2017 2 commits
  23. 07 Mar, 2017 1 commit
  24. 09 Sep, 2016 1 commit
  25. 11 Jun, 2015 2 commits
    • antirez's avatar
      anet.c: new API anetTcpNonBlockBestEffortBindConnect() · a017b7ec
      antirez authored
      This performs a best effort source address binding attempt. If it is
      possible to bind the local address and still have a successful
      connect(), then this socket is returned. Otherwise the call is retried
      without source address binding attempt.
      
      Related to issues #2609 and #2612.
      a017b7ec
    • antirez's avatar
      anetTcpGenericConnect(), jump to error not end on error · 8fa8b251
      antirez authored
      Two code paths jumped to the "ok, return the socket to the user" code
      path to handle error conditions.
      
      Related to issues #2609 and #2612.
      8fa8b251
  26. 21 May, 2015 1 commit
  27. 19 Jan, 2015 1 commit
    • Matt Stancliff's avatar
      Improve networking type correctness · 53c082ec
      Matt Stancliff authored
      read() and write() return ssize_t (signed long), not int.
      
      For other offsets, we can use the unsigned size_t type instead
      of a signed offset (since our replication offsets and buffer
      positions are never negative).
      53c082ec
  28. 11 Dec, 2014 2 commits
  29. 22 Oct, 2014 1 commit
  30. 17 Oct, 2014 1 commit
  31. 18 Sep, 2014 2 commits