1. 28 Jul, 2012 5 commits
  2. 27 Jul, 2012 2 commits
  3. 26 Jul, 2012 1 commit
  4. 25 Jul, 2012 8 commits
  5. 24 Jul, 2012 6 commits
    • antirez's avatar
      9e5bef38
    • antirez's avatar
      Prevent a spurious +sdown event on switch. · a23a5b6c
      antirez authored
      When we reset the master we should start with clean timestamps for ping
      replies otherwise we'll detect a spurious +sdown event, because on
      +master-switch event the previous master instance was probably in +sdown
      condition. Since we updated the address we should count time from
      scratch again.
      
      Also this commit makes sure to explicitly reset the count of pending
      commands, now we can do this because of the new way the hiredis link
      is closed.
      a23a5b6c
    • antirez's avatar
      Sentinel: debugging message removed. · d918e6f1
      antirez authored
      d918e6f1
    • antirez's avatar
      Sentinel: changes to connection handling and redirection. · 75fb6e5b
      antirez authored
      We disconnect the Redis instances hiredis link in a more robust way now.
      Also we change the way we perform the redirection for the +switch-master
      event, that is not just an instance reset with an address change.
      
      Using the same system we now implement the +redirect-to-master event
      that is triggered by an instance that is configured to be master but
      found to be a slave at the first INFO reply. In that case we monitor the
      master instead, logging the incident as an event.
      75fb6e5b
    • antirez's avatar
      Sentinel: check that instance still exists in reply callbacks. · 2179c269
      antirez authored
      We can't be sure the instance object still exists when the reply
      callback is called.
      2179c269
    • antirez's avatar
      Sentinel: more robust failover detection as observer. · d876d6fe
      antirez authored
      Sentinel observers detect failover checking if a slave attached to the
      monitored master turns into its replication state from slave to master.
      However while this change may in theory only happen after a SLAVEOF NO
      ONE command, in practie it is very easy to reboot a slave instance with
      a wrong configuration that turns it into a master, especially if it was
      a past master before a successfull failover.
      
      This commit changes the detection policy so that if an instance goes
      from slave to master, but at the same time the runid has changed, we
      sense a reboot, and in that case we don't detect a failover at all.
      
      This commit also introduces the "reboot" sentinel event, that is logged
      at "warning" level (so this will trigger an admin notification).
      
      The commit also fixes a problem in the disconnect handler that assumed
      that the instance object always existed, that is not the case. Now we
      no longer assume that redisAsyncFree() will call the disconnection
      handler before returning.
      d876d6fe
  6. 23 Jul, 2012 3 commits
  7. 22 Jul, 2012 2 commits
    • antirez's avatar
      03f412dd
    • antirez's avatar
      Allow Pub/Sub in contexts where other commands are blocked. · 5d73073f
      antirez authored
      Redis loading data from disk, and a Redis slave disconnected from its
      master with serve-stale-data disabled, are two conditions where
      commands are normally refused by Redis, returning an error.
      
      However there is no reason to disable Pub/Sub commands as well, given
      that this layer does not interact with the dataset. To allow Pub/Sub in
      as many contexts as possible is especially interesting now that Redis
      Sentinel uses Pub/Sub of a Redis master as a communication channel
      between Sentinels.
      
      This commit allows Pub/Sub to be used in the above two contexts where
      it was previously denied.
      5d73073f
  8. 21 Jul, 2012 1 commit
  9. 18 Jul, 2012 2 commits
    • antirez's avatar
      Don't assume that "char" is signed. · b62bdf1c
      antirez authored
      For the C standard char can be either signed or unsigned, it's up to the
      compiler, but Redis assumed that it was signed in a few places.
      
      The practical effect of this patch is that now Redis 2.6 will run
      correctly in every system where char is unsigned, notably the RaspBerry
      PI and other ARM systems with GCC.
      
      Thanks to Georgi Marinov (@eesn on twitter) that reported the problem
      and allowed me to use his RaspBerry via SSH to trace and fix the issue!
      b62bdf1c
    • Saj Goonatilleke's avatar
      Truncate short write from the AOF · 55302e9e
      Saj Goonatilleke authored
      If Redis only manages to write out a partial buffer, the AOF file won't
      load back into Redis the next time it starts up.  It is better to
      discard the short write than waste time running redis-check-aof.
      55302e9e
  10. 17 Jul, 2012 1 commit
    • Saj Goonatilleke's avatar
      New in INFO: aof_last_bgrewrite_status · 48553a29
      Saj Goonatilleke authored
      Behaves like rdb_last_bgsave_status -- even down to reporting 'ok' when
      no rewrite has been done yet.  (You might want to check that
      aof_last_rewrite_time_sec is not -1.)
      48553a29
  11. 15 Jul, 2012 1 commit
  12. 09 Jul, 2012 1 commit
  13. 29 Jun, 2012 1 commit
  14. 27 Jun, 2012 2 commits
    • antirez's avatar
      Typo in comment. · 36def8fd
      antirez authored
      36def8fd
    • antirez's avatar
      REPLCONF internal command introduced. · 3a328978
      antirez authored
      The REPLCONF command is an internal command (not designed to be directly
      used by normal clients) that allows a slave to set some replication
      related state in the master before issuing SYNC to start the
      replication.
      
      The initial motivation for this command, and the only reason currently
      it is used by the implementation, is to let the slave instance
      communicate its listening port to the slave, so that the master can
      show all the slaves with their listening ports in the "replication"
      section of the INFO output.
      
      This allows clients to auto discover and query all the slaves attached
      into a master.
      
      Currently only a single option of the REPLCONF command is supported, and
      it is called "listening-port", so the slave now starts the replication
      process with something like the following chat:
      
          REPLCONF listening-prot 6380
          SYNC
      
      Note that this works even if the master is an older version of Redis and
      does not understand REPLCONF, because the slave ignores the REPLCONF
      error.
      
      In the future REPLCONF can be used for partial replication and other
      replication related features where there is the need to exchange
      information between master and slave.
      
      NOTE: This commit also fixes a bug: the INFO outout already carried
      information about slaves, but the port was broken, and was obtained
      with getpeername(2), so it was actually just the ephemeral port used
      by the slave to connect to the master as a client.
      3a328978
  15. 21 Jun, 2012 2 commits
    • antirez's avatar
      5410168c
    • antirez's avatar
      Fixed a timing attack on AUTH (Issue #560). · 31a1439b
      antirez authored
      The way we compared the authentication password using strcmp() allowed
      an attacker to gain information about the password using a well known
      class of attacks called "timing attacks".
      
      The bug appears to be practically not exploitable in most modern systems
      running Redis since even using multiple bytes of differences in the
      input at a time instead of one the difference in running time in in the
      order of 10 nanoseconds, making it hard to exploit even on LAN. However
      attacks always get better so we are providing a fix ASAP.
      
      The new implementation uses two fixed length buffers and a constant time
      comparison function, with the goal of:
      
      1) Completely avoid leaking information about the content of the
      password, since the comparison is always performed between 512
      characters and without conditionals.
      2) Partially avoid leaking information about the length of the
      password.
      
      About "2" we still have a stage in the code where the real password and
      the user provided password are copied in the static buffers, we also run
      two strlen() operations against the two inputs, so the running time
      of the comparison is a fixed amount plus a time proportional to
      LENGTH(A)+LENGTH(B). This means that the absolute time of the operation
      performed is still related to the length of the password in some way,
      but there is no way to change the input in order to get a difference in
      the execution time in the comparison that is not just proportional to
      the string provided by the user (because the password length is fixed).
      
      Thus in practical terms the user should try to discover LENGTH(PASSWORD)
      looking at the whole execution time of the AUTH command and trying to
      guess a proportionality between the whole execution time and the
      password length: this appears to be mostly unfeasible in the real world.
      
      Also protecting from this attack is not very useful in the case of Redis
      as a brute force attack is anyway feasible if the password is too short,
      while with a long password makes it not an issue that the attacker knows
      the length.
      31a1439b
  16. 15 Jun, 2012 1 commit
    • antirez's avatar
      Fix c->reply_bytes computation in setDeferredMultiBulkLength() · 5b63ccce
      antirez authored
      In order to implement reply buffer limits introduced in 2.6 and useful
      to close the connection under user-selected circumastances of big output
      buffers (for instance slow consumers in pub/sub, a blocked slave, and so
      forth) Redis takes a counter with the amount of used memory in objects
      inside the output list stored into c->reply.
      
      The computation was broken in the function setDeferredMultiBulkLength(),
      in the case the object was glued with the next one. This caused the
      c->reply_bytes field to go out of sync, be subtracted more than needed,
      and wrap back near to ULONG_MAX values.
      
      This commit fixes this bug and adds an assertion that is able to trap
      this class of problems.
      
      This problem was discovered looking at the INFO output of an unrelated
      issue (issue #547).
      5b63ccce
  17. 14 Jun, 2012 1 commit
    • antirez's avatar
      ziplistFind(): don't assume that entries are comparable by encoding. · ba779119
      antirez authored
      Because Redis 2.6 introduced new integer encodings it is no longer true
      that if two entries have a different encoding they are not equal.
      
      An old ziplist can be loaded from an RDB file generated with Redis 2.4,
      in this case for instance a small unsigned integers is encoded with a
      16 bit encoding, while in Redis 2.6 a more specific 8 bit encoding
      format is used.
      
      Because of this bug hashes ended with duplicated values or fields lookup
      failed, causing many bad behaviors.
      This in turn caused a crash while converting the ziplist encoded hash into
      a real hash table because an assertion was raised on duplicated elements.
      
      This commit fixes issue #547.
      
      Many thanks to Pinterest's Marty Weiner and colleagues for discovering
      the problem and helping us in the debugging process.
      ba779119