1. 17 Jan, 2023 3 commits
    • Meir Shpilraien (Spielrein)'s avatar
      Remove dead code on sorting reply on Lua scripts. (#10701) · dad7f71f
      Meir Shpilraien (Spielrein) authored
      On v6.2.7 a new mechanism was added to Lua scripts that allows
      filtering the globals of the Lua interpreter. This mechanism was
      added on the following commit: https://github.com/redis/redis/commit/11b602fbf8f9cdf8fc741c24625ab6287ab998a9
      
      One of the globals that was filtered out was `__redis__compare_helper`. This global
      was missed and was not added to the allow list or to the deny list. This is
      why we get the following warning when Redis starts:
      `A key '__redis__compare_helper' was added to Lua globals which is not on the globals allow list nor listed on the deny list.`
      
      After investigating the git blame log, the conclusion is that `__redis__compare_helper`
      is no longer needed, the PR deletes this function, and fixes the warning.
      
      Detailed Explanation:
      
      `__redis__compare_helper` was added on this commit: https://github.com/redis/redis/commit/2c861050c1
      Its purpose is to sort the replies of `SORT` command when script replication is enable and keep the replies
      deterministic and avoid primary and replica synchronization issues. On `SORT` command, there was a need for
      special compare function that are able to compare boolean values.
      
      The need to sort the `SORT` command reply was removed on this commit: https://github.com/redis/redis/commit/36741b2c818a95e8ef167818271614ee6b1bc414
      The sorting was moved to be part of the `SORT` command and there was not longer a need
      to sort it on the Lua interpreter. The commit made `__redis__compare_helper` a dead code but did
      not deleted it.
      
      (cherry picked from commit 64c657a8)
      dad7f71f
    • Meir Shpilraien (Spielrein)'s avatar
      Clean Lua stack before parsing call reply to avoid crash on a call with many arguments (#9809) · a511af7c
      Meir Shpilraien (Spielrein) authored
      This commit 0f8b634c (CVE-2021-32626 released in 6.2.6, 6.0.16, 5.0.14)
      fixes an invalid memory write issue by using `lua_checkstack` API to make
      sure the Lua stack is not overflow. This fix was added on 3 places:
      1. `luaReplyToRedisReply`
      2. `ldbRedis`
      3. `redisProtocolToLuaType`
      
      On the first 2 functions, `lua_checkstack` is handled gracefully while the
      last is handled with an assert and a statement that this situation can
      not happened (only with misbehave module):
      
      > the Redis reply might be deep enough to explode the LUA stack (notice
      that currently there is no such command in Redis that returns such a nested
      reply, but modules might do it)
      
      The issue that was discovered is that user arguments is also considered part
      of the stack, and so the following script (for example) make the assertion reachable:
      ```
      local a = {}
      for i=1,7999 do
          a[i] = 1
      end
      return redis.call("lpush", "l", unpack(a))
      ```
      
      This is a regression because such a script would have worked before and now
      its crashing Redis. The solution is to clear the function arguments from the Lua
      stack which makes the original assumption true and the assertion unreachable.
      
      (cherry picked from commit 6b0b04f1)
      a511af7c
    • Vo Trong Phuc's avatar
      add check good slaves to write when execute script (#10249) · 2adbbbcd
      Vo Trong Phuc authored
      
      
      There was no check min-slave-* config when evaluating Lua script.
      Add check enough good slaves for write command when evaluating scripts.
      Co-authored-by: default avatarPhuc. Vo Trong <phucvt@vng.com.vn>
      (cherry picked from commit 34505d26)
      2adbbbcd
  2. 04 Oct, 2021 2 commits
    • meir@redislabs.com's avatar
      Fix invalid memory write on lua stack overflow {CVE-2021-32626} · 666ed7fa
      meir@redislabs.com authored
      When LUA call our C code, by default, the LUA stack has room for 20
      elements. In most cases, this is more than enough but sometimes it's not
      and the caller must verify the LUA stack size before he pushes elements.
      
      On 3 places in the code, there was no verification of the LUA stack size.
      On specific inputs this missing verification could have lead to invalid
      memory write:
      1. On 'luaReplyToRedisReply', one might return a nested reply that will
         explode the LUA stack.
      2. On 'redisProtocolToLuaType', the Redis reply might be deep enough
         to explode the LUA stack (notice that currently there is no such
         command in Redis that returns such a nested reply, but modules might
         do it)
      3. On 'ldbRedis', one might give a command with enough arguments to
         explode the LUA stack (all the arguments will be pushed to the LUA
         stack)
      
      This commit is solving all those 3 issues by calling 'lua_checkstack' and
      verify that there is enough room in the LUA stack to push elements. In
      case 'lua_checkstack' returns an error (there is not enough room in the
      LUA stack and it's not possible to increase the stack), we will do the
      following:
      1. On 'luaReplyToRedisReply', we will return an error to the user.
      2. On 'redisProtocolToLuaType' we will exit with panic (we assume this
         scenario is rare because it can only happen with a module).
      3. On 'ldbRedis', we return an error.
      666ed7fa
    • meir@redislabs.com's avatar
      Fix protocol parsing on 'ldbReplParseCommand' (CVE-2021-32672) · 6ac3c0b7
      meir@redislabs.com authored
      The protocol parsing on 'ldbReplParseCommand' (LUA debugging)
      Assumed protocol correctness. This means that if the following
      is given:
      *1
      $100
      test
      The parser will try to read additional 94 unallocated bytes after
      the client buffer.
      This commit fixes this issue by validating that there are actually enough
      bytes to read. It also limits the amount of data that can be sent by
      the debugger client to 1M so the client will not be able to explode
      the memory.
      6ac3c0b7
  3. 12 Jan, 2021 1 commit
    • Oran Agra's avatar
      Fix wrong order of key/value in Lua map response (#8266) · ec56906b
      Oran Agra authored
      When a Lua script returns a map to redis (a feature which was added in
      redis 6 together with RESP3), it would have returned the value first and
      the key second.
      
      If the client was using RESP2, it was getting them out of order, and if
      the client was in RESP3, it was getting a map of value => key.
      This was happening regardless of the Lua script using redis.setresp(3)
      or not.
      
      This also affects a case where the script was returning a map which it got
      from from redis by doing something like: redis.setresp(3); return redis.call()
      
      This fix is a breaking change for redis 6.0 users who happened to rely
      on the wrong order (either ones that used redis.setresp(3), or ones that
      returned a map explicitly).
      
      This commit also includes other two changes in the tests:
      1. The test suite now handles RESP3 maps as dicts rather than nested
         lists
      2. Remove some redundant (duplicate) tests from tracking.tcl
      
      (cherry picked from commit 2017407b)
      ec56906b
  4. 27 Oct, 2020 2 commits
    • Oran Agra's avatar
      RM_GetContextFlags provides indication that we're in a fork child (#7783) · fd610ae0
      Oran Agra authored
      
      (cherry picked from commit 2458e548)
      fd610ae0
    • Oran Agra's avatar
      Squash merging 125 typo/grammar/comment/doc PRs (#7773) · 2ae7f491
      Oran Agra authored
      List of squashed commits or PRs
      ===============================
      
      commit 66801ea
      Author: hwware <wen.hui.ware@gmail.com>
      Date:   Mon Jan 13 00:54:31 2020 -0500
      
          typo fix in acl.c
      
      commit 46f55db
      Author: Itamar Haber <itamar@redislabs.com>
      Date:   Sun Sep 6 18:24:11 2020 +0300
      
          Updates a couple of comments
      
          Specifically:
      
          * RM_AutoMemory completed instead of pointing to docs
          * Updated link to custom type doc
      
      commit 61a2aa0
      Author: xindoo <xindoo@qq.com>
      Date:   Tue Sep 1 19:24:59 2020 +0800
      
          Correct errors in code comments
      
      commit a5871d1
      Author: yz1509 <pro-756@qq.com>
      Date:   Tue Sep 1 18:36:06 2020 +0800
      
          fix typos in module.c
      
      commit 41eede7
      Author: bookug <bookug@qq.com>
      Date:   Sat Aug 15 01:11:33 2020 +0800
      
          docs: fix typos in comments
      
      commit c303c84
      Author: lazy-snail <ws.niu@outlook.com>
      Date:   Fri Aug 7 11:15:44 2020 +0800
      
          fix spelling in redis.conf
      
      commit 1eb76bf
      Author: zhujian <zhujianxyz@gmail.com>...
      2ae7f491
  5. 07 Apr, 2020 2 commits
    • mymilkbottles's avatar
      Judge the log level in advance · 2437455f
      mymilkbottles authored
      2437455f
    • srzhao's avatar
      Check OOM at script start to get stable lua OOM state. · 026cc11b
      srzhao authored
      Checking OOM by `getMaxMemoryState` inside script might get different result
      with `freeMemoryIfNeededAndSafe` at script start, because lua stack and
      arguments also consume memory.
      
      This leads to memory `borderline` when memory grows near server.maxmemory:
      
      - `freeMemoryIfNeededAndSafe` at script start detects no OOM, no memory freed
      - `getMaxMemoryState` inside script detects OOM, script aborted
      
      We solve this 'borderline' issue by saving OOM state at script start to get
      stable lua OOM state.
      
      related to issue #6565 and #5250.
      026cc11b
  6. 12 Feb, 2020 3 commits
  7. 04 Feb, 2020 1 commit
  8. 17 Dec, 2019 3 commits
  9. 22 Nov, 2019 4 commits
  10. 07 Oct, 2019 1 commit
    • Yossi Gottlieb's avatar
      TLS: Connections refactoring and TLS support. · b087dd1d
      Yossi Gottlieb authored
      * Introduce a connection abstraction layer for all socket operations and
      integrate it across the code base.
      * Provide an optional TLS connections implementation based on OpenSSL.
      * Pull a newer version of hiredis with TLS support.
      * Tests, redis-cli updates for TLS support.
      b087dd1d
  11. 04 Oct, 2019 1 commit
  12. 02 Oct, 2019 1 commit
    • Oran Agra's avatar
      On LUA script timeout, print the script SHA to the log · 98426e98
      Oran Agra authored
      since the slowlog and other means that can help you detect the bad script
      are only exposed after the script is done. it might be a good idea to at least
      print the script name (sha) to the log when it timeouts.
      98426e98
  13. 20 Sep, 2019 2 commits
  14. 17 Sep, 2019 4 commits
  15. 16 Sep, 2019 6 commits
  16. 13 Sep, 2019 3 commits
  17. 17 Jul, 2019 1 commit
    • Oran Agra's avatar
      Module API for Forking · 56258c6b
      Oran Agra authored
      * create module API for forking child processes.
      * refactor duplicate code around creating and tracking forks by AOF and RDB.
      * child processes listen to SIGUSR1 and dies exitFromChild in order to
        eliminate a valgrind warning of unhandled signal.
      * note that BGSAVE error reply has changed.
      
      valgrind error is:
        Process terminating with default action of signal 10 (SIGUSR1)
      56258c6b