mirror of
https://github.com/redis/redis.git
synced 2026-04-21 03:01:35 -04:00
04589f90d7
# PR: Add Mechanism for Internal Commands and Connections in Redis This PR introduces a mechanism to handle **internal commands and connections** in Redis. It includes enhancements for command registration, internal authentication, and observability. ## Key Features 1. **Internal Command Flag**: - Introduced a new **module command registration flag**: `internal`. - Commands marked with `internal` can only be executed by **internal connections**, AOF loading flows, and master-replica connections. - For any other connection, these commands will appear as non-existent. 2. **Support for internal authentication added to `AUTH`**: - Used by depicting the special username `internal connection` with the right internal password, i.e.,: `AUTH "internal connection" <internal_secret>`. - No user-defined ACL username can have this name, since spaces are not aloud in the ACL parser. - Allows connections to authenticate as **internal connections**. - Authenticated internal connections can execute internal commands successfully. 4. **Module API for Internal Secret**: - Added the `RedisModule_GetInternalSecret()` API, that exposes the internal secret that should be used as the password for the new `AUTH "internal connection" <password>` command. - This API enables the modules to authenticate against other shards as local connections. ## Notes on Behavior - **ACL validation**: - Commands dispatched by internal connections bypass ACL validation, to give the caller full access regardless of the user with which it is connected. - **Command Visibility**: - Internal commands **do not appear** in `COMMAND <subcommand>` and `MONITOR` for non-internal connections. - Internal commands **are logged** in the slow log, latency report and commands' statistics to maintain observability. - **`RM_Call()` Updates**: - **Non-internal connections**: - Cannot execute internal commands when the command is sent with the `C` flag (otherwise can). - Internal connections bypass ACL validations (i.e., run as the unrestricted user). - **Internal commands' success**: - Internal commands succeed upon being sent from either an internal connection (i.e., authenticated via the new `AUTH "internal connection" <internal_secret>` API), an AOF loading process, or from a master via the replication link. Any other connections that attempt to execute an internal command fail with the `unknown command` error message raised. - **`CLIENT LIST` flags**: - Added the `I` flag, to indicate that the connection is internal. - **Lua Scripts**: - Prevented internal commands from being executed via Lua scripts. --------- Co-authored-by: Meir Shpilraien <meir@redis.com>
61 lines
1.8 KiB
Bash
Executable File
61 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
TCL_VERSIONS="8.5 8.6 8.7"
|
|
TCLSH=""
|
|
[ -z "$MAKE" ] && MAKE=make
|
|
|
|
for VERSION in $TCL_VERSIONS; do
|
|
TCL=`which tclsh$VERSION 2>/dev/null` && TCLSH=$TCL
|
|
done
|
|
|
|
if [ -z $TCLSH ]
|
|
then
|
|
echo "You need tcl 8.5 or newer in order to run the Redis ModuleApi test"
|
|
exit 1
|
|
fi
|
|
|
|
$MAKE -C tests/modules && \
|
|
$TCLSH tests/test_helper.tcl \
|
|
--single unit/moduleapi/commandfilter \
|
|
--single unit/moduleapi/basics \
|
|
--single unit/moduleapi/fork \
|
|
--single unit/moduleapi/testrdb \
|
|
--single unit/moduleapi/infotest \
|
|
--single unit/moduleapi/moduleconfigs \
|
|
--single unit/moduleapi/infra \
|
|
--single unit/moduleapi/propagate \
|
|
--single unit/moduleapi/hooks \
|
|
--single unit/moduleapi/misc \
|
|
--single unit/moduleapi/blockonkeys \
|
|
--single unit/moduleapi/blockonbackground \
|
|
--single unit/moduleapi/scan \
|
|
--single unit/moduleapi/datatype \
|
|
--single unit/moduleapi/auth \
|
|
--single unit/moduleapi/keyspace_events \
|
|
--single unit/moduleapi/blockedclient \
|
|
--single unit/moduleapi/getkeys \
|
|
--single unit/moduleapi/test_lazyfree \
|
|
--single unit/moduleapi/defrag \
|
|
--single unit/moduleapi/keyspecs \
|
|
--single unit/moduleapi/hash \
|
|
--single unit/moduleapi/zset \
|
|
--single unit/moduleapi/list \
|
|
--single unit/moduleapi/stream \
|
|
--single unit/moduleapi/mallocsize \
|
|
--single unit/moduleapi/datatype2 \
|
|
--single unit/moduleapi/cluster \
|
|
--single unit/moduleapi/aclcheck \
|
|
--single unit/moduleapi/subcommands \
|
|
--single unit/moduleapi/reply \
|
|
--single unit/moduleapi/cmdintrospection \
|
|
--single unit/moduleapi/eventloop \
|
|
--single unit/moduleapi/timer \
|
|
--single unit/moduleapi/publish \
|
|
--single unit/moduleapi/usercall \
|
|
--single unit/moduleapi/postnotifications \
|
|
--single unit/moduleapi/async_rm_call \
|
|
--single unit/moduleapi/moduleauth \
|
|
--single unit/moduleapi/rdbloadsave \
|
|
--single unit/moduleapi/crash \
|
|
--single unit/moduleapi/internalsecret \
|
|
"${@}"
|