feat: client connection security hardening (P0 + P1) #69
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -349,3 +349,120 @@ jobs: | |
| JEOF | ||
| cd /tmp/jedis-test && javac -cp "jedis.jar:commons-pool2.jar:slf4j-api.jar:gson.jar" CompatTest.java | ||
| cd /tmp/jedis-test && java -ea -cp ".:jedis.jar:commons-pool2.jar:slf4j-api.jar:slf4j-simple.jar:gson.jar" CompatTest | ||
|
|
||
| lettuce: | ||
| name: lettuce (Java) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: dtolnay/rust-toolchain@1.94.0 | ||
| - uses: Swatinem/rust-cache@v2 | ||
| - name: Build Moon (tokio) | ||
| run: cargo build --release --no-default-features --features runtime-tokio,jemalloc | ||
| env: | ||
| MOON_NO_URING: "1" | ||
| - name: Start Moon | ||
| run: | | ||
| ./target/release/moon --port 6399 --shards 1 & | ||
| sleep 2 | ||
| env: | ||
| MOON_NO_URING: "1" | ||
| - uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: 'temurin' | ||
| java-version: '21' | ||
| - name: Run lettuce smoke test | ||
| env: | ||
| LETTUCE_VERSION: "6.5.2.RELEASE" | ||
| NETTY_VERSION: "4.1.116.Final" | ||
| REACTOR_VERSION: "3.7.2" | ||
| REACTIVE_STREAMS_VERSION: "1.0.4" | ||
| run: | | ||
| mkdir -p /tmp/lettuce-test | ||
| curl -sL "https://repo1.maven.org/maven2/io/lettuce/lettuce-core/${LETTUCE_VERSION}/lettuce-core-${LETTUCE_VERSION}.jar" -o /tmp/lettuce-test/lettuce-core.jar | ||
| curl -sL "https://repo1.maven.org/maven2/io/netty/netty-all/${NETTY_VERSION}/netty-all-${NETTY_VERSION}.jar" -o /tmp/lettuce-test/netty-all.jar | ||
| curl -sL "https://repo1.maven.org/maven2/io/projectreactor/reactor-core/${REACTOR_VERSION}/reactor-core-${REACTOR_VERSION}.jar" -o /tmp/lettuce-test/reactor-core.jar | ||
| curl -sL "https://repo1.maven.org/maven2/org/reactivestreams/reactive-streams/${REACTIVE_STREAMS_VERSION}/reactive-streams-${REACTIVE_STREAMS_VERSION}.jar" -o /tmp/lettuce-test/reactive-streams.jar | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: cat -n .github/workflows/compat.yml | sed -n '375,395p'Repository: pilotspace/moon Length of output: 1767 Harden JAR downloads: fail fast on HTTP errors and add checksum verification. Lines 382-385 use Replace Example hardening approach- curl -sL "https://repo1.maven.org/maven2/io/lettuce/lettuce-core/${LETTUCE_VERSION}/lettuce-core-${LETTUCE_VERSION}.jar" -o /tmp/lettuce-test/lettuce-core.jar
+ curl -fSL --retry 3 --retry-delay 2 "https://repo1.maven.org/maven2/io/lettuce/lettuce-core/${LETTUCE_VERSION}/lettuce-core-${LETTUCE_VERSION}.jar" -o /tmp/lettuce-test/lettuce-core.jar
+ curl -fSL --retry 3 --retry-delay 2 "https://repo1.maven.org/maven2/io/lettuce/lettuce-core/${LETTUCE_VERSION}/lettuce-core-${LETTUCE_VERSION}.jar.sha256" -o /tmp/lettuce-test/lettuce-core.jar.sha256
+ (cd /tmp/lettuce-test && sha256sum -c lettuce-core.jar.sha256)Apply similar changes for netty-all, reactor-core, and reactive-streams JARs. 🤖 Prompt for AI Agents |
||
| cat > /tmp/lettuce-test/LettuceTest.java << 'LEOF' | ||
| import io.lettuce.core.RedisClient; | ||
| import io.lettuce.core.api.StatefulRedisConnection; | ||
| import io.lettuce.core.api.sync.RedisCommands; | ||
| public class LettuceTest { | ||
| public static void main(String[] args) { | ||
| RedisClient client = RedisClient.create("redis://127.0.0.1:6399"); | ||
| try (StatefulRedisConnection<String, String> conn = client.connect()) { | ||
| RedisCommands<String, String> cmd = conn.sync(); | ||
| cmd.set("lettuce_key", "lettuce_value"); | ||
| String v = cmd.get("lettuce_key"); | ||
| assert "lettuce_value".equals(v) : "GET failed"; | ||
| cmd.hset("lettuce_hash", "f1", "v1"); | ||
| String hv = cmd.hget("lettuce_hash", "f1"); | ||
| assert "v1".equals(hv) : "HGET failed"; | ||
| System.out.println("lettuce: ALL TESTS PASSED"); | ||
| } finally { | ||
| client.shutdown(); | ||
| } | ||
| } | ||
| } | ||
| LEOF | ||
| cd /tmp/lettuce-test && javac -cp "lettuce-core.jar:netty-all.jar:reactor-core.jar:reactive-streams.jar" LettuceTest.java | ||
| cd /tmp/lettuce-test && java -ea -cp ".:lettuce-core.jar:netty-all.jar:reactor-core.jar:reactive-streams.jar" LettuceTest | ||
|
|
||
| stackexchange-redis: | ||
| name: StackExchange.Redis (.NET) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: dtolnay/rust-toolchain@1.94.0 | ||
| - uses: Swatinem/rust-cache@v2 | ||
| - name: Build Moon (tokio) | ||
| run: cargo build --release --no-default-features --features runtime-tokio,jemalloc | ||
| env: | ||
| MOON_NO_URING: "1" | ||
| - name: Start Moon | ||
| run: | | ||
| ./target/release/moon --port 6399 --shards 1 & | ||
| sleep 2 | ||
| env: | ||
| MOON_NO_URING: "1" | ||
| - uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: '9.0.x' | ||
| - name: Run StackExchange.Redis smoke test | ||
| run: | | ||
| mkdir -p /tmp/se-redis-test | ||
| cd /tmp/se-redis-test | ||
| dotnet new console -n CompatTest --force | ||
| cd CompatTest | ||
| dotnet add package StackExchange.Redis | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: # First, let's find the compat.yml file and examine its contents
find . -name "compat.yml" -type fRepository: pilotspace/moon Length of output: 89 🏁 Script executed: # Also check the file structure to understand the workflow layout
fd -t f "\.github/workflows" | head -20Repository: pilotspace/moon Length of output: 41 🏁 Script executed: # Let's examine the compat.yml file to see the context around line 437
wc -l .github/workflows/compat.ymlRepository: pilotspace/moon Length of output: 91 🏁 Script executed: # Read the relevant section of the workflow file around line 437
sed -n '420,450p' .github/workflows/compat.ymlRepository: pilotspace/moon Length of output: 1053 🏁 Script executed: # Let's see more context about the test and check the entire file structure
sed -n '430,468p' .github/workflows/compat.ymlRepository: pilotspace/moon Length of output: 1545 🏁 Script executed: # Check if there are any version constraints documented elsewhere in the project
rg "StackExchange\.Redis" --type-list all -iRepository: pilotspace/moon Length of output: 448 🏁 Script executed: # Search for StackExchange.Redis references in the codebase
rg "StackExchange\.Redis" -iRepository: pilotspace/moon Length of output: 195 🏁 Script executed: # Let's also check the git history of this workflow to see when it was added
git log --oneline .github/workflows/compat.yml | head -10Repository: pilotspace/moon Length of output: 111 🏁 Script executed: # Let's understand the purpose of this workflow better by looking at the beginning
head -50 .github/workflows/compat.ymlRepository: pilotspace/moon Length of output: 1532 🏁 Script executed: # Check when this specific test was added or modified
git log -p .github/workflows/compat.yml | grep -A 10 -B 5 "StackExchange.Redis" | head -40Repository: pilotspace/moon Length of output: 41 🏁 Script executed: # Let's check the complete workflow to see all compatibility tests and version pinning patterns
cat .github/workflows/compat.yml | grep -A 5 -B 5 "add package\|pip install\|npm install" | head -60Repository: pilotspace/moon Length of output: 1098 🏁 Script executed: # Let's also look for any other version pinning patterns in the workflow
grep -n "version" .github/workflows/compat.ymlRepository: pilotspace/moon Length of output: 339 🏁 Script executed: # Let's check if there are any documentation or comments about version strategy
grep -r "version\|deterministic\|pinning" docs/ README.md 2>/dev/null | head -20Repository: pilotspace/moon Length of output: 2124 🏁 Script executed: # Check if there are any recent issues or PRs related to CI stability or version pinning
git log --all --oneline --grep="version\|deterministic\|pin" | head -10Repository: pilotspace/moon Length of output: 742 🏁 Script executed: # Let's also check if there are any other workflows that pin versions
grep -r "version\|@\|--version" .github/workflows/ | grep -E "pip|npm|dotnet|add package" | head -20Repository: pilotspace/moon Length of output: 188 🏁 Script executed: # Let's check if there are any recent issues, failures, or discussions about this
git log --all --oneline | grep -i "stackexchange\|dotnet\|compat" | head -20Repository: pilotspace/moon Length of output: 436 🏁 Script executed: # Check the full compat test section for all clients to see if there's a pattern
sed -n '1,100p' .github/workflows/compat.yml | grep -E "pip install|npm install|add package|Install"Repository: pilotspace/moon Length of output: 120 🏁 Script executed: # Let's look at the end of the file to see all test jobs
tail -100 .github/workflows/compat.ymlRepository: pilotspace/moon Length of output: 4660 🏁 Script executed: # Let's check if there's any documentation about version requirements in the project
cat README.md | grep -A 5 -B 5 "version\|client" | head -50Repository: pilotspace/moon Length of output: 2363 🏁 Script executed: # Let's also check if there are any issues or recent discussions about compatibility test failures
git log --all --oneline .github/workflows/compat.yml | head -20Repository: pilotspace/moon Length of output: 183 🏁 Script executed: # Check what the actual latest version of StackExchange.Redis is
# Let's see if there's any package.lock or similar file that might pin this
fd -t f "package.lock\|packages.lock\|\.csproj\|global.json" 2>/dev/nullRepository: pilotspace/moon Length of output: 41 🏁 Script executed: # Let's look at the commit that added the compat tests to understand the intent
git show 794be8d --stat | head -20Repository: pilotspace/moon Length of output: 640 🏁 Script executed: # Check if there are any recent CI failures or issues related to this
git log --all --oneline --grep="compat\|stack\|dotnet" | head -10Repository: pilotspace/moon Length of output: 778 🏁 Script executed: # Let's see the pattern: are version pins used for other tests?
cat .github/workflows/compat.yml | grep -E "VERSION|version" | grep -v "python-version\|dotnet-version\|java-version\|node-version\|go-version"Repository: pilotspace/moon Length of output: 1904 🏁 Script executed: # Let's check the history of when this compat test was introduced
git show 43b0462 --statRepository: pilotspace/moon Length of output: 1641 🏁 Script executed: # Check if there are any CI failures or issues related to StackExchange.Redis
git log --all --oneline --grep="stackexchange\|dotnet.*compat\|Redis.*test" -i | head -10Repository: pilotspace/moon Length of output: 743 🏁 Script executed: # Let's look more carefully at how the Java tests handle versioning and compare
sed -n '300,400p' .github/workflows/compat.yml | grep -A 15 "jedis-test"Repository: pilotspace/moon Length of output: 2346 🏁 Script executed: # Search for any existing StackExchange.Redis version references or constraints in the codebase
rg "2\.8\.|StackExchange" -iRepository: pilotspace/moon Length of output: 224 🌐 Web query:
💡 Result: StackExchange.Redis version 2.8.31 was released on March 7, 2025, according to NuGet records. The key changes in this release are: - Fix: Respect IReconnectRetryPolicy timing in the case that a node that was present disconnects indefinitely (pull requests Citations:
🌐 Web query:
💡 Result: The latest version of StackExchange.Redis is 2.12.14, released on 2026-04-02. This is confirmed as the most recent release on the official GitHub repository. Previous recent releases include 2.12.8 (2026-03-25, listed on NuGet with 66,675 downloads), 2.12.4, 2.12.1 (2026-03-13), 2.11.8 (2026-02-25), and 2.11.3 (2026-02-19). The NuGet package page shows 2.12.8 as the latest stable with recent downloads, but GitHub releases confirm 2.12.14 as newer, addressing critical issues like high-integrity-mode in cluster scenarios. Citations:
Pin Line 437 installs the latest package version at runtime, which can break compatibility unexpectedly. This is inconsistent with the Java tests in the same workflow (Jedis, Lettuce), which explicitly pin dependency versions. Update to use version Suggested fix+ env:
+ STACKEXCHANGE_REDIS_VERSION: "2.12.14"
run: |
mkdir -p /tmp/se-redis-test
cd /tmp/se-redis-test
dotnet new console -n CompatTest --force
cd CompatTest
- dotnet add package StackExchange.Redis
+ dotnet add package StackExchange.Redis --version ${STACKEXCHANGE_REDIS_VERSION}🤖 Prompt for AI Agents |
||
| cat > Program.cs << 'CSEOF' | ||
| using StackExchange.Redis; | ||
|
|
||
| var mux = ConnectionMultiplexer.Connect("127.0.0.1:6399"); | ||
| var db = mux.GetDatabase(); | ||
|
|
||
| // SET / GET | ||
| db.StringSet("dotnet_key", "dotnet_value"); | ||
| var v = db.StringGet("dotnet_key"); | ||
| if (v != "dotnet_value") throw new Exception("GET failed"); | ||
|
|
||
| // HSET / HGET | ||
| db.HashSet("dotnet_hash", "f1", "v1"); | ||
| var hv = db.HashGet("dotnet_hash", "f1"); | ||
| if (hv != "v1") throw new Exception("HGET failed"); | ||
|
|
||
| // Pipeline (batch) | ||
| var batch = db.CreateBatch(); | ||
| var t1 = batch.StringSetAsync("dp1", "pv1"); | ||
| var t2 = batch.StringSetAsync("dp2", "pv2"); | ||
| var t3 = batch.StringGetAsync("dp1"); | ||
| var t4 = batch.StringGetAsync("dp2"); | ||
| batch.Execute(); | ||
| Task.WaitAll(t1, t2, t3, t4); | ||
| if (t3.Result != "pv1") throw new Exception("batch GET1 failed"); | ||
| if (t4.Result != "pv2") throw new Exception("batch GET2 failed"); | ||
|
|
||
| Console.WriteLine("StackExchange.Redis: ALL TESTS PASSED"); | ||
| mux.Dispose(); | ||
| CSEOF | ||
| dotnet run | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,7 +20,11 @@ jobs: | |
| target: | ||
| - resp_parse | ||
| - resp_parse_differential | ||
| - inline_parse | ||
| - wal_v3_record | ||
| - gossip_deser | ||
| - acl_rule | ||
| - rdb_load | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: dtolnay/rust-toolchain@nightly | ||
|
|
@@ -38,8 +42,8 @@ jobs: | |
| name: fuzz-corpus | ||
| path: fuzz/corpus/ | ||
| continue-on-error: true | ||
| - name: Run fuzzer (15m, multi-process) | ||
| run: cargo +nightly fuzz run "$TARGET" -- -max_total_time=900 -max_len=65536 -fork=2 -ignore_crashes=0 | ||
| env: | ||
| MOON_NO_URING: "1" | ||
| TARGET: ${{ matrix.target }} | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| name: Integration Tests | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
|
|
||
| env: | ||
| CARGO_TERM_COLOR: always | ||
| MOON_NO_URING: "1" | ||
|
|
||
| jobs: | ||
| durability: | ||
| name: Durability Tests | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: dtolnay/rust-toolchain@1.94.1 | ||
| - uses: Swatinem/rust-cache@v2 | ||
| - name: Build Moon (release) | ||
| run: cargo build --release --no-default-features --features runtime-tokio,jemalloc | ||
| - name: Run crash matrix tests | ||
| run: cargo test --release --no-default-features --features runtime-tokio,jemalloc --test durability | ||
| timeout-minutes: 10 | ||
| - name: Run jepsen-lite tests | ||
| run: cargo test --release --no-default-features --features runtime-tokio,jemalloc --test jepsen_lite | ||
| timeout-minutes: 10 | ||
|
|
||
| replication: | ||
| name: Replication Tests | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: dtolnay/rust-toolchain@1.94.1 | ||
| - uses: Swatinem/rust-cache@v2 | ||
| - name: Build Moon (release) | ||
| run: cargo build --release --no-default-features --features runtime-tokio,jemalloc | ||
| - name: Run replication hardening tests | ||
| run: cargo test --release --no-default-features --features runtime-tokio,jemalloc --test replication_hardening | ||
| timeout-minutes: 10 |
Submodule .planning
updated
from 598ce3 to cff8ac
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,6 +6,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 | |
|
|
||
| ## [Unreleased] | ||
|
|
||
| ### Added — Client Connection Security Hardening (2026-04-10) | ||
|
|
||
| - **`--maxclients` (P0):** Connection limit with atomic CAS rejection (default 10000, 0=unlimited). Returns `-ERR max number of clients reached` when exceeded. | ||
| - **`--timeout` (P0):** Client idle timeout in seconds (default 0=disabled). Disconnects idle clients via `tokio::time::timeout` / `monoio::select!`. | ||
| - **`--tcp-keepalive` (P0):** TCP keepalive interval (default 300s, 0=disabled). Sets `SO_KEEPALIVE` + `TCP_KEEPIDLE` on accepted sockets via `socket2`. | ||
| - **AUTH rate limiting (P0):** Per-IP exponential backoff on AUTH failures (100ms base, 10s cap, 60s auto-reset). New module `src/auth_ratelimit.rs`. | ||
| - **CLIENT LIST / INFO / KILL (P1):** Global client registry with Drop-guard deregister. Redis-compatible output format. Kill by ID/ADDR/USER. New module `src/client_registry.rs`. | ||
| - **CLIENT PAUSE / UNPAUSE (P1):** Server-wide pause with ALL/WRITE modes and auto-expiry. New module `src/client_pause.rs`. | ||
| - **CLIENT NO-EVICT / NO-TOUCH (P1):** Accepted stubs for Redis compatibility. | ||
| - **ACL GENPASS (P1):** Cryptographically secure random password generation (1-4096 bits, hex output). | ||
| - **CONFIG GET/SET** support for `maxclients`, `timeout`, `tcp-keepalive` (runtime-mutable). | ||
| - **Monoio connection tracking:** Added missing `record_connection_opened` / `record_connection_closed` for accurate `connected_clients` metric. | ||
|
|
||
| ### Fixed — Wave 0-4 Gap Closure (2026-04-09) | ||
|
|
||
| - **ZREVRANGEBYSCORE/ZREVRANGEBYLEX correctness bug:** Fixed double-swap of min/max bounds in `zrange_by_score` and `zrange_by_lex` that caused empty results for finite score ranges (e.g., `ZREVRANGEBYSCORE key 3 1`). Added finite-range test to `test-commands.sh`. | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.