1. 10 4月, 2017 1 次提交
    • A
      Fix modules blocking commands awake delay. · ffefc9f9
      antirez 提交于
      If a thread unblocks a client blocked in a module command, by using the
      RedisMdoule_UnblockClient() API, the event loop may not be awaken until
      the next timeout of the multiplexing API or the next unrelated I/O
      operation on other clients. We actually want the client to be served
      ASAP, so a mechanism is needed in order for the unblocking API to inform
      Redis that there is a client to serve ASAP.
      
      This commit fixes the issue using the old trick of the pipe: when a
      client needs to be unblocked, a byte is written in a pipe. When we run
      the list of clients blocked in modules, we consume all the bytes
      written in the pipe. Writes and reads are performed inside the context
      of the mutex, so no race is possible in which we consume the bytes that
      are actually related to an awake request for a client that should still
      be put into the list of clients to unblock.
      
      It was verified that after the fix the server handles the blocked
      clients with the expected short delay.
      
      Thanks to @dvirsky for understanding there was such a problem and
      reporting it.
      ffefc9f9
  2. 08 4月, 2017 1 次提交
  3. 07 4月, 2017 1 次提交
  4. 27 3月, 2017 1 次提交
  5. 15 3月, 2017 2 次提交
  6. 09 3月, 2017 1 次提交
  7. 23 2月, 2017 4 次提交
  8. 22 2月, 2017 6 次提交
    • A
      Solaris fixes about tail usage and atomic vars. · 95883313
      antirez 提交于
      Testing with Solaris C compiler (SunOS 5.11 11.2 sun4v sparc sun4v)
      there were issues compiling due to atomicvar.h and running the
      tests also failed because of "tail" usage not conform with Solaris
      tail implementation. This commit fixes both the issues.
      95883313
    • A
      Test: replication-psync, wait more to detect write load. · 2b36706a
      antirez 提交于
      Slow systems like the original Raspberry PI need more time
      than 5 seconds to start the script and detect writes.
      After fixing the Raspberry PI can pass the unit without issues.
      2b36706a
    • A
      7c8ddab4
    • A
      Merge branch 'siphash' into unstable · 06263485
      antirez 提交于
      06263485
    • A
      Merge branch 'arm' into unstable · e084b5a3
      antirez 提交于
      e084b5a3
    • A
      SipHash 2-4 -> SipHash 1-2. · 0285c271
      antirez 提交于
      For performance reasons we use a reduced rounds variant of
      SipHash. This should still provide enough protection and the
      effects in the hash table distribution are non existing.
      If some real world attack on SipHash 1-2 will be found we can
      trivially switch to something more secure. Anyway it is a
      big step forward from Murmurhash, for which it is trivial to
      generate *seed independent* colliding keys... The speed
      penatly introduced by SipHash 2-4, around 4%, was a too big
      price to pay compared to the effectiveness of the HashDoS
      attack against SipHash 1-2, and considering so far in the
      Redis history, no such an incident ever happened even while
      using trivially to collide hash functions.
      0285c271
  9. 21 2月, 2017 4 次提交
    • A
      freeMemoryIfNeeded(): improve code and lazyfree handling. · cd90389b
      antirez 提交于
      1. Refactor memory overhead computation into a function.
      2. Every 10 keys evicted, check if memory usage already reached
         the target value directly, since we otherwise don't count all
         the memory reclaimed by the background thread right now.
      cd90389b
    • A
      Use locale agnostic tolower() in dict.c hash function. · 84fa8230
      antirez 提交于
      84fa8230
    • A
      SipHash x86 optimizations. · 05ea8c61
      antirez 提交于
      05ea8c61
    • A
      Use SipHash hash function to mitigate HashDos attempts. · adeed29a
      antirez 提交于
      This change attempts to switch to an hash function which mitigates
      the effects of the HashDoS attack (denial of service attack trying
      to force data structures to worst case behavior) while at the same time
      providing Redis with an hash function that does not expect the input
      data to be word aligned, a condition no longer true now that sds.c
      strings have a varialbe length header.
      
      Note that it is possible sometimes that even using an hash function
      for which collisions cannot be generated without knowing the seed,
      special implementation details or the exposure of the seed in an
      indirect way (for example the ability to add elements to a Set and
      check the return in which Redis returns them with SMEMBERS) may
      make the attacker's life simpler in the process of trying to guess
      the correct seed, however the next step would be to switch to a
      log(N) data structure when too many items in a single bucket are
      detected: this seems like an overkill in the case of Redis.
      
      SPEED REGRESION TESTS:
      
      In order to verify that switching from MurmurHash to SipHash had
      no impact on speed, a set of benchmarks involving fast insertion
      of 5 million of keys were performed.
      
      The result shows Redis with SipHash in high pipelining conditions
      to be about 4% slower compared to using the previous hash function.
      However this could partially be related to the fact that the current
      implementation does not attempt to hash whole words at a time but
      reads single bytes, in order to have an output which is endian-netural
      and at the same time working on systems where unaligned memory accesses
      are a problem.
      
      Further X86 specific optimizations should be tested, the function
      may easily get at the same level of MurMurHash2 if a few optimizations
      are performed.
      adeed29a
  10. 20 2月, 2017 2 次提交
  11. 19 2月, 2017 4 次提交
  12. 09 2月, 2017 1 次提交
    • A
      Fix MIGRATE closing of cached socket on error. · f917e0da
      antirez 提交于
      After investigating issue #3796, it was discovered that MIGRATE
      could call migrateCloseSocket() after the original MIGRATE c->argv
      was already rewritten as a DEL operation. As a result the host/port
      passed to migrateCloseSocket() could be anything, often a NULL pointer
      that gets deferenced crashing the server.
      
      Now the socket is closed at an earlier time when there is a socket
      error in a later stage where no retry will be performed, before we
      rewrite the argument vector. Moreover a check was added so that later,
      in the socket_err label, there is no further attempt at closing the
      socket if the argument was rewritten.
      
      This fix should resolve the bug reported in #3796.
      f917e0da
  13. 02 2月, 2017 1 次提交
  14. 01 2月, 2017 1 次提交
    • A
      Ziplist: insertion bug under particular conditions fixed. · c495d095
      antirez 提交于
      Ziplists had a bug that was discovered while investigating a different
      issue, resulting in a corrupted ziplist representation, and a likely
      segmentation foult and/or data corruption of the last element of the
      ziplist, once the ziplist is accessed again.
      
      The bug happens when a specific set of insertions / deletions is
      performed so that an entry is encoded to have a "prevlen" field (the
      length of the previous entry) of 5 bytes but with a count that could be
      encoded in a "prevlen" field of a since byte. This could happen when the
      "cascading update" process called by ziplistInsert()/ziplistDelete() in
      certain contitious forces the prevlen to be bigger than necessary in
      order to avoid too much data moving around.
      
      Once such an entry is generated, inserting a very small entry
      immediately before it will result in a resizing of the ziplist for a
      count smaller than the current ziplist length (which is a violation,
      inserting code expects the ziplist to get bigger actually). So an FF
      byte is inserted in a misplaced position. Moreover a realloc() is
      performed with a count smaller than the ziplist current length so the
      final bytes could be trashed as well.
      
      SECURITY IMPLICATIONS:
      
      Currently it looks like an attacker can only crash a Redis server by
      providing specifically choosen commands. However a FF byte is written
      and there are other memory operations that depend on a wrong count, so
      even if it is not immediately apparent how to mount an attack in order
      to execute code remotely, it is not impossible at all that this could be
      done. Attacks always get better... and we did not spent enough time in
      order to think how to exploit this issue, but security researchers
      or malicious attackers could.
      c495d095
  15. 30 1月, 2017 2 次提交
  16. 27 1月, 2017 2 次提交
  17. 26 1月, 2017 2 次提交
  18. 25 1月, 2017 1 次提交
  19. 20 1月, 2017 1 次提交
  20. 19 1月, 2017 2 次提交
    • A
      Add panic() into redisassert.h. · 17ac46ea
      antirez 提交于
      This header file is for libs, like ziplist.c, that we want to leave
      almost separted from the core. The panic() calls will be easy to delete
      in order to use such files outside, but the debugging info we gain are
      very valuable compared to simple assertions where it is not possible to
      print debugging info.
      17ac46ea
    • A
      serverPanic(): allow printf() alike formatting. · 53b8bf2c
      antirez 提交于
      This is of great interest because allows us to print debugging
      informations that could be of useful when debugging, like in the
      following example:
      
          serverPanic("Unexpected encoding for object %d, %d",
              obj->type, obj->encoding);
      53b8bf2c