mirror of
https://github.com/valkey-io/valkey.git
synced 2026-07-29 04:34:12 -04:00
BinbinandGitHub
fef4dbf046
When requirepass is enabled, we want command calls to return NOAUTH instead of ERR with the error message. Previously, these checks were all before the auth check: - command existence exist - command arity check - command protected check This may expose information such as whether the server supports the command, whether the configuration item is enabled, etc. This is more of a consistency issue as the same error message is returned when requirepass is enabled, not a security issue. This is a behavior change, though perhaps not a breaking one. We put the auth check into !client_reprocessing_command block, that means the reprocessing command would skip auth check, it's also a behavior change but align with the old behavior before the refactor of reprocessing, so it should be fine. Before: ``` 127.0.0.1:6379> foo bar (error) ERR unknown command 'foo', with args beginning with: 'bar' 127.0.0.1:6379> set foo (error) ERR wrong number of arguments for 'set' command 127.0.0.1:6379> module load foo (error) ERR MODULE command not allowed... ``` After: ``` 127.0.0.1:6379> foo bar (error) NOAUTH Authentication required. 127.0.0.1:6379> set foo (error) NOAUTH Authentication required. 127.0.0.1:6379> module load foo (error) NOAUTH Authentication required. ``` Signed-off-by: Binbin <[email protected]>
72 lines
2.1 KiB
Tcl
72 lines
2.1 KiB
Tcl
set testmodule [file normalize tests/modules/basics.so]
|
|
|
|
start_server {tags {"modules"}} {
|
|
r module load $testmodule
|
|
|
|
test {test module api basics} {
|
|
r test.basics
|
|
} {ALL TESTS PASSED}
|
|
|
|
test {test rm_call auto mode} {
|
|
r hello 2
|
|
set reply [r test.rmcallautomode]
|
|
assert_equal [lindex $reply 0] f1
|
|
assert_equal [lindex $reply 1] v1
|
|
assert_equal [lindex $reply 2] f2
|
|
assert_equal [lindex $reply 3] v2
|
|
r hello 3
|
|
set reply [r test.rmcallautomode]
|
|
assert_equal [dict get $reply f1] v1
|
|
assert_equal [dict get $reply f2] v2
|
|
}
|
|
|
|
test {test get resp} {
|
|
foreach resp {3 2} {
|
|
if {[lsearch $::denytags "resp3"] >= 0} {
|
|
if {$resp == 3} {continue}
|
|
} elseif {$::force_resp3} {
|
|
if {$resp == 2} {continue}
|
|
}
|
|
r hello $resp
|
|
set reply [r test.getresp]
|
|
assert_equal $reply $resp
|
|
r hello 2
|
|
}
|
|
}
|
|
|
|
test "Busy module name" {
|
|
assert_error {ERR Error loading the extension. Please check the server logs.} {r module load $testmodule}
|
|
verify_log_message 0 "*Module name is busy*" 0
|
|
}
|
|
|
|
test "test latency" {
|
|
r config set latency-monitor-threshold 0
|
|
r latency reset
|
|
r test.latency 0
|
|
r test.latency 1
|
|
assert_equal {} [r latency latest]
|
|
assert_equal {} [r latency history test]
|
|
|
|
r config set latency-monitor-threshold 1
|
|
r test.latency 0
|
|
assert_equal 0 [llength [r latency history test]]
|
|
r test.latency 1
|
|
assert_match {*test * 1 1*} [r latency latest]
|
|
r test.latency 2
|
|
assert_match {*test * 2 2*} [r latency latest]
|
|
}
|
|
|
|
test "Unload the module - basics" {
|
|
assert_equal {OK} [r module unload test]
|
|
}
|
|
}
|
|
|
|
start_server {tags {"modules external:skip"} overrides {requirepass mypass enable-module-command no}} {
|
|
test {module command disabled} {
|
|
assert_error "NOAUTH *" {r module load $testmodule}
|
|
|
|
r auth mypass
|
|
assert_error "ERR *MODULE command not allowed*" {r module load $testmodule}
|
|
}
|
|
}
|