Skip to content

Commit b828044

Browse files
murphyjacob4zuiderkwast
authored andcommitted
Authenticate slot migration client on source node to internal user (#2785)
Just setting the authenticated flag actually authenticates to the default user in this case. The default user may be granted no permission to use CLUSTER SYNCSLOTS. Instaed, we now authenticate to the NULL/internal user, which grants access to all commands. This is the same as what we do for replication: https://github.com/valkey-io/valkey/blob/864de555ced5354976ae4f97f44977041556115f/src/replication.c#L4717 Add a test for this case as well. Closes #2783 Signed-off-by: Jacob Murphy <[email protected]>
1 parent 5018b12 commit b828044

File tree

2 files changed

+37
-1
lines changed

2 files changed

+37
-1
lines changed

src/cluster_migrateslots.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1385,7 +1385,7 @@ void initSlotExportJobClient(slotMigrationJob *job) {
13851385
serverAssert(job->type == SLOT_MIGRATION_EXPORT);
13861386
job->client = createClient(job->conn);
13871387
job->conn = NULL;
1388-
job->client->flag.authenticated = 1;
1388+
clientSetUser(job->client, NULL, 1);
13891389
job->client->slot_migration_job = job;
13901390
initClientReplicationData(job->client);
13911391
}

tests/unit/cluster/cluster-migrateslots.tcl

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2116,6 +2116,42 @@ start_cluster 3 3 {tags {logreqres:skip external:skip cluster} overrides {cluste
21162116
}
21172117
}
21182118

2119+
start_cluster 3 0 {tags {logreqres:skip external:skip cluster}} {
2120+
set 16383_slot_tag "{6ZJ}"
2121+
set node0_id [R 0 CLUSTER MYID]
2122+
2123+
test "Import with default user having no permission" {
2124+
# Configure ACLs on both source and target nodes
2125+
R 2 ACL SETUSER admin on >S3cureAdmin! ~* &* +@all
2126+
R 2 ACL SETUSER default off -@all
2127+
R 2 AUTH admin S3cureAdmin!
2128+
2129+
R 0 ACL SETUSER admin on >S3cureAdmin! ~* &* +@all
2130+
R 0 ACL SETUSER default off -@all
2131+
R 0 AUTH admin S3cureAdmin!
2132+
2133+
# Set primaryuser and primaryauth on the source node
2134+
R 2 CONFIG SET primaryuser admin
2135+
R 2 CONFIG SET primaryauth S3cureAdmin!
2136+
2137+
# Populate data before migration
2138+
populate 1000 "$16383_slot_tag:" 1000 -2
2139+
2140+
# Perform one-shot import
2141+
assert_match "OK" [R 2 CLUSTER MIGRATESLOTS SLOTSRANGE 16383 16383 NODE $node0_id]
2142+
set jobname [get_job_name 2 16383]
2143+
wait_for_migration 0 16383
2144+
2145+
# Keys successfully migrated
2146+
assert_match "1000" [R 0 CLUSTER COUNTKEYSINSLOT 16383]
2147+
assert_match "0" [R 2 CLUSTER COUNTKEYSINSLOT 16383]
2148+
2149+
# Migration log shows success on both ends
2150+
assert {[dict get [get_migration_by_name 0 $jobname] state] eq "success"}
2151+
assert {[dict get [get_migration_by_name 2 $jobname] state] eq "success"}
2152+
}
2153+
}
2154+
21192155
start_cluster 3 6 {tags {logreqres:skip external:skip cluster}} {
21202156
set node0_id [R 0 CLUSTER MYID]
21212157
set node1_id [R 1 CLUSTER MYID]

0 commit comments

Comments
 (0)