Skip to content

fix(server): preserve existing connections after requirepass changes #3443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aviralgarg05 wants to merge 7 commits into
base: unstable
Choose a base branch
from
Open

fix(server): preserve existing connections after requirepass changes #3443

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7e174f4
fix(server): preserve existing connections after requirepass changes
aviralgarg05 Apr 10, 2026
bb21e04
fix(server): initialize passwordless auth on accept
aviralgarg05 Apr 10, 2026
c3233aa
Merge branch 'unstable' into fix-3267-sentinel-existing-connections
jihuayu Apr 15, 2026
3075404
fix(tests): wait for accepted auth connection in regression
aviralgarg05 Apr 16, 2026
1ff5575
Merge branch 'unstable' into fix-3267-sentinel-existing-connections
jihuayu Apr 17, 2026
46a0bf9
fix(server): publish initialized client connections
aviralgarg05 Apr 17, 2026
2b147cf
Merge branch 'unstable' into fix-3267-sentinel-existing-connections
jihuayu Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/server/redis_connection.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,7 @@ class Connection : public EvbufCallbackBase<Connection> {
bool IsAdmin() const { return is_admin_; }
void BecomeAdmin() { is_admin_ = true; }
void BecomeUser() { is_admin_ = false; }
void InitDefaultNamespace() { SetNamespace(kDefaultNamespace); }
std::string GetNamespace() const { return ns_; }
void SetNamespace(std::string ns) { ns_ = std::move(ns); }

Expand Down
18 changes: 13 additions & 5 deletions src/server/worker.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,9 +176,18 @@ void Worker::newTCPConnection(evconnlistener *listener, evutil_socket_t fd, [[ma
}
#endif
auto conn = new redis::Connection(bev, this);
if (srv->GetConfig()->requirepass.empty()) {
conn->BecomeAdmin();
conn->InitDefaultNamespace();
}
conn->SetCB(bev);
bufferevent_enable(bev, EV_READ);

if (auto s = util::GetPeerAddr(fd)) {
auto [ip, port] = std::move(*s);
conn->SetAddr(ip, port);
}

s = AddConnection(conn);
if (!s.IsOK()) {
std::string err_msg = redis::Error({Status::NotOK, s.Msg()});
Expand All @@ -190,11 +199,6 @@ void Worker::newTCPConnection(evconnlistener *listener, evutil_socket_t fd, [[ma
return;
}

if (auto s = util::GetPeerAddr(fd)) {
auto [ip, port] = std::move(*s);
conn->SetAddr(ip, port);
}

if (rate_limit_group_) {
bufferevent_add_to_rate_limit_group(bev, rate_limit_group_);
}
Expand All @@ -210,6 +214,10 @@ void Worker::newUnixSocketConnection(evconnlistener *listener, evutil_socket_t f
bufferevent *bev = bufferevent_socket_new(base, fd, ev_thread_safe_flags);

auto conn = new redis::Connection(bev, this);
if (srv->GetConfig()->requirepass.empty()) {
conn->BecomeAdmin();
conn->InitDefaultNamespace();
}
conn->SetCB(bev);
bufferevent_enable(bev, EV_READ);

Expand Down
2 changes: 1 addition & 1 deletion tests/gocase/integration/replication/replication_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,7 +329,7 @@ func TestReplicationWithLimitSpeed(t *testing.T) {
require.Eventually(t, func() bool {
return slave.LogFileMatches(t, ".*skip count: 1.*")
}, 50*time.Second, 1000*time.Millisecond)
util.WaitForSync(t, slaveClient)
util.WaitForOffsetSync(t, masterClient, slaveClient, 50*time.Second)
Copy link
Copy Markdown
Member

@jihuayu jihuayu Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why we need to change it?

Copy link
Copy Markdown
Author

@aviralgarg05 aviralgarg05 Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WaitForSync only checks master_link_status == up, which is weaker than what this test needs.

In this case we restart the master after a partial SST transfer, so the replica link can come back before the resumed transfer has fully caught up. That was making the test flaky on slower matrix variants, especially -DENABLE_LUAJIT=OFF.

WaitForOffsetSync waits for the master and replica offsets to match, which is the actual condition we care about before checking the replicated key.

require.Equal(t, "b", slaveClient.Get(ctx, "a").Val())
})
}
Expand Down
28 changes: 28 additions & 0 deletions tests/gocase/unit/auth/auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,11 @@ package auth

import (
"context"
"fmt"
"net"
"regexp"
"testing"
"time"

"github.com/apache/kvrocks/tests/gocase/util"
"github.com/stretchr/testify/require"
Expand All @@ -39,6 +43,30 @@ func TestNoAuth(t *testing.T) {
r := rdb.Do(ctx, "AUTH", "foo")
require.ErrorContains(t, r.Err(), "no password")
})

t.Run("Connections accepted before requirepass is set remain usable", func(t *testing.T) {
idleConn := srv.NewTCPClient()
defer func() { require.NoError(t, idleConn.Close()) }()

_, idlePort, err := net.SplitHostPort(idleConn.LocalAddr().String())
require.NoError(t, err)

idleConnPattern := regexp.MustCompile(fmt.Sprintf(`(?:^| )addr=[^ ]*:%s(?: |$)`, idlePort))
require.Eventually(t, func() bool {
return idleConnPattern.MatchString(rdb.ClientList(ctx).Val())
}, 5*time.Second, 10*time.Millisecond)

require.NoError(t, rdb.ConfigSet(ctx, "requirepass", "foobar").Err())

require.NoError(t, idleConn.WriteArgs("PING"))
idleConn.MustRead(t, "+PONG")

newConn := srv.NewTCPClient()
defer func() { require.NoError(t, newConn.Close()) }()

require.NoError(t, newConn.WriteArgs("PING"))
newConn.MustRead(t, "-NOAUTH Authentication required.")
})
}

func TestAuth(t *testing.T) {
Expand Down
4 changes: 4 additions & 0 deletions tests/gocase/util/tcp_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,10 @@ func (c *TCPClient) Close() error {
return c.c.Close()
}

func (c *TCPClient) LocalAddr() net.Addr {
return c.c.LocalAddr()
}

func (c *TCPClient) ReadLine() (string, error) {
r, err := c.r.ReadString('\n')
if err != nil {
Expand Down
Loading