ubeddulla opened a new pull request, #3598: URL: https://github.com/apache/brpc/pull/3598
### What problem does this PR solve? Issue Number: resolve Problem Summary: InputMessenger only authenticates a connection when the protocol registers a verify hook, but redis, mongo and rtmp register none, and redis and rtmp even consume requests inside their parsers where the hook can never run. A server configured with ServerOptions.auth still executes commands from clients that never authenticated, as long as they speak one of these three protocols. nshead, thrift and streaming RPC already fail closed in the same situation. ### What is changed and the side effects? Changed: ParseRedisMessage and ParseRtmpMessage reject input from unauthenticated sockets when the server has an authenticator configured, the same check ParseStreamingMessage got in #3481. mongo goes through the normal message path, so it registers a VerifyMongoRequest shaped like VerifyNsheadRequest and VerifyThriftRequest. Regression tests added for all three protocols; each fails before this change (for example the unauthenticated redis command was executed and answered). Side effects: - Performance effects: one pointer check per request on these paths, nothing when auth is unset. - Breaking backward compatibility: a server that sets ServerOptions.auth and also enables redis_service, mongo_service_adaptor or rtmp_service previously served those clients without any authentication and now rejects them, matching the documented contract of ServerOptions.auth. Redis command-level AUTH implemented via RedisCommandHandler does not rely on ServerOptions.auth and keeps working. --- ### Check List: - Please make sure your changes are compilable. - When providing us with a new feature, it is best to add related tests. - Please follow [Contributor Covenant Code of Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
