Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature proposal: high integrity mode #2706

Open
mgravell opened this issue Apr 30, 2024 · 0 comments
Open

Feature proposal: high integrity mode #2706

mgravell opened this issue Apr 30, 2024 · 0 comments

Comments

@mgravell
Copy link
Collaborator

mgravell commented Apr 30, 2024

This is a client-library alternative suggestion to redis/redis#13240, to address the issue of protocol desync going undetected for at least "some" commands, and causing mayhem.

Proposal: "high integrity mode"

  • new ConfigurationOptions option/connection-string/etc; either a true/false enabled flag, or an int that is "every N messages"?
  • adds a correlation identifier (cid) onto every top-level message (probably not inside multi/exec); this could be random or monotonic incrementing (the latter is probably cheaper?) - just opaque bytes used for integrity checking
  • adds a hidden echo {cid} or ping {cid} (depending on what is available) before all commands (at least on the interactive connection, probably not needed on pub/sub, but is possible there via ping)
  • the cid is verified before processing all responses, burning connections if it ever fails and screaming very loudly
  • should possibly focus on the overhauled API - in addition to efficiencies, this already has the concept of "preamble"
  • needs performance tuning and impact measurement
  • need to document / make enquiries about server cost impact ("do you charge by op? are ping/echo included in that?")

Note that in comparison to the attribute version (redis/redis), this isn't much different at the bytes level:

|1\r\n
+cid\r\n
$10\r\n
1029f737sd\r\n
{actual command here}
...
|1\r\n
+cid\r\n
$10\r\n
1029f737sd\r\n
{actual response here}

vs

*2\r\n
$4\r\n
ping\r\n
$10\r\n
1029f737sd\r\n
{actual command here}
...
*10\r\n
1029f737sd\r\n
{actual response here}

request is 4 bytes larger, response is 10 bytes smaller (vs attribute version)

this has the advantage that it would work on virtually every server version, and could be implemented right now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant