Merge remote-tracking branch 'origin/unstable' into race-empty-primary-with-test

Author: zhijun42

.github/workflows/daily.yml

@@ -1253,7 +1253,7 @@ jobs:
           version: 13.2
           shell: bash
           run: |
-            sudo pkg install -y bash gmake lang/tcl86 lang/tclx
+            sudo pkg install -y bash gmake lang/tcl86 lang/tclX
             gmake
             ./runtest --single unit/keyspace --single unit/auth --single unit/networking --single unit/protocol
 

README.md

@@ -52,6 +52,13 @@ as libsystemd-dev on Debian/Ubuntu or systemd-devel on CentOS) and run:
 
     % make USE_SYSTEMD=yes
 
+Since Valkey version 8.1, `fast_float` has been introduced as an optional 
+dependency, which can speed up sorted sets and other commands that use 
+the double datatype. To build with `fast_float` support, you'll need a 
+C++ compiler and run:
+
+    % make USE_FAST_FLOAT=yes
+
 To append a suffix to Valkey program names, use:
 
     % make PROG_SUFFIX="-alt"

sentinel.conf

@@ -119,8 +119,11 @@ sentinel monitor mymaster 127.0.0.1 6379 2
 # In the Valkey servers side, the ACL to provide just minimal access to
 # Sentinel instances, should be configured along the following lines:
 #
-#     user sentinel-user >somepassword +client +subscribe +publish \
+#     user sentinel-user >somepassword +subscribe +publish +failover +script|kill \
 #                        +ping +info +multi +slaveof +config +client +exec &__sentinel__:hello on
+#
+# Since Valkey Sentinel 9.0, the sentinel user requires the +failover permission
+# on all monitored Valkey instances for proper operation.
 
 # sentinel down-after-milliseconds <master-name> <milliseconds>
 #

src/acl.c

@@ -33,6 +33,8 @@
 #include <fcntl.h>
 #include <ctype.h>
 
+#include "script.h"
+
 /* =============================================================================
  * Global state for ACLs
  * ==========================================================================*/
@@ -1541,11 +1543,25 @@ user *ACLGetUserByName(const char *name, size_t namelen) {
  * ACL permission checks
  * ==========================================================================*/
 
-/* Check if the key can be accessed by the selector.
+/* Checks whether a given key is allowed for the specified ACL selector.
+ *
+ * The function evaluates the key against the selector's patterns, taking into account
+ * the requested key access flags (read/write) and whether the key should be
+ * treated as a prefix. If the selector has the SELECTOR_FLAG_ALLKEYS flag set,
+ * the check always succeeds.
  *
- * If the selector can access the key, ACL_OK is returned, otherwise
- * ACL_DENIED_KEY is returned. */
-static int ACLSelectorCheckKey(aclSelector *selector, const char *key, int keylen, int keyspec_flags) {
+ * - selector The ACL selector containing the allowed key patterns.
+ * - key           Pointer to the key string to check.
+ * - keylen        Length of the key in bytes.
+ * - keyspec_flags Bitmask of requested key operations (e.g., CMD_KEY_ACCESS,
+ *                 CMD_KEY_INSERT, CMD_KEY_DELETE, CMD_KEY_UPDATE).
+ * - is_prefix     If true, the key is compared as a prefix against the selector's
+ *                 patterns using prefixmatchlen rather than a full string match.
+ *
+ * This function returns ACL_OK if the key matches at least one pattern that allows the requested
+ * operations; otherwise ACL_DENIED_KEY.
+ */
+static int ACLSelectorCheckKey(aclSelector *selector, const char *key, int keylen, int keyspec_flags, bool is_prefix) {
     /* The selector can access any key */
     if (selector->flags & SELECTOR_FLAG_ALLKEYS) return ACL_OK;
 
@@ -1564,6 +1580,12 @@ static int ACLSelectorCheckKey(aclSelector *selector, const char *key, int keyle
         keyPattern *pattern = listNodeValue(ln);
         if ((pattern->flags & key_flags) != key_flags) continue;
         size_t plen = sdslen(pattern->pattern);
+        if (is_prefix) {
+            if (prefixmatchlen(pattern->pattern, plen, key, keylen, 0))
+                return ACL_OK;
+            else
+                continue;
+        }
         if (stringmatchlen(pattern->pattern, plen, key, keylen, 0)) return ACL_OK;
     }
     return ACL_DENIED_KEY;
@@ -1688,7 +1710,7 @@ static int ACLSelectorCheckCmd(aclSelector *selector,
         keyReference *resultidx = result->keys;
         for (int j = 0; j < result->numkeys; j++) {
             int idx = resultidx[j].pos;
-            ret = ACLSelectorCheckKey(selector, argv[idx]->ptr, sdslen(argv[idx]->ptr), resultidx[j].flags);
+            ret = ACLSelectorCheckKey(selector, argv[idx]->ptr, sdslen(argv[idx]->ptr), resultidx[j].flags, false);
             if (ret != ACL_OK) {
                 if (keyidxptr) *keyidxptr = resultidx[j].pos;
                 return ret;
@@ -1721,13 +1743,30 @@ static int ACLSelectorCheckCmd(aclSelector *selector,
     return ACL_OK;
 }
 
-/* Check if the key can be accessed by the client according to
- * the ACLs associated with the specified user according to the
- * keyspec access flags.
+/* Checks whether the given user has permission to access a specified key.
  *
- * If the user can access the key, ACL_OK is returned, otherwise
- * ACL_DENIED_KEY is returned. */
-int ACLUserCheckKeyPerm(user *u, const char *key, int keylen, int flags) {
+ * This function verifies the access control list (ACL) permissions for a user on a key.
+ * If the user pointer is  NULL, the connection is considered authorized to run any
+ * command and the function returns  ACL_OK.  Otherwise, the function iterates
+ * through the user's ACL selectors and returns  ACL_OK as soon as any selector
+ * grants permission.  If no selector grants permission,  ACL_DENIED_KEY is returned.
+ *
+ * Input parameters:
+ *
+ * - u Pointer to a user structure. If  NULL, the user is treated as
+ *    having unrestricted access.
+ * - key Pointer to the key string to check.
+ * - keylen Length of the key string in bytes.
+ * - flags Flags that may influence selector checks (implementation-specific).
+ * - is_prefix true if key should be treated as a prefix in selector
+ *    evaluation; false otherwise.
+ *
+ * Returns ACL_OK if access is granted, ACL_DENIED_KEY if access is denied.
+ *
+ * NOTE: The function performs no modification of the  user structure or the key;
+ *       it only evaluates read-only selectors.
+ */
+int ACLUserCheckKeyPerm(user *u, const char *key, int keylen, int flags, bool is_prefix) {
     listIter li;
     listNode *ln;
 
@@ -1738,7 +1777,7 @@ int ACLUserCheckKeyPerm(user *u, const char *key, int keylen, int flags) {
     listRewind(u->selectors, &li);
     while ((ln = listNext(&li))) {
         aclSelector *s = (aclSelector *)listNodeValue(ln);
-        if (ACLSelectorCheckKey(s, key, keylen, flags) == ACL_OK) {
+        if (ACLSelectorCheckKey(s, key, keylen, flags, is_prefix) == ACL_OK) {
             return ACL_OK;
         }
     }
@@ -2546,7 +2585,7 @@ void ACLLoadUsersAtStartup(void) {
 typedef struct ACLLogEntry {
     uint64_t count;             /* Number of times this happened recently. */
     int reason;                 /* Reason for denying the command. ACL_DENIED_*. */
-    int context;                /* Toplevel, Lua or MULTI/EXEC? ACL_LOG_CTX_*. */
+    int context;                /* Toplevel, Lua, Script or MULTI/EXEC? ACL_LOG_CTX_*. */
     sds object;                 /* The key name or command name. */
     sds username;               /* User the client is authenticated with. */
     mstime_t ctime;             /* Milliseconds time of last update to this entry. */
@@ -2654,6 +2693,15 @@ void addACLLogEntry(client *c, int reason, int context, int argpos, sds username
     client *realclient = server.current_client ? server.current_client : c;
 
     le->cinfo = catClientInfoString(sdsempty(), realclient, 0);
+
+    if (context == ACL_LOG_CTX_SCRIPT &&
+        strcmp(scriptGetRunningEngineName(), "LUA") == 0) {
+        /* For backward compatibility, we track that it's Lua using a special
+         * lua ACL log context. Any other scripting language is just "script" in
+         * the ACL log. */
+        context = ACL_LOG_CTX_LUA;
+    }
+
     le->context = context;
 
     /* Try to match this entry with past ones, to see if we can just
@@ -3044,6 +3092,7 @@ void aclCommand(client *c) {
             case ACL_LOG_CTX_MULTI: ctxstr = "multi"; break;
             case ACL_LOG_CTX_LUA: ctxstr = "lua"; break;
             case ACL_LOG_CTX_MODULE: ctxstr = "module"; break;
+            case ACL_LOG_CTX_SCRIPT: ctxstr = "script"; break;
             default: ctxstr = "unknown";
             }
             addReplyBulkCString(c, ctxstr);

src/aof.c

@@ -1452,7 +1452,14 @@ int loadSingleAppendOnlyFile(char *filename) {
 
         if (fseek(fp, 0, SEEK_SET) == -1) goto readerr;
         rioInitWithFile(&rdb, fp);
-        if (rdbLoadRio(&rdb, RDBFLAGS_AOF_PREAMBLE, NULL) != C_OK) {
+        rdbSaveInfo rsi = RDB_SAVE_INFO_INIT;
+        int rdb_flags = RDBFLAGS_AOF_PREAMBLE;
+        int rsi_is_valid = 0;
+        if (iAmPrimary()) {
+            if (server.repl_backlog == NULL) createReplicationBacklog();
+            rdb_flags |= RDBFLAGS_FEED_REPL;
+        }
+        if (rdbLoadRio(&rdb, rdb_flags, &rsi) != RDB_OK) {
             if (old_style)
                 serverLog(LL_WARNING, "Error reading the RDB preamble of the AOF file %s, AOF loading aborted",
                           filename);
@@ -1462,10 +1469,15 @@ int loadSingleAppendOnlyFile(char *filename) {
             ret = AOF_FAILED;
             goto cleanup;
         } else {
+            /* Restore the replication ID / offset from the RDB file. */
+            rsi_is_valid = rdbRestoreOffsetFromSaveInfo(&rsi, true);
             loadingAbsProgress(ftello(fp));
             last_progress_report_size = ftello(fp);
             if (old_style) serverLog(LL_NOTICE, "Reading the remaining AOF tail...");
         }
+        /* If the AOF didn't contain replication info, it's not possible to
+         * support partial resync, so we can free the backlog to save memory. */
+        if (!rsi_is_valid && server.repl_backlog && listLength(server.replicas) == 0) freeReplicationBacklog();
     }
 
     /* Read the actual AOF file, in REPL format, command by command. */
@@ -1910,7 +1922,7 @@ int rewriteSortedSetObject(rio *r, robj *key, robj *o) {
                     return 0;
                 }
             }
-            sds ele = node->ele;
+            sds ele = zslGetNodeElement(node);
             if (!rioWriteBulkDouble(r, node->score) || !rioWriteBulkString(r, ele, sdslen(ele))) {
                 hashtableResetIterator(&iter);
                 return 0;
@@ -2400,8 +2412,10 @@ int rewriteAppendOnlyFile(char *filename) {
     startSaving(RDBFLAGS_AOF_PREAMBLE);
 
     if (server.aof_use_rdb_preamble) {
+        rdbSaveInfo rsi, *rsiptr;
+        rsiptr = rdbPopulateSaveInfo(&rsi);
         int error;
-        if (rdbSaveRio(REPLICA_REQ_NONE, &aof, &error, RDBFLAGS_AOF_PREAMBLE, NULL) == C_ERR) {
+        if (rdbSaveRio(REPLICA_REQ_NONE, &aof, &error, RDBFLAGS_AOF_PREAMBLE, rsiptr) == C_ERR) {
             errno = error;
             goto werr;
         }

src/call_reply.c

@@ -33,6 +33,7 @@
 #define REPLY_FLAG_ROOT (1 << 0)
 #define REPLY_FLAG_PARSED (1 << 1)
 #define REPLY_FLAG_RESP3 (1 << 2)
+#define REPLY_FLAG_EXACT_TYPE (1 << 3)
 
 /* --------------------------------------------------------
  * An opaque struct used to parse a RESP protocol reply and
@@ -83,7 +84,9 @@ static void callReplyNullBulkString(void *ctx, const char *proto, size_t proto_l
 
 static void callReplyNullArray(void *ctx, const char *proto, size_t proto_len) {
     CallReply *rep = ctx;
-    callReplySetSharedData(rep, VALKEYMODULE_REPLY_NULL, proto, proto_len, 0);
+    int type = rep->flags & REPLY_FLAG_EXACT_TYPE ? VALKEYMODULE_REPLY_ARRAY_NULL
+                                                  : VALKEYMODULE_REPLY_NULL;
+    callReplySetSharedData(rep, type, proto, proto_len, 0);
 }
 
 static void callReplyBulkString(void *ctx, const char *str, size_t len, const char *proto, size_t proto_len) {
@@ -102,7 +105,9 @@ static void callReplyError(void *ctx, const char *str, size_t len, const char *p
 
 static void callReplySimpleStr(void *ctx, const char *str, size_t len, const char *proto, size_t proto_len) {
     CallReply *rep = ctx;
-    callReplySetSharedData(rep, VALKEYMODULE_REPLY_STRING, proto, proto_len, 0);
+    int type = rep->flags & REPLY_FLAG_EXACT_TYPE ? VALKEYMODULE_REPLY_SIMPLE_STRING
+                                                  : VALKEYMODULE_REPLY_STRING;
+    callReplySetSharedData(rep, type, proto, proto_len, 0);
     rep->len = len;
     rep->val.str = str;
 }
@@ -306,6 +311,7 @@ int callReplyType(CallReply *rep) {
 
 /* Return reply string as buffer and len. Applicable to:
  * - VALKEYMODULE_REPLY_STRING
+ * - VALKEYMODULE_REPLY_SIMPLE_STRING
  * - VALKEYMODULE_REPLY_ERROR
  *
  * The return value is borrowed from CallReply, so it must not be freed
@@ -316,7 +322,9 @@ int callReplyType(CallReply *rep) {
  */
 const char *callReplyGetString(CallReply *rep, size_t *len) {
     callReplyParse(rep);
-    if (rep->type != VALKEYMODULE_REPLY_STRING && rep->type != VALKEYMODULE_REPLY_ERROR) return NULL;
+    if (rep->type != VALKEYMODULE_REPLY_STRING &&
+        rep->type != VALKEYMODULE_REPLY_SIMPLE_STRING &&
+        rep->type != VALKEYMODULE_REPLY_ERROR) return NULL;
     if (len) *len = rep->len;
     return rep->val.str;
 }
@@ -563,3 +571,14 @@ CallReply *callReplyCreateError(sds reply, void *private_data) {
     listAddNodeTail(deferred_error_list, sdsnew(err_buff));
     return callReplyCreate(err_buff, deferred_error_list, private_data);
 }
+
+/* Enable exact reply type parsing to preserve type distinctions.
+ *
+ * This flag maintains the distinction between simple strings and bulk strings,
+ * as well as preserving RESP2's distinction between null bulk strings and null arrays
+ * when parsing the CallReply.
+ */
+void enableParseExactReplyTypeFlag(CallReply *rep) {
+    serverAssert(!(rep->flags & REPLY_FLAG_PARSED));
+    rep->flags |= REPLY_FLAG_EXACT_TYPE;
+}

src/call_reply.h

@@ -56,5 +56,6 @@ int callReplyIsResp3(CallReply *rep);
 list *callReplyDeferredErrorList(CallReply *rep);
 void freeCallReply(CallReply *rep);
 CallReply *callReplyCreatePromise(void *private_data);
+void enableParseExactReplyTypeFlag(CallReply *rep);
 
 #endif /* SRC_CALL_REPLY_H_ */

src/cli_common.c

@@ -331,7 +331,7 @@ void parseUri(const char *uri, const char *tool_name, cliConnInfo *connInfo, int
         !strncasecmp(redisTlsscheme, curr, strlen(redisTlsscheme))) {
 #ifdef USE_OPENSSL
         *tls_flag = 1;
-        char *del = strstr(curr, "://");
+        const char *del = strstr(curr, "://");
         curr += (del - curr) + 3;
 #else
         char *copy = strdup(curr);
@@ -341,7 +341,7 @@ void parseUri(const char *uri, const char *tool_name, cliConnInfo *connInfo, int
         exit(1);
 #endif
     } else if (!strncasecmp(scheme, curr, strlen(scheme)) || !strncasecmp(redisScheme, curr, strlen(redisScheme))) {
-        char *del = strstr(curr, "://");
+        const char *del = strstr(curr, "://");
         curr += (del - curr) + 3;
     } else {
         fprintf(stderr, "Invalid URI scheme\n");