mirror of
https://codeberg.org/redict/redict.git
synced 2025-01-22 16:18:28 -05:00
31a1439bfd
The way we compared the authentication password using strcmp() allowed an attacker to gain information about the password using a well known class of attacks called "timing attacks". The bug appears to be practically not exploitable in most modern systems running Redis since even using multiple bytes of differences in the input at a time instead of one the difference in running time in in the order of 10 nanoseconds, making it hard to exploit even on LAN. However attacks always get better so we are providing a fix ASAP. The new implementation uses two fixed length buffers and a constant time comparison function, with the goal of: 1) Completely avoid leaking information about the content of the password, since the comparison is always performed between 512 characters and without conditionals. 2) Partially avoid leaking information about the length of the password. About "2" we still have a stage in the code where the real password and the user provided password are copied in the static buffers, we also run two strlen() operations against the two inputs, so the running time of the comparison is a fixed amount plus a time proportional to LENGTH(A)+LENGTH(B). This means that the absolute time of the operation performed is still related to the length of the password in some way, but there is no way to change the input in order to get a difference in the execution time in the comparison that is not just proportional to the string provided by the user (because the password length is fixed). Thus in practical terms the user should try to discover LENGTH(PASSWORD) looking at the whole execution time of the AUTH command and trying to guess a proportionality between the whole execution time and the password length: this appears to be mostly unfeasible in the real world. Also protecting from this attack is not very useful in the case of Redis as a brute force attack is anyway feasible if the password is too short, while with a long password makes it not an issue that the attacker knows the length. |
||
---|---|---|
deps | ||
src | ||
tests | ||
utils | ||
.gitignore | ||
00-RELEASENOTES | ||
BUGS | ||
Changelog | ||
CONTRIBUTING | ||
COPYING | ||
INSTALL | ||
Makefile | ||
MANIFESTO | ||
README | ||
redis.conf | ||
runtest |
Where to find complete Redis documentation? ------------------------------------------- This README is just a fast "quick start" document. You can find more detailed documentation at http://redis.io Building Redis -------------- Redis can be compiled and used on Linux, OSX, OpenBSD, NetBSD, FreeBSD. We support big endian and little endian architectures. It may compile on Solaris derived systems (for instance SmartOS) but our support for this platform is "best effort" and Redis is not guaranteed to work as well as in Linux, OSX, and *BSD there. It is as simple as: % make You can run a 32 bit Redis binary using: % make 32bit After building Redis is a good idea to test it, using: % make test NOTE: if after building Redis with a 32 bit target you need to rebuild it with a 64 bit target you need to perform a "make clean" in the root directory of the Redis distribution. Allocator --------- Selecting a non-default memory allocator when building Redis is done by setting the `MALLOC` environment variable. Redis is compiled and linked against libc malloc by default, with the exception of jemalloc being the default on Linux systems. This default was picked because jemalloc has proven to have fewer fragmentation problems than libc malloc. To force compiling against libc malloc, use: % make MALLOC=libc To compile against jemalloc on Mac OS X systems, use: % make MALLOC=jemalloc Verbose build ------------- Redis will build with a user friendly colorized output by default. If you want to see a more verbose output use the following: % make V=1 Running Redis ------------- To run Redis with the default configuration just type: % cd src % ./redis-server If you want to provide your redis.conf, you have to run it using an additional parameter (the path of the configuration file): % cd src % ./redis-server /path/to/redis.conf It is possible to alter the Redis configuration passing parameters directly as options using the command line. Examples: % ./redis-server --port 9999 --slaveof 127.0.0.1 6379 % ./redis-server /etc/redis/6379.conf --loglevel debug All the options in redis.conf are also supported as options using the command line, with exactly the same name. Playing with Redis ------------------ You can use redis-cli to play with Redis. Start a redis-server instance, then in another terminal try the following: % cd src % ./redis-cli redis> ping PONG redis> set foo bar OK redis> get foo "bar" redis> incr mycounter (integer) 1 redis> incr mycounter (integer) 2 redis> You can find the list of all the available commands here: http://redis.io/commands Installing Redis ----------------- In order to install Redis binaries into /usr/local/bin just use: % make install You can use "make PREFIX=/some/other/directory install" if you wish to use a different destination. Make install will just install binaries in your system, but will not configure init scripts and configuration files in the appropriate place. This is not needed if you want just to play a bit with Redis, but if you are installing it the proper way for a production system, we have a script doing this for Ubuntu and Debian systems: % cd utils % ./install_server The script will ask you a few questions and will setup everything you need to run Redis properly as a background daemon that will start again on system reboots. You'll be able to stop and start Redis using the script named /etc/init.d/redis_<portnumber>, for instance /etc/init.d/redis_6379. Enjoy!