added support for ::auto namespace + support for default user namespace in configuration

src/acl.cpp

@@ -33,6 +33,7 @@ extern "C" {
 }
 #include <fcntl.h>
 #include <ctype.h>
+#include <uuid/uuid.h>
 
 /* =============================================================================
  * Global state for ACLs
@@ -248,7 +249,13 @@ user *ACLCreateUser(const char *name, size_t namelen) {
     if (raxFind(Users,(unsigned char*)name,namelen) != raxNotFound) return NULL;
     user *u = (user*)zmalloc(sizeof(*u), MALLOC_LOCAL);
     u->name = sdsnewlen(name,namelen);
-    u->ns_name = sdsnew("::");
+
+    if (!strcasecmp(cserver.default_user_namespace, "::auto")) {
+        u->ns_name = generateAutoNamespaceName();
+    } else {
+        u->ns_name = sdsnew(cserver.default_user_namespace);
+    }
+
     u->flags = USER_FLAG_DISABLED | g_pserver->acl_pubsub_default;
     u->allowed_subcommands = NULL;
     u->passwords = listCreate();
@@ -675,7 +682,7 @@ sds ACLDescribeUser(user *u) {
     sdsfree(rules);
 
     /* namespace */
-    if (strcmp(u->ns_name, DefaultUser->ns_name) != 0) {
+    if (strcmp(u->ns_name, cserver.default_user_namespace) != 0) {
         res = sdscatlen(res, " ", 1);
         res = sdscatsds(res, u->ns_name);
     }
@@ -815,7 +822,6 @@ void ACLAddAllowedSubcommand(user *u, unsigned long id, const char *sub) {
  * ::<ns>       Sets the namespace for the user.
  *              :: is the default namespace
  *              ::auto will generate a new namespace with a random uuid
- *              (only if the current user is still in the default namespace)
  *
  * The 'op' string must be null terminated. The 'oplen' argument should
  * specify the length of the 'op' string in case the caller requires to pass
@@ -1016,10 +1022,13 @@ int ACLSetUser(user *u, const char *op, ssize_t oplen) {
             return C_ERR;
         }
     } else if (op[0] == ':' && op[1] == ':') {
-        //TODO: implement ::auto
-        sds ns = sdsnewlen(op,oplen);
-        sdsfree(u->ns_name);
-        u->ns_name = ns;
+        if (!strcasecmp(op, "::auto")) {
+            u->ns_name = generateAutoNamespaceName();
+        } else {
+            sds ns = sdsnewlen(op,oplen);
+            sdsfree(u->ns_name);
+            u->ns_name = ns;
+        }
     } else if (!strcasecmp(op,"reset")) {
         serverAssert(ACLSetUser(u,"resetpass",-1) == C_OK);
         serverAssert(ACLSetUser(u,"resetkeys",-1) == C_OK);

src/config.cpp

@@ -2671,7 +2671,7 @@ standardConfig configs[] = {
     createStringConfig("bgsave_cpulist", NULL, IMMUTABLE_CONFIG, EMPTY_STRING_IS_NULL, g_pserver->bgsave_cpulist, NULL, NULL, NULL),
     createStringConfig("ignore-warnings", NULL, MODIFIABLE_CONFIG, ALLOW_EMPTY_STRING, g_pserver->ignore_warnings, "", NULL, NULL),
     createStringConfig("proc-title-template", NULL, MODIFIABLE_CONFIG, ALLOW_EMPTY_STRING, cserver.proc_title_template, CONFIG_DEFAULT_PROC_TITLE_TEMPLATE, isValidProcTitleTemplate, updateProcTitleTemplate),
-
+    createStringConfig("acl-namespace-default", NULL, IMMUTABLE_CONFIG, ALLOW_EMPTY_STRING, cserver.default_user_namespace, "::", NULL, NULL), //TODO: validation
     /* SDS Configs */
     createSDSConfig("masterauth", NULL, MODIFIABLE_CONFIG | SENSITIVE_CONFIG, EMPTY_STRING_IS_NULL, cserver.default_masterauth, NULL, NULL, updateMasterAuthConfig),
     createSDSConfig("requirepass", NULL, MODIFIABLE_CONFIG | SENSITIVE_CONFIG, EMPTY_STRING_IS_NULL, g_pserver->requirepass, NULL, NULL, updateRequirePass),

src/server.h

@@ -1574,6 +1574,7 @@ struct redisServerConst {
     /* Configuration */
     char *default_masteruser;               /* AUTH with this user and masterauth with master */
     char *default_masterauth;               /* AUTH with this password with master */
+    char *default_user_namespace;           /* default user namespace */
     int verbosity;                  /* Loglevel in keydb.conf */
     int maxidletime;                /* Client timeout in seconds */
     int tcpkeepalive;               /* Set SO_KEEPALIVE if non-zero. */
@@ -2156,6 +2157,7 @@ extern dictType sdsReplyDictType;
 
 /* Namespaces */
 redisNamespace *getNamespace(const char* name);
+sds generateAutoNamespaceName();
 
 /* Modules */
 void moduleInitModulesSystem(void);

tests/unit/introspection.tcl

@@ -161,6 +161,7 @@ start_server {tags {"introspection"}} {
             active-replica
             bind
             set-proc-title
+            acl-namespace-default
         }
 
         if {!$::tls} {

tests/unit/namespace.tcl

@@ -6,6 +6,16 @@ start_server [list overrides [list "dir" $server_path "aclfile" "user-namespaces
     # user b2 on ~* +@all -@dangerous -@admin >b2 ::ns2
     # user default on nopass ~* +@all ::
 
+    test {::auto generates unique namespace} {
+        r ACL setuser auto1 on ~* +@all -@dangerous -@admin >auto ::auto
+        set ns1 [dict get [r ACL getuser auto1] namespace]
+        assert_match "::*-*-*-*" $ns1
+        r ACL setuser auto2 on ~* +@all -@dangerous -@admin >auto ::auto
+        set ns2 [dict get [r ACL getuser auto2] namespace]
+        assert_match "::*-*-*-*" $ns2
+        assert {$ns1 != $ns2}
+    }
+
     test {alice can set keys in multiple databases} {
         r AUTH alice alice
         r SELECT 0
@@ -51,7 +61,7 @@ start_server [list overrides [list "dir" $server_path "aclfile" "user-namespaces
         assert_equal "bob2" [r GET name]
     }
 
-    test {b2 can see bob's keys are not overwritten by alice} {
+    test {b2 can see bob's keys} {
         r AUTH b2 b2
         r SELECT 0
         assert_equal "bob0" [r GET name]
@@ -60,5 +70,7 @@ start_server [list overrides [list "dir" $server_path "aclfile" "user-namespaces
         r SELECT 2
         assert_equal "bob2" [r GET name]
     }
+
+
 }