missed a typedef keyword

* Drop obsolete initialization calls.
* Use decoder API for DH parameters.
* Enable auto DH parameters if not explicitly used, which should be the
  preferred configuration going forward.

README.md

@@ -104,12 +104,6 @@ Avoid forwarding RREPLAY messages to other masters? WARNING: This setting is dan
 If you would like KeyDB to dump and load directly to AWS S3 this option specifies the bucket.  Using this option with the traditional RDB options will result in KeyDB backing up twice to both locations.  If both are specified KeyDB will first attempt to load from the local dump file and if that fails load from S3.  This requires the AWS CLI tools to be installed and configured which are used under the hood to transfer the data.
 
 
-```
-storage-provider flash /path/to/flash
-```
-If you would like to use KeyDB FLASH storage, specify the storage medium followed by the directory path on your local SSD volume. Note that this feature is still considered experimental and should be used with discretion. See [FLASH Documentation](https://docs.keydb.dev/docs/flash) for more details on configuration and setting up your FLASH volume. 
-
-
 Building KeyDB
 --------------
 
@@ -151,12 +145,6 @@ installed):
     % ./utils/gen-test-certs.sh
     % ./runtest --tls
 
-To build with KeyDB FLASH support, use:
-
-    % make ENABLE_FLASH=yes
-
-***Note that the KeyDB FLASH feature is considered experimental (beta) and should used with discretion
-
 
 Fixing build problems with dependencies or cached build options
 ---------

keydb.conf

@@ -184,7 +184,9 @@ tcp-keepalive 300
 #
 # tls-client-key-file-pass secret
 
-# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange:
+# Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange,
+# required by older versions of OpenSSL (<3.0). Newer versions do not require
+# this configuration and recommend against it.
 #
 # tls-dh-params-file keydb.dh
 
@@ -2071,18 +2073,4 @@ replica-weighting-factor 2
 #
 # By default this is enabled
 #
-active-client-balancing yes
-
-# Enable FLASH support (Experimental Feature)
-# storage-provider flash /path/to/flash/db
-
-# Blob support is a way to store very large objects (>200MB) on disk
-# The files are automatically cleaned up when KeyDB exits and are only
-# for temporary use.  This helps reduce memory pressure for very large
-# data items at the cost of some performance.
-#
-# By default this config is disable.  When enabled the disk associated
-# with KeyDB's working directory will be used.  If there is insufficient
-# disk space or any other I/O error KeyDB will instead use memory.
-#
-# blob-support false
+active-client-balancing yes

pkg/deb/conf/keydb.conf

@@ -2063,17 +2063,3 @@ server-threads 2
 #
 # By default KeyDB sets this to 2.
 replica-weighting-factor 2
-
-# Enable FLASH support (Experimental Feature)
-# storage-provider flash /path/to/flash/db
-
-# Blob support is a way to store very large objects (>200MB) on disk
-# The files are automatically cleaned up when KeyDB exits and are only
-# for temporary use.  This helps reduce memory pressure for very large
-# data items at the cost of some performance.
-# 
-# By default this config is disable.  When enabled the disk associated
-# with KeyDB's working directory will be used.  If there is insufficient
-# disk space or any other I/O error KeyDB will instead use memory.
-# 
-# blob-support false

pkg/deb/deb-buildsource.sh

@@ -19,11 +19,6 @@ elif [ "$distributor" == "Ubuntu" ]; then
 fi
 codename=$(lsb_release --codename --short)
 date=$(date +%a," "%d" "%b" "%Y" "%T)
-
-# overwrite debian bookworm version until updated
-if [ $codename == "bookworm" ]; then
-    distname=+deb12u1
-fi
 pkg_name=keydb-$majorv:$version$distname
 
 # create build tree

pkg/deb/debian/rules

@@ -4,7 +4,6 @@ include /usr/share/dpkg/buildflags.mk
 
 export BUILD_TLS=yes
 export USE_SYSTEMD=yes
-export ENABLE_FLASH=yes
 export CFLAGS CPPFLAGS LDFLAGS
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 export DEB_LDFLAGS_MAINT_APPEND = -ldl -latomic $(LUA_LDFLAGS)

pkg/deb/debian_dh9/rules

@@ -10,7 +10,6 @@ include /usr/share/dpkg/buildflags.mk
 
 export BUILD_TLS=yes
 export USE_SYSTEMD=yes
-export ENABLE_FLASH=yes
 export CFLAGS CPPFLAGS LDFLAGS
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 export DEB_LDFLAGS_MAINT_APPEND = -ldl -latomic $(LUA_LDFLAGS)

pkg/rpm/keydb_build/keydb_rpm/etc/keydb/keydb.conf

@@ -2063,17 +2063,3 @@ server-threads 2
 #
 # By default KeyDB sets this to 2.
 replica-weighting-factor 2
-
-# Enable FLASH support (Experimental Feature)
-# storage-provider flash /path/to/flash/db
-
-# Blob support is a way to store very large objects (>200MB) on disk
-# The files are automatically cleaned up when KeyDB exits and are only
-# for temporary use.  This helps reduce memory pressure for very large
-# data items at the cost of some performance.
-# 
-# By default this config is disable.  When enabled the disk associated
-# with KeyDB's working directory will be used.  If there is insufficient
-# disk space or any other I/O error KeyDB will instead use memory.
-# 
-# blob-support false

src/redis-cli.h

@@ -98,7 +98,6 @@ extern "C" {
 #define CC_QUIET (1<<1)         /* Don't log connecting errors. */
 
 struct clusterManagerLink;
-typedef struct clusterManagerLink clusterManagerLink;
 
 /* Dict Helpers */
 
@@ -249,12 +248,12 @@ typedef struct clusterManagerReshardTableItem {
 
 /* Info about a cluster internal link. */
 
-typedef struct clusterManagerLink {
+struct clusterManagerLink {
     sds node_name;
     sds node_addr;
     int connected;
     int handshaking;
-} clusterManagerLink;
+};
 
 typedef struct typeinfo {
     char *name;

src/tls.cpp

@@ -46,6 +46,9 @@
 
 #include <sys/stat.h>
 #include <arpa/inet.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/decoder.h>
+#endif
 
 #define REDIS_TLS_PROTO_TLSv1       (1<<0)
 #define REDIS_TLS_PROTO_TLSv1_1     (1<<1)
@@ -154,14 +157,13 @@ void tlsInit(void) {
      */
     #if OPENSSL_VERSION_NUMBER < 0x10100000L
     OPENSSL_config(NULL);
+    SSL_load_error_strings();
+    SSL_library_init();
     #elif OPENSSL_VERSION_NUMBER < 0x10101000L
     OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL);
     #else
     OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG|OPENSSL_INIT_ATFORK, NULL);
     #endif
-    ERR_load_crypto_strings();
-    SSL_load_error_strings();
-    SSL_library_init();
 
 #ifdef USE_CRYPTO_LOCKS
     initCryptoLocks();
@@ -364,20 +366,46 @@ int tlsConfigure(redisTLSContextConfig *ctx_config) {
     if (ctx_config->prefer_server_ciphers)
         SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
 
-#if defined(SSL_CTX_set_ecdh_auto)
+#if ((OPENSSL_VERSION_NUMBER < 0x30000000L) && defined(SSL_CTX_set_ecdh_auto))
     SSL_CTX_set_ecdh_auto(ctx, 1);
 #endif
     SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE);
 
     if (ctx_config->dh_params_file) {
         FILE *dhfile = fopen(ctx_config->dh_params_file, "r");
-        DH *dh = NULL;
         if (!dhfile) {
             serverLog(LL_WARNING, "Failed to load %s: %s", ctx_config->dh_params_file, strerror(errno));
             goto error;
         }
 
-        dh = PEM_read_DHparams(dhfile, NULL, NULL, NULL);
+#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+        EVP_PKEY *pkey = NULL;
+        OSSL_DECODER_CTX *dctx = OSSL_DECODER_CTX_new_for_pkey(
+                &pkey, "PEM", NULL, "DH", OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS, NULL, NULL);
+        if (!dctx) {
+            serverLog(LL_WARNING, "No decoder for DH params.");
+            fclose(dhfile);
+            goto error;
+        }
+        if (!OSSL_DECODER_from_fp(dctx, dhfile)) {
+            serverLog(LL_WARNING, "%s: failed to read DH params.", ctx_config->dh_params_file);
+            OSSL_DECODER_CTX_free(dctx);
+            fclose(dhfile);
+            goto error;
+        }
+
+        OSSL_DECODER_CTX_free(dctx);
+        fclose(dhfile);
+
+        if (SSL_CTX_set0_tmp_dh_pkey(ctx, pkey) <= 0) {
+            ERR_error_string_n(ERR_get_error(), errbuf, sizeof(errbuf));
+            serverLog(LL_WARNING, "Failed to load DH params file: %s: %s", ctx_config->dh_params_file, errbuf);
+            EVP_PKEY_free(pkey);
+            goto error;
+        }
+        /* Not freeing pkey, it is owned by OpenSSL now */
+#else
+        DH *dh = PEM_read_DHparams(dhfile, NULL, NULL, NULL);
         fclose(dhfile);
         if (!dh) {
             serverLog(LL_WARNING, "%s: failed to read DH params.", ctx_config->dh_params_file);
@@ -392,6 +420,11 @@ int tlsConfigure(redisTLSContextConfig *ctx_config) {
         }
 
         DH_free(dh);
+#endif
+    } else {
+#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+        SSL_CTX_set_dh_auto(ctx, 1);
+#endif
     }
 
     /* If a client-side certificate is configured, create an explicit client context */