apache / apache/kvrocks

Disable "plain" server when using (m)TLS

Open
#1,545 5 comments 0 reactions 1 assignee Claimed by @sachinrao8312 View on GitHub
A-security enhancement good first issue help wanted
Dominant language
C++
Stars
4.4k
Forks
658
Avg merge
1d 20h
Merged PRs (30d)
10

Description

### Search before asking

- [X] I had searched in the [issues](https://github.com/apache/kvrocks/issues) and found no similar issues.

### Motivation

Usually, when we want to enable (m)TLS connections on Redis, we first disable the `port` parameter by setting it to 0 in order to have only one "endpoint", the TLS one:

> The `tls-port` configuration directive enables accepting SSL/TLS connections on the specified port. This is in addition to listening on port for TCP connections, so it is possible to access Redis on different ports using TLS and non-TLS connections simultaneously.
> You may specify `port 0` to disable the non-TLS port completely.

Source : https://redis.io/docs/management/security/encryption/

On Kvrocks though, it seems impossible to do the same. When we enable TLS through the various settings such as `tls-port`, using version 2.4.0, it is not possible to disable the non TLS endpoint. When setting `port` to 0, we get an error "out of numeric range". When we set `port` to the same value as `tls-port`, we can only reach the non-TLS version etc.

### Solution

It would be nice if we could disable the non-TLS endpoint when enabling TLS.

As I can see in the code, right now the `port` must be set between 1 and PORT_MAX - 1. We could check:

* If `tls-port` is enabled ;
* And `port` is set to 0 ;

Then disable the non-TLS endpoint.

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.