From b27c6d3a734d1ac1ed80f0bada717a959f757d98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20Pavl=C3=AD=C4=8Dek?= Date: Thu, 18 Jun 2026 15:47:42 +0200 Subject: [PATCH] xxx --- valkey/chaos.go | 2 +- valkey/main.go | 26 +++++++++++++++++--------- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/valkey/chaos.go b/valkey/chaos.go index d552e56..588f950 100644 --- a/valkey/chaos.go +++ b/valkey/chaos.go @@ -679,7 +679,7 @@ func runWorker(ws []WorkerConfig, collectorURL string) int { func buildWorkers(ws []WorkerConfig, cc *chaosCtx) []*worker { workers := make([]*worker, 0, len(ws)) for _, wc := range ws { - opts := optionsFromConn(wc.Host, wc.Port, wc.Password, wc.DB, wc.TLS) + opts := optionsFromConn(wc.Host, wc.Port, wc.Password, wc.DB, wc.TLS, "") w := &worker{cfg: wc, rdb: redis.NewClient(opts), cc: cc} if wc.Role == "bloater" && wc.ValueBytes > 0 { w.bloatBuf = make([]byte, wc.ValueBytes) diff --git a/valkey/main.go b/valkey/main.go index 086af85..bf38f27 100644 --- a/valkey/main.go +++ b/valkey/main.go @@ -139,14 +139,14 @@ func applyFlagOverrides(cfg *Config, host string, port int, password string, tls return nil } -func optionsFromConn(host string, port int, password string, db int, useTLS bool) *redis.Options { +func optionsFromConn(host string, port int, password string, db int, useTLS bool, tlsServerName string) *redis.Options { opts := &redis.Options{ Addr: fmt.Sprintf("%s:%d", host, port), Password: password, DB: db, } if useTLS { - opts.TLSConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: tlsRootCAs} + opts.TLSConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: tlsRootCAs, ServerName: tlsServerName} } return opts } @@ -155,13 +155,20 @@ func optionsFromConn(host string, port int, password string, db int, useTLS bool // --flush/--inspect modes from either a --conn string or the override flags. // A conn string carries host/port/password/db/TLS, so it stands in for the // override flags; redis.ParseURL maps rediss:// to a TLS config. --tls-ca is -// honoured in both paths so a local run can trust a non-system CA. -func buildConnOptions(conn, host string, port int, password string, tlsEnable bool, tlsCAPath string) (*redis.Options, error) { +// honoured in both paths so a local run can trust a non-system CA. --tls-servername +// overrides the name TLS verifies against, which is needed when dialing a Zerops +// public-port IP whose cert only carries internal DNS SANs (e.g. valkey1.zerops). +func buildConnOptions(conn, host string, port int, password string, tlsEnable bool, tlsCAPath, tlsServerName string) (*redis.Options, error) { if conn != "" { parsed, err := redis.ParseURL(conn) if err != nil { return nil, fmt.Errorf("--conn parse error: %w", err) } + if tlsCAPath != "" || tlsServerName != "" { + if parsed.TLSConfig == nil { + parsed.TLSConfig = &tls.Config{MinVersion: tls.VersionTLS12} + } + } if tlsCAPath != "" { pem, err := os.ReadFile(tlsCAPath) if err != nil { @@ -171,11 +178,11 @@ func buildConnOptions(conn, host string, port int, password string, tlsEnable bo if !pool.AppendCertsFromPEM(pem) { return nil, fmt.Errorf("tls-ca: no certificates parsed from %s", tlsCAPath) } - if parsed.TLSConfig == nil { - parsed.TLSConfig = &tls.Config{MinVersion: tls.VersionTLS12} - } parsed.TLSConfig.RootCAs = pool } + if tlsServerName != "" { + parsed.TLSConfig.ServerName = tlsServerName + } return parsed, nil } cfg := &Config{} @@ -188,7 +195,7 @@ func buildConnOptions(conn, host string, port int, password string, tlsEnable bo if cfg.Port == 0 { cfg.Port = 6379 } - return optionsFromConn(cfg.Host, cfg.Port, cfg.Password, cfg.DB, cfg.TLS), nil + return optionsFromConn(cfg.Host, cfg.Port, cfg.Password, cfg.DB, cfg.TLS, tlsServerName), nil } func redactPassword(pw string) string { @@ -218,6 +225,7 @@ func main() { passwordOverride := flag.String("password", "", "override password for all workers (local testing)") tlsEnable := flag.Bool("tls", false, "enable TLS for all workers using system root CAs (local testing)") tlsCAPath := flag.String("tls-ca", "", "path to TLS CA cert PEM; enables TLS for all workers (local testing)") + tlsServerName := flag.String("tls-servername", "", "override the hostname TLS verifies against (e.g. valkey1.zerops) when dialing a Zerops public-port IP whose cert has no IP SANs") seedConn := flag.String("conn", "", "Valkey connection string for the cli tool (default test suite, --watch, --seed/--verify/--flush/--inspect) — e.g. redis://default:pw@valkey1:6379 or rediss://...:6380 for TLS; overrides --host/--port/--password/--tls") watchMode := flag.Bool("watch", false, "PING the target on --interval until Ctrl+C, printing each outage's start/recovery/duration and a summary on exit") watchInterval := flag.Duration("interval", 500*time.Millisecond, "probe interval for --watch") @@ -260,7 +268,7 @@ func main() { // One-time commands against a single Valkey, resolved from --conn or the // split --host/--port/--password/--tls[-ca] flags. Covers the default test // suite plus --seed/--verify/--flush/--inspect. - opts, err := buildConnOptions(*seedConn, *hostOverride, *portOverride, *passwordOverride, *tlsEnable, *tlsCAPath) + opts, err := buildConnOptions(*seedConn, *hostOverride, *portOverride, *passwordOverride, *tlsEnable, *tlsCAPath, *tlsServerName) if err != nil { log.Fatalf("connection error: %v", err) }