feat: update codis fe / proxy with tls; topom updated

codis/admin/codis-fe-admin.sh

@@ -18,6 +18,9 @@ CODIS_FE_DAEMON_FILE=$CODIS_LOG_DIR/codis-fe.out
 COORDINATOR_NAME="filesystem"
 COORDINATOR_ADDR="/tmp/codis"
 CODIS_FE_ADDR="0.0.0.0:9090"
+CODIS_FE_TLS=1
+CODIS_FE_TLS_KEY="/usr/local/src/pika/codis/key.pem"
+CODIS_FE_TLS_CERT="/usr/local/src/pika/codis/cert.pem"
 
 echo $CODIS_FE_CONF_FILE
 
@@ -36,7 +39,7 @@ start)
       fi
     fi
     nohup "$CODIS_FE_BIN" "--assets-dir=${CODIS_FE_ASSETS_DIR}" "--$COORDINATOR_NAME=$COORDINATOR_ADDR" \
-    "--log=$CODIS_FE_LOG_FILE" "--pidfile=$CODIS_FE_PID_FILE" "--log-level=INFO" "--listen=$CODIS_FE_ADDR" > "$CODIS_FE_DAEMON_FILE" 2>&1 < /dev/null &
+    "--tls=$CODIS_FE_TLS" "--tls-key=$CODIS_FE_TLS_KEY" "--tls-cert=$CODIS_FE_TLS_CERT" "--log=$CODIS_FE_LOG_FILE" "--pidfile=$CODIS_FE_PID_FILE" "--log-level=INFO" "--listen=$CODIS_FE_ADDR" > "$CODIS_FE_DAEMON_FILE" 2>&1 < /dev/null &
     ;;
 start-foreground)
     $CODIS_FE_BIN "--assets-dir=${CODIS_FE_ASSETS_DIR}" "--$COORDINATOR_NAME=$COORDINATOR_ADDR" \

codis/cert.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUC/IGKPPBWnAG7MZNPhCUaPmg0oEwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNDAyMDExNTI0MDBaFw0zNDAx
+MjkxNTI0MDBaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQClOgprziC/+nQeHXV5qJA9gdttnx7NV9Cbfc7xox6w
+HRCaavLxdKh//E2o6F492U0i+GSqRYWrQKqWix0myLiZwXEL16mkhL7ANLFSnA8C
+qsMIJf3u6+rN1OtlIVoKP1zWMFRV0inVCZMC0W6KFeVpuTqewc/FC5w/Zh3shPj1
+FJQCOas5SNbpxp9jQQsInur+NeP71r2GcZWD6+H2TCGouMTLFxdL62dbMOGLfm3a
+Yq2d+HVhSMmEkuxXEgaIzxJ04toqQntnq4fnRkkFB7CoXG7AQqHIxKb4bjjnD100
+qDTTPc1wDEhlye/kUbxztF6dv58AUH1ayg1N7pz3EwazAgMBAAGjUzBRMB0GA1Ud
+DgQWBBQtXOfPGePViVYEkHUujTcdtU8RuDAfBgNVHSMEGDAWgBQtXOfPGePViVYE
+kHUujTcdtU8RuDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQA5
+HMCZGl8a/fkG8O8XfdNpKvpb7WWINW5pqNf/Ep1wiqx3Y5/2I+NaCn7NhvxkliPU
+hF/m3ijJ1eXLVjADMwBuW0vaqS0U29c5k/vWto2xx2Uv7dVffvbGTDUitAygGBTi
+9r7A1GnU3PLdA96kUb5RT80tILOSakQYj+KN5QuV4LYmIoUIPlJfn0DOT4D/AoIC
+vn/L77gctOQUfzu/l9saN1uwhgBZ06eQv14BJKnUdpmmMDREiP7lAJtQet1dukh6
+DvS3QUqf91pkOC6tXMHTAAFQ/op+eJVKUMKfFo1oRkXU1sg1/fD25FKO1xaS6afy
+/nr/PY00p+k4s6jw+Fif
+-----END CERTIFICATE-----

codis/cmd/fe/main.go

@@ -4,6 +4,7 @@
 package main
 
 import (
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -56,7 +57,7 @@ func init() {
 func main() {
 	const usage = `
 Usage:
-	codis-fe [--ncpu=N] [--log=FILE] [--log-level=LEVEL] [--assets-dir=PATH] [--pidfile=FILE] (--dashboard-list=FILE|--zookeeper=ADDR [--zookeeper-auth=USR:PWD]|--etcd=ADDR [--etcd-auth=USR:PWD]|--filesystem=ROOT) --listen=ADDR
+	codis-fe [--ncpu=N] [--log=FILE] [--log-level=LEVEL] [--assets-dir=PATH] [--pidfile=FILE] (--dashboard-list=FILE|--zookeeper=ADDR [--zookeeper-auth=USR:PWD]|--etcd=ADDR [--etcd-auth=USR:PWD]|--filesystem=ROOT) --listen=ADDR [--tls-cert=FILE] [--tls-key=FILE] [--tls=N]
 	codis-fe  --version
 
 Options:
@@ -196,10 +197,42 @@ Options:
 	m.MapTo(r, (*martini.Routes)(nil))
 	m.Action(r.Handle)
 
-	l, err := net.Listen("tcp", listen)
-	if err != nil {
-		log.PanicErrorf(err, "listen %s failed", listen)
+	var l net.Listener 
+
+	if n, ok := utils.ArgumentInteger(d, "--tls"); ok && n == 1 {
+
+		// Load server certificate and key
+		certFile, keyFile := utils.ArgumentMust(d, "--tls-cert"), utils.ArgumentMust(d, "--tls-key")
+		if certFile == "" || keyFile == "" {
+			log.Panic("TLS certificate or key file path must be provided")
+		}
+		cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			log.PanicErrorf(err, "failed to load key pair: %s", err)
+		}
+
+		// Create a TLS config
+		tlsConfig := &tls.Config{
+			Certificates: []tls.Certificate{cert},
+		}
+
+		// Create a TLS listener
+		l, err = tls.Listen("tcp", listen, tlsConfig)
+		if err != nil {
+			log.PanicErrorf(err, "listen %s failed", listen)
+		}
+
+
+	}else{
+
+		l, err = net.Listen("tcp", listen)
+		if err != nil {
+			log.PanicErrorf(err, "listen %s failed", listen)
+		}
+
 	}
+
+
 	defer l.Close()
 
 	if s, ok := utils.Argument(d, "--pidfile"); ok {

codis/config/proxy.toml

@@ -21,6 +21,9 @@ admin_addr = "0.0.0.0:11080"
 
 # Set bind address for proxy, proto_type can be "tcp", "tcp4", "tcp6", "unix" or "unixpacket".
 proto_type = "tcp4"
+#proxy_tls = true
+#proxy_tls_cert = "/usr/local/src/pika/codis/cert.pem"
+#proxy_tls_key = "/usr/local/src/pika/codis/key.pem"
 proxy_addr = "0.0.0.0:19000"
 
 # Set jodis address & session timeout

codis/key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQClOgprziC/+nQe
+HXV5qJA9gdttnx7NV9Cbfc7xox6wHRCaavLxdKh//E2o6F492U0i+GSqRYWrQKqW
+ix0myLiZwXEL16mkhL7ANLFSnA8CqsMIJf3u6+rN1OtlIVoKP1zWMFRV0inVCZMC
+0W6KFeVpuTqewc/FC5w/Zh3shPj1FJQCOas5SNbpxp9jQQsInur+NeP71r2GcZWD
+6+H2TCGouMTLFxdL62dbMOGLfm3aYq2d+HVhSMmEkuxXEgaIzxJ04toqQntnq4fn
+RkkFB7CoXG7AQqHIxKb4bjjnD100qDTTPc1wDEhlye/kUbxztF6dv58AUH1ayg1N
+7pz3EwazAgMBAAECggEANou0MAXTGv2wQtbf1uN2hs+tZIGg1hJ0/DgqzuvWcDaQ
+KiI/hMXJ8MKW0rmvjwSDahWNiga8i54kEuHnJEwkYSIS02GFkBoArQxYM9jwPaWp
+EDIWpD7++6ecdHzvsC1d1RoMZW6lv75S6Z3BO9XhsCblus5p7HeaQ/XO0CvP0nxJ
+SxT1Mj6U0dkiGVPWmmsKuWacYUkbYLeOh0s+T298vm5sRaECvewqwGSQYO8EJVaW
+c/sFfJPPwONRGK3+Ggt/Puq6z+6i8baiXnMYHBhHhxdHN8fgRjGW+J+fYddOmd90
+Sfr+OeECnqXKvIQdnH3WOOzvSF8oP0/Si7dEu8mF1QKBgQC1erZifnvnKPTn2Y7t
+lfdbP9tbuBo4e6PXKf7oy3gEMb7DBoXlLrytnyKS2CnNfw3y+Cptk6sHvCRlf00h
+1WSQqLf7+6LvwqZunhLD+lIqbBeYb6FnjU32HTyTA37nojO9G7F+4uUktWtAp5TV
+zp04k/lK4jFC63/GWc9/iHauZQKBgQDpEtYgGcmtCv2+9pKHfKIqC3Ma2HzV9EsW
+VTgVjRZWxSIxeblPI8GqCEPB0Wjn/GcZ83MIpGH4RlPkZVM1z8DkWEBn9OxQysCl
+t8UEIysAParbwdXQ4bLeVmRO8eEXhSSRQgyIPGHQ+oNECbZftnkMIMZqNIP5Tz3C
+mg4zfjDjNwKBgCDWwrgR8TPEGoT1vkJJt8fgRz5SkxQTc3NU2xae8um3YrCBtqrh
+CS1VtXji+rV/vzNvKqZHaVRt/BwNrBRqO9ddYGWNhE9kZp9vpS+nVUTt6FsiIA/P
+5wKZCcQEhus9U6VtpHG0dwhsd6rsaCdESvjY9exR/93/JVDsIXsPY4JtAoGAXCjg
+lkzcHBpuf2YMRpqXnLxuRT05D3jLgAcuaAcjwCeu/5U8GvjuiQc/k5H0Q1bghbhn
+0hD91Cgq3/LY1jxR73id7v0/vCqPxndF5f7p7+xydPbOTwwPqC7M9xJZiO1SqkVN
+o0kM/I8x/GNCw9HpR0xmaHRfguM8bohv+Rh6yD0CgYAfEVhTk+fXshrMeH9qdEwH
+AzfQaQtPpQISgoTADT2ZDkZSSDOuVtMK0L/ZvAAeL+jbQh3RJayARfp2o8BnD12U
+YIaBq9OC8JUZbG71e93zY/zv4HmZdK/RymmwM2jv9UxTnQPpnHRuVcYF0HZpZSWJ
+Xf12eCJQmM/HGdynEvZtcw==
+-----END PRIVATE KEY-----

codis/pkg/models/proxy.go

@@ -11,6 +11,9 @@ type Proxy struct {
 
 	ProtoType string `json:"proto_type"`
 	ProxyAddr string `json:"proxy_addr"`
+	ProxyTLS  bool   `json:"proxy_tls"`
+	ProxyTLSCert string `json:"proxy_tls_cert"`
+	ProxyTLSKey string `json:"proxy_tls_key"`
 
 	JodisPath string `json:"jodis_path,omitempty"`
 

codis/pkg/models/store.go

@@ -123,6 +123,25 @@ func (s *Store) Release() error {
 	return s.client.Delete(s.LockPath())
 }
 
+func (s *Store) ReleaseByToken(token string) error {
+	b, err := s.client.Read(s.LockPath(),false)
+	if err != nil {
+		return err
+	}
+
+	if b != nil {
+		t, err := Decode(b); 
+		if err != nil {
+			return err
+		}
+		if t.Token == token {
+			return s.Release()
+		}
+	}
+
+	return nil
+}
+
 func (s *Store) LoadTopom(must bool) (*Topom, error) {
 	return LoadTopom(s.client, s.product, must)
 }

codis/pkg/models/topom.go

@@ -18,3 +18,11 @@ type Topom struct {
 func (t *Topom) Encode() []byte {
 	return jsonEncode(t)
 }
+
+func Decode(b []byte) (*Topom, error) {
+	s := &Topom{}
+	if err := jsonDecode(s, b); err != nil {
+		return nil,err
+	}
+	return s,nil
+}

codis/pkg/proxy/config.go

@@ -37,6 +37,9 @@ admin_addr = "0.0.0.0:11080"
 
 # Set bind address for proxy, proto_type can be "tcp", "tcp4", "tcp6", "unix" or "unixpacket".
 proto_type = "tcp4"
+#proxy_tls = true
+#proxy_tls_cert = "/usr/local/src/pika/codis/cert.pem"
+#proxy_tls_key = "/usr/local/src/pika/codis/key.pem"
 proxy_addr = "0.0.0.0:19000"
 
 # Set jodis address & session timeout
@@ -166,6 +169,9 @@ type Config struct {
 
 	ProxyDataCenter      string         `toml:"proxy_datacenter" json:"proxy_datacenter"`
 	ProxyMaxClients      int            `toml:"proxy_max_clients" json:"proxy_max_clients"`
+	ProxyTLS	     bool 	    `toml:"proxy_tls" json:"proxy_tls"`
+	ProxyTLSCert         string         `toml:"proxy_tls_cert" json:"proxy_tls_cert"`
+	ProxyTLSKey          string         `toml:"proxy_tls_key" json:"proxy_tls_key"`
 	ProxyMaxOffheapBytes bytesize.Int64 `toml:"proxy_max_offheap_size" json:"proxy_max_offheap_size"`
 	ProxyHeapPlaceholder bytesize.Int64 `toml:"proxy_heap_placeholder" json:"proxy_heap_placeholder"`
 

codis/pkg/proxy/proxy.go

@@ -4,6 +4,7 @@
 package proxy
 
 import (
+	"crypto/tls"
 	"fmt"
 	"net"
 	"net/http"
@@ -103,19 +104,54 @@ func New(config *Config) (*Proxy, error) {
 
 func (p *Proxy) setup(config *Config) error {
 	proto := config.ProtoType
-	if l, err := net.Listen(proto, config.ProxyAddr); err != nil {
-		return errors.Trace(err)
+
+	var l net.Listener
+	var err error
+
+	if config.ProxyTLS {
+		log.Printf("TLS configuration: cert = %s, key = %s", config.ProxyTLSCert, config.ProxyTLSKey)
+
+		// Load the TLS certificate
+		cert, err := tls.LoadX509KeyPair(config.ProxyTLSCert, config.ProxyTLSKey)
+		if err != nil {
+			return errors.Trace(err)
+		}
+
+		// Set up TLS configuration to use TLS 1.2 or higher
+		tlsConfig := &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			MinVersion:   tls.VersionTLS12,
+		}
+
+		// Create a TLS listener
+		l, err = tls.Listen(proto, config.ProxyAddr, tlsConfig)
+		if err != nil {
+			return errors.Trace(err)
+		}
 	} else {
-		p.lproxy = l
+		log.Printf("Setting up a non-TLS listener")
 
-		x, err := utils.ReplaceUnspecifiedIP(proto, l.Addr().String(), config.HostProxy)
+		// Create a non-TLS listener
+		l, err = net.Listen(proto, config.ProxyAddr)
 		if err != nil {
-			return err
+			return errors.Trace(err)
 		}
-		p.model.ProtoType = proto
-		p.model.ProxyAddr = x
 	}
 
+	// Common setup for both TLS and non-TLS
+	p.lproxy = l
+
+	// Replace unspecified IP address with the specific host proxy address
+	x, err := utils.ReplaceUnspecifiedIP(proto, l.Addr().String(), config.HostProxy)
+	if err != nil {
+		return err
+	}
+
+	// Update proxy model
+	p.model.ProtoType = proto
+	p.model.ProxyAddr = x
+
+
 	proto = "tcp"
 	if l, err := net.Listen(proto, config.AdminAddr); err != nil {
 		return errors.Trace(err)

codis/pkg/topom/config.go

@@ -50,9 +50,10 @@ migration_async_numkeys = 500
 migration_timeout = "30s"
 
 # Set configs for redis sentinel.
-sentinel_check_server_state_interval = "5s"
-sentinel_check_master_failover_interval = "1s"
-sentinel_master_dead_check_times = 5
+sentinel_check_server_state_interval = "10s"
+sentinel_check_master_failover_interval = "2s"
+sentinel_master_dead_check_times = 10
+sentinel_check_offline_server_interval = "2s"
 sentinel_client_timeout = "10s"
 sentinel_quorum = 2
 sentinel_parallel_syncs = 1
@@ -86,6 +87,7 @@ type Config struct {
 	SentinelCheckServerStateInterval    timesize.Duration `toml:"sentinel_check_server_state_interval" json:"sentinel_client_timeout"`
 	SentinelCheckMasterFailoverInterval timesize.Duration `toml:"sentinel_check_master_failover_interval" json:"sentinel_check_master_failover_interval"`
 	SentinelMasterDeadCheckTimes        int8              `toml:"sentinel_master_dead_check_times" json:"sentinel_master_dead_check_times"`
+	SentinelCheckOfflineServerInterval  timesize.Duration `toml:"sentinel_check_offline_server_interval" json:"sentinel_check_offline_server_interval"`
 	SentinelClientTimeout               timesize.Duration `toml:"sentinel_client_timeout" json:"sentinel_client_timeout"`
 	SentinelQuorum                      int               `toml:"sentinel_quorum" json:"sentinel_quorum"`
 	SentinelParallelSyncs               int               `toml:"sentinel_parallel_syncs" json:"sentinel_parallel_syncs"`

codis/pkg/topom/topom.go

@@ -168,7 +168,8 @@ func (s *Topom) Close() error {
 	defer s.store.Close()
 
 	if s.online {
-		if err := s.store.Release(); err != nil {
+		err := s.store.ReleaseByToken(s.model.Token); 
+		if err != nil {
 			log.ErrorErrorf(err, "store: release lock of %s failed", s.config.ProductName)
 			return errors.Errorf("store: release lock of %s failed", s.config.ProductName)
 		}