【Redis源码】Redis 6 ACL源码详解

/* 
 * 初始化ACL子系统
 * */
void ACLInit(void) {
    Users = raxNew(); // 初始化用户信息
    UsersToLoad = listCreate();
    ACLLog = listCreate();
    ACLInitDefaultUser();
    server.requirepass = NULL; /* Only used for backward compatibility. */
}

/* 初始化默认用户 */
void ACLInitDefaultUser(void) {
    DefaultUser = ACLCreateUser("default",7);
    ACLSetUser(DefaultUser,"+@all",-1); // 默认用户赋予所有命令的权限
    ACLSetUser(DefaultUser,"~*",-1);// 可以操作任何key
    ACLSetUser(DefaultUser,"on",-1);// 默认开启
    ACLSetUser(DefaultUser,"nopass",-1); // 默认不需要密码
}

int ACLLoadConfiguredUsers(void) {
    listIter li;
    listNode *ln;
    listRewind(UsersToLoad,&li);
    while ((ln = listNext(&li)) != NULL) {
        sds *aclrules = listNodeValue(ln);
        sds username = aclrules[0];

        // 检查ACL用户名当中是否存在空格
        if (ACLStringHasSpaces(aclrules[0],sdslen(aclrules[0]))) {
            serverLog(LL_WARNING,"Spaces not allowed in ACL usernames");
            return C_ERR;
        }
        // 创建ACL用户
        user *u = ACLCreateUser(username,sdslen(username));
        if (!u) {
            u = ACLGetUserByName(username,sdslen(username));
            serverAssert(u != NULL);
            ACLSetUser(u,"reset",-1);
        }

        /* Load every rule defined for this user. */
        for (int j = 1; aclrules[j]; j++) {
            // 添加当前用户的所有属性
            if (ACLSetUser(u,aclrules[j],sdslen(aclrules[j])) != C_OK) {
                char *errmsg = ACLSetUserStringError();
                serverLog(LL_WARNING,"Error loading ACL rule '%s' for "
                                     "the user named '%s': %s",
                          aclrules[j],aclrules[0],errmsg);
                return C_ERR;
            }
        }

        /* Having a disabled user in the configuration may be an error,
         * warn about it without returning any error to the caller.
         * 用户没有开启的时候打印到日志里面
         * */
        if (u->flags & USER_FLAG_DISABLED) {
            serverLog(LL_NOTICE, "The user '%s' is disabled (there is no "
                                 "'on' modifier in the user description). Make "
                                 "sure this is not a configuration error.",
                      aclrules[0]);
        }
    }
    return C_OK;
}

int ACLCheckCommandPerm(client *c, int *keyidxptr) 

int ACLGetUserCommandBit(user *u, unsigned long id) {
    uint64_t word, bit;
    // 计算命令在allowed_commands当中对应的bit位
    if (ACLGetCommandBitCoordinates(id,&word,&bit) == C_ERR) return 0;
    return (u->allowed_commands[word] & bit) != 0;
}