Add password authentication to Redis ports (#2952)

* Implement Redis authentication * Throw exception for legacy Ray * Add test * Formatting * Fix bugs in CLI * Fix bugs in Raylet * Move default password to constants.h * Use pytest.fixture * Fix bug * Authenticate using formatted strings * Add missing passwords * Add test * Improve authentication of async contexts * Disable Redis authentication for credis * Update test for credis * Fix rebase artifacts * Fix formatting * Add workaround for issue #3045 * Increase timeout for test * Improve C++ readability * Fixes for CLI * Add security docs * Address comments * Address comments * Adress comments * Use ray.get * Fix lint
2026-06-29 04:27:27 +08:00 · 2018-10-16 22:48:30 -07:00
parent a9e454f6fd
commit a41bbc10ef
22 changed files with 462 additions and 115 deletions
@@ -0,0 +1,65 @@
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+import pytest
+import redis
+
+import ray
+
+
+@pytest.fixture
+def password():
+    random_bytes = os.urandom(128)
+    if hasattr(random_bytes, "hex"):
+        return random_bytes.hex()  # Python 3
+    return random_bytes.encode("hex")  # Python 2
+
+
+@pytest.fixture
+def shutdown_only():
+    yield None
+    # The code after the yield will run as teardown code.
+    ray.shutdown()
+
+
+class TestRedisPassword(object):
+    @pytest.mark.skipif(
+        os.environ.get("RAY_USE_NEW_GCS") != "on"
+        and os.environ.get("RAY_USE_XRAY"),
+        reason="Redis authentication works for raylet and old GCS.")
+    def test_exceptions(self, password, shutdown_only):
+        with pytest.raises(Exception):
+            ray.init(redis_password=password)
+
+    @pytest.mark.skipif(
+        os.environ.get("RAY_USE_NEW_GCS") == "on",
+        reason="New GCS API doesn't support Redis authentication yet.")
+    @pytest.mark.skipif(
+        not os.environ.get("RAY_USE_XRAY"),
+        reason="Redis authentication is not supported in legacy Ray.")
+    def test_redis_password(self, password, shutdown_only):
+        # Workaround for https://github.com/ray-project/ray/issues/3045
+        @ray.remote
+        def f():
+            return 1
+
+        info = ray.init(redis_password=password)
+        redis_address = info["redis_address"]
+        redis_ip, redis_port = redis_address.split(":")
+
+        # Check that we can run a task
+        object_id = f.remote()
+        ray.get(object_id)
+
+        # Check that Redis connections require a password
+        redis_client = redis.StrictRedis(
+            host=redis_ip, port=redis_port, password=None)
+        with pytest.raises(redis.ResponseError):
+            redis_client.ping()
+
+        # Check that we can connect to Redis using the provided password
+        redis_client = redis.StrictRedis(
+            host=redis_ip, port=redis_port, password=password)
+        assert redis_client.ping()