DiceDB
Add TLS support to DiceDB
To improve security when exposing a DiceDB instance to the open internet, we need to implement TLS support. This will allow encrypted communication between clients and the DiceDB server, protecting data in transit. We should implement support for both HTTPS (for web-based interactions) and Secure RESP (for Redis-compatible clients).
Tasks:
- Research and choose a Go TLS library (e.g., crypto/tls from the standard library)
- Implement TLS configuration:
- Add configuration options for TLS cert and key files
- Create a TLS configuration struct with sensible defaults
- Allow users to customize TLS settings via configuration
- Modify the server to support TLS:
- Update the main listener to use TLS when enabled
- Implement graceful fallback to non-TLS if not configured
- Add HTTPS support:
- Modify HTTP handlers to work with TLS
- Add TLS-specific commands:
- Implement a "TLS" command to query TLS status
- Add ability to switch to TLS mid-session (similar to Redis STARTTLS)
- Testing:
- Add unit tests for TLS configuration and connection handling
- Implement integration tests to verify end-to-end TLS functionality
- Test with various Redis clients to ensure compatibility
- Performance considerations:
- Benchmark TLS vs non-TLS performance
- Implement session caching or resumption if needed for performance
- Consider supporting TLS 1.3 for improved performance and security
Just to drop my update, this doc contains my ongoing research. I guess we will discuss this on thursday call
Hello @tdadadavid,
There has been no activity on this issue for the past 5 days. It would be awesome if you keep posting updates to this issue so that we know you are actively working on it.
We are really eager to close this issue at the earliest, hence if we continue to see the inactivity, we will have to reassign the issue to someone else. We are doing this to ensure that the project maintains its momentum and others are not blocked on this work.
Just drop a comment with the current status of the work or share any issues you are facing. We can always chip in to help you out.
Thanks again.
Hello @tdadadavid,
There has been no activity on this issue for the past 5 days. It would be awesome if you keep posting updates to this issue so that we know you are actively working on it.
We are really eager to close this issue at the earliest, hence if we continue to see the inactivity, we will have to reassign the issue to someone else. We are doing this to ensure that the project maintains its momentum and others are not blocked on this work.
Just drop a comment with the current status of the work or share any issues you are facing. We can always chip in to help you out.
Thanks again.
@JyotinderSingh, please can this be assigned to another person, I am not chanced to work on this now. Thanks for the opportunity 🙏
Hello @RishabhC-137,
There has been no activity on this issue for the past 5 days. It would be awesome if you keep posting updates to this issue so that we know you are actively working on it.
We are really eager to close this issue at the earliest, hence if we continue to see the inactivity, we will have to reassign the issue to someone else. We are doing this to ensure that the project maintains its momentum and others are not blocked on this work.
Just drop a comment with the current status of the work or share any issues you are facing. We can always chip in to help you out.
Thanks again.
I've been working on the issue and will be making a PR in the next few days. If I encounter any issues, I'll drop a comment. Thank you for your patience! @arpitbbhayani
Hi @arpitbbhayani, I wanted to provide a quick update. I was unwell last weeks, which caused a delay in my progress. However, I am actively working on it now and plan to raise a pull request soon. Thank you for your understanding!
@RishabhC-137 Are you still working on it ? Can I pick this up if you are not ? Or can you please share your draft work ?
Hi @arpitbbhayani, @JyotinderSingh! I believe for performance considerations, the DiceDB server is implemented in such a way as to use raw sockets directly using the syscall package, instead of using the net/http package. In that case, to implement a TLS server, we can't use ListenAndServeTLS method from net/http. Instead, we need to find a way to make it work with sockets. Is my understanding correct?
