Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
bull-redlock
Advanced tools
This is a node.js implementation of the redlock algorithm for distributed redis locks. It provides strong guarantees in both single-redis and multi-redis environments, and provides fault tolerance through use of multiple independent redis instances or clusters.
###High-Availability Recommendations
###Using Cluster/Sentinel It is completely possible to use a single redis cluster or sentinal configuration by passing one preconfigured client to redlock. While you do gain high availability and vastly increased throughput under this scheme, the failure modes are a bit different, and it becomes theoretically possible that a lock is acquired twice:
Assume you are using eventually-consistent redis replication, and you acquire a lock for a resource. Immediately after acquiring your lock, the redis master for that shard crashes. Redis does its thing and fails over to the slave which hasn't yet synced your lock. If another process attempts to acquire a lock for the same resource, it will succeed!
This is why redlock allows you to specify multiple independent nodes/clusters: by requiring consensus between them, we can safely take out or fail-over a minority of nodes without invalidating active locks.
To learn more about the the algorithm, check out the redis distlock page.
###How do I check if something is locked? Redlock cannot tell you with certainty if a resource is currently locked. For example, if you are on the smaller side of a network partition you will fail to acquire a lock, but you don't know if the lock exists on the other side; all you know is that you can't guarantee exclusivity on yours.
That said, for many tasks it's sufficient to attempt a lock with retryCount=0
, and treat a failure as the resource being "locked" or (more correctly) "unavailable",
npm install --save redlock
Redlock can use node redis, ioredis or any other compatible redis library to keep its client connections.
A redlock object is instantiated with an array of at least one redis client and an optional options
object. Properties of the Redlock object should NOT be changed after it is firstused, as doing so could have unintended consequences for live locks.
var client1 = require('redis').createClient(6379, 'redis1.example.com');
var client2 = require('redis').createClient(6379, 'redis2.example.com');
var client3 = require('redis').createClient(6379, 'redis3.example.com');
var Redlock = require('redlock');
var redlock = new Redlock(
// you should have one client for each redis node
// in your cluster
[client1, client2, client3],
{
// the expected clock drift; for more details
// see http://redis.io/topics/distlock
driftFactor: 0.01, // time in ms
// the max number of times Redlock will attempt
// to lock a resource before erroring
retryCount: 10,
// the time in ms between attempts
retryDelay: 400, // time in ms
// the max time in ms randomly added to retries
// to improve performance under high contention
// see https://www.awsarchitectureblog.com/2015/03/backoff.html
retryJitter: 400 // time in ms
}
);
Because redlock is designed for high availability, it does not care if a minority of redis instances/clusters fail at an operation. If you want to write logs or take another action when a redis client fails, you can listen for the clientError
event:
// ...
redlock.on('clientError', function(err) {
console.error('A redis error has occurred:', err);
});
// ...
###Locking & Unlocking
// the string identifier for the resource you want to lock
var resource = 'locks:account:322456';
// the maximum amount of time you want the resource locked,
// keeping in mind that you can extend the lock up until
// the point when it expires
var ttl = 1000;
redlock.lock(resource, ttl).then(function(lock) {
// ...do something here...
// unlock your resource when you are done
return lock.unlock()
.catch(function(err) {
// we weren't able to reach redis; your lock will eventually
// expire, but you probably want to log this error
console.error(err);
});
});
###Locking and Extending
redlock.lock('locks:account:322456', 1000).then(function(lock) {
// ...do something here...
// if you need more time, you can continue to extend
// the lock as long as you never let it expire
return lock.extend(1000).then(function(lock){
// ...do something here...
// unlock your resource when you are done
return lock.unlock()
.catch(function(err) {
// we weren't able to reach redis; your lock will eventually
// expire, but you probably want to log this error
console.error(err);
});
});
});
###Locking & Unlocking
var using = require('bluebird').using;
// the string identifier for the resource you want to lock
var resource = 'locks:account:322456';
// the maximum amount of time you want the resource locked,
// keeping in mind that you can extend the lock up until
// the point when it expires
var ttl = 1000;
// if we weren't able to reach redis, your lock will eventually
// expire, but you probably want to do something like log that
// an error occurred; if you don't pass a handler, this error
// will be ignored
function unlockErrorHandler(err) {
console.error(err);
}
using(redlock.disposer(resource, ttl, unlockErrorHandler), function(lock) {
// ...do something here...
}); // <-- unlock is automatically handled by bluebird
###Locking and Extending
using(redlock.disposer('locks:account:322456', 1000, unlockErrorHandler), function(lock) {
// ...do something here...
// if you need more time, you can continue to extend
// the lock until it expires
return lock.extend(1000).then(function(extended){
// Note that redlock modifies the original lock,
// so the vars `lock` and `extended` point to the
// exact same object
// ...do something here...
});
}); // <-- unlock is automatically handled by bluebird
###Locking & Unlocking
// the string identifier for the resource you want to lock
var resource = 'locks:account:322456';
// the maximum amount of time you want the resource locked,
// keeping in mind that you can extend the lock up until
// the point when it expires
var ttl = 1000;
redlock.lock(resource, ttl, function(err, lock) {
// we failed to lock the resource
if(err) {
// ...
}
// we have the lock
else {
// ...do something here...
// unlock your resource when you are done
lock.unlock(function(err) {
// we weren't able to reach redis; your lock will eventually
// expire, but you probably want to log this error
console.error(err);
});
}
});
###Locking and Extending
redlock.lock('locks:account:322456', 1000, function(err, lock) {
// we failed to lock the resource
if(err) {
// ...
}
// we have the lock
else {
// ...do something here...
// if you need more time, you can continue to extend
// the lock until it expires
lock.extend(1000, function(err, lock){
// we failed to extend the lock on the resource
if(err) {
// ...
}
// ...do something here...
// unlock your resource when you are done
lock.unlock();
}
}
});
###Redlock.lock(resource, ttl, ?callback)
resource (string)
resource to be lockedttl (number)
time in ms until the lock expirescallback (function)
callback returning:
err (Error)
lock (Lock)
###Redlock.unlock(lock, ?callback)
lock (Lock)
lock to be releasedcallback (function)
callback returning:
err (Error)
###Redlock.extend(lock, ttl, ?callback)
lock (Lock)
lock to be extendedttl (number)
time in ms to extend the lock's expirationcallback (function)
callback returning:
err (Error)
lock (Lock)
###Redlock.disposer(resource, ttl, ?unlockErrorHandler)
resource (string)
resource to be lockedttl (number)
time in ms to extend the lock's expirationcallback (function)
error handler called with:
err (Error)
###Lock.unlock(?callback)
callback (function)
callback returning:
err (Error)
###Lock.extend(ttl, ?callback)
ttl (number)
time in ms to extend the lock's expirationcallback (function)
callback returning:
err (Error)
lock (Lock)
FAQs
A node.js redlock implementation for distributed redis locks
We found that bull-redlock demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.