Repository: valkey-io/valkey
File: src/networking.c (C)

Code before:
                        "3) If you started the server manually just for testing, restart "
                        "it with the '--protected-mode no' option. "
                        "4) Set up an authentication password for the default user. "
                        "NOTE: You only need to do one of the above things in order for "
                        "the server to start accepting connections from the outside.\r\n";
            if (connWrite(c->conn, err, strlen(err)) == -1) {
                /* Nothing to do, Just to avoid the warning... */
            }
            server.stat_rejected_conn++;
            freeClientAsync(c);
            return;
        }
    }

    /* Auto-authenticate from cert_user field if set */
    sds username = connGetPeerUsername(conn);
    if (username != NULL) {
        user *u = ACLGetUserByName(username, sdslen(username));
        if (u) {
            c->user = u;
            c->flag.authenticated = true;
            serverLog(LL_VERBOSE, "TLS: Auto-authenticated client as %s",
                      server.hide_user_data_from_log ? "*redacted*" : u->name);
        } else {
            serverLog(LL_NOTICE, "TLS: Auto-authentication failed, user '%s' not found", username);
            addACLLogEntry(c, ACL_INVALID_TLS_CERT_AUTH, 0, 0, username, sdsnew("User not found in auto TLS auth"));
        }
        sdsfree(username);
    }

    server.stat_numconnections++;
    moduleFireServerEvent(VALKEYMODULE_EVENT_CLIENT_CHANGE, VALKEYMODULE_SUBEVENT_CLIENT_CHANGE_CONNECTED, c);
}

void acceptCommonHandler(connection *conn, struct ClientFlags flags, char *ip) {
    client *c;
    UNUSED(ip);

    char addr[CONN_ADDR_STR_LEN] = {0};
    char laddr[CONN_ADDR_STR_LEN] = {0};
    connFormatAddr(conn, addr, sizeof(addr), 1);
    connFormatAddr(conn, laddr, sizeof(addr), 0);

    if (connGetState(conn) != CONN_STATE_ACCEPTING) {
        serverLog(LL_VERBOSE, "Accepted client connection in error state: %s (addr=%s laddr=%s)",
                  connGetLastError(conn), addr, laddr);
        connClose(conn);
        return;
    }

    /* Limit the number of connections we take at the same time.

Review comment (security):
No need to store the string `"User not found in auto TLS auth"` in the ACL log. The new reason `ACL_INVALID_TLS_CERT_AUTH` already indicates this. This is a structured log, not a plain text verbose log.

The first 0 there (context) should be ACL_LOG_CTX_TOPLEVEL rather than the a magic number 0. The second 0 is an argument position so here 0 is fine. (Argpos is only used for some `reason` when the logging is triggered by some command.)

```suggestion
            addACLLogEntry(c, ACL_INVALID_TLS_CERT_AUTH, ACL_LOG_CTX_TOPLEVEL, 0, username, NULL);
```

Also, you need to handle this new reason when generating the reply of the `ACL LOG` command in `aclCommand()`, here: https://github.com/valkey-io/valkey/blob/8.1.2/src/acl.c#L3016. The output for this case can be something short like "tls-cert", which would match the other reasons.

You can view the log using the `ACL LOG` command. You should probably test this (at least manually in valkei-cli) to see how the reply looks after logging the new `ACL_INVALID_TLS_CERT_AUTH`.

Code after:
                        "3) If you started the server manually just for testing, restart "
                        "it with the '--protected-mode no' option. "
                        "4) Set up an authentication password for the default user. "
                        "NOTE: You only need to do one of the above things in order for "
                        "the server to start accepting connections from the outside.\r\n";
            if (connWrite(c->conn, err, strlen(err)) == -1) {
                /* Nothing to do, Just to avoid the warning... */
            }
            server.stat_rejected_conn++;
            freeClientAsync(c);
            return;
        }
    }

    /* Auto-authenticate from cert_user field if set */
    sds username = connGetPeerUsername(conn);
    if (username != NULL) {
        user *u = ACLGetUserByName(username, sdslen(username));
        if (u) {
            c->user = u;
            c->flag.authenticated = true;
            serverLog(LL_VERBOSE, "TLS: Auto-authenticated client as %s",
                      server.hide_user_data_from_log ? "*redacted*" : u->name);
        } else {
            addACLLogEntry(c, ACL_INVALID_TLS_CERT_AUTH, ACL_LOG_CTX_TOPLEVEL, 0, username, NULL);
        }
        sdsfree(username);
    }

    server.stat_numconnections++;
    moduleFireServerEvent(VALKEYMODULE_EVENT_CLIENT_CHANGE, VALKEYMODULE_SUBEVENT_CLIENT_CHANGE_CONNECTED, c);
}

void acceptCommonHandler(connection *conn, struct ClientFlags flags, char *ip) {
    client *c;
    UNUSED(ip);

    char addr[CONN_ADDR_STR_LEN] = {0};
    char laddr[CONN_ADDR_STR_LEN] = {0};
    connFormatAddr(conn, addr, sizeof(addr), 1);
    connFormatAddr(conn, laddr, sizeof(addr), 0);

    if (connGetState(conn) != CONN_STATE_ACCEPTING) {
        serverLog(LL_VERBOSE, "Accepted client connection in error state: %s (addr=%s laddr=%s)",
                  connGetLastError(conn), addr, laddr);
        connClose(conn);
        return;
    }

    /* Limit the number of connections we take at the same time.
     *