couchbase 3.0.3-universal-darwin-20

data/ext/couchbase/cbsasl/scram-sha/scram-sha.h

@@ -0,0 +1,185 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+#pragma once
+
+#include <array>
+#include <iostream>
+#include <vector>
+
+/**
+ * This file contains the interface to the SCRAM-SHA1, SCRAM-SHA256 and
+ * SCRAM-512 support.
+ *
+ * SCRAM is defined in https://www.ietf.org/rfc/rfc5802.txt
+ *
+ * The current implementation does not support channel binding (so we
+ * don't advertise the -PLUS)
+ */
+
+#include <cbcrypto/cbcrypto.h>
+
+#include <cbsasl/client.h>
+#include <cbsasl/mechanism.h>
+
+namespace couchbase::sasl::mechanism::scram
+{
+
+class ScramShaBackend
+{
+  protected:
+    ScramShaBackend(const Mechanism& mech, const couchbase::crypto::Algorithm algo)
+      : mechanism(mech)
+      , algorithm(algo)
+    {
+    }
+    ~ScramShaBackend() = default;
+
+    /**
+     * Add a property to the message list according to
+     * https://www.ietf.org/rfc/rfc5802.txt section 5.1
+     *
+     * The purpose of these conversion functions is that we want to
+     * make sure that we enforce the right format on the various attributes
+     * and that we detect illegal keys.
+     *
+     * @param out the destination stream
+     * @param key the key to add
+     * @param value the string representation of the attribute to add
+     * @param more set to true if we should add a trailing comma (more data
+     *             follows)
+     */
+    static void addAttribute(std::ostream& out, char key, const std::string& value, bool more);
+
+    /**
+     * Add a property to the message list according to
+     * https://www.ietf.org/rfc/rfc5802.txt section 5.1
+     *
+     * The purpose of these conversion functions is that we want to
+     * make sure that we enforce the right format on the various attributes
+     * and that we detect illegal keys.
+     *
+     * @param out the destination stream
+     * @param key the key to add
+     * @param value the integer value of the attribute to add
+     * @param more set to true if we should add a trailing comma (more data
+     *             follows)
+     */
+    static void addAttribute(std::ostream& out, char key, int value, bool more);
+
+    std::string getServerSignature();
+
+    std::string getClientProof();
+
+    virtual std::string getSaltedPassword() = 0;
+
+    /**
+     * Get the AUTH message (as specified in the RFC)
+     */
+    std::string getAuthMessage();
+
+    std::string client_first_message;
+    std::string client_first_message_bare;
+    std::string client_final_message;
+    std::string client_final_message_without_proof;
+    std::string server_first_message;
+    std::string server_final_message;
+
+    std::string clientNonce;
+    std::string nonce_;
+
+    Mechanism mechanism;
+    const couchbase::crypto::Algorithm algorithm;
+};
+
+/**
+ * Implementation of the class that provides the client side implementation
+ * of the SCRAM-SHA[1,256,512]
+ */
+class ClientBackend
+  : public MechanismBackend
+  , public ScramShaBackend
+{
+  public:
+    ClientBackend(GetUsernameCallback& user_cb,
+                  GetPasswordCallback& password_cb,
+                  ClientContext& ctx,
+                  Mechanism mech,
+                  couchbase::crypto::Algorithm algo);
+
+    std::pair<error, std::string_view> start() override;
+    std::pair<error, std::string_view> step(std::string_view input) override;
+
+  protected:
+    bool generateSaltedPassword(const std::string& secret);
+
+    std::string getSaltedPassword() override
+    {
+        if (saltedPassword.empty()) {
+            throw std::logic_error("getSaltedPassword called before salted "
+                                   "password is initialized");
+        }
+        return saltedPassword;
+    }
+
+    std::string saltedPassword;
+    std::string salt;
+    unsigned int iterationCount = 4096;
+};
+
+class Sha512ClientBackend : public ClientBackend
+{
+  public:
+    Sha512ClientBackend(GetUsernameCallback& user_cb, GetPasswordCallback& password_cb, ClientContext& ctx)
+      : ClientBackend(user_cb, password_cb, ctx, Mechanism::SCRAM_SHA512, couchbase::crypto::Algorithm::SHA512)
+    {
+    }
+
+    [[nodiscard]] std::string_view get_name() const override
+    {
+        return "SCRAM-SHA512";
+    }
+};
+
+class Sha256ClientBackend : public ClientBackend
+{
+  public:
+    Sha256ClientBackend(GetUsernameCallback& user_cb, GetPasswordCallback& password_cb, ClientContext& ctx)
+      : ClientBackend(user_cb, password_cb, ctx, Mechanism::SCRAM_SHA256, couchbase::crypto::Algorithm::SHA256)
+    {
+    }
+
+    [[nodiscard]] std::string_view get_name() const override
+    {
+        return "SCRAM-SHA256";
+    }
+};
+
+class Sha1ClientBackend : public ClientBackend
+{
+  public:
+    Sha1ClientBackend(GetUsernameCallback& user_cb, GetPasswordCallback& password_cb, ClientContext& ctx)
+      : ClientBackend(user_cb, password_cb, ctx, Mechanism::SCRAM_SHA1, couchbase::crypto::Algorithm::SHA1)
+    {
+    }
+
+    [[nodiscard]] std::string_view get_name() const override
+    {
+        return "SCRAM-SHA1";
+    }
+};
+
+} // namespace couchbase::sasl::mechanism::scram

data/ext/couchbase/cbsasl/scram-sha/stringutils.cc

@@ -0,0 +1,81 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+#include "stringutils.h"
+
+#include <stdexcept>
+#include <cctype>
+
+namespace couchbase::sasl::mechanism::scram
+{
+
+/**
+ * According to the RFC:
+ *
+ * 2.3.  Prohibited Output
+ *
+ *    This profile specifies the following characters as prohibited input:
+ *
+ *       - Non-ASCII space characters [StringPrep, C.1.2]
+ *       - ASCII control characters [StringPrep, C.2.1]
+ *       - Non-ASCII control characters [StringPrep, C.2.2]
+ *       - Private Use characters [StringPrep, C.3]
+ *       - Non-character code points [StringPrep, C.4]
+ *       - Surrogate code points [StringPrep, C.5]
+ *       - Inappropriate for plain text characters [StringPrep, C.6]
+ *       - Inappropriate for canonical representation characters
+ *         [StringPrep, C.7]
+ *       - Change display properties or deprecated characters
+ *         [StringPrep, C.8]
+ *       - Tagging characters [StringPrep, C.9]
+ */
+const std::string&
+sasl_prep(const std::string& string)
+{
+    for (const auto& c : string) {
+        if ((static_cast<unsigned int>(c) & 0x80U) != 0) {
+            throw std::runtime_error("sasl_prep: Multibyte UTF-8 is not"
+                                     " implemented yet");
+        }
+
+        if (iscntrl(c) != 0) {
+            throw std::runtime_error("sasl_prep: control characters is not"
+                                     " allowed");
+        }
+    }
+
+    return string;
+}
+
+std::string
+encode_username(const std::string& username)
+{
+    std::string ret(username);
+
+    std::string::size_type index = 0;
+    while ((index = ret.find_first_of(",=", index)) != std::string::npos) {
+        if (ret[index] == ',') {
+            ret.replace(index, 1, "=2C");
+        } else {
+            ret.replace(index, 1, "=3D");
+        }
+        ++index;
+    }
+
+    return ret;
+}
+
+} // namespace couchbase::sasl::mechanism::scram

data/ext/couchbase/cbsasl/scram-sha/stringutils.h

@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+#pragma once
+
+#include <string>
+
+namespace couchbase::sasl::mechanism::scram
+{
+
+/**
+ * Apply https://www.ietf.org/rfc/rfc4013.txt to the input string
+ *
+ * The input string is supposed to be UTF-8 (but given that we don't
+ * support bucket names with multibyte characters, we only support
+ * single-byte UTF-8 characters ;-))
+ *
+ * @param string The string to run stringprep with the SASL profile on
+ * @return a sasl_prep'd string
+ * @throws std::runtime_error if we encounter a multibyte character
+ */
+const std::string&
+sasl_prep(const std::string& string);
+
+/**
+ * According to https://www.ietf.org/rfc/rfc5802.txt all occurrences
+ * of ',' and '=' needs to be transferred as =2C and =3D.
+ *
+ * @param username the username to encode
+ * @return the escaped string
+ */
+std::string
+encode_username(const std::string& username);
+
+} // namespace couchbase::sasl::mechanism::scram

data/ext/couchbase/cluster.hxx

@@ -0,0 +1,356 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2020 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include <utility>
+#include <thread>
+#include <fstream>
+
+#include <asio/ssl.hpp>
+
+#include <io/mcbp_session.hxx>
+#include <io/http_session_manager.hxx>
+#include <io/http_command.hxx>
+#include <io/dns_client.hxx>
+#include <origin.hxx>
+#include <bucket.hxx>
+#include <operations.hxx>
+#include <operations/document_query.hxx>
+
+#include <diagnostics.hxx>
+
+namespace couchbase
+{
+namespace
+{
+class ping_collector : public std::enable_shared_from_this<ping_collector>
+{
+    diag::ping_result res_;
+    std::function<void(diag::ping_result)> handler_;
+    std::atomic_int expected_{ 0 };
+    std::mutex mutex_{};
+
+  public:
+    ping_collector(std::string report_id, std::function<void(diag::ping_result)> handler)
+      : res_{ std::move(report_id), couchbase::sdk_id() }
+      , handler_(std::move(handler))
+    {
+    }
+
+    ~ping_collector()
+    {
+        invoke_handler();
+    }
+
+    [[nodiscard]] diag::ping_result& result()
+    {
+        return res_;
+    }
+
+    auto build_reporter()
+    {
+        expected_++;
+        return [self = this->shared_from_this()](diag::endpoint_ping_info&& info) {
+            std::scoped_lock lock(self->mutex_);
+            self->res_.services[info.type].emplace_back(info);
+            if (--self->expected_ == 0) {
+                self->invoke_handler();
+            }
+        };
+    }
+
+    void invoke_handler()
+    {
+        if (handler_ != nullptr) {
+            handler_(std::move(res_));
+            handler_ = nullptr;
+        }
+    }
+};
+} // namespace
+
+class cluster
+{
+  public:
+    explicit cluster(asio::io_context& ctx)
+      : id_(uuid::to_string(uuid::random()))
+      , ctx_(ctx)
+      , work_(asio::make_work_guard(ctx_))
+      , tls_(asio::ssl::context::tls_client)
+      , session_manager_(std::make_shared<io::http_session_manager>(id_, ctx_, tls_))
+      , dns_config_(io::dns::dns_config::get())
+      , dns_client_(ctx_)
+    {
+    }
+
+    template<typename Handler>
+    void open(const couchbase::origin& origin, Handler&& handler)
+    {
+        origin_ = origin;
+        if (origin_.options().enable_dns_srv) {
+            return asio::post(asio::bind_executor(
+              ctx_, [this, handler = std::forward<Handler>(handler)]() mutable { return do_dns_srv(std::forward<Handler>(handler)); }));
+        }
+        do_open(std::forward<Handler>(handler));
+    }
+
+    template<typename Handler>
+    void close(Handler&& handler)
+    {
+        asio::post(asio::bind_executor(ctx_, [this, handler = std::forward<Handler>(handler)]() {
+            if (session_) {
+                session_->stop(io::retry_reason::do_not_retry);
+            }
+            for (auto& bucket : buckets_) {
+                bucket.second->close();
+            }
+            session_manager_->close();
+            handler();
+            work_.reset();
+        }));
+    }
+
+    template<typename Handler>
+    void open_bucket(const std::string& bucket_name, Handler&& handler)
+    {
+        auto ptr = buckets_.find(bucket_name);
+        if (ptr != buckets_.end()) {
+            return handler({});
+        }
+        std::vector<protocol::hello_feature> known_features;
+        if (session_ && session_->has_config()) {
+            known_features = session_->supported_features();
+        }
+        auto b = std::make_shared<bucket>(id_, ctx_, tls_, bucket_name, origin_, known_features);
+        b->bootstrap([this, handler = std::forward<Handler>(handler)](std::error_code ec, const configuration& config) mutable {
+            if (!ec && !session_->supports_gcccp()) {
+                session_manager_->set_configuration(config, origin_.options());
+            }
+            handler(ec);
+        });
+        buckets_.emplace(bucket_name, b);
+    }
+
+    template<class Request, class Handler>
+    void execute(Request request, Handler&& handler)
+    {
+        auto bucket = buckets_.find(request.id.bucket);
+        if (bucket == buckets_.end()) {
+            error_context::key_value ctx{};
+            ctx.id = request.id;
+            ctx.ec = std::make_error_code(error::common_errc::bucket_not_found);
+            using response_type = typename Request::encoded_response_type;
+            return handler(operations::make_response(std::move(ctx), request, response_type{}));
+        }
+        return bucket->second->execute(request, std::forward<Handler>(handler));
+    }
+
+    template<class Request, class Handler>
+    void execute_http(Request request, Handler&& handler)
+    {
+        auto session = session_manager_->check_out(Request::type, origin_.credentials());
+        if (!session) {
+            typename Request::error_context_type ctx{};
+            ctx.ec = std::make_error_code(error::common_errc::service_not_available);
+            return handler(operations::make_response(std::move(ctx), request, {}));
+        }
+        auto cmd = std::make_shared<operations::http_command<Request>>(ctx_, request);
+        cmd->send_to(session, [this, session, handler = std::forward<Handler>(handler)](typename Request::response_type resp) mutable {
+            handler(std::move(resp));
+            session_manager_->check_in(Request::type, session);
+        });
+    }
+
+    template<typename Handler>
+    void diagnostics(std::optional<std::string> report_id, Handler&& handler)
+    {
+        if (!report_id) {
+            report_id = std::make_optional(uuid::to_string(uuid::random()));
+        }
+        asio::post(asio::bind_executor(ctx_, [this, report_id, handler = std::forward<Handler>(handler)]() mutable {
+            diag::diagnostics_result res{ report_id.value(), couchbase::sdk_id() };
+            if (session_) {
+                res.services[service_type::kv].emplace_back(session_->diag_info());
+            }
+            for (const auto& bucket : buckets_) {
+                bucket.second->export_diag_info(res);
+            }
+            session_manager_->export_diag_info(res);
+            handler(std::move(res));
+        }));
+    }
+
+    void ping(std::optional<std::string> report_id,
+              std::optional<std::string> bucket_name,
+              std::set<service_type> services,
+              std::function<void(diag::ping_result)> handler)
+    {
+        if (!report_id) {
+            report_id = std::make_optional(uuid::to_string(uuid::random()));
+        }
+        if (services.empty()) {
+            services = { service_type::kv, service_type::views, service_type::query, service_type::search, service_type::analytics };
+        }
+        asio::post(asio::bind_executor(ctx_, [this, report_id, bucket_name, services, handler = std::move(handler)]() mutable {
+            auto collector = std::make_shared<ping_collector>(report_id.value(), std::move(handler));
+            if (bucket_name) {
+                if (services.find(service_type::kv) != services.end()) {
+                    auto bucket = buckets_.find(bucket_name.value());
+                    if (bucket != buckets_.end()) {
+                        bucket->second->ping(collector);
+                    }
+                }
+            } else {
+                if (services.find(service_type::kv) != services.end()) {
+                    if (session_) {
+                        session_->ping(collector->build_reporter());
+                    }
+                    for (auto& bucket : buckets_) {
+                        bucket.second->ping(collector);
+                    }
+                }
+                session_manager_->ping(services, collector, origin_.credentials());
+            }
+        }));
+    }
+
+  private:
+    template<typename Handler>
+    void do_dns_srv(Handler&& handler)
+    {
+        std::string hostname;
+        std::string service;
+        std::tie(hostname, service) = origin_.next_address();
+        service = origin_.options().enable_tls ? "_couchbases" : "_couchbase";
+        dns_client_.query_srv(
+          hostname,
+          service,
+          [hostname, this, handler = std::forward<Handler>(handler)](couchbase::io::dns::dns_client::dns_srv_response&& resp) mutable {
+              if (resp.ec) {
+                  spdlog::warn("failed to fetch DNS SRV records for \"{}\" ({}), assuming that cluster is listening this address",
+                               hostname,
+                               resp.ec.message());
+              } else if (resp.targets.empty()) {
+                  spdlog::warn("DNS SRV query returned 0 records for \"{}\", assuming that cluster is listening this address", hostname);
+              } else {
+                  origin::node_list nodes;
+                  nodes.reserve(resp.targets.size());
+                  for (const auto& address : resp.targets) {
+                      origin::node_entry node;
+                      node.first = address.hostname;
+                      node.second = std::to_string(address.port);
+                      nodes.emplace_back(node);
+                  }
+                  origin_.set_nodes(nodes);
+                  spdlog::info("replace list of bootstrap nodes with addresses from DNS SRV of \"{}\": [{}]",
+                               hostname,
+                               fmt::join(origin_.get_nodes(), ", "));
+              }
+              return do_open(std::forward<Handler>(handler));
+          });
+    }
+
+    template<typename Handler>
+    void do_open(Handler&& handler)
+    {
+        if (origin_.options().enable_tls) {
+            tls_.set_options(asio::ssl::context::default_workarounds | asio::ssl::context::no_sslv2 | asio::ssl::context::no_sslv3);
+            if (!origin_.options().trust_certificate.empty()) {
+                std::error_code ec{};
+                spdlog::debug(R"([{}]: use TLS certificate chain: "{}")", id_, origin_.options().trust_certificate);
+                tls_.use_certificate_chain_file(origin_.options().trust_certificate, ec);
+                if (ec) {
+                    spdlog::error(
+                      "[{}]: unable to load certificate chain \"{}\": {}", id_, origin_.options().trust_certificate, ec.message());
+                    return handler(ec);
+                }
+            }
+#ifdef TLS_KEY_LOG_FILE
+            SSL_CTX_set_keylog_callback(tls_.native_handle(), [](const SSL* /* ssl */, const char* line) {
+                std::ofstream keylog(TLS_KEY_LOG_FILE, std::ios::out | std::ios::app | std::ios::binary);
+                keylog << std::string_view(line) << std::endl;
+            });
+            spdlog::critical("TLS_KEY_LOG_FILE was set to \"{}\" during build, all TLS keys will be logged for network analysis "
+                             "(https://wiki.wireshark.org/TLS). DO NOT USE THIS BUILD IN PRODUCTION",
+                             TLS_KEY_LOG_FILE);
+#endif
+            if (origin_.credentials().uses_certificate()) {
+                std::error_code ec{};
+                spdlog::debug(R"([{}]: use TLS certificate: "{}")", id_, origin_.certificate_path());
+                tls_.use_certificate_file(origin_.certificate_path(), asio::ssl::context::file_format::pem, ec);
+                if (ec) {
+                    spdlog::error("[{}]: unable to load certificate \"{}\": {}", id_, origin_.certificate_path(), ec.message());
+                    return handler(ec);
+                }
+                spdlog::debug(R"([{}]: use TLS private key: "{}")", id_, origin_.key_path());
+                tls_.use_private_key_file(origin_.key_path(), asio::ssl::context::file_format::pem, ec);
+                if (ec) {
+                    spdlog::error("[{}]: unable to load private key \"{}\": {}", id_, origin_.key_path(), ec.message());
+                    return handler(ec);
+                }
+            }
+            session_ = std::make_shared<io::mcbp_session>(id_, ctx_, tls_, origin_);
+        } else {
+            session_ = std::make_shared<io::mcbp_session>(id_, ctx_, origin_);
+        }
+        session_->bootstrap([this, handler = std::forward<Handler>(handler)](std::error_code ec, const configuration& config) mutable {
+            if (!ec) {
+                if (origin_.options().network == "auto") {
+                    origin_.options().network = config.select_network(session_->bootstrap_hostname());
+                    if (origin_.options().network == "default") {
+                        spdlog::debug(R"({} detected network is "{}")", session_->log_prefix(), origin_.options().network);
+                    } else {
+                        spdlog::info(R"({} detected network is "{}")", session_->log_prefix(), origin_.options().network);
+                    }
+                }
+                if (origin_.options().network != "default") {
+                    origin::node_list nodes;
+                    nodes.reserve(config.nodes.size());
+                    for (const auto& address : config.nodes) {
+                        auto port = address.port_or(origin_.options().network, service_type::kv, origin_.options().enable_tls, 0);
+                        if (port == 0) {
+                            continue;
+                        }
+                        origin::node_entry node;
+                        node.first = address.hostname_for(origin_.options().network);
+                        node.second = std::to_string(port);
+                        nodes.emplace_back(node);
+                    }
+                    origin_.set_nodes(nodes);
+                    spdlog::info("replace list of bootstrap nodes with addresses of alternative network \"{}\": [{}]",
+                                 origin_.options().network,
+                                 fmt::join(origin_.get_nodes(), ","));
+                }
+                session_manager_->set_configuration(config, origin_.options());
+            }
+            handler(ec);
+        });
+    }
+
+    std::string id_;
+    asio::io_context& ctx_;
+    asio::executor_work_guard<asio::io_context::executor_type> work_;
+    asio::ssl::context tls_;
+    std::shared_ptr<io::http_session_manager> session_manager_;
+    io::dns::dns_config& dns_config_;
+    couchbase::io::dns::dns_client dns_client_;
+    std::shared_ptr<io::mcbp_session> session_{};
+    std::map<std::string, std::shared_ptr<bucket>> buckets_{};
+    couchbase::origin origin_{};
+};
+} // namespace couchbase