couchbase 3.4.2 → 3.4.4

data/ext/couchbase/core/bucket.cxx

@@ -22,7 +22,6 @@
 #include "core/mcbp/codec.hxx"
 #include "dispatcher.hxx"
 #include "impl/bootstrap_state_listener.hxx"
-#include "mcbp/completion_token.hxx"
 #include "mcbp/operation_queue.hxx"
 #include "mcbp/queue_request.hxx"
 #include "mcbp/queue_response.hxx"
@@ -41,28 +40,6 @@
 
 namespace couchbase::core
 {
-/**
- * copies nodes from rhs that are not in lhs to output vector
- */
-static void
-diff_nodes(const std::vector<topology::configuration::node>& lhs,
-           const std::vector<topology::configuration::node>& rhs,
-           std::vector<topology::configuration::node>& output)
-{
-    for (const auto& re : rhs) {
-        bool known = false;
-        for (const auto& le : lhs) {
-            if (le.hostname == re.hostname && le.services_plain.management.value_or(0) == re.services_plain.management.value_or(0)) {
-                known = true;
-                break;
-            }
-        }
-        if (!known) {
-            output.push_back(re);
-        }
-    }
-}
-
 class bucket_impl
   : public std::enable_shared_from_this<bucket_impl>
   , public config_listener
@@ -303,81 +280,111 @@ class bucket_impl
         return config_->map_key(key, node_index);
     }
 
-    void restart_node(std::size_t index, const std::string& hostname, const std::string& port)
+    void restart_sessions()
     {
-        if (closed_) {
-            CB_LOG_DEBUG(R"({} requested to restart session, but the bucket has been closed already. idx={}, address="{}:{}")",
-                         log_prefix_,
-                         index,
-                         hostname,
-                         port);
+        const std::scoped_lock lock(config_mutex_, sessions_mutex_);
+        if (!config_.has_value()) {
             return;
         }
-        {
-            std::scoped_lock lock(config_mutex_);
-            if (!config_->has_node_with_hostname(hostname)) {
-                CB_LOG_TRACE(
-                  R"({} requested to restart session, but the node has been ejected from current configuration already. idx={}, address="{}:{}")",
-                  log_prefix_,
-                  index,
-                  hostname,
-                  port);
-                return;
-            }
-        }
-        couchbase::core::origin origin(origin_.credentials(), hostname, port, origin_.options());
 
-        io::mcbp_session session = origin_.options().enable_tls
-                                     ? io::mcbp_session(client_id_, ctx_, tls_, origin, state_listener_, name_, known_features_)
-                                     : io::mcbp_session(client_id_, ctx_, origin, state_listener_, name_, known_features_);
+        std::size_t kv_node_index{ 0 };
+        for (std::size_t index = 0; index < config_->nodes.size(); ++index) {
+            const auto& node = config_->nodes[index];
 
-        std::scoped_lock lock(sessions_mutex_);
-        if (auto ptr = sessions_.find(index); ptr == sessions_.end()) {
-            CB_LOG_DEBUG(R"({} requested to restart session idx={}, which does not exist yet, initiate new one id="{}", address="{}:{}")",
-                         log_prefix_,
-                         index,
-                         session.id(),
-                         hostname,
-                         port);
-        } else {
-            const auto& old_session = ptr->second;
-            auto old_id = old_session.id();
-            sessions_.erase(ptr);
-            Expects(sessions_.count(index) == 0);
-            CB_LOG_DEBUG(R"({} restarting session idx={}, id=("{}" -> "{}"), address="{}:{}")",
+            const auto& hostname = node.hostname_for(origin_.options().network);
+            auto port = node.port_or(origin_.options().network, service_type::key_value, origin_.options().enable_tls, 0);
+            if (port == 0) {
+                continue;
+            }
+
+            auto ptr = std::find_if(sessions_.begin(), sessions_.end(), [&hostname, &port](const auto& session) {
+                return session.second.bootstrap_hostname() == hostname && session.second.bootstrap_port_number() == port;
+            });
+            if (ptr != sessions_.end()) {
+
+                if (auto found_kv_node_index = ptr->first; found_kv_node_index != kv_node_index) {
+                    if (auto current = sessions_.find(kv_node_index); current == sessions_.end()) {
+                        CB_LOG_WARNING(R"({} KV node index mismatch: config rev={} states that address="{}:{}" should be at idx={}, )"
+                                       R"(but it is at idx={} ("{}"). Moving session to idx={}.)",
+                                       log_prefix_,
+                                       config_->rev_str(),
+                                       hostname,
+                                       port,
+                                       kv_node_index,
+                                       found_kv_node_index,
+                                       ptr->second.id(),
+                                       kv_node_index);
+                        sessions_.insert_or_assign(kv_node_index, std::move(ptr->second));
+                        sessions_.erase(ptr);
+                    } else {
+                        CB_LOG_WARNING(
+                          R"({} KV node index mismatch: config rev={} states that address="{}:{}" should be at idx={}, )"
+                          R"(but it is at idx={} ("{}"). Slot with idx={} is holds session with address="{}" ("{}"), swapping them.)",
+                          log_prefix_,
+                          config_->rev_str(),
+                          hostname,
+                          port,
+                          kv_node_index,
+                          found_kv_node_index,
+                          ptr->second.id(),
+                          kv_node_index,
+                          current->second.bootstrap_address(),
+                          current->second.id());
+                        std::swap(current->second, ptr->second);
+                    }
+                }
+                ++kv_node_index;
+                continue;
+            }
+            couchbase::core::origin origin(origin_.credentials(), hostname, port, origin_.options());
+            io::mcbp_session session = origin_.options().enable_tls
+                                         ? io::mcbp_session(client_id_, ctx_, tls_, origin, state_listener_, name_, known_features_)
+                                         : io::mcbp_session(client_id_, ctx_, origin, state_listener_, name_, known_features_);
+            CB_LOG_DEBUG(R"({} rev={}, restart idx={}, session="{}", address="{}:{}")",
                          log_prefix_,
-                         index,
-                         old_id,
+                         config_->rev_str(),
+                         node.index,
                          session.id(),
                          hostname,
                          port);
+            session.bootstrap(
+              [self = shared_from_this(), session](std::error_code err, topology::configuration cfg) mutable {
+                  if (err) {
+                      return self->remove_session(session.id());
+                  }
+                  self->update_config(std::move(cfg));
+                  session.on_configuration_update(self);
+                  session.on_stop([id = session.id(), self]() { self->remove_session(id); });
+                  self->drain_deferred_queue();
+              },
+              true);
+            sessions_.insert_or_assign(index, std::move(session));
+            ++kv_node_index;
         }
+    }
 
-        session.bootstrap(
-          [self = shared_from_this(), session, this_index = index, hostname, port](std::error_code ec,
-                                                                                   const topology::configuration& config) mutable {
-              if (self->closed_) {
-                  asio::post(asio::bind_executor(
-                    self->ctx_, [session = std::move(session)]() mutable { return session.stop(retry_reason::do_not_retry); }));
-                  return;
-              }
-              if (ec) {
-                  CB_LOG_WARNING(R"({} failed to restart session idx={}, ec={})", session.log_prefix(), this_index, ec.message());
-                  self->restart_node(this_index, hostname, port);
-                  return;
-              }
-              session.on_configuration_update(self);
-              session.on_stop([this_index, hostname, port, self](retry_reason reason) {
-                  if (reason == retry_reason::socket_closed_while_in_flight) {
-                      self->restart_node(this_index, hostname, port);
-                  }
-              });
+    void remove_session(const std::string& id)
+    {
+        bool found{ false };
+        const std::scoped_lock lock(sessions_mutex_);
+        for (auto ptr = sessions_.cbegin(); ptr != sessions_.cend();) {
+            if (ptr->second.id() == id) {
+                CB_LOG_DEBUG(R"({} removed session id="{}", address="{}", bootstrap_address="{}:{}")",
+                             log_prefix_,
+                             ptr->second.id(),
+                             ptr->second.remote_address(),
+                             ptr->second.bootstrap_hostname(),
+                             ptr->second.bootstrap_port());
+                ptr = sessions_.erase(ptr);
+                found = true;
+            } else {
+                ptr = std::next(ptr);
+            }
+        }
 
-              self->update_config(config);
-              self->drain_deferred_queue();
-          },
-          true);
-        sessions_.insert_or_assign(index, std::move(session));
+        if (found) {
+            asio::post(asio::bind_executor(ctx_, [self = shared_from_this()]() { return self->restart_sessions(); }));
+        }
     }
 
     void bootstrap(utils::movable_function<void(std::error_code, topology::configuration)>&& handler)
@@ -392,15 +399,11 @@ class bucket_impl
                                                                                                topology::configuration cfg) mutable {
             if (ec) {
                 CB_LOG_WARNING(R"({} failed to bootstrap session ec={}, bucket="{}")", new_session.log_prefix(), ec.message(), self->name_);
+                self->remove_session(new_session.id());
             } else {
                 const std::size_t this_index = new_session.index();
                 new_session.on_configuration_update(self);
-                new_session.on_stop([this_index, hostname = new_session.bootstrap_hostname(), port = new_session.bootstrap_port(), self](
-                                      retry_reason reason) {
-                    if (reason == retry_reason::socket_closed_while_in_flight) {
-                        self->restart_node(this_index, hostname, port);
-                    }
-                });
+                new_session.on_stop([id = new_session.id(), self]() { self->remove_session(id); });
 
                 {
                     std::scoped_lock lock(self->sessions_mutex_);
@@ -454,6 +457,9 @@ class bucket_impl
             std::scoped_lock lock(deferred_commands_mutex_);
             std::swap(deferred_commands_, commands);
         }
+        if (!commands.empty()) {
+            CB_LOG_TRACE(R"({} draining deferred operation queue, size={})", log_prefix_, commands.size());
+        }
         while (!commands.empty()) {
             commands.front()();
             commands.pop();
@@ -488,9 +494,33 @@ class bucket_impl
         }
     }
 
+    /**
+     * copies nodes from rhs that are not in lhs to output vector
+     */
+    void diff_nodes(const std::vector<topology::configuration::node>& lhs,
+                    const std::vector<topology::configuration::node>& rhs,
+                    std::vector<topology::configuration::node>& output)
+    {
+        for (const auto& re : rhs) {
+            bool known = false;
+            const auto& rhost = re.hostname_for(origin_.options().network);
+            const auto rport = re.port_or(origin_.options().network, service_type::key_value, origin_.options().enable_tls, 0);
+            for (const auto& le : lhs) {
+                const auto& lhost = le.hostname_for(origin_.options().network);
+                const auto lport = le.port_or(origin_.options().network, service_type::key_value, origin_.options().enable_tls, 0);
+                if (rhost == lhost && rport == lport) {
+                    known = true;
+                    break;
+                }
+            }
+            if (!known) {
+                output.push_back(re);
+            }
+        }
+    }
+
     void update_config(topology::configuration config) override
     {
-        bool forced_config = false;
         std::vector<topology::configuration::node> added{};
         std::vector<topology::configuration::node> removed{};
         {
@@ -499,7 +529,6 @@ class bucket_impl
                 CB_LOG_DEBUG("{} initialize configuration rev={}", log_prefix_, config.rev_str());
             } else if (config.force) {
                 CB_LOG_DEBUG("{} forced to accept configuration rev={}", log_prefix_, config.rev_str());
-                forced_config = true;
             } else if (!config.vbmap) {
                 CB_LOG_DEBUG("{} will not update the configuration old={} -> new={}, because new config does not have partition map",
                              log_prefix_,
@@ -532,78 +561,81 @@ class bucket_impl
             std::scoped_lock lock(sessions_mutex_);
             std::map<size_t, io::mcbp_session> new_sessions{};
 
-            for (auto& [index, session] : sessions_) {
-                std::size_t new_index = config.nodes.size() + 1;
-                for (const auto& node : config.nodes) {
-                    if (session.bootstrap_hostname() == node.hostname_for(origin_.options().network) &&
-                        session.bootstrap_port() ==
-                          std::to_string(
-                            node.port_or(origin_.options().network, service_type::key_value, origin_.options().enable_tls, 0))) {
-                        new_index = node.index;
-                        break;
-                    }
-                }
-                if (new_index < config.nodes.size()) {
-                    CB_LOG_DEBUG(R"({} rev={}, preserve session="{}", address="{}:{}", index={}->{})",
-                                 log_prefix_,
-                                 config.rev_str(),
-                                 session.id(),
-                                 session.bootstrap_hostname(),
-                                 session.bootstrap_port(),
-                                 index,
-                                 new_index);
-                    new_sessions.insert_or_assign(new_index, std::move(session));
-                } else {
-                    CB_LOG_DEBUG(R"({} rev={}, drop session="{}", address="{}:{}", index={})",
-                                 log_prefix_,
-                                 config.rev_str(),
-                                 session.id(),
-                                 session.bootstrap_hostname(),
-                                 session.bootstrap_port(),
-                                 index);
-                    asio::post(asio::bind_executor(
-                      ctx_, [session = std::move(session)]() mutable { return session.stop(retry_reason::do_not_retry); }));
-                }
-            }
-
+            std::size_t next_index{ 0 };
             for (const auto& node : config.nodes) {
-                if (new_sessions.find(node.index) != new_sessions.end()) {
-                    continue;
-                }
-
                 const auto& hostname = node.hostname_for(origin_.options().network);
                 auto port = node.port_or(origin_.options().network, service_type::key_value, origin_.options().enable_tls, 0);
                 if (port == 0) {
                     continue;
                 }
+
+                bool reused_session{ false };
+                for (auto it = sessions_.begin(); it != sessions_.end(); ++it) {
+                    if (it->second.bootstrap_hostname() == hostname && it->second.bootstrap_port_number() == port) {
+                        CB_LOG_DEBUG(R"({} rev={}, preserve session="{}", address="{}:{}", index={}->{})",
+                                     log_prefix_,
+                                     config.rev_str(),
+                                     it->second.id(),
+                                     it->second.bootstrap_hostname(),
+                                     it->second.bootstrap_port(),
+                                     it->first,
+                                     next_index);
+                        new_sessions.insert_or_assign(next_index, std::move(it->second));
+                        reused_session = true;
+                        ++next_index;
+                        sessions_.erase(it);
+                        break;
+                    }
+                }
+                if (reused_session) {
+                    continue;
+                }
+
                 couchbase::core::origin origin(origin_.credentials(), hostname, port, origin_.options());
                 io::mcbp_session session = origin_.options().enable_tls
                                              ? io::mcbp_session(client_id_, ctx_, tls_, origin, state_listener_, name_, known_features_)
                                              : io::mcbp_session(client_id_, ctx_, origin, state_listener_, name_, known_features_);
-                CB_LOG_DEBUG(
-                  R"({} rev={}, add session="{}", address="{}:{}")", log_prefix_, config.rev_str(), session.id(), hostname, port);
+                CB_LOG_DEBUG(R"({} rev={}, add session="{}", address="{}:{}", index={})",
+                             log_prefix_,
+                             config.rev_str(),
+                             session.id(),
+                             hostname,
+                             port,
+                             node.index);
                 session.bootstrap(
-                  [self = shared_from_this(), session, forced_config, idx = node.index](std::error_code err,
-                                                                                        topology::configuration cfg) mutable {
-                      if (!err) {
-                          self->update_config(std::move(cfg));
-                          session.on_configuration_update(self);
-                          session.on_stop(
-                            [index = session.index(), hostname = session.bootstrap_hostname(), port = session.bootstrap_port(), self](
-                              retry_reason reason) {
-                                if (reason == retry_reason::socket_closed_while_in_flight) {
-                                    self->restart_node(index, hostname, port);
-                                }
-                            });
-                          self->drain_deferred_queue();
-                      } else if (err == errc::common::unambiguous_timeout && forced_config) {
-                          self->restart_node(idx, session.bootstrap_hostname(), session.bootstrap_port());
+                  [self = shared_from_this(), session, idx = next_index](std::error_code err, topology::configuration cfg) mutable {
+                      if (err) {
+                          CB_LOG_WARNING(R"({} failed to bootstrap session="{}", address="{}:{}", index={}, ec={})",
+                                         session.log_prefix(),
+                                         session.id(),
+                                         session.bootstrap_hostname(),
+                                         session.bootstrap_port(),
+                                         idx,
+                                         err.message());
+                          return self->remove_session(session.id());
                       }
+                      self->update_config(std::move(cfg));
+                      session.on_configuration_update(self);
+                      session.on_stop([id = session.id(), self]() { self->remove_session(id); });
+                      self->drain_deferred_queue();
                   },
                   true);
-                new_sessions.insert_or_assign(node.index, std::move(session));
+                new_sessions.insert_or_assign(next_index, std::move(session));
+                ++next_index;
+            }
+            std::swap(sessions_, new_sessions);
+
+            for (auto it = new_sessions.begin(); it != new_sessions.end(); ++it) {
+                CB_LOG_DEBUG(R"({} rev={}, drop session="{}", address="{}:{}", index={})",
+                             log_prefix_,
+                             config.rev_str(),
+                             it->second.id(),
+                             it->second.bootstrap_hostname(),
+                             it->second.bootstrap_port(),
+                             it->first);
+                asio::post(asio::bind_executor(
+                  ctx_, [session = std::move(it->second)]() mutable { return session.stop(retry_reason::do_not_retry); }));
             }
-            sessions_ = new_sessions;
         }
     }
 

data/ext/couchbase/core/bucket.hxx

@@ -83,7 +83,7 @@ class bucket
         auto cmd = std::make_shared<operations::mcbp_command<bucket, Request>>(ctx_, shared_from_this(), request, default_timeout());
         cmd->start([cmd, handler = std::forward<Handler>(handler)](std::error_code ec, std::optional<io::mcbp_message>&& msg) mutable {
             using encoded_response_type = typename Request::encoded_response_type;
-            std::uint16_t status_code = msg ? msg->header.status() : 0U;
+            std::uint16_t status_code = msg ? msg->header.status() : 0xffffU;
             auto resp = msg ? encoded_response_type(std::move(*msg)) : encoded_response_type{};
             auto ctx = make_key_value_error_context(ec, status_code, cmd, resp);
             handler(cmd->request.make_response(std::move(ctx), std::move(resp)));
@@ -106,6 +106,8 @@ class bucket
         } else {
             auto [partition, server] = map_id(cmd->request.id);
             if (!server.has_value()) {
+                CB_LOG_TRACE(
+                  R"({} unable to map key="{}" to the node, id={}, partition={})", log_prefix(), cmd->request.id, cmd->id_, partition);
                 return io::retry_orchestrator::maybe_retry(
                   cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
             }
@@ -114,12 +116,32 @@ class bucket
         }
         auto session = find_session_by_index(index);
         if (!session || !session->has_config()) {
+            CB_LOG_TRACE(R"({} defer operation id={}, key="{}", partition={}, index={}, session={}, address="{}", has_config={})",
+                         log_prefix(),
+                         cmd->id_,
+                         cmd->request.id,
+                         cmd->request.partition,
+                         index,
+                         session.has_value(),
+                         session.has_value() ? session->bootstrap_address() : "",
+                         session.has_value() && session->has_config());
             return defer_command([self = shared_from_this(), cmd]() { self->map_and_send(cmd); });
         }
         if (session->is_stopped()) {
+            CB_LOG_TRACE(
+              R"({} the session has been found for idx={}, but it is stopped, retrying id={}, key="{}", partition={}, session={}, address="{}")",
+              log_prefix(),
+              index,
+              cmd->id_,
+              cmd->request.id,
+              cmd->request.partition,
+              session->id(),
+              session->bootstrap_address());
             return io::retry_orchestrator::maybe_retry(
               cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
         }
+        cmd->last_dispatched_from_ = session->local_address();
+        cmd->last_dispatched_to_ = session->bootstrap_address();
         cmd->send_to(session.value());
     }
 

data/ext/couchbase/core/cluster.hxx

@@ -33,6 +33,7 @@
 #include "diagnostics.hxx"
 #include "dispatcher.hxx"
 #include "impl/dns_srv_tracker.hxx"
+#include "mozilla_ca_bundle.hxx"
 #include "operations.hxx"
 #include "origin.hxx"
 
@@ -78,6 +79,7 @@ class cluster : public std::enable_shared_from_this<cluster>
         }
 
         origin_ = std::move(origin);
+        CB_LOG_DEBUG(R"(open cluster, id: "{}", core version: "{}", {})", id_, couchbase::core::meta::sdk_semver(), origin_.to_json());
         // ignore the enable_tracing flag if a tracer was passed in
         if (nullptr != origin_.options().tracer) {
             tracer_ = origin_.options().tracer;
@@ -110,10 +112,7 @@ class cluster : public std::enable_shared_from_this<cluster>
                   return self->dns_srv_tracker_->get_srv_nodes(
                     [self, hostname = std::move(hostname), handler = std::forward<Handler>(handler)](origin::node_list nodes,
                                                                                                      std::error_code ec) mutable {
-                        if (ec) {
-                            return self->close([ec, handler = std::forward<Handler>(handler)]() mutable { handler(ec); });
-                        }
-                        if (!nodes.empty()) {
+                        if (!ec && !nodes.empty()) {
                             self->origin_.set_nodes(std::move(nodes));
                             CB_LOG_INFO("replace list of bootstrap nodes with addresses from DNS SRV of \"{}\": [{}]",
                                         hostname,
@@ -338,8 +337,8 @@ class cluster : public std::enable_shared_from_this<cluster>
     void do_open(Handler&& handler)
     {
         // Warn users if they attempt to use Capella without TLS being enabled.
+        bool has_capella_host = false;
         {
-            bool has_capella_host = false;
             bool has_non_capella_host = false;
             static std::string suffix = "cloud.couchbase.com";
             for (const auto& node : origin_.get_hostnames()) {
@@ -358,6 +357,7 @@ class cluster : public std::enable_shared_from_this<cluster>
 
             if (origin_.options().enable_tls                   /* TLS is enabled */
                 && origin_.options().trust_certificate.empty() /* No CA certificate (or other SDK-specific trust source) is specified */
+                && origin_.options().trust_certificate_value.empty()     /* and certificate value has not been specified */
                 && origin_.options().tls_verify != tls_verify_mode::none /* The user did not disable all TLS verification */
                 && has_non_capella_host /* The connection string has a hostname that does NOT end in ".cloud.couchbase.com" */) {
                 CB_LOG_WARNING("[{}] When TLS is enabled, the cluster options must specify certificate(s) to trust or ensure that they are "
@@ -367,7 +367,17 @@ class cluster : public std::enable_shared_from_this<cluster>
         }
 
         if (origin_.options().enable_tls) {
-            tls_.set_options(asio::ssl::context::default_workarounds | asio::ssl::context::no_sslv2 | asio::ssl::context::no_sslv3);
+            long tls_options = asio::ssl::context::default_workarounds | // various bug workarounds that should be rather harmless
+                               asio::ssl::context::no_sslv2 |            // published: 1995, deprecated: 2011
+                               asio::ssl::context::no_sslv3;             // published: 1996, deprecated: 2015
+            if (origin_.options().tls_disable_deprecated_protocols) {
+                tls_options |= asio::ssl::context::no_tlsv1 |  // published: 1999, deprecated: 2021
+                               asio::ssl::context::no_tlsv1_1; // published: 2006, deprecated: 2021
+            }
+            if (origin_.options().tls_disable_v1_2 || has_capella_host) {
+                tls_options |= asio::ssl::context::no_tlsv1_2; // published: 2008, still in use
+            }
+            tls_.set_options(tls_options);
             switch (origin_.options().tls_verify) {
                 case tls_verify_mode::none:
                     tls_.set_verify_mode(asio::ssl::verify_none);
@@ -377,7 +387,8 @@ class cluster : public std::enable_shared_from_this<cluster>
                     tls_.set_verify_mode(asio::ssl::verify_peer);
                     break;
             }
-            if (origin_.options().trust_certificate.empty()) { // trust certificate is not explicitly specified
+            if (origin_.options().trust_certificate.empty() &&
+                origin_.options().trust_certificate_value.empty()) { // trust certificate is not explicitly specified
                 CB_LOG_DEBUG(R"([{}]: use default CA for TLS verify)", id_);
                 std::error_code ec{};
 
@@ -394,15 +405,41 @@ class cluster : public std::enable_shared_from_this<cluster>
                     CB_LOG_WARNING("[{}]: unable to load default CAs: {}", id_, ec.message());
                     // we don't consider this fatal and try to continue without it
                 }
+
+                if (const auto certificates = default_ca::mozilla_ca_certs();
+                    !origin_.options().disable_mozilla_ca_certificates && !certificates.empty()) {
+                    CB_LOG_DEBUG("[{}]: loading {} CA certificates from Mozilla bundle. Update date: \"{}\", SHA256: \"{}\"",
+                                 id_,
+                                 certificates.size(),
+                                 default_ca::mozilla_ca_certs_date(),
+                                 default_ca::mozilla_ca_certs_sha256());
+                    for (const auto& cert : certificates) {
+                        tls_.add_certificate_authority(asio::const_buffer(cert.body.data(), cert.body.size()), ec);
+                        if (ec) {
+                            CB_LOG_WARNING("[{}]: unable to load CA \"{}\" from Mozilla bundle: {}", id_, cert.authority, ec.message());
+                        }
+                    }
+                }
             } else { // trust certificate is explicitly specified
                 std::error_code ec{};
                 // load only the explicit certificate
                 // system and default capella certificates are not loaded
-                CB_LOG_DEBUG(R"([{}]: use TLS verify file: "{}")", id_, origin_.options().trust_certificate);
-                tls_.load_verify_file(origin_.options().trust_certificate, ec);
-                if (ec) {
-                    CB_LOG_ERROR("[{}]: unable to load verify file \"{}\": {}", id_, origin_.options().trust_certificate, ec.message());
-                    return close([ec, handler = std::forward<Handler>(handler)]() mutable { return handler(ec); });
+                if (!origin_.options().trust_certificate_value.empty()) {
+                    CB_LOG_DEBUG(R"([{}]: use TLS certificate passed through via options object)", id_);
+                    tls_.add_certificate_authority(asio::const_buffer(origin_.options().trust_certificate_value.data(),
+                                                                      origin_.options().trust_certificate_value.size()),
+                                                   ec);
+                    if (ec) {
+                        CB_LOG_WARNING("[{}]: unable to load CA passed via options object: {}", id_, ec.message());
+                    }
+                }
+                if (!origin_.options().trust_certificate.empty()) {
+                    CB_LOG_DEBUG(R"([{}]: use TLS verify file: "{}")", id_, origin_.options().trust_certificate);
+                    tls_.load_verify_file(origin_.options().trust_certificate, ec);
+                    if (ec) {
+                        CB_LOG_ERROR("[{}]: unable to load verify file \"{}\": {}", id_, origin_.options().trust_certificate, ec.message());
+                        return close([ec, handler = std::forward<Handler>(handler)]() mutable { return handler(ec); });
+                    }
                 }
             }
 #ifdef COUCHBASE_CXX_CLIENT_TLS_KEY_LOG_FILE
@@ -430,6 +467,7 @@ class cluster : public std::enable_shared_from_this<cluster>
                     return close([ec, handler = std::forward<Handler>(handler)]() mutable { return handler(ec); });
                 }
             }
+
             session_ = io::mcbp_session(id_, ctx_, tls_, origin_, dns_srv_tracker_);
         } else {
             session_ = io::mcbp_session(id_, ctx_, origin_, dns_srv_tracker_);
@@ -466,7 +504,7 @@ class cluster : public std::enable_shared_from_this<cluster>
                 }
                 self->session_manager_->set_configuration(config, self->origin_.options());
                 self->session_->on_configuration_update(self->session_manager_);
-                self->session_->on_stop([self](retry_reason) {
+                self->session_->on_stop([self]() {
                     if (self->session_) {
                         self->session_.reset();
                     }

data/ext/couchbase/core/cluster_options.cxx

@@ -16,7 +16,7 @@
  */
 
 #include "cluster_options.hxx"
-#include "config_profile.hxx"
+#include "config_profiles.hxx"
 #include <stdexcept>
 
 namespace couchbase::core
@@ -45,6 +45,6 @@ cluster_options::default_timeout_for(service_type type) const
 void
 cluster_options::apply_profile(std::string profile_name)
 {
-    couchbase::core::known_profiles().apply(profile_name, *this);
+    known_profiles().apply(profile_name, *this);
 }
 } // namespace couchbase::core