couchbase 3.8.0 → 3.8.2

data/ext/couchbase/core/impl/error.cxx

@@ -75,6 +75,17 @@ error::error(std::error_code ec,
 {
 }
 
+error::error(std::error_code ec,
+             std::string message,
+             couchbase::error_context ctx,
+             couchbase::node_id node_id)
+  : ec_{ ec }
+  , message_{ std::move(message) }
+  , ctx_{ std::move(ctx) }
+  , node_id_{ std::move(node_id) }
+{
+}
+
 auto
 error::ec() const -> std::error_code
 {
@@ -103,6 +114,12 @@ error::cause() const -> std::optional<error>
   return *cause_;
 }
 
+auto
+error::node_id() const -> const couchbase::node_id&
+{
+  return node_id_;
+}
+
 error::operator bool() const
 {
   return ec_.value() != 0;
@@ -164,19 +181,27 @@ make_error(const core::error_context::http& core_ctx) -> couchbase::error
 auto
 make_error(const couchbase::core::key_value_error_context& core_ctx) -> couchbase::error
 {
+  // Always preserve the node_id so that callers on both success and error
+  // paths can identify which node handled the request.
   if (!core_ctx.ec()) {
-    return {};
+    return { {}, {}, {}, core_ctx.last_dispatched_to_node_id() };
   }
-  return { core_ctx.ec(), {}, internal_error_context::build_error_context(core_ctx) };
+  return { core_ctx.ec(),
+           {},
+           internal_error_context::build_error_context(core_ctx),
+           core_ctx.last_dispatched_to_node_id() };
 }
 
 auto
 make_error(const couchbase::core::subdocument_error_context& core_ctx) -> couchbase::error
 {
   if (!core_ctx.ec()) {
-    return {};
+    return { {}, {}, {}, core_ctx.last_dispatched_to_node_id() };
   }
-  return { core_ctx.ec(), {}, internal_error_context::build_error_context(core_ctx) };
+  return { core_ctx.ec(),
+           {},
+           internal_error_context::build_error_context(core_ctx),
+           core_ctx.last_dispatched_to_node_id() };
 }
 
 auto

data/ext/couchbase/core/impl/invoke_with_node_id.hxx

@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2026-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include <couchbase/error.hxx>
+
+#include <utility>
+
+namespace couchbase::core::impl
+{
+/**
+ * Forwards (err, result) to the caller's handler, propagating the node_id
+ * carried by the error (which make_error populates for KV contexts) onto
+ * the result. Using a plain function template avoids the extra std::function
+ * allocation a type-erasing wrapper would introduce for the sole purpose of
+ * setting node_id - that extra allocation was the source of the 18
+ * "Potential memory leak" reports clang-static-analyzer flagged against the
+ * previous wrap_with_node_id helper. The handler is taken by forwarding
+ * reference and perfect-forwarded to the invocation so that callers moving
+ * an rvalue handler consume it without an intermediate copy.
+ */
+template<typename Handler, typename Result>
+void
+invoke_with_node_id(Handler&& handler, couchbase::error err, Result result)
+{
+  result.node_id(err.node_id());
+  std::forward<Handler>(handler)(std::move(err), std::move(result));
+}
+} // namespace couchbase::core::impl

data/ext/couchbase/core/impl/node_id.cxx

@@ -0,0 +1,110 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2024-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#include "node_id.hxx"
+
+#include "core/utils/crc32.hxx"
+
+#include <spdlog/fmt/bundled/core.h>
+
+#include <cstdint>
+#include <string>
+
+namespace couchbase
+{
+
+namespace
+{
+/**
+ * Produces a stable, opaque hex string from hostname + KV port.
+ *
+ * Uses CRC32 (already in-tree for vBucket mapping) rather than a
+ * cryptographic hash — collision resistance across a handful of cluster
+ * nodes is more than sufficient, and this avoids pulling in OpenSSL headers.
+ */
+auto
+derive_fallback_id(const std::string& hostname, std::uint16_t port) -> std::string
+{
+  auto input = fmt::format("{}:{}", hostname, port);
+  auto crc = core::utils::hash_crc32(input.data(), input.size());
+  return fmt::format("{:08x}", crc);
+}
+} // namespace
+
+node_id::node_id(std::string node_uuid, std::string hostname, std::uint16_t port)
+  : node_uuid_{ std::move(node_uuid) }
+  , hostname_{ std::move(hostname) }
+  , port_{ port }
+  , id_{ node_uuid_.empty() ? derive_fallback_id(hostname_, port_) : node_uuid_ }
+{
+}
+
+auto
+node_id::id() const -> const std::string&
+{
+  return id_;
+}
+
+auto
+node_id::node_uuid() const -> const std::string&
+{
+  return node_uuid_;
+}
+
+auto
+node_id::hostname() const -> const std::string&
+{
+  return hostname_;
+}
+
+auto
+node_id::port() const -> std::uint16_t
+{
+  return port_;
+}
+
+node_id::
+operator bool() const
+{
+  return !id_.empty();
+}
+
+auto
+node_id::operator==(const node_id& other) const -> bool
+{
+  return id_ == other.id_;
+}
+
+auto
+node_id::operator!=(const node_id& other) const -> bool
+{
+  return !(*this == other);
+}
+
+auto
+node_id::operator<(const node_id& other) const -> bool
+{
+  return id_ < other.id_;
+}
+
+auto
+internal_node_id::build(std::string node_uuid, std::string hostname, std::uint16_t port) -> node_id
+{
+  return { std::move(node_uuid), std::move(hostname), port };
+}
+
+} // namespace couchbase

data/ext/couchbase/core/impl/node_id.hxx

@@ -0,0 +1,40 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2024-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include <couchbase/node_id.hxx>
+
+#include <cstdint>
+#include <string>
+
+namespace couchbase
+{
+
+/**
+ * Internal factory for constructing node_id instances from core-level data.
+ *
+ * This class is a friend of node_id and provides the only way to construct
+ * a non-default node_id outside the couchbase namespace.
+ */
+class internal_node_id
+{
+public:
+  static auto build(std::string node_uuid, std::string hostname, std::uint16_t port) -> node_id;
+};
+
+} // namespace couchbase

data/ext/couchbase/core/impl/public_cluster.cxx

@@ -65,6 +65,8 @@
 #include <asio/execution_context.hpp>
 #include <asio/post.hpp>
 
+#include <gsl/assert>
+
 #include <functional>
 #include <future>
 #include <memory>
@@ -414,19 +416,110 @@ public:
 
   void notify_fork(fork_event event)
   {
+    // asio requires notify_fork() to run with no thread inside io_context::run():
+    //
+    //   "This function must not be called while any other execution_context
+    //    function, or any function on an I/O object associated with the
+    //    execution_context, is being called in another thread."
+    //                                       -- asio/execution_context.hpp
+    //
+    // That is not a formality for fork_child: epoll_reactor::notify_fork() closes
+    // and recreates epoll_fd_, timer_fd_ and the interrupter, then rewrites every
+    // descriptor registration. Running it against a live reactor makes the IO
+    // thread epoll_wait() on a descriptor another thread is closing, and then
+    // dereference whatever epoll reports as a descriptor_state.
+    //
+    // So the fixup goes in the window where the IO thread is not running: after
+    // the join in fork_prepare, and before the restart that starts the new one.
     if (event == fork_event::prepare) {
+      // Quiesce the transactions cleanup threads BEFORE stopping the io_context.
+      // transactions_cleanup::stop() joins workers that may be blocking on a KV
+      // operation, and only the IO thread can complete those -- so stopping the
+      // io_context first can leave that join waiting forever.
+      if (transactions_) {
+        transactions_->notify_fork(event);
+      }
       io_.stop();
-      io_thread_.join();
+      // Guarded like do_close() below, and for the same reason: close() already
+      // stopped the io_context and joined this thread, so a notify_fork(prepare)
+      // afterwards has nothing left to join -- and join() on a thread that is not
+      // joinable throws std::system_error, out of a void public API.
+      if (io_thread_.joinable()) {
+        io_thread_.join();
+      }
+    }
+
+    // Our own IO thread is gone at this point, checkable in program order
+    // rather than only by a sanitizer: fork_prepare has just joined it, and
+    // fork_child/fork_parent inherit an already-joined one, because prepare runs
+    // before fork() and only the forking thread survives into the child. If a
+    // later change moves the restart back above this line, this fires
+    // immediately instead of turning into an intermittent use-after-free.
+    //
+    // The transactions cleanup threads were stopped above, before io_.stop(), so
+    // by here the only threads this cluster owned are gone.
+    Expects(!io_thread_.joinable());
+
+    if (event == fork_event::prepare) {
+      try {
+        io_.notify_fork(fork_event_to_asio(event));
+      } catch (...) {
+        // Undo everything this prepare did, then report. Returning stopped and threadless
+        // would hang ~cluster_impl, which waits on a completion only the IO thread can
+        // deliver -- the same hazard as the fork_child/fork_parent path below. The fork
+        // must not go ahead, but the cluster stays usable and destructible.
+        //
+        // The io_context comes back first: restarting cleanup spawns workers that issue KV
+        // operations, and only the IO thread completes those. Restoring cleanup matters as
+        // much as restoring the thread -- it was stopped above, and leaving it stopped
+        // would silently disable lost-attempts cleanup for the rest of the process while
+        // this function claimed the cluster was fine.
+        //
+        // Note for the caller: do not try to compensate by calling notify_fork(parent)
+        // after this throws. Prepare has already been undone here, and that call would
+        // find a restarted IO thread and trip the precondition above.
+        io_.restart();
+        io_thread_ = std::thread{ [&io = io_] {
+          io.run();
+        } };
+        if (transactions_) {
+          transactions_->notify_fork(fork_event::parent);
+        }
+        throw;
+      }
     } else {
-      // TODO(SA): close all sockets in fork_event::child
+      // TODO(CXXCBC-913): disown this cluster's sockets here, instead of leaving it to the
+      // reconnect. epoll_reactor::notify_fork(fork_child) below re-registers every
+      // descriptor inherited from the parent into the child's new epoll instance, so
+      // from here until those sockets are closed the child polls file descriptions the
+      // parent is still using. Closing them is at least no longer destructive -- see
+      // stream_impl::close(), which detaches a socket it did not open rather than
+      // shutting it down -- but it happens on the reconnect path, asynchronously, and
+      // only once the replaced impl is destroyed.
       io_.restart();
+      try {
+        io_.notify_fork(fork_event_to_asio(event));
+      } catch (...) {
+        // notify_fork() throws if re-registering a descriptor with the new
+        // epoll instance fails. The io_context is unusable after that (asio says
+        // to destroy it), but destruction itself needs a runner: do_close()
+        // waits on a completion only the IO thread can deliver, so returning
+        // from here stopped and threadless would hang ~cluster_impl instead of
+        // surfacing the failure.
+        io_thread_ = std::thread{ [&io = io_] {
+          io.run();
+        } };
+        throw;
+      }
       io_thread_ = std::thread{ [&io = io_] {
         io.run();
       } };
     }
-    io_.notify_fork(fork_event_to_asio(event));
 
-    if (event != fork_event::child && transactions_) {
+    // prepare was handled above, before the io_context was stopped. The child does
+    // not restart cleanup on this impl: it is about to be replaced, and the
+    // replacement starts its own.
+    if (event == fork_event::parent && transactions_) {
       transactions_->notify_fork(event);
     }
   }
@@ -640,6 +733,16 @@ cluster::connect(const std::string& connection_string,
 auto
 cluster::notify_fork(fork_event event) -> void
 {
+#if defined(_WIN32)
+  // No fork(2) on Windows, so there is nothing to prepare for or recover from.
+  // The function stays part of the API on every platform -- callers, the wrapper
+  // SDKs especially, should not have to compile differently per platform -- but
+  // here it does nothing. Doing the POSIX work instead would stop and restart the
+  // io_context and re-bootstrap the cluster for no reason, and asio's IOCP
+  // backend has no notify_fork to apply either.
+  (void)event;
+  return;
+#else
   if (!impl_) {
     return;
   }
@@ -659,14 +762,24 @@ cluster::notify_fork(fork_event event) -> void
       if (err.ec()) {
         // TODO(SA): we should fall to background reconnect loop similar to Columnar build
         CB_LOG_ERROR("Unable to reconnect instance after fork: {}", err.ec().message());
-        return;
       }
+      // Adopt the new impl either way. Leaving impl_ null on failure turned the
+      // child's next operation into a segfault, because every data-plane method
+      // dereferences impl_ unchecked; an impl that failed to open reports
+      // errc::network::cluster_closed instead, which is what a caller already gets
+      // from a handle it acquired before the fork.
       impl_ = new_impl;
+      // Always fulfill the barrier. Returning early here used to hang this
+      // function forever: `barrier` is still owned by the enclosing scope below,
+      // so the promise is never destroyed and future.get() never sees a
+      // broken_promise either -- a failed post-fork reconnect just wedged the
+      // caller.
       barrier->set_value();
     });
 
     future.get();
   }
+#endif
 }
 
 void

data/ext/couchbase/core/io/configuration_belongs_to_session.hxx

@@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2020-2021 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include <optional>
+#include <string>
+
+namespace couchbase::core::io
+{
+/**
+ * Decide whether a freshly received cluster map belongs to this session and must
+ * therefore be accepted.
+ *
+ * A session's bucket binding is fixed for its entire lifetime (set once in the
+ * constructor, never reassigned), so the rule reduces to a single invariant:
+ * the bucket identity carried by the configuration must match the bucket identity
+ * of the session.
+ *
+ *   - a cluster-level (bucket-less) session accepts only cluster-level configs;
+ *   - a bucket-level session accepts only configs for *its own* bucket.
+ *
+ * @param config_bucket   bucket name embedded in the configuration payload
+ *                        (std::nullopt  =>  cluster-level / GCCCP config)
+ * @param session_bucket  bucket this session is bound to
+ *                        (std::nullopt  =>  cluster-level / GCCCP session)
+ * @return true if the configuration must be accepted, false if it must be ignored
+ */
+[[nodiscard]] inline auto
+configuration_belongs_to_session(const std::optional<std::string>& config_bucket,
+                                 const std::optional<std::string>& session_bucket) -> bool
+{
+  // Stage 1 — cluster-level config for a cluster-level session.
+  // Neither side names a bucket: this is a GCCCP (cluster) map and the session is
+  // not bound to any bucket, so the config belongs here. Accept.
+  if (!config_bucket.has_value() && !session_bucket.has_value()) {
+    return true;
+  }
+
+  // Stage 2 — cardinality mismatch: exactly one side names a bucket. Reject.
+  // Either a bucket-less config arrived on a bucket-bound session, or a bucket
+  // config arrived on a cluster-level session. In both cases the config does not
+  // belong to this session.
+  if (config_bucket.has_value() != session_bucket.has_value()) {
+    return false;
+  }
+
+  // Stage 3 — both sides name a bucket: accept only if it is the *same* bucket.
+  // Reaching here guarantees both optionals are engaged, so value() is safe.
+  // Guards against applying another bucket's map to this session.
+  return config_bucket.value() == session_bucket.value();
+}
+} // namespace couchbase::core::io