couchbase 3.8.0 → 3.8.2

data/ext/couchbase/core/io/http_session_manager.hxx

@@ -251,45 +251,45 @@ public:
             app_telemetry_meter_,
             options_.default_timeout_for(request.type));
 #endif
-          cmd->start([start = std::chrono::steady_clock::now(),
-                      self = shared_from_this(),
-                      type,
-                      cmd,
-                      handler =
-                        collector->build_reporter()](operations::http_noop_response&& resp) {
-            diag::ping_state state = diag::ping_state::ok;
-            std::optional<std::string> error{};
-            if (auto ec = resp.ctx.ec; ec) {
-              if (ec == errc::common::unambiguous_timeout ||
-                  ec == errc::common::ambiguous_timeout) {
-                state = diag::ping_state::timeout;
-              } else {
-                state = diag::ping_state::error;
+          cmd->start(
+            [start = std::chrono::steady_clock::now(),
+             self = shared_from_this(),
+             type,
+             cmd,
+             handler = collector->build_reporter()](operations::http_noop_response&& resp) {
+              diag::ping_state state = diag::ping_state::ok;
+              std::optional<std::string> error{};
+              if (auto ec = resp.ctx.ec; ec) {
+                if (ec == errc::common::unambiguous_timeout ||
+                    ec == errc::common::ambiguous_timeout) {
+                  state = diag::ping_state::timeout;
+                } else {
+                  state = diag::ping_state::error;
+                }
+                error.emplace(fmt::format("code={}, message={}, http_code={}",
+                                          ec.value(),
+                                          ec.message(),
+                                          resp.ctx.http_status));
               }
-              error.emplace(fmt::format("code={}, message={}, http_code={}",
-                                        ec.value(),
-                                        ec.message(),
-                                        resp.ctx.http_status));
-            }
-            auto remote_address = cmd->session_->remote_address();
-            // If not connected, the remote address will be empty.  Better to
-            // give the user some context on the "attempted" remote address.
-            if (remote_address.empty()) {
-              remote_address =
-                fmt::format("{}:{}", cmd->session_->hostname(), cmd->session_->port());
-            }
-            handler->report(
-              diag::endpoint_ping_info{ type,
-                                        cmd->session_->id(),
-                                        std::chrono::duration_cast<std::chrono::microseconds>(
-                                          std::chrono::steady_clock::now() - start),
-                                        remote_address,
-                                        cmd->session_->local_address(),
-                                        state,
-                                        {},
-                                        error });
-            self->check_in(type, cmd->session_);
-          });
+              auto remote_address = cmd->session_->remote_address();
+              // If not connected, the remote address will be empty.  Better to
+              // give the user some context on the "attempted" remote address.
+              if (remote_address.empty()) {
+                remote_address =
+                  fmt::format("{}:{}", cmd->session_->hostname(), cmd->session_->port());
+              }
+              handler->report(
+                diag::endpoint_ping_info{ type,
+                                          cmd->session_->id(),
+                                          std::chrono::duration_cast<std::chrono::microseconds>(
+                                            std::chrono::steady_clock::now() - start),
+                                          remote_address,
+                                          cmd->session_->local_address(),
+                                          state,
+                                          {},
+                                          error });
+              self->check_in(type, cmd->session_);
+            });
 
           cmd->set_command_session(session);
           if (!session->is_connected()) {
@@ -402,9 +402,20 @@ public:
       return;
     }
     if (!session->is_connected()) {
-      CB_LOG_DEBUG("{} HTTP session never connected.  Skipping check-in", session->log_prefix());
-      return session.reset();
+      {
+        std::scoped_lock lock(sessions_mutex_);
+        if (auto pend_it = pending_sessions_.find(type); pend_it != pending_sessions_.end()) {
+          pend_it->second.remove_if([id = session->id()](const auto& s) {
+            return !s || s->id() == id;
+          });
+        }
+      }
+      CB_LOG_DEBUG("{} HTTP session never connected.  Ensured session is not in pending.",
+                   session->log_prefix());
+      return;
     }
+    bool should_stop = false;
+    std::chrono::milliseconds idle_timeout{};
     {
       std::scoped_lock lock(config_mutex_);
       if (!session->keep_alive() || !config_.has_node(options_.network,
@@ -412,22 +423,34 @@ public:
                                                       options_.enable_tls,
                                                       session->hostname(),
                                                       session->port())) {
-        return asio::post(session->get_executor(), [session]() {
-          session->stop();
-        });
+        should_stop = true;
+      } else {
+        idle_timeout = options_.idle_http_connection_timeout;
       }
     }
+    if (should_stop) {
+      return asio::post(session->get_executor(), [session]() {
+        session->stop();
+      });
+    }
     if (!session->is_stopped()) {
-      session->set_idle(options_.idle_http_connection_timeout);
+      // set_idle() arms the idle timer via async_wait — it never calls stop() inline,
+      // so on_stop cannot re-enter sessions_mutex_ here. It must precede publication to
+      // idle_sessions_ so a concurrent check_out's reset_idle() finds a pending timer.
+      session->set_idle(idle_timeout);
       CB_LOG_DEBUG("{} put HTTP session back to idle connections", session->log_prefix());
       std::scoped_lock lock(sessions_mutex_);
       idle_sessions_[type].push_back(session);
-      busy_sessions_[type].remove_if([id = session->id()](const auto& s) -> bool {
-        return !s || s->id() == id;
-      });
-      pending_sessions_[type].remove_if([id = session->id()](const auto& s) -> bool {
-        return !s || s->id() == id;
-      });
+      if (auto busy_it = busy_sessions_.find(type); busy_it != busy_sessions_.end()) {
+        busy_it->second.remove_if([id = session->id()](const auto& s) -> bool {
+          return !s || s->id() == id;
+        });
+      }
+      if (auto pend_it = pending_sessions_.find(type); pend_it != pending_sessions_.end()) {
+        pend_it->second.remove_if([id = session->id()](const auto& s) -> bool {
+          return !s || s->id() == id;
+        });
+      }
     }
   }
 
@@ -741,13 +764,30 @@ private:
     }
 
     session->on_stop([type, id = session->id(), self = this->shared_from_this()]() {
-      const std::scoped_lock inner_lock(self->sessions_mutex_);
-      self->busy_sessions_[type].remove_if([&id](const auto& s) {
-        return !s || s->id() == id;
-      });
-      self->idle_sessions_[type].remove_if([&id](const auto& s) {
-        return !s || s->id() == id;
-      });
+      // Declared outside the lock so destructors run after sessions_mutex_ is released.
+      // cppcheck-suppress variableScope
+      std::vector<std::shared_ptr<http_session>> dropped;
+      {
+        const std::scoped_lock inner_lock(self->sessions_mutex_);
+        for (auto* map :
+             { &self->busy_sessions_, &self->idle_sessions_, &self->pending_sessions_ }) {
+          auto map_it = map->find(type);
+          if (map_it == map->end()) {
+            continue;
+          }
+          auto& list = map_it->second;
+          for (auto it = list.begin(); it != list.end();) {
+            if (!*it || (*it)->id() == id) {
+              if (*it) {
+                dropped.push_back(std::move(*it));
+              }
+              it = list.erase(it);
+            } else {
+              ++it;
+            }
+          }
+        }
+      }
     });
     return session;
   }

data/ext/couchbase/core/io/mcbp_session.cxx

@@ -22,6 +22,7 @@
 #ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
 #include "core/columnar/background_bootstrap_listener.hxx"
 #endif
+#include "configuration_belongs_to_session.hxx"
 #include "core/config_listener.hxx"
 #include "core/diagnostics.hxx"
 #include "core/impl/bootstrap_error.hxx"
@@ -634,14 +635,9 @@ class mcbp_session_impl
                 }
               }
               std::optional<topology::configuration> config = req.body().config();
-              if (session_ && config.has_value()) {
-                if ((!config->bucket.has_value() && req.body().bucket().empty()) ||
-                    (session_->bucket_name_.has_value() && !req.body().bucket().empty() &&
-                     // TODO(CXXCBC-549)
-                     // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
-                     session_->bucket_name_.value() == req.body().bucket())) {
-                  session_->update_configuration(std::move(config.value()));
-                }
+              if (session_ && config.has_value() &&
+                  configuration_belongs_to_session(config->bucket, session_->bucket_name_)) {
+                session_->update_configuration(std::move(config.value()));
               }
             } break;
             default:
@@ -824,14 +820,9 @@ class mcbp_session_impl
                 }
               }
               std::optional<topology::configuration> config = req.body().config();
-              if (session_ && config.has_value()) {
-                if ((!config->bucket.has_value() && req.body().bucket().empty()) ||
-                    (session_->bucket_name_.has_value() && !req.body().bucket().empty() &&
-                     // TODO(CXXCBC-549)
-                     // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
-                     session_->bucket_name_.value() == req.body().bucket())) {
-                  session_->update_configuration(std::move(config.value()));
-                }
+              if (session_ && config.has_value() &&
+                  configuration_belongs_to_session(config->bucket, session_->bucket_name_)) {
+                session_->update_configuration(std::move(config.value()));
               }
             } break;
             default:

data/ext/couchbase/core/io/streams.cxx

@@ -23,12 +23,128 @@
 #include <asio/error.hpp>
 #include <asio/ssl.hpp>
 
+#include <cerrno>
+
+#if defined(_WIN32)
+#include <process.h>
+#else
+#include <unistd.h>
+#endif
+
 namespace couchbase::core::io
 {
+namespace
+{
+auto
+current_process_id() -> long long
+{
+#if defined(_WIN32)
+  return static_cast<long long>(::_getpid());
+#else
+  return static_cast<long long>(::getpid());
+#endif
+}
+
+/**
+ * Release a socket this process inherited across fork(2), without disturbing the
+ * connection the parent is still using.
+ *
+ * Two things differ from the ordinary close path, and both matter:
+ *
+ *  * No shutdown(2). It acts on the open file description, which fork(2) shares,
+ *    so it would send FIN and break the parent's connection. close(2) drops only
+ *    our own descriptor; the peer sees nothing.
+ *  * release() before closing, rather than asio's close(). asio's close() skips
+ *    EPOLL_CTL_DEL on the assumption that closing a descriptor removes its epoll
+ *    registration. Per epoll(7) that happens only once *every* descriptor
+ *    referring to the description is closed -- and the parent still holds one --
+ *    so the registration would outlive the descriptor_state asio recycles, which
+ *    is precisely the stale-pointer shape the reactor faults on. release() emits
+ *    the EPOLL_CTL_DEL explicitly and hands back the raw descriptor to close.
+ *
+ * release() also completes any outstanding asynchronous operations on this socket
+ * with operation_aborted, which is what we want: those reads belong to the parent.
+ */
+// Takes the basic_socket base rather than tcp::socket so the same code serves both
+// the plain socket and a TLS stream's lowest_layer(), whose type is that base.
+void
+detach_inherited_socket(asio::basic_socket<asio::ip::tcp>& socket, asio::error_code& ec)
+{
+  if (!socket.is_open()) {
+    ec = asio::error::bad_descriptor;
+    return;
+  }
+
+  const auto handle = socket.release(ec);
+  if (ec) {
+    // Report it. Do not reach for asio's close() here: that is the very call
+    // whose epoll behaviour makes it unsafe on an inherited descriptor, and the
+    // descriptor goes away when this process exits anyway.
+    return;
+  }
+
+#if defined(_WIN32)
+  // Unreachable: without fork(2) no socket is ever inherited, so the owner pid
+  // always matches and close() never takes this path.
+  (void)handle;
+  ec = asio::error::operation_not_supported;
+#else
+  if (::close(handle) != 0) {
+    ec.assign(errno, asio::error::get_system_category());
+  }
+#endif
+}
+} // namespace
+
+auto
+configure_tls_handshake(asio::ssl::stream<asio::ip::tcp::socket>& stream,
+                        const std::string& hostname) -> std::error_code
+{
+  if (hostname.empty()) {
+    // Fail closed: a TLS client connection must have a hostname to verify the
+    // server's identity against. Returning success here would silently fall back
+    // to CA-only validation -- the CWE-297 problem this function exists to prevent.
+    return asio::error::make_error_code(asio::error::invalid_argument);
+  }
+
+  // Send SNI so that name-based / multi-tenant TLS endpoints present the correct
+  // certificate for this hostname.
+  {
+    // SSL_set_tlsext_host_name() is a macro that expands to an internal C-style
+    // cast to void*, which trips -Wold-style-cast; suppress it locally.
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wold-style-cast"
+#endif
+    ERR_clear_error();
+    const auto sni_result = SSL_set_tlsext_host_name(stream.native_handle(), hostname.c_str());
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+    if (sni_result != 1) {
+      // Prefer the underlying SSL reason (if any) so failures are diagnosable,
+      // and fall back to a generic error when the SSL error queue is empty.
+      if (const auto reason = ERR_get_error(); reason != 0) {
+        return { static_cast<int>(reason), asio::error::get_ssl_category() };
+      }
+      return asio::error::make_error_code(asio::error::invalid_argument);
+    }
+  }
+
+  // Verify that the presented certificate actually identifies `hostname`
+  // (SAN/CN). asio::ssl::verify_peer on its own only validates the certificate
+  // chain, not the name. In verify_none mode OpenSSL ignores the callback
+  // result, so this has no effect there.
+  std::error_code ec{};
+  stream.set_verify_callback(asio::ssl::host_name_verification(hostname), ec);
+  return ec;
+}
+
 stream_impl::stream_impl(asio::io_context& ctx, bool is_tls)
   : strand_(asio::make_strand(ctx))
   , tls_(is_tls)
   , id_(uuid::to_string(uuid::random()))
+  , owner_pid_(current_process_id())
 {
 }
 
@@ -79,12 +195,20 @@ plain_stream_impl::close(utils::movable_function<void(std::error_code)>&& handle
   if (!stream_) {
     return handler(asio::error::bad_descriptor);
   }
-  return asio::post(strand_, [stream = std::move(stream_), handler = std::move(handler)]() {
-    asio::error_code ec{};
-    stream->shutdown(asio::socket_base::shutdown_both, ec);
-    stream->close(ec);
-    handler(ec);
-  });
+  return asio::post(
+    strand_, [stream = std::move(stream_), owner_pid = owner_pid_, handler = std::move(handler)]() {
+      asio::error_code ec{};
+      // Decide here rather than when this was posted: io_.stop() at fork_prepare
+      // does not drain the queue, so a close queued before the fork runs in the
+      // child once the io_context is restarted, and there the answer differs.
+      if (owner_pid != current_process_id()) {
+        detach_inherited_socket(*stream, ec);
+      } else {
+        stream->shutdown(asio::socket_base::shutdown_both, ec);
+        stream->close(ec);
+      }
+      handler(ec);
+    });
 }
 
 void
@@ -178,12 +302,19 @@ tls_stream_impl::close(utils::movable_function<void(std::error_code)>&& handler)
   if (!stream_) {
     return handler(asio::error::bad_descriptor);
   }
-  return asio::post(strand_, [stream = std::move(stream_), handler = std::move(handler)]() {
-    asio::error_code ec{};
-    stream->lowest_layer().shutdown(asio::socket_base::shutdown_both, ec);
-    stream->lowest_layer().close(ec);
-    handler(ec);
-  });
+  return asio::post(
+    strand_, [stream = std::move(stream_), owner_pid = owner_pid_, handler = std::move(handler)]() {
+      asio::error_code ec{};
+      // See plain_stream_impl::close(): the inheritance test belongs here, not at
+      // post time.
+      if (owner_pid != current_process_id()) {
+        detach_inherited_socket(stream->lowest_layer(), ec);
+      } else {
+        stream->lowest_layer().shutdown(asio::socket_base::shutdown_both, ec);
+        stream->lowest_layer().close(ec);
+      }
+      handler(ec);
+    });
 }
 
 void

data/ext/couchbase/core/io/streams.hxx

@@ -65,6 +65,12 @@ protected:
   asio::strand<asio::io_context::executor_type> strand_;
   bool tls_;
   std::string id_{};
+  // Identifies the process that opened this socket. close() compares it against
+  // the process running at that moment to tell a socket inherited across fork(2)
+  // apart from one this process opened itself, because an inherited socket must not
+  // be shut down: shutdown(2) acts on the open file description, which fork(2)
+  // shares, so it would tear down a connection the parent is still using.
+  long long owner_pid_;
 
 public:
   stream_impl(asio::io_context& ctx, bool is_tls);

data/ext/couchbase/core/operations/document_get_all_replicas.hxx

@@ -18,6 +18,7 @@
 #pragma once
 
 #include <couchbase/error_codes.hxx>
+#include <couchbase/node_id.hxx>
 
 #include "core/error_context/key_value.hxx"
 #include "core/impl/get_replica.hxx"
@@ -40,6 +41,7 @@ struct get_all_replicas_response {
     couchbase::cas cas{};
     std::uint32_t flags{};
     bool replica{ true };
+    couchbase::node_id dispatched_to_node_id{};
   };
   key_value_error_context ctx{};
   std::vector<entry> entries{};
@@ -156,8 +158,12 @@ struct get_all_replicas_request {
                       return;
                     }
                   } else {
-                    ctx->result_.emplace_back(get_all_replicas_response::entry{
-                      std::move(resp.value), resp.cas, resp.flags, true /* replica */ });
+                    ctx->result_.emplace_back(
+                      get_all_replicas_response::entry{ std::move(resp.value),
+                                                        resp.cas,
+                                                        resp.flags,
+                                                        true /* replica */,
+                                                        resp.ctx.last_dispatched_to_node_id() });
                   }
                   if (ctx->expected_responses_ == 0) {
                     ctx->done_ = true;
@@ -203,8 +209,12 @@ struct get_all_replicas_request {
                       return;
                     }
                   } else {
-                    ctx->result_.emplace_back(get_all_replicas_response::entry{
-                      std::move(resp.value), resp.cas, resp.flags, false /* active */ });
+                    ctx->result_.emplace_back(
+                      get_all_replicas_response::entry{ std::move(resp.value),
+                                                        resp.cas,
+                                                        resp.flags,
+                                                        false /* active */,
+                                                        resp.ctx.last_dispatched_to_node_id() });
                   }
                   if (ctx->expected_responses_ == 0) {
                     ctx->done_ = true;

data/ext/couchbase/core/operations/document_get_projected.cxx

@@ -210,14 +210,13 @@ get_projected_request::make_response(key_value_error_context&& ctx,
           response.ctx.override_ec(errc::common::parsing_failure);
           return response;
         }
-        tao::json::value new_doc;
+        tao::json::value new_doc = tao::json::empty_object;
         for (const auto& projection : projections) {
           if (auto value_to_apply = subdoc_lookup(full_doc, projection)) {
             subdoc_apply_projection(new_doc, projection, *value_to_apply, preserve_array_indexes);
-          } else {
-            response.ctx.override_ec(errc::key_value::path_not_found);
-            return response;
           }
+          // We ignore paths that were not found, similar to how we ignore them in the subdoc
+          // multi-lookup below.
         }
         response.value = utils::json::generate_binary(new_doc);
       }

data/ext/couchbase/core/operations/document_lookup_in_all_replicas.hxx

@@ -28,6 +28,7 @@
 
 #include <couchbase/codec/encoded_value.hxx>
 #include <couchbase/error_codes.hxx>
+#include <couchbase/node_id.hxx>
 
 #include <functional>
 #include <memory>
@@ -50,6 +51,7 @@ struct lookup_in_all_replicas_response {
     couchbase::cas cas{};
     bool deleted{ false };
     bool is_replica{ true };
+    couchbase::node_id dispatched_to_node_id{};
   };
   subdocument_error_context ctx{};
   std::vector<entry> entries{};
@@ -203,6 +205,7 @@ struct lookup_in_all_replicas_request {
                       top_entry.cas = resp.cas;
                       top_entry.deleted = resp.deleted;
                       top_entry.is_replica = true;
+                      top_entry.dispatched_to_node_id = resp.ctx.last_dispatched_to_node_id();
                       for (auto& field : resp.fields) {
                         lookup_in_all_replicas_response::entry::lookup_in_entry lookup_in_entry{};
                         lookup_in_entry.path = field.path;
@@ -267,6 +270,7 @@ struct lookup_in_all_replicas_request {
                         top_entry.cas = resp.cas;
                         top_entry.deleted = resp.deleted;
                         top_entry.is_replica = false;
+                        top_entry.dispatched_to_node_id = resp.ctx.last_dispatched_to_node_id();
                         for (auto& field : resp.fields) {
                           lookup_in_all_replicas_response::entry::lookup_in_entry lookup_in_entry{};
                           lookup_in_entry.path = field.path;

data/ext/couchbase/core/operations/document_query.cxx

@@ -20,6 +20,7 @@
 #include "core/cluster_options.hxx"
 #include "core/logger/logger.hxx"
 #include "core/operations/management/error_utils.hxx"
+#include "core/utils/contains_string.hxx"
 #include "core/utils/duration_parser.hxx"
 #include "core/utils/json.hxx"
 
@@ -28,13 +29,11 @@
 #include <gsl/assert>
 #include <tao/json/value.hpp>
 
-#include <regex>
-
 namespace couchbase::core::operations
 {
 auto
-query_request::encode_to(query_request::encoded_request_type& encoded,
-                         http_context& context) -> std::error_code
+query_request::encode_to(query_request::encoded_request_type& encoded, http_context& context)
+  -> std::error_code
 {
   ctx_.emplace(context);
   tao::json::value body{
@@ -209,8 +208,8 @@ query_request::encode_to(query_request::encoded_request_type& encoded,
 }
 
 auto
-query_request::make_response(error_context::query&& ctx,
-                             const encoded_response_type& encoded) -> query_response
+query_request::make_response(error_context::query&& ctx, const encoded_response_type& encoded)
+  -> query_response
 {
   query_response response{ std::move(ctx) };
   response.ctx.statement = statement;
@@ -374,13 +373,14 @@ query_request::make_response(error_context::query&& ctx,
             response.ctx.ec = errc::common::index_exists;
             break;
           case 5000: /* IKey: "Internal Error" */
-            if (std::regex_search(response.ctx.first_error_message,
-                                  std::regex{ ".*[iI]ndex .*already exist.*" })) {
+            if (utils::contains_string(response.ctx.first_error_message, "index", true) &&
+                utils::contains_string(response.ctx.first_error_message, "already exist", true)) {
               response.ctx.ec = errc::common::index_exists;
-            } else if (response.ctx.first_error_message.find("Index does not exist") !=
-                         std::string::npos ||
-                       std::regex_search(response.ctx.first_error_message,
-                                         std::regex{ ".*[iI]ndex .*[nN]ot [fF]ound.*" })) {
+            } else if (utils::contains_string(response.ctx.first_error_message,
+                                              "Index does not exist") ||
+                       (utils::contains_string(response.ctx.first_error_message, "index", true) &&
+                        utils::contains_string(
+                          response.ctx.first_error_message, "not found", true))) {
               response.ctx.ec = errc::common::index_not_found;
             } else if (response.ctx.first_error_message.find("Bucket Not Found") !=
                        std::string::npos) {