couchbase 3.8.1 → 3.8.2

data/ext/couchbase/core/io/streams.cxx

@@ -23,12 +23,128 @@
 #include <asio/error.hpp>
 #include <asio/ssl.hpp>
 
+#include <cerrno>
+
+#if defined(_WIN32)
+#include <process.h>
+#else
+#include <unistd.h>
+#endif
+
 namespace couchbase::core::io
 {
+namespace
+{
+auto
+current_process_id() -> long long
+{
+#if defined(_WIN32)
+  return static_cast<long long>(::_getpid());
+#else
+  return static_cast<long long>(::getpid());
+#endif
+}
+
+/**
+ * Release a socket this process inherited across fork(2), without disturbing the
+ * connection the parent is still using.
+ *
+ * Two things differ from the ordinary close path, and both matter:
+ *
+ *  * No shutdown(2). It acts on the open file description, which fork(2) shares,
+ *    so it would send FIN and break the parent's connection. close(2) drops only
+ *    our own descriptor; the peer sees nothing.
+ *  * release() before closing, rather than asio's close(). asio's close() skips
+ *    EPOLL_CTL_DEL on the assumption that closing a descriptor removes its epoll
+ *    registration. Per epoll(7) that happens only once *every* descriptor
+ *    referring to the description is closed -- and the parent still holds one --
+ *    so the registration would outlive the descriptor_state asio recycles, which
+ *    is precisely the stale-pointer shape the reactor faults on. release() emits
+ *    the EPOLL_CTL_DEL explicitly and hands back the raw descriptor to close.
+ *
+ * release() also completes any outstanding asynchronous operations on this socket
+ * with operation_aborted, which is what we want: those reads belong to the parent.
+ */
+// Takes the basic_socket base rather than tcp::socket so the same code serves both
+// the plain socket and a TLS stream's lowest_layer(), whose type is that base.
+void
+detach_inherited_socket(asio::basic_socket<asio::ip::tcp>& socket, asio::error_code& ec)
+{
+  if (!socket.is_open()) {
+    ec = asio::error::bad_descriptor;
+    return;
+  }
+
+  const auto handle = socket.release(ec);
+  if (ec) {
+    // Report it. Do not reach for asio's close() here: that is the very call
+    // whose epoll behaviour makes it unsafe on an inherited descriptor, and the
+    // descriptor goes away when this process exits anyway.
+    return;
+  }
+
+#if defined(_WIN32)
+  // Unreachable: without fork(2) no socket is ever inherited, so the owner pid
+  // always matches and close() never takes this path.
+  (void)handle;
+  ec = asio::error::operation_not_supported;
+#else
+  if (::close(handle) != 0) {
+    ec.assign(errno, asio::error::get_system_category());
+  }
+#endif
+}
+} // namespace
+
+auto
+configure_tls_handshake(asio::ssl::stream<asio::ip::tcp::socket>& stream,
+                        const std::string& hostname) -> std::error_code
+{
+  if (hostname.empty()) {
+    // Fail closed: a TLS client connection must have a hostname to verify the
+    // server's identity against. Returning success here would silently fall back
+    // to CA-only validation -- the CWE-297 problem this function exists to prevent.
+    return asio::error::make_error_code(asio::error::invalid_argument);
+  }
+
+  // Send SNI so that name-based / multi-tenant TLS endpoints present the correct
+  // certificate for this hostname.
+  {
+    // SSL_set_tlsext_host_name() is a macro that expands to an internal C-style
+    // cast to void*, which trips -Wold-style-cast; suppress it locally.
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wold-style-cast"
+#endif
+    ERR_clear_error();
+    const auto sni_result = SSL_set_tlsext_host_name(stream.native_handle(), hostname.c_str());
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
+    if (sni_result != 1) {
+      // Prefer the underlying SSL reason (if any) so failures are diagnosable,
+      // and fall back to a generic error when the SSL error queue is empty.
+      if (const auto reason = ERR_get_error(); reason != 0) {
+        return { static_cast<int>(reason), asio::error::get_ssl_category() };
+      }
+      return asio::error::make_error_code(asio::error::invalid_argument);
+    }
+  }
+
+  // Verify that the presented certificate actually identifies `hostname`
+  // (SAN/CN). asio::ssl::verify_peer on its own only validates the certificate
+  // chain, not the name. In verify_none mode OpenSSL ignores the callback
+  // result, so this has no effect there.
+  std::error_code ec{};
+  stream.set_verify_callback(asio::ssl::host_name_verification(hostname), ec);
+  return ec;
+}
+
 stream_impl::stream_impl(asio::io_context& ctx, bool is_tls)
   : strand_(asio::make_strand(ctx))
   , tls_(is_tls)
   , id_(uuid::to_string(uuid::random()))
+  , owner_pid_(current_process_id())
 {
 }
 
@@ -79,12 +195,20 @@ plain_stream_impl::close(utils::movable_function<void(std::error_code)>&& handle
   if (!stream_) {
     return handler(asio::error::bad_descriptor);
   }
-  return asio::post(strand_, [stream = std::move(stream_), handler = std::move(handler)]() {
-    asio::error_code ec{};
-    stream->shutdown(asio::socket_base::shutdown_both, ec);
-    stream->close(ec);
-    handler(ec);
-  });
+  return asio::post(
+    strand_, [stream = std::move(stream_), owner_pid = owner_pid_, handler = std::move(handler)]() {
+      asio::error_code ec{};
+      // Decide here rather than when this was posted: io_.stop() at fork_prepare
+      // does not drain the queue, so a close queued before the fork runs in the
+      // child once the io_context is restarted, and there the answer differs.
+      if (owner_pid != current_process_id()) {
+        detach_inherited_socket(*stream, ec);
+      } else {
+        stream->shutdown(asio::socket_base::shutdown_both, ec);
+        stream->close(ec);
+      }
+      handler(ec);
+    });
 }
 
 void
@@ -178,12 +302,19 @@ tls_stream_impl::close(utils::movable_function<void(std::error_code)>&& handler)
   if (!stream_) {
     return handler(asio::error::bad_descriptor);
   }
-  return asio::post(strand_, [stream = std::move(stream_), handler = std::move(handler)]() {
-    asio::error_code ec{};
-    stream->lowest_layer().shutdown(asio::socket_base::shutdown_both, ec);
-    stream->lowest_layer().close(ec);
-    handler(ec);
-  });
+  return asio::post(
+    strand_, [stream = std::move(stream_), owner_pid = owner_pid_, handler = std::move(handler)]() {
+      asio::error_code ec{};
+      // See plain_stream_impl::close(): the inheritance test belongs here, not at
+      // post time.
+      if (owner_pid != current_process_id()) {
+        detach_inherited_socket(stream->lowest_layer(), ec);
+      } else {
+        stream->lowest_layer().shutdown(asio::socket_base::shutdown_both, ec);
+        stream->lowest_layer().close(ec);
+      }
+      handler(ec);
+    });
 }
 
 void

data/ext/couchbase/core/io/streams.hxx

@@ -65,6 +65,12 @@ protected:
   asio::strand<asio::io_context::executor_type> strand_;
   bool tls_;
   std::string id_{};
+  // Identifies the process that opened this socket. close() compares it against
+  // the process running at that moment to tell a socket inherited across fork(2)
+  // apart from one this process opened itself, because an inherited socket must not
+  // be shut down: shutdown(2) acts on the open file description, which fork(2)
+  // shares, so it would tear down a connection the parent is still using.
+  long long owner_pid_;
 
 public:
   stream_impl(asio::io_context& ctx, bool is_tls);

data/ext/couchbase/core/operations/management/bucket_create.cxx

@@ -30,104 +30,101 @@ namespace couchbase::core::operations::management
 {
 
 auto
-bucket_create_request::encode_to(encoded_request_type& encoded,
-                                 http_context& /* context */) const -> std::error_code
+bucket_create_request::encode_to(encoded_request_type& encoded, http_context& /* context */) const
+  -> std::error_code
 {
   encoded.method = "POST";
   encoded.path = "/pools/default/buckets";
 
   encoded.headers["content-type"] = "application/x-www-form-urlencoded";
-  encoded.body.append(fmt::format("name={}", utils::string_codec::form_encode(bucket.name)));
+
+  std::map<std::string, std::string> values{};
+  values["name"] = bucket.name;
   switch (bucket.bucket_type) {
     case couchbase::core::management::cluster::bucket_type::couchbase:
-      encoded.body.append("&bucketType=couchbase");
+      values["bucketType"] = "couchbase";
       break;
     case couchbase::core::management::cluster::bucket_type::memcached:
-      encoded.body.append("&bucketType=memcached");
+      values["bucketType"] = "memcached";
       break;
     case couchbase::core::management::cluster::bucket_type::ephemeral:
-      encoded.body.append("&bucketType=ephemeral");
+      values["bucketType"] = "ephemeral";
       break;
     case couchbase::core::management::cluster::bucket_type::unknown:
       break;
   }
   if (bucket.ram_quota_mb == 0) {
-    encoded.body.append(fmt::format(
-      "&ramQuotaMB={}", 100)); // If not explicitly set, set to prior default value of 100
+    values["ramQuotaMB"] = "100"; // If not explicitly set, set to prior default value of 100
   } else {
-    encoded.body.append(fmt::format("&ramQuotaMB={}", bucket.ram_quota_mb));
+    values["ramQuotaMB"] = std::to_string(bucket.ram_quota_mb);
   }
 
   if (bucket.bucket_type != couchbase::core::management::cluster::bucket_type::memcached &&
       bucket.num_replicas.has_value()) {
-    encoded.body.append(fmt::format("&replicaNumber={}", bucket.num_replicas.value()));
+    values["replicaNumber"] = std::to_string(bucket.num_replicas.value());
   }
   if (bucket.max_expiry.has_value()) {
-    encoded.body.append(fmt::format("&maxTTL={}", bucket.max_expiry.value()));
+    values["maxTTL"] = std::to_string(bucket.max_expiry.value());
   }
   if (bucket.bucket_type != couchbase::core::management::cluster::bucket_type::ephemeral &&
       bucket.replica_indexes.has_value()) {
-    encoded.body.append(
-      fmt::format("&replicaIndex={}", bucket.replica_indexes.value() ? "1" : "0"));
+    values["replicaIndex"] = bucket.replica_indexes.value() ? "1" : "0";
   }
   if (bucket.history_retention_collection_default.has_value()) {
-    encoded.body.append(
-      fmt::format("&historyRetentionCollectionDefault={}",
-                  bucket.history_retention_collection_default.value() ? "true" : "false"));
+    values["historyRetentionCollectionDefault"] =
+      bucket.history_retention_collection_default.value() ? "true" : "false";
   }
   if (bucket.history_retention_bytes.has_value()) {
-    encoded.body.append(
-      fmt::format("&historyRetentionBytes={}", bucket.history_retention_bytes.value()));
+    values["historyRetentionBytes"] = std::to_string(bucket.history_retention_bytes.value());
   }
   if (bucket.history_retention_duration.has_value()) {
-    encoded.body.append(
-      fmt::format("&historyRetentionSeconds={}", bucket.history_retention_duration.value()));
+    values["historyRetentionSeconds"] = std::to_string(bucket.history_retention_duration.value());
   }
   if (bucket.flush_enabled.has_value()) {
-    encoded.body.append(fmt::format("&flushEnabled={}", bucket.flush_enabled.value() ? "1" : "0"));
+    values["flushEnabled"] = bucket.flush_enabled.value() ? "1" : "0";
   }
   if (bucket.num_vbuckets.has_value()) {
-    encoded.body.append(fmt::format("&numVBuckets={}", bucket.num_vbuckets.value()));
+    values["numVBuckets"] = std::to_string(bucket.num_vbuckets.value());
   }
 
   switch (bucket.eviction_policy) {
     case couchbase::core::management::cluster::bucket_eviction_policy::full:
-      encoded.body.append("&evictionPolicy=fullEviction");
+      values["evictionPolicy"] = "fullEviction";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::value_only:
-      encoded.body.append("&evictionPolicy=valueOnly");
+      values["evictionPolicy"] = "valueOnly";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::no_eviction:
-      encoded.body.append("&evictionPolicy=noEviction");
+      values["evictionPolicy"] = "noEviction";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::not_recently_used:
-      encoded.body.append("&evictionPolicy=nruEviction");
+      values["evictionPolicy"] = "nruEviction";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::unknown:
       break;
   }
   switch (bucket.compression_mode) {
     case couchbase::core::management::cluster::bucket_compression::off:
-      encoded.body.append("&compressionMode=off");
+      values["compressionMode"] = "off";
       break;
     case couchbase::core::management::cluster::bucket_compression::active:
-      encoded.body.append("&compressionMode=active");
+      values["compressionMode"] = "active";
       break;
     case couchbase::core::management::cluster::bucket_compression::passive:
-      encoded.body.append("&compressionMode=passive");
+      values["compressionMode"] = "passive";
       break;
     case couchbase::core::management::cluster::bucket_compression::unknown:
       break;
   }
   switch (bucket.conflict_resolution_type) {
     case couchbase::core::management::cluster::bucket_conflict_resolution::timestamp:
-      encoded.body.append("&conflictResolutionType=lww");
+      values["conflictResolutionType"] = "lww";
       break;
     case couchbase::core::management::cluster::bucket_conflict_resolution::sequence_number:
-      encoded.body.append("&conflictResolutionType=seqno");
+      values["conflictResolutionType"] = "seqno";
       break;
     case couchbase::core::management::cluster::bucket_conflict_resolution::custom:
-      encoded.body.append("&conflictResolutionType=custom");
+      values["conflictResolutionType"] = "custom";
       break;
     case couchbase::core::management::cluster::bucket_conflict_resolution::unknown:
       break;
@@ -135,16 +132,16 @@ bucket_create_request::encode_to(encoded_request_type& encoded,
   if (bucket.minimum_durability_level.has_value()) {
     switch (bucket.minimum_durability_level.value()) {
       case durability_level::none:
-        encoded.body.append("&durabilityMinLevel=none");
+        values["durabilityMinLevel"] = "none";
         break;
       case durability_level::majority:
-        encoded.body.append("&durabilityMinLevel=majority");
+        values["durabilityMinLevel"] = "majority";
         break;
       case durability_level::majority_and_persist_to_active:
-        encoded.body.append("&durabilityMinLevel=majorityAndPersistActive");
+        values["durabilityMinLevel"] = "majorityAndPersistActive";
         break;
       case durability_level::persist_to_majority:
-        encoded.body.append("&durabilityMinLevel=persistToMajority");
+        values["durabilityMinLevel"] = "persistToMajority";
         break;
     }
   }
@@ -152,12 +149,14 @@ bucket_create_request::encode_to(encoded_request_type& encoded,
     case couchbase::core::management::cluster::bucket_storage_backend::unknown:
       break;
     case couchbase::core::management::cluster::bucket_storage_backend::couchstore:
-      encoded.body.append("&storageBackend=couchstore");
+      values["storageBackend"] = "couchstore";
       break;
     case couchbase::core::management::cluster::bucket_storage_backend::magma:
-      encoded.body.append("&storageBackend=magma");
+      values["storageBackend"] = "magma";
       break;
   }
+
+  encoded.body = utils::string_codec::v2::form_encode(values);
   return {};
 }
 auto

data/ext/couchbase/core/operations/management/bucket_update.cxx

@@ -30,8 +30,8 @@
 namespace couchbase::core::operations::management
 {
 auto
-bucket_update_request::encode_to(encoded_request_type& encoded,
-                                 http_context& /* context */) const -> std::error_code
+bucket_update_request::encode_to(encoded_request_type& encoded, http_context& /* context */) const
+  -> std::error_code
 {
   encoded.method = "POST";
   encoded.path =
@@ -39,65 +39,61 @@ bucket_update_request::encode_to(encoded_request_type& encoded,
 
   encoded.headers["content-type"] = "application/x-www-form-urlencoded";
 
+  std::map<std::string, std::string> values{};
   if (bucket.ram_quota_mb > 0) {
-    encoded.body.append(fmt::format("&ramQuotaMB={}", bucket.ram_quota_mb));
+    values["ramQuotaMB"] = std::to_string(bucket.ram_quota_mb);
   }
   if (bucket.num_replicas.has_value()) {
-    encoded.body.append(fmt::format("&replicaNumber={}", bucket.num_replicas.value()));
+    values["replicaNumber"] = std::to_string(bucket.num_replicas.value());
   }
-
   if (bucket.max_expiry.has_value()) {
-    encoded.body.append(fmt::format("&maxTTL={}", bucket.max_expiry.value()));
+    values["maxTTL"] = std::to_string(bucket.max_expiry.value());
   }
   if (bucket.history_retention_collection_default.has_value()) {
-    encoded.body.append(
-      fmt::format("&historyRetentionCollectionDefault={}",
-                  bucket.history_retention_collection_default.value() ? "true" : "false"));
+    values["historyRetentionCollectionDefault"] =
+      bucket.history_retention_collection_default.value() ? "true" : "false";
   }
   if (bucket.history_retention_bytes.has_value()) {
-    encoded.body.append(
-      fmt::format("&historyRetentionBytes={}", bucket.history_retention_bytes.value()));
+    values["historyRetentionBytes"] = std::to_string(bucket.history_retention_bytes.value());
   }
   if (bucket.history_retention_duration.has_value()) {
-    encoded.body.append(
-      fmt::format("&historyRetentionSeconds={}", bucket.history_retention_duration.value()));
+    values["historyRetentionSeconds"] = std::to_string(bucket.history_retention_duration.value());
   }
   if (bucket.replica_indexes.has_value()) {
-    encoded.body.append(
-      fmt::format("&replicaIndex={}", bucket.replica_indexes.value() ? "1" : "0"));
+    values["replicaIndex"] = bucket.replica_indexes.value() ? "1" : "0";
   }
   if (bucket.flush_enabled.has_value()) {
-    encoded.body.append(fmt::format("&flushEnabled={}", bucket.flush_enabled.value() ? "1" : "0"));
+    values["flushEnabled"] = bucket.flush_enabled.value() ? "1" : "0";
   }
   if (bucket.num_vbuckets.has_value()) {
-    encoded.body.append(fmt::format("&numVBuckets={}", bucket.num_vbuckets.value()));
+    values["numVBuckets"] = std::to_string(bucket.num_vbuckets.value());
   }
 
   switch (bucket.eviction_policy) {
     case couchbase::core::management::cluster::bucket_eviction_policy::full:
-      encoded.body.append("&evictionPolicy=fullEviction");
+      values["evictionPolicy"] = "fullEviction";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::value_only:
-      encoded.body.append("&evictionPolicy=valueOnly");
+      values["evictionPolicy"] = "valueOnly";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::no_eviction:
-      encoded.body.append("&evictionPolicy=noEviction");
+      values["evictionPolicy"] = "noEviction";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::not_recently_used:
-      encoded.body.append("&evictionPolicy=nruEviction");
+      values["evictionPolicy"] = "nruEviction";
       break;
     case couchbase::core::management::cluster::bucket_eviction_policy::unknown:
       break;
   }
   switch (bucket.compression_mode) {
     case couchbase::core::management::cluster::bucket_compression::off:
-      encoded.body.append("&compressionMode=off");
+      values["compressionMode"] = "off";
       break;
     case couchbase::core::management::cluster::bucket_compression::active:
-      encoded.body.append("&compressionMode=active");
+      values["compressionMode"] = "active";
       break;
     case couchbase::core::management::cluster::bucket_compression::passive:
-      encoded.body.append("&compressionMode=passive");
+      values["compressionMode"] = "passive";
       break;
     case couchbase::core::management::cluster::bucket_compression::unknown:
       break;
@@ -105,19 +101,21 @@ bucket_update_request::encode_to(encoded_request_type& encoded,
   if (bucket.minimum_durability_level) {
     switch (bucket.minimum_durability_level.value()) {
       case durability_level::none:
-        encoded.body.append("&durabilityMinLevel=none");
+        values["durabilityMinLevel"] = "none";
         break;
       case durability_level::majority:
-        encoded.body.append("&durabilityMinLevel=majority");
+        values["durabilityMinLevel"] = "majority";
         break;
       case durability_level::majority_and_persist_to_active:
-        encoded.body.append("&durabilityMinLevel=majorityAndPersistActive");
+        values["durabilityMinLevel"] = "majorityAndPersistActive";
         break;
       case durability_level::persist_to_majority:
-        encoded.body.append("&durabilityMinLevel=persistToMajority");
+        values["durabilityMinLevel"] = "persistToMajority";
         break;
     }
   }
+
+  encoded.body = utils::string_codec::v2::form_encode(values);
   return {};
 }