couchbase 3.8.2 → 3.9.0

data/ext/couchbase/core/bucket.hxx

@@ -18,11 +18,14 @@
 #pragma once
 
 #include "config_listener.hxx"
+#include "document_id_redaction.hxx"
 #include "io/mcbp_command.hxx"
+#include "logger/redaction.hxx"
 #include "operations.hxx"
 #include "tls_context_provider.hxx"
 
 #include <asio/bind_executor.hpp>
+#include <asio/dispatch.hpp>
 #include <asio/io_context.hpp>
 #include <asio/post.hpp>
 #include <asio/ssl.hpp>
@@ -59,6 +62,7 @@ class bootstrap_state_listener;
 class app_telemetry_meter;
 
 class bucket_impl;
+class bucket_unit_test_api;
 struct origin;
 
 class bucket
@@ -87,8 +91,21 @@ public:
     }
     auto cmd = std::make_shared<operations::mcbp_command<bucket, Request>>(
       ctx_, shared_from_this(), request, default_timeout());
-    cmd->start([cmd, handler = std::forward<Handler>(handler)](
+    // Capture the command weakly. The completion is stored as cmd->handler_, so a strong capture
+    // forms a cmd -> handler_ -> cmd cycle that is only broken when the handler runs. For
+    // cancellable (replica fan-out) operations the completion is dispatched onto the command strand
+    // and can be discarded by io_context teardown (close() followed by io_context::stop()) before
+    // it runs, which would leak the command and everything it transitively holds (the bucket, its
+    // topology configuration, error map and session buffers). The command's lifetime is anchored
+    // independently by its deadline timer and session registration, so on any real completion the
+    // weak pointer still locks; when it does not, the command has already been torn down and the
+    // caller's response was going to be dropped regardless.
+    cmd->start([weak_cmd = cmd->weak_from_this(), handler = std::forward<Handler>(handler)](
                  std::error_code ec, std::optional<io::mcbp_message>&& msg) mutable {
+      auto cmd = weak_cmd.lock();
+      if (!cmd) {
+        return;
+      }
       using encoded_response_type = typename Request::encoded_response_type;
       std::uint16_t status_code = msg ? msg->header.status() : 0xffffU;
       auto resp = msg ? encoded_response_type(std::move(*msg)) : encoded_response_type{};
@@ -106,47 +123,107 @@ public:
     });
   }
 
-  void connect_session(std::size_t index);
+  [[nodiscard]] auto connect_session(std::size_t index) -> bool;
 
   template<typename Request>
   void map_and_send(std::shared_ptr<operations::mcbp_command<bucket, Request>> cmd)
   {
+    if constexpr (operations::is_cancellable_operation_v<Request>) {
+      // Confine the dispatch path of cancellable (replica fan-out) commands to
+      // the command strand, so writes to session_/opaque_ here cannot race a
+      // sibling-triggered cancellation arriving on an IO thread. This covers
+      // both the initial dispatch and retry re-entry via schedule_for_retry.
+      if (!cmd->strand_.running_in_this_thread()) {
+        return asio::dispatch(cmd->strand_, [self = shared_from_this(), cmd]() {
+          self->map_and_send(cmd);
+        });
+      }
+    }
     if (is_closed()) {
       return cmd->cancel(retry_reason::do_not_retry);
     }
     std::size_t index;
     if (cmd->request.id.use_any_session()) {
+      // An explicit "any node" request is not subject to routing rules of any
+      // kind.
       index = next_session_index();
     } else {
-      auto [partition, server] = map_id(cmd->request.id);
-      if (!server.has_value()) {
-        CB_LOG_TRACE(R"([{}] unable to map key="{}" to the node, id={}, partition={}, rev={})",
-                     log_prefix(),
-                     cmd->request.id,
-                     cmd->id_,
-                     partition,
-                     config_rev());
-        return io::retry_orchestrator::maybe_retry(
-          cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
+      // A request that resolves its own route may still decline to, in which
+      // case it takes the vbucket-map routing below like every other request.
+      std::optional<std::size_t> self_routed;
+      if constexpr (operations::resolves_own_route_v<Request>) {
+        auto config = config_snapshot();
+        if (!config) {
+          return io::retry_orchestrator::maybe_retry(
+            cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
+        }
+        // Resolution happens on every lap, so a topology that changed between
+        // attempts is honoured.
+        if (const auto decision = cmd->request.resolve_route(*config); decision.has_value()) {
+          // Keep the request's partition in step with the latest resolution on
+          // every path, not only the one that dispatches.
+          cmd->request.partition = decision->partition;
+          if (decision->ec) {
+            // Terminal, so the completion is invoked directly: the retry
+            // orchestrator consults the request's retry strategy first, and a
+            // strategy that retries do_not_retry would loop a condition that
+            // cannot resolve itself.
+            return cmd->invoke_handler(decision->ec);
+          }
+          if (!decision->server_index.has_value()) {
+            CB_LOG_TRACE(R"([{}] unable to map key="{}" to the node, id={}, partition={}, rev={})",
+                         log_prefix(),
+                         logger::document(cmd->request.id),
+                         cmd->id(),
+                         decision->partition,
+                         // The snapshot's own revision, not config_rev(): that
+                         // reads config_ again and can name a configuration this
+                         // decision was not taken against.
+                         config->rev_str());
+            return io::retry_orchestrator::maybe_retry(
+              cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
+          }
+          self_routed = decision->server_index;
+        }
+      }
+      if (self_routed.has_value()) {
+        index = self_routed.value();
+      } else {
+        auto [partition, server] = map_id(cmd->request.id);
+        if (!server.has_value()) {
+          CB_LOG_TRACE(R"([{}] unable to map key="{}" to the node, id={}, partition={}, rev={})",
+                       log_prefix(),
+                       logger::document(cmd->request.id),
+                       cmd->id(),
+                       partition,
+                       config_rev());
+          return io::retry_orchestrator::maybe_retry(
+            cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
+        }
+        cmd->request.partition = partition;
+        index = server.value();
       }
-      cmd->request.partition = partition;
-      index = server.value();
     }
     auto session = find_session_by_index(index);
     if (!session || !session->has_config()) {
       CB_LOG_TRACE(
         R"([{}] defer operation id="{}", key="{}", partition={}, index={}, session={}, address="{}", has_config={}, rev={})",
         log_prefix(),
-        cmd->id_,
-        cmd->request.id,
+        cmd->id(),
+        logger::document(cmd->request.id),
         cmd->request.partition,
         index,
         session.has_value(),
-        session.has_value() ? session->bootstrap_address() : "",
+        logger::system_data(session.has_value() ? session->bootstrap_address() : ""),
         session.has_value() && session->has_config(),
         config_rev());
-      if (!session) {
-        connect_session(index);
+      if (!session && !connect_session(index)) {
+        // No bootstrap was started for this node, and only a bootstrap
+        // completion or a bucket close drains the deferred queue. Deferring
+        // the command here would leave it waiting for its deadline, so retry
+        // instead: that re-routes against the current configuration.
+        return io::retry_orchestrator::maybe_retry(
+          cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
       }
       return defer_command([self = shared_from_this(), cmd](std::error_code ec) {
         if (ec == errc::common::request_canceled) {
@@ -160,11 +237,11 @@ public:
         R"([{}] the session has been found for idx={}, but it is stopped, retrying id={}, key="{}", partition={}, session={}, address="{}", rev={})",
         log_prefix(),
         index,
-        cmd->id_,
-        cmd->request.id,
+        cmd->id(),
+        logger::document(cmd->request.id),
         cmd->request.partition,
         session->id(),
-        session->bootstrap_address(),
+        logger::system_data(session->bootstrap_address()),
         config_rev());
       return io::retry_orchestrator::maybe_retry(
         cmd->manager_, cmd, retry_reason::node_not_available, errc::common::request_canceled);
@@ -174,11 +251,11 @@ public:
     CB_LOG_TRACE(
       R"({} send operation id="{}", key="{}", partition={}, index={}, address="{}", rev={})",
       session->log_prefix(),
-      cmd->id_,
-      cmd->request.id,
+      cmd->id(),
+      logger::document(cmd->request.id),
       cmd->request.partition,
       index,
-      session->bootstrap_address(),
+      logger::system_data(session->bootstrap_address()),
       config_rev());
     cmd->send_to(session.value());
   }
@@ -225,6 +302,8 @@ public:
   [[nodiscard]] auto is_closed() const -> bool;
   [[nodiscard]] auto is_configured() const -> bool;
 
+  [[nodiscard]] auto unit_test_api() -> bucket_unit_test_api;
+
   auto direct_dispatch(std::shared_ptr<mcbp::queue_request> req) -> std::error_code;
   auto direct_re_queue(const std::shared_ptr<mcbp::queue_request>& req, bool is_retry)
     -> std::error_code;
@@ -237,6 +316,7 @@ private:
   [[nodiscard]] auto map_id(const document_id& id)
     -> std::pair<std::uint16_t, std::optional<std::size_t>>;
   [[nodiscard]] auto config_rev() const -> std::string;
+  [[nodiscard]] auto config_snapshot() const -> std::shared_ptr<topology::configuration>;
 
   asio::io_context& ctx_;
   std::shared_ptr<bucket_impl> impl_;

data/ext/couchbase/core/bucket_unit_test_api.hxx

@@ -0,0 +1,57 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2020-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include "error_context/key_value_error_map_info.hxx"
+
+#include <couchbase/retry_reason.hxx>
+
+#include <memory>
+#include <optional>
+#include <system_error>
+
+namespace couchbase::core
+{
+class bucket_impl;
+
+namespace mcbp
+{
+class queue_request;
+class queue_response;
+} // namespace mcbp
+
+class bucket_unit_test_api
+{
+public:
+  // The response path a session drives once a request has been written. Reachable in a test only
+  // through here: it decides between completing a request and handing it to a retry, and both
+  // outcomes have to be checkable without a server.
+  void resolve_response(const std::shared_ptr<mcbp::queue_request>& request,
+                        const std::shared_ptr<mcbp::queue_response>& response,
+                        std::error_code ec,
+                        retry_reason reason,
+                        std::optional<key_value_error_map_info> error_info);
+
+private:
+  friend class bucket;
+
+  explicit bucket_unit_test_api(std::shared_ptr<bucket_impl> impl);
+
+  std::shared_ptr<bucket_impl> impl_;
+};
+} // namespace couchbase::core

data/ext/couchbase/core/capella.hxx

@@ -0,0 +1,91 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2020-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include "core/tls_verify_mode.hxx"
+
+#include <cstddef>
+#include <string_view>
+
+namespace couchbase::core
+{
+/**
+ * Returns true if @p hostname is the bare "cloud.couchbase.com" or a dot-bounded
+ * subdomain of it (e.g. "cb.<tenant>.cloud.couchbase.com").
+ *
+ * The comparison is:
+ *  - anchored at the END of the string (a trailing match), so
+ *    "cloud.couchbase.com.evil.example" does NOT match;
+ *  - tolerant of a single trailing dot (the FQDN root label), so
+ *    "cloud.couchbase.com." matches -- otherwise a trailing dot would be a way
+ *    to slip a Capella host past the forced peer verification (the connection
+ *    string grammar accepts trailing dots and origin preserves them verbatim);
+ *  - dot-bounded with a non-empty leftmost label, so "mycloud.couchbase.com"
+ *    does NOT match (no '.' immediately before the suffix) and neither does the
+ *    malformed ".cloud.couchbase.com" (empty leftmost label), while the bare
+ *    domain itself does;
+ *  - ASCII case-insensitive, because DNS hostnames are case-insensitive, so
+ *    "Tenant.Cloud.Couchbase.Com" is still recognised as Capella.
+ */
+[[nodiscard]] inline auto
+is_capella_host(std::string_view hostname) -> bool
+{
+  static constexpr std::string_view suffix = "cloud.couchbase.com"; // lowercase ASCII
+  // Ignore a single trailing dot: "host.cloud.couchbase.com." is the same FQDN
+  // as the dotless form and must not be a way to bypass Capella enforcement.
+  if (!hostname.empty() && hostname.back() == '.') {
+    hostname.remove_suffix(1);
+  }
+  if (hostname.size() < suffix.size()) {
+    return false;
+  }
+  const auto offset = hostname.size() - suffix.size();
+  for (std::size_t i = 0; i < suffix.size(); ++i) {
+    auto c = hostname[offset + i];
+    if (c >= 'A' && c <= 'Z') {
+      c = static_cast<char>(c - 'A' + 'a');
+    }
+    if (c != suffix[i]) {
+      return false;
+    }
+  }
+  // Either the bare apex domain, or a dot-bounded subdomain whose '.' before the
+  // suffix is preceded by at least one label character (so the leading-dot form
+  // ".cloud.couchbase.com", with an empty leftmost label, is rejected).
+  return offset == 0 || (offset > 1 && hostname[offset - 1] == '.');
+}
+
+/**
+ * Resolve the TLS peer-verification mode that is actually applied to a
+ * connection, given the user-requested @p requested mode and whether any target
+ * host is Couchbase Capella (@p connecting_to_capella).
+ *
+ * Connections to Capella are ALWAYS peer-verified: a user-supplied
+ * tls_verify=none is ignored for Capella hosts (returning tls_verify_mode::peer)
+ * so that certificate verification cannot be silently disabled against the
+ * managed service. For every other host the requested mode is honoured verbatim.
+ */
+[[nodiscard]] inline auto
+effective_tls_verify_mode(tls_verify_mode requested, bool connecting_to_capella) -> tls_verify_mode
+{
+  if (connecting_to_capella) {
+    return tls_verify_mode::peer;
+  }
+  return requested;
+}
+} // namespace couchbase::core