couchbase 3.8.2 → 3.9.1

data/ext/couchbase/core/io/mcbp_session.hxx

@@ -17,8 +17,6 @@
 
 #pragma once
 
-#include <couchbase/build_config.hxx>
-
 #include "core/cluster_credentials.hxx"
 #include "core/protocol/hello_feature.hxx"
 #include "core/response_handler.hxx"
@@ -45,18 +43,16 @@ class context;
 } // namespace ssl
 } // namespace asio
 
+namespace couchbase::core::mcbp
+{
+class queue_request;
+} // namespace couchbase::core::mcbp
+
 namespace couchbase::core
 {
 struct origin;
 class config_listener;
 
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-namespace columnar
-{
-class background_bootstrap_listener;
-} // namespace columnar
-#endif
-
 namespace topology
 {
 struct configuration;
@@ -74,6 +70,9 @@ struct bootstrap_error;
 class bootstrap_state_listener;
 } // namespace impl
 
+class app_telemetry_meter;
+class app_telemetry_value_recorder;
+
 namespace io
 {
 class mcbp_session_impl;
@@ -108,7 +107,18 @@ public:
                std::optional<std::string> bucket_name = {},
                std::vector<protocol::hello_feature> known_features = {});
 
-  [[nodiscard]] auto log_prefix() const -> const std::string&;
+  /**
+   * Constructs a session handle from an existing implementation pointer.
+   *
+   * Used internally by @ref mcbp_session_impl to create a lightweight snapshot of
+   * the session that can be passed to @ref response_handler::handle_response without
+   * transferring ownership of the live session.  The snapshot shares the same
+   * @ref impl_ and therefore exposes the same connection metadata (remote/local
+   * address and port) at the time the response is delivered.
+   */
+  explicit mcbp_session(std::shared_ptr<mcbp_session_impl> impl);
+
+  [[nodiscard]] auto log_prefix() const -> std::string;
   [[nodiscard]] auto cancel(std::uint32_t opaque, std::error_code ec, retry_reason reason) -> bool;
   [[nodiscard]] auto is_stopped() const -> bool;
   [[nodiscard]] auto is_bootstrapped() const -> bool;
@@ -120,6 +130,11 @@ public:
   [[nodiscard]] auto supported_features() const -> std::vector<protocol::hello_feature>;
   [[nodiscard]] auto id() const -> const std::string&;
   [[nodiscard]] auto node_uuid() const -> const std::string&;
+  // Resolve the app_telemetry recorder for this connection, cached per connection and re-resolved
+  // only when the meter's generation changes (see app_telemetry_recorder_cache).
+  [[nodiscard]] auto app_telemetry_recorder(app_telemetry_meter& meter,
+                                            const std::string& bucket_name) const
+    -> std::shared_ptr<app_telemetry_value_recorder>;
   [[nodiscard]] auto remote_address() const -> std::string;
   [[nodiscard]] auto remote_hostname() const -> std::string;
   [[nodiscard]] auto remote_port() const -> std::uint16_t;
@@ -128,12 +143,10 @@ public:
   [[nodiscard]] auto bootstrap_hostname() const -> const std::string&;
   [[nodiscard]] auto bootstrap_port() const -> const std::string&;
   [[nodiscard]] auto bootstrap_port_number() const -> std::uint16_t;
-  [[nodiscard]] auto last_bootstrap_error() && -> std::optional<impl::bootstrap_error>;
-  [[nodiscard]] auto last_bootstrap_error() const& -> const std::optional<impl::bootstrap_error>&;
   [[nodiscard]] auto canonical_hostname() const -> const std::string&;
   [[nodiscard]] auto canonical_port_number() const -> std::uint16_t;
   void write_and_flush(std::vector<std::byte>&& buffer);
-  void write_and_subscribe(const std::shared_ptr<mcbp::queue_request>&,
+  void write_and_subscribe(const std::shared_ptr<mcbp::queue_request>& request,
                            const std::shared_ptr<response_handler>& handler);
   void write_and_subscribe(std::uint32_t opaque,
                            std::vector<std::byte>&& data,
@@ -150,16 +163,12 @@ public:
   [[nodiscard]] auto diag_info() const -> diag::endpoint_diag_info;
   void on_configuration_update(std::shared_ptr<config_listener> handler);
   void ping(const std::shared_ptr<diag::ping_reporter>& handler,
-            std::optional<std::chrono::milliseconds> = {}) const;
+            std::optional<std::chrono::milliseconds> timeout = {}) const;
   [[nodiscard]] auto supports_gcccp() const -> bool;
   [[nodiscard]] auto decode_error_code(std::uint16_t code)
     -> std::optional<key_value_error_map_info>;
   void handle_not_my_vbucket(const io::mcbp_message& msg) const;
   void update_collection_uid(const std::string& path, std::uint32_t uid);
-#ifdef COUCHBASE_CXX_CLIENT_COLUMNAR
-  void add_background_bootstrap_listener(
-    std::shared_ptr<columnar::background_bootstrap_listener> listener);
-#endif
 
 private:
   std::shared_ptr<mcbp_session_impl> impl_{ nullptr };

data/ext/couchbase/core/io/opaque_ring_table.hxx

@@ -0,0 +1,145 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2024. Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <unordered_map>
+#include <utility>
+#include <vector>
+
+namespace couchbase::core::io
+{
+/**
+ * Maps a monotonically increasing 32-bit opaque to an in-flight handler without a per-operation
+ * heap allocation.
+ *
+ * The common case uses a fixed ring indexed by `opaque & mask`. Because the opaque increases by one
+ * per operation, in-flight operations occupy distinct slots as long as the range between the oldest
+ * and newest in-flight opaque stays within the ring; when it does not (a slow operation held open
+ * across a full lap of the ring, or opaque wraparound), the colliding entries spill to an overflow
+ * map, so lookups stay correct for any number of in-flight operations.
+ *
+ * Precondition: an opaque is unique while it is in flight — a value is never registered again
+ * before its handler has been taken. The single caller guarantees this by allocating a fresh opaque
+ * per operation, which is what lets insert() store into a free ring slot without also consulting
+ * the overflow map.
+ *
+ * Not thread-safe: callers serialize access.
+ */
+template<typename Handler>
+class opaque_ring_table
+{
+public:
+  // Register a handler for an opaque. Relies on the unique-in-flight precondition: because a fresh
+  // opaque is never already registered, it always finds either a free ring slot or (on a ring
+  // collision) a free overflow entry. If the target ring slot happens to already hold the same
+  // opaque, insert() keeps the existing handler -- but that is a cheap same-slot guard only; the
+  // overflow map is deliberately not consulted (that would add a lookup to every insert on the hot
+  // path). Re-registering an opaque that is still in flight therefore violates the precondition and
+  // is not a supported dedup: if the original spilled to overflow_ and its ring slot has since been
+  // reclaimed, a duplicate would land in the ring and strand the overflow copy.
+  //
+  // The handler is taken by rvalue reference and moved into storage exactly once (handlers are
+  // move-only and every call site passes an rvalue), avoiding the extra move a by-value parameter
+  // would add on the hot path.
+  void insert(std::uint32_t opaque, Handler&& handler);
+
+  // Remove and return the handler for an opaque, or a default-constructed (empty) handler if
+  // absent. The returned handler is the sole owner; dropping it strands the operation, hence
+  // [[nodiscard]].
+  [[nodiscard]] auto take(std::uint32_t opaque) -> Handler;
+
+  // Move out every registered (opaque, handler) pair and clear the table. The returned handlers are
+  // the sole remaining owners, hence [[nodiscard]].
+  [[nodiscard]] auto drain() -> std::vector<std::pair<std::uint32_t, Handler>>;
+
+private:
+  static constexpr std::size_t ring_size = 512;
+  static constexpr std::uint32_t ring_mask = ring_size - 1;
+  // `opaque & ring_mask` is a valid modulo only when the size is a power of two.
+  static_assert((ring_size & (ring_size - 1)) == 0, "ring_size must be a power of two");
+
+  struct slot {
+    std::uint32_t opaque{ 0 };
+    bool occupied{ false };
+    Handler handler{};
+  };
+
+  std::array<slot, ring_size> ring_{};
+  std::unordered_map<std::uint32_t, Handler> overflow_{};
+};
+
+template<typename Handler>
+void
+opaque_ring_table<Handler>::insert(std::uint32_t opaque, Handler&& handler)
+{
+  auto& s = ring_[opaque & ring_mask];
+  if (!s.occupied) {
+    s.opaque = opaque;
+    s.occupied = true;
+    s.handler = std::move(handler);
+    return;
+  }
+  if (s.opaque == opaque) {
+    return; // keep the existing handler (not expected under the unique-opaque precondition)
+  }
+  // the slot is held by a different in-flight opaque (ring collision) — spill to the overflow map
+  overflow_.try_emplace(opaque, std::move(handler));
+}
+
+template<typename Handler>
+auto
+opaque_ring_table<Handler>::take(std::uint32_t opaque) -> Handler
+{
+  auto& s = ring_[opaque & ring_mask];
+  if (s.occupied && s.opaque == opaque) {
+    Handler h = std::move(s.handler);
+    s.handler = Handler{};
+    s.occupied = false;
+    return h;
+  }
+  if (auto it = overflow_.find(opaque); it != overflow_.end()) {
+    Handler h = std::move(it->second);
+    overflow_.erase(it);
+    return h;
+  }
+  return Handler{};
+}
+
+template<typename Handler>
+auto
+opaque_ring_table<Handler>::drain() -> std::vector<std::pair<std::uint32_t, Handler>>
+{
+  std::vector<std::pair<std::uint32_t, Handler>> result;
+  result.reserve(ring_size + overflow_.size());
+  for (auto& s : ring_) {
+    if (s.occupied) {
+      result.emplace_back(s.opaque, std::move(s.handler));
+      s.handler = Handler{};
+      s.occupied = false;
+    }
+  }
+  for (auto& [opaque, h] : overflow_) {
+    result.emplace_back(opaque, std::move(h));
+  }
+  overflow_.clear();
+  return result;
+}
+} // namespace couchbase::core::io

data/ext/couchbase/core/io/retry_orchestrator.hxx

@@ -18,6 +18,7 @@
 #pragma once
 
 #include "core/logger/logger.hxx"
+#include "core/logger/redaction.hxx"
 #include "core/protocol/client_opcode_fmt.hxx"
 
 #include <couchbase/best_effort_retry_strategy.hxx>
@@ -33,8 +34,8 @@ namespace priv
 {
 template<class Command>
 auto
-cap_duration(std::chrono::milliseconds uncapped,
-             std::shared_ptr<Command> command) -> std::chrono::milliseconds
+cap_duration(std::chrono::milliseconds uncapped, std::shared_ptr<Command> command)
+  -> std::chrono::milliseconds
 {
   auto theoretical_deadline = std::chrono::steady_clock::now() + uncapped;
   auto absolute_deadline = command->deadline.expiry();
@@ -63,11 +64,11 @@ retry_with_duration(std::shared_ptr<Manager> manager,
     manager->log_prefix(),
     decltype(command->request)::encoded_request_type::body_type::opcode,
     duration.count(),
-    command->id_,
+    command->id(),
     command->request.partition,
     reason,
     command->request.retries.retry_attempts(),
-    command->session_ ? command->session_->remote_address() : "");
+    logger::system_data(command->session_ ? command->session_->remote_address() : ""));
   manager->schedule_for_retry(command, duration);
 }
 
@@ -98,7 +99,7 @@ maybe_retry(std::shared_ptr<Manager> manager,
   CB_LOG_TRACE(R"({} not retrying operation {} (id="{}", reason={}, attempts={}, ec={} ({})))",
                manager->log_prefix(),
                decltype(command->request)::encoded_request_type::body_type::opcode,
-               command->id_,
+               command->id(),
                reason,
                command->request.retries.retry_attempts(),
                ec.value(),

data/ext/couchbase/core/io/stream_deadline.hxx

@@ -0,0 +1,50 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2026-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include <system_error>
+
+namespace couchbase::core::io
+{
+// Which timeout a whole-stream deadline reports when it fires. The two are not interchangeable: a
+// retry layer may replay a request that definitely did not apply, and must not replay one that may
+// have partially executed. A deadline has no other terminal, so no other value exists.
+enum class deadline_terminal {
+  // The request is read-only, so the server cannot have applied it.
+  unambiguous,
+  // The request may have mutated state before the deadline closed the body.
+  ambiguous,
+};
+
+// Whether a set_deadline call installed anything.
+enum class deadline_state {
+  // Installed. The body closes at the deadline unless something ends it first.
+  armed,
+  // Nothing was installed, and nothing needs to be: the body has already ended, by expiry, by
+  // cancellation, or by having been read to completion. A replayed buffered response starts here.
+  //
+  // This is not end-of-stream. A consumer pulling rows reaches it before its last row, because
+  // the body ends when its bytes are read and the rows parsed from them are handed out
+  // afterwards. A caller arming per operation sees it for the final rows of every stream.
+  body_already_ended,
+};
+
+// The error_code `terminal` is reported as.
+[[nodiscard]] auto
+terminal_error_code(deadline_terminal terminal) -> std::error_code;
+} // namespace couchbase::core::io

data/ext/couchbase/core/io/streams.cxx

@@ -18,16 +18,22 @@
 #include "streams.hxx"
 
 #include "core/platform/uuid.h"
+#include "core/utils/process_id.hxx"
 
 #include <asio.hpp>
 #include <asio/error.hpp>
 #include <asio/ssl.hpp>
+#include <asio/ssl/host_name_verification.hpp>
+// ERR_get_error()/SSL_* come from the OpenSSL or BoringSSL headers pulled in by
+// <asio/ssl.hpp>; do not include <openssl/*.h> directly so the static BoringSSL
+// build (which ships its own headers) keeps working, matching core/io/mcbp_session.cxx.
 
+#include <algorithm>
 #include <cerrno>
+#include <memory>
+#include <mutex>
 
-#if defined(_WIN32)
-#include <process.h>
-#else
+#if !defined(_WIN32)
 #include <unistd.h>
 #endif
 
@@ -35,16 +41,6 @@ namespace couchbase::core::io
 {
 namespace
 {
-auto
-current_process_id() -> long long
-{
-#if defined(_WIN32)
-  return static_cast<long long>(::_getpid());
-#else
-  return static_cast<long long>(::getpid());
-#endif
-}
-
 /**
  * Release a socket this process inherited across fork(2), without disturbing the
  * connection the parent is still using.
@@ -65,10 +61,12 @@ current_process_id() -> long long
  * release() also completes any outstanding asynchronous operations on this socket
  * with operation_aborted, which is what we want: those reads belong to the parent.
  */
-// Takes the basic_socket base rather than tcp::socket so the same code serves both
-// the plain socket and a TLS stream's lowest_layer(), whose type is that base.
+// Takes the basic_socket base rather than a concrete socket type, so the same code serves the
+// plain socket, a TLS stream's lowest_layer(), whose type is that base, and the DNS client's
+// sockets.
+template<typename Protocol>
 void
-detach_inherited_socket(asio::basic_socket<asio::ip::tcp>& socket, asio::error_code& ec)
+detach_inherited_socket(asio::basic_socket<Protocol>& socket, asio::error_code& ec)
 {
   if (!socket.is_open()) {
     ec = asio::error::bad_descriptor;
@@ -140,11 +138,127 @@ configure_tls_handshake(asio::ssl::stream<asio::ip::tcp::socket>& stream,
   return ec;
 }
 
+// The sockets of one io_context, each with the process that opened it. Held weakly: a socket also
+// lives in the handlers that use it, such as a close posted before a fork, and is found there too.
+class inherited_stream_registry : public asio::execution_context::service
+{
+public:
+  static inline asio::execution_context::id id{};
+
+  explicit inherited_stream_registry(asio::execution_context& ctx)
+    : asio::execution_context::service(ctx)
+  {
+  }
+
+  void add(const std::shared_ptr<asio::ip::tcp::socket>& socket)
+  {
+    const std::scoped_lock lock(mutex_);
+    prune();
+    plain_.push_back({ socket, utils::current_process_id() });
+  }
+
+  void add(const std::shared_ptr<asio::ssl::stream<asio::ip::tcp::socket>>& stream)
+  {
+    const std::scoped_lock lock(mutex_);
+    prune();
+    tls_.push_back({ stream, utils::current_process_id() });
+  }
+
+  void add(const std::shared_ptr<asio::ip::udp::socket>& socket)
+  {
+    const std::scoped_lock lock(mutex_);
+    prune();
+    udp_.push_back({ socket, utils::current_process_id() });
+  }
+
+  // The detach result needs no handling. asio's reactive release() fails only on a socket that is
+  // not open, which is skipped here, and once it succeeds the socket is out of the reactor with its
+  // operations aborted, so a failed close(2) cannot let anything run on the parent's connection.
+  void detach_inherited()
+  {
+    const auto pid = utils::current_process_id();
+    const std::scoped_lock lock(mutex_);
+    for (const auto& [weak, owner_pid] : plain_) {
+      if (auto socket = weak.lock(); socket && owner_pid != pid && socket->is_open()) {
+        asio::error_code ec{};
+        detach_inherited_socket(*socket, ec);
+      }
+    }
+    for (const auto& [weak, owner_pid] : tls_) {
+      if (auto stream = weak.lock();
+          stream && owner_pid != pid && stream->lowest_layer().is_open()) {
+        asio::error_code ec{};
+        detach_inherited_socket(stream->lowest_layer(), ec);
+      }
+    }
+    for (const auto& [weak, owner_pid] : udp_) {
+      if (auto socket = weak.lock(); socket && owner_pid != pid && socket->is_open()) {
+        asio::error_code ec{};
+        detach_inherited_socket(*socket, ec);
+      }
+    }
+    prune();
+  }
+
+private:
+  template<typename Stream>
+  struct entry {
+    std::weak_ptr<Stream> stream;
+    std::int64_t owner_pid;
+  };
+
+  void shutdown() override
+  {
+  }
+
+  void prune()
+  {
+    const auto expired = [](const auto& e) {
+      return e.stream.expired();
+    };
+    plain_.erase(std::remove_if(plain_.begin(), plain_.end(), expired), plain_.end());
+    tls_.erase(std::remove_if(tls_.begin(), tls_.end(), expired), tls_.end());
+    udp_.erase(std::remove_if(udp_.begin(), udp_.end(), expired), udp_.end());
+  }
+
+  std::mutex mutex_{};
+  std::vector<entry<asio::ip::tcp::socket>> plain_{};
+  std::vector<entry<asio::ssl::stream<asio::ip::tcp::socket>>> tls_{};
+  std::vector<entry<asio::ip::udp::socket>> udp_{};
+};
+
+void
+detach_inherited_sockets(asio::io_context& ctx)
+{
+  if (asio::has_service<inherited_stream_registry>(ctx)) {
+    asio::use_service<inherited_stream_registry>(static_cast<asio::execution_context&>(ctx))
+      .detach_inherited();
+  }
+}
+
+void
+register_inherited_socket(asio::io_context& ctx,
+                          const std::shared_ptr<asio::ip::tcp::socket>& socket)
+{
+  asio::use_service<inherited_stream_registry>(static_cast<asio::execution_context&>(ctx))
+    .add(socket);
+}
+
+void
+register_inherited_socket(asio::io_context& ctx,
+                          const std::shared_ptr<asio::ip::udp::socket>& socket)
+{
+  asio::use_service<inherited_stream_registry>(static_cast<asio::execution_context&>(ctx))
+    .add(socket);
+}
+
 stream_impl::stream_impl(asio::io_context& ctx, bool is_tls)
-  : strand_(asio::make_strand(ctx))
+  : inherited_(
+      asio::use_service<inherited_stream_registry>(static_cast<asio::execution_context&>(ctx)))
+  , strand_(asio::make_strand(ctx))
   , tls_(is_tls)
   , id_(uuid::to_string(uuid::random()))
-  , owner_pid_(current_process_id())
+  , owner_pid_(utils::current_process_id())
 {
 }
 
@@ -164,6 +278,7 @@ plain_stream_impl::plain_stream_impl(asio::io_context& ctx)
   : stream_impl(ctx, false)
   , stream_(std::make_shared<asio::ip::tcp::socket>(strand_))
 {
+  inherited_.add(stream_);
 }
 
 auto
@@ -201,7 +316,7 @@ plain_stream_impl::close(utils::movable_function<void(std::error_code)>&& handle
       // Decide here rather than when this was posted: io_.stop() at fork_prepare
       // does not drain the queue, so a close queued before the fork runs in the
       // child once the io_context is restarted, and there the answer differs.
-      if (owner_pid != current_process_id()) {
+      if (owner_pid != utils::current_process_id()) {
         detach_inherited_socket(*stream, ec);
       } else {
         stream->shutdown(asio::socket_base::shutdown_both, ec);
@@ -225,11 +340,13 @@ plain_stream_impl::set_options()
 void
 plain_stream_impl::async_connect(
   const asio::ip::tcp::resolver::results_type::endpoint_type& endpoint,
+  const std::string& /* hostname */,
   utils::movable_function<void(std::error_code)>&& handler)
 {
   if (!stream_) {
     id_ = uuid::to_string(uuid::random());
     stream_ = std::make_shared<asio::ip::tcp::socket>(strand_);
+    inherited_.add(stream_);
   }
   return stream_->async_connect(endpoint,
                                 [stream = stream_, handler = std::move(handler)](auto ec) {
@@ -271,6 +388,7 @@ tls_stream_impl::tls_stream_impl(asio::io_context& ctx, tls_context_provider& tl
       std::make_shared<asio::ssl::stream<asio::ip::tcp::socket>>(asio::ip::tcp::socket(strand_),
                                                                  *tls_.get_ctx()))
 {
+  inherited_.add(stream_);
 }
 
 auto
@@ -307,7 +425,7 @@ tls_stream_impl::close(utils::movable_function<void(std::error_code)>&& handler)
       asio::error_code ec{};
       // See plain_stream_impl::close(): the inheritance test belongs here, not at
       // post time.
-      if (owner_pid != current_process_id()) {
+      if (owner_pid != utils::current_process_id()) {
         detach_inherited_socket(stream->lowest_layer(), ec);
       } else {
         stream->lowest_layer().shutdown(asio::socket_base::shutdown_both, ec);
@@ -330,21 +448,33 @@ tls_stream_impl::set_options()
 
 void
 tls_stream_impl::async_connect(const asio::ip::tcp::resolver::results_type::endpoint_type& endpoint,
+                               const std::string& hostname,
                                utils::movable_function<void(std::error_code)>&& handler)
 {
   if (!stream_) {
     id_ = uuid::to_string(uuid::random());
     stream_ = std::make_shared<asio::ssl::stream<asio::ip::tcp::socket>>(
       asio::ip::tcp::socket(strand_), *tls_.get_ctx());
+    inherited_.add(stream_);
   }
   return stream_->lowest_layer().async_connect(
-    endpoint, [stream = stream_, handler = std::move(handler)](std::error_code ec_connect) mutable {
+    endpoint,
+    // hostname is copied into the closure (owning std::string) so the async
+    // handler does not depend on the caller's argument lifetime.
+    [stream = stream_, hostname = hostname, handler = std::move(handler)](
+      std::error_code ec_connect) mutable {
       if (ec_connect == asio::error::operation_aborted) {
         return;
       }
       if (ec_connect) {
         return handler(ec_connect);
       }
+      // Verify the server's identity against `hostname` (SAN/CN) and set SNI
+      // before the handshake. Without this, verify_peer only checks that the
+      // certificate chains to a trusted CA, not that it identifies this host.
+      if (auto ec_identity = configure_tls_handshake(*stream, hostname); ec_identity) {
+        return handler(ec_identity);
+      }
       stream->async_handshake(
         asio::ssl::stream_base::client,
         [stream, handler = std::move(handler)](std::error_code ec_handshake) mutable {