couchbase 3.8.2 → 3.9.1

data/ext/couchbase/core/io/streams.hxx

@@ -24,10 +24,12 @@
 #include <asio/error.hpp>
 #include <asio/io_context.hpp>
 #include <asio/ip/tcp.hpp>
+#include <asio/ip/udp.hpp>
 #include <asio/ssl/context.hpp>
 #include <asio/ssl/stream.hpp>
 #include <asio/strand.hpp>
 
+#include <cstdint>
 #include <string>
 #include <vector>
 
@@ -59,9 +61,49 @@ async_resolve(ip_protocol protocol,
   return resolver.async_resolve(hostname, service, std::forward<Handler>(handler));
 }
 
+/**
+ * Configure server-identity verification on a client TLS stream prior to the
+ * handshake: install a hostname (SAN/CN) verification callback and set the SNI
+ * server name. When the underlying context is in verify_none mode the callback
+ * has no effect, but SNI is still set.
+ *
+ * Without this, asio::ssl::verify_peer only validates that the certificate
+ * chains to a trusted CA -- it does NOT check that the certificate identifies
+ * the host being contacted (CWE-297).
+ *
+ * @param stream the client TLS stream that has connected but not yet handshaken
+ * @param hostname the canonical hostname the caller intended to reach; must not
+ * be empty (an empty hostname is rejected to avoid silently falling back to
+ * CA-only validation)
+ * @return a non-empty error_code if the hostname is empty, SNI could not be set,
+ * or the hostname-verification callback could not be installed; empty on success
+ */
+[[nodiscard]] auto
+configure_tls_handshake(asio::ssl::stream<asio::ip::tcp::socket>& stream,
+                        const std::string& hostname) -> std::error_code;
+
+class inherited_stream_registry;
+
+// For a forked child, after io_context::notify_fork(fork_child) and before anything runs on ctx:
+// releases and closes every registered stream and socket on ctx that another process opened,
+// without shutdown(2). No pending operation on them can then read or write a connection the
+// parent is still using. The DNS client registers its sockets through register_inherited_socket().
+void
+detach_inherited_sockets(asio::io_context& ctx);
+
+// Records a socket on ctx that is not a stream, so that detach_inherited_sockets() in a forked
+// child releases it. Held weakly: the registry does not keep the socket alive.
+void
+register_inherited_socket(asio::io_context& ctx,
+                          const std::shared_ptr<asio::ip::tcp::socket>& socket);
+void
+register_inherited_socket(asio::io_context& ctx,
+                          const std::shared_ptr<asio::ip::udp::socket>& socket);
+
 class stream_impl
 {
 protected:
+  inherited_stream_registry& inherited_;
   asio::strand<asio::io_context::executor_type> strand_;
   bool tls_;
   std::string id_{};
@@ -70,7 +112,7 @@ protected:
   // apart from one this process opened itself, because an inherited socket must not
   // be shut down: shutdown(2) acts on the open file description, which fork(2)
   // shares, so it would tear down a connection the parent is still using.
-  long long owner_pid_;
+  std::int64_t owner_pid_;
 
 public:
   stream_impl(asio::io_context& ctx, bool is_tls);
@@ -94,7 +136,10 @@ public:
 
   virtual void set_options() = 0;
 
+  // `hostname` is the canonical name the caller intends to reach; TLS streams use
+  // it to verify the server certificate's identity (SAN/CN) and to set SNI.
   virtual void async_connect(const asio::ip::tcp::resolver::results_type::endpoint_type& endpoint,
+                             const std::string& hostname,
                              utils::movable_function<void(std::error_code)>&& handler) = 0;
 
   virtual void async_write(
@@ -123,6 +168,7 @@ public:
   void set_options() override;
 
   void async_connect(const asio::ip::tcp::resolver::results_type::endpoint_type& endpoint,
+                     const std::string& hostname,
                      utils::movable_function<void(std::error_code)>&& handler) override;
 
   void async_write(std::vector<asio::const_buffer>& buffers,
@@ -151,6 +197,7 @@ public:
   void set_options() override;
 
   void async_connect(const asio::ip::tcp::resolver::results_type::endpoint_type& endpoint,
+                     const std::string& hostname,
                      utils::movable_function<void(std::error_code)>&& handler) override;
 
   void async_write(std::vector<asio::const_buffer>& buffers,

data/ext/couchbase/core/logger/logger.cxx

@@ -62,6 +62,10 @@ std::atomic_int file_logger_version{ 0 };
 std::shared_ptr<couchbase::core::logger::log_callback> log_callback{};
 std::mutex log_callback_mutex;
 std::atomic_int log_callback_version{ 0 };
+// Mirrors "is log_callback set?" so the hot-path predicate can be answered with a single atomic
+// load, without copying the owning shared_ptr. Updated under log_callback_mutex alongside
+// log_callback.
+std::atomic<bool> log_callback_present{ false };
 
 auto
 get_file_logger() -> std::shared_ptr<spdlog::logger>
@@ -94,6 +98,7 @@ update_callback_logger(const std::shared_ptr<couchbase::core::logger::log_callba
 {
   const std::scoped_lock lock(log_callback_mutex);
   log_callback = new_callback;
+  log_callback_present.store(new_callback != nullptr, std::memory_order_relaxed);
   ++log_callback_version;
 }
 
@@ -196,6 +201,14 @@ should_log(level lvl) -> bool
   return false;
 }
 
+auto
+has_custom_callback() -> bool
+{
+  // A log macro asks this on every call; answer it with a single atomic load rather than copying
+  // the owning shared_ptr that get_custom_callback() returns.
+  return log_callback_present.load(std::memory_order_relaxed);
+}
+
 namespace detail
 {
 void
@@ -252,6 +265,29 @@ is_initialized() -> bool
   return get_file_logger() != nullptr;
 }
 
+namespace
+{
+std::atomic<bool> log_redaction_enabled{ false };
+} // namespace
+
+void
+set_log_redaction(bool enable)
+{
+  const auto was_enabled = log_redaction_enabled.exchange(enable, std::memory_order_relaxed);
+  if (enable && !was_enabled) {
+    CB_LOG_INFO_RAW(
+      "Log redaction enabled: sensitive values are wrapped in redaction tags. This log still "
+      "contains identifying information until those tags are processed. Once redacted, diagnosis "
+      "and support of issues may be challenging or not possible");
+  }
+}
+
+auto
+is_log_redaction_enabled() -> bool
+{
+  return log_redaction_enabled.load(std::memory_order_relaxed);
+}
+
 auto
 create_file_logger_impl(const std::string& logger_name, const configuration& logger_settings)
   -> std::pair<std::optional<std::string>, std::shared_ptr<spdlog::logger>>

data/ext/couchbase/core/logger/logger.hxx

@@ -181,6 +181,14 @@ get_lowest_log_level() -> level;
 auto
 should_log(level lvl) -> bool;
 
+/**
+ * @return true if a custom log callback is currently registered. Used to decide whether log
+ * arguments need to be formatted at all, independently of the severity level (the callback does
+ * its own level filtering).
+ */
+auto
+has_custom_callback() -> bool;
+
 auto
 should_log_protocol() -> bool;
 
@@ -265,6 +273,29 @@ shutdown();
  */
 auto
 is_initialized() -> bool;
+
+/**
+ * Enable or disable log redaction.
+ *
+ * Redaction state is process-wide. When enabled, values wrapped by the helpers in
+ * `core/logger/redaction.hxx` are surrounded by `<ud>`/`<md>`/`<sd>` tags so that an external tool
+ * can strip or hash them; the SDK never removes or obscures anything itself.
+ *
+ * Connection-context log prefixes bake their tags in at construction, so redaction must be enabled
+ * *before* connecting for those prefixes to be tagged. Enabling it later affects only prefixes
+ * built afterwards.
+ *
+ * Enabling emits a one-time breadcrumb recording that the log carries redaction tags and still
+ * needs processing. That breadcrumb is dropped if no logger has been initialized yet.
+ */
+void
+set_log_redaction(bool enable);
+
+/**
+ * @return whether log redaction is currently enabled
+ */
+auto
+is_log_redaction_enabled() -> bool;
 } // namespace couchbase::core::logger
 
 #if defined(__GNUC__) || defined(__clang__)
@@ -279,10 +310,17 @@ is_initialized() -> bool;
  */
 #define COUCHBASE_LOG(file, line, function, severity, ...)                                         \
   do {                                                                                             \
-    couchbase::core::logger::log_custom_logger(file, line, function, severity, __VA_ARGS__);       \
-                                                                                                   \
-    if (couchbase::core::logger::should_log(severity)) {                                           \
-      couchbase::core::logger::log(file, line, function, severity, __VA_ARGS__);                   \
+    const bool cb_log_to_file_ = couchbase::core::logger::should_log(severity);                    \
+    const bool cb_log_to_custom_ = couchbase::core::logger::has_custom_callback();                 \
+    if (cb_log_to_file_ || cb_log_to_custom_) {                                                    \
+      auto cb_log_message_ = ::fmt::format(__VA_ARGS__);                                           \
+      if (cb_log_to_custom_) {                                                                     \
+        couchbase::core::logger::detail::log_custom_logger(                                        \
+          file, line, function, severity, cb_log_message_);                                        \
+      }                                                                                            \
+      if (cb_log_to_file_) {                                                                       \
+        couchbase::core::logger::detail::log(file, line, function, severity, cb_log_message_);     \
+      }                                                                                            \
     }                                                                                              \
   } while (false)
 
@@ -343,8 +381,10 @@ is_initialized() -> bool;
  */
 #define COUCHBASE_LOG_RAW(file, line, function, severity, msg)                                     \
   do {                                                                                             \
-    couchbase::core::logger::log_custom_logger(file, line, function, severity, msg);               \
-                                                                                                   \
+    /* msg is already a string; deliver it directly (no fmt::format), gated like COUCHBASE_LOG. */ \
+    if (couchbase::core::logger::has_custom_callback()) {                                          \
+      couchbase::core::logger::detail::log_custom_logger(file, line, function, severity, msg);     \
+    }                                                                                              \
     if (couchbase::core::logger::should_log(severity)) {                                           \
       couchbase::core::logger::detail::log(file, line, function, severity, msg);                   \
     }                                                                                              \