dalli 5.1.1 → 5.2.2

data/lib/dalli/protocol/base.rb

@@ -18,7 +18,8 @@ module Dalli
 
       def_delegators :@value_marshaller, :serializer, :compressor, :compression_min_size, :compress_by_default?
       def_delegators :@connection_manager, :name, :hostname, :port, :close, :socket_timeout,
-                     :socket_type, :up!, :down!, :write, :reconnect_down_server?, :raise_down_error
+                     :socket_type, :up!, :down!, :write, :reconnect_down_server?, :raise_down_error,
+                     :quiet_responses_pending?
 
       # Delegated by hand rather than with def_delegators because they run on
       # every request, and a plain method call is cheaper than a Forwardable one.
@@ -41,6 +42,7 @@ module Dalli
         warn_uri_credentials(user_creds)
         @options = client_options.merge(user_creds)
         @raw_mode = client_options[:raw]
+        @defer_drain = client_options[:defer_drain] ? true : false
         @value_marshaller = @raw_mode ? StringMarshaller.new(@options) : ValueMarshaller.new(@options)
         @connection_manager = ConnectionManager.new(hostname, port, socket_type, @options)
       end
@@ -51,6 +53,14 @@ module Dalli
         @raw_mode
       end
 
+      # True when values should come back as stored: the client is in raw mode,
+      # or this request passed raw: true. Retrieval paths use it to skip
+      # requesting flags, so a stored value is never deserialized or
+      # decompressed for a caller who asked for raw bytes.
+      def raw_request?(options)
+        raw_mode? || (options.is_a?(Hash) && options[:raw]) ? true : false
+      end
+
       # Chokepoint method for error handling and ensuring liveness
       def request(opkey, *args)
         verify_state(opkey)
@@ -58,7 +68,11 @@ module Dalli
         begin
           request_completed = false
           @connection_manager.start_request!
+          drain_deferred_quiet_responses(opkey)
           response = send(opkey, *args)
+          # Quiet requests can leave replies on the socket; remember that so the
+          # end of the quiet block knows this server needs draining
+          @connection_manager.mark_quiet_responses_pending! if quiet? && opkey != :noop
 
           # pipelined_get/pipelined_get_interleaved emit query but don't read the response(s)
           @connection_manager.finish_request! unless %i[pipelined_get pipelined_get_interleaved].include?(opkey)
@@ -142,7 +156,15 @@ module Dalli
         reconnect_on_pipeline_complete!
         values = nil
 
-        response_buffer.read
+        # Only the read is socket I/O. The caller's block runs below, outside
+        # this rescue, so an Errno or Timeout::Error it raises reaches the
+        # caller instead of being mistaken for a network failure (which closed
+        # the connection and retried the whole get_multi, yielding keys twice).
+        begin
+          response_buffer.read
+        rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
+          @connection_manager.error_on_request!(e)
+        end
 
         status, cas, key, value = response_buffer.process_single_getk_response
         # status is not nil only if we have a full response to parse
@@ -168,8 +190,6 @@ module Dalli
         end
 
         values || {}
-      rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
-        @connection_manager.error_on_request!(e)
       end
       # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
@@ -183,10 +203,13 @@ module Dalli
         @connection_manager.abort_request!
         return true unless connected?
 
-        # Closes the connection, which ensures that our connection
-        # is in a clean state for future requests
-        @connection_manager.error_on_request!('External timeout')
-      rescue NetworkError
+        # Closes the connection, which ensures that our connection is in a
+        # clean state for future requests. The get_multi ran out of time
+        # overall rather than hitting a socket error, so it doesn't count
+        # toward socket_max_failures: two slow get_multis in a row would
+        # otherwise mark a healthy server down.
+        Dalli.logger.warn { "#{name} didn't finish a get_multi within socket_timeout; closing the connection" }
+        @connection_manager.close
         true
       end
 
@@ -217,6 +240,14 @@ module Dalli
       ALLOWED_QUIET_OPS = %i[add replace set delete incr decr append prepend flush noop].freeze
       private_constant :ALLOWED_QUIET_OPS
 
+      # With defer_drain, quiet blocks leave their replies unread. Read them
+      # before any non-quiet request, which reads a reply of its own.
+      def drain_deferred_quiet_responses(opkey)
+        return unless @defer_drain && !quiet? && opkey != :noop && @connection_manager.quiet_responses_pending?
+
+        noop
+      end
+
       def verify_allowed_quiet!(opkey)
         return if ALLOWED_QUIET_OPS.include?(opkey)
 
@@ -314,6 +345,7 @@ module Dalli
         # Use clear (not reset) to keep pipeline_complete? = true, which is
         # the expected state before pipeline_response_setup is called.
         response_buffer.clear
+        response_buffer.raw = raw_request?(options)
 
         # The terminating noop is sent by pipeline_response_setup
         write(quiet_get_requests(keys, options, return_cas: return_cas))
@@ -325,6 +357,7 @@ module Dalli
       def pipelined_get_interleaved(keys, chunk_size, results, options = nil)
         # Initialize the response buffer for draining during send phase
         response_buffer.ensure_ready
+        response_buffer.raw = raw_request?(options)
 
         keys.each_slice(chunk_size) do |chunk|
           # Build and write this chunk of requests

data/lib/dalli/protocol/connection_manager.rb

@@ -33,9 +33,13 @@ module Dalli
         @socket_type = socket_type
         @options = DEFAULTS.merge(client_options)
         @request_in_progress = false
+        @quiet_responses_pending = false
         @sock = nil
         @pid = nil
+        @write_buffer = []
+        @write_buffer_bytes = 0
 
+        @fail_count = 0
         reset_down_info
       end
 
@@ -51,9 +55,11 @@ module Dalli
         Dalli.logger.debug { "Dalli::Server#connect #{name}" }
 
         @sock = memcached_socket
-        @sock.sync = false # Enable buffered I/O for better performance
+        # Writes are buffered in @write_buffer instead; see WRITE_BUFFER_FLUSH_BYTES
+        @sock.sync = true
         @pid = Process.pid
         @request_in_progress = false
+        @quiet_responses_pending = false
       rescue SystemCallError, *TIMEOUT_ERRORS, EOFError, SocketError => e
         # SocketError = DNS resolution failure
         error_on_request!(e)
@@ -83,6 +89,8 @@ module Dalli
       def down!
         close
         log_down_detected
+        # Once down_retry_delay passes, the server gets a full set of attempts
+        @fail_count = 0
 
         @error = $ERROR_INFO&.class&.name
         @msg ||= $ERROR_INFO&.message
@@ -112,7 +120,7 @@ module Dalli
         return unless @sock
 
         begin
-          @sock.close
+          close_socket
         rescue StandardError
           nil
         ensure
@@ -123,14 +131,38 @@ module Dalli
           # @request_in_progress == true.
           @sock = nil
           @pid = nil
+          @quiet_responses_pending = false
+          discard_write_buffer
           abort_request!
         end
       end
 
+      # A forked child shares the parent's connection, so it closes only its
+      # own file descriptor. Closing the TLS socket itself would send
+      # close_notify and end the parent's TLS session.
+      def close_socket
+        fork_detected? ? @sock.to_io.close : @sock.close
+      end
+
       def connected?
         !@sock.nil?
       end
 
+      # True when a quiet request was written on this connection and its
+      # replies (memcached only suppresses some of them) haven't been
+      # consumed by a noop yet.
+      def quiet_responses_pending?
+        @quiet_responses_pending
+      end
+
+      def mark_quiet_responses_pending!
+        @quiet_responses_pending = true
+      end
+
+      def clear_quiet_responses_pending!
+        @quiet_responses_pending = false
+      end
+
       def request_in_progress?
         @request_in_progress
       end
@@ -145,6 +177,11 @@ module Dalli
         raise '[Dalli] No request in progress. This may be a bug in Dalli.' unless @request_in_progress
 
         @request_in_progress = false
+        # A completed request is what proves the server healthy again, so the
+        # failure count resets here rather than on reconnect: a server that
+        # accepts connections but never answers would otherwise reset it on
+        # every retry and never reach socket_max_failures.
+        @fail_count = 0
       end
 
       def abort_request!
@@ -152,6 +189,7 @@ module Dalli
       end
 
       def read_line
+        flush_write_buffer
         data = @sock.gets("\r\n")
         error_on_request!('EOF in read_line') if data.nil?
         data
@@ -161,14 +199,29 @@ module Dalli
 
       # JRuby doesn't support IO#timeout=, so use custom readfull implementation
       # CRuby 3.3+ has IO#timeout= which makes IO#read work with timeouts
+      # memcached can't store an item larger than 1 GiB (its -I maximum), so a
+      # reply claiming more (or a negative size) is malformed or hostile.
+      # IO#read allocates the full count up front, so check before reading.
+      MAX_READ_BYTES = (1024 * 1024 * 1024) + 2 # plus the value's trailing "\r\n"
+
+      def check_read_size!(count)
+        return if count.between?(0, MAX_READ_BYTES)
+
+        raise Dalli::DalliError, "Reply size #{count} from #{name} is out of range"
+      end
+
       if RUBY_ENGINE == 'jruby'
         def read(count)
+          check_read_size!(count)
+          flush_write_buffer
           @sock.readfull(count)
         rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
           error_on_request!(e)
         end
       else
         def read(count)
+          check_read_size!(count)
+          flush_write_buffer
           read_bytes(count)
         rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
           error_on_request!(e)
@@ -179,22 +232,34 @@ module Dalli
       # at the call site.
       alias read_exact read
 
+      # Requests are buffered here rather than in the socket's own IO buffer
+      # (the socket is sync). Ruby flushes an IO's write buffer when any process
+      # holding it closes or finalizes the IO, so after a fork a child could
+      # send bytes the parent had buffered but not sent yet: a quiet write would
+      # run twice, or the parent's replies would shift onto the wrong requests.
+      # A forked child discards this buffer instead. Like IO's own buffer, it
+      # is sent once it grows past this size, or when a reply is read.
+      WRITE_BUFFER_FLUSH_BYTES = 64 * 1024
+
       def write(bytes)
-        @sock.write(bytes)
+        @write_buffer << bytes
+        @write_buffer_bytes += bytes.bytesize
+        flush_write_buffer if @write_buffer_bytes >= WRITE_BUFFER_FLUSH_BYTES
+        bytes.bytesize
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, IOError => e
         error_on_request!(e)
       end
 
       def flush
-        @sock.flush
+        flush_write_buffer
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, IOError => e
         error_on_request!(e)
       end
 
       def flushed_write(bytes)
-        written = @sock.write(bytes)
-        @sock.flush
-        written
+        @write_buffer << bytes
+        flush_write_buffer
+        bytes.bytesize
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, IOError => e
         error_on_request!(e)
       end
@@ -202,6 +267,7 @@ module Dalli
       # Non-blocking read.  Here to support the operation
       # of the get_multi operation
       def read_available(...)
+        flush_write_buffer
         @sock.read_available(...)
       end
 
@@ -228,8 +294,9 @@ module Dalli
         raise Dalli::RetryableNetworkError, message
       end
 
+      # Called on connect. Deliberately leaves @fail_count alone; see
+      # finish_request!.
       def reset_down_info
-        @fail_count = 0
         @down_at = nil
         @last_down_at = nil
         @msg = nil
@@ -254,7 +321,8 @@ module Dalli
       def reconnect_on_fork
         message = 'Fork detected, re-connecting child process...'
         Dalli.logger.info { message }
-        # Close socket on a fork and reconnect immediately
+        # Drops anything the parent had buffered, closes the inherited socket
+        # without touching the parent's connection, and reconnects immediately
         close
         establish_connection
       end
@@ -284,6 +352,37 @@ module Dalli
 
       private
 
+      # One write per flush. A TLS socket sends each argument of
+      # write(*parts) as its own record and system call, so the parts are
+      # joined first.
+      def flush_write_buffer
+        return if @write_buffer.empty?
+
+        @sock.write(@write_buffer.size == 1 ? @write_buffer.first : joined_write_buffer)
+        discard_write_buffer
+      end
+
+      # Joined as bytes: requests can mix UTF-8 and binary strings, which
+      # String#<< refuses to combine when both hold non-ASCII bytes
+      if String.method_defined?(:append_as_bytes)
+        def joined_write_buffer
+          out = String.new(capacity: @write_buffer_bytes, encoding: Encoding::BINARY)
+          @write_buffer.each { |part| out.append_as_bytes(part) }
+          out
+        end
+      else
+        def joined_write_buffer
+          out = String.new(capacity: @write_buffer_bytes, encoding: Encoding::BINARY)
+          @write_buffer.each { |part| out << part.b }
+          out
+        end
+      end
+
+      def discard_write_buffer
+        @write_buffer.clear
+        @write_buffer_bytes = 0
+      end
+
       # Reads exactly `count` bytes. IO#read(count) on a blocking socket blocks
       # until it has `count` bytes, accumulating across TCP chunks internally,
       # and only hands back a shorter (or nil) buffer when the stream hits EOF.

data/lib/dalli/protocol/meta.rb

@@ -38,20 +38,20 @@ module Dalli
                 RequestFormatter.plain_meta_get(key, skip_flags)
               end
         flushed_write(req)
-        response_processor.meta_get_with_value(cache_nils: cache_nils?(options))
+        response_processor.meta_get_with_value(cache_nils: cache_nils?(options), raw: raw_request?(options))
       end
 
       def quiet_get_request(key, options = nil)
         # Skip bitflags in raw mode - saves 2 bytes per request and skips parsing
-        RequestFormatter.meta_get(key: key, return_cas: true, quiet: true, skip_flags: raw_mode?,
+        RequestFormatter.meta_get(key: key, return_cas: true, quiet: true, skip_flags: raw_request?(options),
                                   **routing_token_kwargs(options))
       end
 
       # Same requests as quiet_get_request for each key, built in one pass
       # and without the trailing noop.
       def quiet_get_requests(keys, options = nil, return_cas: true)
-        RequestFormatter.multi_meta_get(keys, skip_flags: raw_mode?, return_cas: return_cas, terminate: false,
-                                              **routing_token_kwargs(options))
+        RequestFormatter.multi_meta_get(keys, skip_flags: raw_request?(options), return_cas: return_cas,
+                                              terminate: false, **routing_token_kwargs(options))
       end
 
       def gat(key, ttl, options = nil)
@@ -59,7 +59,7 @@ module Dalli
         skip_flags = raw_mode? || (options && options[:raw])
         req = RequestFormatter.meta_get(key: key, ttl: ttl, skip_flags: skip_flags, **routing_token_kwargs(options))
         flushed_write(req)
-        response_processor.meta_get_with_value(cache_nils: cache_nils?(options))
+        response_processor.meta_get_with_value(cache_nils: cache_nils?(options), raw: raw_request?(options))
       end
 
       def touch(key, ttl)
@@ -72,9 +72,10 @@ module Dalli
       # TODO: This is confusing, as there's a cas command in memcached
       # and this isn't it.  Maybe rename?  Maybe eliminate?
       def cas(key, options = nil)
-        req = RequestFormatter.meta_get(key: key, value: true, return_cas: true, **routing_token_kwargs(options))
+        req = RequestFormatter.meta_get(key: key, value: true, return_cas: true, skip_flags: raw_request?(options),
+                                        **routing_token_kwargs(options))
         flushed_write(req)
-        response_processor.meta_get_with_value_and_cas
+        response_processor.meta_get_with_value_and_cas(raw: raw_request?(options))
       end
 
       # Comprehensive meta get with support for all metadata flags.
@@ -103,7 +104,7 @@ module Dalli
       #   - :last_access - seconds since last access (only if return_last_access: true)
       def meta_get(key, options = {})
         req = RequestFormatter.meta_get(
-          key: key, value: true, return_cas: true,
+          key: key, value: true, return_cas: true, skip_flags: raw_request?(options),
           vivify_ttl: options[:vivify_ttl], recache_ttl: options[:recache_ttl],
           return_hit_status: options[:return_hit_status],
           return_last_access: options[:return_last_access],
@@ -115,7 +116,7 @@ module Dalli
         response_processor.meta_get_with_metadata(
           cache_nils: cache_nils?(options), return_hit_status: options[:return_hit_status],
           return_last_access: options[:return_last_access],
-          return_ttl_remaining: options[:return_ttl_remaining]
+          return_ttl_remaining: options[:return_ttl_remaining], raw: raw_request?(options)
         )
       end
 
@@ -157,12 +158,17 @@ module Dalli
       def write_storage_req(mode, key, raw_value, ttl = nil, cas = nil, options = {}, quiet: quiet?)
         (value, bitflags) = @value_marshaller.store(key, raw_value, options)
         ttl = TtlSanitizer.sanitize(ttl) if ttl
-        req = RequestFormatter.meta_set(key: key, value: value,
-                                        bitflags: bitflags, cas: cas,
-                                        ttl: ttl, mode: mode, quiet: quiet,
-                                        **routing_token_kwargs(options))
+        # eql?(0): only Integer 0 means "no CAS" here; anything else takes the general path
+        req = if mode == :set && !quiet && (cas.nil? || cas.eql?(0)) && !routing_tokens?(options)
+                RequestFormatter.plain_meta_set(key, value.bytesize, bitflags, ttl)
+              else
+                RequestFormatter.meta_set(key: key, value: value,
+                                          bitflags: bitflags, cas: cas,
+                                          ttl: ttl, mode: mode, quiet: quiet,
+                                          **routing_token_kwargs(options))
+              end
         write("#{req}#{value}#{TERMINATOR}")
-        @connection_manager.flush unless quiet
+        finish_write(quiet)
       end
       # rubocop:enable Metrics/ParameterLists
 
@@ -183,7 +189,7 @@ module Dalli
                                         cas: cas, ttl: ttl, mode: mode, quiet: quiet?,
                                         **routing_token_kwargs(options))
         write("#{req}#{value}#{TERMINATOR}")
-        @connection_manager.flush unless quiet?
+        finish_write(quiet?)
       end
 
       # Delete Commands
@@ -191,10 +197,15 @@ module Dalli
       # `options` supports the meta-delete keys :invalidate, :tombstone_ttl and
       # :drop_value, plus :p_token/:l_token; see Dalli::Client#delete.
       def delete(key, cas, options = nil)
-        req = RequestFormatter.meta_delete(key: key, cas: cas, quiet: quiet?,
-                                           **tombstone_kwargs(options), **routing_token_kwargs(options))
+        # Fast path for a plain delete: no options, no CAS, not quiet
+        req = if options.nil? && (cas.nil? || cas.eql?(0)) && !quiet?
+                RequestFormatter.plain_meta_delete(key)
+              else
+                RequestFormatter.meta_delete(key: key, cas: cas, quiet: quiet?,
+                                             **tombstone_kwargs(options), **routing_token_kwargs(options))
+              end
         write(req)
-        @connection_manager.flush unless quiet?
+        finish_write(quiet?)
         response_processor.meta_delete unless quiet?
       end
 
@@ -225,22 +236,34 @@ module Dalli
         ttl = initial ? TtlSanitizer.sanitize(ttl) : nil # Only set a TTL if we want to set a value on miss
         write(RequestFormatter.meta_arithmetic(key: key, delta: delta, initial: initial, incr: incr, ttl: ttl,
                                                quiet: quiet?, **routing_token_kwargs(options)))
-        @connection_manager.flush unless quiet?
+        finish_write(quiet?)
         response_processor.decr_incr unless quiet?
       end
 
       # Other Commands
       def flush(delay = 0)
         write(RequestFormatter.flush(delay: delay))
-        @connection_manager.flush unless quiet?
+        finish_write(quiet?)
         response_processor.flush unless quiet?
       end
 
       # Noop is a keepalive operation but also used to demarcate the end of a set of pipelined commands.
       # We need to read all the responses at once.
+      # A write that expects a reply is flushed so the reply can be read. A write
+      # in a quiet block stays buffered until the block's noop, unless
+      # defer_drain is on: then no noop follows at the end of the block, so it is
+      # flushed right away. (pipelined_set passes quiet: true outside a quiet
+      # block; its caller flushes with a terminating noop.)
+      def finish_write(quiet)
+        @connection_manager.flush if !quiet || (@defer_drain && quiet?)
+      end
+
       def noop
         write_noop
-        response_processor.consume_all_responses_until_mn
+        result = response_processor.consume_all_responses_until_mn
+        # Everything up to and including the MN has been read
+        @connection_manager.clear_quiet_responses_pending!
+        result
       end
 
       def stats(info = nil)
@@ -266,7 +289,7 @@ module Dalli
       # response parsing to minimize per-key overhead. Avoids the PipelinedGetter
       # machinery (IO.select, response buffering, server grouping).
       def read_multi_req(keys, options = nil)
-        is_raw = raw_mode?
+        is_raw = raw_request?(options)
         buffer = RequestFormatter.multi_meta_get(keys, skip_flags: is_raw, **routing_token_kwargs(options))
         flushed_write(buffer)
         buffer.clear
@@ -282,7 +305,7 @@ module Dalli
       # Shared by both the single-server fast path and PipelinedGetter's
       # per-server-group request, so this one change covers both routes.
       def read_multi_with_metadata_req(keys, options = nil)
-        is_raw = raw_mode?
+        is_raw = raw_request?(options)
         buffer = RequestFormatter.multi_meta_get(keys, skip_flags: is_raw, return_cas: true,
                                                        **routing_token_kwargs(options))
         flushed_write(buffer)
@@ -299,7 +322,9 @@ module Dalli
           next unless line.start_with?('VA ')
 
           tokens = line.chomp!(TERMINATOR).split
-          value = @connection_manager.read(tokens[1].to_i + TERMINATOR.bytesize)&.chomp!(TERMINATOR)
+          size = tokens[1].to_i
+          response_processor.check_value_size!(size)
+          value = @connection_manager.read(size + TERMINATOR.bytesize)&.chomp!(TERMINATOR)
           stale = response_processor.stale_from_tokens(tokens)
           cas = response_processor.cas_from_tokens(tokens)
           bitflags = is_raw ? 0 : response_processor.bitflags_from_tokens(tokens)
@@ -313,26 +338,27 @@ module Dalli
 
       def read_multi_get_responses(is_raw)
         hash = {}
-        key_index = is_raw ? 2 : 3
         while (line = @connection_manager.read_line)
           break if line.start_with?('MN')
           next unless line.start_with?('VA ')
 
-          key, value = parse_multi_get_value(line, key_index, is_raw)
+          key, value = parse_multi_get_value(line, is_raw)
           hash[key] = value if key
         end
         hash
       end
 
-      def parse_multi_get_value(line, key_index, is_raw)
-        tokens = line.chomp!(TERMINATOR).split
-        value = @connection_manager.read(tokens[1].to_i + TERMINATOR.bytesize)&.chomp!(TERMINATOR)
-        raw_key = tokens[key_index]
-        return unless raw_key
+      # Reads the "VA <size> [f<flags>] k<key> ..." line in place rather than
+      # splitting it into tokens
+      def parse_multi_get_value(line, is_raw)
+        processor = response_processor
+        size = processor.size_from_va_line(line)
+        processor.check_value_size!(size)
+        value = @connection_manager.read(size + TERMINATOR.bytesize)&.chomp!(TERMINATOR)
+        key = processor.key_from_va_line(line)
+        return unless key
 
-        key = raw_key[1..]
-        key = KeyRegularizer.decode(key) if tokens.include?('b')
-        bitflags = is_raw ? 0 : response_processor.bitflags_from_tokens(tokens)
+        bitflags = is_raw ? 0 : processor.bitflags_from_va_line(line)
         [key, @value_marshaller.retrieve(value, bitflags)]
       end
 

data/lib/dalli/protocol/request_formatter.rb

@@ -63,6 +63,19 @@ module Dalli
           skip_flags ? "mg #{encoded_key(key)} v#{TERMINATOR}" : "mg #{encoded_key(key)} v f#{TERMINATOR}"
         end
 
+        # Fast path for a plain set: mode :set, not quiet, no CAS and no routing
+        # tokens. Produces the same bytes as meta_set(key:, value:, bitflags:, ttl:)
+        # without the keyword-argument handling and incremental string building.
+        def plain_meta_set(key, value_bytesize, bitflags, ttl)
+          flags = bitflags ? " F#{bitflags}" : ''
+          flags += " T#{integer_flag(:ttl, ttl)}" if ttl
+          if KeyRegularizer.required?(key)
+            "ms #{KeyRegularizer.encode(key)} #{value_bytesize} c b#{flags} MS#{TERMINATOR}"
+          else
+            "ms #{key} #{value_bytesize} c#{flags} MS#{TERMINATOR}"
+          end
+        end
+
         # Pass terminate: false to leave off the trailing noop, for callers
         # (the pipelined get) that send it separately.
         def multi_meta_get(keys, skip_flags: false, return_cas: false, terminate: true, p_token: nil, l_token: nil)
@@ -158,6 +171,11 @@ module Dalli
           cmd << TERMINATOR
         end
 
+        # Same bytes as meta_delete(key: key), without the keyword-argument handling
+        def plain_meta_delete(key)
+          "md #{encoded_key(key)}#{TERMINATOR}"
+        end
+
         # Tombstone and routing-token flags apply to every key in the batch;
         # see meta_delete.
         def multi_meta_delete(keys, stale: false, ttl: nil, drop_value: false, p_token: nil, l_token: nil)
@@ -200,11 +218,11 @@ module Dalli
         # specifications to a proxy or router inbetween a client and a
         # memcached daemon."
         #
-        # Empty / nil tokens are treated as no-ops. CRLF and null bytes are
-        # rejected with ArgumentError to prevent the token from being used as a
-        # wire-protocol injection vector (e.g. "foo\r\nflush_all\r\n" would
-        # otherwise be parsed as a second command by memcached or any
-        # intermediate proxy/LB).
+        # Empty / nil tokens are treated as no-ops. Whitespace and control
+        # characters are rejected with ArgumentError so a token can't be used
+        # for wire-protocol injection: CRLF would add a second command (e.g.
+        # "foo\r\nflush_all\r\n"), and a space would add meta flags to this one
+        # (e.g. "foo T1" changing an item's TTL on a read).
         def routing_tokens(p_token: nil, l_token: nil)
           # Only an empty *String* is a no-op. Checking respond_to?(:empty?)
           # instead would also swallow p_token: [] / {} before the type check
@@ -261,15 +279,18 @@ module Dalli
 
         private
 
-        # Disallowed bytes: CR, LF, NUL. Any of these embedded in a routing
-        # token would let the caller inject a second wire-protocol command.
-        ROUTING_TOKEN_FORBIDDEN = /[\r\n\0]/
+        # Disallowed bytes: whitespace and control characters. CR, LF or NUL
+        # would let a token inject a second command; a space would let it add
+        # meta flags (T, N, I, q, ...) to the request it rides on.
+        ROUTING_TOKEN_FORBIDDEN = /[\x00-\x20\x7F]/
         private_constant :ROUTING_TOKEN_FORBIDDEN
 
         def validate_routing_token!(name, value)
           return if value.nil?
           raise ArgumentError, "#{name} must be a String, got #{value.class}" unless value.is_a?(String)
-          raise ArgumentError, "#{name} must not contain CRLF or null bytes" if value.match?(ROUTING_TOKEN_FORBIDDEN)
+          return unless value.match?(ROUTING_TOKEN_FORBIDDEN)
+
+          raise ArgumentError, "#{name} must not contain whitespace or control characters"
         end
 
         # Numeric flag values are written straight into the command line, so a

data/lib/dalli/protocol/response_buffer.rb

@@ -15,6 +15,9 @@ module Dalli
     # when advancing through parsed responses.
     ##
     class ResponseBuffer
+      # Whether the current pipeline was requested with raw: true
+      attr_writer :raw
+
       def initialize(io_source, response_processor)
         @io_source = io_source
         @response_processor = response_processor
@@ -39,7 +42,7 @@ module Dalli
       # Attempts to process a single response from the buffer,
       # advancing the offset past the consumed bytes.
       def process_single_getk_response
-        response = @response_processor.getk_response_from_buffer(@buffer, @offset)
+        response = @response_processor.getk_response_from_buffer(@buffer, @offset, raw: @raw || false)
         @offset += response.pop
         response
       end