CXXCBC-739: Support mTLS Cert Refresh (without restart)

Author: Matt-Woz

core/cluster.cxx

@@ -24,6 +24,7 @@
 #include "core/app_telemetry_meter.hxx"
 #include "core/app_telemetry_reporter.hxx"
 #include "core/diagnostics.hxx"
+#include "core/error.hxx"
 #include "core/impl/get_replica.hxx"
 #include "core/impl/lookup_in_replica.hxx"
 #include "core/impl/observe_seqno.hxx"
@@ -521,6 +522,21 @@ class cluster_impl : public std::enable_shared_from_this<cluster_impl>
     return handler({});
   }
 
+  auto update_credentials(cluster_credentials auth) -> core::error
+  {
+    if (stopped_) {
+      return { errc::network::cluster_closed, {} };
+    }
+
+    if (auth.requires_tls() && !origin_.options().enable_tls) {
+      return { errc::common::invalid_argument,
+               "TLS not enabled but the provided authenticator requires TLS" };
+    }
+
+    origin_.update_credentials(std::move(auth));
+    return {};
+  }
+
   auto origin() const -> std::pair<std::error_code, couchbase::core::origin>
   {
     if (stopped_) {
@@ -1437,6 +1453,15 @@ cluster::origin() const -> std::pair<std::error_code, couchbase::core::origin>
   return { errc::network::cluster_closed, {} };
 }
 
+auto
+cluster::update_credentials(core::cluster_credentials auth) -> core::error
+{
+  if (impl_) {
+    return impl_->update_credentials(std::move(auth));
+  }
+  return { errc::network::cluster_closed, {} };
+}
+
 auto
 cluster::io_context() const -> asio::io_context&
 {

core/cluster.hxx

@@ -18,6 +18,7 @@
 #pragma once
 
 #include "diagnostics.hxx"
+#include "error.hxx"
 #include "operations_fwd.hxx"
 #include "origin.hxx"
 #include "topology/configuration.hxx"
@@ -85,6 +86,8 @@ public:
     utils::movable_function<void(std::error_code, std::shared_ptr<topology::configuration>)>&&
       handler) const;
 
+  [[nodiscard]] auto update_credentials(core::cluster_credentials auth) -> core::error;
+
   void execute(o::analytics_request request, mf<void(o::analytics_response)>&& handler) const;
   void execute(o::append_request request, mf<void(o::append_response)>&& handler) const;
   void execute(o::decrement_request request, mf<void(o::decrement_response)>&& handler) const;

core/cluster_credentials.cxx

@@ -24,4 +24,11 @@ cluster_credentials::uses_certificate() const -> bool
 {
   return !certificate_path.empty();
 }
+
+auto
+cluster_credentials::requires_tls() const -> bool
+{
+  return !certificate_path.empty() && !key_path.empty();
+}
+
 } // namespace couchbase::core

core/cluster_credentials.hxx

@@ -31,6 +31,7 @@ struct cluster_credentials {
   std::optional<std::vector<std::string>> allowed_sasl_mechanisms{};
 
   [[nodiscard]] auto uses_certificate() const -> bool;
+  [[nodiscard]] auto requires_tls() const -> bool;
 };
 
 } // namespace couchbase::core

core/impl/public_cluster.cxx

@@ -416,6 +416,15 @@ class cluster_impl : public std::enable_shared_from_this<cluster_impl>
       });
   }
 
+  auto set_authenticator(core::cluster_credentials auth) -> error
+  {
+    auto e = core_.update_credentials(std::move(auth));
+    if (e.ec) {
+      return core::impl::make_error(e);
+    }
+    return {};
+  }
+
   void notify_fork(fork_event event)
   {
     if (event == fork_event::prepare) {
@@ -700,6 +709,29 @@ cluster::close() -> std::future<void>
   return future;
 }
 
+auto
+cluster::set_authenticator(const password_authenticator& authenticator) -> couchbase::error
+{
+  core::cluster_credentials auth;
+  auth.username = authenticator.username_;
+  auth.password = authenticator.password_;
+  if (authenticator.ldap_compatible_) {
+    auth.allowed_sasl_mechanisms = { { "PLAIN" } };
+  }
+
+  return impl_->set_authenticator(std::move(auth));
+}
+
+auto
+cluster::set_authenticator(const certificate_authenticator& authenticator) -> couchbase::error
+{
+  core::cluster_credentials auth;
+  auth.certificate_path = authenticator.certificate_path_;
+  auth.key_path = authenticator.key_path_;
+
+  return impl_->set_authenticator(std::move(auth));
+}
+
 auto
 cluster::query_indexes() const -> query_index_manager
 {

core/origin.cxx

@@ -468,6 +468,11 @@ couchbase::core::origin::set_nodes_from_config(const topology::configuration& co
   }
   next_node_ = nodes_.begin();
 }
+void
+couchbase::core::origin::update_credentials(cluster_credentials auth)
+{
+  credentials_ = std::move(auth);
+}
 auto
 couchbase::core::origin::next_address() -> std::pair<std::string, std::string>
 {

core/origin.hxx

@@ -71,6 +71,8 @@ struct origin {
   void set_nodes(node_list nodes);
   void set_nodes_from_config(const topology::configuration& config);
 
+  void update_credentials(cluster_credentials auth);
+
   [[nodiscard]] auto next_address() -> std::pair<std::string, std::string>;
 
   [[nodiscard]] auto exhausted() const -> bool;

couchbase/certificate_authenticator.hxx

@@ -35,5 +35,6 @@ private:
   std::string key_path_;
 
   friend class cluster_options;
+  friend class cluster;
 };
 } // namespace couchbase

couchbase/cluster.hxx

@@ -102,6 +102,38 @@ public:
   void close(std::function<void()>&& handler);
   [[nodiscard]] auto close() -> std::future<void>;
 
+  /**
+   * Replaces the current authenticator used by this cluster.
+   *
+   * NOTE: Setting a new authenticator does not change the authentication status of existing
+   * connections.
+   *
+   * @param authenticator the authenticator to replace
+   *
+   * @return error
+   *
+   * @since 1.3.0
+   * @committed
+   */
+  auto set_authenticator(const password_authenticator& authenticator) -> error;
+
+  /**
+   * Replaces the current authenticator used by this cluster.
+   *
+   * NOTE: Setting a new authenticator does not change the authentication status of existing
+   connections.
+   *
+   * @param authenticator the authenticator to replace
+
+   * @exception errc::common::invalid_argument if TLS is not enabled.
+   *
+   * @return error
+   *
+   * @since 1.3.0
+   * @committed
+   */
+  auto set_authenticator(const certificate_authenticator& authenticator) -> error;
+
   /**
    * Opens a {@link bucket} with the given name.
    *

couchbase/password_authenticator.hxx

@@ -43,5 +43,6 @@ private:
   bool ldap_compatible_{ false };
 
   friend class cluster_options;
+  friend class cluster;
 };
 } // namespace couchbase