SERVER-7775 refactor fsyncUnlock to execute through standard command …

…path

jstests/auth/auth3.js

@@ -1,6 +1,7 @@
 var conn = MongoRunner.runMongod({auth : "", port : 31001});
 
 var admin = conn.getDB("admin");
+var errorCodeUnauthorized = 13;
 
 admin.createUser({user:"foo",pwd: "bar", roles: jsTest.adminUserRoles});
 
@@ -16,7 +17,7 @@ assert.eq(x.err, "unauthorized", tojson(x));
 
 x = admin.fsyncUnlock();
 assert(x.errmsg != "not locked", tojson(x));
-assert.eq(x.err, "unauthorized", tojson(x));
+assert.eq(x.code, errorCodeUnauthorized, tojson(x));
 
 conn.getDB("admin").auth("foo","bar");
 

jstests/auth/basic_role_auth.js

@@ -237,8 +237,9 @@ var testOps = function(db, allowedActions) {
     if (!isMongos){
         checkErr(allowedActions.hasOwnProperty('fsync_unlock'), function() {
             var res = db.fsyncUnlock();
+            var errorCodeUnauthorized = 13;
 
-            if (res.err == 'unauthorized') {
+            if (res.code == errorCodeUnauthorized) {
                 throw Error("unauthorized unauthorized fsyncUnlock");
             }
         });

jstests/auth/lib/commands_lib.js

@@ -1143,6 +1143,23 @@ var authCommandsLib = {
                 { runOnDb: secondDbName, roles: {} }
             ]
         },
+        {
+            testname: "fsyncUnlock",
+            command: {fsyncUnlock: 1},
+            skipSharded: true, // TODO: remove when fsyncUnlock is implemented in mongos
+            testcases: [
+                {
+                    runOnDb: adminDbName,
+                    roles: roles_hostManager,
+                    privileges: [
+                        { resource: {cluster: true}, actions: ["unlock"] }
+                    ],
+                    expectFail: true
+                },
+                { runOnDb: firstDbName, roles: {} },
+                { runOnDb: secondDbName, roles: {} }
+            ]
+        },
         {
             testname: "geoNear",
             command: {geoNear: "x", near: [50, 50], num: 1},

jstests/core/fsync.js

@@ -36,3 +36,14 @@ assert.eq(2, fsyncLockDB.coll.count({}));
 
 // Ensure eval is not allowed to invoke fsyncLock
 assert(!db.eval('db.fsyncLock()').ok, "eval('db.fsyncLock()') should fail.");
+
+// Check that the fsyncUnlock pseudo-command (a lookup on cmd.$sys.unlock)
+// still has the same effect as a legitimate 'fsyncUnlock' command
+// TODO: remove this in in the release following MongoDB 3.2 when pseudo-commands
+// are removed
+var fsyncCommandRes = db.fsyncLock();
+assert(fsyncLockRes.ok, "fsyncLock command failed against admin DB");
+assert(db.currentOp().fsyncLock, "Value in db.currentOp incorrect for fsyncLocked server");
+var fsyncPseudoCommandRes = db.getSiblingDB("admin").$cmd.sys.unlock.findOne();
+assert(fsyncPseudoCommandRes.ok, "fsyncUnlock pseudo-command failed");
+assert(db.currentOp().fsyncLock == null, "fsyncUnlock is not null in db.currentOp");

jstests/noPassthroughWithMongod/fsync2.js

@@ -40,7 +40,7 @@ function doTest() {
     // Uncomment once SERVER-4243 is fixed
     //assert.eq(1, m.getDB(db.getName()).fsync2.count());
 
-    assert( m.getDB("admin").$cmd.sys.unlock.findOne().ok );
+    assert( m.getDB("admin").fsyncUnlock().ok );
 
     assert.eq( 2, db.fsync2.count() );
 

jstests/repl/snapshot1.js

@@ -14,7 +14,7 @@ for( i = 0; i < 1000; ++i )
 
 m.getDB( "admin" ).runCommand( {fsync:1,lock:1} );
 copyDbpath( rt1.getPath( true ), rt1.getPath( false ) );
-m.getDB( "admin" ).$cmd.sys.unlock.findOne();
+m.getDB( "admin" ).fsyncUnlock();
 
 s1 = rt1.start( false, null, true );
 assert.eq( 1000, s1.getDB( baseName )[ baseName ].count() );
@@ -23,7 +23,7 @@ assert.soon( function() { return 1001 == s1.getDB( baseName )[ baseName ].count(
 
 s1.getDB( "admin" ).runCommand( {fsync:1,lock:1} );
 copyDbpath( rt1.getPath( false ), rt2.getPath( false ) );
-s1.getDB( "admin" ).$cmd.sys.unlock.findOne();
+s1.getDB( "admin" ).fsyncUnlock();
 
 s2 = rt2.start( false, null, true );
 assert.eq( 1001, s2.getDB( baseName )[ baseName ].count() );

jstests/replsets/fsync_lock_read_secondaries.js

@@ -53,7 +53,7 @@ for (var i=0; i<docNum; i++) {
 // this should work just fine.
 var slave0count = slaves[0].getDB("foo").bar.count();
 assert.eq(slave0count, 100, "Doc count in fsync lock wrong. Expected (=100), found " + slave0count);
-assert(slaves[0].getDB("admin").$cmd.sys.unlock.findOne().ok);
+assert(slaves[0].getDB("admin").fsyncUnlock().ok);
 
 // The secondary should have equal or more documents than what it had before.
 assert.soon(function() {

jstests/replsets/maxSyncSourceLagSecs.js

@@ -44,6 +44,6 @@
             return (slaves[1].getDB("foo").bar.count() === 2);
         }, "slave should have caught up after syncing to primary.");
 
-    assert.commandWorked(slaves[0].getDB("admin").$cmd.sys.unlock.findOne());
+    assert.commandWorked(slaves[0].getDB("admin").fsyncUnlock());
     replTest.stopSet();
 }());

jstests/replsets/stepdown.js

@@ -53,7 +53,7 @@ assert.eq(r2.ismaster, false);
 assert.eq(r2.secondary, true);
 
 print("\nunlock");
-printjson(locked.getDB("admin").$cmd.sys.unlock.findOne());
+printjson(locked.getDB("admin").fsyncUnlock());
 
 print("\nreset stepped down time");
 master.getDB("admin").runCommand({replSetFreeze:0});

jstests/replsets/stepdown3.js

@@ -46,5 +46,5 @@ print("result of gle:");
 printjson(result);
 
 // unlock and shut down
-printjson(locked.getDB("admin").$cmd.sys.unlock.findOne());
+printjson(locked.getDB("admin").fsyncUnlock());
 replTest.stopSet();

src/mongo/db/commands/fsync.cpp

@@ -26,29 +26,34 @@
  *    it in the license file.
  */
 
-#define MONGO_LOG_DEFAULT_COMPONENT ::mongo::logger::LogComponent::kStorage
+#define MONGO_LOG_DEFAULT_COMPONENT ::mongo::logger::LogComponent::kCommand
 
 #include "mongo/db/commands/fsync.h"
 
+#include <iostream>
+#include <sstream>
 #include <string>
 #include <vector>
 
+#include "mongo/base/init.h"
+#include "mongo/bson/bsonobj.h"
+#include "mongo/bson/bsonobjbuilder.h"
+#include "mongo/db/audit.h"
 #include "mongo/db/auth/action_set.h"
 #include "mongo/db/auth/action_type.h"
 #include "mongo/db/auth/authorization_manager.h"
+#include "mongo/db/auth/authorization_session.h"
 #include "mongo/db/auth/privilege.h"
 #include "mongo/db/concurrency/d_concurrency.h"
 #include "mongo/db/commands.h"
 #include "mongo/db/global_environment_experiment.h"
 #include "mongo/db/storage/mmap_v1/dur.h"
 #include "mongo/db/storage/storage_engine.h"
 #include "mongo/db/client.h"
-#include "mongo/db/jsobj.h"
 #include "mongo/db/operation_context_impl.h"
 #include "mongo/util/background.h"
 #include "mongo/util/log.h"
 
-
 namespace mongo {
 
     using std::endl;
@@ -154,6 +159,61 @@ namespace mongo {
         }
     } fsyncCmd;
 
+    namespace {
+        bool unlockFsync();
+    }  // namespace
+
+    class FSyncUnlockCommand : public Command {
+    public:
+
+        FSyncUnlockCommand() : Command("fsyncUnlock") {}
+
+        bool isWriteCommandForConfigServer() const override { return false; }
+
+        bool slaveOk() const override { return true; }
+
+        bool adminOnly() const override { return true; }
+
+        Status checkAuthForCommand(ClientBasic* client,
+                                   const std::string& dbname,
+                                   const BSONObj& cmdObj) override {
+
+            bool isAuthorized = client->getAuthorizationSession()->isAuthorizedForActionsOnResource(
+                                    ResourcePattern::forClusterResource(),
+                                    ActionType::unlock);
+
+            if (isAuthorized) {
+                audit::logFsyncUnlockAuthzCheck(client, ErrorCodes::OK);
+                return Status::OK();
+            }
+            else {
+                audit::logFsyncUnlockAuthzCheck(client, ErrorCodes::Unauthorized);
+                return Status(ErrorCodes::Unauthorized, "Unauthorized");
+            }
+        }
+
+        bool run(OperationContext* txn,
+                 const std::string& db,
+                 BSONObj& cmdObj,
+                 int options,
+                 std::string& errmsg,
+                 BSONObjBuilder& result,
+                 bool fromRepl) override {
+
+            log() << "command: unlock requested";
+
+            if (unlockFsync()) {
+                result.append("info", "unlock completed");
+                return true;
+            }
+            else {
+                errmsg = "not locked";
+                return false;
+            }
+        }
+
+    } unlockFsyncCmd;
+
     SimpleMutex filesLockedFsync("filesLockedFsync");
 
     void FSyncLockThread::doRealWork() {
@@ -164,12 +224,12 @@ namespace mongo {
         Lock::GlobalWrite global(txn.lockState()); // No WriteUnitOfWork needed
 
         SimpleMutex::scoped_lock lk(fsyncCmd.m);
-        
+
         invariant(!fsyncCmd.locked);    // impossible to get here if locked is true
-        try { 
+        try {
             getDur().syncDataAndTruncateJournal(&txn);
-        } 
-        catch( std::exception& e ) { 
+        }
+        catch( std::exception& e ) {
             error() << "error doing syncDataAndTruncateJournal: " << e.what() << endl;
             fsyncCmd.err = e.what();
             fsyncCmd._threadSync.notify_one();
@@ -183,7 +243,7 @@ namespace mongo {
             StorageEngine* storageEngine = getGlobalEnvironment()->getGlobalStorageEngine();
             storageEngine->flushAllFiles(true);
         }
-        catch( std::exception& e ) { 
+        catch( std::exception& e ) {
             error() << "error doing flushAll: " << e.what() << endl;
             fsyncCmd.err = e.what();
             fsyncCmd._threadSync.notify_one();
@@ -193,37 +253,39 @@ namespace mongo {
 
         invariant(!fsyncCmd.locked);
         fsyncCmd.locked = true;
-        
+
         fsyncCmd._threadSync.notify_one();
 
         while ( ! fsyncCmd.pendingUnlock ) {
             fsyncCmd._unlockSync.wait(fsyncCmd.m);
         }
         fsyncCmd.pendingUnlock = false;
-        
+
         fsyncCmd.locked = false;
         fsyncCmd.err = "unlocked";
 
         fsyncCmd._unlockSync.notify_one();
     }
 
-    bool lockedForWriting() { 
-        return fsyncCmd.locked; 
+    bool lockedForWriting() {
+        return fsyncCmd.locked;
     }
 
-    // @return true if unlocked
-    bool _unlockFsync() {
-        SimpleMutex::scoped_lock lk( fsyncCmd.m );
-        if( !fsyncCmd.locked ) { 
-            return false;
-        }
-        fsyncCmd.pendingUnlock = true;
-        fsyncCmd._unlockSync.notify_one();
-        fsyncCmd._threadSync.notify_one();
-
-        while ( fsyncCmd.locked ) {
-            fsyncCmd._unlockSync.wait( fsyncCmd.m );
+    namespace {
+        // @return true if unlocked
+        bool unlockFsync() {
+            SimpleMutex::scoped_lock lk( fsyncCmd.m );
+            if( !fsyncCmd.locked ) {
+                return false;
+            }
+            fsyncCmd.pendingUnlock = true;
+            fsyncCmd._unlockSync.notify_one();
+            fsyncCmd._threadSync.notify_one();
+
+            while ( fsyncCmd.locked ) {
+                fsyncCmd._unlockSync.wait( fsyncCmd.m );
+            }
+            return true;
         }
-        return true;
-    }
+    }  // namespace
 }

src/mongo/db/commands/fsync.h

@@ -34,4 +34,4 @@ namespace mongo {
     // Use this for blocking during an fsync-and-lock
     extern SimpleMutex filesLockedFsync;
     bool lockedForWriting();
-}
+}  // namespace mongo