megaphone / megacase Goto Github PK

This is a test case app to explore a bug in mongodb where using authentication causes collection.find with a limit to leak cursors

Steps to reproduce:
Export the following variables, changed to fit your environment:

export MONGO_HOST=localhost
export MONGO_PORT=27017
export MONGO_NAME=mongodbname
export MONGO_USER=mongouser
export MONGO_PASS=mongopass
export PORT=8001

Edit mongodb's config to have auth=true and ensure that there is a user for the database specified by your environment variables

Add a collection called "tweets" to the database with more than 2 documents. The data in the documents doesn't matter they just need an _id field. To populate the collection with three documents (the minimum you need to test) you can do the following from the mongo shell:
db.tweets.insert({})
db.tweets.insert({})
db.tweets.insert({})

Run the app with "node server.js"

Visit the url http://localhost:8001, you should see the _id's on the page

In a mongodb shell call db.serverStatus()['cursors'] and check the totalOpen count. It should rise every time you reload the page.

Next, comment out the "db.authenticate" line in server.js and the closing line (41 and 45) and turn off auth in mongodb config and restart mongo and your server.js app. Now when you hit the same url the totalOpen count will not rise every time you reload the page.



With auth the mongo log looks like this with verbose=true:
Fri Feb  3 21:09:20 [conn6] query mongodbname.tweets ntoreturn:2 nreturned:2 reslen:64 0ms
Fri Feb  3 21:09:20 [conn6] killcursors  0ms

If the collection.find limit is 1 or >= the number of 'tweets' in the database then we do not see a killcursors command in the logs and the totalOpen cursors count does not increase with each page load.


node 0.4.7
npm 1.0.106
mongodb 2.0.2
npm ls
  [email protected] /var/www/megacase
  ├─┬ [email protected] 
  │ ├─┬ [email protected] 
  │ │ └── [email protected] 
  │ ├── [email protected] 
  │ └── [email protected] 
  └── [email protected]