<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[13925] CalendarServer/trunk/calendarserver/tap</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.calendarserver.org//changeset/13925">13925</a></dd>
<dt>Author</dt> <dd>sagen@apple.com</dd>
<dt>Date</dt> <dd>2014-08-29 11:44:34 -0700 (Fri, 29 Aug 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>If pre-flight checks don't pass, shut down more gracefully</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#CalendarServertrunkcalendarservertapcaldavpy">CalendarServer/trunk/calendarserver/tap/caldav.py</a></li>
<li><a href="#CalendarServertrunkcalendarservertaptesttest_utilpy">CalendarServer/trunk/calendarserver/tap/test/test_util.py</a></li>
<li><a href="#CalendarServertrunkcalendarservertaputilpy">CalendarServer/trunk/calendarserver/tap/util.py</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="CalendarServertrunkcalendarservertapcaldavpy"></a>
<div class="modfile"><h4>Modified: CalendarServer/trunk/calendarserver/tap/caldav.py (13924 => 13925)</h4>
<pre class="diff"><span>
<span class="info">--- CalendarServer/trunk/calendarserver/tap/caldav.py 2014-08-28 22:35:37 UTC (rev 13924)
+++ CalendarServer/trunk/calendarserver/tap/caldav.py 2014-08-29 18:44:34 UTC (rev 13925)
</span><span class="lines">@@ -127,7 +127,7 @@
</span><span class="cx"> checkDirectories, getRootResource,
</span><span class="cx"> oracleConnectorFromConfig, pgConnectorFromConfig,
</span><span class="cx"> pgServiceFromConfig, getDBPool, MemoryLimitService,
</span><del>- storeFromConfig, getSSLPassphrase, PreFlightChecksStep
</del><ins>+ storeFromConfig, getSSLPassphrase, preFlightChecks
</ins><span class="cx"> )
</span><span class="cx"> try:
</span><span class="cx"> from calendarserver.version import version
</span><span class="lines">@@ -1406,8 +1406,7 @@
</span><span class="cx">
</span><span class="cx"> uid, gid = getSystemIDs(config.UserName, config.GroupName)
</span><span class="cx"> return self.storageService(
</span><del>- toolServiceCreator, None, uid=uid, gid=gid, directory=None,
- preFlightChecks=False
</del><ins>+ toolServiceCreator, None, uid=uid, gid=gid, directory=None
</ins><span class="cx"> )
</span><span class="cx">
</span><span class="cx">
</span><span class="lines">@@ -1445,7 +1444,7 @@
</span><span class="cx">
</span><span class="cx"> uid, gid = getSystemIDs(config.UserName, config.GroupName)
</span><span class="cx"> svc = self.storageService(
</span><del>- agentServiceCreator, None, uid=uid, gid=gid, preFlightChecks=False
</del><ins>+ agentServiceCreator, None, uid=uid, gid=gid
</ins><span class="cx"> )
</span><span class="cx"> agentLoggingService = ErrorLoggingMultiService(
</span><span class="cx"> config.ErrorLogEnabled,
</span><span class="lines">@@ -1458,8 +1457,7 @@
</span><span class="cx">
</span><span class="cx">
</span><span class="cx"> def storageService(
</span><del>- self, createMainService, logObserver, uid=None, gid=None, directory=None,
- preFlightChecks=True
</del><ins>+ self, createMainService, logObserver, uid=None, gid=None, directory=None
</ins><span class="cx"> ):
</span><span class="cx"> """
</span><span class="cx"> If necessary, create a service to be started used for storage; for
</span><span class="lines">@@ -1586,11 +1584,6 @@
</span><span class="cx"> )
</span><span class="cx"> )
</span><span class="cx">
</span><del>- if preFlightChecks:
- pps.addStep(
- PreFlightChecksStep(config)
- )
-
</del><span class="cx"> pps.addStep(
</span><span class="cx"> UpgradeReleaseLockStep(store)
</span><span class="cx"> )
</span><span class="lines">@@ -1650,6 +1643,7 @@
</span><span class="cx"> Create a master service to coordinate a multi-process configuration,
</span><span class="cx"> spawning subprocesses that use L{makeService_Slave} to perform work.
</span><span class="cx"> """
</span><ins>+
</ins><span class="cx"> s = ErrorLoggingMultiService(
</span><span class="cx"> config.ErrorLogEnabled,
</span><span class="cx"> config.ErrorLogFile,
</span><span class="lines">@@ -1657,6 +1651,18 @@
</span><span class="cx"> config.ErrorLogMaxRotatedFiles
</span><span class="cx"> )
</span><span class="cx">
</span><ins>+ # Perform early pre-flight checks. If this returns True, continue on.
+ # Otherwise one of two things will happen:
+ # A) preFlightChecks( ) will have registered an "after startup" system
+ # event trigger to request a shutdown via the
+ # ServiceDisablingProgram, and we want to return our
+ # ErrorLoggingMultiService so that logging is set up enough to
+ # emit our reason for shutting down into the error.log.
+ # B) preFlightChecks( ) will sys.exit(1) if there is not a
+ # ServiceDisablingProgram configured.
+ if not preFlightChecks(config):
+ return s
+
</ins><span class="cx"> # Add a service to re-exec the master when it receives SIGHUP
</span><span class="cx"> ReExecService(config.PIDFile).setServiceParent(s)
</span><span class="cx">
</span></span></pre></div>
<a id="CalendarServertrunkcalendarservertaptesttest_utilpy"></a>
<div class="modfile"><h4>Modified: CalendarServer/trunk/calendarserver/tap/test/test_util.py (13924 => 13925)</h4>
<pre class="diff"><span>
<span class="info">--- CalendarServer/trunk/calendarserver/tap/test/test_util.py 2014-08-28 22:35:37 UTC (rev 13924)
+++ CalendarServer/trunk/calendarserver/tap/test/test_util.py 2014-08-29 18:44:34 UTC (rev 13925)
</span><span class="lines">@@ -14,16 +14,15 @@
</span><span class="cx"> # limitations under the License.
</span><span class="cx"> ##
</span><span class="cx">
</span><del>-import OpenSSL
</del><span class="cx"> from calendarserver.tap.util import (
</span><del>- MemoryLimitService, Stepper, PreFlightChecksStep
</del><ins>+ MemoryLimitService, Stepper, verifyTLSCertificate
</ins><span class="cx"> )
</span><span class="cx"> from twistedcaldav.util import computeProcessCount
</span><span class="cx"> from twistedcaldav.test.util import TestCase
</span><span class="cx"> from twisted.internet.task import Clock
</span><span class="cx"> from twisted.internet.defer import succeed, inlineCallbacks
</span><span class="cx"> from twisted.python.filepath import FilePath
</span><del>-from twistedcaldav.config import ConfigDict, ConfigurationError
</del><ins>+from twistedcaldav.config import ConfigDict
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> class ProcessCountTestCase(TestCase):
</span><span class="lines">@@ -236,54 +235,41 @@
</span><span class="cx"> ['one success', 'two failure', 'three success', 'four failure'])
</span><span class="cx">
</span><span class="cx">
</span><del>-class PreFlightChecksStepTestCase(TestCase):
</del><ins>+class PreFlightChecksTestCase(TestCase):
</ins><span class="cx"> """
</span><span class="cx"> Verify that missing, empty, or bogus TLS Certificates are detected
</span><span class="cx"> """
</span><span class="cx">
</span><del>- @inlineCallbacks
</del><span class="cx"> def test_missingCertificate(self):
</span><del>- step = PreFlightChecksStep(
</del><ins>+ success, reason = verifyTLSCertificate(
</ins><span class="cx"> ConfigDict(
</span><span class="cx"> {
</span><span class="cx"> "SSLCertificate": "missing",
</span><span class="cx"> }
</span><span class="cx"> )
</span><span class="cx"> )
</span><del>- try:
- yield step.stepWithResult(None)
- except ConfigurationError as e:
- self.assertTrue("Missing" in str(e))
- else:
- self.fail("Did not raise ConfigurationError")
</del><ins>+ self.assertFalse(success)
</ins><span class="cx">
</span><span class="cx">
</span><del>- @inlineCallbacks
</del><span class="cx"> def test_emptyCertificate(self):
</span><span class="cx"> certFilePath = FilePath(self.mktemp())
</span><span class="cx"> certFilePath.setContent("")
</span><del>- step = PreFlightChecksStep(
</del><ins>+ success, reason = verifyTLSCertificate(
</ins><span class="cx"> ConfigDict(
</span><span class="cx"> {
</span><span class="cx"> "SSLCertificate": certFilePath.path,
</span><span class="cx"> }
</span><span class="cx"> )
</span><span class="cx"> )
</span><del>- try:
- yield step.stepWithResult(None)
- except ConfigurationError as e:
- self.assertTrue("Empty" in str(e))
- else:
- self.fail("Did not raise ConfigurationError")
</del><ins>+ self.assertFalse(success)
</ins><span class="cx">
</span><span class="cx">
</span><del>- @inlineCallbacks
</del><span class="cx"> def test_bogusCertificate(self):
</span><span class="cx"> certFilePath = FilePath(self.mktemp())
</span><span class="cx"> certFilePath.setContent("bogus")
</span><span class="cx"> keyFilePath = FilePath(self.mktemp())
</span><span class="cx"> keyFilePath.setContent("bogus")
</span><del>- step = PreFlightChecksStep(
</del><ins>+ success, reason = verifyTLSCertificate(
</ins><span class="cx"> ConfigDict(
</span><span class="cx"> {
</span><span class="cx"> "SSLCertificate": certFilePath.path,
</span><span class="lines">@@ -294,9 +280,4 @@
</span><span class="cx"> }
</span><span class="cx"> )
</span><span class="cx"> )
</span><del>- try:
- yield step.stepWithResult(None)
- except OpenSSL.SSL.Error:
- pass
- else:
- self.fail("Did not raise OpenSSL.SSL.Error")
</del><ins>+ self.assertFalse(success)
</ins></span></pre></div>
<a id="CalendarServertrunkcalendarservertaputilpy"></a>
<div class="modfile"><h4>Modified: CalendarServer/trunk/calendarserver/tap/util.py (13924 => 13925)</h4>
<pre class="diff"><span>
<span class="info">--- CalendarServer/trunk/calendarserver/tap/util.py 2014-08-28 22:35:37 UTC (rev 13924)
+++ CalendarServer/trunk/calendarserver/tap/util.py 2014-08-29 18:44:34 UTC (rev 13925)
</span><span class="lines">@@ -20,12 +20,12 @@
</span><span class="cx"> """
</span><span class="cx">
</span><span class="cx"> __all__ = [
</span><ins>+ "FakeRequest",
+ "getDBPool",
</ins><span class="cx"> "getRootResource",
</span><del>- "getDBPool",
- "FakeRequest",
</del><ins>+ "getSSLPassphrase",
</ins><span class="cx"> "MemoryLimitService",
</span><del>- "PreFlightChecksStep",
- "getSSLPassphrase",
</del><ins>+ "preFlightChecks",
</ins><span class="cx"> ]
</span><span class="cx">
</span><span class="cx"> import errno
</span><span class="lines">@@ -34,6 +34,7 @@
</span><span class="cx"> import psutil
</span><span class="cx"> from socket import fromfd, AF_UNIX, SOCK_STREAM, socketpair
</span><span class="cx"> from subprocess import Popen, PIPE
</span><ins>+import sys
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> from twext.internet.ssl import ChainingOpenSSLContextFactory
</span><span class="lines">@@ -1114,63 +1115,108 @@
</span><span class="cx"> return self.deferred
</span><span class="cx">
</span><span class="cx">
</span><del>-class PreFlightChecksStep(object):
</del><ins>+def requestShutdown(programPath, reason):
</ins><span class="cx"> """
</span><del>- A place to make any other checks before finishing up the
- PreProcessingService.
- """
</del><ins>+ Log the shutdown reason and call the shutdown-requesting program.
</ins><span class="cx">
</span><del>- def __init__(self, config):
- self.config = config
</del><ins>+ In the case the service is spawned by launchd (or equivalent), if our
+ service decides it needs to shut itself down, because of a misconfiguration,
+ for example, we can't just exit. We may need to go through the system
+ machinery to unload our job, manage reverse proxies, update admin UI, etc.
+ Therefore you can configure the ServiceDisablingProgram plist key to point
+ to a program to run which will stop our service.
</ins><span class="cx">
</span><ins>+ @param programPath: the full path to a program to call (with no args)
+ @type programPath: C{str}
+ @param reason: a shutdown reason to log
+ @type reason: C{str}
+ """
+ log.error("Shutting down Calendar and Contacts server")
+ log.error(reason)
+ Popen(
+ args=[config.ServiceDisablingProgram],
+ stdout=PIPE,
+ stderr=PIPE,
+ ).communicate()
</ins><span class="cx">
</span><del>- def stepWithResult(self, result):
- self.verifyTLSCertificate()
- return succeed(None)
</del><span class="cx">
</span><ins>+def preFlightChecks(config):
+ """
+ Perform checks prior to spawning any processes. Returns True if the checks
+ are ok, False if they don't and we have a ServiceDisablingProgram configured.
+ Otherwise exits.
+ """
</ins><span class="cx">
</span><del>- def verifyTLSCertificate(self):
- """
- If a TLS certificate is configured, make sure it exists, is non empty,
- and that it's valid.
- """
</del><ins>+ success, reason = verifyTLSCertificate(config)
</ins><span class="cx">
</span><del>- if self.config.SSLCertificate:
- if not os.path.exists(self.config.SSLCertificate):
- log.error(
- "The configured TLS certificate ({cert}) is missing",
- cert=self.config.SSLCertificate
</del><ins>+ if not success:
+ if config.ServiceDisablingProgram:
+ # If pre-flight checks fail, we don't want launchd to
+ # repeatedly launch us, we want our job to get unloaded.
+ # If the config.ServiceDisablingProgram is assigned and exists
+ # we schedule it to run after startService finishes.
+ # Its job is to carry out the platform-specific tasks of disabling
+ # the service.
+ if os.path.exists(config.ServiceDisablingProgram):
+ addSystemEventTrigger(
+ "after", "startup",
+ requestShutdown, config.ServiceDisablingProgram, reason
</ins><span class="cx"> )
</span><del>- raise ConfigurationError("Missing certificate file")
</del><ins>+ return False
+
</ins><span class="cx"> else:
</span><del>- return
</del><ins>+ sys.exit(1)
</ins><span class="cx">
</span><del>- length = os.stat(self.config.SSLCertificate).st_size
- if length == 0:
- log.error(
- "The configured TLS certificate ({cert}) is empty",
- cert=self.config.SSLCertificate
</del><ins>+ return True
+
+
+def verifyTLSCertificate(config):
+ """
+ If a TLS certificate is configured, make sure it exists, is non empty,
+ and that it's valid.
+ """
+
+ if config.SSLCertificate:
+ if not os.path.exists(config.SSLCertificate):
+ message = (
+ "The configured TLS certificate ({cert}) is missing".format(
+ cert=config.SSLCertificate
</ins><span class="cx"> )
</span><del>- raise ConfigurationError("Empty certificate file")
</del><ins>+ )
+ return False, message
+ else:
+ return True, "TLS disabled"
</ins><span class="cx">
</span><del>- try:
- ChainingOpenSSLContextFactory(
- self.config.SSLPrivateKey,
- self.config.SSLCertificate,
- certificateChainFile=self.config.SSLAuthorityChain,
- passwdCallback=getSSLPassphrase,
- sslmethod=getattr(OpenSSL.SSL, self.config.SSLMethod),
- ciphers=self.config.SSLCiphers.strip()
</del><ins>+ length = os.stat(config.SSLCertificate).st_size
+ if length == 0:
+ message = (
+ "The configured TLS certificate ({cert}) is empty".format(
+ cert=config.SSLCertificate
+ )
</ins><span class="cx"> )
</span><del>- except Exception as e:
- log.error(
- "The configured TLS certificate ({cert}) cannot be used: {reason}",
- cert=self.config.SSLCertificate,
</del><ins>+ return False, message
+
+ try:
+ ChainingOpenSSLContextFactory(
+ config.SSLPrivateKey,
+ config.SSLCertificate,
+ certificateChainFile=config.SSLAuthorityChain,
+ passwdCallback=getSSLPassphrase,
+ sslmethod=getattr(OpenSSL.SSL, config.SSLMethod),
+ ciphers=config.SSLCiphers.strip()
+ )
+ except Exception as e:
+ message = (
+ "The configured TLS certificate ({cert}) cannot be used: {reason}".format(
+ cert=config.SSLCertificate,
</ins><span class="cx"> reason=str(e)
</span><span class="cx"> )
</span><del>- raise
</del><ins>+ )
+ return False, message
</ins><span class="cx">
</span><ins>+ return True, "TLS enabled"
</ins><span class="cx">
</span><ins>+
</ins><span class="cx"> def getSSLPassphrase(*ignored):
</span><span class="cx">
</span><span class="cx"> if not config.SSLPrivateKey:
</span></span></pre>
</div>
</div>
</body>
</html>