Merge lp:~cjwatson/launchpad/private-loggerhead into lp:launchpad

[Colin Watson]

Make loggerhead listen on an additional private port without authentication.

The idea of this is to be able to use loggerhead as an API from Launchpad, mostly its JSON endpoints.

paste.httpserver couldn't listen on multiple ports without having to bring up entire new thread pools for each one, so I ported this to gunicorn. I've tried to keep the worker configuration as close to what was there before as possible, but of course we should keep an eye on poor old babaco's memory usage after deployment.

The one thing I couldn't figure out how to port was the NoLockingFileHandler business. In principle it would be possible to do this by going through all the existing loggers in LoggerheadLogger.setup and hacking out the acquire and release methods of their handlers. However, gunicorn's different thread management may avoid the problem, and the whole thing is extremely dubious anyway; bearing in mind that locks are used for more than just writing to log files, it wouldn't surprise me if it caused as many weird hangs as it prevented. My plan is to ignore this until we see a problem that can be ascribed to it.

[William Grant (wgrant)]

Can you split out the gunicorn port into an earlier MP? We can get that landed and deployed now and separately work out the security around the private port.

review: Needs Fixing

[Colin Watson (cjwatson)]

https://code.launchpad.net/~cjwatson/launchpad/loggerhead-gunicorn/+merge/347387

[Colin Watson (cjwatson)]

loggerhead is now on gunicorn on production. I believe I understand the necessary port security changes now after my work on this last week, so I can take care of that if this is approved.

[William Grant (wgrant)]

We'll need to get production/qastaging/staging host firewalls sorted out before this can land.

review: Approve (code)

=== modified file 'lib/launchpad_loggerhead/app.py'
--- lib/launchpad_loggerhead/app.py	2017-01-14 15:16:36 +0000
+++ lib/launchpad_loggerhead/app.py	2018-06-06 12:47:56 +0000
@@ -1,4 +1,4 @@
-# Copyright 2009-2017 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2018 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 import logging
@@ -45,6 +45,7 @@
 from lp.code.interfaces.codehosting import (
     BRANCH_TRANSPORT,
     LAUNCHPAD_ANONYMOUS,
+    LAUNCHPAD_SERVICES,
     )
 from lp.codehosting.safe_open import safe_open
 from lp.codehosting.vfs import get_lp_server
@@ -185,6 +186,8 @@
         raise HTTPMovedPermanently(next_url)
 
     def __call__(self, environ, start_response):
+        request_is_private = (
+            environ['SERVER_PORT'] == str(config.codebrowse.private_port))
         environ['loggerhead.static.url'] = environ['SCRIPT_NAME']
         if environ['PATH_INFO'].startswith('/static/'):
             path_info_pop(environ)
@@ -193,15 +196,23 @@
             return favicon_app(environ, start_response)
         elif environ['PATH_INFO'] == '/robots.txt':
             return robots_app(environ, start_response)
-        elif environ['PATH_INFO'].startswith('/+login'):
-            return self._complete_login(environ, start_response)
-        elif environ['PATH_INFO'].startswith('/+logout'):
-            return self._logout(environ, start_response)
+        elif not request_is_private:
+            if environ['PATH_INFO'].startswith('/+login'):
+                return self._complete_login(environ, start_response)
+            elif environ['PATH_INFO'].startswith('/+logout'):
+                return self._logout(environ, start_response)
         path = environ['PATH_INFO']
         trailingSlashCount = len(path) - len(path.rstrip('/'))
-        identity_url = environ[self.session_var].get(
-            'identity_url', LAUNCHPAD_ANONYMOUS)
-        user = environ[self.session_var].get('user', LAUNCHPAD_ANONYMOUS)
+        if request_is_private:
+            # Requests on the private port are internal API requests from
+            # something that has already performed security checks.  As
+            # such, they get read-only access to everything.
+            identity_url = LAUNCHPAD_SERVICES
+            user = LAUNCHPAD_SERVICES
+        else:
+            identity_url = environ[self.session_var].get(
+                'identity_url', LAUNCHPAD_ANONYMOUS)
+            user = environ[self.session_var].get('user', LAUNCHPAD_ANONYMOUS)
         lp_server = get_lp_server(
             identity_url, branch_transport=self.get_transport())
         lp_server.start_server()

=== modified file 'lib/launchpad_loggerhead/tests.py'
--- lib/launchpad_loggerhead/tests.py	2018-06-06 08:57:53 +0000
+++ lib/launchpad_loggerhead/tests.py	2018-06-06 12:47:56 +0000
@@ -204,3 +204,28 @@
         self.assertEqual(
             "testopenid.dev:8085",
             urlsplit(response.headers["Location"]).netloc)
+
+    def test_private_port_public_branch(self):
+        # Requests for public branches on the private port are allowed.
+        db_branch, _ = self.create_branch_and_tree()
+        branch_url = "http://127.0.0.1:%d/%s" % (
+            config.codebrowse.private_port, db_branch.unique_name)
+        response = requests.get(branch_url)
+        self.assertEqual(200, response.status_code)
+        title_tag = soupmatchers.Tag(
+            "page title", "title", text="%s : changes" % db_branch.unique_name)
+        self.assertThat(response.text, soupmatchers.HTMLContains(title_tag))
+
+    def test_private_port_private_branch(self):
+        # Requests for private branches on the private port are allowed.
+        db_branch, _ = self.create_branch_and_tree(
+            information_type=InformationType.USERDATA)
+        naked_branch = removeSecurityProxy(db_branch)
+        branch_url = "http://127.0.0.1:%d/%s" % (
+            config.codebrowse.private_port, naked_branch.unique_name)
+        response = requests.get(branch_url)
+        self.assertEqual(200, response.status_code)
+        title_tag = soupmatchers.Tag(
+            "page title", "title",
+            text="%s : changes" % naked_branch.unique_name)
+        self.assertThat(response.text, soupmatchers.HTMLContains(title_tag))

=== modified file 'lib/launchpad_loggerhead/wsgi.py'
--- lib/launchpad_loggerhead/wsgi.py	2018-06-04 14:02:57 +0000
+++ lib/launchpad_loggerhead/wsgi.py	2018-06-06 12:47:56 +0000
@@ -105,6 +105,7 @@
             "accesslog": os.path.join(log_folder, "access.log"),
             "bind": [
                 "%s:%s" % (listen_host, config.codebrowse.port),
+                "%s:%s" % (listen_host, config.codebrowse.private_port),
                 ],
             "errorlog": os.path.join(log_folder, "debug.log"),
             # Trust that firewalls only permit sending requests to

=== modified file 'lib/lp/services/config/schema-lazr.conf'
--- lib/lp/services/config/schema-lazr.conf	2018-05-31 13:14:12 +0000
+++ lib/lp/services/config/schema-lazr.conf	2018-06-06 12:47:56 +0000
@@ -199,6 +199,11 @@
 # datatype: int
 port: 8080
 
+# The port to listen on for private API requests.
+#
+# datatype: int
+private_port: 8090
+
 # A file path that contains a secret used for verifying cookies sent
 # to codebrowse.  This file should ideally contain 64 bytes of random
 # data, and should be considered private -- if it is disclosed, we