URL: https://github.com/freeipa/freeipa/pull/407
Author: tiran
 Title: #407: New lite-server implementation
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/407/head:pr407
git checkout pr407
From 902ab13730170863ab45f8e47241a1d685e3a99e Mon Sep 17 00:00:00 2001
From: Christian Heimes <chei...@redhat.com>
Date: Sat, 21 Jan 2017 19:34:12 +0100
Subject: [PATCH] New lite-server implementation

The new development server depends on werkzeug instead of paste. The
werkzeug WSGI server comes with some additional features, most
noticeable multi-processing server. The IPA framework is not compatible
with threaded servers. Werkzeug can serve static files easily and has a
fast auto-reloader.

The new lite-server implementation depends on PR 314 (privilege
separation). For Python 3 support, it additionally depends on PR 393.

Signed-off-by: Christian Heimes <chei...@redhat.com>
---
 lite-server.py | 267 +++++++++++++++++++++++++++++++++------------------------
 1 file changed, 156 insertions(+), 111 deletions(-)

diff --git a/lite-server.py b/lite-server.py
index cd4f09c..a0a8692 100755
--- a/lite-server.py
+++ b/lite-server.py
@@ -1,125 +1,133 @@
-#!/usr/bin/python2
-
-# Authors:
-#   Jason Gerard DeRose <jder...@redhat.com>
-#
-# Copyright (C) 2008  Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
+#!/usr/bin/env python
 #
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
+# Copyright (C) 2017 FreeIPA Contributors see COPYING for license
 #
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+"""In-tree development server
 
-"""
-In-tree paste-based test server.
+The dev server requires a Kerberos TGT and a file based credential cache:
 
-This uses the *Python Paste* WSGI server.  For more info, see:
+    $ mkdir -p ~/.ipa
+    $ export KRB5CCNAME=~/.ipa/ccache
+    $ kinit admin
+    $ ./lite-server.py
 
-    http://pythonpaste.org/
+Optionally you can set KRB5_CONFIG to use a custom Kerberos configuration
+instead of /etc/krb5.conf.
 
-Unfortunately, SSL support is broken under Python 2.6 with paste 1.7.2, see:
+By default the dev server supports HTTP only. To switch to HTTPS, you can put
+a PEM file at ~/.ipa/lite.pem. The PEM file must contain a server certificate,
+its unencrypted private key and intermediate chain certs (if applicable).
 
-    http://trac.pythonpaste.org/pythonpaste/ticket/314
-"""
+Prerequisite
+------------
+
+Additionally to build and runtime requirements of FreeIPA, the dev server
+depends on the werkzeug framework and optionally watchdog for auto-reloading.
+You may also have to enable a development COPR.
 
-from os import path, getcwd
+    $ sudo dnf install -y dnf-plugins-core
+    $ sudo dnf builddep --spec freeipa.spec.in
+    $ sudo dnf install -y python-werkzeug python2-watchdog \
+        python3-werkzeug python3-watchdog
+    $ ./autogen.sh
+    $ make
+
+For more information see
+
+  * http://www.freeipa.org/page/Build
+  * http://www.freeipa.org/page/Testing
+
+"""
+import os
 import optparse  # pylint: disable=deprecated-module
-from paste import httpserver
-import paste.gzipper
-from paste.urlmap import URLMap
-from ipalib import api
-from subprocess import check_output, CalledProcessError
-import re
-
-# Ugly hack for test purposes only. GSSAPI has no way to get default ccache
-# name, but we don't need it outside test server
-def get_default_ccache_name():
-    try:
-        out = check_output(['klist'])
-    except CalledProcessError:
-        raise RuntimeError("Default ccache not found. Did you kinit?")
-    match = re.match(r'^Ticket cache:\s*(\S+)', out)
-    if not match:
-        raise RuntimeError("Cannot obtain ccache name")
-    return match.group(1)
+import ssl
+import sys
+
+from werkzeug.exceptions import NotFound
+from werkzeug.serving import run_simple
+from werkzeug.utils import redirect, append_slash_redirect
+from werkzeug.wsgi import DispatcherMiddleware, SharedDataMiddleware
+
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+STATIC_FILES = {
+    '/ipa/ui': os.path.join(HERE, 'install/ui'),
+    '/ipa/ui/js': os.path.join(HERE, 'install/ui/src'),
+    '/ipa/ui/js/dojo': os.path.join(HERE, 'install/ui/build/dojo'),
+    '/ipa/ui/fonts': '/usr/share/fonts',
+}
+
+# import ipa Python packages from script directory
+sys.path.insert(0, HERE)
+from ipalib import api  # noqa: E402
+from ipalib.krb_utils import krb5_parse_ccache  # noqa: E402
+from ipalib.krb_utils import krb5_unparse_ccache  # noqa: E402
+
+
+def get_ccname():
+    """Retrieve and validate Kerberos credential cache
+
+    Only FILE schema is supported.
+    """
+    ccname = os.environ.get('KRB5CCNAME')
+    if ccname is None:
+        raise ValueError("KRB5CCNAME env var is not set.")
+    scheme, location = krb5_parse_ccache(ccname)
+    if scheme != 'FILE':  # MEMORY makes no sense
+        raise ValueError("Unsupported KRB5CCNAME scheme {}".format(scheme))
+    if not os.path.isfile(location):
+        raise ValueError("KRB5CCNAME file '{}' does not exit".format(location))
+    return krb5_unparse_ccache(scheme, location)
 
 
 class KRBCheater(object):
-    def __init__(self, app):
+    """Add KRB5CCNAME to WSGI environ
+    """
+    def __init__(self, app, ccname):
         self.app = app
-        self.url = app.url
-        self.ccname = get_default_ccache_name()
+        self.ccname = ccname
 
     def __call__(self, environ, start_response):
         environ['KRB5CCNAME'] = self.ccname
         return self.app(environ, start_response)
 
 
-class WebUIApp(object):
-    INDEX_FILE = 'index.html'
-    EXTENSION_TO_MIME_MAP = {
-        'xhtml': 'text/html',
-        'html': 'text/html',
-        'js': 'text/javascript',
-        'inc': 'text/html',
-        'css': 'text/css',
-        'png': 'image/png',
-        'json': 'text/javascript',
-    }
-
-    def __init__(self):
-        self.url = '/ipa/ui'
-
-    def __call__(self, environ, start_response):
-        path_info = environ['PATH_INFO'].lstrip('/')
-        if path_info == '':
-            path_info = self.INDEX_FILE
-        requested_file = path.join(getcwd(), 'install/ui/', path_info)
-        extension = requested_file.rsplit('.', 1)[-1]
-
-        if extension not in self.EXTENSION_TO_MIME_MAP:
-            start_response('404 Not Found', [('Content-Type', 'text/plain')])
-            return ['NOT FOUND']
-        mime_type = self.EXTENSION_TO_MIME_MAP[extension]
-
-        f = None
-        try:
-            f = open(requested_file, 'r')
-            api.log.info('Request file %s' % requested_file)
-            start_response('200 OK', [('Content-Type', mime_type)])
-            return [f.read()]
-        except IOError:
-            start_response('404 Not Found', [('Content-Type', 'text/plain')])
-            return ['NOT FOUND']
-        finally:
-            if f is not None:
-                f.close()
-            api.log.info('Request done')
-
-
-if __name__ == '__main__':
+class StaticFilesMiddleware(SharedDataMiddleware):
+    def get_directory_loader(self, directory):
+        # override directory loader to support index.html
+        def loader(path):
+            if path is not None:
+                path = os.path.join(directory, path)
+            else:
+                path = directory
+            # use index.html for directory views
+            if os.path.isdir(path):
+                path = os.path.join(path, 'index.html')
+            if os.path.isfile(path):
+                return os.path.basename(path), self._opener(path)
+            return None, None
+        return loader
+
+
+def init_api():
+    """Initialize FreeIPA API from command line
+    """
     parser = optparse.OptionParser()
 
-    parser.add_option('--dev',
-        help='Run WebUI in development mode (requires FireBug)',
+    parser.add_option(
+        '--dev',
+        help='Run WebUI in development mode',
         default=True,
         action='store_false',
         dest='prod',
     )
-    parser.add_option('--host',
+    parser.add_option(
+        '--host',
         help='Listen on address HOST (default 127.0.0.1)',
         default='127.0.0.1',
     )
-    parser.add_option('--port',
+    parser.add_option(
+        '--port',
         help='Listen on PORT (default 8888)',
         default=8888,
         type='int',
@@ -127,7 +135,13 @@ def __call__(self, environ, start_response):
 
     api.env.in_server = True
     api.env.startup_traceback = True
-    (options, args) = api.bootstrap_with_global_options(parser, context='lite')
+    # workaround for RefererError in rpcserver
+    api.env.in_tree = True
+    # workaround: AttributeError: locked: cannot set ldap2.time_limit to None
+    api.env.mode = 'production'
+
+    # pylint: disable=unused-variable
+    options, args = api.bootstrap_with_global_options(parser, context='lite')
     api.env._merge(
         lite_port=options.port,
         lite_host=options.host,
@@ -136,23 +150,54 @@ def __call__(self, environ, start_response):
     )
     api.finalize()
 
-    urlmap = URLMap()
-    apps = [
-        ('IPA', KRBCheater(api.Backend.wsgi_dispatch)),
-        ('webUI', KRBCheater(WebUIApp())),
-    ]
-    for (name, app) in apps:
-        urlmap[app.url] = app
-        api.log.info('Mounting %s at %s', name, app.url)
-
-    if path.isfile(api.env.lite_pem):
-        pem = api.env.lite_pem
+
+def redirect_ui(app):
+    """Redirects for UI
+    """
+    def wsgi(environ, start_response):
+        path_info = environ['PATH_INFO']
+        if path_info in {'/', '/ipa', '/ipa/'}:
+            response = redirect('/ipa/ui/')
+            return response(environ, start_response)
+        # Redirect to append slash to some routes
+        if path_info in {'/ipa/ui', '/ipa/ui/test'}:
+            response = append_slash_redirect(environ)
+            return response(environ, start_response)
+        if path_info == '/favicon.ico':
+            response = redirect('/ipa/ui/favicon.ico')
+            return response(environ, start_response)
+        return app(environ, start_response)
+    return wsgi
+
+
+def main():
+    ccname = get_ccname()
+    init_api()
+
+    if os.path.isfile(api.env.lite_pem):
+        ctx = ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
+        ctx.load_cert_chain(api.env.lite_pem)
     else:
-        api.log.info('To enable SSL, place PEM file at %r', api.env.lite_pem)
-        pem = None
+        ctx = None
+
+    app = NotFound()
+    app = DispatcherMiddleware(app, {
+        '/ipa': KRBCheater(api.Backend.wsgi_dispatch, ccname),
+    })
+    app = StaticFilesMiddleware(app, STATIC_FILES)
+    app = redirect_ui(app)
 
-    httpserver.serve(paste.gzipper.middleware(urlmap),
-        host=api.env.lite_host,
+    run_simple(
+        hostname=api.env.lite_host,
         port=api.env.lite_port,
-        ssl_pem=pem,
+        application=app,
+        processes=5,
+        ssl_context=ctx,
+        use_reloader=True,
+        # debugger doesn't work because framework catches all exceptions
+        # use_debugger=not api.env.webui_prod,
+        # use_evalex=not api.env.webui_prod,
     )
+
+if __name__ == '__main__':
+    main()
-- 
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to