issue2551137, 2551138 - roundup-server SSL issues.

Python3 no longer supports socket._fileobject, so fake it using
SocketIO and layering io.BufferedReader as in:

   https://bugs.launchpad.net/python-glanceclient/+bug/1812525

Also handle SSL.ZeroReturnError exception by ignoring it.  This
exception is thrown when the SSL layer has been closed and a read
happens. There is a warning in openssl as well as python docs that the
underlying (unencrypted) socket may not be closed. In manual testing,
netstat -anp didn't show any unclosed socket so.... Could it leak a fd
still, unknown.

This also seesm to have fixed an error when running under python2
where socket shutdown throws an error. Maybe ignoring ZeroErrorREturn
handled that case?

Also added doc to man page recommending not using -s and using a real
web server instead. Also added doc on format of pem file passed to -e.

No automated testing on this, so no test updates 8-(.

Author: rouilj

CHANGES.txt

@@ -30,6 +30,12 @@ Fixed:
 - added more testing of BasicDatabase to support use of SQLite
   for that purpose. Had to fix memory, rdbms and dbm edge cases
   due to new tests. (John Rouillard)
+- issue2551138 - roundup-server with ssl under python2 throws
+  traceback on socket close. Not sure how this got fixed,
+  but after fixing issue2551137 it was not an issue anymore.
+- issue2551137 - roundup-server won't run with ssl under python3
+  Fixed by using SocketIO and manually adding buffering io and
+  catching SSL.ZeroReturnError indicating SSL has been shut down.
 
 Features:
 

roundup/scripts/roundup_server.py

@@ -161,6 +161,13 @@ def readline(self, *args):
                             return self.__fileobj.readline(*args)
                         except SSL.WantReadError:
                             time.sleep(.1)
+                        except SSL.ZeroReturnError:
+                            # Raised here on every request.
+                            # SSL connection has been closed.
+                            # But maybe not the underlying socket.
+                            # FIXME: Does this lead to a socket leak??
+                            #  if so how to fix?
+                            pass
 
                 def read(self, *args):
                     """ SSL.Connection can return WantRead """
@@ -169,6 +176,15 @@ def read(self, *args):
                             return self.__fileobj.read(*args)
                         except SSL.WantReadError:
                             time.sleep(.1)
+                        except SSL.ZeroReturnError:
+                            # Put here to match readline() handling above.
+                            # Even though this never was the source of the
+                            #  exception logged during use.
+                            # SSL connection has been closed.
+                            # But maybe not the underlying socket.
+                            # FIXME: Does this lead to a socket leak??
+                            #  if so how to fix?
+                            pass
 
                 def __getattr__(self, attrib):
                     return getattr(self.__fileobj, attrib)
@@ -180,8 +196,26 @@ def __init__(self, conn):
                     self.__conn = conn
 
                 def makefile(self, mode, bufsize):
-                    fo = socket._fileobject(self.__conn, mode, bufsize)
-                    return RetryingFile(fo)
+                    fo = None
+                    try:
+                        # see below of url used for this
+                        fo = socket.SocketIO(self.__conn, mode)
+                    except AttributeError:
+                        # python 2 in use
+                        buffer = socket._fileobject(self.__conn, mode, bufsize)
+
+                    if fo:
+                        # python3 set up buffering
+                        # verify mode is rb and bufsize is -1
+                        # implement subset of socket::makefile
+                        # https://bugs.launchpad.net/python-glanceclient/+bug/1812525
+                        if mode == 'rb' and bufsize == -1:
+                            buffering = io.DEFAULT_BUFFER_SIZE
+                            buffer = io.BufferedReader(fo, buffering)
+                        else:
+                            buffer = fo
+
+                    return RetryingFile(buffer)
 
                 def __getattr__(self, attrib):
                     return getattr(self.__conn, attrib)

share/man/man1/roundup-server.1

@@ -45,11 +45,19 @@ front end server to authenticate a user and pass the user identity to
 roundup.
 .TP
 \fB-s\fP
-Enables use of SSL.
+Enables use of SSL. SSL only works when running the server using
+python 3. In most cases, you will want to run a real web server
+(Apache, Nginx) as a proxy to roundup-server running without SSL.
+The real web server can filter/rate limit/firewall requests to
+roundup-server.
 .TP
 \fB-e\fP \fIfile\fP
-Sets a filename containing the PEM file to use for SSL. If left blank, a
-temporary self-signed certificate will be used.
+Sets a filename containing the PEM file to use for SSL. The PEM file
+must include both the private key and certificate with appropriate
+headers (e.g. "-----BEGIN PRIVATE KEY-----", "-----END PRIVATE
+KEY-----" and "-----BEGIN CERTIFICATE-----", "-----END
+CERTIFICATE-----". If no file is specified, a temporary self-signed
+certificate will be used.
 .TP
 \fB-N\fP
 Log client machine names instead of IP addresses (much slower).