| ikostia |
| Restricted Project |
Some environments configure a separate certificate store, and SSL connections
can fail if the wrong store is auto-discovered or no store exists.
This makes the client tied to the specific certificates used, so update the
client cache to key on the ca_certs value passed in.
| Lint Skipped |
| Unit Tests Skipped |
| Path | Packages | |||
|---|---|---|---|---|
| M | hgext3rd/phabstatus.py (3 lines) | |||
| M | hgext3rd/rage.py (3 lines) | |||
| M | phabricator/conduit.py (38 lines) |
| def getdiffstatus(repo, *diffid): | def getdiffstatus(repo, *diffid): | ||||
| """Perform a Conduit API call to get the diff status | """Perform a Conduit API call to get the diff status | ||||
| Returns status of the diff""" | Returns status of the diff""" | ||||
| if not diffid: | if not diffid: | ||||
| return [] | return [] | ||||
| timeout = repo.ui.configint('ssl', 'timeout', 5) | timeout = repo.ui.configint('ssl', 'timeout', 5) | ||||
| ca_certs = repo.ui.configpath('web', 'cacerts') | |||||
| try: | try: | ||||
| resp = conduit.call_conduit('differential.querydiffhashes', | resp = conduit.call_conduit('differential.querydiffhashes', | ||||
| {'revisionIDs': diffid}, | {'revisionIDs': diffid}, | ||||
| timeout=timeout) | timeout=timeout, ca_certs=ca_certs) | ||||
| except conduit.ClientError as ex: | except conduit.ClientError as ex: | ||||
| msg = _('Error talking to phabricator. No diff information can be ' | msg = _('Error talking to phabricator. No diff information can be ' | ||||
| 'provided.\n') | 'provided.\n') | ||||
| hint = _("Error info: %s\n") % str(ex) | hint = _("Error info: %s\n") % str(ex) | ||||
| return _fail(repo, diffid, msg, hint) | return _fail(repo, diffid, msg, hint) | ||||
| except arcconfig.ArcConfigError as ex: | except arcconfig.ArcConfigError as ex: | ||||
| msg = _('arcconfig configuration problem. No diff information can be ' | msg = _('arcconfig configuration problem. No diff information can be ' | ||||
| if _failsafeerrors: | if _failsafeerrors: | ||||
| msg += '\n' + '\n'.join(_failsafeerrors) | msg += '\n' + '\n'.join(_failsafeerrors) | ||||
| if opts.get('preview'): | if opts.get('preview'): | ||||
| ui.write('%s\n' % msg) | ui.write('%s\n' % msg) | ||||
| return | return | ||||
| timeout = ui.configint('ssl', 'timeout', 5) | timeout = ui.configint('ssl', 'timeout', 5) | ||||
| ca_certs = repo.ui.configpath('web', 'cacerts') | |||||
| pasteurl = None | pasteurl = None | ||||
| try: | try: | ||||
| resp = conduit.call_conduit('paste.create', { | resp = conduit.call_conduit('paste.create', { | ||||
| 'content': msg, | 'content': msg, | ||||
| 'title': 'hg rage for %s' % _failsafe(lambda: repo.root), | 'title': 'hg rage for %s' % _failsafe(lambda: repo.root), | ||||
| 'language': 'hgrage' | 'language': 'hgrage' | ||||
| }, timeout=timeout) | }, timeout=timeout, ca_certs=ca_certs) | ||||
| pasteurl = resp.get('uri') | pasteurl = resp.get('uri') | ||||
| except arcconfig.ArcConfigError: | except arcconfig.ArcConfigError: | ||||
| ui.warn(_('arcconfig configuration problem.\n')) | ui.warn(_('arcconfig configuration problem.\n')) | ||||
| except conduit.ClientError: | except conduit.ClientError: | ||||
| ui.warn(_('Error talking to phabricator.\n')) | ui.warn(_('Error talking to phabricator.\n')) | ||||
| except ValueError: | except ValueError: | ||||
| ui.warn(_('Bad response from phabricator.\n')) | ui.warn(_('Bad response from phabricator.\n')) | ||||
| mocked_responses = None | mocked_responses = None | ||||
| class ClientError(Exception): | class ClientError(Exception): | ||||
| def __init__(self, code, msg): | def __init__(self, code, msg): | ||||
| Exception.__init__(self, msg) | Exception.__init__(self, msg) | ||||
| self.code = code | self.code = code | ||||
| class Client(object): | class Client(object): | ||||
| def __init__(self, url=None, user=None, cert=None, act_as=None): | def __init__(self, url=None, user=None, cert=None, act_as=None, | ||||
| ca_certs=None): | |||||
| self._url = url or DEFAULT_URL | self._url = url or DEFAULT_URL | ||||
| self._user = user | self._user = user | ||||
| self._cert = cert | self._cert = cert | ||||
| self._actas = act_as or self._user | self._actas = act_as or self._user | ||||
| self._connection = None | self._connection = None | ||||
| self._ca_certs = ca_certs | |||||
| def apply_arcconfig(self, config): | def apply_arcconfig(self, config): | ||||
| self._url = config.get('conduit_uri', DEFAULT_URL) | self._url = config.get('conduit_uri', DEFAULT_URL) | ||||
| if self._url == 'https://phabricator.fb.com/api/': | if self._url == 'https://phabricator.fb.com/api/': | ||||
| self._url = 'https://phabricator.intern.facebook.com/api/' | self._url = 'https://phabricator.intern.facebook.com/api/' | ||||
| try: | try: | ||||
| hostconfig = config['hosts'][self._url] | hostconfig = config['hosts'][self._url] | ||||
| self._user = hostconfig['user'] | self._user = hostconfig['user'] | ||||
| 'output': 'json', | 'output': 'json', | ||||
| } | } | ||||
| headers = ( | headers = ( | ||||
| ('Connection', 'Keep-Alive'), | ('Connection', 'Keep-Alive'), | ||||
| ) | ) | ||||
| url = self._url + method | url = self._url + method | ||||
| if self._connection is None: | if self._connection is None: | ||||
| self._connection = urllib3.PoolManager() | self._connection = urllib3.PoolManager(ca_certs=self._ca_certs) | ||||
| try: | try: | ||||
| response = self._connection.request( | response = self._connection.request( | ||||
| 'POST', url, headers=headers, fields=req_data, timeout=timeout) | 'POST', url, headers=headers, fields=req_data, timeout=timeout) | ||||
| except urllib3.exceptions.HTTPError as ex: | except urllib3.exceptions.HTTPError as ex: | ||||
| errno = -1 | errno = -1 | ||||
| if ex.args and util.safehasattr(ex.args[0], 'errno'): | if ex.args and util.safehasattr(ex.args[0], 'errno'): | ||||
| errno = ex.args[0].errno | errno = ex.args[0].errno | ||||
| raise ClientError(errno, str(ex)) | raise ClientError(errno, str(ex)) | ||||
| # contains a series of json serialized object values. | # contains a series of json serialized object values. | ||||
| with open(os.environ['HG_ARC_CONDUIT_MOCK'], 'r') as f: | with open(os.environ['HG_ARC_CONDUIT_MOCK'], 'r') as f: | ||||
| mocked_responses = json.load(f) | mocked_responses = json.load(f) | ||||
| Client = MockClient | Client = MockClient | ||||
| class ClientCache(object): | class ClientCache(object): | ||||
| def __init__(self): | def __init__(self): | ||||
| self.max_idle_seconds = 10 | self.max_idle_seconds = 10 | ||||
| self.client = None | self.client = {} | ||||
| self.lastuse = None | self.lastuse = {} | ||||
| @contextlib.contextmanager | @contextlib.contextmanager | ||||
| def getclient(self): | def getclient(self, ca_certs=None): | ||||
| # Use the existing client if we have one and it hasn't been idle too | # Use the existing client if we have one and it hasn't been idle too | ||||
| # long. | # long. | ||||
| # | # | ||||
| # We reconnect if we have been idle for too long just in case the | # We reconnect if we have been idle for too long just in case the | ||||
| # server might have closed our connection while we were idle. (We | # server might have closed our connection while we were idle. (We | ||||
| # could potentially check the socket for readability, but that might | # could potentially check the socket for readability, but that might | ||||
| # still race with the server currently closing our socket.) | # still race with the server currently closing our socket.) | ||||
| if (self.client is not None and | client = self.client.get(ca_certs), | ||||
| time.time() <= (self.lastuse + self.max_idle_seconds)): | lastuse = self.lastuse.get(ca_certs, 0) | ||||
| client = self.client | if client and time.time() <= (lastuse + self.max_idle_seconds): | ||||
| # Remove self.client for this ca_certs config while we are using | |||||
| # Reset self.client to None while we are using it. | # it. If our caller throws an exception during the yield this | ||||
| # If our caller throws an exception during the yield this ensures | # ensures that we do not continue to use this client later. | ||||
| # that we do not continue to use this client later. | del self.client.pop[ca_certs], self.lastuse[ca_certs] | ||||
| self.client = None | |||||
| self.lastuse = None | |||||
| else: | else: | ||||
| # We have to make a new connection | # We have to make a new connection | ||||
| client = Client() | client = Client(ca_certs=ca_certs) | ||||
| client.apply_arcconfig(arcconfig.load_for_path(os.getcwd())) | client.apply_arcconfig(arcconfig.load_for_path(os.getcwd())) | ||||
| yield client | yield client | ||||
| # Our caller used this client successfully and did not throw an | # Our caller used this client successfully and did not throw an | ||||
| # exception. Store it to use again next time getclient() is called. | # exception. Store it to use again next time getclient() is called. | ||||
| self.lastuse = time.time() | self.lastuse[ca_certs] = time.time() | ||||
| self.client = client | self.client[ca_certs] = client | ||||
| _clientcache = ClientCache() | _clientcache = ClientCache() | ||||
| def call_conduit(method, args, timeout=DEFAULT_TIMEOUT): | def call_conduit(method, args, ca_certs=None, timeout=DEFAULT_TIMEOUT): | ||||
| with _clientcache.getclient() as client: | with _clientcache.getclient(ca_certs=ca_certs) as client: | ||||
| return client.call(method, args, timeout=timeout) | return client.call(method, args, timeout=timeout) | ||||