307 lines
16 KiB
Python
307 lines
16 KiB
Python
"""通过隔离实机验证 SQLite 迁移、两种重启及目标不可读时的恢复。"""
|
||
|
||
import argparse
|
||
from contextlib import closing
|
||
from email.message import EmailMessage
|
||
import hashlib
|
||
import json
|
||
import os
|
||
from pathlib import Path
|
||
import re
|
||
import sqlite3
|
||
import ssl
|
||
import stat
|
||
import subprocess
|
||
import sys
|
||
import time
|
||
|
||
from runtime_probe import ACCOUNT, ADDRESS, Client, protocol_operation, smtp_connect, verify_protocol_read
|
||
|
||
|
||
def read_database(path):
|
||
# 只读打开，缺失数据库必须失败，不能由验收器创建来掩盖问题。
|
||
return closing(sqlite3.connect(path.resolve().as_uri() + '?mode=ro', uri=True, timeout=5))
|
||
|
||
|
||
def database_fingerprint(path):
|
||
with read_database(path) as database:
|
||
assert database.execute('PRAGMA integrity_check').fetchone() == ('ok',)
|
||
rows = list(database.iterdump())
|
||
return hashlib.sha256('\n'.join(rows).encode()).hexdigest()
|
||
|
||
|
||
def verify_history_preserved(root):
|
||
query = 'SELECT kind, id, payload, digest FROM config_records'
|
||
with read_database(root / 'data/smail.db') as source:
|
||
old = set(source.execute(query))
|
||
with read_database(root / 'data/migrated.db') as target:
|
||
current = set(target.execute(query))
|
||
assert old and old.issubset(current), '源库配置历史没有完整保留在目标库'
|
||
return {'source_records': len(old), 'target_records': len(current), 'all_source_records_equal': True}
|
||
|
||
|
||
def root_database(root):
|
||
data = json.loads((root / 'config/config.json').read_text())
|
||
database = data['database']
|
||
assert database['type'] == 'sqlite'
|
||
assert database['localRef'] in ('smail.db', 'migrated.db')
|
||
return database['localRef']
|
||
|
||
|
||
def migration_integrity(root, interrupted=False):
|
||
active = root_database(root)
|
||
assert active == 'migrated.db'
|
||
names = sorted(path.name for path in (root / 'data').glob('*.db'))
|
||
expected = ['migrated.db', 'occupied.db', 'smail.db']
|
||
if interrupted:
|
||
expected.append('interrupted.db')
|
||
assert names == sorted(expected), '发现意外数据库文件'
|
||
with read_database(root / 'data' / active) as database:
|
||
assert database.execute('PRAGMA integrity_check').fetchone() == ('ok',)
|
||
count = database.execute('SELECT COUNT(*) FROM config_records').fetchone()[0]
|
||
assert count > 0
|
||
return {'active_database': active, 'config_records': count,
|
||
'retained_offline_files': sorted(set(expected) - {active}), 'integrity': 'ok'}
|
||
|
||
|
||
def wait_ready(client, generation=None):
|
||
for _ in range(70):
|
||
try:
|
||
if generation is None:
|
||
assert client.request('/api/ping', method='GET')[0] == 200
|
||
else:
|
||
status = client.success('/api/v1/config/status', method='GET')
|
||
assert status['activeGeneration'] == generation and not status['pendingRestart']
|
||
return
|
||
except (OSError, AssertionError):
|
||
time.sleep(1)
|
||
raise AssertionError('迁移后的应用服务未就绪')
|
||
|
||
|
||
def login(root, password):
|
||
context = ssl.create_default_context(cafile=str(root / 'ssl/runtime.crt'))
|
||
assert context.check_hostname and context.verify_mode == ssl.CERT_REQUIRED
|
||
client = Client(context)
|
||
wait_ready(client)
|
||
assert client.success('/api/v1/login', {'account': ACCOUNT, 'password': password})['account'] == ACCOUNT
|
||
client.success('/api/v1/security/reauth', {'password': password})
|
||
return client, context
|
||
|
||
|
||
def clear_pending_restart(client):
|
||
status = client.success('/api/v1/config/status', method='GET')
|
||
if status['pendingRestart']:
|
||
assert client.success('/api/v1/system/restart')['status'] == 'accepted'
|
||
wait_ready(client, status['activeGeneration'])
|
||
return status['activeGeneration']
|
||
|
||
|
||
def prepare(root, password):
|
||
client, _ = login(root, password)
|
||
generation = clear_pending_restart(client)
|
||
endpoint = '/api/v1/database/migrations'
|
||
# 预览时目标不存在；执行前故意占用，只能拒绝，不能覆盖已有文件。
|
||
preview = client.success(endpoint + '/preview', {
|
||
'expectedGeneration': generation, 'target': {'type': 'sqlite', 'localRef': 'occupied.db'},
|
||
})
|
||
occupied = root / 'data/occupied.db'
|
||
with occupied.open('xb') as stream:
|
||
stream.write(b'smail-migration-occupied-target\n')
|
||
occupied.chmod(0o600)
|
||
original = occupied.read_bytes()
|
||
status, rejected, _ = client.request(endpoint, {
|
||
'id': preview['migration']['id'], 'token': preview['token'],
|
||
})
|
||
assert status == 409 and rejected is not None and rejected['errorNo'] != 0
|
||
assert rejected['data']['code'] == 'DATABASE_MIGRATION_TARGET_EXISTS'
|
||
assert occupied.read_bytes() == original and root_database(root) == 'smail.db'
|
||
failed = client.success(endpoint + '/' + preview['migration']['id'], method='GET')
|
||
assert failed['status'] == 'failed' and failed['errorCode'] == 'TARGET_EXISTS'
|
||
assert client.success('/api/v1/user/info')['account'] == ACCOUNT
|
||
# 写入实际配置，证明失败后没有卡在只读维护状态。
|
||
from runtime_probe import verify_config_history
|
||
verify_config_history(client)
|
||
generation = clear_pending_restart(client)
|
||
preview = client.success(endpoint + '/preview', {
|
||
'expectedGeneration': generation, 'target': {'type': 'sqlite', 'localRef': 'migrated.db'},
|
||
})
|
||
record = client.success(endpoint, {'id': preview['migration']['id'], 'token': preview['token']})
|
||
assert record['status'] == 'succeeded'
|
||
assert root_database(root) == 'migrated.db'
|
||
pending = client.success('/api/v1/config/status', method='GET')
|
||
assert pending['activeGeneration'] > generation and pending['pendingRestart']
|
||
# 成功切换到新配置但尚未重启时，不允许继续写业务。
|
||
denied_status, denied, _ = client.request('/api/v1/security/credentials/protocols/generate', {'protocol': 'imap'})
|
||
assert denied_status == 503 and denied is not None and denied['data'] == 'DATABASE_RESTART_REQUIRED'
|
||
assert client.success('/api/v1/system/restart')['status'] == 'accepted'
|
||
wait_ready(client, pending['activeGeneration'])
|
||
assert client.success('/api/v1/user/info')['account'] == ACCOUNT
|
||
return {'occupied_target_rejected': True, 'occupied_target_unchanged': True,
|
||
'failed_record': failed['status'], 'failure_releases_maintenance': True,
|
||
'switch_succeeded': True, 'pending_write_denied': True,
|
||
'internal_restart_completed': True, 'existing_session_preserved': True,
|
||
'generation': pending['activeGeneration'], 'rejection_http_status': status}
|
||
|
||
|
||
def verify_mail(root, password, phase):
|
||
client, context = login(root, password)
|
||
assert root_database(root) == 'migrated.db'
|
||
assert client.success('/api/v1/user/info')['account'] == ACCOUNT
|
||
status = client.success('/api/v1/config/status', method='GET')
|
||
assert not status['pendingRestart']
|
||
codes = {}
|
||
for protocol in ('smtp', 'imap', 'pop3'):
|
||
codes[protocol] = client.success('/api/v1/security/credentials/protocols/generate', {'protocol': protocol})['code']
|
||
assert protocol_operation(protocol, context, codes[protocol])() == 'success'
|
||
original = json.loads((root.parent / 'probe-result.json').read_text())['smtp']['message_id']
|
||
body = '内部25端口真实收信，检查中文正文和附件。'
|
||
attachment = '隔离验收附件内容'.encode('utf-8')
|
||
historical = verify_protocol_read(context, codes, original, body, attachment)
|
||
message_id = original + '.' + phase
|
||
message = EmailMessage()
|
||
message['From'], message['To'] = 'migration@sender.invalid', ADDRESS
|
||
message['Subject'] = '切库重启后的中文邮件验收'
|
||
message['Message-ID'] = '<' + message_id + '>'
|
||
message.set_content(body)
|
||
message.add_attachment(attachment, maintype='text', subtype='plain', filename='验收附件.txt')
|
||
with smtp_connect(context) as smtp:
|
||
assert not smtp.send_message(message)
|
||
received = verify_protocol_read(context, codes, message_id, body, attachment)
|
||
with read_database(root / 'data/migrated.db') as database:
|
||
assert database.execute('SELECT COUNT(*) FROM email WHERE msg_id=?', (message_id,)).fetchone()[0] == 1
|
||
assert database.execute('SELECT COUNT(*) FROM config_records').fetchone()[0] > 0
|
||
with read_database(root / 'data/smail.db') as database:
|
||
assert database.execute('SELECT COUNT(*) FROM email WHERE msg_id=?', (message_id,)).fetchone()[0] == 0
|
||
return {'login': True, 'session': True, 'historical_mail': historical,
|
||
'new_mail': received, 'new_mail_only_in_target': True, 'message_id': message_id}
|
||
|
||
|
||
def service_state(unit):
|
||
assert re.fullmatch(r'smail-runtime-review-\d{8}-\d{6}', unit)
|
||
output = subprocess.check_output(['systemctl', 'show', unit,
|
||
'--property=MainPID,InvocationID,ActiveState,SubState,Result,ExecMainStatus'], text=True, timeout=15)
|
||
return dict(line.split('=', 1) for line in output.splitlines())
|
||
|
||
|
||
def process_uses_target(root, state):
|
||
pid = state['MainPID']
|
||
assert pid.isdigit() and int(pid) > 0
|
||
assert Path('/proc/' + pid + '/root/opt/smail/smail').stat().st_ino == (root / 'smail').stat().st_ino
|
||
paths = []
|
||
for item in Path('/proc/' + pid + '/fd').iterdir():
|
||
try:
|
||
paths.append(str(item.readlink()))
|
||
except FileNotFoundError:
|
||
pass
|
||
assert '/opt/smail/data/migrated.db' in paths, '进程未持有迁移目标库'
|
||
assert '/opt/smail/data/smail.db' not in paths, '进程仍然打开旧业务库'
|
||
|
||
|
||
def run_probe(root, unit, password, phase, sql_settings=None, probe_script=None):
|
||
state = service_state(unit)
|
||
pid = state['MainPID']
|
||
assert pid.isdigit() and int(pid) > 0
|
||
assert Path('/proc/' + pid + '/ns/net').readlink() != Path('/proc/self/ns/net').readlink()
|
||
probe = 'smail-migration-probe-' + unit.removeprefix('smail-runtime-review-') + '-' + phase
|
||
script = 'runtime_sql_migration.py' if sql_settings else 'runtime_migration.py'
|
||
if probe_script is not None:
|
||
assert probe_script == 'runtime_interruption.py' and sql_settings is None
|
||
script = probe_script
|
||
command = ['systemd-run', '--wait', '--pipe', '--unit=' + probe,
|
||
'--property=User=smail', '--property=Group=smail',
|
||
'--property=NetworkNamespacePath=/proc/' + pid + '/ns/net',
|
||
'--property=ProtectSystem=strict', '--property=ProtectHome=yes',
|
||
'--property=NoNewPrivileges=yes', '--property=InaccessiblePaths=/opt/smail /run/smail',
|
||
'--property=ReadWritePaths=' + str(root.parent), '--property=MemoryMax=48M',
|
||
'--property=MemorySwapMax=0', '--property=CPUQuota=25%', '--property=TasksMax=32',
|
||
'--property=RuntimeMaxSec=150s', '--property=KillMode=control-group',
|
||
'--property=TimeoutStopSec=10s', 'python3', str(root.parent / script),
|
||
str(root), phase]
|
||
try:
|
||
data = password + '\n' + (json.dumps(sql_settings) + '\n' if sql_settings else '')
|
||
completed = subprocess.run(command, input=data, text=True,
|
||
stdout=subprocess.PIPE, stderr=subprocess.STDOUT, timeout=175)
|
||
(root.parent / ('migration-' + phase + '.log')).write_text(completed.stdout, encoding='utf-8')
|
||
assert completed.returncode == 0, '迁移探针失败，请检查独立阶段日志'
|
||
return json.loads((root.parent / ('migration-' + phase + '.json')).read_text())
|
||
finally:
|
||
# 瞬时单元可能已经回收；只有确认无进程且不活动才接受未加载返回值。
|
||
stopped = subprocess.run(['systemctl', 'stop', probe], capture_output=True, text=True, timeout=25)
|
||
output = subprocess.check_output(['systemctl', 'show', probe,
|
||
'--property=MainPID,ActiveState,LoadState'], text=True, timeout=15)
|
||
values = dict(line.split('=', 1) for line in output.splitlines())
|
||
assert values['MainPID'] == '0' and values['ActiveState'] in ('inactive', 'failed')
|
||
assert stopped.returncode == 0 or (stopped.returncode == 5 and values['LoadState'] == 'not-found')
|
||
|
||
|
||
def verify_migration(root, unit, password, result):
|
||
assert root.parent.parent == Path('/var/tmp') and re.fullmatch(
|
||
r'smail-review-runtime-\d{8}-\d{6}', root.parent.name)
|
||
assert root.name == 'instance' and not root.is_symlink()
|
||
assert root.resolve(strict=True) == root
|
||
details = result['migration'] = {'passed': False}
|
||
before = service_state(unit)
|
||
details['prepare'] = run_probe(root, unit, password, 'prepare')
|
||
internal = service_state(unit)
|
||
assert before['MainPID'] == internal['MainPID'] and before['InvocationID'] == internal['InvocationID']
|
||
process_uses_target(root, internal)
|
||
details['internal_restart_same_process'] = True
|
||
source_digest = database_fingerprint(root / 'data/smail.db')
|
||
details['internal'] = run_probe(root, unit, password, 'internal')
|
||
# 必须实际更换进程，不能把 API 的 accepted 或管理器 reload 当作系统重启。
|
||
subprocess.run(['systemctl', 'restart', unit], check=True, timeout=55)
|
||
restarted = service_state(unit)
|
||
assert restarted['MainPID'] != internal['MainPID'] and restarted['InvocationID'] != internal['InvocationID']
|
||
details['process'] = run_probe(root, unit, password, 'process')
|
||
process_uses_target(root, restarted)
|
||
details['process_states'] = {'before': before, 'internal': internal, 'restarted': restarted}
|
||
target = root / 'data/migrated.db'
|
||
assert target.is_file() and not target.is_symlink()
|
||
mode = stat.S_IMODE(target.stat().st_mode)
|
||
assert mode == 0o600
|
||
try:
|
||
# 只收紧本轮唯一目标文件权限，故障时绝不回写或清空正式库。
|
||
target.chmod(0)
|
||
subprocess.run(['systemctl', 'restart', unit], check=True, timeout=55)
|
||
for _ in range(60):
|
||
failed = service_state(unit)
|
||
if failed['MainPID'] == '0' and failed['ActiveState'] == 'failed':
|
||
break
|
||
time.sleep(1)
|
||
else:
|
||
raise AssertionError('目标库不可读时没有明确停止，可能静默回退')
|
||
assert root_database(root) == 'migrated.db'
|
||
assert database_fingerprint(root / 'data/smail.db') == source_digest
|
||
details['unavailable_target'] = {'failed_closed': True, 'source_unchanged': True,
|
||
'configuration_preserved': True, 'state': failed}
|
||
finally:
|
||
target.chmod(mode)
|
||
subprocess.run(['systemctl', 'start', unit], check=True, timeout=55)
|
||
details['recovered'] = run_probe(root, unit, password, 'recovered')
|
||
final = service_state(unit)
|
||
process_uses_target(root, final)
|
||
assert database_fingerprint(root / 'data/smail.db') == source_digest
|
||
assert final['MainPID'] not in (before['MainPID'], restarted['MainPID'])
|
||
details['history'] = verify_history_preserved(root)
|
||
details.update(source_unchanged=True, target_permissions_restored=True, final_state=final, passed=True)
|
||
(root.parent / 'migration-result.json').write_text(json.dumps(details, ensure_ascii=False, indent=2), encoding='utf-8')
|
||
|
||
|
||
def main():
|
||
parser = argparse.ArgumentParser()
|
||
parser.add_argument('root', type=Path)
|
||
parser.add_argument('phase', choices=('prepare', 'internal', 'process', 'recovered'))
|
||
args = parser.parse_args()
|
||
assert os.geteuid() != 0, 'HTTP 与邮件探针必须使用非特权用户'
|
||
password = sys.stdin.readline().strip()
|
||
assert len(password) == 12
|
||
result = prepare(args.root, password) if args.phase == 'prepare' else verify_mail(args.root, password, args.phase)
|
||
result['passed'] = True
|
||
(args.root.parent / ('migration-' + args.phase + '.json')).write_text(
|
||
json.dumps(result, ensure_ascii=False, indent=2), encoding='utf-8')
|
||
print(json.dumps(result, ensure_ascii=False, indent=2))
|
||
|
||
|
||
if __name__ == '__main__':
|
||
main()
|