March 29, 2018
Posted in Software at 19:34 by graham
Gardening is my preferred metaphor for software. When I grow a new piece of software, there is a very predictable path I go through as I attempt to manage it’s complexity. It is, in fast-forward, the history of programming language design. That process is short enough to capture in about 400 characters, as two tweets.
Read the rest of this entry »
April 9, 2016
Posted in Software at 20:01 by graham
To start a server on a port below 1024 (i.e. 80, 443), you need root permissions or capability CAP_NET_BIND_SERVICE, but you also want most of your server to run unprivileged, reducing your attack surface. The traditional way to achieve this was to start as root, bind the socket, then drop privileges. It’s a hassle, and if you get it wrong it’s a big security hole, so often we just run on an unprivileged port and use something like nginx to proxy. But no longer. There’s a much better way: systemd socket activation.
Here is a Go program that will listen on port 8080 if started manually, or port 80 if run via systemd.
package main
import (
"log"
"net"
"net/http"
"os"
"strconv"
)
func main() {
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
w.Write([]byte("Hello World!"))
})
if os.Getenv("LISTEN_PID") == strconv.Itoa(os.Getpid()) {
// systemd run
f := os.NewFile(3, "from systemd")
l, err := net.FileListener(f)
if err != nil {
log.Fatal(err)
}
http.Serve(l, nil)
} else {
// manual run
log.Fatal(http.ListenAndServe(":8080", nil))
}
}
Build it (go build hello.go) and put the hello binary on your path (~/bin/ in my case).
Create /etc/systemd/system/hello.service:
[Unit]
Requires=hello.socket
[Service]
ExecStart=/home/graham/bin/hello
NonBlocking=true
Create /etc/systemd/system/hello.socket:
[Unit]
Description=Hello socket
[Socket]
ListenStream=80
NoDelay=true
We use NoDelay (TCP_NODELAY) and NonBlocking (O_NONBLOCK) because Go sets these by default on sockets it opens, and we want similar behavior.
Reload the config in systemd (sudo systemctl daemon-reload), and you’re done. If you start it manually it will listen on 8080, if you start it via sudo systemctl start hello it will listen on port 80.
To stop the service you also need to stop the socket. If you don’t stop the socket, incoming connections will auto-start the service (inetd style). systemd will warn you about this.
sudo systemctl stop hello.socket hello
How it works
When systemd starts a process that uses socket-based activation it sets the following environment variables. To check whether we are being started via socket activation we just need to check if one of those environment variables is set.
LISTEN_PID: The process id of the process who gets the sockets. This prevents a child forked from your main process from thinking it is being given some sockets.LISTEN_FDS: The number of file descriptors (sockets) your process is being given. In our case this will be 1.
Every process gets three standard file descriptors: STDIN=0, STDOUT=1, and STDERR=2. Descriptors given to us by systemd hence start at number 3.
Here are all the .socket file options. You should also set protections in your .service file, see The joy of systemd.
TLS and HTTP2
Edit /etc/systemd/system/hello.socket to use port 443:
ListenStream=443
Wrap the listener with tls.NewListener, and set tls.Config.NextProtos to be []string{"h2", "http/1.1"} to maintain http2 support. Here’s the full // systemd run section:
config := &tls.Config{
Certificates: make([]tls.Certificate, 1),
NextProtos: []string{"h2", "http/1.1"},
PreferServerCipherSuites: true,
}
var err error
config.Certificates[0], err = tls.LoadX509KeyPair(
"my_cert.pem",
"my_cert.key",
)
if err != nil {
log.Fatal(err)
}
f := os.NewFile(3, "from systemd")
l, err := net.FileListener(f)
if err != nil {
log.Fatal(err)
}
tlsListener := tls.NewListener(l, config)
http.Serve(tlsListener, nil)
That’s it!
UPDATE 2018: Vincent Bernat has an excellent blog-post on zero-downtime upgrades in Go with systemd.
January 12, 2016
Posted in Software at 17:51 by graham
Three years ago when I wrote The Joy of Upstart, that was the easiest way to turn your scripts into daemons. Today the future belongs firmly to systemd, so let’s revisit the Upstart post, and update it for systemd.
systemd is here, it is the default on most major distributions including Ubuntu from 15.04, Fedora from 15, and Red Hat from v7, so you can probably use it now. The main exception is Ubuntu LTS, where we need to wait a few more months for 16.04.
Take this python script: /home/myuser/ez_daemon.py
import time
while 1:
print("I'm a daemon!")
time.sleep(1)
We’re going to turn it into a daemon in just two lines. Create /etc/systemd/system/ez_daemon.service:
[Service]
ExecStart=/usr/bin/python -u /home/myuser/ez_daemon.py
And that’s it!
systemctl start ez_daemonjournalctl -f -u ez_daemon. Stdout goes to the journal by default (more below).systemctl status ez_daemon. The status page is actually useful.systemctl stop ez_daemon
A systemd file (such as /etc/systemd/system/ez_daemon.service) is called a unit. Paths in units must be absolute, hence /usr/bin/python. systemd caches units. When you change one you must systemctl daemon-reload to use the latest version. systemd will remind you.
A major difference with Upstart is that stdout and stderr are now buffered. Upstart went the extra mile by wrapping our script with a pseudo-tty to prevent the buffering. systemd uses a pipe, which means by default there is a 4k buffer on stdout and stderr. You won’t see anything in journalctl until that buffer fills. We pass -u to python to prevent this buffering, or we could have called sys.stdout.flush() after each print. Note also that you can’t have end-of-line comments, a comment must be on a line by itself.
Here’s a more complete example:
[Unit]
Description="Example daemon"
# Don't start until the network is available
Requires=network-online.target
After=network-online.target
[Service]
ExecStart=/usr/bin/python -u /home/myuser/bin/ez_daemon.py
Restart=on-failure
User=www-data
Group=www-data
Environment=\
PYTHONPATH=/srv/example/src/example/ \
ANSWER=42 \
"GREET=Hello systemd"
# /usr, /boot and /etc are read-only
ProtectSystem=full # even safer: ProtectSystem=strict
# $HOME is read only ..
ProtectHome=read-only
# .. except /home/myuser/logs
ReadWriteDirectories=/home/myuser/logs
# /tmp is isolated from all other processes
PrivateTmp=true
# Minimal /dev, no physical device access
PrivateDevices=true
# Don't allow process to raise privileges (e.g. disable suid)
NoNewPrivileges=true
# No network access
PrivateNetwork=true
[Install]
WantedBy=multi-user.target
A particularly exciting part of systemd is the security features enabled by cgroups. The example script includes most of them, which you’ll want to remove as necessary. For example PrivateNetwork wouldn’t be applicable for nginx. Here are full details on systemd security. UPDATE 2018: systemd now has the even safer ProtectSystem=strict and dynamic users.
systemd replaces syslog. As a convenience Ubuntu still runs syslog, messages are available in /var/log/syslog. Fedora no longer runs syslog by default, so /var/log/messages is empty. Instead you use journalctl, which has greatly improving filtering capabilities. Examples in Linux Voice.
Another exciting feature of systemd is socket activation, for example systemd can open port 80 and hand it to your process. You no longer need to start as root, open the port, then drop privileges. This USENIX Login has examples, and is probably the best place to continue reading after this post.
Ubuntu maintains tips for converting Upstart scripts to systemd.
systemd can also replace cron, run containers, and much more. It’s our future, and it’s going to be amazing.
November 1, 2015
Posted in Software at 00:15 by graham
tl;dr: It looks like Facebook is getting the textbook results of ignoring code quality.
Update: More examples, and insights from ex-employees in the reddit discussion
Facebook has a software quality problem. I’m going to try to convince you with three examples. This is important because it demonstrates the time-honored principle that quality matters. In demonstrates it, as Facebook engineers like to say, at scale. I don’t work at Facebook or any competitor, I’m just an observer.
Exhibit A: “iOS can’t handle our scale”
About a month ago a Facebook engineer gave this presentation: iOS at Facebook, which was followed by a discussion on reddit.
The Facebook iOS app has over 18,000 Objective-C classes, and in a single week 429 people contributing to it. That’s 429 people working, in some way, on the Facebook iOS app. Rather than take the obvious lesson that there are too many people working on this application, the presentation goes on to blame everything from git to Xcode for those 18,000 classes.
Read the rest of this entry »
October 26, 2015
Posted in Software at 01:18 by graham
tl;dr Use the mitmproxy doc, return here if trouble.
I am porting a server from Java to Go, and need to watch the traffic it receives. The clients include OSX and Windows desktop apps, talking to the server over HTTPS. Here’s how I did that with mitmproxy and iptables. We will setup a transparent proxy.
Instructions are for Ubuntu (arguably the most popular server operating system), but mitmproxy will also run on OSX (anecdotaly the most popular developer laptop) using pf instead of iptables.
Read the rest of this entry »
August 26, 2015
Posted in Software at 04:19 by graham
I attended OSCON for the first time this year in Portland. This was a dream come true for me, I have wanted to attend for many years. Here are my impressions and some talk links. I can’t link you to most of the talks, because O’Reilly sells them for $1,000. Open Source indeed.
First, it is a very big conference. They had 1,200 talk proposals, 4,700 attendees, up to 13 talks running concurrently, and two competing mobile apps. Twice I walked into a random Portland bar, which turned out to be hosting an OSCON-related event. It’s that big.
Second, it is a strange mixture of open-source and commercialism. Sponsors above a certain level get a keynote. Tremendous efforts are expended to herd the attendees into the expo hall at every opportunity, towards the paying booths. And I can’t link you to the best talks, because as mentioned O’Reilly sells them. On the other hand all sorts of people I admire in the tech world were there, and I had some wonderful conversations with them, and at the booths in the open-source section. At OSCON, you get to be a peer of the people whose blogs and books you read, and that’s really special.
Here are the speaker slides, a youtube search and, of the public ones, my favorites:
See you next year, in Austin!
July 31, 2015
Posted in Software at 04:58 by graham
GopherCon was in Denver again this year, and a lot of fun it was, mostly the meeting of wonderful people. Judging by the sponsors, Go continues to be the language of infrastructure (docker, coreos, etcd, mesos, kubernetes, influxdb, etc). Here are my three favorite talks:
- Rick Hudson: Go GC: Latency problem solved. This was probably the highlight of the conference for me. Rick is a fun speaker, and he’s talking about the key feature in Go 1.5. The garbage collector used to freeze your application for increasingly large amounts of time as you used more memory. It no longer does.
- Dmitry Vyukov: Go Dynamic Tools. Dmitry covers three tools: The race detector, go-fuzz, and the new execution tracer. The Go tooling is amazing.
- Audrey Lim: A Beginner’s Mind. Audrey is a lawyer who became a programmer recently, and she recounts her journey – but wait, read on. I confess when her talk was announced I thought I would not find it interesting. I was very wrong, because Audrey is phenomenal. She tried Python, Ruby and Node JS first, and detailed exactly why those were hard for a complete beginner. She made some very astute observations about how the language you use shapes how you think about programming, and the projects you will undertake.
Here are all the other GopherCon 2015 videos.
Robert Griesemer’s keynote highlighted the Pascal (via Oberon) heritage of Go, and remarked that Pascal is a European language family. The C heritage of Go that is more commonly referenced is North American. He hoped Go is a merging of the two software cultures.
And finally, joke of the conference has to go to Tomás Senart.
July 24, 2015
Posted in Software at 22:12 by graham
In part 1 we called a very simple Go shared library from Python. Let’s do a more complex example, passing string and []byte, from C++, and getting back a []byte.
Calling Go from C++
Save the following as concat/main.go:
package main
import "C"
//export Concat
func Concat(sIn string, bIn []byte, bOut []byte) {
n := copy(bOut, sIn)
copy(bOut[n:], bIn)
}
func main() {}
We add the import "C" so that cgo gives us a header file to #include. Build the shared library and header:
go build -buildmode=c-shared -o libconcat.so concat
In libconcat.h we have this signature:
extern void Concat(GoString p0, GoSlice p1, GoSlice p2)
GoString and GoSlice are defined further up in the header file like this:
typedef struct { char *p; GoInt n; } GoString;
typedef struct { void *data; GoInt len; GoInt cap; } GoSlice;
Copy libconcat.so to /usr/lib/ (or wherever your libraries live). Now let’s call Concat from C++:
#include <vector>
#include <string>
#include <iostream>
#include "libconcat.h"
int main() {
std::string s_in {"Hello "};
std::vector<char> v_in {'W', 'o', 'r', 'l', 'd'};
std::vector<char> v_out(11);
GoString go_s_in{&s_in[0], static_cast<GoInt>(s_in.size())};
GoSlice go_v_in{
v_in.data(),
static_cast<GoInt>(v_in.size()),
static_cast<GoInt>(v_in.size()),
};
GoSlice go_v_out{
v_out.data(),
static_cast<GoInt>(v_out.size()),
static_cast<GoInt>(v_out.size()),
};
Concat(go_s_in, go_v_in, go_v_out);
for(auto& c : v_out) {
std::cout << c;
}
std::cout << '\n';
}
Save that as concat.cpp. Copy libconcat.h into the same directory. Build and run:
g++ --std=c++14 concat.cpp -o concat -lconcat
./concat
I need the static_cast<GoInt> because a GoInt is a signed type (long long on my machine), but size() returns unsigned type size_t. Apart from wrapping things in Go[String|Slice|etc], this is exactly like calling an ordinary shared libary, because that’s what we built, an ordinary shared library.
The one very important caveat is that you should not pass pointers to Go allocated memory back to the C++ side; that’s why we use an output parameter (v_out). Even if you maintain a reference to it on the Go side so that the garbage collector doesn’t reclaim it, the Go runtime reserves the right to move that memory if they build a copying garbage collector. Lots of details in issue #8310.
Passing C++ allocated memory to Go is fine. Go will not garbage collect memory it did not allocate. There rules here are the same as for cgo.
July 15, 2015
Posted in Software at 03:22 by graham
Since 1.5, we can write C-style shared libraries (.so) in Go. These can be used directly from C and C++, but also from any language that can use a C shared library, which is most languages. Here’s the original design document. Let’s do a very simple example and call it from Python. In Part 2 we’ll do a more complex example and call it from C++.
Calling Go from Python
package main
import "C"
//export DoubleIt
func DoubleIt(x int) int {
return x * 2
}
func main() {}
Save that in your GOPATH as doubler/main.go. The exported symbols (the functions the shared library provides) must be in a main package, with a required but ignored main function. They must be marked with magic comment //export <name> (no space), because go build will call cgo.
go build -o libdoubler.so -buildmode=c-shared doubler
This puts libdoubler.so in your current directory. Let’s check we really have a dynamic shared library:
$ file libdoubler.so
libdoubler.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked ...
$ nm -D libdoubler.so | grep "T DoubleIt"
000000000005d230 T DoubleIt
Well that looks good. Let’s call it from Python, because Python’s ctypes makes this incredibly easy:
>>> import ctypes
>>> lib = ctypes.CDLL("libdoubler.so")
>>> lib.DoubleIt(21)
42
Ta da!
For me this ability to build normal shared libraries makes Go a first-class language on Unix. In later posts we’ll do a more complex example with C++, and time permitting a SWIG example with Ruby.
July 10, 2015
Posted in Software at 16:38 by graham
tl;dr man 2 brk
Last year when I was learning assembler, I was asking myself how to allocate memory without malloc. Usually memory is either allocated for us by our language, or we do it with new or malloc. But malloc is a library function, it’s not a system call. How does malloc itself get memory from the kernel? To answer that we need to look at the layout of a program in memory.
On Linux amd64, every process gets it’s own 128 Tb virtual address space. The program code, global data, debugging information and so on are loaded at the bottom of that space, working ‘upwards’ (bigger numeric addresses). Then comes the heap, where we are going to allocate some memory. Where the heap ends is called the program break. Then there is a very large gap, which the heap will grow into. At the top of the address space (0x7fffffffffff) is the stack, which will grow downwards, back towards the top of the heap. Here is a graphic of virtual memory layout
To allocate memory on the heap, we simply ask the kernel to move the program break up. The space between old program break and new program break is our memory. The system call is brk. First we have to find out where it is now. brk returns the current position, so we simply have to call it. We pass it 0, which is an invalid value, so that it doesn’t change anything.
mov $12, %rax # brk syscall number
mov $0, %rdi # 0 is invalid, want to get current position
syscall
When that returns, the current position is in rax. Let’s allocate 4 bytes, by asking the kernel to move our break up by four bytes:
mov %rax, %rsi # save current break
mov %rax, %rdi # move top of heap to here ...
add $4, %rdi # .. plus 4 bytes we allocate
mov $12, %rax # brk, again
syscall
We can now store anything we want at the address pointed at by rsi, where we saved the start of our allocated space. Here is a full assembly program which puts “HI\n” into that space, and prints it out. alloc.s. Compile, link, run:
as -o alloc.o alloc.s
ld -o alloc alloc.o
./alloc
To free memory, you do the opposite, you move the break back down. That allows the kernel to re-use that space. Happy allocating!
« Previous Page — « Previous entries « Previous Page · Next Page » Next entries » — Next Page »
Feed
RSS / Atom feed