<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Foolscap Schemas</title> <link href="stylesheet-unprocessed.css" type="text/css" rel="style" /> </head> <body> <h1>Foolscap Schemas</h1> <em>NOTE! This is all preliminary and is more an exercise in semiconscious protocol design than anything else. Do not believe this document. This sentence is lying. So there.</em> <h2>Existing <code>Constraint</code> classes</h2> <table border="" width=""> <tr><td>class name</td><td>shortcut</td><td></td></tr> <tr> <td><code>Any()</code></td> <td></td> <td>accept anything</td> </tr> <tr> <td><code>StringConstraint(maxLength=1000)</code></td> <td><code>str</code></td> <td>string of up to maxLength characters (maxLength=None means unlimited), or a VOCAB sequence of any length</td> </tr> <tr> <td><code>IntegerConstraint(maxBytes=-1)</code></td> <td><code>int</code></td> <td>integer. maxBytes=-1 means s_int32_t, =N means LONGINT which can be expressed in N or fewer bytes (i.e. abs(num) < 2**(8*maxBytes)), =None means unlimited. NOTE: shortcut 'long' is like shortcut 'int' but maxBytes=1024.</td> </tr> <tr> <td><code>NumberConstraint(maxBytes=1024)</code></td> <td><code>float</code></td> <td>integer or float. Integers are limited by maxBytes as in <code>IntegerConstraint</code>, floats are fixed size.</td> </tr> <tr> <td><code>BooleanConstraint(value=None)</code></td> <td><code>bool</code></td> <td>True or False. If value=True, only accepts True. If value=False, only accepts False. NOTE: value= is a very silly parameter.</td> </tr> <tr> <td><code>InterfaceConstraint(iface)</code></td> <td>Interface</td> <td>TODO. UNSAFE. Accepts an instance which claims to implement the given Interface. The shortcut is simply any Interface subclass.</td> </tr> <tr> <td><code>ClassConstraint</code></td> <td>Class</td> <td>TODO. UNSAFE. Accepts an instance which claims to be of the given class name. The shortcut is simply any (old-style) class object.</td> </tr> <tr> <td><code>PolyConstraint(*alternatives)</code></td> <td>(alt1, alt2)</td> <td>Accepts any object which obeys at least one of the alternative constraints provided. Implements a logical OR function of the given constraints. Also known as <code>ChoiceOf</code>.</td> </tr> <tr> <td><code>TupleConstraint(*elemConstraints)</code></td> <td></td> <td>Accepts a tuple of fixed length with elements that obey the given constraints. Also known as <code>TupleOf</code>.</td> </tr> <tr> <td><code>ListConstraint(elemConstraint, maxLength=30)</code></td> <td></td> <td>Accepts a list of up to maxLength items, each of which obeys the element constraint provided. Also known as <code>ListOf</code>.</td> </tr> <tr> <td><code>DictConstraint(keyConstraint, valueConstraint, maxKeys=30)</code></td> <td></td> <td>Accepts a dictionary of up to maxKeys items. Each key must obey keyConstraint and each value must obey valueConstraint. Also known as <code>DictOf</code>.</td> </tr> <tr> <td><code>AttributeDictConstraint(*attrTuples, **kwargs)</code></td> <td></td> <td>Constrains dictionaries used to describe instance attributes, as used by RemoteCopy. Each attrTuple is a pair of (attrname, constraint), used to constraint individual named attributes. kwargs['attributes'] provides the same control. kwargs['ignoreUnknown'] is a boolean flag which indicates that unknown attributes in inbound state should simply be dropped. kwargs['acceptUnknown'] indicates that unknown attributes should be accepted into the instance state dictionary.</td> </tr> <tr> <td><code>RemoteMethodSchema(method=None, _response=None, __options=[], **kwargs)</code></td> <td></td> <td>Constrains arguments and return value of a single remotely-invokable method. If method= is provided, the <code>inspect</code> module is used to extract constraints from the method itself (positional arguments are not allowed, default values of keyword arguments provide constraints for each argument, the results of running the method provide the return value constraint). If not, most kwargs items provide constraints for method arguments, _response provides a constraint for the return value. __options and additional kwargs keys provide neato whiz-bang future expansion possibilities.</td> </tr> <tr> <td><code>Shared(constraint, refLimit=None)</code></td> <td></td> <td>TODO. Allows objects with refcounts no greater than refLimit (=None means unlimited). Wraps another constraint, which the object must obey. refLimit=1 rejects shared objects.</td> </tr> <tr> <td><code>Optional(constraint, default)</code></td> <td></td> <td>TODO. Can be used to tag Copyable attributes or (maybe) method arguments. Wraps another constraint. If an object is provided, it must obey the constraint. If not provided, the default value will be given in its place.</td> </tr> <tr> <td><code>FailureConstraint()</code></td> <td></td> <td>Constrains the contents of a CopiedFailure.</td> </tr> </table> <pre> """ RemoteReference objects should all be tagged with interfaces that they implement, which point to representations of the method schemas. When a remote method is called, Foolscap should look up the appropriate method and serialize the argument list accordingly. We plan to eliminate positional arguments, so local RemoteReferences use their schema to convert callRemote calls with positional arguments to all-keyword arguments before serialization. Conversion to the appropriate version interface should be handled at the application level. Eventually, with careful use of twisted.python.context, we might be able to provide automated tools for helping application authors automatically convert interface calls and isolate version-conversion code, but that is probably pretty hard. """ class Attributes: def __init__(self,*a,**k): pass X = Attributes( ('hello', str), ('goodbye', int), # Allow the possibility of multiple or circular references. The default # is to make multiple copies to avoid making the serializer do extra # work. ('next', Shared(Narf)), ('asdf', ListOf(Narf, maxLength=30)), ('fdsa', (Narf, String(maxLength=5), int)), ('qqqq', DictOf(str, Narf, maxKeys=30)), ('larg', AttributeDict(('A', int), ('X', Number), ('Z', float))), Optional("foo", str), Optional("bar", str, default=None), ignoreUnknown=True, ) X = Attributes( attributes={ 'hello': str, # this form doesn't allow Optional() 'goodbye': int, }, Optional("foo", str), # but both can be used at once ignoreUnknown=True) class Narf(Remoteable): # step 1 __schema__ = X # step 2 (possibly - this loses information) class schema: hello = str goodbye = int class add: x = Number y = Number __return__ = Copy(Number) class getRemoteThingy: fooID = Arg(WhateverID, default=None) barID = Arg(WhateverID, default=None) __return__ = Reference(Narf) # step 3 - this is the only example that shows argument order, which we # _do_ need in order to translate positional arguments to callRemote, so # don't take the nested-classes example too seriously. schema = """ int add (int a, int b) """ # Since the above schema could also be used for Formless, or possibly for # World (for state) we can also do: class remote_schema: """blah blah """ # You could even subclass that from the other one... class remote_schema(schema): dontUse = 'hello', 'goodbye' def remote_add(self, x, y): return x + y def rejuvinate(self, deadPlayer): return Reference(deadPlayer.bringToLife()) # "Remoteable" is a new concept - objects which may be method-published # remotely _or_ copied remotely. The schema objects support both method # / interface definitions and state definitions, so which one gets used # can be defined by the sending side as to whether it sends a # Copy(theRemoteable) or Reference(theRemoteable) # (also, with methods that are explicitly published by a schema there is # no longer technically any security need for the remote_ prefix, which, # based on past experience can be kind of annoying if you want to # provide the same methods locally and remotely) # outstanding design choice - Referenceable and Copyable are subclasses # of Remoteable, but should they restrict the possibility of sending it # the other way or def getPlayerInfo(self, playerID): return CopyOf(self.players[playerID]) def getRemoteThingy(self, fooID, barID): return ReferenceTo(self.players[selfPlayerID]) class RemoteNarf(Remoted): __schema__ = X # or, example of a difference between local and remote class schema: class getRemoteThingy: __return__ = Reference(RemoteNarf) class movementUpdate: posX = int posY = int # No return value __return__ = None # Don't wait for the answer __wait__ = False # Feel free to send this over UDP __reliable__ = False # but send in order! __ordered__ = True # use priority queue / stream 3 __priority__ = 3 # allow full serialization of failures __failure__ = FullFailure # default: trivial failures, or str or int __failure__ = ErrorMessage # These options may imply different method names - e.g. '__wait__ = # False' might imply that you can't use callRemote, you have to # call 'sendRemote' instead... __reliable__ = False might be # 'callRemoteUnreliable' (longer method name to make it less # convenient to call by accident...) ## (and yes, donovan, we know that TypedInterface exists and we are going to ## use it. we're just screwing around with other syntaxes to see what about PB ## might be different.) Common banana sequences: A reference to a remote object. (On the sending side: Referenceable or ReferenceTo(aRemoteable) On the receiving side: RemoteReference) ('remote', reference-id, interface, version, interface, version, ...) A call to a remote method: ('fastcall', request-id, reference-id, method-name, 'arg-name', arg1, 'arg-name', arg2) A call to a remote method with extra spicy metadata: ('call', request-id, reference-id, interface, version, method-name, 'arg-name', arg1, 'arg-name', arg2) Special hack: request-id of 0 means 'do not answer this call, do not acknowledge', etc. Answer to a method call: ('answer', request-id, response) ('error', request-id, response) Decrement a reference incremented by 'remote' command: ('decref', reference-id) Broker currently has 9 proto_ methods: _version(vnum): accept a version number, compare to ours, reject if different _didNotUnderstand(command): log command, maybe drop connection _message(reqID, objID, message, answerRequired, netArgs, netKw): _cachemessage (like _message but finds objID with self.cachedLocallyAs instead of self.localObjectForID, used by RemoteCacheMethod and RemoteCacheObserver) look up objID, invoke it with .remoteMessageReceived(message, args), send "answer"(reqID, results) _answer(reqID, results): look up self.waitingForAnswers[reqID] and fire callback with results _error(reqID, failure): lookup waitingForAnswers, fire errback _decref(objID): dec refcount of self.localObjects[objID]. Sent in RemoteReference.__del__ _decache(objID): dec refcount of self.remotelyCachedObjects[objID] _uncache(objID): remove obj from self.locallyCachedObjects[objID] </pre> <h2>stuff</h2> <p>A RemoteReference/RemoteCopy (called a Remote for now) has a schema attached to it. remote.callRemote(methodname, *args) does schema.getMethodSchema(methodname) to obtain a MethodConstraint that describes the individual method. This MethodConstraint (or MethodSchema) has other attributes which are used by either end: what arguments are allowed and/or expected, calling conventions (synchronous, in-order, priority, etc), and how the return value should be constrained.</p> <p>To use the Remote like a RemoteCopy ...</p> <pre> Remote: .methods .attributes .getMethodSchema(methodname) -> MethodConstraint .getAttributeSchema(attrname) -> a Constraint XPCOM idl specifies methods and attributes (readonly, readwrite). A Remote object which represented a distant XPCOM object would have a Schema that is created by parsing the IDL. Its callRemote would do the appropriate marshalling. Issue1: XPCOM lets methods have in/out/inout parameters.. these must be detected and a wrapper generated. Issue2: what about attribute set/get operations? Could add setRemote and getRemote for these. --- Some of the schema questions come down to how PBRootSlicer should deal with instances. The question is whether to treat the instance as a Referenceable (copy-by-reference: create and transmit a reference number, which will be turned into a RemoteReference on the other end), or as a Copyable (copy-by-value: collect some instance state and send it as an instance). This decision could be made by looking at what the instance inherits from: if isinstance(obj, pb.Referenceable): sendByReference(obj) elif isinstance(obj, pb.Copyable): sendByValue(obj) else: raise InsecureJellyError or by what it can be adapted to: r = IReferenceable(obj, None) if r: sendByReference(r) else: r = ICopyable(obj, None) if r: sendByValue(r) else: raise InsecureJellyError The decision could also be influenced by the sending schema currently in effect. Side A invokes a method on side B. A knows of a schema which states that the 'foo' argument of this method should be a CopyableSpam, so it requires the object be adaptable to ICopyableSpam (which is then copied by value) tries to comply when that argument is serialized. B will enforce its own schema. When B returns a result to A, the method-result schema on B's side can influence how the return value is handled. For bonus points, it may be possible to send the object as a combination of these two. That may get pretty hard to follow, though. </pre> <h2>adapters and Referenceable/Copyable</h2> <p>One possibility: rather than using a SlicerRegistry, use Adapters. The ISliceable interface has one method: getSlicer(). Slicer.py would register adapters for basic types (list, dict, etc) that would just return an appropriate ListSlicer, etc. Instances which would have been pb.Copyable subclasses in oldpb can still inherit from pb.Copyable, which now implements ISliceable and produces a Slicer (opentype='instance') that calls getStateToCopy() (although the subclass-__implements__ handling is now more important than before). pb.Referenceable implements ISlicer and produces a Slicer (opentype='reference'?) which (possibly) registers itself in the broker and then sends the reference number (along with a schema if necessary (and the other end wants them)).</p> <p>Classes are also welcome to implement ISlicer themselves and produce whatever clever (streaming?) Slicer objects they like.</p> <p>On the receiving side, we still need a registry to provide reasonable security. There are two registries. The first is the RootUnslicer.openRegistry, and maps OPEN types to Unslicer factories. It is used in doOpen().</p> <p>The second registry should map opentype=instance class names to something which can handle the instance contents. Should this be a replacement Unslicer?</p> </body> </html>