Fix logout

The logout was broken by the forwarder security hardening
Fix user api
2026-09-29 16:50:57 +00:00 · 2017-11-28 15:48:35 -05:00 · 2017-11-28 15:23:27 -05:00 · 2017-11-28 13:42:32 -05:00 · 2017-11-28 13:42:21 -05:00 · 2017-11-27 16:59:13 -05:00
116 changed files with 9727 additions and 693 deletions
@@ -1 +1,2 @@
-include confluent_env.sh
+include confluent_env.sh
+include confluent_env.csh
@@ -0,0 +1,86 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This is a utility to bring xcoll (plus enhancements) to confluent
+# the core engine is textgroup.py, this simply provides a CLI to use
+# generically
+
+import optparse
+import os
+import sys
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.textgroup as tg
+import confluent.client
+
+argparser = optparse.OptionParser(usage="Usage: <other command> | %prog [options]")
+argparser.add_option('-a', '--abbreviate', action='store_true',
+                     help='Attempt to use confluent server to shorten noderanges')
+argparser.add_option('-d', '--diff', action='store_true',
+                     help='Show what differs between most common '
+                          'output group and others')
+argparser.add_option('-w', '--watch', action='store_true',
+                     help='Show intermediate results while running')
+argparser.add_option('-s', '--skipcommon', action='store_true',
+                     help='Do not print most common result, only non modal '
+                          'groups, useful when combined with -d')
+argparser.add_option('-c', '--count', action='store_true',
+                     help='Also display count of nodes in a given group')
+argparser.add_option('-r', '--reverse', action='store_true',
+                     help='Reverse sort order to show biggest output group '
+                          'last')
+(options, args) = argparser.parse_args()
+if sys.stdin.isatty():
+    argparser.print_help()
+    sys.exit(1)
+
+grouped = tg.GroupedData()
+
+if options.abbreviate:
+    grouped = tg.GroupedData(confluent.client.Command())
+else:
+    grouped = tg.GroupedData()
+
+def print_current():
+    if options.diff:
+        grouped.print_deviants(skipmodal=options.skipcommon, count=options.count,
+                          reverse=options.reverse)
+    else:
+        grouped.print_all(skipmodal=options.skipcommon,
+                               count=options.count,
+                               reverse=options.reverse)
+    sys.stdout.flush()
+
+fullline = sys.stdin.readline()
+while fullline:
+    for line in fullline.split('\n'):
+        if not line:
+            continue
+        if ': ' not in line:
+            line = 'UNKNOWN: ' + line
+        grouped.add_line(*line.split(': ', 1))
+        if options.watch:
+            sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
+            print_current()
+    fullline = sys.stdin.readline()
+if not options.watch:
+    print_current()
+
@@ -2,7 +2,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

 # Copyright 2014 IBM Corporation
-# Copyright 2015 Lenovo
+# Copyright 2015-2016 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -47,6 +47,7 @@ import optparse
 import os
 import select
 import shlex
+import signal
 import socket
 import sys
 import time
@@ -56,7 +57,10 @@ try:
    import tty
 except ImportError:
    pass
-
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 exitcode = 0
 consoleonly = False
 consolename = ""
@@ -72,6 +76,7 @@ import confluent.tlvdata as tlvdata
 import confluent.client as client

 conserversequence = '\x05c'  # ctrl-e, c
+clearpowermessage = False

 oldtcattr = None
 fd = sys.stdin
@@ -84,7 +89,34 @@ netserver = None
 laststate = {}


+def print_help():
+    print("confetty provides a filesystem like interface to confluent.  "
+          "Navigation is done using the same commands as would be used in a "
+          "filesystem.  Tab completion is supported to aid in navigation,"
+          "as is up arrow to recall previous commands and control-r to search"
+          "previous command history, similar to using bash\n\n"
+          "The supported commands are:\n"
+          "cd [location] - Set the current command context, similar to a "
+          "working directory.\n"
+          "show [resource] - Present the information about the specified "
+          "resource, or current context if omitted.\n"
+          "create [resource] attributename=value attributename=value - Create "
+          "a new instance of a resource.\n"
+          "remove [resource] - Remove a resource from a list\n"
+          "set [resource] attributename=value attributename=value - Change "
+          "the specified attributes value for the given resource name\n"
+          "unset [resource] attributename - Clear any value for the given "
+          "attribute names on a resource.\n"
+          "start [resource] - When used on a text session resource, it "
+          "enters remote terminal mode.  In this mode, use 'ctrl-e, c, ?' for "
+          "help"
+          )
+    #TODO(jjohnson2): lookup context help for 'target' variable, perhaps
+    #common with the api document
+
+
 def updatestatus(stateinfo={}):
+    global powerstate, powertime, clearpowermessage
    status = consolename
    info = []
    for statekey in stateinfo:
@@ -99,6 +131,15 @@ def updatestatus(stateinfo={}):
        # error will be repeated if relevant
        # avoid keeping it around as stale
        del laststate['error']
+    if 'state' in stateinfo:  # currently only read power means anything
+        newpowerstate = stateinfo['state']['value']
+        if newpowerstate != powerstate and newpowerstate == 'off':
+            sys.stdout.write("\x1b[2J\x1b[;H[powered off]\r\n")
+            clearpowermessage = True
+        if newpowerstate == 'on' and clearpowermessage:
+            sys.stdout.write("\x1b[2J\x1b[;H")
+            clearpowermessage = False
+        powerstate = newpowerstate
    if 'clientcount' in laststate and laststate['clientcount'] != 1:
        info.append('clients: %d' % laststate['clientcount'])
    if 'bufferage' in stateinfo and stateinfo['bufferage'] is not None:
@@ -106,14 +147,14 @@ def updatestatus(stateinfo={}):
    if 'showtime' in laststate:
        showtime = laststate['showtime']
        age = time.time() - laststate['showtime']
-        if age > 86400: # older than one day
+        if age > 86400:  # older than one day
            # disambiguate by putting date in and time
            info.append(time.strftime('%m-%dT%H:%M', time.localtime(showtime)))
        else:
            info.append(time.strftime('%H:%M', time.localtime(showtime)))
    if info:
        status += ' [' + ','.join(info) + ']'
-    if os.environ['TERM'] not in ('linux'):
+    if os.environ.get('TERM', '') not in ('linux'):
        sys.stdout.write('\x1b]0;console: %s\x07' % status)
    sys.stdout.flush()

@@ -145,7 +186,7 @@ def recurse_format(datum, levels=0):


 def prompt():
-    if os.environ['TERM'] not in ('linux'):
+    if os.environ.get('TERM', '') not in ('linux'):
        sys.stdout.write('\x1b]0;confetty: %s\x07' % target)
    try:
        return raw_input(target + ' -> ')
@@ -169,6 +210,7 @@ valid_commands = [
    'remove',
    'rm',
    'delete',
+    'help',
 ]

 candidates = None
@@ -235,7 +277,11 @@ def rcompleter(text, state):


 def parse_command(command):
-    args = shlex.split(command, posix=True)
+    try:
+        args = shlex.split(command, posix=True)
+    except ValueError as ve:
+        print('Error: ' + str(ve))
+        return []
    return args


@@ -249,14 +295,17 @@ def print_result(res):
    if 'databynode' in res:
        print_result(res['databynode'])
        return
-    for key in res.iterkeys():
+    for key in sorted(res):
        notes = []
        if res[key] is None:
            attrstr = '%s=""' % key
        elif type(res[key]) == list:
            attrstr = '%s=%s' % (key, recurse_format(res[key]))
        elif not isinstance(res[key], dict):
-            print '{0}: {1}'.format(key, res[key])
+            try:
+                print '{0}: {1}'.format(key, res[key])
+            except UnicodeEncodeError:
+                print '{0}: {1}'.format(key, repr(res[key]))
            continue
        elif 'value' in res[key] and res[key]['value'] is not None:
            attrstr = '%s="%s"' % (key, res[key]['value'])
@@ -302,7 +351,11 @@ def do_command(command, server):
        return
    argv[0] = argv[0].lower()
    if argv[0] == 'exit':
+        if os.environ.get('TERM', '') not in ('linux'):
+            sys.stdout.write('\x1b]0;\x07')
        sys.exit(0)
+    elif argv[0] in ('help', '?'):
+        return print_help()
    elif argv[0] == 'cd':
        otarget = target
        if len(argv) > 1:
@@ -316,24 +369,49 @@ def do_command(command, server):
        if parentpath:
            childname = '{0}/'.format(parentpath[parentpath.rindex('/') + 1:])
            parentpath = parentpath[:parentpath.rindex('/') + 1]
-            foundchild = False
-            for res in session.read(parentpath, server):
-                try:
-                    if res['item']['href'] == childname:
-                        foundchild = True
-                except KeyError:
-                    pass
-                if 'errorcode' in res:
-                    exitcode = res['errorcode']
-                if 'error' in res:
-                    sys.stderr.write(target + ': ' + res['error'] + '\n')
+            if parentpath == '/noderange/':
+                for res in session.read(target, server):
+                    if 'errorcode' in res:
+                        exitcode = res['errorcode']
+                        target = otarget
+                    if 'error' in res:
+                        sys.stderr.write(target + ': ' + res['error'] + '\n')
+                        target = otarget
+            else:
+                foundchild = False
+                for res in session.read(parentpath, server):
+                    try:
+                        if res['item']['href'] == childname:
+                            foundchild = True
+                    except KeyError:
+                        pass
+                    if 'errorcode' in res:
+                        exitcode = res['errorcode']
+                        target = otarget
+                    if 'error' in res:
+                        sys.stderr.write(target + ': ' + res['error'] + '\n')
+                        target = otarget
+                if not foundchild:
+                    sys.stderr.write(target + ': Target not found - \n')
                    target = otarget
-            if not foundchild:
-                sys.stderr.write(target + ': Target not found - \n')
-                target = otarget
    elif argv[0] in ('cat', 'show', 'ls', 'dir'):
        if len(argv) > 1:
            targpath = fullpath_target(argv[1])
+            if argv[0] in ('ls', 'dir'):
+                if targpath[-1] != '/':
+                    # could still be a directory, fetch the parent..
+                    childname = targpath[targpath.rindex('/') + 1:]
+                    parentpath = targpath[:targpath.rindex('/') + 1]
+                    if parentpath != '/noderange/':
+                        # if it were /noderange/, then it's a directory
+                        # even though parent won't tell us that
+                        for res in session.read(parentpath, server):
+                            try:
+                                if res['item']['href'] == childname:
+                                    print(childname)
+                                    return
+                            except KeyError:
+                                pass
        else:
            targpath = target
        for res in session.read(targpath):
@@ -396,14 +474,21 @@ def createresource(args):
    if keydata is None:
        return
    targpath = fullpath_target(resname)
-    collection, _, resname = targpath.rpartition('/')
-    keydata['name'] = resname
+    if targpath.startswith('/noderange//'):
+        collection = targpath
+    else:
+        collection, _, resname = targpath.rpartition('/')
+        keydata['name'] = resname
    makecall(session.create, (collection, keydata))


 def makecall(callout, args):
    global exitcode
    for response in callout(*args):
+        if 'deleted' in response:
+            print("Deleted: " + response['deleted'])
+        if 'created' in response:
+            print("Created: " + response['created'])
        if 'error' in response:
            if 'errorcode' in response:
                exitcode = response['errorcode']
@@ -512,7 +597,11 @@ def quitconfetty(code=0, fullexit=False, fixterm=True):
        fcntl.fcntl(sys.stdin.fileno(), fcntl.F_SETFL, currfl ^ os.O_NONBLOCK)
        if oldtcattr is not None:
            termios.tcsetattr(sys.stdin.fileno(), termios.TCSANOW, oldtcattr)
+    # Request default color scheme, to undo potential weirdness of terminal
+    sys.stdout.write('\x1b[m')
    if fullexit:
+        if os.environ.get('TERM', '') not in ('linux'):
+            sys.stdout.write('\x1b]0;\x07')
        sys.exit(code)
    else:
        tlvdata.send(session.connection, {'operation': 'stop',
@@ -532,7 +621,7 @@ def get_session_node(shellargs):
    return None


-def conserver_command(filehandle, command):
+def conserver_command(filehandle, localcommand):
    # x - conserver has that as 'show baud', I am inclined to replace that with
    #     'request exclusive'
    # b - conserver has that as 'broadcast message', I'm tempted to use that
@@ -547,33 +636,139 @@ def conserver_command(filehandle, command):
    # d - down a console... never used this...
    # L - toggle logging
    # w - who is on console
-    while not command:
-        ready, _, _ = select.select((filehandle,), (), (), 1)
-        if ready:
-            command += filehandle.read()
-    if command[0] == '.':
+
+    cmdlen = 1
+    localcommand = get_command_bytes(filehandle, localcommand, cmdlen)
+
+    if localcommand[0] == '.':
        print("disconnect]\r")
        quitconfetty(fullexit=consoleonly)
-    elif command[0] == 'o':
+    elif localcommand[0] == 'o':
        tlvdata.send(session.connection, {'operation': 'reopen',
                                          'path': currconsole})
        print('reopen]\r')
-    elif command[0] == 'b':
+    elif localcommand[0] == 'b':
        tlvdata.send(session.connection, {'operation': 'break',
                                          'path': currconsole})
        print("break sent]\r")
-    elif command[0] == '?':
+    elif localcommand[0] == 'p':  # power
+        cmdlen += 1
+        localcommand = get_command_bytes(filehandle, localcommand, cmdlen)
+
+        if localcommand[1] == 'o': # off
+            print("powering off...")
+            session.simple_noderange_command(consolename, '/power/state', 'off')
+            print("complete]\r")
+        elif localcommand[1] == 's':  # shutdown
+            print("shutting down...")
+            session.simple_noderange_command(consolename, '/power/state', 'shutdown')
+            print("complete]\r")
+        elif localcommand[1] == 'b': # boot
+            cmdlen += 1
+            localcommand = get_command_bytes(filehandle, localcommand, cmdlen)
+
+            if localcommand[2] == 's':  # boot to setup
+                print("booting to setup...")
+
+                bootmode = 'uefi'
+                bootdev = 'setup'
+
+                rc = session.simple_noderange_command(consolename, '/boot/nextdevice', bootdev, bootmode=bootmode)
+
+                if rc:
+                    print("Error]\r")
+                else:
+                    rc = session.simple_noderange_command(consolename, '/power/state', 'boot')
+                    if rc:
+                        print("Error]\r")
+                    else:
+                        print("complete]\r")
+
+            elif localcommand[2] == 'n':  # boot to network
+                print("booting to network...")
+
+                bootmode = 'uefi'
+                bootdev = 'network'
+
+                rc = session.simple_noderange_command(consolename, '/boot/nextdevice', bootdev, bootmode=bootmode)
+
+                if rc:
+                    print("Error]\r")
+                else:
+                    rc = session.simple_noderange_command(consolename, '/power/state', 'boot')
+
+                    if rc:
+                        print("Error]\r")
+                    else:
+                        print("complete]\r")
+
+            elif localcommand[2] == '\x0d':  # boot to default
+                print("booting to default...")
+
+                bootmode = 'uefi'
+                bootdev = 'default'
+
+                rc = session.simple_noderange_command(consolename, '/boot/nextdevice', bootdev, bootmode=bootmode)
+
+                if rc:
+                    print("Error]\r")
+                else:
+                    rc = session.simple_noderange_command(consolename, '/power/state', 'boot')
+
+                    if rc:
+                        print("Error]\r")
+                    else:
+                        print("complete]\r")
+
+            else:
+                print("Unknown boot state.]\r")
+
+        else:
+            print("Unknown power state.]\r")
+
+        check_power_state()
+    elif localcommand[0] == 'r':
+        sys.stdout.write('\x1b7\x1b[999;999H\x1b[6n')
+        sys.stdout.flush()
+        reply = ''
+        while 'R' not in reply:
+            try:
+                reply += sys.stdin.read(1)
+            except IOError:
+                pass
+        reply = reply.replace('\x1b[', '')
+        reply = reply.replace('R', '')
+        height, width = reply.split(';')
+        sys.stdout.write('\x1b8')
+        sys.stdout.flush()
+        print('sending stty commands]')
+        return 'stty columns {0}\rstty rows {1}\r'.format(width, height)
+    elif localcommand[0] == '?':
        print("help]\r")
-        print(".    disconnect\r")
-        print("b    break\r")
-        print("o    reopen\r")
+        print(".       exit console\r")
+        print("b       break\r")
+        print("o       reopen\r")
+        print("po      power off\r")
+        print("ps      shutdown\r")
+        print("pbs     boot to setup\r")
+        print("pbn     boot to network\r")
+        print("pb<ent> boot to default\r")
+        print("r       send stty command to resize terminal\r")
        print("<cr> abort command\r")
-    elif command[0] == '\x0d':
+    elif localcommand[0] == '\x0d':
        print("ignored]\r")
    else:  # not a command at all..
        print("unknown -- use '?']\r")


+def get_command_bytes(filehandle, localcommand, cmdlen):
+    while len(localcommand) < cmdlen:
+        ready, _, _ = select.select((filehandle,), (), (), 1)
+        if ready:
+            localcommand += filehandle.read()
+    return localcommand
+
+
 def check_escape_seq(currinput, filehandle):
    while conserversequence.startswith(currinput):
        if currinput.startswith(conserversequence):  # We have full sequence
@@ -640,6 +835,8 @@ if sys.stdout.isatty():

    readline.parse_and_bind("tab: complete")
    readline.parse_and_bind("set bell-style none")
+    dl = readline.get_completer_delims().replace('-', '')
+    readline.set_completer_delims(dl)
    readline.set_completer(completer)

 doexit = False
@@ -655,10 +852,22 @@ elif shellargs:
    do_command(command, netserver)
    quitconfetty(fullexit=True, fixterm=False)

+powerstate = None
+powertime = None
+
+
+def check_power_state():
+    tlvdata.send(
+        session.connection,
+        {'operation': 'retrieve',
+         'path': '/nodes/' + consolename + '/power/state'})
+    return
+
+
 while inconsole or not doexit:
    if inconsole:
        rdylist, _, _ = select.select(
-            (sys.stdin, session.connection), (), (), 60)
+            (sys.stdin, session.connection), (), (), 10)
        for fh in rdylist:
            if fh == session.connection:
                # this only should get called in the
@@ -674,7 +883,15 @@ while inconsole or not doexit:
                    updatestatus(data)
                    continue
                if data is not None:
-                    sys.stdout.write(data)
+                    if clearpowermessage:
+                        sys.stdout.write("\x1b[2J\x1b[;H")
+                        clearpowermessage = False
+                    try:
+                        sys.stdout.write(data)
+                    except IOError:  # Some times circumstances are bad
+                        # resort to byte at a time...
+                        for d in data:
+                            sys.stdout.write(d)
                    now = time.time()
                    if ('showtime' not in laststate or
                            (now // 60) != laststate['showtime'] // 60):
@@ -704,10 +921,17 @@ while inconsole or not doexit:
                        sys.stdout.write("\r\n[remote disconnected]\r\n")
                    break
            else:
-                myinput = fh.read()
-                myinput = check_escape_seq(myinput, fh)
-                if myinput:
-                    tlvdata.send(session.connection, myinput)
+                try:
+                    myinput = fh.read()
+                    myinput = check_escape_seq(myinput, fh)
+                    if myinput:
+                        tlvdata.send(session.connection, myinput)
+                except IOError:
+                    pass
+        if powerstate is None or powertime < time.time() - 10:  # Check powerstate every 10 seconds
+            powertime = time.time()
+            powerstate = True
+            check_power_state()
    else:
        currcommand = prompt()
        try:
@@ -0,0 +1,112 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+__author__ = 'alin37'
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(
+    usage='''\n       %prog [-b] noderange [list of attributes]  \
+             \n       %prog -c noderange <list of attributes>  \
+             \n       %prog noderange attribute1=value1 attribute2=value,...
+             \n ''')
+argparser.add_option('-b', '--blame', action='store_true',
+                     help='Show information about how attributes inherited')
+argparser.add_option('-c', '--clear', action='store_true',
+                     help='Clear attributes')
+(options, args) = argparser.parse_args()
+
+
+#setting minimal output to only output current information
+showtype = 'current'
+requestargs=None
+try:
+    noderange = args[0]
+    nodelist = '/noderange/{0}/nodes/'.format(noderange)
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+session = client.Command()
+exitcode = 0
+
+#Sets attributes
+nodetype="noderange"
+
+if len(args) > 1:
+    if "=" in args[1] or options.clear:
+        if "=" in args[1] and options.clear:
+            print("Can not clear and set at the same time!")
+            argparser.print_help()
+            sys.exit(1)
+        exitcode=client.updateattrib(session,args,nodetype, noderange, options)
+    try:
+        # setting user output to what the user inputs
+        if args[1] == 'all':
+            showtype = 'all'
+            requestargs=args[2:]
+        elif args[1] == 'current':
+            showtype = 'current'
+            requestargs=args[2:]
+        else:
+            showtype = 'all'
+            requestargs=args[1:]
+    except:
+        pass
+
+if exitcode != 0:
+    sys.exit(exitcode)
+
+# Lists all attributes
+if len(args) > 0:
+    # setting output to all so it can search since if we do have something to search, we want to show all outputs even if it is blank.
+    if requestargs is None:
+        showtype = 'current'
+    elif requestargs == []:
+        #showtype already set
+        pass
+    else:
+        try:
+            requestargs.remove('all')
+            requestargs.remove('current')
+        except ValueError:
+            pass
+    exitcode = client.printattributes(session, requestargs, showtype,nodetype, noderange, options)
+else:
+    for res in session.read(nodelist):
+        if 'error' in res:
+            sys.stderr.write(res['error'] + '\n')
+            exitcode = 1
+        else:
+            print res['item']['href'].replace('/', '')
+
+sys.exit(exitcode)
@@ -0,0 +1,62 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2015-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(usage="Usage: %prog <noderange>")
+(options, args) = argparser.parse_args()
+try:
+    noderange = args[0]
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+session = client.Command()
+exitcode = 0
+
+errorNodes = set([])
+
+success = session.simple_noderange_command(noderange, 'configuration/management_controller/reset', 'reset', key='state', errnodes=errorNodes)   # = 0 if successful
+
+# Determine which nodes were successful and print them
+
+allNodes = set([])
+
+for node in session.read('/noderange/{0}/nodes/'.format(noderange)):
+    allNodes.add(node['item']['href'].replace("/", ""))
+
+goodNodes = allNodes - errorNodes
+
+for node in goodNodes:
+    print node + ": BMC Reset Successful"
+
+
+sys.exit(success)
@@ -0,0 +1,73 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2015 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser()
+argparser.add_option('-b', '--bios', dest='biosmode',
+                     action='store_true', default=False,
+                     help='Request BIOS style boot (rather than UEFI)')
+argparser.add_option('-p', '--persist', dest='persist', action='store_true',
+                     default=False,
+                     help='Request the boot device be persistent rather than '
+                          'one time')
+
+(options, args) = argparser.parse_args()
+
+try:
+    noderange = args[0]
+except IndexError:
+    sys.stderr.write(
+        'Usage: {0} <noderange> [default|cd|network|setup|hd]\n'.format(
+            sys.argv[0]))
+    sys.exit(1)
+client.check_globbing(noderange)
+bootdev = None
+if len(sys.argv) > 2:
+    bootdev = sys.argv[2]
+    if bootdev in ('net', 'pxe'):
+        bootdev = 'network'
+session = client.Command()
+exitcode = 0
+if options.biosmode:
+    bootmode = 'bios'
+else:
+    bootmode = 'uefi'
+
+errnodes = set([])
+rc = session.simple_noderange_command(noderange, '/boot/nextdevice', bootdev,
+                                     bootmode=bootmode,
+                                     persistent=options.persist,
+                                     errnodes=errnodes)
+if errnodes:
+    noderange = noderange + ',-(' + ','.join(errnodes) + ')'
+rc |= session.simple_noderange_command(noderange, '/power/state', 'boot')
+sys.exit(rc)
@@ -0,0 +1,147 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import os
+import signal
+import optparse
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+class NullOpt(object):
+    blame = None
+    clear = None
+
+
+def bailout(msg, code=1):
+    sys.stderr.write(msg + '\n')
+    sys.exit(code)
+
+
+argparser = optparse.OptionParser()
+(options, args) = argparser.parse_args()
+
+cfgpaths = {
+    'bmc.ipv4_address': (
+        'configuration/management_controller/net_interfaces/management',
+        'ipv4_address'),
+    'bmc.ipv4_method': (
+        'configuration/management_controller/net_interfaces/management',
+        'ipv4_configuration'),
+    'bmc.ipv4_gateway': (
+        'configuration/management_controller/net_interfaces/management',
+        'ipv4_gateway'),
+}
+
+autodeps = {
+    'bmc.ipv4_address': (('bmc.ipv4_method', 'static'),)
+}
+
+try:
+    noderange = args[0]
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+setmode = None
+assignment = {}
+queryparms = {}
+
+
+if len(args) == 1:
+    for candidate in cfgpaths:
+        path, attrib = cfgpaths[candidate]
+        path = '/noderange/{0}/{1}'.format(noderange, path)
+        if path not in queryparms:
+            queryparms[path] = {}
+        queryparms[path][attrib] = candidate
+for param in args[1:]:
+    if '=' in param:
+        if setmode is None:
+            setmode = True
+        if setmode != True:
+            bailout('Cannot do set and query in same command')
+        key, _, value = param.partition('=')
+        if key not in cfgpaths:
+            bailout('Unrecognized setting: {0}'.format(key))
+        for depkey, depval in autodeps.get(key, []):
+            assignment[depkey] = depval
+        assignment[key] = value
+    else:
+        if setmode is None:
+            setmode = False
+        if setmode != False:
+            bailout('Cannot do set and query in same command')
+        if '.' not in param:
+            matchedparms = False
+            for candidate in cfgpaths:
+                if candidate.startswith('{0}.'.format(param)):
+                    matchedparms = True
+                    path, attrib = cfgpaths[candidate]
+                    path = '/noderange/{0}/{1}'.format(noderange, path)
+                    if path not in queryparms:
+                        queryparms[path] = {}
+                    queryparms[path][attrib] = candidate
+            if not matchedparms:
+                bailout('Unrecognized settings category: {0}'.format(param))
+        elif param not in cfgpaths:
+            bailout('Unrecognized parameter: {0}'.format(param))
+        else:
+            path, attrib = cfgpaths[param]
+            path = '/noderange/{0}/{1}'.format(noderange, path)
+            if path not in queryparms:
+                queryparms[path] = {}
+            queryparms[path][attrib] = param
+session = client.Command()
+if setmode:
+    updatebypath = {}
+    attrnamebypath = {}
+    for key in assignment:
+        if key not in cfgpaths:
+            bailout('Unknown settings key: {0}'.format(key))
+        path, attrib = cfgpaths[key]
+        if path not in updatebypath:
+            updatebypath[path] = {}
+            attrnamebypath[path] = {}
+        updatebypath[path][attrib] = assignment[key]
+        attrnamebypath[path][attrib] = key
+    # well, we want to expand things..
+    # check ipv4, if requested change method to static
+    for path in updatebypath:
+        for r in session.update('/noderange/{0}/{1}'.format(noderange, path),
+                                updatebypath[path]):
+            for node in r:
+                keyval = r[node]['value']
+                key, val = keyval.split('=')
+                if key in attrnamebypath[path]:
+                    key = attrnamebypath[path][key]
+                print('{0}: {1}: {2}'.format(node, key, val))
+else:
+    for path in queryparms:
+        client.print_attrib_path(path, session, list(queryparms[path]),
+                                 NullOpt(), queryparms[path])
+
@@ -0,0 +1,58 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(
+    usage='''\n       %prog noderange attribute1=value1 attribute2=value,...
+             \n ''')
+(options, args) = argparser.parse_args()
+requestargs=None
+try:
+    noderange = args[0]
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+session = client.Command()
+exitcode = 0
+attribs = {'name': noderange}
+for arg in args[1:]:
+    key, val = arg.split('=')
+    attribs[key] = val
+for r in session.create('/noderange/', attribs):
+    if 'error' in r:
+        sys.stderr.write(r['error'] + '\n')
+        exitcode |= 1
+    if 'created' in r:
+        print('{0}: created'.format(r['created']))
+sys.exit(exitcode)
@@ -0,0 +1,270 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import csv
+import optparse
+import os
+import sys
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+tabformat = '{0:>15}|{1:>15}|{2:>15}|{3:>36}|{4:>17}|{5:>12}|{6:>48}'
+columns = ['Node', 'Model', 'Serial', 'UUID', 'Mac Address', 'Type',
+           'Current IP Addresses']
+delimit = ['-' * 15, '-' * 15, '-' * 15, '-' * 36, '-' * 17, '-' * 12,
+           '-' * 48]
+
+
+def dumpmacs(procinfo):
+    return ','.join(procinfo['macs']) # + procinfo.get('relatedmacs', []))
+
+
+def print_disco(options, session, currmac):
+    procinfo = {}
+    for tmpinfo in session.read('/discovery/by-mac/{0}'.format(currmac)):
+
+        procinfo.update(tmpinfo)
+    record = [procinfo['nodename'], procinfo['modelnumber'],
+              procinfo['serialnumber'], procinfo['uuid'], dumpmacs(procinfo),
+              ','.join(procinfo['types']),
+              ','.join(sorted(procinfo['ipaddrs']))]
+    if options.csv:
+        csv.writer(sys.stdout).writerow(record)
+    else:
+        print(tabformat.format(*record))
+
+
+def process_header(header):
+    # normalize likely header titles
+    fields = []
+    broken = False
+    for datum in header:
+        datum = datum.lower()
+        if datum.startswith('node') or datum.startswith('name'):
+            fields.append('node')
+        elif datum in ('nodegroup', 'nodegroups', 'group', 'groups'):
+            fields.append('groups')
+        elif datum.startswith('mac') or datum.startswith('ether'):
+            fields.append('mac')
+        elif datum.startswith('serial') or datum in ('sn', 's/n'):
+            fields.append('serial')
+        elif datum == 'uuid':
+            fields.append('uuid')
+        elif datum in ('bmc', 'imm', 'xcc'):
+            fields.append('hardwaremanagement.manager')
+        elif datum in ('bmc gateway', 'xcc gateway', 'imm gateway'):
+            fields.append('net.bmc.gateway')
+        elif datum in ('bmcuser', 'username', 'user'):
+            fields.append('secret.hardwaremanagementuser')
+        elif datum in ('bmcpass', 'password', 'pass'):
+            fields.append('secret.hardwaremanagementpassword')
+        else:
+            print("Unrecognized column name {0}".format(datum))
+            broken = True
+    if broken:
+        sys.exit(1)
+    return tuple(fields)
+
+
+def datum_complete(datum):
+    if 'node' not in datum or not datum['node']:
+        sys.stderr.write('Nodename is a required field')
+        return False
+    provided = set(datum)
+    required = set(['serial', 'uuid', 'mac'])
+    for field in provided & required:
+        if datum[field]:
+            break
+    else:
+        sys.stderr.write('One of the fields "Serial Number", "UUID", or '
+                   '"MAC Address" must be provided')
+        return False
+    return True
+
+
+searchkeys = set(['mac', 'serial', 'uuid'])
+
+
+def search_record(datum, options, session):
+    for searchkey in searchkeys:
+        options.__dict__[searchkey] = None
+    for searchkey in searchkeys & set(datum):
+        options.__dict__[searchkey] = datum[searchkey]
+    return list(list_matching_macs(options, session))
+
+
+def datum_to_attrib(datum):
+    for key in ('serial', 'uuid', 'mac'):
+        try:
+            del datum[key]
+        except KeyError:
+            pass
+    datum['name'] = datum['node']
+    del datum['node']
+    return datum
+
+def import_csv(options, session):
+    nodedata = []
+    with open(options.importfile, 'r') as datasrc:
+        records = csv.reader(datasrc)
+        fields = process_header(next(records))
+        for record in records:
+            currfields = list(fields)
+            nodedatum = {}
+            for datum in record:
+                nodedatum[currfields.pop(0)] = datum
+            if not datum_complete(nodedatum):
+                sys.exit(1)
+            if not search_record(nodedatum, options, session):
+                sys.stderr.write(
+                    "Could not match the following data: " +
+                    repr(nodedatum) + '\n')
+                sys.exit(1)
+            nodedata.append(nodedatum)
+    for datum in nodedata:
+        maclist = search_record(datum, options, session)
+        datum = datum_to_attrib(datum)
+        nodename = datum['name']
+        for res in session.create('/nodes/', datum):
+            if 'error' in res:
+                sys.stderr.write(res['error'] + '\n')
+                continue
+            elif 'created' in res:
+                print('Defined ' + res['created'])
+            else:
+                print(repr(res))
+        for mac in maclist:
+            for res in session.update('/discovery/by-mac/{0}'.format(mac),
+                                      {'node': nodename}):
+                if 'error' in res:
+                    sys.stderr.write(res['error'] + '\n')
+                    continue
+                elif 'assigned' in res:
+                    print('Discovered ' + res['assigned'])
+                else:
+                    print(repr(res))
+
+
+def list_discovery(options, session):
+    if options.csv:
+        csv.writer(sys.stdout).writerow(columns)
+    else:
+        print(tabformat.format(*columns))
+        print(tabformat.format(*delimit))
+    for mac in list_matching_macs(options, session):
+        print_disco(options, session, mac)
+
+
+def list_matching_macs(options, session):
+    path = '/discovery/'
+    if options.model:
+        path += 'by-model/{0}/'.format(options.model)
+    if options.serial:
+        path += 'by-serial/{0}/'.format(options.serial)
+    if options.uuid:
+        path += 'by-uuid/{0}/'.format(options.uuid)
+    if options.type:
+        path += 'by-type/{0}/'.format(options.type)
+    if options.mac:
+        path += 'by-mac/{0}'.format(options.mac)
+        result = list(session.read(path))[0]
+        if 'error' in result:
+            return []
+        return [options.mac.replace(':', '-')]
+    else:
+        path += 'by-mac/'
+        return [x['item']['href'] for x in session.read(path)]
+
+def assign_discovery(options, session):
+    abort = False
+    if options.importfile:
+        return import_csv(options, session)
+    if not (options.serial or options.uuid or options.mac):
+        sys.stderr.write(
+            "UUID (-u), serial (-s), or ether address (-e) required for "
+            "assignment\n")
+        abort = True
+    if not options.node:
+        sys.stderr.write("Node (-n) must be specified for assignment\n")
+        abort = True
+    if abort:
+        sys.exit(1)
+    matches = list_matching_macs(options, session)
+    if not matches:
+        sys.stderr.write("No matching discovery candidates found\n")
+        sys.exit(1)
+    for res in session.update('/discovery/by-mac/{0}'.format(matches[0]),
+                   {'node': options.node}):
+        if 'assigned' in res:
+            print('Assigned: {0}'.format(res['assigned']))
+        else:
+            print(repr(res))
+
+
+
+def main():
+    parser = optparse.OptionParser(
+        usage='Usage: %prog [list|assign|rescan] [options]')
+    # -a for 'address' maybe?
+    # order by
+    # show state (discovered or..
+    # nodediscover approve?
+    # flush to clear old data out?  (e.g. no good way to age pxe data)
+    # also delete discovery datum... more targeted
+    # defect: -t lenovo-imm returns all
+    parser.add_option('-m', '--model', dest='model',
+                      help='Operate with nodes matching the specified model '
+                       'number', metavar='MODEL')
+    parser.add_option('-s', '--serial', dest='serial',
+                      help='Operate against the system matching the specified '
+                           'serial number', metavar='SERIAL')
+    parser.add_option('-u', '--uuid', dest='uuid',
+                      help='Operate against the system matching the specified '
+                           'UUID', metavar='UUID')
+    parser.add_option('-n', '--node', help='Operate with the given nodename')
+    parser.add_option('-e', '--ethaddr', dest='mac',
+                      help='Operate against the system with the specified MAC '
+                           'address', metavar='MAC')
+    parser.add_option('-t', '--type', dest='type',
+                      help='Operate against the system of the specified type',
+                      metavar='TYPE')
+    parser.add_option('-c', '--csv', dest='csv',
+                      help='Use CSV formatted output', action='store_true')
+    parser.add_option('-i', '--import', dest='importfile',
+                      help='Import bulk assignment data from given CSV file',
+                      metavar='IMPORT.CSV')
+    (options, args) = parser.parse_args()
+    if len(args) == 0 or args[0] not in ('list', 'assign', 'rescan'):
+        parser.print_help()
+        sys.exit(1)
+    session = client.Command()
+    if args[0] == 'list':
+        list_discovery(options, session)
+    if args[0] == 'assign':
+        assign_discovery(options, session)
+    if args[0] == 'rescan':
+        list(session.update('/discovery/rescan', {'rescan': 'start'}))
+        print("Rescan initiated")
+
+
+if __name__ == '__main__':
+    main()
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2015-2016 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,10 +15,17 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+import codecs
 from datetime import datetime as dt
+import optparse
 import os
+import signal
 import sys

+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
@@ -26,34 +33,42 @@ if path.startswith('/opt'):

 import confluent.client as client

+sys.stdout = codecs.getwriter('utf8')(sys.stdout)

+argparser = optparse.OptionParser(
+    usage="Usage: %prog [options] noderange [clear]")
+(options, args) = argparser.parse_args()
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
 except IndexError:
-    sys.stderr.write(
-        'Usage: {0} <noderange> [clear]\n'.format(
-            sys.argv[0]))
+    argparser.print_help()
    sys.exit(1)
-
+client.check_globbing(noderange)
 deletemode = False
+if len(sys.argv) > 3:
+    argparser.print_help()
+    sys.exit(1)
 if len(sys.argv) == 3:
    if sys.argv[2] == 'clear':
        deletemode = True
+    else:
+        argparser.print_help()
+        sys.exit(1)

 session = client.Command()
 exitcode = 0

 def format_event(evt):
    retparts = []
-    if 'timestamp' in evt:
+    if 'timestamp' in evt and evt['timestamp'] is not None:
        display = dt.strptime(evt['timestamp'], '%Y-%m-%dT%H:%M:%S')
        retparts.append(display.strftime('%m/%d/%Y %H:%M:%S'))
    dscparts = []
-    if 'component_type' in evt:
+    if 'component_type' in evt and evt['component_type'] is not None:
        dscparts.append(evt['component_type'])
    if 'component' in evt and evt['component'] is not None:
        dscparts.append(evt['component'])
-    if 'event' in evt and evt['event']:
+    if 'event' in evt and evt['event'] and evt['event'] is not None:
        evttext = evt['event']
        try:
            if evttext.startswith(evt['component'] + ' - '):
@@ -83,4 +98,4 @@ for rsp in func('/noderange/{0}/events/hardware/log'.format(noderange)):
            if 'events' in thisdata:
               evtdata = thisdata['events']
               for evt in evtdata:
-                   print '{0}: {1}'.format(node, format_event(evt))
+                   print '{0}: {1}'.format(node, format_event(evt))
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2016 Lenovo
+# Copyright 2016-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,15 +15,23 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+import optparse
 import os
+import signal
 import sys
+import time
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
    sys.path.append(path)

 import confluent.client as client
-
+import confluent.screensqueeze as sq

 exitcode = 0

@@ -57,15 +65,76 @@ def printfirm(node, prefix, data):
    print('{0}: {1}: {2}'.format(node, prefix, version))


+argparser = optparse.OptionParser(
+    usage="Usage: %prog <noderange> [update [--backup <file>]")
+argparser.add_option('-b', '--backup', action='store_true',
+                     help='Target a backup bank rather than primary')
+(options, args) = argparser.parse_args()
+upfile = None
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
+    if len(args) > 1:
+        if args[1] != 'update':
+            argparser.print_help()
+            sys.exit(1)
+        upfile = args[2]
 except IndexError:
-    sys.stderr.write(
-        'Usage: {0} <noderange>\n'.format(
-            sys.argv[0]))
+    argparser.print_help()
    sys.exit(1)
-try:
-    session = client.Command()
+client.check_globbing(noderange)
+
+def get_update_progress(session, url):
+    for res in session.read(url):
+        status = res['phase']
+        percent = res['progress']
+        detail = res['detail']
+        if status == 'error':
+            text = 'error!'
+        else:
+            text = '{0}: {1:3.0f}%'.format(status, percent)
+    return text, status, detail
+
+def update_firmware(session, filename):
+    global exitcode
+    output = sq.ScreenPrinter(noderange, session)
+    nodeurls = {}
+    filename = os.path.abspath(filename)
+    resource = '/noderange/{0}/inventory/firmware/updates/active'.format(
+        noderange)
+    upargs = {'filename': filename}
+    if options.backup:
+        upargs['bank'] = 'backup'
+    noderrs = {}
+    for res in session.create(resource, upargs):
+        if 'created' not in res:
+            for nodename in res.get('databynode', ()):
+                output.set_output(nodename, 'error!')
+                noderrs[nodename] = res['databynode'][nodename].get(
+                    'error', 'Unknown Error')
+            continue
+        watchurl = res['created']
+        currnode = watchurl.split('/')[1]
+        nodeurls[currnode] = '/' + watchurl
+    while nodeurls:
+        for node in list(nodeurls):
+            progress, status, err = get_update_progress(
+                session, nodeurls[node])
+            if status == 'error':
+                exitcode = 1
+                noderrs[node] = err
+            if status in ('error', 'complete', 'pending'):
+                list(session.delete(nodeurls[node]))
+                del nodeurls[node]
+            output.set_output(node, progress)
+        time.sleep(2)
+    allerrnodes = ','.join(noderrs)
+    if noderrs:
+        sys.stderr.write(
+            'Nodes had errors updating ({0})!\n'.format(allerrnodes))
+    for node in noderrs:
+        sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
+
+def show_firmware(session):
    for res in session.read('/noderange/{0}/inventory/firmware/all/all'.format(
            noderange)):
        printerror(res)
@@ -78,6 +147,14 @@ try:
            for inv in res['databynode'][node]['firmware']:
                for prefix in inv:
                    printfirm(node, prefix, inv[prefix])
+
+
+try:
+    session = client.Command()
+    if upfile is None:
+        show_firmware(session)
+    else:
+        update_firmware(session, upfile)
 except KeyboardInterrupt:
    print('')
 sys.exit(exitcode)
@@ -0,0 +1,109 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+__author__ = 'alin37'
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(
+    usage='''\n       %prog [options]   \
+             \n       %prog [options] nodegroup [list of attributes]  \
+             \n       %prog [options] nodegroup group=value1,value2   \
+             \n       %prog [options] nodegroup group=value1,value2
+             \n ''')
+argparser.add_option('-b', '--blame', action='store_true',
+                     help='Show information about how attributes inherited')
+argparser.add_option('-c', '--clear', action='store_true',
+                     help='Clear variables')
+(options, args) = argparser.parse_args()
+
+
+#setting minimal output to only output current information
+showtype = 'current'
+requestargs=None
+nodetype="nodegroups"
+
+try:
+    nodegroups = args[0]
+    nodelist = '/{0}/{1}/'.format(nodetype,nodegroups)
+except IndexError:
+    nodelist = '/nodegroups/'
+client.check_globbing(nodegroups)
+session = client.Command()
+exitcode = 0
+
+#Sets attributes
+
+if len(args) > 1:
+    showtype = 'all'
+    if "=" in args[1] and options.clear:
+        print("Can not clear and set at the same time!")
+        argparser.print_help()
+        sys.exit(1)
+    exitcode=client.updateattrib(session,args,nodetype, nodegroups, options)
+    try:
+        # setting user output to what the user inputs
+        if args[1] == 'all':
+            showtype = 'all'
+        elif args[1] == 'current':
+            showtype = 'current'
+
+        requestargs=args[1:]
+    except Exception as e:
+        print str(e)
+
+if exitcode != 0:
+    sys.exit(exitcode)
+
+# Lists all attributes
+if len(args) > 0:
+    # setting output to all so it can search since if we do have something to search, we want to show all outputs even if it is blank.
+    if requestargs is None:
+        showtype = 'current'
+    elif requestargs == []:
+        #showtype already set
+        pass
+    else:
+        try:
+            requestargs.remove('all')
+            requestargs.remove('current')
+        except ValueError:
+            pass
+    exitcode = client.printgroupattributes(session, requestargs, showtype,nodetype, nodegroups, options)
+else:
+    for res in session.read(nodelist):
+        if 'error' in res:
+            sys.stderr.write(res['error'] + '\n')
+            exitcode = 1
+        else:
+            print res['item']['href'].replace('/', '')
+
+sys.exit(exitcode)
@@ -0,0 +1,58 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(
+    usage='''\n       %prog noderange attribute1=value1 attribute2=value,...
+             \n ''')
+(options, args) = argparser.parse_args()
+requestargs=None
+try:
+    noderange = args[0]
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+session = client.Command()
+exitcode = 0
+attribs = {'name': noderange}
+for arg in args[1:]:
+    key, val = arg.split('=')
+    attribs[key] = val
+for r in session.create('/nodegroups/', attribs):
+    if 'error' in r:
+        sys.stderr.write(r['error'] + '\n')
+        exitcode |= 1
+    if 'created' in r:
+        print('{0}: created'.format(r['created']))
+sys.exit(exitcode)
@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(
+    usage='''\n       %prog noderange
+             \n ''')
+(options, args) = argparser.parse_args()
+if len(args) != 1:
+    argparser.print_help()
+    sys.exit(1)
+noderange = args[0]
+client.check_globbing(noderange)
+session = client.Command()
+exitcode = 0
+for r in session.delete('/nodegroups/{0}'.format(noderange)):
+    if 'error' in r:
+        sys.stderr.write(r['error'] + '\n')
+        exitcode |= 1
+    if 'deleted' in r:
+        print('{0}: deleted'.format(r['deleted']))
+sys.exit(exitcode)
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,9 +16,15 @@
 # limitations under the License.

 import codecs
+import optparse
 import os
+import signal
 import sys

+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
@@ -28,11 +34,14 @@ import confluent.client as client

 sys.stdout = codecs.getwriter('utf8')(sys.stdout)

+argparser = optparse.OptionParser(usage="Usage: %prog <noderange>")
+(options, args) = argparser.parse_args()
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
 except IndexError:
-    sys.stderr.write('Usage: {0} <noderange>\n'.format(sys.argv[0]))
+    argparser.print_help()
    sys.exit(1)
+client.check_globbing(noderange)


 def main():
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,8 +15,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+import optparse
 import os
+import signal
 import sys
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass

 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
@@ -25,15 +31,20 @@ if path.startswith('/opt'):

 import confluent.client as client

+argparser = optparse.OptionParser(usage="Usage: %prog <noderange> [on|off]")
+(options, args) = argparser.parse_args()
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
 except IndexError:
-    sys.stderr.write('Usage: {0} <noderange> [on|off]\n'.format(sys.argv[0]))
+    argparser.print_help()
    sys.exit(1)
-
+client.check_globbing(noderange)
 identifystate = None
 if len(sys.argv) > 2:
    identifystate = sys.argv[2]
+else:
+    argparser.print_help()
+    sys.exit(1)
 session = client.Command()
 exitcode = 0
 sys.exit(
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2016 Lenovo
+# Copyright 2016-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,8 +15,17 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+import codecs
+import optparse
 import os
+import re
+import signal
 import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
@@ -24,6 +33,10 @@ if path.startswith('/opt'):

 import confluent.client as client

+sys.stdout = codecs.getwriter('utf8')(sys.stdout)
+
+filters = []
+

 def pretty(text):
    if text == 'pcislot':
@@ -33,14 +46,17 @@ def pretty(text):
    return text

 def print_mem_info(node, prefix, meminfo):
-    capacity = meminfo['capacity_mb'] / 1024
    memdescfmt = '{0}GB PC'
    if meminfo['memory_type'] == 'DDR3 SDRAM':
        memdescfmt += '3-{1} '
    elif meminfo['memory_type'] == 'DDR4 SDRAM':
        memdescfmt += '4-{1} '
+    elif meminfo['memory_type'] == 'Unknown':
+        print('{0}: Unrecognized Memory'.format(node))
+        return
    if meminfo['ecc']:
        memdescfmt += 'ECC '
+    capacity = meminfo['capacity_mb'] / 1024
    memdescfmt += meminfo['module_type']
    memdesc = memdescfmt.format(capacity, meminfo['speed'])
    print('{0}: {1} description: {2}'.format(node, prefix, memdesc))
@@ -69,17 +85,37 @@ def printerror(res, node=None):
            exitcode = 1


+url = '/noderange/{0}/inventory/hardware/all/all'
+
+argparser = optparse.OptionParser(
+    usage="Usage: %prog <noderange> [serial|model|uuid|mac]")
+(options, args) = argparser.parse_args()
 try:
    noderange = sys.argv[1]
 except IndexError:
-    sys.stderr.write(
-        'Usage: {0} <noderange>\n'.format(
-            sys.argv[0]))
+    argparser.print_help()
    sys.exit(1)
+client.check_globbing(noderange)
+if len(args) > 1:
+    if args[1] == 'firm':
+        os.execlp('nodefirmware', 'nodefirmware', noderange)
+    else:
+        url = '/noderange/{0}/inventory/hardware/all/system'
+        for arg in args:
+            for arg in arg.split(','):
+                if arg == 'serial':
+                    filters.append(re.compile('serial number'))
+                elif arg == 'model':
+                    filters.append(re.compile('^model'))
+                    filters.append(re.compile('product name'))
+                elif arg == 'uuid':
+                    filters.append(re.compile('uuid'))
+                elif arg == 'mac':
+                    filters.append(re.compile('mac address'))
+                    url = '/noderange/{0}/inventory/hardware/all/all'
 try:
    session = client.Command()
-    for res in session.read('/noderange/{0}/inventory/hardware/all/all'.format(
-            noderange)):
+    for res in session.read(url.format(noderange)):
        printerror(res)
        if 'databynode' not in res:
            continue
@@ -90,7 +126,8 @@ try:
            for inv in res['databynode'][node]['inventory']:
                prefix = inv['name']
                if not inv['present']:
-                    print '{0}: {1}: Not Present'.format(node, prefix)
+                    if not filters:
+                        print '{0}: {1}: Not Present'.format(node, prefix)
                    continue
                info = inv['information']
                info.pop('board_extra', None)
@@ -98,9 +135,16 @@ try:
                info.pop('chassis_extra', None)
                info.pop('product_extra', None)
                if 'memory_type' in info:
-                    print_mem_info(node, prefix, info)
+                    if not filters:
+                        print_mem_info(node, prefix, info)
                    continue
                for datum in info:
+                    if filters:
+                        for filter in filters:
+                            if filter.match(datum.lower()):
+                                break
+                        else:
+                            continue
                    if info[datum] is None:
                        continue
                    print(u'{0}: {1} {2}: {3}'.format(node, prefix,
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,12 +15,17 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-__author__ = 'jjohnson2'
+__author__ = 'jjohnson2,alin37'

 import optparse
 import os
+import signal
 import sys

+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
@@ -28,77 +33,37 @@ if path.startswith('/opt'):

 import confluent.client as client

-
-def attrrequested(attr, attrlist, seenattributes):
-    for candidate in attrlist:
-        truename = candidate
-        if candidate.startswith('hm'):
-            candidate = candidate.replace('hm', 'hardwaremanagement', 1)
-        if candidate == attr:
-            seenattributes.add(truename)
-            return True
-        elif '.' not in candidate and attr.startswith(candidate + '.'):
-            seenattributes.add(truename)
-            return True
-    return False
-argparser = optparse.OptionParser(
-    usage="Usage: %prog [options] noderange [list of attributes")
-argparser.add_option('-b', '--blame', action='store_true',
+def main():
+    argparser = optparse.OptionParser(
+    usage="Usage: %prog noderange\n"
+          "   or: %prog [options] noderange <nodeattribute>...")
+    argparser.add_option('-b', '--blame', action='store_true',
                     help='Show information about how attributes inherited')
-(options, args) = argparser.parse_args()
-try:
-    noderange = args[0]
-    nodelist = '/noderange/{0}/nodes/'.format(noderange)
-except IndexError:
-    nodelist = '/nodes/'
-session = client.Command()
-exitcode = 0
-if len(args) > 1:
-    seenattributes = set([])
-    for res in session.read('/noderange/{0}/attributes/all'.format(noderange)):
-        if 'error' in res:
-            sys.stderr.write(res['error'] + '\n')
-            exitcode = 1
-            continue
-        for node in res['databynode']:
-            for attr in res['databynode'][node]:
-                seenattributes.add(attr)
-                currattr = res['databynode'][node][attr]
-                if attrrequested(attr, args[1:], seenattributes):
-                    if 'value' in currattr:
-                        if currattr['value'] is not None:
-                           attrout = '{0}: {1}: {2}'.format(
-                                node, attr, currattr['value'])
-                        else:
-                            attrout = '{0}: {1}:'.format(node, attr)
-                    elif 'isset' in currattr:
-                        if currattr['isset']:
-                            attrout = '{0}: {1}: ********'.format(node, attr)
-                        else:
-                            attrout = '{0}: {1}:'.format(node, attr)
-                    if options.blame:
-                        blamedata = []
-                        if 'inheritedfrom' in currattr:
-                            blamedata.append('inherited from group {0}'.format(
-                                currattr['inheritedfrom']
-                            ))
-                        if 'expression' in currattr:
-                            blamedata.append(
-                                'derived from expression "{0}"'.format(
-                                    currattr['expression']))
-                        if blamedata:
-                            attrout += ' (' + ', '.join(blamedata) + ')'
-                    print attrout
-    if not exitcode:
-        for attr in args[1:]:
-            if attr not in seenattributes:
-                sys.stderr.write('Error: {0} not a valid attribute\n'.format(attr))
+    (options, args) = argparser.parse_args()
+    noderange=""
+    nodelist=""
+    try:
+        noderange = args[0]
+        nodelist = '/noderange/{0}/nodes/'.format(noderange)
+    except IndexError:
+        nodelist = '/nodes/'
+    client.check_globbing(noderange)
+    session = client.Command()
+    exitcode = 0
+    showtype='all'
+    requestargs=args[1:]
+    nodetype='noderange'
+    if len(args) > 1:
+        exitcode=client.printattributes(session,requestargs,showtype,nodetype,noderange,options)
+    else:
+        for res in session.read(nodelist):
+            if 'error' in res:
+                sys.stderr.write(res['error'] + '\n')
                exitcode = 1
-else:
-    for res in session.read(nodelist):
-        if 'error' in res:
-            sys.stderr.write(res['error'] + '\n')
-            exitcode = 1
-        else:
-            print res['item']['href'].replace('/', '')
-sys.exit(exitcode)
+            else:
+                print res['item']['href'].replace('/', '')
+
+    sys.exit(exitcode)
+
+if __name__ == '__main__':
+    main()
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,9 +15,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+import optparse
 import os
+import signal
 import sys

+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
@@ -25,15 +31,16 @@ if path.startswith('/opt'):

 import confluent.client as client

-
+argparser = optparse.OptionParser(
+    usage="Usage: %prog [options] noderange "
+          "([status|on|off|shutdown|boot|reset])")
+(options, args) = argparser.parse_args()
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
 except IndexError:
-    sys.stderr.write(
-        'Usage: {0} <noderange> ([status|on|off|shutdown|boot|reset]\n'.format(
-            sys.argv[0]))
+    argparser.print_help()
    sys.exit(1)
-
+client.check_globbing(noderange)
 setstate = None
 if len(sys.argv) > 2:
    if setstate == 'softoff':
@@ -41,7 +48,11 @@ if len(sys.argv) > 2:
    elif not sys.argv[2] in ('stat', 'state', 'status'):
        setstate = sys.argv[2]

+if setstate not in (None, 'on', 'off', 'shutdown', 'boot', 'reset'):
+    argparser.print_help()
+    sys.exit(1)
 session = client.Command()
 exitcode = 0
+session.add_precede_key('oldstate')
 sys.exit(
    session.simple_noderange_command(noderange, '/power/state', setstate))
@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(
+    usage='''\n       %prog noderange
+             \n ''')
+(options, args) = argparser.parse_args()
+if len(args) != 1:
+    argparser.print_help()
+    sys.exit(1)
+noderange = args[0]
+client.check_globbing(noderange)
+session = client.Command()
+exitcode = 0
+for r in session.delete('/noderange/{0}'.format(noderange)):
+    if 'error' in r:
+        sys.stderr.write(r['error'] + '\n')
+        exitcode |= 1
+    if 'deleted' in r:
+        print('{0}: deleted'.format(r['deleted']))
+sys.exit(exitcode)
@@ -0,0 +1,62 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2015-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(usage="Usage: %prog <noderange>")
+(options, args) = argparser.parse_args()
+try:
+    noderange = args[0]
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+session = client.Command()
+exitcode = 0
+
+errorNodes = set([])
+
+success = session.simple_noderange_command(noderange, 'power/reseat', 'reseat', key='reseat', errnodes=errorNodes)   # = 0 if successful
+
+# Determine which nodes were successful and print them
+
+allNodes = set([])
+
+for node in session.read('/noderange/{0}/nodes/'.format(noderange)):
+    allNodes.add(node['item']['href'].replace("/", ""))
+
+goodNodes = allNodes - errorNodes
+
+for node in goodNodes:
+    print node + ": Reseat successful"
+
+
+sys.exit(success)
@@ -0,0 +1,128 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2016-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from collections import deque
+import optparse
+import os
+import select
+import shlex
+import signal
+import subprocess
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.sortutil as sortutil
+
+
+def run():
+    argparser = optparse.OptionParser(
+        usage="Usage: %prog noderange commandexpression",
+        epilog="Expressions are the same as in attributes, e.g. "
+               "'ipmitool -H {hardwaremanagement.manager}' will be expanded.")
+    argparser.add_option('-c', '--count', type='int', default=168,
+                         help='Number of commands to run at a time')
+    # among other things, FD_SETSIZE limits.  Besides, spawning too many
+    # processes can be unkind for the unaware on memory pressure and such...
+    argparser.disable_interspersed_args()
+    (options, args) = argparser.parse_args()
+    if len(args) < 2:
+        argparser.print_help()
+        sys.exit(1)
+    concurrentprocs = options.count
+    client.check_globbing(args[0])
+    c = client.Command()
+    cmdstr = " ".join(args[1:])
+
+    currprocs = 0
+    all = set([])
+    pipedesc = {}
+    pendingexecs = deque()
+    exitcode = 0
+
+    for exp in c.create('/noderange/{0}/attributes/expression'.format(args[0]),
+                        {'expression': cmdstr}):
+        if 'error' in exp:
+            sys.stderr.write(exp['error'] + '\n')
+            exitcode |= exp.get('errorcode', 1)
+        ex = exp.get('databynode', ())
+        for node in ex:
+            cmd = ex[node]['value'].encode('utf-8')
+            cmdv = shlex.split(cmd)
+            if currprocs < concurrentprocs:
+                currprocs += 1
+                run_cmdv(node, cmdv, all, pipedesc)
+            else:
+                pendingexecs.append((node, cmdv))
+    if not all or exitcode:
+        sys.exit(exitcode)
+    rdy, _, _ = select.select(all, [], [], 10)
+    while all:
+        pernodeout = {}
+        for r in rdy:
+            desc = pipedesc[r]
+            node = desc['node']
+            data = True
+            while data and select.select([r], [], [], 0):
+                data = r.readline()
+                if data:
+                    if desc['type'] == 'stdout':
+                        if node not in pernodeout:
+                            pernodeout[node] = []
+                        pernodeout[node].append(data)
+                    else:
+                        sys.stderr.write('{0}: {1}'.format(node, data))
+                        sys.stderr.flush()
+                else:
+                    pop = desc['popen']
+                    ret = pop.poll()
+                    if ret is not None:
+                        exitcode = exitcode | ret
+                        all.discard(r)
+                        if desc['type'] == 'stdout' and pendingexecs:
+                            node, cmdv = pendingexecs.popleft()
+                            run_cmdv(node, cmdv, all, pipedesc)
+        for node in sortutil.natural_sort(pernodeout):
+            for line in pernodeout[node]:
+                sys.stdout.write('{0}: {1}'.format(node, line))
+        sys.stdout.flush()
+        if all:
+            rdy, _, _ = select.select(all, [], [], 10)
+    sys.exit(exitcode)
+
+
+def run_cmdv(node, cmdv, all, pipedesc):
+    nopen = subprocess.Popen(
+        cmdv, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    pipedesc[nopen.stdout] = {'node': node, 'popen': nopen,
+                              'type': 'stdout'}
+    pipedesc[nopen.stderr] = {'node': node, 'popen': nopen,
+                              'type': 'stderr'}
+    all.add(nopen.stdout)
+    all.add(nopen.stderr)
+
+
+if __name__ == '__main__':
+    run()
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,11 +16,17 @@
 # limitations under the License.

 import csv
+import datetime
 import optparse
 import os
+import signal
 import sys
 import time

+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
@@ -30,6 +36,7 @@ import confluent.client as client

 sensorcollections = {
    'all': 'sensors/hardware/all/all',
+    'energy': 'sensors/hardware/energy/all',
    'temperature': 'sensors/hardware/temperature/all',
    'temp': 'sensors/hardware/temperature/all',
    'power': 'sensors/hardware/power/all',
@@ -39,8 +46,8 @@ sensorcollections = {


 argparser = optparse.OptionParser(
-    usage="Usage: %prog [options] noderange [sensor(s)")
-argparser.add_option('-i', '--interval', type='int',
+    usage="Usage: %prog [options] noderange ([sensor(s)])")
+argparser.add_option('-i', '--interval', type='float',
                     help='Interval to do repeated samples over')
 argparser.add_option('-n', '--numreadings', type='int',
                     help='Number of readings to gather')
@@ -58,8 +65,9 @@ if options.numreadings:
        options.interval = 1
 try:
    noderange = args[0]
+    client.check_globbing(noderange)
 except IndexError:
-    argparser.print_usage()
+    argparser.print_help()
    sys.exit(1)
 sensors = []
 for sensorgroup in args[1:]:
@@ -72,7 +80,6 @@ for sensorgroup in args[1:]:
                sensors.append('sensors/hardware/all/' + sensor)
 if not sensors:
    sensors = ['sensors/hardware/all/all']
-
 session = client.Command()
 exitcode = 0
 sensorheaders = {}
@@ -119,6 +126,8 @@ def sensorpass(showout=True, appendtime=False):
                    if showout:
                        if sensedata['value'] is None:
                            showval = ''
+                        elif isinstance(sensedata['value'], float):
+                            showval = u' {0:.5f} '.format(sensedata['value'])
                        else:
                            showval = u' {0} '.format(sensedata['value'])
                        if sensedata['units'] not in (None, u''):
@@ -140,13 +149,19 @@ def sensorpass(showout=True, appendtime=False):
                                '%Y-%m-%dT%H:%M:%S')
                        print(u'{0}: {1}:{2}'.format(
                            node, sensedata['name'], showval).encode('utf-8'))
+                        sys.stdout.flush()
    return resultdata


 def format_csv(csvwriter, orderedsensors, resdata, showtime=True):
    for nodekey in resdata:
        if showtime:
-            rowdata = [time.strftime('%Y-%m-%dT%H:%M:%S'), nodekey]
+            if showtime.is_integer():
+                rowdata = [time.strftime('%Y-%m-%dT%H:%M:%S'), nodekey]
+            else:
+                rowdata = [time.strftime('%Y-%m-%dT%H:%M:%S.') +
+                           str(datetime.datetime.now().microsecond//1000),
+                           nodekey]
        else:
            rowdata = [nodekey]
        for sensorkey in orderedsensors:
@@ -197,7 +212,8 @@ def main():
            nextstart = os.times()[4] + options.interval
            resdata = sensorpass(linebyline, True)
            if options.csv:
-                format_csv(csvwriter, orderedsensors, resdata)
+                format_csv(csvwriter, orderedsensors, resdata,
+                           showtime=options.interval)
            if options.numreadings:
                options.numreadings -= 1
                if options.numreadings <= 0:
@@ -17,8 +17,13 @@

 import optparse
 import os
+import signal
 import sys

+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
 if path.startswith('/opt'):
@@ -26,7 +31,8 @@ if path.startswith('/opt'):

 import confluent.client as client

-argparser = optparse.OptionParser()
+argparser = optparse.OptionParser(
+    usage='Usage: %prog [options] noderange [default|cd|network|setup|hd]')
 argparser.add_option('-b', '--bios', dest='biosmode',
                     action='store_true', default=False,
                     help='Request BIOS style boot (rather than UEFI)')
@@ -34,15 +40,17 @@ argparser.add_option('-p', '--persist', dest='persist', action='store_true',
                     default=False,
                     help='Request the boot device be persistent rather than '
                          'one time')
+argparser.add_option('-u', '--uefi', dest='uefi', action='store_true',
+                     default=True,
+                     help='Request UEFI style boot (rather than BIOS)')

 (options, args) = argparser.parse_args()

 try:
    noderange = args[0]
+    client.check_globbing(noderange)
 except IndexError:
-    sys.stderr.write(
-        'Usage: {0} <noderange> [default|cd|network|setup|hd]\n'.format(
-            sys.argv[0]))
+    argparser.print_help()
    sys.exit(1)
 bootdev = None
 if len(sys.argv) > 2:
@@ -55,7 +63,6 @@ if options.biosmode:
    bootmode = 'bios'
 else:
    bootmode = 'uefi'
-sys.exit(
-    session.simple_noderange_command(noderange, '/boot/nextdevice', bootdev,
+sys.exit(session.simple_noderange_command(noderange, '/boot/nextdevice', bootdev,
                                     bootmode=bootmode,
                                     persistent=options.persist))
@@ -0,0 +1,129 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2016-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from collections import deque
+import optparse
+import os
+import select
+import signal
+import subprocess
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.sortutil as sortutil
+
+
+def run():
+
+    argparser = optparse.OptionParser(
+        usage="Usage: %prog noderange commandexpression",
+        epilog="Expressions are the same as in attributes, e.g. "
+               "'ipmitool -H {hardwaremanagement.manager}' will be expanded.")
+    argparser.add_option('-c', '--count', type='int', default=168,
+                         help='Number of commands to run at a time')
+    # among other things, FD_SETSIZE limits.  Besides, spawning too many
+    # processes can be unkind for the unaware on memory pressure and such...
+    argparser.disable_interspersed_args()
+    (options, args) = argparser.parse_args()
+    if len(args) < 2:
+        argparser.print_help()
+        sys.exit(1)
+    client.check_globbing(args[0])
+    concurrentprocs = options.count
+    c = client.Command()
+    cmdstr = " ".join(args[1:])
+
+    currprocs = 0
+    all = set([])
+    pipedesc = {}
+    pendingexecs = deque()
+    exitcode = 0
+
+
+    for exp in c.create('/noderange/{0}/attributes/expression'.format(args[0]),
+                        {'expression': cmdstr}):
+        if 'error' in exp:
+            sys.stderr.write(exp['error'] + '\n')
+            exitcode |= exp.get('errorcode', 1)
+        ex = exp.get('databynode', ())
+        for node in ex:
+            cmd = ex[node]['value'].encode('utf-8')
+            cmdv = ['ssh', node, cmd]
+            if currprocs < concurrentprocs:
+                currprocs += 1
+                run_cmdv(node, cmdv, all, pipedesc)
+            else:
+                pendingexecs.append((node, cmdv))
+    if not all or exitcode:
+        sys.exit(exitcode)
+    rdy, _, _ = select.select(all, [], [], 10)
+    while all:
+        pernodeout = {}
+        for r in rdy:
+            desc = pipedesc[r]
+            node = desc['node']
+            data = True
+            while data and select.select([r], [], [], 0):
+                data = r.readline()
+                if data:
+                    if desc['type'] == 'stdout':
+                        if node not in pernodeout:
+                            pernodeout[node] = []
+                        pernodeout[node].append(data)
+                    else:
+                        sys.stderr.write('{0}: {1}'.format(node, data))
+                        sys.stderr.flush()
+                else:
+                    pop = desc['popen']
+                    ret = pop.poll()
+                    if ret is not None:
+                        exitcode = exitcode | ret
+                        all.discard(r)
+                        if desc['type'] == 'stdout' and pendingexecs:
+                            node, cmdv = pendingexecs.popleft()
+                            run_cmdv(node, cmdv, all, pipedesc)
+        for node in sortutil.natural_sort(pernodeout):
+            for line in pernodeout[node]:
+                sys.stdout.write('{0}: {1}'.format(node, line))
+        sys.stdout.flush()
+        if all:
+            rdy, _, _ = select.select(all, [], [], 10)
+    sys.exit(exitcode)
+
+
+def run_cmdv(node, cmdv, all, pipedesc):
+    nopen = subprocess.Popen(
+        cmdv, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    pipedesc[nopen.stdout] = {'node': node, 'popen': nopen,
+                              'type': 'stdout'}
+    pipedesc[nopen.stderr] = {'node': node, 'popen': nopen,
+                              'type': 'stderr'}
+    all.add(nopen.stdout)
+    all.add(nopen.stderr)
+
+
+if __name__ == '__main__':
+    run()
@@ -19,6 +19,7 @@ import anydbm as dbm
 import errno
 import hashlib
 import os
+import shlex
 import socket
 import ssl
 import sys
@@ -26,6 +27,15 @@ import confluent.tlvdata as tlvdata

 SO_PASSCRED = 16

+_attraliases = {
+    'bmc': 'hardwaremanagement.manager',
+    'bmcuser': 'secret.hardwaremanagementuser',
+    'bmcpass': 'secret.hardwaremanagementpassword',
+}
+
+def cprint(txt):
+    print(txt)
+    sys.stdout.flush()

 def _parseserver(string):
    if ']:' in string:
@@ -42,9 +52,10 @@ def _parseserver(string):


 class Command(object):
-
    def __init__(self, server=None):
+        self._prevkeyname = None
        self.connection = None
+        self._currnoderange = None
        if server is None:
            if 'CONFLUENT_HOST' in os.environ:
                self.serverloc = os.environ['CONFLUENT_HOST']
@@ -74,8 +85,13 @@ class Command(object):
        if authdata['authpassed'] == 1:
            self.authenticated = True

-    def handle_results(self, ikey, rc, res):
+    def add_precede_key(self, keyname):
+        self._prevkeyname = keyname
+
+    def handle_results(self, ikey, rc, res, errnodes=None):
        if 'error' in res:
+            if errnodes is not None:
+                errnodes.add(self._currnoderange)
            sys.stderr.write('Error: {0}\n'.format(res['error']))
            if 'errorcode' in res:
                return res['errorcode']
@@ -86,6 +102,8 @@ class Command(object):
        res = res['databynode']
        for node in res:
            if 'error' in res[node]:
+                if errnodes is not None:
+                    errnodes.add(node)
                sys.stderr.write('{0}: Error: {1}\n'.format(
                    node, res[node]['error']))
                if 'errorcode' in res[node]:
@@ -93,12 +111,23 @@ class Command(object):
                else:
                    rc |= 1
            elif ikey in res[node]:
-                print('{0}: {1}'.format(node, res[node][ikey]['value']))
+                if 'value' in res[node][ikey]:
+                    val = res[node][ikey]['value']
+                elif 'isset' in res[node][ikey]:
+                    val = '********' if res[node][ikey] else ''
+                else:
+                    val = repr(res[node][ikey])
+                if self._prevkeyname and self._prevkeyname in res[node]:
+                    cprint('{0}: {2}->{1}'.format(
+                        node, val, res[node][self._prevkeyname]['value']))
+                else:
+                    cprint('{0}: {1}'.format(node, val))
        return rc

    def simple_noderange_command(self, noderange, resource, input=None,
-                                 key=None, **kwargs):
+                                 key=None, errnodes=None, **kwargs):
        try:
+            self._currnoderange = noderange
            rc = 0
            if resource[0] == '/':
                resource = resource[1:]
@@ -110,19 +139,42 @@ class Command(object):
            if input is None:
                for res in self.read('/noderange/{0}/{1}'.format(
                        noderange, resource)):
-                    rc = self.handle_results(ikey, rc, res)
+                    rc = self.handle_results(ikey, rc, res, errnodes)
            else:
                kwargs[ikey] = input
                for res in self.update('/noderange/{0}/{1}'.format(
                        noderange, resource), kwargs):
+                    rc = self.handle_results(ikey, rc, res, errnodes)
+            self._currnoderange = None
+            return rc
+        except KeyboardInterrupt:
+            cprint('')
+            return 0
+
+    def simple_nodegroups_command(self, noderange, resource, input=None, key=None, **kwargs):
+        try:
+            rc = 0
+            if resource[0] == '/':
+                resource = resource[1:]
+            # The implicit key is the resource basename
+            if key is None:
+                ikey = resource.rpartition('/')[-1]
+            else:
+                ikey = key
+            if input is None:
+                for res in self.read('/nodegroups/{0}/{1}'.format(
+                        noderange, resource)):
+                    rc = self.handle_results(ikey, rc, res)
+            else:
+                kwargs[ikey] = input
+                for res in self.update('/nodegroups/{0}/{1}'.format(
+                        noderange, resource), kwargs):
                    rc = self.handle_results(ikey, rc, res)
            return rc
        except KeyboardInterrupt:
-            print('')
+            cprint('')
            return 0

-
-
    def read(self, path, parameters=None):
        if not self.authenticated:
            raise Exception('Unauthenticated')
@@ -192,7 +244,7 @@ class Command(object):
        if knownhosts:
            certdata = self.connection.getpeercert(binary_form=True)
            fingerprint = 'sha512$' + hashlib.sha512(certdata).hexdigest()
-            hostid = '@'.join((port,server))
+            hostid = '@'.join((port, server))
            khf = dbm.open(os.path.join(clientcfgdir, "knownhosts"), 'c', 384)
            if hostid in khf:
                if fingerprint == khf[hostid]:
@@ -202,11 +254,10 @@ class Command(object):
                        "MISMATCHED CERTIFICATE DATA, ACCEPT NEW? (y/n):")
                    if replace not in ('y', 'Y'):
                        raise Exception("BAD CERTIFICATE")
-            print 'Adding new key for %s:%s' % (server, port)
+            cprint('Adding new key for %s:%s' % (server, port))
            khf[hostid] = fingerprint


-
 def send_request(operation, path, server, parameters=None):
    """This function iterates over all the responses
    received from the server.
@@ -223,8 +274,219 @@ def send_request(operation, path, server, parameters=None):
    tlvdata.send(server, payload)
    result = tlvdata.recv(server)
    while '_requestdone' not in result:
-        yield result
+        try:
+            yield result
+        except GeneratorExit:
+            while '_requestdone' not in result:
+                result = tlvdata.recv(server)
+            raise
        result = tlvdata.recv(server)


+def attrrequested(attr, attrlist, seenattributes):
+    for candidate in attrlist:
+        truename = candidate
+        if candidate.startswith('hm'):
+            candidate = candidate.replace('hm', 'hardwaremanagement', 1)
+        if candidate in _attraliases:
+            candidate = _attraliases[candidate]
+        if candidate == attr:
+            seenattributes.add(truename)
+            return True
+        elif attr.startswith(candidate + '.'):
+            seenattributes.add(truename)
+            return True
+    return False

+
+def printattributes(session, requestargs, showtype, nodetype, noderange, options):
+    path = '/{0}/{1}/attributes/{2}'.format(nodetype, noderange, showtype)
+    return print_attrib_path(path, session, requestargs, options)
+
+
+def print_attrib_path(path, session, requestargs, options, rename=None):
+    exitcode = 0
+    seenattributes = set([])
+    for res in session.read(path):
+        if 'error' in res:
+            sys.stderr.write(res['error'] + '\n')
+            exitcode = 1
+            continue
+        for node in res['databynode']:
+            for attr in res['databynode'][node]:
+                seenattributes.add(attr)
+                if rename and attr in rename:
+                    printattr = rename[attr]
+                else:
+                    printattr = attr
+                currattr = res['databynode'][node][attr]
+                if (requestargs is None or requestargs == [] or attrrequested(
+                        attr, requestargs, seenattributes)):
+                    if 'value' in currattr:
+                        if currattr['value'] is not None:
+                            attrout = '{0}: {1}: {2}'.format(
+                                node, printattr, currattr['value'])
+                        else:
+                            attrout = '{0}: {1}:'.format(node, printattr)
+                    elif 'isset' in currattr:
+                        if currattr['isset']:
+                            attrout = '{0}: {1}: ********'.format(node,
+                                                                  printattr)
+                        else:
+                            attrout = '{0}: {1}:'.format(node, printattr)
+                    elif 'broken' in currattr:
+                        attrout = '{0}: {1}: *ERROR* BROKEN EXPRESSION: ' \
+                                  '{2}'.format(node, printattr,
+                                               currattr['broken'])
+                    elif isinstance(currattr, list) or isinstance(currattr, tuple):
+                        attrout = '{0}: {1}: {2}'.format(node, attr, ','.join(map(str, currattr)))
+                    elif isinstance(currattr, dict):
+                        dictout = []
+                        for k, v in currattr.items:
+                            dictout.append("{0}={1}".format(k, v))
+                        attrout = '{0}: {1}: {2}'.format(node, printattr, ','.join(map(str, dictout)))
+                    else:
+                        cprint("CODE ERROR" + repr(attr))
+
+                    if options.blame or 'broken' in currattr:
+                        blamedata = []
+                        if 'inheritedfrom' in currattr:
+                            blamedata.append('inherited from group {0}'.format(
+                                currattr['inheritedfrom']
+                            ))
+                        if 'expression' in currattr:
+                            blamedata.append(
+                                'derived from expression "{0}"'.format(
+                                    currattr['expression']))
+                        if blamedata:
+                            attrout += ' (' + ', '.join(blamedata) + ')'
+                    cprint(attrout)
+    if not exitcode:
+        if requestargs:
+            for attr in requestargs:
+                if attr not in seenattributes:
+                    sys.stderr.write('Error: {0} not a valid attribute\n'.format(attr))
+                    exitcode = 1
+    return exitcode
+
+
+def printgroupattributes(session, requestargs, showtype, nodetype, noderange, options):
+    exitcode = 0
+    seenattributes = set([])
+    for res in session.read('/{0}/{1}/attributes/{2}'.format(nodetype, noderange, showtype)):
+        if 'error' in res:
+            sys.stderr.write(res['error'] + '\n')
+            exitcode = 1
+            continue
+        for attr in res:
+            seenattributes.add(attr)
+            currattr = res[attr]
+            if (requestargs is None or requestargs == [] or attrrequested(attr, requestargs, seenattributes)):
+                if 'value' in currattr:
+                    if currattr['value'] is not None:
+                        attrout = '{0}: {1}: {2}'.format(
+                            noderange, attr, currattr['value'])
+                    else:
+                        attrout = '{0}: {1}:'.format(noderange, attr)
+                elif 'isset' in currattr:
+                    if currattr['isset']:
+                        attrout = '{0}: {1}: ********'.format(noderange, attr)
+                    else:
+                        attrout = '{0}: {1}:'.format(noderange, attr)
+                elif 'broken' in currattr:
+                    attrout = '{0}: {1}: *ERROR* BROKEN EXPRESSION: ' \
+                              '{2}'.format(noderange, attr,
+                                           currattr['broken'])
+                elif 'expression' in currattr:
+                    attrout = '{0}: {1}:  (will derive from expression {2})'.format(noderange, attr, currattr['expression'])
+                elif isinstance(currattr, list) or isinstance(currattr, tuple):
+                    attrout = '{0}: {1}: {2}'.format(noderange, attr, ','.join(map(str, currattr)))
+                elif isinstance(currattr, dict):
+                    dictout = []
+                    for k, v in currattr.items:
+                        dictout.append("{0}={1}".format(k, v))
+                    attrout = '{0}: {1}: {2}'.format(noderange, attr, ','.join(map(str, dictout)))
+                else:
+                    cprint("CODE ERROR" + repr(attr))
+                cprint(attrout)
+    if not exitcode:
+        if requestargs:
+            for attr in requestargs:
+                if attr not in seenattributes:
+                    sys.stderr.write('Error: {0} not a valid attribute\n'.format(attr))
+                    exitcode = 1
+    return exitcode
+
+def updateattrib(session, updateargs, nodetype, noderange, options):
+    # update attribute
+    exitcode = 0
+    if options.clear:
+        targpath = '/{0}/{1}/attributes/all'.format(nodetype, noderange)
+        keydata = {}
+        for attrib in updateargs[1:]:
+            keydata[attrib] = None
+        for res in session.update(targpath, keydata):
+            if 'error' in res:
+                if 'errorcode' in res:
+                    exitcode = res['errorcode']
+                sys.stderr.write('Error: ' + res['error'] + '\n')
+        sys.exit(exitcode)
+    else:
+        if "=" in updateargs[1]:
+            try:
+                if len(updateargs[1:]) > 1:
+                    for val in updateargs[1:]:
+                        val = val.split('=')
+                        if (nodetype == "nodegroups"):
+                            exitcode =  session.simple_nodegroups_command(noderange, 'attributes/all',
+                                                                         val[1],val[0])
+                        else:
+                            exitcode = session.simple_noderange_command(noderange, 'attributes/all',
+                                                                        val[1], val[0])
+                else:
+                    val = updateargs[1].split('=')
+                    if nodetype == "nodegroups" :
+                        exitcode = session.simple_nodegroups_command(noderange, 'attributes/all',
+                                                                     val[1], val[0])
+                    else:
+                        exitcode = session.simple_noderange_command(noderange, 'attributes/all',
+                                                                    val[1], val[0])
+            except:
+                sys.stderr.write('Error: {0} not a valid expression\n'.format(str(updateargs[1:])))
+                exitcode = 1
+            sys.exit(exitcode)
+    return exitcode
+
+
+# So we try to prevent bad things from happening when globbing
+# We tried to head this off at the shell, but the various solutions would end
+# up breaking the shell in various ways (breaking pipe capability if using
+# DEBUG, breaking globbing if in pipe, etc)
+# Then we tried to parse the original commandline instead, however shlex isn't
+# going to parse full bourne language (e.g. knowing that '|' and '>' and
+# a world of other things would not be in our command line
+# so finally, just make sure the noderange appears verbatim in the command line
+# if we glob to something, then bash will change noderange and this should
+# detect it and save the user from tragedy
+def check_globbing(noderange):
+    if not os.path.exists(noderange):
+        return True
+    rawargs = os.environ.get('CURRENT_CMDLINE', None)
+    if rawargs:
+        rawargs = shlex.split(rawargs)
+        for arg in rawargs:
+            if arg.startswith('$'):
+                arg = arg[1:]
+                if arg.endswith(';'):
+                    arg = arg[:-1]
+                arg = os.environ.get(arg, '$' + arg)
+            if arg.startswith(noderange):
+                break
+        else:
+            sys.stderr.write(
+                'Shell glob conflict detected, specified target "{0}" '
+                'not in command line, but is a file.  You can use "set -f" in '
+                'bash or change directories such that there is no filename '
+                'that would conflict.'
+                '\n'.format(noderange))
+            sys.exit(1)
@@ -0,0 +1,85 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import fcntl
+import sys
+import struct
+import termios
+
+def get_screenwidth():
+    return struct.unpack('hh', fcntl.ioctl(sys.stdout, termios.TIOCGWINSZ,
+                                           b'....'))[1]
+class ScreenPrinter(object):
+
+    def __init__(self, noderange, client, textlen=4):
+        self.squeeze = sys.stdout.isatty()
+        self.textlen = textlen
+        self.noderange = noderange
+        self.client = client
+        self.nodeoutput = {}
+        self.nodelist = []
+        maxlen = 0
+        for ans in self.client.read('/noderange/{0}/nodes/'.format(noderange)):
+            if 'error' in ans:
+                sys.stderr.write(ans['error'])
+                continue
+            nodename = ans['item']['href'][:-1]
+            if len(nodename) > maxlen:
+                maxlen = len(nodename)
+            self.nodelist.append(nodename)
+            self.nodeoutput[nodename] = ''
+        self.nodenamelen = maxlen
+        self.textlen = textlen
+        self.fieldwidth = maxlen + textlen + 1  # 1 for column
+
+    def set_output(self, node, text):
+        self.nodeoutput[node] = text
+        if len(text) >= self.textlen:
+            self.textlen = len(text) + 1
+            self.fieldwidth = self.textlen + self.nodenamelen + 1
+        self.drawscreen()
+
+    def drawscreen(self):
+        if self.squeeze:
+            currwidth = get_screenwidth()
+            numfields = currwidth // self.fieldwidth
+            fieldformat = '{{0:>{0}}}:{{1:{1}}}'.format(self.nodenamelen,
+                                                        self.textlen)
+            sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
+        else:
+            numfields = 1
+            fieldformat = '{0}: {1}'
+        currfields = 0
+        for node in self.nodelist:
+            if currfields >= numfields:
+                sys.stdout.write('\n')
+                currfields = 1
+            else:
+                currfields += 1
+            sys.stdout.write(fieldformat.format(node, self.nodeoutput[node]))
+        sys.stdout.write('\n')
+        sys.stdout.flush()
+
+
+
+
+
+if __name__ == '__main__':
+    import confluent.client as client
+    c = client.Command()
+    p = ScreenPrinter('n1-n13', c)
+    p.set_output('n3', 'Upload: 67%')
+
+
+
@@ -0,0 +1,43 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2014 IBM Corporation
+# Copyright 2015-2016 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import re
+
+numregex = re.compile('([0-9]+)')
+
+
+def naturalize_string(key):
+    """Analyzes string in a human way to enable natural sort
+
+    :param key: The node name to analyze
+    :returns: A structure that can be consumed by 'sorted'
+    """
+    return [int(text) if text.isdigit() else text.lower()
+            for text in re.split(numregex, key)]
+
+
+def natural_sort(iterable):
+    """Return a sort using natural sort if possible
+
+    :param iterable:
+    :return:
+    """
+    try:
+        return sorted(iterable, key=naturalize_string)
+    except TypeError:
+        # The natural sort attempt failed, fallback to ascii sort
+        return sorted(iterable)
@@ -0,0 +1,217 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import difflib
+import re
+import sys
+
+try:
+    range = xrange
+except NameError:
+    pass
+
+
+
+numregex = re.compile('([0-9]+)')
+def humanify_nodename(nodename):
+    """Analyzes nodename in a human way to enable natural sort
+
+    :param nodename: The node name to analyze
+    :returns: A structure that can be consumed by 'sorted'
+    """
+    return [int(text) if text.isdigit() else text.lower()
+            for text in re.split(numregex, nodename)]
+
+
+def _colorize_line(orig, mask):
+    highlighted = False
+    newline = orig[0]
+    for i in range(1, len(orig)):
+        if i > len(mask) - 1:
+            if highlighted:
+                newline += '\x1b[0m'
+            newline += orig[i:]
+            break
+        if highlighted and mask[i] == ' ':
+            highlighted = False
+            newline += '\x1b[0m'
+        elif not highlighted and mask[i] != ' ':
+            highlighted = True
+            newline += '\x1b[31m'
+        newline += orig[i]
+    newline += '\x1b[0m'
+    return newline
+
+
+def near_diff(idx, diffdata):
+    maxidx = idx + 3
+    if maxidx > len(diffdata) -1:
+        maxidx = len(diffdata) - 1
+    idx = idx - 3
+    if idx < 0:
+        idx = 0
+    while idx <= maxidx:
+        if len(diffdata[idx]) > 0 and diffdata[idx][0] in ('+', '-'):
+            return True
+        idx += 1
+    return False
+
+
+def colordiff(first, second):
+    diffdata = list(difflib.ndiff(first, second))
+    quiet = True
+    for i in range(len(diffdata)):
+        if i < len(diffdata) - 1 and diffdata[i + 1].startswith('?'):
+            if quiet:
+                quiet = False
+                yield '@@'
+            yield _colorize_line(diffdata[i], diffdata[i + 1])
+        elif not diffdata[i].startswith('?') and near_diff(i, diffdata):
+            if quiet:
+                quiet = False
+                yield '@@'
+            yield diffdata[i]
+        elif not diffdata[i].startswith('?'):
+            quiet = True
+
+
+
+class GroupedData(object):
+    '''A post processor to sort and compare per-node data
+
+    :param confluentconnection: If given, will attempt to use the connection to abbreviate noderanges
+    '''
+
+    def __init__(self, confluentconnection=None):
+        self.bynode = {}
+        self.byoutput = {}
+        self.header = {}
+        self.client = confluentconnection
+
+    def generate_byoutput(self):
+        self.byoutput = {}
+        for n in self.bynode:
+            output = '\n'.join(self.bynode[n])
+            if output not in self.byoutput:
+                self.byoutput[output] = set([n])
+            else:
+                self.byoutput[output].add(n)
+
+    def add_line(self, node, line):
+        if node not in self.bynode:
+            self.bynode[node] = [line]
+        else:
+            self.bynode[node].append(line)
+
+    def get_group_text(self, nodes):
+        if self.client:
+            headerkey = ','.join(sorted(nodes))
+            if headerkey in self.header:
+                return self.header[headerkey]
+            noderange = ''
+            for reply in self.client.create('/noderange//abbreviate',
+                                            {'nodes': sorted(nodes)}):
+                noderange = reply['noderange']
+            self.header[headerkey] = noderange
+            return noderange
+        else:
+            return ','.join(sorted(nodes, key=humanify_nodename))
+
+    def print_all(self, output=sys.stdout, skipmodal=False, reverse=False,
+                  count=False):
+        self.generate_byoutput()
+        modaloutput = None
+        ismodal = True
+
+        if reverse:
+            outdatalist = sorted(
+                self.byoutput, key=lambda x: [len(self.byoutput[x]),
+                                              humanify_nodename(
+                                                  self.get_group_text(
+                                                      self.byoutput[x]
+                                                  ))])
+        else:
+            outdatalist = sorted(
+                self.byoutput, key=lambda x: [0 - len(self.byoutput[x]),
+                                              humanify_nodename(
+                                                  self.get_group_text(
+                                                      self.byoutput[x]
+                                                  ))])
+        if reverse and skipmodal:
+            # if reversed, the last is biggest and should be skipped if modal
+            outdatalist = outdatalist[:-1]
+        for outdata in outdatalist:
+            if not reverse and skipmodal:
+                # If big first, this makes skipmodal skip first
+                skipmodal = False
+                continue
+            currout = '====================================\n'
+            currout += self.get_group_text(self.byoutput[outdata])
+            currout += '\n====================================\n'
+            if count:
+                currout += 'Count: {0}'.format(len(list(
+                    self.byoutput[outdata])))
+                currout += '\n====================================\n'
+            currout += outdata
+            currout += '\n\n'
+            output.write(currout)
+        output.flush()
+
+    def print_deviants(self, output=sys.stdout, skipmodal=False, reverse=False,
+                       count=False):
+        self.generate_byoutput()
+        modaloutput = None
+        ismodal = True
+        revoutput = []
+        for outdata in sorted(
+                self.byoutput, key=lambda x: [0 - len(self.byoutput[x]),
+                                              humanify_nodename(
+                                                  self.get_group_text(
+                                                      self.byoutput[x]
+                                                  ))]):
+            if modaloutput is None:
+                modaloutput = outdata
+            if skipmodal:
+                skipmodal = False
+                ismodal = False
+                continue
+            currout = '====================================\n'
+            currout += self.get_group_text(self.byoutput[outdata])
+            currout += '\n====================================\n'
+            if count:
+                currout += 'Count: {0}'.format(len(list(
+                    self.byoutput[outdata])))
+                currout += '\n====================================\n'
+            if ismodal:
+                ismodal = False
+                currout += outdata
+            else:
+                currout += '\n'.join(colordiff(modaloutput.split('\n'),
+                                                 outdata.split('\n')))
+            currout += '\n\n'
+            if reverse:
+                revoutput.append(currout)
+            else:
+                output.write(currout)
+        for currout in reversed(revoutput):
+            output.write(currout)
+        output.flush()
+
+if __name__ == '__main__':
+    groupoutput = GroupedData()
+    for line in sys.stdin.read().split('\n'):
+        if not line:
+            continue
+        groupoutput.add_line(*line.split(': ', 1))
+    groupoutput.print_deviants()
@@ -0,0 +1 @@
+setenv PATH /opt/confluent/bin:$PATH
@@ -1,2 +1,38 @@
 PATH=/opt/confluent/bin:$PATH
 export PATH
+MANPATH=/opt/confluent/share/man:$MANPATH
+export MANPATH
+# The aliases below are to signify that file globbing is unwelcome at the shell
+# this avoids a problem if a user does a noderange like 'n[21-33] and there is a file
+# in the directory like 'n3' that causes the parameter to change and target a totally
+# different node
+# Unfortunately in bourne shell, we cannot reliably ensure a prepended set-f
+# and an appended set +f are both run.  alias seems to be the only mechanism
+# that can intervene before glob expansion, but it lacks power.
+# putting it into a function to append is all well and good, *except*  that
+# if doing something like 'nodepower compute|grep' causes set -f to execute
+# in current shell, and the function to be in a subshell and leaves globbing
+# disabled in the parent shell.  Instead, store the current command in a
+# variable and use that to check for misglobbed noderanges, which was the goal
+alias nodeattrib='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeattrib'
+alias nodebmcreset='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodebmcreset'
+alias nodeboot='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeboot'
+alias nodeconfig='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeconfig'
+alias nodeconsole='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeconsole'
+alias nodedefine='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodedefine'
+alias nodeeventlog='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeeventlog'
+alias nodefirmware='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodefirmware'
+alias nodegroupattrib='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodegroupattrib'
+alias nodegroupdefine='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodegroupdefine'
+alias nodegroupremove='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodegroupremove'
+alias nodehealth='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodehealth'
+alias nodeidentify='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeidentify'
+alias nodeinventory='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeinventory'
+alias nodelist='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodelist'
+alias nodepower='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodepower'
+alias noderemove='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; noderemove'
+alias nodereseat='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodereseat'
+alias noderun='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; noderun'
+alias nodesensors='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodesensors'
+alias nodesetboot='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodesetboot'
+alias nodeshell='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeshell'
@@ -0,0 +1 @@
+for i in *.ronn; do echo -n `head -n 1  $i|awk '{print $1}'`; echo " $i"; done > index.txt
@@ -0,0 +1,85 @@
+collate(1) -- Organize text input by node
+==============================
+
+## SYNOPSIS
+
+`<other command> | collate [-a] [-d] [-w] [-s] [-c] [-r]`
+
+## DESCRIPTION
+
+**collate** takes input in the form of <nodename>: <data> and groups
+the output for each <nodename> together, and checks for identical data to further group nodes together.  It also will sort the output groups so that
+the most frequently seen output is printed first, and then other groups in descending order of frequency.
+
+## OPTIONS
+
+* `-a`, `--abbreviate`:
+   Use confluent to attempt to shorten the noderange.  This can help identify
+   when output differs along a telling group boundary.  For example, if
+   output suggests a large number of nodes are unreachable, abbreviate
+   showing 'rack1' as being unreachable may make more obvious a possible cause.
+
+* `-d`, `--diff`:
+   Express all but the most common result group in terms of diff from
+   the most common result group
+
+* `-w`, `--watch`:
+   Update results dynamically as data becomes available, rather than
+   waiting    for the command to fully complete.
+
+* `-s`, `--skipcommon`:
+   Suppress printing of the most common result text group.  This is used to
+   focus on stray output against a well known and expected result.
+   
+* `-c`, `--count`:
+   Print a count of the number of nodes in an output group under the 
+  noderange.
+  
+ * `-r`, `--reverse`:
+    Rather than starting with most common to least common, start with
+    the least common and print the most common last.
+   
+## EXAMPLES
+ * Organizing power state of multiple nodes:  
+  `# nodepower n1-n12 | collate`  
+  `====================================`  
+  `n1,n2,n3,n4,n7,n8,n9,n10,n11,n12`  
+  `====================================`  
+  `on`  
+  ` `  
+  `====================================`  
+  `n5,n6`  
+  `====================================`  
+  `off`  
+
+* Using diff to detect distinct UEFI configuration
+
+  `# pasu n1-n4 show Processors|collate -d -s`  
+  `====================================`  
+  `n3`  
+  `====================================`  
+  `@@`  
+  `  Processors.ProcessorPerformanceStates=Enable`  
+  `  Processors.C-States=Enable`  
+  `  Processors.PackageACPIC-StateLimit=ACPI C3`  
+  `- Processors.C1EnhancedMode=Enable`  
+  `+ Processors.C1EnhancedMode=Disable`  
+  `- Processors.Hyper-Threading=Enable`  
+  `+ Processors.Hyper-Threading=Disable`  
+  `  Processors.ExecuteDisableBit=Enable`  
+  `  Processors.IntelVirtualizationTechnology=Enable`  
+  ` `  
+  `====================================`  
+  `n1`  
+  `====================================`  
+  `@@`  
+  `  Processors.ProcessorPerformanceStates=Enable`  
+  `  Processors.C-States=Enable`  
+  `  Processors.PackageACPIC-StateLimit=ACPI C3`  
+  `- Processors.C1EnhancedMode=Enable`  
+  `+ Processors.C1EnhancedMode=Disable`  
+  `  Processors.Hyper-Threading=Enable`  
+  `  Processors.ExecuteDisableBit=Enable`  
+
+   
+   
@@ -0,0 +1,36 @@
+confetty(8) --- Interactive confluent client
+=================================================
+
+## SYNOPSIS
+
+`confetty`  
+`confetty <confetty command line>`
+
+## DESCRIPTION
+
+**confetty** launches an interactive CLI session to the
+confluent service.  It provides a filesystem-like
+view of the confluent interface.  It is intended to
+be mostly an aid for developing client software, with
+day to day administration generally being easier with
+the various function specific commands.
+
+## COMMANDS
+
+The CLI may be navigated by shell commands and some other
+commands.
+
+* `cd`:
+  Change the location within the tree
+* `ls`:
+  List the elements within the current directory/tree
+* `show` **ELEMENT**, `cat` **ELEMENT**:
+  Display the result of reading a specific element (by full or relative path)
+* `unset` **ELEMENT** **ATTRIBUTE**
+  For an element with attributes, request to clear the value of the attribue
+* `set` **ELEMENT** **ATTRIBUTE**=**VALUE**
+  Set the specified attribute to the given value
+* `start` **ELEMENT**
+  Start a console session indicated by **ELEMENT** (e.g. /nodes/n1/console/session)
+* `rm` **ELEMENT**
+  Request removal of an element.  (e.g. rm events/hardware/log clears log from a node)
@@ -0,0 +1,14 @@
+confluent(8) -- Start the confluent server
+=========================================================
+
+## SYNOPSIS
+
+`confluent`
+
+## DESCRIPTION
+
+**confluent** is the name of the server daemon.  It is normally run
+through the init subsystem rather than executed directly.  All confluent
+commands connect to confluent daemon.  It provides the web interface, debug,
+and unix socket connectivity.
+
@@ -0,0 +1,26 @@
+confluentdbutil(8) -- Backup or restore confluent database
+=========================================================
+
+## SYNOPSIS
+
+
+`confluentdbutil [options] <dump|restore> <path>`
+
+## DESCRIPTION
+
+**confluentdbutil** is a utility to export/import the confluent attributes
+to/from json files.  The path is a directory that holds the json version.
+In order to perform restore, the confluent service must not be running.  It
+is required to indicate how to treat the usernames/passwords are treated in
+the json files (password protected, removed from the files, or unprotected).
+
+## OPTIONS
+
+* `-p`, `--password`:
+  If specified, information such as usernames and passwords will be encrypted
+  using the given password.
+* `-r`, `--redact`:
+  Indicates to replace usernames and passwords with a dummy string rather
+  than included.
+* `-u`, `--unprotected`:
+  The keys.json file will include the encryption keys without any protection.
@@ -0,0 +1,80 @@
+nodeattrib(8) -- List or change confluent nodes attributes
+=========================================================
+
+## SYNOPSIS
+
+`nodeattrib [-b] <noderange> [<nodeattribute>...]`  
+`nodeattrib <noderange> [<nodeattribute1=value1> <nodeattribute2=value2> ...]`  
+`nodeattrib -c <noderange> <nodeattribute1> <nodeattribute2> ...`  
+
+## DESCRIPTION
+
+**nodeattrib** manages the attributes of confluent nodes.  In
+the simplest form, it simply takes the given noderange(5) and lists the
+matching nodes, one line at a time.
+
+If a list of node attribute names are given, the value of those are also
+displayed.  If `-b` is specified, it will also display information on
+how inherited and expression based attributes are defined.  Attributes can be
+straightforward values, or an expression as documented in nodeattribexpressions(5).
+For a full list of attributes, run `nodeattrib <node> all` against a node.
+If `-c` is specified, this will set the nodeattribute to a null valid.
+This is different from setting the value to an empty string.
+
+Note that `nodeattrib <group>` will likely not provide the expected behavior.
+See nodegroupattrib(8) command on how to manage attributes on a group level.
+
+## OPTIONS
+
+* `-b`, `--blame`:
+  Annotate inherited and expression based attributes to show their base value.
+* `-c`, `--clear`:
+  Clear specified nodeattributes
+
+## EXAMPLES
+* Listing matching nodes of a simple noderange:
+    `# nodeattrib n1-n2`  
+    `n1: console.method: ipmi`  
+    `n1: hardwaremanagement.manager: 172.30.3.1`  
+    `n2: console.method: ipmi`  
+    `n2: hardwaremanagement.manager: 172.30.3.2`  
+
+* Getting an attribute of nodes matching a noderange:
+    `# nodeattrib n1,n2 hardwaremanagement.manager`  
+    `n1: hardwaremanagement.manager: 172.30.3.1`  
+    `n2: hardwaremanagement.manager: 172.30.3.2`  
+
+* Getting a group of attributes while determining what group defines them:
+    `# nodeattrib n1,n2 hardwaremanagement --blame`  
+    `n1: hardwaremanagement.manager: 172.30.3.1`  
+    `n1: hardwaremanagement.method: ipmi (inherited from group everything)`  
+    `n1: hardwaremanagement.switch: r8e1`  
+    `n1: hardwaremanagement.switchport: 14`  
+    `n2: hardwaremanagement.manager: 172.30.3.2`  
+    `n2: hardwaremanagement.method: ipmi (inherited from group everything)`  
+    `n2: hardwaremanagement.switch: r8e1`  
+    `n2: hardwaremanagement.switchport: 2`  
+
+* Listing matching nodes of a simple noderange that are set:
+    `# nodeattrib n1-n2 current`  
+    `n1: console.method: ipmi`  
+    `n1: hardwaremanagement.manager: 172.30.3.1`  
+    `n2: console.method: ipmi`  
+    `n2: hardwaremanagement.manager: 172.30.3.2`  
+
+* Change attribute on nodes of a simple noderange:
+    `# nodeattrib n1-n2 console.method=serial`  
+    `n1: console.method: serial`  
+    `n1: hardwaremanagement.manager: 172.30.3.1`  
+    `n2: console.method: serial`  
+    `n2: hardwaremanagement.manager: 172.30.3.2`  
+
+* Clear attribute on nodes of a simple noderange, if you want to retain the variable set the attribute to "":
+    `# nodeattrib n1-n2 -c console.method`  
+    `# nodeattrib n1-n2 console.method`  
+    `n1: console.method: `  
+    `n2: console.method: `  
+
+## SEE ALSO
+
+nodegroupattrib(8), nodeattribexpressions(5)
@@ -0,0 +1,64 @@
+nodeattribexpressions(5) -- Confluent attribute expression syntax
+=================================================================
+
+## DESCRIPTION
+
+In confluent, any attribute may either be a straightforward value, or an
+expression to generate the value.
+
+An expression will contain some directives wrapped in `{}` characters. Within
+`{}` are a number of potential substitute values and operations.
+
+The most common operation is to extract a number from the nodename. These 
+values are available as n1, n2, etc. So for example attributes for a node named 
+b1o2r3u4 would have {n1} as 1, {n2} as 2, {n3} as 3, and {n4} as 4. 
+Additionally, {n0} is special as representing the last number in a name, so in
+the b1o2r3u4 example, {n0} would be 4.
+
+Frequently a value derives from a number in the node name, but must undergo a
+transform to be useful. As an example, if we have a scheme where nodes are
+numbered n1-n512, and they are arranged 1-42 in rack1, 43-84 in rack2, and so
+forth, it is convenient to perform arithmetic on the extracted number. Here is
+an example of codifying the above scheme, and setting the u to the remainder:
+
+`location.rack=rack{(n1-1)/42+1}`  
+`location.u={(n1-1)%42+1}`  
+
+Note how text may be mixed into expressions, only data within {} will receive
+special treatment. Here we also had to adjust by subtracting 1 and adding it
+back to make the math work as expected.
+
+It is sometimes the case that the number must be formatted a different way,
+either specifying 0 padding or converting to hexadecimal. This can be done by a
+number of operators at the end to indicate formatting changes.
+
+`{n1:02x} - Zero pad to two decimal places, and convert to hexadecimal, as mightbe used for generating MAC addresses`  
+`{n1:x} - Hexadecimal without padding, as may be used in a generated IPv6 address`  
+`{n1:X} - Uppercase hexadecimal`  
+`{n1:02d} - Zero pad a normal numeric representation of the number.`  
+
+Another common element to pull into an expression is the node name in whole:
+
+`hardwaremanagement.manager={nodename}-imm`  
+
+Additionally other attributes may be pulled in:
+
+`hardwaremanagement.switchport={location.u}`  
+
+Multiple expressions are permissible within a single attribute:
+
+`hardwaremanagement.manager={nodename}-{hardwaremanagement.method}`  
+
+A note to developers: in general the API layer will automatically recognize a
+generic set attribute to string with expression syntax and import it as an
+expression. For example, submitting the following JSON:
+
+`{ 'location.rack': '{n1}' }`
+
+Will auto-detect {n1} as an expression and assign it normally. If wanting to
+set that value verbatim, it can either be escaped by doubling the {} or by
+explicitly declaring it as a value:
+
+`{ 'location.rack': '{{n1}}' }`  
+
+`{ 'location.rack': { 'value': '{n1}' } }`
@@ -0,0 +1,19 @@
+nodebmcreset(8) -- Reset management controller
+=========================================================
+
+## SYNOPSIS
+
+`nodebmcreset <noderange>`  
+
+## DESCRIPTION
+
+`nodebmcreset` allows you to reset the management controller of the specified noderange
+
+## EXAMPLES:
+
+* Reset the management controller for nodes n1 through n4:
+  `# nodebmcreset n1-n4`  
+  `n1: BMC Reset Successful`  
+  `n2: BMC Reset Successful`  
+  `n3: BMC Reset Successful`  
+  `n4: BMC Reset Successful`  
@@ -0,0 +1,34 @@
+nodeboot(8) -- Reboot a confluent node to a specific device
+=========================================================
+
+## SYNOPSIS
+
+`nodeboot <noderange>`  
+`nodeboot <noderange>` [net|setup]  
+
+## DESCRIPTION
+
+**nodeboot** reboots nodes in a noderange.  If an additional argument is given,
+it sets the node to specifically boot to that as the next boot.
+
+## EXAMPLES
+* Booting n3 and n4 to the default boot behavior:
+  `# nodeboot n3-n4`  
+  `n3: default`  
+  `n4: default`  
+  `n3: on->reset`  
+  `n4: on->reset`  
+
+* Booting n1 and n2 to setup menu:
+  `# nodeboot n1-n2 setup`
+  `n2: setup`  
+  `n1: setup`  
+  `n2: on->reset`  
+  `n1: on->reset`  
+
+* Booting n3 and n4 to network:
+  `# nodeboot n3-n4 net`  
+  `n3: network`  
+  `n4: network`  
+  `n4: on->reset`  
+  `n3: off->on`  
@@ -0,0 +1,33 @@
+nodeconfig(8) -- Show or change node configuration
+==================================================
+
+## SYNOPSIS
+
+`nodecanfig <noderange> [<configuration>..]`
+`nodecanfig <noderange> [<configuration=value>..]`
+
+## DESCRIPTION
+
+**nodeconfig** manages the configuration of nodes managed by confluent.
+Rather than manipulating the confluent database, this actually modifies the
+running configuration on the node firmware.  Calling without '=' will show the
+current value, and '=' will change the value.  Network information can be
+given as a node expression, as documented in the man page for nodeattribexpressions(5).
+
+## EXAMPLES
+* Showing the current IP configuration of noderange BMC/IMM/XCC:
+    `# nodeconfig s3,s4 bmc`  
+    `s3: bmc.ipv4_address: 172.30.254.193/16`  
+    `s3: bmc.ipv4_method: DHCP`  
+    `s3: bmc.ipv4_gateway: 172.30.0.6`  
+    `s4: bmc.ipv4_address: 172.30.254.192/16`  
+    `s4: bmc.ipv4_method: DHCP`  
+    `s4: bmc.ipv4_gateway: 172.30.0.6`  
+
+* Changing nodes `s3` and `s4` to have the ip addressess 10.1.2.3 and 10.1.2.4 with a 16 bit subnet mask:
+    `# nodeconfig s3,s4 bmc.ipv4_address=10.1.2.{n1}/16`  
+
+## SEE ALSO
+
+nodeattribexpressions(5)
+
@@ -0,0 +1,57 @@
+nodeconsole(8) -- Open a console to a confluent node
+=====================================================
+
+## SYNOPSIS
+`nodeconsole <node>`
+
+## DESCRIPTION
+
+**nodeconsole** opens an interactive console session to a given node.  This is the
+text or serial console of a system.  Exiting is done by hitting `Ctrl-e`, then `c`,
+ then `.`.  Note that console output by default is additionally logged to
+`/var/log/confluent/consoles/`**NODENAME**.
+
+When the console connection to the target is broken, then confluent on backend
+will initiate an automatic retry interval that is randomized between 2 and 4 minutes.
+The reopen escape sequence below requests an immediate retry, as does connecting
+a new session.
+
+## ESCAPE SEQUENCE COMMANDS
+
+While connected to a console, a number of commands may be performed through escape
+sequences.  To begin an command escape sequence, hit `Ctrl-e`, then `c`.  The next
+keystroke will be interpreted as a command.  The following commands are available.
+
+* `.`:
+  Exit the session and return to the command prompt
+* `b`:
+  [send Break]
+  Send a break to the remote console when possible (some console plugins may not support this)
+* `o`:
+  [reOpen]
+  Request confluent to disconnect and reconnect to console.  For example if there is suspicion
+  that the console has gone inoperable, but would work if reconnected.
+* `po`:
+  [Power Off]
+  Power off server immediately, without waiting for OS to shutdown
+* `ps`:
+  [Power Shutdown]
+  Request OS shut down gracefully, and then power off
+* `pb<ent>`:
+  [Power Boot]
+  Cause system to immediately boot, resetting or turning on as appropriate.
+  Hitting enter is required to execute the reboot rather than another pb sequence
+* `pbs`:
+  [Power Boot Setup]
+  Request immediate boot ultimately landing in interactive firmware setup
+* `pbn`:
+  [Power Boot Network]
+  Request immediate boot to network
+* `r`:
+  [send Resize]
+  This queries the current terminal and sends stty commands to advertise the user termineal
+  size to the remote console
+* `?`:
+  Get a list of supported commands
+* `<ent>`:
+  Hit enter to skip entering a command at the escape prompt.
@@ -0,0 +1,28 @@
+nodedefine(8) -- Define new confluent nodes
+
+## SYNOPSIS
+
+`nodedefine <noderange> [nodeattribute1=value1> <nodeattribute2=value2> ...]`  
+
+## DESCRIPTION
+
+`nodedefine` allows the definition of new nodes for the confluent management
+system.  It has the same syntax as `nodeattrib(8)`, and the commands differ in
+that `nodeattrib(8)` will error if a node does not exist.
+
+## EXAMPLES
+
+* Define two racks of nodes, named r{rack}u{u}:
+    `# nodedefine r1u1-r2u4`  
+    `r1u4: created`  
+    `r1u1: created`  
+    `r1u2: created`  
+    `r1u3: created`  
+    `r2u4: created`  
+    `r2u3: created`  
+    `r2u2: created`  
+    `r2u1: created`  
+
+## SEE ALSO
+
+noderange(5), nodeattribexpressions(8)
@@ -0,0 +1,106 @@
+nodediscover(8)  -- List or manage confluent node discovery
+=========================================================
+
+## SYNOPSIS
+
+`nodediscover rescan`  
+`nodediscover [options] list`  
+`nodeattrib [options] assign`  
+
+## DESCRIPTION
+
+**nodediscover** provides streamlined access to the confluent discovery data
+and assignment.  Nodes are detected through either an active scan (as occurs
+at service startup and on request by nodediscover rescan) or through passive
+detection (as a target comes online, it may attempt to register with the
+network).
+
+**nodediscover list** provides the currently known data in tabular format.  The
+data may be filtered by various parameters, as denoted in the options below.
+
+**nodediscover assign** performs manual discovery, assigning an entry to a node
+identity or, using `-i`, using a csv file to assign nodes all at once.  For
+example, a spreadsheet of serial numbers to desired node names could be used.
+
+## CSV FORMAT
+
+The CSV format used by nodediscover consists of one header describing the
+columns followed by the data.  The available columns are:
+
+* node: The name desired for the node in confluent
+* groups: A comma delimited list of groups to put the node into (using normal CSV escape rules for the commas)
+* mac: The mac address of the node
+* serial: The serial number of the node
+* uuid: The uuid of the node
+* bmc: The name or ip address that should be assigned to the BMC, regardless of current address
+* bmc_gateway: IP address of gateway, if desired
+* bmcuser: The desired username for the BMC to have as administrator
+* bmcpass: The desired password for the BMC to require
+
+Note that node is the only mandatory field.  To identify the systems, one of
+mac, serial, or uuid should be specified, it is pointless to provide more than
+one of these columns.  Other attributes if not provided may be defined through
+nodeattrib or group inherited.  It is possible to define nodes without ever
+providing a BMC ip, in which case IPv6 will be used automatically if possible.
+
+One example of a valid CSV file would be:
+node,serial,bmc,bmcuser,bmcpass
+n1,06DPMDF,172.30.204.1,admin,Passw0rd12
+n2,J30002HG,172.30.204.2,admin,Passw0rd12
+
+Which would use the serial number to assign the name and other three values to
+the nodes.
+
+## OPTIONS
+
+* `-m MODEL`, `--model=MODEL`:
+  Operate with nodes matching the specified model number
+* `-s SERIAL`, `--serial=SERIAL`:
+  Operate against the system matching the specified
+  serial number
+* `-u UUID`, `--uuid=UUID`:
+  Operate against the system matching the specified UUID
+* `-n NODE`, `--node=NODE`:
+  Operate with the given nodename
+* `-e MAC`, `--ethaddr=MAC`:
+  Operate against the system with the specified MAC
+  address
+* `-t TYPE, --type=TYPE`:
+  Operate against the system of the specified type
+* `-c, --csv`:
+  Use CSV formatted output
+* `-i IMPORT.CSV`, `--import=IMPORT.CSV`:
+  Import bulk assignment data from given CSV file
+
+## EXAMPLES
+
+* Listing all detected Lenovo IMMv2 systems on a local network:
+  `# nodediscover list -t lenovo-imm2`  
+  `           Node|          Model|         Serial|                                UUID|      Mac Address|        Type|                            Current IP Addresses`  
+  `---------------|---------------|---------------|------------------------------------|-----------------|------------|------------------------------------------------`  
+  `             r2|        5463AC1|        06DPMDF|5f7133b8-c8cb-11e4-99a9-40f2e9b91018|40:f2:e9:b9:10:1d| lenovo-imm2|     172.30.204.1,fe80::42f2:e9ff:feb9:101d%eth1`  
+  `               |        7906AC1|        06PBX15|e98d483d-2759-11e1-8ffd-5cf3fc11249c|5c:f3:fc:11:24:9f| lenovo-imm2|      172.30.3.12,fe80::5ef3:fcff:fe11:249f%eth1`  
+  `             n1|        8737AC1|        23XXH41|14dd3ba6-5c38-11e1-931a-5cf3fc6e4680|5c:f3:fc:6e:13:e1| lenovo-imm2|       172.30.3.1,fe80::5ef3:fcff:fe6e:13e1%eth1`  
+  `             n7|        8737AC1|        23XXH32|79d2ce28-5cd5-11e1-8c86-5cf3fc6e46b0|5c:f3:fc:6e:13:f9| lenovo-imm2|       172.30.3.7,fe80::5ef3:fcff:fe6e:13f9%eth1`  
+  `             n8|        8737AC1|        23XXH49|551a8438-5cd5-11e1-8d6c-5cf3fc6e4708|5c:f3:fc:6e:14:25| lenovo-imm2|       172.30.3.8,fe80::5ef3:fcff:fe6e:1425%eth1`  
+  `             n3|        8737AC1|        23XXH30|1dd7f7b3-5da5-11e1-baf0-5cf3fc6e4738|5c:f3:fc:6e:14:3d| lenovo-imm2|       172.30.3.3,fe80::5ef3:fcff:fe6e:143d%eth1`  
+  `             n4|        8737AC1|        23XXH35|45b81dae-5d9b-11e1-8337-5cf3fc6e4858|5c:f3:fc:6e:14:cd| lenovo-imm2|       172.30.3.4,fe80::5ef3:fcff:fe6e:14cd%eth1`  
+  `            n11|        8737AC1|        23XXH12|31d90128-5c37-11e1-bdb7-5cf3fc6e4920|5c:f3:fc:6e:15:31| lenovo-imm2|      172.30.3.11,fe80::5ef3:fcff:fe6e:1531%eth1`  
+  `            n13|        8737AC1|        23XXH44|e23a138a-5cd3-11e1-8f3d-5cf3fc6e4950|5c:f3:fc:6e:15:49| lenovo-imm2|      172.30.3.13,fe80::5ef3:fcff:fe6e:1549%eth1`  
+  `               |        8737AC1|        23XXH29|5cd1216b-5c37-11e1-ba0c-5cf3fc6e49c8|5c:f3:fc:6e:15:85| lenovo-imm2|       172.30.3.9,fe80::5ef3:fcff:fe6e:1585%eth1`  
+  `               |        8737AC1|        23ZYT44|f4bf48ca-71f0-11e1-b274-5cf3fc6e4f10|5c:f3:fc:6e:18:29| lenovo-imm2|      172.30.3.10,fe80::5ef3:fcff:fe6e:1829%eth1`  
+  `         hpcedr|        7915AC1|        06DRHL5|a64e3014-d7e3-11e1-8d21-6cae8b1dff32|6c:ae:8b:1d:ff:36| lenovo-imm2|   172.30.254.250,fe80::6eae:8bff:fe1d:ff36%eth1`  
+  `               |        8737AC1|        06YRWC3|3af85a51-7efd-11e3-8599-000af7482e00|6c:ae:8b:32:cb:c5| lenovo-imm2|       172.30.3.6,fe80::6eae:8bff:fe32:cbc5%eth1`  
+  `               |        8737AC1|        06YRWB7|b230f62e-7efd-11e3-9773-000af7482980|6c:ae:8b:32:cd:01| lenovo-imm2|       172.30.3.5,fe80::6eae:8bff:fe32:cd01%eth1`  
+  `               |        8737AC1|        06YRWC7|09586005-7efe-11e3-9f03-000af7482df0|6c:ae:8b:32:cd:a5| lenovo-imm2|       172.30.3.2,fe80::6eae:8bff:fe32:cda5%eth1`  
+
+* Manually assign a single node according to serial number:
+  `[root@odin ~]# nodediscover assign -s 06PBX15 -n n12`  
+  `Assigned: n12`  
+
+* Bulk execute discovery based on spreadsheet:
+  `[root@odin ~]# nodediscover assign -i import.csv`  
+  `Defined r2`  
+  `Discovered r2`  
+  `Defined c1`  
+  `Discovered c1`  
@@ -0,0 +1,33 @@
+nodeeventlog(8) -- Pull eventlog from confluent nodes
+============================================================
+
+## SYNOPSIS
+
+`nodeeventlog <noderange>`  
+`nodeeventlog <noderange> [clear]`
+
+## DESCRIPTION
+
+`nodeeventlog` pulls and optionally clears the event log from the requested
+noderange.
+
+## EXAMPLES
+* Pull the event log from n2 and n3:
+  `# nodeeventlog n2,n3`  
+  `n2: 05/03/2017 11:44:25 Event Log Disabled - SEL Fullness - Log clear`  
+  `n2: 05/03/2017 11:44:56 System Firmware - Progress - Unspecified`  
+  `n3: 05/03/2017 11:44:39 Event Log Disabled - SEL Fullness - Log clear`  
+  `n3: 05/03/2017 11:45:00 System Firmware - Progress - Unspecified`  
+  `n3: 05/03/2017 11:47:22 System Firmware - Progress - Starting OS boot`  
+
+* Pull and clear the event log from n2 and n3:
+`# nodeeventlog n2,n3 clear`  
+`n2: 05/03/2017 11:44:25 Event Log Disabled - SEL Fullness - Log clear`  
+`n2: 05/03/2017 11:44:56 System Firmware - Progress - Unspecified`  
+`n2: 05/03/2017 11:48:29 System Firmware - Progress - Starting OS boot`  
+`n3: 05/03/2017 11:44:39 Event Log Disabled - SEL Fullness - Log clear`  
+`n3: 05/03/2017 11:45:00 System Firmware - Progress - Unspecified`  
+`n3: 05/03/2017 11:47:22 System Firmware - Progress - Starting OS boot`  
+`# nodeeventlog n2,n3`  
+`n2: 05/03/2017 11:48:48 Event Log Disabled - SEL Fullness - Log clear`  
+`n3: 05/03/2017 11:48:52 Event Log Disabled - SEL Fullness - Log clear`  
@@ -0,0 +1,36 @@
+nodefirmware(8) -- Report firmware information on confluent nodes
+=================================================================
+
+## SYNOPSIS
+
+`nodefirmware <noderange>`  
+`nodefirmware <noderange> update [--backup] <filename>`
+
+## DESCRIPTION
+
+`nodefirmware` reports and updates various firmware on nodes.  In the update form, it accepts a single
+file and attempts to update it using the out of band facilities.  Firmware updates can end in one of three states:
+
+* `error`: The attempted update encountered an error that prevented successful install.  Nodes experiencing this state will be reported at the end and more detail on the error will be given
+* `pending`:  The firmware update process has completed, but the firmware will not be active until the relevant component next resets.  Generally speaking, for UEFI update the system will need a reboot, and for BMC updates, the `nodebmcreset` command will begin the process to activate the firmware.
+* `complete`:  The firmware update process has completed and activation has proceeded.  Note that while the activation process has commenced, the component may still be in the process of rebooting when nodefirmware exits.
+
+## EXAMPLES
+
+* Pull firmware from a node:
+`# nodefirmware r1`  
+`r1: IMM: 3.70 (TCOO26H 2016-11-29T05:09:51)`  
+`r1: IMM Backup: 1.71 (TCOO10D 2015-04-17T00:00:00)`  
+`r1: IMM Trusted Image: TCOO26H`  
+`r1: UEFI: 2.31 (TCE128I 2016-12-13T00:00:00)`  
+`r1: UEFI Backup: 2.20 (TCE126O)`  
+`r1: FPGA: 3.2.0`  
+`r1: Broadcom NetXtreme Gigabit Ethernet Controller Bootcode: 1.38`  
+`r1: Broadcom NetXtreme Gigabit Ethernet Controller MBA: 16.8.0`  
+`r1: Broadcom NetXtreme Gigabit Ethernet Controller Firmware Package: 0.0.0a`  
+`r1: ServeRAID M1215 MegaRAID Controller Firmware: 24.12.0-0038 (2016-10-20T00:00:00)`  
+`r1: ServeRAID M1215 Disk 28 MBF2600RC: SB2C`  
+`r1: ServeRAID M1215 Disk 29 MBF2600RC: SB2C`  
+`r1: ServeRAID M5210 Disk 0 MBF2600RC: SB2C`  
+`r1: ServeRAID M5210 Disk 1 MBF2600RC: SB2C`  
+`r1: ServeRAID M5210 Disk 2 MBF2600RC: SB2C`  
@@ -0,0 +1,42 @@
+nodegroupattrib(8) -- List or change confluent nodegroup attributes
+===================================================================
+
+## SYNOPSIS
+
+`nodegroupattrib <group> [ current | all ]`  
+`nodegroupattrib <group> [<nodeattribute>...]`  
+`nodegroupattrib <group> [<nodeattribute1=value1> <nodeattribute2=value2> ...]`  
+`nodegroupattrib <group> [-c] [<nodeattribute1> <nodeattribute2=value2> ...]`  
+
+## DESCRIPTION
+
+`nodegroupattrip` queries the confluent server to get information about nodes.
+In the simplest form, it simply takes the given group and lists the attributes of that group.
+
+Contrasted with nodeattrib(8), settings managed by nodegroupattrib will be added
+and removed from a node as it is added or removed from a group.  If an attribute
+is set using nodeattrib(8) against a noderange(5) that happens to be a group name,
+nodeattrib(8) individually sets attributes directly on each individual node that is
+currently a member of that group.  Removing group membership or adding a new
+node after using the nodeattrib(8) command will not have attributes change automatically.
+It's easiest to see by using the `nodeattrib <noderange> -b` to understand how
+the attributes are set on the node versus a group to which a node belongs.
+
+## OPTIONS
+
+* `-c`, `--clear`:
+  Clear specified nodeattributes.
+
+## EXAMPLES
+
+* Show attributes of a group called `demogrp`:
+  `# nodegroupattrib demogrp`  
+  `demogrp: hardwaremanagement.manager:  (will derive from expression 10.30.{n0/255}.{n0%255})`  
+  `demogrp: nodes: n12,n13,n10,n11,n9,n1,n2,n3,n4`  
+
+* Set location.u to be the remainder of first number in node name when divided by 42:  
+  `# nodegroupattrib demogrp location.u={n1%42}`  
+
+## SEE ALSO
+
+nodeattrib(8), nodeattribexpressions(5)
@@ -0,0 +1,23 @@
+nodegroupdefine(8) -- Define new confluent node group
+
+## SYNOPSIS
+
+`nodegroupdefine <groupname> [nodeattribute1=value1> <nodeattribute2=value2> ...]`  
+
+## DESCRIPTION
+
+`nodegroupdefine` allows the definition of a new node for the confluent management
+service.  It may only define a single group name at a time.
+It has the same syntax as `nodegroupattrib(8)`, and the commands differ in
+that `nodegroupattrib(8)` will error if a node group does not exist.
+
+## EXAMPLES
+
+* Create a group called `compute`:
+    `# nodegroupdefine compute`  
+    `compute: created`  
+
+
+## SEE ALSO
+
+nodeattribexpressions(8), nodegroupattrib(8), nodegroupremove(8)
@@ -0,0 +1,18 @@
+nodegroupremove(8) -- Remove a nodegroup from the confluent database
+====================================================================
+
+## SYNOPSIS
+
+`nodegroupremove <noderange>`  
+
+## DESCRIPTION
+
+`nodegroupremove` simply removes the given single nodegroup from the confluent database.
+
+
+## EXAMPLES
+
+* Remove group called testgroup
+    `# nodegroupremove testgroup`  
+    `testgroup: deleted`  
+
@@ -0,0 +1,22 @@
+nodehealth(8) -- Show health summary of confluent nodes
+========================================================
+
+## SYNOPSIS
+
+`nodehealth <noderange>`  
+
+## DESCRIPTION
+
+`nodehealth` reports the current health assessment of a confluent node.  It
+will report either `ok`, `warning`, `critical`, or `failed`, along with
+a string explaining the reason for any result other than `ok`.
+
+## EXAMPLES
+
+* Pull health summary of 5 nodes:
+  `# nodehealth n1-n4,r1`  
+  `n1: critical (Mezz Exp 2 Fault:Critical)`  
+  `n3: ok`  
+  `n2: ok`  
+  `r1: ok`  
+  `n4: ok`
@@ -0,0 +1,31 @@
+nodeidentify(8) -- Control the identify LED of confluent nodes
+=========================================================
+
+## SYNOPSIS
+
+`nodidentify <noderange> [on|off]`  
+
+## DESCRIPTION
+
+`nodeidentify` allows you to turn on or off the location LED of conflueunt nodes,
+making it easier to determine the physical location of the nodes.  The following
+options are supported:
+
+* `on`: Turn on the identify LED
+* `off`: Turn off the identify LED
+
+## EXAMPLES:
+
+* Turn on the identify LED on nodes n1 through n4:
+  `# nodeidentify n1-n4 on`  
+  `n1: on`  
+  `n2: on`  
+  `n3: on`  
+  `n4: on`  
+
+* Turn off the identify LED on nodes n1 thorugh n4:
+  `# nodeidentify n1-n4 off`  
+  `n1: off`  
+  `n2: off`  
+  `n4: off`  
+  `n3: off`  
@@ -0,0 +1,121 @@
+nodeinventory(8) -- Get hardware inventory of confluent node
+===============================================================
+
+## SYNOPSIS
+
+`nodeinventory <noderange> [serial|model|uuid|mac]`
+
+## DESCRIPTION
+
+`nodeinventory` pulls information about hardware of a node.  This includes 
+information such as adapters, serial numbers, processors, and memory modules,
+as supported by the platforms hardware management implementation.  It accepts
+arguments such as serial or model or others as listed above to filter
+output to specific data.
+
+## EXAMPLES
+
+* Pulling inventory of a node named r1:
+  `# nodeinventory r1`   
+  `r1: System MAC Address 1: 40:f2:e9:af:45:a0`   
+  `r1: System MAC Address 2: 40:f2:e9:af:45:a1`   
+  `r1: System MAC Address 3: 40:f2:e9:af:45:a2`   
+  `r1: System MAC Address 4: 40:f2:e9:af:45:a3`   
+  `r1: System Board manufacturer: IBM`   
+  `r1: System Product name: System x3650 M5`   
+  `r1: System Device ID: 32`   
+  `r1: System Revision: 9`   
+  `r1: System Product ID: 323`   
+  `r1: System Board model: 00KG915`   
+  `r1: System Device Revision: 0`   
+  `r1: System Serial Number: E2K4831`   
+  `r1: System Board manufacture date: 2014-10-20T12:00`   
+  `r1: System Board serial number: Y010UF4AL0B5`   
+  `r1: System Manufacturer: IBM`   
+  `r1: System FRU Number: 00FK639`   
+  `r1: System Board product name: System Board`   
+  `r1: System Model: 5462AC1`   
+  `r1: System UUID: 1B29CE46-765E-31A3-A3B9-B5FB934F15AB`   
+  `r1: System Hardware Version: 0x0000`   
+  `r1: System Manufacturer ID: 20301`   
+  `r1: System Chassis serial number: E2K4831`   
+  `r1: System Asset Number: `   
+  `r1: System Chassis type: Other`   
+  `r1: Power Supply 1 Board model: 94Y8136`   
+  `r1: Power Supply 1 Board manufacturer: EMER`   
+  `r1: Power Supply 1 FRU Number: 94Y8137`   
+  `r1: Power Supply 1 Board product name: IBM Designed Device`   
+  `r1: Power Supply 1 Board manufacture date: 2014-11-08T00:00`   
+  `r1: Power Supply 1 Board serial number:  K13814B88ED`   
+  `r1: Power Supply 1 Revision: 49`   
+  `r1: Power Supply 2: Not Present`   
+  `r1: DASD Backplane 1 Board model: 00JY139`   
+  `r1: DASD Backplane 1 Board manufacturer: WIST`   
+  `r1: DASD Backplane 1 FRU Number: 00FJ756`   
+  `r1: DASD Backplane 1 Board product name: IBM Designed Device`   
+  `r1: DASD Backplane 1 Board manufacture date: 2014-08-28T00:00`   
+  `r1: DASD Backplane 1 Board serial number: Y011UF48W02U`   
+  `r1: DASD Backplane 1 Revision: 0`   
+  `r1: DASD Backplane 2: Not Present`   
+  `r1: DASD Backplane 3: Not Present`   
+  `r1: DASD Backplane 4: Not Present`   
+  `r1: DASD Backplane 5 Board model: 00YJ530`   
+  `r1: DASD Backplane 5 Board manufacturer: WIST`   
+  `r1: DASD Backplane 5 FRU Number: 00AL953`   
+  `r1: DASD Backplane 5 Board product name: IBM Designed Device`   
+  `r1: DASD Backplane 5 Board manufacture date: 2016-02-04T00:00`   
+  `r1: DASD Backplane 5 Board serial number: Y010UF624024`   
+  `r1: DASD Backplane 5 Revision: 0`   
+  `r1: DASD Backplane 6: Not Present`   
+  `r1: CPU 1 Hardware Version: Intel(R) Xeon(R) CPU E5-2640 v3 @ 2.60GHz`   
+  `r1: CPU 1 Asset Number: Unknown`   
+  `r1: CPU 1 Manufacturer: Intel(R) Corporation`   
+  `r1: CPU 2: Not Present`   
+  `r1: ML2 Card: Not Present`   
+  `r1: DIMM 1: Not Present`   
+  `r1: DIMM 2: Not Present`   
+  `r1: DIMM 3: Not Present`   
+  `r1: DIMM 4: Not Present`   
+  `r1: DIMM 5: Not Present`   
+  `r1: DIMM 6: Not Present`   
+  `r1: DIMM 7: Not Present`   
+  `r1: DIMM 8: Not Present`   
+  `r1: DIMM 9: Not Present`   
+  `r1: DIMM 10: Not Present`   
+  `r1: DIMM 11: Not Present`   
+  `r1: DIMM 12: Not Present`   
+  `r1: DIMM 13: Not Present`   
+  `r1: DIMM 14: Not Present`   
+  `r1: DIMM 15: Not Present`   
+  `r1: DIMM 16: Not Present`   
+  `r1: DIMM 17: Not Present`   
+  `r1: DIMM 18: Not Present`   
+  `r1: DIMM 19: Not Present`   
+  `r1: DIMM 20: Not Present`   
+  `r1: DIMM 21: Not Present`   
+  `r1: DIMM 22: Not Present`   
+  `r1: DIMM 23: Not Present`   
+  `r1: DIMM 24: Not Present`   
+  `r1: X8 PCI 1: Not Present`   
+  `r1: X8 PCI 2: Not Present`   
+  `r1: X8 PCI 6: Not Present`   
+  `r1: X8 PCI 7: Not Present`   
+  `r1: Broadcom NetXtreme Gigabit Ethernet Controller MAC Address 1: 40:f2:e9:af:45:a0`   
+  `r1: Broadcom NetXtreme Gigabit Ethernet Controller MAC Address 2: 40:f2:e9:af:45:a1`   
+  `r1: Broadcom NetXtreme Gigabit Ethernet Controller MAC Address 3: 40:f2:e9:af:45:a2`   
+  `r1: Broadcom NetXtreme Gigabit Ethernet Controller MAC Address 4: 40:f2:e9:af:45:a3`   
+  `r1: Broadcom NetXtreme Gigabit Ethernet Controller PCI slot: 1b:00`   
+  `r1: Broadcom NetXtreme Gigabit Ethernet Controller location: Onboard`   
+
+* Reporting just the mac addresses of a node named r2:
+  `# nodeinventory r2 mac`
+  `r2: System MAC Address 1: 40:f2:e9:b9:10:18`
+  `r2: System MAC Address 2: 40:f2:e9:b9:10:19`
+  `r2: System MAC Address 3: 40:f2:e9:b9:10:1a`
+  `r2: System MAC Address 4: 40:f2:e9:b9:10:1b`
+
+* Getting the model number and serial number of a node named s2:
+  `# nodeinventory stark2 serial model`
+  `s2: System Product name: LENOVO THINKSYSTEM SD530 SERVER`
+  `s2: System Serial Number: DEV0000002`
+  `s2: System Model: 7X2104Z028`
@@ -0,0 +1,47 @@
+nodelist(8) -- List confluent nodes and their attributes
+=========================================================
+
+## SYNOPSIS
+
+`nodelist <noderange>`  
+`nodelist <noderange> [-b] <nodeattribute>...`  
+
+## DESCRIPTION
+
+**nodelist** queries the confluent server to get information about nodes.  In
+the simplest form, it simply takes the given noderange(5) and lists the
+matching nodes, one line at a time.
+
+If a list of node attribute names are given, the value of those are also
+displayed.  If `-b` is specified, it will also display information on
+how inherited and expression based attributes are defined.  There is more
+information on node attributes in nodeattributes(5) man page.
+
+## OPTIONS
+
+* `-b`, `--blame`:
+  Annotate inherited and expression based attributes to show their base value.
+
+## EXAMPLES
+* Listing matching nodes of a simple noderange:
+  `# nodelist n1-n4`  
+  `n1`  
+  `n2`  
+  `n3`  
+  `n4`  
+
+* Getting an attribute of nodes matching a noderange:
+  `# nodelist n1,n2 hardwaremanagement.manager`  
+  `n1: hardwaremanagement.manager: 172.30.3.1`  
+  `n2: hardwaremanagement.manager: 172.30.3.2`  
+
+* Getting a group of attributes while determining what group defines them:
+  `# nodelist n1,n2 hardwaremanegement --blame`  
+  `n1: hardwaremanagement.manager: 172.30.3.1`  
+  `n1: hardwaremanagement.method: ipmi (inherited from group everything)`  
+  `n1: hardwaremanagement.switch: r8e1`  
+  `n1: hardwaremanagement.switchport: 14`  
+  `n2: hardwaremanagement.manager: 172.30.3.2`  
+  `n2: hardwaremanagement.method: ipmi (inherited from group everything)`  
+  `n2: hardwaremanagement.switch: r8e1`  
+  `n2: hardwaremanagement.switchport: 2`  
@@ -0,0 +1,43 @@
+nodepower(8) -- Check or change power state of confluent nodes
+=========================================================
+
+## SYNOPSIS
+
+`nodepower <noderange>`  
+`nodepower <noderange> [on|off|boot|shutdown|reset|status]`
+
+## DESCRIPTION
+
+**nodepower** with only a noderange will retrieve current power state of nodes
+through confluent.  When given an additional argument, it will request a change
+to the power state of the nodes.  The following arguments are recognized:
+
+* `on`: Turn on the specified noderange.  Nothing will happen to nodes of
+the noderange that are already on.
+* `off`:  Immediately turn off the specified noderange, without waiting for OS
+to shutdown.  Nothing will happen to nodes of the noderange that are already on.
+* `boot`:  Immediately boot a system.  This will power on nodes of the noderange
+that are off, and reset nodes of the noderange that are on.  The previous state
+will be reflected in the output.
+* `shutdown`:  Request the OS gracefully shut down.  Nothing will happen for
+nodes that are off, and nodes will not shutdown if the OS fails to gracefully
+respond.
+* `reset`:  Request immediate reset of nodes of the noderange.  Nodes that are
+off will not react to this request.
+* `status`:  Behave identically to having no argument passed at all.
+
+## EXAMPLES
+* Get power state of nodes n1 through n4:
+  `# nodepower n1-n4`  
+  `n1: on`  
+  `n2: on`  
+  `n3: on`  
+  `n4: off`  
+
+
+* Forcing a reboot of nodes n1-n4:
+    `# nodepower n1-n4 boot`  
+    `n3: on->reset`  
+    `n1: on->reset`  
+    `n2: on->reset`  
+    `n4: off->on`  
@@ -0,0 +1,57 @@
+noderange(5) -- Indicate a target set of nodes in confluent
+=========================================================
+
+## SYNOPSIS
+
+`<noderange>`  
+
+## DESCRIPTION
+
+<noderange> is a syntax that can be used in most Confluent commands to conveniently specify a list of nodes. The result is that the command will be applied to a range of nodes, often in parallel.
+
+## EXAMPLES:
+
+The simplest noderange is a single node name:
+`n1`
+
+Nodes and groups may be used interchangeably. The following may be used in any context where n1 would be accepted as a noderange:
+`rack1`
+
+Commonly, there is a desire to target a range of elements. There are a few identically behaving syntaxes for the purpose.
+`n1:n20`
+`n1-n20`
+`n[1-20]`
+
+Note that numbers may be zero padded or not, it will automatically detect the padding amount and adjust members of the range accordingly. Ranges also can understand multiple numeric values changing:
+`r[1-3]u[01-10]`
+`r1u01-r3u10`
+
+Ranges can also be applied to group names, and all above syntaxes are compatible:
+`rack1-rack10`
+`rack[1-10]`
+
+Also, regular expressions may be used to indicate nodes with names matching certain patterns:
+`~r1u..`
+
+The other major noderange primitive is indicating nodes by some attribute value:
+`location.rack=7`
+
+Commas can be used to indicate multiple nodes, and can mix and match any of the above primitives. The following can be a valid single noderange, combining any and all members of each comma separated component
+`n1,n2,rack1,storage,location.rack=9,~s1..,n20-n30`
+
+Exclusions can be done by prepending a ‘-‘ before a portion of a noderange:
+`rack1,-n2`
+`compute,-rack1`
+`compute,-location.row=12`
+
+To indicate nodes that match multiple selections at once (set intersection), the @ symbol may be used:
+`compute@rack1`
+`location.rack=10@compute`
+
+For complex expressions, () may be used to indicate order of expanding the noderange to be explicit
+`rack1,-(console.logging=full@compute)`
+
+Noderange syntax can also indicate ‘pagination’, or separating the nodes into well defined chunks. > is used to indicate how many nodes to display at a time, and < is used to indicate how many nodes to skip into a noderange:
+`rack1>3<6`
+
+The above would show the seventh through ninth nodes of the rack1 group. Like all other noderange operations, this may be combined with any of the above, but must appear as the very last operation. Ordering is done with a natural sort.
@@ -0,0 +1,25 @@
+noderemove(8) -- Remove nodes from the confluent management service
+===================================================================
+
+## SYNOPSIS
+
+`noderemove <noderange>`  
+
+## DESCRIPTION
+
+`noderemove` simply removes the given noderange from the confluent database.
+
+
+## EXAMPLES
+
+* Remove two racks each with 4 nodes:
+    `# noderemove r1u1-r2u4`  
+    `r1u4: deleted`  
+    `r1u1: deleted`  
+    `r1u2: deleted`  
+    `r1u3: deleted`  
+    `r2u4: deleted`  
+    `r2u3: deleted`  
+    `r2u2: deleted`  
+    `r2u1: deleted`  
+
@@ -0,0 +1,19 @@
+nodereseat(8) -- Request a reseat of a node
+============================================
+
+## SYNOPSIS
+
+`nodereseat <noderange>`  
+
+## DESCRIPTION
+
+`nodereseat` requests the enclosure manager of the current node to reseat that
+node's slot.  This should be equivalent to removing the system entirely from
+the chassis and putting it back in, but without actually having to do so.
+
+## EXAMPLES
+
+* Reseating the node `s1`:
+    `# nodereseat s1`  
+    `s1: Reseat successful`  
+
@@ -0,0 +1,53 @@
+noderun(8) -- Run arbitrary commands per node in a noderange
+=============================================================
+
+## SYNOPSIS
+
+`noderun <noderange> <command string>`
+
+## DESCRIPTION
+
+`noderun` will take a given command and execute it in parallel once per node
+in the specified noderange.  Attribute expressions as documented in
+nodeattribexpressions(5) are expanded prior to execution of the command.  For
+noderun, the commands are locally executed.  To execute commands on the nodes
+themselves, see nodeshell(8).
+
+## EXAMPLES
+
+* Run ping against nodes n1 through n4:
+  `# noderun n1-n4 ping -c 1 {nodename}`  
+  `n3: PING n3 (172.30.2.3) 56(84) bytes of data.`  
+  `n3: 64 bytes from n3 (172.30.2.3): icmp_seq=1 ttl=64 time=0.387 ms`  
+  `n3: `  
+  `n3: --- n3 ping statistics ---`  
+  `n3: 1 packets transmitted, 1 received, 0% packet loss, time 0ms`  
+  `n3: rtt min/avg/max/mdev = 0.387/0.387/0.387/0.000 ms`  
+  `n4: PING n4 (172.30.2.4) 56(84) bytes of data.`  
+  `n4: 64 bytes from n4 (172.30.2.4): icmp_seq=1 ttl=64 time=0.325 ms`  
+  `n4: `  
+  `n4: --- n4 ping statistics ---`  
+  `n4: 1 packets transmitted, 1 received, 0% packet loss, time 0ms`  
+  `n4: rtt min/avg/max/mdev = 0.325/0.325/0.325/0.000 ms`  
+  `n2: PING n2 (172.30.2.2) 56(84) bytes of data.`  
+  `n2: From odin (172.30.0.6) icmp_seq=1 Destination Host Unreachable`  
+  `n2: `  
+  `n2: --- n2 ping statistics ---`  
+  `n2: 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 3000ms`  
+  `n2: `  
+  `n1: PING n1 (172.30.2.1) 56(84) bytes of data.`  
+  `n1: `  
+  `n1: --- n1 ping statistics ---`  
+  `n1: 1 packets transmitted, 0 received, 100% packet loss, time 10000ms`  
+  `n1: `  
+
+* Run an ipmitool raw command against the management controllers of n1 through n4:
+  `# noderun n1-n4 ipmitool -I lanplus -U USERID -E -H {hardwaremanagement.manager} raw 0 1`  
+  `n3:  01 10 00`  
+  `n1:  01 10 00`  
+  `n4:  01 10 00`  
+  `n2:  01 10 00`  
+
+## SEE ALSO
+
+nodeshell(8)
@@ -0,0 +1,55 @@
+nodesensors(8) --- Retrieve telemetry for sensors of confluent nodes
+====================================================================
+
+## SYNOPSIS
+
+`nodesensors <noderange> [-c] [-i <interval>] [-n <samplecount>]  [<sensor name  or category>...]`  
+
+
+## DESCRIPTION
+
+**nodesensors** queries the confluent server to get telemetry from nodes.  Telemetry can include
+data such as temperature, power, and so forth.  Without arguments, it lists all available sensors
+and their current values.  If `-c` is specified, CSV format is used for output.  Normally
+nodesensors outputs once and exits.  Repeated periodic gathering can be done with `-i` to specify
+interval and `-n` to specify number of requests.  If `-i` is specified without `-n`, then it will
+retrieve data at the requested interval indefinitely.  If '-n' is specified without `-i`, an
+interval of 1 second is used.
+
+## OPTIONS
+
+* `-c`, `--csv`:
+  Organize output into CSV format, one sensor per column.
+
+* `-i`, `--interval`=**SECONDS**:
+  Repeat data gathering waiting, waiting the specified time between samples.  Unless `-n` is
+  specified, indefinite retrieval is assumed.
+
+* `-n`, `--numreadings`=**SAMPLES**:
+  Perform the specified number of readings, waiting `-i` indicated interval or 1 second if not
+  otherwise indicated.
+
+## EXAMPLES
+* Retrieving all temperature related sensors from one system  
+  `# nodesensors n1 temperature`  
+  `n1: CPU 1 Overtemp: Ok`  
+  `n1: CPU 2 Overtemp: Ok`  
+  `n1: Inlet Temp: 16.0 °C`  
+  `n1: PCH Overtemp: Ok`  
+  `n1: LOM Temp: Ok`  
+
+* Retrieving a sensor named "Inlet Temp" for 4 systems over a 3 second period of time:  
+   `# nodesensors n1-n4 'Inlet Temp' -c -n 3`  
+   `time,node,Inlet Temp (°C)`  
+   `2016-10-04T15:09:20,n1,19.0`  
+   `2016-10-04T15:09:20,n2,18.0`  
+   `2016-10-04T15:09:20,n3,18.0`  
+   `2016-10-04T15:09:20,n4,17.0`  
+   `2016-10-04T15:09:21,n1,19.0`  
+   `2016-10-04T15:09:21,n2,18.0`  
+   `2016-10-04T15:09:21,n3,18.0`  
+   `2016-10-04T15:09:21,n4,17.0`  
+   `2016-10-04T15:09:22,n1,19.0`  
+   `2016-10-04T15:09:22,n2,18.0`  
+   `2016-10-04T15:09:22,n3,18.0`  
+   `2016-10-04T15:09:22,n4,17.0`  
@@ -0,0 +1,69 @@
+nodesetboot(8) -- Check or set next boot device for noderange
+====================================================
+
+## SYNOPSIS
+
+`nodesetboot <noderange>`  
+`nodesetboot [options] <noderang> [default|cd|network|setup|hd]`
+
+## DESCRIPTION
+
+Requests that the next boot occur from the specified device.  Unless otherwise
+specified, this is a one time boot option, and does not change the normal boot
+behavior of the system.  This is useful for taking a system that normally boots
+to the hard drive and startking a network install, or to go into the firmware
+setup menu without having to hit a keystroke at the correct time on the console.
+
+Generally, it's a bit more convenient and direct to use the nodeboot(8) command,
+which will follow up the boot device with an immediate power directive to take
+effect.  The `nodesetboot` command is still useful, particularly if you want
+to use `nodesetboot <noderange> setup` and then initiate a reboot from within
+the operating system with ssh or similar rather than using the remote hardware
+control.
+
+## OPTIONS
+
+* `-b`, `--bios`:
+  For a system that supports both BIOS and UEFI style boot, request BIOS style
+  boot if supported (some platforms will UEFI boot with this flag anyway).
+
+* `-p`, `--persist`:
+  For a system that supports it, mark the boot override to persist rather than
+  be a one time change.  Many systems do not support this functionality.
+  
+* `default`:
+  Request a normal default boot with no particular device override
+
+* `cd`:
+  Request boot from media.  Note that this can include physical CD,
+  remote media mounted as CD/DVD, and detachable hard disks drives such as usb
+  key devices.
+  
+* `network`:
+  Request boot to network
+  
+* `setup`:
+  Request to enter the firmware configuration menu (e.g. F1 setup) on next boot.
+
+* `hd`:
+  Boot straight to hard disk drive
+
+## EXAMPLES
+
+* Set next boot to setup for four nodes:
+  `# nodesetboot n1-n4 setup`  
+  `n1: setup`  
+  `n3: setup`  
+  `n2: setup`  
+  `n4: setup`  
+
+* Check boot override settings on four nodes:
+  `# nodesetboot n1-n4`  
+  `n1: setup`  
+  `n2: setup`  
+  `n3: setup`  
+  `n4: setup`  
+  
+## SEE ALSO
+
+nodeboot(8)
@@ -0,0 +1,29 @@
+nodeshell(8) -- Execute command on many nodes in a noderange through ssh
+=========================================================================
+
+## SYNOPSIS
+
+`nodeshell <noderange> <command to execute on each node>`
+
+## DESCRIPTION
+
+Allows execution of a command on many nodes in parallel.  Like noderun(8), it
+accepts and interpolates confluent attribute expressions as documented in 
+nodeattribexpressions(5).  `nodeshell` provides stdout as stdout and stderr
+as stderr, unlike psh which combines all stdout and stderr into stdout.
+
+## EXAMPLES
+
+* Running `echo hi` on for nodes:
+  `# nodeshell n1-n4 echo hi`  
+  `n1: hi`  
+  `n2: hi`  
+  `n3: hi`  
+  `n4: hi`  
+
+* Setting a new static ip address temporarily on secondary interface of four nodes:
+  `# nodeshell n1-n4 ifconfig eth1 172.30.93.{n1}`  
+  
+## SEE ALSO
+
+noderun(8)
@@ -0,0 +1,10 @@
+#!/bin/sh
+cd `dirname $0`/doc/man
+mkdir -p ../../man/man1
+mkdir -p ../../man/man5
+mkdir -p ../../man/man8
+ronn -r *.ronn
+mv *.1 ../../man/man1/
+mv *.5 ../../man/man5/
+mv *.8 ../../man/man8/
+
@@ -1,4 +1,14 @@
 from setuptools import setup
+import os
+
+data_files = [('/etc/profile.d', ['confluent_env.sh', 'confluent_env.csh'])]
+try:
+    scriptlist = ['bin/{0}'.format(d) for d in os.listdir('bin/')]
+    data_files.append(('/opt/confluent/share/man/man1', ['man/man1/' + x for x in os.listdir('man/man1')]))
+    data_files.append(('/opt/confluent/share/man/man5', ['man/man5/' + x for x in os.listdir('man/man5')]))
+    data_files.append(('/opt/confluent/share/man/man8', ['man/man8/' + x for x in os.listdir('man/man8')]))
+except OSError:
+    pass

 setup(
    name='confluent_client',
@@ -7,9 +17,6 @@ setup(
    author_email='jjohnson2@lenovo.com',
    url='http://xcat.sf.net/',
    packages=['confluent'],
-    scripts=['bin/confetty', 'bin/nodeconsole', 'bin/nodeeventlog',
-             'bin/nodefirmware', 'bin/nodehealth', 'bin/nodeidentify',
-             'bin/nodeinventory', 'bin/nodelist', 'bin/nodepower',
-             'bin/nodesensors', 'bin/nodesetboot'],
-    data_files=[('/etc/profile.d', ['confluent_env.sh'])],
+    scripts=scriptlist,
+    data_files=data_files,
 )
@@ -1,2 +1,3 @@
 include sysvinit/*
 include systemd/*
+include sysctl/*
@@ -0,0 +1,67 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import optparse
+import sys
+import os
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    # if installed into system path, do not muck with things
+    sys.path.append(path)
+import confluent.config.configmanager as cfm
+import confluent.config.conf as conf
+import confluent.main as main
+
+argparser = optparse.OptionParser(
+    usage="Usage: %prog [options] [dump|restore] [path]")
+argparser.add_option('-p', '--password',
+                     help='Password to use to protect/unlock a protected dump')
+argparser.add_option('-r', '--redact', action='store_true',
+                     help='Redact potentially sensitive data rather than store')
+argparser.add_option('-u', '--unprotected', action='store_true',
+                      help='Specify that no password should be used to protect'
+                           ' the key information.  Fields will be encrypted, '
+                           'but keys.json will contain unencrypted decryption'
+                           ' keys that may be used to read the dump')
+(options, args) = argparser.parse_args()
+if len(args) != 2 or args[0] not in ('dump', 'restore'):
+    argparser.print_help()
+    sys.exit(1)
+dumpdir = args[1]
+
+
+if args[0] == 'restore':
+    pid = main.is_running()
+    if pid is not None:
+        print("Confluent is running, must shut down to restore db")
+        sys.exit(1)
+    cfm.restore_db_from_directory(dumpdir, options.password)
+elif args[0] == 'dump':
+    if options.password is None and not (options.unprotected or options.redact):
+        print("Must indicate a password to protect or -u to opt opt of "
+              "secure value protection or -r to skip all protected data")
+        sys.exit(1)
+    os.umask(077)
+    main._initsecurity(conf.get_config())
+    if not os.path.exists(dumpdir):
+        os.makedirs(dumpdir)
+    cfm.dump_db_to_directory(dumpdir, options.password, options.redact)
+
+
+
@@ -1,5 +1,8 @@
 #!/bin/sh
 cd `dirname $0`
+if [ -x ./makeman ]; then
+    ./makeman
+fi
 ./makesetup
 VERSION=`cat VERSION`
 PKGNAME=$(basename $(pwd))
@@ -0,0 +1 @@
+__version__ = "1.5.0.dev395.ggacb3a20"
@@ -110,9 +110,12 @@ class AsyncSession(object):
        del _asyncsessions[self.asyncid]

    def run_handler(self, handler, requestid):
-        for rsp in handler:
-            self.add(requestid, rsp)
-        self.add(requestid, messages.AsyncCompletion())
+        try:
+            for rsp in handler:
+                self.add(requestid, rsp)
+            self.add(requestid, messages.AsyncCompletion())
+        except Exception as e:
+            self.add(requestid, e)

    def get_responses(self, timeout=25):
        self.reaper.cancel()
@@ -37,6 +37,7 @@ _passcache = {}
 _passchecking = {}

 authworkers = None
+authcleaner = None


 class Credentials(object):
@@ -195,6 +196,13 @@ def check_user_passphrase(name, passphrase, element=None, tenant=False):
    #such a beast could be passed into pyghmi as a way for pyghmi to
    #magically get offload of the crypto functions without having
    #to explicitly get into the eventlet tpool game
+    global authworkers
+    global authcleaner
+    if authworkers is None:
+        authworkers = multiprocessing.Pool(processes=1)
+    else:
+        authcleaner.cancel()
+    authcleaner = eventlet.spawn_after(30, _clean_authworkers)
    crypted = eventlet.tpool.execute(_do_pbkdf, passphrase, salt)
    del _passchecking[(user, tenant)]
    eventlet.sleep(0.05)  # either way, we want to stall so that client can't
@@ -211,19 +219,16 @@ def _apply_pbkdf(passphrase, salt):
                      lambda p, s: hmac.new(p, s, hashlib.sha256).digest())


+def _clean_authworkers():
+    global authworkers
+    global authcleaner
+    authworkers = None
+    authcleaner = None
+
+
 def _do_pbkdf(passphrase, salt):
    # we must get it over to the authworkers pool or else get blocked in
    # compute.  However, we do want to wait for result, so we have
    # one of the exceedingly rare sort of circumstances where 'apply'
    # actually makes sense
-    return authworkers.apply(_apply_pbkdf, [passphrase, salt])
-
-
-def init_auth():
-    # have a some auth workers available.  Keep them distinct from
-    # the general populace of workers to avoid unauthorized users
-    # starving out productive work
-    global authworkers
-    # for now we'll just have one auth worker and see if there is any
-    # demand for more.  I personally doubt it.
-    authworkers = multiprocessing.Pool(processes=1)
+    return authworkers.apply(_apply_pbkdf, [passphrase, salt])
@@ -16,50 +16,69 @@
 # limitations under the License.


-#This defines the attributes of variou classes of things
+#This defines the attributes of various classes of things

 # 'nic', meant to be a nested structure under node
-nic = {
-    'name': {
-        'description': 'Name in ip/ifconfig as desired by administrator',
-    },
-    'port': {
-        'description': 'Port that this nic connects to',
-    },
-    'switch': {
-        'description': 'Switch that this nic connects to',
-    },
-    'customhardwareaddress': {
-        'description': 'Mac address to push to nic',
-    },
-    'dnssuffix': {
-        'description': ('String to place after nodename, but before'
-                        'Network.Domain to derive FQDN for this NIC'),
-    },
-    'hardwareaddress': {
-        'description': 'Active mac address on this nic (factory or custom)'
-    },
-    'ipaddresses': {
-        'description': 'Set of IPv4 and IPv6 addresses in CIDR format'
-    },
-    'pvid': {
-        'description': 'PVID of port on switch this nic connects to',
-    },
-    'mtu': {
-        'description': 'Requested MTU to configure on this interface',
-    },
-    'vlans': {
-        'description': 'Tagged VLANs to apply to nic/switch',
-    },
-    'dhcpv4enabled': {
-        'description':  ('Whether DHCP should be attempted to acquire IPv4'
-                         'address on this interface'),
-    },
-    'dhcpv6enabled': {
-        'description':  ('Whether DHCP should be attempted to acquire IPv6'
-                         'address on this interface'),
-    },
-}
+# changing mind on design, flattening to a single attribute, a *touch* less
+# flexible at the top end, but much easier on the low end
+# now net.<name>.attribute scheme
+# similarly, leaning toward comma delimited ip addresses, since 99.99% of the
+# time each nic will have one ip address
+# vlan specification will need to be thought about a tad, each ip could be on
+# a distinct vlan, but could have a vlan without an ip for sake of putting
+# to a bridge.  Current thought is
+# vlans attribute would be comma delimited referring to the same index
+# as addresses, with either 'native' or a number for vlan id
+# the 'joinbridge' attribute would have some syntax like @<vlanid> to indicate
+# joining only a vlan of the nic to the bridge
+# 'joinbond' attribute would not support vlans.
+
+#nic = {
+#    'name': {
+#        'description': 'Name in ip/ifconfig as desired by administrator',
+#    },
+#    'biosdevname': {
+#        'description': '"biosdevname" scheme to identify the adapter. If not'
+#                       'mac address match is preferred, then biosdevname, then'
+#                       'name.',
+#    },
+#    'port': {
+#        'description': 'Port that this nic connects to',
+#    },
+#    'switch': {
+#        'description': 'Switch that this nic connects to',
+#    },
+#    'customhardwareaddress': {
+#        'description': 'Mac address to push to nic',
+#    },
+#    'dnssuffix': {
+#        'description': ('String to place after nodename, but before'
+#                        'Network.Domain to derive FQDN for this NIC'),
+#    },
+#    'hardwareaddress': {
+#        'description': 'Active mac address on this nic (factory or custom)'
+#    },
+#    'ipaddresses': {
+#        'description': 'Set of IPv4 and IPv6 addresses in CIDR format'
+#    },
+#    'pvid': {
+#        'description': 'PVID of port on switch this nic connects to',
+#    },
+#    'mtu': {
+#        'description': 'Requested MTU to configure on this interface',
+#    },
+#    'vlans': {
+#        'description': 'Tagged VLANs to apply to nic/switch',
+#    },
+#    'dhcpv4enabled': {
+#        'description':  ('Whether DHCP should be attempted to acquire IPv4'
+#                         'address on this interface'),
+#    },
+#    'dhcpv6enabled': {
+#        'description':  ('Whether DHCP should be attempted to acquire IPv6'
+#                         'address on this interface'),
+#    },
+#}

 user = {
    'password': {
@@ -71,7 +90,6 @@ user = {
 node = {
    'groups': {
        'type': list,
-        'default': 'all',
        'description': ('List of static groups for which this node is '
                        'considered a member'),
    },
@@ -81,6 +99,72 @@ node = {
    #'id': {
    #    'description': ('Numeric identifier for node')
    #},
+    # autonode is the feature of generating nodes based on connectivity to
+    # current node.  In recursive autonode, for now we just allow endpoint to
+    # either be a server directly *or* a server enclosure.  This precludes
+    # for the moment a concept of nested arbitrarily deep, but for now do this.
+    # hypothetically, one could imagine supporting an array and 'popping'
+    # names until reaching end.  Not worth implementing at this point.  If
+    # a traditional switch is added, it needs some care and feeding anyway.
+    # If a more exciting scheme presents itself, well we won't have to
+#   # own discovering switches anyway.
+#   'autonode.servername': {
+#       'description': ('Template for creating nodenames for automatic '
+#                       'creation of nodes detected as children of '
+#                       'this node.  For example, a node in a server '
+#                       'enclosure bay or a server connected to a switch or '
+#                       'an enclosure manager connected to a switch.  Certain '
+#                       'special template parameters are available and can '
+#                       'be used alongside usual config template directives. '
+#                       '"discovered.nodenumber" will be replaced with the '
+#                       'bay or port number where the child node is connected.'
+#                       ),
+#   },
+#   'autonode.servergroups': {
+#       'type': list,
+#       'description': ('A list of groups to which discovered nodes will '
+#                       'belong to.  As in autonode.servername, "discovered." '
+#                       'variable names will be substituted in special context')
+#   },
+#   'autonode.enclosurename': {
+#       'description': ('Template for creating nodenames when the discovered '
+#                       'node is an enclosure that will in turn generate nodes.'
+#                       )
+#   },
+#   'autonode.enclosuregroups': {
+#       'type': list,
+#       'description': ('A list of groups to which a discovered node will be'
+#                       'placed, presuming that node is an enclosure.')
+#   },
+#For now, we consider this eventuality if needed.  For now emphasize paradigm
+# of group membership and see how far that goes.
+#    'autonode.copyattribs': {
+#        'type': list,
+#        'description': ('A list of attributes to copy from the node generator '
+#                        'to the generated node.  Expressions will be copied '
+#                        'over without evaluation, so will be evaluated '
+#                        'in the context of the generated node, rather than the'
+#                        'parent node.  By default, an enclosure will copy over'
+#                        'autonode.servername, so that would not need to be '
+#                        'copied ')
+#    },
+    'discovery.policy': {
+        'description':  'Policy to use for auto-configuration of discovered '
+                        'and identified nodes. Valid values are "manual", '
+                        '"permissive", or "open". "manual" means nodes are '
+                        'detected, but not autoconfigured until a user '
+                        'approves. "permissive" indicates to allow discovery, '
+                        'so long as the node has no existing public key. '
+                        '"open" allows discovery even if a known public key '
+                        'is already stored',
+    },
+    'info.note': {
+        'description':  'A field used for administrators to make arbitrary '
+                        'notations about nodes. This is meant entirely for '
+                        'human use and not programmatic use, so it can be '
+                        'freeform text data without concern for issues in how '
+                        'the server will process it.',
+    },
    'location.room': {
        'description': 'Room description for the node',
    },
@@ -188,7 +272,8 @@ node = {
 #        'appliesto': ['vm'],
 #    },
    'hardwaremanagement.manager': {
-        'description': 'The management address dedicated to this node',
+        'description': 'The management address dedicated to this node.  This '
+                       'is the address of, for example, the Lenovo IMM.',
    },
    'hardwaremanagement.method': {
        'description': 'The method used to perform operations such as power '
@@ -202,40 +287,89 @@ node = {
         'description': 'The bay in the enclosure, if any',
 #        'appliesto': ['system'],
    },
+
 #    'enclosure.type': {
 #        'description': '''The type of enclosure in use (e.g. IBM BladeCenter,
 #IBM Flex)''',
 #        'appliesto': ['system'],
 #    },
-#    'inventory.serialnumber': {
-#        'description': 'The manufacturer serial number of node',
-#    },
-#    'inventory.uuid': {
-#        'description': 'The UUID of the node as presented in DMI',
-#    },
-#    'inventory.modelnumber': {
+    'id.model': {
+        'description': 'The model number of a node.  In scenarios where there '
+                       'is both a name and a model number, it is generally '
+                       'expected that this would be the generally more '
+                       'specific model number.'
+    },
+    'id.serial': {
+        'description': 'The manufacturer serial number of node',
+    },
+    'id.uuid': {
+        'description': 'The UUID of the node as presented in DMI.',
+    },
+    # For single interface mac collection, net.bootable suffices
+    # For multiple interface mac collection, we perhaps add an address field and use subnet affinity as a clue
+    # to disambiguate multiple addresses for external provisioning
+    # For internal provisioning, the UUID matters rather than the MAC, though subnet affinity may
+    # still be a factor to select the appropriate static config to send down.  In such a case bonding
+    # is hopefully more likely as that's a bit easier.
+    # Start with the first case and only document that, the other thoughts can be future items if they turn up
+    'net.bootable': {
+        'type': bool,
+        'description': 'Whether or not the indicated network interface is to be used for booting.  This is used by '
+                       'the discovery process to decide where to place the mac address of a detected PXE nic.',
+    },
+    'net.ipv4_gateway': {
+        'description':  'The IPv4 gateway to use if applicable.  As is the '
+                        'case for other net attributes, net.eth0.ipv4_gateway '
+                        'and similar is accepted.'
+    },
+    'net.hwaddr': {
+        'description': 'The hardware address, aka MAC address of the interface indicated, generally populated by the '
+                       'PXE discovery mechanism'
+    },
+    # 'net.pxe': { 'description': 'Whether pxe will be used on this interface'
+    # TODO(jjohnson2):  Above being 'true' will control whether mac addresses
+    # are stored in this nics attribute on pxe-client discovery, since
+    # pxe discovery is ambiguous for BMC and system on same subnet,
+    # or even both on the same port and same subnet
+    'net.switch': {
+        'description': 'An ethernet switch the node is connected to.  Note '
+                       'that net.* attributes may be indexed by interface. '
+                       'For example instead of using net.switch, it is '
+                       'possible to use net.eth0.switch and net.eth1.switch '
+                       'or net.0.switch and net.1.switch to define multiple '
+                       'sets of net connectivity associated with each other.'
+    },
+    'net.switchport': {
+        'description': 'The port on the switch that corresponds to this node. '
+                       'See information on net.switch for more on the '
+                       'flexibility of net.* attributes.'
+    },
+#    'id.modelnumber': {
 #        'description': 'The manufacturer dictated  model number for the node',
 #    },
-#    'inventory.snmpengineid': {
+#    'id.modelname': {
+#        'description': 'The manufacturer model label for the node',
+#    },
+#    'id.snmpengineid': {
 #        'description': 'The SNMP Engine id used by this node',
 #    },
 #    'secret.snmpuser': {
 #        'description': 'The user to use for SNMPv3 access to this node',
 #    },
-#    'secret.snmppassphrase': {
-#        'description': 'The passphrase to use for SNMPv3 access to this node',
+#    'secret.snmppassword': {
+#        'description': 'The password to use for SNMPv3 access to this node',
 #    },
+    'secret.snmpcommunity': {
+        'description': ('SNMPv1 community string, it is highly recommended to'
+                        'step up to SNMPv3'),
+    },
 #    'secret.snmplocalizedkey': {
 #        'description': ("SNMPv3 key localized to this node's SNMP Engine id"
 #                        'This can be used in lieu of snmppassphrase to avoid'
 #                        'retaining the passphrase TODO: document procedure'
 #                        'to commit passphrase to localized key'),
 #    },
-#    'secret.snmpcommunity': {
-#        'description': ('SNMPv1 community string, it is highly recommended to'
-#                        'step up to SNMPv3'),
-#    },
-#    'secret.localadminpassphrase': {
+#    'secret.adminpassword': {
 #        'description': ('The passphrase to apply to local root/administrator '
 #                        'account. '
 #                        'If the environment is 100% Linux, the value may be '
@@ -246,35 +380,18 @@ node = {
 #                        'AD')
 #    },
    'secret.ipmikg': {
-        'description': 'Optional Integrity key for IPMI communication'
+        'description': 'Optional Integrity key for IPMI communication.  This '
+                       'should generally be ignored, as mutual authentication '
+                       'is normally done with the password alone (which is a '
+                       'shared secret in IPMI)'
    },
-#    'secret.ipmiuser': {
-#        'description': ('The username to use to log into IPMI device related '
-#                        'to the node.  For setting username, default '
-#                        'behavior is to randomize username, for using '
-#                        'username if not set, USERID is assumed'),
-#    },
-#    'secret.ipmipassphrase': {
-#        'description': ('The key to use to authenticate to IPMI device '
-#                        'related to the node.  For setting passphrase, '
-#                        'default behavior is to randomize passphrase and '
-#                        'store it here.  If going to connect over the '
-#                        'network and value is not set, PASSW0RD is attempted')
-#    },
    'secret.hardwaremanagementuser': {
-        'description': ('Username to be set and used by protocols like SSH '
-                        'and HTTP where client provides passphrase over the '
-                        'network. Given the distinct security models betwen '
-                        'this class of protocols and SNMP and IPMI, snmp and '
-                        'ipmi utilize dedicated values.'),
+        'description': ('The username to use when connecting to the hardware '
+                        'manager'),
    },
    'secret.hardwaremanagementpassword': {
-        'description': ('Passphrase to be set and used by protocols like SSH '
-                        'and HTTP, where client sends passphrase over the '
-                        'network.  Given distinct security models between '
-                        'this class of protocols, SNMP, and IPMI, SNMP and '
-                        'IPMI are given their own settings with distinct '
-                        'behaviors'),
+        'description': ('Password to use when connecting to the hardware '
+                        'manager'),
    },
    'pubkeys.addpolicy': {
        'description': ('Policy to use when encountering unknown public '
@@ -65,12 +65,15 @@ import anydbm as dbm
 import ast
 import base64
 import confluent.config.attributes as allattributes
+import confluent.config.conf as conf
 import confluent.log
 import confluent.util
 import confluent.exceptions as exc
 import copy
 import cPickle
 import errno
+import eventlet
+import fnmatch
 import json
 import operator
 import os
@@ -87,6 +90,14 @@ _masterintegritykey = None
 _dirtylock = threading.RLock()
 _config_areas = ('nodegroups', 'nodes', 'usergroups', 'users')
 tracelog = None
+statelessmode = False
+_cfgstore = None
+
+_attraliases = {
+    'bmc': 'hardwaremanagement.manager',
+    'bmcuser': 'secret.hardwaremanagementuser',
+    'bmcpass': 'secret.hardwaremanagementpassword',
+}

 def _mkpath(pathname):
    try:
@@ -128,6 +139,18 @@ def _get_protected_key(keydict, password, paramname):
        raise exc.LockedCredentials("No available decryption key")


+def _parse_key(keydata, password=None):
+    if keydata.startswith('*unencrypted:'):
+        return base64.b64decode(keydata[13:])
+    elif password:
+        salt, iv, crypt, hmac = [base64.b64decode(x)
+                                 for x in keydata.split('!')]
+        privkey, integkey = _derive_keys(password, salt)
+        return decrypt_value([iv, crypt, hmac], privkey, integkey)
+    raise(exc.LockedCredentials(
+        "Passphrase protected secret requires password"))
+
+
 def _format_key(key, password=None):
    if password is not None:
        salt = os.urandom(32)
@@ -138,6 +161,29 @@ def _format_key(key, password=None):
        return {"unencryptedvalue": key}


+def _do_notifier(cfg, watcher, callback):
+    try:
+        callback(nodeattribs=watcher['nodeattrs'], configmanager=cfg)
+    except Exception:
+        logException()
+
+
+def logException():
+    global tracelog
+    if tracelog is None:
+        tracelog = confluent.log.Logger('trace')
+    tracelog.log(traceback.format_exc(),
+                 ltype=confluent.log.DataTypes.event,
+                 event=confluent.log.Events.stacktrace)
+
+
+def _do_add_watcher(watcher, added, configmanager):
+    try:
+        watcher(added=added, deleting=[], configmanager=configmanager)
+    except Exception:
+        logException()
+
+
 def init_masterkey(password=None):
    global _masterkey
    global _masterintegritykey
@@ -185,6 +231,43 @@ def decrypt_value(cryptvalue,
    return value[0:-padsize]


+def fixup_attribute(attrname, attrval):
+    # Normalize some data, for example strings and numbers to bool
+    if attrname.startswith('custom.'):
+        return attrval
+    if attrname.startswith('net.'):
+        # For net.* attribtues, split on the dots and put back together
+        # longer term we might want a generic approach, but
+        # right now it's just net. attributes
+        netattrparts = attrname.split('.')
+        attrname = netattrparts[0] + '.' + netattrparts[-1]
+    if 'type' in allattributes.node[attrname] and not isinstance(attrval, allattributes.node[attrname]['type']):
+        if (allattributes.node[attrname]['type'] == bool and
+                (isinstance(attrval, str) or isinstance(attrval, unicode))):
+            return attrval.lower() in ('true', '1', 'y', 'yes', 'enable', 'enabled')
+    return attrval
+
+
+def attribute_is_invalid(attrname, attrval):
+    if attrname.startswith('custom.'):
+        # No type checking or name checking is provided for custom,
+        # it's not possible
+        return False
+    if attrname.startswith('net.'):
+        # For net.* attribtues, split on the dots and put back together
+        # longer term we might want a generic approach, but
+        # right now it's just net. attributes
+        netattrparts = attrname.split('.')
+        attrname = netattrparts[0] + '.' + netattrparts[-1]
+    if attrname not in allattributes.node:
+        # Otherwise, it must be in the allattributes key list
+        return True
+    if 'type' in allattributes.node[attrname]:
+        if not isinstance(attrval, allattributes.node[attrname]['type']):
+            # provide type checking for attributes with a specific type
+            return True
+    return False
+
 def crypt_value(value,
                key=None,
                integritykey=None):
@@ -201,7 +284,10 @@ def crypt_value(value,
    neededpad = 16 - (len(value) % 16)
    pad = chr(neededpad) * neededpad
    value += pad
-    cryptval = crypter.encrypt(value)
+    try:
+        cryptval = crypter.encrypt(value)
+    except TypeError:
+        cryptval = crypter.encrypt(value.encode('utf-8'))
    hmac = HMAC.new(integritykey, cryptval, SHA256).digest()
    return iv, cryptval, hmac

@@ -215,7 +301,7 @@ def _load_dict_from_dbm(dpath, tdb):
                currdict[elem] = {}
            currdict = currdict[elem]
        try:
-            for tk in dbe.iterkeys():
+            for tk in dbe:
                currdict[tk] = cPickle.loads(dbe[tk])
        except AttributeError:
            tk = dbe.firstkey()
@@ -239,6 +325,8 @@ def get_global(globalname):

    :param globalname: The global parameter name to read
    """
+    if _cfgstore is None:
+        init()
    try:
        return _cfgstore['globals'][globalname]
    except KeyError:
@@ -255,6 +343,8 @@ def set_global(globalname, value):
    :param globalname:  The global parameter name to store
    :param value: The value to set the global parameter to.
    """
+    if _cfgstore is None:
+        init()
    with _dirtylock:
        if 'dirtyglobals' not in _cfgstore:
            _cfgstore['dirtyglobals'] = set()
@@ -328,17 +418,15 @@ class _ExpressionFormat(string.Formatter):
            left = node.value.id
            right = node.attr
            key = left + '.' + right
-            if '_expressionkeys' not in self._nodeobj:
-                self._nodeobj['_expressionkeys'] = set([key])
-            else:
-                self._nodeobj['_expressionkeys'].add(key)
-            val = _decode_attribute(key, self._nodeobj,
-                                    formatter=self)
+            val = self._expand_attribute(key)
            return val['value'] if 'value' in val else ""
        elif isinstance(node, ast.Name):
            var = node.id
            if var == 'nodename':
                return self._nodename
+            if var in _attraliases:
+                val = self._expand_attribute(_attraliases[var])
+                return val['value'] if 'value' in val else ""
            mg = re.match(self.posmatch, var)
            if mg:
                idx = int(mg.group(1))
@@ -347,20 +435,24 @@ class _ExpressionFormat(string.Formatter):
                return int(self._numbers[idx - 1])
            else:
                if var in self._nodeobj:
-                    if '_expressionkeys' not in self._nodeobj:
-                        self._nodeobj['_expressionkeys'] = set([var])
-                    else:
-                        self._nodeobj['_expressionkeys'].add(var)
-                    val = _decode_attribute(var, self._nodeobj,
-                                            formatter=self)
+                    val = self._expand_attribute(var)
                    return val['value'] if 'value' in val else ""
        elif isinstance(node, ast.BinOp):
            optype = type(node.op)
            if optype not in self._supported_ops:
                raise Exception("Unsupported operation")
            op = self._supported_ops[optype]
-            return op(self._handle_ast_node(node.left),
-                      self._handle_ast_node(node.right))
+            return op(int(self._handle_ast_node(node.left)),
+                      int(self._handle_ast_node(node.right)))
+
+    def _expand_attribute(self, key):
+        if '_expressionkeys' not in self._nodeobj:
+            self._nodeobj['_expressionkeys'] = set([key])
+        else:
+            self._nodeobj['_expressionkeys'].add(key)
+        val = _decode_attribute(key, self._nodeobj,
+                                formatter=self)
+        return val


 def _decode_attribute(attribute, nodeobj, formatter=None, decrypt=False):
@@ -415,7 +507,7 @@ def hook_new_configmanagers(callback):
    #TODO(jbjohnso): actually live up to the promise of ongoing callbacks
    callback(ConfigManager(None))
    try:
-        for tenant in _cfgstore['tenant'].iterkeys():
+        for tenant in _cfgstore['tenant']:
            callback(ConfigManager(tenant))
    except KeyError:
        pass
@@ -437,6 +529,8 @@ class ConfigManager(object):

    def __init__(self, tenant, decrypt=False, username=None):
        global _cfgstore
+        if _cfgstore is None:
+            init()
        self.decrypt = decrypt
        self.current_user = username
        if tenant is None:
@@ -538,7 +632,9 @@ class ConfigManager(object):

    def watch_attributes(self, nodes, attributes, callback):
        """
-        Watch a list of attributes for changes on a list of nodes
+        Watch a list of attributes for changes on a list of nodes.  The
+        attributes may be literal, or a filename style wildcard like
+        'net*.switch'

        :param nodes: An iterable of node names to be watching
        :param attributes: An iterable of attribute names to be notified about
@@ -566,6 +662,10 @@ class ConfigManager(object):
                    }
                else:
                    attribwatchers[node][attribute][notifierid] = callback
+                if '*' in attribute:
+                    currglobs = attribwatchers[node].get('_attrglobs', set([]))
+                    currglobs.add(attribute)
+                    attribwatchers[node]['_attrglobs'] = currglobs
        return notifierid

    def watch_nodecollection(self, callback):
@@ -613,7 +713,7 @@ class ConfigManager(object):

    def list_users(self):
        try:
-            return self._cfgstore['users'].iterkeys()
+            return list(self._cfgstore['users'])
        except KeyError:
            return []

@@ -655,7 +755,7 @@ class ConfigManager(object):
        :param attributemap: The mapping of keys to values to set
        """

-        for attribute in attributemap.iterkeys():
+        for attribute in attributemap:
            self._cfgstore['usergroups'][attribute] = attributemap[attribute]
        _mark_dirtykey('usergroups', groupname, self.tenant)

@@ -707,6 +807,8 @@ class ConfigManager(object):
        :param uid: Custom identifier number if desired.  Defaults to random.
        :param displayname: Optional long format name for UI consumption
        """
+        if 'idmap' not in _cfgstore['main']:
+            _cfgstore['main']['idmap'] = {}
        if uid is None:
            uid = _generate_new_id()
        else:
@@ -720,8 +822,6 @@ class ConfigManager(object):
        self._cfgstore['users'][name] = {'id': uid}
        if displayname is not None:
            self._cfgstore['users'][name]['displayname'] = displayname
-        if 'idmap' not in _cfgstore['main']:
-            _cfgstore['main']['idmap'] = {}
        _cfgstore['main']['idmap'][uid] = {
            'tenant': self.tenant,
            'username': name
@@ -738,19 +838,23 @@ class ConfigManager(object):
    def is_nodegroup(self, nodegroup):
        return nodegroup in self._cfgstore['nodegroups']

-    def get_groups(self):
-        return self._cfgstore['nodegroups'].iterkeys()
+    def get_groups(self, sizesort=False):
+        if sizesort:
+            return reversed(
+                sorted(self._cfgstore['nodegroups'], key=lambda x: len(
+                    self._cfgstore['nodegroups'][x]['nodes'])))
+        return iter(self._cfgstore['nodegroups'])

    def list_nodes(self):
        try:
-            return self._cfgstore['nodes'].iterkeys()
+            return iter(self._cfgstore['nodes'])
        except KeyError:
            return []

    def get_nodegroup_attributes(self, nodegroup, attributes=()):
        cfgnodeobj = self._cfgstore['nodegroups'][nodegroup]
        if not attributes:
-            attributes = cfgnodeobj.iterkeys()
+            attributes = cfgnodeobj
        nodeobj = {}
        for attribute in attributes:
            if attribute.startswith('_'):
@@ -761,11 +865,23 @@ class ConfigManager(object):
                                                   decrypt=self.decrypt)
        return nodeobj

-    def get_node_attributes(self, nodelist, attributes=()):
+    def expand_attrib_expression(self, nodelist, expression):
+        if type(nodelist) in (unicode, str):
+            nodelist = (nodelist,)
+        for node in nodelist:
+            cfgobj = self._cfgstore['nodes'][node]
+            fmt = _ExpressionFormat(cfgobj, node)
+            yield (node, fmt.format(expression))
+
+    def get_node_attributes(self, nodelist, attributes=(), decrypt=None):
+        if decrypt is None:
+            decrypt = self.decrypt
        retdict = {}
-        relattribs = attributes
        if isinstance(nodelist, str) or isinstance(nodelist, unicode):
            nodelist = [nodelist]
+        if isinstance(attributes, str) or isinstance(attributes, unicode):
+            attributes = [attributes]
+        relattribs = attributes
        for node in nodelist:
            if node not in self._cfgstore['nodes']:
                continue
@@ -777,13 +893,17 @@ class ConfigManager(object):
                if attribute.startswith('_'):
                    # skip private things
                    continue
+                if '*' in attribute:
+                    for attr in fnmatch.filter(list(cfgnodeobj), attribute):
+                        nodeobj[attr] = _decode_attribute(attr, cfgnodeobj,
+                                                          decrypt=decrypt)
                if attribute not in cfgnodeobj:
                    continue
                # since the formatter is not passed in, the calculator is
                # skipped.  The decryption, however, we want to do only on
                # demand
                nodeobj[attribute] = _decode_attribute(attribute, cfgnodeobj,
-                                                       decrypt=self.decrypt)
+                                                       decrypt=decrypt)
            retdict[node] = nodeobj
        return retdict

@@ -793,7 +913,7 @@ class ConfigManager(object):
            groupcfg = self._cfgstore['nodegroups'][group]
        except KeyError:  # something did not exist, nothing to do
            return
-        for attrib in groupcfg.iterkeys():
+        for attrib in groupcfg:
            self._do_inheritance(nodecfg, attrib, node, changeset)
            _addchange(changeset, node, attrib)

@@ -847,7 +967,7 @@ class ConfigManager(object):
                return

    def _sync_groups_to_node(self, groups, node, changeset):
-        for group in self._cfgstore['nodegroups'].iterkeys():
+        for group in self._cfgstore['nodegroups']:
            if group not in groups:
                if node in self._cfgstore['nodegroups'][group]['nodes']:
                    self._cfgstore['nodegroups'][group]['nodes'].discard(node)
@@ -864,7 +984,7 @@ class ConfigManager(object):
            self._node_added_to_group(node, group, changeset)

    def _sync_nodes_to_group(self, nodes, group, changeset):
-        for node in self._cfgstore['nodes'].iterkeys():
+        for node in self._cfgstore['nodes']:
            if node not in nodes and 'groups' in self._cfgstore['nodes'][node]:
                if group in self._cfgstore['nodes'][node]['groups']:
                    self._cfgstore['nodes'][node]['groups'].remove(group)
@@ -885,38 +1005,51 @@ class ConfigManager(object):

    def set_group_attributes(self, attribmap, autocreate=False):
        changeset = {}
-        for group in attribmap.iterkeys():
+        for group in attribmap:
            if group == '':
                raise ValueError('"{0}" is not a valid group name'.format(
                    group))
            if not autocreate and group not in self._cfgstore['nodegroups']:
                raise ValueError("{0} group does not exist".format(group))
-            for attr in attribmap[group].iterkeys():
-                if (attr not in ('nodes', 'noderange') and
-                        (attr not in allattributes.node or
-                         ('type' in allattributes.node[attr] and
-                          not isinstance(attribmap[group][attr],
-                                         allattributes.node[attr]['type'])))):
-                    raise ValueError
+            for attr in attribmap[group]:
+                # first do a pass to normalize out any aliased attribute names
+                if attr in _attraliases:
+                    newattr = _attraliases[attr]
+                    attribmap[group][newattr] = attribmap[group][attr]
+                    del attribmap[group][attr]
+            for attr in attribmap[group]:
+                if attr in _attraliases:
+                    newattr = _attraliases[attr]
+                    attribmap[group][newattr] = attribmap[group][attr]
+                    del attribmap[group][attr]
+                if attr not in ('nodes', 'noderange'):
+                    attrval = fixup_attribute(attr, attribmap[group][attr])
+                    if attribute_is_invalid(attr, attrval):
+                        errstr = "{0} attribute is invalid".format(attrname)
+                        raise ValueError(errstr)
+                    attribmap[group][attr] = attrval
                if attr == 'nodes':
                    if not isinstance(attribmap[group][attr], list):
-                        raise ValueError(
-                            "nodes attribute on group must be list")
+                        if type(attribmap[group][attr]) is unicode or type(attribmap[group][attr]) is str:
+                            attribmap[group][attr]=attribmap[group][attr].split(",")
+                        else:
+                            raise ValueError("nodes attribute on group must be list")
                    for node in attribmap[group]['nodes']:
                        if node not in self._cfgstore['nodes']:
                            raise ValueError(
                                "{0} node does not exist to add to {1}".format(
                                    node, group))
-        for group in attribmap.iterkeys():
+        for group in attribmap:
            group = group.encode('utf-8')
            if group not in self._cfgstore['nodegroups']:
                self._cfgstore['nodegroups'][group] = {'nodes': set()}
            cfgobj = self._cfgstore['nodegroups'][group]
-            for attr in attribmap[group].iterkeys():
+            for attr in attribmap[group]:
                if attr == 'nodes':
                    newdict = set(attribmap[group][attr])
                elif (isinstance(attribmap[group][attr], str) or
-                        isinstance(attribmap[group][attr], unicode)):
+                        isinstance(attribmap[group][attr], unicode) or
+                        isinstance(attribmap[group][attr], bool)):
                    newdict = {'value': attribmap[group][attr]}
                else:
                    newdict = attribmap[group][attr]
@@ -940,6 +1073,13 @@ class ConfigManager(object):

    def clear_group_attributes(self, groups, attributes):
        changeset = {}
+        realattributes = []
+        for attrname in list(attributes):
+            if attrname in _attraliases:
+                realattributes.append(_attraliases[attrname])
+            else:
+                realattributes.append(attrname)
+        attributes = realattributes
        if type(groups) in (str, unicode):
            groups = (groups,)
        for group in groups:
@@ -994,7 +1134,7 @@ class ConfigManager(object):
            return
        notifdata = {}
        attribwatchers = self._attribwatchers[self.tenant]
-        for node in nodeattrs.iterkeys():
+        for node in nodeattrs:
            if node not in attribwatchers:
                continue
            attribwatcher = attribwatchers[node]
@@ -1007,10 +1147,21 @@ class ConfigManager(object):
                # to deletion, to make all watchers aware of the removed
                # node and take appropriate action
                checkattrs = attribwatcher
+            globattrs = {}
+            for attrglob in attribwatcher.get('_attrglobs', []):
+                for matched in fnmatch.filter(list(checkattrs), attrglob):
+                    globattrs[matched] = attrglob
            for attrname in checkattrs:
-                if attrname not in attribwatcher:
+                if attrname == '_attrglobs':
                    continue
-                for notifierid in attribwatcher[attrname].iterkeys():
+                watchkey = attrname
+                # the attrib watcher could still have a glob
+                if attrname not in attribwatcher:
+                    if attrname in globattrs:
+                        watchkey = globattrs[attrname]
+                    else:
+                        continue
+                for notifierid in attribwatcher[watchkey]:
                    if notifierid in notifdata:
                        if node in notifdata[notifierid]['nodeattrs']:
                            notifdata[notifierid]['nodeattrs'][node].append(
@@ -1021,18 +1172,12 @@ class ConfigManager(object):
                    else:
                        notifdata[notifierid] = {
                            'nodeattrs': {node: [attrname]},
-                            'callback': attribwatcher[attrname][notifierid]
+                            'callback': attribwatcher[watchkey][notifierid]
                        }
        for watcher in notifdata.itervalues():
            callback = watcher['callback']
-            try:
-                callback(nodeattribs=watcher['nodeattrs'], configmanager=self)
-            except Exception:
-                global tracelog
-                if tracelog is None:
-                    tracelog = confluent.log.Logger('trace')
-                tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
-                             event=log.Events.stacktrace)
+            eventlet.spawn_n(_do_notifier, self, watcher, callback)
+

    def del_nodes(self, nodes):
        if self.tenant in self._nodecollwatchers:
@@ -1066,6 +1211,13 @@ class ConfigManager(object):
    def clear_node_attributes(self, nodes, attributes):
        # accumulate all changes into a changeset and push in one go
        changeset = {}
+        realattributes = []
+        for attrname in list(attributes):
+            if attrname in _attraliases:
+                realattributes.append(_attraliases[attrname])
+            else:
+                realattributes.append(attrname)
+        attributes = realattributes
        for node in nodes:
            node = node.encode('utf-8')
            try:
@@ -1092,7 +1244,7 @@ class ConfigManager(object):
        self._bg_sync_to_file()

    def add_node_attributes(self, attribmap):
-        for node in attribmap.iterkeys():
+        for node in attribmap:
            if 'groups' not in attribmap[node]:
                attribmap[node]['groups'] = []
        self.set_node_attributes(attribmap, autocreate=True)
@@ -1105,23 +1257,28 @@ class ConfigManager(object):
        changeset = {}
        # first do a sanity check of the input upfront
        # this mitigates risk of arguments being partially applied
-        for node in attribmap.iterkeys():
+        for node in attribmap:
            node = node.encode('utf-8')
            if node == '':
                raise ValueError('"{0}" is not a valid node name'.format(node))
            if autocreate is False and node not in self._cfgstore['nodes']:
                raise ValueError("node {0} does not exist".format(node))
-            for attrname in attribmap[node].iterkeys():
+            for attrname in list(attribmap[node]):
+                if attrname in _attraliases:
+                    truename = _attraliases[attrname]
+                    attribmap[node][truename] = attribmap[node][attrname]
+                    del attribmap[node][attrname]
+            for attrname in attribmap[node]:
                attrval = attribmap[node][attrname]
-                if (attrname not in allattributes.node or
-                        ('type' in allattributes.node[attrname] and
-                         not isinstance(
-                             attrval,
-                             allattributes.node[attrname]['type']))):
-                    errstr = "{0} attribute on node {1} is invalid".format(
-                        attrname, node)
-                    raise ValueError(errstr)
+                try:
+                    if (allattributes.node[attrname]['type'] == 'list' and
+                            type(attrval) in (str, unicode)):
+                        attrval = attrval.split(",")
+                except KeyError:
+                    pass
                if attrname == 'groups':
+                    if type(attribmap[node]['groups']) != list:
+                        attribmap[node]['groups']=attribmap[node]['groups'].split(",")
                    for group in attribmap[node]['groups']:
                        if group not in self._cfgstore['nodegroups']:
                            raise ValueError(
@@ -1129,7 +1286,14 @@ class ConfigManager(object):
                    if ('everything' in self._cfgstore['nodegroups'] and
                            'everything' not in attribmap[node]['groups']):
                        attribmap[node]['groups'].append('everything')
-        for node in attribmap.iterkeys():
+                else:
+                    attrval = fixup_attribute(attrname, attrval)
+                    if attribute_is_invalid(attrname, attrval):
+                        errstr = "{0} attribute on node {1} is invalid".format(
+                            attrname, node)
+                        raise ValueError(errstr)
+                    attribmap[node][attrname] = attrval
+        for node in attribmap:
            node = node.encode('utf-8')
            exprmgr = None
            if node not in self._cfgstore['nodes']:
@@ -1137,9 +1301,10 @@ class ConfigManager(object):
                self._cfgstore['nodes'][node] = {}
            cfgobj = self._cfgstore['nodes'][node]
            recalcexpressions = False
-            for attrname in attribmap[node].iterkeys():
+            for attrname in attribmap[node]:
                if (isinstance(attribmap[node][attrname], str) or
-                        isinstance(attribmap[node][attrname], unicode)):
+                        isinstance(attribmap[node][attrname], unicode) or
+                        isinstance(attribmap[node][attrname], bool)):
                    newdict = {'value': attribmap[node][attrname]}
                else:
                    newdict = attribmap[node][attrname]
@@ -1173,10 +1338,76 @@ class ConfigManager(object):
            if self.tenant in self._nodecollwatchers:
                nodecollwatchers = self._nodecollwatchers[self.tenant]
                for watcher in nodecollwatchers.itervalues():
-                    watcher(added=newnodes, deleting=[], configmanager=self)
+                    eventlet.spawn_n(_do_add_watcher, watcher, newnodes, self)
        self._bg_sync_to_file()
        #TODO: wait for synchronization to suceed/fail??)

+    def _load_from_json(self, jsondata):
+        """Load fresh configuration data from jsondata
+
+        :param jsondata: String of jsondata
+        :return:
+        """
+        dumpdata = json.loads(jsondata)
+        tmpconfig = {}
+        for confarea in _config_areas:
+            if confarea not in dumpdata:
+                continue
+            tmpconfig[confarea] = {}
+            for element in dumpdata[confarea]:
+                newelement = copy.deepcopy(dumpdata[confarea][element])
+                for attribute in dumpdata[confarea][element]:
+                    if newelement[attribute] == '*REDACTED*':
+                        raise Exception(
+                            "Unable to restore from redacted backup")
+                    elif attribute == 'cryptpass':
+                        passparts = newelement[attribute].split('!')
+                        newelement[attribute] = tuple([base64.b64decode(x)
+                                                       for x in passparts])
+                    elif 'cryptvalue' in newelement[attribute]:
+                        bincrypt = newelement[attribute]['cryptvalue']
+                        bincrypt = tuple([base64.b64decode(x)
+                                          for x in bincrypt.split('!')])
+                        newelement[attribute]['cryptvalue'] = bincrypt
+                    elif attribute in ('nodes', '_expressionkeys'):
+                        # A group with nodes
+                        # delete it and defer until nodes are being added
+                        # which will implicitly fill this up
+                        # Or _expressionkeys attribute, which will similarly
+                        # be rebuilt
+                        del newelement[attribute]
+                tmpconfig[confarea][element] = newelement
+        # We made it through above section without an exception, go ahead and
+        # replace
+        # Start by erasing the dbm files if present
+        for confarea in _config_areas:
+            try:
+                os.unlink(os.path.join(self._cfgdir, confarea))
+            except OSError as e:
+                if e.errno == 2:
+                    pass
+        # Now we have to iterate through each fixed up element, using the
+        # set attribute to flesh out inheritence and expressions
+        _cfgstore['main']['idmap'] = {}
+        for confarea in _config_areas:
+            self._cfgstore[confarea] = {}
+            if confarea not in tmpconfig:
+                continue
+            if confarea == 'nodes':
+                self.set_node_attributes(tmpconfig[confarea], True)
+            elif confarea == 'nodegroups':
+                self.set_group_attributes(tmpconfig[confarea], True)
+            elif confarea == 'users':
+                for user in tmpconfig[confarea]:
+                    uid = tmpconfig[confarea].get('id', None)
+                    displayname = tmpconfig[confarea].get('displayname', None)
+                    self.create_user(user, uid=uid, displayname=displayname)
+                    if 'cryptpass' in tmpconfig[confarea][user]:
+                        self._cfgstore['users'][user]['cryptpass'] = \
+                            tmpconfig[confarea][user]['cryptpass']
+                        _mark_dirtykey('users', user, self.tenant)
+        self._bg_sync_to_file()
+
    def _dump_to_json(self, redact=None):
        """Dump the configuration in json form to output

@@ -1195,10 +1426,10 @@ class ConfigManager(object):
            if confarea not in self._cfgstore:
                continue
            dumpdata[confarea] = {}
-            for element in self._cfgstore[confarea].iterkeys():
+            for element in self._cfgstore[confarea]:
                dumpdata[confarea][element] = \
                    copy.deepcopy(self._cfgstore[confarea][element])
-                for attribute in self._cfgstore[confarea][element].iterkeys():
+                for attribute in self._cfgstore[confarea][element]:
                    if 'inheritedfrom' in dumpdata[confarea][element][attribute]:
                        del dumpdata[confarea][element][attribute]
                    elif (attribute == 'cryptpass' or
@@ -1256,6 +1487,8 @@ class ConfigManager(object):

    @classmethod
    def _bg_sync_to_file(cls):
+        if statelessmode:
+            return
        with cls._syncstate:
            if cls._syncrunning:
                cls._writepending = True
@@ -1269,6 +1502,8 @@ class ConfigManager(object):

    @classmethod
    def _sync_to_file(cls):
+        if statelessmode:
+            return
        if 'dirtyglobals' in _cfgstore:
            with _dirtylock:
                dirtyglobals = copy.deepcopy(_cfgstore['dirtyglobals'])
@@ -1289,7 +1524,7 @@ class ConfigManager(object):
            with _dirtylock:
                currdirt = copy.deepcopy(_cfgstore['dirtykeys'])
                del _cfgstore['dirtykeys']
-            for tenant in currdirt.iterkeys():
+            for tenant in currdirt:
                dkdict = currdirt[tenant]
                if tenant is None:
                    pathname = cls._cfgdir
@@ -1297,7 +1532,7 @@ class ConfigManager(object):
                else:
                    pathname = os.path.join(cls._cfgdir, 'tenants', tenant)
                    currdict = _cfgstore['tenant'][tenant]
-                for category in dkdict.iterkeys():
+                for category in dkdict:
                    _mkpath(pathname)
                    dbf = dbm.open(os.path.join(pathname, category), 'c', 384)  # 0600
                    try:
@@ -1320,7 +1555,7 @@ class ConfigManager(object):
            return cls._sync_to_file()

    def _recalculate_expressions(self, cfgobj, formatter, node, changeset):
-        for key in cfgobj.iterkeys():
+        for key in cfgobj:
            if not isinstance(cfgobj[key], dict):
                continue
            if 'expression' in cfgobj[key]:
@@ -1334,39 +1569,95 @@ class ConfigManager(object):
                self._recalculate_expressions(cfgobj[key], formatter, node,
                                              changeset)

+
+def _restore_keys(jsond, password, newpassword=None):
+    # the jsond from the restored file, password (if any) used to protect
+    # the file, and newpassword to use, (also check the service.cfg file)
+    global _masterkey
+    global _masterintegritykey
+    keydata = json.loads(jsond)
+    cryptkey = _parse_key(keydata['cryptkey'], password)
+    integritykey = _parse_key(keydata['integritykey'], password)
+    conf.init_config()
+    cfg = conf.get_config()
+    if cfg.has_option('security', 'externalcfgkey'):
+        keyfilename = cfg.get('security', 'externalcfgkey')
+        with open(keyfilename, 'r') as keyfile:
+            newpassword = keyfile.read()
+    set_global('master_privacy_key', _format_key(cryptkey,
+                                                 password=newpassword))
+    set_global('master_integrity_key', _format_key(integritykey,
+                                                   password=newpassword))
+    _masterkey = cryptkey
+    _masterintegritykey = integritykey
+    ConfigManager.wait_for_sync()
+    # At this point, we should have the key situation all sorted
+
+
 def _dump_keys(password):
    if _masterkey is None or _masterintegritykey is None:
        init_masterkey()
    cryptkey = _format_key(_masterkey, password=password)
-    cryptkey = '!'.join(map(base64.b64encode, cryptkey['passphraseprotected']))
+    if 'passphraseprotected' in cryptkey:
+        cryptkey = '!'.join(map(base64.b64encode,
+                                cryptkey['passphraseprotected']))
+    else:
+        cryptkey = '*unencrypted:{0}'.format(base64.b64encode(
+            cryptkey['unencryptedvalue']))
    integritykey = _format_key(_masterintegritykey, password=password)
-    integritykey = '!'.join(map(base64.b64encode, integritykey['passphraseprotected']))
+    if 'passphraseprotected' in integritykey:
+        integritykey = '!'.join(map(base64.b64encode,
+                                    integritykey['passphraseprotected']))
+    else:
+        integritykey = '*unencrypted:{0}'.format(base64.b64encode(
+            integritykey['unencryptedvalue']))
    return json.dumps({'cryptkey': cryptkey, 'integritykey': integritykey},
                      sort_keys=True, indent=4, separators=(',', ': '))


+def restore_db_from_directory(location, password):
+    try:
+        with open(os.path.join(location, 'keys.json'), 'r') as cfgfile:
+            keydata = cfgfile.read()
+            json.loads(keydata)
+            _restore_keys(keydata, password)
+    except IOError as e:
+        if e.errno == 2:
+            raise Exception("Cannot restore without keys, this may be a "
+                            "redacted dump")
+    with open(os.path.join(location, 'main.json'), 'r') as cfgfile:
+        cfgdata = cfgfile.read()
+        ConfigManager(tenant=None)._load_from_json(cfgdata)
+
+
 def dump_db_to_directory(location, password, redact=None):
-    with open(os.path.join(location, 'keys.json'), 'w') as cfgfile:
-        cfgfile.write(_dump_keys(password))
-        cfgfile.write('\n')
+    if not redact:
+        with open(os.path.join(location, 'keys.json'), 'w') as cfgfile:
+            cfgfile.write(_dump_keys(password))
+            cfgfile.write('\n')
    with open(os.path.join(location, 'main.json'), 'w') as cfgfile:
        cfgfile.write(ConfigManager(tenant=None)._dump_to_json(redact=redact))
        cfgfile.write('\n')
    try:
        for tenant in os.listdir(
                os.path.join(ConfigManager._cfgdir, '/tenants/')):
-            with open(os.path.join(location, tenant + '.json'), 'w') as cfgfile:
+            with open(os.path.join(location, 'tenants', tenant,
+                                   'main.json'), 'w') as cfgfile:
                cfgfile.write(ConfigManager(tenant=tenant)._dump_to_json(
                    redact=redact))
                cfgfile.write('\n')
    except OSError:
        pass

-
-try:
-    ConfigManager._read_from_path()
-except IOError:
-    _cfgstore = {}
+def init(stateless=False):
+    global _cfgstore
+    if stateless:
+        _cfgstore = {}
+        return
+    try:
+        ConfigManager._read_from_path()
+    except IOError:
+        _cfgstore = {}


 # some unit tests worth implementing:
@@ -1,6 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

 # Copyright 2014 IBM Corporation
+# Copyright 2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,6 +21,7 @@

 # we track nodes that are actively being logged, watched, or have attached
 # there should be no more than one handler per node
+import codecs
 import collections
 import confluent.config.configmanager as configmodule
 import confluent.exceptions as exc
@@ -29,6 +31,7 @@ import confluent.core as plugin
 import confluent.util as util
 import eventlet
 import eventlet.event
+import pyte
 import random
 import time
 import traceback
@@ -37,6 +40,100 @@ _handled_consoles = {}

 _tracelog = None

+try:
+    range = xrange
+except NameError:
+    pass
+
+pytecolors2ansi = {
+    'black': 0,
+    'red': 1,
+    'green': 2,
+    'brown': 3,
+    'blue': 4,
+    'magenta': 5,
+    'cyan': 6,
+    'white': 7,
+    'default': 9,
+}
+# might be able to use IBMPC map from pyte charsets,
+# in that case, would have to mask out certain things (like ESC)
+# in the same way that Screen's draw method would do
+# for now at least get some of the arrows in there (note ESC is one
+# of those arrows... so skip it...
+ansichars = dict(zip((0x18, 0x19), u'\u2191\u2193'))
+
+
+def _utf8_normalize(data, shiftin, decoder):
+    # first we give the stateful decoder a crack at the byte stream,
+    # we may come up empty in the event of a partial multibyte
+    try:
+        data = decoder.decode(data)
+    except UnicodeDecodeError:
+        # first order of business is to reset the state of
+        # the decoder to a clean one, so we can switch back to utf-8
+        # when things change, for example going from an F1 setup menu stuck
+        # in the old days to a modern platform using utf-8
+        decoder.setstate(codecs.getincrementaldecoder('utf-8')().getstate())
+        # Ok, so we have something that is not valid UTF-8,
+        # our next stop is to try CP437.  We don't try incremental
+        # decode, since cp437 is single byte
+        # replace is silly here, since there does not exist invalid c437,
+        # but just in case
+        data = data.decode('cp437', 'replace')
+    # Finally, the low part of ascii is valid utf-8, but we are going to be
+    # more interested in the cp437 versions (since this is console *output*
+    # not input
+    if shiftin is None:
+        data = data.translate(ansichars)
+    return data.encode('utf-8')
+
+
+def pytechars2line(chars, maxlen=None):
+    line = '\x1b[m'  # start at default params
+    lb = False  # last bold
+    li = False  # last italic
+    lu = False  # last underline
+    ls = False  # last strikethrough
+    lr = False  # last reverse
+    lfg = 'default'  # last fg color
+    lbg = 'default'   # last bg color
+    hasdata = False
+    len = 1
+    for charidx in range(maxlen):
+        char = chars[charidx]
+        csi = []
+        if char.fg != lfg:
+            csi.append(30 + pytecolors2ansi[char.fg])
+            lfg = char.fg
+        if char.bg != lbg:
+            csi.append(40 + pytecolors2ansi[char.bg])
+            lbg = char.bg
+        if char.bold != lb:
+            lb = char.bold
+            csi.append(1 if lb else 22)
+        if char.italics != li:
+            li = char.italics
+            csi.append(3 if li else 23)
+        if char.underscore != lu:
+            lu = char.underscore
+            csi.append(4 if lu else 24)
+        if char.strikethrough != ls:
+            ls = char.strikethrough
+            csi.append(9 if ls else 29)
+        if char.reverse != lr:
+            lr = char.reverse
+            csi.append(7 if lr else 27)
+        if csi:
+            line += b'\x1b[' + b';'.join(['{0}'.format(x) for x in csi]) + b'm'
+        if not hasdata and char.data.encode('utf-8').rstrip():
+            hasdata = True
+        line += char.data.encode('utf-8')
+        if maxlen and len >= maxlen:
+            break
+        len += 1
+    return line, hasdata
+

 class ConsoleHandler(object):
    _plugin_path = '/nodes/{0}/_console/session'
@@ -44,6 +141,7 @@ class ConsoleHandler(object):
    _genwatchattribs = frozenset(('console.method', 'console.logging'))

    def __init__(self, node, configmanager):
+        self.clearpending = False
        self._dologging = True
        self._isondemand = False
        self.error = None
@@ -51,14 +149,15 @@ class ConsoleHandler(object):
        self.node = node
        self.connectstate = 'unconnected'
        self._isalive = True
-        self.buffer = bytearray()
+        self.buffer = pyte.Screen(100, 31)
+        self.termstream = pyte.ByteStream()
+        self.termstream.attach(self.buffer)
        self.livesessions = set([])
+        self.utf8decoder = codecs.getincrementaldecoder('utf-8')()
        if self._logtobuffer:
            self.logger = log.Logger(node, console=True,
                                     tenant=configmanager.tenant)
-            (text, termstate, timestamp) = self.logger.read_recent_text(8192)
-        else:
-            (text, termstate, timestamp) = ('', 0, False)
+        (text, termstate, timestamp) = (b'', 0, False)
        # when reading from log file, we will use wall clock
        # it should usually match walltime.
        self.lasttime = 0
@@ -70,7 +169,7 @@ class ConsoleHandler(object):
                # wall clock has gone backwards, use current time as best
                # guess
                self.lasttime = util.monotonic_time()
-        self.buffer += text
+        self.clearbuffer()
        self.appmodedetected = False
        self.shiftin = None
        self.reconnect = None
@@ -91,6 +190,16 @@ class ConsoleHandler(object):
            self.connectstate = 'connecting'
            eventlet.spawn(self._connect)

+    def feedbuffer(self, data):
+        try:
+            self.termstream.feed(data)
+        except StopIteration:  # corrupt parser state, start over
+            self.termstream = pyte.ByteStream()
+            self.termstream.attach(self.buffer)
+        except Exception:
+            _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
+                          event=log.Events.stacktrace)
+
    def check_isondemand(self):
        self._dologging = True
        attrvalue = self.cfgmgr.get_node_attributes(
@@ -99,11 +208,12 @@ class ConsoleHandler(object):
            self._isondemand = False
        elif 'console.logging' not in attrvalue[self.node]:
            self._isondemand = False
-        elif (attrvalue[self.node]['console.logging']['value'] not in (
-                'full', '')):
-            self._isondemand = True
-        elif (attrvalue[self.node]['console.logging']['value']) == 'none':
-            self._dologging = False
+        else:
+            if (attrvalue[self.node]['console.logging']['value'] not in (
+                'full', '', 'buffer')):
+                self._isondemand = True
+            if (attrvalue[self.node]['console.logging']['value']) in ('none', 'memory'):
+                self._dologging = False

    def get_buffer_age(self):
        """Return age of buffered data
@@ -138,7 +248,7 @@ class ConsoleHandler(object):
                    return
            else:
                self._ondemand()
-                if logvalue == 'none':
+                if logvalue in ('none', 'memory'):
                    self._dologging = False
        if not self._isondemand or self.livesessions:
            eventlet.spawn(self._connect)
@@ -157,10 +267,18 @@ class ConsoleHandler(object):
        else:
            self._console.ping()

+    def clearbuffer(self):
+        self.feedbuffer(
+            '\x1bc[no replay buffer due to console.logging attribute set to '
+            'none or interactive,\r\nconnection loss, or service restart]')
+        self.clearpending = True
+
    def _disconnect(self):
        if self.connectionthread:
            self.connectionthread.kill()
            self.connectionthread = None
+        # clear the terminal buffer when disconnected
+        self.clearbuffer()
        if self._console:
            self.log(
                logdata='console disconnected', ltype=log.DataTypes.event,
@@ -194,10 +312,13 @@ class ConsoleHandler(object):
            self._console = plugin.handle_path(
                self._plugin_path.format(self.node),
                "create", self.cfgmgr)
+        except (exc.NotImplementedException, exc.NotFoundException):
+            self._console = None
        except:
            _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
                          event=log.Events.stacktrace)
        if not isinstance(self._console, conapi.Console):
+            self.clearbuffer()
            self.connectstate = 'unconnected'
            self.error = 'misconfigured'
            self._send_rcpts({'connectstate': self.connectstate,
@@ -217,6 +338,7 @@ class ConsoleHandler(object):
        try:
            self._console.connect(self.get_console_output)
        except exc.TargetEndpointBadCredentials:
+            self.clearbuffer()
            self.error = 'badcredentials'
            self.connectstate = 'unconnected'
            self._send_rcpts({'connectstate': self.connectstate,
@@ -226,6 +348,7 @@ class ConsoleHandler(object):
                self.reconnect = eventlet.spawn_after(retrytime, self._connect)
            return
        except exc.TargetEndpointUnreachable:
+            self.clearbuffer()
            self.error = 'unreachable'
            self.connectstate = 'unconnected'
            self._send_rcpts({'connectstate': self.connectstate,
@@ -235,6 +358,7 @@ class ConsoleHandler(object):
                self.reconnect = eventlet.spawn_after(retrytime, self._connect)
            return
        except Exception:
+            self.clearbuffer()
            _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
                          event=log.Events.stacktrace)
            self.error = 'unknown'
@@ -255,11 +379,13 @@ class ConsoleHandler(object):
        self._send_rcpts({'connectstate': self.connectstate})

    def _got_disconnected(self):
-        self.connectstate = 'unconnected'
-        self.log(
-            logdata='console disconnected', ltype=log.DataTypes.event,
-            event=log.Events.consoledisconnect)
-        self._send_rcpts({'connectstate': self.connectstate})
+        self.clearbuffer()
+        if self.connectstate != 'unconnected':
+            self.connectstate = 'unconnected'
+            self.log(
+                logdata='console disconnected', ltype=log.DataTypes.event,
+                event=log.Events.consoledisconnect)
+            self._send_rcpts({'connectstate': self.connectstate})
        if self._isalive:
            self._connect()

@@ -275,12 +401,6 @@ class ConsoleHandler(object):
            self.connectionthread.kill()
            self.connectionthread = None

-    def flushbuffer(self):
-        # Logging is handled in a different stream
-        # this buffer is now just for having screen redraw on
-        # connect
-        self.buffer = bytearray(self.buffer[-8192:])
-
    def get_console_output(self, data):
        # Spawn as a greenthread, return control as soon as possible
        # to the console object
@@ -351,19 +471,18 @@ class ConsoleHandler(object):
            eventdata |= 2
        self.log(data, eventdata=eventdata)
        self.lasttime = util.monotonic_time()
-        if isinstance(data, bytearray) or isinstance(data, bytes):
-            self.buffer += data
-        else:
-            self.buffer += data.encode('utf-8')
+        self.feedbuffer(data)
        # TODO: analyze buffer for registered events, examples:
        #   panics
        #   certificate signing request
-        if len(self.buffer) > 16384:
-            self.flushbuffer()
-        self._send_rcpts(data)
+        if self.clearpending:
+            self.clearpending = False
+            self.feedbuffer(b'\x1bc')
+            self._send_rcpts(b'\x1bc')
+        self._send_rcpts(_utf8_normalize(data, self.shiftin, self.utf8decoder))

    def _send_rcpts(self, data):
-        for rcpt in self.livesessions:
+        for rcpt in list(self.livesessions):
            try:
                rcpt.data_handler(data)
            except:  # No matter the reason, advance to next recipient
@@ -382,7 +501,26 @@ class ConsoleHandler(object):
            'connectstate': self.connectstate,
            'clientcount': len(self.livesessions),
        }
-        retdata = ''
+        retdata = b'\x1b[H\x1b[J'  # clear screen
+        pendingbl = b''  # pending blank lines
+        maxlen = 0
+        for line in self.buffer.display:
+            line = line.rstrip()
+            if len(line) > maxlen:
+                maxlen = len(line)
+        for line in range(self.buffer.lines):
+            nline, notblank = pytechars2line(self.buffer.buffer[line], maxlen)
+            if notblank:
+                if pendingbl:
+                    retdata += pendingbl
+                    pendingbl = b''
+                retdata += nline + '\r\n'
+            else:
+                pendingbl += nline + '\r\n'
+        if len(retdata) >  6:
+            retdata = retdata[:-2]  # remove the last \r\n
+        retdata += b'\x1b[{0};{1}H'.format(self.buffer.cursor.y + 1,
+                                           self.buffer.cursor.x + 1)
        if self.shiftin is not None:  # detected that terminal requested a
            # shiftin character set, relay that to the terminal that cannected
            retdata += '\x1b)' + self.shiftin
@@ -390,27 +528,16 @@ class ConsoleHandler(object):
            retdata += '\x1b[?1h'
        else:
            retdata += '\x1b[?1l'
-        # an alternative would be to emulate a VT100 to know what the
-        # whole screen would look like
-        # this is one scheme to clear screen, move cursor then clear
-        bufidx = self.buffer.rfind('\x1b[H\x1b[J')
-        if bufidx >= 0:
-            return retdata + str(self.buffer[bufidx:]), connstate
-        # another scheme is the 2J scheme
-        bufidx = self.buffer.rfind('\x1b[2J')
-        if bufidx >= 0:
-            # there was some sort of clear screen event
-            # somewhere in the buffer, replay from that point
-            # in hopes that it reproduces the screen
-            return retdata + str(self.buffer[bufidx:]), connstate
-        else:
-            # we have no indication of last erase, play back last kibibyte
-            #  to give some sense of context anyway
-            return retdata + str(self.buffer[-1024:]), connstate
+        return retdata, connstate

    def write(self, data):
        if self.connectstate == 'connected':
-            self._console.write(data)
+            try:
+                self._console.write(data)
+            except Exception:
+                _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
+                              event=log.Events.stacktrace)
+                self._got_disconnected()


 def disconnect_node(node, configmanager):
@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

 # Copyright 2014 IBM Corporation
-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -33,11 +33,14 @@
 # functions.  Console is special and just get's passed through
 # see API.txt

+import confluent
 import confluent.alerts as alerts
 import confluent.config.attributes as attrscheme
+import confluent.discovery.core as disco
 import confluent.interface.console as console
 import confluent.exceptions as exc
 import confluent.messages as msg
+import confluent.networking.macmap as macmap
 import confluent.noderange as noderange
 try:
    import confluent.shellmodule as shellmodule
@@ -78,7 +81,7 @@ def load_plugins():
        plugindir = os.path.join(plugintop, plugindir)
        if not os.path.isdir(plugindir):
            continue
-        sys.path.append(plugindir)
+        sys.path.insert(1, plugindir)
        # two passes, to avoid adding both py and pyc files
        for plugin in os.listdir(plugindir):
            if plugin.startswith('.'):
@@ -96,9 +99,12 @@ def load_plugins():
                    pluginmap[name] = tmpmod
            else:
                pluginmap[plugin] = tmpmod
+        # restore path to not include the plugindir
+        sys.path.pop(1)


-rootcollections = ['noderange/', 'nodes/', 'nodegroups/', 'users/', 'events/']
+rootcollections = ['discovery/', 'events/', 'networking/',
+                   'noderange/', 'nodes/', 'nodegroups/', 'users/', 'version']


 class PluginRoute(object):
@@ -120,6 +126,7 @@ def _init_core():
        'attributes': {
            'all': PluginRoute({'handler': 'attributes'}),
            'current': PluginRoute({'handler': 'attributes'}),
+            'expression': PluginRoute({'handler': 'attributes'}),
        },
        'boot': {
            'nextdevice': PluginRoute({
@@ -178,6 +185,11 @@ def _init_core():
                'handler': 'ssh',
            }),
        },
+        '_enclosure': {
+            'reseat_bay': PluginRoute(
+                {'pluginattrs': ['hardwaremanagement.method'],
+                 'default': 'ipmi'}),
+        },
        'shell': {
            # another special case similar to console
            'sessions': PluginCollection({
@@ -204,6 +216,10 @@ def _init_core():
                }),
            },
        },
+        #'forward': {
+        #    # Another dummy value, currently only for the gui
+        #    'web': None,
+        #},
        'health': {
            'hardware': PluginRoute({
                'pluginattrs': ['hardwaremanagement.method'],
@@ -226,6 +242,12 @@ def _init_core():
                    'pluginattrs': ['hardwaremanagement.method'],
                    'default': 'ipmi',
                }),
+                'updates': {
+                    'active': PluginCollection({
+                            'pluginattrs': ['hardwaremanagement.method'],
+                            'default': 'ipmi',
+                    }),
+                },
            },
        },
        'power': {
@@ -233,6 +255,7 @@ def _init_core():
                'pluginattrs': ['hardwaremanagement.method'],
                'default': 'ipmi',
            }),
+            'reseat':  PluginRoute({'handler': 'enclosure'}),
        },
        'sensors': {
            'hardware': {
@@ -240,6 +263,10 @@ def _init_core():
                    'pluginattrs': ['hardwaremanagement.method'],
                    'default': 'ipmi',
                }),
+                'energy': PluginCollection({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
                'temperature': PluginCollection({
                    'pluginattrs': ['hardwaremanagement.method'],
                    'default': 'ipmi',
@@ -319,10 +346,12 @@ def iterate_collections(iterable, forcecollection=True):


 def iterate_resources(fancydict):
-    for resource in fancydict.iterkeys():
+    for resource in fancydict:
        if resource.startswith("_"):
            continue
-        if not isinstance(fancydict[resource], PluginRoute):  # a resource
+        if resource == 'abbreviate':
+            pass
+        elif not isinstance(fancydict[resource], PluginRoute):  # a resource
            resource += '/'
        yield msg.ChildCollection(resource)

@@ -341,11 +370,14 @@ def delete_nodegroup_collection(collectionpath, configmanager):
        raise Exception("Not implemented")


-def delete_node_collection(collectionpath, configmanager):
+def delete_node_collection(collectionpath, configmanager, isnoderange):
    if len(collectionpath) == 2:  # just node
-        node = collectionpath[-1]
-        configmanager.del_nodes([node])
-        yield msg.DeletedResource(node)
+        nodes = [collectionpath[-1]]
+        if isnoderange:
+            nodes = noderange.NodeRange(nodes[0], configmanager).nodes
+        configmanager.del_nodes(nodes)
+        for node in nodes:
+            yield msg.DeletedResource(node)
    else:
        raise Exception("Not implemented")

@@ -353,7 +385,8 @@ def delete_node_collection(collectionpath, configmanager):
 def enumerate_nodegroup_collection(collectionpath, configmanager):
    nodegroup = collectionpath[1]
    if not configmanager.is_nodegroup(nodegroup):
-        raise exc.NotFoundException("Invalid element requested")
+        raise exc.NotFoundException(
+            'Invalid nodegroup: {0} not found'.format(nodegroup))
    del collectionpath[0:2]
    collection = nested_lookup(nodegroupresources, collectionpath)
    return iterate_resources(collection)
@@ -373,6 +406,7 @@ def enumerate_node_collection(collectionpath, configmanager):
    collection = nested_lookup(noderesources, collectionpath[2:])
    if len(collectionpath) == 2 and collectionpath[0] == 'noderange':
        collection['nodes'] = {}
+        collection['abbreviate'] = {}
    if not isinstance(collection, dict):
        raise exc.NotFoundException("Invalid element requested")
    return iterate_resources(collection)
@@ -389,6 +423,7 @@ def create_group(inputdata, configmanager):
        configmanager.add_group_attributes(attribmap)
    except ValueError as e:
        raise exc.InvalidArgumentException(str(e))
+    yield msg.CreatedResource(groupname)


 def create_node(inputdata, configmanager):
@@ -402,6 +437,25 @@ def create_node(inputdata, configmanager):
        configmanager.add_node_attributes(attribmap)
    except ValueError as e:
        raise exc.InvalidArgumentException(str(e))
+    yield msg.CreatedResource(nodename)
+
+
+def create_noderange(inputdata, configmanager):
+    try:
+        noder = inputdata['name']
+        del inputdata['name']
+        attribmap = {}
+        for node in noderange.NodeRange(noder).nodes:
+            attribmap[node] = inputdata
+    except KeyError:
+        raise exc.InvalidArgumentException('name not specified')
+    try:
+        configmanager.add_node_attributes(attribmap)
+    except ValueError as e:
+        raise exc.InvalidArgumentException(str(e))
+    for node in attribmap:
+        yield msg.CreatedResource(node)
+


 def enumerate_collections(collections):
@@ -416,7 +470,7 @@ def handle_nodegroup_request(configmanager, inputdata,
    if len(pathcomponents) < 2:
        if operation == "create":
            inputdata = msg.InputAttributes(pathcomponents, inputdata)
-            create_group(inputdata.attribs, configmanager)
+            return create_group(inputdata.attribs, configmanager)
        allgroups = list(configmanager.get_groups())
        try:
            allgroups.sort(key=noderange.humanify_nodename)
@@ -455,6 +509,26 @@ def handle_nodegroup_request(configmanager, inputdata,
    raise Exception("unknown case encountered")


+class BadPlugin(object):
+    def __init__(self, node, plugin):
+        self.node = node
+        self.plugin = plugin
+
+    def error(self, *args, **kwargs):
+        yield msg.ConfluentNodeError(
+            self.node, self.plugin + ' is not a supported plugin')
+
+
+def abbreviate_noderange(configmanager, inputdata, operation):
+    if operation != 'create':
+        raise exc.InvalidArgumentException('Must be a create with nodes in list')
+    if 'nodes' not in inputdata:
+        raise exc.InvalidArgumentException('Must be given list of nodes under key named nodes')
+    if isinstance(inputdata['nodes'], str) or isinstance(inputdata['nodes'], unicode):
+        inputdata['nodes'] = inputdata['nodes'].split(',')
+    return (msg.KeyValueData({'noderange': noderange.ReverseNodeRange(inputdata['nodes'], configmanager).noderange}),)
+
+
 def handle_node_request(configmanager, inputdata, operation,
                        pathcomponents, autostrip=True):
    iscollection = False
@@ -467,6 +541,8 @@ def handle_node_request(configmanager, inputdata, operation,
            # facility anyway
            isnoderange = False
            pathcomponents = pathcomponents[2:]
+        elif len(pathcomponents) == 3 and pathcomponents[2] == 'abbreviate':
+            return abbreviate_noderange(configmanager, inputdata, operation)
        else:
            isnoderange = True
    else:
@@ -475,7 +551,8 @@ def handle_node_request(configmanager, inputdata, operation,
        nodeorrange = pathcomponents[1]
        if not isnoderange and not configmanager.is_node(nodeorrange):
            raise exc.NotFoundException("Invalid Node")
-        if isnoderange:
+        if isnoderange and not (len(pathcomponents) == 3 and
+                                        pathcomponents[2] == 'abbreviate'):
            try:
                nodes = noderange.NodeRange(nodeorrange, configmanager).nodes
            except Exception as e:
@@ -486,11 +563,14 @@ def handle_node_request(configmanager, inputdata, operation,
        # this is enumerating a list of nodes or just empty noderange
        if isnoderange and operation == "retrieve":
            return iterate_collections([])
+        elif isnoderange and operation == "create":
+            inputdata = msg.InputAttributes(pathcomponents, inputdata)
+            return create_noderange(inputdata.attribs, configmanager)
        elif isnoderange or operation == "delete":
            raise exc.InvalidArgumentException()
        if operation == "create":
            inputdata = msg.InputAttributes(pathcomponents, inputdata)
-            create_node(inputdata.attribs, configmanager)
+            return create_node(inputdata.attribs, configmanager)
        allnodes = list(configmanager.list_nodes())
        try:
            allnodes.sort(key=noderange.humanify_nodename)
@@ -521,7 +601,8 @@ def handle_node_request(configmanager, inputdata, operation,
            raise exc.InvalidArgumentException('Custom interface required for resource')
    if iscollection:
        if operation == "delete":
-            return delete_node_collection(pathcomponents, configmanager)
+            return delete_node_collection(pathcomponents, configmanager,
+                                          isnoderange)
        elif operation == "retrieve":
            return enumerate_node_collection(pathcomponents, configmanager)
        else:
@@ -530,7 +611,8 @@ def handle_node_request(configmanager, inputdata, operation,
    passvalues = []
    plugroute = routespec.routeinfo
    inputdata = msg.get_input_message(
-        pathcomponents, operation, inputdata, nodes, isnoderange)
+        pathcomponents, operation, inputdata, nodes, isnoderange,
+        configmanager)
    if 'handler' in plugroute:  # fixed handler definition, easy enough
        if isinstance(plugroute['handler'], str):
            hfunc = getattr(pluginmap[plugroute['handler']], operation)
@@ -558,7 +640,11 @@ def handle_node_request(configmanager, inputdata, operation,
                if attrname in nodeattr[node]:
                    plugpath = nodeattr[node][attrname]['value']
            if plugpath is not None:
-                hfunc = getattr(pluginmap[plugpath], operation)
+                try:
+                    hfunc = getattr(pluginmap[plugpath], operation)
+                except KeyError:
+                    nodesbyhandler[BadPlugin(node, plugpath).error] = [node]
+                    continue
                if hfunc in nodesbyhandler:
                    nodesbyhandler[hfunc].append(node)
                else:
@@ -570,11 +656,28 @@ def handle_node_request(configmanager, inputdata, operation,
                inputdata=inputdata))
        if isnoderange or not autostrip:
            return itertools.chain(*passvalues)
-        elif isinstance(passvalues[0], console.Console):
-            return passvalues[0]
        else:
-            return stripnode(passvalues[0], nodes[0])
+            if len(passvalues) > 0:
+                if isinstance(passvalues[0], console.Console):
+                    return passvalues[0]
+                else:
+                    return stripnode(passvalues[0], nodes[0])
+            else:
+                raise exc.NotImplementedException()

+        # elif isinstance(passvalues[0], console.Console):
+        #     return passvalues[0]
+        # else:
+        #     return stripnode(passvalues[0], nodes[0])
+
+
+def handle_discovery(pathcomponents, operation, configmanager, inputdata):
+    if pathcomponents[0] == 'detected':
+        pass
+
+def handle_discovery(pathcomponents, operation, configmanager, inputdata):
+    if pathcomponents[0] == 'detected':
+        pass

 def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
    """Given a full path request, return an object.
@@ -600,6 +703,14 @@ def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
        # single node request of some sort
        return handle_node_request(configmanager, inputdata,
                                   operation, pathcomponents, autostrip)
+    elif pathcomponents[0] == 'discovery':
+        return disco.handle_api_request(
+            configmanager, inputdata, operation, pathcomponents)
+    elif pathcomponents[0] == 'networking':
+        return macmap.handle_api_request(
+            configmanager, inputdata, operation, pathcomponents)
+    elif pathcomponents[0] == 'version':
+        return (msg.Attributes(kv={'version': confluent.__version__}),)
    elif pathcomponents[0] == 'users':
        # TODO: when non-administrator accounts exist,
        # they must only be allowed to see their own user
@@ -608,7 +719,8 @@ def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
        except IndexError:  # it's just users/
            if operation == 'create':
                inputdata = msg.get_input_message(
-                    pathcomponents, operation, inputdata)
+                    pathcomponents, operation, inputdata,
+                    configmanager=configmanager)
                create_user(inputdata.attribs, configmanager)
            return iterate_collections(configmanager.list_users(),
                                       forcecollection=False)
@@ -620,7 +732,8 @@ def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
            return delete_user(user, configmanager)
        elif operation == 'update':
            inputdata = msg.get_input_message(
-                pathcomponents, operation, inputdata)
+                pathcomponents, operation, inputdata,
+                configmanager=configmanager)
            update_user(user, inputdata.attribs, configmanager)
            return show_user(user, configmanager)
    elif pathcomponents[0] == 'events':
@@ -634,5 +747,8 @@ def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
            raise exc.NotFoundException()
        if operation == 'update':
            return alerts.decode_alert(inputdata, configmanager)
+    elif pathcomponents[0] == 'discovery':
+        return handle_discovery(pathcomponents[1:], operation, configmanager,
+                                inputdata)
    else:
        raise exc.NotFoundException()
@@ -0,0 +1,981 @@
+# Copyright 2016-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This manages the detection and auto-configuration of nodes.
+# Discovery sources may implement scans and may be passive or may provide
+# both.
+
+# The phases and actions:
+# - Detect - Notice the existance of a potentially supported target
+#        - Potentially apply a secure replacement for default credential
+#           (perhaps using some key identifier combined with some string
+#            denoting temporary use, and use confluent master integrity key
+#            to generate a password in a formulaic way?)
+#       - Do some universal reconfiguration if applicable (e.g. if something is
+#         part of an enclosure with an optionally enabled enclosure manager,
+#         check and request enclosure manager enablement
+#       - Throughout all of this, at this phase no sensitive data is divulged,
+#         only using credentials that are factory default or equivalent to
+#         factory default
+#       - Request transition to Locate
+# - Locate - Use available cues to ascertain the physical location.  This may
+#         be mac address lookup through switch or correlated by a server
+#         enclosure manager.  If the location data suggests a node identity,
+#         then proceed to the 'verify' state
+# - Verify - Given the current information and candidate upstream verifier,
+#            verify the authenticity of the servers claim in an automated way
+#            if possible.  A few things may happen at this juncture
+#               - Verification outright fails (confirmed negative response)
+#                    - Audit log entry created, element is not *allowed* to
+#                      proceed
+#               - Verification not possible (neither good or bad)
+#                   - If security policy is set to low, proceed to 'Manage'
+#                   - Otherwise, log the detection event and stop (user
+#                     would then manually bless the endpoint if applicable
+#               - Verification succeeds
+#                   - If security policy is set to strict (or manual, whichever
+#                     word works best, note the successfull verification, but
+#                     do not manage
+#                   - Otherwise, proceed to 'Manage'
+#  -Pre-configure - Given data up to this point, try to do some pre-config.
+#                   For example, if located and X, then check for S, enable S
+#                   This happens regardless of verify, as verify may depend on
+#                   S
+#  - Manage
+#     - Create the node if autonode (Deferred)
+#     - If there is not a defined ip address, collect the current LLA and use
+#       that value.
+#     - If no username/password defined, generate a unique password, 20 bytes
+#       long, written to pass most complexity rules (15 random bytes, base64,
+#       retry until uppercase, lowercase, digit, and symbol all present)
+#     - Apply defined configuration to endpoint
+
+import confluent.config.configmanager as cfm
+import confluent.discovery.protocols.pxe as pxe
+#import confluent.discovery.protocols.ssdp as ssdp
+import confluent.discovery.protocols.slp as slp
+import confluent.discovery.handlers.imm as imm
+import confluent.discovery.handlers.pxe as pxeh
+import confluent.discovery.handlers.smm as smm
+import confluent.discovery.handlers.xcc as xcc
+import confluent.exceptions as exc
+import confluent.log as log
+import confluent.messages as msg
+import confluent.networking.macmap as macmap
+import confluent.noderange as noderange
+import confluent.util as util
+import traceback
+
+import eventlet
+import eventlet.greenpool
+import eventlet.semaphore
+
+class nesteddict(dict):
+
+    def __missing__(self, key):
+        v = self[key] = nesteddict()
+        return v
+
+nodehandlers = {
+    'service:lenovo-smm': smm,
+    'service:management-hardware.Lenovo:lenovo-xclarity-controller': xcc,
+    'service:management-hardware.IBM:integrated-management-module2': imm,
+    'pxe-client': pxeh,
+}
+
+servicenames = {
+    'pxe-client': 'pxe-client',
+    'service:lenovo-smm': 'lenovo-smm',
+    'service:management-hardware.Lenovo:lenovo-xclarity-controller': 'lenovo-xcc',
+    'service:management-hardware.IBM:integrated-management-module2': 'lenovo-imm2',
+}
+
+servicebyname = {
+    'pxe-client': 'pxe-client',
+    'lenovo-smm': 'service:lenovo-smm',
+    'lenovo-xcc': 'service:management-hardware.Lenovo:lenovo-xclarity-controller',
+    'lenovo-imm2': 'service:management-hardware.IBM:integrated-management-module2',
+}
+
+discopool = eventlet.greenpool.GreenPool(500)
+runningevals = {}
+# Passive-only auto-detection protocols:
+# PXE
+
+# Both passive and active
+# SLP (passive mode listens for SLP DA and unicast interrogation of the system)
+# mDNS
+# SSD
+
+# Also there are location providers
+# Switch
+# chassis
+# chassis may in turn describe more chassis
+
+# We normalize discovered node data to the following pieces of information:
+# * Detected node name (if available, from switch discovery or similar or
+#   auto generated node name.
+# * Model number
+# * Model name
+# * Serial number
+# * System UUID (in x86 space, specifically whichever UUID would be in DMI)
+# * Network interfaces and addresses
+# * Switch connectivity information
+# * enclosure information
+# * Management TLS fingerprint if validated (switch publication or enclosure)
+# * System TLS fingerprint if validated (switch publication or system manager)
+
+
+#TODO: by serial, by uuid, by node
+known_info = {}
+known_services = {}
+known_serials = {}
+known_uuids = nesteddict()
+known_nodes = nesteddict()
+unknown_info = {}
+pending_nodes = {}
+
+
+def enrich_pxe_info(info):
+    sn = None
+    mn = None
+    nodename = info.get('nodename', None)
+    uuid = info.get('uuid', '')
+    if not uuid_is_valid(uuid):
+        return info
+    for mac in known_uuids.get(uuid, {}):
+        if not sn and 'serialnumber' in known_uuids[uuid][mac]:
+            info['serialnumber'] = known_uuids[uuid][mac]['serialnumber']
+        if not mn and 'modelnumber' in known_uuids[uuid][mac]:
+            info['modelnumber'] = known_uuids[uuid][mac]['modelnumber']
+        if nodename is None and 'nodename' in known_uuids[uuid][mac]:
+            info['nodename'] = known_uuids[uuid][mac]['nodename']
+
+
+
+def uuid_is_valid(uuid):
+    if not uuid:
+        return False
+    return uuid.lower() not in ('00000000-0000-0000-0000-000000000000',
+                                'ffffffff-ffff-ffff-ffff-ffffffffffff',
+                                '00112233-4455-6677-8899-aabbccddeeff',
+                                '20202020-2020-2020-2020-202020202020')
+
+
+def send_discovery_datum(info):
+    addresses = info.get('addresses', [])
+    if info['handler'] == pxeh:
+        enrich_pxe_info(info)
+    yield msg.KeyValueData({'nodename': info.get('nodename', '')})
+    yield msg.KeyValueData({'ipaddrs': [x[0] for x in addresses]})
+    sn = info.get('serialnumber', '')
+    mn = info.get('modelnumber', '')
+    uuid = info.get('uuid', '')
+    if uuid:
+        relatedmacs = []
+        for mac in known_uuids.get(uuid, {}):
+            if mac and mac != info.get('hwaddr', ''):
+                relatedmacs.append(mac)
+        if relatedmacs:
+            yield msg.KeyValueData({'relatedmacs': relatedmacs})
+    yield msg.KeyValueData({'serialnumber': sn})
+    yield msg.KeyValueData({'modelnumber': mn})
+    yield msg.KeyValueData({'uuid': uuid})
+    if 'enclosure.bay' in info:
+        yield msg.KeyValueData({'bay': int(info['enclosure.bay'])})
+    yield msg.KeyValueData({'macs': [info.get('hwaddr', '')]})
+    types = []
+    for infotype in info.get('services', []):
+        if infotype in servicenames:
+            types.append(servicenames[infotype])
+    yield msg.KeyValueData({'types': types})
+
+
+def _info_matches(info, criteria):
+    model = criteria.get('by-model', None)
+    devtype = criteria.get('by-type', None)
+    node = criteria.get('by-node', None)
+    serial = criteria.get('by-serial', None)
+    status = criteria.get('by-state', None)
+    uuid = criteria.get('by-uuid', None)
+    if model and info.get('modelnumber', None) != model:
+        return False
+    if devtype and devtype not in info.get('services', []):
+            return False
+    if node and info.get('nodename', None) != node:
+        return False
+    if serial and info.get('serialnumber', None) != serial:
+        return False
+    if status and info.get('discostatus', None) != status:
+        return False
+    if uuid and info.get('uuid', None) != uuid:
+        return False
+    return True
+
+
+def list_matching_nodes(criteria):
+    retnodes = []
+    for node in known_nodes:
+        for mac in known_nodes[node]:
+            info = known_info[mac]
+            if _info_matches(info, criteria):
+                retnodes.append(node)
+                break
+    retnodes.sort(key=noderange.humanify_nodename)
+    return [msg.ChildCollection(node + '/') for node in retnodes]
+
+
+def list_matching_serials(criteria):
+    for serial in sorted(list(known_serials)):
+        info = known_serials[serial]
+        if _info_matches(info, criteria):
+            yield msg.ChildCollection(serial + '/')
+
+def list_matching_uuids(criteria):
+    for uuid in sorted(list(known_uuids)):
+        for mac in known_uuids[uuid]:
+            info = known_uuids[uuid][mac]
+            if _info_matches(info, criteria):
+                yield msg.ChildCollection(uuid + '/')
+                break
+
+
+def list_matching_states(criteria):
+    return [msg.ChildCollection(x) for x in ('discovered/', 'identified/',
+                                             'unidentified/')]
+
+def list_matching_macs(criteria):
+    for mac in sorted(list(known_info)):
+        info = known_info[mac]
+        if _info_matches(info, criteria):
+            yield msg.ChildCollection(mac.replace(':', '-'))
+
+
+def list_matching_types(criteria):
+    rettypes = []
+    for infotype in known_services:
+        typename = servicenames[infotype]
+        if ('by-model' not in criteria or
+                criteria['by-model'] in known_services[infotype]):
+            rettypes.append(typename)
+    return [msg.ChildCollection(typename + '/')
+            for typename in sorted(rettypes)]
+
+
+def list_matching_models(criteria):
+    for model in sorted(list(detected_models())):
+        if ('by-type' not in criteria or
+                model in known_services[criteria['by-type']]):
+            yield msg.ChildCollection(model + '/')
+
+
+def show_info(mac):
+    mac = mac.replace('-', ':')
+    if mac not in known_info:
+        raise exc.NotFoundException(mac + ' not a known mac address')
+    for i in send_discovery_datum(known_info[mac]):
+        yield i
+
+
+list_info = {
+    'by-node': list_matching_nodes,
+    'by-serial': list_matching_serials,
+    'by-type': list_matching_types,
+    'by-model': list_matching_models,
+    'by-mac': list_matching_macs,
+    'by-state': list_matching_states,
+    'by-uuid': list_matching_uuids,
+}
+
+multi_selectors = set([
+    'by-type',
+    'by-model',
+    'by-state',
+    'by-uuid',
+])
+
+
+node_selectors = set([
+    'by-node',
+    'by-serial',
+])
+
+
+single_selectors = set([
+    'by-mac',
+])
+
+
+def _parameterize_path(pathcomponents):
+    listrequested = False
+    childcoll = True
+    if len(pathcomponents) % 2 == 1:
+        listrequested = pathcomponents[-1]
+        pathcomponents = pathcomponents[:-1]
+    pathit = iter(pathcomponents)
+    keyparams = {}
+    validselectors = multi_selectors | node_selectors | single_selectors
+    for key, val in zip(pathit, pathit):
+        if key not in validselectors:
+            raise exc.NotFoundException('{0} is not valid here'.format(key))
+        if key == 'by-type':
+            keyparams[key] = servicebyname.get(val, '!!!!invalid-type')
+        else:
+            keyparams[key] = val
+        validselectors.discard(key)
+        if key in single_selectors:
+            childcoll = False
+            validselectors = set([])
+        elif key in node_selectors:
+            validselectors = single_selectors | set([])
+    return validselectors, keyparams, listrequested, childcoll
+
+
+def handle_api_request(configmanager, inputdata, operation, pathcomponents):
+    if operation == 'retrieve':
+        return handle_read_api_request(pathcomponents)
+    elif (operation in ('update', 'create') and
+            pathcomponents == ['discovery', 'rescan']):
+        if inputdata != {'rescan': 'start'}:
+            raise exc.InvalidArgumentException()
+        rescan()
+        return (msg.KeyValueData({'rescan': 'started'}),)
+    elif (operation in ('update', 'create')):
+        if 'node' not in inputdata:
+            raise exc.InvalidArgumentException('Missing node name in input')
+        _, queryparms, _, _ = _parameterize_path(pathcomponents[1:])
+        if 'by-mac' not in queryparms:
+            raise exc.InvalidArgumentException('Must target using "by-mac"')
+        mac = queryparms['by-mac'].replace('-', ':')
+        if mac not in known_info:
+            raise exc.NotFoundException('{0} not found'.format(mac))
+        info = known_info[mac]
+        handler = info['handler'].NodeHandler(info, configmanager)
+        eval_node(configmanager, handler, info, inputdata['node'],
+                  manual=True)
+        return [msg.AssignedResource(inputdata['node'])]
+    raise exc.NotImplementedException(
+        'Unable to {0} to {1}'.format(operation, '/'.join(pathcomponents)))
+
+
+def handle_read_api_request(pathcomponents):
+    # TODO(jjohnson2): This should be more generalized...
+    #  odd indexes into components are 'by-'*, even indexes
+    # starting at 2 are parameters to previous index
+    subcats, queryparms, indexof, coll = _parameterize_path(pathcomponents[1:])
+    if len(pathcomponents) == 1:
+        dirlist = [msg.ChildCollection(x + '/') for x in sorted(list(subcats))]
+        dirlist.append(msg.ChildCollection('rescan'))
+        return dirlist
+    if not coll:
+        return show_info(queryparms['by-mac'])
+    if not indexof:
+        return [msg.ChildCollection(x + '/') for x in sorted(list(subcats))]
+    if indexof not in list_info:
+        raise exc.NotFoundException('{0} is not found'.format(indexof))
+    return list_info[indexof](queryparms)
+
+
+def detected_services():
+    for srv in known_services:
+        yield servicenames[srv]
+
+
+def detected_models():
+    knownmodels = set([])
+    for info in known_info:
+        info = known_info[info]
+        if 'modelnumber' in info and info['modelnumber'] not in knownmodels:
+            knownmodels.add(info['modelnumber'])
+            yield info['modelnumber']
+
+
+def _recheck_nodes(nodeattribs, configmanager):
+    if rechecklock.locked():
+        # if already in progress, don't run again
+        # it may make sense to schedule a repeat, but will try the easier and less redundant way first
+        return
+    with rechecklock:
+        return _recheck_nodes_backend(nodeattribs, configmanager)
+
+def _recheck_nodes_backend(nodeattribs, configmanager):
+    global rechecker
+    _map_unique_ids(nodeattribs)
+    # for the nodes whose attributes have changed, consider them as potential
+    # strangers
+    for node in nodeattribs:
+        if node in known_nodes:
+            for somemac in known_nodes[node]:
+                unknown_info[somemac] = known_nodes[node][somemac]
+                unknown_info[somemac]['discostatus'] = 'unidentified'
+    # Now we go through ones we did not find earlier
+    for mac in list(unknown_info):
+        try:
+            _recheck_single_unknown(configmanager, mac)
+        except Exception:
+            traceback.print_exc()
+            continue
+    # now we go through ones that were identified, but could not pass
+    # policy or hadn't been able to verify key
+    for nodename in pending_nodes:
+        info = pending_nodes[nodename]
+        try:
+            handler = info['handler'].NodeHandler(info, configmanager)
+            discopool.spawn_n(eval_node, configmanager, handler, info, nodename)
+        except Exception:
+            traceback.print_exc()
+            log.log({'error': 'Unexpected error during discovery of {0}, check debug '
+                              'logs'.format(nodename)})
+
+
+def _recheck_single_unknown(configmanager, mac):
+    global rechecker
+    global rechecktime
+    info = unknown_info.get(mac, None)
+    if not info:
+        return
+    if info['handler'] != pxeh and not info.get('addresses', None):
+        #log.log({'info': 'Missing address information in ' + repr(info)})
+        return
+    handler = info['handler'].NodeHandler(info, configmanager)
+    if handler.https_supported and not handler.https_cert:
+        if handler.cert_fail_reason == 'unreachable':
+            log.log(
+                {
+                    'info': '{0} with hwaddr {1} is not reachable at {2}'
+                            ''.format(
+                        handler.devname, info['hwaddr'], handler.ipaddr
+                    )})
+            # addresses data is bad, delete the offending ip
+            info['addresses'] = [x for x in info.get('addresses', []) if x != handler.ipaddr]
+            # TODO(jjohnson2):  rescan due to bad peer addr data?
+            # not just wait around for the next announce
+            return
+        log.log(
+            {
+                'info': '{0} with hwaddr {1} at address {2} is not yet running '
+                        'https, will examine later'.format(
+                    handler.devname, info['hwaddr'], handler.ipaddr
+                )})
+        if rechecker is not None and rechecktime > util.monotonic_time() + 300:
+            rechecker.cancel()
+        # if cancel did not result in dead, then we are in progress
+        if rechecker is None or rechecker.dead:
+            rechecktime = util.monotonic_time() + 300
+            rechecker = eventlet.spawn_after(300, _periodic_recheck,
+                                             configmanager)
+        return
+    nodename, info['maccount'] = get_nodename(configmanager, handler, info)
+    if nodename:
+        if handler.https_supported:
+            dp = configmanager.get_node_attributes([nodename],
+                                         ('pubkeys.tls_hardwaremanager',))
+            lastfp = dp.get(nodename, {}).get('pubkeys.tls_hardwaremanager',
+                                              {}).get('value', None)
+            if util.cert_matches(lastfp, handler.https_cert):
+                info['nodename'] = nodename
+                known_nodes[nodename][info['hwaddr']] = info
+                info['discostatus'] = 'discovered'
+                return  # already known, no need for more
+        discopool.spawn_n(eval_node, configmanager, handler, info, nodename)
+
+
+def safe_detected(info):
+    if 'hwaddr' not in info:
+        return
+    if info['hwaddr'] in runningevals:
+        # Do not evaluate the same mac multiple times at once
+        return
+    runningevals[info['hwaddr']] = discopool.spawn(eval_detected, info)
+
+
+def eval_detected(info):
+    try:
+        detected(info)
+    except Exception as e:
+        traceback.print_exc()
+    del runningevals[info['hwaddr']]
+
+
+def detected(info):
+    global rechecker
+    global rechecktime
+    # later, manual and CMM discovery may act on SN and/or UUID
+    for service in info['services']:
+        if nodehandlers.get(service, None):
+            if service not in known_services:
+                known_services[service] = set([])
+            handler = nodehandlers[service]
+            info['handler'] = handler
+            break
+    else:  # no nodehandler, ignore for now
+        return
+    try:
+        snum = info['attributes']['enclosure-serial-number'][0].strip()
+        if snum:
+            info['serialnumber'] = snum
+            known_serials[info['serialnumber']] = info
+    except (KeyError, IndexError):
+        pass
+    try:
+        info['modelnumber'] = info['attributes']['enclosure-machinetype-model'][0]
+        known_services[service].add(info['modelnumber'])
+    except (KeyError, IndexError):
+        pass
+    if info['hwaddr'] in known_info and 'addresses' in info:
+        # we should tee these up for parsing when an enclosure comes up
+        # also when switch config parameters change, should discard
+        # and there's also if wiring is fixed...
+        # of course could periodically revisit known_nodes
+        # replace potentially stale address info
+        #TODO(jjohnson2): remove this
+        # temporary workaround for XCC not doing SLP DA over dedicated port
+        # bz 93219, fix submitted, but not in builds yet
+        # strictly speaking, going ipv4 only legitimately is mistreated here,
+        # but that should be an edge case
+        oldaddr = known_info[info['hwaddr']].get('addresses', [])
+        for addr in info['addresses']:
+            if addr[0].startswith('fe80::'):
+                break
+        else:
+            for addr in oldaddr:
+                if addr[0].startswith('fe80::'):
+                    info['addresses'].append(addr)
+        if known_info[info['hwaddr']].get(
+                'addresses', []) == info['addresses']:
+            # if the ip addresses match, then assume no changes
+            # now something resetting to defaults could, in theory
+            # have the same address, but need to be reset
+            # in that case, however, a user can clear pubkeys to force a check
+            return
+    known_info[info['hwaddr']] = info
+    cfg = cfm.ConfigManager(None)
+    handler = handler.NodeHandler(info, cfg)
+    handler.scan()
+    uuid = info.get('uuid', None)
+    if uuid_is_valid(uuid):
+        known_uuids[uuid][info['hwaddr']] = info
+    if handler.https_supported and not handler.https_cert:
+        if handler.cert_fail_reason == 'unreachable':
+            log.log(
+                {
+                    'info': '{0} with hwaddr {1} is not reachable at {2}'
+                            ''.format(
+                        handler.devname, info['hwaddr'], handler.ipaddr
+                    )})
+            info['addresses'] = [x for x in info.get('addresses', []) if x != handler.ipaddr]
+            return
+        log.log(
+            {'info':  '{0} with hwaddr {1} at address {2} is not yet running '
+                      'https, will examine later'.format(
+                        handler.devname, info['hwaddr'], handler.ipaddr
+            )})
+        if rechecker is not None and rechecktime > util.monotonic_time() + 300:
+            rechecker.cancel()
+        if rechecker is None or rechecker.dead:
+            rechecktime = util.monotonic_time() + 300
+            rechecker = eventlet.spawn_after(300, _periodic_recheck, cfg)
+        unknown_info[info['hwaddr']] = info
+        info['discostatus'] = 'unidentfied'
+        #TODO, eventlet spawn after to recheck sooner, or somehow else
+        # influence periodic recheck to shorten delay?
+        return
+    nodename, info['maccount'] = get_nodename(cfg, handler, info)
+    if nodename and handler.https_supported:
+        dp = cfg.get_node_attributes([nodename],
+                                     ('pubkeys.tls_hardwaremanager',))
+        lastfp = dp.get(nodename, {}).get('pubkeys.tls_hardwaremanager',
+                                          {}).get('value', None)
+        if util.cert_matches(lastfp, handler.https_cert):
+            info['nodename'] = nodename
+            known_nodes[nodename][info['hwaddr']] = info
+            info['discostatus'] = 'discovered'
+            return  # already known, no need for more
+    #TODO(jjohnson2): We might have to get UUID for certain searches...
+    #for now defer probe until inside eval_node.  We might not have
+    #a nodename without probe in the future.
+    if nodename:
+        eval_node(cfg, handler, info, nodename)
+    else:
+        log.log(
+            {'info': 'Detected unknown {0} with hwaddr {1} at '
+                     'address {2}'.format(
+                        handler.devname, info['hwaddr'], handler.ipaddr
+                      )})
+        info['discostatus'] = 'unidentified'
+        unknown_info[info['hwaddr']] = info
+
+
+def get_nodename(cfg, handler, info):
+    nodename = None
+    maccount = None
+    if handler.https_supported:
+        currcert = handler.https_cert
+        if not currcert:
+            info['discofailure'] = 'nohttps'
+            return None, None
+        currprint = util.get_fingerprint(currcert)
+        nodename = nodes_by_fprint.get(currprint, None)
+    if not nodename:
+        curruuid = info.get('uuid', None)
+        if uuid_is_valid(curruuid):
+            nodename = nodes_by_uuid.get(curruuid, None)
+            if nodename is None:
+                _map_unique_ids()
+                nodename = nodes_by_uuid.get(curruuid, None)
+    if not nodename:  # as a last resort, search switch for info
+        nodename, macinfo = macmap.find_nodeinfo_by_mac(info['hwaddr'], cfg)
+        maccount = macinfo['maccount']
+        if (nodename and
+                not handler.discoverable_by_switch(macinfo['maccount'])):
+            if handler.devname == 'SMM':
+                errorstr = 'Attempt to discover SMM by switch, but chained ' \
+                           'topology or incorrect net attributes detected, ' \
+                           'which is not compatible with switch discovery ' \
+                           'of SMM, nodename would have been ' \
+                           '{0}'.format(nodename)
+                log.log({'error': errorstr})
+                return None, None
+    return nodename, maccount
+
+
+def eval_node(cfg, handler, info, nodename, manual=False):
+    try:
+        handler.probe()  # unicast interrogation as possible to get more data
+        # for now, we search switch only, ideally we search cmm, smm, and
+        # switch concurrently
+        # do some preconfig, for example, to bring a SMM online if applicable
+        handler.preconfig()
+    except Exception as e:
+        unknown_info[info['hwaddr']] = info
+        info['discostatus'] = 'unidentified'
+        errorstr = 'An error occured during discovery, check the ' \
+                   'trace and stderr logs, mac was {0} and ip was {1}' \
+                   ', the node or the containing enclosure was {2}' \
+                   ''.format(info['hwaddr'], handler.ipaddr, nodename)
+        traceback.print_exc()
+        if manual:
+            raise exc.InvalidArgumentException(errorstr)
+        log.log({'error': errorstr})
+        return
+    # first, if had a bay, it was in an enclosure.  If it was discovered by
+    # switch, it is probably the enclosure manager and not
+    # the node directly.  switch is ambiguous and we should leave it alone
+    if 'enclosure.bay' in info and handler.is_enclosure:
+        unknown_info[info['hwaddr']] = info
+        info['discostatus'] = 'unidentified'
+        log.log({'error': 'Something that is an enclosure reported a bay, '
+                          'not possible'})
+        if manual:
+            raise exc.InvalidArgumentException()
+        return
+    nl = list(cfg.filter_node_attributes('enclosure.manager=' + nodename))
+    if not handler.is_enclosure and nl:
+        # The specified node is an enclosure (has nodes mapped to it), but
+        # what we are talking to is *not* an enclosure
+        if 'enclosure.bay' not in info:
+            unknown_info[info['hwaddr']] = info
+            info['discostatus'] = 'unidentified'
+            errorstr = '{2} with mac {0} is in {1}, but unable to ' \
+                       'determine bay number'.format(info['hwaddr'],
+                                                     nodename,
+                                                     handler.ipaddr)
+            if manual:
+                raise exc.InvalidArgumentException(errorstr)
+            log.log({'error': errorstr})
+            return
+        # search for nodes fitting our description using filters
+        # lead with the most specific to have a small second pass
+        nl = cfg.filter_node_attributes(
+            'enclosure.bay={0}'.format(info['enclosure.bay']), nl)
+        nl = list(nl)
+        # sadly, we cannot detect when user has a daisy chain smm config
+        # without ability to disambiguate, however the SMM will be caught so
+        # at least one actionable error will be encountered.
+        if len(nl) != 1:
+            info['discofailure'] = 'ambigconfig'
+            if len(nl):
+                errorstr = 'The following nodes have duplicate ' \
+                           'enclosure attributes: ' + ','.join(nl)
+
+            else:
+                errorstr = 'The {0} in enclosure {1} bay {2} does not ' \
+                           'seem to be a defined node ({3})'.format(
+                                        handler.devname, nodename,
+                                        info['enclosure.bay'],
+                                        handler.ipaddr,
+                                    )
+            if manual:
+                raise exc.InvalidArgumentException(errorstr)
+            log.log({'error': errorstr})
+            unknown_info[info['hwaddr']] = info
+            info['discostatus'] = 'unidentified'
+            return
+        nodename = nl[0]
+        if not discover_node(cfg, handler, info, nodename, manual):
+            # store it as pending, assuming blocked on enclosure
+            # assurance...
+            pending_nodes[nodename] = info
+    else:
+        # we can and did accurately discover by switch or in enclosure
+        # but... is this really ok?  could be on an upstream port or
+        # erroneously put in the enclosure with no nodes yet
+        if (info['maccount'] and
+                not handler.discoverable_by_switch(info['maccount'])):
+            errorstr = 'The detected node {0} was detected using switch, ' \
+                       'however the relevant port has too many macs learned ' \
+                       'for this type of device ({1}) to be discovered by ' \
+                       'switch.'.format(nodename, handler.devname)
+            if manual:
+                raise exc.InvalidArgumentException(errorstr)
+            log.log({'error': errorstr})
+            return
+        if not discover_node(cfg, handler, info, nodename, manual):
+            pending_nodes[nodename] = info
+
+
+def discover_node(cfg, handler, info, nodename, manual):
+    known_nodes[nodename][info['hwaddr']] = info
+    if info['hwaddr'] in unknown_info:
+        del unknown_info[info['hwaddr']]
+    info['discostatus'] = 'identified'
+    dp = cfg.get_node_attributes(
+        [nodename], ('discovery.policy',
+                     'pubkeys.tls_hardwaremanager'))
+    policy = dp.get(nodename, {}).get('discovery.policy', {}).get(
+        'value', None)
+    if policy is None:
+        policy = ''
+    policies = set(policy.split(','))
+    lastfp = dp.get(nodename, {}).get('pubkeys.tls_hardwaremanager',
+                                      {}).get('value', None)
+    # TODO(jjohnson2): permissive requires we guarantee storage of
+    # the pubkeys, which is deferred for a little bit
+    # Also, 'secure', when we have the needed infrastructure done
+    # in some product or another.
+    if 'pxe' in policies and info['handler'] == pxeh:
+        return do_pxe_discovery(cfg, handler, info, manual, nodename, policies)
+    elif ('permissive' in policies and handler.https_supported and lastfp and
+            not util.cert_matches(lastfp, handler.https_cert) and not manual):
+        info['discofailure'] = 'fingerprint'
+        log.log({'info': 'Detected replacement of {0} with existing '
+                         'fingerprint and permissive discovery policy, not '
+                         'doing discovery unless discovery.policy=open or '
+                         'pubkeys.tls_hardwaremanager attribute is cleared '
+                         'first'.format(nodename)})
+        return False  # With a permissive policy, do not discover new
+    elif policies & set(('open', 'permissive')) or manual:
+        info['nodename'] = nodename
+        if info['handler'] == pxeh:
+            return do_pxe_discovery(cfg, handler, info, manual, nodename, policies)
+        elif manual or not util.cert_matches(lastfp, handler.https_cert):
+            # only 'discover' if it is not the same as last time
+            try:
+                handler.config(nodename)
+            except Exception as e:
+                info['discofailure'] = 'bug'
+                if manual:
+                    raise
+                log.log(
+                    {'error':
+                         'Error encountered trying to set up {0}, {1}'.format(
+                             nodename, str(e))})
+                traceback.print_exc()
+                return False
+            newnodeattribs = {}
+            if 'uuid' in info:
+                newnodeattribs['id.uuid'] = info['uuid']
+            if 'serialnumber' in info:
+                newnodeattribs['id.serial'] = info['serialnumber']
+            if 'modelnumber' in info:
+                newnodeattribs['id.model'] = info['modelnumber']
+            if handler.https_cert:
+                newnodeattribs['pubkeys.tls_hardwaremanager'] = \
+                    util.get_fingerprint(handler.https_cert)
+            if newnodeattribs:
+                cfg.set_node_attributes({nodename: newnodeattribs})
+            log.log({'info': 'Discovered {0} ({1})'.format(nodename,
+                                                          handler.devname)})
+        info['discostatus'] = 'discovered'
+        return True
+    log.log({'info': 'Detected {0}, but discovery.policy is not set to a '
+                     'value allowing discovery (open or permissive)'.format(
+                        nodename)})
+    info['discofailure'] = 'policy'
+    return False
+
+
+def do_pxe_discovery(cfg, handler, info, manual, nodename, policies):
+    # use uuid based scheme in lieu of tls cert, ideally only
+    # for stateless 'discovery' targets like pxe, where data does not
+    # change
+    uuidinfo = cfg.get_node_attributes(nodename, ['id.uuid', 'id.serial', 'id.model', 'net*.bootable'])
+    if manual or policies & set(('open', 'pxe')):
+        enrich_pxe_info(info)
+        attribs = {}
+        olduuid = uuidinfo.get(nodename, {}).get('id.uuid', None)
+        uuid = info.get('uuid', None)
+        if uuid and uuid != olduuid:
+            attribs['id.uuid'] = info['uuid']
+        sn = info.get('serialnumber', None)
+        mn = info.get('modelnumber', None)
+        if sn and sn != uuidinfo.get(nodename, {}).get('id.serial', None):
+            attribs['id.serial'] = sn
+        if mn and mn != uuidinfo.get(nodename, {}).get('id.model', None):
+            attribs['id.model'] = mn
+        for attrname in uuidinfo.get(nodename, {}):
+            if attrname.endswith('.bootable') and uuidinfo[nodename][attrname].get('value', None):
+                newattrname = attrname[:-8] + 'hwaddr'
+                attribs[newattrname] = info['hwaddr']
+        if attribs:
+            cfg.set_node_attributes({nodename: attribs})
+    if info['uuid'] in known_pxe_uuids:
+        return True
+    if uuid_is_valid(info['uuid']):
+        known_pxe_uuids[info['uuid']] = nodename
+    log.log({'info': 'Detected {0} ({1} with mac {2})'.format(
+        nodename, handler.devname, info['hwaddr'])})
+    return True
+
+
+attribwatcher = None
+nodeaddhandler = None
+needaddhandled = False
+
+
+def _handle_nodelist_change(configmanager):
+    global needaddhandled
+    global nodeaddhandler
+    _recheck_nodes((), configmanager)
+    if needaddhandled:
+        needaddhandled = False
+        nodeaddhandler = eventlet.spawn(_handle_nodelist_change, configmanager)
+    else:
+        nodeaddhandler = None
+
+
+def newnodes(added, deleting, configmanager):
+    global attribwatcher
+    global needaddhandled
+    global nodeaddhandler
+    configmanager.remove_watcher(attribwatcher)
+    allnodes = configmanager.list_nodes()
+    attribwatcher = configmanager.watch_attributes(
+        allnodes, ('discovery.policy', 'net*.switch',
+                   'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
+                   'pubkeys.tls_hardwaremanager', 'net*.bootable'), _recheck_nodes)
+    if nodeaddhandler:
+        needaddhandled = True
+    else:
+        nodeaddhandler = eventlet.spawn(_handle_nodelist_change, configmanager)
+
+
+
+rechecker = None
+rechecktime = None
+rechecklock = eventlet.semaphore.Semaphore()
+
+def _periodic_recheck(configmanager):
+    global rechecker
+    global rechecktime
+    rechecker = None
+    try:
+        _recheck_nodes((), configmanager)
+    except Exception:
+        traceback.print_exc()
+        log.log({'error': 'Unexpected error during discovery, check debug '
+                          'logs'})
+    # if rechecker is set, it means that an accelerated schedule
+    # for rechecker was requested in the course of recheck_nodes
+    if rechecker is None:
+        rechecktime = util.monotonic_time() + 900
+        rechecker = eventlet.spawn_after(900, _periodic_recheck,
+                                         configmanager)
+
+
+def rescan():
+    _map_unique_ids()
+    eventlet.spawn_n(slp.active_scan, safe_detected)
+
+
+def start_detection():
+    global attribwatcher
+    global rechecker
+    _map_unique_ids()
+    cfg = cfm.ConfigManager(None)
+    allnodes = cfg.list_nodes()
+    attribwatcher = cfg.watch_attributes(
+        allnodes, ('discovery.policy', 'net*.switch',
+                   'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
+                   'pubkeys.tls_hardwaremanager'), _recheck_nodes)
+    cfg.watch_nodecollection(newnodes)
+    eventlet.spawn_n(slp.snoop, safe_detected)
+    eventlet.spawn_n(pxe.snoop, safe_detected)
+    if rechecker is None:
+        rechecktime = util.monotonic_time() + 900
+        rechecker = eventlet.spawn_after(900, _periodic_recheck, cfg)
+
+    # eventlet.spawn_n(ssdp.snoop, safe_detected)
+
+
+
+nodes_by_fprint = {}
+nodes_by_uuid = {}
+known_pxe_uuids = {}
+
+def _map_unique_ids(nodes=None):
+    global nodes_by_uuid
+    global nodes_by_fprint
+    nodes_by_uuid = {}
+    nodes_by_fprint = {}
+    # Map current known ids based on uuid and fingperprints for fast lookup
+    cfg = cfm.ConfigManager(None)
+    if nodes is None:
+        nodes = cfg.list_nodes()
+    bigmap = cfg.get_node_attributes(nodes,
+                                     ('id.uuid',
+                                      'pubkeys.tls_hardwaremanager'))
+    uuid_by_nodes = {}
+    fprint_by_nodes = {}
+    for uuid in nodes_by_uuid:
+        if not uuid_is_valid():
+            continue
+        node = nodes_by_uuid[uuid]
+        if node in bigmap:
+            uuid_by_nodes[node] = uuid
+    for fprint in nodes_by_fprint:
+        node = nodes_by_fprint[fprint]
+        if node in bigmap:
+            fprint_by_nodes[node] = fprint
+    for node in bigmap:
+        if node in uuid_by_nodes:
+            del nodes_by_uuid[uuid_by_nodes[node]]
+        if node in fprint_by_nodes:
+            del nodes_by_fprint[fprint_by_nodes[node]]
+        uuid = bigmap[node].get('id.uuid', {}).get('value', None)
+        if uuid_is_valid(uuid):
+            nodes_by_uuid[uuid] = node
+        fprint = bigmap[node].get(
+            'pubkeys.tls_hardwaremanager', {}).get('value', None)
+        if fprint:
+            nodes_by_fprint[fprint] = node
+    for uuid in known_pxe_uuids:
+        if uuid_is_valid(uuid) and uuid not in nodes_by_uuid:
+            nodes_by_uuid[uuid] = known_pxe_uuids[uuid]
+
+
+if __name__ == '__main__':
+    start_detection()
+    while True:
+        eventlet.sleep(30)
@@ -0,0 +1,157 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import confluent.discovery.handlers.generic as generic
+import confluent.exceptions as exc
+import confluent.netutil as netutil
+import eventlet.support.greendns
+
+# Provide foundation for general IPMI device configuration
+
+import pyghmi.exceptions as pygexc
+ipmicommand = eventlet.import_patched('pyghmi.ipmi.command')
+ipmicommand.session.select = eventlet.green.select
+ipmicommand.session.threading = eventlet.green.threading
+ipmicommand.session.socket.getaddrinfo = eventlet.support.greendns.getaddrinfo
+getaddrinfo = eventlet.support.greendns.getaddrinfo
+
+DEFAULT_USER = 'USERID'
+DEFAULT_PASS = 'PASSW0RD'
+
+
+class NodeHandler(generic.NodeHandler):
+
+    def _get_ipmicmd(self, user=DEFAULT_USER, password=DEFAULT_PASS):
+        return ipmicommand.Command(self.ipaddr, user, password)
+
+    def __init__(self, info, configmanager):
+        super(NodeHandler, self).__init__(info, configmanager)
+
+    def probe(self):
+        return
+        # TODO(jjohnson2): probe serial number and uuid
+
+    def config(self, nodename, reset=False):
+        self._bmcconfig(nodename, reset)
+
+    def _bmcconfig(self, nodename, reset=False):
+        # TODO(jjohnson2): set ip parameters, user/pass, alert cfg maybe
+        # In general, try to use https automation, to make it consistent
+        # between hypothetical secure path and today.
+        try:
+            ic = self._get_ipmicmd()
+            passwd = DEFAULT_PASS
+        except pygexc.IpmiException as pi:
+            creds = self.configmanager.get_node_attributes(
+                nodename,
+                ['secret.hardwaremanagementuser',
+                 'secret.hardwaremanagementpassword'], decrypt=True)
+            user = creds.get(nodename, {}).get(
+                'secret.hardwaremanagementuser', {}).get('value', None)
+            havecustomcreds = False
+            if user is not None and user != DEFAULT_USER:
+                havecustomcreds = True
+            else:
+                user = DEFAULT_USER
+            passwd = creds.get(nodename, {}).get(
+                'secret.hardwaremanagementpassword', {}).get('value', None)
+            if passwd is not None and passwd != DEFAULT_PASS:
+                havecustomcreds = True
+            else:
+                passwd = DEFAULT_PASS
+            if havecustomcreds:
+                ic = self._get_ipmicmd(user, passwd)
+            else:
+                raise
+        currusers = ic.get_users()
+        lanchan = ic.get_network_channel()
+        userdata = ic.xraw_command(netfn=6, command=0x44, data=(lanchan,
+                                                                1))
+        userdata = bytearray(userdata['data'])
+        maxusers = userdata[0] & 0b111111
+        enabledusers = userdata[1] & 0b111111
+        lockedusers = userdata[2] & 0b111111
+        cfg = self.configmanager
+        cd = cfg.get_node_attributes(
+            nodename, ['secret.hardwaremanagementuser',
+                       'secret.hardwaremanagementpassword',
+                       'hardwaremanagement.manager'], True)
+        cd = cd.get(nodename, {})
+        if ('secret.hardwaremanagementuser' not in cd or
+                'secret.hardwaremanagementpassword' not in cd):
+            raise exc.TargetEndpointBadCredentials(
+                'secret.hardwaremanagementuser and/or '
+                'secret.hardwaremanagementpassword was not configured')
+        if ('hardwaremanagement.manager' in cd and
+                cd['hardwaremanagement.manager']['value'] and
+                not cd['hardwaremanagement.manager']['value'].startswith(
+                    'fe80::')):
+            newip = cd['hardwaremanagement.manager']['value']
+            newipinfo = getaddrinfo(newip, 0)[0]
+            # This getaddrinfo is repeated in get_nic_config, could be
+            # optimized, albeit with a more convoluted api..
+            newip = newipinfo[-1][0]
+            if ':' in newip:
+                raise exc.NotImplementedException('IPv6 remote config TODO')
+            netconfig = netutil.get_nic_config(cfg, nodename, ip=newip)
+            plen = netconfig['prefix']
+            newip = '{0}/{1}'.format(newip, plen)
+            ic.set_net_configuration(ipv4_address=newip,
+                                     ipv4_configuration='static',
+                                     ipv4_gateway=netconfig['ipv4_gateway'])
+        elif self.ipaddr.startswith('fe80::'):
+            cfg.set_node_attributes(
+                {nodename: {'hardwaremanagement.manager': self.ipaddr}})
+        else:
+            raise exc.TargetEndpointUnreachable(
+                'hardwaremanagement.manager must be set to desired address')
+        newuser = cd['secret.hardwaremanagementuser']['value']
+        newpass = cd['secret.hardwaremanagementpassword']['value']
+        for uid in currusers:
+            if currusers[uid]['name'] == newuser:
+                # Use existing account that has been created
+                newuserslot = uid
+                break
+        else:
+            newuserslot = lockedusers + 1
+            if newuserslot < 2:
+                newuserslot = 2
+            ic.set_user_name(newuserslot, newuser)
+            ic.set_user_access(newuserslot, lanchan,
+                               privilege_level='administrator')
+        if newpass != passwd:  # don't mess with existing if no change
+            ic.set_user_password(newuserslot, password=newpass)
+        # Now to zap others
+        for uid in currusers:
+            if uid != newuserslot:
+                if uid <= lockedusers:  # we cannot delete, settle for disable
+                    ic.disable_user(uid, 'disable')
+                else:
+                    # lead with the most critical thing, removing user access
+                    ic.set_user_access(uid, channel=None, callback=False,
+                                       link_auth=False, ipmi_msg=False,
+                                       privilege_level='no_access')
+                    # next, try to disable the password
+                    ic.set_user_password(uid, mode='disable', password=None)
+                    # ok, now we can be less paranoid
+                    try:
+                        ic.user_delete(uid)
+                    except pygexc.IpmiException as ie:
+                        if ie.ipmicode != 0xd5:  # some response to the 0xff
+                            # name...
+                            # the user will remain, but that is life
+                            raise
+        if reset:
+            ic.reset_bmc()
+        return ic
@@ -0,0 +1,96 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import errno
+import eventlet
+webclient = eventlet.import_patched('pyghmi.util.webclient')
+
+class NodeHandler(object):
+    https_supported = True
+    is_enclosure = False
+    devname = ''
+    maxmacs = 2  # reasonable default, allowing for common scenario of
+                 # shared nic in theory, but blocking enclosure managers
+                 # and uplink ports
+
+    def __init__(self, info, configmanager):
+        self._certfailreason = None
+        self._fp = None
+        self.info = info
+        self.configmanager = configmanager
+        targsa = [None]
+        # first let us prefer LLA if possible, since that's most stable
+        for sa in info['addresses']:
+            if sa[0].startswith('fe80'):
+                targsa = sa
+                break
+        else:
+            if info.get('addresses', False):
+                targsa = info['addresses'][0]
+        self.ipaddr = targsa[0]
+
+    def scan(self):
+        # Do completely passive things to enhance data.
+        # Probe is permitted to for example attempt a login
+        # scan *only* does what it can without a login attempt
+        return
+
+    def probe(self):
+        # Use appropriate direct strategy to gather data such as
+        # serial number and uuid to flesh out data as needed
+        return
+
+    def preconfig(self):
+        return
+
+    def discoverable_by_switch(self, macs):
+        # Given the number of macs sharing the port, is this handler
+        # appropriate?
+        return macs <= self.maxmacs
+
+    def _savecert(self, certificate):
+        self._fp = certificate
+        return True
+
+    @property
+    def cert_fail_reason(self):
+        if self._certfailreason == 1:
+            return 'refused'
+        elif self._certfailreason == 2:
+            return 'unreachable'
+
+    @property
+    def https_cert(self):
+        if self._fp:
+            return self._fp
+        if ':' in self.ipaddr:
+            ip = '[{0}]'.format(self.ipaddr)
+        else:
+            ip = self.ipaddr
+        wc = webclient.SecureHTTPConnection(ip, verifycallback=self._savecert)
+        try:
+            wc.connect()
+        except IOError as ie:
+            if ie.errno == errno.ECONNREFUSED:
+                self._certfailreason = 1
+                return None
+            elif ie.errno == errno.EHOSTUNREACH:
+                self._certfailreason = 2
+                return None
+            self._certfailreason = 2
+            return None
+        except Exception:
+            self._certfailreason = 2
+            return None
+        return self._fp
@@ -0,0 +1,85 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import confluent.discovery.handlers.bmc as bmchandler
+import pyghmi.exceptions as pygexc
+import pyghmi.ipmi.private.util as pygutil
+import string
+import struct
+
+class NodeHandler(bmchandler.NodeHandler):
+    devname = 'IMM'
+
+    def scan(self):
+        slpattrs = self.info.get('attributes', {})
+        self.isdense = False
+        try:
+            ff = slpattrs.get('enclosure-form-factor', [''])[0]
+        except IndexError:
+            return
+        wronguuid = slpattrs.get('node-uuid', [''])[0]
+        if wronguuid:
+            # we need to fix the first three portions of the uuid
+            uuidprefix = wronguuid.split('-')[:3]
+            uuidprefix = struct.pack(
+                '<IHH', *[int(x, 16) for x in uuidprefix]).encode('hex')
+            uuidprefix = uuidprefix[:8] + '-' + uuidprefix[8:12] + '-' + \
+                         uuidprefix[12:16]
+            self.info['uuid'] = uuidprefix + '-' + '-'.join(
+                wronguuid.split('-')[3:])
+            self.info['uuid'] = string.lower(self.info['uuid'])
+        if ff not in ('dense-computing', 'BC2'):
+            # do not probe unless it's a dense platform
+            return
+        self.isdense = True
+        slot = int(slpattrs.get('slot', ['0'])[0])
+        if slot != 0:
+            self.info['enclosure.bay'] = slot
+
+    def probe(self):
+        if self.info.get('enclosure.bay', 0) == 0:
+            self.scan()
+        if self.info.get('enclosure.bay', 0) != 0:
+            # scan has already populated info
+            return
+        ff = self.info.get('attributes', {}).get('enclosure-form-factor', '')
+        if ff != 'dense-computing':
+            return
+        try:
+            # we are a dense platform, but the SLP data did not give us slot
+            # attempt to probe using IPMI
+            ipmicmd = self._get_ipmicmd()
+            guiddata = ipmicmd.xraw_command(netfn=6, command=8)
+            self.info['uuid'] = pygutil.decode_wireformat_uuid(
+                guiddata['data']).lower()
+            ipmicmd.oem_init()
+            bayid = ipmicmd._oem.immhandler.get_property(
+                '/v2/cmm/sp/7')
+            if not bayid:
+                return
+            self.info['enclosure.bay'] = int(bayid)
+            smmid = ipmicmd._oem.immhandler.get_property(
+                '/v2/ibmc/smm/chassis/uuid')
+            if not smmid:
+                return
+            smmid = smmid.lower().replace(' ', '')
+            smmid = '{0}-{1}-{2}-{3}-{4}'.format(smmid[:8], smmid[8:12],
+                                                 smmid[12:16], smmid[16:20],
+                                                 smmid[20:])
+            self.info['enclosure.uuid'] = smmid
+            self.info['enclosure.type'] = 'smm'
+        except pygexc.IpmiException as ie:
+            print(repr(ie))
+            raise
+
@@ -0,0 +1,39 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This contains functionality for passive detection and, one day, active
+# response to pxe
+
+
+import confluent.discovery.handlers.generic as generic
+
+class NodeHandler(generic.NodeHandler):
+    https_supported = False
+    is_enclosure = False
+    devname = 'PXE'
+
+    def __init__(self, info, configmanager):
+        self.ipaddr = ''
+        self.cfm = configmanager
+
+    @property
+    def cert_fail_reason(self):
+        return 'unsupported'
+
+    @property
+    def https_cert(self):
+        return None
+
+    def config(self, nodename):
+        return
@@ -0,0 +1,56 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import confluent.discovery.handlers.bmc as bmchandler
+import struct
+
+def fixuuid(baduuid):
+    # SMM dumps it out in hex
+    uuidprefix = (baduuid[:8], baduuid[8:12], baduuid[12:16])
+    a = struct.pack('<IHH', *[int(x, 16) for x in uuidprefix]).encode(
+        'hex')
+    uuid = (a[:8], a[8:12], a[12:16], baduuid[16:20], baduuid[20:])
+    return '-'.join(uuid).lower()
+
+class NodeHandler(bmchandler.NodeHandler):
+    is_enclosure = True
+    devname = 'SMM'
+    maxmacs = 5  # support an enclosure, but try to avoid catching daisy chain
+
+    def scan(self):
+        # the UUID is in a weird order, fix it up to match
+        # ipmi return and property value
+        uuid = self.info.get('attributes', {}).get('uuid', None)
+        if uuid:
+            uuid = fixuuid(uuid[0])
+            self.info['uuid'] = uuid
+
+    def config(self, nodename):
+        # SMM for now has to reset to assure configuration applies
+        super(NodeHandler, self).config(nodename)
+
+# notes for smm:
+# POST to:
+# https://172.30.254.160/data/changepwd
+# oripwd=PASSW0RD&newpwd=Passw0rd!4321
+# got response:
+# <?xml version="1.0" encoding="UTF-8"?><root><statusCode>0-ChangePwd</statusCode><fowardUrl>login.html</fowardUrl><status>ok</status></root>
+# requires relogin
+# https://172.30.254.160/index.html
+# post to:
+# https://172.30.254.160/data/login
+# with body user=USERID&password=Passw0rd!4321
+# yields:
+# <?xml version="1.0" encoding="UTF-8"?><root> <status>ok</status> <authResult>0</authResult> <forwardUrl>index.html</forwardUrl> </root>
+# note forwardUrl, if password change needed, will indicate something else
@@ -0,0 +1,72 @@
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import confluent.discovery.handlers.imm as immhandler
+import pyghmi.exceptions as pygexc
+import pyghmi.ipmi.oem.lenovo.imm as imm
+
+
+
+class NodeHandler(immhandler.NodeHandler):
+    devname = 'XCC'
+
+    def preconfig(self):
+        ff = self.info.get('attributes', {}).get('enclosure-form-factor', '')
+        if ff not in ('dense-computing', [u'dense-computing']):
+            return
+        # attempt to enable SMM
+        #it's normal to get a 'not supported' (193) for systems without an SMM
+        ipmicmd = None
+        try:
+            ipmicmd = self._get_ipmicmd()
+            ipmicmd.xraw_command(netfn=0x3a, command=0xf1, data=(1,))
+        except pygexc.IpmiException as e:
+            if (e.ipmicode != 193 and 'Unauthorized name' not in str(e) and
+                    'Incorrect password' not in str(e)):
+                # raise an issue if anything other than to be expected
+                raise
+        #TODO: decide how to clean out if important
+        #as it stands, this can step on itself
+        #if ipmicmd:
+        #    ipmicmd.ipmi_session.logout()
+
+    def config(self, nodename, reset=False):
+        # TODO(jjohnson2): set ip parameters, user/pass, alert cfg maybe
+        # In general, try to use https automation, to make it consistent
+        # between hypothetical secure path and today.
+        ic = self._bmcconfig(nodename)
+        ff = self.info.get('attributes', {}).get('enclosure-form-factor', '')
+        if ff not in ('dense-computing', [u'dense-computing']):
+            return
+        # Ok, we can get the enclosure uuid now..
+        ic.oem_init()
+        enclosureuuid = ic._oem.immhandler.get_property(
+            '/v2/ibmc/smm/chassis/uuid')
+        enclosureuuid = ic._oem.immhandler.get_property(
+            '/v2/ibmc/smm/chassis/uuid')
+        if enclosureuuid:
+            enclosureuuid = imm.fixup_uuid(enclosureuuid).lower()
+            em = self.configmanager.get_node_attributes(nodename,
+                                                        'enclosure.manager')
+            em = em.get(nodename, {}).get('enclosure.manager', {}).get(
+                'value', None)
+            # ok, set the uuid of the manager...
+            if em:
+                self.configmanager.set_node_attributes(
+                    {em: {'id.uuid': enclosureuuid}})
+
+# TODO(jjohnson2): web based init config for future prevalidated cert scheme
+#    def config(self, nodename):
+#        return
+
@@ -0,0 +1,118 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# We can listen to port 69 with SO_REUSEADDR to snoop port 69 *even* if dhcp
+# is running (because the other dhcp servers do it already)
+
+# Goal is to detect and act on a DHCPDISCOVER, without actually having to do
+# any offer
+
+# option 97 = UUID (wireformat)
+
+import eventlet.green.socket as socket
+import struct
+
+pxearchs = {
+    '\x00\x00': 'bios-x86',
+    '\x00\x07': 'uefi-x64',
+    '\x00\x09': 'uefi-x64',
+    '\x00\x0b': 'uefi-aarch64',
+}
+
+
+def decode_uuid(rawguid):
+    lebytes = struct.unpack_from('<IHH', buffer(rawguid[:8]))
+    bebytes = struct.unpack_from('>HHI', buffer(rawguid[8:]))
+    return '{0:08X}-{1:04X}-{2:04X}-{3:04X}-{4:04X}{5:08X}'.format(
+        lebytes[0], lebytes[1], lebytes[2], bebytes[0], bebytes[1], bebytes[2]).lower()
+
+
+def find_info_in_options(rq, optidx):
+    uuid = None
+    arch = None
+    try:
+        while uuid is None or arch is None:
+            if rq[optidx] == 53:  # DHCP message type
+                # we want only length 1 and only discover (type 1)
+                if rq[optidx + 1] != 1 or rq[optidx + 2] != 1:
+                    return uuid, arch
+                optidx += 3
+            elif rq[optidx] == 97:
+                if rq[optidx + 1] != 17:
+                    # 16 bytes of uuid and one reserved byte
+                    return uuid, arch
+                if rq[optidx + 2] != 0:  # the reserved byte should be zero,
+                    # anything else would be a new spec that we don't know yet
+                    return uuid, arch
+                uuid = decode_uuid(rq[optidx + 3:optidx + 19])
+                optidx += 19
+            elif rq[optidx] == 93:
+                if rq[optidx + 1] != 2:
+                    return uuid, arch
+                archraw = bytes(rq[optidx + 2:optidx + 4])
+                if archraw in pxearchs:
+                    arch = pxearchs[archraw]
+                optidx += 4
+            else:
+                optidx += rq[optidx + 1] + 2
+    except IndexError:
+        return uuid, arch
+    return uuid, arch
+
+def snoop(handler):
+    #TODO(jjohnson2): ipv6 socket and multicast for DHCPv6, should that be
+    #prominent
+    #TODO(jjohnson2): IP_PKTINFO, recvmsg to get the destination ip, per
+    #proxydhcp.c from xCAT
+    net4 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    net4.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    net4.bind(('', 67))
+    while True:
+        # Just need some delay, picked a prime number so that overlap with other
+        # timers might be reduced, though it really is probably nothing
+        (rq, peer) = net4.recvfrom(9000)
+        # if we have a small packet, just skip, it can't possible hold enough
+        # data and avoids some downstream IndexErrors that would be messy
+        # with try/except
+        if len(rq) < 64:
+            continue
+        rq = bytearray(rq)
+        if rq[0] == 1:  # Boot request
+            addrlen = rq[2]
+            if addrlen > 16:  # max address size in bootp is 16 bytes
+                continue
+            netaddr = rq[28:28+addrlen]
+            netaddr = ':'.join(['{0:02x}'.format(x) for x in netaddr])
+            optidx = 0
+            try:
+                optidx = rq.index('\x63\x82\x53\x63') + 4
+            except ValueError:
+                continue
+            uuid, arch = find_info_in_options(rq, optidx)
+            if uuid is None:
+                continue
+            # We will fill out service to have something to byte into,
+            # but the nature of the beast is that we do not have peers,
+            # so that will not be present for a pxe snoop
+            handler({'hwaddr': netaddr, 'uuid': uuid, 'architecture': arch,
+                     'services': ('pxe-client',)})
+
+if __name__ == '__main__':
+    def testsnoop(info):
+        print(repr(info))
+    snoop(testsnoop)
+
+
@@ -0,0 +1,538 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import confluent.neighutil as neighutil
+import confluent.util as util
+import os
+import random
+import eventlet.green.select as select
+import eventlet.green.socket as socket
+import struct
+import subprocess
+
+
+_slp_services = set([
+    'service:management-hardware.IBM:integrated-management-module2',
+    'service:lenovo-smm',
+    'service:management-hardware.Lenovo:lenovo-xclarity-controller',
+    'service:management-hardware.IBM:chassis-management-module',
+    'service:management-hardware.Lenovo:chassis-management-module',
+])
+
+# SLP has a lot of ambition that was unfulfilled in practice.
+# So we have a static footer here to always use 'DEFAULT' scope, no LDAP
+# predicates, and no authentication for service requests
+srvreqfooter = b'\x00\x07DEFAULT\x00\x00\x00\x00'
+# An empty instance of the attribute list extension
+# which is defined in RFC 3059, used to indicate support for that capability
+attrlistext = b'\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00'
+
+try:
+    IPPROTO_IPV6 = socket.IPPROTO_IPV6
+except AttributeError:
+    IPPROTO_IPV6 = 41  # Assume Windows value if socket is missing it
+
+
+
+def _parse_slp_header(packet):
+    packet = bytearray(packet)
+    if len(packet) < 16 or packet[0] != 2:
+        # discard packets that are obviously useless
+        return None
+    parsed = {
+        'function': packet[1],
+    }
+    (offset, parsed['xid'], langlen) = struct.unpack('!IHH',
+                                           bytes(b'\x00' + packet[7:14]))
+    parsed['lang'] = packet[14:14 + langlen].decode('utf-8')
+    parsed['payload'] = packet[14 + langlen:]
+    if offset:
+        parsed['offset'] = 14 + langlen
+        parsed['extoffset'] = offset
+    return parsed
+
+
+def _pop_url(payload):
+    urllen = struct.unpack('!H', bytes(payload[3:5]))[0]
+    url = bytes(payload[5:5+urllen]).decode('utf-8')
+    if payload[5+urllen] != 0:
+        raise Exception('Auth blocks unsupported')
+    payload = payload[5+urllen+1:]
+    return url, payload
+
+
+def _parse_SrvRply(parsed):
+    """ Modify passed dictionary to have parsed data
+
+
+    :param parsed:
+    :return:
+    """
+    payload = parsed['payload']
+    ecode, ucount = struct.unpack('!HH', bytes(payload[0:4]))
+    if ecode:
+        parsed['errorcode'] = ecode
+    payload = payload[4:]
+    parsed['urls'] = []
+    while ucount:
+        ucount -= 1
+        url, payload = _pop_url(payload)
+        parsed['urls'].append(url)
+
+
+def _parse_slp_packet(packet, peer, rsps, xidmap):
+    parsed = _parse_slp_header(packet)
+    if not parsed:
+        return
+    addr = peer[0]
+    if '%' in addr:
+        addr = addr[:addr.index('%')]
+    mac = None
+    if addr in neighutil.neightable:
+        identifier = neighutil.neightable[addr]
+        mac = identifier
+    else:
+        identifier = addr
+    if (identifier, parsed['xid']) in rsps:
+        # avoid obviously duplicate entries
+        parsed = rsps[(identifier, parsed['xid'])]
+    else:
+        rsps[(identifier, parsed['xid'])] = parsed
+    if mac and 'hwaddr' not in parsed:
+        parsed['hwaddr'] = mac
+    if parsed['xid'] in xidmap:
+        parsed['services'] = [xidmap[parsed['xid']]]
+    if 'addresses' in parsed:
+        if peer not in parsed['addresses']:
+            parsed['addresses'].append(peer)
+    else:
+        parsed['addresses'] = [peer]
+    if parsed['function'] == 2:  # A service reply
+        _parse_SrvRply(parsed)
+
+
+def _v6mcasthash(srvtype):
+    # The hash algorithm described by RFC 3111
+    nums = bytearray(srvtype.encode('utf-8'))
+    hashval = 0
+    for i in nums:
+        hashval *= 33
+        hashval += i
+        hashval &= 0xffff  # only need to track the lowest 16 bits
+    hashval &= 0x3ff
+    hashval |= 0x1000
+    return '{0:x}'.format(hashval)
+
+
+def _generate_slp_header(payload, multicast, functionid, xid, extoffset=0):
+    if multicast:
+        flags = 0x2000
+    else:
+        flags = 0
+    packetlen = len(payload) + 16  # we have a fixed 16 byte header supported
+    if extoffset:  # if we have an offset, add 16 to account for this function
+        # generating a 16 byte header
+        extoffset += 16
+    if packetlen > 1400:
+        # For now, we aren't intending to support large SLP transmits
+        # raise an exception to help identify if such a requirement emerges
+        raise Exception("TODO: Transmit overflow packets")
+    # We always do SLP v2, and only v2
+    header = bytearray([2, functionid])
+    # SLP uses 24 bit packed integers, so in such places we pack 32 then
+    # discard the high byte
+    header.extend(struct.pack('!IH', packetlen, flags)[1:])
+    # '2' below refers to the length of the language tag
+    header.extend(struct.pack('!IHH', extoffset, xid, 2)[1:])
+    # we only do english (in SLP world, it's not like non-english appears...)
+    header.extend(b'en')
+    return header
+
+def _generate_attr_request(service, xid):
+    service = service.encode('utf-8')
+    payload = bytearray(struct.pack('!HH', 0, len(service)) + service)
+    payload.extend(srvreqfooter)
+    header = _generate_slp_header(payload, False, functionid=6, xid=xid)
+    return header + payload
+
+
+
+def _generate_request_payload(srvtype, multicast, xid, prlist=''):
+    prlist = prlist.encode('utf-8')
+    payload = bytearray(struct.pack('!H', len(prlist)) + prlist)
+    srvtype = srvtype.encode('utf-8')
+    payload.extend(struct.pack('!H', len(srvtype)) + srvtype)
+    payload.extend(srvreqfooter)
+    extoffset = len(payload)
+    payload.extend(attrlistext)
+    header = _generate_slp_header(payload, multicast, functionid=1, xid=xid,
+                                  extoffset=extoffset)
+    return header + payload
+
+
+def _find_srvtype(net, net4, srvtype, addresses, xid):
+    """Internal function to find a single service type
+
+    Helper to do singleton requests to srvtype
+
+    :param net: Socket active
+    :param srvtype: Service type to do now
+    :param addresses:  Pass through of addresses argument from find_targets
+    :return:
+    """
+    if addresses is None:
+        data = _generate_request_payload(srvtype, True, xid)
+        net4.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
+        v6addrs = []
+        v6hash = _v6mcasthash(srvtype)
+        # do 'interface local' and 'link local'
+        # it shouldn't make sense, but some configurations work with interface
+        # local that do not work with link local
+        v6addrs.append(('ff01::1:' + v6hash, 427, 0, 0))
+        v6addrs.append(('ff02::1:' + v6hash, 427, 0, 0))
+        for idx in util.list_interface_indexes():
+            # IPv6 multicast is by index, so lead with that
+            net.setsockopt(IPPROTO_IPV6, socket.IPV6_MULTICAST_IF, idx)
+            for sa in v6addrs:
+                try:
+                    net.sendto(data, sa)
+                except socket.error:
+                    # if we hit an interface without ipv6 multicast,
+                    # this can cause an error, skip such an interface
+                    # case in point, 'lo'
+                    pass
+        for i4 in util.list_ips():
+            if 'broadcast' not in i4:
+                continue
+            addr = i4['addr']
+            bcast = i4['broadcast']
+            net4.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_IF,
+                           socket.inet_aton(addr))
+            net4.sendto(data, ('239.255.255.253', 427))
+            net4.sendto(data, (bcast, 427))
+
+
+def _grab_rsps(socks, rsps, interval, xidmap):
+    r, _, _ = select.select(socks, (), (), interval)
+    while r:
+        for s in r:
+            (rsp, peer) = s.recvfrom(9000)
+            neighutil.refresh_neigh()
+            _parse_slp_packet(rsp, peer, rsps, xidmap)
+            r, _, _ = select.select(socks, (), (), interval)
+
+
+
+def _parse_attrlist(attrstr):
+    attribs = {}
+    while attrstr:
+        if attrstr[0] == '(':
+            if ')' not in attrstr:
+                attribs['INCOMPLETE'] = True
+                return attribs
+            currattr = attrstr[1:attrstr.index(')')]
+            if '=' not in currattr:  # Not allegedly kosher, but still..
+                currattr = currattr.decode('utf-8')
+                attribs[currattr] = None
+            else:
+                attrname, attrval = currattr.split('=')
+                attrname = attrname.decode('utf-8')
+                attribs[attrname] = []
+                for val in attrval.split(','):
+                    try:
+                        val = val.decode('utf-8')
+                    except UnicodeDecodeError:
+                        val = '*DECODEERROR*'
+                    if val[:3] == '\\FF':  # we should make this bytes
+                        finalval = bytearray([])
+                        for bnum in attrval[3:].split('\\'):
+                            if bnum == '':
+                                continue
+                            finalval.append(int(bnum, 16))
+                        val = finalval
+                        if 'uuid' in attrname and len(val) == 16:
+                            lebytes = struct.unpack_from(
+                                '<IHH', buffer(val[:8]))
+                            bebytes = struct.unpack_from(
+                                '>HHI', buffer(val[8:]))
+                            val = '{0:08X}-{1:04X}-{2:04X}-{3:04X}-' \
+                                  '{4:04X}{5:08X}'.format(
+                                lebytes[0], lebytes[1], lebytes[2], bebytes[0],
+                                bebytes[1], bebytes[2]
+                            ).lower()
+                    attribs[attrname].append(val)
+            attrstr = attrstr[attrstr.index(')'):]
+        elif attrstr[0] == ',':
+            attrstr = attrstr[1:]
+        elif ',' in attrstr:
+            currattr = attrstr[:attrstr.index(',')]
+            attribs[currattr] = None
+            attrstr = attrstr[attrstr.index(','):]
+        else:
+            currattr = attrstr
+            attribs[currattr] = None
+            attrstr = None
+    return attribs
+
+
+def _parse_attrs(data, parsed):
+    headinfo = _parse_slp_header(data)
+    if headinfo['function'] != 7 or headinfo['xid'] != parsed['xid']:
+        return
+    payload = headinfo['payload']
+    if struct.unpack('!H', bytes(payload[:2]))[0] != 0:
+        return
+    length = struct.unpack('!H', bytes(payload[2:4]))[0]
+    attrstr = bytes(payload[4:4+length])
+    parsed['attributes'] = _parse_attrlist(attrstr)
+
+
+def _add_attributes(parsed):
+    attrq = _generate_attr_request(parsed['services'][0], parsed['xid'])
+    target = None
+    # prefer reaching out to an fe80 if present, to be highly robust
+    # in face of network changes
+    for addr in parsed['addresses']:
+        if addr[0].startswith('fe80'):
+            target = addr
+    # however if no fe80 seen, roll with the first available address
+    if not target:
+        target = parsed['addresses'][0]
+    if len(target) == 4:
+        net = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+    else:
+        net = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        net.connect(target)
+    except socket.error:
+        return
+    net.sendall(attrq)
+    rsp = net.recv(8192)
+    net.close()
+    _parse_attrs(rsp, parsed)
+
+
+def query_srvtypes(target):
+    """Query the srvtypes advertised by the target
+
+    :param target: A sockaddr tuple (if you get the peer info)
+    """
+    payload = b'\x00\x00\xff\xff\x00\x07DEFAULT'
+    header = _generate_slp_header(payload, False, functionid=9, xid=1)
+    packet = header + payload
+    if len(target) == 2:
+        net = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    elif len(target) == 4:
+        net = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+    else:
+        raise Exception('Unrecognized target {0}'.format(repr(target)))
+    tries = 3
+    connected = False
+    while tries and not connected:
+        tries -= 1
+        try:
+            net.connect(target)
+            connected = True
+        except socket.error:
+            pass
+    if not connected:
+        return [u'']
+    net.sendall(packet)
+    rs = net.recv(8192)
+    net.close()
+    parsed = _parse_slp_header(rs)
+    if parsed:
+        payload = parsed['payload']
+        if payload[:2] != '\x00\x00':
+            return
+        stypelen = struct.unpack('!H', bytes(payload[2:4]))[0]
+        stypes = payload[4:4+stypelen].decode('utf-8')
+        return stypes.split(',')
+
+def rescan(handler):
+    known_peers = set([])
+    for scanned in scan():
+        for addr in scanned['addresses']:
+            ip = addr[0].partition('%')[0]  # discard scope if present
+            if ip not in neighutil.neightable:
+                continue
+            if addr in known_peers:
+                break
+            known_peers.add(addr)
+        else:
+            handler(scanned)
+
+
+def snoop(handler):
+    """Watch for SLP activity
+
+    handler will be called with a dictionary of relevant attributes
+
+    :param handler:
+    :return:
+    """
+    active_scan(handler)
+    net = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    net.setsockopt(IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+    slpg = socket.inet_pton(socket.AF_INET6, 'ff01::123')
+    slpg2 = socket.inet_pton(socket.AF_INET6, 'ff02::123')
+    for i6idx in util.list_interface_indexes():
+        mreq = slpg + struct.pack('=I', i6idx)
+        net.setsockopt(IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq)
+        mreq = slpg2 + struct.pack('=I', i6idx)
+        net.setsockopt(IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, mreq)
+    net4 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    net.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    net4.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    for i4 in util.list_ips():
+        if 'broadcast' not in i4:
+            continue
+        slpmcast = socket.inet_aton('239.255.255.253') + \
+            socket.inet_aton(i4['addr'])
+        try:
+            net4.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP,
+                            slpmcast)
+        except socket.error as e:
+            if e.errno != 98:
+                raise
+            # socket in use can occur when aliased ipv4 are encountered
+    net.bind(('', 427))
+    net4.bind(('', 427))
+
+    while True:
+        newmacs = set([])
+        r, _, _ = select.select((net, net4), (), (), 60)
+        # clear known_peers and peerbymacaddress
+        # to avoid stale info getting in...
+        # rely upon the select(0.2) to catch rapid fire and aggregate ip
+        # addresses that come close together
+        # calling code needs to understand deeper context, as snoop
+        # will now yield dupe info over time
+        known_peers = set([])
+        peerbymacaddress = {}
+        neighutil.update_neigh()
+        while r:
+            for s in r:
+                (rsp, peer) = s.recvfrom(9000)
+                ip = peer[0].partition('%')[0]
+                if ip not in neighutil.neightable:
+                    continue
+                if peer in known_peers:
+                    continue
+                known_peers.add(peer)
+                mac = neighutil.neightable[ip]
+                if mac in peerbymacaddress:
+                    peerbymacaddress[mac]['addresses'].append(peer)
+                else:
+                    q = query_srvtypes(peer)
+                    if not q or not q[0]:
+                        # SLP might have started and not ready yet
+                        # ignore for now
+                        known_peers.discard(peer)
+                        continue
+                    # we want to prioritize the very well known services
+                    svcs = []
+                    for svc in q:
+                        if svc in _slp_services:
+                            svcs.insert(0, svc)
+                        else:
+                            svcs.append(svc)
+                    peerbymacaddress[mac] = {
+                        'services': svcs,
+                        'addresses': [peer],
+                    }
+                newmacs.add(mac)
+            r, _, _ = select.select((net, net4), (), (), 0.2)
+        for mac in newmacs:
+            peerbymacaddress[mac]['xid'] = 1
+            _add_attributes(peerbymacaddress[mac])
+            peerbymacaddress[mac]['hwaddr'] = mac
+            handler(peerbymacaddress[mac])
+
+
+def active_scan(handler):
+    known_peers = set([])
+    for scanned in scan():
+        for addr in scanned['addresses']:
+            ip = addr[0].partition('%')[0]  # discard scope if present
+            if ip not in neighutil.neightable:
+                continue
+            if addr in known_peers:
+                break
+            known_peers.add(addr)
+        else:
+            handler(scanned)
+
+
+def scan(srvtypes=_slp_services, addresses=None, localonly=False):
+    """Find targets providing matching requested srvtypes
+
+    This is a generator that will iterate over respondants to the SrvType
+    requested.
+
+    :param srvtypes: An iterable list of the service types to find
+    :param addresses: An iterable of addresses/ranges.  Default is to scan
+                      local network segment using multicast and broadcast.
+                      Each address can be a single address, hyphen-delimited
+                      range, or an IP/CIDR indication of a network.
+    :return: Iterable set of results
+    """
+    net = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    net4 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    # increase RCVBUF to max, mitigate chance of
+    # failure due to full buffer.
+    net.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 16777216)
+    net4.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 16777216)
+    # SLP is very poor at scanning large counts and managing it, so we
+    # must make the best of it
+    # Some platforms/config default to IPV6ONLY, we are doing IPv4
+    # too, so force it
+    #net.setsockopt(IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
+    # we are going to do broadcast, so allow that...
+    initxid = random.randint(0, 32768)
+    xididx = 0
+    xidmap = {}
+    # First we give fast repsonders of each srvtype individual chances to be
+    # processed, mitigating volume of response traffic
+    rsps = {}
+    for srvtype in srvtypes:
+        xididx += 1
+        _find_srvtype(net, net4, srvtype, addresses, initxid + xididx)
+        xidmap[initxid + xididx] = srvtype
+        _grab_rsps((net, net4), rsps, 0.1, xidmap)
+        # now do a more slow check to work to get stragglers,
+        # but fortunately the above should have taken the brunt of volume, so
+        # reduced chance of many responses overwhelming receive buffer.
+    _grab_rsps((net, net4), rsps, 1, xidmap)
+    # now to analyze and flesh out the responses
+    for id in rsps:
+        if localonly:
+            for addr in rsps[id]['addresses']:
+                if 'fe80' in addr[0]:
+                    break
+            else:
+                continue
+        _add_attributes(rsps[id])
+        del rsps[id]['payload']
+        del rsps[id]['function']
+        del rsps[id]['xid']
+        yield rsps[id]
+
+
+if __name__ == '__main__':
+    def testsnoop(a):
+        print(repr(a))
+    snoop(testsnoop)
@@ -0,0 +1,232 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Documented somewhat at
+# http://buildingskb.schneider-electric.com/view.php?AID=15197
+
+# Here is the payload of an SSDP 'announce', sent to the multicast v4/v6 1900
+# NOTIFY * HTTP/1.1
+# HOST: 239.255.255.250:1900
+# CACHE-CONTROL: max-age=1800
+# AL: https://172.30.254.151:8080/redfish/v1
+# SERVER: Linux/3.14.28-ltsi Redfish/1.0
+# NT: urn:dmtf-org:service:redfish-rest:1
+# USN: uuid:00000000-0000-0000-0005-000000000001::urn:dmtf-org:service:redfish-rest:1
+# NTS: ssdp:alive
+
+
+import confluent.neighutil as neighutil
+import confluent.util as util
+import eventlet.green.select as select
+import eventlet.green.socket as socket
+import struct
+
+mcastv4addr = '239.255.255.250'
+mcastv6addr = 'ff02::c'
+
+ssdp6mcast = socket.inet_pton(socket.AF_INET6, mcastv6addr)
+smsg = ('M-SEARCH * HTTP/1.1\r\n'
+        'HOST: {0}:1900\r\n'
+        'MAN: "ssdp:discover"\r\n'
+        'ST: {1}\r\n'
+        'MX: 3\r\n\r\n')
+
+
+def scan(services, target=None):
+    for service in services:
+        for rply in _find_service(service, target):
+            yield rply
+
+
+def snoop(handler, byehandler=None):
+    """Watch for SSDP notify messages
+
+    The handler shall be called on any service coming online.
+    byehandler is called whenever a system advertises that it is departing.
+    If no byehandler is specified, byebye messages are ignored.  The handler is
+    given (as possible), the mac address, a list of viable sockaddrs to reference
+    the peer, and the notification type (e.g.
+    'urn:dmtf-org:service:redfish-rest:1'
+
+    :param handler:  A handler for online notifications from network
+    :param byehandler: Optional handler for devices going off the network
+    """
+    # Normally, I like using v6/v4 agnostic socket. However, since we are
+    # dabbling in multicast wizardry here, such sockets can cause big problems,
+    # so we will have two distinct sockets
+    known_peers = set([])
+    net6 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    net6.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+    for ifidx in util.list_interface_indexes():
+        v6grp = ssdp6mcast + struct.pack('=I', ifidx)
+        net6.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_JOIN_GROUP, v6grp)
+    net6.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    net4 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    for i4 in util.list_ips():
+        ssdp4mcast = socket.inet_pton(socket.AF_INET, mcastv4addr) + \
+                     socket.inet_aton(i4['addr'])
+        net4.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP,
+                        ssdp4mcast)
+    net4.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    net4.bind(('', 1900))
+    net6.bind(('', 1900))
+    peerbymacaddress = {}
+    while True:
+        newmacs = set([])
+        machandlers = {}
+        r, _, _ = select.select((net4, net6), (), (), 60)
+        neighutil.update_neigh()
+        while r:
+            for s in r:
+                (rsp, peer) = s.recvfrom(9000)
+                rsp = rsp.split('\r\n')
+                method, _, _ = rsp[0].split(' ', 2)
+                if method == 'NOTIFY':
+                    ip = peer[0].partition('%')[0]
+                    if ip not in neighutil.neightable:
+                        continue
+                    if peer in known_peers:
+                        continue
+                    mac = neighutil.neightable[ip]
+                    known_peers.add(peer)
+                    newmacs.add(mac)
+                    if mac in peerbymacaddress:
+                        peerbymacaddress[mac]['peers'].append(peer)
+                    else:
+                        peerbymacaddress[mac] = {
+                            'hwaddr': mac,
+                            'peers': [peer],
+                        }
+                        peerdata = peerbymacaddress[mac]
+                        for headline in rsp[1:]:
+                            if not headline:
+                                continue
+                            header, _, value = headline.partition(':')
+                            header = header.strip()
+                            value = value.strip()
+                            if header == 'NT':
+                                peerdata['service'] = value
+                            elif header == 'NTS':
+                                if value == 'ssdp:byebye':
+                                    machandlers[mac] = byehandler
+                                elif value == 'ssdp:alive':
+                                    machandlers[mac] = handler
+            r, _, _ = select.select((net4, net6), (), (), 0.1)
+        for mac in newmacs:
+            thehandler = machandlers.get(mac, None)
+            if thehandler:
+                thehandler(peerbymacaddress[mac])
+
+
+def _find_service(service, target):
+    net4 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    net6 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    net6.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+    if target:
+        addrs = socket.getaddrinfo(target, 1900, 0, socket.SOCK_DGRAM)
+        for addr in addrs:
+            host = addr[4][0]
+            if addr[0] == socket.AF_INET:
+                net4.sendto(smsg.format(host, service), addr[4])
+            elif addr[0] == socket.AF_INET6:
+                host = '[{0}]'.format(host)
+                net6.sendto(smsg.format(host, service), addr[4])
+    else:
+        net4.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
+        for idx in util.list_interface_indexes():
+            net6.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_MULTICAST_IF,
+                            idx)
+            try:
+                net6.sendto(smsg.format('[{0}]'.format(mcastv6addr), service
+                                        ), (mcastv6addr, 1900, 0, 0))
+            except socket.error:
+                # ignore interfaces without ipv6 multicast causing error
+                pass
+        for i4 in util.list_ips():
+            if 'broadcast' not in i4:
+                continue
+            addr = i4['addr']
+            bcast = i4['broadcast']
+            net4.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_IF,
+                            socket.inet_aton(addr))
+            net4.sendto(smsg.format(mcastv4addr, service),
+                        (mcastv4addr, 1900))
+            net4.sendto(smsg.format(bcast, service), (bcast, 1900))
+    # SSDP by spec encourages responses to spread out over a 3 second interval
+    # hence we must be a bit more patient
+    r, _, _ = select.select((net4, net6), (), (), 4)
+    peerdata = {}
+    while r:
+        for s in r:
+            (rsp, peer) = s.recvfrom(9000)
+            neighutil.refresh_neigh()
+            _parse_ssdp(peer, rsp, peerdata)
+        r, _, _ = select.select((net4, net6), (), (), 4)
+    for nid in peerdata:
+        yield peerdata[nid]
+
+
+def _parse_ssdp(peer, rsp, peerdata):
+    ip = peer[0].partition('%')[0]
+    nid = ip
+    mac = None
+    if ip in neighutil.neightable:
+        nid = neighutil.neightable[ip]
+        mac = nid
+    headlines = rsp.split('\r\n')
+    try:
+        _, code, _ = headlines[0].split(' ', 2)
+    except ValueError:
+        return
+    myurl = None
+    if code == '200':
+        if nid in peerdata:
+            peerdatum = peerdata[nid]
+        else:
+            peerdatum = {
+                'peers': [peer],
+                'hwaddr': mac,
+            }
+            peerdata[nid] = peerdatum
+        for headline in headlines[1:]:
+            if not headline:
+                continue
+            header, _, value = headline.partition(':')
+            header = header.strip()
+            value = value.strip()
+            if header == 'AL' or header == 'LOCATION':
+                myurl = value
+                if 'urls' not in peerdatum:
+                    peerdatum['urls'] = [value]
+                elif value not in peerdatum['urls']:
+                    peerdatum['urls'].append(value)
+            elif header == 'ST':
+                if 'services' not in peerdatum:
+                    peerdatum['services'] = [value]
+                elif value not in peerdatum['services']:
+                    peerdatum['services'].append(value)
+
+
+
+if __name__ == '__main__':
+
+    for rsp in scan(['urn:dmtf-org:service:redfish-rest:1']):
+        print(repr(rsp))
+    def fun(a):
+        print(repr(a))
+    def byefun(a):
+        print('bye' + repr(a))
+    snoop(fun, byefun)
@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

 # Copyright 2014 IBM Corporation
-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -21,65 +21,86 @@ import json

 class ConfluentException(Exception):
    apierrorcode = 500
-    apierrorstr = 'Unexpected Error'
+    _apierrorstr = 'Unexpected Error'

    def get_error_body(self):
-        return self.apierrorstr
+        errstr = ' - '.join((self._apierrorstr, str(self)))
+        return json.dumps({'error': errstr })
+
+    @property
+    def apierrorstr(self):
+        if str(self):
+            return self._apierrorstr + ' - ' + str(self)
+        return self._apierrorstr


 class NotFoundException(ConfluentException):
    # Something that could be construed as a name was not found
    # basically, picture an http error code 404
-    pass
+    apierrorcode = 404
+    _apierrorstr = 'Target not found'


 class InvalidArgumentException(ConfluentException):
    # Something from the remote client wasn't correct
    # like http code 400
-    pass
+    apierrorcode = 400
+    _apierrorstr = 'Bad Request'


 class TargetEndpointUnreachable(ConfluentException):
    # A target system was unavailable.  For example, a BMC
    # was unreachable.  http code 504
-    pass
+    apierrorcode = 504
+    _apierrorstr = 'Unreachable Target'


 class TargetEndpointBadCredentials(ConfluentException):
    # target was reachable, but authentication/authorization
    # failed
-    pass
+    apierrorcode = 502
+    _apierrorstr = 'Bad Credentials'


 class LockedCredentials(ConfluentException):
    # A request was performed that required a credential, but the credential
    # store is locked
-    pass
+    _apierrorstr = 'Credential store locked'


 class ForbiddenRequest(ConfluentException):
    # The client request is not allowed by authorization engine
-    pass
+    apierrorcode = 403
+    _apierrorstr = 'Forbidden'


 class NotImplementedException(ConfluentException):
    # The current configuration/plugin is unable to perform
    # the requested task. http code 501
-    pass
+    apierrorcode = 501
+    _apierrorstr = '501 - Not Implemented'
+


 class GlobalConfigError(ConfluentException):
    # The configuration in the global config file is not right
-    pass
+    _apierrorstr = 'Global configuration contains an error'


+class TargetResourceUnavailable(ConfluentException):
+    # This is meant for scenarios like asking to read a sensor that is
+    # currently unavailable.  This may be a persistent or transient state
+    apierrocode = 503
+    _apierrorstr = 'Target Resource Unavailable'
+
 class PubkeyInvalid(ConfluentException):
    apierrorcode = 502
-    apierrorstr = '502 - Invalid certificate or key on target'
+    _apierrorstr = '502 - Invalid certificate or key on target'

    def __init__(self, text, certificate, fingerprint, attribname, event):
        super(PubkeyInvalid, self).__init__(self, text)
        self.fingerprint = fingerprint
+        self.attrname = attribname
        bodydata = {'message': text,
                    'event': event,
                    'fingerprint': fingerprint,
@@ -92,7 +113,7 @@ class PubkeyInvalid(ConfluentException):

 class LoggedOut(ConfluentException):
    apierrorcode = 401
-    apierrorstr = '401 - Logged out'
+    _apierrorstr = '401 - Logged out'

    def get_error_body(self):
        return '{"loggedout": 1}'
@@ -0,0 +1,108 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# provide managing firmware update process and firmware repository if/when
+# the time comes
+
+import confluent.exceptions as exc
+import confluent.messages as msg
+import eventlet
+
+updatesbytarget = {}
+updatepool = eventlet.greenpool.GreenPool(256)
+
+
+def execupdate(handler, filename, updateobj):
+    try:
+        completion = handler(filename, progress=updateobj.handle_progress,
+                             bank=updateobj.bank)
+        if completion is None:
+            completion = 'complete'
+        updateobj.handle_progress({'phase': completion, 'progress': 100.0})
+    except exc.PubkeyInvalid as pi:
+        errstr = 'Certificate mismatch detected, does not match value in ' \
+                 'attribute {0}'.format(pi.attrname)
+        updateobj.handle_progress({'phase': 'error', 'progress': 0.0,
+                                   'detail': errstr})
+    except Exception as e:
+        updateobj.handle_progress({'phase': 'error', 'progress': 0.0,
+                                   'detail': str(e)})
+
+class Updater(object):
+    def __init__(self, node, handler, filename, tenant=None, name=None,
+                 bank=None):
+        self.bank = bank
+        self.node = node
+        self.phase = 'initializing'
+        self.detail = ''
+        self.percent = 0.0
+        #Change the below to a pool???
+        self.updateproc = updatepool.spawn(execupdate, handler, filename, self)
+        if (node, tenant) not in updatesbytarget:
+            updatesbytarget[(node, tenant)] = {}
+        if name is None:
+            name = 1
+            while '{0}'.format(name) in updatesbytarget[(node, tenant)]:
+                name += 1
+        self.name = '{0}'.format(name)
+        updatesbytarget[(node, tenant)][self.name] = self
+
+    def handle_progress(self, progress):
+        self.phase = progress['phase']
+        self.percent = float(progress['progress'])
+        self.detail = progress.get('detail', '')
+
+    def cancel(self):
+        self.updateproc.kill()
+
+    @property
+    def progress(self):
+        return {'phase': self.phase, 'progress': self.percent,
+                'detail': self.detail}
+
+
+def remove_updates(nodes, tenant, element):
+    if len(element) < 5:
+        raise exc.InvalidArgumentException()
+    upid = element[-1]
+    for node in nodes:
+        try:
+            upd = updatesbytarget[(node, tenant)][upid]
+        except KeyError:
+            raise exc.NotFoundException('No active update matches request')
+        upd.cancel()
+        del updatesbytarget[(node, tenant)][upid]
+        yield msg.DeletedResource(
+            'nodes/{0}/inventory/firmware/updates/active/{1}'.format(
+                node, upid))
+
+
+def list_updates(nodes, tenant, element):
+    showmode = False
+    if len(element) > 4:
+        showmode = True
+        upid = element[-1]
+    for node in nodes:
+        if showmode:
+            try:
+                updater = updatesbytarget[(node, tenant)][upid]
+            except KeyError:
+                raise exc.NotFoundException('No matching update process found')
+            yield msg.KeyValueData(updater.progress, name=node)
+        else:
+            for updateid in updatesbytarget.get((node, tenant), {}):
+                yield msg.ChildCollection(updateid)
@@ -0,0 +1,119 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#This handles port forwarding for web interfaces on management devices
+#It will also hijack port 3900 and do best effort..
+
+import eventlet
+import eventlet.green.select as select
+import eventlet.green.socket as socket
+forwardersbyclient = {}
+relaysbysession = {}
+sessionsbyip = {}
+ipsbysession = {}
+sockhandler = {}
+vidtargetbypeer = {}
+vidforwarder = None
+
+def handle_connection(incoming, outgoing):
+    while True:
+        r, _, _ = select.select((incoming, outgoing), (), (), 60)
+        for mysock in r:
+            data = mysock.recv(32768)
+            if not data:
+                return
+            if mysock == incoming:
+                outgoing.sendall(data)
+            elif mysock == outgoing:
+                incoming.sendall(data)
+
+
+def forward_port(sock, target, clientip, sessionid):
+    while True:
+        conn, cli = sock.accept()
+        if cli[0] != clientip:
+            conn.close()
+            continue
+        try:
+            client = socket.create_connection((target, 443))
+        except Exception:
+            conn.close()
+            continue
+        if sessionid not in relaysbysession:
+            relaysbysession[sessionid] = {}
+        relaysbysession[sessionid][eventlet.spawn(
+            handle_connection, conn, client)] = conn
+
+
+def forward_video():
+    sock = eventlet.listen(('::', 3900, 0, 0), family=socket.AF_INET6)
+    while True:
+        conn, cli = sock.accept()
+        if cli[0] not in vidtargetbypeer or not sessionsbyip.get(cli[0], None):
+            conn.close()
+            continue
+        try:
+            vidclient = socket.create_connection((vidtargetbypeer[cli[0]],
+                                                  3900))
+        except Exception:
+            conn.close()
+            continue
+        eventlet.spawn_n(handle_connection, conn, vidclient)
+
+
+def close_session(sessionid):
+    for addr in forwardersbyclient.get(sessionid, []):
+        killsock = forwardersbyclient[sessionid][addr]
+        sockhandler[killsock].kill()
+        del sockhandler[killsock]
+        killsock.close()
+    if sessionid in forwardersbyclient:
+        del forwardersbyclient[sessionid]
+    for clip in ipsbysession.get(sessionid, ()):
+        sessionsbyip[clip].discard(sessionid)
+    if sessionid in ipsbysession:
+        del ipsbysession[sessionid]
+    for relay in list(relaysbysession.get(sessionid, ())):
+        conn = relaysbysession[sessionid][relay]
+        relay.kill()
+        conn.close()
+    if sessionid in relaysbysession:
+        del relaysbysession[sessionid]
+
+
+def get_port(addr, clientip, sessionid):
+    global vidforwarder
+    if socket.getaddrinfo(clientip, 0)[0][0] == socket.AF_INET:
+        clientip = '::ffff:' + clientip
+    if sessionid not in ipsbysession:
+        ipsbysession[sessionid] = set([])
+    if clientip not in sessionsbyip:
+        sessionsbyip[clientip] = set([])
+    sessionsbyip[clientip].add(sessionid)
+    ipsbysession[sessionid].add(clientip)
+    if sessionid not in forwardersbyclient:
+        forwardersbyclient[sessionid] = {}
+    if addr not in forwardersbyclient[sessionid]:
+        newsock = eventlet.listen(('::', 0, 0, 0),
+                  family=socket.AF_INET6)
+        forwardersbyclient[sessionid][addr] = newsock
+        sockhandler[newsock] = eventlet.spawn(forward_port, newsock, addr,
+                                              clientip, sessionid)
+        if not vidforwarder:
+            vidforwarder = eventlet.spawn(forward_video)
+    vidtargetbypeer[clientip] = addr
+    return forwardersbyclient[sessionid][addr].getsockname()[1]
+
@@ -21,6 +21,7 @@ import Cookie
 import confluent.auth as auth
 import confluent.config.attributes as attribs
 import confluent.consoleserver as consoleserver
+import confluent.forwarder as forwarder
 import confluent.exceptions as exc
 import confluent.log as log
 import confluent.messages
@@ -35,6 +36,7 @@ import eventlet.greenthread
 import greenlet
 import json
 import socket
+import sys
 import traceback
 import time
 import urlparse
@@ -150,6 +152,7 @@ def _sessioncleaner():
            if httpsessions[session]['expiry'] < currtime:
                targsessions.append(session)
        for session in targsessions:
+            forwarder.close_session(session)
            del httpsessions[session]
        targsessions = []
        for session in consolesessions:
@@ -214,6 +217,50 @@ def _should_skip_authlog(env):
        return True
    return False

+
+def _csrf_exempt(path):
+    # first a get of info to get CSRF key, also '/forward/web' to enable
+    # the popup ability to just forward
+    return path == '/sessions/current/info' or path.endswith('/forward/web')
+
+
+def _csrf_valid(env, session):
+    # This could be simplified into a statement, but this is more readable
+    # to have it broken out
+    if env['REQUEST_METHOD'] == 'GET' and _csrf_exempt(env['PATH_INFO']):
+        # Provide a web client a safe hook to request the CSRF token
+        # This means that we consider GET of /sessions/current/info to be
+        # a safe thing to inflict via CSRF, since CORS should prevent
+        # hypothetical attacker from reading the data and it has no
+        # side effects to speak of
+        return True
+    if 'csrftoken' not in session:
+        # The client has not (yet) requested CSRF protection
+        # so we return true
+        if 'HTTP_CONFLUENTAUTHTOKEN' in env:
+            # The client has requested CSRF countermeasures,
+            # oblige the request and apply a new token to the
+            # session
+            session['csrftoken'] = util.randomstring(32)
+        elif 'HTTP_REFERER' in env:
+            # If there is a referrer, make sure it stays consistent
+            # across the session.  A change in referer is a bad thing
+            try:
+                referer = env['HTTP_REFERER'].split('/')[2]
+            except IndexError:
+                return False
+            if 'validreferer' not in session:
+                session['validreferer'] = referer
+            elif session['validreferer'] != referer:
+                return False
+        return True
+    # The session has CSRF protection enabled, only mark valid if
+    # the client has provided an auth token and that token matches the
+    # value protecting the session
+    return ('HTTP_CONFLUENTAUTHTOKEN' in env and
+            env['HTTP_CONFLUENTAUTHTOKEN'] == session['csrftoken'])
+
+
 def _authorize_request(env, operation):
    """Grant/Deny access based on data from wsgi env

@@ -228,22 +275,31 @@ def _authorize_request(env, operation):
        cc.load(env['HTTP_COOKIE'])
        if 'confluentsessionid' in cc:
            sessionid = cc['confluentsessionid'].value
+            sessid = sessionid
            if sessionid in httpsessions:
-                if env['PATH_INFO'] == '/sessions/current/logout':
-                    targets = []
-                    for mythread in httpsessions[sessionid]['inflight']:
-                        targets.append(mythread)
-                    for mythread in targets:
-                        eventlet.greenthread.kill(mythread)
-                    del httpsessions[sessionid]
-                    return ('logout',)
-                httpsessions[sessionid]['expiry'] = time.time() + 90
-                name = httpsessions[sessionid]['name']
-                authdata = auth.authorize(
-                    name, element=None,
-                    skipuserobj=httpsessions[sessionid]['skipuserobject'])
+                if _csrf_valid(env, httpsessions[sessionid]):
+                    if env['PATH_INFO'] == '/sessions/current/logout':
+                        targets = []
+                        for mythread in httpsessions[sessionid]['inflight']:
+                            targets.append(mythread)
+                        for mythread in targets:
+                            eventlet.greenthread.kill(mythread)
+                        forwarder.close_session(sessionid)
+                        del httpsessions[sessionid]
+                        return ('logout',)
+                    httpsessions[sessionid]['expiry'] = time.time() + 90
+                    name = httpsessions[sessionid]['name']
+                    authdata = auth.authorize(
+                        name, element=None,
+                        skipuserobj=httpsessions[sessionid]['skipuserobject'])
    if (not authdata) and 'HTTP_AUTHORIZATION' in env:
        if env['PATH_INFO'] == '/sessions/current/logout':
+            if 'HTTP_REFERER' in env:
+                # note that this doesn't actually do harm
+                # otherwise, but this way do not give appearance
+                # of something having a side effect if it has the smell
+                # of a CSRF
+                return {'code': 401}
            return ('logout',)
        name, passphrase = base64.b64decode(
            env['HTTP_AUTHORIZATION'].replace('Basic ', '')).split(':', 1)
@@ -256,6 +312,8 @@ def _authorize_request(env, operation):
        httpsessions[sessid] = {'name': name, 'expiry': time.time() + 90,
                                'skipuserobject': authdata[4],
                                'inflight': set([])}
+        if 'HTTP_CONFLUENTAUTHTOKEN' in env:
+            httpsessions[sessid]['csrftoken'] = util.randomstring(32)
        cookie['confluentsessionid'] = sessid
        cookie['confluentsessionid']['secure'] = 1
        cookie['confluentsessionid']['httponly'] = 1
@@ -276,10 +334,12 @@ def _authorize_request(env, operation):
            auditmsg['tenant'] = authdata[3]
            authinfo['tenant'] = authdata[3]
        auditmsg['user'] = authdata[2]
-        if sessionid is not None:
-            authinfo['sessionid'] = sessionid
+        if sessid is not None:
+            authinfo['sessionid'] = sessid
        if not skiplog:
            auditlog.log(auditmsg)
+        if 'csrftoken' in httpsessions[sessid]:
+            authinfo['authtoken'] = httpsessions[sessid]['csrftoken']
        return authinfo
    else:
        return {'code': 401}
@@ -336,7 +396,13 @@ def resourcehandler_backend(env, start_response):
    """Function to handle new wsgi requests
    """
    mimetype, extension = _pick_mimetype(env)
-    headers = [('Content-Type', mimetype), ('Cache-Control', 'no-cache')]
+    headers = [('Content-Type', mimetype), ('Cache-Control', 'no-store'),
+               ('Pragma', 'no-cache'),
+               ('X-Content-Type-Options', 'nosniff'),
+               ('Content-Security-Policy', "default-src 'self'"),
+               ('X-XSS-Protection', '1'), ('X-Frame-Options', 'deny'),
+               ('Strict-Transport-Security', 'max-age=86400'),
+               ('X-Permitted-Cross-Domain-Policies', 'none')]
    reqbody = None
    reqtype = None
    if 'CONTENT_LENGTH' in env and int(env['CONTENT_LENGTH']) > 0:
@@ -349,10 +415,10 @@ def resourcehandler_backend(env, start_response):
        del querydict['restexplorerop']
    authorized = _authorize_request(env, operation)
    if 'logout' in authorized:
-        start_response('200 Sucessful logout', headers)
+        start_response('200 Successful logout', headers)
        yield('{"result": "200 - Successful logout"}')
        return
-    if 'HTTP_SUPPRESSAUTHHEADER' in env:
+    if 'HTTP_SUPPRESSAUTHHEADER' in env or 'HTTP_CONFLUENTAUTHTOKEN' in env:
        badauth = [('Content-type', 'text/plain')]
    else:
        badauth = [('Content-type', 'text/plain'),
@@ -389,6 +455,24 @@ def resourcehandler_backend(env, start_response):
            start_response('{0} {1}'.format(e.apierrorcode, e.apierrorstr),
                           headers)
            yield e.get_error_body()
+    elif (env['PATH_INFO'].endswith('/forward/web') and
+              env['PATH_INFO'].startswith('/nodes/')):
+        prefix, _, _ = env['PATH_INFO'].partition('/forward/web')
+        _, _, nodename = prefix.rpartition('/')
+        hm = cfgmgr.get_node_attributes(nodename, 'hardwaremanagement.manager')
+        targip = hm.get(nodename, {}).get(
+            'hardwaremanagement.manager', {}).get('value', None)
+        if not targip:
+            start_response('404 Not Found', headers)
+            yield 'No hardwaremanagemnet.manager defined for node'
+            return
+        funport = forwarder.get_port(targip, env['HTTP_X_FORWARDED_FOR'],
+                                     authorized['sessionid'])
+        host = env['HTTP_X_FORWARDED_HOST']
+        url = 'https://{0}:{1}/'.format(host, funport)
+        start_response('302', [('Location', url)])
+        yield 'Our princess is in another castle!'
+        return
    elif (operation == 'create' and ('/console/session' in env['PATH_INFO'] or
            '/shell/sessions/' in env['PATH_INFO'])):
        #hard bake JSON into this path, do not support other incarnations
@@ -461,6 +545,17 @@ def resourcehandler_backend(env, start_response):
            start_response('200 OK', headers)
            yield '{"sessionclosed": true}'
            return
+        elif 'action' in querydict:
+            if querydict['action'] == 'break':
+                consolesessions[querydict['session']]['session'].send_break()
+            elif querydict['action'] == 'reopen':
+                consolesessions[querydict['session']]['session'].reopen()
+            else:
+                start_response('400 Bad Request')
+                yield 'Unrecognized action ' + querydict['action']
+                return
+            start_response('200 OK', headers)
+            yield json.dumps({'session': querydict['session']})
        else:  # no keys, but a session, means it's hooking to receive data
            sessid = querydict['session']
            if sessid not in consolesessions:
@@ -519,7 +614,10 @@ def resourcehandler_backend(env, start_response):
        url = url.replace('.html', '')
        if url == '/sessions/current/info':
            start_response('200 OK', headers)
-            yield json.dumps({'username': authorized['username']})
+            sessinfo = {'username': authorized['username']}
+            if 'authtoken' in authorized:
+                sessinfo['authtoken'] = authorized['authtoken']
+            yield json.dumps(sessinfo)
            return
        resource = '.' + url[url.rindex('/'):]
        lquerydict = copy.deepcopy(querydict)
@@ -541,26 +639,9 @@ def resourcehandler_backend(env, start_response):
                    pagecontent += datum
            start_response('200 OK', headers)
            yield pagecontent
-        except exc.NotFoundException as ne:
-            start_response('404 Not found', headers)
-            yield "404 - Request path not recognized - " + str(ne)
-        except exc.InvalidArgumentException as e:
-            start_response('400 Bad Request - ' + str(e), headers)
-            yield '400 - Bad Request - ' + str(e)
-        except exc.TargetEndpointUnreachable as tu:
-            start_response('504 Unreachable Target', headers)
-            yield '504 - Unreachable Target - ' + str(tu)
-        except exc.TargetEndpointBadCredentials:
-            start_response('502 Bad Credentials', headers)
-            yield '502 - Bad Credentials'
-        except exc.LockedCredentials:
-            start_response('500 Locked credential store', headers)
-            yield '500 - Credential store locked'
-        except exc.NotImplementedException:
-            start_response('501 Not Implemented', headers)
-            yield '501 Not Implemented'
        except exc.ConfluentException as e:
-            if e.apierrorcode == 500:
+            if ((not isinstance(e, exc.LockedCredentials)) and
+                    e.apierrorcode == 500):
                # raise generics to trigger the tracelog
                raise
            start_response('{0} {1}'.format(e.apierrorcode, e.apierrorstr),
@@ -688,9 +769,20 @@ def serve(bind_host, bind_port):
    #but deps are simpler without flup
    #also, the potential for direct http can be handy
    #todo remains unix domain socket for even http
-    eventlet.wsgi.server(
-        eventlet.listen((bind_host, bind_port, 0, 0), family=socket.AF_INET6),
-        resourcehandler, log=False, log_output=False, debug=False)
+    sock = None
+    while not sock:
+        try:
+            sock = eventlet.listen(
+                (bind_host, bind_port, 0, 0), family=socket.AF_INET6)
+        except socket.error as e:
+            if e.errno != 98:
+                raise
+            sys.stderr.write(
+                'Failed to open HTTP due to busy port, trying again in'
+                ' a second\n')
+            eventlet.sleep(1)
+    eventlet.wsgi.server(sock, resourcehandler, log=False, log_output=False,
+                         debug=False)


 class HttpApi(object):
@@ -379,7 +379,7 @@ class TimedAndSizeRotatingFileHandler(BaseRotatingHandler):

    def _sizeRoll(self):
        self.close()
-        for i in range(self.sizeRollingCount, 0, -1):
+        for i in range(self.backupCount - 1, 0, -1):
            sbfn = "%s.%d" % (self.binpath, i)
            dbfn = "%s.%d" % (self.binpath, i + 1)
            stfn = "%s.%d" % (self.textpath, i)
@@ -392,8 +392,6 @@ class TimedAndSizeRotatingFileHandler(BaseRotatingHandler):
                if os.path.exists(dtfn):
                    os.remove(dtfn)
                os.rename(stfn, dtfn)
-        # size rolling happens, add statistics count
-        self.sizeRollingCount += 1
        dbfn = self.binpath + ".1"
        dtfn = self.textpath + ".1"
        if os.path.exists(dbfn):
@@ -404,8 +402,18 @@ class TimedAndSizeRotatingFileHandler(BaseRotatingHandler):
            os.rename(self.binpath, dbfn)
        if os.path.exists(self.textpath):
            os.rename(self.textpath, dtfn)
+        self._deleteFilesForSizeRolling()
        return dbfn, dtfn

+    def _deleteFilesForSizeRolling(self):
+        for i in range(self.sizeRollingCount, self.backupCount -1, -1):
+            dbfn = "%s.%d" % (self.binpath, i)
+            dtfn = "%s.%d" % (self.textpath, i)
+            if os.path.exists(dbfn):
+                os.remove(dbfn)
+            if os.path.exists(dtfn):
+                os.remove(dtfn)
+
    def _timeRoll(self):
        self.close()
        # get the time that this sequence started at and make it a TimeTuple
@@ -424,8 +432,7 @@ class TimedAndSizeRotatingFileHandler(BaseRotatingHandler):
                    addend = -3600
                timeTuple = time.localtime(t + addend)

-        # if size rolling files exist
-        for i in range(self.sizeRollingCount, 0, -1):
+        for i in range(self.backupCount - 1, 0, -1):
            sbfn = "%s.%d" % ( self.binpath, i)
            dbfn = "%s.%s.%d" % (
            self.binpath, time.strftime(self.suffix, timeTuple),i)
@@ -441,15 +448,18 @@ class TimedAndSizeRotatingFileHandler(BaseRotatingHandler):
                    os.remove(dtfn)
                os.rename(stfn, dtfn)

-        # As time rolling happens, reset statistics count
-        self.sizeRollingCount = 0
        dbfn = self.binpath + "." + time.strftime(self.suffix, timeTuple)
+        odbfn = dbfn
        dtfn = self.textpath + "." + time.strftime(self.suffix, timeTuple)
-
-        if os.path.exists(dbfn):
-            os.remove(dbfn)
-        if os.path.exists(dtfn):
-            os.remove(dtfn)
+        odtfn = dtfn
+        append=1
+        while os.path.exists(dbfn):
+            dbfn = odbfn + '.{0}'.format(append)
+            append += 1
+        append=1
+        while os.path.exists(dtfn):
+            dtfn = odtfn + '.{0}'.format(append)
+            append += 1
        if os.path.exists(self.binpath):
            os.rename(self.binpath, dbfn)
        if os.path.exists(self.textpath):
@@ -489,7 +499,7 @@ class Logger(object):
                     False, events will be formatted like syslog:
                     date: message<CR>
    """
-    def __new__(cls, logname, console=False, tenant=None):
+    def __new__(cls, logname, console=False, tenant=None, buffered=True):
        global _loggers
        if console:
            relpath = 'consoles/' + logname
@@ -500,11 +510,12 @@ class Logger(object):
        else:
            return object.__new__(cls)

-    def __init__(self, logname, console=False, tenant=None):
+    def __init__(self, logname, console=False, tenant=None, buffered=True):
        if hasattr(self, 'initialized'):
            # we are just a copy of the same object
            return
        self.initialized = True
+        self.buffered = buffered
        self.filepath = confluent.config.configmanager.get_global("logdirectory")
        if self.filepath is None:
            if os.name == 'nt':
@@ -534,6 +545,12 @@ class Logger(object):
            tstamp = entry[1]
            data = entry[2]
            evtdata = entry[3]
+            if len(data) > 65535:
+                # our max log entry is 65k, take only the first 65k and put
+                # rest back on as a continuation
+                entry[2] = data[65535:]
+                self.logentries.appendleft(entry)
+                data = data[:65535]
            textdate = ''
            if self.isconsole and ltype != 2:
                textdate = time.strftime(
@@ -613,8 +630,14 @@ class Logger(object):
                struct.unpack(">BBIHIBBH", recbytes)
            # rolling events found.
            if ltype == DataTypes.event and evtdata == Events.logrollover:
-                textpath, binpath = parse_last_rolling_files(textfile, offset,
-                                                             datalen)
+                txtpath, bpath = parse_last_rolling_files(textfile, offset,
+                                                          datalen)
+                if txtpath == textpath:
+                    break
+                if bpath == binpath:
+                    break
+                textpath = txtpath
+                binpath = bpath
                # Rolling event detected, close the current bin file, then open
                # the renamed bin file.
                flock(binfile, LOCK_UN)
@@ -716,9 +739,29 @@ class Logger(object):
        else:
            self.logentries.append(
                [ltype, timestamp, logdata, event, eventdata])
-        if self.writer is None:
-            self.writer = eventlet.spawn_after(2, self.writedata)
+        if self.buffered:
+            if self.writer is None:
+                self.writer = eventlet.spawn_after(2, self.writedata)
+        else:
+            self.writedata()

    def closelog(self):
        self.handler.close()
        self.closer = None
+
+globaleventlog = None
+tracelog = None
+
+
+def log(logdata=None, ltype=None, event=0, eventdata=None):
+    global globaleventlog
+    if globaleventlog is None:
+        globaleventlog = Logger('events')
+    globaleventlog.log(logdata, ltype, event, eventdata)
+
+def logtrace():
+    global tracelog
+    if tracelog is None:
+        tracelog = Logger('trace', buffered=False)
+    tracelog.log(traceback.format_exc(), ltype=DataTypes.event,
+                 event=Events.stacktrace)
@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

 # Copyright 2014 IBM Corporation
-# Copyright 2015 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@ except ImportError:
    #On platforms without pwd, give up on the sockapi in general and be http
    #only for now
    pass
+import confluent.discovery.core as disco
 import eventlet
 dbgif = False
 if  map(int, (eventlet.__version__.split('.'))) > [0, 18]:
@@ -77,8 +78,8 @@ def _daemonize():
    os.open(os.devnull, os.O_RDWR)
    os.dup2(0, 1)
    os.dup2(0, 2)
-    sys.stdout = log.Logger('stdout')
-    sys.stderr = log.Logger('stderr')
+    sys.stdout = log.Logger('stdout', buffered=False)
+    sys.stderr = log.Logger('stderr', buffered=False)


 def _updatepidfile():
@@ -89,15 +90,41 @@ def _updatepidfile():
    pidfile.close()


+def is_running():
+    # Utility function for utilities to check if confluent is running
+    try:
+        pidfile = open('/var/run/confluent/pid', 'r+')
+        fcntl.flock(pidfile, fcntl.LOCK_SH)
+        pid = pidfile.read()
+        if pid != '':
+            try:
+                os.kill(int(pid), 0)
+                return pid
+            except OSError:
+                # There is no process running by that pid, must be stale
+                pass
+        fcntl.flock(pidfile, fcntl.LOCK_UN)
+        pidfile.close()
+    except IOError:
+        pass
+    return None
+
+
 def _checkpidfile():
    try:
        pidfile = open('/var/run/confluent/pid', 'r+')
        fcntl.flock(pidfile, fcntl.LOCK_EX)
        pid = pidfile.read()
        if pid != '':
-            print ('/var/run/confluent/pid exists and indicates %s is still '
-                   'running' % pid)
-            sys.exit(1)
+            try:
+                os.kill(int(pid), 0)
+                print ('/var/run/confluent/pid exists and indicates %s is still '
+                       'running' % pid)
+                sys.exit(1)
+            except OSError:
+                # There is no process running by that pid, must be stale
+                pass
+        pidfile.seek(0)
        pidfile.write(str(os.getpid()))
        fcntl.flock(pidfile, fcntl.LOCK_UN)
        pidfile.close()
@@ -136,7 +163,7 @@ def dumptrace(signalname, frame):
            continue
        if not o:
            continue
-        ht.write('Thread trace:\n')
+        ht.write('Thread trace: ({0})\n'.format(id(o)))
        ht.write(''.join(traceback.format_stack(o.gr_frame)))
    ht.close()

@@ -177,7 +204,10 @@ def setlimits():

 def run():
    setlimits()
-    signal.signal(signal.SIGUSR1, dumptrace)
+    try:
+        signal.signal(signal.SIGUSR1, dumptrace)
+    except AttributeError:
+        pass   # silly windows
    if havefcntl:
        _checkpidfile()
    conf.init_config()
@@ -196,28 +226,34 @@ def run():
    _daemonize()
    if havefcntl:
        _updatepidfile()
-    auth.init_auth()
    signal.signal(signal.SIGINT, terminate)
    signal.signal(signal.SIGTERM, terminate)
-    #TODO(jbjohnso): eventlet has a bug about unix domain sockets, this code
-    #works with bugs fixed
    if dbgif:
        oumask = os.umask(0077)
-        dbgsock = eventlet.listen("/var/run/confluent/dbg.sock",
-                                   family=socket.AF_UNIX)
-        eventlet.spawn_n(backdoor.backdoor_server, dbgsock)
+        try:
+            os.remove('/var/run/confluent/dbg.sock')
+        except OSError:
+            pass  # We are not expecting the file to exist
+        try:
+            dbgsock = eventlet.listen("/var/run/confluent/dbg.sock",
+                                       family=socket.AF_UNIX)
+            eventlet.spawn_n(backdoor.backdoor_server, dbgsock)
+        except AttributeError:
+            pass  # Windows...
        os.umask(oumask)
    http_bind_host, http_bind_port = _get_connector_config('http')
    sock_bind_host, sock_bind_port = _get_connector_config('socket')
-    consoleserver.start_console_sessions()
    webservice = httpapi.HttpApi(http_bind_host, http_bind_port)
    webservice.start()
+    disco.start_detection()
    try:
        sockservice = sockapi.SockApi(sock_bind_host, sock_bind_port)
        sockservice.start()
    except NameError:
        pass
    atexit.register(doexit)
+    eventlet.sleep(1)
+    consoleserver.start_console_sessions()
    while 1:
        eventlet.sleep(100)

@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4

 # Copyright 2014 IBM Corporation
-# Copyright 2015-2016 Lenovo
+# Copyright 2015-2017 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -19,6 +19,8 @@
 # Things are defined here to 'encourage' developers to coordinate information
 # format.  This is also how different data formats are supported
 import confluent.exceptions as exc
+import confluent.config.configmanager as cfm
+from copy import deepcopy
 from datetime import datetime
 import json

@@ -58,6 +60,7 @@ def _htmlify_structure(indict):


 class ConfluentMessage(object):
+    apicode = 200
    readonly = False
    defaultvalue = ''
    defaulttype = 'text'
@@ -136,7 +139,10 @@ class ConfluentMessage(object):
                        '<input type="checkbox" name="restexplorerhonorkey" '
                        'value="{1}">\r').format(valtype, key, self.desc)
                return snippet
-            if val is not None and 'value' in val:
+            if (isinstance(val, bool) or isinstance(val, str) or
+                    isinstance(val, unicode)):
+                value = str(val)
+            elif val is not None and 'value' in val:
                value = val['value']
                if 'inheritedfrom' in val:
                    notes.append('Inherited from %s' % val['inheritedfrom'])
@@ -160,7 +166,7 @@ class ConfluentMessage(object):
                    notes.append('Inherited from %s' % val['inheritedfrom'])
                value = '********'
            if self.readonly:
-                snippet += "{0}: {1}".format(key, value)
+                snippet += "{0}: {1}<br>".format(key, value)
            else:
                snippet += (key + ":" +
                            '<input type="{0}" name="{1}" value="{2}" '
@@ -173,12 +179,15 @@ class ConfluentMessage(object):


 class ConfluentNodeError(object):
+    apicode = 500
+
    def __init__(self, node, errorstr):
        self.node = node
        self.error = errorstr

    def raw(self):
-        return {'databynode': {self.node: {'error': self.error}}}
+        return {'databynode': {self.node: {'errorcode': self.apicode,
+                                           'error': self.error}}}

    def html(self):
        return self.node + ":" + self.error
@@ -189,16 +198,32 @@ class ConfluentNodeError(object):
        raise Exception(self.error)


+class ConfluentResourceUnavailable(ConfluentNodeError):
+    apicode = 503
+
+    def __init__(self, node, errstr='Unavailable'):
+        self.node = node
+        self.error = errstr
+
+    def strip_node(self, node):
+        raise exc.TargetResourceUnavailable()
+
+
 class ConfluentTargetTimeout(ConfluentNodeError):
+    apicode = 504
+
    def __init__(self, node, errstr='timeout'):
        self.node = node
        self.error = errstr

+
    def strip_node(self, node):
        raise exc.TargetEndpointUnreachable(self.error)


 class ConfluentTargetNotFound(ConfluentNodeError):
+    apicode = 404
+
    def __init__(self, node, errorstr='not found'):
        self.node = node
        self.error = errorstr
@@ -208,6 +233,7 @@ class ConfluentTargetNotFound(ConfluentNodeError):


 class ConfluentTargetInvalidCredentials(ConfluentNodeError):
+    apicode = 502
    def __init__(self, node):
        self.node = node
        self.error = 'bad credentials'
@@ -217,9 +243,26 @@ class ConfluentTargetInvalidCredentials(ConfluentNodeError):


 class DeletedResource(ConfluentMessage):
+    notnode = True
    def __init__(self, resource):
-        self.kvpairs = {}
+        self.kvpairs = {'deleted': resource}

+    def strip_node(self, node):
+        pass
+
+class CreatedResource(ConfluentMessage):
+    notnode = True
+    readonly = True
+
+    def __init__(self, resource):
+        self.kvpairs = {'created': resource}
+
+class AssignedResource(ConfluentMessage):
+    notnode = True
+    readonly = True
+
+    def __init__(self, resource):
+        self.kvpairs = {'assigned': resource}

 class ConfluentChoiceMessage(ConfluentMessage):
    valid_values = set()
@@ -314,9 +357,20 @@ class ChildCollection(LinkRelation):
                                                                  extension)


-def get_input_message(path, operation, inputdata, nodes=None, multinode=False):
+# TODO(jjohnson2): enhance the following to support expressions:
+# InputNetworkConfiguration
+# InputMCI
+# InputDomainName
+# InputNTPServer
+def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
+                      configmanager=None):
    if path[0] == 'power' and path[1] == 'state' and operation != 'retrieve':
        return InputPowerMessage(path, nodes, inputdata)
+    elif (path in (['power', 'reseat'], ['_enclosure', 'reseat_bay']) and
+            operation != 'retrieve'):
+        return InputReseatMessage(path, nodes, inputdata)
+    elif path == ['attributes', 'expression']:
+        return InputExpression(path, inputdata, nodes)
    elif path[0] in ('attributes', 'users') and operation != 'retrieve':
        return InputAttributes(path, inputdata, nodes)
    elif path == ['boot', 'nextdevice'] and operation != 'retrieve':
@@ -340,7 +394,8 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False):
        return InputMCI(path, nodes, inputdata)
    elif (path[:4] == ['configuration', 'management_controller',
            'net_interfaces', 'management'] and operation != 'retrieve'):
-        return InputNetworkConfiguration(path, nodes, inputdata)
+        return InputNetworkConfiguration(path, nodes, inputdata,
+                                         configmanager)
    elif (path[:3] == ['configuration', 'management_controller', 'domain_name']
            and operation != 'retrieve'):
        return InputDomainName(path, nodes, inputdata)
@@ -350,8 +405,18 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False):
    elif (path[:4] == ['configuration', 'management_controller', 'ntp',
            'servers'] and operation != 'retrieve' and len(path) == 5):
        return InputNTPServer(path, nodes, inputdata)
+    elif 'inventory/firmware/updates/active' in '/'.join(path) and inputdata:
+        return InputFirmwareUpdate(path, nodes, inputdata)
    elif inputdata:
-        raise exc.InvalidArgumentException()
+        raise exc.InvalidArgumentException(
+            'No known input handler for request')
+
+class InputFirmwareUpdate(ConfluentMessage):
+
+    def __init__(self, path, nodes, inputdata):
+        self.filename = inputdata['filename']
+        self.bank = inputdata.get('bank', None)
+        self.nodes = nodes


 class InputAlertData(ConfluentMessage):
@@ -376,10 +441,39 @@ class InputAlertData(ConfluentMessage):
        return self.alertparams


-class InputAttributes(ConfluentMessage):
+class InputExpression(ConfluentMessage):
+    # This is specifically designed to suppress the expansion of an expression
+    # so that it can make it intact to the pertinent configmanager function
+    def __init__(self, path, inputdata, nodes=None):
+        self.nodeattribs = {}
+        if not inputdata:
+            raise exc.InvalidArgumentException('no request data provided')
+        if nodes is None:
+            self.attribs = inputdata
+            return
+        for node in nodes:
+            self.nodeattribs[node] = inputdata
+
+    def get_attributes(self, node):
+        if node not in self.nodeattribs:
+            return {}
+        nodeattr = deepcopy(self.nodeattribs[node])
+        return nodeattr
+
+
+class InputAttributes(ConfluentMessage):
+    # This is particularly designed for attributes, where a simple string
+    # should become either a string value or a dict with {'expression':} to
+    # preserve the client provided expression for posterity, rather than
+    # immediate consumption.
+    # for things like node configuration or similar, a different class is
+    # appropriate since it nedes to immediately expand an expression.
+    # with that class, the 'InputExpression' and calling code in attributes.py
+    # might be deprecated in favor of the generic expression expander
+    # and a small function in attributes.py to reflect the expansion back
+    # to the client
    def __init__(self, path, inputdata, nodes=None):
        self.nodeattribs = {}
-        nestedmode = False
        if not inputdata:
            raise exc.InvalidArgumentException('no request data provided')
        if nodes is None:
@@ -404,21 +498,12 @@ class InputAttributes(ConfluentMessage):
                            'expression': self.attribs[attrib]}
            return
        for node in nodes:
-            if node in inputdata:
-                nestedmode = True
-                self.nodeattribs[node] = inputdata[node]
-        if nestedmode:
-            for key in inputdata:
-                if key not in nodes:
-                    raise exc.InvalidArgumentException
-        else:
-            for node in nodes:
-                self.nodeattribs[node] = inputdata
+            self.nodeattribs[node] = inputdata

    def get_attributes(self, node):
        if node not in self.nodeattribs:
            return {}
-        nodeattr = self.nodeattribs[node]
+        nodeattr = deepcopy(self.nodeattribs[node])
        for attr in nodeattr:
            if type(nodeattr[attr]) in (str, unicode):
                try:
@@ -450,19 +535,19 @@ class InputCredential(ConfluentMessage):

    def __init__(self, path, inputdata, nodes=None):
        self.credentials = {}
-        nestedmode = False
        if not inputdata:
            raise exc.InvalidArgumentException('no request data provided')

        if len(path) == 4:
            inputdata['uid'] = path[-1]
        # if the operation is 'create' check if all fields are present
-        elif ('uid' not in inputdata or 'privilege_level' not in inputdata or
-                'username' not in inputdata or 'password' not in inputdata):
-            raise exc.InvalidArgumentException('all fields are required')
-
-        if 'uid' not in inputdata:
-            raise exc.InvalidArgumentException('uid is missing')
+        missingattrs = []
+        for attrname in ('uid', 'privilege_level', 'username', 'password'):
+            if attrname not in inputdata:
+                missingattrs.append(attrname)
+        if missingattrs:
+            raise exc.InvalidArgumentException(
+                'Required fields missing: {0}'.format(','.join(missingattrs)))
        if (isinstance(inputdata['uid'], str) and
                not inputdata['uid'].isdigit()):
            raise exc.InvalidArgumentException('uid must be a number')
@@ -492,7 +577,7 @@ class InputCredential(ConfluentMessage):
    def get_attributes(self, node):
        if node not in self.credentials:
            return {}
-        credential = self.credentials[node]
+        credential = deepcopy(self.credentials[node])
        for attr in credential:
            if type(credential[attr]) in (str, unicode):
                try:
@@ -524,7 +609,7 @@ class ConfluentInputMessage(ConfluentMessage):
                if self.keyname not in datum:
                    raise exc.InvalidArgumentException(
                        'missing {0} argument'.format(self.keyname))
-                elif datum[self.keyname] not in self.valid_values:
+                elif not self.is_valid_key(datum[self.keyname]):
                    raise exc.InvalidArgumentException(
                        datum[self.keyname] + ' is not one of ' +
                        ','.join(self.valid_values))
@@ -534,13 +619,15 @@ class ConfluentInputMessage(ConfluentMessage):
            if self.keyname not in datum:
                raise exc.InvalidArgumentException(
                    'missing {0} argument'.format(self.keyname))
-            elif datum[self.keyname] not in self.valid_values:
+            elif not self.is_valid_key(datum[self.keyname]):
                raise exc.InvalidArgumentException(datum[self.keyname] +
                                                   ' is not one of ' +
                                                   ','.join(self.valid_values))
            for node in nodes:
                self.inputbynode[node] = datum[self.keyname]

+    def is_valid_key(self, key):
+        return key in self.valid_values

 class InputIdentifyMessage(ConfluentInputMessage):
    valid_values = set([
@@ -564,6 +651,16 @@ class InputPowerMessage(ConfluentInputMessage):
    def powerstate(self, node):
        return self.inputbynode[node]

+class InputReseatMessage(ConfluentInputMessage):
+    valid_values = set([
+        'reseat',
+    ])
+
+    keyname = 'reseat'
+
+    def is_valid_key(self, key):
+        return key in self.valid_values or isinstance(key, int)
+

 class InputBMCReset(ConfluentInputMessage):
    valid_values = set([
@@ -595,7 +692,7 @@ class InputMCI(ConfluentInputMessage):


 class InputNetworkConfiguration(ConfluentInputMessage):
-    def __init__(self, path, nodes, inputdata):
+    def __init__(self, path, nodes, inputdata, configmanager=None):
        self.inputbynode = {}
        self.stripped = False
        if not inputdata:
@@ -619,8 +716,27 @@ class InputNetworkConfiguration(ConfluentInputMessage):
        if nodes is None:
            raise exc.InvalidArgumentException(
                'This only supports per-node input')
+        nodeattrmap = {}
+        for attr in inputdata:
+            try:
+                if inputdata[attr] is not None:
+                    inputdata[attr].format()
+            except (KeyError, IndexError):
+                nodeattrmap[attr] = {}
+                for expanded in configmanager.expand_attrib_expression(
+                        nodes, inputdata[attr]):
+                    node, value = expanded
+                    nodeattrmap[attr][node] = value
+        if not nodeattrmap:
+            for node in nodes:
+                self.inputbynode[node] = inputdata
+            return
+        # an expression was encountered
        for node in nodes:
-            self.inputbynode[node] = inputdata
+            self.inputbynode[node] = deepcopy(inputdata)
+            for attr in self.inputbynode[node]:
+                if attr in nodeattrmap:
+                    self.inputbynode[node][attr] = nodeattrmap[attr][node]

    def netconfig(self, node):
        return self.inputbynode[node]
@@ -775,6 +891,13 @@ class IdentifyState(ConfluentChoiceMessage):
    keyname = 'identify'


+class ReseatResult(ConfluentChoiceMessage):
+    valid_values = set([
+        'success',
+    ])
+    keyname = 'reseat'
+
+
 class PowerState(ConfluentChoiceMessage):
    valid_values = set([
        'on',
@@ -786,6 +909,11 @@ class PowerState(ConfluentChoiceMessage):
    ])
    keyname = 'state'

+    def __init__(self, node, state, oldstate=None):
+        super(PowerState, self).__init__(node, state)
+        if oldstate is not None:
+            self.kvpairs[node]['oldstate'] = {'value': oldstate}
+

 class BMCReset(ConfluentChoiceMessage):
    valid_values = set([
@@ -869,6 +997,11 @@ class AsyncMessage(ConfluentMessage):
        if (isinstance(rsp, ConfluentMessage) or
                isinstance(rsp, ConfluentNodeError)):
            rspdict = rsp.raw()
+        elif isinstance(rsp, exc.ConfluentException):
+            rspdict = {'exceptioncode': rsp.apierrorcode,
+                       'exception': rsp.get_error_body()}
+        elif isinstance(rsp, Exception):
+            rspdict = {'exceptioncode': 500, 'exception': str(rsp)}
        elif isinstance(rsp, dict):  # console metadata
            rspdict = rsp
        else: # terminal text
@@ -0,0 +1,64 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2016 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# A consolidated manage of neighbor table information management.
+# Ultimately, this should use AF_NETLINK, but in the interest of time,
+# use ip neigh for the moment
+
+import eventlet.green.subprocess as subprocess
+import os
+
+neightable = {}
+neightime = 0
+
+import re
+
+_validmac = re.compile('..:..:..:..:..:..')
+
+
+def update_neigh():
+    global neightable
+    global neightime
+    neightable = {}
+    if os.name == 'nt':
+        return
+    ipn = subprocess.Popen(['ip', 'neigh'], stdin=subprocess.PIPE,
+                                 stdout=subprocess.PIPE,
+                                 stderr=subprocess.PIPE)
+    (neighdata, err) = ipn.communicate()
+    for entry in neighdata.split('\n'):
+        entry = entry.split(' ')
+        if len(entry) < 5 or not entry[4]:
+            continue
+        if entry[0] in ('192.168.0.100', '192.168.70.100', '192.168.70.125'):
+            # Note that these addresses are common static ip addresses
+            # that are hopelessly ambiguous if there are many
+            # so ignore such entries and move on
+            # ideally the system network steers clear of this landmine of
+            # a subnet, but just in case
+            continue
+        if not _validmac.match(entry[4]):
+            continue
+        neightable[entry[0]] = entry[4]
+    neightime = os.times()[4]
+
+
+def refresh_neigh():
+    global neightime
+    if os.name == 'nt':
+        return
+    if os.times()[4] > (neightime + 30):
+        update_neigh()
@@ -0,0 +1,124 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# this will implement noderange grammar
+
+
+import codecs
+import struct
+import eventlet.green.socket as socket
+import eventlet.support.greendns
+getaddrinfo = eventlet.support.greendns.getaddrinfo
+
+
+def ip_on_same_subnet(first, second, prefix):
+    addrinf = socket.getaddrinfo(first, None, 0, socket.SOCK_STREAM)[0]
+    fam = addrinf[0]
+    ip = socket.inet_pton(fam, addrinf[-1][0])
+    ip = int(codecs.encode(bytes(ip), 'hex'), 16)
+    addrinf = socket.getaddrinfo(second, None, 0, socket.SOCK_STREAM)[0]
+    if fam != addrinf[0]:
+        return False
+    oip = socket.inet_pton(fam, addrinf[-1][0])
+    oip = int(codecs.encode(bytes(oip), 'hex'), 16)
+    if fam == socket.AF_INET:
+        addrlen = 32
+    elif fam == socket.AF_INET6:
+        addrlen = 128
+    else:
+        raise Exception("Unknown address family {0}".format(fam))
+    mask = 2 ** prefix - 1 << (addrlen - prefix)
+    return ip & mask == oip & mask
+
+
+# TODO(jjohnson2): have a method to arbitrate setting methods, to aid
+# in correct matching of net.* based on parameters, mainly for pxe
+# The scheme for pxe:
+# For one: the candidate net.* should have pxe set to true, to help
+# disambiguate from interfaces meant for bmc access
+# bmc relies upon hardwaremanagement.manager, plus we don't collect
+# that mac address
+# the ip as reported by recvmsg to match the subnet of that net.* interface
+# if switch and port available, that should match.
+def get_nic_config(configmanager, node, ip=None, mac=None):
+    """Fetch network configuration parameters for a nic
+    
+    For a given node and interface, find and retrieve the pertinent network
+    configuration data.  The desired configuration can be searched
+    either by ip or by mac.
+    
+    :param configmanager: The relevant confluent.config.ConfigManager 
+        instance.
+    :param node:  The name of the node
+    :param ip:  An IP address on the intended subnet
+    :param mac: The mac address of the interface
+    
+    :returns: A dict of parameters, 'ipv4_gateway', ....
+    """
+    # ip parameter *could* be the result of recvmsg with cmsg to tell
+    # pxe *our* ip address, or it could be the desired ip address
+    #TODO(jjohnson2): ip address, prefix length, mac address,
+    # join a bond/bridge, vlan configs, etc.
+    # also other nic criteria, physical location, driver and index...
+    nodenetattribs = configmanager.get_node_attributes(
+        node, 'net*.ipv4_gateway').get(node, {})
+    cfgdata = {
+        'ipv4_gateway': None,
+        'prefix': None,
+    }
+    if ip is not None:
+        prefixlen = get_prefix_len_for_ip(ip)
+        cfgdata['prefix'] = prefixlen
+        for setting in nodenetattribs:
+            gw = nodenetattribs[setting].get('value', None)
+            if gw is None:
+                continue
+            if ip_on_same_subnet(ip, gw, prefixlen):
+                cfgdata['ipv4_gateway'] = gw
+                break
+    return cfgdata
+
+
+def get_prefix_len_for_ip(ip):
+    # for now, we'll use the system route table
+    # later may provide for configuration lookup to override the route
+    # table
+    ip = getaddrinfo(ip, 0, socket.AF_INET)[0][-1][0]
+    try:
+        ipn = socket.inet_aton(ip)
+    except socket.error:  # For now, assume 64 for ipv6
+        return 64
+    # It comes out big endian, regardless of host arch
+    ipn = struct.unpack('>I', ipn)[0]
+    rf = open('/proc/net/route')
+    ri = rf.read()
+    rf.close()
+    ri = ri.split('\n')[1:]
+    for rl in ri:
+        if not rl:
+            continue
+        rd = rl.split('\t')
+        if rd[1] == '00000000':  # default gateway, not useful for this
+            continue
+        # don't have big endian to look at, assume that it is host endian
+        maskn = struct.unpack('I', struct.pack('>I', int(rd[7], 16)))[0]
+        netn = struct.unpack('I', struct.pack('>I', int(rd[1], 16)))[0]
+        if ipn & maskn == netn:
+            nbits = 0
+            while maskn:
+                nbits += 1
+                maskn = maskn << 1 & 0xffffffff
+            return nbits
+    raise exc.NotImplementedException("Non local addresses not supported")
@@ -0,0 +1,326 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2016, 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This provides the implementation of locating MAC addresses on ethernet
+# switches.  It is, essentially, a port of 'MacMap.pm' to confluent.
+# However, there are enhancements.
+# For one, each switch interrogation is handled in an eventlet 'thread'
+# For another, MAC addresses are checked in the dictionary on every
+# switch return, rather than waiting for all switches to check in
+# (which makes it more responsive when there is a missing or bad switch)
+# Also, we track the quantity, actual ifName value, and provide a mechanism
+# to detect ambiguous result (e.g. if two matches are found, can log an error
+# rather than doing the wrong one, complete with the detected ifName value).
+# Further, the map shall be available to all facets of the codebase, not just
+# the discovery process, so that the cached data maintenance will pay off
+# for direct queries
+
+# Provides support for viewing and processing lldp data for switches
+
+if __name__ == '__main__':
+    import sys
+    import confluent.config.configmanager as cfm
+import confluent.exceptions as exc
+import confluent.log as log
+import confluent.messages as msg
+import confluent.snmputil as snmp
+import confluent.networking.netutil as netutil
+import confluent.util as util
+import eventlet
+from eventlet.greenpool import GreenPool
+import eventlet.semaphore
+import re
+
+# The interesting OIDs are:
+# lldpLocChassisId - to cross reference (1.0.8802.1.1.2.1.3.2.0)
+# lldpLocPortId - for cross referencing.. (1.0.8802.1.1.2.1.3.7.1.3)
+# 1.0.8802.1.1.2.1.3.7.1.4 - Lookup of LLDP index id to description
+#                            Yet another fun fact, the LLDP port index frequent
+#                            does *not* map to ifName, like a sane
+#                            implementation would do.  Assume ifName equality
+#                            but provide a way for 1.3.6.1.2.1.1 indicated
+#                            ids to provide custom functions
+#  (1.0.8802.1.1.2.1.3.7.1.2 - theoretically this process is only very useful
+#                              if this is '5' meaning 'same as ifName per
+#                              802.1AB-2005, however at *least* 7 has
+#                              been observed to produce same results
+#                              For now we'll optimistically assume
+#                              equality to ifName
+# 1.0.8802.1.1.2.1.4.1.1 - The information about the remote systems attached
+#                            indexed by time index, local port, and an
+#                            incrementing value
+# 1.0.8802.1.1.2.1.4.1.1.5 - chassis id - in theory might have been useful, in
+#                            practice limited as the potential to correlate
+#                            to other contexts is limited.  As a result,
+#                            our strategy will be to ignore this and focus
+#                            instead on bridge-mib/qbridge-mib indicate data
+#                            a potential exception would be pulling in things
+#                            that are fundamentally network equipment,
+#                            where significant ambiguity may exist.
+#                            While in a 'host' scenario, there is ambiguity
+#                            it is more controlled (virtual machines are given
+#                            special treatment, and strategies exist for
+#                            disambiguating shared management/data port, and
+#                            other functions do not interact with our discovery
+#                            framework
+# # 1.0.8802.1.1.2.1.4.1.1.9 - SysName - could be handy hint in some scenarios
+# # 1.0.8802.1.1.2.1.4.1.1.10 - SysDesc - good stuff
+
+
+_neighdata = {}
+_neighbypeerid = {}
+_updatelocks = {}
+_chassisidbyswitch = {}
+
+def lenovoname(idx, desc):
+    if desc.isdigit():
+        return 'Ethernet' + str(idx)
+    return desc
+
+nameoverrides = [
+    (re.compile('20301\..*'), lenovoname),
+]
+
+# Lenovo chassis id rule is match only first 5 bytes for a match.....
+
+def _api_sanitize_string(source):
+    source = source.strip()
+    return source.replace(':', '-').replace('/', '-')
+
+def close_enough(fuzz, literal):
+    if fuzz == literal:
+        return True
+    fuzz = '^' + fuzz.replace('-', '[/: -]') + '$'
+    matcher = re.compile(fuzz)
+    return bool(matcher.match(literal))
+
+
+def _lldpdesc_to_ifname(switchid, idx, desc):
+    for tform in nameoverrides:
+        if tform[0].match(switchid):
+            desc = tform[1](idx, desc)
+    return desc.strip().strip('\x00')
+
+
+def _dump_neighbordatum(info):
+    return [msg.KeyValueData(info)]
+
+
+def _extract_extended_desc(info, source, integritychecked):
+    source = str(source)
+    info['verified']  = bool(integritychecked)
+    if source.startswith('Lenovo SMM;'):
+        info['peerdescription'] = 'Lenovo SMM'
+        if ';S2=' in source:
+            info['peersha256fingerprint'] = source.replace('Lenovo SMM;S2=',
+                                                           '')
+    else:
+        info['peerdescription'] = source
+
+def sanitize(val):
+    val = str(val)
+    for x in val.strip('\x00'):
+        if ord(x) < 32 or ord(x) > 128:
+            val = ':'.join(['{0:02x}'.format(ord(x)) for x in str(val)])
+            break
+    return val
+
+def _init_lldp(data, iname, idx, idxtoportid, switch):
+    if iname not in data:
+        data[iname] = {'port': iname, 'portid': str(idxtoportid[idx]),
+                       'chassisid': str(_chassisidbyswitch[switch])}
+
+def _extract_neighbor_data_b(args):
+    """Build LLDP data about elements connected to switch
+
+    args are carried as a tuple, because of eventlet convenience
+    """
+    switch, password, user, force = args
+    vintage = _neighdata.get(switch, {}).get('!!vintage', 0)
+    now = util.monotonic_time()
+    if vintage > (now - 60) and not force:
+        return
+    conn = snmp.Session(switch, password, user)
+    sid = None
+    lldpdata = {'!!vintage': now}
+    for sysid in conn.walk('1.3.6.1.2.1.1.2'):
+        sid = str(sysid[1][6:])
+    idxtoifname = {}
+    idxtoportid = {}
+    _chassisidbyswitch[switch] = list(conn.walk('1.0.8802.1.1.2.1.3.2'))[0][1]
+    for oidindex in conn.walk('1.0.8802.1.1.2.1.3.7.1.3'):
+        idx = oidindex[0][-1]
+        idxtoportid[idx] = sanitize(oidindex[1])
+    for oidindex in conn.walk('1.0.8802.1.1.2.1.3.7.1.4'):
+        idx = oidindex[0][-1]
+        idxtoifname[idx] = _lldpdesc_to_ifname(sid, idx, str(oidindex[1]))
+    for remotedesc in conn.walk('1.0.8802.1.1.2.1.4.1.1.10'):
+        iname = idxtoifname[remotedesc[0][-2]]
+        _init_lldp(lldpdata, iname, remotedesc[0][-2], idxtoportid, switch)
+        _extract_extended_desc(lldpdata[iname], remotedesc[1], user)
+    for remotename in conn.walk('1.0.8802.1.1.2.1.4.1.1.9'):
+        iname = idxtoifname[remotename[0][-2]]
+        _init_lldp(lldpdata, iname, remotename[0][-2], idxtoportid, switch)
+        lldpdata[iname]['peername'] = str(remotename[1])
+    for remotename in conn.walk('1.0.8802.1.1.2.1.4.1.1.7'):
+        iname = idxtoifname[remotename[0][-2]]
+        _init_lldp(lldpdata, iname, remotename[0][-2], idxtoportid, switch)
+        lldpdata[iname]['peerportid'] = sanitize(remotename[1])
+    for remoteid in conn.walk('1.0.8802.1.1.2.1.4.1.1.5'):
+        iname = idxtoifname[remoteid[0][-2]]
+        _init_lldp(lldpdata, iname, remoteid[0][-2], idxtoportid, switch)
+        lldpdata[iname]['peerchassisid'] = sanitize(remoteid[1])
+    for entry in lldpdata:
+        if entry == '!!vintage':
+            continue
+        entry = lldpdata[entry]
+        entry['switch'] = switch
+        peerid = '{0}.{1}'.format(
+            entry.get('peerchassisid', '').replace(':', '-').replace('/', '-'),
+            entry.get('peerportid', '').replace(':', '-').replace('/', '-'))
+        entry['peerid'] = peerid
+        _neighbypeerid[peerid] = entry
+    _neighdata[switch] = lldpdata
+
+
+def update_switch_data(switch, configmanager, force=False):
+    switchcreds = netutil.get_switchcreds(configmanager, (switch,))[0]
+    _extract_neighbor_data(switchcreds + (force,))
+    return _neighdata.get(switch, {})
+
+
+def update_neighbors(configmanager, force=False):
+    return _update_neighbors_backend(configmanager, force)
+
+
+def _update_neighbors_backend(configmanager, force):
+    global _neighdata
+    global _neighbypeerid
+    vintage = _neighdata.get('!!vintage', 0)
+    now = util.monotonic_time()
+    if vintage > (now - 60) and not force:
+        return
+    _neighdata = {'!!vintage': now}
+    _neighbypeerid = {'!!vintage': now}
+    switches = netutil.list_switches(configmanager)
+    switchcreds = netutil.get_switchcreds(configmanager, switches)
+    switchcreds = [ x + (force,) for x in switchcreds]
+    pool = GreenPool(64)
+    for ans in pool.imap(_extract_neighbor_data, switchcreds):
+        yield ans
+
+
+def _extract_neighbor_data(args):
+    # single switch neighbor data update
+    switch = args[0]
+    if switch not in _updatelocks:
+        _updatelocks[switch] = eventlet.semaphore.Semaphore()
+    if _updatelocks[switch].locked():
+        while _updatelocks[switch].locked():
+            eventlet.sleep(1)
+        return
+    try:
+        with _updatelocks[switch]:
+            _extract_neighbor_data_b(args)
+    except Exception:
+        log.logtrace()
+
+if __name__ == '__main__':
+    # a quick one-shot test, args are switch and snmpv1 string for now
+    # (should do three argument form for snmpv3 test
+    import sys
+    _extract_neighbor_data((sys.argv[1], sys.argv[2], None, True))
+    print(repr(_neighdata))
+
+
+multi_selectors = set(['by-switch', 'by-peername', 'by-peerportid',
+                        'by-peerchassisid', 'by-chassisid', 'by-port',
+                        'by-portid'])
+single_selectors = set(['by-peerid'])
+
+def _parameterize_path(pathcomponents):
+    listrequested = False
+    childcoll = True
+    if len(pathcomponents) % 2 == 1:
+        listrequested = pathcomponents[-1]
+        pathcomponents = pathcomponents[:-1]
+    pathit = iter(pathcomponents)
+    keyparams = {}
+    validselectors = multi_selectors | single_selectors
+    for key, val in zip(pathit, pathit):
+        if key not in validselectors:
+            raise exc.NotFoundException('{0} is not valid here'.format(key))
+        keyparams[key] = val
+        validselectors.discard(key)
+        if key == 'by-switch':
+            validselectors.add('by-port')
+        if key in single_selectors:
+            childcoll = False
+            validselectors = set([])
+    return validselectors, keyparams, listrequested, childcoll
+
+def list_info(parms, requestedparameter):
+    #{u'by-switch': u'r8e1', u'by-port': u'e'}
+    #by-peerport
+    suffix = '/' if requestedparameter in multi_selectors else ''
+    results = set([])
+    requestedparameter = requestedparameter.replace('by-', '')
+    for info in _neighbypeerid:
+        if info == '!!vintage':
+            continue
+        info = _neighbypeerid[info]
+        for mk in parms:
+            mk = mk.replace('by-', '')
+            if mk not in info:
+                continue
+            if (not close_enough(parms['by-' + mk], info[mk]) or
+                    requestedparameter not in info):
+                break
+        else:
+            candidate = info[requestedparameter]
+            candidate = candidate.strip()
+            if candidate != '':
+                results.add(_api_sanitize_string(candidate))
+    return [msg.ChildCollection(x + suffix) for x in util.natural_sort(results)]
+
+def _handle_neighbor_query(pathcomponents, configmanager):
+    choices, parms, listrequested, childcoll = _parameterize_path(
+        pathcomponents)
+    if not childcoll:  # this means it's a single entry with by-peerid
+        # guaranteed
+        if (parms['by-peerid'] not in _neighbypeerid and
+                _neighbypeerid.get('!!vintage', 0) < util.monotonic_time() - 60):
+            list(update_neighbors(configmanager))
+        if parms['by-peerid'] not in _neighbypeerid:
+            raise exc.NotFoundException('No matching peer known')
+        return _dump_neighbordatum(_neighbypeerid[parms['by-peerid']])
+    if not listrequested:  # the query is for currently valid choices
+        return [msg.ChildCollection(x + '/') for x in sorted(list(choices))]
+    if listrequested not in multi_selectors | single_selectors:
+        raise exc.NotFoundException('{0} is not found'.format(listrequested))
+    if 'by-switch' in parms:
+        update_switch_data(parms['by-switch'], configmanager)
+    else:
+        list(update_neighbors(configmanager))
+    return list_info(parms, listrequested)
+
+
+def _list_interfaces(switchname, configmanager):
+    switchcreds = get_switchcreds(configmanager, (switchname,))
+    switchcreds = switchcreds[0]
+    conn = snmp.Session(*switchcreds)
+    ifnames = netutil.get_portnamemap(conn)
+    return util.natural_sort(ifnames.values())
@@ -0,0 +1,479 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2016-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This provides the implementation of locating MAC addresses on ethernet
+# switches.  It is, essentially, a port of 'MacMap.pm' to confluent.
+# However, there are enhancements.
+# For one, each switch interrogation is handled in an eventlet 'thread'
+# For another, MAC addresses are checked in the dictionary on every
+# switch return, rather than waiting for all switches to check in
+# (which makes it more responsive when there is a missing or bad switch)
+# Also, we track the quantity, actual ifName value, and provide a mechanism
+# to detect ambiguous result (e.g. if two matches are found, can log an error
+# rather than doing the wrong one, complete with the detected ifName value).
+# Further, the map shall be available to all facets of the codebase, not just
+# the discovery process, so that the cached data maintenance will pay off
+# for direct queries
+
+# this module will provide mac to switch and full 'ifName' label
+# This functionality is restricted to the null tenant
+from confluent.networking.lldp import _handle_neighbor_query
+from confluent.networking.netutil import get_switchcreds, list_switches, get_portnamemap
+
+if __name__ == '__main__':
+    import sys
+    import confluent.config.configmanager as cfm
+import confluent.exceptions as exc
+import confluent.log as log
+import confluent.messages as msg
+import confluent.snmputil as snmp
+import confluent.util as util
+from eventlet.greenpool import GreenPool
+import eventlet
+import eventlet.semaphore
+import re
+
+_macmap = {}
+_macsbyswitch = {}
+_nodesbymac = {}
+_switchportmap = {}
+_neighdata = {}
+vintage = None
+
+
+_whitelistnames = (
+    # 3com
+    re.compile(r'^RMON Port (\d+) on unit \d+'),
+    # Dell
+    re.compile(r'^Unit \d+ Port (\d+)\Z'),
+)
+
+_blacklistnames = (
+    re.compile(r'vl'),
+    re.compile(r'Nu'),
+    re.compile(r'RMON'),
+    re.compile(r'onsole'),
+    re.compile(r'Stack'),
+    re.compile(r'Trunk'),
+    re.compile(r'po\d'),
+    re.compile(r'XGE'),
+    re.compile(r'LAG'),
+    re.compile(r'CPU'),
+    re.compile(r'Management'),
+)
+
+
+def _namesmatch(switchdesc, userdesc):
+    if switchdesc == userdesc:
+        return True
+    try:
+        portnum = int(userdesc)
+    except ValueError:
+        portnum = None
+    if portnum is not None:
+        for exp in _whitelistnames:
+            match = exp.match(switchdesc)
+            if match:
+                snum = int(match.groups()[0])
+                if snum == portnum:
+                    return True
+    anymatch = re.search(r'[^0123456789]' + userdesc + r'(\.0)?\Z', switchdesc)
+    if anymatch:
+        for blexp in _blacklistnames:
+            if blexp.match(switchdesc):
+                return False
+        return True
+    return False
+
+def _map_switch(args):
+    try:
+        return _map_switch_backend(args)
+    except UnicodeError:
+        log.log({'error': "Cannot resolve switch '{0}' to an address".format(
+            args[0])})
+    except exc.TargetEndpointUnreachable:
+        log.log({'error': "Timeout or bad SNMPv1 community string trying to "
+                         "reach switch '{0}'".format(
+            args[0])})
+    except exc.TargetEndpointBadCredentials:
+        log.log({'error': "Bad SNMPv3 credentials for \'{0}\'".format(
+            args[0])})
+    except Exception as e:
+        log.log({'error': 'Unexpected condition trying to reach switch "{0}"'
+                          ' check trace log for more'.format(args[0])})
+        log.logtrace()
+
+
+def _nodelookup(switch, ifname):
+    """Get a nodename for a given switch and interface name
+    """
+    for portdesc in _switchportmap.get(switch, {}):
+        if _namesmatch(ifname, portdesc):
+            return _switchportmap[switch][portdesc]
+    return None
+
+
+def _map_switch_backend(args):
+    """Manipulate portions of mac address map relevant to a given switch
+    """
+
+    # 1.3.6.1.2.1.17.7.1.2.2.1.2 - mactoindex (qbridge - preferred)
+    #  if not, check for cisco and if cisco, build list of all relevant vlans:
+    #  .1.3.6.1.4.1.9.9.46.1.6.1.1.5 - trunk port vlan map (cisco only)
+    #  .1.3.6.1.4.1.9.9.68.1.2.2.1.2 - access port vlan map (cisco only)
+    # if cisco, vlan community string indexed or snmpv3 contest for:
+    # 1.3.6.1.2.1.17.4.3.1.2 - mactoindx (bridge - low-end switches and cisco)
+    #     .1.3.6.1.2.1.17.1.4.1.2 - bridge index to if index map
+    # no vlan index or context for:
+    #  .1.3.6.1.2.1.31.1.1.1.1 - ifName... but some switches don't do it
+    #  .1.3.6.1.2.1.2.2.1.2 - ifDescr, usually useless, but a
+    #   fallback if ifName is empty
+    #
+    global _macmap
+    if len(args) == 3:
+        switch, password, user = args
+        if not user:
+            user = None
+    else:
+        switch, password = args
+        user = None
+    haveqbridge = False
+    mactobridge = {}
+    conn = snmp.Session(switch, password, user)
+    for vb in conn.walk('1.3.6.1.2.1.17.7.1.2.2.1.2'):
+        haveqbridge = True
+        oid, bridgeport = vb
+        if not bridgeport:
+            continue
+        oid = str(oid).rsplit('.', 6)  # if 7, then oid[1] would be vlan id
+        macaddr = '{0:02x}:{1:02x}:{2:02x}:{3:02x}:{4:02x}:{5:02x}'.format(
+            *([int(x) for x in oid[-6:]])
+        )
+        mactobridge[macaddr] = int(bridgeport)
+    if not haveqbridge:
+        for vb in conn.walk('1.3.6.1.2.1.17.4.3.1.2'):
+            oid, bridgeport = vb
+            if not bridgeport:
+                continue
+            oid = str(oid).rsplit('.', 6)
+            macaddr = '{0:02x}:{1:02x}:{2:02x}:{3:02x}:{4:02x}:{5:02x}'.format(
+                *([int(x) for x in oid[-6:]])
+            )
+            mactobridge[macaddr] = int(bridgeport)
+    bridgetoifmap = {}
+    for vb in conn.walk('1.3.6.1.2.1.17.1.4.1.2'):
+        bridgeport, ifidx = vb
+        bridgeport = int(str(bridgeport).rsplit('.', 1)[1])
+        try:
+            bridgetoifmap[bridgeport] = int(ifidx)
+        except ValueError:
+            # ifidx might be '', skip in such a case
+            continue
+    ifnamemap = get_portnamemap(conn)
+    maccounts = {}
+    bridgetoifvalid = False
+    for mac in mactobridge:
+        try:
+            ifname = ifnamemap[bridgetoifmap[mactobridge[mac]]]
+            bridgetoifvalid = True
+        except KeyError:
+            continue
+        if ifname not in maccounts:
+            maccounts[ifname] = 1
+        else:
+            maccounts[ifname] += 1
+    if not bridgetoifvalid:
+        bridgetoifmap = {}
+    # Not a single mac address resolved to an interface index, chances are
+    # that the switch is broken, and the mactobridge is reporting ifidx
+    # instead of bridge port index
+    # try again, skipping the bridgetoifmap lookup
+        for mac in mactobridge:
+            try:
+                ifname = ifnamemap[mactobridge[mac]]
+                bridgetoifmap[mactobridge[mac]] = mactobridge[mac]
+            except KeyError:
+                continue
+            if ifname not in maccounts:
+                maccounts[ifname] = 1
+            else:
+                maccounts[ifname] += 1
+    _macsbyswitch[switch] = {}
+    for mac in mactobridge:
+        # We want to merge it so that when a mac appears in multiple
+        # places, it is captured.
+        try:
+            ifname = ifnamemap[bridgetoifmap[mactobridge[mac]]]
+        except KeyError:
+            continue
+        if mac in _macmap:
+            _macmap[mac].append((switch, ifname, maccounts[ifname]))
+        else:
+            _macmap[mac] = [(switch, ifname, maccounts[ifname])]
+        if ifname in _macsbyswitch[switch]:
+            _macsbyswitch[switch][ifname].append(mac)
+        else:
+            _macsbyswitch[switch][ifname] = [mac]
+        nodename = _nodelookup(switch, ifname)
+        if nodename is not None:
+            if mac in _nodesbymac and _nodesbymac[mac][0] != nodename:
+                # For example, listed on both a real edge port
+                # and by accident a trunk port
+                log.log({'error': '{0} and {1} described by ambiguous'
+                                  ' switch topology values'.format(
+                                      nodename, _nodesbymac[mac][0])})
+                _nodesbymac[mac] = (None, None)
+            else:
+                _nodesbymac[mac] = (nodename, maccounts[ifname])
+
+
+switchbackoff = 30
+
+
+def find_nodeinfo_by_mac(mac, configmanager):
+    now = util.monotonic_time()
+    if vintage and (now - vintage) < 90 and mac in _nodesbymac:
+        return _nodesbymac[mac][0], {'maccount': _nodesbymac[mac][1]}
+    # do not actually sweep switches more than once every 30 seconds
+    # however, if there is an update in progress, wait on it
+    for _ in update_macmap(configmanager,
+                           vintage and (now - vintage) < switchbackoff):
+        if mac in _nodesbymac:
+            return _nodesbymac[mac][0], {'maccount': _nodesbymac[mac][1]}
+    # If update_mac bailed out, still check one last time
+    return _nodesbymac.get(mac, (None, {'maccount': 0}))
+
+
+mapupdating = eventlet.semaphore.Semaphore()
+
+
+def update_macmap(configmanager, impatient=False):
+    """Interrogate switches to build/update mac table
+
+    Begin a rebuild process.  This process is a generator that will yield
+    as each switch interrogation completes, allowing a caller to
+    recheck the cache as results become possible, rather
+    than having to wait for the process to complete to interrogate.
+    """
+    if mapupdating.locked():
+        while mapupdating.locked():
+            eventlet.sleep(1)
+            yield None
+        return
+    if impatient:
+        return
+    completions = _full_updatemacmap(configmanager)
+    for completion in completions:
+        try:
+            yield completion
+        except GeneratorExit:
+            # the calling function has stopped caring, but we want to finish
+            # the sweep, background it
+            eventlet.spawn_n(_finish_update, completions)
+            raise
+
+
+def _finish_update(completions):
+    for _ in completions:
+        pass
+
+
+def _full_updatemacmap(configmanager):
+    global vintage
+    global _macmap
+    global _nodesbymac
+    global _switchportmap
+    global _macsbyswitch
+    global switchbackoff
+    start = util.monotonic_time()
+    with mapupdating:
+        vintage = util.monotonic_time()
+        # Clear all existing entries
+        _macmap = {}
+        _nodesbymac = {}
+        _switchportmap = {}
+        _macsbyswitch = {}
+        if configmanager.tenant is not None:
+            raise exc.ForbiddenRequest(
+                'Network topology not available to tenants')
+        # here's a list of switches... need to add nodes that are switches
+        nodelocations = configmanager.get_node_attributes(
+            configmanager.list_nodes(), ('net*.switch', 'net*.switchport'))
+        switches = set([])
+        for node in nodelocations:
+            cfg = nodelocations[node]
+            for attr in cfg:
+                if not attr.endswith('.switch') or 'value' not in cfg[attr]:
+                    continue
+                curswitch = cfg[attr].get('value', None)
+                if not curswitch:
+                    continue
+                switches.add(curswitch)
+                switchportattr = attr + 'port'
+                if switchportattr in cfg:
+                    portname = cfg[switchportattr].get('value', '')
+                    if not portname:
+                        continue
+                    if curswitch not in _switchportmap:
+                        _switchportmap[curswitch] = {}
+                    if portname in _switchportmap[curswitch]:
+                        log.log({'error': 'Duplicate switch topology config '
+                                          'for {0} and {1}'.format(
+                                            node,
+                                            _switchportmap[curswitch][
+                                                portname])})
+                        _switchportmap[curswitch][portname] = None
+                    else:
+                        _switchportmap[curswitch][portname] = node
+        switchauth = get_switchcreds(configmanager, switches)
+        pool = GreenPool(64)
+        for ans in pool.imap(_map_switch, switchauth):
+            vintage = util.monotonic_time()
+            yield ans
+    endtime = util.monotonic_time()
+    duration = endtime - start
+    duration = duration * 15  # wait 15 times as long as it takes to walk
+    # avoid spending a large portion of the time hitting switches with snmp
+    # requests
+    if duration > switchbackoff:
+        switchbackoff = duration
+
+
+def _dump_locations(info, macaddr, nodename=None):
+    yield msg.KeyValueData({'possiblenode': nodename, 'mac': macaddr})
+    retdata = {}
+    portinfo = []
+    for location in info:
+        portinfo.append({'switch': location[0],
+                              'port': location[1], 'macsonport': location[2]})
+    retdata['ports'] = sorted(portinfo, key=lambda x: x['macsonport'],
+                              reverse=True)
+    yield msg.KeyValueData(retdata)
+
+
+def handle_api_request(configmanager, inputdata, operation, pathcomponents):
+    if operation == 'retrieve':
+        return handle_read_api_request(pathcomponents, configmanager)
+    if (operation in ('update', 'create') and
+            pathcomponents == ['networking', 'macs', 'rescan']):
+        if inputdata != {'rescan': 'start'}:
+            raise exc.InvalidArgumentException()
+        eventlet.spawn_n(rescan, configmanager)
+        return [msg.KeyValueData({'rescan': 'started'})]
+    raise exc.NotImplementedException(
+        'Operation {0} on {1} not implemented'.format(
+            operation, '/'.join(pathcomponents)))
+
+
+def handle_read_api_request(pathcomponents, configmanager):
+    # TODO(jjohnson2): discovery core.py api handler design, apply it here
+    # to make this a less tangled mess as it gets extended
+    if len(pathcomponents) == 1:
+        return [msg.ChildCollection('macs/'),
+                msg.ChildCollection('neighbors/')]
+    elif pathcomponents[1] == 'neighbors':
+        if len(pathcomponents) == 3 and pathcomponents[-1] == 'by-switch':
+            return [msg.ChildCollection(x + '/')
+                    for x in list_switches(configmanager)]
+        else:
+            return _handle_neighbor_query(pathcomponents[2:], configmanager)
+    elif len(pathcomponents) == 2:
+        if pathcomponents[-1] == 'macs':
+            return [msg.ChildCollection(x) for x in (# 'by-node/',
+                                                     'by-mac/', 'by-switch/',
+                                                     'rescan')]
+        elif pathcomponents[-1] == 'neighbors':
+            return [msg.ChildCollection('by-switch/')]
+        else:
+            raise exc.NotFoundException(
+                'Unknown networking resource {0}'.format(pathcomponents[-1]))
+    if False and pathcomponents[2] == 'by-node':
+        # TODO: should be list of node names, and then under that 'by-mac'
+        if len(pathcomponents) == 3:
+            return [msg.ChildCollection(x.replace(':', '-'))
+                    for x in util.natural_sort(list(_nodesbymac))]
+        elif len(pathcomponents) == 4:
+            macaddr = pathcomponents[-1].replace('-', ':')
+            return dump_macinfo(macaddr)
+    elif pathcomponents[2] == 'by-mac':
+        if len(pathcomponents) == 3:
+            return [msg.ChildCollection(x.replace(':', '-'))
+                    for x in sorted(list(_macmap))]
+        elif len(pathcomponents) == 4:
+            return dump_macinfo(pathcomponents[-1])
+    elif pathcomponents[2] == 'by-switch':
+        if len(pathcomponents) == 3:
+            return [msg.ChildCollection(x + '/')
+                    for x in list_switches(configmanager)]
+        if len(pathcomponents) == 4:
+            return [msg.ChildCollection('by-port/')]
+        if len(pathcomponents) == 5:
+            switchname = pathcomponents[-2]
+            if switchname not in _macsbyswitch:
+                raise exc.NotFoundException(
+                    'No known macs for switch {0}'.format(switchname))
+            return [msg.ChildCollection(x.replace('/', '-') + '/')
+                    for x in util.natural_sort(list(_macsbyswitch[switchname]))]
+        if len(pathcomponents) == 6:
+            return [msg.ChildCollection('by-mac/')]
+        if len(pathcomponents) == 7:
+            switchname = pathcomponents[-4]
+            portname = pathcomponents[-2]
+            try:
+                if portname not in _macsbyswitch[switchname]:
+                    portname = portname.replace('-', '/')
+                maclist = _macsbyswitch[switchname][portname]
+            except KeyError:
+                raise exc.NotFoundException('No known macs for switch {0} '
+                                            'port {1}'.format(switchname,
+                                                              portname))
+            return [msg.ChildCollection(x.replace(':', '-'))
+                    for x in sorted(maclist)]
+        if len(pathcomponents) == 8:
+            return dump_macinfo(pathcomponents[-1])
+    raise exc.NotFoundException('Unrecognized path {0}'.format(
+        '/'.join(pathcomponents)))
+
+
+def dump_macinfo(macaddr):
+    macaddr = macaddr.replace('-', ':')
+    info = _macmap.get(macaddr, None)
+    if info is None:
+        raise exc.NotFoundException(
+            '{0} not found in mac table of '
+            'any known switches'.format(macaddr))
+    return _dump_locations(info, macaddr, _nodesbymac.get(macaddr, (None,))[0])
+
+
+def rescan(cfg):
+    for _ in update_macmap(cfg):
+        pass
+
+
+if __name__ == '__main__':
+    cg = cfm.ConfigManager(None)
+    for res in update_macmap(cg):
+        print("map has updated")
+    if len(sys.argv) > 1:
+        print(repr(_macmap[sys.argv[1]]))
+        print(repr(_nodesbymac[sys.argv[1]]))
+    else:
+        print("Mac to Node lookup table: -------------------")
+        print(repr(_nodesbymac))
+        print("Mac to location lookup table: -------------------")
+        print(repr(_macmap))
+        print("switch to fdb lookup table: -------------------")
+        print(repr(_macsbyswitch))
@@ -0,0 +1,72 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import confluent.util as util
+
+
+def get_switchcreds(configmanager, switches):
+    switchcfg = configmanager.get_node_attributes(
+        switches, ('secret.hardwaremanagementuser', 'secret.snmpcommunity',
+                   'secret.hardwaremanagementpassword'), decrypt=True)
+    switchauth = []
+    for switch in switches:
+        if not switch:
+            continue
+        switchparms = switchcfg.get(switch, {})
+        user = None
+        password = switchparms.get(
+            'secret.snmpcommunity', {}).get('value', None)
+        if not password:
+            password = switchparms.get(
+                'secret.hardwaremanagementpassword', {}).get('value',
+                                                             'public')
+            user = switchparms.get(
+                'secret.hardwaremanagementuser', {}).get('value', None)
+        switchauth.append((switch, password, user))
+    return switchauth
+
+
+def list_switches(configmanager):
+    nodelocations = configmanager.get_node_attributes(
+        configmanager.list_nodes(), ('net*.switch', 'net*.switchport'))
+    switches = set([])
+    for node in nodelocations:
+        cfg = nodelocations[node]
+        for attr in cfg:
+            if not attr.endswith('.switch') or 'value' not in cfg[attr]:
+                continue
+            curswitch = cfg[attr].get('value', None)
+            if not curswitch:
+                continue
+            switches.add(curswitch)
+    return util.natural_sort(switches)
+
+
+def get_portnamemap(conn):
+    ifnamemap = {}
+    havenames = False
+    for vb in conn.walk('1.3.6.1.2.1.31.1.1.1.1'):
+        ifidx, ifname = vb
+        if not ifname:
+            continue
+        havenames = True
+        ifidx = int(str(ifidx).rsplit('.', 1)[1])
+        ifnamemap[ifidx] = str(ifname)
+    if not havenames:
+        for vb in conn.walk('1.3.6.1.2.1.2.2.1.2'):
+            ifidx, ifname = vb
+            ifidx = int(str(ifidx).rsplit('.', 1)[1])
+            ifnamemap[ifidx] = str(ifname)
+    return ifnamemap
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				for i in *.ronn; do echo -n `head -n 1 $i\|awk '{print $1}'`; echo " $i"; done > index.txt