Add configuration to opt into password policies.

Password rules may be relevant to some scenarios.  In such a case, this
can provide guidance if the BMC does not have such a facility or
alternatively provide friendlier warnings than the BMC provides
around shortcomings of the password.

confluent_client/bin/collate

@@ -21,6 +21,7 @@
 
 import optparse
 import os
+import select
 import sys
 
 path = os.path.dirname(os.path.realpath(__file__))
@@ -34,6 +35,9 @@ import confluent.client
 argparser = optparse.OptionParser(usage="Usage: <other command> | %prog [options]")
 argparser.add_option('-a', '--abbreviate', action='store_true',
                      help='Attempt to use confluent server to shorten noderanges')
+argparser.add_option('-b', '--base',
+                     help='Use given node as reference for comparison when '
+                          'using -d, instead of using the most common result')
 argparser.add_option('-d', '--diff', action='store_true',
                      help='Show what differs between most common '
                           'output group and others')
@@ -47,6 +51,8 @@ argparser.add_option('-c', '--count', action='store_true',
 argparser.add_option('-r', '--reverse', action='store_true',
                      help='Reverse sort order to show biggest output group '
                           'last')
+argparser.add_option('-l', '--log', action='store', type='string', dest='log',
+                     help='Log each output to file, using {node} as a placeholder for node.')
 (options, args) = argparser.parse_args()
 if sys.stdin.isatty():
     argparser.print_help()
@@ -62,7 +68,7 @@ else:
 def print_current():
     if options.diff:
         grouped.print_deviants(skipmodal=options.skipcommon, count=options.count,
-                          reverse=options.reverse)
+                          reverse=options.reverse, basenode=options.base)
     else:
         grouped.print_all(skipmodal=options.skipcommon,
                                count=options.count,
@@ -70,17 +76,39 @@ def print_current():
     sys.stdout.flush()
 
 fullline = sys.stdin.readline()
+printpending = True
+clearpending = False
+holdoff = 0
 while fullline:
     for line in fullline.split('\n'):
         if not line:
             continue
         if ': ' not in line:
             line = 'UNKNOWN: ' + line
+        if options.log:
+            node, output = line.split(': ', 1)
+            currlog = options.log.format(node=node, nodename=node)
+            with open(currlog, mode='a')  as log:
+                log.write(output + '\n')
+            continue
         grouped.add_line(*line.split(': ', 1))
         if options.watch:
-            sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
-            print_current()
+            if not holdoff:
+                holdoff = os.times()[4] + 0.250
+            if (holdoff < os.times()[4] or
+                    not select.select((sys.stdin,), (), (), 0.250)[0]):
+                # print now, nothing pending
+                holdoff = 0
+                sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
+                print_current()
+                printpending = False
+                clearpending = True
+            else:
+                printpending = True
     fullline = sys.stdin.readline()
-if not options.watch:
+
+if printpending:
+    if clearpending:
+        sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
     print_current()
 

confluent_client/bin/confetty

@@ -2,7 +2,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2014 IBM Corporation
-# Copyright 2015-2016 Lenovo
+# Copyright 2015-2018 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -49,6 +49,7 @@ import select
 import shlex
 import signal
 import socket
+import struct
 import sys
 import time
 try:
@@ -89,6 +90,11 @@ netserver = None
 laststate = {}
 
 
+class BailOut(Exception):
+    def __init__(self, errorcode=0):
+        self.errorcode = errorcode
+
+
 def print_help():
     print("confetty provides a filesystem like interface to confluent.  "
           "Navigation is done using the same commands as would be used in a "
@@ -353,7 +359,7 @@ def do_command(command, server):
     if argv[0] == 'exit':
         if os.environ.get('TERM', '') not in ('linux'):
             sys.stdout.write('\x1b]0;\x07')
-        sys.exit(0)
+        raise Bailout()
     elif argv[0] in ('help', '?'):
         return print_help()
     elif argv[0] == 'cd':
@@ -434,6 +440,10 @@ def do_command(command, server):
         currconsole = targpath
         startrequest = {'operation': 'start', 'path': targpath,
                         'parameters': {}}
+        height, width = struct.unpack(
+            'hh', fcntl.ioctl(sys.stdout, termios.TIOCGWINSZ, b'....'))[:2]
+        startrequest['parameters']['width'] = width
+        startrequest['parameters']['height'] = height
         for param in argv[2:]:
             (parmkey, parmval) = param.split("=")
             startrequest['parameters'][parmkey] = parmval
@@ -478,7 +488,8 @@ def createresource(args):
         collection = targpath
     else:
         collection, _, resname = targpath.rpartition('/')
-        keydata['name'] = resname
+        if 'name' not in keydata:
+            keydata['name'] = resname
     makecall(session.create, (collection, keydata))
 
 
@@ -493,6 +504,13 @@ def makecall(callout, args):
             if 'errorcode' in response:
                 exitcode = response['errorcode']
             sys.stderr.write('Error: ' + response['error'] + '\n')
+        if 'databynode' in response:
+            lresponse = response['databynode']
+            for node in lresponse:
+                if 'errorcode' in lresponse[node]:
+                    exitcode = lresponse[node]['errorcode']
+                if 'error' in lresponse[node]:
+                    sys.stderr.write('{0}: Error - {1}\n'.format(node, lresponse[node]['error']))
 
 
 def clearvalues(resource, attribs):
@@ -575,11 +593,20 @@ def fullpath_target(currpath, forcepath=False):
         ntarget += '/'
     return ntarget
 
+def do_resize(a, b):
+    if not inconsole:
+        return
+    height, width = struct.unpack(
+        'hh', fcntl.ioctl(sys.stdout, termios.TIOCGWINSZ, b'....'))[:2]
+    tlvdata.send(session.connection, {'operation': 'resize', 'width': width,
+                                      'height': height})
+
 
 def startconsole(nodename):
     global inconsole
     global consolename
     global didconsole
+    signal.signal(signal.SIGWINCH, do_resize)
     didconsole = True
     consolename = nodename
     tty.setraw(sys.stdin.fileno())
@@ -598,11 +625,12 @@ def quitconfetty(code=0, fullexit=False, fixterm=True):
         if oldtcattr is not None:
             termios.tcsetattr(sys.stdin.fileno(), termios.TCSANOW, oldtcattr)
     # Request default color scheme, to undo potential weirdness of terminal
-    sys.stdout.write('\x1b[m')
+    if sys.stdout.isatty():
+        sys.stdout.write('\x1b[m')
     if fullexit:
-        if os.environ.get('TERM', '') not in ('linux'):
+        if sys.stdout.isatty() and os.environ.get('TERM', '') not in ('linux'):
             sys.stdout.write('\x1b]0;\x07')
-        sys.exit(code)
+        raise BailOut(code)
     else:
         tlvdata.send(session.connection, {'operation': 'stop',
                                           'path': currconsole})
@@ -763,7 +791,10 @@ def conserver_command(filehandle, localcommand):
 
 def get_command_bytes(filehandle, localcommand, cmdlen):
     while len(localcommand) < cmdlen:
-        ready, _, _ = select.select((filehandle,), (), (), 1)
+        try:
+            ready, _, _ = select.select((filehandle,), (), (), 1)
+        except select.error:
+            ready = ()
         if ready:
             localcommand += filehandle.read()
     return localcommand
@@ -776,7 +807,10 @@ def check_escape_seq(currinput, filehandle):
             sys.stdout.flush()
             return conserver_command(
                 filehandle, currinput[len(conserversequence):])
-        ready, _, _ = select.select((filehandle,), (), (), 3)
+        try:
+            ready, _, _ = select.select((filehandle,), (), (), 3)
+        except select.error:
+            ready = ()
         if not ready:  # 3 seconds of no typing
             break
         currinput += filehandle.read()
@@ -789,6 +823,10 @@ parser.add_option("-s", "--server", dest="netserver",
 parser.add_option("-c", "--control", dest="controlpath",
                   help="Path to offer terminal control",
                   metavar="PATH")
+parser.add_option(
+    '-m', '--mintime', default=0,
+    help='Minimum time to run or else pause for input (used to keep a '
+         'terminal from closing quickly on error)')
 opts, shellargs = parser.parse_args()
 
 username = None
@@ -817,45 +855,6 @@ def server_connect():
         passphrase = getpass.getpass("Passphrase: ")
         session.authenticate(username, passphrase)
 
-
-try:
-    server_connect()
-except EOFError, KeyboardInterrupt:
-    sys.exit(0)
-except socket.gaierror:
-    sys.stderr.write('Could not connect to confluent\n')
-    sys.exit(1)
-# clear on start can help with readable of TUI, but it
-# can be annoying, so for now don't do it.
-# sys.stdout.write('\x1b[H\x1b[J')
-# sys.stdout.flush()
-
-if sys.stdout.isatty():
-    import readline
-
-    readline.parse_and_bind("tab: complete")
-    readline.parse_and_bind("set bell-style none")
-    dl = readline.get_completer_delims().replace('-', '')
-    readline.set_completer_delims(dl)
-    readline.set_completer(completer)
-
-doexit = False
-inconsole = False
-pendingcommand = ""
-session_node = get_session_node(shellargs)
-if session_node is not None:
-    consoleonly = True
-    do_command("start /nodes/%s/console/session" % session_node, netserver)
-    doexit = True
-elif shellargs:
-    command = " ".join(shellargs)
-    do_command(command, netserver)
-    quitconfetty(fullexit=True, fixterm=False)
-
-powerstate = None
-powertime = None
-
-
 def check_power_state():
     tlvdata.send(
         session.connection,
@@ -864,83 +863,147 @@ def check_power_state():
     return
 
 
-while inconsole or not doexit:
-    if inconsole:
-        rdylist, _, _ = select.select(
-            (sys.stdin, session.connection), (), (), 10)
-        for fh in rdylist:
-            if fh == session.connection:
-                # this only should get called in the
-                # case of a console session
-                # each command should slurp up all relevant
-                # recv potential
-                #fh.read()
-                try:
-                    data = tlvdata.recv(fh)
-                except Exception:
-                    data = None
-                if type(data) == dict:
-                    updatestatus(data)
-                    continue
-                if data is not None:
-                    if clearpowermessage:
-                        sys.stdout.write("\x1b[2J\x1b[;H")
-                        clearpowermessage = False
-                    try:
-                        sys.stdout.write(data)
-                    except IOError:  # Some times circumstances are bad
-                        # resort to byte at a time...
-                        for d in data:
-                            sys.stdout.write(d)
-                    now = time.time()
-                    if ('showtime' not in laststate or
-                            (now // 60) != laststate['showtime'] // 60):
-                        # don't bother churning if minute does not change
-                        laststate['showtime'] = now
-                        updatestatus()
-                    sys.stdout.flush()
-                else:
-                    deadline = 5
-                    connected = False
-                    while not connected and deadline > 0:
-                        try:
-                            server_connect()
-                            connected = True
-                        except (socket.gaierror, socket.error):
-                            pass
-                        if not connected:
-                            time.sleep(1)
-                            deadline -=1
-                    if connected:
-                        do_command(
-                            "start /nodes/%s/console/session skipreplay=True" % consolename,
-                            netserver)
-                    else:
-                        doexit = True
-                        inconsole = False
-                        sys.stdout.write("\r\n[remote disconnected]\r\n")
-                    break
-            else:
-                try:
-                    myinput = fh.read()
-                    myinput = check_escape_seq(myinput, fh)
-                    if myinput:
-                        tlvdata.send(session.connection, myinput)
-                except IOError:
-                    pass
-        if powerstate is None or powertime < time.time() - 10:  # Check powerstate every 10 seconds
-            powertime = time.time()
-            powerstate = True
-            check_power_state()
-    else:
-        currcommand = prompt()
-        try:
-            do_command(currcommand, netserver)
-        except socket.error:
+if sys.stdout.isatty():
+    import readline
+
+
+def main():
+    global inconsole
+    try:
+        server_connect()
+    except EOFError, KeyboardInterrupt:
+        raise BailOut(0)
+    except socket.gaierror:
+        sys.stderr.write('Could not connect to confluent\n')
+        raise BailOut(1)
+    # clear on start can help with readable of TUI, but it
+    # can be annoying, so for now don't do it.
+    # sys.stdout.write('\x1b[H\x1b[J')
+    # sys.stdout.flush()
+    global powerstate, powertime, clearpowermessage
+
+
+    if sys.stdout.isatty():
+
+        readline.parse_and_bind("tab: complete")
+        readline.parse_and_bind("set bell-style none")
+        dl = readline.get_completer_delims().replace('-', '')
+        readline.set_completer_delims(dl)
+        readline.set_completer(completer)
+
+    doexit = False
+    inconsole = False
+    pendingcommand = ""
+    session_node = get_session_node(shellargs)
+    if session_node is not None:
+        consoleonly = True
+        do_command("start /nodes/%s/console/session" % session_node, netserver)
+        doexit = True
+    elif shellargs:
+        command = " ".join(shellargs)
+        do_command(command, netserver)
+        quitconfetty(fullexit=True, fixterm=False)
+
+    powerstate = None
+    powertime = None
+
+    while inconsole or not doexit:
+        if inconsole:
+            try:
+                rdylist, _, _ = select.select(
+                    (sys.stdin, session.connection), (), (), 10)
+            except select.error:
+                rdylist = ()
+            for fh in rdylist:
+                if fh == session.connection:
+                    # this only should get called in the
+                    # case of a console session
+                    # each command should slurp up all relevant
+                    # recv potential
+                    #fh.read()
+                    try:
+                        data = tlvdata.recv(fh)
+                    except Exception:
+                        data = None
+                    if type(data) == dict:
+                        updatestatus(data)
+                        continue
+                    if data is not None:
+                        if clearpowermessage:
+                            sys.stdout.write("\x1b[2J\x1b[;H")
+                            clearpowermessage = False
+                        try:
+                            sys.stdout.write(data)
+                        except IOError:  # Some times circumstances are bad
+                            # resort to byte at a time...
+                            for d in data:
+                                sys.stdout.write(d)
+                        now = time.time()
+                        if ('showtime' not in laststate or
+                                (now // 60) != laststate['showtime'] // 60):
+                            # don't bother churning if minute does not change
+                            laststate['showtime'] = now
+                            updatestatus()
+                        sys.stdout.flush()
+                    else:
+                        deadline = 5
+                        connected = False
+                        while not connected and deadline > 0:
+                            try:
+                                server_connect()
+                                connected = True
+                            except (socket.gaierror, socket.error):
+                                pass
+                            if not connected:
+                                time.sleep(1)
+                                deadline -=1
+                        if connected:
+                            do_command(
+                                "start /nodes/%s/console/session skipreplay=True" % consolename,
+                                netserver)
+                        else:
+                            doexit = True
+                            inconsole = False
+                            sys.stdout.write("\r\n[remote disconnected]\r\n")
+                        break
+                else:
+                    try:
+                        myinput = fh.read()
+                        myinput = check_escape_seq(myinput, fh)
+                        if myinput:
+                            tlvdata.send(session.connection, myinput)
+                    except IOError:
+                        pass
+            if powerstate is None or powertime < time.time() - 10:  # Check powerstate every 10 seconds
+                powertime = time.time()
+                powerstate = True
+                check_power_state()
+        else:
+            currcommand = prompt()
             try:
-                server_connect()
                 do_command(currcommand, netserver)
             except socket.error:
-                doexit = True
-                sys.stdout.write('Lost connection to server')
-quitconfetty(fullexit=True)
+                try:
+                    server_connect()
+                    do_command(currcommand, netserver)
+                except socket.error:
+                    doexit = True
+                    sys.stdout.write('Lost connection to server')
+    quitconfetty(fullexit=True)
+
+if __name__ == '__main__':
+    errcode = 0
+    deadline = 0
+    if opts.mintime:
+        deadline = os.times()[4] + float(opts.mintime)
+    try:
+        main()
+    except BailOut as e:
+        errcode = e.errorcode
+    finally:
+        if deadline and os.times()[4] < deadline:
+            sys.stderr.write('[Exited early, hit enter to continue]')
+            sys.stdin.readline()
+        if errcode == 0:
+            errcode = exitcode
+        sys.exit(errcode)

confluent_client/bin/confluent2ansible

@@ -0,0 +1,71 @@
+#!/usr/bin/env python
+import optparse
+import signal
+import sys
+import os
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.sortutil as sortutil
+
+
+def lookupdata(data, key):
+    ret = data.get(key, {}).get('value', '')
+    if ret is None:
+        ret = ''
+    return ret
+
+def main():
+    argparser = optparse.OptionParser(
+    usage='''\n       %prog noderange -o ansible.hosts
+             \n ''')
+    argparser.add_option('-o', '--output',
+                         help='Ansible hosts file')
+    (options, args) = argparser.parse_args()
+    try:
+        noderange = args[0]
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    if not options.output:
+        sys.stderr.write('Output file must be specified by -o\n')
+        sys.exit(1)
+    sess = client.Command()
+    databynode = {}
+    for res in sess.read('/noderange/{0}/attributes/all'.format(noderange)):
+        for node in res.get('databynode', {}):
+            if node not in databynode:
+                databynode[node] = {}
+            databynode[node].update(res['databynode'][node])
+    nodesbygroup = {}
+    with open(options.output, 'w') as importfile:
+        needempty = False
+        for node in sortutil.natural_sort(databynode):
+            data = databynode[node]
+            if not data.get('groups', []):
+                importfile.write(node + '\n')
+                needempty = True
+            for g in data.get('groups', []):
+                if g not in nodesbygroup:
+                    nodesbygroup[g] = set([node])
+                else:
+                    nodesbygroup[g].add(node)
+        if needempty:
+            importfile.write('\n')
+        for group in sortutil.natural_sort(nodesbygroup):
+            importfile.write('[{0}]\n'.format(group))
+            for node in sortutil.natural_sort(nodesbygroup[group]):
+                importfile.write('{0}\n'.format(node))
+            importfile.write('\n')
+
+
+if __name__ == '__main__':
+    main()

confluent_client/bin/confluent2lxca

@@ -0,0 +1,76 @@
+#!/usr/bin/env python
+import csv
+import optparse
+import signal
+import sys
+import os
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.sortutil as sortutil
+
+headers = '# Type,Serial Number,Current IP,Current username,Current password,New password,Recovery password,Switch enable password,New IPv4,IPv4 Subnet mask,IPv4 Default gateway,IPv4 DNS1,IPv4 DNS2,New IPv6,IPv6 Prefix,IPv6 Default gateway,IPv6 DNS1,IPv6 DNS2,Domain,Host name,Display name,Rack,Lowest Rack Unit,Height,Force,Stored credentials ID,Managed authentication,Group Name'.split(',')
+
+def lookupdata(data, key):
+    ret = data.get(key, {}).get('value', '')
+    if ret is None:
+        ret = ''
+    return ret
+
+def main():
+    argparser = optparse.OptionParser(
+    usage='''\n       %prog noderange -o bulkimport.csv
+             \n ''')
+    argparser.add_option('-o', '--output',
+                         help='File to write for bulk import into xClarity Administrator')
+    (options, args) = argparser.parse_args()
+    try:
+        noderange = args[0]
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    if not options.output:
+        sys.stderr.write('Output file must be specified by -o\n')
+        sys.exit(1)
+    if 'XCCUSER' not in os.environ or 'XCCPASS' not in os.environ:
+        sys.stderr.write('Must specify XCCUSER and XCCPASS in environment variables\n')
+        sys.exit(1)
+    xccuser = os.environ['XCCUSER']
+    xccpass = os.environ['XCCPASS']
+    sess = client.Command()
+    databynode = {}
+    for res in sess.read('/noderange/{0}/attributes/all'.format(noderange)):
+        for node in res.get('databynode', {}):
+            if node not in databynode:
+                databynode[node] = {}
+            databynode[node].update(res['databynode'][node])
+    for res in sess.read(
+            '/noderange/{0}/configuration/management_controller/net_interfaces/management'.format(
+                    noderange)):
+        for node in res.get('databynode', {}):
+            currip = res['databynode'][node].get('ipv4_address', {}).get(
+                'value', '')
+            if currip:
+                databynode[node]['hardwaremanagement.manager'] = {
+                    'value': currip.split('/', 1)[0]}
+    with open(options.output, 'w') as importfile:
+        bulkimport = csv.writer(importfile)
+        bulkimport.writerow(headers)
+        for node in sortutil.natural_sort(databynode):
+            data = databynode[node]
+            row = ['server', lookupdata(data, 'id.serial'), lookupdata(data, 'hardwaremanagement.manager'), xccuser, xccpass, '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', node, lookupdata(data, 'location.rack'), lookupdata(data, 'location.u'), '', '', '','', '']
+            bulkimport.writerow(row)
+
+
+
+
+if __name__ == '__main__':
+    main()

confluent_client/bin/confluent2xcat

@@ -0,0 +1,103 @@
+#!/usr/bin/env python
+import csv
+import optparse
+import signal
+import sys
+import os
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.sortutil as sortutil
+
+
+def lookupdata(data, key):
+    ret = data.get(key, {}).get('value', '')
+    if ret is None:
+        ret = ''
+    return ret
+
+def main():
+    argparser = optparse.OptionParser(
+    usage='''\n       %prog noderange -o xcatnodes.def
+             \n ''')
+    argparser.add_option('-o', '--output',
+                         help='xCAT stanza file')
+    argparser.add_option('-m', '--macs',
+                         help='xCAT macs.csv to write')
+    (options, args) = argparser.parse_args()
+    try:
+        noderange = args[0]
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    if not (options.output or options.macs):
+        sys.stderr.write('Output file must be specified by -o or -m\n')
+        sys.exit(1)
+    sess = client.Command()
+    databynode = {}
+    for res in sess.read('/noderange/{0}/attributes/all'.format(noderange)):
+        for node in res.get('databynode', {}):
+            if node not in databynode:
+                databynode[node] = {}
+            databynode[node].update(res['databynode'][node])
+    if options.output:
+        with open(options.output, 'w') as importfile:
+            for node in sortutil.natural_sort(databynode):
+                xcatattrs = collect_attribute_data(databynode, node)
+                importfile.write('{0}:\n'.format(node))
+                importfile.write('   objtype=node\n')
+                importfile.write('   arch=x86_64\n')
+                importfile.write('   netboot=xnba\n')
+                importfile.write('   mgt=ipmi\n')
+                for attr in xcatattrs:
+                    if xcatattrs[attr] is None:
+                        continue
+                    importfile.write('   {0}={1}\n'.format(attr,
+                                                           xcatattrs[attr]))
+                importfile.write('\n')
+    if options.macs:
+        with open(options.macs, 'w') as importfile:
+            macsv = csv.writer(importfile)
+            macsv.writerow(['#node', 'mac'])
+            for node in sortutil.natural_sort(databynode):
+                xcatattrs = collect_attribute_data(databynode, node)
+                macsv.writerow([node, xcatattrs['mac']])
+
+
+
+def collect_attribute_data(databynode, node):
+    data = databynode[node]
+    xcatattrs = {}
+    xcatattrs['groups'] = ','.join(data.get('groups', []))
+    xcatattrs['bmc'] = data.get('hardwaremanagement.manager', {}).get(
+        'value', None)
+    xcatattrs['mpa'] = data.get('enclosure.manager', {}).get(
+        'value', None)
+    xcatattrs['slotid'] = data.get('enclosure.bay', {}).get(
+        'value', None)
+    gotmac = False
+    for key in data:
+        if key.startswith('net.') and 'hwaddr' in key:
+            currmac = data[key].get('value', None)
+            if currmac:
+                if gotmac:
+                    sys.stderr.write(
+                        'Ignoring {0} and using only {1} for mac, '
+                        'multiple macs not supported by '
+                        'confluent2xcat\n'.format(key, gotmac))
+                    continue
+                gotmac = key
+                xcatattrs['mac'] = currmac
+    return xcatattrs
+
+
+if __name__ == '__main__':
+    main()

confluent_client/bin/dir2img

@@ -0,0 +1,19 @@
+#!/bin/sh
+# This will take a given directory and make a 'big floppy image'
+# out of it, suitable for nodemedia upload.
+
+if [ -z "$1" -o -z "$2" ]; then
+        echo "Usage: $0 <directory> <imagefile>"
+        exit 1
+fi
+# Get the needed payload side
+SIZE=$(du -sB 512 $1|awk '{print $1}')
+ENTRIES=$(find $1 |wc -l)
+# Also, each file and directory has overhead, pad size by 32kb per file,
+# which should be overkill but other values proved to be inadequate
+# A deeper understanding of VFAT would probably allow for more precise value
+SIZE=$((SIZE + ENTRIES * 64))
+dd if=/dev/zero of=$2 bs=512 count=$SIZE
+# Make a big single sided floppy with many many tracks, saves on complex math
+mformat -i $2 -d 1 -t $SIZE -s 1 -h 1 ::
+mcopy -i $2 -s $1/* ::

confluent_client/bin/nodeattrib

@@ -17,6 +17,7 @@
 
 __author__ = 'alin37'
 
+from getpass import getpass
 import optparse
 import os
 import signal
@@ -35,14 +36,20 @@ if path.startswith('/opt'):
 import confluent.client as client
 
 argparser = optparse.OptionParser(
-    usage='''\n       %prog [-b] noderange [list of attributes]  \
+    usage='''\n       %prog [-b] noderange [list of attributes or 'all']  \
              \n       %prog -c noderange <list of attributes>  \
+             \n       %prog -e noderange <attribute names to set>  \
              \n       %prog noderange attribute1=value1 attribute2=value,...
              \n ''')
 argparser.add_option('-b', '--blame', action='store_true',
                      help='Show information about how attributes inherited')
+argparser.add_option('-e', '--environment', action='store_true',
+                     help='Set attributes, but from environment variable of '
+                          'same name')
 argparser.add_option('-c', '--clear', action='store_true',
                      help='Clear attributes')
+argparser.add_option('-p', '--prompt', action='store_true',
+                     help='Prompt for attribute values interactively')
 (options, args) = argparser.parse_args()
 
 
@@ -63,12 +70,24 @@ exitcode = 0
 nodetype="noderange"
 
 if len(args) > 1:
-    if "=" in args[1] or options.clear:
+    if "=" in args[1] or options.clear or options.environment or options.prompt:
         if "=" in args[1] and options.clear:
             print("Can not clear and set at the same time!")
             argparser.print_help()
             sys.exit(1)
-        exitcode=client.updateattrib(session,args,nodetype, noderange, options)
+        argassign = None
+        if options.prompt:
+            argassign = {}
+            for arg in args[1:]:
+                oneval = 1
+                twoval = 2
+                while oneval != twoval:
+                    oneval = getpass('Enter value for {0}: '.format(arg))
+                    twoval = getpass('Confirm value for {0}: '.format(arg))
+                    if oneval != twoval:
+                        print('Values did not match.')
+                argassign[arg] = twoval
+        exitcode=client.updateattrib(session,args,nodetype, noderange, options, argassign)
     try:
         # setting user output to what the user inputs
         if args[1] == 'all':
@@ -107,6 +126,6 @@ else:
             sys.stderr.write(res['error'] + '\n')
             exitcode = 1
         else:
-            print res['item']['href'].replace('/', '')
+            print(res['item']['href'].replace('/', ''))
 
 sys.exit(exitcode)

confluent_client/bin/nodeboot

@@ -35,6 +35,9 @@ argparser = optparse.OptionParser()
 argparser.add_option('-b', '--bios', dest='biosmode',
                      action='store_true', default=False,
                      help='Request BIOS style boot (rather than UEFI)')
+argparser.add_option('-u', '--uefi', dest='uefimode',
+                     action='store_true', default=False,
+                     help='Request UEFI style boot (rather than BIOS)')
 argparser.add_option('-p', '--persist', dest='persist', action='store_true',
                      default=False,
                      help='Request the boot device be persistent rather than '

confluent_client/bin/nodeconfig

@@ -19,6 +19,7 @@
 import os
 import signal
 import optparse
+import shlex
 import sys
 
 try:
@@ -42,7 +43,31 @@ def bailout(msg, code=1):
     sys.exit(code)
 
 
-argparser = optparse.OptionParser()
+argparser = optparse.OptionParser(usage="Usage: %prog [options] noderange [option|option=value]")
+argparser.add_option('-c', '--comparedefault', dest='comparedefault',
+                     action='store_true', default=False,
+                     help='Compare given settings to default or list settings '
+                          'that are non default')
+argparser.add_option('-b', '--batch', dest='batch', metavar='settings.batch',
+                     default=False, help='Provide settings in a batch file')
+argparser.add_option('-d', '--detail', dest='detail',
+                     action='store_true', default=False,
+                     help='Provide verbose information as available, such as '
+                          'help text and possible valid values')
+argparser.add_option('-x', '--exclude', dest='exclude',
+                     action='store_true', default=False,
+                     help='Treat positional arguments as items to not '
+                          'examine, compare, or restore default')
+argparser.add_option('-a', '--advanced', dest='advanced',
+                     action='store_true', default=False,
+                     help='Include advanced settings, which are normally not '
+                          'intended to be used without direction from the '
+                          'relevant server vendor.')
+argparser.add_option('-r', '--restoredefault', default=False,
+                     dest='restoredefault', metavar="COMPONENT",
+                     help='Restore the configuration of the node '
+                          'to factory default for given component. '
+                          'Currently only uefi is supported')
 (options, args) = argparser.parse_args()
 
 cfgpaths = {
@@ -55,6 +80,8 @@ cfgpaths = {
     'bmc.ipv4_gateway': (
         'configuration/management_controller/net_interfaces/management',
         'ipv4_gateway'),
+    'bmc.hostname': (
+        'configuration/management_controller/hostname', 'hostname'),
 }
 
 autodeps = {
@@ -70,60 +97,130 @@ client.check_globbing(noderange)
 setmode = None
 assignment = {}
 queryparms = {}
+printsys = []
+setsys = {}
+forceset = False
+needval = None
 
-
-if len(args) == 1:
+if len(args) == 1 or options.exclude:
+    if not options.exclude:
+        printsys = 'all'
     for candidate in cfgpaths:
         path, attrib = cfgpaths[candidate]
         path = '/noderange/{0}/{1}'.format(noderange, path)
         if path not in queryparms:
             queryparms[path] = {}
         queryparms[path][attrib] = candidate
-for param in args[1:]:
-    if '=' in param:
-        if setmode is None:
+
+
+def _assign_value():
+    if key not in cfgpaths:
+        setsys[key] = value
+    for depkey, depval in autodeps.get(key, []):
+        assignment[depkey] = depval
+    assignment[key] = value
+
+
+def parse_config_line(arguments):
+    global setmode, forceset, key, value, needval, candidate, path, attrib
+    for param in arguments:
+        if param == 'show':
+            continue  # forgive muscle memory of pasu users
+        if param == 'set':
             setmode = True
-        if setmode != True:
-            bailout('Cannot do set and query in same command')
-        key, _, value = param.partition('=')
-        if key not in cfgpaths:
-            bailout('Unrecognized setting: {0}'.format(key))
-        for depkey, depval in autodeps.get(key, []):
-            assignment[depkey] = depval
-        assignment[key] = value
-    else:
-        if setmode is None:
-            setmode = False
-        if setmode != False:
-            bailout('Cannot do set and query in same command')
-        if '.' not in param:
-            matchedparms = False
-            for candidate in cfgpaths:
-                if candidate.startswith('{0}.'.format(param)):
-                    matchedparms = True
-                    path, attrib = cfgpaths[candidate]
-                    path = '/noderange/{0}/{1}'.format(noderange, path)
-                    if path not in queryparms:
-                        queryparms[path] = {}
-                    queryparms[path][attrib] = candidate
-            if not matchedparms:
-                bailout('Unrecognized settings category: {0}'.format(param))
-        elif param not in cfgpaths:
-            bailout('Unrecognized parameter: {0}'.format(param))
+            forceset = True
+            continue
+        if needval:
+            key = needval
+            needval = None
+            value = param
+            _assign_value()
+            continue
+        if '=' in param or param[-1] == ':' or forceset:
+            if setmode is None:
+                setmode = True
+            if setmode != True:
+                bailout('Cannot do set and query in same command')
+            if '=' in param:
+                key, _, value = param.partition('=')
+                _assign_value()
+            elif param[-1] == ':':
+                needval = param[:-1]
+            else:
+                needval = param
         else:
-            path, attrib = cfgpaths[param]
-            path = '/noderange/{0}/{1}'.format(noderange, path)
-            if path not in queryparms:
-                queryparms[path] = {}
-            queryparms[path][attrib] = param
+            if setmode is None:
+                setmode = False
+            if setmode != False:
+                bailout('Cannot do set and query in same command')
+            if '.' not in param:
+                matchedparms = False
+                for candidate in cfgpaths:
+                    if candidate.startswith('{0}.'.format(param)):
+                        matchedparms = True
+                        if not options.exclude:
+                            path, attrib = cfgpaths[candidate]
+                            path = '/noderange/{0}/{1}'.format(noderange, path)
+                            if path not in queryparms:
+                                queryparms[path] = {}
+                            queryparms[path][attrib] = candidate
+                        else:
+                            try:
+                                del queryparms[path]
+                            except KeyError:
+                                pass
+                if not matchedparms:
+                    printsys.append(param)
+            elif param not in cfgpaths:
+                printsys.append(param)
+            else:
+                path, attrib = cfgpaths[param]
+                path = '/noderange/{0}/{1}'.format(noderange, path)
+                if path not in queryparms:
+                    queryparms[path] = {}
+                queryparms[path][attrib] = param
+
+if options.batch:
+    printsys = []
+    argfile = open(options.batch, 'r')
+    argset = argfile.readline()
+    while argset:
+        try:
+            argset = argset[:argset.index('#')]
+        except ValueError:
+            pass
+        argset = argset.strip()
+        if argset:
+            parse_config_line(shlex.split(argset))
+        argset = argfile.readline()
+else:
+    parse_config_line(args[1:])
 session = client.Command()
+rcode = 0
+if options.restoredefault and options.restoredefault.lower() in (
+        'sys', 'system', 'uefi', 'bios'):
+    for fr in session.update(
+            '/noderange/{0}/configuration/system/clear'.format(noderange),
+            {'clear': True}):
+        rcode |= client.printerror(fr)
+    sys.exit(rcode)
+elif options.restoredefault:
+    sys.stderr.write(
+        'Unrecognized component to restore defaults: {0}\n'.format(
+            options.restoredefault))
+    sys.exit(1)
 if setmode:
+    if options.exclude:
+        sys.stderr.write('Cannot use exclude and assign at the same time\n')
+        sys.exit(1)
     updatebypath = {}
     attrnamebypath = {}
     for key in assignment:
         if key not in cfgpaths:
-            bailout('Unknown settings key: {0}'.format(key))
-        path, attrib = cfgpaths[key]
+            path = 'configuration/system/all'
+            attrib = key
+        else:
+            path, attrib = cfgpaths[key]
         if path not in updatebypath:
             updatebypath[path] = {}
             attrnamebypath[path] = {}
@@ -132,16 +229,35 @@ if setmode:
     # well, we want to expand things..
     # check ipv4, if requested change method to static
     for path in updatebypath:
-        for r in session.update('/noderange/{0}/{1}'.format(noderange, path),
+        for fr in session.update('/noderange/{0}/{1}'.format(noderange, path),
                                 updatebypath[path]):
-            for node in r:
-                keyval = r[node]['value']
+            rcode |= client.printerror(fr)
+            for node in fr.get('databynode', []):
+                r = fr['databynode'][node]
+                rcode |= client.printerror(r, node)
+                if 'value' not in r:
+                    continue
+                keyval = r['value']
                 key, val = keyval.split('=')
                 if key in attrnamebypath[path]:
                     key = attrnamebypath[path][key]
                 print('{0}: {1}: {2}'.format(node, key, val))
 else:
     for path in queryparms:
-        client.print_attrib_path(path, session, list(queryparms[path]),
-                                 NullOpt(), queryparms[path])
-
+        if options.comparedefault:
+            continue
+        rc = client.print_attrib_path(path, session, list(queryparms[path]),
+                                      NullOpt(), queryparms[path])
+        if rc:
+            sys.exit(rc)
+    if printsys or options.exclude:
+        if printsys == 'all':
+            printsys = []
+        if (options.comparedefault or printsys == []) and not options.advanced:
+            path = '/noderange/{0}/configuration/system/all'.format(noderange)
+        else:
+            path = '/noderange/{0}/configuration/system/advanced'.format(
+                noderange)
+        rcode = client.print_attrib_path(path, session, printsys,
+                                         options)
+sys.exit(rcode)

confluent_client/bin/nodeconsole

@@ -17,7 +17,14 @@
 
 import optparse
 import os
+import subprocess
 import sys
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+import confluent.client as client
+import confluent.sortutil as sortutil
 
 confettypath = os.path.join(os.path.dirname(sys.argv[0]), 'confetty')
 argparser = optparse.OptionParser(
@@ -26,9 +33,45 @@ argparser = optparse.OptionParser(
            "ctrl-'e', then release ctrl, then 'c', then '?' for a full list. "
            "For example, ctrl-'e', then 'c', then '.' will exit the current "
            "console")
+argparser.add_option('-t', '--tile', action='store_true', default=False,
+                     help='Tile console windows in the terminal')
 (options, args) = argparser.parse_args()
 if len(args) != 1:
     argparser.print_help()
     sys.exit(1)
-os.execl(confettypath, confettypath, 'start',
-         '/nodes/{0}/console/session'.format(args[0]))
+if options.tile:
+    null = open('/dev/null', 'w')
+    nodes = []
+    sess = client.Command()
+    for res in sess.read('/noderange/{0}/nodes/'.format(args[0])):
+        node = res.get('item', {}).get('href', '/').replace('/', '')
+        if not node:
+            sys.stderr.write(res.get('error', repr(res)) + '\n')
+            sys.exit(1)
+        nodes.append(node)
+    initial = True
+    pane = 0
+    for node in sortutil.natural_sort(nodes):
+        if initial:
+            initial = False
+            subprocess.call(
+                ['tmux', 'new-session', '-d', '-s',
+                 'nodeconsole_{0}'.format(os.getpid()), '-x', '800', '-y',
+                 '800', '{0} -m 5 start /nodes/{1}/console/session'.format(
+                    confettypath, node)])
+        else:
+            subprocess.call(['tmux', 'select-pane', '-t', str(pane)])
+            subprocess.call(['tmux', 'set-option', 'pane-border-status', 'top'], stderr=null)
+            pane += 1
+            subprocess.call(
+                ['tmux', 'split', '-h',
+                 '{0} -m 5 start /nodes/{1}/console/session'.format(
+                     confettypath, node)])
+            subprocess.call(['tmux', 'select-layout', 'tiled'], stdout=null)
+    subprocess.call(['tmux', 'select-pane', '-t', '0'])
+    subprocess.call(['tmux', 'set-option', 'pane-border-status', 'top'], stderr=null)
+    os.execlp('tmux', 'tmux', 'attach', '-t', 'nodeconsole_{0}'.format(
+        os.getpid()))
+else:
+    os.execl(confettypath, confettypath, 'start',
+             '/nodes/{0}/console/session'.format(args[0]))

confluent_client/bin/nodedefine

@@ -47,7 +47,7 @@ session = client.Command()
 exitcode = 0
 attribs = {'name': noderange}
 for arg in args[1:]:
-    key, val = arg.split('=')
+    key, val = arg.split('=', 1)
     attribs[key] = val
 for r in session.create('/noderange/', attribs):
     if 'error' in r:

confluent_client/bin/nodediscover

@@ -19,6 +19,7 @@ import csv
 import optparse
 import os
 import sys
+import time
 
 path = os.path.dirname(os.path.realpath(__file__))
 path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
@@ -26,31 +27,49 @@ if path.startswith('/opt'):
     sys.path.append(path)
 
 import confluent.client as client
+import confluent.sortutil as sortutil
 
-tabformat = '{0:>15}|{1:>15}|{2:>15}|{3:>36}|{4:>17}|{5:>12}|{6:>48}'
-columns = ['Node', 'Model', 'Serial', 'UUID', 'Mac Address', 'Type',
-           'Current IP Addresses']
-delimit = ['-' * 15, '-' * 15, '-' * 15, '-' * 36, '-' * 17, '-' * 12,
-           '-' * 48]
+defcolumns = ['Node', 'Model', 'Serial', 'UUID', 'Mac Address', 'Type',
+              'Current IP Addresses']
+columnmapping = {
+    'Node': 'nodename',
+    'Model': 'modelnumber',
+    'Serial': 'serialnumber',
+    'UUID': 'uuid',
+    'Type': 'types',
+    'Current IP Addresses': 'ipaddrs',
+    'IP': 'ipaddrs',
+    'Bay': 'bay',
+    'Mac Address': 'macs',
+    'Mac': 'macs',
+    'Switch': 'switch',
+    'Port': 'port',
+    'Advertised IP': 'otheripaddrs',
+    'Other IP': 'otheripaddrs',
+}
 
 
-def dumpmacs(procinfo):
-    return ','.join(procinfo['macs']) # + procinfo.get('relatedmacs', []))
-
-
-def print_disco(options, session, currmac):
+def print_disco(options, session, currmac, outhandler, columns):
     procinfo = {}
     for tmpinfo in session.read('/discovery/by-mac/{0}'.format(currmac)):
 
         procinfo.update(tmpinfo)
-    record = [procinfo['nodename'], procinfo['modelnumber'],
-              procinfo['serialnumber'], procinfo['uuid'], dumpmacs(procinfo),
-              ','.join(procinfo['types']),
-              ','.join(sorted(procinfo['ipaddrs']))]
-    if options.csv:
-        csv.writer(sys.stdout).writerow(record)
-    else:
-        print(tabformat.format(*record))
+    if 'Switch' in columns or 'Port' in columns:
+        for tmpinfo in session.read(
+                '/networking/macs/by-mac/{0}'.format(currmac)):
+            if 'ports' in tmpinfo:
+                # The api sorts so that the most specific available value
+                # is last
+                procinfo.update(tmpinfo['ports'][-1])
+    record = []
+    for col in columns:
+        rawcol = columnmapping[col]
+        rawval = procinfo.get(rawcol, '')
+        if isinstance(rawval, list):
+            record.append(','.join(rawval))
+        else:
+            record.append(str(rawval))
+    outhandler.add_row(record)
 
 
 def process_header(header):
@@ -72,7 +91,7 @@ def process_header(header):
         elif datum in ('bmc', 'imm', 'xcc'):
             fields.append('hardwaremanagement.manager')
         elif datum in ('bmc gateway', 'xcc gateway', 'imm gateway'):
-            fields.append('net.bmc.gateway')
+            fields.append('net.bmc.ipv4_gateway')
         elif datum in ('bmcuser', 'username', 'user'):
             fields.append('secret.hardwaremanagementuser')
         elif datum in ('bmcpass', 'password', 'pass'):
@@ -122,18 +141,35 @@ def datum_to_attrib(datum):
     del datum['node']
     return datum
 
+unique_fields = frozenset(['serial', 'mac', 'uuid'])
+
 def import_csv(options, session):
     nodedata = []
+    unique_data = {}
     with open(options.importfile, 'r') as datasrc:
         records = csv.reader(datasrc)
         fields = process_header(next(records))
+        for field in fields:
+            if field in unique_fields:
+                unique_data[field] = set([])
         for record in records:
             currfields = list(fields)
             nodedatum = {}
             for datum in record:
-                nodedatum[currfields.pop(0)] = datum
+                currfield = currfields.pop(0)
+                if currfield in unique_fields:
+                    if datum in unique_data[currfield]:
+                        sys.stderr.write(
+                            "Import contains duplicate values "
+                            "({0} with value {1}\n".format(currfield, datum)
+                        )
+                        sys.exit(1)
+                    unique_data[currfield].add(datum)
+                nodedatum[currfield] = datum
             if not datum_complete(nodedatum):
                 sys.exit(1)
+            if not search_record(nodedatum, options, session):
+                blocking_scan(session)
             if not search_record(nodedatum, options, session):
                 sys.stderr.write(
                     "Could not match the following data: " +
@@ -165,17 +201,41 @@ def import_csv(options, session):
 
 
 def list_discovery(options, session):
-    if options.csv:
-        csv.writer(sys.stdout).writerow(columns)
+    orderby = None
+    if options.fields:
+        columns = []
+        for field in options.fields.split(','):
+            for cdt in columnmapping:
+                if cdt.lower().replace(
+                        ' ', '') == field.lower().replace(' ', ''):
+                    columns.append(cdt)
     else:
-        print(tabformat.format(*columns))
-        print(tabformat.format(*delimit))
+        columns = defcolumns
+    if options.order:
+        for field in columns:
+            if options.order.lower() == field.lower():
+                orderby = field
+    outhandler = client.Tabulator(columns)
     for mac in list_matching_macs(options, session):
-        print_disco(options, session, mac)
+        print_disco(options, session, mac, outhandler, columns)
+    if options.csv:
+        outhandler.write_csv(sys.stdout, orderby)
+    else:
+        for row in outhandler.get_table(orderby):
+            print(row)
 
+def clear_discovery(options, session):
+    for mac in list_matching_macs(options, session):
+        for res in session.delete('/discovery/by-mac/{0}'.format(mac)):
+            if 'deleted' in res:
+                print('Cleared info for {0}'.format(res['deleted']))
+            else:
+                print(repr(res))
 
-def list_matching_macs(options, session):
+def list_matching_macs(options, session, node=None):
     path = '/discovery/'
+    if node:
+        path += 'by-node/{0}/'.format(node)
     if options.model:
         path += 'by-model/{0}/'.format(options.model)
     if options.serial:
@@ -184,6 +244,10 @@ def list_matching_macs(options, session):
         path += 'by-uuid/{0}/'.format(options.uuid)
     if options.type:
         path += 'by-type/{0}/'.format(options.type)
+    if options.state:
+        if options.state == 'unknown':
+            options.state = 'unidentified'
+        path += 'by-state/{0}/'.format(options.state).lower()
     if options.mac:
         path += 'by-mac/{0}'.format(options.mac)
         result = list(session.read(path))[0]
@@ -194,21 +258,25 @@ def list_matching_macs(options, session):
         path += 'by-mac/'
         return [x['item']['href'] for x in session.read(path)]
 
-def assign_discovery(options, session):
+def assign_discovery(options, session, needid=True):
     abort = False
     if options.importfile:
         return import_csv(options, session)
-    if not (options.serial or options.uuid or options.mac):
+    if not options.node:
+        sys.stderr.write("Node (-n) must be specified for assignment\n")
+        abort = True
+    if needid and not (options.serial or options.uuid or options.mac):
         sys.stderr.write(
             "UUID (-u), serial (-s), or ether address (-e) required for "
             "assignment\n")
         abort = True
-    if not options.node:
-        sys.stderr.write("Node (-n) must be specified for assignment\n")
-        abort = True
     if abort:
         sys.exit(1)
-    matches = list_matching_macs(options, session)
+    matches = list_matching_macs(options, session, None if needid else options.node)
+    if not matches:
+        # Do a rescan to catch missing requested data
+        blocking_scan(session)
+        matches = list_matching_macs(options, session, None if needid else options.node)
     if not matches:
         sys.stderr.write("No matching discovery candidates found\n")
         sys.exit(1)
@@ -219,11 +287,16 @@ def assign_discovery(options, session):
         else:
             print(repr(res))
 
+def blocking_scan(session):
+    list(session.update('/discovery/rescan', {'rescan': 'start'}))
+    while(list(session.read('/discovery/rescan'))[0].get('scanning', False)):
+        time.sleep(0.5)
+    list(session.update('/networking/macs/rescan', {'rescan': 'start'}))
 
 
 def main():
     parser = optparse.OptionParser(
-        usage='Usage: %prog [list|assign|rescan] [options]')
+        usage='Usage: %prog [list|assign|rescan|clear] [options]')
     # -a for 'address' maybe?
     # order by
     # show state (discovered or..
@@ -234,6 +307,9 @@ def main():
     parser.add_option('-m', '--model', dest='model',
                       help='Operate with nodes matching the specified model '
                        'number', metavar='MODEL')
+    parser.add_option('-d', '--discoverystate', dest='state',
+                      help='The discovery state of the entries (discovered, '
+                           'identified, and unidentified)')
     parser.add_option('-s', '--serial', dest='serial',
                       help='Operate against the system matching the specified '
                            'serial number', metavar='SERIAL')
@@ -252,19 +328,28 @@ def main():
     parser.add_option('-i', '--import', dest='importfile',
                       help='Import bulk assignment data from given CSV file',
                       metavar='IMPORT.CSV')
+    parser.add_option('-f', '--fields', dest='fields',
+                      help='Select fields for output',
+                      metavar='FIELDS')
+    parser.add_option('-o', '--order', dest='order',
+                      help='Order output by given field', metavar='ORDER')
     (options, args) = parser.parse_args()
-    if len(args) == 0 or args[0] not in ('list', 'assign', 'rescan'):
+    if len(args) == 0 or args[0] not in ('list', 'assign', 'reassign', 'rescan', 'clear'):
         parser.print_help()
         sys.exit(1)
     session = client.Command()
     if args[0] == 'list':
         list_discovery(options, session)
+    if args[0] == 'clear':
+        clear_discovery(options, session)
     if args[0] == 'assign':
         assign_discovery(options, session)
+    if args[0] == 'reassign':
+        assign_discovery(options, session, False)
     if args[0] == 'rescan':
-        list(session.update('/discovery/rescan', {'rescan': 'start'}))
-        print("Rescan initiated")
+        blocking_scan(session)
+        print("Rescan complete")
 
 
 if __name__ == '__main__':
-    main()
+    main()

confluent_client/bin/nodeeventlog

@@ -33,7 +33,8 @@ if path.startswith('/opt'):
 
 import confluent.client as client
 
-sys.stdout = codecs.getwriter('utf8')(sys.stdout)
+if sys.version_info[0] < 3:
+    sys.stdout = codecs.getwriter('utf8')(sys.stdout)
 
 argparser = optparse.OptionParser(
     usage="Usage: %prog [options] noderange [clear]")
@@ -77,7 +78,10 @@ def format_event(evt):
             pass
         dscparts.append(evttext)
     retparts.append(' - '.join(dscparts))
-    return ' '.join(retparts)
+    msg = evt.get('message')
+    if not msg:
+        msg = ''
+    return ' '.join(retparts) + msg
 
 
 if deletemode:

confluent_client/bin/nodefirmware

@@ -35,28 +35,16 @@ import confluent.screensqueeze as sq
 
 exitcode = 0
 
-def printerror(res, node=None):
-    global exitcode
-    if 'errorcode' in res:
-        exitcode = res['errorcode']
-    if 'error' in res:
-        if node:
-            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
-        else:
-            sys.stderr.write('{0}\n'.format(res['error']))
-        if 'errorcode' not in res:
-            exitcode = 1
-
 
 def printfirm(node, prefix, data):
-    if 'model' in data:
+    if 'model' in data and data['model']:
         prefix += ' ' + data['model']
     builddesc = []
-    if 'build' in data:
+    if 'build' in data and data['build']:
         builddesc.append(data['build'])
-    if 'date' in data:
+    if 'date' in data and data['date']:
         builddesc.append(data['date'])
-    if 'version' in data:
+    if 'version' in data and data['version']:
         version = data['version']
         if builddesc:
             version += ' ({0})'.format(' '.join(builddesc))
@@ -64,9 +52,11 @@ def printfirm(node, prefix, data):
         version = ' '.join(builddesc)
     print('{0}: {1}: {2}'.format(node, prefix, version))
 
+components = ['all']
 
 argparser = optparse.OptionParser(
-    usage="Usage: %prog <noderange> [update [--backup <file>]")
+    usage="Usage: "
+          "%prog <noderange> [list][update [--backup <file>]]|[<components>]")
 argparser.add_option('-b', '--backup', action='store_true',
                      help='Target a backup bank rather than primary')
 (options, args) = argparser.parse_args()
@@ -74,10 +64,19 @@ upfile = None
 try:
     noderange = args[0]
     if len(args) > 1:
-        if args[1] != 'update':
-            argparser.print_help()
-            sys.exit(1)
-        upfile = args[2]
+        if args[1] == 'update':
+            upfile = args[2]
+        else:
+            if args[1] == 'list':
+                comps = args[2:]
+            else:
+                comps = args[1:]
+            components = []
+            for arg in comps:
+                components += arg.split(',')
+            if not components:
+                components = ['all']
+
 except IndexError:
     argparser.print_help()
     sys.exit(1)
@@ -135,18 +134,25 @@ def update_firmware(session, filename):
         sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
 
 def show_firmware(session):
-    for res in session.read('/noderange/{0}/inventory/firmware/all/all'.format(
-            noderange)):
-        printerror(res)
-        if 'databynode' not in res:
-            continue
-        for node in res['databynode']:
-            printerror(res['databynode'][node], node)
-            if 'firmware' not in res['databynode'][node]:
+    global exitcode
+    firmware_shown = False
+    for component in components:
+        for res in session.read(
+                '/noderange/{0}/inventory/firmware/all/{1}'.format(
+                    noderange, component)):
+            exitcode |= client.printerror(res)
+            if 'databynode' not in res:
                 continue
-            for inv in res['databynode'][node]['firmware']:
-                for prefix in inv:
-                    printfirm(node, prefix, inv[prefix])
+            for node in res['databynode']:
+                exitcode |= client.printerror(res['databynode'][node], node)
+                if 'firmware' not in res['databynode'][node]:
+                    continue
+                for inv in res['databynode'][node]['firmware']:
+                    for prefix in inv:
+                        firmware_shown = True
+                        printfirm(node, prefix, inv[prefix])
+    if not firmware_shown:
+        argparser.print_help()
 
 
 try:

confluent_client/bin/nodegroupattrib

@@ -17,6 +17,7 @@
 
 __author__ = 'alin37'
 
+from getpass import getpass
 import optparse
 import os
 import signal
@@ -35,14 +36,20 @@ import confluent.client as client
 
 argparser = optparse.OptionParser(
     usage='''\n       %prog [options]   \
-             \n       %prog [options] nodegroup [list of attributes]  \
-             \n       %prog [options] nodegroup group=value1,value2   \
-             \n       %prog [options] nodegroup group=value1,value2
+             \n       %prog [options] nodegroup [list of attributes|all]  \
+             \n       %prog [options] nodegroup nodes=value1,value2   \
+             \n       %prog -e nodegroup <attribute names to set>  \
+             \n       %prog [options] nodegroup nodes=value1,value2
              \n ''')
 argparser.add_option('-b', '--blame', action='store_true',
                      help='Show information about how attributes inherited')
+argparser.add_option('-e', '--environment', action='store_true',
+                     help='Set attributes, but from environment variable of '
+                          'same name')
 argparser.add_option('-c', '--clear', action='store_true',
                      help='Clear variables')
+argparser.add_option('-p', '--prompt', action='store_true',
+                     help='Prompt for attribute values interactively')
 (options, args) = argparser.parse_args()
 
 
@@ -68,7 +75,19 @@ if len(args) > 1:
         print("Can not clear and set at the same time!")
         argparser.print_help()
         sys.exit(1)
-    exitcode=client.updateattrib(session,args,nodetype, nodegroups, options)
+    argassign = None
+    if options.prompt:
+        argassign = {}
+        for arg in args[1:]:
+            oneval = 1
+            twoval = 2
+            while oneval != twoval:
+                oneval = getpass('Enter value for {0}: '.format(arg))
+                twoval = getpass('Confirm value for {0}: '.format(arg))
+                if oneval != twoval:
+                    print('Values did not match.')
+            argassign[arg] = twoval
+    exitcode=client.updateattrib(session,args,nodetype, nodegroups, options, argassign)
     try:
         # setting user output to what the user inputs
         if args[1] == 'all':

confluent_client/bin/nodegroupdefine

@@ -47,7 +47,7 @@ session = client.Command()
 exitcode = 0
 attribs = {'name': noderange}
 for arg in args[1:]:
-    key, val = arg.split('=')
+    key, val = arg.split('=', 1)
     attribs[key] = val
 for r in session.create('/nodegroups/', attribs):
     if 'error' in r:

confluent_client/bin/nodegrouplist

@@ -0,0 +1,62 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2015-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+__author__ = 'jjohnson2,alin37,andywray'
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+def main():
+    argparser = optparse.OptionParser(
+    usage="Usage: %prog\n")
+    (options, args) = argparser.parse_args()
+    noderange=""
+    nodelist=""
+    nodelist = '/nodegroups/'
+    session = client.Command()
+    exitcode = 0
+    showtype='all'
+    requestargs=args[1:]
+    nodetype='noderange'
+    if len(args) > 0:
+        argparser.print_help()
+        sys.exit(1)
+    else:
+        for res in session.read(nodelist):
+            if 'error' in res:
+                sys.stderr.write(res['error'] + '\n')
+                exitcode = 1
+            else:
+                print(res['item']['href'].replace('/', ''))
+
+    sys.exit(exitcode)
+
+if __name__ == '__main__':
+    main()

confluent_client/bin/nodegrouprename

@@ -0,0 +1,63 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2019 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+__author__ = 'jjohnson2,alin37,andywray'
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+def main():
+    argparser = optparse.OptionParser(
+    usage="Usage: %prog <group> <new group name>\n")
+    (options, args) = argparser.parse_args()
+    noderange=""
+    nodelist=""
+    nodelist = '/nodegroups/'
+    session = client.Command()
+    exitcode = 0
+    requestargs=args[1:]
+    nodetype='noderange'
+    if len(args) != 2:
+        argparser.print_help()
+        sys.exit(1)
+    else:
+        for res in session.update(
+            '/nodegroups/{0}/attributes/rename'.format(args[0]),
+            {'rename': args[1]}):
+            if 'error' in res:
+                sys.stderr.write(res['error'] + '\n')
+                exitcode = 1
+            else:
+                print('{0}: {1}'.format(res['oldname'], res['newname']))
+
+    sys.exit(exitcode)
+
+if __name__ == '__main__':
+    main()

confluent_client/bin/nodehealth

@@ -32,7 +32,8 @@ if path.startswith('/opt'):
 
 import confluent.client as client
 
-sys.stdout = codecs.getwriter('utf8')(sys.stdout)
+if sys.version_info[0] < 3:
+    sys.stdout = codecs.getwriter('utf8')(sys.stdout)
 
 argparser = optparse.OptionParser(usage="Usage: %prog <noderange>")
 (options, args) = argparser.parse_args()
@@ -44,6 +45,13 @@ except IndexError:
 client.check_globbing(noderange)
 
 
+codemappings = {
+    'ok': 0,
+    'warning': 1,
+    'critical': 2,
+    'failed': 2,
+}
+
 def main():
     global session, exitcode, healthbynode, healthexplanations, health, node, sensor, explanation
     session = client.Command()
@@ -66,9 +74,11 @@ def main():
             if 'error' in health[node]:
                 sys.stderr.write('{0}: Error: {1}\n'.format(
                     node, health[node]['error']))
-                exitcode |= 1
+                exitcode = 3
             if 'health' in health[node]:
                 healthbynode[node] = health[node]['health']['value']
+                if codemappings[healthbynode[node]] > exitcode:
+                    exitcode = codemappings[healthbynode[node]]
             if 'sensors' in health[node]:
                 healthexplanations[node] = []
                 for sensor in health[node]['sensors']:
@@ -94,5 +104,5 @@ try:
     main()
 except KeyboardInterrupt:
     print('')
-    sys.exit(0)
+sys.exit(exitcode)
 

confluent_client/bin/nodeinventory

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 import codecs
+import json
 import optparse
 import os
 import re
@@ -33,7 +34,8 @@ if path.startswith('/opt'):
 
 import confluent.client as client
 
-sys.stdout = codecs.getwriter('utf8')(sys.stdout)
+if sys.version_info[0] < 3:
+    sys.stdout = codecs.getwriter('utf8')(sys.stdout)
 
 filters = []
 
@@ -49,15 +51,17 @@ def print_mem_info(node, prefix, meminfo):
     memdescfmt = '{0}GB PC'
     if meminfo['memory_type'] == 'DDR3 SDRAM':
         memdescfmt += '3-{1} '
-    elif meminfo['memory_type'] == 'DDR4 SDRAM':
+    elif 'DDR4' in meminfo['memory_type']:
         memdescfmt += '4-{1} '
-    elif meminfo['memory_type'] == 'Unknown':
-        print('{0}: Unrecognized Memory'.format(node))
+    else:
+        print('{0}: {1}: Unrecognized Memory'.format(node, prefix))
         return
-    if meminfo['ecc']:
+    if meminfo.get('ecc', False):
         memdescfmt += 'ECC '
     capacity = meminfo['capacity_mb'] / 1024
-    memdescfmt += meminfo['module_type']
+    modtype = meminfo.get('module_type', None)
+    if modtype:
+        memdescfmt += modtype
     memdesc = memdescfmt.format(capacity, meminfo['speed'])
     print('{0}: {1} description: {2}'.format(node, prefix, memdesc))
     print('{0}: {1} manufacturer: {2}'.format(
@@ -65,10 +69,11 @@ def print_mem_info(node, prefix, meminfo):
     print('{0}: {1} model: {2}'.format(node, prefix, meminfo['model']))
     print('{0}: {1} serial number: {2}'.format(node, prefix,
                                                meminfo['serial']))
-    print('{0}: {1} manufacture date: {2}'.format(node, prefix,
-                                                  meminfo['manufacture_date']))
-    print('{0}: {1} manufacture location: {2}'.format(
-        node, prefix, meminfo['manufacture_location']))
+    if 'manufacture_date' in meminfo:
+        print('{0}: {1} manufacture date: {2}'.format(node, prefix,
+                                                      meminfo['manufacture_date']))
+        print('{0}: {1} manufacture location: {2}'.format(
+            node, prefix, meminfo['manufacture_location']))
 
 exitcode = 0
 
@@ -86,12 +91,14 @@ def printerror(res, node=None):
 
 
 url = '/noderange/{0}/inventory/hardware/all/all'
+usedprefixes = set([])
 
 argparser = optparse.OptionParser(
     usage="Usage: %prog <noderange> [serial|model|uuid|mac]")
+argparser.add_option('-j', '--json', action='store_true', help='Output JSON')
 (options, args) = argparser.parse_args()
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
 except IndexError:
     argparser.print_help()
     sys.exit(1)
@@ -114,6 +121,8 @@ if len(args) > 1:
                     filters.append(re.compile('mac address'))
                     url = '/noderange/{0}/inventory/hardware/all/all'
 try:
+    if options.json:
+        databynode = {}
     session = client.Command()
     for res in session.read(url.format(noderange)):
         printerror(res)
@@ -125,9 +134,19 @@ try:
                 continue
             for inv in res['databynode'][node]['inventory']:
                 prefix = inv['name']
+                idx = 2
+                while (node, prefix) in usedprefixes:
+                    prefix = '{0} {1}'.format(inv['name'], idx)
+                    idx += 1
+                usedprefixes.add((node, prefix))
                 if not inv['present']:
                     if not filters:
-                        print '{0}: {1}: Not Present'.format(node, prefix)
+                        if options.json:
+                            if node not in databynode:
+                                databynode[node] = {}
+                            databynode[node][prefix] = inv
+                        else:
+                            print('{0}: {1}: Not Present'.format(node, prefix))
                     continue
                 info = inv['information']
                 info.pop('board_extra', None)
@@ -136,6 +155,11 @@ try:
                 info.pop('product_extra', None)
                 if 'memory_type' in info:
                     if not filters:
+                        if options.json:
+                            if node not in databynode:
+                                databynode[node] = {}
+                            databynode[node][prefix] = inv
+                            continue
                         print_mem_info(node, prefix, info)
                     continue
                 for datum in info:
@@ -147,9 +171,17 @@ try:
                             continue
                     if info[datum] is None:
                         continue
+                    if options.json:
+                        if node not in databynode:
+                            databynode[node] = {}
+                        databynode[node][prefix] = inv
+                        break
                     print(u'{0}: {1} {2}: {3}'.format(node, prefix,
                                                      pretty(datum),
                                                      info[datum]))
+    if options.json:
+        print(json.dumps(databynode, sort_keys=True, indent=4,
+                         separators=(',', ': ')))
 except KeyboardInterrupt:
     print('')
-sys.exit(exitcode)
+sys.exit(exitcode)

confluent_client/bin/nodelicense

@@ -0,0 +1,141 @@
+#!/usr/bin/python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2019 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+import time
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+exitcode = 0
+
+argparser = optparse.OptionParser(
+    usage="Usage: "
+          "%prog <noderange> [list][install <file>|save <directory>|delete <name>]")
+(options, args) = argparser.parse_args()
+upfile = None
+downdir = None
+delete = False
+try:
+    noderange = args[0]
+    if len(args) > 1:
+        if args[1] == 'install':
+            upfile = args[2]
+        elif args[1] == 'save':
+            downdir = args[2]
+        elif args[1] == 'delete':
+            delete = args[2]
+        else:
+            components = ['all']
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+
+
+def install_license(session, filename):
+    global exitcode
+    if not os.path.exists(filename):
+        sys.stderr.write('Unable to locate requested file {0}\n'.format(
+            filename))
+        sys.exit(404)
+    resource = '/noderange/{0}/configuration/' \
+               'management_controller/licenses/'.format(noderange)
+    filename = os.path.abspath(filename)
+    instargs = {'filename': filename}
+    for res in session.create(resource, instargs):
+        pass # print(repr(res))
+    show_licenses(session)
+
+
+def save_licenses(session, dirname):
+    global exitcode
+    resource = '/noderange/{0}/configuration/' \
+               'management_controller/save_licenses'.format(noderange)
+    filename = os.path.abspath(dirname)
+    if not os.path.exists(filename):
+        sys.stderr.write('Unable to locate specified directory {0}\n'.format(
+            filename))
+        sys.exit(404)
+    instargs = {'dirname': filename}
+    for res in session.create(resource, instargs):
+        for node in res.get('databynode', {}):
+            fname = res['databynode'][node].get('filename', None)
+            if fname:
+                print('{0}: Saved license to {1}'.format(node, fname))
+            else:
+                sys.stderr.write('{0}: {1}', node, repr(res['databynode'][node]))
+
+
+def show_licenses(session):
+    global exitcode
+    for res in session.read(
+            '/noderange/{0}/configuration/management_controller/licenses/'
+            'all'.format(noderange)):
+        for node in res.get('databynode', {}):
+            for license in res['databynode'][node].get('License', []):
+                msg = '{0}: {1}'.format(node, license.get('feature',
+                                                          'Unknown'))
+                if license.get('state', 'Active') != 'Active':
+                    msg += ' ({0})'.format(license['state'])
+                print(msg)
+
+
+def delete_license(session, licname):
+    global exitcode
+    licstodel = []
+    for res in list(session.read(
+            '/noderange/{0}/configuration/management_controller/licenses/'
+            'all'.format(noderange))):
+        for node in res.get('databynode', {}):
+            for license in res['databynode'][node].get('License', []):
+                if license.get('feature', None) == licname:
+                    prefix = '/nodes/{0}/configuration/management_controller/licenses/'.format(node)
+                    for currlic in list(session.read(prefix)):
+                        currlic = currlic.get('item', {}).get('href', 'all')
+                        if currlic == 'all':
+                            continue
+                        currname = list(session.read(prefix + currlic))[0]
+                        currname = currname.get('License', [{}])[0].get('feature', None)
+                        if currname == licname:
+                            list(session.delete(prefix + currlic))
+    show_licenses(session)
+
+try:
+    session = client.Command()
+    if upfile:
+        install_license(session, upfile)
+    elif downdir:
+        save_licenses(session, downdir)
+    elif delete:
+        delete_license(session, delete)
+    else:
+        show_licenses(session)
+except KeyboardInterrupt:
+    print('')
+sys.exit(exitcode)

confluent_client/bin/nodelist

@@ -61,7 +61,7 @@ def main():
                 sys.stderr.write(res['error'] + '\n')
                 exitcode = 1
             else:
-                print res['item']['href'].replace('/', '')
+                print(res['item']['href'].replace('/', ''))
 
     sys.exit(exitcode)
 

confluent_client/bin/nodemedia

@@ -0,0 +1,191 @@
+#!/usr/bin/python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+import time
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.screensqueeze as sq
+
+exitcode = 0
+
+
+def get_update_progress(session, url):
+    for res in session.read(url):
+        status = res['phase']
+        percent = res['progress']
+        detail = res['detail']
+        if status == 'error':
+            text = 'error!'
+        else:
+            text = '{0}: {1:3.0f}%'.format(status, percent)
+    return text, status, detail
+
+
+def printerror(res, node=None):
+    global exitcode
+    if 'errorcode' in res:
+        exitcode = res['errorcode']
+    if 'error' in res:
+        if node:
+            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
+        else:
+            sys.stderr.write('{0}\n'.format(res['error']))
+        if 'errorcode' not in res:
+            exitcode = 1
+    for node in res.get('databynode', ()):
+        printerror(res['databynode'][node], node)
+
+
+def attach_media(noderange, media):
+    global exitcode
+    session = client.Command()
+    if ':' not in media:
+        sys.stderr.write('Full URL required for attach\n')
+        sys.exit(1)
+    resource = '/noderange/{0}/media/attach'.format(noderange)
+    for res in session.update(resource, {'url': media}):
+        printerror(res)
+    list_media(noderange, media)
+
+
+def list_media(noderange, media):
+    session = client.Command()
+    resource = '/noderange/{0}/media/current'.format(noderange)
+    for res in session.read(resource):
+        printerror(res)
+        for node in res.get('databynode', []):
+            url = res['databynode'][node].get('url', None)
+            name =  res['databynode'][node].get('name', None)
+            if (url and not url.startswith('file:') and
+                    not res['databynode'][node].get('secure', False)):
+                name += ' (insecure)'
+            if not name:
+                continue
+            print('{0}: {1}'.format(node, url + '/' + name if url else name))
+
+
+def detach_media(noderange, media):
+    global exitcode
+    session = client.Command()
+    resource = '/noderange/{0}/media/detach'.format(noderange)
+    for res in session.update(resource, {'detachall': 1}):
+        printerror(res)
+
+
+def upload_media(noderange, media):
+    global exitcode
+    if not os.path.exists(media):
+        sys.stderr.write('Unable to locate requested file {0}\n'.format(
+            media))
+        sys.exit(404)
+    session = client.Command()
+    output = sq.ScreenPrinter(noderange, session)
+    filename = os.path.abspath(media)
+    resource = '/noderange/{0}/media/uploads/'.format(noderange)
+    upargs = {'filename': filename}
+    noderrs = {}
+    nodeurls = {}
+    for res in session.create(resource, upargs):
+        if 'created' not in res:
+            for nodename in res.get('databynode', ()):
+                output.set_output(nodename, 'error!')
+                noderrs[nodename] = res['databynode'][nodename].get(
+                    'error', 'Unknown Error')
+            continue
+        watchurl = res['created']
+        currnode = watchurl.split('/')[1]
+        nodeurls[currnode] = '/' + watchurl
+    while nodeurls:
+        for node in list(nodeurls):
+            progress, status, err = get_update_progress(
+                session, nodeurls[node])
+            if status == 'error':
+                exitcode = 1
+                noderrs[node] = err
+            if status in ('error', 'complete', 'pending'):
+                list(session.delete(nodeurls[node]))
+                del nodeurls[node]
+            output.set_output(node, progress)
+        time.sleep(2)
+    allerrnodes = ','.join(noderrs)
+    if noderrs:
+        sys.stderr.write(
+            'Nodes had errors receiving media ({0})!\n'.format(allerrnodes))
+    for node in noderrs:
+        sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
+    list_media(noderange, media)
+
+funmap = {
+    'upload': upload_media,
+    'attach': attach_media,
+    'detachall': detach_media,
+    'list': list_media,
+}
+
+
+class OptParser(optparse.OptionParser):
+
+    def format_epilog(self, formatter):
+        return self.expand_prog_name(self.epilog)
+
+def main():
+    argparser = OptParser(
+        usage="Usage: %prog <noderange> [list|upload|attach|detachall] "
+              "<filename>|all|<url>",
+        epilog='\nupload will take the specified file and upload it to the '
+               'BMC.\n\n'
+               'attach will instruct the BMC to connect a remote media to the '
+               'specified url.\n\ndetachall will remove *ALL* uploaded and '
+               'attached urls from the BMC\n\nlist shows currently mounted '
+               'media.\n\nSee `man %prog` for more info.\n')
+    (options, args) = argparser.parse_args()
+    media = None
+    try:
+        noderange = args[0]
+        operation = args[1]
+        arglength = 2
+        if operation in ('attach', 'upload'):
+            media = args[2]
+            arglength = 3
+        if len(args) > arglength:
+            argparser.print_help()
+            sys.exit(1)
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    client.check_globbing(noderange)
+    try:
+        handler = funmap[operation]
+    except KeyError:
+        argparser.print_help()
+        sys.exit(1)
+    handler(noderange, media)
+if __name__ == '__main__':
+    main()

confluent_client/bin/nodepower

@@ -34,6 +34,9 @@ import confluent.client as client
 argparser = optparse.OptionParser(
     usage="Usage: %prog [options] noderange "
           "([status|on|off|shutdown|boot|reset])")
+argparser.add_option('-p', '--showprevious', dest='previous',
+                     action='store_true', default=False,
+                     help='Show previous power state')
 (options, args) = argparser.parse_args()
 try:
     noderange = args[0]
@@ -42,11 +45,11 @@ except IndexError:
     sys.exit(1)
 client.check_globbing(noderange)
 setstate = None
-if len(sys.argv) > 2:
+if len(args) > 1:
     if setstate == 'softoff':
         setstate = 'shutdown'
-    elif not sys.argv[2] in ('stat', 'state', 'status'):
-        setstate = sys.argv[2]
+    elif not args[1] in ('stat', 'state', 'status'):
+        setstate = args[1]
 
 if setstate not in (None, 'on', 'off', 'shutdown', 'boot', 'reset'):
     argparser.print_help()
@@ -54,5 +57,19 @@ if setstate not in (None, 'on', 'off', 'shutdown', 'boot', 'reset'):
 session = client.Command()
 exitcode = 0
 session.add_precede_key('oldstate')
-sys.exit(
-    session.simple_noderange_command(noderange, '/power/state', setstate))
+
+if options.previous:
+    # get previous states
+    prev = {}
+    for rsp in session.read("/noderange/{0}/power/state".format(noderange)):
+        # gets previous (current) states
+
+        databynode = rsp["databynode"]
+
+        for node in databynode:
+            prev[node] = databynode[node]["state"]["value"]
+
+    # add dictionary to session
+    session.add_precede_dict(prev)
+
+sys.exit(session.simple_noderange_command(noderange, '/power/state', setstate))

confluent_client/bin/noderename

@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2019 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+
+argparser = optparse.OptionParser(usage="Usage: %prog <noderange> <newname>")
+(options, args) = argparser.parse_args()
+try:
+    noderange = args[0]
+except IndexError:
+    argparser.print_help()
+    sys.exit(1)
+client.check_globbing(noderange)
+identifystate = None
+if len(sys.argv) > 2:
+    newname = sys.argv[2]
+else:
+    argparser.print_help()
+    sys.exit(1)
+session = client.Command()
+exitcode = 0
+sys.exit(
+    session.simple_noderange_command(noderange, 'attributes/rename', newname))
+

confluent_client/bin/nodersync

@@ -0,0 +1,153 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2016-2017 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from collections import deque
+import optparse
+import os
+import select
+import shlex
+import signal
+import subprocess
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.screensqueeze as sq
+import confluent.sortutil as sortutil
+
+
+def run():
+    argparser = optparse.OptionParser(
+        usage="Usage: %prog location noderange:location",
+    )
+    argparser.add_option('-f', '-c', '--count', type='int', default=168,
+                         help='Number of nodes to concurrently rsync')
+    # among other things, FD_SETSIZE limits.  Besides, spawning too many
+    # processes can be unkind for the unaware on memory pressure and such...
+    argparser.disable_interspersed_args()
+    (options, args) = argparser.parse_args()
+    if len(args) < 2 or ':' not in args[-1]:
+        argparser.print_help()
+        sys.exit(1)
+    concurrentprocs = options.count
+    noderange, targpath = args[-1].split(':', 1)
+    client.check_globbing(noderange)
+    c = client.Command()
+    cmdstr = " ".join(args[:-1])
+    cmdstr = 'rsync -av --info=progress2 ' + cmdstr
+    cmdstr += ' {node}:' + targpath
+
+    currprocs = 0
+    all = set([])
+    pipedesc = {}
+    pendingexecs = deque()
+    exitcode = 0
+
+    for exp in c.create('/noderange/{0}/attributes/expression'.format(noderange),
+                        {'expression': cmdstr}):
+        if 'error' in exp:
+            sys.stderr.write(exp['error'] + '\n')
+            exitcode |= exp.get('errorcode', 1)
+        ex = exp.get('databynode', ())
+        for node in ex:
+            cmd = ex[node]['value'].encode('utf-8')
+            cmdv = shlex.split(cmd)
+            if currprocs < concurrentprocs:
+                currprocs += 1
+                run_cmdv(node, cmdv, all, pipedesc)
+            else:
+                pendingexecs.append((node, cmdv))
+    if not all or exitcode:
+        sys.exit(exitcode)
+    rdy, _, _ = select.select(all, [], [], 10)
+    nodeerrs = {}
+    pernodeout = {}
+    pernodefile = {}
+    output = sq.ScreenPrinter(noderange, c)
+
+    while all:
+        for r in rdy:
+            desc = pipedesc[r]
+            node = desc['node']
+            data = True
+            while data and select.select([r], [], [], 0)[0]:
+                data = r.read(1)
+                if data:
+                    if desc['type'] == 'stdout':
+                        if node not in pernodeout:
+                            pernodeout[node] = ''
+                        pernodeout[node] += data
+                        if '\n' in pernodeout[node]:
+                            currout, pernodeout[node] = pernodeout[node].split('\n', 1)
+                            if currout:
+                                pernodefile[node] = os.path.basename(currout)
+                        if '\r' in pernodeout[node]:
+                            currout, pernodeout[node] = pernodeout[node].split('\r', 1)
+                            if currout:
+                                currout = currout.split()
+                                try:
+                                    currout = currout[1]
+                                    output.set_output(node, '{0}:{1}'.format(pernodefile[node], currout))
+                                except IndexError:
+                                    pernodefile = currout[0]
+                                    pass
+                    else:
+                        output.set_output(node, 'error!')
+                        if node not in nodeerrs:
+                            nodeerrs[node] = ''
+                        nodeerrs[node] += data
+                else:
+                    pop = desc['popen']
+                    ret = pop.poll()
+                    if ret is not None:
+                        exitcode = exitcode | ret
+                        all.discard(r)
+                        r.close()
+                        if node not in nodeerrs:
+                            output.set_output(node, 'complete')
+                        if desc['type'] == 'stdout' and pendingexecs:
+                            node, cmdv = pendingexecs.popleft()
+                            run_cmdv(node, cmdv, all, pipedesc)
+        if all:
+            rdy, _, _ = select.select(all, [], [], 10)
+    for node in nodeerrs:
+        for line in nodeerrs[node].split('\n'):
+            sys.stderr.write('{0}: {1}\n'.format(node, line))
+    sys.exit(exitcode)
+
+
+def run_cmdv(node, cmdv, all, pipedesc):
+    nopen = subprocess.Popen(
+        cmdv, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    pipedesc[nopen.stdout] = {'node': node, 'popen': nopen,
+                              'type': 'stdout'}
+    pipedesc[nopen.stderr] = {'node': node, 'popen': nopen,
+                              'type': 'stderr'}
+    all.add(nopen.stdout)
+    all.add(nopen.stderr)
+
+
+if __name__ == '__main__':
+    run()

confluent_client/bin/noderun

@@ -39,11 +39,13 @@ import confluent.sortutil as sortutil
 
 def run():
     argparser = optparse.OptionParser(
-        usage="Usage: %prog noderange commandexpression",
+        usage="Usage: %prog [options] noderange commandexpression",
         epilog="Expressions are the same as in attributes, e.g. "
                "'ipmitool -H {hardwaremanagement.manager}' will be expanded.")
-    argparser.add_option('-c', '--count', type='int', default=168,
+    argparser.add_option('-f', '-c', '--count', type='int', default=168,
                          help='Number of commands to run at a time')
+    argparser.add_option('-n', '--nonodeprefix', action='store_true',
+                         help='Do not prefix output with node names')
     # among other things, FD_SETSIZE limits.  Besides, spawning too many
     # processes can be unkind for the unaware on memory pressure and such...
     argparser.disable_interspersed_args()
@@ -85,7 +87,7 @@ def run():
             desc = pipedesc[r]
             node = desc['node']
             data = True
-            while data and select.select([r], [], [], 0):
+            while data and select.select([r], [], [], 0)[0]:
                 data = r.readline()
                 if data:
                     if desc['type'] == 'stdout':
@@ -93,7 +95,10 @@ def run():
                             pernodeout[node] = []
                         pernodeout[node].append(data)
                     else:
-                        sys.stderr.write('{0}: {1}'.format(node, data))
+                        if options.nonodeprefix:
+                            sys.stderr.write(data)
+                        else:
+                            sys.stderr.write('{0}: {1}'.format(node, data))
                         sys.stderr.flush()
                 else:
                     pop = desc['popen']
@@ -101,12 +106,16 @@ def run():
                     if ret is not None:
                         exitcode = exitcode | ret
                         all.discard(r)
+                        r.close()
                         if desc['type'] == 'stdout' and pendingexecs:
                             node, cmdv = pendingexecs.popleft()
                             run_cmdv(node, cmdv, all, pipedesc)
         for node in sortutil.natural_sort(pernodeout):
             for line in pernodeout[node]:
-                sys.stdout.write('{0}: {1}'.format(node, line))
+                if options.nonodeprefix:
+                    sys.stdout.write(line)
+                else:
+                    sys.stdout.write('{0}: {1}'.format(node, line))
         sys.stdout.flush()
         if all:
             rdy, _, _ = select.select(all, [], [], 10)
@@ -125,4 +134,4 @@ def run_cmdv(node, cmdv, all, pipedesc):
 
 
 if __name__ == '__main__':
-    run()
+    run()

confluent_client/bin/nodesensors

@@ -114,7 +114,8 @@ def sensorpass(showout=True, appendtime=False):
                         continue
                     for redundant_state in ('Non-Critical', 'Critical'):
                         try:
-                            sensedata['states'].remove(redundant_state)
+                            if sensedata.get('states', False):
+                                sensedata['states'].remove(redundant_state)
                         except ValueError:
                             pass
                     resultdata[node][sensedata['name']] = sensedata
@@ -132,11 +133,12 @@ def sensorpass(showout=True, appendtime=False):
                             showval = u' {0} '.format(sensedata['value'])
                         if sensedata['units'] not in (None, u''):
                             showval += sensedata['units']
-                        if sensedata['health'] != 'ok':
+                        if sensedata.get('health', 'ok') != 'ok':
                             datadescription = [sensedata['health']]
                         else:
                             datadescription = []
-                        datadescription.extend(sensedata['states'])
+                        if sensedata.get('states', False):
+                            datadescription.extend(sensedata['states'])
                         if datadescription:
                             if showval == '':
                                 showval += u' {0}'.format(
@@ -148,7 +150,7 @@ def sensorpass(showout=True, appendtime=False):
                             showval += ' @' + time.strftime(
                                 '%Y-%m-%dT%H:%M:%S')
                         print(u'{0}: {1}:{2}'.format(
-                            node, sensedata['name'], showval).encode('utf-8'))
+                            node, sensedata['name'], showval))
                         sys.stdout.flush()
     return resultdata
 
@@ -183,6 +185,7 @@ def format_csv(csvwriter, orderedsensors, resdata, showtime=True):
             except KeyError:
                 rowdata.append('N/A')
         csvwriter.writerow(rowdata)
+        sys.stdout.flush()
 
 
 def main():
@@ -196,7 +199,7 @@ def main():
             orderedsensors.append(name)
         orderedsensors.sort()
         for name in orderedsensors:
-            headernames.append(sensorheaders[name].encode('utf-8'))
+            headernames.append(sensorheaders[name])
     if options.csv:
         linebyline = False
         csvwriter = csv.writer(sys.stdout)
@@ -220,7 +223,7 @@ def main():
                     sys.exit(exitcode)
             sleeptime = nextstart - os.times()[4]
             if sleeptime > 0:
-                time.sleep(nextstart - os.times()[4])
+                time.sleep(sleeptime)
     else:
         if options.csv:
             format_csv(csvwriter, orderedsensors, resdata, showtime=False)

confluent_client/bin/nodesetboot

@@ -53,8 +53,8 @@ except IndexError:
     argparser.print_help()
     sys.exit(1)
 bootdev = None
-if len(sys.argv) > 2:
-    bootdev = sys.argv[2]
+if len(args) > 1:
+    bootdev = args[1]
     if bootdev in ('net', 'pxe'):
         bootdev = 'network'
 session = client.Command()
@@ -65,4 +65,4 @@ else:
     bootmode = 'uefi'
 sys.exit(session.simple_noderange_command(noderange, '/boot/nextdevice', bootdev,
                                      bootmode=bootmode,
-                                     persistent=options.persist))
+                                     persistent=options.persist))

confluent_client/bin/nodeshell

@@ -39,11 +39,13 @@ import confluent.sortutil as sortutil
 def run():
 
     argparser = optparse.OptionParser(
-        usage="Usage: %prog noderange commandexpression",
+        usage="Usage: %prog [options] noderange commandexpression",
         epilog="Expressions are the same as in attributes, e.g. "
                "'ipmitool -H {hardwaremanagement.manager}' will be expanded.")
-    argparser.add_option('-c', '--count', type='int', default=168,
+    argparser.add_option('-f', '-c', '--count', type='int', default=168,
                          help='Number of commands to run at a time')
+    argparser.add_option('-n', '--nonodeprefix', action='store_true',
+                         help='Do not prefix output with node names')
     # among other things, FD_SETSIZE limits.  Besides, spawning too many
     # processes can be unkind for the unaware on memory pressure and such...
     argparser.disable_interspersed_args()
@@ -86,7 +88,7 @@ def run():
             desc = pipedesc[r]
             node = desc['node']
             data = True
-            while data and select.select([r], [], [], 0):
+            while data and select.select([r], [], [], 0)[0]:
                 data = r.readline()
                 if data:
                     if desc['type'] == 'stdout':
@@ -94,7 +96,10 @@ def run():
                             pernodeout[node] = []
                         pernodeout[node].append(data)
                     else:
-                        sys.stderr.write('{0}: {1}'.format(node, data))
+                        if options.nonodeprefix:
+                            sys.stderr.write(data)
+                        else:
+                            sys.stderr.write('{0}: {1}'.format(node, data))
                         sys.stderr.flush()
                 else:
                     pop = desc['popen']
@@ -102,12 +107,16 @@ def run():
                     if ret is not None:
                         exitcode = exitcode | ret
                         all.discard(r)
+                        r.close()
                         if desc['type'] == 'stdout' and pendingexecs:
                             node, cmdv = pendingexecs.popleft()
                             run_cmdv(node, cmdv, all, pipedesc)
         for node in sortutil.natural_sort(pernodeout):
             for line in pernodeout[node]:
-                sys.stdout.write('{0}: {1}'.format(node, line))
+                if options.nonodeprefix:
+                    sys.stdout.write(line)
+                else:
+                    sys.stdout.write('{0}: {1}'.format(node, line))
         sys.stdout.flush()
         if all:
             rdy, _, _ = select.select(all, [], [], 10)
@@ -126,4 +135,4 @@ def run_cmdv(node, cmdv, all, pipedesc):
 
 
 if __name__ == '__main__':
-    run()
+    run()

confluent_client/bin/nodestorage

@@ -0,0 +1,224 @@
+#!/usr/bin/python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+exitcode = 0
+
+class OptParser(optparse.OptionParser):
+
+    def format_epilog(self, formatter):
+        return self.expand_prog_name(self.epilog)
+
+def mbtohuman(mb):
+    if mb > 1000000:
+        return '{0:.3f} TB'.format(mb/1000000.0)
+    if mb > 1000:
+        return '{0:.3f} GB'.format(mb/1000.0)
+    return '{0:.3f} MB'.format(mb)
+
+def showstorage(noderange, options, args):
+    global exitcode
+    session = client.Command()
+    disks = {}
+    arrays = {}
+    volumes = {}
+    scfg = session.read('/noderange/{0}/configuration/storage/all'.format(
+        noderange))
+    _print_cfg(scfg)
+
+
+def _print_cfg(scfg):
+    global exitcode
+    storagebynode = {}
+    for e in scfg:
+        if 'error' in e:
+            sys.stderr.write(e['error'] + '\n')
+            exitcode = e.get('errorcode', 1)
+        for node in e.get('databynode', {}):
+            if node not in storagebynode:
+                storagebynode[node] = {'disks': [], 'arrays': [],
+                                       'volumes': []}
+            curr = e['databynode'][node]
+            storagebynode[node][curr['type'] + 's'].append(curr)
+    for node in storagebynode:
+        for disk in sorted(storagebynode[node]['disks'],
+                           key=lambda x: x['name']):
+            print('{0}: Disk {1} Description: {2}'.format(
+                node, disk['name'], disk['description']))
+            print('{0}: Disk {1} State: {2}'.format(node, disk['name'],
+                                                    disk['state']))
+            print('{0}: Disk {1} FRU: {2}'.format(node, disk['name'],
+                                                  disk['fru']))
+            print('{0}: Disk {1} Serial Number: {2}'.format(node, disk['name'],
+                                                            disk['serial']))
+            if disk['array']:
+                print('{0}: Disk {1} Array: {2}'.format(node, disk['name'],
+                                                        disk['array']))
+        for arr in storagebynode[node]['arrays']:
+            print('{0}: Array {1} Available Capacity: {2}'.format(
+                node, arr['id'], mbtohuman(arr['available'])))
+            print('{0}: Array {1} Total Capacity: {2}'.format(
+                node, arr['id'], mbtohuman(arr['capacity'])))
+            print('{0}: Array {1} RAID: {2}'.format(node, arr['id'],
+                                                    arr['raid']))
+            print('{0}: Array {1} Disks: {2}'.format(node, arr['id'], ','.join(
+                arr['disks'])))
+            print(
+                '{0}: Array {1} Volumes: {2}'.format(node, arr['id'], ','.join(
+                    arr['volumes'])))
+        for vol in storagebynode[node]['volumes']:
+            print('{0}: Volume {1}: Size: {2}'.format(node, vol['name'],
+                                                      mbtohuman(vol['size'])))
+            print('{0}: Volume {1}: State: {2}'.format(node, vol['name'],
+                                                       vol['state']))
+            print('{0}: Volume {1}: Array {2}'.format(node, vol['name'],
+                                                      vol['array']))
+
+
+def createstorage(noderange, options, args):
+    if options.raidlevel is None or options.disks is None:
+        sys.stderr.write('-r and -d are required arguments to create array\n')
+        sys.exit(1)
+    session = client.Command()
+    names = options.name
+    if names is None:
+        names = ''.join(args)
+    parms = {'disks': options.disks, 'raidlevel': options.raidlevel,
+             'name': names}
+    if options.size:
+        parms['size'] = options.size
+    if options.stripsizes:
+        parms['stripsizes'] = options.stripsizes
+    _print_cfg(session.create(
+            '/noderange/{0}/configuration/storage/volumes/{1}'.format(
+                noderange, names), parms))
+
+
+def deletestorage(noderange, options, args):
+    if options.name is None:
+        if len(args) == 1:
+            names = args[0]
+        else:
+            sys.stderr.write('-n is required to indicate volume(s) to delete\n')
+            sys.exit(1)
+    else:
+        names = options.name
+    session = client.Command()
+    for rsp in session.delete(
+            '/noderange/{0}/configuration/storage/volumes/{1}'.format(
+                noderange, names)):
+        if 'deleted' in rsp:
+            print('Deleted: {0}'.format(rsp['deleted']))
+        elif 'databynode' in rsp:
+            for node in rsp['databynode']:
+                if 'error' in rsp['databynode'][node]:
+                    sys.stderr.write('{0}: {1}\n'.format(
+                        node, rsp['databynode'][node]['error']))
+                else:
+                    sys.stderr.write('{0}: {1}\n'.format(
+                        node, repr(rsp['databynode'][node])))
+        else:
+            print(repr(rsp))
+
+
+def setdisk(noderange, options, args):
+    if options.disks is None:
+        if len(args):
+            names = args.pop(0)
+        else:
+            sys.stderr.write('-d is required to indicate disk to modify\n')
+            sys.exit(1)
+    else:
+        names = options.disks
+    if not len(args) or args[0] not in ('hotspare', 'jbod', 'unconfigured'):
+        sys.stderr.write('diskset requires valid state as argument (hotspare, jbod, unconfigured)\n')
+        sys.exit(1)
+    session = client.Command()
+    scfg = session.update('/noderange/{0}/configuration/storage/disks/{1}'.format(noderange, names), {'state': args[0]})
+    _print_cfg(scfg)
+
+funmap = {
+    'create': createstorage,
+    'show': showstorage,
+    'diskset': setdisk,
+    'delete': deletestorage,
+    'rm': deletestorage,
+}
+
+
+
+def main():
+    argparser = OptParser(
+        usage='Usage: %prog <noderange> [show|create|delete|diskset]',
+        epilog='',
+    )
+    argparser.add_option('-r', '--raidlevel', type='int',
+                         help='RAID level to use when creating an array')
+    argparser.add_option('-d', '--disks', type='str',
+                         help='Comma separated list of disks to use, or the '
+                              'word "rest" to indicate use of all available '
+                              'disks')
+    argparser.add_option('-s', '--size', type='str',
+                         help='Comma separated list of sizes to use when '
+                              'creating volumes.  The sizes may be absolute '
+                              'size (e.g. 16gb), percentage (10%) or the word '
+                              '"rest" to use remaining capacity, default '
+                              'behavior is to use all capacity to make a '
+                              'volume')
+    argparser.add_option('-n', '--name', type='str',
+                         help='Comma separated list of names to use when '
+                              'naming volumes, or selecting a volume for '
+                              'delete.  Default behavior is to use '
+                              'implementation provided default names.')
+    argparser.add_option('-z', '--stripsizes', type='str',
+                         help='Comma separated list of stripsizes to use when creating volumes. '
+                            'This value is in kilobytes.  The default behavior is to allow the '
+                            'storage controller to decide.')
+    (options, args) = argparser.parse_args()
+    if len(args) == 1:
+        args.append('show')
+    try:
+        noderange = args[0]
+        operation = args[1]
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    client.check_globbing(noderange)
+    try:
+        handler = funmap[operation]
+    except KeyError:
+        argparser.print_help()
+        sys.exit(1)
+    handler(noderange, options, args[2:])
+
+
+if __name__ == '__main__':
+    main()

confluent_client/bin/nodesupport

@@ -0,0 +1,147 @@
+#!/usr/bin/python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+import time
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.screensqueeze as sq
+
+exitcode = 0
+
+
+def get_update_progress(session, url):
+    for res in session.read(url):
+        status = res['phase']
+        percent = res['progress']
+        detail = res['detail']
+        if status == 'error':
+            text = 'error!'
+        else:
+            text = '{0}: {1:3.0f}%'.format(status, percent)
+    return text, status, detail
+
+
+def printerror(res, node=None):
+    global exitcode
+    if 'errorcode' in res:
+        exitcode = res['errorcode']
+    if 'error' in res:
+        if node:
+            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
+        else:
+            sys.stderr.write('{0}\n'.format(res['error']))
+        if 'errorcode' not in res:
+            exitcode = 1
+    for node in res.get('databynode', ()):
+        printerror(res['databynode'][node], node)
+
+
+
+def download_servicedata(noderange, media):
+    global exitcode
+    session = client.Command()
+    output = sq.ScreenPrinter(noderange, session)
+    filename = os.path.abspath(media)
+    resource = '/noderange/{0}/support/servicedata/'.format(noderange)
+    upargs = {'filename': filename}
+    noderrs = {}
+    nodeurls = {}
+    for res in session.create(resource, upargs):
+        if 'created' not in res:
+            for nodename in res.get('databynode', ()):
+                output.set_output(nodename, 'error!')
+                noderrs[nodename] = res['databynode'][nodename].get(
+                    'error', 'Unknown Error')
+            continue
+        watchurl = res['created']
+        currnode = watchurl.split('/')[1]
+        nodeurls[currnode] = '/' + watchurl
+    while nodeurls:
+        for node in list(nodeurls):
+            progress, status, err = get_update_progress(
+                session, nodeurls[node])
+            if status == 'error':
+                exitcode = 1
+                noderrs[node] = err
+            if status in ('error', 'complete', 'pending'):
+                list(session.delete(nodeurls[node]))
+                del nodeurls[node]
+            output.set_output(node, progress)
+        time.sleep(2)
+    allerrnodes = ','.join(noderrs)
+    if noderrs:
+        sys.stderr.write(
+            'Nodes had errors retrieving service data ({0})!\n'.format(allerrnodes))
+    for node in noderrs:
+        sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
+
+funmap = {
+    'servicedata': download_servicedata,
+}
+
+
+class OptParser(optparse.OptionParser):
+
+    def format_epilog(self, formatter):
+        return self.expand_prog_name(self.epilog)
+
+def main():
+    argparser = OptParser(
+        usage="Usage: %prog <noderange> servicedata "
+              "<filename>",
+        epilog='\nservicedata will save service data to the given '
+               'directory.  It is saved to the location on the relevant '
+               'management server (the confluent server if running remote, '
+               'and the collective.manager if in collective)\n'
+               '\n\nSee `man %prog` for more info.\n')
+    (options, args) = argparser.parse_args()
+    media = None
+    try:
+        noderange = args[0]
+        operation = args[1]
+        arglength = 2
+        if operation == 'servicedata':
+            media = args[2]
+            arglength = 3
+        if len(args) > arglength:
+            argparser.print_help()
+            sys.exit(1)
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    client.check_globbing(noderange)
+    try:
+        handler = funmap[operation]
+    except KeyError:
+        argparser.print_help()
+        sys.exit(1)
+    handler(noderange, media)
+if __name__ == '__main__':
+    main()

confluent_client/bin/stats

@@ -0,0 +1,167 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2019 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import csv
+import fcntl
+import io
+import numpy as np
+
+import os
+import sixel
+import subprocess
+import sys
+
+class DumbWriter(sixel.SixelWriter):
+    def restore_position(self, output):
+        return
+
+
+def plot(gui, output, plotdata, bins):
+    import matplotlib as mpl
+    if not gui:
+        mpl.use('Agg')
+    import matplotlib.pyplot as plt
+    n, bins, patches = plt.hist(plotdata, bins)
+    plt.show()
+    if not gui:
+        if output:
+            tdata = output
+        else:
+            tdata = io.BytesIO()
+        plt.savefig(tdata)
+    if not gui and not output:
+        writer = DumbWriter()
+        writer.draw(tdata)
+    return n, bins
+
+def textplot(plotdata, bins):
+    n, bins = np.histogram(plotdata, bins)
+    labels = []
+    for bin in bins:
+        labels.append('{0:0.1f}'.format(bin))
+    width = 80
+    # Since this will be primarily piped into, hard to get 
+    # terminal width
+    labelwidth = 0
+    for lab in labels:
+        if len(lab) > labelwidth:
+            labelwidth = len(lab)
+    width -= (labelwidth) + 1
+    labelfmt = '{{0:>{0}s}}|'.format(labelwidth)
+    maxn = 0.0
+    for lgth in n:
+        if lgth > maxn:
+            maxn = float(lgth)
+    for i in range(len(n)):
+        print(labelfmt.format(labels[i]) + '=' * int(np.round((n[i]/maxn) * width)))
+    return n, bins
+
+histogram = False
+aparser = argparse.ArgumentParser(description='Quick access to common statistics')
+aparser.add_argument('-c', type=int, default=0, help='Column number to analyze (default is last column)')
+aparser.add_argument('-d', default=None, help='Value used to separate columns')
+aparser.add_argument('-x', default=False, action='store_true', help='Output histogram in sixel format')
+aparser.add_argument('-s', default=0, help='Number of header lines to skip before processing')
+aparser.add_argument('-g', default=False, action='store_true', help='Open histogram in separate graphical window')
+aparser.add_argument('-o', default=None, help='Output histogram to the specified filename in PNG format')
+aparser.add_argument('-t', default=False, action='store_true', help='Output a histogram in text format')
+aparser.add_argument('-v', default=False, action='store_true', help='Attempt to list nodes relevant to each histogram bar (requires -s, -o, or -t)')
+aparser.add_argument('-b', type=int, default=10, help='Number of bins to use in histogram (default is 10)')
+args = aparser.parse_args(sys.argv[1:])
+plotdata = []
+headlines = int(args.s)
+while headlines >= 0:
+    data = sys.stdin.readline()
+    headlines -= 1
+if args.d:
+    delimiter = args.d
+else:
+    if '\t' in data:
+        delimiter = '\t'
+    elif ' ' in data:
+        delimiter = ' '
+    elif ',' in data:
+        delimiter = ','
+    else:
+        delimiter = ' '  # handle single column
+data = list(csv.reader([data], delimiter=delimiter))[0]
+nodebydatum = {}
+idx = args.c - 1
+autoidx = False
+while data:
+    node = None
+    if ':' in data[0]:
+        node, data[0] = data[0].split(':', 1)
+    else:
+        node = data[0]
+    if idx == -1 and not autoidx:
+        while not autoidx:
+            try:
+                datum = float(data[idx])
+            except ValueError:
+                idx -= 1
+                continue
+            except IndexError:
+                sys.stderr.write('Unable to identify a numerical column\n')
+                sys.exit(1)
+            autoidx = True
+    else:
+        datum = float(data[idx])
+    if node:
+        if datum in nodebydatum:
+            nodebydatum[datum].add(node)
+        else:
+            nodebydatum[datum] = set([node])
+    plotdata.append(datum)
+    data = sys.stdin.readline()
+    data = list(csv.reader([data], delimiter=delimiter))[0]
+n = None
+if args.g or args.o or args.x:
+    n, bins = plot(args.g, args.o, plotdata, bins=args.b)
+if args.t:
+    n, bins = textplot(plotdata, bins=args.b)
+print('Samples: {5} Min: {3} Median: {0} Mean: {1} Max: {4} StandardDeviation: {2} Sum: {6}'.format(np.median(plotdata), np.mean(plotdata), np.std(plotdata), np.min(plotdata), np.max(plotdata), len(plotdata), np.sum(plotdata)))
+if args.v and n is not None and nodebydatum:
+    print('')
+    currbin = bins[0]
+    bins = bins[1:]
+    currbinmembers = []
+    for datum in sorted(nodebydatum):
+        if datum > bins[0]:
+           nextbin = None
+           endbin = bins[0]
+           while len(bins) and bins[0] < datum:
+                nextbin = bins[0]
+                bins = bins[1:]
+           if not nextbin:
+               nextbin = np.max(plotdata)
+           print('Entries between {0} and {1}'.format(currbin, endbin))
+           currbin = nextbin
+           print('-' * 80)
+           print(','.join(sorted(currbinmembers)))
+           print('')
+           print('')
+           currbinmembers = []
+        for node in nodebydatum[datum]:
+            currbinmembers.append(node)
+    if currbinmembers:
+       print('Entries between {0} and {1}'.format(currbin, np.max(plotdata)))
+       print('-' * 80)
+       print(','.join(sorted(currbinmembers)))
+       print('')
+       print('')

confluent_client/builddeb

@@ -0,0 +1 @@
+../confluent_server/builddeb

confluent_client/confluent/client.py

@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2014 IBM Corporation
-# Copyright 2015-2016 Lenovo
+# Copyright 2015-2018 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,8 +15,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import anydbm as dbm
+try:
+    import anydbm as dbm
+except ImportError:
+    import dbm
+import csv
 import errno
+import fnmatch
 import hashlib
 import os
 import shlex
@@ -24,6 +29,7 @@ import socket
 import ssl
 import sys
 import confluent.tlvdata as tlvdata
+import confluent.sortutil as sortutil
 
 SO_PASSCRED = 16
 
@@ -33,6 +39,73 @@ _attraliases = {
     'bmcpass': 'secret.hardwaremanagementpassword',
 }
 
+
+class Tabulator(object):
+    def __init__(self, headers):
+        self.headers = headers
+        self.rows = []
+
+    def add_row(self, row):
+        self.rows.append(row)
+
+    def get_table(self, order=None):
+        i = 0
+        fmtstr = ''
+        separator = []
+        for head in self.headers:
+            if order and order == head:
+                order = i
+            neededlen = len(head)
+            for row in self.rows:
+                if len(row[i]) > neededlen:
+                    neededlen = len(row[i])
+            separator.append('-' * (neededlen + 1))
+            fmtstr += '{{{0}:>{1}}}|'.format(i, neededlen + 1)
+            i = i + 1
+        fmtstr = fmtstr[:-1]
+        yield fmtstr.format(*self.headers)
+        yield fmtstr.format(*separator)
+        if order is not None:
+            for row in sorted(
+                    self.rows,
+                    key=lambda x: sortutil.naturalize_string(x[order])):
+                yield fmtstr.format(*row)
+        else:
+            for row in self.rows:
+                yield fmtstr.format(*row)
+
+    def write_csv(self, output, order=None):
+        output = csv.writer(output)
+        output.writerow(self.headers)
+        i = 0
+        for head in self.headers:
+            if order and order == head:
+                order = i
+            i = i + 1
+        if order is not None:
+            for row in sorted(
+                    self.rows,
+                    key=lambda x: sortutil.naturalize_string(x[order])):
+                output.writerow(row)
+        else:
+            for row in self.rows:
+                output.writerow(row)
+
+
+def printerror(res, node=None):
+    exitcode = 0
+    if 'errorcode' in res:
+        exitcode = res['errorcode']
+    if 'error' in res:
+        if node:
+            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
+        else:
+            sys.stderr.write('{0}\n'.format(res['error']))
+        if 'errorcode' not in res:
+            exitcode = 1
+    return exitcode
+
+
 def cprint(txt):
     print(txt)
     sys.stdout.flush()
@@ -53,6 +126,7 @@ def _parseserver(string):
 
 class Command(object):
     def __init__(self, server=None):
+        self._prevdict = None
         self._prevkeyname = None
         self.connection = None
         self._currnoderange = None
@@ -65,6 +139,8 @@ class Command(object):
             self.serverloc = server
         if os.path.isabs(self.serverloc) and os.path.exists(self.serverloc):
             self._connect_unix()
+        elif self.serverloc == '/var/run/confluent/api.sock':
+            raise Exception('Confluent service is not available')
         else:
             self._connect_tls()
         tlvdata.recv(self.connection)
@@ -88,6 +164,9 @@ class Command(object):
     def add_precede_key(self, keyname):
         self._prevkeyname = keyname
 
+    def add_precede_dict(self, dict):
+        self._prevdict = dict
+
     def handle_results(self, ikey, rc, res, errnodes=None):
         if 'error' in res:
             if errnodes is not None:
@@ -120,6 +199,9 @@ class Command(object):
                 if self._prevkeyname and self._prevkeyname in res[node]:
                     cprint('{0}: {2}->{1}'.format(
                         node, val, res[node][self._prevkeyname]['value']))
+                elif self._prevdict and node in self._prevdict:
+                    cprint('{0}: {2}->{1}'.format(
+                        node, val, self._prevdict[node]))
                 else:
                     cprint('{0}: {1}'.format(node, val))
         return rc
@@ -239,19 +321,23 @@ class Command(object):
             certreqs = ssl.CERT_NONE
             knownhosts = True
         self.connection = ssl.wrap_socket(self.connection, ca_certs=cacert,
-                                          cert_reqs=certreqs,
-                                          ssl_version=ssl.PROTOCOL_TLSv1)
+                                          cert_reqs=certreqs)
         if knownhosts:
             certdata = self.connection.getpeercert(binary_form=True)
             fingerprint = 'sha512$' + hashlib.sha512(certdata).hexdigest()
+            fingerprint = fingerprint.encode('utf-8')
             hostid = '@'.join((port, server))
             khf = dbm.open(os.path.join(clientcfgdir, "knownhosts"), 'c', 384)
             if hostid in khf:
                 if fingerprint == khf[hostid]:
                     return
                 else:
-                    replace = raw_input(
-                        "MISMATCHED CERTIFICATE DATA, ACCEPT NEW? (y/n):")
+                    try:
+                        replace = raw_input(
+                            "MISMATCHED CERTIFICATE DATA, ACCEPT NEW? (y/n):")
+                    except NameError:
+                        replace = input(
+                            "MISMATCHED CERTIFICATE DATA, ACCEPT NEW? (y/n):")
                     if replace not in ('y', 'Y'):
                         raise Exception("BAD CERTIFICATE")
             cprint('Adding new key for %s:%s' % (server, port))
@@ -290,10 +376,10 @@ def attrrequested(attr, attrlist, seenattributes):
             candidate = candidate.replace('hm', 'hardwaremanagement', 1)
         if candidate in _attraliases:
             candidate = _attraliases[candidate]
-        if candidate == attr:
+        if fnmatch.fnmatch(attr.lower(), candidate.lower()):
             seenattributes.add(truename)
             return True
-        elif attr.startswith(candidate + '.'):
+        elif attr.lower().startswith(candidate.lower() + '.'):
             seenattributes.add(truename)
             return True
     return False
@@ -312,20 +398,30 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
             sys.stderr.write(res['error'] + '\n')
             exitcode = 1
             continue
-        for node in res['databynode']:
-            for attr in res['databynode'][node]:
+        for node in sorted(res['databynode']):
+            for attr, val in sorted(
+                    res['databynode'][node].items(),
+                    key=lambda k: k[1].get('sortid', k[0]) if isinstance(k[1], dict) else k[0]):
+                if attr == 'error':
+                    sys.stderr.write('{0}: Error: {1}\n'.format(node, val))
+                    continue
+                if attr == 'errorcode':
+                    exitcode |= val
+                    continue
                 seenattributes.add(attr)
-                if rename and attr in rename:
-                    printattr = rename[attr]
+                if rename:
+                    printattr = rename.get(attr, attr)
                 else:
                     printattr = attr
                 currattr = res['databynode'][node][attr]
-                if (requestargs is None or requestargs == [] or attrrequested(
-                        attr, requestargs, seenattributes)):
+                if show_attr(attr, requestargs, seenattributes, options):
                     if 'value' in currattr:
                         if currattr['value'] is not None:
+                            val = currattr['value']
+                            if isinstance(val, list):
+                                val = ','.join(val)
                             attrout = '{0}: {1}: {2}'.format(
-                                node, printattr, currattr['value'])
+                                node, printattr, val)
                         else:
                             attrout = '{0}: {1}:'.format(node, printattr)
                     elif 'isset' in currattr:
@@ -347,8 +443,11 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
                         attrout = '{0}: {1}: {2}'.format(node, printattr, ','.join(map(str, dictout)))
                     else:
                         cprint("CODE ERROR" + repr(attr))
-
-                    if options.blame or 'broken' in currattr:
+                    try:
+                        blame = options.blame
+                    except AttributeError:
+                        blame = False
+                    if blame or 'broken' in currattr:
                         blamedata = []
                         if 'inheritedfrom' in currattr:
                             blamedata.append('inherited from group {0}'.format(
@@ -360,7 +459,42 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
                                     currattr['expression']))
                         if blamedata:
                             attrout += ' (' + ', '.join(blamedata) + ')'
-                    cprint(attrout)
+                    try:
+                        comparedefault = options.comparedefault
+                    except AttributeError:
+                        comparedefault = False
+                    if comparedefault:
+                        try:
+                            exclude = options.exclude
+                        except AttributeError:
+                            exclude = False
+                        if ((requestargs and not exclude) or
+                                (currattr.get('default', None) is not None and
+                                currattr.get('value', None) is not None and
+                                currattr['value'] != currattr['default'])):
+                            cval = ','.join(currattr['value']) if isinstance(
+                                currattr['value'], list) else currattr['value']
+                            dval = ','.join(currattr['default']) if isinstance(
+                                currattr['default'], list) else currattr['default']
+                            cprint('{0}: {1}: {2} (Default: {3})'.format(
+                                node, printattr, cval, dval))
+                    else:
+
+                        try:
+                            details = options.detail
+                        except AttributeError:
+                            details = False
+                        if details:
+                            if currattr.get('help', None):
+                                attrout += u' (Help: {0})'.format(
+                                    currattr['help'])
+                            if currattr.get('possible', None):
+                                try:
+                                    attrout += u' (Choices: {0})'.format(
+                                        ','.join(currattr['possible']))
+                                except TypeError:
+                                    pass
+                        cprint(attrout)
     if not exitcode:
         if requestargs:
             for attr in requestargs:
@@ -370,6 +504,19 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
     return exitcode
 
 
+def show_attr(attr, requestargs, seenattributes, options):
+    try:
+        reverse = options.exclude
+    except AttributeError:
+        reverse = False
+    if requestargs is None or requestargs == []:
+        return True
+    processattr = attrrequested(attr, requestargs, seenattributes)
+    if reverse:
+        processattr = not processattr
+    return processattr
+
+
 def printgroupattributes(session, requestargs, showtype, nodetype, noderange, options):
     exitcode = 0
     seenattributes = set([])
@@ -417,7 +564,7 @@ def printgroupattributes(session, requestargs, showtype, nodetype, noderange, op
                     exitcode = 1
     return exitcode
 
-def updateattrib(session, updateargs, nodetype, noderange, options):
+def updateattrib(session, updateargs, nodetype, noderange, options, dictassign=None):
     # update attribute
     exitcode = 0
     if options.clear:
@@ -431,26 +578,53 @@ def updateattrib(session, updateargs, nodetype, noderange, options):
                     exitcode = res['errorcode']
                 sys.stderr.write('Error: ' + res['error'] + '\n')
         sys.exit(exitcode)
+    elif hasattr(options, 'environment') and options.environment:
+        for key in updateargs[1:]:
+            key = key.replace('.', '_')
+            value = os.environ.get(
+                key, os.environ[key.upper()])
+            # Let's do one pass to make sure that there's not a usage problem
+        for key in updateargs[1:]:
+            key = key.replace('.', '_')
+            value = os.environ.get(
+                key, os.environ[key.upper()])
+            if (nodetype == "nodegroups"):
+                exitcode = session.simple_nodegroups_command(noderange,
+                                                             'attributes/all',
+                                                             value, key)
+            else:
+                exitcode = session.simple_noderange_command(noderange,
+                                                            'attributes/all',
+                                                            value, key)
+        sys.exit(exitcode)
+    elif dictassign:
+        for key in dictassign:
+            if nodetype == 'nodegroups':
+                exitcode = session.simple_nodegroups_command(
+                    noderange, 'attributes/all', dictassign[key], key)
+            else:
+                exitcode = session.simple_noderange_command(
+                    noderange, 'attributes/all', dictassign[key], key)
     else:
         if "=" in updateargs[1]:
             try:
-                if len(updateargs[1:]) > 1:
-                    for val in updateargs[1:]:
-                        val = val.split('=')
-                        if (nodetype == "nodegroups"):
-                            exitcode =  session.simple_nodegroups_command(noderange, 'attributes/all',
-                                                                         val[1],val[0])
-                        else:
-                            exitcode = session.simple_noderange_command(noderange, 'attributes/all',
-                                                                        val[1], val[0])
-                else:
-                    val = updateargs[1].split('=')
-                    if nodetype == "nodegroups" :
-                        exitcode = session.simple_nodegroups_command(noderange, 'attributes/all',
-                                                                     val[1], val[0])
+                for val in updateargs[1:]:
+                    val = val.split('=', 1)
+                    if val[0][-1] in (',', '-', '^'):
+                        key = val[0][:-1]
+                        if val[0][-1] == ',':
+                            value = {'prepend': val[1]}
+                        elif val[0][-1] in ('-', '^'):
+                            value = {'remove': val[1]}
+                    else:
+                        key = val[0]
+                        value = val[1]
+                    if (nodetype == "nodegroups"):
+                        exitcode =  session.simple_nodegroups_command(noderange, 'attributes/all',
+                                                                     value, key)
                     else:
                         exitcode = session.simple_noderange_command(noderange, 'attributes/all',
-                                                                    val[1], val[0])
+                                                                    value, key)
             except:
                 sys.stderr.write('Error: {0} not a valid expression\n'.format(str(updateargs[1:])))
                 exitcode = 1
@@ -489,4 +663,4 @@ def check_globbing(noderange):
                 'bash or change directories such that there is no filename '
                 'that would conflict.'
                 '\n'.format(noderange))
-            sys.exit(1)
+            sys.exit(1)

confluent_client/confluent/screensqueeze.py

@@ -44,6 +44,8 @@ class ScreenPrinter(object):
         self.fieldwidth = maxlen + textlen + 1  # 1 for column
 
     def set_output(self, node, text):
+        if self.nodeoutput[node] == text:
+            return
         self.nodeoutput[node] = text
         if len(text) >= self.textlen:
             self.textlen = len(text) + 1

confluent_client/confluent/textgroup.py

@@ -169,13 +169,18 @@ class GroupedData(object):
         output.flush()
 
     def print_deviants(self, output=sys.stdout, skipmodal=False, reverse=False,
-                       count=False):
+                       count=False, basenode=None):
         self.generate_byoutput()
         modaloutput = None
         ismodal = True
         revoutput = []
+        if basenode:
+            for checkout in self.byoutput:
+                if basenode in self.byoutput[checkout]:
+                    modaloutput = checkout
         for outdata in sorted(
-                self.byoutput, key=lambda x: [0 - len(self.byoutput[x]),
+                self.byoutput, key=lambda x: [0 if modaloutput == x else 1,
+                                              0 - len(self.byoutput[x]),
                                               humanify_nodename(
                                                   self.get_group_text(
                                                       self.byoutput[x]

confluent_client/confluent/tlvdata.py

@@ -20,6 +20,11 @@ from datetime import datetime
 import json
 import struct
 
+try:
+    unicode
+except NameError:
+    unicode = str
+
 def decodestr(value):
     ret = None
     try:
@@ -29,6 +34,8 @@ def decodestr(value):
             ret = value.decode('cp437')
         except UnicodeDecodeError:
             ret = value
+    except AttributeError:
+        return value
     return ret
 
 def unicode_dictvalues(dictdata):
@@ -38,17 +45,28 @@ def unicode_dictvalues(dictdata):
         elif isinstance(dictdata[key], datetime):
             dictdata[key] = dictdata[key].strftime('%Y-%m-%dT%H:%M:%S')
         elif isinstance(dictdata[key], list):
-            for i in xrange(len(dictdata[key])):
-                if isinstance(dictdata[key][i], str):
-                    dictdata[key][i] = decodestr(dictdata[key][i])
-                elif isinstance(dictdata[key][i], dict):
-                    unicode_dictvalues(dictdata[key][i])
+            _unicode_list(dictdata[key])
         elif isinstance(dictdata[key], dict):
             unicode_dictvalues(dictdata[key])
 
 
+def _unicode_list(currlist):
+    for i in xrange(len(currlist)):
+        if isinstance(currlist[i], str):
+            currlist[i] = decodestr(currlist[i])
+        elif isinstance(currlist[i], dict):
+            unicode_dictvalues(currlist[i])
+        elif isinstance(currlist[i], list):
+            _unicode_list(currlist[i])
+
+
 def send(handle, data):
-    if isinstance(data, str):
+    if isinstance(data, unicode):
+        try:
+            data = data.encode('utf-8')
+        except AttributeError:
+            pass
+    if isinstance(data, str) or isinstance(data, unicode):
         # plain text, e.g. console data
         tl = len(data)
         if tl == 0:
@@ -74,6 +92,14 @@ def send(handle, data):
         handle.sendall(struct.pack("!I", tl))
         handle.sendall(sdata)
 
+def recvall(handle, size):
+    rd = handle.recv(size)
+    while len(rd) < size:
+        nd = handle.recv(size - len(rd))
+        if not nd:
+            raise Exception("Error reading data")
+        rd += nd
+    return rd
 
 def recv(handle):
     tl = handle.recv(4)

confluent_client/confluent_env.sh

@@ -29,10 +29,263 @@ alias nodehealth='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export C
 alias nodeidentify='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeidentify'
 alias nodeinventory='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeinventory'
 alias nodelist='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodelist'
+alias nodemedia='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodemedia'
 alias nodepower='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodepower'
 alias noderemove='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; noderemove'
 alias nodereseat='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodereseat'
 alias noderun='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; noderun'
 alias nodesensors='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodesensors'
 alias nodesetboot='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodesetboot'
+alias nodestorage='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodestorage'
 alias nodeshell='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeshell'
+alias nodelicense='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodelicense'
+# Do not continue for non-bash shells, the rest of this sets up bash completion functions
+[ -z "$BASH_VERSION" -o -z "$PS1" ] && return
+
+
+_confluent_get_args()
+{
+    CMPARGS=($COMP_LINE)
+    NUMARGS=${#CMPARGS[@]}
+    if [ "${COMP_WORDS[-1]}" == '' ]; then
+        NUMARGS=$((NUMARGS+1))
+        CMPARGS+=("")
+    fi
+    GENNED=""
+    for CAND in ${COMP_CANDIDATES[@]}; do
+        candarray=(${CAND//,/ })
+        matched=0
+        for c in "${candarray[@]}"; do
+            for arg in "${CMPARGS[@]}"; do
+                if [ "$arg" = "$c" ]; then
+                    matched=1
+                    break
+                fi
+            done
+        done
+        if [ 0 = $matched ]; then
+            for c in "${candarray[@]}"; do
+                GENNED+=" $c"
+            done
+        fi
+    done
+}
+
+function _confluent_generic_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS -ge 3 ] && [ ! -z "$GENNED" ]; then
+        COMPREPLY=($(compgen -W "$GENNED" -- ${COMP_WORDS[-1]}))
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+_confluent_nodeidentify_completion()
+{
+    COMP_CANDIDATES=("on,off -h")
+    _confluent_generic_completion
+}
+
+
+_confluent_nodesetboot_completion()
+{
+    COMP_CANDIDATES=("default,cd,network,setup,hd -h -b -p")
+    _confluent_generic_completion
+}
+
+_confluent_nodepower_completion()
+{
+   COMP_CANDIDATES=("boot,off,on,status -h -p")
+   _confluent_generic_completion
+}
+
+_confluent_nodemedia_completion()
+{
+    COMP_CANDIDATES=("list,upload,attach,detachall -h")
+    _confluent_get_args
+    if [ $NUMARGS -gt 3 ] && [ ${CMPARGS[-2]} == 'upload' ]; then
+        compopt -o default
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -ge 3 ] && [ ! -z "$GENNED" ]; then
+        COMPREPLY=($(compgen -W "$GENNED" -- ${COMP_WORDS[-1]}))
+        return;
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+
+_confluent_nodefirmware_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS == 3 ]; then
+        COMPREPLY=($(compgen -W "list update" -- ${COMP_WORDS[-1]}))
+        return;
+    fi
+    if [ $NUMARGS -gt 3 ] && [ ${CMPARGS[2]} == 'update' ]; then
+        compopt -o default
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+
+_confluent_nodeshell_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS == 3 ]; then
+        COMPREPLY=($(compgen -c -- ${COMP_WORDS[-1]}))
+        return
+    fi
+    if [ $NUMARGS -gt 3 ]; then
+        compopt -o default
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+
+_confluent_nodelicense_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS == 3 ]; then
+        COMPREPLY=($(compgen -W "install list save delete" -- ${COMP_WORDS[-1]}))
+        return;
+    fi
+    if [ $NUMARGS == 4 ] && [ ${CMPARGS[2]} == 'install' ]; then
+        compopt -o default
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS == 4 ] && [ ${CMPARGS[2]} == 'save' ]; then
+        compopt -o dirnames
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+         _confluent_nr_completion
+         return
+    fi
+}
+
+_confluent_nodesupport_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS == 3 ]; then
+        COMPREPLY=($(compgen -W "servicedata" -- ${COMP_WORDS[-1]}))
+        return;
+    fi
+    if [ $NUMARGS == 4 ] && [ ${CMPARGS[2]} == 'servicedata' ]; then
+        compopt -o  dirnames
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+         _confluent_nr_completion
+         return
+    fi
+}
+
+_confluent_nodeattrib_completion()
+{
+    COMP_CANDIDATES=$(nodeattrib '~.>1' all | awk '{print $2}'|sed -e 's/://')
+    _confluent_generic_completion
+}
+
+
+_confluent_nn_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS -gt 2 ]; then
+        return;
+    fi
+    INPUT=${COMP_WORDS[-1]}
+    INPUT=${INPUT##*,-}
+    INPUT=${INPUT##*,}
+    INPUT=${INPUT##*@}
+    PREFIX=""
+    if [ "$INPUT" != "${COMP_WORDS[-1]}" ]; then
+        PREFIX=${COMP_WORDS[-1]}
+        PREFIX=$(echo $PREFIX | sed -e 's/,[^,@-]*$/,/' -e 's/,-[^,@]*$/,-/' -e 's/@[^,@]*/@/')
+    fi
+
+    COMPREPLY=($(compgen -W "$(nodelist | sed -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+}
+_confluent_nr_completion()
+{
+    CMPARGS=($COMP_LINE)
+    NUMARGS=${#CMPARGS[@]}
+    if [ "${COMP_WORDS[-1]}" == '' ]; then
+        NUMARGS=$((NUMARGS+1))
+    fi
+    _confluent_get_args
+    if [ $NUMARGS -gt 2 ]; then
+        return;
+    fi
+    INPUT=${COMP_WORDS[-1]}
+    INPUT=${INPUT##*,-}
+    INPUT=${INPUT##*,}
+    INPUT=${INPUT##*@}
+    PREFIX=""
+    if [ "$INPUT" != "${COMP_WORDS[-1]}" ]; then
+        PREFIX=${COMP_WORDS[-1]}
+        PREFIX=$(echo $PREFIX | sed -e 's/,[^,@-]*$/,/' -e 's/,-[^,@]*$/,-/' -e 's/@[^,@]*/@/')
+    fi
+
+    #COMPREPLY=($(compgen -W "$(confetty show /nodegroups|sed -e 's/\///' -e s/^/$PREFIX/;nodelist | sed -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+    COMPREPLY=($(compgen -W "$(confetty show /nodegroups|sed -e 's/\///' -e s/^/$PREFIX/;nodelist | sed -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+}
+_confluent_ng_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS -gt 2 ]; then
+        return;
+    fi
+    INPUT=${COMP_WORDS[-1]}
+    INPUT=${INPUT##*,-}
+    INPUT=${INPUT##*,}
+    INPUT=${INPUT##*@}
+    PREFIX=""
+    if [ "$INPUT" != "${COMP_WORDS[-1]}" ]; then
+        PREFIX=${COMP_WORDS[-1]}
+        PREFIX=$(echo $PREFIX | sed -e 's/,[^,@-]*$/,/' -e 's/,-[^,@]*$/,-/' -e 's/@[^,@]*/@/')
+    fi
+
+    COMPREPLY=($(compgen -W "$(confetty show /nodegroups|sed -e 's/\///' -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+}
+complete -F _confluent_nodeattrib_completion nodeattrib
+complete -F _confluent_nodeattrib_completion nodegroupattrib
+complete -F _confluent_nr_completion nodebmcreset
+complete -F _confluent_nodesetboot_completion nodeboot
+complete -F _confluent_nr_completion nodeconfig
+complete -F _confluent_nn_completion nodeconsole
+complete -F _confluent_nr_completion nodeeventlog
+complete -F _confluent_nodefirmware_completion nodefirmware
+complete -F _confluent_ng_completion nodegroupattrib
+complete -F _confluent_ng_completion nodegroupremove
+complete -F _confluent_nr_completion nodehealth
+complete -F _confluent_nodeidentify_completion nodeidentify
+complete -F _confluent_nr_completion nodeinventory
+complete -F _confluent_nr_completion nodelist
+complete -F _confluent_nodemedia_completion nodemedia
+complete -F _confluent_nodepower_completion nodepower
+complete -F _confluent_nr_completion noderemove
+complete -F _confluent_nr_completion nodereseat
+complete -F _confluent_nodeshell_completion noderun
+complete -F _confluent_nr_completion nodesensors
+complete -F _confluent_nodesetboot_completion nodesetboot
+complete -F _confluent_nodeshell_completion nodeshell
+complete -F _confluent_nodesupport_completion nodesupport
+complete -F _confluent_nodelicense_completion nodelicense
+

confluent_client/doc/man/collate.ronn

@@ -3,13 +3,16 @@ collate(1) -- Organize text input by node
 
 ## SYNOPSIS
 
-`<other command> | collate [-a] [-d] [-w] [-s] [-c] [-r]`
+`<other command> | collate [-a] [-d] [-w] [-s] [-c] [-r] [-l lognametemplate]`
 
 ## DESCRIPTION
 
 **collate** takes input in the form of <nodename>: <data> and groups
-the output for each <nodename> together, and checks for identical data to further group nodes together.  It also will sort the output groups so that
-the most frequently seen output is printed first, and then other groups in descending order of frequency.
+the output for each <nodename> together, and checks for identical data to further group nodes together.
+Output groups are sorted in descending size such that the topmost group is the largest, and the
+last output group is the smallest.  In the event of equally sized output groups,
+the groups are sorted alphanumerically by their header, and each header has
+node and group names sorted alphanumerically.
 
 ## OPTIONS
 
@@ -23,6 +26,10 @@ the most frequently seen output is printed first, and then other groups in desce
    Express all but the most common result group in terms of diff from
    the most common result group
 
+* `-l`, `--log`:
+   Save output per node to individual log files, replacing {node} in the name
+   with the nodename of each
+
 * `-w`, `--watch`:
    Update results dynamically as data becomes available, rather than
    waiting    for the command to fully complete.
@@ -82,4 +89,4 @@ the most frequently seen output is printed first, and then other groups in desce
   `  Processors.ExecuteDisableBit=Enable`  
 
    
-   
+   

confluent_client/doc/man/collective.ronn

@@ -0,0 +1,55 @@
+collective(1) -- Check and manage a confluent collective
+==============================
+
+## SYNOPSIS
+
+`collective invite <server>`  
+`collective join <server> [-i TOKEN]`  
+`collective show`  
+`collective gencert`  
+
+
+## DESCRIPTION
+
+**collective** helps manage the collective mode of confluent, where multiple
+confluent servers are linked together to act as one.  For example, the procedure to set up
+a collective to run on three servers called mgt1, mgt2, and mgt3, first install and start
+confluent as usual on the three servers.  On mgt1, run `collective invite mgt2` and an
+invitation token will be output.  On mgt2, either run `collective join mgt1` to paste
+the token interactively, or `collective join mgt1 -i <token>`.  At this point, either
+mgt1 or mgt2 can bring in mgt3.  For example on mgt2 run `collective invite mgt3` and
+on mgt3 run `collective join mgt2 -i <token>`
+
+This can be linked together in the following manner with ssh:
+on mgt1:
+  `# ssh mgt2 collective join mgt1 -i $(collective invite mgt2)`
+
+Note that a collective is only redundant with 3 or more members.  The collective
+will function so long as more than half of the members are online.  A collective
+of two members is supported, but without redundancy.
+
+Also note that the collective leader role is dynamic, but has no impact on interacting
+with confluent.  It is merely an internal role that can dynamically change depending
+on circumstances.
+
+## OPTIONS
+
+ * `-i`:
+    Provide the token as an argument rather than interactively.
+   
+## EXAMPLES
+ * Inviting a server called mgt2:
+  `# collective invite mgt2`  
+  `bWd0MkA+BNQ6XAxMXlqJJa+EQRlihL/k9xCXnasgSQXZr989Pa1/ln7G3e1Ncxx6BMzMqqreHJVkPr2FrzjNit/UgHlg`  
+
+* On mgt2, joining mgt1:
+  `# collective join mgt1 -i bWd0MkA+BNQ6XAxMXlqJJa+EQRlihL/k9xCXnasgSQXZr989Pa1/ln7G3e1Ncxx6BMzMqqreHJVkPr2FrzjNit/UgHlg`  
+  `Success`  
+
+* Showing the collective state:
+  `# collective show`  
+  `Quorum: True`  
+  `Leader: mgt1`  
+  `Active collective members:`  
+  `  mgt2`  
+

confluent_client/doc/man/nodeattrib.ronn

@@ -3,9 +3,11 @@ nodeattrib(8) -- List or change confluent nodes attributes
 
 ## SYNOPSIS
 
-`nodeattrib [-b] <noderange> [<nodeattribute>...]`  
+`nodeattrib [-b] <noderange> [all|<nodeattribute>...]`
 `nodeattrib <noderange> [<nodeattribute1=value1> <nodeattribute2=value2> ...]`  
 `nodeattrib -c <noderange> <nodeattribute1> <nodeattribute2> ...`  
+`nodeattrib -e <noderange> <nodeattribute1> <nodeattribute2> ...`  
+`nodeattrib -p <noderange> <nodeattribute1> <nodeattribute2> ...`  
 
 ## DESCRIPTION
 
@@ -18,9 +20,19 @@ displayed.  If `-b` is specified, it will also display information on
 how inherited and expression based attributes are defined.  Attributes can be
 straightforward values, or an expression as documented in nodeattribexpressions(5).
 For a full list of attributes, run `nodeattrib <node> all` against a node.
-If `-c` is specified, this will set the nodeattribute to a null valid.
+If `-c` is specified, this will set the nodeattribute to a null value.
 This is different from setting the value to an empty string.
 
+Attributes may be specified by wildcard, for example `net.*switch` will report
+all attributes that begin with `net.` and end with `switch`.
+
+If the word all is specified, then all available attributes are given.
+Omitting any attribute name or the word 'all' will display only attributes
+that are currently set.
+
+For the `groups` attribute, it is possible to add a group by doing
+`groups,=<newgroup>` and to remove by doing `groups^=<oldgroup>`
+
 Note that `nodeattrib <group>` will likely not provide the expected behavior.
 See nodegroupattrib(8) command on how to manage attributes on a group level.
 
@@ -30,6 +42,10 @@ See nodegroupattrib(8) command on how to manage attributes on a group level.
   Annotate inherited and expression based attributes to show their base value.
 * `-c`, `--clear`:
   Clear specified nodeattributes
+* `-e`, `--environment`:
+  Set specified attributes based on exported environment variable of matching name.  Environment variable names may be lower case or all upper case.  Replace . with _ as needed (e.g. info.note may be specified as either $info_note or $INFO_NOTE
+* `-p`, `--prompt`:
+  Request interactive prompting to provide values rather than the command line or environment variables.
 
 ## EXAMPLES
 * Listing matching nodes of a simple noderange:
@@ -75,6 +91,12 @@ See nodegroupattrib(8) command on how to manage attributes on a group level.
     `n1: console.method: `  
     `n2: console.method: `  
 
+* List all switches that a node is described as connected to:
+    `# nodeattrib d1 net.*switch`  
+    `d1: net.mgt.switch: mgtswitch1`  
+    `d1: net.pxe.switch: pxeswitch1`  
+    `d1: net.switch:`  
+
 ## SEE ALSO
 
 nodegroupattrib(8), nodeattribexpressions(5)

confluent_client/doc/man/nodeattribexpressions.ronn

@@ -9,6 +9,18 @@ expression to generate the value.
 An expression will contain some directives wrapped in `{}` characters. Within
 `{}` are a number of potential substitute values and operations.
 
+Note that syntax of expressions can have overlap with the shell syntax.
+For example:
+
+`$ echo (n2)`  
+`-bash: syntax error near unexpected token `n2'`  
+
+In such a case, it helps to quote the expression to allow it to be passed:
+
+`$ echo '(n2)'`  
+`(n2)`  
+
+
 The most common operation is to extract a number from the nodename. These 
 values are available as n1, n2, etc. So for example attributes for a node named 
 b1o2r3u4 would have {n1} as 1, {n2} as 2, {n3} as 3, and {n4} as 4. 
@@ -39,7 +51,7 @@ number of operators at the end to indicate formatting changes.
 
 Another common element to pull into an expression is the node name in whole:
 
-`hardwaremanagement.manager={nodename}-imm`  
+`hardwaremanagement.manager={node}-imm`
 
 Additionally other attributes may be pulled in:
 
@@ -47,7 +59,7 @@ Additionally other attributes may be pulled in:
 
 Multiple expressions are permissible within a single attribute:
 
-`hardwaremanagement.manager={nodename}-{hardwaremanagement.method}`  
+`hardwaremanagement.manager={node}-{hardwaremanagement.method}`
 
 A note to developers: in general the API layer will automatically recognize a
 generic set attribute to string with expression syntax and import it as an

confluent_client/doc/man/nodeboot.ronn

@@ -4,12 +4,44 @@ nodeboot(8) -- Reboot a confluent node to a specific device
 ## SYNOPSIS
 
 `nodeboot <noderange>`  
-`nodeboot <noderange>` [net|setup]  
+`nodeboot [options] <noderange>` [default|cd|network|setup|hd]  
 
 ## DESCRIPTION
 
 **nodeboot** reboots nodes in a noderange.  If an additional argument is given,
-it sets the node to specifically boot to that as the next boot.
+it sets the node to specifically boot to that as the next boot.  This 
+performs an immediate reboot without waiting for the OS.  To set the boot
+device without inducing a reboot, see the `nodesetboot` command.
+
+## OPTIONS
+
+* `-b`, `--bios`:
+  For a system that supports both BIOS and UEFI style boot, request BIOS style
+  boot if supported (some platforms will UEFI boot with this flag anyway).
+
+* `-u`, `--uefi`:
+  This flag does nothing, it is for command compatibility with xCAT's rsetboot
+
+* `-p`, `--persist`:
+  For a system that supports it, mark the boot override to persist rather than
+  be a one time change.  Many systems do not support this functionality.
+
+* `default`:
+  Request a normal default boot with no particular device override
+
+* `cd`:
+  Request boot from media.  Note that this can include physical CD,
+  remote media mounted as CD/DVD, and detachable hard disks drives such as usb
+  key devices.
+  
+* `network`:
+  Request boot to network
+  
+* `setup`:
+  Request to enter the firmware configuration menu (e.g. F1 setup) on next boot.
+
+* `hd`:
+  Boot straight to hard disk drive
 
 ## EXAMPLES
 * Booting n3 and n4 to the default boot behavior:

confluent_client/doc/man/nodeconfig.ronn

@@ -3,8 +3,8 @@ nodeconfig(8) -- Show or change node configuration
 
 ## SYNOPSIS
 
-`nodecanfig <noderange> [<configuration>..]`
-`nodecanfig <noderange> [<configuration=value>..]`
+`nodeconfig <noderange> [options] [<configuration>..]`  
+`nodeconfig <noderange> [options] [<configuration=value>..]`  
 
 ## DESCRIPTION
 
@@ -14,6 +14,31 @@ running configuration on the node firmware.  Calling without '=' will show the
 current value, and '=' will change the value.  Network information can be
 given as a node expression, as documented in the man page for nodeattribexpressions(5).
 
+## OPTIONS
+
+* `-c`, `--comparedefault`:
+  Take the given settings and compare against default value, if available.  If
+  no configuration values are specified, it will show only those that differ.
+  If combined with `-x`, will show all differing values except those indicated
+  by `-x`
+
+* `-x`, `--exclude`:
+  Rather than listing only the specified configuration parameters, list all
+  attributes except for the specified ones
+
+* `-d`, `--detail`:
+  Provide detailed data as available.  This can include help text and valid
+  values for a setting.
+
+* `-r`, `--restoredefault`:
+  Request that the specified component of the targeted nodes will have its
+  configuration reset to default.  Currently the only component implemented
+  is uefi.
+
+* `-b`, '--batch':
+   Provide arguments as lines of a file, rather than the command line.
+
+
 ## EXAMPLES
 * Showing the current IP configuration of noderange BMC/IMM/XCC:
     `# nodeconfig s3,s4 bmc`  

confluent_client/doc/man/nodeconsole.ronn

@@ -2,7 +2,7 @@ nodeconsole(8) -- Open a console to a confluent node
 =====================================================
 
 ## SYNOPSIS
-`nodeconsole <node>`
+`nodeconsole [options] <noderange>`
 
 ## DESCRIPTION
 
@@ -16,6 +16,12 @@ will initiate an automatic retry interval that is randomized between 2 and 4 min
 The reopen escape sequence below requests an immediate retry, as does connecting
 a new session.
 
+## OPTIONS
+
+* `-t`, `--tile`:
+  Use tmux to arrange consoles of the given noderange into a tiled layout on
+  the terminal screen
+
 ## ESCAPE SEQUENCE COMMANDS
 
 While connected to a console, a number of commands may be performed through escape

confluent_client/doc/man/nodedefine.ronn

@@ -1,4 +1,5 @@
 nodedefine(8) -- Define new confluent nodes
+===================================================================
 
 ## SYNOPSIS
 

confluent_client/doc/man/nodediscover.ronn

@@ -5,7 +5,9 @@ nodediscover(8)  -- List or manage confluent node discovery
 
 `nodediscover rescan`  
 `nodediscover [options] list`  
-`nodeattrib [options] assign`  
+`nodediscover [options] assign`
+`nodediscover [options] rescan`
+`nodediscover [options] clear`
 
 ## DESCRIPTION
 
@@ -22,6 +24,14 @@ data may be filtered by various parameters, as denoted in the options below.
 identity or, using `-i`, using a csv file to assign nodes all at once.  For
 example, a spreadsheet of serial numbers to desired node names could be used.
 
+**nodediscover rescan** requests the server to do an active sweep for new
+devices.  Generally every effort is made to passively detect devices as they
+become available (as they boot or are plugged in), however sometimes an active
+scan is the best approach to catch something that appears to be missing.
+
+**nodedsicover clear** requests the server forget about a selection of
+detected device.  It takes the same arguments as **nodediscover list**.
+
 ## CSV FORMAT
 
 The CSV format used by nodediscover consists of one header describing the
@@ -65,12 +75,40 @@ the nodes.
 * `-e MAC`, `--ethaddr=MAC`:
   Operate against the system with the specified MAC
   address
-* `-t TYPE, --type=TYPE`:
+* `-f FIELDS`, `--fields=FIELDS`:
+  Request a custom set of fields.  The available fields are:  
+  Node: The node name if a correlation has been identified  
+  Model: The model number  
+  Serial: The serial number  
+  UUID: The UUID as it should appear in DMI  
+  Type: Device type (e.g. lenovo-xcc, pxe-client, etc)  
+  IP: The confirmed working IP addresses associated with the record  
+  Mac: Mac address of the relevant network interface  
+  Switch: The nearest detected switch to the entry  
+  Port: Port of the switch that most closely connects to the network interface  
+  Advertised IP: IP addresses that may not have been confirmed, but are advertised  
+* `-o ORDER`, `--order=ORDER`:
+  Order output by given field.  Field names are the same as documented in the -f argument.
+* `-t TYPE`, `--type=TYPE`:
   Operate against the system of the specified type
-* `-c, --csv`:
+* `-c`, `--csv`:
   Use CSV formatted output
 * `-i IMPORT.CSV`, `--import=IMPORT.CSV`:
   Import bulk assignment data from given CSV file
+* `-d STATE`, `--discoverystate=STATE`:
+  Indicate devices with a particular state.  The states are listed below
+* discovered: The device has been identified and has also had discovery
+              activities performed, including any relevant certificate
+              exchanges and deploying user and network configuration.
+* identified:  The device has been identified as to what node it is
+               supposed to be, however no active changes to the attributes
+               or device configuration has been performed.  This is
+               generally discovery awaiting approval due to
+               discovery.policy specifying a strict security model.
+* unidentified:  A device has been sensed, but no node identity has been
+                 established at all.  It provides data that can be used
+                 for nodediscover assign, as well as current IP addresses
+                 that can be used for manual efforts as possible.
 
 ## EXAMPLES
 

confluent_client/doc/man/nodefirmware.ronn

@@ -4,12 +4,19 @@ nodefirmware(8) -- Report firmware information on confluent nodes
 ## SYNOPSIS
 
 `nodefirmware <noderange>`  
-`nodefirmware <noderange> update [--backup] <filename>`
+`nodefirmware <noderange> list|<components>|core`  
+`nodefirmware <noderange> update [--backup] <filename>`  
 
 ## DESCRIPTION
 
-`nodefirmware` reports and updates various firmware on nodes.  In the update form, it accepts a single
-file and attempts to update it using the out of band facilities.  Firmware updates can end in one of three states:
+`nodefirmware` reports and updates various firmware on nodes.  By default it
+will retrieve all firmware, but can be directed to fetch specific firmware by
+calling out the name of the firmware (e.g. uefi or xcc) or request reading only
+core firmware firmware by using the word 'core', which is generally a quicker
+operation.
+
+In the update form, it accepts a single file and attempts to update it using
+the out of band facilities.  Firmware updates can end in one of three states:
 
 * `error`: The attempted update encountered an error that prevented successful install.  Nodes experiencing this state will be reported at the end and more detail on the error will be given
 * `pending`:  The firmware update process has completed, but the firmware will not be active until the relevant component next resets.  Generally speaking, for UEFI update the system will need a reboot, and for BMC updates, the `nodebmcreset` command will begin the process to activate the firmware.

confluent_client/doc/man/nodegroupattrib.ronn

@@ -7,6 +7,7 @@ nodegroupattrib(8) -- List or change confluent nodegroup attributes
 `nodegroupattrib <group> [<nodeattribute>...]`  
 `nodegroupattrib <group> [<nodeattribute1=value1> <nodeattribute2=value2> ...]`  
 `nodegroupattrib <group> [-c] [<nodeattribute1> <nodeattribute2=value2> ...]`  
+`nodeattrib -p <noderange> <nodeattribute1> <nodeattribute2> ...`  
 
 ## DESCRIPTION
 

confluent_client/doc/man/nodegroupdefine.ronn

@@ -1,4 +1,5 @@
 nodegroupdefine(8) -- Define new confluent node group
+===================================================================
 
 ## SYNOPSIS
 
@@ -6,7 +7,7 @@ nodegroupdefine(8) -- Define new confluent node group
 
 ## DESCRIPTION
 
-`nodegroupdefine` allows the definition of a new node for the confluent management
+`nodegroupdefine` allows the definition of a new nodegroup for the confluent management
 service.  It may only define a single group name at a time.
 It has the same syntax as `nodegroupattrib(8)`, and the commands differ in
 that `nodegroupattrib(8)` will error if a node group does not exist.

confluent_client/doc/man/nodegrouplist.ronn

@@ -0,0 +1,14 @@
+nodegrouplist(8) -- List the defined confluent nodegroups
+===================================================================
+
+## SYNOPSIS
+
+`nodegrouplist`  
+
+## DESCRIPTION
+
+`nodegrouplist` lists the currently defined groups in confluent.
+
+## SEE ALSO
+
+nodeattrib(8), nodeattribexpressions(5), nodegroupattrib(8)

confluent_client/doc/man/nodelicense.ronn

@@ -0,0 +1,17 @@
+nodelicense(8) -- Manage license keys on BMC
+=================================================================
+
+## SYNOPSIS
+
+`nodelicense <noderange> [list|install <filename>|delete <license>|save <directory>]`
+
+## DESCRIPTION
+
+`nodelicense` manages license keys on supported BMCs. Without an argument, the command
+lists currently installed license.  Using `delete` will remove the specified license name
+from th eBMC.  The `save` subcommand will take the passed directory (which may be in the form
+of /path/to/{node}/ to have the node name substituted for each node) and back up installed licenses
+to that directory. The `install` command will take the specified filename and install.  The filename
+argument may be of the form  xcc_fod_0034_7X21{id.serial}.key to have the serial number substituted
+to allow unique licenses to be specified in a single command.
+

confluent_client/doc/man/nodelist.ronn

@@ -17,6 +17,9 @@ displayed.  If `-b` is specified, it will also display information on
 how inherited and expression based attributes are defined.  There is more
 information on node attributes in nodeattributes(5) man page.
 
+Attributes may be specified by wildcard, for example `net.*switch` will report
+all attributes that begin with `net.` and end with `switch`.
+
 ## OPTIONS
 
 * `-b`, `--blame`:

confluent_client/doc/man/nodemedia.ronn

@@ -0,0 +1,57 @@
+nodemedia(8) -- Manage server remote media
+=========================================================
+
+## SYNOPSIS
+
+`nodemedia <noderange> [attach|detachall|list|upload] [options] <media>`
+
+## DESCRIPTION
+
+**nodemedia** manages the remote media functionality of supported BMCs.
+
+`list` shows all the current remote media the BMCs of the noderange are
+providing to the host platform.  The string (insecure) is appended to URLs that
+are mounted in an insecure fashion.  http is insecure, and https is also
+insecure when no meaningful certificate validation is performed.  Currently
+there is no action that can change this, and this is purely informational.  A
+future version of software may provide a means to increase security of attached
+remote media.  If no media is mounted, this will provide no output, error
+conditions will result in output to standard error.
+
+`detachall` removes all the currently provided media to the host.  This unlinks
+remote media from urls and deletes uploaded media from the BMC.
+
+`upload` takes the given media image and uploads it to the BMC.  This causes
+the remote media to reside internally to the system without having to go
+to the network after the upload.  This is more constrained, for example the
+Lenovo xClarity Controller has a limit of 50 megabytes, but it has zero ongoing
+load on the media source.
+
+`attach` takes a URL to a remote media as an argument, and has the given
+BMCs map a virtual USB device to that url.  Content is loaded on demand, and
+as such that URL is referenced potentially once for every IO operation that
+the host platform attempts.
+
+## OPTIONS
+
+* `-c`:
+  Specify the maximum number of instances to run concurrently.
+
+## EXAMPLES
+* Listing currently mounted media:
+  `# nodemedia s1-s4 list`  
+  `s1: boot.img`  
+  `s2: boot.img`  
+  `s4: boot.img`  
+
+* Uploading a small boot image to the BMC:
+  `# nodemedia s1-s4 upload boot.img`  
+  `s1:complete: 100%     s2:complete: 100%     s3:complete: 100%     s4:complete: 100%`  
+  `s1: boot.img`  
+  `s4: boot.img`  
+  `s2: boot.img`  
+
+* Attaching a larger ISO for on-demand access:
+  `# nodemedia s1,s4 attach http://172.30.0.6/install/rhel74.iso`  
+  `s4: http://172.30.0.6/install/rhel74.iso (insecure)`  
+  `s1: http://172.30.0.6/install/rhel74.iso (insecure)`

confluent_client/doc/man/nodepower.ronn

@@ -4,7 +4,7 @@ nodepower(8) -- Check or change power state of confluent nodes
 ## SYNOPSIS
 
 `nodepower <noderange>`  
-`nodepower <noderange> [on|off|boot|shutdown|reset|status]`
+`nodepower <noderange> [-p] [on|off|boot|shutdown|reset|status]`
 
 ## DESCRIPTION
 
@@ -26,6 +26,11 @@ respond.
 off will not react to this request.
 * `status`:  Behave identically to having no argument passed at all.
 
+## OPTIONS
+
+* `-p`, '--showprevious':
+   Show previous power state for all directives that may change power state.
+
 ## EXAMPLES
 * Get power state of nodes n1 through n4:
   `# nodepower n1-n4`  

confluent_client/doc/man/noderange.ronn

@@ -36,6 +36,9 @@ Also, regular expressions may be used to indicate nodes with names matching cert
 The other major noderange primitive is indicating nodes by some attribute value:
 `location.rack=7`
 
+The attribute name may use a wildcard:
+`net.*switch=switch1`
+
 Commas can be used to indicate multiple nodes, and can mix and match any of the above primitives. The following can be a valid single noderange, combining any and all members of each comma separated component
 `n1,n2,rack1,storage,location.rack=9,~s1..,n20-n30`
 

confluent_client/doc/man/noderun.ronn

@@ -48,6 +48,10 @@ themselves, see nodeshell(8).
   `n4:  01 10 00`  
   `n2:  01 10 00`  
 
+
+* If wanting to use literal {} in the command, they must be escaped by doubling:
+  `# noderun n1-n4 "echo {node} | awk '{{print $1}}'"`
+
 ## SEE ALSO
 
 nodeshell(8)

confluent_client/doc/man/nodesetboot.ronn

@@ -4,7 +4,7 @@ nodesetboot(8) -- Check or set next boot device for noderange
 ## SYNOPSIS
 
 `nodesetboot <noderange>`  
-`nodesetboot [options] <noderang> [default|cd|network|setup|hd]`
+`nodesetboot [options] <noderange> [default|cd|network|setup|hd]`
 
 ## DESCRIPTION
 
@@ -30,7 +30,10 @@ control.
 * `-p`, `--persist`:
   For a system that supports it, mark the boot override to persist rather than
   be a one time change.  Many systems do not support this functionality.
-  
+
+* `-u`, `--uefi`:
+  This flag does nothing, it is for command compatibility with xCAT's rsetboot
+
 * `default`:
   Request a normal default boot with no particular device override
 

confluent_client/doc/man/nodeshell.ronn

@@ -3,7 +3,7 @@ nodeshell(8) -- Execute command on many nodes in a noderange through ssh
 
 ## SYNOPSIS
 
-`nodeshell <noderange> <command to execute on each node>`
+`nodeshell <noderange> [options] <command to execute on each node>`
 
 ## DESCRIPTION
 
@@ -12,6 +12,11 @@ accepts and interpolates confluent attribute expressions as documented in
 nodeattribexpressions(5).  `nodeshell` provides stdout as stdout and stderr
 as stderr, unlike psh which combines all stdout and stderr into stdout.
 
+## OPTIONS
+
+* `-c`:
+  Specify the maximum number of instances to run concurrently.
+
 ## EXAMPLES
 
 * Running `echo hi` on for nodes:
@@ -22,7 +27,10 @@ as stderr, unlike psh which combines all stdout and stderr into stdout.
   `n4: hi`  
 
 * Setting a new static ip address temporarily on secondary interface of four nodes:
-  `# nodeshell n1-n4 ifconfig eth1 172.30.93.{n1}`  
+  `# nodeshell n1-n4 ifconfig eth1 172.30.93.{n1}`
+
+* If wanting to use literal {} in the command, they must be escaped by doubling:
+  `# nodeshell n1-n4 "ps | awk '{{print $1}}'"`
   
 ## SEE ALSO
 

confluent_client/doc/man/nodestorage.ronn

@@ -0,0 +1,65 @@
+nodestorage(8) -- Examine/Modify storage configuration of a node
+============================================
+
+## SYNOPSIS
+
+`nodestorage <noderange> [show|create|delete] [options]`  
+
+## DESCRIPTION
+
+`nodestorage` provides access to the remote storage configuration of
+the noderange.
+
+## OPTIONS
+* `-r` **RAIDLEVEL**, `--raidlevel`=**RAIDLEVEL**:
+  RAID level to use when creating an array
+
+* `-d` **DISKS**, `--disks`=**DISKS**:
+   Comma separated list of disks to use, or the word "rest" to
+   indicate use of all available disks
+
+* `-s` **SIZE**, `--size`=**SIZE**:
+  Comma separated list of sizes to use when creating
+  volumes.  The sizes may be absolute size (e.g. 16gb),
+  percentage (10%) or the word "rest" to use remaining
+  capacity, default behavior is to use all capacity to
+  make a volume
+* `-n` **NAME**, `--name`=**NAME**:
+  Comma separated list of names to use when naming
+  volumes, or selecting a volume for delete.  Default
+  behavior is to use implementation provided default
+
+## EXAMPLES
+
+* Deleting the volume `somedata`:
+    `$ nodestorage d5 delete somedata`  
+    `Deleted: somedata`  
+
+* Creating a raid5 of 4 disks and a volume named `somedata`:
+    `$ nodestorage d5 create -r 5 -d drive0,drive_1,drive_2,drive_3 -n somedata`  
+    `d5: Volume somedata: Size: 1.905 TB`  
+    `d5: Volume somedata: State: Optimal`  
+    `d5: Volume somedata: Array 1-2`  
+
+* Showing current storage configuration of `d3`:
+    `$ nodestorage d3`  
+    `d3: Disk m.2-0 Description: 128GB M.2 SATA SSD`  
+    `d3: Disk m.2-0 State: online`  
+    `d3: Disk m.2-0 FRU: 00LF428`  
+    `d3: Disk m.2-0 Serial Number: H6B80054`  
+    `d3: Disk m.2-0 Array: 0-0`  
+    `d3: Disk m.2-1 Description: 128GB M.2 SATA SSD`  
+    `d3: Disk m.2-1 State: online`  
+    `d3: Disk m.2-1 FRU: 00LF428`  
+    `d3: Disk m.2-1 Serial Number: H6B80059`  
+    `d3: Disk m.2-1 Array: 0-0`  
+    `d3: Array 0-0 Available Capacity: 0.000 MB`  
+    `d3: Array 0-0 Total Capacity: 131.072 GB`  
+    `d3: Array 0-0 RAID: RAID 1`  
+    `d3: Array 0-0 Disks: m.2-0,m.2-1`  
+    `d3: Array 0-0 Volumes: new_vd`  
+    `d3: Volume new_vd: Size: 122.040 GB`  
+    `d3: Volume new_vd: State: Optimal`  
+    `d3: Volume new_vd: Array 0-0`  
+
+

confluent_client/doc/man/nodesupport.ronn

@@ -0,0 +1,29 @@
+nodesupport(8) -- Utilities for interacting with vendor support
+=================================================================
+
+## SYNOPSIS
+
+`nodesupport <noderange> servicedata <directory or filename>`  
+
+## DESCRIPTION
+
+`nodesupport` provides capabilities associated with interactiong with support.
+Currently it only has the `servicedata` subcommand.  `servicedata` takes
+an argument that is either a directory name (that can be used for a single node
+or multiple nodes) or a file name (only to be used with single node noderange).
+Note that the file will be downloaded to the confluent server that actually
+connects to the managed system, so it will download to the remote system if running
+remotely and will download to the collective.manager indicated system if
+running in collective mode.
+
+## EXAMPLES
+
+* Download support data from a single node to a specific filename  
+`# nodesupport d1 servicedata svcdata.out`  
+`d1:initializing:  15%`  
+
+* Download support data from multiple nodes to a directory  
+`# nodesupport d1-d4 servicedata service/`    
+`d1:initializing:   0% d2:initializing:   0% d3:initializing:   0% d4:initializing:   0%`  
+`# ls service/`  
+`d1.svcdata d2.svcdata  d3.svcdata  d4.svcdata`  

confluent_client/samples/nodeattrib_from_switch.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+# This is a sample python script for going through all observed mac addresses
+# and assuming they are BMC related and printing nodeattrib commands
+# for each node to access the bmc using the interface specified on the command
+# line
+
+# Not necessarily as useful if there may be mistakes in the
+# net.switch/net.switchport attributes, but a handy utility in a pinch when
+# you really know
+
+
+import confluent.client as cl
+import socket
+import struct
+c = cl.Command()
+macs = []
+interface = sys.argv[1]
+for mac in c.read('/networking/macs/by-mac/'):
+    macs.append(mac['item']['href'])
+for mac in macs:
+    macinfo = list(c.read('/networking/macs/by-mac/{0}'.format(mac)))[0]
+    if 'possiblenode' in macinfo and macinfo['possiblenode']:
+        if macinfo['macsonport'] > 1:
+            print('#Ambiguous set of macs on port for ' + macinfo[
+                'possiblenode'])
+        prefix = int(mac.replace('-', '')[:6], 16) ^ 0b100000000000000000
+        prefix = prefix << 8
+        prefix |= 0xff
+        suffix = int(mac.replace('-', '')[6:], 16)
+        suffix |= 0xfe000000
+        rawn = struct.pack('!QLL', 0xfe80000000000000, prefix, suffix)
+        bmc = socket.inet_ntop(socket.AF_INET6, rawn)
+        print('nodeattrib {0} bmc={1}%{2}'.format(macinfo['possiblenode'],
+                                                  bmc, interface))

confluent_common/setup.cfg

@@ -1,17 +0,0 @@
-[metadata]
-name = confluent_common
-summary = Confluent Common Libraries
-description-file =
-    README.txt
-author = Jarrod Johnson
-author-email = jjohnson2@lenovo.com
-home-page = http://xcat.sf.net/
-classifier =
-    Intended Audience :: Information Technology
-    Intended Audience :: System Administrators
-    License :: OSI Approved :: Apache Software License
-    Operating System :: POSIX :: Linux
-    Programming Language :: Python :: 2.6
-    Programming Language :: Python :: 2.7
-
-[files]

confluent_server/MANIFEST.in

@@ -1,3 +1,4 @@
+include pam/*
 include sysvinit/*
 include systemd/*
 include sysctl/*

confluent_server/bin/collective

@@ -0,0 +1,122 @@
+#!/usr/bin/env python
+
+import argparse
+import errno
+import os
+import socket
+import subprocess
+import sys
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    # if installed into system path, do not muck with things
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.tlvdata as tlvdata
+
+try:
+    input = raw_input
+except NameError:
+    pass
+
+def make_certificate():
+    umask = os.umask(0077)
+    try:
+        os.makedirs('/etc/confluent/cfg')
+    except OSError as e:
+        if e.errno == errno.EEXIST and os.path.isdir('/etc/confluent/cfg'):
+            pass
+        else:
+            raise
+    if subprocess.check_call(
+            'openssl ecparam -name secp384r1 -genkey -out '
+            '/etc/confluent/privkey.pem'.split(' ')):
+        raise Exception('Error generating private key')
+
+    if subprocess.check_call('openssl req -new -x509 -key '
+                              '/etc/confluent/privkey.pem -days 7300 -out '
+                              '/etc/confluent/srvcert.pem -subj /CN='
+                              '{0}'.format(socket.gethostname()).split(' ')):
+        raise Exception('Error generating certificate')
+    print('Certificate generated successfully')
+    os.umask(umask)
+
+
+def show_invitation(name):
+    if not os.path.exists('/etc/confluent/srvcert.pem'):
+        make_certificate()
+    s = client.Command().connection
+    tlvdata.send(s, {'collective': {'operation': 'invite', 'name': name}})
+    invite = tlvdata.recv(s)['collective']
+    if 'error' in invite:
+        sys.stderr.write(invite['error'] + '\n')
+        return
+    print('{0}'.format(invite['invitation']))
+
+
+def join_collective(server, invitation):
+    if not os.path.exists('/etc/confluent/srvcert.pem'):
+        make_certificate()
+    s = client.Command().connection
+    while not invitation:
+        invitation = raw_input('Paste the invitation here: ')
+    tlvdata.send(s, {'collective': {'operation': 'join',
+                                    'invitation': invitation,
+                                    'server': server}})
+    res = tlvdata.recv(s)
+    res = res.get('collective',
+                  {'status': 'Unknown response: ' + repr(res)})
+    print(res.get('status', res.get('error', repr(res))))
+
+
+def show_collective():
+    s = client.Command().connection
+    tlvdata.send(s, {'collective': {'operation': 'show'}})
+    res = tlvdata.recv(s)
+    if 'error' in res['collective']:
+        print(res['collective']['error'])
+        return
+    if 'quorum' in res['collective']:
+        print('Quorum: {0}'.format(res['collective']['quorum']))
+    print('Leader: {0}'.format(res['collective']['leader']))
+    if 'active' in res['collective']:
+        if res['collective']['active']:
+            print('Active collective members:')
+            for member in res['collective']['active']:
+                print('    {0}'.format(member))
+        if res['collective']['offline']:
+            print('Offline collective members:')
+            for member in res['collective']['offline']:
+                print('    {0}'.format(member))
+    else:
+        print('Run collective show on leader for more data')
+
+def main():
+    a = argparse.ArgumentParser(description='Confluent server utility')
+    sp = a.add_subparsers(dest='command')
+    gc = sp.add_parser('gencert', help='Generate Confluent Certificates for '
+                                'collective mode and remote CLI access')
+    sl = sp.add_parser('show', help='Show information about the collective')
+    ic = sp.add_parser('invite', help='Generate a invitation to allow a new '
+                                    'confluent instance to join as a '
+                                    'collective member.  Run collective invite -h for more information')
+    ic.add_argument('name', help='Name of server to invite to join the '
+                                 'collective')
+    jc = sp.add_parser('join', help='Join a collective.  Run collective join -h for more information')
+    jc.add_argument('server', help='Existing collective member that ran invite and generated a token')
+    jc.add_argument('-i', help='Invitation provided by runniing invite on an '
+                               'existing collective member')
+    cmdset = a.parse_args()
+    if cmdset.command == 'gencert':
+        make_certificate()
+    elif cmdset.command == 'invite':
+        show_invitation(cmdset.name)
+    elif cmdset.command == 'join':
+        join_collective(cmdset.server, cmdset.i)
+    elif cmdset.command == 'show':
+        show_collective()
+
+if __name__ == '__main__':
+    main()

confluent_server/bin/confluentcertutil.py

@@ -0,0 +1,50 @@
+import shutil
+import socket
+import subprocess
+import tempfile
+
+def get_openssl_conf_location():
+    # CentOS/RHAT
+    return '/etc/pki/tls/openssl.cnf'
+
+def get_ip_addresses():
+    lines = subprocess.check_output('ip addr'.split(' '))
+    for line in lines.split('\n'):
+        if line.startswith('    inet6 '):
+            line = line.replace('    inet6 ', '').split('/')[0]
+            if line.startswith('fe80::'):
+                continue
+            if line == '::1':
+                continue
+        elif line.startswith('    inet '):
+            line = line.replace('    inet ', '').split('/')[0]
+            if line == '127.0.0.1':
+                continue
+            if line.startswith('169.254.'):
+                continue
+        else:
+            continue
+        yield line
+
+def create_certificate():
+    shortname = socket.gethostname().split('.')[0]
+    longname = socket.getfqdn()
+    subprocess.check_call(
+        'openssl ecparam -name secp384r1 -genkey -out privkey.pem'.split(' '))
+    san = ['IP:{0}'.format(x) for x in get_ip_addresses()]
+    san.append('DNS:{0}'.format(shortname))
+    san.append('DNS:{0}'.format(longname))
+    san = ','.join(san)
+    sslcfg = get_openssl_conf_location()
+    tmpconfig = tempfile.mktemp()
+    shutil.copy2(sslcfg, tmpconfig)
+    with open(tmpconfig, 'a') as cfgfile:
+        cfgfile.write('\n[SAN]\nsubjectAltName={0}'.format(san))
+    subprocess.check_call(
+        'openssl req -new -x509 -key privkey.pem -days 7300 -out cert.pem '
+        '-subj /CN={0} -extensions SAN '
+        '-config {1}'.format(longname, tmpconfig).split(' ')
+    )
+
+if __name__ == '__main__':
+    create_certificate()

confluent_server/bin/confluentdbutil

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 
+import getpass
 import optparse
 import sys
 import os
@@ -32,6 +33,8 @@ argparser = optparse.OptionParser(
     usage="Usage: %prog [options] [dump|restore] [path]")
 argparser.add_option('-p', '--password',
                      help='Password to use to protect/unlock a protected dump')
+argparser.add_option('-i', '--interactivepassword', help='Prompt for password',
+                     action='store_true')
 argparser.add_option('-r', '--redact', action='store_true',
                      help='Redact potentially sensitive data rather than store')
 argparser.add_option('-u', '--unprotected', action='store_true',
@@ -39,6 +42,14 @@ argparser.add_option('-u', '--unprotected', action='store_true',
                            ' the key information.  Fields will be encrypted, '
                            'but keys.json will contain unencrypted decryption'
                            ' keys that may be used to read the dump')
+argparser.add_option('-s', '--skipkeys', action='store_true',
+                      help='This specifies to dump the encrypted data without '
+                           'dumping the keys needed to decrypt it.  This is '
+                           'suitable for an automated incremental backup, '
+                           'where an earlier password protected dump has a '
+                           'protected keys.json file, and only the protected '
+                           'data is needed.  keys do not change and as such '
+                           'they do not require incremental backup')
 (options, args) = argparser.parse_args()
 if len(args) != 2 or args[0] not in ('dump', 'restore'):
     argparser.print_help()
@@ -51,17 +62,32 @@ if args[0] == 'restore':
     if pid is not None:
         print("Confluent is running, must shut down to restore db")
         sys.exit(1)
-    cfm.restore_db_from_directory(dumpdir, options.password)
+    try:
+        cfm.restore_db_from_directory(dumpdir, options.password)
+    except Exception as e:
+        print(str(e))
+        sys.exit(1)
 elif args[0] == 'dump':
-    if options.password is None and not (options.unprotected or options.redact):
+    password = options.password
+    if not password and options.interactivepassword:
+        passcfm = None
+        while passcfm is None or password != passcfm:
+            password = getpass.getpass(
+                'Enter password to protect the backup: ')
+            passcfm = getpass.getpass('Confirm password to protect the backup: ')
+    if password is None and not (options.unprotected or options.redact
+                                         or options.skipkeys):
         print("Must indicate a password to protect or -u to opt opt of "
-              "secure value protection or -r to skip all protected data")
+              "secure value protection or -r to redact sensitive information, "
+              "or -s to do encrypted backup that requires keys.json from "
+              "another backup to restore.")
         sys.exit(1)
     os.umask(077)
     main._initsecurity(conf.get_config())
     if not os.path.exists(dumpdir):
         os.makedirs(dumpdir)
-    cfm.dump_db_to_directory(dumpdir, options.password, options.redact)
+    cfm.dump_db_to_directory(dumpdir, options.password, options.redact,
+                             options.skipkeys)
 
 
 

confluent_server/bin/createcert.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+umask 0077
+openssl ecparam -name secp384r1 -genkey -out /etc/confluent/privkey.pem
+openssl req -new -x509 -key /etc/confluent/privkey.pem -days 760 -out /etc/confluent/srvcert.pem -subj /CN=$(hostname)

confluent_server/builddeb

@@ -0,0 +1,64 @@
+#!/bin/bash
+cd `dirname $0`
+PKGNAME=$(basename $(pwd))
+DPKGNAME=$(basename $(pwd) | sed -e s/_/-/)
+OPKGNAME=$(basename $(pwd) | sed -e s/_/-/)
+if grep wheezy /etc/os-release; then
+    DPKGNAME=python-$DPKGNAME
+fi
+cd ..
+mkdir -p /tmp/confluent # $DPKGNAME
+cp -a * .git /tmp/confluent # $DPKGNAME
+cd /tmp/confluent/$PKGNAME
+if [ -x ./makeman ]; then
+    ./makeman
+fi
+./makesetup
+VERSION=`cat VERSION`
+cat > setup.cfg << EOF
+[install]
+install-purelib=/opt/confluent/lib/python
+install-scripts=/opt/confluent/bin
+
+[sdist_dsc]
+package=$DPKGNAME
+EOF
+
+python setup.py sdist > /dev/null 2>&1
+py2dsc dist/*.tar.gz
+shopt -s extglob
+cd deb_dist/!(*.orig)/
+if [ "$OPKGNAME" = "confluent-server" ]; then
+    if grep wheezy /etc/os-release; then
+        sed -i 's/^\(Depends:.*\)/\1, python-confluent-client, python-lxml, python-eficompressor, python-pycryptodomex/' debian/control
+    else
+        sed -i 's/^\(Depends:.*\)/\1, confluent-client, python-lxml, python-eficompressor, python-pycryptodome, python-dateutil/' debian/control
+    fi
+    if grep wheezy /etc/os-release; then
+        echo 'confluent_client python-confluent-client' >> debian/pydist-overrides
+    else
+        echo 'confluent_client confluent-client' >> debian/pydist-overrides
+    fi
+fi
+head -n -1 debian/control > debian/control1
+mv debian/control1 debian/control
+echo 'export PYBUILD_INSTALL_ARGS=--install-lib=/opt/confluent/lib/python' >> debian/rules
+#echo 'Provides: python-'$DPKGNAME >> debian/control
+#echo 'Conflicts: python-'$DPKGNAME >> debian/control
+#echo 'Replaces: python-'$DPKGNAME' (<<2)' >> debian/control
+#echo 'Breaks: python-'$DPKGNAME' (<<2)' >> debian/control
+
+dpkg-buildpackage -rfakeroot -uc  -us -i
+if [ $? -ne 0 ]; then
+    echo "[ERROR] rpmbuild returned non-zero, run: rpmbuild -ba ~/rpmbuild/SPECS/$PKGNAME.spec"
+    exit 1
+else
+    cd -
+    # Clean up the generated files in this directory
+    rm -rf $PKGNAME.egg-info dist setup.py
+    rm -rf $(find deb_dist -mindepth 1 -maxdepth 1 -type d)
+    if [ ! -z "$1" ]; then
+        mv deb_dist/* $1/
+    fi
+fi
+exit 0

confluent_server/confluent/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.5.0.dev395.ggacb3a20"

confluent_server/confluent/asynchttp.py

@@ -1,6 +1,6 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
-# Copyright 2016 Lenovo
+# Copyright 2016-2018 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -83,6 +83,8 @@ class AsyncSession(object):
         self.reaper = eventlet.spawn_after(15, self.destroy)
 
     def add(self, requestid, rsp):
+        if self.responses is None:
+            return
         self.responses.append((requestid, rsp))
         if self._evt:
             self._evt.send()
@@ -107,6 +109,7 @@ class AsyncSession(object):
         for console in self.consoles:
             _consolesessions[console]['session'].destroy()
         self.consoles = None
+        self.responses = None
         del _asyncsessions[self.asyncid]
 
     def run_handler(self, handler, requestid):
@@ -166,6 +169,9 @@ def handle_async(env, querydict, threadset):
         currsess = AsyncSession()
         yield messages.AsyncSession(currsess.asyncid)
         return
+    if  querydict['asyncid'] not in _asyncsessions:
+        raise exc.InvalidArgumentException(
+                'Invalid or expired async id')
     mythreadid = greenlet.getcurrent()
     threadset.add(mythreadid)
     loggedout = None

confluent_server/confluent/auth.py

@@ -22,10 +22,12 @@
 import confluent.config.configmanager as configmanager
 import eventlet
 import eventlet.tpool
-import Crypto.Protocol.KDF as KDF
+import Cryptodome.Protocol.KDF as KDF
+from fnmatch import fnmatch
 import hashlib
 import hmac
 import multiprocessing
+import confluent.userutil as userutil
 try:
     import PAM
 except ImportError:
@@ -39,7 +41,59 @@ _passchecking = {}
 authworkers = None
 authcleaner = None
 
+_allowedbyrole = {
+    'Operator': {
+        'retrieve': ['*'],
+        'create': [
+            '/noderange/',
+            '/nodes/',
+            '/node*/media/uploads/',
+            '/node*/inventory/firmware/updates/*',
+            '/node*/suppport/servicedata*',
+            '/node*/attributes/expression',
+            '/nodes/*/console/session*',
+            '/nodes/*/shell/sessions*',
+            '/node*/configuration/*',
+        ],
+        'update': [
+            '/discovery/*', 
+            '/networking/macs/rescan',
+            '/node*/power/state', 
+            '/node*/power/reseat',
+            '/node*/attributes/*',
+            '/node*/media/*tach',
+            '/node*/boot/nextdevice',
+            '/node*/identify',
+            '/node*/configuration/*',
+        ],
+        'start': [
+            '/nodes/*/console/session*',
+            '/nodes/*/shell/sessions*',
+        ],
+        'delete': [
+            '/discovery/*',
+            '/node*',
+        ],
+    },
+    'Monitor': {
+        'retrieve': [
+            '/node*/health/hardware',
+            '/node*/power/state',
+            '/node*/sensors/*',
+            '/nodes/',
+            '/',
+        ],
+    }
+}
 
+_deniedbyrole = {
+    # This supersedes the above and is only consulted after the allowed has happened
+    'Operator': {
+        'update': [
+            '/node*/configuration/management_controller/users/*',
+        ]
+    }
+}
 class Credentials(object):
     def __init__(self, username, passphrase):
         self.username = username
@@ -112,21 +166,37 @@ def authorize(name, element, tenant=False, operation='create',
             and the relevant ConfigManager object for the context of the
             request.
     """
-    if operation not in ('create', 'start', 'update', 'retrieve', 'delete'):
-        return None
+    # skipuserobj is a leftover from the now abandoned plan to use pam session
+    # to do authorization and authentication.  Now confluent always does authorization
+    # even if pam does authentication.
+    if operation not in ('create', 'start', 'update', 'retrieve', 'delete', None):
+        return False
     user, tenant = _get_usertenant(name, tenant)
     if tenant is not None and not configmanager.is_tenant(tenant):
-        return None
+        return False
     manager = configmanager.ConfigManager(tenant, username=user)
-    if skipuserobj:
-        return None, manager, user, tenant, skipuserobj
     userobj = manager.get_user(user)
+    if not userobj:
+        for group in userutil.grouplist(user):
+            userobj = manager.get_usergroup(group)
+            if userobj:
+                break
     if userobj:  # returning
+        role = userobj.get('role', 'Administrator')
+        if element and role != 'Administrator':
+            for rule in _allowedbyrole.get(role, {}).get(operation, []):
+                if fnmatch(element, rule):
+                    break
+            else:
+                return False
+            for rule in _deniedbyrole.get(role, {}).get(operation, []):
+                if fnmatch(element, rule):
+                    return False
         return userobj, manager, user, tenant, skipuserobj
-    return None
+    return False
 
 
-def check_user_passphrase(name, passphrase, element=None, tenant=False):
+def check_user_passphrase(name, passphrase, operation=None, element=None, tenant=False):
     """Check a a login name and passphrase for authenticity and authorization
 
     The function combines authentication and authorization into one function.
@@ -158,59 +228,70 @@ def check_user_passphrase(name, passphrase, element=None, tenant=False):
         # but here there's no need for that
         eventlet.sleep(0.5)
     credobj = Credentials(user, passphrase)
-    try:
-        pammy = PAM.pam()
-        pammy.start(_pamservice, user, credobj.pam_conv)
-        pammy.authenticate()
-        pammy.acct_mgmt()
-        del pammy
-        return authorize(user, element, tenant, skipuserobj=False)
-    except NameError:
-        pass
-    except PAM.error:
-        if credobj.haspam:
-            return None
+    cfm = configmanager.ConfigManager(tenant, username=user)
+    ucfg = cfm.get_user(user)
+    if ucfg is None:
+        try:
+            for group in userutil.grouplist(user):
+                ucfg = cfm.get_usergroup(group)
+                if ucfg:
+                    break
+        except KeyError:
+            pass
+    if ucfg is None:
+        eventlet.sleep(0.05)
+        return None
     if (user, tenant) in _passcache:
-        if passphrase == _passcache[(user, tenant)]:
-            return authorize(user, element, tenant)
+        if hashlib.sha256(passphrase).digest() == _passcache[(user, tenant)]:
+            return authorize(user, element, tenant, operation=operation)
         else:
             # In case of someone trying to guess,
             # while someone is legitimately logged in
             # invalidate cache and force the slower check
             del _passcache[(user, tenant)]
             return None
-    cfm = configmanager.ConfigManager(tenant, username=user)
-    ucfg = cfm.get_user(user)
-    if ucfg is None or 'cryptpass' not in ucfg:
-        eventlet.sleep(0.05)  # stall even on test for existence of a username
-        return None
-    _passchecking[(user, tenant)] = True
-    # TODO(jbjohnso): WORKERPOOL
-    # PBKDF2 is, by design, cpu intensive
-    # throw it at the worker pool when implemented
-    # maybe a distinct worker pool, wondering about starving out non-auth stuff
-    salt, crypt = ucfg['cryptpass']
-    # execute inside tpool to get greenthreads to give it a special thread
-    # world
-    #TODO(jbjohnso): util function to generically offload a call
-    #such a beast could be passed into pyghmi as a way for pyghmi to
-    #magically get offload of the crypto functions without having
-    #to explicitly get into the eventlet tpool game
-    global authworkers
-    global authcleaner
-    if authworkers is None:
-        authworkers = multiprocessing.Pool(processes=1)
-    else:
-        authcleaner.cancel()
-    authcleaner = eventlet.spawn_after(30, _clean_authworkers)
-    crypted = eventlet.tpool.execute(_do_pbkdf, passphrase, salt)
-    del _passchecking[(user, tenant)]
-    eventlet.sleep(0.05)  # either way, we want to stall so that client can't
+    if 'cryptpass' in ucfg:
+        _passchecking[(user, tenant)] = True
+        # TODO(jbjohnso): WORKERPOOL
+        # PBKDF2 is, by design, cpu intensive
+        # throw it at the worker pool when implemented
+        # maybe a distinct worker pool, wondering about starving out non-auth stuff
+        salt, crypt = ucfg['cryptpass']
+        # execute inside tpool to get greenthreads to give it a special thread
+        # world
+        # TODO(jbjohnso): util function to generically offload a call
+        # such a beast could be passed into pyghmi as a way for pyghmi to
+        # magically get offload of the crypto functions without having
+        # to explicitly get into the eventlet tpool game
+        global authworkers
+        global authcleaner
+        if authworkers is None:
+            authworkers = multiprocessing.Pool(processes=1)
+        else:
+            authcleaner.cancel()
+        authcleaner = eventlet.spawn_after(30, _clean_authworkers)
+        crypted = eventlet.tpool.execute(_do_pbkdf, passphrase, salt)
+        del _passchecking[(user, tenant)]
+        eventlet.sleep(
+            0.05)  # either way, we want to stall so that client can't
         # determine failure because there is a delay, valid response will
         # delay as well
-    if crypt == crypted:
-        _passcache[(user, tenant)] = passphrase
-        return authorize(user, element, tenant)
+        if crypt == crypted:
+            _passcache[(user, tenant)] = hashlib.sha256(passphrase).digest()
+            return authorize(user, element, tenant, operation)
+    try:
+        pammy = PAM.pam()
+        pammy.start(_pamservice, user, credobj.pam_conv)
+        pammy.authenticate()
+        pammy.acct_mgmt()
+        del pammy
+        _passcache[(user, tenant)] = hashlib.sha256(passphrase).digest()
+        return authorize(user, element, tenant, operation, skipuserobj=False)
+    except NameError:
+        pass
+    except PAM.error:
+        pass
+    eventlet.sleep(0.05)  # stall even on test for existence of a username
     return None
 
 

confluent_server/confluent/collective/invites.py

@@ -0,0 +1,60 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This handles the process of generating and tracking/validating invites
+
+import base64
+import hashlib
+import hmac
+import os
+pending_invites = {}
+
+def create_server_invitation(servername):
+    servername = servername.encode('utf-8')
+    randbytes = (3 - ((len(servername) + 2) % 3)) % 3 + 64
+    invitation = os.urandom(randbytes)
+    pending_invites[servername] = invitation
+    return base64.b64encode(servername + b'@' + invitation)
+
+def create_client_proof(invitation, mycert, peercert):
+    return hmac.new(invitation, peercert + mycert, hashlib.sha256).digest()
+
+def check_server_proof(invitation, mycert, peercert, proof):
+    validproof = hmac.new(invitation, mycert + peercert, hashlib.sha256
+                          ).digest()
+    return proof == validproof
+
+def check_client_proof(servername, mycert, peercert, proof):
+    servername = servername.encode('utf-8')
+    if servername not in pending_invites:
+        return False
+    invitation = pending_invites[servername]
+    validproof = hmac.new(invitation, mycert + peercert, hashlib.sha256
+                          ).digest()
+    if proof == validproof:
+        # We know that the client knew the secret, and that it measured our
+        # certificate, and thus calling code can bless the certificate, and
+        # we can forget the invitation
+        del pending_invites[servername]
+        # We now want to prove to the client that we also know the secret,
+        # and that we measured their certificate well
+        # Now to generate an answer...., reverse the cert order so our answer
+        # is different, but still proving things
+        return hmac.new(invitation, peercert + mycert, hashlib.sha256
+                          ).digest()
+    # The given proof did not verify the invitation
+    return False
+

confluent_server/confluent/collective/manager.py

@@ -0,0 +1,590 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import base64
+import confluent.collective.invites as invites
+import confluent.config.configmanager as cfm
+import confluent.exceptions as exc
+import confluent.log as log
+import confluent.tlvdata as tlvdata
+import confluent.util as util
+import eventlet
+import eventlet.green.socket as socket
+import eventlet.green.ssl as ssl
+import eventlet.green.threading as threading
+import greenlet
+import random
+try:
+    import OpenSSL.crypto as crypto
+except ImportError:
+    # while not always required, we use pyopenssl required for at least
+    # collective
+    crypto = None
+
+currentleader = None
+follower = None
+retrythread = None
+
+class ContextBool(object):
+    def __init__(self):
+        self.active = False
+        self.mylock = threading.RLock()
+
+    def __enter__(self):
+        self.active = True
+        self.mylock.__enter__()
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.active = False
+        self.mylock.__exit__(exc_type, exc_val, exc_tb)
+
+connecting = ContextBool()
+leader_init = ContextBool()
+
+def connect_to_leader(cert=None, name=None, leader=None):
+    global currentleader
+    global follower
+    if leader is None:
+        leader = currentleader
+    log.log({'info': 'Attempting connection to leader {0}'.format(leader),
+             'subsystem': 'collective'})
+    try:
+        remote = connect_to_collective(cert, leader)
+    except socket.error as e:
+        log.log({'error': 'Collective connection attempt to {0} failed: {1}'
+                          ''.format(leader, str(e)),
+                 'subsystem': 'collective'})
+        return False
+    with connecting:
+        with cfm._initlock:
+            tlvdata.recv(remote)  # the banner
+            tlvdata.recv(remote)  # authpassed... 0..
+            if name is None:
+                name = get_myname()
+            tlvdata.send(remote, {'collective': {'operation': 'connect',
+                                                 'name': name,
+                                                 'txcount': cfm._txcount}})
+            keydata = tlvdata.recv(remote)
+            if not keydata:
+                return False
+            if 'error' in keydata:
+                if 'backoff' in keydata:
+                    log.log({
+                        'info': 'Collective initialization in progress on '
+                                '{0}'.format(leader),
+                        'subsystem': 'collective'})
+                    return False
+                if 'leader' in keydata:
+                    log.log(
+                        {'info': 'Prospective leader {0} has redirected this '
+                                 'member to {1}'.format(leader, keydata['leader']),
+                         'subsystem': 'collective'})
+                    ldrc = cfm.get_collective_member_by_address(
+                        keydata['leader'])
+                    if ldrc and ldrc['name'] == name:
+                        raise Exception("Redirected to self")
+                    return connect_to_leader(name=name,
+                                             leader=keydata['leader'])
+                if 'txcount' in keydata:
+                    log.log({'info':
+                                 'Prospective leader {0} has inferior '
+                                 'transaction count, becoming leader'
+                                 ''.format(leader), 'subsystem': 'collective',
+                             'subsystem': 'collective'})
+                    return become_leader(remote)
+                return False
+                follower.kill()
+                cfm.stop_following()
+                follower = None
+            if follower:
+                follower.kill()
+                cfm.stop_following()
+                follower = None
+            log.log({'info': 'Following leader {0}'.format(leader),
+                     'subsystem': 'collective'})
+            colldata = tlvdata.recv(remote)
+            globaldata = tlvdata.recv(remote)
+            dbi = tlvdata.recv(remote)
+            dbsize = dbi['dbsize']
+            dbjson = ''
+            while (len(dbjson) < dbsize):
+                ndata = remote.recv(dbsize - len(dbjson))
+                if not ndata:
+                    try:
+                        remote.close()
+                    except Exception:
+                        pass
+                    raise Exception("Error doing initial DB transfer")
+                dbjson += ndata
+            cfm.clear_configuration()
+            try:
+                cfm._restore_keys(keydata, None, sync=False)
+                for c in colldata:
+                    cfm._true_add_collective_member(c, colldata[c]['address'],
+                                                    colldata[c]['fingerprint'],
+                                                    sync=False)
+                for globvar in globaldata:
+                    cfm.set_global(globvar, globaldata[globvar], False)
+                cfm._txcount = dbi.get('txcount', 0)
+                cfm.ConfigManager(tenant=None)._load_from_json(dbjson,
+                                                               sync=False)
+                cfm.commit_clear()
+            except Exception:
+                cfm.stop_following()
+                cfm.rollback_clear()
+                raise
+            currentleader = leader
+        #spawn this as a thread...
+        follower = eventlet.spawn(follow_leader, remote)
+    return True
+
+
+def follow_leader(remote):
+    global currentleader
+    cleanexit = False
+    try:
+        cfm.follow_channel(remote)
+    except greenlet.GreenletExit:
+        cleanexit = True
+    finally:
+        if cleanexit:
+            log.log({'info': 'Previous following cleanly closed',
+                     'subsystem': 'collective'})
+            return
+        log.log({'info': 'Current leader has disappeared, restarting '
+                         'collective membership', 'subsystem': 'collective'})
+        # The leader has folded, time to startup again...
+        cfm.stop_following()
+        currentleader = None
+        eventlet.spawn_n(start_collective)
+
+
+def connect_to_collective(cert, member):
+    remote = socket.create_connection((member, 13001))
+    # TLS cert validation is custom and will not pass normal CA vetting
+    # to override completely in the right place requires enormous effort, so just defer until after connect
+    remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE, keyfile='/etc/confluent/privkey.pem',
+                             certfile='/etc/confluent/srvcert.pem')
+    if cert:
+        fprint = cert
+    else:
+        collent = cfm.get_collective_member_by_address(member)
+        fprint = collent['fingerprint']
+    if not util.cert_matches(fprint, remote.getpeercert(binary_form=True)):
+        # probably Janeway up to something
+        raise Exception("Certificate mismatch in the collective")
+    return remote
+
+
+def get_myname():
+    try:
+        with open('/etc/confluent/cfg/myname', 'r') as f:
+            return f.read().strip()
+    except IOError:
+        myname = socket.gethostname()
+        with open('/etc/confluent/cfg/myname', 'w') as f:
+            f.write(myname)
+        return myname
+
+def handle_connection(connection, cert, request, local=False):
+    global currentleader
+    global retrythread
+    operation = request['operation']
+    if cert:
+        cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    else:
+        if not local:
+            return
+
+        if 'show' == operation:
+            if not list(cfm.list_collective()):
+                tlvdata.send(connection,
+                             {'collective': {'error': 'Collective mode not '
+                                                      'enabled on this '
+                                                      'system'}})
+                return
+            if follower:
+                linfo = cfm.get_collective_member_by_address(currentleader)
+                remote = socket.create_connection((currentleader, 13001))
+                remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                         keyfile='/etc/confluent/privkey.pem',
+                                         certfile='/etc/confluent/srvcert.pem')
+                cert = remote.getpeercert(binary_form=True)
+                if not (linfo and util.cert_matches(
+                        linfo['fingerprint'],
+                        cert)):
+                    remote.close()
+                    tlvdata.send(connection,
+                                 {'error': 'Invalid certificate, '
+                                           'redo invitation process'})
+                    connection.close()
+                    return
+                tlvdata.recv(remote)  # ignore banner
+                tlvdata.recv(remote)  # ignore authpassed: 0
+                tlvdata.send(remote,
+                             {'collective': {'operation': 'getinfo',
+                                             'name': get_myname()}})
+                collinfo = tlvdata.recv(remote)
+            else:
+                collinfo = {}
+                populate_collinfo(collinfo)
+            try:
+                cfm.check_quorum()
+                collinfo['quorum'] = True
+            except exc.DegradedCollective:
+                collinfo['quorum'] = False
+            tlvdata.send(connection, {'collective':  collinfo})
+            return
+        if 'invite' == operation:
+            try:
+                cfm.check_quorum()
+            except exc.DegradedCollective:
+                tlvdata.send(connection,
+                    {'collective':
+                         {'error': 'Collective does not have quorum'}})
+                return
+            #TODO(jjohnson2): Cannot do the invitation if not the head node, the certificate hand-carrying
+            #can't work in such a case.
+            name = request['name']
+            invitation = invites.create_server_invitation(name)
+            tlvdata.send(connection,
+                         {'collective': {'invitation': invitation}})
+            connection.close()
+        if 'join' == operation:
+            invitation = request['invitation']
+            try:
+                invitation = base64.b64decode(invitation)
+                name, invitation = invitation.split('@', 1)
+            except Exception:
+                tlvdata.send(
+                    connection,
+                    {'collective':
+                         {'status': 'Invalid token format'}})
+                connection.close()
+                return
+            host = request['server']
+            try:
+                remote = socket.create_connection((host, 13001))
+                # This isn't what it looks like.  We do CERT_NONE to disable
+                # openssl verification, but then use the invitation as a
+                # shared secret to validate the certs as part of the join
+                # operation
+                remote = ssl.wrap_socket(remote,  cert_reqs=ssl.CERT_NONE,
+                                         keyfile='/etc/confluent/privkey.pem',
+                                         certfile='/etc/confluent/srvcert.pem')
+            except Exception:
+                tlvdata.send(
+                    connection,
+                    {'collective':
+                         {'status': 'Failed to connect to {0}'.format(host)}})
+                connection.close()
+                return
+            mycert = util.get_certificate_from_file(
+                '/etc/confluent/srvcert.pem')
+            cert = remote.getpeercert(binary_form=True)
+            proof = base64.b64encode(invites.create_client_proof(
+                invitation, mycert, cert))
+            tlvdata.recv(remote)  # ignore banner
+            tlvdata.recv(remote)  # ignore authpassed: 0
+            tlvdata.send(remote, {'collective': {'operation': 'enroll',
+                                                 'name': name, 'hmac': proof}})
+            rsp = tlvdata.recv(remote)
+            if 'error' in rsp:
+                tlvdata.send(connection, {'collective':
+                                              {'status': rsp['error']}})
+                connection.close()
+                return
+            proof = rsp['collective']['approval']
+            proof = base64.b64decode(proof)
+            j = invites.check_server_proof(invitation, mycert, cert, proof)
+            if not j:
+                remote.close()
+                tlvdata.send(connection, {'collective':
+                                              {'status': 'Bad server token'}})
+                connection.close()
+                return
+            tlvdata.send(connection, {'collective': {'status': 'Success'}})
+            connection.close()
+            currentleader = rsp['collective']['leader']
+            f = open('/etc/confluent/cfg/myname', 'w')
+            f.write(name)
+            f.close()
+            log.log({'info': 'Connecting to collective due to join',
+                     'subsystem': 'collective'})
+            eventlet.spawn_n(connect_to_leader, rsp['collective'][
+                'fingerprint'], name)
+    if 'enroll' == operation:
+        #TODO(jjohnson2): error appropriately when asked to enroll, but the master is elsewhere
+        mycert = util.get_certificate_from_file('/etc/confluent/srvcert.pem')
+        proof = base64.b64decode(request['hmac'])
+        myrsp = invites.check_client_proof(request['name'], mycert,
+                                           cert, proof)
+        if not myrsp:
+            tlvdata.send(connection, {'error': 'Invalid token'})
+            connection.close()
+            return
+        myrsp = base64.b64encode(myrsp)
+        fprint = util.get_fingerprint(cert)
+        myfprint = util.get_fingerprint(mycert)
+        cfm.add_collective_member(get_myname(),
+                                  connection.getsockname()[0], myfprint)
+        cfm.add_collective_member(request['name'],
+                                  connection.getpeername()[0], fprint)
+        myleader = get_leader(connection)
+        ldrfprint = cfm.get_collective_member_by_address(
+            myleader)['fingerprint']
+        tlvdata.send(connection,
+                     {'collective': {'approval': myrsp,
+                                     'fingerprint': ldrfprint,
+                                     'leader': get_leader(connection)}})
+    if 'assimilate' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not droneinfo:
+            tlvdata.send(connection,
+                         {'error': 'Unrecognized leader, '
+                                   'redo invitation process'})
+            return
+        if not util.cert_matches(droneinfo['fingerprint'], cert):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            return
+        if request['txcount'] < cfm._txcount:
+            tlvdata.send(connection,
+                         {'error': 'Refusing to be assimilated by inferior'
+                                   'transaction count',
+                          'txcount': cfm._txcount,})
+            return
+        if connecting.active:
+            # don't try to connect while actively already trying to connect
+            tlvdata.send(connection, {'status': 0})
+            connection.close()
+            return
+        if (currentleader == connection.getpeername()[0] and
+                follower and follower.isAlive()):
+            # if we are happily following this leader already, don't stir
+            # the pot
+            tlvdata.send(connection, {'status': 0})
+            connection.close()
+            return
+        log.log({'info': 'Connecting in response to assimilation',
+                 'subsystem': 'collective'})
+        eventlet.spawn_n(connect_to_leader, None, None,
+                         leader=connection.getpeername()[0])
+        tlvdata.send(connection, {'status': 0})
+        connection.close()
+    if 'getinfo' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
+                                                cert)):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            connection.close()
+            return
+        collinfo = {}
+        populate_collinfo(collinfo)
+        tlvdata.send(connection, collinfo)
+    if 'connect' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
+                                                cert)):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            connection.close()
+            return
+        myself = connection.getsockname()[0]
+        if connecting.active:
+            tlvdata.send(connection, {'error': 'Connecting right now',
+                                      'backoff': True})
+            connection.close()
+            return
+        if myself != get_leader(connection):
+            tlvdata.send(
+                connection,
+                {'error': 'Cannot assimilate, our leader is '
+                          'in another castle', 'leader': currentleader})
+            connection.close()
+            return
+        if request['txcount'] > cfm._txcount:
+            retire_as_leader()
+            tlvdata.send(connection,
+                         {'error': 'Client has higher tranasaction count, '
+                                   'should assimilate me, connecting..',
+                          'txcount': cfm._txcount})
+            log.log({'info': 'Connecting to leader due to superior '
+                             'transaction count', 'subsystem': collective})
+            eventlet.spawn_n(connect_to_leader, None, None,
+                             connection.getpeername()[0])
+            connection.close()
+            return
+        if retrythread:
+            retrythread.cancel()
+            retrythread = None
+        with leader_init:
+            cfm.update_collective_address(request['name'],
+                                          connection.getpeername()[0])
+            tlvdata.send(connection, cfm._dump_keys(None, False))
+            tlvdata.send(connection, cfm._cfgstore['collective'])
+            tlvdata.send(connection, cfm.get_globals())
+            cfgdata = cfm.ConfigManager(None)._dump_to_json()
+            tlvdata.send(connection, {'txcount': cfm._txcount,
+                                      'dbsize': len(cfgdata)})
+            connection.sendall(cfgdata)
+        #tlvdata.send(connection, {'tenants': 0}) # skip the tenants for now,
+        # so far unused anyway
+        if not cfm.relay_slaved_requests(drone, connection):
+            if not retrythread:  # start a recovery if everyone else seems
+                # to have disappeared
+                retrythread = eventlet.spawn_after(30 + random.random(),
+                                                   start_collective)
+        # ok, we have a connecting member whose certificate checks out
+        # He needs to bootstrap his configuration and subscribe it to updates
+
+
+def populate_collinfo(collinfo):
+    iam = get_myname()
+    collinfo['leader'] = iam
+    collinfo['active'] = list(cfm.cfgstreams)
+    activemembers = set(cfm.cfgstreams)
+    activemembers.add(iam)
+    collinfo['offline'] = []
+    for member in cfm.list_collective():
+        if member not in activemembers:
+            collinfo['offline'].append(member)
+
+
+def try_assimilate(drone):
+    try:
+        remote = connect_to_collective(None, drone)
+    except socket.error:
+        # Oh well, unable to connect, hopefully the rest will be
+        # in order
+        return
+    tlvdata.send(remote, {'collective': {'operation': 'assimilate',
+                                         'name': get_myname(),
+                                         'txcount': cfm._txcount}})
+    tlvdata.recv(remote)  # the banner
+    tlvdata.recv(remote)  # authpassed... 0..
+    answer = tlvdata.recv(remote)
+    if not answer:
+        log.log(
+            {'error':
+                 'No answer from {0} while trying to assimilate'.format(
+                     drone),
+            'subsystem': 'collective'})
+        return
+    if 'txcount' in answer:
+        log.log({'info': 'Deferring to {0} due to transaction count'.format(
+            drone), 'subsystem': 'collective'})
+        connect_to_leader(None, None, leader=remote.getpeername()[0])
+        return
+    if 'error' in answer:
+        log.log({
+            'error': 'Error encountered while attempting to '
+                     'assimilate {0}: {1}'.format(drone, answer['error']),
+            'subsystem': 'collective'})
+        return
+    log.log({'info': 'Assimilated {0} into collective'.format(drone),
+             'subsystem': 'collective'})
+
+
+def get_leader(connection):
+    if currentleader is None or connection.getpeername()[0] == currentleader:
+        if currentleader is None:
+            msg = 'Becoming leader as no leader known'
+        else:
+            msg = 'Becoming leader because {0} attempted to connect and it ' \
+                  'is current leader'.format(currentleader)
+        log.log({'info': msg, 'subsystem': 'collective'})
+        become_leader(connection)
+    return currentleader
+
+def retire_as_leader():
+    global currentleader
+    cfm.stop_leading()
+    currentleader = None
+
+def become_leader(connection):
+    global currentleader
+    global follower
+    global retrythread
+    log.log({'info': 'Becoming leader of collective',
+             'subsystem': 'collective'})
+    if follower:
+        follower.kill()
+        cfm.stop_following()
+        follower = None
+    if retrythread:
+        retrythread.cancel()
+        retrythread = None
+    currentleader = connection.getsockname()[0]
+    skipaddr = connection.getpeername()[0]
+    myname = get_myname()
+    skipem = set(cfm.cfgstreams)
+    skipem.add(currentleader)
+    skipem.add(skipaddr)
+    for member in cfm.list_collective():
+        dronecandidate = cfm.get_collective_member(member)['address']
+        if dronecandidate in skipem or member == myname:
+            continue
+        eventlet.spawn_n(try_assimilate, dronecandidate)
+
+
+def startup():
+    members = list(cfm.list_collective())
+    if len(members) < 2:
+        # Not in collective mode, return
+        return
+    eventlet.spawn_n(start_collective)
+
+def start_collective():
+    global follower
+    global retrythread
+    if follower:
+        follower.kill()
+        cfm.stop_following()
+        follower = None
+    try:
+        if cfm.cfgstreams:
+            cfm.check_quorum()
+            # Do not start if we have quorum and are leader
+            return
+    except exc.DegradedCollective:
+        pass
+    if leader_init.active:  # do not start trying to connect if we are
+        # xmitting data to a follower
+        return
+    myname = get_myname()
+    for member in sorted(list(cfm.list_collective())):
+        if member == myname:
+            continue
+        if cfm.cfgleader is None:
+            cfm.stop_following(True)
+        ldrcandidate = cfm.get_collective_member(member)['address']
+        log.log({'info': 'Performing startup attempt to {0}'.format(
+            ldrcandidate), 'subsystem': 'collective'})
+        if connect_to_leader(name=myname, leader=ldrcandidate):
+            break
+    else:
+        retrythread = eventlet.spawn_after(30 + random.random(),
+                                           start_collective)
+
+

confluent_server/confluent/config/attributes.py

@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2014 IBM Corporation
-# Copyright 2015 Lenovo
+# Copyright 2015-2019 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -93,9 +93,10 @@ node = {
         'description': ('List of static groups for which this node is '
                         'considered a member'),
     },
-    #'type': {
-    #    'description': ('Classification of node as system, vm, etc')
-    #},
+    'type': {
+        'description': ('Classification of node as server or switch'),
+        'validvalues': ('switch', 'server'),
+    },
     #'id': {
     #    'description': ('Numeric identifier for node')
     #},
@@ -148,6 +149,22 @@ node = {
 #                        'autonode.servername, so that would not need to be '
 #                        'copied ')
 #    },
+    'collective.manager': {
+        'description': ('When in collective mode, the member of the '
+                        'collective currently considered to be responsible '
+                        'for this node.  At a future date, this may be '
+                        'modified automatically if another attribute '
+                        'indicates candidate managers, either for '
+                        'high availability or load balancing purposes.')
+    },
+    'discovery.passwordrules': {
+        'description':  'Any specified rules shall be configured on the BMC '
+                        'upon discovery.  "expiration=no,loginfailures=no,complexity=no,reuse=no" '
+                        'would disable password expiration, login failures '
+                        'triggering a lockout, password complexity requirements,'
+                        'and any restrictions around reusing an old password.',
+        'validlistkeys': ('expiration', 'loginfailures', 'complexity', 'reuse'),
+    },
     'discovery.policy': {
         'description':  'Policy to use for auto-configuration of discovered '
                         'and identified nodes. Valid values are "manual", '
@@ -157,6 +174,7 @@ node = {
                         'so long as the node has no existing public key. '
                         '"open" allows discovery even if a known public key '
                         'is already stored',
+        'validlist': ('manual', 'permissive', 'pxe', 'open'),
     },
     'info.note': {
         'description':  'A field used for administrators to make arbitrary '
@@ -165,6 +183,9 @@ node = {
                         'freeform text data without concern for issues in how '
                         'the server will process it.',
     },
+    'location.height': {
+        'description': 'Height in RU of the system (defaults to query the systems)',
+    },
     'location.room': {
         'description': 'Room description for the node',
     },
@@ -244,11 +265,13 @@ node = {
     'console.logging': {
         'description': ('Indicate logging level to apply to console.  Valid '
                         'values are currently "full", "interactive", and '
-                        '"none". Defaults to "full".')
+                        '"none". Defaults to "full".'),
+        'validvalues': ('full', 'interactive', 'none'),
     },
     'console.method': {
         'description': ('Indicate the method used to access the console of '
-                        'the managed node.')
+                        'the managed node.'),
+        'validvalues': ('ssh', 'ipmi'),
     },
 #    'virtualization.host': {
 #        'description': ('Hypervisor where this node does/should reside'),
@@ -279,12 +302,17 @@ node = {
         'description': 'The method used to perform operations such as power '
                        'control, get sensor data, get inventory, and so on. '
     },
-    'enclosure.manager': {
-        'description': "The management device for this node's chassis",
-#        'appliesto': ['system'],
-    },
     'enclosure.bay': {
          'description': 'The bay in the enclosure, if any',
+#        'appliesto': ['system'],
+    },
+    'enclosure.extends': {
+        'description': 'When using an extendable enclosure, this is the node '
+                       'representing the manager that is one closer to the '
+                       'uplink.',
+    },
+    'enclosure.manager': {
+        'description': "The management device for this node's chassis",
 #        'appliesto': ['system'],
     },
 

confluent_server/confluent/consoleserver.py

@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2014 IBM Corporation
-# Copyright 2017 Lenovo
+# Copyright 2017-2018 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -23,14 +23,18 @@
 # there should be no more than one handler per node
 import codecs
 import collections
+import confluent.collective.manager as collective
 import confluent.config.configmanager as configmodule
 import confluent.exceptions as exc
 import confluent.interface.console as conapi
 import confluent.log as log
 import confluent.core as plugin
+import confluent.tlvdata as tlvdata
 import confluent.util as util
 import eventlet
 import eventlet.event
+import eventlet.green.socket as socket
+import eventlet.green.ssl as ssl
 import pyte
 import random
 import time
@@ -138,13 +142,18 @@ def pytechars2line(chars, maxlen=None):
 class ConsoleHandler(object):
     _plugin_path = '/nodes/{0}/_console/session'
     _logtobuffer = True
-    _genwatchattribs = frozenset(('console.method', 'console.logging'))
+    _genwatchattribs = frozenset(('console.method', 'console.logging',
+                                  'collective.manager'))
 
-    def __init__(self, node, configmanager):
+    def __init__(self, node, configmanager, width=80, height=24):
         self.clearpending = False
+        self.clearerror = False
+        self.initsize = (width, height)
         self._dologging = True
+        self._is_local = True
         self._isondemand = False
         self.error = None
+        self._retrytime = 0
         self.cfgmgr = configmanager
         self.node = node
         self.connectstate = 'unconnected'
@@ -190,6 +199,16 @@ class ConsoleHandler(object):
             self.connectstate = 'connecting'
             eventlet.spawn(self._connect)
 
+    def _get_retry_time(self):
+        clustsize = len(self.cfgmgr._cfgstore['nodes'])
+        self._retrytime = self._retrytime * 2 + 1
+        if self._retrytime > 120:
+            self._retrytime = 120
+        retrytime = clustsize * 0.05 * self._retrytime
+        if retrytime > 120:
+            retrytime = 120
+        return retrytime + (retrytime * random.random())
+
     def feedbuffer(self, data):
         try:
             self.termstream.feed(data)
@@ -203,7 +222,7 @@ class ConsoleHandler(object):
     def check_isondemand(self):
         self._dologging = True
         attrvalue = self.cfgmgr.get_node_attributes(
-            (self.node,), ('console.logging',))
+            (self.node,), ('console.logging', 'collective.manager'))
         if self.node not in attrvalue:
             self._isondemand = False
         elif 'console.logging' not in attrvalue[self.node]:
@@ -214,6 +233,23 @@ class ConsoleHandler(object):
                 self._isondemand = True
             if (attrvalue[self.node]['console.logging']['value']) in ('none', 'memory'):
                 self._dologging = False
+        self.check_collective(attrvalue)
+
+    def check_collective(self, attrvalue):
+        myc = attrvalue.get(self.node, {}).get('collective.manager', {}).get(
+            'value', None)
+        if configmodule.list_collective() and not myc:
+            self._is_local = False
+            self._detach()
+            self._disconnect()
+        if myc and myc != collective.get_myname():
+            # Do not do console connect for nodes managed by another
+            # confluent collective member
+            self._is_local = False
+            self._detach()
+            self._disconnect()
+        else:
+            self._is_local = True
 
     def get_buffer_age(self):
         """Return age of buffered data
@@ -225,6 +261,10 @@ class ConsoleHandler(object):
         return False
 
     def _attribschanged(self, nodeattribs, configmanager, **kwargs):
+        if 'collective.manager' in nodeattribs[self.node]:
+            attrval = configmanager.get_node_attributes(self.node,
+                                                        'collective.manager')
+            self.check_collective(attrval)
         if 'console.logging' in nodeattribs[self.node]:
             # decide whether logging changes how we react or not
             self._dologging = True
@@ -269,10 +309,17 @@ class ConsoleHandler(object):
 
     def clearbuffer(self):
         self.feedbuffer(
-            '\x1bc[no replay buffer due to console.logging attribute set to '
-            'none or interactive,\r\nconnection loss, or service restart]')
+            '\x1bc[No data has been received from the remote console since ' \
+            'connecting.  This could\r\nbe due to having the console.logging ' \
+            'attribute set to none or interactive,\r\nserial console not '  \
+            'being enabled or incorrectly configured in the OS or\r\nfirmware, ' \
+            'or the console simply not having any output since last connection]')
         self.clearpending = True
 
+    def _detach(self):
+        for ses in list(self.livesessions):
+            ses.detach()
+
     def _disconnect(self):
         if self.connectionthread:
             self.connectionthread.kill()
@@ -294,6 +341,8 @@ class ConsoleHandler(object):
             self._disconnect()
 
     def _connect(self):
+        if not self._is_local:
+            return
         if self.connectionthread:
             self.connectionthread.kill()
             self.connectionthread = None
@@ -309,22 +358,39 @@ class ConsoleHandler(object):
             self.reconnect.cancel()
             self.reconnect = None
         try:
-            self._console = plugin.handle_path(
+            self._console = list(plugin.handle_path(
                 self._plugin_path.format(self.node),
-                "create", self.cfgmgr)
+                "create", self.cfgmgr))[0]
         except (exc.NotImplementedException, exc.NotFoundException):
             self._console = None
         except:
-            _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
-                          event=log.Events.stacktrace)
+            if _tracelog:
+                _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
+                              event=log.Events.stacktrace)
+            else:
+                print(traceback.format_exc())
         if not isinstance(self._console, conapi.Console):
             self.clearbuffer()
             self.connectstate = 'unconnected'
             self.error = 'misconfigured'
             self._send_rcpts({'connectstate': self.connectstate,
                               'error': self.error})
+            self.feedbuffer(
+                '\x1bc\x1b[2J\x1b[1;1H[The console.method attribute for this node is '
+                'not configured,\r\nset it to a valid value for console '
+                'function]')
+            self._send_rcpts(
+                '\x1bc\x1b[2J\x1b[1;1H[The console.method attribute for this node is '
+                'not configured,\r\nset it to a valid value for console '
+                'function]')
+            self.clearerror = True
             return
+        if self.clearerror:
+            self.clearerror = False
+            self.clearbuffer()
+            self._send_rcpts(b'\x1bc\x1b[2J\x1b[1;1H')
         self.send_break = self._console.send_break
+        self.resize = self._console.resize
         if self._attribwatcher:
             self.cfgmgr.remove_watcher(self._attribwatcher)
             self._attribwatcher = None
@@ -336,6 +402,7 @@ class ConsoleHandler(object):
             self._attribwatcher = self.cfgmgr.watch_attributes(
                 (self.node,), attribstowatch, self._attribschanged)
         try:
+            self.resize(width=self.initsize[0], height=self.initsize[1])
             self._console.connect(self.get_console_output)
         except exc.TargetEndpointBadCredentials:
             self.clearbuffer()
@@ -343,7 +410,7 @@ class ConsoleHandler(object):
             self.connectstate = 'unconnected'
             self._send_rcpts({'connectstate': self.connectstate,
                               'error': self.error})
-            retrytime = 120 + (120 * random.random())
+            retrytime = self._get_retry_time()
             if not self.reconnect:
                 self.reconnect = eventlet.spawn_after(retrytime, self._connect)
             return
@@ -353,7 +420,7 @@ class ConsoleHandler(object):
             self.connectstate = 'unconnected'
             self._send_rcpts({'connectstate': self.connectstate,
                               'error': self.error})
-            retrytime = 120 + (120 * random.random())
+            retrytime = self._get_retry_time()
             if not self.reconnect:
                 self.reconnect = eventlet.spawn_after(retrytime, self._connect)
             return
@@ -365,7 +432,7 @@ class ConsoleHandler(object):
             self.connectstate = 'unconnected'
             self._send_rcpts({'connectstate': self.connectstate,
                               'error': self.error})
-            retrytime = 120 + (120 * random.random())
+            retrytime = self._get_retry_time()
             if not self.reconnect:
                 self.reconnect = eventlet.spawn_after(retrytime, self._connect)
             return
@@ -373,13 +440,13 @@ class ConsoleHandler(object):
 
     def _got_connected(self):
         self.connectstate = 'connected'
+        self._retrytime = 0
         self.log(
             logdata='console connected', ltype=log.DataTypes.event,
             event=log.Events.consoleconnect)
         self._send_rcpts({'connectstate': self.connectstate})
 
     def _got_disconnected(self):
-        self.clearbuffer()
         if self.connectstate != 'unconnected':
             self.connectstate = 'unconnected'
             self.log(
@@ -388,6 +455,8 @@ class ConsoleHandler(object):
             self._send_rcpts({'connectstate': self.connectstate})
         if self._isalive:
             self._connect()
+        else:
+            self.clearbuffer()
 
     def close(self):
         self._isalive = False
@@ -400,6 +469,9 @@ class ConsoleHandler(object):
         if self.connectionthread:
             self.connectionthread.kill()
             self.connectionthread = None
+        if self._attribwatcher:
+            self.cfgmgr.remove_watcher(self._attribwatcher)
+            self._attribwatcher = None
 
     def get_console_output(self, data):
         # Spawn as a greenthread, return control as soon as possible
@@ -469,17 +541,19 @@ class ConsoleHandler(object):
             eventdata |= 1
         if self.shiftin is not None:
             eventdata |= 2
-        self.log(data, eventdata=eventdata)
-        self.lasttime = util.monotonic_time()
-        self.feedbuffer(data)
         # TODO: analyze buffer for registered events, examples:
         #   panics
         #   certificate signing request
-        if self.clearpending:
+        if self.clearpending or self.clearerror:
             self.clearpending = False
-            self.feedbuffer(b'\x1bc')
-            self._send_rcpts(b'\x1bc')
+            self.clearerror = False
+            self.feedbuffer(b'\x1bc\x1b[2J\x1b[1;1H')
+            self._send_rcpts(b'\x1bc\x1b[2J\x1b[1;1H')
         self._send_rcpts(_utf8_normalize(data, self.shiftin, self.utf8decoder))
+        self.log(data, eventdata=eventdata)
+        self.lasttime = util.monotonic_time()
+        self.feedbuffer(data)
+
 
     def _send_rcpts(self, data):
         for rcpt in list(self.livesessions):
@@ -547,15 +621,23 @@ def disconnect_node(node, configmanager):
         del _handled_consoles[consk]
 
 
-def _nodechange(added, deleting, configmanager):
-    for node in added:
-        connect_node(node, configmanager)
+def _nodechange(added, deleting, renamed, configmanager):
     for node in deleting:
         disconnect_node(node, configmanager)
+    for node in renamed:
+        disconnect_node(node, configmanager)
+        connect_node(renamed[node], configmanager)
+    for node in added:
+        connect_node(node, configmanager)
 
 
 def _start_tenant_sessions(cfm):
-    for node in cfm.list_nodes():
+    nodeattrs = cfm.get_node_attributes(cfm.list_nodes(), 'collective.manager')
+    for node in nodeattrs:
+        manager = nodeattrs[node].get('collective.manager', {}).get('value',
+                                                                    None)
+        if manager and collective.get_myname() != manager:
+            continue
         try:
             connect_node(node, cfm)
         except:
@@ -570,12 +652,130 @@ def start_console_sessions():
     configmodule.hook_new_configmanagers(_start_tenant_sessions)
 
 
-def connect_node(node, configmanager, username=None):
+def connect_node(node, configmanager, username=None, direct=True, width=80,
+                 height=24):
+    attrval = configmanager.get_node_attributes(node, 'collective.manager')
+    myc = attrval.get(node, {}).get('collective.manager', {}).get(
+        'value', None)
+    myname = collective.get_myname()
+    if myc and myc != collective.get_myname() and direct:
+        minfo = configmodule.get_collective_member(myc)
+        return ProxyConsole(node, minfo, myname, configmanager, username,
+                            width, height)
     consk = (node, configmanager.tenant)
     if consk not in _handled_consoles:
-        _handled_consoles[consk] = ConsoleHandler(node, configmanager)
+        _handled_consoles[consk] = ConsoleHandler(node, configmanager, width,
+                                                  height)
     return _handled_consoles[consk]
 
+# A stub console handler that just passes through to a remote confluent
+# collective member.  It can skip the multi-session sharing as that is handled
+# remotely
+class ProxyConsole(object):
+    _genwatchattribs = frozenset(('collective.manager',))
+
+    def __init__(self, node, managerinfo, myname, configmanager, user, width,
+                 height):
+        self.skipreplay = True
+        self.initsize = (width, height)
+        self.managerinfo = managerinfo
+        self.myname = myname
+        self.cfm = configmanager
+        self.node = node
+        self.user = user
+        self.remote = None
+        self.clisession = None
+        self._attribwatcher = configmanager.watch_attributes(
+            (self.node,), self._genwatchattribs, self._attribschanged)
+
+
+    def _attribschanged(self, nodeattribs, configmanager, **kwargs):
+        if self.clisession:
+            self.clisession.detach()
+            self.clisession = None
+
+    def relay_data(self):
+        data = tlvdata.recv(self.remote)
+        while data:
+            self.data_handler(data)
+            data = tlvdata.recv(self.remote)
+
+    def get_buffer_age(self):
+        # the server sends a buffer age if appropriate, no need to handle
+        # it explicitly in the proxy instance
+        return False
+
+    def get_recent(self):
+        # Again, delegate this to the remote collective member
+        self.skipreplay = False
+        return b''
+
+    def write(self, data):
+        # Relay data to the collective manager
+        try:
+            tlvdata.send(self.remote, data)
+        except Exception:
+            if self.clisession:
+                self.clisession.detach()
+            self.clisession = None
+
+
+    def attachsession(self, session):
+        self.clisession = session
+        self.data_handler = session.data_handler
+        termreq = {
+            'proxyconsole': {
+                'name': self.myname,
+                'user': self.user,
+                'tenant': self.cfm.tenant,
+                'node': self.node,
+                'skipreplay': self.skipreplay,
+                'width': self.initsize[0],
+                'height': self.initsize[1],
+                #TODO(jjohnson2): declare myself as a proxy,
+                #facilitate redirect rather than relay on manager change
+            },
+        }
+        try:
+            remote = socket.create_connection((self.managerinfo['address'], 13001))
+            remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                     keyfile='/etc/confluent/privkey.pem',
+                                     certfile='/etc/confluent/srvcert.pem')
+            if not util.cert_matches(self.managerinfo['fingerprint'],
+                                     remote.getpeercert(binary_form=True)):
+                raise Exception('Invalid peer certificate')
+        except Exception:
+            eventlet.sleep(3)
+            if self.clisession:
+                self.clisession.detach()
+            self.detachsession(None)
+            return
+        tlvdata.recv(remote)
+        tlvdata.recv(remote)
+        tlvdata.send(remote, termreq)
+        self.remote = remote
+        eventlet.spawn(self.relay_data)
+
+    def detachsession(self, session):
+        # we will disappear, so just let that happen...
+        if self.remote:
+            try:
+                tlvdata.send(self.remote, {'operation': 'stop'})
+            except Exception:
+                pass
+        self.clisession = None
+
+    def send_break(self):
+        tlvdata.send(self.remote, {'operation': 'break'})
+
+    def reopen(self):
+        tlvdata.send(self.remote, {'operation': 'reopen'})
+
+    def resize(self, width, height):
+        tlvdata.send(self.remote, {'operation': 'resize', 'width': width,
+                                   'height': height})
+
+
 # this represents some api view of a console handler.  This handles things like
 # holding the caller specific queue data, for example, when http api should be
 # sending data, but there is no outstanding POST request to hold it,
@@ -597,10 +797,9 @@ class ConsoleSession(object):
                          'get_next_output' non-functional
     :param skipreplay: If true, will skip the attempt to redraw the screen
     """
-    connector = connect_node
 
     def __init__(self, node, configmanager, username, datacallback=None,
-                 skipreplay=False):
+                 skipreplay=False, direct=True, width=80, height=24):
         self.registered = False
         self.tenant = configmanager.tenant
         if not configmanager.is_node(node):
@@ -608,6 +807,10 @@ class ConsoleSession(object):
         self.username = username
         self.node = node
         self.configmanager = configmanager
+        self.direct = direct  # true if client is directly connected versus
+                              # relay
+        self.width = width
+        self.height = height
         self.connect_session()
         self.registered = True
         self._evt = None
@@ -636,12 +839,16 @@ class ConsoleSession(object):
         between console and shell.
         """
         self.conshdl = connect_node(self.node, self.configmanager,
-                                    self.username)
+                                    self.username, self.direct, self.width,
+                                    self.height)
     def send_break(self):
         """Send break to remote system
         """
         self.conshdl.send_break()
 
+    def resize(self, width, height):
+        self.conshdl.resize(width, height)
+
     def get_buffer_age(self):
         """Get the age in seconds of the buffered data
 
@@ -667,6 +874,18 @@ class ConsoleSession(object):
         self._evt = None
         self.reghdl = None
 
+    def detach(self):
+        """Handler for the console handler to detach so it can reattach,
+        currently to facilitate changing from one collective.manager to
+        another
+
+        :return:
+        """
+        self.conshdl.detachsession(self)
+        self.connect_session()
+        self.conshdl.attachsession(self)
+        self.write = self.conshdl.write
+
     def got_data(self, data):
         """Receive data from console and buffer
 

confluent_server/confluent/core.py

@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2014 IBM Corporation
-# Copyright 2015-2017 Lenovo
+# Copyright 2015-2018 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -35,7 +35,11 @@
 
 import confluent
 import confluent.alerts as alerts
+import confluent.log as log
+import confluent.tlvdata as tlvdata
 import confluent.config.attributes as attrscheme
+import confluent.config.configmanager as cfm
+import confluent.collective.manager as collective
 import confluent.discovery.core as disco
 import confluent.interface.console as console
 import confluent.exceptions as exc
@@ -46,11 +50,27 @@ try:
     import confluent.shellmodule as shellmodule
 except ImportError:
     pass
+try:
+    import OpenSSL.crypto as crypto
+except ImportError:
+    # Only required for collective mode
+    crypto = None
+import confluent.util as util
+import eventlet.greenpool as greenpool
+import eventlet.green.ssl as ssl
+import eventlet.queue as queue
 import itertools
 import os
+try:
+    import cPickle as pickle
+except ImportError:
+    import pickle
+import socket
+import struct
 import sys
 
 pluginmap = {}
+dispatch_plugins = (b'ipmi', u'ipmi')
 
 
 def seek_element(currplace, currkey):
@@ -104,7 +124,7 @@ def load_plugins():
 
 
 rootcollections = ['discovery/', 'events/', 'networking/',
-                   'noderange/', 'nodes/', 'nodegroups/', 'users/', 'version']
+                   'noderange/', 'nodes/', 'nodegroups/', 'usergroups/' , 'users/', 'version']
 
 
 class PluginRoute(object):
@@ -124,6 +144,7 @@ def _init_core():
     # be enumerated in any collection
     noderesources = {
         'attributes': {
+            'rename': PluginRoute({'handler': 'attributes'}),
             'all': PluginRoute({'handler': 'attributes'}),
             'current': PluginRoute({'handler': 'attributes'}),
             'expression': PluginRoute({'handler': 'attributes'}),
@@ -146,6 +167,14 @@ def _init_core():
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
                 }),
+                'licenses': PluginCollection({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+                'save_licenses': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
                 'net_interfaces': PluginCollection({
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
@@ -154,6 +183,10 @@ def _init_core():
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
                 }),
+                'hostname': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
                 'identifier': PluginRoute({
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
@@ -172,7 +205,39 @@ def _init_core():
                         'default': 'ipmi',
                     }),
                 },
-            }
+            },
+            'storage': {
+                'all': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+                'arrays': PluginCollection({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+                'disks': PluginCollection({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+                'volumes': PluginCollection({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                })
+            },
+            'system': {
+                'all': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+                'advanced': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+                'clear': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                })
+            },
         },
         '_console': {
             'session': PluginRoute({
@@ -204,6 +269,10 @@ def _init_core():
                 'default': 'ipmi',
             }),
         },
+        'description': PluginRoute({
+            'pluginattrs': ['hardwaremanagement.method'],
+            'default': 'ipmi',
+        }),
         'events': {
             'hardware': {
                 'log': PluginRoute({
@@ -250,6 +319,25 @@ def _init_core():
                 },
             },
         },
+        'media': {
+            'uploads': PluginCollection({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+            'attach': PluginRoute({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+            'detach': PluginRoute({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+            'current': PluginRoute({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+
+        },
         'power': {
             'state': PluginRoute({
                 'pluginattrs': ['hardwaremanagement.method'],
@@ -286,10 +374,17 @@ def _init_core():
             },
 
         },
+        'support': {
+            'servicedata': PluginCollection({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+        },
     }
 
     nodegroupresources = {
         'attributes': {
+            'rename': PluginRoute({'handler': 'attributes'}),
             'all': PluginRoute({'handler': 'attributes'}),
             'current': PluginRoute({'handler': 'attributes'}),
         },
@@ -305,13 +400,33 @@ def create_user(inputdata, configmanager):
     configmanager.create_user(username, attributemap=inputdata)
 
 
+def create_usergroup(inputdata, configmanager):
+    try:
+        groupname = inputdata['name']
+        del inputdata['name']
+    except (KeyError, ValueError):
+        raise exc.InvalidArgumentException()
+    configmanager.create_usergroup(groupname)
+
+
+def update_usergroup(groupname, attribmap, configmanager):
+    try:
+        configmanager.set_usergroup(groupname, attribmap)
+    except ValueError as e:
+        raise exc.InvalidArgumentException(str(e))
+
 def update_user(name, attribmap, configmanager):
     try:
         configmanager.set_user(name, attribmap)
-    except ValueError:
-        raise exc.InvalidArgumentException()
+    except ValueError as e:
+        raise exc.InvalidArgumentException(str(e))
 
 
+def show_usergroup(groupname, configmanager):
+    groupinfo = configmanager.get_usergroup(groupname)
+    for attr in groupinfo:
+        yield msg.Attributes(kv={attr: groupinfo[attr]})
+
 def show_user(name, configmanager):
     userobj = configmanager.get_user(name)
     rv = {}
@@ -328,6 +443,10 @@ def show_user(name, configmanager):
                 rv[attr] = userobj[attr]
             yield msg.Attributes(kv={attr: rv[attr]},
                                  desc=attrscheme.user[attr]['description'])
+    if 'role' in userobj:
+        yield msg.Attributes(kv={'role': userobj['role']})
+
+
 
 
 def stripnode(iterablersp, node):
@@ -360,6 +479,10 @@ def delete_user(user, configmanager):
     configmanager.del_user(user)
     yield msg.DeletedResource(user)
 
+def delete_usergroup(usergroup, configmanager):
+    configmanager.del_usergroup(usergroup)
+    yield msg.DeletedResource(usergroup)
+
 
 def delete_nodegroup_collection(collectionpath, configmanager):
     if len(collectionpath) == 2:  # just the nodegroup
@@ -519,6 +642,15 @@ class BadPlugin(object):
             self.node, self.plugin + ' is not a supported plugin')
 
 
+class BadCollective(object):
+    def __init__(self, node):
+        self.node = node
+
+    def error(self, *args, **kwargs):
+        yield msg.ConfluentNodeError(
+            self.node, 'collective mode is active, but collective.manager '
+                       'is not set for this node')
+
 def abbreviate_noderange(configmanager, inputdata, operation):
     if operation != 'create':
         raise exc.InvalidArgumentException('Must be a create with nodes in list')
@@ -529,8 +661,71 @@ def abbreviate_noderange(configmanager, inputdata, operation):
     return (msg.KeyValueData({'noderange': noderange.ReverseNodeRange(inputdata['nodes'], configmanager).noderange}),)
 
 
+def handle_dispatch(connection, cert, dispatch, peername):
+    cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    if not util.cert_matches(
+            cfm.get_collective_member(peername)['fingerprint'], cert):
+        connection.close()
+        return
+    dispatch = pickle.loads(dispatch)
+    configmanager = cfm.ConfigManager(dispatch['tenant'])
+    nodes = dispatch['nodes']
+    inputdata = dispatch['inputdata']
+    operation = dispatch['operation']
+    pathcomponents = dispatch['path']
+    routespec = nested_lookup(noderesources, pathcomponents)
+    plugroute = routespec.routeinfo
+    plugpath = None
+    nodesbyhandler = {}
+    passvalues = []
+    nodeattr = configmanager.get_node_attributes(
+        nodes, plugroute['pluginattrs'])
+    for node in nodes:
+        for attrname in plugroute['pluginattrs']:
+            if attrname in nodeattr[node]:
+                plugpath = nodeattr[node][attrname]['value']
+            elif 'default' in plugroute:
+                plugpath = plugroute['default']
+        if plugpath:
+            try:
+                hfunc = getattr(pluginmap[plugpath], operation)
+            except KeyError:
+                nodesbyhandler[BadPlugin(node, plugpath).error] = [node]
+                continue
+            if hfunc in nodesbyhandler:
+                nodesbyhandler[hfunc].append(node)
+            else:
+                nodesbyhandler[hfunc] = [node]
+    try:
+        for hfunc in nodesbyhandler:
+            passvalues.append(hfunc(
+                nodes=nodesbyhandler[hfunc], element=pathcomponents,
+                configmanager=configmanager,
+                inputdata=inputdata))
+        for res in itertools.chain(*passvalues):
+            _forward_rsp(connection, res)
+    except Exception as res:
+        _forward_rsp(connection, res)
+    connection.sendall('\x00\x00\x00\x00\x00\x00\x00\x00')
+
+
+def _forward_rsp(connection, res):
+    try:
+        r = pickle.dumps(res)
+    except TypeError:
+        r = pickle.dumps(Exception(
+            'Cannot serialize error, check collective.manager error logs for details' + str(res)))
+    rlen = len(r)
+    if not rlen:
+        return
+    connection.sendall(struct.pack('!Q', rlen))
+    connection.sendall(r)
+
+
 def handle_node_request(configmanager, inputdata, operation,
                         pathcomponents, autostrip=True):
+    if log.logfull:
+        raise exc.TargetResourceUnavailable('Filesystem full, free up space and restart confluent service')
     iscollection = False
     routespec = None
     if pathcomponents[0] == 'noderange':
@@ -608,7 +803,7 @@ def handle_node_request(configmanager, inputdata, operation,
         else:
             raise Exception("TODO here")
     del pathcomponents[0:2]
-    passvalues = []
+    passvalues = queue.Queue()
     plugroute = routespec.routeinfo
     inputdata = msg.get_input_message(
         pathcomponents, operation, inputdata, nodes, isnoderange,
@@ -625,21 +820,37 @@ def handle_node_request(configmanager, inputdata, operation,
         if isnoderange:
             return passvalue
         elif isinstance(passvalue, console.Console):
-            return passvalue
+            return [passvalue]
         else:
             return stripnode(passvalue, nodes[0])
     elif 'pluginattrs' in plugroute:
         nodeattr = configmanager.get_node_attributes(
-            nodes, plugroute['pluginattrs'])
+            nodes, plugroute['pluginattrs'] + ['collective.manager'])
         plugpath = None
-        if 'default' in plugroute:
-            plugpath = plugroute['default']
+        nodesbymanager = {}
         nodesbyhandler = {}
+        badcollnodes = []
         for node in nodes:
             for attrname in plugroute['pluginattrs']:
                 if attrname in nodeattr[node]:
                     plugpath = nodeattr[node][attrname]['value']
-            if plugpath is not None:
+                elif 'default' in plugroute:
+                    plugpath = plugroute['default']
+            if plugpath in dispatch_plugins:
+                cfm.check_quorum()
+                manager = nodeattr[node].get('collective.manager', {}).get(
+                    'value', None)
+                if manager:
+                    if collective.get_myname() != manager:
+                        if manager not in nodesbymanager:
+                            nodesbymanager[manager] = set([node])
+                        else:
+                            nodesbymanager[manager].add(node)
+                        continue
+                elif list(cfm.list_collective()):
+                    badcollnodes.append(node)
+                    continue
+            if plugpath:
                 try:
                     hfunc = getattr(pluginmap[plugpath], operation)
                 except KeyError:
@@ -649,19 +860,27 @@ def handle_node_request(configmanager, inputdata, operation,
                     nodesbyhandler[hfunc].append(node)
                 else:
                     nodesbyhandler[hfunc] = [node]
+        for bn in badcollnodes:
+            nodesbyhandler[BadCollective(bn).error] = [bn]
+        workers = greenpool.GreenPool()
+        numworkers = 0
         for hfunc in nodesbyhandler:
-            passvalues.append(hfunc(
-                nodes=nodesbyhandler[hfunc], element=pathcomponents,
-                configmanager=configmanager,
-                inputdata=inputdata))
+            numworkers += 1
+            workers.spawn(addtoqueue, passvalues, hfunc, {'nodes': nodesbyhandler[hfunc],
+                                           'element': pathcomponents,
+                'configmanager': configmanager,
+                'inputdata': inputdata})
+        for manager in nodesbymanager:
+            numworkers += 1
+            workers.spawn(addtoqueue, passvalues, dispatch_request, {
+                'nodes': nodesbymanager[manager], 'manager': manager,
+                'element': pathcomponents, 'configmanager': configmanager,
+                'inputdata': inputdata, 'operation': operation})
         if isnoderange or not autostrip:
-            return itertools.chain(*passvalues)
+            return iterate_queue(numworkers, passvalues)
         else:
-            if len(passvalues) > 0:
-                if isinstance(passvalues[0], console.Console):
-                    return passvalues[0]
-                else:
-                    return stripnode(passvalues[0], nodes[0])
+            if numworkers > 0:
+                return iterate_queue(numworkers, passvalues, nodes[0])
             else:
                 raise exc.NotImplementedException()
 
@@ -671,6 +890,117 @@ def handle_node_request(configmanager, inputdata, operation,
         #     return stripnode(passvalues[0], nodes[0])
 
 
+def iterate_queue(numworkers, passvalues, strip=False):
+    completions = 0
+    while completions < numworkers:
+        nv = passvalues.get()
+        if nv == 'theend':
+            completions += 1
+        else:
+            if isinstance(nv, Exception):
+                raise nv
+            if strip and not isinstance(nv, console.Console):
+                nv.strip_node(strip)
+            yield nv
+
+
+def addtoqueue(theq, fun, kwargs):
+    try:
+        result = fun(**kwargs)
+        if isinstance(result, console.Console):
+            theq.put(result)
+        else:
+            for pv in result:
+                theq.put(pv)
+    except Exception as e:
+        theq.put(e)
+    finally:
+        theq.put('theend')
+
+
+def dispatch_request(nodes, manager, element, configmanager, inputdata,
+                     operation):
+    a = configmanager.get_collective_member(manager)
+    try:
+        remote = socket.create_connection((a['address'], 13001))
+        remote.settimeout(180)
+        remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                 keyfile='/etc/confluent/privkey.pem',
+                                 certfile='/etc/confluent/srvcert.pem')
+    except Exception:
+        for node in nodes:
+            if a:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} is unreachable'.format(
+                        a['name']))
+            else:
+                yield msg.ConfluentResourceUnavailable(
+                    node,
+                    '"{0}" is not recognized as a collective member'.format(
+                        manager))
+
+        return
+    if not util.cert_matches(a['fingerprint'], remote.getpeercert(
+            binary_form=True)):
+        raise Exception("Invalid certificate on peer")
+    tlvdata.recv(remote)
+    tlvdata.recv(remote)
+    myname = collective.get_myname()
+    dreq = pickle.dumps({'name': myname, 'nodes': list(nodes),
+                         'path': element,'tenant': configmanager.tenant,
+                         'operation': operation, 'inputdata': inputdata})
+    tlvdata.send(remote, {'dispatch': {'name': myname, 'length': len(dreq)}})
+    remote.sendall(dreq)
+    while True:
+        try:
+            rlen = remote.recv(8)
+        except Exception:
+            for node in nodes:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} went unreachable'.format(
+                        a['name']))
+            return
+        while len(rlen) < 8:
+            try:
+                nlen = remote.recv(8 - len(rlen))
+            except Exception:
+                nlen = 0
+            if not nlen:
+                for node in nodes:
+                    yield msg.ConfluentResourceUnavailable(
+                        node, 'Collective member {0} went unreachable'.format(
+                            a['name']))
+                return
+            rlen += nlen
+        rlen = struct.unpack('!Q', rlen)[0]
+        if rlen == 0:
+            break
+        try:
+            rsp = remote.recv(rlen)
+        except Exception:
+            for node in nodes:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} went unreachable'.format(
+                        a['name']))
+            return
+        while len(rsp) < rlen:
+            try:
+                nrsp = remote.recv(rlen - len(rsp))
+            except Exception:
+                nrsp = 0
+            if not nrsp:
+                for node in nodes:
+                    yield msg.ConfluentResourceUnavailable(
+                        node, 'Collective member {0} went unreachable'.format(
+                            a['name']))
+                return
+            rsp += nrsp
+        rsp = pickle.loads(rsp)
+        if isinstance(rsp, Exception):
+            raise rsp
+        yield rsp
+
+
 def handle_discovery(pathcomponents, operation, configmanager, inputdata):
     if pathcomponents[0] == 'detected':
         pass
@@ -711,6 +1041,31 @@ def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
             configmanager, inputdata, operation, pathcomponents)
     elif pathcomponents[0] == 'version':
         return (msg.Attributes(kv={'version': confluent.__version__}),)
+    elif pathcomponents[0] == 'usergroups':
+        # TODO: when non-administrator accounts exist,
+        # they must only be allowed to see their own user
+        try:
+            usergroup = pathcomponents[1]
+        except IndexError:  # it's just users/
+            if operation == 'create':
+                inputdata = msg.get_input_message(
+                    pathcomponents, operation, inputdata,
+                    configmanager=configmanager)
+                create_usergroup(inputdata.attribs, configmanager)
+            return iterate_collections(configmanager.list_usergroups(),
+                                       forcecollection=False)
+        if usergroup not in configmanager.list_usergroups():
+            raise exc.NotFoundException("Invalid usergroup %s" % usergroup)
+        if operation == 'retrieve':
+            return show_usergroup(usergroup, configmanager)
+        elif operation == 'delete':
+            return delete_usergroup(usergroup, configmanager)
+        elif operation == 'update':
+            inputdata = msg.get_input_message(
+                pathcomponents, operation, inputdata,
+                configmanager=configmanager)
+            update_usergroup(usergroup, inputdata.attribs, configmanager)
+            return show_usergroup(usergroup, configmanager)
     elif pathcomponents[0] == 'users':
         # TODO: when non-administrator accounts exist,
         # they must only be allowed to see their own user
@@ -719,7 +1074,8 @@ def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
         except IndexError:  # it's just users/
             if operation == 'create':
                 inputdata = msg.get_input_message(
-                    pathcomponents, operation, inputdata, configmanager)
+                    pathcomponents, operation, inputdata,
+                    configmanager=configmanager)
                 create_user(inputdata.attribs, configmanager)
             return iterate_collections(configmanager.list_users(),
                                        forcecollection=False)
@@ -731,7 +1087,8 @@ def handle_path(path, operation, configmanager, inputdata=None, autostrip=True):
             return delete_user(user, configmanager)
         elif operation == 'update':
             inputdata = msg.get_input_message(
-                pathcomponents, operation, inputdata, configmanager)
+                pathcomponents, operation, inputdata,
+                configmanager=configmanager)
             update_user(user, inputdata.attribs, configmanager)
             return show_user(user, configmanager)
     elif pathcomponents[0] == 'events':

confluent_server/confluent/discovery/core.py

@@ -61,7 +61,9 @@
 #       retry until uppercase, lowercase, digit, and symbol all present)
 #     - Apply defined configuration to endpoint
 
+import base64
 import confluent.config.configmanager as cfm
+import confluent.collective.manager as collective
 import confluent.discovery.protocols.pxe as pxe
 #import confluent.discovery.protocols.ssdp as ssdp
 import confluent.discovery.protocols.slp as slp
@@ -75,12 +77,18 @@ import confluent.messages as msg
 import confluent.networking.macmap as macmap
 import confluent.noderange as noderange
 import confluent.util as util
+import eventlet
 import traceback
+webclient = eventlet.import_patched('pyghmi.util.webclient')
+
 
 import eventlet
 import eventlet.greenpool
 import eventlet.semaphore
 
+autosensors = set()
+scanner = None
+
 class nesteddict(dict):
 
     def __missing__(self, key):
@@ -92,6 +100,7 @@ nodehandlers = {
     'service:management-hardware.Lenovo:lenovo-xclarity-controller': xcc,
     'service:management-hardware.IBM:integrated-management-module2': imm,
     'pxe-client': pxeh,
+    'service:io-device.Lenovo:management-module': None,
 }
 
 servicenames = {
@@ -99,6 +108,7 @@ servicenames = {
     'service:lenovo-smm': 'lenovo-smm',
     'service:management-hardware.Lenovo:lenovo-xclarity-controller': 'lenovo-xcc',
     'service:management-hardware.IBM:integrated-management-module2': 'lenovo-imm2',
+    'service:io-device.Lenovo:management-module': 'lenovo-switch',
 }
 
 servicebyname = {
@@ -106,6 +116,7 @@ servicebyname = {
     'lenovo-smm': 'service:lenovo-smm',
     'lenovo-xcc': 'service:management-hardware.Lenovo:lenovo-xclarity-controller',
     'lenovo-imm2': 'service:management-hardware.IBM:integrated-management-module2',
+    'lenovo-switch': 'service:io-device.Lenovo:management-module',
 }
 
 discopool = eventlet.greenpool.GreenPool(500)
@@ -145,6 +156,7 @@ known_uuids = nesteddict()
 known_nodes = nesteddict()
 unknown_info = {}
 pending_nodes = {}
+pending_by_uuid = {}
 
 
 def enrich_pxe_info(info):
@@ -200,6 +212,8 @@ def send_discovery_datum(info):
         if infotype in servicenames:
             types.append(servicenames[infotype])
     yield msg.KeyValueData({'types': types})
+    if 'otheraddresses' in info:
+        yield msg.KeyValueData({'otheripaddrs': list(info['otheraddresses'])})
 
 
 def _info_matches(info, criteria):
@@ -342,7 +356,28 @@ def _parameterize_path(pathcomponents):
     return validselectors, keyparams, listrequested, childcoll
 
 
+def handle_autosense_config(operation, inputdata):
+    autosense = cfm.get_global('discovery.autosense')
+    autosense = autosense or autosense is None
+    if operation == 'retrieve':
+        yield msg.KeyValueData({'enabled': autosense})
+    elif operation == 'update':
+        enabled = inputdata['enabled']
+        if type(enabled) in (unicode, str):
+            enabled = enabled.lower() in ('true', '1', 'y', 'yes', 'enable',
+                                          'enabled')
+        if autosense == enabled:
+            return
+        cfm.set_global('discovery.autosense', enabled)
+        if enabled:
+            start_autosense()
+        else:
+            stop_autosense()
+
+
 def handle_api_request(configmanager, inputdata, operation, pathcomponents):
+    if pathcomponents == ['discovery', 'autosense']:
+        return handle_autosense_config(operation, inputdata)
     if operation == 'retrieve':
         return handle_read_api_request(pathcomponents)
     elif (operation in ('update', 'create') and
@@ -351,32 +386,56 @@ def handle_api_request(configmanager, inputdata, operation, pathcomponents):
             raise exc.InvalidArgumentException()
         rescan()
         return (msg.KeyValueData({'rescan': 'started'}),)
-    elif (operation in ('update', 'create')):
+
+    elif operation in ('update', 'create'):
         if 'node' not in inputdata:
             raise exc.InvalidArgumentException('Missing node name in input')
-        _, queryparms, _, _ = _parameterize_path(pathcomponents[1:])
-        if 'by-mac' not in queryparms:
-            raise exc.InvalidArgumentException('Must target using "by-mac"')
-        mac = queryparms['by-mac'].replace('-', ':')
-        if mac not in known_info:
-            raise exc.NotFoundException('{0} not found'.format(mac))
+        mac = _get_mac_from_query(pathcomponents)
         info = known_info[mac]
+        if info['handler'] is None:
+            raise exc.NotImplementedException(
+                'Unable to {0} to {1}'.format(operation,
+                                              '/'.join(pathcomponents)))
         handler = info['handler'].NodeHandler(info, configmanager)
-        eval_node(configmanager, handler, info, inputdata['node'],
-                  manual=True)
+        try:
+            eval_node(configmanager, handler, info, inputdata['node'],
+                      manual=True)
+        except Exception as e:
+            # or... incorrect passworod provided..
+            if 'Incorrect password' in str(e) or 'Unauthorized name' in str(e):
+                return [msg.ConfluentTargetInvalidCredentials(
+                    inputdata['node'])]
+            raise
         return [msg.AssignedResource(inputdata['node'])]
+    elif operation == 'delete':
+        mac = _get_mac_from_query(pathcomponents)
+        del known_info[mac]
+        return [msg.DeletedResource(mac)]
     raise exc.NotImplementedException(
         'Unable to {0} to {1}'.format(operation, '/'.join(pathcomponents)))
 
 
+def _get_mac_from_query(pathcomponents):
+    _, queryparms, _, _ = _parameterize_path(pathcomponents[1:])
+    if 'by-mac' not in queryparms:
+        raise exc.InvalidArgumentException('Must target using "by-mac"')
+    mac = queryparms['by-mac'].replace('-', ':')
+    if mac not in known_info:
+        raise exc.NotFoundException('{0} not found'.format(mac))
+    return mac
+
+
 def handle_read_api_request(pathcomponents):
     # TODO(jjohnson2): This should be more generalized...
     #  odd indexes into components are 'by-'*, even indexes
     # starting at 2 are parameters to previous index
+    if pathcomponents == ['discovery', 'rescan']:
+        return (msg.KeyValueData({'scanning': bool(scanner)}),)
     subcats, queryparms, indexof, coll = _parameterize_path(pathcomponents[1:])
     if len(pathcomponents) == 1:
         dirlist = [msg.ChildCollection(x + '/') for x in sorted(list(subcats))]
         dirlist.append(msg.ChildCollection('rescan'))
+        dirlist.append(msg.ChildCollection('autosense'))
         return dirlist
     if not coll:
         return show_info(queryparms['by-mac'])
@@ -414,6 +473,9 @@ def _recheck_nodes_backend(nodeattribs, configmanager):
     _map_unique_ids(nodeattribs)
     # for the nodes whose attributes have changed, consider them as potential
     # strangers
+    if nodeattribs:
+        macmap.vintage = 0  # expire current mac map data, in case
+        # the attributes changed impacted the result
     for node in nodeattribs:
         if node in known_nodes:
             for somemac in known_nodes[node]:
@@ -431,6 +493,8 @@ def _recheck_nodes_backend(nodeattribs, configmanager):
     for nodename in pending_nodes:
         info = pending_nodes[nodename]
         try:
+            if info['handler'] is None:
+                next
             handler = info['handler'].NodeHandler(info, configmanager)
             discopool.spawn_n(eval_node, configmanager, handler, info, nodename)
         except Exception:
@@ -440,10 +504,14 @@ def _recheck_nodes_backend(nodeattribs, configmanager):
 
 
 def _recheck_single_unknown(configmanager, mac):
+    info = unknown_info.get(mac, None)
+    _recheck_single_unknown_info(configmanager, info)
+
+
+def _recheck_single_unknown_info(configmanager, info):
     global rechecker
     global rechecktime
-    info = unknown_info.get(mac, None)
-    if not info:
+    if not info or info['handler'] is None:
         return
     if info['handler'] != pxeh and not info.get('addresses', None):
         #log.log({'info': 'Missing address information in ' + repr(info)})
@@ -492,7 +560,7 @@ def _recheck_single_unknown(configmanager, mac):
 
 
 def safe_detected(info):
-    if 'hwaddr' not in info:
+    if 'hwaddr' not in info or not info['hwaddr']:
         return
     if info['hwaddr'] in runningevals:
         # Do not evaluate the same mac multiple times at once
@@ -513,7 +581,7 @@ def detected(info):
     global rechecktime
     # later, manual and CMM discovery may act on SN and/or UUID
     for service in info['services']:
-        if nodehandlers.get(service, None):
+        if service in nodehandlers:
             if service not in known_services:
                 known_services[service] = set([])
             handler = nodehandlers[service]
@@ -521,6 +589,11 @@ def detected(info):
             break
     else:  # no nodehandler, ignore for now
         return
+    if (handler and not handler.NodeHandler.adequate(info) and
+            info.get('protocol', None)):
+        eventlet.spawn_after(10, info['protocol'].fix_info, info,
+                             safe_detected)
+        return
     try:
         snum = info['attributes']['enclosure-serial-number'][0].strip()
         if snum:
@@ -561,17 +634,21 @@ def detected(info):
             return
     known_info[info['hwaddr']] = info
     cfg = cfm.ConfigManager(None)
-    handler = handler.NodeHandler(info, cfg)
-    handler.scan()
+    if handler:
+        handler = handler.NodeHandler(info, cfg)
+        handler.scan()
     uuid = info.get('uuid', None)
     if uuid_is_valid(uuid):
         known_uuids[uuid][info['hwaddr']] = info
-    if handler.https_supported and not handler.https_cert:
+    info['otheraddresses'] = set([])
+    for i4addr in info.get('attributes', {}).get('ipv4-address', []):
+        info['otheraddresses'].add(i4addr)
+    if handler and handler.https_supported and not handler.https_cert:
         if handler.cert_fail_reason == 'unreachable':
             log.log(
                 {
-                    'info': '{0} with hwaddr {1} is not reachable at {2}'
-                            ''.format(
+                    'info': '{0} with hwaddr {1} is not reachable by https '
+                            'at address {2}'.format(
                         handler.devname, info['hwaddr'], handler.ipaddr
                     )})
             info['addresses'] = [x for x in info.get('addresses', []) if x != handler.ipaddr]
@@ -592,7 +669,7 @@ def detected(info):
         # influence periodic recheck to shorten delay?
         return
     nodename, info['maccount'] = get_nodename(cfg, handler, info)
-    if nodename and handler.https_supported:
+    if nodename and handler and handler.https_supported:
         dp = cfg.get_node_attributes([nodename],
                                      ('pubkeys.tls_hardwaremanager',))
         lastfp = dp.get(nodename, {}).get('pubkeys.tls_hardwaremanager',
@@ -605,9 +682,9 @@ def detected(info):
     #TODO(jjohnson2): We might have to get UUID for certain searches...
     #for now defer probe until inside eval_node.  We might not have
     #a nodename without probe in the future.
-    if nodename:
+    if nodename and handler:
         eval_node(cfg, handler, info, nodename)
-    else:
+    elif handler:
         log.log(
             {'info': 'Detected unknown {0} with hwaddr {1} at '
                      'address {2}'.format(
@@ -617,16 +694,108 @@ def detected(info):
         unknown_info[info['hwaddr']] = info
 
 
+
+def b64tohex(b64str):
+    bd = base64.b64decode(b64str)
+    return ''.join(['{0:02x}'.format(ord(x)) for x in bd])
+
+
+def get_enclosure_chain_head(nodename, cfg):
+    ne = True
+    members = [nodename]
+    while ne:
+        ne = cfg.get_node_attributes(
+            nodename, 'enclosure.extends').get(nodename, {}).get(
+            'enclosure.extends', {}).get('value', None)
+        if not ne:
+            return nodename
+        if ne in members:
+            raise exc.InvalidArgumentException(
+                'Circular chain that includes ' + nodename)
+        if not cfg.is_node(ne):
+            raise exc.InvalidArgumentException(
+                '{0} is chained to nonexistent node {1} '.format(
+                    nodename, ne))
+        nodename = ne
+        members.append(nodename)
+    return nodename
+
+
+def get_chained_smm_name(nodename, cfg, handler, nl=None, checkswitch=True):
+    # nodename is the head of the chain, cfg is a configmanager, handler
+    # is the handler of the current candidate, nl is optional indication
+    # of the next link in the chain, checkswitch can disable the switch
+    # search if not indicated by current situation
+    # returns the new name and whether it has been securely validated or not
+    # first we check to see if directly connected
+    mycert = handler.https_cert
+    if checkswitch:
+        fprints = macmap.get_node_fingerprints(nodename, cfg)
+        for fprint in fprints:
+            if util.cert_matches(fprint[0], mycert):
+                # ok we have a direct match, it is this node
+                return nodename, fprint[1]
+    # ok, unable to get it, need to traverse the chain from the beginning
+    if not nl:
+        nl = list(cfg.filter_node_attributes(
+            'enclosure.extends=' + nodename))
+    while nl:
+        if len(nl) != 1:
+            raise exc.InvalidArgumentException('Multiple enclosures trying to '
+                                               'extend a single enclosure')
+        cd = cfg.get_node_attributes(nodename, ['hardwaremanagement.manager',
+                                                'pubkeys.tls_hardwaremanager'])
+        smmaddr = cd[nodename]['hardwaremanagement.manager']['value']
+        pkey = cd[nodename].get('pubkeys.tls_hardwaremanager', {}).get(
+            'value', None)
+        if not pkey:
+            # We cannot continue through a break in the chain
+            return None, False
+        if pkey:
+            cv = util.TLSCertVerifier(
+                cfg, nodename, 'pubkeys.tls_hardwaremanager').verify_cert
+            for fprint in get_smm_neighbor_fingerprints(smmaddr, cv):
+                if util.cert_matches(fprint, mycert):
+                    # a trusted chain member vouched for the cert
+                    # so it's validated
+                    return nl[0], True
+            # advance down the chain by one and try again
+        nodename = nl[0]
+        nl = list(cfg.filter_node_attributes(
+            'enclosure.extends=' + nodename))
+    return None, False
+
+
+def get_smm_neighbor_fingerprints(smmaddr, cv):
+    if ':' in smmaddr:
+        smmaddr = '[{0}]'.format(smmaddr)
+    wc = webclient.SecureHTTPConnection(smmaddr, verifycallback=cv)
+    neighs = wc.grab_json_response('/scripts/neighdata.json')
+    if not neighs:
+        return
+    for idx in (4, 5):
+        if 'sha256' not in neighs[idx]:
+            continue
+        yield 'sha256$' + b64tohex(neighs[idx]['sha256'])
+
+
 def get_nodename(cfg, handler, info):
     nodename = None
     maccount = None
+    info['verified'] = False
+    if not handler:
+        return None, None
     if handler.https_supported:
         currcert = handler.https_cert
         if not currcert:
             info['discofailure'] = 'nohttps'
             return None, None
-        currprint = util.get_fingerprint(currcert)
+        currprint = util.get_fingerprint(currcert, 'sha256')
         nodename = nodes_by_fprint.get(currprint, None)
+        if not nodename:
+            # Try SHA512 as well
+            currprint = util.get_fingerprint(currcert)
+            nodename = nodes_by_fprint.get(currprint, None)
     if not nodename:
         curruuid = info.get('uuid', None)
         if uuid_is_valid(curruuid):
@@ -634,9 +803,31 @@ def get_nodename(cfg, handler, info):
             if nodename is None:
                 _map_unique_ids()
                 nodename = nodes_by_uuid.get(curruuid, None)
-    if not nodename:  # as a last resort, search switch for info
+    if not nodename:
+        # Ok, see if it is something with a chassis-uuid and discover by
+        # chassis
+        nodename = get_nodename_from_enclosures(cfg, info)
+    if not nodename and handler.devname == 'SMM':
+        nodename = get_nodename_from_chained_smms(cfg, handler, info)
+    if not nodename:  # as a last resort, search switches for info
+        # This is the slowest potential operation, so we hope for the
+        # best to occur prior to this
         nodename, macinfo = macmap.find_nodeinfo_by_mac(info['hwaddr'], cfg)
         maccount = macinfo['maccount']
+        if nodename:
+            if handler.devname == 'SMM':
+                nl = list(cfg.filter_node_attributes(
+                            'enclosure.extends=' + nodename))
+                if nl:
+                    # We found an SMM, and it's in a chain per configuration
+                    # we need to ask the switch for the fingerprint to see
+                    # if we have a match or not
+                    newnodename, v = get_chained_smm_name(nodename, cfg,
+                                                          handler, nl)
+                    if newnodename:
+                        # while this started by switch, it was disambiguated
+                        info['verified'] = v
+                        return newnodename, None
         if (nodename and
                 not handler.discoverable_by_switch(macinfo['maccount'])):
             if handler.devname == 'SMM':
@@ -650,10 +841,44 @@ def get_nodename(cfg, handler, info):
     return nodename, maccount
 
 
+def get_nodename_from_chained_smms(cfg, handler, info):
+    nodename = None
+    for fprint in get_smm_neighbor_fingerprints(
+            handler.ipaddr, lambda x: True):
+        if fprint in nodes_by_fprint:
+            # need to chase the whole chain
+            # to support either direction
+            chead = get_enclosure_chain_head(nodes_by_fprint[fprint],
+                                             cfg)
+            newnodename, v = get_chained_smm_name(
+                chead, cfg, handler, checkswitch=False)
+            if newnodename:
+                info['verified'] = v
+                nodename = newnodename
+    return nodename
+
+
+def get_nodename_from_enclosures(cfg, info):
+    nodename = None
+    cuuid = info.get('attributes', {}).get('chassis-uuid', [None])[0]
+    if cuuid and cuuid in nodes_by_uuid:
+        encl = nodes_by_uuid[cuuid]
+        bay = info.get('enclosure.bay', None)
+        if bay:
+            tnl = cfg.filter_node_attributes('enclosure.manager=' + encl)
+            tnl = list(
+                cfg.filter_node_attributes('enclosure.bay={0}'.format(bay),
+                                           tnl))
+            if len(tnl) == 1:
+                # This is not a secure assurance, because it's by
+                # uuid instead of a key
+                nodename = tnl[0]
+    return nodename
+
+
 def eval_node(cfg, handler, info, nodename, manual=False):
     try:
         handler.probe()  # unicast interrogation as possible to get more data
-        # for now, we search switch only, ideally we search cmm, smm, and
         # switch concurrently
         # do some preconfig, for example, to bring a SMM online if applicable
         handler.preconfig()
@@ -684,6 +909,7 @@ def eval_node(cfg, handler, info, nodename, manual=False):
     if not handler.is_enclosure and nl:
         # The specified node is an enclosure (has nodes mapped to it), but
         # what we are talking to is *not* an enclosure
+        # might be ambiguous, need to match chassis-uuid as well..
         if 'enclosure.bay' not in info:
             unknown_info[info['hwaddr']] = info
             info['discostatus'] = 'unidentified'
@@ -695,14 +921,39 @@ def eval_node(cfg, handler, info, nodename, manual=False):
                 raise exc.InvalidArgumentException(errorstr)
             log.log({'error': errorstr})
             return
+        enl = list(cfg.filter_node_attributes('enclosure.extends=' + nodename))
+        if enl:
+            # ambiguous SMM situation according to the configuration, we need
+            # to match uuid
+            encuuid = info['attributes'].get('chassis-uuid', None)
+            if encuuid:
+                encuuid = encuuid[0]
+                enl = list(cfg.filter_node_attributes('id.uuid=' + encuuid))
+                if len(enl) != 1:
+                    # errorstr = 'No SMM by given UUID known, *yet*'
+                    # if manual:
+                    #     raise exc.InvalidArgumentException(errorstr)
+                    # log.log({'error': errorstr})
+                    if encuuid in pending_by_uuid:
+                        pending_by_uuid[encuuid].add(info)
+                    else:
+                        pending_by_uuid[encuuid] = set([info])
+                    return
+                # We found the real smm, replace the list with the actual smm
+                # to continue
+                nl = list(cfg.filter_node_attributes(
+                    'enclosure.manager=' + enl[0]))
+            else:
+                errorstr = 'Chained SMM configuration with older XCC, ' \
+                           'unable to perform zero power discovery'
+                if manual:
+                    raise exc.InvalidArgumentException(errorstr)
+                log.log({'error': errorstr})
+                return
         # search for nodes fitting our description using filters
         # lead with the most specific to have a small second pass
-        nl = cfg.filter_node_attributes(
-            'enclosure.bay={0}'.format(info['enclosure.bay']), nl)
-        nl = list(nl)
-        # sadly, we cannot detect when user has a daisy chain smm config
-        # without ability to disambiguate, however the SMM will be caught so
-        # at least one actionable error will be encountered.
+        nl = list(cfg.filter_node_attributes(
+            'enclosure.bay={0}'.format(info['enclosure.bay']), nl))
         if len(nl) != 1:
             info['discofailure'] = 'ambigconfig'
             if len(nl):
@@ -731,16 +982,26 @@ def eval_node(cfg, handler, info, nodename, manual=False):
         # we can and did accurately discover by switch or in enclosure
         # but... is this really ok?  could be on an upstream port or
         # erroneously put in the enclosure with no nodes yet
-        if (info['maccount'] and
-                not handler.discoverable_by_switch(info['maccount'])):
-            errorstr = 'The detected node {0} was detected using switch, ' \
-                       'however the relevant port has too many macs learned ' \
-                       'for this type of device ({1}) to be discovered by ' \
-                       'switch.'.format(nodename, handler.devname)
-            if manual:
-                raise exc.InvalidArgumentException(errorstr)
-            log.log({'error': errorstr})
-            return
+        # so first, see if the candidate node is a chain host
+        if not manual:
+            if info.get('maccount', False):
+                # discovery happened through switch
+                nl = list(cfg.filter_node_attributes(
+                    'enclosure.extends=' + nodename))
+                if nl:
+                    # The candidate nodename is the head of a chain, we must
+                    # validate the smm certificate by the switch
+                    macmap.get_node_fingerprint(nodename, cfg)
+                    util.handler.cert_matches(fprint, handler.https_cert)
+                    return
+            if (info.get('maccount', False) and
+                    not handler.discoverable_by_switch(info['maccount'])):
+                errorstr = 'The detected node {0} was detected using switch, ' \
+                           'however the relevant port has too many macs learned ' \
+                           'for this type of device ({1}) to be discovered by ' \
+                           'switch.'.format(nodename, handler.devname)
+                log.log({'error': errorstr})
+                return
         if not discover_node(cfg, handler, info, nodename, manual):
             pending_nodes[nodename] = info
 
@@ -764,6 +1025,7 @@ def discover_node(cfg, handler, info, nodename, manual):
     # the pubkeys, which is deferred for a little bit
     # Also, 'secure', when we have the needed infrastructure done
     # in some product or another.
+    curruuid = info.get('uuid', False)
     if 'pxe' in policies and info['handler'] == pxeh:
         return do_pxe_discovery(cfg, handler, info, manual, nodename, policies)
     elif ('permissive' in policies and handler.https_supported and lastfp and
@@ -794,6 +1056,14 @@ def discover_node(cfg, handler, info, nodename, manual):
                 traceback.print_exc()
                 return False
             newnodeattribs = {}
+            if cfm.list_collective():
+                # We are in a collective, check collective.manager
+                cmc = cfg.get_node_attributes(nodename, 'collective.manager')
+                cm = cmc.get(nodename, {}).get('collective.manager', {}).get('value', None)
+                if not cm:
+                    # Node is being discovered in collective, but no collective.manager, default
+                    # to the collective member actually able to execute the discovery
+                    newnodeattribs['collective.manager'] = collective.get_myname()
             if 'uuid' in info:
                 newnodeattribs['id.uuid'] = info['uuid']
             if 'serialnumber' in info:
@@ -802,12 +1072,14 @@ def discover_node(cfg, handler, info, nodename, manual):
                 newnodeattribs['id.model'] = info['modelnumber']
             if handler.https_cert:
                 newnodeattribs['pubkeys.tls_hardwaremanager'] = \
-                    util.get_fingerprint(handler.https_cert)
+                    util.get_fingerprint(handler.https_cert, 'sha256')
             if newnodeattribs:
                 cfg.set_node_attributes({nodename: newnodeattribs})
             log.log({'info': 'Discovered {0} ({1})'.format(nodename,
                                                           handler.devname)})
         info['discostatus'] = 'discovered'
+        for i in pending_by_uuid.get(curruuid, []):
+            eventlet.spawn_n(_recheck_single_unknown_info, cfg, i)
         return True
     log.log({'info': 'Detected {0}, but discovery.policy is not set to a '
                      'value allowing discovery (open or permissive)'.format(
@@ -857,6 +1129,7 @@ needaddhandled = False
 def _handle_nodelist_change(configmanager):
     global needaddhandled
     global nodeaddhandler
+    macmap.vintage = 0  # the current mac map is probably inaccurate
     _recheck_nodes((), configmanager)
     if needaddhandled:
         needaddhandled = False
@@ -865,16 +1138,26 @@ def _handle_nodelist_change(configmanager):
         nodeaddhandler = None
 
 
-def newnodes(added, deleting, configmanager):
+def newnodes(added, deleting, renamed, configmanager):
     global attribwatcher
     global needaddhandled
     global nodeaddhandler
+    alldeleting = set(deleting) | set(renamed)
+    for node in alldeleting:
+        if node not in known_nodes:
+            continue
+        for mac in known_nodes[node]:
+            if mac in known_info:
+                del known_info[mac]
+        del known_nodes[node]
+    _map_unique_ids()
     configmanager.remove_watcher(attribwatcher)
     allnodes = configmanager.list_nodes()
     attribwatcher = configmanager.watch_attributes(
         allnodes, ('discovery.policy', 'net*.switch',
-                   'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
-                   'pubkeys.tls_hardwaremanager', 'net*.bootable'), _recheck_nodes)
+                   'hardwaremanagement.manager', 'net*.switchport',
+                   'id.uuid', 'pubkeys.tls_hardwaremanager',
+                   'net*.bootable'), _recheck_nodes)
     if nodeaddhandler:
         needaddhandled = True
     else:
@@ -906,7 +1189,11 @@ def _periodic_recheck(configmanager):
 
 def rescan():
     _map_unique_ids()
-    eventlet.spawn_n(slp.active_scan, safe_detected)
+    global scanner
+    if scanner:
+        return
+    else:
+        scanner = eventlet.spawn(slp.active_scan, safe_detected, slp)
 
 
 def start_detection():
@@ -920,14 +1207,23 @@ def start_detection():
                    'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
                    'pubkeys.tls_hardwaremanager'), _recheck_nodes)
     cfg.watch_nodecollection(newnodes)
-    eventlet.spawn_n(slp.snoop, safe_detected)
-    eventlet.spawn_n(pxe.snoop, safe_detected)
+    autosense = cfm.get_global('discovery.autosense')
+    if autosense or autosense is None:
+        start_autosense()
     if rechecker is None:
         rechecktime = util.monotonic_time() + 900
         rechecker = eventlet.spawn_after(900, _periodic_recheck, cfg)
 
     # eventlet.spawn_n(ssdp.snoop, safe_detected)
 
+def stop_autosense():
+    for watcher in list(autosensors):
+        watcher.kill()
+        autosensors.discard(watcher)
+
+def start_autosense():
+    autosensors.add(eventlet.spawn(slp.snoop, safe_detected, slp))
+    autosensors.add(eventlet.spawn(pxe.snoop, safe_detected, pxe))
 
 
 nodes_by_fprint = {}
@@ -949,7 +1245,7 @@ def _map_unique_ids(nodes=None):
     uuid_by_nodes = {}
     fprint_by_nodes = {}
     for uuid in nodes_by_uuid:
-        if not uuid_is_valid():
+        if not uuid_is_valid(uuid):
             continue
         node = nodes_by_uuid[uuid]
         if node in bigmap:

confluent_server/confluent/discovery/handlers/bmc.py

@@ -32,10 +32,21 @@ DEFAULT_PASS = 'PASSW0RD'
 
 class NodeHandler(generic.NodeHandler):
 
-    def _get_ipmicmd(self, user=DEFAULT_USER, password=DEFAULT_PASS):
-        return ipmicommand.Command(self.ipaddr, user, password)
+    def _get_ipmicmd(self, user=None, password=None):
+        priv = None
+        if user is None or password is None:
+            if self.trieddefault:
+                raise pygexc.IpmiException()
+            priv = 4  # manually indicate priv to avoid double-attempt
+        if user is None:
+            user = DEFAULT_USER
+        if password is None:
+            password = DEFAULT_PASS
+        return ipmicommand.Command(self.ipaddr, user, password,
+                                   privlevel=priv, keepalive=False)
 
     def __init__(self, info, configmanager):
+        self.trieddefault = None
         super(NodeHandler, self).__init__(info, configmanager)
 
     def probe(self):
@@ -45,7 +56,7 @@ class NodeHandler(generic.NodeHandler):
     def config(self, nodename, reset=False):
         self._bmcconfig(nodename, reset)
 
-    def _bmcconfig(self, nodename, reset=False):
+    def _bmcconfig(self, nodename, reset=False, customconfig=None):
         # TODO(jjohnson2): set ip parameters, user/pass, alert cfg maybe
         # In general, try to use https automation, to make it consistent
         # between hypothetical secure path and today.
@@ -74,6 +85,8 @@ class NodeHandler(generic.NodeHandler):
                 ic = self._get_ipmicmd(user, passwd)
             else:
                 raise
+        if customconfig:
+            customconfig(ic)
         currusers = ic.get_users()
         lanchan = ic.get_network_channel()
         userdata = ic.xraw_command(netfn=6, command=0x44, data=(lanchan,
@@ -107,9 +120,14 @@ class NodeHandler(generic.NodeHandler):
             netconfig = netutil.get_nic_config(cfg, nodename, ip=newip)
             plen = netconfig['prefix']
             newip = '{0}/{1}'.format(newip, plen)
-            ic.set_net_configuration(ipv4_address=newip,
-                                     ipv4_configuration='static',
-                                     ipv4_gateway=netconfig['ipv4_gateway'])
+            currcfg = ic.get_net_configuration()
+            if currcfg['ipv4_address'] != newip:
+                # do not change the ipv4_config if the current config looks
+                # like it is already accurate
+                ic.set_net_configuration(ipv4_address=newip,
+                                         ipv4_configuration='static',
+                                         ipv4_gateway=netconfig[
+                                             'ipv4_gateway'])
         elif self.ipaddr.startswith('fe80::'):
             cfg.set_node_attributes(
                 {nodename: {'hardwaremanagement.manager': self.ipaddr}})
@@ -122,16 +140,18 @@ class NodeHandler(generic.NodeHandler):
             if currusers[uid]['name'] == newuser:
                 # Use existing account that has been created
                 newuserslot = uid
+                if newpass != passwd:  # don't mess with existing if no change
+                    ic.set_user_password(newuserslot, password=newpass)
                 break
         else:
             newuserslot = lockedusers + 1
             if newuserslot < 2:
                 newuserslot = 2
+            if newpass != passwd:  # don't mess with existing if no change
+                ic.set_user_password(newuserslot, password=newpass)
             ic.set_user_name(newuserslot, newuser)
             ic.set_user_access(newuserslot, lanchan,
                                privilege_level='administrator')
-        if newpass != passwd:  # don't mess with existing if no change
-            ic.set_user_password(newuserslot, password=newpass)
         # Now to zap others
         for uid in currusers:
             if uid != newuserslot:

confluent_server/confluent/discovery/handlers/generic.py

@@ -40,6 +40,12 @@ class NodeHandler(object):
                 targsa = info['addresses'][0]
         self.ipaddr = targsa[0]
 
+    @classmethod
+    def adequate(cls, info):
+        # Check if the referenced info is really enough, if false, a rescan
+        # may occur against the target in a short while
+        return True
+
     def scan(self):
         # Do completely passive things to enhance data.
         # Probe is permitted to for example attempt a login
@@ -62,6 +68,23 @@ class NodeHandler(object):
     def _savecert(self, certificate):
         self._fp = certificate
         return True
+    
+    def get_node_credentials(self, nodename, creds, defuser, defpass):
+        user = creds.get(nodename, {}).get(
+            'secret.hardwaremanagementuser', {}).get('value', None)
+        havecustomcreds = False
+        if user is not None and user != defuser:
+            havecustomcreds = True
+        else:
+            user = defuser
+        passwd = creds.get(nodename, {}).get(
+            'secret.hardwaremanagementpassword', {}).get('value', None)
+        if passwd is not None and passwd != defpass:
+            havecustomcreds = True
+        else:
+            passwd = defpass
+        return user, passwd, not havecustomcreds
+
 
     @property
     def cert_fail_reason(self):

confluent_server/confluent/discovery/handlers/imm.py

@@ -15,12 +15,17 @@
 import confluent.discovery.handlers.bmc as bmchandler
 import pyghmi.exceptions as pygexc
 import pyghmi.ipmi.private.util as pygutil
-import string
 import struct
 
 class NodeHandler(bmchandler.NodeHandler):
     devname = 'IMM'
 
+    @classmethod
+    def adequate(cls, info):
+        # We can sometimes receive a partially initialized SLP packet
+        # This is not adequate for being satisfied
+        return bool(info.get('attributes', {}))
+
     def scan(self):
         slpattrs = self.info.get('attributes', {})
         self.isdense = False
@@ -38,7 +43,7 @@ class NodeHandler(bmchandler.NodeHandler):
                          uuidprefix[12:16]
             self.info['uuid'] = uuidprefix + '-' + '-'.join(
                 wronguuid.split('-')[3:])
-            self.info['uuid'] = string.lower(self.info['uuid'])
+            self.info['uuid'] = self.info['uuid'].lower()
         if ff not in ('dense-computing', 'BC2'):
             # do not probe unless it's a dense platform
             return

confluent_server/confluent/discovery/handlers/smm.py

@@ -36,9 +36,42 @@ class NodeHandler(bmchandler.NodeHandler):
             uuid = fixuuid(uuid[0])
             self.info['uuid'] = uuid
 
+    def _validate_cert(self, certificate):
+        # Assumption is by the time we call config, that discovery core has
+        # vetted self._fp.  Our job here then is just to make sure that
+        # the currect connection matches the previously saved cert
+        return certificate == self._fp
+
+    def set_password_policy(self, ic):
+        rules = []
+        for rule in self.ruleset.split(','):
+            if '=' not in rule:
+                continue
+            name, value = rule.split('=')
+            if value.lower() in ('no', 'none', 'disable', 'disabled'):
+                value = '0'
+            if name.lower() in ('expiry', 'expiration'):
+                rules.append('passwordDurationDays:' + value)
+                warndays = '5' if int(value) > 5 else value
+                rules.append('passwordExpireWarningDays:' + warndays)
+            if name.lower() in ('lockout', 'loginfailures'):
+                rules.append('passwordFailAllowdNum:' + value)
+            if name.lower() == 'reuse':
+                rules.append('passwordReuseCheckNum:' + value)
+        if rules:
+            apirequest = 'set={0}'.format(','.join(rules))
+            ic.register_key_handler(self._validate_cert)
+            ic.oem_init()
+            ic._oem.smmhandler.wc.request('POST', '/data', apirequest)
+            ic._oem.smmhandler.wc.getresponse().read()
+
     def config(self, nodename):
         # SMM for now has to reset to assure configuration applies
-        super(NodeHandler, self).config(nodename)
+        dpp = self.configmanager.get_node_attributes(
+            nodename, 'discovery.passwordrules')
+        self.ruleset = dpp.get(nodename, {}).get(
+            'discovery.passwordrules', {}).get('value', '')
+        ic = self._bmcconfig(nodename, customconfig=self.set_password_policy)
 
 # notes for smm:
 # POST to:

confluent_server/confluent/discovery/handlers/xcc.py

@@ -1,4 +1,4 @@
-# Copyright 2017 Lenovo
+# Copyright 2017-2019 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,19 +12,52 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import base64
 import confluent.discovery.handlers.imm as immhandler
+import confluent.netutil as netutil
+import confluent.util as util
+import eventlet
+import eventlet.support.greendns
+import json
+import os
 import pyghmi.exceptions as pygexc
-import pyghmi.ipmi.oem.lenovo.imm as imm
+xcc = eventlet.import_patched('pyghmi.redfish.oem.lenovo.xcc')
+import pyghmi.util.webclient as webclient
+import struct
+getaddrinfo = eventlet.support.greendns.getaddrinfo
+
+
+def fixup_uuid(uuidprop):
+    baduuid = ''.join(uuidprop.split())
+    uuidprefix = (baduuid[:8], baduuid[8:12], baduuid[12:16])
+    a = struct.pack('<IHH', *[int(x, 16) for x in uuidprefix]).encode('hex')
+    uuid = (a[:8], a[8:12], a[12:16], baduuid[16:20], baduuid[20:])
+    return '-'.join(uuid).upper()
+
 
 
 
 class NodeHandler(immhandler.NodeHandler):
     devname = 'XCC'
 
+    def __init__(self, info, configmanager):
+        self._xcchdlr = None
+        self._wc = None
+        self.nodename = None
+        self._atdefaultcreds = True
+        super(NodeHandler, self).__init__(info, configmanager)
+
+    @classmethod
+    def adequate(cls, info):
+        # We can sometimes receive a partially initialized SLP packet
+        # This is not adequate for being satisfied
+        return bool(info.get('attributes', {}))
+
     def preconfig(self):
         ff = self.info.get('attributes', {}).get('enclosure-form-factor', '')
         if ff not in ('dense-computing', [u'dense-computing']):
             return
+        self.trieddefault = None  # Reset state on a preconfig attempt
         # attempt to enable SMM
         #it's normal to get a 'not supported' (193) for systems without an SMM
         ipmicmd = None
@@ -36,27 +69,196 @@ class NodeHandler(immhandler.NodeHandler):
                     'Incorrect password' not in str(e)):
                 # raise an issue if anything other than to be expected
                 raise
+            self.trieddefault = True
         #TODO: decide how to clean out if important
         #as it stands, this can step on itself
         #if ipmicmd:
         #    ipmicmd.ipmi_session.logout()
 
+    def validate_cert(self, certificate):
+        # broadly speaking, merely checks consistency moment to moment,
+        # but if https_cert gets stricter, this check means something
+        fprint = util.get_fingerprint(self.https_cert)
+        return util.cert_matches(fprint, certificate)
+
+    @property
+    def wc(self):
+        if self._wc is None:
+            self._wc = webclient.SecureHTTPConnection(
+                self.ipaddr, 443, verifycallback=self.validate_cert)
+            self._wc.connect()
+            self._xcchdlr = xcc.OEMHandler(None, None, self._wc, False)
+        if not self.trieddefault:
+            self._xcchdlr.set_credentials('USERID', 'PASSW0RD')
+            wc = self._xcchdlr.get_webclient()
+            if wc:
+                return wc
+        self.trieddefault = True
+        creds = self.configmanager.get_node_attributes(
+            self.nodename, ['secret.hardwaremanagementuser',
+            'secret.hardwaremanagementpassword'], decrypt=True)
+        user, passwd, isdefault = self.get_node_credentials(
+            self.nodename, creds, 'USERID', 'PASSW0RD')
+        if isdefault:
+            return
+        self._atdefaultcreds = False
+        self._xcchdlr.set_credentials(user, passwd)
+        wc = self._xcchdlr.get_webclient()
+        if wc:
+            return wc
+
+    def set_password_policy(self):
+        ruleset = {'USER_GlobalMinPassChgInt': '0'}
+        for rule in self.ruleset.split(','):
+            if '=' not in rule:
+                continue
+            name, value = rule.split('=')
+            if value.lower() in ('no', 'none', 'disable', 'disabled'):
+                value = '0'
+            if name.lower() in ('expiry', 'expiration'):
+                ruleset['USER_GlobalPassExpPeriod'] = value
+                if int(value) < 5:
+                    ruleset['USER_GlobalPassExpWarningPeriod'] = value
+            if name.lower() in ('lockout', 'loginfailures'):
+                if value.lower() in ('no', 'none', 'disable', 'disabled'):
+                    value = '0'
+                ruleset['USER_GlobalMaxLoginFailures'] = value
+            if name.lower() == 'complexity':
+                ruleset['USER_GlobalPassComplexRequired'] = value
+            if name.lower() == 'reuse':
+                ruleset['USER_GlobalMinPassReuseCycle'] = value
+        try:
+            self.wc.grab_json_response('/api/dataset', ruleset)
+        except Exception as e:
+            print(repr(e))
+            pass
+
+    def _get_next_userid(self, wc):
+        userinfo = wc.grab_json_response('/api/dataset/imm_users')
+        userinfo = userinfo['items'][0]['users']
+        for user in userinfo:
+            if user['users_user_name'] == '':
+                return user['users_user_id']
+
+    def _setup_xcc_account(self, username, passwd, wc):
+        userinfo = wc.grab_json_response('/api/dataset/imm_users')
+        uid = None
+        for user in userinfo['items'][0]['users']:
+            if user['users_user_name'] == username:
+                uid = user['users_user_id']
+                break
+        else:
+            for user in userinfo['items'][0]['users']:
+                if user['users_user_name'] == 'USERID':
+                    uid = user['users_user_id']
+                    break
+        if not uid:
+            raise Exception("XCC has neither the default user nor configured user")
+        # The following will work if the password is force change or normal..
+        wc.grab_json_response('/api/function',
+                             {'USER_UserPassChange': '{0},{1}'.format(uid, passwd)})
+        if username != 'USERID':
+            wc.grab_json_response(
+                '/api/function',
+                {'USER_UserModify': '{0},{1},,1,4,0,0,0,0,,8,'.format(uid, username)})
+
+    def _convert_sha256account(self, user, passwd, wc):
+        # First check if the specified user is sha256...
+        userinfo = wc.grab_json_response('/api/dataset/imm_users')
+        curruser = None
+        uid = None
+        for userent in userinfo['items'][0]['users']:
+            if userent['users_user_name'] == user:
+                curruser = userent
+                break
+        if curruser.get('users_pass_is_sha256', 0):
+            self._wc = None
+            wc = self.wc
+            nwc = wc.dupe()
+            # Have to convert it for being useful with most Lenovo automation tools
+            # This requires deleting the account entirely and trying again
+            tmpuid = self._get_next_userid(wc)
+            try:
+                tpass = base64.b64encode(os.urandom(9)) + 'Iw47$'
+                userparams = "{0},6pmu0ezczzcp,{1},1,4,0,0,0,0,,8,".format(tmpuid, tpass)
+                result = wc.grab_json_response('/api/function', {'USER_UserCreate': userparams})
+                adata = json.dumps({
+                    'username': '6pmu0ezczzcp',
+                    'password': tpass,
+                })
+                headers = {'Connection': 'keep-alive', 'Content-Type': 'application/json'}
+                nwc.request('POST', '/api/login', adata, headers)
+                rsp = nwc.getresponse()
+                if rsp.status == 200:
+                    rspdata = json.loads(rsp.read())
+                    nwc.set_header('Content-Type', 'application/json')
+                    nwc.set_header('Authorization', 'Bearer ' + rspdata['access_token'])
+                    if '_csrf_token' in wc.cookies:
+                        nwc.set_header('X-XSRF-TOKEN', wc.cookies['_csrf_token'])
+                    if rspdata.get('reason', False):
+                        newpass = base64.b64encode(os.urandom(9)) + 'q4J$'
+                        nwc.grab_json_response(
+                            '/api/function',
+                            {'USER_UserPassChange': '{0},{1}'.format(tmpuid, newpass)})
+                    nwc.grab_json_response('/api/function', {'USER_UserDelete': "{0},{1}".format(curruser['users_user_id'], user)})
+                    userparams = "{0},{1},{2},1,4,0,0,0,0,,8,".format(curruser['users_user_id'], user, passwd)
+                    nwc.grab_json_response('/api/function', {'USER_UserCreate': userparams})
+            finally:
+                self._wc = None
+                self.wc.grab_json_response('/api/function', {'USER_UserDelete': "{0},{1}".format(tmpuid, '6pmu0ezczzcp')})
+
     def config(self, nodename, reset=False):
+        self.nodename = nodename
         # TODO(jjohnson2): set ip parameters, user/pass, alert cfg maybe
         # In general, try to use https automation, to make it consistent
         # between hypothetical secure path and today.
-        ic = self._bmcconfig(nodename)
+        dpp = self.configmanager.get_node_attributes(
+            nodename, 'discovery.passwordrules')
+        self.ruleset = dpp.get(nodename, {}).get(
+            'discovery.passwordrules', {}).get('value', '')
+        wc = self.wc
+        creds = self.configmanager.get_node_attributes(
+            self.nodename, ['secret.hardwaremanagementuser',
+            'secret.hardwaremanagementpassword'], decrypt=True)
+        user, passwd, isdefault = self.get_node_credentials(nodename, creds, 'USERID', 'PASSW0RD')
+        self.set_password_policy()
+        if self._atdefaultcreds:
+            if not isdefault:
+                self._setup_xcc_account(user, passwd, wc)
+        self._convert_sha256account(user, passwd, wc)
+        cd = self.configmanager.get_node_attributes(
+            nodename, ['secret.hardwaremanagementuser',
+                       'secret.hardwaremanagementpassword',
+                       'hardwaremanagement.manager'], True)
+        cd = cd.get(nodename, {})
+        if ('hardwaremanagement.manager' in cd and
+                cd['hardwaremanagement.manager']['value'] and
+                not cd['hardwaremanagement.manager']['value'].startswith(
+                    'fe80::')):
+            newip = cd['hardwaremanagement.manager']['value']
+            newipinfo = getaddrinfo(newip, 0)[0]
+            newip = newipinfo[-1][0]
+            if ':' in newip:
+                raise exc.NotImplementedException('IPv6 remote config TODO')
+            netconfig = netutil.get_nic_config(self.configmanager, nodename, ip=newip)
+            newmask = netutil.cidr_to_mask(netconfig['prefix'])
+            # do not change the ipv4_config if the current config looks
+            statargs = {'ENET_IPv4Ena': '1', 'ENET_IPv4AddrSource': '0', 'ENET_IPv4StaticIPAddr': newip, 'ENET_IPv4StaticIPNetMask': newmask}
+            if netconfig['ipv4_gateway']:
+                statargs['ENET_IPv4GatewayIPAddr'] = netconfig['ipv4_gateway']
+            wc.grab_json_response('/api/dataset', statargs)
+        elif self.ipaddr.startswith('fe80::'):
+            self.configmanager.set_node_attributes(
+                {nodename: {'hardwaremanagement.manager': self.ipaddr}})
+        else:
+            raise exc.TargetEndpointUnreachable(
+                'hardwaremanagement.manager must be set to desired address (No IPv6 Link Local detected)')
         ff = self.info.get('attributes', {}).get('enclosure-form-factor', '')
         if ff not in ('dense-computing', [u'dense-computing']):
             return
-        # Ok, we can get the enclosure uuid now..
-        ic.oem_init()
-        enclosureuuid = ic._oem.immhandler.get_property(
-            '/v2/ibmc/smm/chassis/uuid')
-        enclosureuuid = ic._oem.immhandler.get_property(
-            '/v2/ibmc/smm/chassis/uuid')
+        enclosureuuid = self.info.get('attributes', {}).get('chassis-uuid', [None])[0]
         if enclosureuuid:
-            enclosureuuid = imm.fixup_uuid(enclosureuuid).lower()
+            enclosureuuid = enclosureuuid.lower()
             em = self.configmanager.get_node_attributes(nodename,
                                                         'enclosure.manager')
             em = em.get(nodename, {}).get('enclosure.manager', {}).get(
@@ -65,8 +267,3 @@ class NodeHandler(immhandler.NodeHandler):
             if em:
                 self.configmanager.set_node_attributes(
                     {em: {'id.uuid': enclosureuuid}})
-
-# TODO(jjohnson2): web based init config for future prevalidated cert scheme
-#    def config(self, nodename):
-#        return
-

confluent_server/confluent/discovery/protocols/pxe.py

@@ -72,7 +72,7 @@ def find_info_in_options(rq, optidx):
         return uuid, arch
     return uuid, arch
 
-def snoop(handler):
+def snoop(handler, protocol=None):
     #TODO(jjohnson2): ipv6 socket and multicast for DHCPv6, should that be
     #prominent
     #TODO(jjohnson2): IP_PKTINFO, recvmsg to get the destination ip, per
@@ -92,7 +92,7 @@ def snoop(handler):
         rq = bytearray(rq)
         if rq[0] == 1:  # Boot request
             addrlen = rq[2]
-            if addrlen > 16:  # max address size in bootp is 16 bytes
+            if addrlen > 16 or addrlen == 0:
                 continue
             netaddr = rq[28:28+addrlen]
             netaddr = ':'.join(['{0:02x}'.format(x) for x in netaddr])

confluent_server/confluent/discovery/protocols/slp.py

@@ -16,13 +16,13 @@
 
 import confluent.neighutil as neighutil
 import confluent.util as util
+import confluent.log as log
 import os
 import random
 import eventlet.green.select as select
 import eventlet.green.socket as socket
 import struct
-import subprocess
-
+import traceback
 
 _slp_services = set([
     'service:management-hardware.IBM:integrated-management-module2',
@@ -30,6 +30,7 @@ _slp_services = set([
     'service:management-hardware.Lenovo:lenovo-xclarity-controller',
     'service:management-hardware.IBM:chassis-management-module',
     'service:management-hardware.Lenovo:chassis-management-module',
+    'service:io-device.Lenovo:management-module',
 ])
 
 # SLP has a lot of ambition that was unfulfilled in practice.
@@ -221,7 +222,13 @@ def _find_srvtype(net, net4, srvtype, addresses, xid):
             bcast = i4['broadcast']
             net4.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_IF,
                            socket.inet_aton(addr))
-            net4.sendto(data, ('239.255.255.253', 427))
+            try:
+                net4.sendto(data, ('239.255.255.253', 427))
+            except socket.error as se:
+                # On occasion, multicasting may be disabled
+                # tolerate this scenario and move on
+                if se.errno != 101:
+                    raise
             net4.sendto(data, (bcast, 427))
 
 
@@ -248,7 +255,7 @@ def _parse_attrlist(attrstr):
                 currattr = currattr.decode('utf-8')
                 attribs[currattr] = None
             else:
-                attrname, attrval = currattr.split('=')
+                attrname, attrval = currattr.split('=', 1)
                 attrname = attrname.decode('utf-8')
                 attribs[attrname] = []
                 for val in attrval.split(','):
@@ -288,9 +295,11 @@ def _parse_attrlist(attrstr):
     return attribs
 
 
-def _parse_attrs(data, parsed):
+def _parse_attrs(data, parsed, xid=None):
     headinfo = _parse_slp_header(data)
-    if headinfo['function'] != 7 or headinfo['xid'] != parsed['xid']:
+    if xid is None:
+        xid = parsed['xid']
+    if headinfo['function'] != 7 or headinfo['xid'] != xid:
         return
     payload = headinfo['payload']
     if struct.unpack('!H', bytes(payload[:2]))[0] != 0:
@@ -300,8 +309,18 @@ def _parse_attrs(data, parsed):
     parsed['attributes'] = _parse_attrlist(attrstr)
 
 
+def fix_info(info, handler):
+    if '_attempts' not in info:
+        info['_attempts'] = 10
+    if info['_attempts'] == 0:
+        return
+    info['_attempts'] -= 1
+    _add_attributes(info)
+    handler(info)
+
 def _add_attributes(parsed):
-    attrq = _generate_attr_request(parsed['services'][0], parsed['xid'])
+    xid = parsed.get('xid', 42)
+    attrq = _generate_attr_request(parsed['services'][0], xid)
     target = None
     # prefer reaching out to an fe80 if present, to be highly robust
     # in face of network changes
@@ -316,13 +335,14 @@ def _add_attributes(parsed):
     else:
         net = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     try:
+        net.settimeout(1.0)
         net.connect(target)
     except socket.error:
         return
     net.sendall(attrq)
     rsp = net.recv(8192)
     net.close()
-    _parse_attrs(rsp, parsed)
+    _parse_attrs(rsp, parsed, xid)
 
 
 def query_srvtypes(target):
@@ -344,6 +364,7 @@ def query_srvtypes(target):
     while tries and not connected:
         tries -= 1
         try:
+            net.settimeout(1.0)
             net.connect(target)
             connected = True
         except socket.error:
@@ -376,7 +397,7 @@ def rescan(handler):
             handler(scanned)
 
 
-def snoop(handler):
+def snoop(handler, protocol=None):
     """Watch for SLP activity
 
     handler will be called with a dictionary of relevant attributes
@@ -384,7 +405,8 @@ def snoop(handler):
     :param handler:
     :return:
     """
-    active_scan(handler)
+    tracelog = log.Logger('trace')
+    active_scan(handler, protocol)
     net = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
     net.setsockopt(IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
     slpg = socket.inet_pton(socket.AF_INET6, 'ff01::123')
@@ -413,57 +435,62 @@ def snoop(handler):
     net4.bind(('', 427))
 
     while True:
-        newmacs = set([])
-        r, _, _ = select.select((net, net4), (), (), 60)
-        # clear known_peers and peerbymacaddress
-        # to avoid stale info getting in...
-        # rely upon the select(0.2) to catch rapid fire and aggregate ip
-        # addresses that come close together
-        # calling code needs to understand deeper context, as snoop
-        # will now yield dupe info over time
-        known_peers = set([])
-        peerbymacaddress = {}
-        neighutil.update_neigh()
-        while r:
-            for s in r:
-                (rsp, peer) = s.recvfrom(9000)
-                ip = peer[0].partition('%')[0]
-                if ip not in neighutil.neightable:
-                    continue
-                if peer in known_peers:
-                    continue
-                known_peers.add(peer)
-                mac = neighutil.neightable[ip]
-                if mac in peerbymacaddress:
-                    peerbymacaddress[mac]['addresses'].append(peer)
-                else:
-                    q = query_srvtypes(peer)
-                    if not q or not q[0]:
-                        # SLP might have started and not ready yet
-                        # ignore for now
-                        known_peers.discard(peer)
+        try:
+            newmacs = set([])
+            r, _, _ = select.select((net, net4), (), (), 60)
+            # clear known_peers and peerbymacaddress
+            # to avoid stale info getting in...
+            # rely upon the select(0.2) to catch rapid fire and aggregate ip
+            # addresses that come close together
+            # calling code needs to understand deeper context, as snoop
+            # will now yield dupe info over time
+            known_peers = set([])
+            peerbymacaddress = {}
+            neighutil.update_neigh()
+            while r:
+                for s in r:
+                    (rsp, peer) = s.recvfrom(9000)
+                    ip = peer[0].partition('%')[0]
+                    if ip not in neighutil.neightable:
                         continue
-                    # we want to prioritize the very well known services
-                    svcs = []
-                    for svc in q:
-                        if svc in _slp_services:
-                            svcs.insert(0, svc)
-                        else:
-                            svcs.append(svc)
-                    peerbymacaddress[mac] = {
-                        'services': svcs,
-                        'addresses': [peer],
-                    }
-                newmacs.add(mac)
-            r, _, _ = select.select((net, net4), (), (), 0.2)
-        for mac in newmacs:
-            peerbymacaddress[mac]['xid'] = 1
-            _add_attributes(peerbymacaddress[mac])
-            peerbymacaddress[mac]['hwaddr'] = mac
-            handler(peerbymacaddress[mac])
+                    if peer in known_peers:
+                        continue
+                    known_peers.add(peer)
+                    mac = neighutil.neightable[ip]
+                    if mac in peerbymacaddress:
+                        peerbymacaddress[mac]['addresses'].append(peer)
+                    else:
+                        q = query_srvtypes(peer)
+                        if not q or not q[0]:
+                            # SLP might have started and not ready yet
+                            # ignore for now
+                            known_peers.discard(peer)
+                            continue
+                        # we want to prioritize the very well known services
+                        svcs = []
+                        for svc in q:
+                            if svc in _slp_services:
+                                svcs.insert(0, svc)
+                            else:
+                                svcs.append(svc)
+                        peerbymacaddress[mac] = {
+                            'services': svcs,
+                            'addresses': [peer],
+                        }
+                    newmacs.add(mac)
+                r, _, _ = select.select((net, net4), (), (), 0.2)
+            for mac in newmacs:
+                peerbymacaddress[mac]['xid'] = 1
+                _add_attributes(peerbymacaddress[mac])
+                peerbymacaddress[mac]['hwaddr'] = mac
+                peerbymacaddress[mac]['protocol'] = protocol
+                handler(peerbymacaddress[mac])
+        except Exception as e:
+            tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
+                         event=log.Events.stacktrace)
 
 
-def active_scan(handler):
+def active_scan(handler, protocol=None):
     known_peers = set([])
     for scanned in scan():
         for addr in scanned['addresses']:
@@ -474,6 +501,7 @@ def active_scan(handler):
                 break
             known_peers.add(addr)
         else:
+            scanned['protocol'] = protocol
             handler(scanned)
 
 

confluent_server/confluent/discovery/protocols/ssdp.py

@@ -167,6 +167,7 @@ def _find_service(service, target):
             net4.sendto(smsg.format(bcast, service), (bcast, 1900))
     # SSDP by spec encourages responses to spread out over a 3 second interval
     # hence we must be a bit more patient
+    deadline = util.monotonic_time() + 4
     r, _, _ = select.select((net4, net6), (), (), 4)
     peerdata = {}
     while r:
@@ -174,7 +175,10 @@ def _find_service(service, target):
             (rsp, peer) = s.recvfrom(9000)
             neighutil.refresh_neigh()
             _parse_ssdp(peer, rsp, peerdata)
-        r, _, _ = select.select((net4, net6), (), (), 4)
+        timeout = deadline - util.monotonic_time()
+        if timeout < 0:
+            timeout = 0
+        r, _, _ = select.select((net4, net6), (), (), timeout)
     for nid in peerdata:
         yield peerdata[nid]
 
@@ -191,10 +195,11 @@ def _parse_ssdp(peer, rsp, peerdata):
         _, code, _ = headlines[0].split(' ', 2)
     except ValueError:
         return
-    myurl = None
     if code == '200':
         if nid in peerdata:
             peerdatum = peerdata[nid]
+            if peer not in peerdatum['peers']:
+                peerdatum['peers'].append(peer)
         else:
             peerdatum = {
                 'peers': [peer],
@@ -208,7 +213,6 @@ def _parse_ssdp(peer, rsp, peerdata):
             header = header.strip()
             value = value.strip()
             if header == 'AL' or header == 'LOCATION':
-                myurl = value
                 if 'urls' not in peerdatum:
                     peerdatum['urls'] = [value]
                 elif value not in peerdatum['urls']:

confluent_server/confluent/exceptions.py

@@ -68,6 +68,11 @@ class LockedCredentials(ConfluentException):
     _apierrorstr = 'Credential store locked'
 
 
+class DegradedCollective(ConfluentException):
+    # We are in a collective with at least half of the member nodes missing
+    _apierrorstr = 'Collective does not have quorum'
+
+
 class ForbiddenRequest(ConfluentException):
     # The client request is not allowed by authorization engine
     apierrorcode = 403
@@ -101,6 +106,7 @@ class PubkeyInvalid(ConfluentException):
         super(PubkeyInvalid, self).__init__(self, text)
         self.fingerprint = fingerprint
         self.attrname = attribname
+        self.message = text
         bodydata = {'message': text,
                     'event': event,
                     'fingerprint': fingerprint,

confluent_server/confluent/firmwaremanager.py

@@ -19,19 +19,42 @@
 # the time comes
 
 import confluent.exceptions as exc
+import confluent.log as log
 import confluent.messages as msg
 import eventlet
+import os
+import pwd
+import socket
+import traceback
 
 updatesbytarget = {}
+uploadsbytarget = {}
+downloadsbytarget = {}
 updatepool = eventlet.greenpool.GreenPool(256)
+_tracelog = None
 
 
-def execupdate(handler, filename, updateobj):
+def execupdate(handler, filename, updateobj, type, owner, node):
+    global _tracelog
+    if type != 'ffdc' and not os.path.exists(filename):
+        errstr =  '{0} does not appear to exist on {1}'.format(
+            filename, socket.gethostname())
+        updateobj.handle_progress({'phase': 'error', 'progress': 0.0,
+                                   'detail': errstr})
+        return
+    if type == 'ffdc' and os.path.isdir(filename):
+        filename += '/' + node + '.svcdata'
     try:
-        completion = handler(filename, progress=updateobj.handle_progress,
-                             bank=updateobj.bank)
+        if type == 'firmware':
+            completion = handler(filename, progress=updateobj.handle_progress,
+                                 bank=updateobj.bank)
+        else:
+            completion = handler(filename, progress=updateobj.handle_progress)
         if completion is None:
             completion = 'complete'
+        if owner:
+            pwent = pwd.getpwnam(owner)
+            os.chown(filename, pwent.pw_uid, pwent.pw_gid)
         updateobj.handle_progress({'phase': completion, 'progress': 100.0})
     except exc.PubkeyInvalid as pi:
         errstr = 'Certificate mismatch detected, does not match value in ' \
@@ -39,31 +62,40 @@ def execupdate(handler, filename, updateobj):
         updateobj.handle_progress({'phase': 'error', 'progress': 0.0,
                                    'detail': errstr})
     except Exception as e:
+        if _tracelog is None:
+            _tracelog = log.Logger('trace')
+        _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event, event=log.Events.stacktrace)
         updateobj.handle_progress({'phase': 'error', 'progress': 0.0,
                                    'detail': str(e)})
 
 class Updater(object):
     def __init__(self, node, handler, filename, tenant=None, name=None,
-                 bank=None):
+                 bank=None, type='firmware', owner=None):
         self.bank = bank
         self.node = node
         self.phase = 'initializing'
         self.detail = ''
         self.percent = 0.0
-        #Change the below to a pool???
-        self.updateproc = updatepool.spawn(execupdate, handler, filename, self)
-        if (node, tenant) not in updatesbytarget:
-            updatesbytarget[(node, tenant)] = {}
+        self.updateproc = updatepool.spawn(execupdate, handler, filename,
+                                           self, type, owner, node)
+        if type == 'firmware':
+            myparty = updatesbytarget
+        elif type == 'mediaupload':
+            myparty = uploadsbytarget
+        elif type == 'ffdc':
+            myparty = downloadsbytarget
+        if (node, tenant) not in myparty:
+            myparty[(node, tenant)] = {}
         if name is None:
             name = 1
-            while '{0}'.format(name) in updatesbytarget[(node, tenant)]:
+            while '{0}'.format(name) in myparty[(node, tenant)]:
                 name += 1
         self.name = '{0}'.format(name)
-        updatesbytarget[(node, tenant)][self.name] = self
+        myparty[(node, tenant)][self.name] = self
 
     def handle_progress(self, progress):
-        self.phase = progress['phase']
-        self.percent = float(progress['progress'])
+        self.phase = progress.get('phase', 'unknown')
+        self.percent = float(progress.get('progress', 100.0))
         self.detail = progress.get('detail', '')
 
     def cancel(self):
@@ -75,34 +107,54 @@ class Updater(object):
                 'detail': self.detail}
 
 
-def remove_updates(nodes, tenant, element):
-    if len(element) < 5:
+def remove_updates(nodes, tenant, element, type='firmware'):
+    if len(element) < 5 and element[:2] != ['media', 'uploads']:
         raise exc.InvalidArgumentException()
     upid = element[-1]
+    if type == 'firmware':
+        myparty = updatesbytarget
+    elif type == 'ffdc':
+        myparty = downloadsbytarget
+    else:
+        myparty = uploadsbytarget
     for node in nodes:
         try:
-            upd = updatesbytarget[(node, tenant)][upid]
+            upd = myparty[(node, tenant)][upid]
         except KeyError:
             raise exc.NotFoundException('No active update matches request')
         upd.cancel()
-        del updatesbytarget[(node, tenant)][upid]
+        del myparty[(node, tenant)][upid]
         yield msg.DeletedResource(
             'nodes/{0}/inventory/firmware/updates/active/{1}'.format(
                 node, upid))
 
 
-def list_updates(nodes, tenant, element):
+def list_updates(nodes, tenant, element, type='firmware'):
     showmode = False
-    if len(element) > 4:
+    if type == 'mediaupload':
+        myparty = uploadsbytarget
+        verb = 'upload'
+    elif type == 'ffdc':
+        verb = 'download'
+        myparty = downloadsbytarget
+    else:
+        myparty = updatesbytarget
+        verb = 'update'
+    if type == 'firmware':
+        specificlen = 4
+    else:
+        specificlen = 2
+    if len(element) > specificlen:
         showmode = True
         upid = element[-1]
     for node in nodes:
         if showmode:
             try:
-                updater = updatesbytarget[(node, tenant)][upid]
+                updater = myparty[(node, tenant)][upid]
             except KeyError:
-                raise exc.NotFoundException('No matching update process found')
+                raise exc.NotFoundException(
+                    'No matching {0} process found'.format(verb))
             yield msg.KeyValueData(updater.progress, name=node)
         else:
-            for updateid in updatesbytarget.get((node, tenant), {}):
+            for updateid in myparty.get((node, tenant), {}):
                 yield msg.ChildCollection(updateid)

confluent_server/confluent/forwarder.py

@@ -82,11 +82,11 @@ def close_session(sessionid):
         killsock.close()
     if sessionid in forwardersbyclient:
         del forwardersbyclient[sessionid]
-    for clip in ipsbysession[sessionid]:
+    for clip in ipsbysession.get(sessionid, ()):
         sessionsbyip[clip].discard(sessionid)
     if sessionid in ipsbysession:
         del ipsbysession[sessionid]
-    for relay in list(relaysbysession[sessionid]):
+    for relay in list(relaysbysession.get(sessionid, ())):
         conn = relaysbysession[sessionid][relay]
         relay.kill()
         conn.close()

confluent_server/confluent/httpapi.py

@@ -269,6 +269,9 @@ def _authorize_request(env, operation):
     name = ''
     sessionid = None
     cookie = Cookie.SimpleCookie()
+    element = env['PATH_INFO']
+    if element.startswith('/sessions/current/'):
+        element = None
     if 'HTTP_COOKIE' in env:
         #attempt to use the cookie.  If it matches
         cc = RobustCookie()
@@ -290,7 +293,7 @@ def _authorize_request(env, operation):
                     httpsessions[sessionid]['expiry'] = time.time() + 90
                     name = httpsessions[sessionid]['name']
                     authdata = auth.authorize(
-                        name, element=None,
+                        name, element=element, operation=operation,
                         skipuserobj=httpsessions[sessionid]['skipuserobject'])
     if (not authdata) and 'HTTP_AUTHORIZATION' in env:
         if env['PATH_INFO'] == '/sessions/current/logout':
@@ -303,8 +306,10 @@ def _authorize_request(env, operation):
             return ('logout',)
         name, passphrase = base64.b64decode(
             env['HTTP_AUTHORIZATION'].replace('Basic ', '')).split(':', 1)
-        authdata = auth.check_user_passphrase(name, passphrase, element=None)
-        if not authdata:
+        authdata = auth.check_user_passphrase(name, passphrase, operation=operation, element=element)
+        if authdata is False:
+            return {'code': 403}
+        elif not authdata:
             return {'code': 401}
         sessid = util.randomstring(32)
         while sessid in httpsessions:
@@ -341,15 +346,10 @@ def _authorize_request(env, operation):
         if 'csrftoken' in httpsessions[sessid]:
             authinfo['authtoken'] = httpsessions[sessid]['csrftoken']
         return authinfo
-    else:
+    elif authdata is None:
         return {'code': 401}
-        # TODO(jbjohnso): actually evaluate the request for authorization
-        # In theory, the x509 or http auth stuff will get translated and then
-        # passed on to the core authorization function in an appropriate form
-        # expresses return in the form of http code
-        # 401 if there is no known identity
-        # 403 if valid identity, but no access
-        # going to run 200 just to get going for now
+    else:
+        return {'code': 403}
 
 
 def _pick_mimetype(env):
@@ -384,11 +384,11 @@ def resourcehandler(env, start_response):
     try:
         for rsp in resourcehandler_backend(env, start_response):
             yield rsp
-    except:
+    except Exception as e:
         tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
                      event=log.Events.stacktrace)
-        start_response('500 - Internal Server Error', [])
-        yield '500 - Internal Server Error'
+        start_response('500 - ' + str(e), [])
+        yield '500 - ' + str(e)
         return
 
 
@@ -400,7 +400,7 @@ def resourcehandler_backend(env, start_response):
                ('Pragma', 'no-cache'),
                ('X-Content-Type-Options', 'nosniff'),
                ('Content-Security-Policy', "default-src 'self'"),
-               ('X-XSS-Protection', '1'), ('X-Frame-Options', 'deny'),
+               ('X-XSS-Protection', '1; mode=block'), ('X-Frame-Options', 'deny'),
                ('Strict-Transport-Security', 'max-age=86400'),
                ('X-Permitted-Cross-Domain-Policies', 'none')]
     reqbody = None
@@ -429,7 +429,7 @@ def resourcehandler_backend(env, start_response):
         return
     if authorized['code'] == 403:
         start_response('403 Forbidden', badauth)
-        yield 'authorization failed'
+        yield 'Forbidden'
         return
     if authorized['code'] != 200:
         raise Exception("Unrecognized code from auth engine")
@@ -469,6 +469,10 @@ def resourcehandler_backend(env, start_response):
         funport = forwarder.get_port(targip, env['HTTP_X_FORWARDED_FOR'],
                                      authorized['sessionid'])
         host = env['HTTP_X_FORWARDED_HOST']
+        if ']' in host:
+            host = host.split(']')[0] + ']'
+        elif ':' in host:
+            host = host.rsplit(':', 1)[0]
         url = 'https://{0}:{1}/'.format(host, funport)
         start_response('302', [('Location', url)])
         yield 'Our princess is in another castle!'
@@ -496,6 +500,8 @@ def resourcehandler_backend(env, start_response):
             skipreplay = False
             if 'skipreplay' in querydict and querydict['skipreplay']:
                 skipreplay = True
+            width = querydict.get('width', 80)
+            height = querydict.get('height', 24)
             datacallback = None
             async = None
             if 'HTTP_CONFLUENTASYNCID' in env:
@@ -507,13 +513,13 @@ def resourcehandler_backend(env, start_response):
                     consession = shellserver.ShellSession(
                         node=nodename, configmanager=cfgmgr,
                         username=authorized['username'], skipreplay=skipreplay,
-                        datacallback=datacallback
+                        datacallback=datacallback, width=width, height=height
                     )
                 else:
                     consession = consoleserver.ConsoleSession(
                         node=nodename, configmanager=cfgmgr,
                         username=authorized['username'], skipreplay=skipreplay,
-                        datacallback=datacallback
+                        datacallback=datacallback, width=width, height=height
                     )
             except exc.NotFoundException:
                 start_response("404 Not found", headers)
@@ -548,6 +554,9 @@ def resourcehandler_backend(env, start_response):
         elif 'action' in querydict:
             if querydict['action'] == 'break':
                 consolesessions[querydict['session']]['session'].send_break()
+            elif querydict['action'] == 'resize':
+                consolesessions[querydict['session']]['session'].resize(
+                    width=querydict['width'], height=querydict['height'])
             elif querydict['action'] == 'reopen':
                 consolesessions[querydict['session']]['session'].reopen()
             else:
@@ -741,7 +750,10 @@ def _assemble_json(responses, resource=None, url=None, extension=None):
             for dk in rsp.iterkeys():
                 if dk in rspdata:
                     if isinstance(rspdata[dk], list):
-                        rspdata[dk].append(rsp[dk])
+                        if isinstance(rsp[dk], list):
+                            rspdata[dk].extend(rsp[dk])
+                        else:
+                            rspdata[dk].append(rsp[dk])
                     else:
                         rspdata[dk] = [rspdata[dk], rsp[dk]]
                 else:
@@ -781,8 +793,17 @@ def serve(bind_host, bind_port):
                 'Failed to open HTTP due to busy port, trying again in'
                 ' a second\n')
             eventlet.sleep(1)
-    eventlet.wsgi.server(sock, resourcehandler, log=False, log_output=False,
-                         debug=False)
+    # TCP_FASTOPEN
+    try:
+        sock.setsockopt(socket.SOL_TCP, 23, 5)
+    except Exception:
+        pass  # we gave it our best shot there
+    try:
+        eventlet.wsgi.server(sock, resourcehandler, log=False, log_output=False,
+                             debug=False, socket_timeout=60)
+    except TypeError:
+        # Older eventlet in place, skip arguments it does not understand
+        eventlet.wsgi.server(sock, resourcehandler, log=False, debug=False)
 
 
 class HttpApi(object):

confluent_server/confluent/interface/console.py

@@ -41,6 +41,11 @@ class Console(object):
         the remote console"""
         return
 
+    def resize(self, width, height):
+        """This function is responsible for relaying resize request from
+        client terminal to remote console"""
+        return
+
     def ping(self):
         """This function is a hint to the console plugin that now would be a
         nice time to assess health of console connection.  Plugins that see

confluent_server/confluent/log.py

@@ -51,11 +51,15 @@
 #    - leading bit reserved, 0 for now
 #    - length of metadata record 7 bits
 #    - type of data referenced by this entry (one byte), currently:
-#       0=text event, 1=json, 2=console data
+#       0=text event, 1=json, 2=console data, 3=event
 #    - offset into the text log to begin (4 bytes)
 #    - length of data referenced by this entry (2 bytes)
-#    - UTC timestamp of this entry in seconds since epoch (unsigned 32 bit?)
-#    - CRC32 over the record
+#    - UTC timestamp of this entry in seconds since epoch (unsigned 32 bit)
+#    - Event type (per 'Events' class below)
+#    - Event data (per event, currently used by connect/disconnect to represent
+#      single or multiple connections by user and for 'appmode' and 'shiftin'
+#      status for console
+#    - 2 reserved bytes
 #    (a future extended version might include suport for Forward Secure Sealing
 #    or other fields)
 
@@ -73,6 +77,8 @@ import struct
 import time
 import traceback
 
+daemonized = False
+logfull = False
 try:
     from fcntl import flock, LOCK_EX, LOCK_UN, LOCK_SH
 except ImportError:
@@ -150,21 +156,34 @@ class BaseRotatingHandler(object):
         Output the record to the file, catering for rollover as described
         in doRollover().
         """
-        rolling_type = self.shouldRollover(binrecord, textrecord)
-        if rolling_type:
-            flock(self.textfile, LOCK_UN)
-            return self.doRollover(rolling_type)
-        return None
+        global logfull
+        try:
+            rolling_type = self.shouldRollover(binrecord, textrecord)
+            if rolling_type:
+                flock(self.textfile, LOCK_UN)
+                return self.doRollover(rolling_type)
+            return None
+        except (IOError, OSError) as e:
+            if not daemonized:
+                raise
+            logfull = True
+
 
     def emit(self, binrecord, textrecord):
-        if self.textfile is None:
-            self.textfile = open(self.textpath, mode='ab')
-        if self.binfile is None:
-            self.binfile = open(self.binpath, mode='ab')
-        self.textfile.write(textrecord)
-        self.binfile.write(binrecord)
-        self.textfile.flush()
-        self.binfile.flush()
+        global logfull
+        try:
+            if self.textfile is None:
+                self.textfile = open(self.textpath, mode='ab')
+            if self.binfile is None:
+                self.binfile = open(self.binpath, mode='ab')
+            self.textfile.write(textrecord)
+            self.binfile.write(binrecord)
+            self.textfile.flush()
+            self.binfile.flush()
+        except (IOError, OSError) as e:
+            if not daemonized:
+                raise
+            logfull = True
 
     def get_textfile_offset(self, data_len):
         if self.textfile is None:
@@ -561,28 +580,35 @@ class Logger(object):
                 textdate = time.strftime(
                     '%b %d %H:%M:%S ', time.localtime(tstamp))
             flock(textfile, LOCK_EX)
-            offset = textfile.tell() + len(textdate)
-            datalen = len(data)
-            eventaux = entry[4]
-            if eventaux is None:
-                eventaux = 0
-            # metadata length is always 16 for this code at the moment
-            binrecord = struct.pack(
-                ">BBIHIBBH", 16, ltype, offset, datalen, tstamp, evtdata,
-                eventaux, 0)
-            if self.isconsole:
-                if ltype == 2:
-                    textrecord = data
+            try:
+                offset = textfile.tell() + len(textdate)
+                datalen = len(data)
+                eventaux = entry[4]
+                if eventaux is None:
+                    eventaux = 0
+                # metadata length is always 16 for this code at the moment
+                binrecord = struct.pack(
+                    ">BBIHIBBH", 16, ltype, offset, datalen, tstamp, evtdata,
+                    eventaux, 0)
+                if self.isconsole:
+                    if ltype == 2:
+                        textrecord = data
+                    else:
+                        textrecord = textdate + data + ']'
                 else:
-                    textrecord = textdate + data + ']'
-            else:
-                textrecord = textdate + data
-                if not textrecord.endswith('\n'):
-                    textrecord += '\n'
-            files = self.handler.try_emit(binrecord, textrecord)
+                    textrecord = textdate + data
+                    if not textrecord.endswith('\n'):
+                        textrecord += '\n'
+                files = self.handler.try_emit(binrecord, textrecord)
+            except struct.error:
+                files = self.handler.doRollover(RollingTypes.size_rolling)
+            finally:
+                try:
+                    flock(textfile, LOCK_UN)
+                except Exception:
+                    pass
             if not files:
                 self.handler.emit(binrecord, textrecord)
-                flock(textfile, LOCK_UN)
             else:
                 # Log the rolling event at first, then log the last data
                 # which cause the rolling event.
@@ -753,11 +779,13 @@ globaleventlog = None
 tracelog = None
 
 
-def log(logdata=None, ltype=None, event=0, eventdata=None):
+def log(logdata=None, ltype=None, event=0, eventdata=None, flush=False):
     global globaleventlog
     if globaleventlog is None:
         globaleventlog = Logger('events')
     globaleventlog.log(logdata, ltype, event, eventdata)
+    if flush:
+        globaleventlog.writedata()
 
 def logtrace():
     global tracelog

confluent_server/confluent/main.py

@@ -33,6 +33,7 @@ import confluent.consoleserver as consoleserver
 import confluent.core as confluentcore
 import confluent.httpapi as httpapi
 import confluent.log as log
+import confluent.collective.manager as collective
 try:
     import confluent.sockapi as sockapi
 except ImportError:
@@ -71,7 +72,7 @@ def _daemonize():
     os.setsid()
     thispid = os.fork()
     if thispid > 0:
-        print 'confluent server starting as pid %d' % thispid
+        print('confluent server starting as pid {0}'.format(thispid))
         os._exit(0)
     os.closerange(0, 2)
     os.umask(63)
@@ -80,6 +81,7 @@ def _daemonize():
     os.dup2(0, 2)
     sys.stdout = log.Logger('stdout', buffered=False)
     sys.stderr = log.Logger('stderr', buffered=False)
+    log.daemonized = True
 
 
 def _updatepidfile():
@@ -223,13 +225,19 @@ def run():
     except:
         doexit()
         raise
+    try:
+        log.log({'info': 'Confluent management service starting'}, flush=True)
+    except (OSError, IOError) as e:
+        print(repr(e))
+        sys.exit(1)
     _daemonize()
     if havefcntl:
         _updatepidfile()
     signal.signal(signal.SIGINT, terminate)
     signal.signal(signal.SIGTERM, terminate)
+    collective.startup()
     if dbgif:
-        oumask = os.umask(0077)
+        oumask = os.umask(0o077)
         try:
             os.remove('/var/run/confluent/dbg.sock')
         except OSError:

confluent_server/confluent/messages.py

@@ -20,6 +20,7 @@
 # format.  This is also how different data formats are supported
 import confluent.exceptions as exc
 import confluent.config.configmanager as cfm
+import confluent.config.conf as cfgfile
 from copy import deepcopy
 from datetime import datetime
 import json
@@ -32,10 +33,24 @@ valid_health_values = set([
     'unknown',
 ])
 
+passcomplexity = cfgfile.get_option('policy', 'passwordminlength')
+passminlength = cfgfile.get_option('policy', 'minpasswordlength')
+if passminlength:
+    passminlength = int(passminlength)
+if passcomplexity:
+    passcomplexity = int(passcomplexity)
+else:
+    passcomplexity = 0
+
+def simplify_name(name):
+    return name.lower().replace(' ', '_').replace('/', '-').replace(
+        '_-_', '-')
+
+
 def _htmlify_structure(indict):
     ret = "<ul>"
     if isinstance(indict, dict):
-        for key in indict.iterkeys():
+        for key in sorted(indict):
             ret += "<li>{0}: ".format(key)
             if type(indict[key]) in (str, unicode, float, int):
                 ret += str(indict[key])
@@ -77,7 +92,7 @@ class ConfluentMessage(object):
             datasource = self.kvpairs
         else:
             datasource = {'databynode': self.kvpairs}
-        jsonsnippet = json.dumps(datasource, separators=(',', ':'))[1:-1]
+        jsonsnippet = json.dumps(datasource, sort_keys=True, separators=(',', ':'))[1:-1]
         return jsonsnippet
 
     def raw(self):
@@ -250,6 +265,7 @@ class DeletedResource(ConfluentMessage):
     def strip_node(self, node):
         pass
 
+
 class CreatedResource(ConfluentMessage):
     notnode = True
     readonly = True
@@ -257,6 +273,28 @@ class CreatedResource(ConfluentMessage):
     def __init__(self, resource):
         self.kvpairs = {'created': resource}
 
+    def strip_node(self, node):
+        pass
+
+
+class RenamedResource(ConfluentMessage):
+    notnode = True
+    readonly = True
+
+    def __init__(self, oldname, newname):
+        self.kvpairs = {'oldname': oldname, 'newname': newname}
+
+    def strip_node(self, node):
+        pass
+
+
+class RenamedNode(ConfluentMessage):
+    def __init__(self, name, rename):
+        self.desc = 'New Name'
+        kv = {'rename': {'value': rename}}
+        self.kvpairs = {name: kv}
+
+
 class AssignedResource(ConfluentMessage):
     notnode = True
     readonly = True
@@ -371,7 +409,9 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
         return InputReseatMessage(path, nodes, inputdata)
     elif path == ['attributes', 'expression']:
         return InputExpression(path, inputdata, nodes)
-    elif path[0] in ('attributes', 'users') and operation != 'retrieve':
+    elif path == ['attributes', 'rename']:
+        return InputConfigChangeSet(path, inputdata, nodes, configmanager)
+    elif path[0] in ('attributes', 'users', 'usergroups') and operation != 'retrieve':
         return InputAttributes(path, inputdata, nodes)
     elif path == ['boot', 'nextdevice'] and operation != 'retrieve':
         return InputBootDevice(path, nodes, inputdata)
@@ -392,6 +432,9 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
     elif (path[:3] == ['configuration', 'management_controller', 'identifier']
             and operation != 'retrieve'):
         return InputMCI(path, nodes, inputdata)
+    elif (path[:3] == ['configuration', 'management_controller', 'hostname']
+            and operation != 'retrieve'):
+        return InputHostname(path, nodes, inputdata, configmanager)
     elif (path[:4] == ['configuration', 'management_controller',
             'net_interfaces', 'management'] and operation != 'retrieve'):
         return InputNetworkConfiguration(path, nodes, inputdata,
@@ -405,19 +448,83 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
     elif (path[:4] == ['configuration', 'management_controller', 'ntp',
             'servers'] and operation != 'retrieve' and len(path) == 5):
         return InputNTPServer(path, nodes, inputdata)
+    elif (path[:3] == ['configuration', 'system', 'all'] and
+            operation != 'retrieve'):
+        return InputConfigChangeSet(path, inputdata, nodes, configmanager)
+    elif (path[:3] == ['configuration', 'system', 'clear'] and
+            operation != 'retrieve'):
+        return InputConfigClear(path, inputdata, nodes, configmanager)
+    elif (path[:3] == ['configuration', 'storage', 'disks'] and
+            operation != 'retrieve'):
+        return InputDisk(path, nodes, inputdata)
+    elif (path[:3] == ['configuration', 'storage', 'volumes'] and
+          operation in ('update', 'create')):
+        return InputVolumes(path, nodes, inputdata)
     elif 'inventory/firmware/updates/active' in '/'.join(path) and inputdata:
-        return InputFirmwareUpdate(path, nodes, inputdata)
+        return InputFirmwareUpdate(path, nodes, inputdata, configmanager)
+    elif '/'.join(path).startswith('media/detach'):
+        return DetachMedia(path, nodes, inputdata)
+    elif '/'.join(path).startswith('media/') and inputdata:
+        return InputMedia(path, nodes, inputdata, configmanager)
+    elif '/'.join(path).startswith('support/servicedata') and inputdata:
+        return InputMedia(path, nodes, inputdata, configmanager)
+    elif '/'.join(path).startswith('configuration/management_controller/save_licenses') and inputdata:
+        return InputMedia(path, nodes, inputdata, configmanager)
+    elif '/'.join(path).startswith(
+            'configuration/management_controller/licenses') and inputdata:
+        return InputLicense(path, nodes, inputdata, configmanager)
     elif inputdata:
         raise exc.InvalidArgumentException(
             'No known input handler for request')
 
 class InputFirmwareUpdate(ConfluentMessage):
 
-    def __init__(self, path, nodes, inputdata):
-        self.filename = inputdata['filename']
+    def __init__(self, path, nodes, inputdata, configmanager):
+        self._filename = inputdata.get('filename', inputdata.get('url', inputdata.get('dirname', None)))
         self.bank = inputdata.get('bank', None)
         self.nodes = nodes
+        self.filebynode = {}
+        self._complexname = False
+        for expanded in configmanager.expand_attrib_expression(
+                nodes, self._filename):
+            node, value = expanded
+            if value != self._filename:
+                self._complexname = True
+            self.filebynode[node] = value
 
+    @property
+    def filename(self):
+        if self._complexname:
+            raise Exception('User requested substitutions, but code is '
+                            'written against old api, code must be fixed or '
+                            'skip {} expansion')
+        return self._filename
+
+    def nodefile(self, node):
+        return self.filebynode[node]
+
+class InputMedia(InputFirmwareUpdate):
+    # Use InputFirmwareUpdate
+    pass
+
+class InputLicense(InputFirmwareUpdate):
+    pass
+
+
+class DetachMedia(ConfluentMessage):
+    def __init__(self, path, nodes, inputdata):
+        if 'detachall' not in inputdata:
+            raise exc.InvalidArgumentException('Currently only supporting'
+                                               '{"detachall": 1}')
+
+
+class Media(ConfluentMessage):
+    def __init__(self, node, media):
+        self.kvpairs = {node: {'name': media.name, 'url': media.url}}
+
+class SavedFile(ConfluentMessage):
+    def __init__(self, node, file):
+        self.kvpairs = {node: {'filename': file}}
 
 class InputAlertData(ConfluentMessage):
 
@@ -460,6 +567,31 @@ class InputExpression(ConfluentMessage):
         nodeattr = deepcopy(self.nodeattribs[node])
         return nodeattr
 
+class InputConfigClear(ConfluentMessage):
+    def __init__(self, path, inputdata, nodes=None, configmanager=None):
+        if not inputdata:
+            raise exc.InvalidArgumentException('no request data provided')
+        if 'clear' not in inputdata or not inputdata['clear']:
+            raise exc.InvalidArgumentException('Input must be {"clear":true}')
+
+class InputConfigChangeSet(InputExpression):
+    def __init__(self, path, inputdata, nodes=None, configmanager=None):
+        self.cfm = configmanager
+        super(InputConfigChangeSet, self).__init__(path, inputdata, nodes)
+
+    def get_attributes(self, node):
+        attrs = super(InputConfigChangeSet, self).get_attributes(node)
+        endattrs = {}
+        for attr in attrs:
+            origval = attrs[attr]
+            if isinstance(origval, str) or isinstance(origval, unicode):
+                origval = {'expression': origval}
+            if 'expression' not in origval:
+                endattrs[attr] = attrs[attr]
+            else:
+                endattrs[attr] = list(self.cfm.expand_attrib_expression(
+                    [node], attrs[attr]))[0][1]
+        return endattrs
 
 class InputAttributes(ConfluentMessage):
     # This is particularly designed for attributes, where a simple string
@@ -467,7 +599,7 @@ class InputAttributes(ConfluentMessage):
     # preserve the client provided expression for posterity, rather than
     # immediate consumption.
     # for things like node configuration or similar, a different class is
-    # appropriate since it nedes to immediately expand an expression.
+    # appropriate since it needs to immediately expand an expression.
     # with that class, the 'InputExpression' and calling code in attributes.py
     # might be deprecated in favor of the generic expression expander
     # and a small function in attributes.py to reflect the expansion back
@@ -500,7 +632,7 @@ class InputAttributes(ConfluentMessage):
         for node in nodes:
             self.nodeattribs[node] = inputdata
 
-    def get_attributes(self, node):
+    def get_attributes(self, node, validattrs=None):
         if node not in self.nodeattribs:
             return {}
         nodeattr = deepcopy(self.nodeattribs[node])
@@ -515,15 +647,82 @@ class InputAttributes(ConfluentMessage):
                     # an expression string will error if format() done
                     # use that as cue to put it into config as an expr
                     nodeattr[attr] = {'expression': nodeattr[attr]}
+            if validattrs and 'validvalues' in validattrs.get(attr, []):
+                if (nodeattr[attr] and
+                        nodeattr[attr] not in validattrs[attr]['validvalues']):
+                    raise exc.InvalidArgumentException(
+                        'Attribute {0} does not accept value {1} (valid values would be {2})'.format(
+                            attr, nodeattr[attr], ','.join(validattrs[attr]['validvalues'])))
+            elif validattrs and 'validlist' in validattrs.get(attr, []) and nodeattr[attr]:
+                req = nodeattr[attr].split(',')
+                for v in req:
+                    if v and v not in validattrs[attr]['validlist']:
+                        raise exc.InvalidArgumentException(
+                            'Attribute {0} does not accept list member '
+                            '{1} (valid values would be {2})'.format(
+                                attr, v, ','.join(
+                                    validattrs[attr]['validlist'])))
+            elif validattrs and 'validlistkeys' in validattrs.get(attr, []) and nodeattr[attr]:
+                req = nodeattr[attr].split(',')
+                for v in req:
+                    if '=' not in v:
+                        raise exc.InvalidArgumentException(
+                            'Passed key {0} requires a parameter'.format(v))
+                    v = v.split('=', 1)[0]
+                    if v and v not in validattrs[attr]['validlistkeys']:
+                        raise exc.InvalidArgumentException(
+                            'Attribute {0} does not accept key {1} (valid values would be {2})'.format(
+                                attr, v, ','.join(
+                                    validattrs[attr]['validlistkeys'])
+                            )
+                        )
         return nodeattr
 
+def checkPassword(password, username):
+    lowercase = set('abcdefghijklmnopqrstuvwxyz')
+    uppercase = set('abcdefghijklmnopqrstuvwxyz'.upper())
+    numbers = set('0123456789')
+    special = set('`~!@#$%^&*()-_=+[{]};:"/?.>,<' + "'")
+    if len(password) < passminlength:
+        raise exc.InvalidArgumentException('Password must be at least {0} characters long'.format(passminlength))
+    if not isinstance(passcomplexity, int) or passcomplexity < 1:
+        return
+    if not bool(set(password.lower()) & lowercase):  # rule 1
+        raise exc.InvalidArgumentException('Password must contain at least one letter')
+    if passcomplexity < 2:
+        return
+    thepass = set(password)
+    if not bool(thepass & numbers):  # rule 2
+        raise exc.InvalidArgumentException('Password must contain at least one number')
+    if passcomplexity < 3:
+        return
+    classes = 0
+    for charclass in (lowercase, uppercase, special):
+        if bool(thepass & charclass):
+            classes += 1
+    if classes < 2:
+        raise exc.InvalidArgumentException('Password must contain at least two of upper case letter, lower case letter, and/or special character')
+    if passcomplexity < 4:
+        return
+    if username and password in (username, username[::-1]): # rule 4
+        raise exc.InvalidArgumentException('Password must not be similar to username')
+    if passcomplexity < 5:
+        return
+    for char in thepass:
+        if char * 3 in password:
+            raise exc.InvalidArgumentException('Password must not contain any of the same character repeated 3 times')
+
+
 
 class InputCredential(ConfluentMessage):
     valid_privilege_levels = set([
         'callback',
         'user',
+        'ReadOnly',
         'operator',
+        'Operator',
         'administrator',
+        'Administrator',
         'proprietary',
         'no_access',
     ])
@@ -541,33 +740,21 @@ class InputCredential(ConfluentMessage):
         if len(path) == 4:
             inputdata['uid'] = path[-1]
         # if the operation is 'create' check if all fields are present
-        missingattrs = []
-        for attrname in ('uid', 'privilege_level', 'username', 'password'):
-            if attrname not in inputdata:
-                missingattrs.append(attrname)
-        if missingattrs:
-            raise exc.InvalidArgumentException(
-                'Required fields missing: {0}'.format(','.join(missingattrs)))
         if (isinstance(inputdata['uid'], str) and
                 not inputdata['uid'].isdigit()):
-            raise exc.InvalidArgumentException('uid must be a number')
+            inputdata['uid'] = inputdata['uid']
         else:
             inputdata['uid'] = int(inputdata['uid'])
         if ('privilege_level' in inputdata and
               inputdata['privilege_level'] not in self.valid_privilege_levels):
             raise exc.InvalidArgumentException('privilege_level is not one of '
                                         + ','.join(self.valid_privilege_levels))
-        if 'username' in inputdata and len(inputdata['username']) > 16:
-            raise exc.InvalidArgumentException(
-                                        'name must be less than or = 16 chars')
-        if 'password' in inputdata and len(inputdata['password']) > 20:
-            raise exc.InvalidArgumentException('password has limit of 20 chars')
-
         if ('enabled' in inputdata and
             inputdata['enabled'] not in self.valid_enabled_values):
             raise exc.InvalidArgumentException('valid values for enabled are '
                                                             + 'yes and no')
-
+        if 'password' in inputdata and (passcomplexity or passminlength):
+            checkPassword(inputdata['password'], inputdata.get('username', None))
         if nodes is None:
             raise exc.InvalidArgumentException(
                 'This only supports per-node input')
@@ -638,6 +825,81 @@ class InputIdentifyMessage(ConfluentInputMessage):
     keyname = 'identify'
 
 
+class InputDisk(ConfluentInputMessage):
+    valid_values = set([
+        'jbod',
+        'unconfigured',
+        'hotspare',
+    ])
+
+    keyname = 'state'
+
+
+class InputVolumes(ConfluentInputMessage):
+    def __init__(self, path, nodes, inputdata):
+        self.inputbynode = {}
+        self.stripped = False
+        if not inputdata:
+            raise exc.InvalidArgumentException('missing input data')
+        if isinstance(inputdata, dict):
+            volnames = [None]
+            if len(path) == 6:
+                volnames = path[-1]
+            volnames = inputdata.get('name', volnames)
+            if not isinstance(volnames, list):
+                volnames = volnames.split(',')
+            sizes = inputdata.get('size', [None])
+            if not isinstance(sizes, list):
+                sizes = sizes.split(',')
+            stripsizes = inputdata.get('stripsizes', [None])
+            if not isinstance(stripsizes, list):
+                stripsizes = stripsizes.split(',')
+            disks = inputdata.get('disks', [])
+            if not disks:
+                raise exc.InvalidArgumentException(
+                    'disks are currently required to create a volume')
+            raidlvl = inputdata.get('raidlevel', None)
+            inputdata = []
+            for size in sizes:
+                if volnames:
+                    currname = volnames.pop(0)
+                else:
+                    currname = None
+                if stripsizes:
+                    currstripsize = stripsizes.pop(0)
+                    if currstripsize:
+                        currstripsize = int(currstripsize)
+                else:
+                    currstripsize = None
+                inputdata.append(
+                    {'name': currname, 'size': size,
+                     'stripsize': currstripsize,
+                     'disks': disks,
+                     'raidlevel': raidlvl})
+        for node in nodes:
+            self.inputbynode[node] = []
+        for input in inputdata:
+            volname = None
+            if len(path) == 6:
+                volname = path[-1]
+            volname = input.get('name', volname)
+            if not volname:
+                volname = None
+            volsize = input.get('size', None)
+            if isinstance(input['disks'], list):
+                disks = input['disks']
+            else:
+                disks = input['disks'].split(',')
+            raidlvl = input.get('raidlevel', None)
+            for node in nodes:
+                self.inputbynode[node].append({'name': volname,
+                                               'size': volsize,
+                                               'disks': disks,
+                                               'stripsize': input.get('stripsize', None),
+                                               'raidlevel': raidlvl,
+                                               })
+
+
 class InputPowerMessage(ConfluentInputMessage):
     valid_values = set([
         'on',
@@ -671,6 +933,25 @@ class InputBMCReset(ConfluentInputMessage):
         return self.inputbynode[node]
 
 
+
+class InputHostname(ConfluentInputMessage):
+    def __init__(self, path, nodes, inputdata, configmanager):
+        self.inputbynode = {}
+        self.stripped = False
+        if not inputdata or 'hostname' not in inputdata:
+            raise exc.InvalidArgumentException('missing hostname attribute')
+        if nodes is None:
+            raise exc.InvalidArgumentException(
+                'This only supports per-node input')
+        for expanded in configmanager.expand_attrib_expression(
+                nodes, inputdata['hostname']):
+            node, value = expanded
+            self.inputbynode[node] = value
+
+    def hostname(self, node):
+        return self.inputbynode[node]
+
+
 class InputMCI(ConfluentInputMessage):
     def __init__(self, path, nodes, inputdata):
         self.inputbynode = {}
@@ -964,6 +1245,7 @@ class EventCollection(ConfluentMessage):
                 'event': event.get('event', None),
                 'severity': event['severity'],
                 'timestamp': event.get('timestamp', None),
+                'message': event.get('message', None),
                 'record_id': event.get('record_id', None),
             }
             if event['severity'] not in valid_health_values:
@@ -1018,14 +1300,15 @@ class AsyncSession(ConfluentMessage):
         self.kvpairs = {'asyncid': id}
 
 class User(ConfluentMessage):
-    def __init__(self, uid, username, privilege_level, name=None):
+    def __init__(self, uid, username, privilege_level, name=None, expiration=None):
         self.desc = 'foo'
         self.stripped = False
         self.notnode = name is None
         kvpairs = {'username': {'value': username},
                    'password': {'value': '', 'type': 'password'},
                    'privilege_level': {'value': privilege_level},
-                   'enabled': {'value': ''}
+                   'enabled': {'value': ''},
+                   'expiration': {'value': expiration},
                    }
         if self.notnode:
             self.kvpairs = kvpairs
@@ -1044,6 +1327,7 @@ class UserCollection(ConfluentMessage):
             entry = {
                 'uid': user['uid'],
                 'username': user['name'],
+                'expiration': user.get('expiration', None),
                 'privilege_level': user['access']['privilege_level']
             }
             userlist.append(entry)
@@ -1159,6 +1443,76 @@ class KeyValueData(ConfluentMessage):
         else:
             self.kvpairs = {name: kvdata}
 
+class Array(ConfluentMessage):
+    def __init__(self, name, disks=None, raid=None, volumes=None,
+                 id=None, capacity=None, available=None):
+        self.kvpairs = {
+            name: {
+                'type': 'array',
+                'disks': disks,
+                'raid': raid,
+                'id': id,
+                'volumes': volumes,
+                'capacity': capacity,
+                'available': available,
+            }
+        }
+
+class Volume(ConfluentMessage):
+    def __init__(self, name, volname, size, state, array, stripsize=None):
+        self.kvpairs = {
+            name: {
+                'type': 'volume',
+                'name': simplify_name(volname),
+                'label': volname,
+                'stripsize': stripsize,
+                'size': size,
+                'state': state,
+                'array': array,
+            }
+        }
+
+class Disk(ConfluentMessage):
+    valid_states = set([
+        'jbod',
+        'unconfigured',
+        'hotspare',
+        'online',
+    ])
+    state_aliases = {
+        'unconfigured good': 'unconfigured',
+        'global hot spare': 'hotspare',
+        'dedicated hot spare': 'hotspare',
+    }
+
+    def _normalize_state(self, instate):
+        newstate = instate.lower()
+        if newstate in self.valid_states:
+            return newstate
+        elif newstate in self.state_aliases:
+            return self.state_aliases[newstate]
+        raise Exception("Unknown state {0}".format(instate))
+
+
+    def __init__(self, name, label=None, description=None,
+                 diskid=None, state=None, serial=None, fru=None,
+                 array=None):
+        state = self._normalize_state(state)
+        self.kvpairs = {
+            name: {
+                'type': 'disk',
+                'name': simplify_name(label),
+                'label': label,
+                'description': description,
+                'diskid': diskid,
+                'state': state,
+                'serial': serial,
+                'fru': fru,
+                'array': array,
+            }
+        }
+
+
 
 class LEDStatus(ConfluentMessage):
     readonly = True
@@ -1213,7 +1567,7 @@ class Attributes(ConfluentMessage):
         self.desc = desc
         nkv = {}
         self.notnode = name is None
-        for key in kv.iterkeys():
+        for key in kv:
             if type(kv[key]) in (str, unicode):
                 nkv[key] = {'value': kv[key]}
             else:
@@ -1225,6 +1579,8 @@ class Attributes(ConfluentMessage):
                 name: nkv
             }
 
+class ConfigSet(Attributes):
+    pass
 
 class ListAttributes(ConfluentMessage):
     def __init__(self, name=None, kv=None, desc=''):
@@ -1248,6 +1604,17 @@ class MCI(ConfluentMessage):
             self.kvpairs = {name: kv}
 
 
+class Hostname(ConfluentMessage):
+    def __init__(self, name=None, hostname=None):
+        self.notnode = name is None
+        self.desc = 'BMC hostname'
+
+        kv = {'hostname': {'value': hostname}}
+        if self.notnode:
+            self.kvpairs = kv
+        else:
+            self.kvpairs = {name: kv}
+
 class DomainName(ConfluentMessage):
     def __init__(self, name=None, dn=None):
         self.notnode = name is None
@@ -1293,12 +1660,12 @@ class NTPServer(ConfluentMessage):
 class License(ConfluentMessage):
     readonly = True
 
-    def __init__(self, name=None, kvm=None):
+    def __init__(self, name=None, kvm=None, feature=None, state=None):
         self.notnode = name is None
         self.desc = 'License'
 
         kv = []
-        kv.append({'kvm_availability': str(kvm)})
+        kv.append({'kvm_availability': str(kvm), 'feature': feature, 'state': state})
         if self.notnode:
             self.kvpairs = {'License': kv}
         else:

confluent_server/confluent/netutil.py

@@ -16,6 +16,7 @@
 # this will implement noderange grammar
 
 
+import confluent.exceptions as exc
 import codecs
 import struct
 import eventlet.green.socket as socket
@@ -23,6 +24,19 @@ import eventlet.support.greendns
 getaddrinfo = eventlet.support.greendns.getaddrinfo
 
 
+def mask_to_cidr(mask):
+    maskn = socket.inet_pton(socket.AF_INET, mask)
+    maskn = struct.unpack('!I', maskn)[0]
+    cidr = 32
+    while maskn & 0b1 == 0 and cidr > 0:
+        cidr -= 1
+        maskn >>= 1
+    return cidr
+
+def cidr_to_mask(cidr):
+    return socket.inet_ntop(
+        socket.AF_INET, struct.pack('!I', (2**32 - 1) ^ (2**(32 - cidr) - 1)))
+
 def ip_on_same_subnet(first, second, prefix):
     addrinf = socket.getaddrinfo(first, None, 0, socket.SOCK_STREAM)[0]
     fam = addrinf[0]
@@ -83,7 +97,7 @@ def get_nic_config(configmanager, node, ip=None, mac=None):
         cfgdata['prefix'] = prefixlen
         for setting in nodenetattribs:
             gw = nodenetattribs[setting].get('value', None)
-            if gw is None:
+            if gw is None or not gw:
                 continue
             if ip_on_same_subnet(ip, gw, prefixlen):
                 cfgdata['ipv4_gateway'] = gw
@@ -121,4 +135,28 @@ def get_prefix_len_for_ip(ip):
                 nbits += 1
                 maskn = maskn << 1 & 0xffffffff
             return nbits
-    raise exc.NotImplementedException("Non local addresses not supported")
+    raise exc.NotImplementedException("Non local addresses not supported")
+
+def addresses_match(addr1, addr2):
+    """Check two network addresses for similarity
+
+    Is it zero padded in one place, not zero padded in another?  Is one place by name and another by IP??
+    Is one context getting a normal IPv4 address and another getting IPv4 in IPv6 notation?
+    This function examines the two given names, performing the required changes to compare them for equivalency
+
+    :param addr1:
+    :param addr2:
+    :return: True if the given addresses refer to the same thing
+    """
+    for addrinfo in socket.getaddrinfo(addr1, 0, 0, socket.SOCK_STREAM):
+        rootaddr1 = socket.inet_pton(addrinfo[0], addrinfo[4][0])
+        if addrinfo[0] == socket.AF_INET6 and rootaddr1[:12] == b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff':
+            # normalize to standard IPv4
+            rootaddr1 = rootaddr1[-4:]
+        for otherinfo in socket.getaddrinfo(addr2, 0, 0, socket.SOCK_STREAM):
+            otheraddr = socket.inet_pton(otherinfo[0], otherinfo[4][0])
+            if otherinfo[0] == socket.AF_INET6 and otheraddr[:12] == b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff':
+                otheraddr = otheraddr[-4:]
+            if otheraddr == rootaddr1:
+                return True
+    return False

confluent_server/confluent/networking/lldp.py

@@ -33,6 +33,7 @@
 if __name__ == '__main__':
     import sys
     import confluent.config.configmanager as cfm
+import base64
 import confluent.exceptions as exc
 import confluent.log as log
 import confluent.messages as msg
@@ -87,7 +88,7 @@ _chassisidbyswitch = {}
 
 def lenovoname(idx, desc):
     if desc.isdigit():
-        return 'Ethernet' + str(idx)
+        return 'Ethernet' + str(desc)
     return desc
 
 nameoverrides = [
@@ -118,6 +119,25 @@ def _lldpdesc_to_ifname(switchid, idx, desc):
 def _dump_neighbordatum(info):
     return [msg.KeyValueData(info)]
 
+def b64tohex(b64str):
+    bd = base64.b64decode(b64str)
+    return ''.join(['{0:02x}'.format(ord(x)) for x in bd])
+
+def get_fingerprint(switch, port, configmanager, portmatch):
+    update_switch_data(switch, configmanager)
+    for neigh in _neighbypeerid:
+        info = _neighbypeerid[neigh]
+        if neigh == '!!vintage' or info.get('switch', None) != switch:
+            continue
+        if 'peersha256fingerprint' not in info:
+            continue
+        if info.get('switch', None) != switch:
+            continue
+        if portmatch(info.get('port'), port):
+            return ('sha256$' + b64tohex(info['peersha256fingerprint']),
+                    info.get('verified', False))
+    return None, False
+
 
 def _extract_extended_desc(info, source, integritychecked):
     source = str(source)
@@ -131,6 +151,9 @@ def _extract_extended_desc(info, source, integritychecked):
         info['peerdescription'] = source
 
 def sanitize(val):
+    # This is pretty much the same approach net-snmp takes.
+    # if the string is printable as-is, then just give it as-is
+    # if the string has non-printable, then hexify it
     val = str(val)
     for x in val.strip('\x00'):
         if ord(x) < 32 or ord(x) > 128:
@@ -141,14 +164,14 @@ def sanitize(val):
 def _init_lldp(data, iname, idx, idxtoportid, switch):
     if iname not in data:
         data[iname] = {'port': iname, 'portid': str(idxtoportid[idx]),
-                       'chassisid': str(_chassisidbyswitch[switch])}
+                       'chassisid': _chassisidbyswitch[switch]}
 
 def _extract_neighbor_data_b(args):
     """Build LLDP data about elements connected to switch
 
     args are carried as a tuple, because of eventlet convenience
     """
-    switch, password, user, force = args
+    switch, password, user, force = args[:4]
     vintage = _neighdata.get(switch, {}).get('!!vintage', 0)
     now = util.monotonic_time()
     if vintage > (now - 60) and not force:
@@ -160,7 +183,8 @@ def _extract_neighbor_data_b(args):
         sid = str(sysid[1][6:])
     idxtoifname = {}
     idxtoportid = {}
-    _chassisidbyswitch[switch] = list(conn.walk('1.0.8802.1.1.2.1.3.2'))[0][1]
+    _chassisidbyswitch[switch] = sanitize(list(
+        conn.walk('1.0.8802.1.1.2.1.3.2'))[0][1])
     for oidindex in conn.walk('1.0.8802.1.1.2.1.3.7.1.3'):
         idx = oidindex[0][-1]
         idxtoportid[idx] = sanitize(oidindex[1])
@@ -196,17 +220,19 @@ def _extract_neighbor_data_b(args):
     _neighdata[switch] = lldpdata
 
 
-def update_switch_data(switch, configmanager, force=False):
+def update_switch_data(switch, configmanager, force=False, retexc=False):
     switchcreds = netutil.get_switchcreds(configmanager, (switch,))[0]
-    _extract_neighbor_data(switchcreds + (force,))
+    ndr = _extract_neighbor_data(switchcreds + (force, retexc))
+    if retexc and isinstance(ndr, Exception):
+        raise ndr
     return _neighdata.get(switch, {})
 
 
-def update_neighbors(configmanager, force=False):
-    return _update_neighbors_backend(configmanager, force)
+def update_neighbors(configmanager, force=False, retexc=False):
+    return _update_neighbors_backend(configmanager, force, retexc)
 
 
-def _update_neighbors_backend(configmanager, force):
+def _update_neighbors_backend(configmanager, force, retexc):
     global _neighdata
     global _neighbypeerid
     vintage = _neighdata.get('!!vintage', 0)
@@ -217,7 +243,7 @@ def _update_neighbors_backend(configmanager, force):
     _neighbypeerid = {'!!vintage': now}
     switches = netutil.list_switches(configmanager)
     switchcreds = netutil.get_switchcreds(configmanager, switches)
-    switchcreds = [ x + (force,) for x in switchcreds]
+    switchcreds = [ x + (force, retexc) for x in switchcreds]
     pool = GreenPool(64)
     for ans in pool.imap(_extract_neighbor_data, switchcreds):
         yield ans
@@ -234,9 +260,15 @@ def _extract_neighbor_data(args):
         return
     try:
         with _updatelocks[switch]:
-            _extract_neighbor_data_b(args)
-    except Exception:
-        log.logtrace()
+            return _extract_neighbor_data_b(args)
+    except Exception as e:
+        yieldexc = False
+        if len(args) >= 5:
+            yieldexc = args[4]
+        if yieldexc:
+            return e
+        else:
+            log.logtrace()
 
 if __name__ == '__main__':
     # a quick one-shot test, args are switch and snmpv1 string for now
@@ -303,7 +335,9 @@ def _handle_neighbor_query(pathcomponents, configmanager):
         # guaranteed
         if (parms['by-peerid'] not in _neighbypeerid and
                 _neighbypeerid.get('!!vintage', 0) < util.monotonic_time() - 60):
-            list(update_neighbors(configmanager))
+            for x in update_neighbors(configmanager, retexc=True):
+                if isinstance(x, Exception):
+                    raise x
         if parms['by-peerid'] not in _neighbypeerid:
             raise exc.NotFoundException('No matching peer known')
         return _dump_neighbordatum(_neighbypeerid[parms['by-peerid']])
@@ -312,9 +346,11 @@ def _handle_neighbor_query(pathcomponents, configmanager):
     if listrequested not in multi_selectors | single_selectors:
         raise exc.NotFoundException('{0} is not found'.format(listrequested))
     if 'by-switch' in parms:
-        update_switch_data(parms['by-switch'], configmanager)
+        update_switch_data(parms['by-switch'], configmanager, retexc=True)
     else:
-        list(update_neighbors(configmanager))
+        for x in update_neighbors(configmanager, retexc=True):
+            if isinstance(x, Exception):
+                raise x
     return list_info(parms, listrequested)
 
 

confluent_server/confluent/networking/macmap.py

@@ -30,7 +30,7 @@
 
 # this module will provide mac to switch and full 'ifName' label
 # This functionality is restricted to the null tenant
-from confluent.networking.lldp import _handle_neighbor_query
+from confluent.networking.lldp import _handle_neighbor_query, get_fingerprint
 from confluent.networking.netutil import get_switchcreds, list_switches, get_portnamemap
 
 if __name__ == '__main__':
@@ -47,6 +47,7 @@ import eventlet.semaphore
 import re
 
 _macmap = {}
+_apimacmap = {}
 _macsbyswitch = {}
 _nodesbymac = {}
 _switchportmap = {}
@@ -211,7 +212,7 @@ def _map_switch_backend(args):
                 maccounts[ifname] = 1
             else:
                 maccounts[ifname] += 1
-    _macsbyswitch[switch] = {}
+    newmacs = {}
     for mac in mactobridge:
         # We want to merge it so that when a mac appears in multiple
         # places, it is captured.
@@ -223,10 +224,10 @@ def _map_switch_backend(args):
             _macmap[mac].append((switch, ifname, maccounts[ifname]))
         else:
             _macmap[mac] = [(switch, ifname, maccounts[ifname])]
-        if ifname in _macsbyswitch[switch]:
-            _macsbyswitch[switch][ifname].append(mac)
+        if ifname in newmacs:
+            newmacs[ifname].append(mac)
         else:
-            _macsbyswitch[switch][ifname] = [mac]
+            newmacs[ifname] = [mac]
         nodename = _nodelookup(switch, ifname)
         if nodename is not None:
             if mac in _nodesbymac and _nodesbymac[mac][0] != nodename:
@@ -238,6 +239,7 @@ def _map_switch_backend(args):
                 _nodesbymac[mac] = (None, None)
             else:
                 _nodesbymac[mac] = (nodename, maccounts[ifname])
+    _macsbyswitch[switch] = newmacs
 
 
 switchbackoff = 30
@@ -254,7 +256,9 @@ def find_nodeinfo_by_mac(mac, configmanager):
         if mac in _nodesbymac:
             return _nodesbymac[mac][0], {'maccount': _nodesbymac[mac][1]}
     # If update_mac bailed out, still check one last time
-    return _nodesbymac.get(mac, (None, {'maccount': 0}))
+    if mac in _nodesbymac:
+        return _nodesbymac[mac][0], {'maccount': _nodesbymac[mac][1]}
+    return None, {'maccount': 0}
 
 
 mapupdating = eventlet.semaphore.Semaphore()
@@ -293,6 +297,7 @@ def _finish_update(completions):
 
 def _full_updatemacmap(configmanager):
     global vintage
+    global _apimacmap
     global _macmap
     global _nodesbymac
     global _switchportmap
@@ -305,16 +310,17 @@ def _full_updatemacmap(configmanager):
         _macmap = {}
         _nodesbymac = {}
         _switchportmap = {}
-        _macsbyswitch = {}
         if configmanager.tenant is not None:
             raise exc.ForbiddenRequest(
                 'Network topology not available to tenants')
         # here's a list of switches... need to add nodes that are switches
         nodelocations = configmanager.get_node_attributes(
-            configmanager.list_nodes(), ('net*.switch', 'net*.switchport'))
+            configmanager.list_nodes(), ('type', 'net*.switch', 'net*.switchport'))
         switches = set([])
         for node in nodelocations:
             cfg = nodelocations[node]
+            if cfg.get('type', {}).get('value', None) == 'switch':
+                switches.add(node)
             for attr in cfg:
                 if not attr.endswith('.switch') or 'value' not in cfg[attr]:
                     continue
@@ -338,11 +344,15 @@ def _full_updatemacmap(configmanager):
                         _switchportmap[curswitch][portname] = None
                     else:
                         _switchportmap[curswitch][portname] = node
+        for switch in list(_macsbyswitch):
+            if switch not in switches:
+                del _macsbyswitch[switch]
         switchauth = get_switchcreds(configmanager, switches)
         pool = GreenPool(64)
         for ans in pool.imap(_map_switch, switchauth):
             vintage = util.monotonic_time()
             yield ans
+    _apimacmap = _macmap
     endtime = util.monotonic_time()
     duration = endtime - start
     duration = duration * 15  # wait 15 times as long as it takes to walk
@@ -378,6 +388,17 @@ def handle_api_request(configmanager, inputdata, operation, pathcomponents):
             operation, '/'.join(pathcomponents)))
 
 
+def get_node_fingerprints(nodename, configmanager):
+    cfg = configmanager.get_node_attributes(nodename, ['net*.switch',
+                                                       'net*.switchport'])
+    for attrkey in cfg[nodename]:
+        if attrkey.endswith('switch'):
+            switch = cfg[nodename][attrkey]['value']
+            port = cfg[nodename][attrkey + 'port']['value']
+            yield get_fingerprint(switch, port, configmanager,
+                                       _namesmatch)
+
+
 def handle_read_api_request(pathcomponents, configmanager):
     # TODO(jjohnson2): discovery core.py api handler design, apply it here
     # to make this a less tangled mess as it gets extended
@@ -411,7 +432,7 @@ def handle_read_api_request(pathcomponents, configmanager):
     elif pathcomponents[2] == 'by-mac':
         if len(pathcomponents) == 3:
             return [msg.ChildCollection(x.replace(':', '-'))
-                    for x in sorted(list(_macmap))]
+                    for x in sorted(list(_apimacmap))]
         elif len(pathcomponents) == 4:
             return dump_macinfo(pathcomponents[-1])
     elif pathcomponents[2] == 'by-switch':
@@ -444,12 +465,14 @@ def handle_read_api_request(pathcomponents, configmanager):
                     for x in sorted(maclist)]
         if len(pathcomponents) == 8:
             return dump_macinfo(pathcomponents[-1])
+    elif pathcomponents[2] == 'rescan':
+        return [msg.KeyValueData({'scanning': mapupdating.locked()})]
     raise exc.NotFoundException('Unrecognized path {0}'.format(
         '/'.join(pathcomponents)))
 
 
 def dump_macinfo(macaddr):
-    macaddr = macaddr.replace('-', ':')
+    macaddr = macaddr.replace('-', ':').lower()
     info = _macmap.get(macaddr, None)
     if info is None:
         raise exc.NotFoundException(