Add batch support to nodeconfig

This reverts commit 2972374da8.

confluent_client/bin/collate

@@ -21,6 +21,7 @@
 
 import optparse
 import os
+import select
 import sys
 
 path = os.path.dirname(os.path.realpath(__file__))
@@ -70,6 +71,9 @@ def print_current():
     sys.stdout.flush()
 
 fullline = sys.stdin.readline()
+printpending = True
+clearpending = False
+holdoff = 0
 while fullline:
     for line in fullline.split('\n'):
         if not line:
@@ -78,9 +82,22 @@ while fullline:
             line = 'UNKNOWN: ' + line
         grouped.add_line(*line.split(': ', 1))
         if options.watch:
-            sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
-            print_current()
+            if not holdoff:
+                holdoff = os.times()[4] + 0.250
+            if (holdoff < os.times()[4] or
+                    not select.select((sys.stdin,), (), (), 0.250)[0]):
+                # print now, nothing pending
+                holdoff = 0
+                sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
+                print_current()
+                printpending = False
+                clearpending = True
+            else:
+                printpending = True
     fullline = sys.stdin.readline()
-if not options.watch:
+
+if printpending:
+    if clearpending:
+        sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
     print_current()
 

confluent_client/bin/confetty

@@ -763,7 +763,10 @@ def conserver_command(filehandle, localcommand):
 
 def get_command_bytes(filehandle, localcommand, cmdlen):
     while len(localcommand) < cmdlen:
-        ready, _, _ = select.select((filehandle,), (), (), 1)
+        try:
+            ready, _, _ = select.select((filehandle,), (), (), 1)
+        except select.error:
+            ready = ()
         if ready:
             localcommand += filehandle.read()
     return localcommand
@@ -776,7 +779,10 @@ def check_escape_seq(currinput, filehandle):
             sys.stdout.flush()
             return conserver_command(
                 filehandle, currinput[len(conserversequence):])
-        ready, _, _ = select.select((filehandle,), (), (), 3)
+        try:
+            ready, _, _ = select.select((filehandle,), (), (), 3)
+        except select.error:
+            ready = ()
         if not ready:  # 3 seconds of no typing
             break
         currinput += filehandle.read()
@@ -866,8 +872,11 @@ def check_power_state():
 
 while inconsole or not doexit:
     if inconsole:
-        rdylist, _, _ = select.select(
-            (sys.stdin, session.connection), (), (), 10)
+        try:
+            rdylist, _, _ = select.select(
+                (sys.stdin, session.connection), (), (), 10)
+        except select.error:
+            rdylist = ()
         for fh in rdylist:
             if fh == session.connection:
                 # this only should get called in the

confluent_client/bin/dir2img

@@ -0,0 +1,19 @@
+#!/bin/sh
+# This will take a given directory and make a 'big floppy image'
+# out of it, suitable for nodemedia upload.
+
+if [ -z "$1" -o -z "$2" ]; then
+        echo "Usage: $0 <directory> <imagefile>"
+        exit 1
+fi
+# Get the needed payload side
+SIZE=$(du -sB 512 $1|awk '{print $1}')
+ENTRIES=$(find $1 |wc -l)
+# Also, each file and directory has overhead, pad size by 32kb per file,
+# which should be overkill but other values proved to be inadequate
+# A deeper understanding of VFAT would probably allow for more precise value
+SIZE=$((SIZE + ENTRIES * 64))
+dd if=/dev/zero of=$2 bs=512 count=$SIZE
+# Make a big single sided floppy with many many tracks, saves on complex math
+mformat -i $2 -d 1 -t $SIZE -s 1 -h 1 ::
+mcopy -i $2 -s $1/* ::

confluent_client/bin/nodeattrib

@@ -35,12 +35,16 @@ if path.startswith('/opt'):
 import confluent.client as client
 
 argparser = optparse.OptionParser(
-    usage='''\n       %prog [-b] noderange [list of attributes]  \
+    usage='''\n       %prog [-b] noderange [list of attributes or 'all']  \
              \n       %prog -c noderange <list of attributes>  \
+             \n       %prog -e noderange <attribute names to set>  \
              \n       %prog noderange attribute1=value1 attribute2=value,...
              \n ''')
 argparser.add_option('-b', '--blame', action='store_true',
                      help='Show information about how attributes inherited')
+argparser.add_option('-e', '--environment', action='store_true',
+                     help='Set attributes, but from environment variable of '
+                          'same name')
 argparser.add_option('-c', '--clear', action='store_true',
                      help='Clear attributes')
 (options, args) = argparser.parse_args()
@@ -63,7 +67,7 @@ exitcode = 0
 nodetype="noderange"
 
 if len(args) > 1:
-    if "=" in args[1] or options.clear:
+    if "=" in args[1] or options.clear or options.environment:
         if "=" in args[1] and options.clear:
             print("Can not clear and set at the same time!")
             argparser.print_help()

confluent_client/bin/nodeconfig

@@ -19,6 +19,7 @@
 import os
 import signal
 import optparse
+import shlex
 import sys
 
 try:
@@ -43,6 +44,20 @@ def bailout(msg, code=1):
 
 
 argparser = optparse.OptionParser()
+argparser.add_option('-c', '--comparedefault', dest='comparedefault',
+                     action='store_true', default=False,
+                     help='Compare given settings to default or list settings '
+                          'that are non default')
+argparser.add_option('-b', '--batch', dest='batch', metavar='settings.batch',
+                     default=False, help='Provide settings in a batch file')
+argparser.add_option('-d', '--detail', dest='detail',
+                     action='store_true', default=False,
+                     help='Provide verbose information as available, such as '
+                          'help text and possible valid values')
+argparser.add_option('-x', '--exclude', dest='exclude',
+                     action='store_true', default=False,
+                     help='Treat positional arguments as items to not '
+                          'examine, compare, or restore default')
 (options, args) = argparser.parse_args()
 
 cfgpaths = {
@@ -55,6 +70,8 @@ cfgpaths = {
     'bmc.ipv4_gateway': (
         'configuration/management_controller/net_interfaces/management',
         'ipv4_gateway'),
+    'bmc.hostname': (
+        'configuration/management_controller/hostname', 'hostname'),
 }
 
 autodeps = {
@@ -70,60 +87,111 @@ client.check_globbing(noderange)
 setmode = None
 assignment = {}
 queryparms = {}
+printsys = []
+setsys = {}
+forceset = False
+needval = None
 
-
-if len(args) == 1:
+if len(args) == 1 or options.exclude:
+    if not options.exclude:
+        printsys = 'all'
     for candidate in cfgpaths:
         path, attrib = cfgpaths[candidate]
         path = '/noderange/{0}/{1}'.format(noderange, path)
         if path not in queryparms:
             queryparms[path] = {}
         queryparms[path][attrib] = candidate
-for param in args[1:]:
-    if '=' in param:
-        if setmode is None:
+
+
+def _assign_value():
+    if key not in cfgpaths:
+        setsys[key] = value
+    for depkey, depval in autodeps.get(key, []):
+        assignment[depkey] = depval
+    assignment[key] = value
+
+
+def parse_config_line(arguments):
+    global setmode, forceset, key, value, needval, candidate, path, attrib
+    for param in arguments:
+        if param == 'show':
+            continue  # forgive muscle memory of pasu users
+        if param == 'set':
             setmode = True
-        if setmode != True:
-            bailout('Cannot do set and query in same command')
-        key, _, value = param.partition('=')
-        if key not in cfgpaths:
-            bailout('Unrecognized setting: {0}'.format(key))
-        for depkey, depval in autodeps.get(key, []):
-            assignment[depkey] = depval
-        assignment[key] = value
-    else:
-        if setmode is None:
-            setmode = False
-        if setmode != False:
-            bailout('Cannot do set and query in same command')
-        if '.' not in param:
-            matchedparms = False
-            for candidate in cfgpaths:
-                if candidate.startswith('{0}.'.format(param)):
-                    matchedparms = True
-                    path, attrib = cfgpaths[candidate]
-                    path = '/noderange/{0}/{1}'.format(noderange, path)
-                    if path not in queryparms:
-                        queryparms[path] = {}
-                    queryparms[path][attrib] = candidate
-            if not matchedparms:
-                bailout('Unrecognized settings category: {0}'.format(param))
-        elif param not in cfgpaths:
-            bailout('Unrecognized parameter: {0}'.format(param))
+            forceset = True
+            continue
+        if needval:
+            key = needval
+            value = param
+            _assign_value()
+            continue
+        if '=' in param or param[-1] == ':' or forceset:
+            if setmode is None:
+                setmode = True
+            if setmode != True:
+                bailout('Cannot do set and query in same command')
+            if '=' in param:
+                key, _, value = param.partition('=')
+                _assign_value()
+            elif param[-1] == ':':
+                needval = param[:-1]
+            else:
+                needval = param
         else:
-            path, attrib = cfgpaths[param]
-            path = '/noderange/{0}/{1}'.format(noderange, path)
-            if path not in queryparms:
-                queryparms[path] = {}
-            queryparms[path][attrib] = param
+            if setmode is None:
+                setmode = False
+            if setmode != False:
+                bailout('Cannot do set and query in same command')
+            if '.' not in param:
+                matchedparms = False
+                for candidate in cfgpaths:
+                    if candidate.startswith('{0}.'.format(param)):
+                        matchedparms = True
+                        if not options.exclude:
+                            path, attrib = cfgpaths[candidate]
+                            path = '/noderange/{0}/{1}'.format(noderange, path)
+                            if path not in queryparms:
+                                queryparms[path] = {}
+                            queryparms[path][attrib] = candidate
+                        else:
+                            try:
+                                del queryparms[path]
+                            except KeyError:
+                                pass
+                if not matchedparms:
+                    printsys.append(param)
+            elif param not in cfgpaths:
+                printsys.append(param)
+            else:
+                path, attrib = cfgpaths[param]
+                path = '/noderange/{0}/{1}'.format(noderange, path)
+                if path not in queryparms:
+                    queryparms[path] = {}
+                queryparms[path][attrib] = param
+
+if options.batch:
+    printsys = []
+    argfile = open(options.batch, 'r')
+    argset = argfile.readline()
+    while argset:
+        parse_config_line(shlex.split(argset))
+        argset = argfile.readline()
+else:
+    parse_config_line(args[1:])
 session = client.Command()
+rcode = 0
 if setmode:
+    if options.exclude:
+        sys.stderr.write('Cannot use exclude and assign at the same time\n')
+        sys.exit(1)
     updatebypath = {}
     attrnamebypath = {}
     for key in assignment:
         if key not in cfgpaths:
-            bailout('Unknown settings key: {0}'.format(key))
-        path, attrib = cfgpaths[key]
+            path = 'configuration/system/all'
+            attrib = key
+        else:
+            path, attrib = cfgpaths[key]
         if path not in updatebypath:
             updatebypath[path] = {}
             attrnamebypath[path] = {}
@@ -132,16 +200,31 @@ if setmode:
     # well, we want to expand things..
     # check ipv4, if requested change method to static
     for path in updatebypath:
-        for r in session.update('/noderange/{0}/{1}'.format(noderange, path),
+        for fr in session.update('/noderange/{0}/{1}'.format(noderange, path),
                                 updatebypath[path]):
-            for node in r:
-                keyval = r[node]['value']
+            rcode |= client.printerror(fr)
+            for node in fr.get('databynode', []):
+                r = fr['databynode'][node]
+                rcode |= client.printerror(r, node)
+                if 'value' not in r:
+                    continue
+                keyval = r['value']
                 key, val = keyval.split('=')
                 if key in attrnamebypath[path]:
                     key = attrnamebypath[path][key]
                 print('{0}: {1}: {2}'.format(node, key, val))
 else:
     for path in queryparms:
-        client.print_attrib_path(path, session, list(queryparms[path]),
-                                 NullOpt(), queryparms[path])
-
+        if options.comparedefault:
+            continue
+        rc = client.print_attrib_path(path, session, list(queryparms[path]),
+                                      NullOpt(), queryparms[path])
+        if rc:
+            sys.exit(rc)
+    if printsys or options.exclude:
+        if printsys == 'all':
+            printsys = []
+        path = '/noderange/{0}/configuration/system/all'.format(noderange)
+        rcode = client.print_attrib_path(path, session, printsys,
+                                         options)
+sys.exit(rcode)

confluent_client/bin/nodedefine

@@ -47,7 +47,7 @@ session = client.Command()
 exitcode = 0
 attribs = {'name': noderange}
 for arg in args[1:]:
-    key, val = arg.split('=')
+    key, val = arg.split('=', 1)
     attribs[key] = val
 for r in session.create('/noderange/', attribs):
     if 'error' in r:

confluent_client/bin/nodediscover

@@ -173,6 +173,13 @@ def list_discovery(options, session):
     for mac in list_matching_macs(options, session):
         print_disco(options, session, mac)
 
+def clear_discovery(options, session):
+    for mac in list_matching_macs(options, session):
+        for res in session.delete('/discovery/by-mac/{0}'.format(mac)):
+            if 'deleted' in res:
+                print('Cleared info for {0}'.format(res['deleted']))
+            else:
+                print(repr(res))
 
 def list_matching_macs(options, session):
     path = '/discovery/'
@@ -184,6 +191,10 @@ def list_matching_macs(options, session):
         path += 'by-uuid/{0}/'.format(options.uuid)
     if options.type:
         path += 'by-type/{0}/'.format(options.type)
+    if options.state:
+        if options.state == 'unknown':
+            options.state = 'unidentified'
+        path += 'by-state/{0}/'.format(options.state).lower()
     if options.mac:
         path += 'by-mac/{0}'.format(options.mac)
         result = list(session.read(path))[0]
@@ -223,7 +234,7 @@ def assign_discovery(options, session):
 
 def main():
     parser = optparse.OptionParser(
-        usage='Usage: %prog [list|assign|rescan] [options]')
+        usage='Usage: %prog [list|assign|rescan|clear] [options]')
     # -a for 'address' maybe?
     # order by
     # show state (discovered or..
@@ -234,6 +245,9 @@ def main():
     parser.add_option('-m', '--model', dest='model',
                       help='Operate with nodes matching the specified model '
                        'number', metavar='MODEL')
+    parser.add_option('-d', '--discoverystate', dest='state',
+                      help='The discovery state of the entries (discovered, '
+                           'identified, and unidentified)')
     parser.add_option('-s', '--serial', dest='serial',
                       help='Operate against the system matching the specified '
                            'serial number', metavar='SERIAL')
@@ -253,12 +267,14 @@ def main():
                       help='Import bulk assignment data from given CSV file',
                       metavar='IMPORT.CSV')
     (options, args) = parser.parse_args()
-    if len(args) == 0 or args[0] not in ('list', 'assign', 'rescan'):
+    if len(args) == 0 or args[0] not in ('list', 'assign', 'rescan', 'clear'):
         parser.print_help()
         sys.exit(1)
     session = client.Command()
     if args[0] == 'list':
         list_discovery(options, session)
+    if args[0] == 'clear':
+        clear_discovery(options, session)
     if args[0] == 'assign':
         assign_discovery(options, session)
     if args[0] == 'rescan':

confluent_client/bin/nodefirmware

@@ -35,18 +35,6 @@ import confluent.screensqueeze as sq
 
 exitcode = 0
 
-def printerror(res, node=None):
-    global exitcode
-    if 'errorcode' in res:
-        exitcode = res['errorcode']
-    if 'error' in res:
-        if node:
-            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
-        else:
-            sys.stderr.write('{0}\n'.format(res['error']))
-        if 'errorcode' not in res:
-            exitcode = 1
-
 
 def printfirm(node, prefix, data):
     if 'model' in data:
@@ -64,9 +52,10 @@ def printfirm(node, prefix, data):
         version = ' '.join(builddesc)
     print('{0}: {1}: {2}'.format(node, prefix, version))
 
+components = ['all']
 
 argparser = optparse.OptionParser(
-    usage="Usage: %prog <noderange> [update [--backup <file>]")
+    usage="Usage: %prog <noderange> [update [--backup <file>]]|[<components>]")
 argparser.add_option('-b', '--backup', action='store_true',
                      help='Target a backup bank rather than primary')
 (options, args) = argparser.parse_args()
@@ -74,10 +63,13 @@ upfile = None
 try:
     noderange = args[0]
     if len(args) > 1:
-        if args[1] != 'update':
-            argparser.print_help()
-            sys.exit(1)
-        upfile = args[2]
+        if args[1] == 'update':
+            upfile = args[2]
+        else:
+            components = []
+            for arg in args[1:]:
+                components += arg.split(',')
+
 except IndexError:
     argparser.print_help()
     sys.exit(1)
@@ -135,18 +127,25 @@ def update_firmware(session, filename):
         sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
 
 def show_firmware(session):
-    for res in session.read('/noderange/{0}/inventory/firmware/all/all'.format(
-            noderange)):
-        printerror(res)
-        if 'databynode' not in res:
-            continue
-        for node in res['databynode']:
-            printerror(res['databynode'][node], node)
-            if 'firmware' not in res['databynode'][node]:
+    global exitcode
+    firmware_shown = False
+    for component in components:
+        for res in session.read(
+                '/noderange/{0}/inventory/firmware/all/{1}'.format(
+                    noderange, component)):
+            exitcode |= client.printerror(res)
+            if 'databynode' not in res:
                 continue
-            for inv in res['databynode'][node]['firmware']:
-                for prefix in inv:
-                    printfirm(node, prefix, inv[prefix])
+            for node in res['databynode']:
+                exitcode |= client.printerror(res['databynode'][node], node)
+                if 'firmware' not in res['databynode'][node]:
+                    continue
+                for inv in res['databynode'][node]['firmware']:
+                    for prefix in inv:
+                        firmware_shown = True
+                        printfirm(node, prefix, inv[prefix])
+    if not firmware_shown:
+        argparser.print_help()
 
 
 try:

confluent_client/bin/nodegroupattrib

@@ -36,11 +36,15 @@ import confluent.client as client
 argparser = optparse.OptionParser(
     usage='''\n       %prog [options]   \
              \n       %prog [options] nodegroup [list of attributes]  \
-             \n       %prog [options] nodegroup group=value1,value2   \
-             \n       %prog [options] nodegroup group=value1,value2
+             \n       %prog [options] nodegroup nodes=value1,value2   \
+             \n       %prog -e nodegroup <attribute names to set>  \             
+             \n       %prog [options] nodegroup nodes=value1,value2
              \n ''')
 argparser.add_option('-b', '--blame', action='store_true',
                      help='Show information about how attributes inherited')
+argparser.add_option('-e', '--environment', action='store_true',
+                     help='Set attributes, but from environment variable of '
+                          'same name')
 argparser.add_option('-c', '--clear', action='store_true',
                      help='Clear variables')
 (options, args) = argparser.parse_args()

confluent_client/bin/nodegroupdefine

@@ -47,7 +47,7 @@ session = client.Command()
 exitcode = 0
 attribs = {'name': noderange}
 for arg in args[1:]:
-    key, val = arg.split('=')
+    key, val = arg.split('=', 1)
     attribs[key] = val
 for r in session.create('/nodegroups/', attribs):
     if 'error' in r:

confluent_client/bin/nodeinventory

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 import codecs
+import json
 import optparse
 import os
 import re
@@ -51,8 +52,8 @@ def print_mem_info(node, prefix, meminfo):
         memdescfmt += '3-{1} '
     elif meminfo['memory_type'] == 'DDR4 SDRAM':
         memdescfmt += '4-{1} '
-    elif meminfo['memory_type'] == 'Unknown':
-        print('{0}: Unrecognized Memory'.format(node))
+    else:
+        print('{0}: {1}: Unrecognized Memory'.format(node, prefix))
         return
     if meminfo['ecc']:
         memdescfmt += 'ECC '
@@ -89,9 +90,10 @@ url = '/noderange/{0}/inventory/hardware/all/all'
 
 argparser = optparse.OptionParser(
     usage="Usage: %prog <noderange> [serial|model|uuid|mac]")
+argparser.add_option('-j', '--json', action='store_true', help='Output JSON')
 (options, args) = argparser.parse_args()
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
 except IndexError:
     argparser.print_help()
     sys.exit(1)
@@ -114,6 +116,8 @@ if len(args) > 1:
                     filters.append(re.compile('mac address'))
                     url = '/noderange/{0}/inventory/hardware/all/all'
 try:
+    if options.json:
+        databynode = {}
     session = client.Command()
     for res in session.read(url.format(noderange)):
         printerror(res)
@@ -127,7 +131,12 @@ try:
                 prefix = inv['name']
                 if not inv['present']:
                     if not filters:
-                        print '{0}: {1}: Not Present'.format(node, prefix)
+                        if options.json:
+                            if node not in databynode:
+                                databynode[node] = {}
+                            databynode[node][prefix] = inv
+                        else:
+                            print '{0}: {1}: Not Present'.format(node, prefix)
                     continue
                 info = inv['information']
                 info.pop('board_extra', None)
@@ -136,6 +145,11 @@ try:
                 info.pop('product_extra', None)
                 if 'memory_type' in info:
                     if not filters:
+                        if options.json:
+                            if node not in databynode:
+                                databynode[node] = {}
+                            databynode[node][prefix] = inv
+                            continue
                         print_mem_info(node, prefix, info)
                     continue
                 for datum in info:
@@ -147,9 +161,17 @@ try:
                             continue
                     if info[datum] is None:
                         continue
+                    if options.json:
+                        if node not in databynode:
+                            databynode[node] = {}
+                        databynode[node][prefix] = inv
+                        break
                     print(u'{0}: {1} {2}: {3}'.format(node, prefix,
                                                      pretty(datum),
                                                      info[datum]))
+    if options.json:
+        print(json.dumps(databynode, sort_keys=True, indent=4,
+                         separators=(',', ': ')))
 except KeyboardInterrupt:
     print('')
-sys.exit(exitcode)
+sys.exit(exitcode)

confluent_client/bin/nodemedia

@@ -0,0 +1,190 @@
+#!/usr/bin/python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+import time
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.screensqueeze as sq
+
+exitcode = 0
+
+
+def get_update_progress(session, url):
+    for res in session.read(url):
+        status = res['phase']
+        percent = res['progress']
+        detail = res['detail']
+        if status == 'error':
+            text = 'error!'
+        else:
+            text = '{0}: {1:3.0f}%'.format(status, percent)
+    return text, status, detail
+
+
+def printerror(res, node=None):
+    global exitcode
+    if 'errorcode' in res:
+        exitcode = res['errorcode']
+    if 'error' in res:
+        if node:
+            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
+        else:
+            sys.stderr.write('{0}\n'.format(res['error']))
+        if 'errorcode' not in res:
+            exitcode = 1
+    for node in res.get('databynode', ()):
+        printerror(res['databynode'][node], node)
+
+
+def attach_media(noderange, media):
+    global exitcode
+    session = client.Command()
+    if ':' not in media:
+        sys.stderr.write('Full URL required for attach\n')
+        sys.exit(1)
+    resource = '/noderange/{0}/media/attach'.format(noderange)
+    for res in session.update(resource, {'url': media}):
+        printerror(res)
+    list_media(noderange, media)
+
+
+def list_media(noderange, media):
+    session = client.Command()
+    resource = '/noderange/{0}/media/current'.format(noderange)
+    for res in session.read(resource):
+        printerror(res)
+        for node in res.get('databynode', []):
+            url = res['databynode'][node].get('url', None)
+            name =  res['databynode'][node].get('name', None)
+            if url and not res['databynode'][node].get('secure', False):
+                name += ' (insecure)'
+            if not name:
+                continue
+            print('{0}: {1}'.format(node, url + '/' + name if url else name))
+
+
+def detach_media(noderange, media):
+    global exitcode
+    session = client.Command()
+    resource = '/noderange/{0}/media/detach'.format(noderange)
+    for res in session.update(resource, {'detachall': 1}):
+        printerror(res)
+
+
+def upload_media(noderange, media):
+    global exitcode
+    if not os.path.exists(media):
+        sys.stderr.write('Unable to locate requested file {0}\n'.format(
+            media))
+        sys.exit(404)
+    session = client.Command()
+    output = sq.ScreenPrinter(noderange, session)
+    filename = os.path.abspath(media)
+    resource = '/noderange/{0}/media/uploads/'.format(noderange)
+    upargs = {'filename': filename}
+    noderrs = {}
+    nodeurls = {}
+    for res in session.create(resource, upargs):
+        if 'created' not in res:
+            for nodename in res.get('databynode', ()):
+                output.set_output(nodename, 'error!')
+                noderrs[nodename] = res['databynode'][nodename].get(
+                    'error', 'Unknown Error')
+            continue
+        watchurl = res['created']
+        currnode = watchurl.split('/')[1]
+        nodeurls[currnode] = '/' + watchurl
+    while nodeurls:
+        for node in list(nodeurls):
+            progress, status, err = get_update_progress(
+                session, nodeurls[node])
+            if status == 'error':
+                exitcode = 1
+                noderrs[node] = err
+            if status in ('error', 'complete', 'pending'):
+                list(session.delete(nodeurls[node]))
+                del nodeurls[node]
+            output.set_output(node, progress)
+        time.sleep(2)
+    allerrnodes = ','.join(noderrs)
+    if noderrs:
+        sys.stderr.write(
+            'Nodes had errors receiving media ({0})!\n'.format(allerrnodes))
+    for node in noderrs:
+        sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
+    list_media(noderange, media)
+
+funmap = {
+    'upload': upload_media,
+    'attach': attach_media,
+    'detachall': detach_media,
+    'list': list_media,
+}
+
+
+class OptParser(optparse.OptionParser):
+
+    def format_epilog(self, formatter):
+        return self.expand_prog_name(self.epilog)
+
+def main():
+    argparser = OptParser(
+        usage="Usage: %prog <noderange> [list|upload|attach|detachall] "
+              "<filename>|all|<url>",
+        epilog='\nupload will take the specified file and upload it to the '
+               'BMC.\n\n'
+               'attach will instruct the BMC to connect a remote media to the '
+               'specified url.\n\ndetachall will remove *ALL* uploaded and '
+               'attached urls from the BMC\n\nlist shows currently mounted '
+               'media.\n\nSee `man %prog` for more info.\n')
+    (options, args) = argparser.parse_args()
+    media = None
+    try:
+        noderange = args[0]
+        operation = args[1]
+        arglength = 2
+        if operation in ('attach', 'upload'):
+            media = args[2]
+            arglength = 3
+        if len(args) > arglength:
+            argparser.print_help()
+            sys.exit(1)
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    client.check_globbing(noderange)
+    try:
+        handler = funmap[operation]
+    except KeyError:
+        argparser.print_help()
+        sys.exit(1)
+    handler(noderange, media)
+if __name__ == '__main__':
+    main()

confluent_client/bin/nodepower

@@ -34,6 +34,9 @@ import confluent.client as client
 argparser = optparse.OptionParser(
     usage="Usage: %prog [options] noderange "
           "([status|on|off|shutdown|boot|reset])")
+argparser.add_option('-p', '--showprevious', dest='previous',
+                     action='store_true', default=False,
+                     help='Show previous power state')
 (options, args) = argparser.parse_args()
 try:
     noderange = args[0]
@@ -42,11 +45,11 @@ except IndexError:
     sys.exit(1)
 client.check_globbing(noderange)
 setstate = None
-if len(sys.argv) > 2:
+if len(args) > 1:
     if setstate == 'softoff':
         setstate = 'shutdown'
-    elif not sys.argv[2] in ('stat', 'state', 'status'):
-        setstate = sys.argv[2]
+    elif not args[1] in ('stat', 'state', 'status'):
+        setstate = args[1]
 
 if setstate not in (None, 'on', 'off', 'shutdown', 'boot', 'reset'):
     argparser.print_help()
@@ -54,5 +57,19 @@ if setstate not in (None, 'on', 'off', 'shutdown', 'boot', 'reset'):
 session = client.Command()
 exitcode = 0
 session.add_precede_key('oldstate')
-sys.exit(
-    session.simple_noderange_command(noderange, '/power/state', setstate))
+
+if options.previous:
+    # get previous states
+    prev = {}
+    for rsp in session.read("/noderange/{0}/power/state".format(noderange)):
+        # gets previous (current) states
+
+        databynode = rsp["databynode"]
+
+        for node in databynode:
+            prev[node] = databynode[node]["state"]["value"]
+
+    # add dictionary to session
+    session.add_precede_dict(prev)
+
+sys.exit(session.simple_noderange_command(noderange, '/power/state', setstate))

confluent_client/bin/noderun

@@ -42,7 +42,7 @@ def run():
         usage="Usage: %prog noderange commandexpression",
         epilog="Expressions are the same as in attributes, e.g. "
                "'ipmitool -H {hardwaremanagement.manager}' will be expanded.")
-    argparser.add_option('-c', '--count', type='int', default=168,
+    argparser.add_option('-f', '-c', '--count', type='int', default=168,
                          help='Number of commands to run at a time')
     # among other things, FD_SETSIZE limits.  Besides, spawning too many
     # processes can be unkind for the unaware on memory pressure and such...
@@ -101,6 +101,7 @@ def run():
                     if ret is not None:
                         exitcode = exitcode | ret
                         all.discard(r)
+                        r.close()
                         if desc['type'] == 'stdout' and pendingexecs:
                             node, cmdv = pendingexecs.popleft()
                             run_cmdv(node, cmdv, all, pipedesc)
@@ -125,4 +126,4 @@ def run_cmdv(node, cmdv, all, pipedesc):
 
 
 if __name__ == '__main__':
-    run()
+    run()

confluent_client/bin/nodeshell

@@ -42,7 +42,7 @@ def run():
         usage="Usage: %prog noderange commandexpression",
         epilog="Expressions are the same as in attributes, e.g. "
                "'ipmitool -H {hardwaremanagement.manager}' will be expanded.")
-    argparser.add_option('-c', '--count', type='int', default=168,
+    argparser.add_option('-f', '-c', '--count', type='int', default=168,
                          help='Number of commands to run at a time')
     # among other things, FD_SETSIZE limits.  Besides, spawning too many
     # processes can be unkind for the unaware on memory pressure and such...
@@ -86,7 +86,7 @@ def run():
             desc = pipedesc[r]
             node = desc['node']
             data = True
-            while data and select.select([r], [], [], 0):
+            while data and select.select([r], [], [], 0)[0]:
                 data = r.readline()
                 if data:
                     if desc['type'] == 'stdout':
@@ -102,6 +102,7 @@ def run():
                     if ret is not None:
                         exitcode = exitcode | ret
                         all.discard(r)
+                        r.close()
                         if desc['type'] == 'stdout' and pendingexecs:
                             node, cmdv = pendingexecs.popleft()
                             run_cmdv(node, cmdv, all, pipedesc)
@@ -126,4 +127,4 @@ def run_cmdv(node, cmdv, all, pipedesc):
 
 
 if __name__ == '__main__':
-    run()
+    run()

confluent_client/confluent/client.py

@@ -1,7 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2014 IBM Corporation
-# Copyright 2015-2016 Lenovo
+# Copyright 2015-2018 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -33,6 +33,21 @@ _attraliases = {
     'bmcpass': 'secret.hardwaremanagementpassword',
 }
 
+
+def printerror(res, node=None):
+    exitcode = 0
+    if 'errorcode' in res:
+        exitcode = res['errorcode']
+    if 'error' in res:
+        if node:
+            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
+        else:
+            sys.stderr.write('{0}\n'.format(res['error']))
+        if 'errorcode' not in res:
+            exitcode = 1
+    return exitcode
+
+
 def cprint(txt):
     print(txt)
     sys.stdout.flush()
@@ -53,6 +68,7 @@ def _parseserver(string):
 
 class Command(object):
     def __init__(self, server=None):
+        self._prevdict = None
         self._prevkeyname = None
         self.connection = None
         self._currnoderange = None
@@ -88,6 +104,9 @@ class Command(object):
     def add_precede_key(self, keyname):
         self._prevkeyname = keyname
 
+    def add_precede_dict(self, dict):
+        self._prevdict = dict
+
     def handle_results(self, ikey, rc, res, errnodes=None):
         if 'error' in res:
             if errnodes is not None:
@@ -120,6 +139,9 @@ class Command(object):
                 if self._prevkeyname and self._prevkeyname in res[node]:
                     cprint('{0}: {2}->{1}'.format(
                         node, val, res[node][self._prevkeyname]['value']))
+                elif self._prevdict and node in self._prevdict:
+                    cprint('{0}: {2}->{1}'.format(
+                        node, val, self._prevdict[node]))
                 else:
                     cprint('{0}: {1}'.format(node, val))
         return rc
@@ -239,8 +261,7 @@ class Command(object):
             certreqs = ssl.CERT_NONE
             knownhosts = True
         self.connection = ssl.wrap_socket(self.connection, ca_certs=cacert,
-                                          cert_reqs=certreqs,
-                                          ssl_version=ssl.PROTOCOL_TLSv1)
+                                          cert_reqs=certreqs)
         if knownhosts:
             certdata = self.connection.getpeercert(binary_form=True)
             fingerprint = 'sha512$' + hashlib.sha512(certdata).hexdigest()
@@ -290,10 +311,10 @@ def attrrequested(attr, attrlist, seenattributes):
             candidate = candidate.replace('hm', 'hardwaremanagement', 1)
         if candidate in _attraliases:
             candidate = _attraliases[candidate]
-        if candidate == attr:
+        if candidate.lower() == attr.lower():
             seenattributes.add(truename)
             return True
-        elif attr.startswith(candidate + '.'):
+        elif attr.lower().startswith(candidate.lower() + '.'):
             seenattributes.add(truename)
             return True
     return False
@@ -312,20 +333,30 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
             sys.stderr.write(res['error'] + '\n')
             exitcode = 1
             continue
-        for node in res['databynode']:
-            for attr in res['databynode'][node]:
+        for node in sorted(res['databynode']):
+            for attr, val in sorted(
+                    res['databynode'][node].items(),
+                    key=lambda (k, v): v.get('sortid', k) if isinstance(v, dict) else k):
+                if attr == 'error':
+                    sys.stderr.write('{0}: Error: {1}\n'.format(node, val))
+                    continue
+                if attr == 'errorcode':
+                    exitcode |= val
+                    continue
                 seenattributes.add(attr)
-                if rename and attr in rename:
-                    printattr = rename[attr]
+                if rename:
+                    printattr = rename.get(attr, attr)
                 else:
                     printattr = attr
                 currattr = res['databynode'][node][attr]
-                if (requestargs is None or requestargs == [] or attrrequested(
-                        attr, requestargs, seenattributes)):
+                if show_attr(attr, requestargs, seenattributes, options):
                     if 'value' in currattr:
                         if currattr['value'] is not None:
+                            val = currattr['value']
+                            if isinstance(val, list):
+                                val = ','.join(val)
                             attrout = '{0}: {1}: {2}'.format(
-                                node, printattr, currattr['value'])
+                                node, printattr, val)
                         else:
                             attrout = '{0}: {1}:'.format(node, printattr)
                     elif 'isset' in currattr:
@@ -347,8 +378,11 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
                         attrout = '{0}: {1}: {2}'.format(node, printattr, ','.join(map(str, dictout)))
                     else:
                         cprint("CODE ERROR" + repr(attr))
-
-                    if options.blame or 'broken' in currattr:
+                    try:
+                        blame = options.blame
+                    except AttributeError:
+                        blame = False
+                    if blame or 'broken' in currattr:
                         blamedata = []
                         if 'inheritedfrom' in currattr:
                             blamedata.append('inherited from group {0}'.format(
@@ -360,7 +394,36 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
                                     currattr['expression']))
                         if blamedata:
                             attrout += ' (' + ', '.join(blamedata) + ')'
-                    cprint(attrout)
+                    try:
+                        comparedefault = options.comparedefault
+                    except AttributeError:
+                        comparedefault = False
+                    if comparedefault:
+                        try:
+                            exclude = options.exclude
+                        except AttributeError:
+                            exclude = False
+                        if ((requestargs and not exclude) or
+                                (currattr.get('default', None) is not None and
+                                currattr.get('value', None) is not None and
+                                currattr['value'] != currattr['default'])):
+                            cprint('{0}: {1}: {2} (Default: {3})'.format(
+                                node, printattr, currattr['value'],
+                                currattr['default']))
+                    else:
+
+                        try:
+                            details = options.detail
+                        except AttributeError:
+                            details = False
+                        if details:
+                            if currattr.get('help', None):
+                                attrout += ' (Help: {0})'.format(
+                                    currattr['help'].encode('utf-8'))
+                            if currattr.get('possible', None):
+                                attrout += ' (Choices: {0})'.format(
+                                    ','.join(currattr['possible']))
+                        cprint(attrout)
     if not exitcode:
         if requestargs:
             for attr in requestargs:
@@ -370,6 +433,19 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
     return exitcode
 
 
+def show_attr(attr, requestargs, seenattributes, options):
+    try:
+        reverse = options.exclude
+    except AttributeError:
+        reverse = False
+    if requestargs is None or requestargs == []:
+        return True
+    processattr = attrrequested(attr, requestargs, seenattributes)
+    if reverse:
+        processattr = not processattr
+    return processattr
+
+
 def printgroupattributes(session, requestargs, showtype, nodetype, noderange, options):
     exitcode = 0
     seenattributes = set([])
@@ -431,26 +507,45 @@ def updateattrib(session, updateargs, nodetype, noderange, options):
                     exitcode = res['errorcode']
                 sys.stderr.write('Error: ' + res['error'] + '\n')
         sys.exit(exitcode)
+    elif hasattr(options, 'environment') and options.environment:
+        for key in updateargs[1:]:
+            key = key.replace('.', '_')
+            value = os.environ.get(
+                key, os.environ[key.upper()])
+            # Let's do one pass to make sure that there's not a usage problem
+        for key in updateargs[1:]:
+            key = key.replace('.', '_')
+            value = os.environ.get(
+                key, os.environ[key.upper()])
+            if (nodetype == "nodegroups"):
+                exitcode = session.simple_nodegroups_command(noderange,
+                                                             'attributes/all',
+                                                             value, key)
+            else:
+                exitcode = session.simple_noderange_command(noderange,
+                                                            'attributes/all',
+                                                            value, key)
+        sys.exit(exitcode)
     else:
         if "=" in updateargs[1]:
             try:
-                if len(updateargs[1:]) > 1:
-                    for val in updateargs[1:]:
-                        val = val.split('=')
-                        if (nodetype == "nodegroups"):
-                            exitcode =  session.simple_nodegroups_command(noderange, 'attributes/all',
-                                                                         val[1],val[0])
-                        else:
-                            exitcode = session.simple_noderange_command(noderange, 'attributes/all',
-                                                                        val[1], val[0])
-                else:
-                    val = updateargs[1].split('=')
-                    if nodetype == "nodegroups" :
-                        exitcode = session.simple_nodegroups_command(noderange, 'attributes/all',
-                                                                     val[1], val[0])
+                for val in updateargs[1:]:
+                    val = val.split('=', 1)
+                    if val[0][-1] in (',', '-', '^'):
+                        key = val[0][:-1]
+                        if val[0][-1] == ',':
+                            value = {'prepend': val[1]}
+                        elif val[0][-1] in ('-', '^'):
+                            value = {'remove': val[1]}
+                    else:
+                        key = val[0]
+                        value = val[1]
+                    if (nodetype == "nodegroups"):
+                        exitcode =  session.simple_nodegroups_command(noderange, 'attributes/all',
+                                                                     value, key)
                     else:
                         exitcode = session.simple_noderange_command(noderange, 'attributes/all',
-                                                                    val[1], val[0])
+                                                                    value, key)
             except:
                 sys.stderr.write('Error: {0} not a valid expression\n'.format(str(updateargs[1:])))
                 exitcode = 1

confluent_client/confluent/tlvdata.py

@@ -20,6 +20,11 @@ from datetime import datetime
 import json
 import struct
 
+try:
+    unicode
+except NameError:
+    unicode = str
+
 def decodestr(value):
     ret = None
     try:
@@ -38,17 +43,28 @@ def unicode_dictvalues(dictdata):
         elif isinstance(dictdata[key], datetime):
             dictdata[key] = dictdata[key].strftime('%Y-%m-%dT%H:%M:%S')
         elif isinstance(dictdata[key], list):
-            for i in xrange(len(dictdata[key])):
-                if isinstance(dictdata[key][i], str):
-                    dictdata[key][i] = decodestr(dictdata[key][i])
-                elif isinstance(dictdata[key][i], dict):
-                    unicode_dictvalues(dictdata[key][i])
+            _unicode_list(dictdata[key])
         elif isinstance(dictdata[key], dict):
             unicode_dictvalues(dictdata[key])
 
 
+def _unicode_list(currlist):
+    for i in xrange(len(currlist)):
+        if isinstance(currlist[i], str):
+            currlist[i] = decodestr(currlist[i])
+        elif isinstance(currlist[i], dict):
+            unicode_dictvalues(currlist[i])
+        elif isinstance(currlist[i], list):
+            _unicode_list(currlist[i])
+
+
 def send(handle, data):
-    if isinstance(data, str):
+    if isinstance(data, unicode):
+        try:
+            data = data.encode('utf-8')
+        except AttributeError:
+            pass
+    if isinstance(data, str) or isinstance(data, unicode):
         # plain text, e.g. console data
         tl = len(data)
         if tl == 0:
@@ -74,6 +90,14 @@ def send(handle, data):
         handle.sendall(struct.pack("!I", tl))
         handle.sendall(sdata)
 
+def recvall(handle, size):
+    rd = handle.recv(size)
+    while len(rd) < size:
+        nd = handle.recv(size - len(rd))
+        if not nd:
+            raise Exception("Error reading data")
+        rd += nd
+    return rd
 
 def recv(handle):
     tl = handle.recv(4)

confluent_client/confluent_env.sh

@@ -29,6 +29,7 @@ alias nodehealth='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export C
 alias nodeidentify='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeidentify'
 alias nodeinventory='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeinventory'
 alias nodelist='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodelist'
+alias nodemedia='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodemedia'
 alias nodepower='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodepower'
 alias noderemove='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; noderemove'
 alias nodereseat='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodereseat'

confluent_client/doc/man/collate.ronn

@@ -8,8 +8,11 @@ collate(1) -- Organize text input by node
 ## DESCRIPTION
 
 **collate** takes input in the form of <nodename>: <data> and groups
-the output for each <nodename> together, and checks for identical data to further group nodes together.  It also will sort the output groups so that
-the most frequently seen output is printed first, and then other groups in descending order of frequency.
+the output for each <nodename> together, and checks for identical data to further group nodes together.
+Output groups are sorted in descending size such that the topmost group is the largest, and the
+last output group is the smallest.  In the event of equally sized output groups,
+the groups are sorted alphanumerically by their header, and each header has
+node and group names sorted alphanumerically.
 
 ## OPTIONS
 

confluent_client/doc/man/nodeattrib.ronn

@@ -3,9 +3,10 @@ nodeattrib(8) -- List or change confluent nodes attributes
 
 ## SYNOPSIS
 
-`nodeattrib [-b] <noderange> [<nodeattribute>...]`  
+`nodeattrib [-b] <noderange> [all|<nodeattribute>...]`
 `nodeattrib <noderange> [<nodeattribute1=value1> <nodeattribute2=value2> ...]`  
 `nodeattrib -c <noderange> <nodeattribute1> <nodeattribute2> ...`  
+`nodeattrib -e <noderange> <nodeattribute1> <nodeattribute2> ...`  
 
 ## DESCRIPTION
 
@@ -18,9 +19,16 @@ displayed.  If `-b` is specified, it will also display information on
 how inherited and expression based attributes are defined.  Attributes can be
 straightforward values, or an expression as documented in nodeattribexpressions(5).
 For a full list of attributes, run `nodeattrib <node> all` against a node.
-If `-c` is specified, this will set the nodeattribute to a null valid.
+If `-c` is specified, this will set the nodeattribute to a null value.
 This is different from setting the value to an empty string.
 
+If the word all is specified, then all available attributes are given.
+Omitting any attribute name or the word 'all' will display only attributes
+that are currently set.
+
+For the `groups` attribute, it is possible to add a group by doing
+`groups,=<newgroup>` and to remove by doing `groups^=<oldgroup>`
+
 Note that `nodeattrib <group>` will likely not provide the expected behavior.
 See nodegroupattrib(8) command on how to manage attributes on a group level.
 
@@ -30,6 +38,8 @@ See nodegroupattrib(8) command on how to manage attributes on a group level.
   Annotate inherited and expression based attributes to show their base value.
 * `-c`, `--clear`:
   Clear specified nodeattributes
+* `-e`, `--environment`:
+  Set specified attributes based on exported environment variable of matching name.  Environment variable names may be lower case or all upper case.  Replace . with _ as needed (e.g. info.note may be specified as either $info_note or $INFO_NOTE
 
 ## EXAMPLES
 * Listing matching nodes of a simple noderange:

confluent_client/doc/man/nodeattribexpressions.ronn

@@ -39,7 +39,7 @@ number of operators at the end to indicate formatting changes.
 
 Another common element to pull into an expression is the node name in whole:
 
-`hardwaremanagement.manager={nodename}-imm`  
+`hardwaremanagement.manager={node}-imm`
 
 Additionally other attributes may be pulled in:
 
@@ -47,7 +47,7 @@ Additionally other attributes may be pulled in:
 
 Multiple expressions are permissible within a single attribute:
 
-`hardwaremanagement.manager={nodename}-{hardwaremanagement.method}`  
+`hardwaremanagement.manager={node}-{hardwaremanagement.method}`
 
 A note to developers: in general the API layer will automatically recognize a
 generic set attribute to string with expression syntax and import it as an

confluent_client/doc/man/nodeconfig.ronn

@@ -3,8 +3,8 @@ nodeconfig(8) -- Show or change node configuration
 
 ## SYNOPSIS
 
-`nodecanfig <noderange> [<configuration>..]`
-`nodecanfig <noderange> [<configuration=value>..]`
+`nodeconfig <noderange> [options] [<configuration>..]`
+`nodeconfig <noderange> [options] [<configuration=value>..]`
 
 ## DESCRIPTION
 
@@ -14,6 +14,26 @@ running configuration on the node firmware.  Calling without '=' will show the
 current value, and '=' will change the value.  Network information can be
 given as a node expression, as documented in the man page for nodeattribexpressions(5).
 
+## OPTIONS
+
+* `-c`, `--comparedefault`:
+  Take the given settings and compare against default value, if available.  If
+  no configuration values are specified, it will show only those that differ.
+  If combined with `-x`, will show all differing values except those indicated
+  by `-x`
+
+* `-x`, `--exclude`:
+  Rather than listing only the specified configuration parameters, list all
+  attributes except for the specified ones
+
+* `-d`, `--detail`:
+  Provide detailed data as available.  This can include help text and valid
+  values for a setting.
+
+* `-b`, '--batch':
+   Provide arguments as lines of a file, rather than the command line.
+
+
 ## EXAMPLES
 * Showing the current IP configuration of noderange BMC/IMM/XCC:
     `# nodeconfig s3,s4 bmc`  

confluent_client/doc/man/nodediscover.ronn

@@ -5,7 +5,9 @@ nodediscover(8)  -- List or manage confluent node discovery
 
 `nodediscover rescan`  
 `nodediscover [options] list`  
-`nodeattrib [options] assign`  
+`nodediscover [options] assign`
+`nodediscover [options] rescan`
+`nodediscover [options] clear`
 
 ## DESCRIPTION
 
@@ -22,6 +24,14 @@ data may be filtered by various parameters, as denoted in the options below.
 identity or, using `-i`, using a csv file to assign nodes all at once.  For
 example, a spreadsheet of serial numbers to desired node names could be used.
 
+**nodediscover rescan** requests the server to do an active sweep for new
+devices.  Generally every effort is made to passively detect devices as they
+become available (as they boot or are plugged in), however sometimes an active
+scan is the best approach to catch something that appears to be missing.
+
+**nodedsicover clear** requests the server forget about a selection of
+detected device.  It takes the same arguments as **nodediscover list**.
+
 ## CSV FORMAT
 
 The CSV format used by nodediscover consists of one header describing the
@@ -65,12 +75,26 @@ the nodes.
 * `-e MAC`, `--ethaddr=MAC`:
   Operate against the system with the specified MAC
   address
-* `-t TYPE, --type=TYPE`:
+* `-t TYPE`, `--type=TYPE`:
   Operate against the system of the specified type
-* `-c, --csv`:
+* `-c`, `--csv`:
   Use CSV formatted output
 * `-i IMPORT.CSV`, `--import=IMPORT.CSV`:
   Import bulk assignment data from given CSV file
+* `-d STATE`, `--discoverystate=STATE`:
+  Indicate devices with a particular state.  The states are listed below
+* discovered: The device has been identified and has also had discovery
+              activities performed, including any relevant certificate
+              exchanges and deploying user and network configuration.
+* identified:  The device has been identified as to what node it is
+               supposed to be, however no active changes to the attributes
+               or device configuration has been performed.  This is
+               generally discovery awaiting approval due to
+               discovery.policy specifying a strict security model.
+* unidentified:  A device has been sensed, but no node identity has been
+                 established at all.  It provides data that can be used
+                 for nodediscover assign, as well as current IP addresses
+                 that can be used for manual efforts as possible.
 
 ## EXAMPLES
 

confluent_client/doc/man/nodefirmware.ronn

@@ -4,12 +4,19 @@ nodefirmware(8) -- Report firmware information on confluent nodes
 ## SYNOPSIS
 
 `nodefirmware <noderange>`  
-`nodefirmware <noderange> update [--backup] <filename>`
+`nodefirmware <noderange> <components>|core`  
+`nodefirmware <noderange> update [--backup] <filename>`  
 
 ## DESCRIPTION
 
-`nodefirmware` reports and updates various firmware on nodes.  In the update form, it accepts a single
-file and attempts to update it using the out of band facilities.  Firmware updates can end in one of three states:
+`nodefirmware` reports and updates various firmware on nodes.  By default it
+will retrieve all firmware, but can be directed to fetch specific firmware by
+calling out the name of the firmware (e.g. uefi or xcc) or request reading only
+core firmware firmware by using the word 'core', which is generally a quicker
+operation.
+
+In the update form, it accepts a single file and attempts to update it using
+the out of band facilities.  Firmware updates can end in one of three states:
 
 * `error`: The attempted update encountered an error that prevented successful install.  Nodes experiencing this state will be reported at the end and more detail on the error will be given
 * `pending`:  The firmware update process has completed, but the firmware will not be active until the relevant component next resets.  Generally speaking, for UEFI update the system will need a reboot, and for BMC updates, the `nodebmcreset` command will begin the process to activate the firmware.

confluent_client/doc/man/nodemedia.ronn

@@ -0,0 +1,57 @@
+nodemedia(8) -- Manage server remote media
+=========================================================
+
+## SYNOPSIS
+
+`nodemedia <noderange> [attach|detachall|list|upload] [options] <media>`
+
+## DESCRIPTION
+
+**nodemedia** manages the remote media functionality of supported BMCs.
+
+`list` shows all the current remote media the BMCs of the noderange are
+providing to the host platform.  The string (insecure) is appended to URLs that
+are mounted in an insecure fashion.  http is insecure, and https is also
+insecure when no meaningful certificate validation is performed.  Currently
+there is no action that can change this, and this is purely informational.  A
+future version of software may provide a means to increase security of attached
+remote media.  If no media is mounted, this will provide no output, error
+conditions will result in output to standard error.
+
+`detachall` removes all the currently provided media to the host.  This unlinks
+remote media from urls and deletes uploaded media from the BMC.
+
+`upload` takes the given media image and uploads it to the BMC.  This causes
+the remote media to reside internally to the system without having to go
+to the network after the upload.  This is more constrained, for example the
+Lenovo xClarity Controller has a limit of 50 megabytes, but it has zero ongoing
+load on the media source.
+
+`attach` takes a URL to a remote media as an argument, and has the given
+BMCs map a virtual USB device to that url.  Content is loaded on demand, and
+as such that URL is referenced potentially once for every IO operation that
+the host platform attempts.
+
+## OPTIONS
+
+* `-c`:
+  Specify the maximum number of instances to run concurrently.
+
+## EXAMPLES
+* Listing currently mounted media:
+  `# nodemedia s1-s4 list`  
+  `s1: boot.img`  
+  `s2: boot.img`  
+  `s4: boot.img`  
+
+* Uploading a small boot image to the BMC:
+  `# nodemedia s1-s4 upload boot.img`  
+  `s1:complete: 100%     s2:complete: 100%     s3:complete: 100%     s4:complete: 100%`  
+  `s1: boot.img`  
+  `s4: boot.img`  
+  `s2: boot.img`  
+
+* Attaching a larger ISO for on-demand access:
+  `# nodemedia s1,s4 attach http://172.30.0.6/install/rhel74.iso`  
+  `s4: http://172.30.0.6/install/rhel74.iso (insecure)`  
+  `s1: http://172.30.0.6/install/rhel74.iso (insecure)`

confluent_client/doc/man/nodepower.ronn

@@ -4,7 +4,7 @@ nodepower(8) -- Check or change power state of confluent nodes
 ## SYNOPSIS
 
 `nodepower <noderange>`  
-`nodepower <noderange> [on|off|boot|shutdown|reset|status]`
+`nodepower <noderange> [-p] [on|off|boot|shutdown|reset|status]`
 
 ## DESCRIPTION
 
@@ -26,6 +26,11 @@ respond.
 off will not react to this request.
 * `status`:  Behave identically to having no argument passed at all.
 
+## OPTIONS
+
+* `-p`, '--showprevious':
+   Show previous power state for all directives that may change power state.
+
 ## EXAMPLES
 * Get power state of nodes n1 through n4:
   `# nodepower n1-n4`  

confluent_client/doc/man/noderun.ronn

@@ -48,6 +48,10 @@ themselves, see nodeshell(8).
   `n4:  01 10 00`  
   `n2:  01 10 00`  
 
+
+* If wanting to use literal {} in the command, they must be escaped by doubling:
+  `# noderun n1-n4 "echo {node} | awk '{{print $1}}'"`
+
 ## SEE ALSO
 
 nodeshell(8)

confluent_client/doc/man/nodesetboot.ronn

@@ -4,7 +4,7 @@ nodesetboot(8) -- Check or set next boot device for noderange
 ## SYNOPSIS
 
 `nodesetboot <noderange>`  
-`nodesetboot [options] <noderang> [default|cd|network|setup|hd]`
+`nodesetboot [options] <noderange> [default|cd|network|setup|hd]`
 
 ## DESCRIPTION
 

confluent_client/doc/man/nodeshell.ronn

@@ -3,7 +3,7 @@ nodeshell(8) -- Execute command on many nodes in a noderange through ssh
 
 ## SYNOPSIS
 
-`nodeshell <noderange> <command to execute on each node>`
+`nodeshell <noderange> [options] <command to execute on each node>`
 
 ## DESCRIPTION
 
@@ -12,6 +12,11 @@ accepts and interpolates confluent attribute expressions as documented in
 nodeattribexpressions(5).  `nodeshell` provides stdout as stdout and stderr
 as stderr, unlike psh which combines all stdout and stderr into stdout.
 
+## OPTIONS
+
+* `-c`:
+  Specify the maximum number of instances to run concurrently.
+
 ## EXAMPLES
 
 * Running `echo hi` on for nodes:
@@ -22,7 +27,10 @@ as stderr, unlike psh which combines all stdout and stderr into stdout.
   `n4: hi`  
 
 * Setting a new static ip address temporarily on secondary interface of four nodes:
-  `# nodeshell n1-n4 ifconfig eth1 172.30.93.{n1}`  
+  `# nodeshell n1-n4 ifconfig eth1 172.30.93.{n1}`
+
+* If wanting to use literal {} in the command, they must be escaped by doubling:
+  `# nodeshell n1-n4 "ps | awk '{{print $1}}'"`
   
 ## SEE ALSO
 

confluent_client/samples/nodeattrib_from_switch.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+# This is a sample python script for going through all observed mac addresses
+# and assuming they are BMC related and printing nodeattrib commands
+# for each node to access the bmc using the interface specified on the command
+# line
+
+# Not necessarily as useful if there may be mistakes in the
+# net.switch/net.switchport attributes, but a handy utility in a pinch when
+# you really know
+
+
+import confluent.client as cl
+import socket
+import struct
+c = cl.Command()
+macs = []
+interface = sys.argv[1]
+for mac in c.read('/networking/macs/by-mac/'):
+    macs.append(mac['item']['href'])
+for mac in macs:
+    macinfo = list(c.read('/networking/macs/by-mac/{0}'.format(mac)))[0]
+    if 'possiblenode' in macinfo and macinfo['possiblenode']:
+        if macinfo['macsonport'] > 1:
+            print('#Ambiguous set of macs on port for ' + macinfo[
+                'possiblenode'])
+        prefix = int(mac.replace('-', '')[:6], 16) ^ 0b100000000000000000
+        prefix = prefix << 8
+        prefix |= 0xff
+        suffix = int(mac.replace('-', '')[6:], 16)
+        suffix |= 0xfe000000
+        rawn = struct.pack('!QLL', 0xfe80000000000000, prefix, suffix)
+        bmc = socket.inet_ntop(socket.AF_INET6, rawn)
+        print('nodeattrib {0} bmc={1}%{2}'.format(macinfo['possiblenode'],
+                                                  bmc, interface))

confluent_server/bin/collective

@@ -0,0 +1,121 @@
+#!/usr/bin/env python
+
+import argparse
+import errno
+import os
+import socket
+import subprocess
+import sys
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    # if installed into system path, do not muck with things
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.tlvdata as tlvdata
+
+try:
+    input = raw_input
+except NameError:
+    pass
+
+def make_certificate():
+    umask = os.umask(0077)
+    try:
+        os.makedirs('/etc/confluent/cfg')
+    except OSError as e:
+        if e.errno == errno.EEXIST and os.path.isdir('/etc/confluent/cfg'):
+            pass
+        else:
+            raise
+    if subprocess.check_call(
+            'openssl ecparam -name secp384r1 -genkey -out '
+            '/etc/confluent/privkey.pem'.split(' ')):
+        raise Exception('Error generating private key')
+
+    if subprocess.check_call('openssl req -new -x509 -key '
+                              '/etc/confluent/privkey.pem -days 7300 -out '
+                              '/etc/confluent/srvcert.pem -subj /CN='
+                              '{0}'.format(socket.gethostname()).split(' ')):
+        raise Exception('Error generating certificate')
+    print('Certificate generated successfully')
+    os.umask(umask)
+
+
+def show_invitation(name):
+    if not os.path.exists('/etc/confluent/srvcert.pem'):
+        make_certificate()
+    s = client.Command().connection
+    tlvdata.send(s, {'collective': {'operation': 'invite', 'name': name}})
+    invite = tlvdata.recv(s)['collective']
+    if 'error' in invite:
+        sys.stderr.write(invite['error'] + '\n')
+        return
+    print('{0}'.format(invite['invitation']))
+
+
+def join_collective(server, invitation):
+    if not os.path.exists('/etc/confluent/srvcert.pem'):
+        make_certificate()
+    s = client.Command().connection
+    while not invitation:
+        invitation = raw_input('Paste the invitation here: ')
+    tlvdata.send(s, {'collective': {'operation': 'join',
+                                    'invitation': invitation,
+                                    'server': server}})
+    res = tlvdata.recv(s)
+    print(res.get('collective',
+                  {'status': 'Unknown response: ' + repr(res)})['status'])
+
+
+def show_collective():
+    s = client.Command().connection
+    tlvdata.send(s, {'collective': {'operation': 'show'}})
+    res = tlvdata.recv(s)
+    if 'error' in res['collective']:
+        print(res['collective']['error'])
+        return
+    if 'quorum' in res['collective']:
+        print('Quorum: {0}'.format(res['collective']['quorum']))
+    print('Leader: {0}'.format(res['collective']['leader']))
+    if 'active' in res['collective']:
+        if res['collective']['active']:
+            print('Active collective members:')
+            for member in res['collective']['active']:
+                print('    {0}'.format(member))
+        if res['collective']['offline']:
+            print('Offline collective members:')
+            for member in res['collective']['offline']:
+                print('    {0}'.format(member))
+    else:
+        print('Run collective show on leader for more data')
+
+def main():
+    a = argparse.ArgumentParser(description='Confluent server utility')
+    sp = a.add_subparsers(dest='command')
+    gc = sp.add_parser('gencert', help='Generate Confluent Certificates for '
+                                'collective mode and remote CLI access')
+    sl = sp.add_parser('show', help='Show information about the collective')
+    ic = sp.add_parser('invite', help='Generate a invitation to allow a new '
+                                    'confluent instance to join as a '
+                                    'collective member')
+    ic.add_argument('name', help='Name of server to invite to join the '
+                                 'collective')
+    jc = sp.add_parser('join', help='Join a collective')
+    jc.add_argument('server', help='A server currently in the collective')
+    jc.add_argument('-i', help='Invitation provided by runniing invite on an '
+                               'existing collective member')
+    cmdset = a.parse_args()
+    if cmdset.command == 'gencert':
+        make_certificate()
+    elif cmdset.command == 'invite':
+        show_invitation(cmdset.name)
+    elif cmdset.command == 'join':
+        join_collective(cmdset.server, cmdset.i)
+    elif cmdset.command == 'show':
+        show_collective()
+
+if __name__ == '__main__':
+    main()

confluent_server/bin/confluentdbutil

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 
+import getpass
 import optparse
 import sys
 import os
@@ -32,6 +33,8 @@ argparser = optparse.OptionParser(
     usage="Usage: %prog [options] [dump|restore] [path]")
 argparser.add_option('-p', '--password',
                      help='Password to use to protect/unlock a protected dump')
+argparser.add_option('-i', '--interactivepassword', help='Prompt for password',
+                     action='store_true')
 argparser.add_option('-r', '--redact', action='store_true',
                      help='Redact potentially sensitive data rather than store')
 argparser.add_option('-u', '--unprotected', action='store_true',
@@ -39,6 +42,14 @@ argparser.add_option('-u', '--unprotected', action='store_true',
                            ' the key information.  Fields will be encrypted, '
                            'but keys.json will contain unencrypted decryption'
                            ' keys that may be used to read the dump')
+argparser.add_option('-s', '--skipkeys', action='store_true',
+                      help='This specifies to dump the encrypted data without '
+                           'dumping the keys needed to decrypt it.  This is '
+                           'suitable for an automated incremental backup, '
+                           'where an earlier password protected dump has a '
+                           'protected keys.json file, and only the protected '
+                           'data is needed.  keys do not change and as such '
+                           'they do not require incremental backup')
 (options, args) = argparser.parse_args()
 if len(args) != 2 or args[0] not in ('dump', 'restore'):
     argparser.print_help()
@@ -51,17 +62,32 @@ if args[0] == 'restore':
     if pid is not None:
         print("Confluent is running, must shut down to restore db")
         sys.exit(1)
-    cfm.restore_db_from_directory(dumpdir, options.password)
+    try:
+        cfm.restore_db_from_directory(dumpdir, options.password)
+    except Exception as e:
+        print(str(e))
+        sys.exit(1)
 elif args[0] == 'dump':
-    if options.password is None and not (options.unprotected or options.redact):
+    password = options.password
+    if not password and options.interactivepassword:
+        passcfm = None
+        while passcfm is None or password != passcfm:
+            password = getpass.getpass(
+                'Enter password to protect the backup: ')
+            passcfm = getpass.getpass('Confirm password to protect the backup: ')
+    if password is None and not (options.unprotected or options.redact
+                                         or options.skipkeys):
         print("Must indicate a password to protect or -u to opt opt of "
-              "secure value protection or -r to skip all protected data")
+              "secure value protection or -r to redact sensitive information, "
+              "or -s to do encrypted backup that requires keys.json from "
+              "another backup to restore.")
         sys.exit(1)
     os.umask(077)
     main._initsecurity(conf.get_config())
     if not os.path.exists(dumpdir):
         os.makedirs(dumpdir)
-    cfm.dump_db_to_directory(dumpdir, options.password, options.redact)
+    cfm.dump_db_to_directory(dumpdir, options.password, options.redact,
+                             options.skipkeys)
 
 
 

confluent_server/bin/createcert.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+umask 0077
+openssl ecparam -name secp384r1 -genkey -out /etc/confluent/privkey.pem
+openssl req -new -x509 -key /etc/confluent/privkey.pem -days 760 -out /etc/confluent/srvcert.pem -subj /CN=$(hostname)

confluent_server/confluent/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.5.0.dev395.ggacb3a20"

confluent_server/confluent/auth.py

@@ -22,7 +22,7 @@
 import confluent.config.configmanager as configmanager
 import eventlet
 import eventlet.tpool
-import Crypto.Protocol.KDF as KDF
+import Cryptodome.Protocol.KDF as KDF
 import hashlib
 import hmac
 import multiprocessing

confluent_server/confluent/collective/invites.py

@@ -0,0 +1,60 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This handles the process of generating and tracking/validating invites
+
+import base64
+import hashlib
+import hmac
+import os
+pending_invites = {}
+
+def create_server_invitation(servername):
+    servername = servername.encode('utf-8')
+    randbytes = (3 - ((len(servername) + 2) % 3)) % 3 + 64
+    invitation = os.urandom(randbytes)
+    pending_invites[servername] = invitation
+    return base64.b64encode(servername + b'@' + invitation)
+
+def create_client_proof(invitation, mycert, peercert):
+    return hmac.new(invitation, peercert + mycert, hashlib.sha256).digest()
+
+def check_server_proof(invitation, mycert, peercert, proof):
+    validproof = hmac.new(invitation, mycert + peercert, hashlib.sha256
+                          ).digest()
+    return proof == validproof
+
+def check_client_proof(servername, mycert, peercert, proof):
+    servername = servername.encode('utf-8')
+    if servername not in pending_invites:
+        return False
+    invitation = pending_invites[servername]
+    validproof = hmac.new(invitation, mycert + peercert, hashlib.sha256
+                          ).digest()
+    if proof == validproof:
+        # We know that the client knew the secret, and that it measured our
+        # certificate, and thus calling code can bless the certificate, and
+        # we can forget the invitation
+        del pending_invites[servername]
+        # We now want to prove to the client that we also know the secret,
+        # and that we measured their certificate well
+        # Now to generate an answer...., reverse the cert order so our answer
+        # is different, but still proving things
+        return hmac.new(invitation, peercert + mycert, hashlib.sha256
+                          ).digest()
+    # The given proof did not verify the invitation
+    return False
+

confluent_server/confluent/collective/manager.py

@@ -0,0 +1,494 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import base64
+import confluent.collective.invites as invites
+import confluent.config.configmanager as cfm
+import confluent.exceptions as exc
+import confluent.tlvdata as tlvdata
+import confluent.util as util
+import eventlet
+import eventlet.green.socket as socket
+import eventlet.green.ssl as ssl
+import eventlet.green.threading as threading
+import random
+try:
+    import OpenSSL.crypto as crypto
+except ImportError:
+    # while not always required, we use pyopenssl required for at least
+    # collective
+    crypto = None
+
+currentleader = None
+cfginitlock = None
+follower = None
+retrythread = None
+
+class ContextBool(object):
+    def __init__(self):
+        self.active = False
+
+    def __enter__(self):
+        self.active = True
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.active = False
+
+connecting = ContextBool()
+leader_init = ContextBool()
+
+
+def connect_to_leader(cert=None, name=None, leader=None):
+    global currentleader
+    global cfginitlock
+    global follower
+    if cfginitlock is None:
+        cfginitlock = threading.RLock()
+    if leader is None:
+        leader = currentleader
+    try:
+        remote = connect_to_collective(cert, leader)
+    except socket.error:
+        return False
+    with connecting:
+        with cfginitlock:
+            tlvdata.recv(remote)  # the banner
+            tlvdata.recv(remote)  # authpassed... 0..
+            if name is None:
+                name = get_myname()
+            tlvdata.send(remote, {'collective': {'operation': 'connect',
+                                                 'name': name,
+                                                 'txcount': cfm._txcount}})
+            keydata = tlvdata.recv(remote)
+            if not keydata:
+                return False
+            if 'error' in keydata:
+                if 'backoff' in keydata:
+                    eventlet.spawn_after(random.random(), connect_to_leader,
+                                         cert, name, leader)
+                    return True
+                if 'leader' in keydata:
+                    ldrc = cfm.get_collective_member_by_address(
+                        keydata['leader'])
+                    if ldrc and ldrc['name'] == name:
+                        raise Exception("Redirected to self")
+                    return connect_to_leader(name=name,
+                                             leader=keydata['leader'])
+                if 'txcount' in keydata:
+                    return become_leader(remote)
+                print(keydata['error'])
+                return False
+            if follower is not None:
+                follower.kill()
+                cfm.stop_following()
+                follower = None
+            colldata = tlvdata.recv(remote)
+            globaldata = tlvdata.recv(remote)
+            dbi = tlvdata.recv(remote)
+            dbsize = dbi['dbsize']
+            dbjson = ''
+            while (len(dbjson) < dbsize):
+                ndata = remote.recv(dbsize - len(dbjson))
+                if not ndata:
+                    try:
+                        remote.close()
+                    except Exception:
+                        pass
+                    raise Exception("Error doing initial DB transfer")
+                dbjson += ndata
+            cfm.clear_configuration()
+            try:
+                cfm._restore_keys(keydata, None, sync=False)
+                for c in colldata:
+                    cfm._true_add_collective_member(c, colldata[c]['address'],
+                                                    colldata[c]['fingerprint'],
+                                                    sync=False)
+                for globvar in globaldata:
+                    cfm.set_global(globvar, globaldata[globvar], False)
+                cfm._txcount = dbi.get('txcount', 0)
+                cfm.ConfigManager(tenant=None)._load_from_json(dbjson,
+                                                               sync=False)
+                cfm.commit_clear()
+            except Exception:
+                cfm.stop_following()
+                cfm.rollback_clear()
+                raise
+            currentleader = leader
+        #spawn this as a thread...
+        follower = eventlet.spawn(follow_leader, remote)
+    return True
+
+
+def follow_leader(remote):
+    global currentleader
+    cfm.follow_channel(remote)
+    # The leader has folded, time to startup again...
+    cfm.stop_following()
+    currentleader = None
+    eventlet.spawn_n(start_collective)
+
+
+def connect_to_collective(cert, member):
+    remote = socket.create_connection((member, 13001))
+    # TLS cert validation is custom and will not pass normal CA vetting
+    # to override completely in the right place requires enormous effort, so just defer until after connect
+    remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE, keyfile='/etc/confluent/privkey.pem',
+                             certfile='/etc/confluent/srvcert.pem')
+    if cert:
+        fprint = cert
+    else:
+        collent = cfm.get_collective_member_by_address(member)
+        fprint = collent['fingerprint']
+    if not util.cert_matches(fprint, remote.getpeercert(binary_form=True)):
+        # probably Janeway up to something
+        raise Exception("Certificate mismatch in the collective")
+    return remote
+
+
+def get_myname():
+    try:
+        with open('/etc/confluent/cfg/myname', 'r') as f:
+            return f.read().strip()
+    except IOError:
+        myname = socket.gethostname()
+        with open('/etc/confluent/cfg/myname', 'w') as f:
+            f.write(myname)
+        return myname
+
+def handle_connection(connection, cert, request, local=False):
+    global currentleader
+    global retrythread
+    operation = request['operation']
+    if cert:
+        cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    else:
+        if not local:
+            return
+
+        if 'show' == operation:
+            if not list(cfm.list_collective()):
+                tlvdata.send(connection,
+                             {'collective': {'error': 'Collective mode not '
+                                                      'enabled on this '
+                                                      'system'}})
+                return
+            if follower:
+                linfo = cfm.get_collective_member_by_address(currentleader)
+                remote = socket.create_connection((currentleader, 13001))
+                remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                         keyfile='/etc/confluent/privkey.pem',
+                                         certfile='/etc/confluent/srvcert.pem')
+                cert = remote.getpeercert(binary_form=True)
+                if not (linfo and util.cert_matches(
+                        linfo['fingerprint'],
+                        cert)):
+                    remote.close()
+                    tlvdata.send(connection,
+                                 {'error': 'Invalid certificate, '
+                                           'redo invitation process'})
+                    connection.close()
+                    return
+                tlvdata.recv(remote)  # ignore banner
+                tlvdata.recv(remote)  # ignore authpassed: 0
+                tlvdata.send(remote,
+                             {'collective': {'operation': 'getinfo',
+                                             'name': get_myname()}})
+                collinfo = tlvdata.recv(remote)
+            else:
+                collinfo = {}
+                populate_collinfo(collinfo)
+            try:
+                cfm.check_quorum()
+                collinfo['quorum'] = True
+            except exc.DegradedCollective:
+                collinfo['quorum'] = False
+            tlvdata.send(connection, {'collective':  collinfo})
+            return
+        if 'invite' == operation:
+            try:
+                cfm.check_quorum()
+            except exc.DegradedCollective:
+                tlvdata.send(connection,
+                    {'collective':
+                         {'error': 'Collective does not have quorum'}})
+                return
+            #TODO(jjohnson2): Cannot do the invitation if not the head node, the certificate hand-carrying
+            #can't work in such a case.
+            name = request['name']
+            invitation = invites.create_server_invitation(name)
+            tlvdata.send(connection,
+                         {'collective': {'invitation': invitation}})
+            connection.close()
+        if 'join' == operation:
+            invitation = request['invitation']
+            try:
+                invitation = base64.b64decode(invitation)
+                name, invitation = invitation.split('@', 1)
+            except Exception:
+                tlvdata.send(
+                    connection,
+                    {'collective':
+                         {'status': 'Invalid token format'}})
+                connection.close()
+                return
+            host = request['server']
+            try:
+                remote = socket.create_connection((host, 13001))
+                # This isn't what it looks like.  We do CERT_NONE to disable
+                # openssl verification, but then use the invitation as a
+                # shared secret to validate the certs as part of the join
+                # operation
+                remote = ssl.wrap_socket(remote,  cert_reqs=ssl.CERT_NONE,
+                                         keyfile='/etc/confluent/privkey.pem',
+                                         certfile='/etc/confluent/srvcert.pem')
+            except Exception:
+                tlvdata.send(
+                    connection,
+                    {'collective':
+                         {'status': 'Failed to connect to {0}'.format(host)}})
+                connection.close()
+                return
+            mycert = util.get_certificate_from_file(
+                '/etc/confluent/srvcert.pem')
+            cert = remote.getpeercert(binary_form=True)
+            proof = base64.b64encode(invites.create_client_proof(
+                invitation, mycert, cert))
+            tlvdata.recv(remote)  # ignore banner
+            tlvdata.recv(remote)  # ignore authpassed: 0
+            tlvdata.send(remote, {'collective': {'operation': 'enroll',
+                                                 'name': name, 'hmac': proof}})
+            rsp = tlvdata.recv(remote)
+            if 'error' in rsp:
+                tlvdata.send(connection, {'collective':
+                                              {'status': rsp['error']}})
+                connection.close()
+                return
+            proof = rsp['collective']['approval']
+            proof = base64.b64decode(proof)
+            j = invites.check_server_proof(invitation, mycert, cert, proof)
+            if not j:
+                remote.close()
+                tlvdata.send(connection, {'collective':
+                                              {'status': 'Bad server token'}})
+                connection.close()
+                return
+            tlvdata.send(connection, {'collective': {'status': 'Success'}})
+            connection.close()
+            currentleader = rsp['collective']['leader']
+            f = open('/etc/confluent/cfg/myname', 'w')
+            f.write(name)
+            f.close()
+            eventlet.spawn_n(connect_to_leader, rsp['collective'][
+                'fingerprint'], name)
+    if 'enroll' == operation:
+        #TODO(jjohnson2): error appropriately when asked to enroll, but the master is elsewhere
+        mycert = util.get_certificate_from_file('/etc/confluent/srvcert.pem')
+        proof = base64.b64decode(request['hmac'])
+        myrsp = invites.check_client_proof(request['name'], mycert,
+                                           cert, proof)
+        if not myrsp:
+            tlvdata.send(connection, {'error': 'Invalid token'})
+            connection.close()
+            return
+        myrsp = base64.b64encode(myrsp)
+        fprint = util.get_fingerprint(cert)
+        myfprint = util.get_fingerprint(mycert)
+        cfm.add_collective_member(get_myname(),
+                                  connection.getsockname()[0], myfprint)
+        cfm.add_collective_member(request['name'],
+                                  connection.getpeername()[0], fprint)
+        myleader = get_leader(connection)
+        ldrfprint = cfm.get_collective_member_by_address(
+            myleader)['fingerprint']
+        tlvdata.send(connection,
+                     {'collective': {'approval': myrsp,
+                                     'fingerprint': ldrfprint,
+                                     'leader': get_leader(connection)}})
+    if 'assimilate' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not util.cert_matches(droneinfo['fingerprint'], cert):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            return
+        if request['txcount'] < cfm._txcount:
+            tlvdata.send(connection,
+                         {'error': 'Refusing to be assimilated by inferior'
+                                   'transaction count',
+                          'txcount': cfm._txcount})
+            return
+        eventlet.spawn_n(connect_to_leader, None, None,
+                         leader=connection.getpeername()[0])
+        tlvdata.send(connection, {'status': 0})
+        connection.close()
+    if 'getinfo' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
+                                                cert)):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            connection.close()
+            return
+        collinfo = {}
+        populate_collinfo(collinfo)
+        tlvdata.send(connection, collinfo)
+    if 'connect' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
+                                                cert)):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            connection.close()
+            return
+        myself = connection.getsockname()[0]
+        if myself != get_leader(connection):
+            tlvdata.send(
+                connection,
+                {'error': 'Cannot assimilate, our leader is '
+                          'in another castle', 'leader': currentleader})
+            connection.close()
+            return
+        if connecting.active:
+            tlvdata.send(connection, {'error': 'Connecting right now',
+                                      'backoff': True})
+            connection.close()
+            return
+        if request['txcount'] > cfm._txcount:
+            retire_as_leader()
+            tlvdata.send(connection,
+                         {'error': 'Client has higher tranasaction count, '
+                                   'should assimilate me, connecting..',
+                          'txcount': cfm._txcount})
+            eventlet.spawn_n(connect_to_leader, None, None,
+                             connection.getpeername()[0])
+            connection.close()
+            return
+        if retrythread:
+            retrythread.cancel()
+            retrythread = None
+        with leader_init:
+            cfm.update_collective_address(request['name'],
+                                          connection.getpeername()[0])
+            tlvdata.send(connection, cfm._dump_keys(None, False))
+            tlvdata.send(connection, cfm._cfgstore['collective'])
+            tlvdata.send(connection, cfm.get_globals())
+            cfgdata = cfm.ConfigManager(None)._dump_to_json()
+            tlvdata.send(connection, {'txcount': cfm._txcount,
+                                      'dbsize': len(cfgdata)})
+            connection.sendall(cfgdata)
+        #tlvdata.send(connection, {'tenants': 0}) # skip the tenants for now,
+        # so far unused anyway
+        if not cfm.relay_slaved_requests(drone, connection):
+            if not retrythread:  # start a recovery if everyone else seems
+                # to have disappeared
+                retrythread = eventlet.spawn_after(30 + random.random(),
+                                                   start_collective)
+        # ok, we have a connecting member whose certificate checks out
+        # He needs to bootstrap his configuration and subscribe it to updates
+
+
+def populate_collinfo(collinfo):
+    iam = get_myname()
+    collinfo['leader'] = iam
+    collinfo['active'] = list(cfm.cfgstreams)
+    activemembers = set(cfm.cfgstreams)
+    activemembers.add(iam)
+    collinfo['offline'] = []
+    for member in cfm.list_collective():
+        if member not in activemembers:
+            collinfo['offline'].append(member)
+
+
+def try_assimilate(drone):
+    try:
+        remote = connect_to_collective(None, drone)
+    except socket.error:
+        # Oh well, unable to connect, hopefully the rest will be
+        # in order
+        return
+    tlvdata.send(remote, {'collective': {'operation': 'assimilate',
+                                         'name': get_myname(),
+                                         'txcount': cfm._txcount}})
+    tlvdata.recv(remote)  # the banner
+    tlvdata.recv(remote)  # authpassed... 0..
+    answer = tlvdata.recv(remote)
+    if answer and 'error' in answer:
+        connect_to_leader(None, None, leader=remote.getpeername()[0])
+
+def get_leader(connection):
+    if currentleader is None or connection.getpeername()[0] == currentleader:
+        become_leader(connection)
+    return currentleader
+
+def retire_as_leader():
+    global currentleader
+    cfm.stop_leading()
+    currentleader = None
+
+def become_leader(connection):
+    global currentleader
+    global follower
+    if follower:
+        follower.kill()
+        follower = None
+    currentleader = connection.getsockname()[0]
+    skipaddr = connection.getpeername()[0]
+    myname = get_myname()
+    for member in cfm.list_collective():
+        dronecandidate = cfm.get_collective_member(member)['address']
+        if dronecandidate in (currentleader, skipaddr) or member == myname:
+            continue
+        eventlet.spawn_n(try_assimilate, dronecandidate)
+
+
+def startup():
+    global cfginitlock
+    members = list(cfm.list_collective())
+    if len(members) < 2:
+        # Not in collective mode, return
+        return
+    if cfginitlock is None:
+        cfginitlock = threading.RLock()
+    eventlet.spawn_n(start_collective)
+
+def start_collective():
+    global follower
+    global retrythread
+    if follower:
+        follower.kill()
+        follower = None
+    if leader_init.active:  # do not start trying to connect if we are
+        # xmitting data to a follower
+        return
+    myname = get_myname()
+    for member in sorted(list(cfm.list_collective())):
+        if member == myname:
+            continue
+        if cfm.cfgleader is None:
+            cfm.stop_following(True)
+        ldrcandidate = cfm.get_collective_member(member)['address']
+        if connect_to_leader(name=myname, leader=ldrcandidate):
+            break
+    else:
+        retrythread = eventlet.spawn_after(30 + random.random(),
+                                           start_collective)
+
+

confluent_server/confluent/config/attributes.py

@@ -148,6 +148,14 @@ node = {
 #                        'autonode.servername, so that would not need to be '
 #                        'copied ')
 #    },
+    'collective.manager': {
+        'description': ('When in collective mode, the member of the '
+                        'collective currently considered to be responsible '
+                        'for this node.  At a future date, this may be '
+                        'modified automatically if another attribute '
+                        'indicates candidate managers, either for '
+                        'high availability or load balancing purposes.')
+    },
     'discovery.policy': {
         'description':  'Policy to use for auto-configuration of discovered '
                         'and identified nodes. Valid values are "manual", '
@@ -279,12 +287,17 @@ node = {
         'description': 'The method used to perform operations such as power '
                        'control, get sensor data, get inventory, and so on. '
     },
-    'enclosure.manager': {
-        'description': "The management device for this node's chassis",
-#        'appliesto': ['system'],
-    },
     'enclosure.bay': {
          'description': 'The bay in the enclosure, if any',
+#        'appliesto': ['system'],
+    },
+    'enclosure.extends': {
+        'description': 'When using an extendable enclosure, this is the node '
+                       'representing the manager that is one closer to the '
+                       'uplink.',
+    },
+    'enclosure.manager': {
+        'description': "The management device for this node's chassis",
 #        'appliesto': ['system'],
     },
 

confluent_server/confluent/consoleserver.py

@@ -23,14 +23,18 @@
 # there should be no more than one handler per node
 import codecs
 import collections
+import confluent.collective.manager as collective
 import confluent.config.configmanager as configmodule
 import confluent.exceptions as exc
 import confluent.interface.console as conapi
 import confluent.log as log
 import confluent.core as plugin
+import confluent.tlvdata as tlvdata
 import confluent.util as util
 import eventlet
 import eventlet.event
+import eventlet.green.socket as socket
+import eventlet.green.ssl as ssl
 import pyte
 import random
 import time
@@ -138,13 +142,16 @@ def pytechars2line(chars, maxlen=None):
 class ConsoleHandler(object):
     _plugin_path = '/nodes/{0}/_console/session'
     _logtobuffer = True
-    _genwatchattribs = frozenset(('console.method', 'console.logging'))
+    _genwatchattribs = frozenset(('console.method', 'console.logging',
+                                  'collective.manager'))
 
     def __init__(self, node, configmanager):
         self.clearpending = False
         self._dologging = True
+        self._is_local = True
         self._isondemand = False
         self.error = None
+        self._retrytime = 0
         self.cfgmgr = configmanager
         self.node = node
         self.connectstate = 'unconnected'
@@ -190,6 +197,16 @@ class ConsoleHandler(object):
             self.connectstate = 'connecting'
             eventlet.spawn(self._connect)
 
+    def _get_retry_time(self):
+        clustsize = len(self.cfgmgr._cfgstore['nodes'])
+        self._retrytime = self._retrytime * 2 + 1
+        if self._retrytime > 120:
+            self._retrytime = 120
+        retrytime = clustsize * 0.05 * self._retrytime
+        if retrytime > 120:
+            retrytime = 120
+        return retrytime + (retrytime * random.random())
+
     def feedbuffer(self, data):
         try:
             self.termstream.feed(data)
@@ -203,7 +220,7 @@ class ConsoleHandler(object):
     def check_isondemand(self):
         self._dologging = True
         attrvalue = self.cfgmgr.get_node_attributes(
-            (self.node,), ('console.logging',))
+            (self.node,), ('console.logging', 'collective.manager'))
         if self.node not in attrvalue:
             self._isondemand = False
         elif 'console.logging' not in attrvalue[self.node]:
@@ -214,6 +231,23 @@ class ConsoleHandler(object):
                 self._isondemand = True
             if (attrvalue[self.node]['console.logging']['value']) in ('none', 'memory'):
                 self._dologging = False
+        self.check_collective(attrvalue)
+
+    def check_collective(self, attrvalue):
+        myc = attrvalue.get(self.node, {}).get('collective.manager', {}).get(
+            'value', None)
+        if configmodule.list_collective() and not myc:
+            self._is_local = False
+            self._detach()
+            self._disconnect()
+        if myc and myc != collective.get_myname():
+            # Do not do console connect for nodes managed by another
+            # confluent collective member
+            self._is_local = False
+            self._detach()
+            self._disconnect()
+        else:
+            self._is_local = True
 
     def get_buffer_age(self):
         """Return age of buffered data
@@ -225,6 +259,10 @@ class ConsoleHandler(object):
         return False
 
     def _attribschanged(self, nodeattribs, configmanager, **kwargs):
+        if 'collective.manager' in nodeattribs[self.node]:
+            attrval = configmanager.get_node_attributes(self.node,
+                                                        'collective.manager')
+            self.check_collective(attrval)
         if 'console.logging' in nodeattribs[self.node]:
             # decide whether logging changes how we react or not
             self._dologging = True
@@ -273,6 +311,10 @@ class ConsoleHandler(object):
             'none or interactive,\r\nconnection loss, or service restart]')
         self.clearpending = True
 
+    def _detach(self):
+        for ses in list(self.livesessions):
+            ses.detach()
+
     def _disconnect(self):
         if self.connectionthread:
             self.connectionthread.kill()
@@ -294,6 +336,8 @@ class ConsoleHandler(object):
             self._disconnect()
 
     def _connect(self):
+        if not self._is_local:
+            return
         if self.connectionthread:
             self.connectionthread.kill()
             self.connectionthread = None
@@ -309,9 +353,9 @@ class ConsoleHandler(object):
             self.reconnect.cancel()
             self.reconnect = None
         try:
-            self._console = plugin.handle_path(
+            self._console = list(plugin.handle_path(
                 self._plugin_path.format(self.node),
-                "create", self.cfgmgr)
+                "create", self.cfgmgr))[0]
         except (exc.NotImplementedException, exc.NotFoundException):
             self._console = None
         except:
@@ -343,7 +387,7 @@ class ConsoleHandler(object):
             self.connectstate = 'unconnected'
             self._send_rcpts({'connectstate': self.connectstate,
                               'error': self.error})
-            retrytime = 120 + (120 * random.random())
+            retrytime = self._get_retry_time()
             if not self.reconnect:
                 self.reconnect = eventlet.spawn_after(retrytime, self._connect)
             return
@@ -353,7 +397,7 @@ class ConsoleHandler(object):
             self.connectstate = 'unconnected'
             self._send_rcpts({'connectstate': self.connectstate,
                               'error': self.error})
-            retrytime = 120 + (120 * random.random())
+            retrytime = self._get_retry_time()
             if not self.reconnect:
                 self.reconnect = eventlet.spawn_after(retrytime, self._connect)
             return
@@ -365,7 +409,7 @@ class ConsoleHandler(object):
             self.connectstate = 'unconnected'
             self._send_rcpts({'connectstate': self.connectstate,
                               'error': self.error})
-            retrytime = 120 + (120 * random.random())
+            retrytime = self._get_retry_time()
             if not self.reconnect:
                 self.reconnect = eventlet.spawn_after(retrytime, self._connect)
             return
@@ -373,13 +417,13 @@ class ConsoleHandler(object):
 
     def _got_connected(self):
         self.connectstate = 'connected'
+        self._retrytime = 0
         self.log(
             logdata='console connected', ltype=log.DataTypes.event,
             event=log.Events.consoleconnect)
         self._send_rcpts({'connectstate': self.connectstate})
 
     def _got_disconnected(self):
-        self.clearbuffer()
         if self.connectstate != 'unconnected':
             self.connectstate = 'unconnected'
             self.log(
@@ -388,6 +432,8 @@ class ConsoleHandler(object):
             self._send_rcpts({'connectstate': self.connectstate})
         if self._isalive:
             self._connect()
+        else:
+            self.clearbuffer()
 
     def close(self):
         self._isalive = False
@@ -400,6 +446,9 @@ class ConsoleHandler(object):
         if self.connectionthread:
             self.connectionthread.kill()
             self.connectionthread = None
+        if self._attribwatcher:
+            self.cfgmgr.remove_watcher(self._attribwatcher)
+            self._attribwatcher = None
 
     def get_console_output(self, data):
         # Spawn as a greenthread, return control as soon as possible
@@ -469,9 +518,6 @@ class ConsoleHandler(object):
             eventdata |= 1
         if self.shiftin is not None:
             eventdata |= 2
-        self.log(data, eventdata=eventdata)
-        self.lasttime = util.monotonic_time()
-        self.feedbuffer(data)
         # TODO: analyze buffer for registered events, examples:
         #   panics
         #   certificate signing request
@@ -480,6 +526,10 @@ class ConsoleHandler(object):
             self.feedbuffer(b'\x1bc')
             self._send_rcpts(b'\x1bc')
         self._send_rcpts(_utf8_normalize(data, self.shiftin, self.utf8decoder))
+        self.log(data, eventdata=eventdata)
+        self.lasttime = util.monotonic_time()
+        self.feedbuffer(data)
+
 
     def _send_rcpts(self, data):
         for rcpt in list(self.livesessions):
@@ -555,7 +605,12 @@ def _nodechange(added, deleting, configmanager):
 
 
 def _start_tenant_sessions(cfm):
-    for node in cfm.list_nodes():
+    nodeattrs = cfm.get_node_attributes(cfm.list_nodes(), 'collective.manager')
+    for node in nodeattrs:
+        manager = nodeattrs[node].get('collective.manager', {}).get('value',
+                                                                    None)
+        if manager and collective.get_myname() != manager:
+            continue
         try:
             connect_node(node, cfm)
         except:
@@ -571,11 +626,117 @@ def start_console_sessions():
 
 
 def connect_node(node, configmanager, username=None):
+    attrval = configmanager.get_node_attributes(node, 'collective.manager')
+    myc = attrval.get(node, {}).get('collective.manager', {}).get(
+        'value', None)
+    myname = collective.get_myname()
+    if myc and myc != collective.get_myname():
+        minfo = configmodule.get_collective_member(myc)
+        return ProxyConsole(node, minfo, myname, configmanager, username)
     consk = (node, configmanager.tenant)
     if consk not in _handled_consoles:
         _handled_consoles[consk] = ConsoleHandler(node, configmanager)
     return _handled_consoles[consk]
 
+# A stub console handler that just passes through to a remote confluent
+# collective member.  It can skip the multi-session sharing as that is handled
+# remotely
+class ProxyConsole(object):
+    _genwatchattribs = frozenset(('collective.manager',))
+
+    def __init__(self, node, managerinfo, myname, configmanager, user):
+        self.skipreplay = True
+        self.managerinfo = managerinfo
+        self.myname = myname
+        self.cfm = configmanager
+        self.node = node
+        self.user = user
+        self.remote = None
+        self.clisession = None
+        self._attribwatcher = configmanager.watch_attributes(
+            (self.node,), self._genwatchattribs, self._attribschanged)
+
+    def _attribschanged(self, nodeattribs, configmanager, **kwargs):
+        if self.clisession:
+            self.clisession.detach()
+            self.clisession = None
+
+    def relay_data(self):
+        data = tlvdata.recv(self.remote)
+        while data:
+            self.data_handler(data)
+            data = tlvdata.recv(self.remote)
+
+    def get_buffer_age(self):
+        # the server sends a buffer age if appropriate, no need to handle
+        # it explicitly in the proxy instance
+        return False
+
+    def get_recent(self):
+        # Again, delegate this to the remote collective member
+        self.skipreplay = False
+        return b''
+
+    def write(self, data):
+        # Relay data to the collective manager
+        try:
+            tlvdata.send(self.remote, data)
+        except Exception:
+            if self.clisession:
+                self.clisession.detach()
+            self.clisession = None
+
+
+    def attachsession(self, session):
+        self.clisession = session
+        self.data_handler = session.data_handler
+        termreq = {
+            'proxyconsole': {
+                'name': self.myname,
+                'user': self.user,
+                'tenant': self.cfm.tenant,
+                'node': self.node,
+                'skipreplay': self.skipreplay,
+                #TODO(jjohnson2): declare myself as a proxy,
+                #facilitate redirect rather than relay on manager change
+            },
+        }
+        try:
+            remote = socket.create_connection((self.managerinfo['address'], 13001))
+            remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                     keyfile='/etc/confluent/privkey.pem',
+                                     certfile='/etc/confluent/srvcert.pem')
+            if not util.cert_matches(self.managerinfo['fingerprint'],
+                                     remote.getpeercert(binary_form=True)):
+                raise Exception('Invalid peer certificate')
+        except Exception:
+            eventlet.sleep(3)
+            if self.clisession:
+                self.clisession.detach()
+            self.detachsession(None)
+            return
+        tlvdata.recv(remote)
+        tlvdata.recv(remote)
+        tlvdata.send(remote, termreq)
+        self.remote = remote
+        eventlet.spawn(self.relay_data)
+
+    def detachsession(self, session):
+        # we will disappear, so just let that happen...
+        if self.remote:
+            try:
+                tlvdata.send(self.remote, {'operation': 'stop'})
+            except Exception:
+                pass
+        self.clisession = None
+
+    def send_break(self):
+        tlvdata.send(self.remote, {'operation': 'break'})
+
+    def reopen(self):
+        tlvdata.send(self.remote, {'operation': 'reopen'})
+
+
 # this represents some api view of a console handler.  This handles things like
 # holding the caller specific queue data, for example, when http api should be
 # sending data, but there is no outstanding POST request to hold it,
@@ -667,6 +828,18 @@ class ConsoleSession(object):
         self._evt = None
         self.reghdl = None
 
+    def detach(self):
+        """Handler for the console handler to detach so it can reattach,
+        currently to facilitate changing from one collective.manager to
+        another
+
+        :return:
+        """
+        self.conshdl.detachsession(self)
+        self.connect_session()
+        self.conshdl.attachsession(self)
+        self.write = self.conshdl.write
+
     def got_data(self, data):
         """Receive data from console and buffer
 

confluent_server/confluent/core.py

@@ -35,7 +35,10 @@
 
 import confluent
 import confluent.alerts as alerts
+import confluent.tlvdata as tlvdata
 import confluent.config.attributes as attrscheme
+import confluent.config.configmanager as cfm
+import confluent.collective.manager as collective
 import confluent.discovery.core as disco
 import confluent.interface.console as console
 import confluent.exceptions as exc
@@ -46,11 +49,27 @@ try:
     import confluent.shellmodule as shellmodule
 except ImportError:
     pass
+try:
+    import OpenSSL.crypto as crypto
+except ImportError:
+    # Only required for collective mode
+    crypto = None
+import confluent.util as util
+import eventlet.greenpool as greenpool
+import eventlet.green.ssl as ssl
+import eventlet.queue as queue
 import itertools
 import os
+try:
+    import cPickle as pickle
+except ImportError:
+    import pickle
+import socket
+import struct
 import sys
 
 pluginmap = {}
+dispatch_plugins = (b'ipmi', u'ipmi')
 
 
 def seek_element(currplace, currkey):
@@ -154,6 +173,10 @@ def _init_core():
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
                 }),
+                'hostname': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
                 'identifier': PluginRoute({
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
@@ -172,7 +195,13 @@ def _init_core():
                         'default': 'ipmi',
                     }),
                 },
-            }
+            },
+            'system': {
+                'all': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+            },
         },
         '_console': {
             'session': PluginRoute({
@@ -250,6 +279,25 @@ def _init_core():
                 },
             },
         },
+        'media': {
+            'uploads': PluginCollection({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+            'attach': PluginRoute({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+            'detach': PluginRoute({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+            'current': PluginRoute({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+
+        },
         'power': {
             'state': PluginRoute({
                 'pluginattrs': ['hardwaremanagement.method'],
@@ -529,6 +577,63 @@ def abbreviate_noderange(configmanager, inputdata, operation):
     return (msg.KeyValueData({'noderange': noderange.ReverseNodeRange(inputdata['nodes'], configmanager).noderange}),)
 
 
+def handle_dispatch(connection, cert, dispatch, peername):
+    cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    if not util.cert_matches(
+            cfm.get_collective_member(peername)['fingerprint'], cert):
+        connection.close()
+        return
+    dispatch = pickle.loads(dispatch)
+    configmanager = cfm.ConfigManager(dispatch['tenant'])
+    nodes = dispatch['nodes']
+    inputdata = dispatch['inputdata']
+    operation = dispatch['operation']
+    pathcomponents = dispatch['path']
+    routespec = nested_lookup(noderesources, pathcomponents)
+    plugroute = routespec.routeinfo
+    plugpath = None
+    nodesbyhandler = {}
+    passvalues = []
+    nodeattr = configmanager.get_node_attributes(
+        nodes, plugroute['pluginattrs'])
+    for node in nodes:
+        for attrname in plugroute['pluginattrs']:
+            if attrname in nodeattr[node]:
+                plugpath = nodeattr[node][attrname]['value']
+            elif 'default' in plugroute:
+                plugpath = plugroute['default']
+        if plugpath is not None:
+            try:
+                hfunc = getattr(pluginmap[plugpath], operation)
+            except KeyError:
+                nodesbyhandler[BadPlugin(node, plugpath).error] = [node]
+                continue
+            if hfunc in nodesbyhandler:
+                nodesbyhandler[hfunc].append(node)
+            else:
+                nodesbyhandler[hfunc] = [node]
+    try:
+        for hfunc in nodesbyhandler:
+            passvalues.append(hfunc(
+                nodes=nodesbyhandler[hfunc], element=pathcomponents,
+                configmanager=configmanager,
+                inputdata=inputdata))
+        for res in itertools.chain(*passvalues):
+            _forward_rsp(connection, res)
+    except Exception as res:
+        _forward_rsp(connection, res)
+    connection.sendall('\x00\x00\x00\x00\x00\x00\x00\x00')
+
+
+def _forward_rsp(connection, res):
+    r = pickle.dumps(res)
+    rlen = len(r)
+    if not rlen:
+        return
+    connection.sendall(struct.pack('!Q', rlen))
+    connection.sendall(r)
+
+
 def handle_node_request(configmanager, inputdata, operation,
                         pathcomponents, autostrip=True):
     iscollection = False
@@ -608,7 +713,7 @@ def handle_node_request(configmanager, inputdata, operation,
         else:
             raise Exception("TODO here")
     del pathcomponents[0:2]
-    passvalues = []
+    passvalues = queue.Queue()
     plugroute = routespec.routeinfo
     inputdata = msg.get_input_message(
         pathcomponents, operation, inputdata, nodes, isnoderange,
@@ -625,20 +730,35 @@ def handle_node_request(configmanager, inputdata, operation,
         if isnoderange:
             return passvalue
         elif isinstance(passvalue, console.Console):
-            return passvalue
+            return [passvalue]
         else:
             return stripnode(passvalue, nodes[0])
     elif 'pluginattrs' in plugroute:
         nodeattr = configmanager.get_node_attributes(
-            nodes, plugroute['pluginattrs'])
+            nodes, plugroute['pluginattrs'] + ['collective.manager'])
         plugpath = None
-        if 'default' in plugroute:
-            plugpath = plugroute['default']
+        nodesbymanager = {}
         nodesbyhandler = {}
+        badcollnodes = []
         for node in nodes:
             for attrname in plugroute['pluginattrs']:
                 if attrname in nodeattr[node]:
                     plugpath = nodeattr[node][attrname]['value']
+                elif 'default' in plugroute:
+                    plugpath = plugroute['default']
+            if plugpath in dispatch_plugins:
+                cfm.check_quorum()
+                manager = nodeattr[node].get('collective.manager', {}).get(
+                    'value', None)
+                if manager:
+                    if collective.get_myname() != manager:
+                        if manager not in nodesbymanager:
+                            nodesbymanager[manager] = set([node])
+                        else:
+                            nodesbymanager[manager].add(node)
+                        continue
+                elif list(cfm.list_collective()):
+                    badcollnodes.append(node)
             if plugpath is not None:
                 try:
                     hfunc = getattr(pluginmap[plugpath], operation)
@@ -649,19 +769,30 @@ def handle_node_request(configmanager, inputdata, operation,
                     nodesbyhandler[hfunc].append(node)
                 else:
                     nodesbyhandler[hfunc] = [node]
+        if badcollnodes:
+            raise exc.ConfluentException(
+                'collective management active, '
+                'collective.manager must be set for {0}'.format(
+                    ','.join(badcollnodes)))
+        workers = greenpool.GreenPool()
+        numworkers = 0
         for hfunc in nodesbyhandler:
-            passvalues.append(hfunc(
-                nodes=nodesbyhandler[hfunc], element=pathcomponents,
-                configmanager=configmanager,
-                inputdata=inputdata))
+            numworkers += 1
+            workers.spawn(addtoqueue, passvalues, hfunc, {'nodes': nodesbyhandler[hfunc],
+                                           'element': pathcomponents,
+                'configmanager': configmanager,
+                'inputdata': inputdata})
+        for manager in nodesbymanager:
+            numworkers += 1
+            workers.spawn(addtoqueue, passvalues, dispatch_request, {
+                'nodes': nodesbymanager[manager], 'manager': manager,
+                'element': pathcomponents, 'configmanager': configmanager,
+                'inputdata': inputdata, 'operation': operation})
         if isnoderange or not autostrip:
-            return itertools.chain(*passvalues)
+            return iterate_queue(numworkers, passvalues)
         else:
-            if len(passvalues) > 0:
-                if isinstance(passvalues[0], console.Console):
-                    return passvalues[0]
-                else:
-                    return stripnode(passvalues[0], nodes[0])
+            if numworkers > 0:
+                return iterate_queue(numworkers, passvalues, nodes[0])
             else:
                 raise exc.NotImplementedException()
 
@@ -671,6 +802,105 @@ def handle_node_request(configmanager, inputdata, operation,
         #     return stripnode(passvalues[0], nodes[0])
 
 
+def iterate_queue(numworkers, passvalues, strip=False):
+    completions = 0
+    while completions < numworkers:
+        nv = passvalues.get()
+        if nv == 'theend':
+            completions += 1
+        else:
+            if strip and not isinstance(nv, console.Console):
+                nv.strip_node(strip)
+            yield nv
+
+
+def addtoqueue(theq, fun, kwargs):
+    try:
+        result = fun(**kwargs)
+        if isinstance(result, console.Console):
+            theq.put(result)
+        else:
+            for pv in result:
+                theq.put(pv)
+    finally:
+        theq.put('theend')
+
+
+def dispatch_request(nodes, manager, element, configmanager, inputdata,
+                     operation):
+    a = configmanager.get_collective_member(manager)
+    try:
+        remote = socket.create_connection((a['address'], 13001))
+        remote.settimeout(90)
+        remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                 keyfile='/etc/confluent/privkey.pem',
+                                 certfile='/etc/confluent/srvcert.pem')
+    except Exception:
+        for node in nodes:
+            yield msg.ConfluentResourceUnavailable(
+                node, 'Collective member {0} is unreachable'.format(a['name']))
+        return
+    if not util.cert_matches(a['fingerprint'], remote.getpeercert(
+            binary_form=True)):
+        raise Exception("Invalid certificate on peer")
+    tlvdata.recv(remote)
+    tlvdata.recv(remote)
+    myname = collective.get_myname()
+    dreq = pickle.dumps({'name': myname, 'nodes': list(nodes),
+                         'path': element,'tenant': configmanager.tenant,
+                         'operation': operation, 'inputdata': inputdata})
+    tlvdata.send(remote, {'dispatch': {'name': myname, 'length': len(dreq)}})
+    remote.sendall(dreq)
+    while True:
+        try:
+            rlen = remote.recv(8)
+        except Exception:
+            for node in nodes:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} went unreachable'.format(
+                        a['name']))
+            return
+        while len(rlen) < 8:
+            try:
+                nlen = remote.recv(8 - len(rlen))
+            except Exception:
+                nlen = 0
+            if not nlen:
+                for node in nodes:
+                    yield msg.ConfluentResourceUnavailable(
+                        node, 'Collective member {0} went unreachable'.format(
+                            a['name']))
+                return
+            rlen += nlen
+        rlen = struct.unpack('!Q', rlen)[0]
+        if rlen == 0:
+            break
+        try:
+            rsp = remote.recv(rlen)
+        except Exception:
+            for node in nodes:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} went unreachable'.format(
+                        a['name']))
+            return
+        while len(rsp) < rlen:
+            try:
+                nrsp = remote.recv(rlen - len(rsp))
+            except Exception:
+                nrsp = 0
+            if not nrsp:
+                for node in nodes:
+                    yield msg.ConfluentResourceUnavailable(
+                        node, 'Collective member {0} went unreachable'.format(
+                            a['name']))
+                return
+            rsp += nrsp
+        rsp = pickle.loads(rsp)
+        if isinstance(rsp, Exception):
+            raise rsp
+        yield rsp
+
+
 def handle_discovery(pathcomponents, operation, configmanager, inputdata):
     if pathcomponents[0] == 'detected':
         pass

confluent_server/confluent/discovery/core.py

@@ -61,6 +61,7 @@
 #       retry until uppercase, lowercase, digit, and symbol all present)
 #     - Apply defined configuration to endpoint
 
+import base64
 import confluent.config.configmanager as cfm
 import confluent.discovery.protocols.pxe as pxe
 #import confluent.discovery.protocols.ssdp as ssdp
@@ -75,12 +76,16 @@ import confluent.messages as msg
 import confluent.networking.macmap as macmap
 import confluent.noderange as noderange
 import confluent.util as util
+import eventlet
 import traceback
+webclient = eventlet.import_patched('pyghmi.util.webclient')
+
 
 import eventlet
 import eventlet.greenpool
 import eventlet.semaphore
 
+autosensors = set()
 class nesteddict(dict):
 
     def __missing__(self, key):
@@ -92,6 +97,7 @@ nodehandlers = {
     'service:management-hardware.Lenovo:lenovo-xclarity-controller': xcc,
     'service:management-hardware.IBM:integrated-management-module2': imm,
     'pxe-client': pxeh,
+    'service:io-device.Lenovo:management-module': None,
 }
 
 servicenames = {
@@ -99,6 +105,7 @@ servicenames = {
     'service:lenovo-smm': 'lenovo-smm',
     'service:management-hardware.Lenovo:lenovo-xclarity-controller': 'lenovo-xcc',
     'service:management-hardware.IBM:integrated-management-module2': 'lenovo-imm2',
+    'service:io-device.Lenovo:management-module': 'lenovo-switch',
 }
 
 servicebyname = {
@@ -106,6 +113,7 @@ servicebyname = {
     'lenovo-smm': 'service:lenovo-smm',
     'lenovo-xcc': 'service:management-hardware.Lenovo:lenovo-xclarity-controller',
     'lenovo-imm2': 'service:management-hardware.IBM:integrated-management-module2',
+    'lenovo-switch': 'service:io-device.Lenovo:management-module',
 }
 
 discopool = eventlet.greenpool.GreenPool(500)
@@ -145,6 +153,7 @@ known_uuids = nesteddict()
 known_nodes = nesteddict()
 unknown_info = {}
 pending_nodes = {}
+pending_by_uuid = {}
 
 
 def enrich_pxe_info(info):
@@ -342,7 +351,28 @@ def _parameterize_path(pathcomponents):
     return validselectors, keyparams, listrequested, childcoll
 
 
+def handle_autosense_config(operation, inputdata):
+    autosense = cfm.get_global('discovery.autosense')
+    autosense = autosense or autosense is None
+    if operation == 'retrieve':
+        yield msg.KeyValueData({'enabled': autosense})
+    elif operation == 'update':
+        enabled = inputdata['enabled']
+        if type(enabled) in (unicode, str):
+            enabled = enabled.lower() in ('true', '1', 'y', 'yes', 'enable',
+                                          'enabled')
+        if autosense == enabled:
+            return
+        cfm.set_global('discovery.autosense', enabled)
+        if enabled:
+            start_autosense()
+        else:
+            stop_autosense()
+
+
 def handle_api_request(configmanager, inputdata, operation, pathcomponents):
+    if pathcomponents == ['discovery', 'autosense']:
+        return handle_autosense_config(operation, inputdata)
     if operation == 'retrieve':
         return handle_read_api_request(pathcomponents)
     elif (operation in ('update', 'create') and
@@ -351,24 +381,37 @@ def handle_api_request(configmanager, inputdata, operation, pathcomponents):
             raise exc.InvalidArgumentException()
         rescan()
         return (msg.KeyValueData({'rescan': 'started'}),)
-    elif (operation in ('update', 'create')):
+    elif operation in ('update', 'create'):
         if 'node' not in inputdata:
             raise exc.InvalidArgumentException('Missing node name in input')
-        _, queryparms, _, _ = _parameterize_path(pathcomponents[1:])
-        if 'by-mac' not in queryparms:
-            raise exc.InvalidArgumentException('Must target using "by-mac"')
-        mac = queryparms['by-mac'].replace('-', ':')
-        if mac not in known_info:
-            raise exc.NotFoundException('{0} not found'.format(mac))
+        mac = _get_mac_from_query(pathcomponents)
         info = known_info[mac]
+        if info['handler'] is None:
+            raise exc.NotImplementedException(
+                'Unable to {0} to {1}'.format(operation,
+                                              '/'.join(pathcomponents)))
         handler = info['handler'].NodeHandler(info, configmanager)
         eval_node(configmanager, handler, info, inputdata['node'],
                   manual=True)
         return [msg.AssignedResource(inputdata['node'])]
+    elif operation == 'delete':
+        mac = _get_mac_from_query(pathcomponents)
+        del known_info[mac]
+        return [msg.DeletedResource(mac)]
     raise exc.NotImplementedException(
         'Unable to {0} to {1}'.format(operation, '/'.join(pathcomponents)))
 
 
+def _get_mac_from_query(pathcomponents):
+    _, queryparms, _, _ = _parameterize_path(pathcomponents[1:])
+    if 'by-mac' not in queryparms:
+        raise exc.InvalidArgumentException('Must target using "by-mac"')
+    mac = queryparms['by-mac'].replace('-', ':')
+    if mac not in known_info:
+        raise exc.NotFoundException('{0} not found'.format(mac))
+    return mac
+
+
 def handle_read_api_request(pathcomponents):
     # TODO(jjohnson2): This should be more generalized...
     #  odd indexes into components are 'by-'*, even indexes
@@ -377,6 +420,7 @@ def handle_read_api_request(pathcomponents):
     if len(pathcomponents) == 1:
         dirlist = [msg.ChildCollection(x + '/') for x in sorted(list(subcats))]
         dirlist.append(msg.ChildCollection('rescan'))
+        dirlist.append(msg.ChildCollection('autosense'))
         return dirlist
     if not coll:
         return show_info(queryparms['by-mac'])
@@ -431,6 +475,8 @@ def _recheck_nodes_backend(nodeattribs, configmanager):
     for nodename in pending_nodes:
         info = pending_nodes[nodename]
         try:
+            if info['handler'] is None:
+                next
             handler = info['handler'].NodeHandler(info, configmanager)
             discopool.spawn_n(eval_node, configmanager, handler, info, nodename)
         except Exception:
@@ -440,10 +486,14 @@ def _recheck_nodes_backend(nodeattribs, configmanager):
 
 
 def _recheck_single_unknown(configmanager, mac):
+    info = unknown_info.get(mac, None)
+    _recheck_single_unknown_info(configmanager, info)
+
+
+def _recheck_single_unknown_info(configmanager, info):
     global rechecker
     global rechecktime
-    info = unknown_info.get(mac, None)
-    if not info:
+    if not info or info['handler'] is None:
         return
     if info['handler'] != pxeh and not info.get('addresses', None):
         #log.log({'info': 'Missing address information in ' + repr(info)})
@@ -492,7 +542,7 @@ def _recheck_single_unknown(configmanager, mac):
 
 
 def safe_detected(info):
-    if 'hwaddr' not in info:
+    if 'hwaddr' not in info or not info['hwaddr']:
         return
     if info['hwaddr'] in runningevals:
         # Do not evaluate the same mac multiple times at once
@@ -513,7 +563,7 @@ def detected(info):
     global rechecktime
     # later, manual and CMM discovery may act on SN and/or UUID
     for service in info['services']:
-        if nodehandlers.get(service, None):
+        if service in nodehandlers:
             if service not in known_services:
                 known_services[service] = set([])
             handler = nodehandlers[service]
@@ -561,17 +611,18 @@ def detected(info):
             return
     known_info[info['hwaddr']] = info
     cfg = cfm.ConfigManager(None)
-    handler = handler.NodeHandler(info, cfg)
-    handler.scan()
+    if handler:
+        handler = handler.NodeHandler(info, cfg)
+        handler.scan()
     uuid = info.get('uuid', None)
     if uuid_is_valid(uuid):
         known_uuids[uuid][info['hwaddr']] = info
-    if handler.https_supported and not handler.https_cert:
+    if handler and handler.https_supported and not handler.https_cert:
         if handler.cert_fail_reason == 'unreachable':
             log.log(
                 {
-                    'info': '{0} with hwaddr {1} is not reachable at {2}'
-                            ''.format(
+                    'info': '{0} with hwaddr {1} is not reachable by https '
+                            'at address {2}'.format(
                         handler.devname, info['hwaddr'], handler.ipaddr
                     )})
             info['addresses'] = [x for x in info.get('addresses', []) if x != handler.ipaddr]
@@ -592,7 +643,7 @@ def detected(info):
         # influence periodic recheck to shorten delay?
         return
     nodename, info['maccount'] = get_nodename(cfg, handler, info)
-    if nodename and handler.https_supported:
+    if nodename and handler and handler.https_supported:
         dp = cfg.get_node_attributes([nodename],
                                      ('pubkeys.tls_hardwaremanager',))
         lastfp = dp.get(nodename, {}).get('pubkeys.tls_hardwaremanager',
@@ -605,9 +656,9 @@ def detected(info):
     #TODO(jjohnson2): We might have to get UUID for certain searches...
     #for now defer probe until inside eval_node.  We might not have
     #a nodename without probe in the future.
-    if nodename:
+    if nodename and handler:
         eval_node(cfg, handler, info, nodename)
-    else:
+    elif handler:
         log.log(
             {'info': 'Detected unknown {0} with hwaddr {1} at '
                      'address {2}'.format(
@@ -617,16 +668,104 @@ def detected(info):
         unknown_info[info['hwaddr']] = info
 
 
+
+def b64tohex(b64str):
+    bd = base64.b64decode(b64str)
+    return ''.join(['{0:02x}'.format(ord(x)) for x in bd])
+
+
+def get_enclosure_chain_head(nodename, cfg):
+    ne = True
+    members = [nodename]
+    while ne:
+        ne = cfg.get_node_attributes(
+            nodename, 'enclosure.extends').get(nodename, {}).get(
+            'enclosure.extends', {}).get('value', None)
+        if not ne:
+            return nodename
+        if ne in members:
+            raise exc.InvalidArgumentException(
+                'Circular chain that includes ' + nodename)
+        nodename = ne
+        members.append(nodename)
+    return nodename
+
+
+def get_chained_smm_name(nodename, cfg, handler, nl=None, checkswitch=True):
+    # nodename is the head of the chain, cfg is a configmanager, handler
+    # is the handler of the current candidate, nl is optional indication
+    # of the next link in the chain, checkswitch can disable the switch
+    # search if not indicated by current situation
+    # returns the new name and whether it has been securely validated or not
+    # first we check to see if directly connected
+    mycert = handler.https_cert
+    if checkswitch:
+        fprints = macmap.get_node_fingerprints(nodename, cfg)
+        for fprint in fprints:
+            if util.cert_matches(fprint[0], mycert):
+                # ok we have a direct match, it is this node
+                return nodename, fprint[1]
+    # ok, unable to get it, need to traverse the chain from the beginning
+    if not nl:
+        nl = list(cfg.filter_node_attributes(
+            'enclosure.extends=' + nodename))
+    while nl:
+        if len(nl) != 1:
+            raise exc.InvalidArgumentException('Multiple enclosures trying to '
+                                               'extend a single enclosure')
+        cd = cfg.get_node_attributes(nodename, ['hardwaremanagement.manager',
+                                                'pubkeys.tls_hardwaremanager'])
+        smmaddr = cd[nodename]['hardwaremanagement.manager']['value']
+        pkey = cd[nodename].get('pubkeys.tls_hardwaremanager', {}).get(
+            'value', None)
+        if not pkey:
+            # We cannot continue through a break in the chain
+            return None, False
+        if pkey:
+            cv = util.TLSCertVerifier(
+                cfg, nodename, 'pubkeys.tls_hardwaremanager').verify_cert
+            for fprint in get_smm_neighbor_fingerprints(smmaddr, cv):
+                if util.cert_matches(fprint, mycert):
+                    # a trusted chain member vouched for the cert
+                    # so it's validated
+                    return nl[0], True
+            # advance down the chain by one and try again
+        nodename = nl[0]
+        nl = list(cfg.filter_node_attributes(
+            'enclosure.extends=' + nodename))
+    return None, False
+
+
+def get_smm_neighbor_fingerprints(smmaddr, cv):
+    if ':' in smmaddr:
+        smmaddr = '[{0}]'.format(smmaddr)
+    wc = webclient.SecureHTTPConnection(smmaddr, verifycallback=cv)
+    neighs = wc.grab_json_response('/scripts/neighdata.json')
+    if not neighs:
+        return
+    for idx in (4, 5):
+        if 'sha256' not in neighs[idx]:
+            continue
+        yield 'sha256$' + b64tohex(neighs[idx]['sha256'])
+
+
 def get_nodename(cfg, handler, info):
     nodename = None
     maccount = None
+    info['verified'] = False
+    if not handler:
+        return None, None
     if handler.https_supported:
         currcert = handler.https_cert
         if not currcert:
             info['discofailure'] = 'nohttps'
             return None, None
-        currprint = util.get_fingerprint(currcert)
+        currprint = util.get_fingerprint(currcert, 'sha256')
         nodename = nodes_by_fprint.get(currprint, None)
+        if not nodename:
+            # Try SHA512 as well
+            currprint = util.get_fingerprint(currcert)
+            nodename = nodes_by_fprint.get(currprint, None)
     if not nodename:
         curruuid = info.get('uuid', None)
         if uuid_is_valid(curruuid):
@@ -634,9 +773,31 @@ def get_nodename(cfg, handler, info):
             if nodename is None:
                 _map_unique_ids()
                 nodename = nodes_by_uuid.get(curruuid, None)
-    if not nodename:  # as a last resort, search switch for info
+    if not nodename:
+        # Ok, see if it is something with a chassis-uuid and discover by
+        # chassis
+        nodename = get_nodename_from_enclosures(cfg, info)
+    if not nodename and handler.devname == 'SMM':
+        nodename = get_nodename_from_chained_smms(cfg, handler, info)
+    if not nodename:  # as a last resort, search switches for info
+        # This is the slowest potential operation, so we hope for the
+        # best to occur prior to this
         nodename, macinfo = macmap.find_nodeinfo_by_mac(info['hwaddr'], cfg)
         maccount = macinfo['maccount']
+        if nodename:
+            if handler.devname == 'SMM':
+                nl = list(cfg.filter_node_attributes(
+                            'enclosure.extends=' + nodename))
+                if nl:
+                    # We found an SMM, and it's in a chain per configuration
+                    # we need to ask the switch for the fingerprint to see
+                    # if we have a match or not
+                    newnodename, v = get_chained_smm_name(nodename, cfg,
+                                                          handler, nl)
+                    if newnodename:
+                        # while this started by switch, it was disambiguated
+                        info['verified'] = v
+                        return newnodename, None
         if (nodename and
                 not handler.discoverable_by_switch(macinfo['maccount'])):
             if handler.devname == 'SMM':
@@ -650,10 +811,44 @@ def get_nodename(cfg, handler, info):
     return nodename, maccount
 
 
+def get_nodename_from_chained_smms(cfg, handler, info):
+    nodename = None
+    for fprint in get_smm_neighbor_fingerprints(
+            handler.ipaddr, lambda x: True):
+        if fprint in nodes_by_fprint:
+            # need to chase the whole chain
+            # to support either direction
+            chead = get_enclosure_chain_head(nodes_by_fprint[fprint],
+                                             cfg)
+            newnodename, v = get_chained_smm_name(
+                chead, cfg, handler, checkswitch=False)
+            if newnodename:
+                info['verified'] = v
+                nodename = newnodename
+    return nodename
+
+
+def get_nodename_from_enclosures(cfg, info):
+    nodename = None
+    cuuid = info.get('attributes', {}).get('chassis-uuid', [None])[0]
+    if cuuid and cuuid in nodes_by_uuid:
+        encl = nodes_by_uuid[cuuid]
+        bay = info.get('enclosure.bay', None)
+        if bay:
+            tnl = cfg.filter_node_attributes('enclosure.manager=' + encl)
+            tnl = list(
+                cfg.filter_node_attributes('enclosure.bay={0}'.format(bay),
+                                           tnl))
+            if len(tnl) == 1:
+                # This is not a secure assurance, because it's by
+                # uuid instead of a key
+                nodename = tnl[0]
+    return nodename
+
+
 def eval_node(cfg, handler, info, nodename, manual=False):
     try:
         handler.probe()  # unicast interrogation as possible to get more data
-        # for now, we search switch only, ideally we search cmm, smm, and
         # switch concurrently
         # do some preconfig, for example, to bring a SMM online if applicable
         handler.preconfig()
@@ -684,6 +879,7 @@ def eval_node(cfg, handler, info, nodename, manual=False):
     if not handler.is_enclosure and nl:
         # The specified node is an enclosure (has nodes mapped to it), but
         # what we are talking to is *not* an enclosure
+        # might be ambiguous, need to match chassis-uuid as well..
         if 'enclosure.bay' not in info:
             unknown_info[info['hwaddr']] = info
             info['discostatus'] = 'unidentified'
@@ -695,14 +891,39 @@ def eval_node(cfg, handler, info, nodename, manual=False):
                 raise exc.InvalidArgumentException(errorstr)
             log.log({'error': errorstr})
             return
+        enl = list(cfg.filter_node_attributes('enclosure.extends=' + nodename))
+        if enl:
+            # ambiguous SMM situation according to the configuration, we need
+            # to match uuid
+            encuuid = info['attributes'].get('chassis-uuid', None)
+            if encuuid:
+                encuuid = encuuid[0]
+                enl = list(cfg.filter_node_attributes('id.uuid=' + encuuid))
+                if len(enl) != 1:
+                    # errorstr = 'No SMM by given UUID known, *yet*'
+                    # if manual:
+                    #     raise exc.InvalidArgumentException(errorstr)
+                    # log.log({'error': errorstr})
+                    if encuuid in pending_by_uuid:
+                        pending_by_uuid[encuuid].add(info)
+                    else:
+                        pending_by_uuid[encuuid] = set([info])
+                    return
+                # We found the real smm, replace the list with the actual smm
+                # to continue
+                nl = list(cfg.filter_node_attributes(
+                    'enclosure.manager=' + enl[0]))
+            else:
+                errorstr = 'Chained SMM configuration with older XCC, ' \
+                           'unable to perform zero power discovery'
+                if manual:
+                    raise exc.InvalidArgumentException(errorstr)
+                log.log({'error': errorstr})
+                return
         # search for nodes fitting our description using filters
         # lead with the most specific to have a small second pass
-        nl = cfg.filter_node_attributes(
-            'enclosure.bay={0}'.format(info['enclosure.bay']), nl)
-        nl = list(nl)
-        # sadly, we cannot detect when user has a daisy chain smm config
-        # without ability to disambiguate, however the SMM will be caught so
-        # at least one actionable error will be encountered.
+        nl = list(cfg.filter_node_attributes(
+            'enclosure.bay={0}'.format(info['enclosure.bay']), nl))
         if len(nl) != 1:
             info['discofailure'] = 'ambigconfig'
             if len(nl):
@@ -731,16 +952,26 @@ def eval_node(cfg, handler, info, nodename, manual=False):
         # we can and did accurately discover by switch or in enclosure
         # but... is this really ok?  could be on an upstream port or
         # erroneously put in the enclosure with no nodes yet
-        if (info['maccount'] and
-                not handler.discoverable_by_switch(info['maccount'])):
-            errorstr = 'The detected node {0} was detected using switch, ' \
-                       'however the relevant port has too many macs learned ' \
-                       'for this type of device ({1}) to be discovered by ' \
-                       'switch.'.format(nodename, handler.devname)
-            if manual:
-                raise exc.InvalidArgumentException(errorstr)
-            log.log({'error': errorstr})
-            return
+        # so first, see if the candidate node is a chain host
+        if not manual:
+            if info.get('maccount', False):
+                # discovery happened through switch
+                nl = list(cfg.filter_node_attributes(
+                    'enclosure.extends=' + nodename))
+                if nl:
+                    # The candidate nodename is the head of a chain, we must
+                    # validate the smm certificate by the switch
+                    macmap.get_node_fingerprint(nodename, cfg)
+                    util.handler.cert_matches(fprint, handler.https_cert)
+                    return
+            if (info.get('maccount', False) and
+                    not handler.discoverable_by_switch(info['maccount'])):
+                errorstr = 'The detected node {0} was detected using switch, ' \
+                           'however the relevant port has too many macs learned ' \
+                           'for this type of device ({1}) to be discovered by ' \
+                           'switch.'.format(nodename, handler.devname)
+                log.log({'error': errorstr})
+                return
         if not discover_node(cfg, handler, info, nodename, manual):
             pending_nodes[nodename] = info
 
@@ -764,6 +995,7 @@ def discover_node(cfg, handler, info, nodename, manual):
     # the pubkeys, which is deferred for a little bit
     # Also, 'secure', when we have the needed infrastructure done
     # in some product or another.
+    curruuid = info.get('uuid', False)
     if 'pxe' in policies and info['handler'] == pxeh:
         return do_pxe_discovery(cfg, handler, info, manual, nodename, policies)
     elif ('permissive' in policies and handler.https_supported and lastfp and
@@ -802,12 +1034,14 @@ def discover_node(cfg, handler, info, nodename, manual):
                 newnodeattribs['id.model'] = info['modelnumber']
             if handler.https_cert:
                 newnodeattribs['pubkeys.tls_hardwaremanager'] = \
-                    util.get_fingerprint(handler.https_cert)
+                    util.get_fingerprint(handler.https_cert, 'sha256')
             if newnodeattribs:
                 cfg.set_node_attributes({nodename: newnodeattribs})
             log.log({'info': 'Discovered {0} ({1})'.format(nodename,
                                                           handler.devname)})
         info['discostatus'] = 'discovered'
+        for i in pending_by_uuid.get(curruuid, []):
+            eventlet.spawn_n(_recheck_single_unknown_info, cfg, i)
         return True
     log.log({'info': 'Detected {0}, but discovery.policy is not set to a '
                      'value allowing discovery (open or permissive)'.format(
@@ -869,12 +1103,14 @@ def newnodes(added, deleting, configmanager):
     global attribwatcher
     global needaddhandled
     global nodeaddhandler
+    _map_unique_ids()
     configmanager.remove_watcher(attribwatcher)
     allnodes = configmanager.list_nodes()
     attribwatcher = configmanager.watch_attributes(
         allnodes, ('discovery.policy', 'net*.switch',
-                   'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
-                   'pubkeys.tls_hardwaremanager', 'net*.bootable'), _recheck_nodes)
+                   'hardwaremanagement.manager', 'net*.switchport',
+                   'id.uuid', 'pubkeys.tls_hardwaremanager',
+                   'net*.bootable'), _recheck_nodes)
     if nodeaddhandler:
         needaddhandled = True
     else:
@@ -920,14 +1156,23 @@ def start_detection():
                    'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
                    'pubkeys.tls_hardwaremanager'), _recheck_nodes)
     cfg.watch_nodecollection(newnodes)
-    eventlet.spawn_n(slp.snoop, safe_detected)
-    eventlet.spawn_n(pxe.snoop, safe_detected)
+    autosense = cfm.get_global('discovery.autosense')
+    if autosense or autosense is None:
+        start_autosense()
     if rechecker is None:
         rechecktime = util.monotonic_time() + 900
         rechecker = eventlet.spawn_after(900, _periodic_recheck, cfg)
 
     # eventlet.spawn_n(ssdp.snoop, safe_detected)
 
+def stop_autosense():
+    for watcher in list(autosensors):
+        watcher.kill()
+        autosensors.discard(watcher)
+
+def start_autosense():
+    autosensors.add(eventlet.spawn(slp.snoop, safe_detected))
+    autosensors.add(eventlet.spawn(pxe.snoop, safe_detected))
 
 
 nodes_by_fprint = {}

confluent_server/confluent/discovery/protocols/pxe.py

@@ -92,7 +92,7 @@ def snoop(handler):
         rq = bytearray(rq)
         if rq[0] == 1:  # Boot request
             addrlen = rq[2]
-            if addrlen > 16:  # max address size in bootp is 16 bytes
+            if addrlen > 16 or addrlen == 0:
                 continue
             netaddr = rq[28:28+addrlen]
             netaddr = ':'.join(['{0:02x}'.format(x) for x in netaddr])

confluent_server/confluent/discovery/protocols/slp.py

@@ -16,13 +16,13 @@
 
 import confluent.neighutil as neighutil
 import confluent.util as util
+import confluent.log as log
 import os
 import random
 import eventlet.green.select as select
 import eventlet.green.socket as socket
 import struct
-import subprocess
-
+import traceback
 
 _slp_services = set([
     'service:management-hardware.IBM:integrated-management-module2',
@@ -30,6 +30,7 @@ _slp_services = set([
     'service:management-hardware.Lenovo:lenovo-xclarity-controller',
     'service:management-hardware.IBM:chassis-management-module',
     'service:management-hardware.Lenovo:chassis-management-module',
+    'service:io-device.Lenovo:management-module',
 ])
 
 # SLP has a lot of ambition that was unfulfilled in practice.
@@ -221,7 +222,13 @@ def _find_srvtype(net, net4, srvtype, addresses, xid):
             bcast = i4['broadcast']
             net4.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_IF,
                            socket.inet_aton(addr))
-            net4.sendto(data, ('239.255.255.253', 427))
+            try:
+                net4.sendto(data, ('239.255.255.253', 427))
+            except socket.error as se:
+                # On occasion, multicasting may be disabled
+                # tolerate this scenario and move on
+                if se.errno != 101:
+                    raise
             net4.sendto(data, (bcast, 427))
 
 
@@ -384,6 +391,7 @@ def snoop(handler):
     :param handler:
     :return:
     """
+    tracelog = log.Logger('trace')
     active_scan(handler)
     net = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
     net.setsockopt(IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
@@ -413,54 +421,58 @@ def snoop(handler):
     net4.bind(('', 427))
 
     while True:
-        newmacs = set([])
-        r, _, _ = select.select((net, net4), (), (), 60)
-        # clear known_peers and peerbymacaddress
-        # to avoid stale info getting in...
-        # rely upon the select(0.2) to catch rapid fire and aggregate ip
-        # addresses that come close together
-        # calling code needs to understand deeper context, as snoop
-        # will now yield dupe info over time
-        known_peers = set([])
-        peerbymacaddress = {}
-        neighutil.update_neigh()
-        while r:
-            for s in r:
-                (rsp, peer) = s.recvfrom(9000)
-                ip = peer[0].partition('%')[0]
-                if ip not in neighutil.neightable:
-                    continue
-                if peer in known_peers:
-                    continue
-                known_peers.add(peer)
-                mac = neighutil.neightable[ip]
-                if mac in peerbymacaddress:
-                    peerbymacaddress[mac]['addresses'].append(peer)
-                else:
-                    q = query_srvtypes(peer)
-                    if not q or not q[0]:
-                        # SLP might have started and not ready yet
-                        # ignore for now
-                        known_peers.discard(peer)
+        try:
+            newmacs = set([])
+            r, _, _ = select.select((net, net4), (), (), 60)
+            # clear known_peers and peerbymacaddress
+            # to avoid stale info getting in...
+            # rely upon the select(0.2) to catch rapid fire and aggregate ip
+            # addresses that come close together
+            # calling code needs to understand deeper context, as snoop
+            # will now yield dupe info over time
+            known_peers = set([])
+            peerbymacaddress = {}
+            neighutil.update_neigh()
+            while r:
+                for s in r:
+                    (rsp, peer) = s.recvfrom(9000)
+                    ip = peer[0].partition('%')[0]
+                    if ip not in neighutil.neightable:
                         continue
-                    # we want to prioritize the very well known services
-                    svcs = []
-                    for svc in q:
-                        if svc in _slp_services:
-                            svcs.insert(0, svc)
-                        else:
-                            svcs.append(svc)
-                    peerbymacaddress[mac] = {
-                        'services': svcs,
-                        'addresses': [peer],
-                    }
-                newmacs.add(mac)
-            r, _, _ = select.select((net, net4), (), (), 0.2)
-        for mac in newmacs:
-            peerbymacaddress[mac]['xid'] = 1
-            _add_attributes(peerbymacaddress[mac])
-            peerbymacaddress[mac]['hwaddr'] = mac
-            handler(peerbymacaddress[mac])
+                    if peer in known_peers:
+                        continue
+                    known_peers.add(peer)
+                    mac = neighutil.neightable[ip]
+                    if mac in peerbymacaddress:
+                        peerbymacaddress[mac]['addresses'].append(peer)
+                    else:
+                        q = query_srvtypes(peer)
+                        if not q or not q[0]:
+                            # SLP might have started and not ready yet
+                            # ignore for now
+                            known_peers.discard(peer)
+                            continue
+                        # we want to prioritize the very well known services
+                        svcs = []
+                        for svc in q:
+                            if svc in _slp_services:
+                                svcs.insert(0, svc)
+                            else:
+                                svcs.append(svc)
+                        peerbymacaddress[mac] = {
+                            'services': svcs,
+                            'addresses': [peer],
+                        }
+                    newmacs.add(mac)
+                r, _, _ = select.select((net, net4), (), (), 0.2)
+            for mac in newmacs:
+                peerbymacaddress[mac]['xid'] = 1
+                _add_attributes(peerbymacaddress[mac])
+                peerbymacaddress[mac]['hwaddr'] = mac
+                handler(peerbymacaddress[mac])
+        except Exception as e:
+            tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
+                         event=log.Events.stacktrace)
 
 
 def active_scan(handler):

confluent_server/confluent/discovery/protocols/ssdp.py

@@ -191,7 +191,6 @@ def _parse_ssdp(peer, rsp, peerdata):
         _, code, _ = headlines[0].split(' ', 2)
     except ValueError:
         return
-    myurl = None
     if code == '200':
         if nid in peerdata:
             peerdatum = peerdata[nid]
@@ -208,7 +207,6 @@ def _parse_ssdp(peer, rsp, peerdata):
             header = header.strip()
             value = value.strip()
             if header == 'AL' or header == 'LOCATION':
-                myurl = value
                 if 'urls' not in peerdatum:
                     peerdatum['urls'] = [value]
                 elif value not in peerdatum['urls']:

confluent_server/confluent/exceptions.py

@@ -68,6 +68,11 @@ class LockedCredentials(ConfluentException):
     _apierrorstr = 'Credential store locked'
 
 
+class DegradedCollective(ConfluentException):
+    # We are in a collective with at least half of the member nodes missing
+    _apierrorstr = 'Collective does not have quorum'
+
+
 class ForbiddenRequest(ConfluentException):
     # The client request is not allowed by authorization engine
     apierrorcode = 403

confluent_server/confluent/firmwaremanager.py

@@ -21,15 +21,26 @@
 import confluent.exceptions as exc
 import confluent.messages as msg
 import eventlet
+import os
+import socket
 
 updatesbytarget = {}
+uploadsbytarget = {}
 updatepool = eventlet.greenpool.GreenPool(256)
 
 
-def execupdate(handler, filename, updateobj):
+def execupdate(handler, filename, updateobj, type):
+    if not os.path.exists(filename):
+        errstr =  '{0} does not appear to exist on {1}'.format(
+            filename, socket.gethostname())
+        updateobj.handle_progress({'phase': 'error', 'progress': 0.0,
+                                   'detail': errstr})
     try:
-        completion = handler(filename, progress=updateobj.handle_progress,
-                             bank=updateobj.bank)
+        if type == 'firmware':
+            completion = handler(filename, progress=updateobj.handle_progress,
+                                 bank=updateobj.bank)
+        else:
+            completion = handler(filename, progress=updateobj.handle_progress)
         if completion is None:
             completion = 'complete'
         updateobj.handle_progress({'phase': completion, 'progress': 100.0})
@@ -44,26 +55,30 @@ def execupdate(handler, filename, updateobj):
 
 class Updater(object):
     def __init__(self, node, handler, filename, tenant=None, name=None,
-                 bank=None):
+                 bank=None, type='firmware'):
         self.bank = bank
         self.node = node
         self.phase = 'initializing'
         self.detail = ''
         self.percent = 0.0
-        #Change the below to a pool???
-        self.updateproc = updatepool.spawn(execupdate, handler, filename, self)
-        if (node, tenant) not in updatesbytarget:
-            updatesbytarget[(node, tenant)] = {}
+        self.updateproc = updatepool.spawn(execupdate, handler, filename,
+                                           self, type)
+        if type == 'firmware':
+            myparty = updatesbytarget
+        elif type == 'mediaupload':
+            myparty = uploadsbytarget
+        if (node, tenant) not in myparty:
+            myparty[(node, tenant)] = {}
         if name is None:
             name = 1
-            while '{0}'.format(name) in updatesbytarget[(node, tenant)]:
+            while '{0}'.format(name) in myparty[(node, tenant)]:
                 name += 1
         self.name = '{0}'.format(name)
-        updatesbytarget[(node, tenant)][self.name] = self
+        myparty[(node, tenant)][self.name] = self
 
     def handle_progress(self, progress):
-        self.phase = progress['phase']
-        self.percent = float(progress['progress'])
+        self.phase = progress.get('phase', 'unknown')
+        self.percent = float(progress.get('progress', 100.0))
         self.detail = progress.get('detail', '')
 
     def cancel(self):
@@ -75,34 +90,49 @@ class Updater(object):
                 'detail': self.detail}
 
 
-def remove_updates(nodes, tenant, element):
-    if len(element) < 5:
+def remove_updates(nodes, tenant, element, type='firmware'):
+    if len(element) < 5 and element[:2] != ['media', 'uploads']:
         raise exc.InvalidArgumentException()
     upid = element[-1]
+    if type == 'firmware':
+        myparty = updatesbytarget
+    else:
+        myparty = uploadsbytarget
     for node in nodes:
         try:
-            upd = updatesbytarget[(node, tenant)][upid]
+            upd = myparty[(node, tenant)][upid]
         except KeyError:
             raise exc.NotFoundException('No active update matches request')
         upd.cancel()
-        del updatesbytarget[(node, tenant)][upid]
+        del myparty[(node, tenant)][upid]
         yield msg.DeletedResource(
             'nodes/{0}/inventory/firmware/updates/active/{1}'.format(
                 node, upid))
 
 
-def list_updates(nodes, tenant, element):
+def list_updates(nodes, tenant, element, type='firmware'):
     showmode = False
-    if len(element) > 4:
+    if type == 'mediaupload':
+        myparty = uploadsbytarget
+        verb = 'upload'
+    else:
+        myparty = updatesbytarget
+        verb = 'update'
+    if type == 'firmware':
+        specificlen = 4
+    else:
+        specificlen = 2
+    if len(element) > specificlen:
         showmode = True
         upid = element[-1]
     for node in nodes:
         if showmode:
             try:
-                updater = updatesbytarget[(node, tenant)][upid]
+                updater = myparty[(node, tenant)][upid]
             except KeyError:
-                raise exc.NotFoundException('No matching update process found')
+                raise exc.NotFoundException(
+                    'No matching {0} process found'.format(verb))
             yield msg.KeyValueData(updater.progress, name=node)
         else:
-            for updateid in updatesbytarget.get((node, tenant), {}):
+            for updateid in myparty.get((node, tenant), {}):
                 yield msg.ChildCollection(updateid)

confluent_server/confluent/httpapi.py

@@ -400,7 +400,7 @@ def resourcehandler_backend(env, start_response):
                ('Pragma', 'no-cache'),
                ('X-Content-Type-Options', 'nosniff'),
                ('Content-Security-Policy', "default-src 'self'"),
-               ('X-XSS-Protection', '1'), ('X-Frame-Options', 'deny'),
+               ('X-XSS-Protection', '1; mode=block'), ('X-Frame-Options', 'deny'),
                ('Strict-Transport-Security', 'max-age=86400'),
                ('X-Permitted-Cross-Domain-Policies', 'none')]
     reqbody = None
@@ -741,7 +741,10 @@ def _assemble_json(responses, resource=None, url=None, extension=None):
             for dk in rsp.iterkeys():
                 if dk in rspdata:
                     if isinstance(rspdata[dk], list):
-                        rspdata[dk].append(rsp[dk])
+                        if isinstance(rsp[dk], list):
+                            rspdata[dk].extend(rsp[dk])
+                        else:
+                            rspdata[dk].append(rsp[dk])
                     else:
                         rspdata[dk] = [rspdata[dk], rsp[dk]]
                 else:
@@ -782,7 +785,7 @@ def serve(bind_host, bind_port):
                 ' a second\n')
             eventlet.sleep(1)
     eventlet.wsgi.server(sock, resourcehandler, log=False, log_output=False,
-                         debug=False)
+                         debug=False, socket_timeout=60)
 
 
 class HttpApi(object):

confluent_server/confluent/main.py

@@ -33,6 +33,7 @@ import confluent.consoleserver as consoleserver
 import confluent.core as confluentcore
 import confluent.httpapi as httpapi
 import confluent.log as log
+import confluent.collective.manager as collective
 try:
     import confluent.sockapi as sockapi
 except ImportError:
@@ -228,6 +229,7 @@ def run():
         _updatepidfile()
     signal.signal(signal.SIGINT, terminate)
     signal.signal(signal.SIGTERM, terminate)
+    collective.startup()
     if dbgif:
         oumask = os.umask(0077)
         try:

confluent_server/confluent/messages.py

@@ -35,7 +35,7 @@ valid_health_values = set([
 def _htmlify_structure(indict):
     ret = "<ul>"
     if isinstance(indict, dict):
-        for key in indict.iterkeys():
+        for key in sorted(indict):
             ret += "<li>{0}: ".format(key)
             if type(indict[key]) in (str, unicode, float, int):
                 ret += str(indict[key])
@@ -77,7 +77,7 @@ class ConfluentMessage(object):
             datasource = self.kvpairs
         else:
             datasource = {'databynode': self.kvpairs}
-        jsonsnippet = json.dumps(datasource, separators=(',', ':'))[1:-1]
+        jsonsnippet = json.dumps(datasource, sort_keys=True, separators=(',', ':'))[1:-1]
         return jsonsnippet
 
     def raw(self):
@@ -250,6 +250,7 @@ class DeletedResource(ConfluentMessage):
     def strip_node(self, node):
         pass
 
+
 class CreatedResource(ConfluentMessage):
     notnode = True
     readonly = True
@@ -257,6 +258,10 @@ class CreatedResource(ConfluentMessage):
     def __init__(self, resource):
         self.kvpairs = {'created': resource}
 
+    def strip_node(self, node):
+        pass
+
+
 class AssignedResource(ConfluentMessage):
     notnode = True
     readonly = True
@@ -392,6 +397,9 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
     elif (path[:3] == ['configuration', 'management_controller', 'identifier']
             and operation != 'retrieve'):
         return InputMCI(path, nodes, inputdata)
+    elif (path[:3] == ['configuration', 'management_controller', 'hostname']
+            and operation != 'retrieve'):
+        return InputHostname(path, nodes, inputdata, configmanager)
     elif (path[:4] == ['configuration', 'management_controller',
             'net_interfaces', 'management'] and operation != 'retrieve'):
         return InputNetworkConfiguration(path, nodes, inputdata,
@@ -405,8 +413,15 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
     elif (path[:4] == ['configuration', 'management_controller', 'ntp',
             'servers'] and operation != 'retrieve' and len(path) == 5):
         return InputNTPServer(path, nodes, inputdata)
+    elif (path[:3] == ['configuration', 'system', 'all'] and
+            operation != 'retrieve'):
+        return InputConfigChangeSet(path, inputdata, nodes, configmanager)
     elif 'inventory/firmware/updates/active' in '/'.join(path) and inputdata:
         return InputFirmwareUpdate(path, nodes, inputdata)
+    elif '/'.join(path).startswith('media/detach'):
+        return DetachMedia(path, nodes, inputdata)
+    elif '/'.join(path).startswith('media/') and inputdata:
+        return InputMedia(path, nodes, inputdata)
     elif inputdata:
         raise exc.InvalidArgumentException(
             'No known input handler for request')
@@ -414,10 +429,25 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
 class InputFirmwareUpdate(ConfluentMessage):
 
     def __init__(self, path, nodes, inputdata):
-        self.filename = inputdata['filename']
+        self.filename = inputdata.get('filename', inputdata.get('url', None))
         self.bank = inputdata.get('bank', None)
         self.nodes = nodes
 
+class InputMedia(InputFirmwareUpdate):
+    # Use InputFirmwareUpdate
+    pass
+
+
+class DetachMedia(ConfluentMessage):
+    def __init__(self, path, nodes, inputdata):
+        if 'detachall' not in inputdata:
+            raise exc.InvalidArgumentException('Currently only supporting'
+                                               '{"detachall": 1}')
+
+
+class Media(ConfluentMessage):
+    def __init__(self, node, media):
+        self.kvpairs = {node: {'name': media.name, 'url': media.url}}
 
 class InputAlertData(ConfluentMessage):
 
@@ -460,6 +490,27 @@ class InputExpression(ConfluentMessage):
         nodeattr = deepcopy(self.nodeattribs[node])
         return nodeattr
 
+class InputConfigChangeSet(InputExpression):
+    # For now, this is identical to InputExpression, later it may
+    # internalize formula expansion, but not now..
+    def __init__(self, path, inputdata, nodes=None, configmanager=None):
+        self.cfm = configmanager
+        super(InputConfigChangeSet, self).__init__(path, inputdata, nodes)
+
+    def get_attributes(self, node):
+        attrs = super(InputConfigChangeSet, self).get_attributes(node)
+        endattrs = {}
+        for attr in attrs:
+            origval = attrs[attr]
+            if isinstance(origval, str) or isinstance(origval, unicode):
+                origval = {'expression': origval}
+            if 'expression' not in origval:
+                endattrs[attr] = attrs[attr]
+            else:
+                endattrs[attr] = list(self.cfm.expand_attrib_expression(
+                    [node], attrs[attr]))[0][1]
+        return endattrs
+
 
 class InputAttributes(ConfluentMessage):
     # This is particularly designed for attributes, where a simple string
@@ -467,7 +518,7 @@ class InputAttributes(ConfluentMessage):
     # preserve the client provided expression for posterity, rather than
     # immediate consumption.
     # for things like node configuration or similar, a different class is
-    # appropriate since it nedes to immediately expand an expression.
+    # appropriate since it needs to immediately expand an expression.
     # with that class, the 'InputExpression' and calling code in attributes.py
     # might be deprecated in favor of the generic expression expander
     # and a small function in attributes.py to reflect the expansion back
@@ -671,6 +722,25 @@ class InputBMCReset(ConfluentInputMessage):
         return self.inputbynode[node]
 
 
+
+class InputHostname(ConfluentInputMessage):
+    def __init__(self, path, nodes, inputdata, configmanager):
+        self.inputbynode = {}
+        self.stripped = False
+        if not inputdata or 'hostname' not in inputdata:
+            raise exc.InvalidArgumentException('missing hostname attribute')
+        if nodes is None:
+            raise exc.InvalidArgumentException(
+                'This only supports per-node input')
+        for expanded in configmanager.expand_attrib_expression(
+                nodes, inputdata['hostname']):
+            node, value = expanded
+            self.inputbynode[node] = value
+
+    def hostname(self, node):
+        return self.inputbynode[node]
+
+
 class InputMCI(ConfluentInputMessage):
     def __init__(self, path, nodes, inputdata):
         self.inputbynode = {}
@@ -1213,7 +1283,7 @@ class Attributes(ConfluentMessage):
         self.desc = desc
         nkv = {}
         self.notnode = name is None
-        for key in kv.iterkeys():
+        for key in kv:
             if type(kv[key]) in (str, unicode):
                 nkv[key] = {'value': kv[key]}
             else:
@@ -1225,6 +1295,8 @@ class Attributes(ConfluentMessage):
                 name: nkv
             }
 
+class ConfigSet(Attributes):
+    pass
 
 class ListAttributes(ConfluentMessage):
     def __init__(self, name=None, kv=None, desc=''):
@@ -1248,6 +1320,17 @@ class MCI(ConfluentMessage):
             self.kvpairs = {name: kv}
 
 
+class Hostname(ConfluentMessage):
+    def __init__(self, name=None, hostname=None):
+        self.notnode = name is None
+        self.desc = 'BMC hostname'
+
+        kv = {'hostname': {'value': hostname}}
+        if self.notnode:
+            self.kvpairs = kv
+        else:
+            self.kvpairs = {name: kv}
+
 class DomainName(ConfluentMessage):
     def __init__(self, name=None, dn=None):
         self.notnode = name is None

confluent_server/confluent/netutil.py

@@ -16,6 +16,7 @@
 # this will implement noderange grammar
 
 
+import confluent.exceptions as exc
 import codecs
 import struct
 import eventlet.green.socket as socket
@@ -83,7 +84,7 @@ def get_nic_config(configmanager, node, ip=None, mac=None):
         cfgdata['prefix'] = prefixlen
         for setting in nodenetattribs:
             gw = nodenetattribs[setting].get('value', None)
-            if gw is None:
+            if gw is None or not gw:
                 continue
             if ip_on_same_subnet(ip, gw, prefixlen):
                 cfgdata['ipv4_gateway'] = gw
@@ -121,4 +122,28 @@ def get_prefix_len_for_ip(ip):
                 nbits += 1
                 maskn = maskn << 1 & 0xffffffff
             return nbits
-    raise exc.NotImplementedException("Non local addresses not supported")
+    raise exc.NotImplementedException("Non local addresses not supported")
+
+def addresses_match(addr1, addr2):
+    """Check two network addresses for similarity
+
+    Is it zero padded in one place, not zero padded in another?  Is one place by name and another by IP??
+    Is one context getting a normal IPv4 address and another getting IPv4 in IPv6 notation?
+    This function examines the two given names, performing the required changes to compare them for equivalency
+
+    :param addr1:
+    :param addr2:
+    :return: True if the given addresses refer to the same thing
+    """
+    for addrinfo in socket.getaddrinfo(addr1, 0, 0, socket.SOCK_STREAM):
+        rootaddr1 = socket.inet_pton(addrinfo[0], addrinfo[4][0])
+        if addrinfo[0] == socket.AF_INET6 and rootaddr1[:12] == b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff':
+            # normalize to standard IPv4
+            rootaddr1 = rootaddr1[-4:]
+        for otherinfo in socket.getaddrinfo(addr2, 0, 0, socket.SOCK_STREAM):
+            otheraddr = socket.inet_pton(otherinfo[0], otherinfo[4][0])
+            if otherinfo[0] == socket.AF_INET6 and otheraddr[:12] == b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff':
+                otheraddr = otheraddr[-4:]
+            if otheraddr == rootaddr1:
+                return True
+    return False

confluent_server/confluent/networking/lldp.py

@@ -33,6 +33,7 @@
 if __name__ == '__main__':
     import sys
     import confluent.config.configmanager as cfm
+import base64
 import confluent.exceptions as exc
 import confluent.log as log
 import confluent.messages as msg
@@ -87,7 +88,7 @@ _chassisidbyswitch = {}
 
 def lenovoname(idx, desc):
     if desc.isdigit():
-        return 'Ethernet' + str(idx)
+        return 'Ethernet' + str(desc)
     return desc
 
 nameoverrides = [
@@ -118,6 +119,25 @@ def _lldpdesc_to_ifname(switchid, idx, desc):
 def _dump_neighbordatum(info):
     return [msg.KeyValueData(info)]
 
+def b64tohex(b64str):
+    bd = base64.b64decode(b64str)
+    return ''.join(['{0:02x}'.format(ord(x)) for x in bd])
+
+def get_fingerprint(switch, port, configmanager, portmatch):
+    update_switch_data(switch, configmanager)
+    for neigh in _neighbypeerid:
+        info = _neighbypeerid[neigh]
+        if neigh == '!!vintage' or info.get('switch', None) != switch:
+            continue
+        if 'peersha256fingerprint' not in info:
+            continue
+        if info.get('switch', None) != switch:
+            continue
+        if portmatch(info.get('port'), port):
+            return ('sha256$' + b64tohex(info['peersha256fingerprint']),
+                    info.get('verified', False))
+    return None, False
+
 
 def _extract_extended_desc(info, source, integritychecked):
     source = str(source)
@@ -131,6 +151,9 @@ def _extract_extended_desc(info, source, integritychecked):
         info['peerdescription'] = source
 
 def sanitize(val):
+    # This is pretty much the same approach net-snmp takes.
+    # if the string is printable as-is, then just give it as-is
+    # if the string has non-printable, then hexify it
     val = str(val)
     for x in val.strip('\x00'):
         if ord(x) < 32 or ord(x) > 128:
@@ -141,7 +164,7 @@ def sanitize(val):
 def _init_lldp(data, iname, idx, idxtoportid, switch):
     if iname not in data:
         data[iname] = {'port': iname, 'portid': str(idxtoportid[idx]),
-                       'chassisid': str(_chassisidbyswitch[switch])}
+                       'chassisid': _chassisidbyswitch[switch]}
 
 def _extract_neighbor_data_b(args):
     """Build LLDP data about elements connected to switch
@@ -160,7 +183,8 @@ def _extract_neighbor_data_b(args):
         sid = str(sysid[1][6:])
     idxtoifname = {}
     idxtoportid = {}
-    _chassisidbyswitch[switch] = list(conn.walk('1.0.8802.1.1.2.1.3.2'))[0][1]
+    _chassisidbyswitch[switch] = sanitize(list(
+        conn.walk('1.0.8802.1.1.2.1.3.2'))[0][1])
     for oidindex in conn.walk('1.0.8802.1.1.2.1.3.7.1.3'):
         idx = oidindex[0][-1]
         idxtoportid[idx] = sanitize(oidindex[1])

confluent_server/confluent/networking/macmap.py

@@ -30,7 +30,7 @@
 
 # this module will provide mac to switch and full 'ifName' label
 # This functionality is restricted to the null tenant
-from confluent.networking.lldp import _handle_neighbor_query
+from confluent.networking.lldp import _handle_neighbor_query, get_fingerprint
 from confluent.networking.netutil import get_switchcreds, list_switches, get_portnamemap
 
 if __name__ == '__main__':
@@ -254,7 +254,9 @@ def find_nodeinfo_by_mac(mac, configmanager):
         if mac in _nodesbymac:
             return _nodesbymac[mac][0], {'maccount': _nodesbymac[mac][1]}
     # If update_mac bailed out, still check one last time
-    return _nodesbymac.get(mac, (None, {'maccount': 0}))
+    if mac in _nodesbymac:
+        return _nodesbymac[mac][0], {'maccount': _nodesbymac[mac][1]}
+    return None, {'maccount': 0}
 
 
 mapupdating = eventlet.semaphore.Semaphore()
@@ -378,6 +380,17 @@ def handle_api_request(configmanager, inputdata, operation, pathcomponents):
             operation, '/'.join(pathcomponents)))
 
 
+def get_node_fingerprints(nodename, configmanager):
+    cfg = configmanager.get_node_attributes(nodename, ['net*.switch',
+                                                       'net*.switchport'])
+    for attrkey in cfg[nodename]:
+        if attrkey.endswith('switch'):
+            switch = cfg[nodename][attrkey]['value']
+            port = cfg[nodename][attrkey + 'port']['value']
+            yield get_fingerprint(switch, port, configmanager,
+                                       _namesmatch)
+
+
 def handle_read_api_request(pathcomponents, configmanager):
     # TODO(jjohnson2): discovery core.py api handler design, apply it here
     # to make this a less tangled mess as it gets extended
@@ -449,7 +462,7 @@ def handle_read_api_request(pathcomponents, configmanager):
 
 
 def dump_macinfo(macaddr):
-    macaddr = macaddr.replace('-', ':')
+    macaddr = macaddr.replace('-', ':').lower()
     info = _macmap.get(macaddr, None)
     if info is None:
         raise exc.NotFoundException(

confluent_server/confluent/networking/netutil.py

@@ -34,6 +34,8 @@ def get_switchcreds(configmanager, switches):
                                                              'public')
             user = switchparms.get(
                 'secret.hardwaremanagementuser', {}).get('value', None)
+            if not user:
+                user = None
         switchauth.append((switch, password, user))
     return switchauth
 

confluent_server/confluent/noderange.py

@@ -38,6 +38,9 @@ _parser = pp.nestedExpr(content=_grammar)
 _numextractor = pp.OneOrMore(pp.Word(pp.alphas + '-') | pp.Word(pp.nums))
 
 numregex = re.compile('([0-9]+)')
+
+lastnoderange = None
+
 def humanify_nodename(nodename):
     """Analyzes nodename in a human way to enable natural sort
 
@@ -64,6 +67,13 @@ class ReverseNodeRange(object):
     def noderange(self):
         subsetgroups = []
         for group in self.cfm.get_groups(sizesort=True):
+            if lastnoderange:
+                for nr in lastnoderange:
+                    if lastnoderange[nr] - self.nodes:
+                        continue
+                    if self.nodes - lastnoderange[nr]:
+                        continue
+                    return nr
             nl = set(
                 self.cfm.get_nodegroup_attributes(group).get('nodes', []))
             if len(nl) > len(self.nodes) or not nl:
@@ -86,6 +96,7 @@ class NodeRange(object):
     """
 
     def __init__(self, noderange, config=None):
+        global lastnoderange
         self.beginpage = None
         self.endpage = None
         self.cfm = config
@@ -99,6 +110,7 @@ class NodeRange(object):
             self._noderange = set(self.cfm.list_nodes())
         else:
             self._noderange = self._evaluate(elements)
+        lastnoderange = {noderange: set(self._noderange)}
 
     @property
     def nodes(self):

confluent_server/confluent/plugins/configuration/attributes.py

@@ -20,6 +20,7 @@ import confluent.util as util
 
 
 def retrieve(nodes, element, configmanager, inputdata):
+    configmanager.check_quorum()
     if nodes is not None:
         return retrieve_nodes(nodes, element, configmanager, inputdata)
     elif element[0] == 'nodegroups':
@@ -177,10 +178,17 @@ def _expand_expression(nodes, configmanager, inputdata):
     if type(expression) is dict:
         expression = expression['expression']
     pernodeexpressions = {}
-    for expanded in configmanager.expand_attrib_expression(nodes, expression):
-        pernodeexpressions[expanded[0]] = expanded[1]
-    for node in util.natural_sort(pernodeexpressions):
-        yield msg.KeyValueData({'value': pernodeexpressions[node]}, node)
+    try:
+        for expanded in configmanager.expand_attrib_expression(nodes,
+                                                               expression):
+            pernodeexpressions[expanded[0]] = expanded[1]
+        for node in util.natural_sort(pernodeexpressions):
+            yield msg.KeyValueData({'value': pernodeexpressions[node]}, node)
+    except (SyntaxError, ValueError) as e:
+        raise exc.InvalidArgumentException(
+            'Bad confluent expression syntax (must use "{{" and "}}" if not '
+            'desiring confluent expansion): ' + str(e))
+
 
 
 def create(nodes, element, configmanager, inputdata):

confluent_server/confluent/plugins/hardwaremanagement/enclosure.py

@@ -19,8 +19,15 @@ def update(nodes, element, configmanager, inputdata):
     emebs = configmanager.get_node_attributes(
         nodes, (u'enclosure.manager', u'enclosure.bay'))
     for node in nodes:
-        em = emebs[node]['enclosure.manager']['value']
-        eb = emebs[node]['enclosure.bay']['value']
+        try:
+            em = emebs[node]['enclosure.manager']['value']
+            eb = emebs[node]['enclosure.bay']['value']
+        except KeyError:
+            yield msg.ConfluentNodeError(
+                node,
+                'Reseat is only supported on servers in an enclosure, and '
+                'with enclosure.manager and enclosure.bay defined')
+            continue
         try:
             for rsp in core.handle_path(
                     '/nodes/{0}/_enclosure/reseat_bay'.format(em),

confluent_server/confluent/plugins/hardwaremanagement/ipmi.py

@@ -30,6 +30,7 @@ import pyghmi.exceptions as pygexc
 console = eventlet.import_patched('pyghmi.ipmi.console')
 ipmicommand = eventlet.import_patched('pyghmi.ipmi.command')
 import socket
+import ssl
 
 
 # There is something not right with the RLocks used in pyghmi when
@@ -131,7 +132,7 @@ class IpmiCommandWrapper(ipmicommand.Command):
         self._inhealth = False
         self._lasthealth = None
         self._attribwatcher = cfm.watch_attributes(
-            (node,), ('secret.hardwaremanagementuser',
+            (node,), ('secret.hardwaremanagementuser', 'collective.manager',
                       'secret.hardwaremanagementpassword', 'secret.ipmikg',
                       'hardwaremanagement.manager'), self._attribschanged)
         super(self.__class__, self).__init__(**kwargs)
@@ -291,6 +292,7 @@ class IpmiConsole(conapi.Console):
             self.solconnection.out_handler = _donothing
             self.solconnection.close()
         self.solconnection = None
+        self.datacallback = None
         self.broken = True
         self.error = "closed"
 
@@ -343,16 +345,26 @@ def perform_request(operator, node, element,
                                cfg, results).handle_request()
         except pygexc.IpmiException as ipmiexc:
             excmsg = str(ipmiexc)
-            if excmsg == 'Session no longer connected':
+            if excmsg in ('Session no longer connected', 'timeout'):
                 results.put(msg.ConfluentTargetTimeout(node))
             else:
                 results.put(msg.ConfluentNodeError(node, excmsg))
                 raise
         except exc.TargetEndpointUnreachable as tu:
             results.put(msg.ConfluentTargetTimeout(node, str(tu)))
-        except Exception as e:
+        except ssl.SSLEOFError:
             results.put(msg.ConfluentNodeError(
-                node, 'IPMI PluginException (see stderr log): ' + str(e)))
+                self.node, 'Unable to communicate with the https server on '
+                           'the target BMC'))
+        except exc.PubkeyInvalid:
+            results.put(msg.ConfluentNodeError(
+                node,
+                'Mismatch detected between target certificate fingerprint '
+                'and pubkeys.tls_hardwaremanager attribute'))
+        except pygexc.InvalidParameterValue as e:
+            results.put(msg.ConfluentNodeError(node, str(e)))
+        except Exception as e:
+            results.put(e)
             raise
         finally:
             results.put('Done')
@@ -394,9 +406,10 @@ class IpmiHandler(object):
                 ipmisess = persistent_ipmicmds[(node, tenant)].ipmi_session
                 begin = util.monotonic_time()
                 while ((not (self.broken or self.loggedin)) and
-                               (util.monotonic_time() - begin) < 180):
-                    ipmisess.wait_for_rsp(180)
+                               (util.monotonic_time() - begin) < 30):
+                    ipmisess.wait_for_rsp(31 - (util.monotonic_time() - begin))
                 if not (self.broken or self.loggedin):
+                    ipmisess._mark_broken()
                     raise exc.TargetEndpointUnreachable(
                         "Login process to " + connparams['bmc'] + " died")
             except socket.gaierror as ge:
@@ -450,6 +463,14 @@ class IpmiHandler(object):
             self.handle_update()
         elif self.element[0] == 'inventory':
             self.handle_inventory()
+        elif self.element == ['media', 'attach']:
+            self.handle_attach_media()
+        elif self.element == ['media', 'detach']:
+            self.handle_detach_media()
+        elif self.element == ['media', 'uploads']:
+            self.handle_media_upload()
+        elif self.element == ['media', 'current']:
+            self.handle_list_media()
         elif self.element == ['events', 'hardware', 'log']:
             self.do_eventlog()
         elif self.element == ['events', 'hardware', 'decode']:
@@ -468,6 +489,25 @@ class IpmiHandler(object):
                 'nodes/{0}/inventory/firmware/updates/active/{1}'.format(
                     self.node, u.name)))
 
+    def handle_media_upload(self):
+        u = firmwaremanager.Updater(self.node, self.ipmicmd.upload_media,
+                                     self.inputdata.filename, self.tenant,
+                                     type='mediaupload')
+        self.output.put(msg.CreatedResource(
+            'nodes/{0}/media/uploads/{1}'.format(self.node, u.name)))
+
+    def handle_attach_media(self):
+        try:
+            self.ipmicmd.attach_remote_media(self.inputdata.filename)
+        except pygexc.UnsupportedFunctionality as uf:
+            self.output.put(msg.ConfluentNodeError(self.node, str(uf)))
+
+    def handle_detach_media(self):
+        self.ipmicmd.detach_remote_media()
+
+    def handle_list_media(self):
+        for media in self.ipmicmd.list_media():
+            self.output.put(msg.Media(self.node, media))
 
     def handle_configuration(self):
         if self.element[1:3] == ['management_controller', 'alerts']:
@@ -480,10 +520,14 @@ class IpmiHandler(object):
             return self.handle_reset()
         elif self.element[1:3] == ['management_controller', 'identifier']:
             return self.handle_identifier()
+        elif self.element[1:3] == ['management_controller', 'hostname']:
+            return self.handle_hostname()
         elif self.element[1:3] == ['management_controller', 'domain_name']:
             return self.handle_domain_name()
         elif self.element[1:3] == ['management_controller', 'ntp']:
             return self.handle_ntp()
+        elif self.element[1:3] == ['system', 'all']:
+            return self.handle_sysconfig()
         raise Exception('Not implemented')
 
     def decode_alert(self):
@@ -555,10 +599,20 @@ class IpmiHandler(object):
                 ))
             elif self.op == 'update':
                 config = self.inputdata.netconfig(self.node)
-                self.ipmicmd.set_net_configuration(
-                                ipv4_address=config['ipv4_address'],
-                                ipv4_configuration=config['ipv4_configuration'],
-                                ipv4_gateway=config['ipv4_gateway'])
+                try:
+                    self.ipmicmd.set_net_configuration(
+                        ipv4_address=config['ipv4_address'],
+                        ipv4_configuration=config['ipv4_configuration'],
+                        ipv4_gateway=config['ipv4_gateway'])
+                except socket.error as se:
+                    self.output.put(msg.ConfluentNodeError(self.node,
+                                                           se.message))
+                except ValueError as e:
+                    if e.message == 'negative shift count':
+                        self.output.put(msg.ConfluentNodeError(
+                            self.node, 'Invalid prefix length given'))
+                    else:
+                        raise
 
     def handle_users(self):
         # Create user
@@ -706,17 +760,27 @@ class IpmiHandler(object):
 
     def read_firmware(self, component):
         items = []
+        errorneeded = False
         try:
-            for id, data in self.ipmicmd.get_firmware():
-                if component == 'all' or component == simplify_name(id):
+            complist = () if component == 'all' else (component,)
+            for id, data in self.ipmicmd.get_firmware(complist):
+                if (component in ('core', 'all') or
+                        component == simplify_name(id)):
                     items.append({id: data})
+        except ssl.SSLEOFError:
+            errorneeded = msg.ConfluentNodeError(
+                self.node, 'Unable to communicate with the https server on '
+                           'the target BMC while trying to read extended '
+                           'information')
         except exc.PubkeyInvalid:
-            self.output.put(msg.ConfluentNodeError(
+            errorneeded = msg.ConfluentNodeError(
                 self.node,
                 'Extended information unavailable, mismatch detected between '
                 'target certificate fingerprint and '
-                'pubkeys.tls_hardwaremanager attribute'))
+                'pubkeys.tls_hardwaremanager attribute')
         self.output.put(msg.Firmware(items, self.node))
+        if errorneeded:
+            self.output.put(errorneeded)
 
     def handle_inventory(self):
         if self.element[1] == 'firmware':
@@ -744,32 +808,47 @@ class IpmiHandler(object):
         self.output.put(msg.LEDStatus(led_categories, self.node))
 
     def read_inventory(self, component):
-        invitems = []
-        if component == 'all':
-            for invdata in self.ipmicmd.get_inventory():
-                if invdata[1] is None:
+        errorneeded = False
+        try:
+            invitems = []
+            if component == 'all':
+                for invdata in self.ipmicmd.get_inventory():
+                    if invdata[1] is None:
+                        newinf = {'present': False, 'information': None}
+                    else:
+                        sanitize_invdata(invdata[1])
+                        newinf = {'present': True, 'information': invdata[1]}
+                    newinf['name'] = invdata[0]
+                    invitems.append(newinf)
+            else:
+                self.make_inventory_map()
+                compname = self.invmap.get(component, None)
+                if compname is None:
+                    self.output.put(msg.ConfluentTargetNotFound())
+                    return
+                invdata = self.ipmicmd.get_inventory_of_component(compname)
+                if invdata is None:
                     newinf = {'present': False, 'information': None}
                 else:
-                    sanitize_invdata(invdata[1])
-                    newinf = {'present': True, 'information': invdata[1]}
-                newinf['name'] = invdata[0]
+                    sanitize_invdata(invdata)
+                    newinf = {'present': True, 'information': invdata}
+                newinf['name'] = compname
                 invitems.append(newinf)
-        else:
-            self.make_inventory_map()
-            compname = self.invmap.get(component, None)
-            if compname is None:
-                self.output.put(msg.ConfluentTargetNotFound())
-                return
-            invdata = self.ipmicmd.get_inventory_of_component(compname)
-            if invdata is None:
-                newinf = {'present': False, 'information': None}
-            else:
-                sanitize_invdata(invdata)
-                newinf = {'present': True, 'information': invdata}
-            newinf['name'] = compname
-            invitems.append(newinf)
+        except ssl.SSLEOFError:
+            errorneeded = msg.ConfluentNodeError(
+                self.node, 'Unable to communicate with the https server on '
+                           'the target BMC while trying to read extended '
+                           'information')
+        except exc.PubkeyInvalid:
+            errorneeded = msg.ConfluentNodeError(
+                self.node,
+                'Extended information unavailable, mismatch detected between '
+                'target certificate fingerprint and '
+                'pubkeys.tls_hardwaremanager attribute')
         newinvdata = {'inventory': invitems}
         self.output.put(msg.KeyValueData(newinvdata, self.node))
+        if errorneeded:
+            self.output.put(errorneeded)
 
     def handle_sensors(self):
         if self.element[-1] == '':
@@ -921,6 +1000,16 @@ class IpmiHandler(object):
             self.ipmicmd.set_mci(mci)
             return
 
+    def handle_hostname(self):
+        if 'read' == self.op:
+            hostname = self.ipmicmd.get_hostname()
+            self.output.put(msg.Hostname(self.node, hostname))
+            return
+        elif 'update' == self.op:
+            hostname = self.inputdata.hostname(self.node)
+            self.ipmicmd.set_hostname(hostname)
+            return
+
     def handle_domain_name(self):
         if 'read' == self.op:
             dn = self.ipmicmd.get_domain_name()
@@ -931,6 +1020,14 @@ class IpmiHandler(object):
             self.ipmicmd.set_domain_name(dn)
             return
 
+    def handle_sysconfig(self):
+        if 'read' == self.op:
+            self.output.put(msg.ConfigSet(
+                self.node, self.ipmicmd.get_system_configuration()))
+        elif 'update' == self.op:
+            self.ipmicmd.set_system_configuration(
+                self.inputdata.get_attributes(self.node))
+
     def handle_ntp(self):
         if self.element[3] == 'enabled':
             if 'read' == self.op:
@@ -1022,6 +1119,9 @@ def retrieve(nodes, element, configmanager, inputdata):
     if '/'.join(element).startswith('inventory/firmware/updates/active'):
         return firmwaremanager.list_updates(nodes, configmanager.tenant,
                                             element)
+    elif '/'.join(element).startswith('media/uploads'):
+        return firmwaremanager.list_updates(nodes, configmanager.tenant,
+                                            element, 'mediaupload')
     else:
         return perform_requests('read', nodes, element, configmanager, inputdata)
 
@@ -1030,5 +1130,8 @@ def delete(nodes, element, configmanager, inputdata):
     if '/'.join(element).startswith('inventory/firmware/updates/active'):
         return firmwaremanager.remove_updates(nodes, configmanager.tenant,
                                               element)
+    elif '/'.join(element).startswith('media/uploads'):
+        return firmwaremanager.remove_updates(nodes, configmanager.tenant,
+                                              element, type='mediaupload')
     return perform_requests(
         'delete', nodes, element, configmanager, inputdata)

confluent_server/confluent/plugins/shell/ssh.py

@@ -63,6 +63,7 @@ class SshShell(conapi.Console):
     def __init__(self, node, config, username='', password=''):
         self.node = node
         self.ssh = None
+        self.datacallback = None
         self.nodeconfig = config
         self.username = username
         self.password = password
@@ -128,7 +129,7 @@ class SshShell(conapi.Console):
                 data = data[:delidx - 1] + data[delidx + 1:]
             self.username += data
             if '\r' in self.username:
-                self.username, self.password = self.username.split('\r')
+                self.username, self.password = self.username.split('\r')[:2]
                 lastdata = data.split('\r')[0]
                 if lastdata != '':
                     self.datacallback(lastdata)
@@ -155,6 +156,7 @@ class SshShell(conapi.Console):
     def close(self):
         if self.ssh is not None:
             self.ssh.close()
+        self.datacallback = None
 
 def create(nodes, element, configmanager, inputdata):
     if len(nodes) == 1:

confluent_server/confluent/shellmodule.py

@@ -116,6 +116,7 @@ class ExecConsole(conapi.Console):
                 break
         if self.subproc is not None and self.subproc.poll() is None:
             self.subproc.kill()
+        self._datacallback = None
 
 
 class Plugin(object):

confluent_server/confluent/shellserver.py

@@ -30,6 +30,9 @@ class _ShellHandler(consoleserver.ConsoleHandler):
     _genwatchattribs = False
     _logtobuffer = False
 
+    def check_collective(self, attrvalue):
+        return
+
     def log(self, *args, **kwargs):
         # suppress logging through proving a stub 'log' function
         return

confluent_server/confluent/snmputil.py

@@ -99,6 +99,10 @@ class Session(object):
                 elif errnum:
                     raise exc.ConfluentException(errnum.prettyPrint())
                 for ans in answers:
+                    if not obj[0].isPrefixOf(ans[0]):
+                        # PySNMP returns leftovers in a bulk command
+                        # filter out such leftovers
+                        break
                     yield ans
         except snmperr.WrongValueError:
             raise exc.TargetEndpointBadCredentials('Invalid SNMPv3 password')

confluent_server/confluent/sockapi.py

@@ -21,6 +21,8 @@
 #
 
 import atexit
+import ctypes
+import ctypes.util
 import errno
 import os
 import pwd
@@ -29,6 +31,7 @@ import struct
 import sys
 import traceback
 
+import eventlet.green.select as select
 import eventlet.green.socket as socket
 import eventlet.green.ssl as ssl
 import eventlet
@@ -41,7 +44,8 @@ import confluent.exceptions as exc
 import confluent.log as log
 import confluent.core as pluginapi
 import confluent.shellserver as shellserver
-
+import confluent.collective.manager as collective
+import confluent.util as util
 
 tracelog = None
 auditlog = None
@@ -54,6 +58,22 @@ except AttributeError:
     else:
         SO_PEERCRED = 17
 
+try:
+    # Python core TLS despite improvements still has no support for custom
+    # verify functions.... try to use PyOpenSSL where available to support
+    # client certificates with custom verify
+    import eventlet.green.OpenSSL.SSL as libssl
+    # further, not even pyopenssl exposes SSL_CTX_set_cert_verify_callback
+    # so we need to ffi that in using a strategy compatible with PyOpenSSL
+    import OpenSSL.SSL as libssln
+    import OpenSSL.crypto as crypto
+    from OpenSSL._util import ffi
+except ImportError:
+    libssl = None
+    ffi = None
+    crypto = None
+
+plainsocket = None
 
 class ClientConsole(object):
     def __init__(self, client):
@@ -82,7 +102,7 @@ def send_data(connection, data):
             raise
 
 
-def sessionhdl(connection, authname, skipauth=False):
+def sessionhdl(connection, authname, skipauth=False, cert=None):
     # For now, trying to test the console stuff, so let's just do n4.
     authenticated = False
     authdata = None
@@ -99,6 +119,15 @@ def sessionhdl(connection, authname, skipauth=False):
     while not authenticated:  # prompt for name and passphrase
         send_data(connection, {'authpassed': 0})
         response = tlvdata.recv(connection)
+        if 'collective' in response:
+            return collective.handle_connection(connection, cert,
+                                           response['collective'])
+        if 'dispatch' in response:
+            dreq = tlvdata.recvall(connection, response['dispatch']['length'])
+            return pluginapi.handle_dispatch(connection, cert, dreq,
+                                             response['dispatch']['name'])
+        if 'proxyconsole' in response:
+            return start_proxy_term(connection, cert, response['proxyconsole'])
         authname = response['username']
         passphrase = response['password']
         # note(jbjohnso): here, we need to authenticate, but not
@@ -114,6 +143,9 @@ def sessionhdl(connection, authname, skipauth=False):
             cfm = authdata[1]
     send_data(connection, {'authpassed': 1})
     request = tlvdata.recv(connection)
+    if 'collective' in request and skipauth:
+        return collective.handle_connection(connection, None, request['collective'],
+                                     local=True)
     while request is not None:
         try:
             process_request(
@@ -172,7 +204,7 @@ def process_request(connection, request, cfm, authdata, authname, skipauth):
         if operation == 'start':
             return start_term(authname, cfm, connection, params, path,
                               authdata, skipauth)
-        elif operation == 'shutdown':
+        elif operation == 'shutdown' and skipauth:
             configmanager.ConfigManager.shutdown()
         else:
             hdlr = pluginapi.handle_path(path, operation, cfm, params)
@@ -187,6 +219,18 @@ def process_request(connection, request, cfm, authdata, authname, skipauth):
     send_response(hdlr, connection)
     return
 
+def start_proxy_term(connection, cert, request):
+    cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    droneinfo = configmanager.get_collective_member(request['name'])
+    if not util.cert_matches(droneinfo['fingerprint'], cert):
+        connection.close()
+        return
+    cfm = configmanager.ConfigManager(request['tenant'])
+    ccons = ClientConsole(connection)
+    consession = consoleserver.ConsoleSession(
+        node=request['node'], configmanager=cfm, username=request['user'],
+        datacallback=ccons.sendall, skipreplay=request['skipreplay'])
+    term_interact(None, None, ccons, None, connection, consession, None)
 
 def start_term(authname, cfm, connection, params, path, authdata, skipauth):
     elems = path.split('/')
@@ -210,12 +254,16 @@ def start_term(authname, cfm, connection, params, path, authdata, skipauth):
             node=node, configmanager=cfm, username=authname,
             datacallback=ccons.sendall, skipreplay=skipreplay,
             sessionid=sessionid)
-
     else:
         raise exc.InvalidArgumentException('Invalid path {0}'.format(path))
-
     if consession is None:
         raise Exception("TODO")
+    term_interact(authdata, authname, ccons, cfm, connection, consession,
+                  skipauth)
+
+
+def term_interact(authdata, authname, ccons, cfm, connection, consession,
+                  skipauth):
     send_data(connection, {'started': 1})
     ccons.startsending()
     bufferage = consession.get_buffer_age()
@@ -226,7 +274,7 @@ def start_term(authname, cfm, connection, params, path, authdata, skipauth):
         if type(data) == dict:
             if data['operation'] == 'stop':
                 consession.destroy()
-                return
+                break
             elif data['operation'] == 'break':
                 consession.send_break()
                 continue
@@ -247,11 +295,12 @@ def start_term(authname, cfm, connection, params, path, authdata, skipauth):
                 continue
         if not data:
             consession.destroy()
-            return
+            break
         consession.write(data)
 
 
 def _tlshandler(bind_host, bind_port):
+    global plainsocket
     plainsocket = socket.socket(socket.AF_INET6)
     plainsocket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     plainsocket.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
@@ -271,13 +320,54 @@ def _tlshandler(bind_host, bind_port):
         eventlet.spawn_n(_tlsstartup, cnn)
 
 
+if ffi:
+    @ffi.callback("int(*)( X509_STORE_CTX *, void*)")
+    def verify_stub(store, misc):
+        return 1
+
+
 def _tlsstartup(cnn):
     authname = None
-    cnn = ssl.wrap_socket(cnn, keyfile="/etc/confluent/privkey.pem",
-                          certfile="/etc/confluent/srvcert.pem",
-                          ssl_version=ssl.PROTOCOL_TLSv1,
-                          server_side=True)
-    sessionhdl(cnn, authname)
+    cert = None
+    if libssl:
+        # most fully featured SSL function
+        ctx = libssl.Context(libssl.SSLv23_METHOD)
+        ctx.set_options(libssl.OP_NO_SSLv2 | libssl.OP_NO_SSLv3 |
+                        libssl.OP_NO_TLSv1 | libssl.OP_NO_TLSv1_1 |
+                        libssl.OP_CIPHER_SERVER_PREFERENCE)
+        ctx.set_cipher_list(
+            'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:'
+            'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384')
+        ctx.set_tmp_ecdh(crypto.get_elliptic_curve('secp384r1'))
+        ctx.use_certificate_file('/etc/confluent/srvcert.pem')
+        ctx.use_privatekey_file('/etc/confluent/privkey.pem')
+        ctx.set_verify(libssln.VERIFY_PEER, lambda *args: True)
+        libssln._lib.SSL_CTX_set_cert_verify_callback(ctx._context,
+                                                      verify_stub, ffi.NULL)
+        cnn = libssl.Connection(ctx, cnn)
+        cnn.set_accept_state()
+        cnn.do_handshake()
+        cert = cnn.get_peer_certificate()
+    else:
+        try:
+            # Try relatively newer python TLS function
+            ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+            ctx.options |= ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3
+            ctx.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+            ctx.options |= ssl.OP_CIPHER_SERVER_PREFERENCE
+            ctx.set_ciphers(
+                'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:'
+                'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384')
+            ctx.load_cert_chain('/etc/confluent/srvcert.pem',
+                                '/etc/confluent/privkey.pem')
+            cnn = ctx.wrap_socket(cnn, server_side=True)
+        except AttributeError:
+            # Python 2.6 era, go with best effort
+            cnn = ssl.wrap_socket(cnn, keyfile="/etc/confluent/privkey.pem",
+                                  certfile="/etc/confluent/srvcert.pem",
+                                  ssl_version=ssl.PROTOCOL_TLSv1,
+                                  server_side=True)
+    sessionhdl(cnn, authname, cert=cert)
 
 def removesocket():
     try:
@@ -336,6 +426,36 @@ class SockApi(object):
         global tracelog
         tracelog = log.Logger('trace')
         auditlog = log.Logger('audit')
+        self.tlsserver = None
+        if self.should_run_remoteapi():
+            self.start_remoteapi()
+        else:
+            eventlet.spawn_n(self.watch_for_cert)
+        self.unixdomainserver = eventlet.spawn(_unixdomainhandler)
+
+    def watch_for_cert(self):
+        libc = ctypes.CDLL(ctypes.util.find_library('c'))
+        watcher = libc.inotify_init()
+        if libc.inotify_add_watch(watcher, '/etc/confluent/', 0x100) > -1:
+            while True:
+                select.select((watcher,), (), (), 86400)
+                if self.should_run_remoteapi():
+                    os.close(watcher)
+                    self.start_remoteapi()
+                    break
+
+    def should_run_remoteapi(self):
+        return os.path.exists("/etc/confluent/srvcert.pem")
+
+    def stop_remoteapi(self):
+        if self.tlsserver is None:
+            return
+        self.tlsserver.kill()
+        plainsocket.close()
+        self.tlsserver = None
+
+    def start_remoteapi(self):
+        if self.tlsserver is not None:
+            return
         self.tlsserver = eventlet.spawn(
             _tlshandler, self.bind_host, self.bind_port)
-        self.unixdomainserver = eventlet.spawn(_unixdomainhandler)

confluent_server/confluent/util.py

@@ -24,6 +24,7 @@ import netifaces
 import os
 import re
 import socket
+import ssl
 import struct
 
 
@@ -99,10 +100,26 @@ def monotonic_time():
     return os.times()[4]
 
 
+def get_certificate_from_file(certfile):
+    cert = open(certfile, 'rb').read()
+    inpemcert = False
+    prunedcert = ''
+    for line in cert.split('\n'):
+        if '-----BEGIN CERTIFICATE-----' in line:
+            inpemcert = True
+        if inpemcert:
+            prunedcert += line
+        if '-----END CERTIFICATE-----' in line:
+            break
+    return ssl.PEM_cert_to_DER_cert(prunedcert)
+
+
 def get_fingerprint(certificate, algo='sha512'):
-    if algo != 'sha512':
-        raise Exception("TODO: Non-sha512")
-    return 'sha512$' + hashlib.sha512(certificate).hexdigest()
+    if algo == 'sha256':
+        return 'sha256$' + hashlib.sha256(certificate).hexdigest()
+    elif algo == 'sha512':
+        return 'sha512$' + hashlib.sha512(certificate).hexdigest()
+    raise Exception('Unsupported fingerprint algorithm ' + algo)
 
 
 def cert_matches(fingerprint, certificate):
@@ -110,8 +127,8 @@ def cert_matches(fingerprint, certificate):
         return False
     algo, _, fp = fingerprint.partition('$')
     newfp = None
-    if algo == 'sha512':
-        newfp = get_fingerprint(certificate)
+    if algo in ('sha512', 'sha256'):
+        newfp = get_fingerprint(certificate, algo)
     return newfp and fingerprint == newfp
 
 
@@ -122,7 +139,6 @@ class TLSCertVerifier(object):
         self.fieldname = fieldname
 
     def verify_cert(self, certificate):
-        fingerprint = get_fingerprint(certificate)
         storedprint = self.cfm.get_node_attributes(self.node, (self.fieldname,)
                                                    )
         if (self.fieldname not in storedprint[self.node] or
@@ -135,19 +151,23 @@ class TLSCertVerifier(object):
                     newpolicy[self.node]['pubkeys.addpolicy']['value'] == 'manual'):
                 # manual policy means always raise unless a match is set
                 # manually
+                fingerprint = get_fingerprint(certificate, 'sha256')
                 raise cexc.PubkeyInvalid('New certificate detected',
                                          certificate, fingerprint,
                                          self.fieldname, 'newkey')
             # since the policy is not manual, go ahead and add new key
             # after logging to audit log
+            fingerprint = get_fingerprint(certificate, 'sha256')
             auditlog = log.Logger('audit')
             auditlog.log({'node': self.node, 'event': 'certautoadd',
                           'fingerprint': fingerprint})
             self.cfm.set_node_attributes(
                 {self.node: {self.fieldname: fingerprint}})
             return True
-        elif storedprint[self.node][self.fieldname]['value'] == fingerprint:
+        elif cert_matches(storedprint[self.node][self.fieldname]['value'],
+                          certificate):
             return True
+        fingerprint = get_fingerprint(certificate, 'sha256')
         raise cexc.PubkeyInvalid(
             'Mismatched certificate detected', certificate, fingerprint,
             self.fieldname, 'mismatch')

confluent_server/confluent_server.spec.tmpl

@@ -12,7 +12,7 @@ Group: Development/Libraries
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-buildroot
 Prefix: %{_prefix}
 BuildArch: noarch
-Requires: python-pyghmi, python-eventlet, python-greenlet, python-crypto >= 2.6.1, confluent_client, pyparsing, python-paramiko, python-dns, python-netifaces, python2-pyasn1 >= 0.2.3, python-pysnmp >= 4.3.4, python-pyte
+Requires: python-pyghmi >= 1.0.34, python-eventlet, python-greenlet, python-pycryptodomex >= 3.4.7, confluent_client, python-pyparsing, python-paramiko, python-dns, python-netifaces, python2-pyasn1 >= 0.2.3, python-pysnmp >= 4.3.4, python-pyte, python-lxml, python-eficompressor, python-setuptools
 Vendor: Jarrod Johnson <jjohnson2@lenovo.com>
 Url: http://xcat.sf.net/
 

confluent_server/dbgtools/confluentdbgcli.py

@@ -61,7 +61,10 @@ class GetInput(threading.Thread):
 inputthread = GetInput()
 inputthread.start()
 while True:
-    r, _, _ = select.select((conn,), (), (), 0.1)
+    try:
+        r, _, _ = select.select((conn,), (), (), 0.1)
+    except select.error:
+        continue
     if conn in r:
         sys.stdout.write(conn.recv(1))
     if pendingoutput is not None:

confluent_server/dbgtools/processhangtraces.py

@@ -27,7 +27,7 @@ with open(sys.argv[1]) as tracefile:
                 if currtrace not in threadtraces:
                     threadtraces[currtrace] = 0
                 threadtraces[currtrace] += 1
-            currtrace = line
+            currtrace = ''
         elif currtrace is not None:
             currtrace += line + '\n'
 for trace in sorted(threadtraces, key=lambda x: threadtraces[x]):

confluent_server/makesetup

@@ -6,4 +6,6 @@ if [ "$NUMCOMMITS" != "$VERSION"  ]; then
 fi
 echo $VERSION > VERSION
 sed -e "s/#VERSION#/$VERSION/" setup.py.tmpl > setup.py
-echo '__version__ = "'$VERSION'"' > confluent/__init__.py
+if [ -f confluent/client.py ]; then 
+    echo '__version__ = "'$VERSION'"' > confluent/__init__.py
+fi

confluent_server/setup.py.tmpl

@@ -15,10 +15,12 @@ setup(
               'confluent/networking/',
               'confluent/plugins/hardwaremanagement/',
               'confluent/plugins/shell/',
+              'confluent/collective/',
               'confluent/plugins/configuration/'],
     install_requires=['paramiko', 'pycrypto>=2.6', 'confluent_client>=0.1.0', 'eventlet',
-                      'pyghmi>=0.6.5'],
-    scripts=['bin/confluent', 'bin/confluentdbutil'],
+                      'dnspython', 'netifaces', 'pyte', 'pysnmp', 'pyparsing',
+                      'pyghmi>=1.0.44'],
+    scripts=['bin/confluent', 'bin/confluentdbutil', 'bin/collective'],
     data_files=[('/etc/init.d', ['sysvinit/confluent']),
                 ('/usr/lib/sysctl.d', ['sysctl/confluent.conf']),
                 ('/usr/lib/systemd/system', ['systemd/confluent.service']),