Set password before setting username

The BMC is at much higher risk for rejecting the password
(e.g. the password does not pass complexity requirements).  If the
username changes, but the password is still default, it is very
confusing.  Give the password change the chance to break the
configuration process first.

confluent_client/bin/collate

@@ -21,6 +21,7 @@
 
 import optparse
 import os
+import select
 import sys
 
 path = os.path.dirname(os.path.realpath(__file__))
@@ -47,6 +48,8 @@ argparser.add_option('-c', '--count', action='store_true',
 argparser.add_option('-r', '--reverse', action='store_true',
                      help='Reverse sort order to show biggest output group '
                           'last')
+argparser.add_option('-l', '--log', action='store', type='string', dest='log',
+                     help='Log each output to file, using {node} as a placeholder for node.')
 (options, args) = argparser.parse_args()
 if sys.stdin.isatty():
     argparser.print_help()
@@ -70,17 +73,39 @@ def print_current():
     sys.stdout.flush()
 
 fullline = sys.stdin.readline()
+printpending = True
+clearpending = False
+holdoff = 0
 while fullline:
     for line in fullline.split('\n'):
         if not line:
             continue
         if ': ' not in line:
             line = 'UNKNOWN: ' + line
+        if options.log:
+            node, output = line.split(': ', 1)
+            currlog = options.log.format(node=node, nodename=node)
+            with open(currlog, mode='a')  as log:
+                log.write(output + '\n')
+            continue
         grouped.add_line(*line.split(': ', 1))
         if options.watch:
-            sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
-            print_current()
+            if not holdoff:
+                holdoff = os.times()[4] + 0.250
+            if (holdoff < os.times()[4] or
+                    not select.select((sys.stdin,), (), (), 0.250)[0]):
+                # print now, nothing pending
+                holdoff = 0
+                sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
+                print_current()
+                printpending = False
+                clearpending = True
+            else:
+                printpending = True
     fullline = sys.stdin.readline()
-if not options.watch:
+
+if printpending:
+    if clearpending:
+        sys.stdout.write('\x1b[2J\x1b[;H')  # clear screen
     print_current()
 

confluent_client/bin/confetty

@@ -598,9 +598,10 @@ def quitconfetty(code=0, fullexit=False, fixterm=True):
         if oldtcattr is not None:
             termios.tcsetattr(sys.stdin.fileno(), termios.TCSANOW, oldtcattr)
     # Request default color scheme, to undo potential weirdness of terminal
-    sys.stdout.write('\x1b[m')
+    if sys.stdout.isatty():
+        sys.stdout.write('\x1b[m')
     if fullexit:
-        if os.environ.get('TERM', '') not in ('linux'):
+        if sys.stdout.isatty() and os.environ.get('TERM', '') not in ('linux'):
             sys.stdout.write('\x1b]0;\x07')
         sys.exit(code)
     else:
@@ -763,7 +764,10 @@ def conserver_command(filehandle, localcommand):
 
 def get_command_bytes(filehandle, localcommand, cmdlen):
     while len(localcommand) < cmdlen:
-        ready, _, _ = select.select((filehandle,), (), (), 1)
+        try:
+            ready, _, _ = select.select((filehandle,), (), (), 1)
+        except select.error:
+            ready = ()
         if ready:
             localcommand += filehandle.read()
     return localcommand
@@ -776,7 +780,10 @@ def check_escape_seq(currinput, filehandle):
             sys.stdout.flush()
             return conserver_command(
                 filehandle, currinput[len(conserversequence):])
-        ready, _, _ = select.select((filehandle,), (), (), 3)
+        try:
+            ready, _, _ = select.select((filehandle,), (), (), 3)
+        except select.error:
+            ready = ()
         if not ready:  # 3 seconds of no typing
             break
         currinput += filehandle.read()
@@ -866,8 +873,11 @@ def check_power_state():
 
 while inconsole or not doexit:
     if inconsole:
-        rdylist, _, _ = select.select(
-            (sys.stdin, session.connection), (), (), 10)
+        try:
+            rdylist, _, _ = select.select(
+                (sys.stdin, session.connection), (), (), 10)
+        except select.error:
+            rdylist = ()
         for fh in rdylist:
             if fh == session.connection:
                 # this only should get called in the

confluent_client/bin/nodeattrib

@@ -17,6 +17,7 @@
 
 __author__ = 'alin37'
 
+from getpass import getpass
 import optparse
 import os
 import signal
@@ -35,7 +36,7 @@ if path.startswith('/opt'):
 import confluent.client as client
 
 argparser = optparse.OptionParser(
-    usage='''\n       %prog [-b] noderange [list of attributes]  \
+    usage='''\n       %prog [-b] noderange [list of attributes or 'all']  \
              \n       %prog -c noderange <list of attributes>  \
              \n       %prog -e noderange <attribute names to set>  \
              \n       %prog noderange attribute1=value1 attribute2=value,...
@@ -47,6 +48,8 @@ argparser.add_option('-e', '--environment', action='store_true',
                           'same name')
 argparser.add_option('-c', '--clear', action='store_true',
                      help='Clear attributes')
+argparser.add_option('-p', '--prompt', action='store_true',
+                     help='Prompt for attribute values interactively')
 (options, args) = argparser.parse_args()
 
 
@@ -67,12 +70,24 @@ exitcode = 0
 nodetype="noderange"
 
 if len(args) > 1:
-    if "=" in args[1] or options.clear or options.environment:
+    if "=" in args[1] or options.clear or options.environment or options.prompt:
         if "=" in args[1] and options.clear:
             print("Can not clear and set at the same time!")
             argparser.print_help()
             sys.exit(1)
-        exitcode=client.updateattrib(session,args,nodetype, noderange, options)
+        argassign = None
+        if options.prompt:
+            argassign = {}
+            for arg in args[1:]:
+                oneval = 1
+                twoval = 2
+                while oneval != twoval:
+                    oneval = getpass('Enter value for {0}: '.format(arg))
+                    twoval = getpass('Confirm value for {0}: '.format(arg))
+                    if oneval != twoval:
+                        print('Values did not match.')
+                argassign[arg] = twoval
+        exitcode=client.updateattrib(session,args,nodetype, noderange, options, argassign)
     try:
         # setting user output to what the user inputs
         if args[1] == 'all':

confluent_client/bin/nodeboot

@@ -35,6 +35,9 @@ argparser = optparse.OptionParser()
 argparser.add_option('-b', '--bios', dest='biosmode',
                      action='store_true', default=False,
                      help='Request BIOS style boot (rather than UEFI)')
+argparser.add_option('-u', '--uefi', dest='uefimode',
+                     action='store_true', default=False,
+                     help='Request UEFI style boot (rather than BIOS)')
 argparser.add_option('-p', '--persist', dest='persist', action='store_true',
                      default=False,
                      help='Request the boot device be persistent rather than '

confluent_client/bin/nodeconfig

@@ -55,6 +55,16 @@ argparser.add_option('-x', '--exclude', dest='exclude',
                      action='store_true', default=False,
                      help='Treat positional arguments as items to not '
                           'examine, compare, or restore default')
+argparser.add_option('-a', '--advanced', dest='advanced',
+                     action='store_true', default=False,
+                     help='Include advanced settings, which are normally not '
+                          'intended to be used without direction from the '
+                          'relevant server vendor.')
+argparser.add_option('-r', '--restoredefault', default=False,
+                     dest='restoredefault', metavar="COMPONENT",
+                     help='Restore the configuration of the node '
+                          'to factory default for given component. '
+                          'Currently only uefi is supported')
 (options, args) = argparser.parse_args()
 
 cfgpaths = {
@@ -67,6 +77,8 @@ cfgpaths = {
     'bmc.ipv4_gateway': (
         'configuration/management_controller/net_interfaces/management',
         'ipv4_gateway'),
+    'bmc.hostname': (
+        'configuration/management_controller/hostname', 'hostname'),
 }
 
 autodeps = {
@@ -163,6 +175,18 @@ for param in args[1:]:
             queryparms[path][attrib] = param
 session = client.Command()
 rcode = 0
+if options.restoredefault and options.restoredefault.lower() in (
+        'sys', 'system', 'uefi', 'bios'):
+    for fr in session.update(
+            '/noderange/{0}/configuration/system/clear'.format(noderange),
+            {'clear': True}):
+        rcode |= client.printerror(fr)
+    sys.exit(rcode)
+elif options.restoredefault:
+    sys.stderr.write(
+        'Unrecognized component to restore defaults: {0}\n'.format(
+            options.restoredefault))
+    sys.exit(1)
 if setmode:
     if options.exclude:
         sys.stderr.write('Cannot use exclude and assign at the same time\n')
@@ -185,12 +209,10 @@ if setmode:
     for path in updatebypath:
         for fr in session.update('/noderange/{0}/{1}'.format(noderange, path),
                                 updatebypath[path]):
-            for node in fr['databynode']:
+            rcode |= client.printerror(fr)
+            for node in fr.get('databynode', []):
                 r = fr['databynode'][node]
-                if 'error' in r:
-                    sys.stderr.write(node + ': ' + r['error'] + '\n')
-                    if 'errorcode' in r:
-                        rcode |= r['errorcode']
+                rcode |= client.printerror(r, node)
                 if 'value' not in r:
                     continue
                 keyval = r['value']
@@ -202,12 +224,18 @@ else:
     for path in queryparms:
         if options.comparedefault:
             continue
-        client.print_attrib_path(path, session, list(queryparms[path]),
-                                 NullOpt(), queryparms[path])
+        rc = client.print_attrib_path(path, session, list(queryparms[path]),
+                                      NullOpt(), queryparms[path])
+        if rc:
+            sys.exit(rc)
     if printsys or options.exclude:
         if printsys == 'all':
             printsys = []
-        path = '/noderange/{0}/configuration/system/all'.format(noderange)
-        client.print_attrib_path(path, session, printsys,
-                                 options)
-sys.exit(rcode)
+        if (options.comparedefault or printsys == []) and not options.advanced:
+            path = '/noderange/{0}/configuration/system/all'.format(noderange)
+        else:
+            path = '/noderange/{0}/configuration/system/advanced'.format(
+                noderange)
+        rcode = client.print_attrib_path(path, session, printsys,
+                                         options)
+sys.exit(rcode)

confluent_client/bin/nodedefine

@@ -47,7 +47,7 @@ session = client.Command()
 exitcode = 0
 attribs = {'name': noderange}
 for arg in args[1:]:
-    key, val = arg.split('=')
+    key, val = arg.split('=', 1)
     attribs[key] = val
 for r in session.create('/noderange/', attribs):
     if 'error' in r:

confluent_client/bin/nodefirmware

@@ -35,18 +35,6 @@ import confluent.screensqueeze as sq
 
 exitcode = 0
 
-def printerror(res, node=None):
-    global exitcode
-    if 'errorcode' in res:
-        exitcode = res['errorcode']
-    if 'error' in res:
-        if node:
-            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
-        else:
-            sys.stderr.write('{0}\n'.format(res['error']))
-        if 'errorcode' not in res:
-            exitcode = 1
-
 
 def printfirm(node, prefix, data):
     if 'model' in data:
@@ -67,7 +55,8 @@ def printfirm(node, prefix, data):
 components = ['all']
 
 argparser = optparse.OptionParser(
-    usage="Usage: %prog <noderange> [update [--backup <file>]]|[<components>]")
+    usage="Usage: "
+          "%prog <noderange> [list][update [--backup <file>]]|[<components>]")
 argparser.add_option('-b', '--backup', action='store_true',
                      help='Target a backup bank rather than primary')
 (options, args) = argparser.parse_args()
@@ -78,9 +67,15 @@ try:
         if args[1] == 'update':
             upfile = args[2]
         else:
+            if args[1] == 'list':
+                comps = args[2:]
+            else:
+                comps = args[1:]
             components = []
-            for arg in args[1:]:
+            for arg in comps:
                 components += arg.split(',')
+            if not components:
+                components = ['all']
 
 except IndexError:
     argparser.print_help()
@@ -139,16 +134,17 @@ def update_firmware(session, filename):
         sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
 
 def show_firmware(session):
+    global exitcode
     firmware_shown = False
     for component in components:
         for res in session.read(
                 '/noderange/{0}/inventory/firmware/all/{1}'.format(
                     noderange, component)):
-            printerror(res)
+            exitcode |= client.printerror(res)
             if 'databynode' not in res:
                 continue
             for node in res['databynode']:
-                printerror(res['databynode'][node], node)
+                exitcode |= client.printerror(res['databynode'][node], node)
                 if 'firmware' not in res['databynode'][node]:
                     continue
                 for inv in res['databynode'][node]['firmware']:

confluent_client/bin/nodegroupattrib

@@ -17,6 +17,7 @@
 
 __author__ = 'alin37'
 
+from getpass import getpass
 import optparse
 import os
 import signal
@@ -47,6 +48,8 @@ argparser.add_option('-e', '--environment', action='store_true',
                           'same name')
 argparser.add_option('-c', '--clear', action='store_true',
                      help='Clear variables')
+argparser.add_option('-p', '--prompt', action='store_true',
+                     help='Prompt for attribute values interactively')
 (options, args) = argparser.parse_args()
 
 
@@ -72,7 +75,19 @@ if len(args) > 1:
         print("Can not clear and set at the same time!")
         argparser.print_help()
         sys.exit(1)
-    exitcode=client.updateattrib(session,args,nodetype, nodegroups, options)
+    argassign = None
+    if options.prompt:
+        argassign = {}
+        for arg in args[1:]:
+            oneval = 1
+            twoval = 2
+            while oneval != twoval:
+                oneval = getpass('Enter value for {0}: '.format(arg))
+                twoval = getpass('Confirm value for {0}: '.format(arg))
+                if oneval != twoval:
+                    print('Values did not match.')
+            argassign[arg] = twoval
+    exitcode=client.updateattrib(session,args,nodetype, nodegroups, options, argassign)
     try:
         # setting user output to what the user inputs
         if args[1] == 'all':

confluent_client/bin/nodegroupdefine

@@ -47,7 +47,7 @@ session = client.Command()
 exitcode = 0
 attribs = {'name': noderange}
 for arg in args[1:]:
-    key, val = arg.split('=')
+    key, val = arg.split('=', 1)
     attribs[key] = val
 for r in session.create('/nodegroups/', attribs):
     if 'error' in r:

confluent_client/bin/nodeinventory

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 import codecs
+import json
 import optparse
 import os
 import re
@@ -86,12 +87,14 @@ def printerror(res, node=None):
 
 
 url = '/noderange/{0}/inventory/hardware/all/all'
+usedprefixes = set([])
 
 argparser = optparse.OptionParser(
     usage="Usage: %prog <noderange> [serial|model|uuid|mac]")
+argparser.add_option('-j', '--json', action='store_true', help='Output JSON')
 (options, args) = argparser.parse_args()
 try:
-    noderange = sys.argv[1]
+    noderange = args[0]
 except IndexError:
     argparser.print_help()
     sys.exit(1)
@@ -114,6 +117,8 @@ if len(args) > 1:
                     filters.append(re.compile('mac address'))
                     url = '/noderange/{0}/inventory/hardware/all/all'
 try:
+    if options.json:
+        databynode = {}
     session = client.Command()
     for res in session.read(url.format(noderange)):
         printerror(res)
@@ -125,9 +130,19 @@ try:
                 continue
             for inv in res['databynode'][node]['inventory']:
                 prefix = inv['name']
+                idx = 2
+                while (node, prefix) in usedprefixes:
+                    prefix = '{0} {1}'.format(inv['name'], idx)
+                    idx += 1
+                usedprefixes.add((node, prefix))
                 if not inv['present']:
                     if not filters:
-                        print '{0}: {1}: Not Present'.format(node, prefix)
+                        if options.json:
+                            if node not in databynode:
+                                databynode[node] = {}
+                            databynode[node][prefix] = inv
+                        else:
+                            print '{0}: {1}: Not Present'.format(node, prefix)
                     continue
                 info = inv['information']
                 info.pop('board_extra', None)
@@ -136,6 +151,11 @@ try:
                 info.pop('product_extra', None)
                 if 'memory_type' in info:
                     if not filters:
+                        if options.json:
+                            if node not in databynode:
+                                databynode[node] = {}
+                            databynode[node][prefix] = inv
+                            continue
                         print_mem_info(node, prefix, info)
                     continue
                 for datum in info:
@@ -147,9 +167,17 @@ try:
                             continue
                     if info[datum] is None:
                         continue
+                    if options.json:
+                        if node not in databynode:
+                            databynode[node] = {}
+                        databynode[node][prefix] = inv
+                        break
                     print(u'{0}: {1} {2}: {3}'.format(node, prefix,
                                                      pretty(datum),
                                                      info[datum]))
+    if options.json:
+        print(json.dumps(databynode, sort_keys=True, indent=4,
+                         separators=(',', ': ')))
 except KeyboardInterrupt:
     print('')
-sys.exit(exitcode)
+sys.exit(exitcode)

confluent_client/bin/nodepower

@@ -45,11 +45,11 @@ except IndexError:
     sys.exit(1)
 client.check_globbing(noderange)
 setstate = None
-if len(sys.argv) > 2:
+if len(args) > 1:
     if setstate == 'softoff':
         setstate = 'shutdown'
-    elif not sys.argv[2] in ('stat', 'state', 'status'):
-        setstate = sys.argv[2]
+    elif not args[1] in ('stat', 'state', 'status'):
+        setstate = args[1]
 
 if setstate not in (None, 'on', 'off', 'shutdown', 'boot', 'reset'):
     argparser.print_help()

confluent_client/bin/noderun

@@ -85,7 +85,7 @@ def run():
             desc = pipedesc[r]
             node = desc['node']
             data = True
-            while data and select.select([r], [], [], 0):
+            while data and select.select([r], [], [], 0)[0]:
                 data = r.readline()
                 if data:
                     if desc['type'] == 'stdout':

confluent_client/bin/nodeshell

@@ -86,7 +86,7 @@ def run():
             desc = pipedesc[r]
             node = desc['node']
             data = True
-            while data and select.select([r], [], [], 0):
+            while data and select.select([r], [], [], 0)[0]:
                 data = r.readline()
                 if data:
                     if desc['type'] == 'stdout':

confluent_client/bin/nodesupport

@@ -0,0 +1,145 @@
+#!/usr/bin/python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import optparse
+import os
+import signal
+import sys
+import time
+
+try:
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+except AttributeError:
+    pass
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.screensqueeze as sq
+
+exitcode = 0
+
+
+def get_update_progress(session, url):
+    for res in session.read(url):
+        status = res['phase']
+        percent = res['progress']
+        detail = res['detail']
+        if status == 'error':
+            text = 'error!'
+        else:
+            text = '{0}: {1:3.0f}%'.format(status, percent)
+    return text, status, detail
+
+
+def printerror(res, node=None):
+    global exitcode
+    if 'errorcode' in res:
+        exitcode = res['errorcode']
+    if 'error' in res:
+        if node:
+            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
+        else:
+            sys.stderr.write('{0}\n'.format(res['error']))
+        if 'errorcode' not in res:
+            exitcode = 1
+    for node in res.get('databynode', ()):
+        printerror(res['databynode'][node], node)
+
+
+
+def download_servicedata(noderange, media):
+    global exitcode
+    session = client.Command()
+    output = sq.ScreenPrinter(noderange, session)
+    filename = os.path.abspath(media)
+    resource = '/noderange/{0}/support/servicedata/'.format(noderange)
+    upargs = {'filename': filename}
+    noderrs = {}
+    nodeurls = {}
+    for res in session.create(resource, upargs):
+        if 'created' not in res:
+            for nodename in res.get('databynode', ()):
+                output.set_output(nodename, 'error!')
+                noderrs[nodename] = res['databynode'][nodename].get(
+                    'error', 'Unknown Error')
+            continue
+        watchurl = res['created']
+        currnode = watchurl.split('/')[1]
+        nodeurls[currnode] = '/' + watchurl
+    while nodeurls:
+        for node in list(nodeurls):
+            progress, status, err = get_update_progress(
+                session, nodeurls[node])
+            if status == 'error':
+                exitcode = 1
+                noderrs[node] = err
+            if status in ('error', 'complete', 'pending'):
+                list(session.delete(nodeurls[node]))
+                del nodeurls[node]
+            output.set_output(node, progress)
+        time.sleep(2)
+    allerrnodes = ','.join(noderrs)
+    if noderrs:
+        sys.stderr.write(
+            'Nodes had errors retrieving service data ({0})!\n'.format(allerrnodes))
+    for node in noderrs:
+        sys.stderr.write('{0}: {1}\n'.format(node, noderrs[node]))
+
+funmap = {
+    'servicedata': download_servicedata,
+}
+
+
+class OptParser(optparse.OptionParser):
+
+    def format_epilog(self, formatter):
+        return self.expand_prog_name(self.epilog)
+
+def main():
+    argparser = OptParser(
+        usage="Usage: %prog <noderange> [servicedata] "
+              "<filename>",
+        epilog='\nservicedata will save service data to the given '
+               'directory\n'
+               '\n\nSee `man %prog` for more info.\n')
+    (options, args) = argparser.parse_args()
+    media = None
+    try:
+        noderange = args[0]
+        operation = args[1]
+        arglength = 2
+        if operation == 'servicedata':
+            media = args[2]
+            arglength = 3
+        if len(args) > arglength:
+            argparser.print_help()
+            sys.exit(1)
+    except IndexError:
+        argparser.print_help()
+        sys.exit(1)
+    client.check_globbing(noderange)
+    try:
+        handler = funmap[operation]
+    except KeyError:
+        argparser.print_help()
+        sys.exit(1)
+    handler(noderange, media)
+if __name__ == '__main__':
+    main()

confluent_client/confluent/client.py

@@ -17,6 +17,7 @@
 
 import anydbm as dbm
 import errno
+import fnmatch
 import hashlib
 import os
 import shlex
@@ -33,6 +34,21 @@ _attraliases = {
     'bmcpass': 'secret.hardwaremanagementpassword',
 }
 
+
+def printerror(res, node=None):
+    exitcode = 0
+    if 'errorcode' in res:
+        exitcode = res['errorcode']
+    if 'error' in res:
+        if node:
+            sys.stderr.write('{0}: {1}\n'.format(node, res['error']))
+        else:
+            sys.stderr.write('{0}\n'.format(res['error']))
+        if 'errorcode' not in res:
+            exitcode = 1
+    return exitcode
+
+
 def cprint(txt):
     print(txt)
     sys.stdout.flush()
@@ -246,8 +262,7 @@ class Command(object):
             certreqs = ssl.CERT_NONE
             knownhosts = True
         self.connection = ssl.wrap_socket(self.connection, ca_certs=cacert,
-                                          cert_reqs=certreqs,
-                                          ssl_version=ssl.PROTOCOL_TLSv1)
+                                          cert_reqs=certreqs)
         if knownhosts:
             certdata = self.connection.getpeercert(binary_form=True)
             fingerprint = 'sha512$' + hashlib.sha512(certdata).hexdigest()
@@ -297,7 +312,7 @@ def attrrequested(attr, attrlist, seenattributes):
             candidate = candidate.replace('hm', 'hardwaremanagement', 1)
         if candidate in _attraliases:
             candidate = _attraliases[candidate]
-        if candidate.lower() == attr.lower():
+        if fnmatch.fnmatch(attr.lower(), candidate.lower()):
             seenattributes.add(truename)
             return True
         elif attr.lower().startswith(candidate.lower() + '.'):
@@ -323,6 +338,12 @@ def print_attrib_path(path, session, requestargs, options, rename=None):
             for attr, val in sorted(
                     res['databynode'][node].items(),
                     key=lambda (k, v): v.get('sortid', k) if isinstance(v, dict) else k):
+                if attr == 'error':
+                    sys.stderr.write('{0}: Error: {1}\n'.format(node, val))
+                    continue
+                if attr == 'errorcode':
+                    exitcode |= val
+                    continue
                 seenattributes.add(attr)
                 if rename:
                     printattr = rename.get(attr, attr)
@@ -473,7 +494,7 @@ def printgroupattributes(session, requestargs, showtype, nodetype, noderange, op
                     exitcode = 1
     return exitcode
 
-def updateattrib(session, updateargs, nodetype, noderange, options):
+def updateattrib(session, updateargs, nodetype, noderange, options, dictassign=None):
     # update attribute
     exitcode = 0
     if options.clear:
@@ -506,11 +527,19 @@ def updateattrib(session, updateargs, nodetype, noderange, options):
                                                             'attributes/all',
                                                             value, key)
         sys.exit(exitcode)
+    elif dictassign:
+        for key in dictassign:
+            if nodetype == 'nodegroups':
+                exitcode = session.simple_nodegroups_command(
+                    noderange, 'attributes/all', dictassign[key], key)
+            else:
+                exitcode = session.simple_noderange_command(
+                    noderange, 'attributes/all', dictassign[key], key)
     else:
         if "=" in updateargs[1]:
             try:
                 for val in updateargs[1:]:
-                    val = val.split('=')
+                    val = val.split('=', 1)
                     if val[0][-1] in (',', '-', '^'):
                         key = val[0][:-1]
                         if val[0][-1] == ',':

confluent_client/confluent/tlvdata.py

@@ -20,6 +20,11 @@ from datetime import datetime
 import json
 import struct
 
+try:
+    unicode
+except NameError:
+    unicode = str
+
 def decodestr(value):
     ret = None
     try:
@@ -38,17 +43,28 @@ def unicode_dictvalues(dictdata):
         elif isinstance(dictdata[key], datetime):
             dictdata[key] = dictdata[key].strftime('%Y-%m-%dT%H:%M:%S')
         elif isinstance(dictdata[key], list):
-            for i in xrange(len(dictdata[key])):
-                if isinstance(dictdata[key][i], str):
-                    dictdata[key][i] = decodestr(dictdata[key][i])
-                elif isinstance(dictdata[key][i], dict):
-                    unicode_dictvalues(dictdata[key][i])
+            _unicode_list(dictdata[key])
         elif isinstance(dictdata[key], dict):
             unicode_dictvalues(dictdata[key])
 
 
+def _unicode_list(currlist):
+    for i in xrange(len(currlist)):
+        if isinstance(currlist[i], str):
+            currlist[i] = decodestr(currlist[i])
+        elif isinstance(currlist[i], dict):
+            unicode_dictvalues(currlist[i])
+        elif isinstance(currlist[i], list):
+            _unicode_list(currlist[i])
+
+
 def send(handle, data):
-    if isinstance(data, str):
+    if isinstance(data, unicode):
+        try:
+            data = data.encode('utf-8')
+        except AttributeError:
+            pass
+    if isinstance(data, str) or isinstance(data, unicode):
         # plain text, e.g. console data
         tl = len(data)
         if tl == 0:
@@ -74,6 +90,14 @@ def send(handle, data):
         handle.sendall(struct.pack("!I", tl))
         handle.sendall(sdata)
 
+def recvall(handle, size):
+    rd = handle.recv(size)
+    while len(rd) < size:
+        nd = handle.recv(size - len(rd))
+        if not nd:
+            raise Exception("Error reading data")
+        rd += nd
+    return rd
 
 def recv(handle):
     tl = handle.recv(4)

confluent_client/confluent_env.sh

@@ -37,3 +37,219 @@ alias noderun='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURR
 alias nodesensors='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodesensors'
 alias nodesetboot='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodesetboot'
 alias nodeshell='CURRENT_CMDLINE=$(HISTTIMEFORMAT= builtin history 1); export CURRENT_CMDLINE; nodeshell'
+
+
+_confluent_get_args()
+{
+    CMPARGS=($COMP_LINE)
+    NUMARGS=${#CMPARGS[@]}
+    if [ "${COMP_WORDS[-1]}" == '' ]; then
+        NUMARGS=$((NUMARGS+1))
+        CMPARGS+=("")
+    fi
+    GENNED=""
+    for CAND in ${COMP_CANDIDATES[@]}; do
+        candarray=(${CAND//,/ })
+        matched=0
+        for c in "${candarray[@]}"; do
+            for arg in "${CMPARGS[@]}"; do
+                if [ "$arg" = "$c" ]; then
+                    matched=1
+                    break
+                fi
+            done
+        done
+        if [ 0 = $matched ]; then
+            for c in "${candarray[@]}"; do
+                GENNED+=" $c"
+            done
+        fi
+    done
+}
+
+function _confluent_generic_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS -ge 3 ] && [ ! -z "$GENNED" ]; then
+        COMPREPLY=($(compgen -W "$GENNED" -- ${COMP_WORDS[-1]}))
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+_confluent_nodeidentify_completion()
+{
+    COMP_CANDIDATES=("on,off -h")
+    _confluent_generic_completion
+}
+
+
+_confluent_nodesetboot_completion()
+{
+    COMP_CANDIDATES=("default,cd,network,setup,hd -h -b -p")
+    _confluent_generic_completion
+}
+
+_confluent_nodepower_completion()
+{
+   COMP_CANDIDATES=("boot,off,on,status -h -p")
+   _confluent_generic_completion
+}
+
+_confluent_nodemedia_completion()
+{
+    COMP_CANDIDATES=("list,upload,attach,detachall -h")
+    _confluent_get_args
+    if [ $NUMARGS -gt 3 ] && [ ${CMPARGS[-2]} == 'upload' ]; then
+        compopt -o default
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -ge 3 ] && [ ! -z "$GENNED" ]; then
+        COMPREPLY=($(compgen -W "$GENNED" -- ${COMP_WORDS[-1]}))
+        return;
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+
+_confluent_nodefirmware_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS == 3 ]; then
+        COMPREPLY=($(compgen -W "list update" -- ${COMP_WORDS[-1]}))
+        return;
+    fi
+    if [ $NUMARGS -gt 3 ] && [ ${CMPARGS[2]} == 'update' ]; then
+        compopt -o default
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+
+_confluent_nodeshell_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS == 3 ]; then
+        COMPREPLY=($(compgen -c -- ${COMP_WORDS[-1]}))
+        return
+    fi
+    if [ $NUMARGS -gt 3 ]; then
+        compopt -o default
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+        _confluent_nr_completion
+        return;
+    fi
+}
+
+_confluent_nodesupport_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS == 3 ]; then
+        COMPREPLY=($(compgen -W "servicedata" -- ${COMP_WORDS[-1]}))
+        return;
+    fi
+    if [ $NUMARGS == 4 ] && [ ${CMPARGS[2]} == 'servicedata' ]; then
+        compopt -o  dirnames
+        COMPREPLY=()
+        return
+    fi
+    if [ $NUMARGS -lt 3 ]; then
+         _confluent_nr_completion
+         return
+    fi
+}
+
+_confluent_nn_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS -gt 2 ]; then
+        return;
+    fi
+    INPUT=${COMP_WORDS[-1]}
+    INPUT=${INPUT##*,-}
+    INPUT=${INPUT##*,}
+    INPUT=${INPUT##*@}
+    PREFIX=""
+    if [ "$INPUT" != "${COMP_WORDS[-1]}" ]; then
+        PREFIX=${COMP_WORDS[-1]}
+        PREFIX=$(echo $PREFIX | sed -e 's/,[^,@-]*$/,/' -e 's/,-[^,@]*$/,-/' -e 's/@[^,@]*/@/')
+    fi
+
+    COMPREPLY=($(compgen -W "$(nodelist | sed -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+}
+_confluent_nr_completion()
+{
+    CMPARGS=($COMP_LINE)
+    NUMARGS=${#CMPARGS[@]}
+    if [ "${COMP_WORDS[-1]}" == '' ]; then
+        NUMARGS=$((NUMARGS+1))
+    fi
+    _confluent_get_args
+    if [ $NUMARGS -gt 2 ]; then
+        return;
+    fi
+    INPUT=${COMP_WORDS[-1]}
+    INPUT=${INPUT##*,-}
+    INPUT=${INPUT##*,}
+    INPUT=${INPUT##*@}
+    PREFIX=""
+    if [ "$INPUT" != "${COMP_WORDS[-1]}" ]; then
+        PREFIX=${COMP_WORDS[-1]}
+        PREFIX=$(echo $PREFIX | sed -e 's/,[^,@-]*$/,/' -e 's/,-[^,@]*$/,-/' -e 's/@[^,@]*/@/')
+    fi
+
+    #COMPREPLY=($(compgen -W "$(confetty show /nodegroups|sed -e 's/\///' -e s/^/$PREFIX/;nodelist | sed -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+    COMPREPLY=($(compgen -W "$(confetty show /nodegroups|sed -e 's/\///' -e s/^/$PREFIX/;nodelist | sed -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+}
+_confluent_ng_completion()
+{
+    _confluent_get_args
+    if [ $NUMARGS -gt 2 ]; then
+        return;
+    fi
+    INPUT=${COMP_WORDS[-1]}
+    INPUT=${INPUT##*,-}
+    INPUT=${INPUT##*,}
+    INPUT=${INPUT##*@}
+    PREFIX=""
+    if [ "$INPUT" != "${COMP_WORDS[-1]}" ]; then
+        PREFIX=${COMP_WORDS[-1]}
+        PREFIX=$(echo $PREFIX | sed -e 's/,[^,@-]*$/,/' -e 's/,-[^,@]*$/,-/' -e 's/@[^,@]*/@/')
+    fi
+
+    COMPREPLY=($(compgen -W "$(confetty show /nodegroups|sed -e 's/\///' -e s/^/$PREFIX/)" -- "${COMP_WORDS[-1]}"))
+}
+complete -F _confluent_nr_completion nodeattrib
+complete -F _confluent_nr_completion nodebmcreset
+complete -F _confluent_nodesetboot_completion nodeboot
+complete -F _confluent_nr_completion nodeconfig
+complete -F _confluent_nn_completion nodeconsole
+complete -F _confluent_nr_completion nodeeventlog
+complete -F _confluent_nodefirmware_completion nodefirmware
+complete -F _confluent_ng_completion nodegroupattrib
+complete -F _confluent_ng_completion nodegroupremove
+complete -F _confluent_nr_completion nodehealth
+complete -F _confluent_nodeidentify_completion nodeidentify
+complete -F _confluent_nr_completion nodeinventory
+complete -F _confluent_nr_completion nodelist
+complete -F _confluent_nodemedia_completion nodemedia
+complete -F _confluent_nodepower_completion nodepower
+complete -F _confluent_nr_completion noderemove
+complete -F _confluent_nr_completion nodereseat
+complete -F _confluent_nodeshell_completion noderun
+complete -F _confluent_nr_completion nodesensors
+complete -F _confluent_nodesetboot_completion nodesetboot
+complete -F _confluent_nodeshell_completion nodeshell
+complete -F _confluent_nodesupport_completion nodesupport
+

confluent_client/doc/man/collate.ronn

@@ -3,7 +3,7 @@ collate(1) -- Organize text input by node
 
 ## SYNOPSIS
 
-`<other command> | collate [-a] [-d] [-w] [-s] [-c] [-r]`
+`<other command> | collate [-a] [-d] [-w] [-s] [-c] [-r] [-l lognametemplate]`
 
 ## DESCRIPTION
 
@@ -26,6 +26,10 @@ node and group names sorted alphanumerically.
    Express all but the most common result group in terms of diff from
    the most common result group
 
+* `-l`, `--log`:
+   Save output per node to individual log files, replacing {node} in the name
+   with the nodename of each
+
 * `-w`, `--watch`:
    Update results dynamically as data becomes available, rather than
    waiting    for the command to fully complete.
@@ -85,4 +89,4 @@ node and group names sorted alphanumerically.
   `  Processors.ExecuteDisableBit=Enable`  
 
    
-   
+   

confluent_client/doc/man/nodeattrib.ronn

@@ -3,10 +3,11 @@ nodeattrib(8) -- List or change confluent nodes attributes
 
 ## SYNOPSIS
 
-`nodeattrib [-b] <noderange> [<nodeattribute>...]`  
+`nodeattrib [-b] <noderange> [all|<nodeattribute>...]`
 `nodeattrib <noderange> [<nodeattribute1=value1> <nodeattribute2=value2> ...]`  
 `nodeattrib -c <noderange> <nodeattribute1> <nodeattribute2> ...`  
 `nodeattrib -e <noderange> <nodeattribute1> <nodeattribute2> ...`  
+`nodeattrib -p <noderange> <nodeattribute1> <nodeattribute2> ...`  
 
 ## DESCRIPTION
 
@@ -19,11 +20,15 @@ displayed.  If `-b` is specified, it will also display information on
 how inherited and expression based attributes are defined.  Attributes can be
 straightforward values, or an expression as documented in nodeattribexpressions(5).
 For a full list of attributes, run `nodeattrib <node> all` against a node.
-If `-c` is specified, this will set the nodeattribute to a null valid.
+If `-c` is specified, this will set the nodeattribute to a null value.
 This is different from setting the value to an empty string.
 
+If the word all is specified, then all available attributes are given.
+Omitting any attribute name or the word 'all' will display only attributes
+that are currently set.
+
 For the `groups` attribute, it is possible to add a group by doing
-`groups,=<newgroup>`` and to remove by doing `groups^=<oldgroup>`
+`groups,=<newgroup>` and to remove by doing `groups^=<oldgroup>`
 
 Note that `nodeattrib <group>` will likely not provide the expected behavior.
 See nodegroupattrib(8) command on how to manage attributes on a group level.
@@ -36,6 +41,8 @@ See nodegroupattrib(8) command on how to manage attributes on a group level.
   Clear specified nodeattributes
 * `-e`, `--environment`:
   Set specified attributes based on exported environment variable of matching name.  Environment variable names may be lower case or all upper case.  Replace . with _ as needed (e.g. info.note may be specified as either $info_note or $INFO_NOTE
+* `-p`, `--prompt`:
+  Request interactive prompting to provide values rather than the command line or environment variables.
 
 ## EXAMPLES
 * Listing matching nodes of a simple noderange:

confluent_client/doc/man/nodeboot.ronn

@@ -4,12 +4,44 @@ nodeboot(8) -- Reboot a confluent node to a specific device
 ## SYNOPSIS
 
 `nodeboot <noderange>`  
-`nodeboot <noderange>` [net|setup]  
+`nodeboot [options] <noderange>` [default|cd|network|setup|hd]  
 
 ## DESCRIPTION
 
 **nodeboot** reboots nodes in a noderange.  If an additional argument is given,
-it sets the node to specifically boot to that as the next boot.
+it sets the node to specifically boot to that as the next boot.  This 
+performs an immediate reboot without waiting for the OS.  To set the boot
+device without inducing a reboot, see the `nodesetboot` command.
+
+## OPTIONS
+
+* `-b`, `--bios`:
+  For a system that supports both BIOS and UEFI style boot, request BIOS style
+  boot if supported (some platforms will UEFI boot with this flag anyway).
+
+* `-u`, `--uefi`:
+  This flag does nothing, it is for command compatibility with xCAT's rsetboot
+
+* `-p`, `--persist`:
+  For a system that supports it, mark the boot override to persist rather than
+  be a one time change.  Many systems do not support this functionality.
+
+* `default`:
+  Request a normal default boot with no particular device override
+
+* `cd`:
+  Request boot from media.  Note that this can include physical CD,
+  remote media mounted as CD/DVD, and detachable hard disks drives such as usb
+  key devices.
+  
+* `network`:
+  Request boot to network
+  
+* `setup`:
+  Request to enter the firmware configuration menu (e.g. F1 setup) on next boot.
+
+* `hd`:
+  Boot straight to hard disk drive
 
 ## EXAMPLES
 * Booting n3 and n4 to the default boot behavior:

confluent_client/doc/man/nodeconfig.ronn

@@ -30,6 +30,11 @@ given as a node expression, as documented in the man page for nodeattribexpressi
   Provide detailed data as available.  This can include help text and valid
   values for a setting.
 
+* `-r`, `--restoredefault`:
+  Request that the specified component of the targeted nodes will have its
+  configuration reset to default.  Currently the only component implemented
+  is uefi.
+
 
 ## EXAMPLES
 * Showing the current IP configuration of noderange BMC/IMM/XCC:

confluent_client/doc/man/nodedefine.ronn

@@ -1,4 +1,5 @@
 nodedefine(8) -- Define new confluent nodes
+===================================================================
 
 ## SYNOPSIS
 

confluent_client/doc/man/nodefirmware.ronn

@@ -4,7 +4,7 @@ nodefirmware(8) -- Report firmware information on confluent nodes
 ## SYNOPSIS
 
 `nodefirmware <noderange>`  
-`nodefirmware <noderange> <components>|core`  
+`nodefirmware <noderange> list|<components>|core`  
 `nodefirmware <noderange> update [--backup] <filename>`  
 
 ## DESCRIPTION

confluent_client/doc/man/nodegroupattrib.ronn

@@ -7,6 +7,7 @@ nodegroupattrib(8) -- List or change confluent nodegroup attributes
 `nodegroupattrib <group> [<nodeattribute>...]`  
 `nodegroupattrib <group> [<nodeattribute1=value1> <nodeattribute2=value2> ...]`  
 `nodegroupattrib <group> [-c] [<nodeattribute1> <nodeattribute2=value2> ...]`  
+`nodeattrib -p <noderange> <nodeattribute1> <nodeattribute2> ...`  
 
 ## DESCRIPTION
 

confluent_client/doc/man/nodegroupdefine.ronn

@@ -1,4 +1,5 @@
 nodegroupdefine(8) -- Define new confluent node group
+===================================================================
 
 ## SYNOPSIS
 
@@ -6,7 +7,7 @@ nodegroupdefine(8) -- Define new confluent node group
 
 ## DESCRIPTION
 
-`nodegroupdefine` allows the definition of a new node for the confluent management
+`nodegroupdefine` allows the definition of a new nodegroup for the confluent management
 service.  It may only define a single group name at a time.
 It has the same syntax as `nodegroupattrib(8)`, and the commands differ in
 that `nodegroupattrib(8)` will error if a node group does not exist.

confluent_client/doc/man/nodemedia.ronn

@@ -15,7 +15,8 @@ are mounted in an insecure fashion.  http is insecure, and https is also
 insecure when no meaningful certificate validation is performed.  Currently
 there is no action that can change this, and this is purely informational.  A
 future version of software may provide a means to increase security of attached
-remote media.
+remote media.  If no media is mounted, this will provide no output, error
+conditions will result in output to standard error.
 
 `detachall` removes all the currently provided media to the host.  This unlinks
 remote media from urls and deletes uploaded media from the BMC.

confluent_client/doc/man/nodepower.ronn

@@ -4,7 +4,7 @@ nodepower(8) -- Check or change power state of confluent nodes
 ## SYNOPSIS
 
 `nodepower <noderange>`  
-`nodepower <noderange> [on|off|boot|shutdown|reset|status]`
+`nodepower <noderange> [-p] [on|off|boot|shutdown|reset|status]`
 
 ## DESCRIPTION
 
@@ -26,6 +26,11 @@ respond.
 off will not react to this request.
 * `status`:  Behave identically to having no argument passed at all.
 
+## OPTIONS
+
+* `-p`, '--showprevious':
+   Show previous power state for all directives that may change power state.
+
 ## EXAMPLES
 * Get power state of nodes n1 through n4:
   `# nodepower n1-n4`  

confluent_client/doc/man/noderun.ronn

@@ -48,6 +48,10 @@ themselves, see nodeshell(8).
   `n4:  01 10 00`  
   `n2:  01 10 00`  
 
+
+* If wanting to use literal {} in the command, they must be escaped by doubling:
+  `# noderun n1-n4 "echo {node} | awk '{{print $1}}'"`
+
 ## SEE ALSO
 
 nodeshell(8)

confluent_client/doc/man/nodesetboot.ronn

@@ -30,7 +30,10 @@ control.
 * `-p`, `--persist`:
   For a system that supports it, mark the boot override to persist rather than
   be a one time change.  Many systems do not support this functionality.
-  
+
+* `-u`, `--uefi`:
+  This flag does nothing, it is for command compatibility with xCAT's rsetboot
+
 * `default`:
   Request a normal default boot with no particular device override
 

confluent_client/doc/man/nodeshell.ronn

@@ -27,7 +27,10 @@ as stderr, unlike psh which combines all stdout and stderr into stdout.
   `n4: hi`  
 
 * Setting a new static ip address temporarily on secondary interface of four nodes:
-  `# nodeshell n1-n4 ifconfig eth1 172.30.93.{n1}`  
+  `# nodeshell n1-n4 ifconfig eth1 172.30.93.{n1}`
+
+* If wanting to use literal {} in the command, they must be escaped by doubling:
+  `# nodeshell n1-n4 "ps | awk '{{print $1}}'"`
   
 ## SEE ALSO
 

confluent_client/doc/man/nodesupport.ronn

@@ -0,0 +1,25 @@
+nodesupport(8) -- Utilities for interacting with vendor support
+=================================================================
+
+## SYNOPSIS
+
+`nodesupport <noderange> servicedata <directory or filename>`  
+
+## DESCRIPTION
+
+`nodesupport` provides capabilities associated with interactiong with support.
+Currently it only has the `servicedata` subcommand.  `servicedata` takes
+an argument that is either a directory name (that can be used for a single node
+or multiple nodes) or a file name (only to be used with single node noderange)
+
+## EXAMPLES
+
+* Download support data from a single node to a specific filename  
+`# nodesupport d1 servicedata svcdata.out`  
+`d1:initializing:  15%`  
+
+* Download support data from multiple nodes to a directory  
+`# nodesupport d1-d4 servicedata service/`    
+`d1:initializing:   0% d2:initializing:   0% d3:initializing:   0% d4:initializing:   0%`  
+`# ls service/`  
+`d1.svcdata d2.svcdata  d3.svcdata  d4.svcdata`  

confluent_client/samples/nodeattrib_from_switch.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+# This is a sample python script for going through all observed mac addresses
+# and assuming they are BMC related and printing nodeattrib commands
+# for each node to access the bmc using the interface specified on the command
+# line
+
+# Not necessarily as useful if there may be mistakes in the
+# net.switch/net.switchport attributes, but a handy utility in a pinch when
+# you really know
+
+
+import confluent.client as cl
+import socket
+import struct
+c = cl.Command()
+macs = []
+interface = sys.argv[1]
+for mac in c.read('/networking/macs/by-mac/'):
+    macs.append(mac['item']['href'])
+for mac in macs:
+    macinfo = list(c.read('/networking/macs/by-mac/{0}'.format(mac)))[0]
+    if 'possiblenode' in macinfo and macinfo['possiblenode']:
+        if macinfo['macsonport'] > 1:
+            print('#Ambiguous set of macs on port for ' + macinfo[
+                'possiblenode'])
+        prefix = int(mac.replace('-', '')[:6], 16) ^ 0b100000000000000000
+        prefix = prefix << 8
+        prefix |= 0xff
+        suffix = int(mac.replace('-', '')[6:], 16)
+        suffix |= 0xfe000000
+        rawn = struct.pack('!QLL', 0xfe80000000000000, prefix, suffix)
+        bmc = socket.inet_ntop(socket.AF_INET6, rawn)
+        print('nodeattrib {0} bmc={1}%{2}'.format(macinfo['possiblenode'],
+                                                  bmc, interface))

confluent_common/setup.cfg

@@ -1,17 +0,0 @@
-[metadata]
-name = confluent_common
-summary = Confluent Common Libraries
-description-file =
-    README.txt
-author = Jarrod Johnson
-author-email = jjohnson2@lenovo.com
-home-page = http://xcat.sf.net/
-classifier =
-    Intended Audience :: Information Technology
-    Intended Audience :: System Administrators
-    License :: OSI Approved :: Apache Software License
-    Operating System :: POSIX :: Linux
-    Programming Language :: Python :: 2.6
-    Programming Language :: Python :: 2.7
-
-[files]

confluent_server/bin/collective

@@ -0,0 +1,122 @@
+#!/usr/bin/env python
+
+import argparse
+import errno
+import os
+import socket
+import subprocess
+import sys
+
+path = os.path.dirname(os.path.realpath(__file__))
+path = os.path.realpath(os.path.join(path, '..', 'lib', 'python'))
+if path.startswith('/opt'):
+    # if installed into system path, do not muck with things
+    sys.path.append(path)
+
+import confluent.client as client
+import confluent.tlvdata as tlvdata
+
+try:
+    input = raw_input
+except NameError:
+    pass
+
+def make_certificate():
+    umask = os.umask(0077)
+    try:
+        os.makedirs('/etc/confluent/cfg')
+    except OSError as e:
+        if e.errno == errno.EEXIST and os.path.isdir('/etc/confluent/cfg'):
+            pass
+        else:
+            raise
+    if subprocess.check_call(
+            'openssl ecparam -name secp384r1 -genkey -out '
+            '/etc/confluent/privkey.pem'.split(' ')):
+        raise Exception('Error generating private key')
+
+    if subprocess.check_call('openssl req -new -x509 -key '
+                              '/etc/confluent/privkey.pem -days 7300 -out '
+                              '/etc/confluent/srvcert.pem -subj /CN='
+                              '{0}'.format(socket.gethostname()).split(' ')):
+        raise Exception('Error generating certificate')
+    print('Certificate generated successfully')
+    os.umask(umask)
+
+
+def show_invitation(name):
+    if not os.path.exists('/etc/confluent/srvcert.pem'):
+        make_certificate()
+    s = client.Command().connection
+    tlvdata.send(s, {'collective': {'operation': 'invite', 'name': name}})
+    invite = tlvdata.recv(s)['collective']
+    if 'error' in invite:
+        sys.stderr.write(invite['error'] + '\n')
+        return
+    print('{0}'.format(invite['invitation']))
+
+
+def join_collective(server, invitation):
+    if not os.path.exists('/etc/confluent/srvcert.pem'):
+        make_certificate()
+    s = client.Command().connection
+    while not invitation:
+        invitation = raw_input('Paste the invitation here: ')
+    tlvdata.send(s, {'collective': {'operation': 'join',
+                                    'invitation': invitation,
+                                    'server': server}})
+    res = tlvdata.recv(s)
+    res = res.get('collective',
+                  {'status': 'Unknown response: ' + repr(res)})
+    print(res.get('status', res.get('error', repr(res))))
+
+
+def show_collective():
+    s = client.Command().connection
+    tlvdata.send(s, {'collective': {'operation': 'show'}})
+    res = tlvdata.recv(s)
+    if 'error' in res['collective']:
+        print(res['collective']['error'])
+        return
+    if 'quorum' in res['collective']:
+        print('Quorum: {0}'.format(res['collective']['quorum']))
+    print('Leader: {0}'.format(res['collective']['leader']))
+    if 'active' in res['collective']:
+        if res['collective']['active']:
+            print('Active collective members:')
+            for member in res['collective']['active']:
+                print('    {0}'.format(member))
+        if res['collective']['offline']:
+            print('Offline collective members:')
+            for member in res['collective']['offline']:
+                print('    {0}'.format(member))
+    else:
+        print('Run collective show on leader for more data')
+
+def main():
+    a = argparse.ArgumentParser(description='Confluent server utility')
+    sp = a.add_subparsers(dest='command')
+    gc = sp.add_parser('gencert', help='Generate Confluent Certificates for '
+                                'collective mode and remote CLI access')
+    sl = sp.add_parser('show', help='Show information about the collective')
+    ic = sp.add_parser('invite', help='Generate a invitation to allow a new '
+                                    'confluent instance to join as a '
+                                    'collective member')
+    ic.add_argument('name', help='Name of server to invite to join the '
+                                 'collective')
+    jc = sp.add_parser('join', help='Join a collective')
+    jc.add_argument('server', help='A server currently in the collective')
+    jc.add_argument('-i', help='Invitation provided by runniing invite on an '
+                               'existing collective member')
+    cmdset = a.parse_args()
+    if cmdset.command == 'gencert':
+        make_certificate()
+    elif cmdset.command == 'invite':
+        show_invitation(cmdset.name)
+    elif cmdset.command == 'join':
+        join_collective(cmdset.server, cmdset.i)
+    elif cmdset.command == 'show':
+        show_collective()
+
+if __name__ == '__main__':
+    main()

confluent_server/bin/confluentdbutil

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 
+import getpass
 import optparse
 import sys
 import os
@@ -32,6 +33,8 @@ argparser = optparse.OptionParser(
     usage="Usage: %prog [options] [dump|restore] [path]")
 argparser.add_option('-p', '--password',
                      help='Password to use to protect/unlock a protected dump')
+argparser.add_option('-i', '--interactivepassword', help='Prompt for password',
+                     action='store_true')
 argparser.add_option('-r', '--redact', action='store_true',
                      help='Redact potentially sensitive data rather than store')
 argparser.add_option('-u', '--unprotected', action='store_true',
@@ -39,6 +42,14 @@ argparser.add_option('-u', '--unprotected', action='store_true',
                            ' the key information.  Fields will be encrypted, '
                            'but keys.json will contain unencrypted decryption'
                            ' keys that may be used to read the dump')
+argparser.add_option('-s', '--skipkeys', action='store_true',
+                      help='This specifies to dump the encrypted data without '
+                           'dumping the keys needed to decrypt it.  This is '
+                           'suitable for an automated incremental backup, '
+                           'where an earlier password protected dump has a '
+                           'protected keys.json file, and only the protected '
+                           'data is needed.  keys do not change and as such '
+                           'they do not require incremental backup')
 (options, args) = argparser.parse_args()
 if len(args) != 2 or args[0] not in ('dump', 'restore'):
     argparser.print_help()
@@ -51,17 +62,32 @@ if args[0] == 'restore':
     if pid is not None:
         print("Confluent is running, must shut down to restore db")
         sys.exit(1)
-    cfm.restore_db_from_directory(dumpdir, options.password)
+    try:
+        cfm.restore_db_from_directory(dumpdir, options.password)
+    except Exception as e:
+        print(str(e))
+        sys.exit(1)
 elif args[0] == 'dump':
-    if options.password is None and not (options.unprotected or options.redact):
+    password = options.password
+    if not password and options.interactivepassword:
+        passcfm = None
+        while passcfm is None or password != passcfm:
+            password = getpass.getpass(
+                'Enter password to protect the backup: ')
+            passcfm = getpass.getpass('Confirm password to protect the backup: ')
+    if password is None and not (options.unprotected or options.redact
+                                         or options.skipkeys):
         print("Must indicate a password to protect or -u to opt opt of "
-              "secure value protection or -r to skip all protected data")
+              "secure value protection or -r to redact sensitive information, "
+              "or -s to do encrypted backup that requires keys.json from "
+              "another backup to restore.")
         sys.exit(1)
     os.umask(077)
     main._initsecurity(conf.get_config())
     if not os.path.exists(dumpdir):
         os.makedirs(dumpdir)
-    cfm.dump_db_to_directory(dumpdir, options.password, options.redact)
+    cfm.dump_db_to_directory(dumpdir, options.password, options.redact,
+                             options.skipkeys)
 
 
 

confluent_server/bin/createcert.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+umask 0077
+openssl ecparam -name secp384r1 -genkey -out /etc/confluent/privkey.pem
+openssl req -new -x509 -key /etc/confluent/privkey.pem -days 760 -out /etc/confluent/srvcert.pem -subj /CN=$(hostname)

confluent_server/confluent/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.5.0.dev395.ggacb3a20"

confluent_server/confluent/auth.py

@@ -22,7 +22,7 @@
 import confluent.config.configmanager as configmanager
 import eventlet
 import eventlet.tpool
-import Crypto.Protocol.KDF as KDF
+import Cryptodome.Protocol.KDF as KDF
 import hashlib
 import hmac
 import multiprocessing

confluent_server/confluent/collective/invites.py

@@ -0,0 +1,60 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This handles the process of generating and tracking/validating invites
+
+import base64
+import hashlib
+import hmac
+import os
+pending_invites = {}
+
+def create_server_invitation(servername):
+    servername = servername.encode('utf-8')
+    randbytes = (3 - ((len(servername) + 2) % 3)) % 3 + 64
+    invitation = os.urandom(randbytes)
+    pending_invites[servername] = invitation
+    return base64.b64encode(servername + b'@' + invitation)
+
+def create_client_proof(invitation, mycert, peercert):
+    return hmac.new(invitation, peercert + mycert, hashlib.sha256).digest()
+
+def check_server_proof(invitation, mycert, peercert, proof):
+    validproof = hmac.new(invitation, mycert + peercert, hashlib.sha256
+                          ).digest()
+    return proof == validproof
+
+def check_client_proof(servername, mycert, peercert, proof):
+    servername = servername.encode('utf-8')
+    if servername not in pending_invites:
+        return False
+    invitation = pending_invites[servername]
+    validproof = hmac.new(invitation, mycert + peercert, hashlib.sha256
+                          ).digest()
+    if proof == validproof:
+        # We know that the client knew the secret, and that it measured our
+        # certificate, and thus calling code can bless the certificate, and
+        # we can forget the invitation
+        del pending_invites[servername]
+        # We now want to prove to the client that we also know the secret,
+        # and that we measured their certificate well
+        # Now to generate an answer...., reverse the cert order so our answer
+        # is different, but still proving things
+        return hmac.new(invitation, peercert + mycert, hashlib.sha256
+                          ).digest()
+    # The given proof did not verify the invitation
+    return False
+

confluent_server/confluent/collective/manager.py

@@ -0,0 +1,590 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2018 Lenovo
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import base64
+import confluent.collective.invites as invites
+import confluent.config.configmanager as cfm
+import confluent.exceptions as exc
+import confluent.log as log
+import confluent.tlvdata as tlvdata
+import confluent.util as util
+import eventlet
+import eventlet.green.socket as socket
+import eventlet.green.ssl as ssl
+import eventlet.green.threading as threading
+import greenlet
+import random
+try:
+    import OpenSSL.crypto as crypto
+except ImportError:
+    # while not always required, we use pyopenssl required for at least
+    # collective
+    crypto = None
+
+currentleader = None
+follower = None
+retrythread = None
+
+class ContextBool(object):
+    def __init__(self):
+        self.active = False
+        self.mylock = threading.RLock()
+
+    def __enter__(self):
+        self.active = True
+        self.mylock.__enter__()
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.active = False
+        self.mylock.__exit__(exc_type, exc_val, exc_tb)
+
+connecting = ContextBool()
+leader_init = ContextBool()
+
+def connect_to_leader(cert=None, name=None, leader=None):
+    global currentleader
+    global follower
+    if leader is None:
+        leader = currentleader
+    log.log({'info': 'Attempting connection to leader {0}'.format(leader),
+             'subsystem': 'collective'})
+    try:
+        remote = connect_to_collective(cert, leader)
+    except socket.error as e:
+        log.log({'error': 'Collective connection attempt to {0} failed: {1}'
+                          ''.format(leader, str(e)),
+                 'subsystem': 'collective'})
+        return False
+    with connecting:
+        with cfm._initlock:
+            tlvdata.recv(remote)  # the banner
+            tlvdata.recv(remote)  # authpassed... 0..
+            if name is None:
+                name = get_myname()
+            tlvdata.send(remote, {'collective': {'operation': 'connect',
+                                                 'name': name,
+                                                 'txcount': cfm._txcount}})
+            keydata = tlvdata.recv(remote)
+            if not keydata:
+                return False
+            if 'error' in keydata:
+                if 'backoff' in keydata:
+                    log.log({
+                        'info': 'Collective initialization in progress on '
+                                '{0}'.format(leader),
+                        'subsystem': 'collective'})
+                    return False
+                if 'leader' in keydata:
+                    log.log(
+                        {'info': 'Prospective leader {0} has redirected this '
+                                 'member to {1}'.format(leader, keydata['leader']),
+                         'subsystem': 'collective'})
+                    ldrc = cfm.get_collective_member_by_address(
+                        keydata['leader'])
+                    if ldrc and ldrc['name'] == name:
+                        raise Exception("Redirected to self")
+                    return connect_to_leader(name=name,
+                                             leader=keydata['leader'])
+                if 'txcount' in keydata:
+                    log.log({'info':
+                                 'Prospective leader {0} has inferior '
+                                 'transaction count, becoming leader'
+                                 ''.format(leader), 'subsystem': 'collective',
+                             'subsystem': 'collective'})
+                    return become_leader(remote)
+                return False
+                follower.kill()
+                cfm.stop_following()
+                follower = None
+            if follower:
+                follower.kill()
+                cfm.stop_following()
+                follower = None
+            log.log({'info': 'Following leader {0}'.format(leader),
+                     'subsystem': 'collective'})
+            colldata = tlvdata.recv(remote)
+            globaldata = tlvdata.recv(remote)
+            dbi = tlvdata.recv(remote)
+            dbsize = dbi['dbsize']
+            dbjson = ''
+            while (len(dbjson) < dbsize):
+                ndata = remote.recv(dbsize - len(dbjson))
+                if not ndata:
+                    try:
+                        remote.close()
+                    except Exception:
+                        pass
+                    raise Exception("Error doing initial DB transfer")
+                dbjson += ndata
+            cfm.clear_configuration()
+            try:
+                cfm._restore_keys(keydata, None, sync=False)
+                for c in colldata:
+                    cfm._true_add_collective_member(c, colldata[c]['address'],
+                                                    colldata[c]['fingerprint'],
+                                                    sync=False)
+                for globvar in globaldata:
+                    cfm.set_global(globvar, globaldata[globvar], False)
+                cfm._txcount = dbi.get('txcount', 0)
+                cfm.ConfigManager(tenant=None)._load_from_json(dbjson,
+                                                               sync=False)
+                cfm.commit_clear()
+            except Exception:
+                cfm.stop_following()
+                cfm.rollback_clear()
+                raise
+            currentleader = leader
+        #spawn this as a thread...
+        follower = eventlet.spawn(follow_leader, remote)
+    return True
+
+
+def follow_leader(remote):
+    global currentleader
+    cleanexit = False
+    try:
+        cfm.follow_channel(remote)
+    except greenlet.GreenletExit:
+        cleanexit = True
+    finally:
+        if cleanexit:
+            log.log({'info': 'Previous following cleanly closed',
+                     'subsystem': 'collective'})
+            return
+        log.log({'info': 'Current leader has disappeared, restarting '
+                         'collective membership', 'subsystem': 'collective'})
+        # The leader has folded, time to startup again...
+        cfm.stop_following()
+        currentleader = None
+        eventlet.spawn_n(start_collective)
+
+
+def connect_to_collective(cert, member):
+    remote = socket.create_connection((member, 13001))
+    # TLS cert validation is custom and will not pass normal CA vetting
+    # to override completely in the right place requires enormous effort, so just defer until after connect
+    remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE, keyfile='/etc/confluent/privkey.pem',
+                             certfile='/etc/confluent/srvcert.pem')
+    if cert:
+        fprint = cert
+    else:
+        collent = cfm.get_collective_member_by_address(member)
+        fprint = collent['fingerprint']
+    if not util.cert_matches(fprint, remote.getpeercert(binary_form=True)):
+        # probably Janeway up to something
+        raise Exception("Certificate mismatch in the collective")
+    return remote
+
+
+def get_myname():
+    try:
+        with open('/etc/confluent/cfg/myname', 'r') as f:
+            return f.read().strip()
+    except IOError:
+        myname = socket.gethostname()
+        with open('/etc/confluent/cfg/myname', 'w') as f:
+            f.write(myname)
+        return myname
+
+def handle_connection(connection, cert, request, local=False):
+    global currentleader
+    global retrythread
+    operation = request['operation']
+    if cert:
+        cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    else:
+        if not local:
+            return
+
+        if 'show' == operation:
+            if not list(cfm.list_collective()):
+                tlvdata.send(connection,
+                             {'collective': {'error': 'Collective mode not '
+                                                      'enabled on this '
+                                                      'system'}})
+                return
+            if follower:
+                linfo = cfm.get_collective_member_by_address(currentleader)
+                remote = socket.create_connection((currentleader, 13001))
+                remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                         keyfile='/etc/confluent/privkey.pem',
+                                         certfile='/etc/confluent/srvcert.pem')
+                cert = remote.getpeercert(binary_form=True)
+                if not (linfo and util.cert_matches(
+                        linfo['fingerprint'],
+                        cert)):
+                    remote.close()
+                    tlvdata.send(connection,
+                                 {'error': 'Invalid certificate, '
+                                           'redo invitation process'})
+                    connection.close()
+                    return
+                tlvdata.recv(remote)  # ignore banner
+                tlvdata.recv(remote)  # ignore authpassed: 0
+                tlvdata.send(remote,
+                             {'collective': {'operation': 'getinfo',
+                                             'name': get_myname()}})
+                collinfo = tlvdata.recv(remote)
+            else:
+                collinfo = {}
+                populate_collinfo(collinfo)
+            try:
+                cfm.check_quorum()
+                collinfo['quorum'] = True
+            except exc.DegradedCollective:
+                collinfo['quorum'] = False
+            tlvdata.send(connection, {'collective':  collinfo})
+            return
+        if 'invite' == operation:
+            try:
+                cfm.check_quorum()
+            except exc.DegradedCollective:
+                tlvdata.send(connection,
+                    {'collective':
+                         {'error': 'Collective does not have quorum'}})
+                return
+            #TODO(jjohnson2): Cannot do the invitation if not the head node, the certificate hand-carrying
+            #can't work in such a case.
+            name = request['name']
+            invitation = invites.create_server_invitation(name)
+            tlvdata.send(connection,
+                         {'collective': {'invitation': invitation}})
+            connection.close()
+        if 'join' == operation:
+            invitation = request['invitation']
+            try:
+                invitation = base64.b64decode(invitation)
+                name, invitation = invitation.split('@', 1)
+            except Exception:
+                tlvdata.send(
+                    connection,
+                    {'collective':
+                         {'status': 'Invalid token format'}})
+                connection.close()
+                return
+            host = request['server']
+            try:
+                remote = socket.create_connection((host, 13001))
+                # This isn't what it looks like.  We do CERT_NONE to disable
+                # openssl verification, but then use the invitation as a
+                # shared secret to validate the certs as part of the join
+                # operation
+                remote = ssl.wrap_socket(remote,  cert_reqs=ssl.CERT_NONE,
+                                         keyfile='/etc/confluent/privkey.pem',
+                                         certfile='/etc/confluent/srvcert.pem')
+            except Exception:
+                tlvdata.send(
+                    connection,
+                    {'collective':
+                         {'status': 'Failed to connect to {0}'.format(host)}})
+                connection.close()
+                return
+            mycert = util.get_certificate_from_file(
+                '/etc/confluent/srvcert.pem')
+            cert = remote.getpeercert(binary_form=True)
+            proof = base64.b64encode(invites.create_client_proof(
+                invitation, mycert, cert))
+            tlvdata.recv(remote)  # ignore banner
+            tlvdata.recv(remote)  # ignore authpassed: 0
+            tlvdata.send(remote, {'collective': {'operation': 'enroll',
+                                                 'name': name, 'hmac': proof}})
+            rsp = tlvdata.recv(remote)
+            if 'error' in rsp:
+                tlvdata.send(connection, {'collective':
+                                              {'status': rsp['error']}})
+                connection.close()
+                return
+            proof = rsp['collective']['approval']
+            proof = base64.b64decode(proof)
+            j = invites.check_server_proof(invitation, mycert, cert, proof)
+            if not j:
+                remote.close()
+                tlvdata.send(connection, {'collective':
+                                              {'status': 'Bad server token'}})
+                connection.close()
+                return
+            tlvdata.send(connection, {'collective': {'status': 'Success'}})
+            connection.close()
+            currentleader = rsp['collective']['leader']
+            f = open('/etc/confluent/cfg/myname', 'w')
+            f.write(name)
+            f.close()
+            log.log({'info': 'Connecting to collective due to join',
+                     'subsystem': 'collective'})
+            eventlet.spawn_n(connect_to_leader, rsp['collective'][
+                'fingerprint'], name)
+    if 'enroll' == operation:
+        #TODO(jjohnson2): error appropriately when asked to enroll, but the master is elsewhere
+        mycert = util.get_certificate_from_file('/etc/confluent/srvcert.pem')
+        proof = base64.b64decode(request['hmac'])
+        myrsp = invites.check_client_proof(request['name'], mycert,
+                                           cert, proof)
+        if not myrsp:
+            tlvdata.send(connection, {'error': 'Invalid token'})
+            connection.close()
+            return
+        myrsp = base64.b64encode(myrsp)
+        fprint = util.get_fingerprint(cert)
+        myfprint = util.get_fingerprint(mycert)
+        cfm.add_collective_member(get_myname(),
+                                  connection.getsockname()[0], myfprint)
+        cfm.add_collective_member(request['name'],
+                                  connection.getpeername()[0], fprint)
+        myleader = get_leader(connection)
+        ldrfprint = cfm.get_collective_member_by_address(
+            myleader)['fingerprint']
+        tlvdata.send(connection,
+                     {'collective': {'approval': myrsp,
+                                     'fingerprint': ldrfprint,
+                                     'leader': get_leader(connection)}})
+    if 'assimilate' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not droneinfo:
+            tlvdata.send(connection,
+                         {'error': 'Unrecognized leader, '
+                                   'redo invitation process'})
+            return
+        if not util.cert_matches(droneinfo['fingerprint'], cert):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            return
+        if request['txcount'] < cfm._txcount:
+            tlvdata.send(connection,
+                         {'error': 'Refusing to be assimilated by inferior'
+                                   'transaction count',
+                          'txcount': cfm._txcount,})
+            return
+        if connecting.active:
+            # don't try to connect while actively already trying to connect
+            tlvdata.send(connection, {'status': 0})
+            connection.close()
+            return
+        if (currentleader == connection.getpeername()[0] and
+                follower and follower.isAlive()):
+            # if we are happily following this leader already, don't stir
+            # the pot
+            tlvdata.send(connection, {'status': 0})
+            connection.close()
+            return
+        log.log({'info': 'Connecting in response to assimilation',
+                 'subsystem': 'collective'})
+        eventlet.spawn_n(connect_to_leader, None, None,
+                         leader=connection.getpeername()[0])
+        tlvdata.send(connection, {'status': 0})
+        connection.close()
+    if 'getinfo' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
+                                                cert)):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            connection.close()
+            return
+        collinfo = {}
+        populate_collinfo(collinfo)
+        tlvdata.send(connection, collinfo)
+    if 'connect' == operation:
+        drone = request['name']
+        droneinfo = cfm.get_collective_member(drone)
+        if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
+                                                cert)):
+            tlvdata.send(connection,
+                         {'error': 'Invalid certificate, '
+                                   'redo invitation process'})
+            connection.close()
+            return
+        myself = connection.getsockname()[0]
+        if connecting.active:
+            tlvdata.send(connection, {'error': 'Connecting right now',
+                                      'backoff': True})
+            connection.close()
+            return
+        if myself != get_leader(connection):
+            tlvdata.send(
+                connection,
+                {'error': 'Cannot assimilate, our leader is '
+                          'in another castle', 'leader': currentleader})
+            connection.close()
+            return
+        if request['txcount'] > cfm._txcount:
+            retire_as_leader()
+            tlvdata.send(connection,
+                         {'error': 'Client has higher tranasaction count, '
+                                   'should assimilate me, connecting..',
+                          'txcount': cfm._txcount})
+            log.log({'info': 'Connecting to leader due to superior '
+                             'transaction count', 'subsystem': collective})
+            eventlet.spawn_n(connect_to_leader, None, None,
+                             connection.getpeername()[0])
+            connection.close()
+            return
+        if retrythread:
+            retrythread.cancel()
+            retrythread = None
+        with leader_init:
+            cfm.update_collective_address(request['name'],
+                                          connection.getpeername()[0])
+            tlvdata.send(connection, cfm._dump_keys(None, False))
+            tlvdata.send(connection, cfm._cfgstore['collective'])
+            tlvdata.send(connection, cfm.get_globals())
+            cfgdata = cfm.ConfigManager(None)._dump_to_json()
+            tlvdata.send(connection, {'txcount': cfm._txcount,
+                                      'dbsize': len(cfgdata)})
+            connection.sendall(cfgdata)
+        #tlvdata.send(connection, {'tenants': 0}) # skip the tenants for now,
+        # so far unused anyway
+        if not cfm.relay_slaved_requests(drone, connection):
+            if not retrythread:  # start a recovery if everyone else seems
+                # to have disappeared
+                retrythread = eventlet.spawn_after(30 + random.random(),
+                                                   start_collective)
+        # ok, we have a connecting member whose certificate checks out
+        # He needs to bootstrap his configuration and subscribe it to updates
+
+
+def populate_collinfo(collinfo):
+    iam = get_myname()
+    collinfo['leader'] = iam
+    collinfo['active'] = list(cfm.cfgstreams)
+    activemembers = set(cfm.cfgstreams)
+    activemembers.add(iam)
+    collinfo['offline'] = []
+    for member in cfm.list_collective():
+        if member not in activemembers:
+            collinfo['offline'].append(member)
+
+
+def try_assimilate(drone):
+    try:
+        remote = connect_to_collective(None, drone)
+    except socket.error:
+        # Oh well, unable to connect, hopefully the rest will be
+        # in order
+        return
+    tlvdata.send(remote, {'collective': {'operation': 'assimilate',
+                                         'name': get_myname(),
+                                         'txcount': cfm._txcount}})
+    tlvdata.recv(remote)  # the banner
+    tlvdata.recv(remote)  # authpassed... 0..
+    answer = tlvdata.recv(remote)
+    if not answer:
+        log.log(
+            {'error':
+                 'No answer from {0} while trying to assimilate'.format(
+                     drone),
+            'subsystem': 'collective'})
+        return
+    if 'txcount' in answer:
+        log.log({'info': 'Deferring to {0} due to transaction count'.format(
+            drone), 'subsystem': 'collective'})
+        connect_to_leader(None, None, leader=remote.getpeername()[0])
+        return
+    if 'error' in answer:
+        log.log({
+            'error': 'Error encountered while attempting to '
+                     'assimilate {0}: {1}'.format(drone, answer['error']),
+            'subsystem': 'collective'})
+        return
+    log.log({'info': 'Assimilated {0} into collective'.format(drone),
+             'subsystem': 'collective'})
+
+
+def get_leader(connection):
+    if currentleader is None or connection.getpeername()[0] == currentleader:
+        if currentleader is None:
+            msg = 'Becoming leader as no leader known'
+        else:
+            msg = 'Becoming leader because {0} attempted to connect and it ' \
+                  'is current leader'.format(currentleader)
+        log.log({'info': msg, 'subsystem': 'collective'})
+        become_leader(connection)
+    return currentleader
+
+def retire_as_leader():
+    global currentleader
+    cfm.stop_leading()
+    currentleader = None
+
+def become_leader(connection):
+    global currentleader
+    global follower
+    global retrythread
+    log.log({'info': 'Becoming leader of collective',
+             'subsystem': 'collective'})
+    if follower:
+        follower.kill()
+        cfm.stop_following()
+        follower = None
+    if retrythread:
+        retrythread.cancel()
+        retrythread = None
+    currentleader = connection.getsockname()[0]
+    skipaddr = connection.getpeername()[0]
+    myname = get_myname()
+    skipem = set(cfm.cfgstreams)
+    skipem.add(currentleader)
+    skipem.add(skipaddr)
+    for member in cfm.list_collective():
+        dronecandidate = cfm.get_collective_member(member)['address']
+        if dronecandidate in skipem or member == myname:
+            continue
+        eventlet.spawn_n(try_assimilate, dronecandidate)
+
+
+def startup():
+    members = list(cfm.list_collective())
+    if len(members) < 2:
+        # Not in collective mode, return
+        return
+    eventlet.spawn_n(start_collective)
+
+def start_collective():
+    global follower
+    global retrythread
+    if follower:
+        follower.kill()
+        cfm.stop_following()
+        follower = None
+    try:
+        if cfm.cfgstreams:
+            cfm.check_quorum()
+            # Do not start if we have quorum and are leader
+            return
+    except exc.DegradedCollective:
+        pass
+    if leader_init.active:  # do not start trying to connect if we are
+        # xmitting data to a follower
+        return
+    myname = get_myname()
+    for member in sorted(list(cfm.list_collective())):
+        if member == myname:
+            continue
+        if cfm.cfgleader is None:
+            cfm.stop_following(True)
+        ldrcandidate = cfm.get_collective_member(member)['address']
+        log.log({'info': 'Performing startup attempt to {0}'.format(
+            ldrcandidate), 'subsystem': 'collective'})
+        if connect_to_leader(name=myname, leader=ldrcandidate):
+            break
+    else:
+        retrythread = eventlet.spawn_after(30 + random.random(),
+                                           start_collective)
+
+

confluent_server/confluent/config/attributes.py

@@ -148,6 +148,20 @@ node = {
 #                        'autonode.servername, so that would not need to be '
 #                        'copied ')
 #    },
+    'collective.manager': {
+        'description': ('When in collective mode, the member of the '
+                        'collective currently considered to be responsible '
+                        'for this node.  At a future date, this may be '
+                        'modified automatically if another attribute '
+                        'indicates candidate managers, either for '
+                        'high availability or load balancing purposes.')
+    },
+    'discovery.passwordrules': {
+        'description':  'Any specified rules shall be configured on the BMC '
+                        'upon discovery.  "expiration=no,loginfailures=no" '
+                        'would disable password expiration and login failures '
+                        'triggering a lockout.'
+    },
     'discovery.policy': {
         'description':  'Policy to use for auto-configuration of discovered '
                         'and identified nodes. Valid values are "manual", '

confluent_server/confluent/consoleserver.py

@@ -23,14 +23,18 @@
 # there should be no more than one handler per node
 import codecs
 import collections
+import confluent.collective.manager as collective
 import confluent.config.configmanager as configmodule
 import confluent.exceptions as exc
 import confluent.interface.console as conapi
 import confluent.log as log
 import confluent.core as plugin
+import confluent.tlvdata as tlvdata
 import confluent.util as util
 import eventlet
 import eventlet.event
+import eventlet.green.socket as socket
+import eventlet.green.ssl as ssl
 import pyte
 import random
 import time
@@ -138,11 +142,13 @@ def pytechars2line(chars, maxlen=None):
 class ConsoleHandler(object):
     _plugin_path = '/nodes/{0}/_console/session'
     _logtobuffer = True
-    _genwatchattribs = frozenset(('console.method', 'console.logging'))
+    _genwatchattribs = frozenset(('console.method', 'console.logging',
+                                  'collective.manager'))
 
     def __init__(self, node, configmanager):
         self.clearpending = False
         self._dologging = True
+        self._is_local = True
         self._isondemand = False
         self.error = None
         self._retrytime = 0
@@ -214,7 +220,7 @@ class ConsoleHandler(object):
     def check_isondemand(self):
         self._dologging = True
         attrvalue = self.cfgmgr.get_node_attributes(
-            (self.node,), ('console.logging',))
+            (self.node,), ('console.logging', 'collective.manager'))
         if self.node not in attrvalue:
             self._isondemand = False
         elif 'console.logging' not in attrvalue[self.node]:
@@ -225,6 +231,23 @@ class ConsoleHandler(object):
                 self._isondemand = True
             if (attrvalue[self.node]['console.logging']['value']) in ('none', 'memory'):
                 self._dologging = False
+        self.check_collective(attrvalue)
+
+    def check_collective(self, attrvalue):
+        myc = attrvalue.get(self.node, {}).get('collective.manager', {}).get(
+            'value', None)
+        if configmodule.list_collective() and not myc:
+            self._is_local = False
+            self._detach()
+            self._disconnect()
+        if myc and myc != collective.get_myname():
+            # Do not do console connect for nodes managed by another
+            # confluent collective member
+            self._is_local = False
+            self._detach()
+            self._disconnect()
+        else:
+            self._is_local = True
 
     def get_buffer_age(self):
         """Return age of buffered data
@@ -236,6 +259,10 @@ class ConsoleHandler(object):
         return False
 
     def _attribschanged(self, nodeattribs, configmanager, **kwargs):
+        if 'collective.manager' in nodeattribs[self.node]:
+            attrval = configmanager.get_node_attributes(self.node,
+                                                        'collective.manager')
+            self.check_collective(attrval)
         if 'console.logging' in nodeattribs[self.node]:
             # decide whether logging changes how we react or not
             self._dologging = True
@@ -284,6 +311,10 @@ class ConsoleHandler(object):
             'none or interactive,\r\nconnection loss, or service restart]')
         self.clearpending = True
 
+    def _detach(self):
+        for ses in list(self.livesessions):
+            ses.detach()
+
     def _disconnect(self):
         if self.connectionthread:
             self.connectionthread.kill()
@@ -305,6 +336,8 @@ class ConsoleHandler(object):
             self._disconnect()
 
     def _connect(self):
+        if not self._is_local:
+            return
         if self.connectionthread:
             self.connectionthread.kill()
             self.connectionthread = None
@@ -320,14 +353,17 @@ class ConsoleHandler(object):
             self.reconnect.cancel()
             self.reconnect = None
         try:
-            self._console = plugin.handle_path(
+            self._console = list(plugin.handle_path(
                 self._plugin_path.format(self.node),
-                "create", self.cfgmgr)
+                "create", self.cfgmgr))[0]
         except (exc.NotImplementedException, exc.NotFoundException):
             self._console = None
         except:
-            _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
-                          event=log.Events.stacktrace)
+            if _tracelog:
+                _tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
+                              event=log.Events.stacktrace)
+            else:
+                print(traceback.format_exc())
         if not isinstance(self._console, conapi.Console):
             self.clearbuffer()
             self.connectstate = 'unconnected'
@@ -413,6 +449,9 @@ class ConsoleHandler(object):
         if self.connectionthread:
             self.connectionthread.kill()
             self.connectionthread = None
+        if self._attribwatcher:
+            self.cfgmgr.remove_watcher(self._attribwatcher)
+            self._attribwatcher = None
 
     def get_console_output(self, data):
         # Spawn as a greenthread, return control as soon as possible
@@ -482,9 +521,6 @@ class ConsoleHandler(object):
             eventdata |= 1
         if self.shiftin is not None:
             eventdata |= 2
-        self.log(data, eventdata=eventdata)
-        self.lasttime = util.monotonic_time()
-        self.feedbuffer(data)
         # TODO: analyze buffer for registered events, examples:
         #   panics
         #   certificate signing request
@@ -493,6 +529,10 @@ class ConsoleHandler(object):
             self.feedbuffer(b'\x1bc')
             self._send_rcpts(b'\x1bc')
         self._send_rcpts(_utf8_normalize(data, self.shiftin, self.utf8decoder))
+        self.log(data, eventdata=eventdata)
+        self.lasttime = util.monotonic_time()
+        self.feedbuffer(data)
+
 
     def _send_rcpts(self, data):
         for rcpt in list(self.livesessions):
@@ -568,7 +608,12 @@ def _nodechange(added, deleting, configmanager):
 
 
 def _start_tenant_sessions(cfm):
-    for node in cfm.list_nodes():
+    nodeattrs = cfm.get_node_attributes(cfm.list_nodes(), 'collective.manager')
+    for node in nodeattrs:
+        manager = nodeattrs[node].get('collective.manager', {}).get('value',
+                                                                    None)
+        if manager and collective.get_myname() != manager:
+            continue
         try:
             connect_node(node, cfm)
         except:
@@ -583,12 +628,118 @@ def start_console_sessions():
     configmodule.hook_new_configmanagers(_start_tenant_sessions)
 
 
-def connect_node(node, configmanager, username=None):
+def connect_node(node, configmanager, username=None, direct=True):
+    attrval = configmanager.get_node_attributes(node, 'collective.manager')
+    myc = attrval.get(node, {}).get('collective.manager', {}).get(
+        'value', None)
+    myname = collective.get_myname()
+    if myc and myc != collective.get_myname() and direct:
+        minfo = configmodule.get_collective_member(myc)
+        return ProxyConsole(node, minfo, myname, configmanager, username)
     consk = (node, configmanager.tenant)
     if consk not in _handled_consoles:
         _handled_consoles[consk] = ConsoleHandler(node, configmanager)
     return _handled_consoles[consk]
 
+# A stub console handler that just passes through to a remote confluent
+# collective member.  It can skip the multi-session sharing as that is handled
+# remotely
+class ProxyConsole(object):
+    _genwatchattribs = frozenset(('collective.manager',))
+
+    def __init__(self, node, managerinfo, myname, configmanager, user):
+        self.skipreplay = True
+        self.managerinfo = managerinfo
+        self.myname = myname
+        self.cfm = configmanager
+        self.node = node
+        self.user = user
+        self.remote = None
+        self.clisession = None
+        self._attribwatcher = configmanager.watch_attributes(
+            (self.node,), self._genwatchattribs, self._attribschanged)
+
+    def _attribschanged(self, nodeattribs, configmanager, **kwargs):
+        if self.clisession:
+            self.clisession.detach()
+            self.clisession = None
+
+    def relay_data(self):
+        data = tlvdata.recv(self.remote)
+        while data:
+            self.data_handler(data)
+            data = tlvdata.recv(self.remote)
+
+    def get_buffer_age(self):
+        # the server sends a buffer age if appropriate, no need to handle
+        # it explicitly in the proxy instance
+        return False
+
+    def get_recent(self):
+        # Again, delegate this to the remote collective member
+        self.skipreplay = False
+        return b''
+
+    def write(self, data):
+        # Relay data to the collective manager
+        try:
+            tlvdata.send(self.remote, data)
+        except Exception:
+            if self.clisession:
+                self.clisession.detach()
+            self.clisession = None
+
+
+    def attachsession(self, session):
+        self.clisession = session
+        self.data_handler = session.data_handler
+        termreq = {
+            'proxyconsole': {
+                'name': self.myname,
+                'user': self.user,
+                'tenant': self.cfm.tenant,
+                'node': self.node,
+                'skipreplay': self.skipreplay,
+                #TODO(jjohnson2): declare myself as a proxy,
+                #facilitate redirect rather than relay on manager change
+            },
+        }
+        try:
+            remote = socket.create_connection((self.managerinfo['address'], 13001))
+            remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                     keyfile='/etc/confluent/privkey.pem',
+                                     certfile='/etc/confluent/srvcert.pem')
+            if not util.cert_matches(self.managerinfo['fingerprint'],
+                                     remote.getpeercert(binary_form=True)):
+                raise Exception('Invalid peer certificate')
+        except Exception:
+            eventlet.sleep(3)
+            if self.clisession:
+                self.clisession.detach()
+            self.detachsession(None)
+            return
+        tlvdata.recv(remote)
+        tlvdata.recv(remote)
+        tlvdata.send(remote, termreq)
+        self.remote = remote
+        eventlet.spawn(self.relay_data)
+
+    def detachsession(self, session):
+        # we will disappear, so just let that happen...
+        if self.remote:
+            try:
+                tlvdata.send(self.remote, {'operation': 'stop'})
+            except Exception:
+                pass
+        self.clisession = None
+
+    def send_break(self):
+        tlvdata.send(self.remote, {'operation': 'break'})
+
+    def reopen(self):
+        tlvdata.send(self.remote, {'operation': 'reopen'})
+
+
 # this represents some api view of a console handler.  This handles things like
 # holding the caller specific queue data, for example, when http api should be
 # sending data, but there is no outstanding POST request to hold it,
@@ -610,10 +761,9 @@ class ConsoleSession(object):
                          'get_next_output' non-functional
     :param skipreplay: If true, will skip the attempt to redraw the screen
     """
-    connector = connect_node
 
     def __init__(self, node, configmanager, username, datacallback=None,
-                 skipreplay=False):
+                 skipreplay=False, direct=True):
         self.registered = False
         self.tenant = configmanager.tenant
         if not configmanager.is_node(node):
@@ -621,6 +771,8 @@ class ConsoleSession(object):
         self.username = username
         self.node = node
         self.configmanager = configmanager
+        self.direct = direct  # true if client is directly connected versus
+                              # relay
         self.connect_session()
         self.registered = True
         self._evt = None
@@ -649,7 +801,7 @@ class ConsoleSession(object):
         between console and shell.
         """
         self.conshdl = connect_node(self.node, self.configmanager,
-                                    self.username)
+                                    self.username, self.direct)
     def send_break(self):
         """Send break to remote system
         """
@@ -680,6 +832,18 @@ class ConsoleSession(object):
         self._evt = None
         self.reghdl = None
 
+    def detach(self):
+        """Handler for the console handler to detach so it can reattach,
+        currently to facilitate changing from one collective.manager to
+        another
+
+        :return:
+        """
+        self.conshdl.detachsession(self)
+        self.connect_session()
+        self.conshdl.attachsession(self)
+        self.write = self.conshdl.write
+
     def got_data(self, data):
         """Receive data from console and buffer
 

confluent_server/confluent/core.py

@@ -35,7 +35,10 @@
 
 import confluent
 import confluent.alerts as alerts
+import confluent.tlvdata as tlvdata
 import confluent.config.attributes as attrscheme
+import confluent.config.configmanager as cfm
+import confluent.collective.manager as collective
 import confluent.discovery.core as disco
 import confluent.interface.console as console
 import confluent.exceptions as exc
@@ -46,11 +49,27 @@ try:
     import confluent.shellmodule as shellmodule
 except ImportError:
     pass
+try:
+    import OpenSSL.crypto as crypto
+except ImportError:
+    # Only required for collective mode
+    crypto = None
+import confluent.util as util
+import eventlet.greenpool as greenpool
+import eventlet.green.ssl as ssl
+import eventlet.queue as queue
 import itertools
 import os
+try:
+    import cPickle as pickle
+except ImportError:
+    import pickle
+import socket
+import struct
 import sys
 
 pluginmap = {}
+dispatch_plugins = (b'ipmi', u'ipmi')
 
 
 def seek_element(currplace, currkey):
@@ -154,6 +173,10 @@ def _init_core():
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
                 }),
+                'hostname': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
                 'identifier': PluginRoute({
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
@@ -178,6 +201,14 @@ def _init_core():
                     'pluginattrs': ['hardwaremanagement.method'],
                     'default': 'ipmi',
                 }),
+                'advanced': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                }),
+                'clear': PluginRoute({
+                    'pluginattrs': ['hardwaremanagement.method'],
+                    'default': 'ipmi',
+                })
             },
         },
         '_console': {
@@ -210,6 +241,10 @@ def _init_core():
                 'default': 'ipmi',
             }),
         },
+        'description': PluginRoute({
+            'pluginattrs': ['hardwaremanagement.method'],
+            'default': 'ipmi',
+        }),
         'events': {
             'hardware': {
                 'log': PluginRoute({
@@ -311,6 +346,12 @@ def _init_core():
             },
 
         },
+        'support': {
+            'servicedata': PluginCollection({
+                'pluginattrs': ['hardwaremanagement.method'],
+                'default': 'ipmi',
+            }),
+        },
     }
 
     nodegroupresources = {
@@ -544,6 +585,15 @@ class BadPlugin(object):
             self.node, self.plugin + ' is not a supported plugin')
 
 
+class BadCollective(object):
+    def __init__(self, node):
+        self.node = node
+
+    def error(self, *args, **kwargs):
+        yield msg.ConfluentNodeError(
+            self.node, 'collective mode is active, but collective.manager '
+                       'is not set for this node')
+
 def abbreviate_noderange(configmanager, inputdata, operation):
     if operation != 'create':
         raise exc.InvalidArgumentException('Must be a create with nodes in list')
@@ -554,6 +604,63 @@ def abbreviate_noderange(configmanager, inputdata, operation):
     return (msg.KeyValueData({'noderange': noderange.ReverseNodeRange(inputdata['nodes'], configmanager).noderange}),)
 
 
+def handle_dispatch(connection, cert, dispatch, peername):
+    cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    if not util.cert_matches(
+            cfm.get_collective_member(peername)['fingerprint'], cert):
+        connection.close()
+        return
+    dispatch = pickle.loads(dispatch)
+    configmanager = cfm.ConfigManager(dispatch['tenant'])
+    nodes = dispatch['nodes']
+    inputdata = dispatch['inputdata']
+    operation = dispatch['operation']
+    pathcomponents = dispatch['path']
+    routespec = nested_lookup(noderesources, pathcomponents)
+    plugroute = routespec.routeinfo
+    plugpath = None
+    nodesbyhandler = {}
+    passvalues = []
+    nodeattr = configmanager.get_node_attributes(
+        nodes, plugroute['pluginattrs'])
+    for node in nodes:
+        for attrname in plugroute['pluginattrs']:
+            if attrname in nodeattr[node]:
+                plugpath = nodeattr[node][attrname]['value']
+            elif 'default' in plugroute:
+                plugpath = plugroute['default']
+        if plugpath is not None:
+            try:
+                hfunc = getattr(pluginmap[plugpath], operation)
+            except KeyError:
+                nodesbyhandler[BadPlugin(node, plugpath).error] = [node]
+                continue
+            if hfunc in nodesbyhandler:
+                nodesbyhandler[hfunc].append(node)
+            else:
+                nodesbyhandler[hfunc] = [node]
+    try:
+        for hfunc in nodesbyhandler:
+            passvalues.append(hfunc(
+                nodes=nodesbyhandler[hfunc], element=pathcomponents,
+                configmanager=configmanager,
+                inputdata=inputdata))
+        for res in itertools.chain(*passvalues):
+            _forward_rsp(connection, res)
+    except Exception as res:
+        _forward_rsp(connection, res)
+    connection.sendall('\x00\x00\x00\x00\x00\x00\x00\x00')
+
+
+def _forward_rsp(connection, res):
+    r = pickle.dumps(res)
+    rlen = len(r)
+    if not rlen:
+        return
+    connection.sendall(struct.pack('!Q', rlen))
+    connection.sendall(r)
+
+
 def handle_node_request(configmanager, inputdata, operation,
                         pathcomponents, autostrip=True):
     iscollection = False
@@ -633,7 +740,7 @@ def handle_node_request(configmanager, inputdata, operation,
         else:
             raise Exception("TODO here")
     del pathcomponents[0:2]
-    passvalues = []
+    passvalues = queue.Queue()
     plugroute = routespec.routeinfo
     inputdata = msg.get_input_message(
         pathcomponents, operation, inputdata, nodes, isnoderange,
@@ -650,20 +757,36 @@ def handle_node_request(configmanager, inputdata, operation,
         if isnoderange:
             return passvalue
         elif isinstance(passvalue, console.Console):
-            return passvalue
+            return [passvalue]
         else:
             return stripnode(passvalue, nodes[0])
     elif 'pluginattrs' in plugroute:
         nodeattr = configmanager.get_node_attributes(
-            nodes, plugroute['pluginattrs'])
+            nodes, plugroute['pluginattrs'] + ['collective.manager'])
         plugpath = None
-        if 'default' in plugroute:
-            plugpath = plugroute['default']
+        nodesbymanager = {}
         nodesbyhandler = {}
+        badcollnodes = []
         for node in nodes:
             for attrname in plugroute['pluginattrs']:
                 if attrname in nodeattr[node]:
                     plugpath = nodeattr[node][attrname]['value']
+                elif 'default' in plugroute:
+                    plugpath = plugroute['default']
+            if plugpath in dispatch_plugins:
+                cfm.check_quorum()
+                manager = nodeattr[node].get('collective.manager', {}).get(
+                    'value', None)
+                if manager:
+                    if collective.get_myname() != manager:
+                        if manager not in nodesbymanager:
+                            nodesbymanager[manager] = set([node])
+                        else:
+                            nodesbymanager[manager].add(node)
+                        continue
+                elif list(cfm.list_collective()):
+                    badcollnodes.append(node)
+                    continue
             if plugpath is not None:
                 try:
                     hfunc = getattr(pluginmap[plugpath], operation)
@@ -674,19 +797,27 @@ def handle_node_request(configmanager, inputdata, operation,
                     nodesbyhandler[hfunc].append(node)
                 else:
                     nodesbyhandler[hfunc] = [node]
+        for bn in badcollnodes:
+            nodesbyhandler[BadCollective(bn).error] = [bn]
+        workers = greenpool.GreenPool()
+        numworkers = 0
         for hfunc in nodesbyhandler:
-            passvalues.append(hfunc(
-                nodes=nodesbyhandler[hfunc], element=pathcomponents,
-                configmanager=configmanager,
-                inputdata=inputdata))
+            numworkers += 1
+            workers.spawn(addtoqueue, passvalues, hfunc, {'nodes': nodesbyhandler[hfunc],
+                                           'element': pathcomponents,
+                'configmanager': configmanager,
+                'inputdata': inputdata})
+        for manager in nodesbymanager:
+            numworkers += 1
+            workers.spawn(addtoqueue, passvalues, dispatch_request, {
+                'nodes': nodesbymanager[manager], 'manager': manager,
+                'element': pathcomponents, 'configmanager': configmanager,
+                'inputdata': inputdata, 'operation': operation})
         if isnoderange or not autostrip:
-            return itertools.chain(*passvalues)
+            return iterate_queue(numworkers, passvalues)
         else:
-            if len(passvalues) > 0:
-                if isinstance(passvalues[0], console.Console):
-                    return passvalues[0]
-                else:
-                    return stripnode(passvalues[0], nodes[0])
+            if numworkers > 0:
+                return iterate_queue(numworkers, passvalues, nodes[0])
             else:
                 raise exc.NotImplementedException()
 
@@ -696,6 +827,117 @@ def handle_node_request(configmanager, inputdata, operation,
         #     return stripnode(passvalues[0], nodes[0])
 
 
+def iterate_queue(numworkers, passvalues, strip=False):
+    completions = 0
+    while completions < numworkers:
+        nv = passvalues.get()
+        if nv == 'theend':
+            completions += 1
+        else:
+            if isinstance(nv, Exception):
+                raise nv
+            if strip and not isinstance(nv, console.Console):
+                nv.strip_node(strip)
+            yield nv
+
+
+def addtoqueue(theq, fun, kwargs):
+    try:
+        result = fun(**kwargs)
+        if isinstance(result, console.Console):
+            theq.put(result)
+        else:
+            for pv in result:
+                theq.put(pv)
+    except Exception as e:
+        theq.put(e)
+    finally:
+        theq.put('theend')
+
+
+def dispatch_request(nodes, manager, element, configmanager, inputdata,
+                     operation):
+    a = configmanager.get_collective_member(manager)
+    try:
+        remote = socket.create_connection((a['address'], 13001))
+        remote.settimeout(90)
+        remote = ssl.wrap_socket(remote, cert_reqs=ssl.CERT_NONE,
+                                 keyfile='/etc/confluent/privkey.pem',
+                                 certfile='/etc/confluent/srvcert.pem')
+    except Exception:
+        for node in nodes:
+            if a:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} is unreachable'.format(
+                        a['name']))
+            else:
+                yield msg.ConfluentResourceUnavailable(
+                    node,
+                    '"{0}" is not recognized as a collective member'.format(
+                        manager))
+
+        return
+    if not util.cert_matches(a['fingerprint'], remote.getpeercert(
+            binary_form=True)):
+        raise Exception("Invalid certificate on peer")
+    tlvdata.recv(remote)
+    tlvdata.recv(remote)
+    myname = collective.get_myname()
+    dreq = pickle.dumps({'name': myname, 'nodes': list(nodes),
+                         'path': element,'tenant': configmanager.tenant,
+                         'operation': operation, 'inputdata': inputdata})
+    tlvdata.send(remote, {'dispatch': {'name': myname, 'length': len(dreq)}})
+    remote.sendall(dreq)
+    while True:
+        try:
+            rlen = remote.recv(8)
+        except Exception:
+            for node in nodes:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} went unreachable'.format(
+                        a['name']))
+            return
+        while len(rlen) < 8:
+            try:
+                nlen = remote.recv(8 - len(rlen))
+            except Exception:
+                nlen = 0
+            if not nlen:
+                for node in nodes:
+                    yield msg.ConfluentResourceUnavailable(
+                        node, 'Collective member {0} went unreachable'.format(
+                            a['name']))
+                return
+            rlen += nlen
+        rlen = struct.unpack('!Q', rlen)[0]
+        if rlen == 0:
+            break
+        try:
+            rsp = remote.recv(rlen)
+        except Exception:
+            for node in nodes:
+                yield msg.ConfluentResourceUnavailable(
+                    node, 'Collective member {0} went unreachable'.format(
+                        a['name']))
+            return
+        while len(rsp) < rlen:
+            try:
+                nrsp = remote.recv(rlen - len(rsp))
+            except Exception:
+                nrsp = 0
+            if not nrsp:
+                for node in nodes:
+                    yield msg.ConfluentResourceUnavailable(
+                        node, 'Collective member {0} went unreachable'.format(
+                            a['name']))
+                return
+            rsp += nrsp
+        rsp = pickle.loads(rsp)
+        if isinstance(rsp, Exception):
+            raise rsp
+        yield rsp
+
+
 def handle_discovery(pathcomponents, operation, configmanager, inputdata):
     if pathcomponents[0] == 'detected':
         pass

confluent_server/confluent/discovery/core.py

@@ -85,6 +85,9 @@ import eventlet
 import eventlet.greenpool
 import eventlet.semaphore
 
+autosensors = set()
+scanner = None
+
 class nesteddict(dict):
 
     def __missing__(self, key):
@@ -350,7 +353,28 @@ def _parameterize_path(pathcomponents):
     return validselectors, keyparams, listrequested, childcoll
 
 
+def handle_autosense_config(operation, inputdata):
+    autosense = cfm.get_global('discovery.autosense')
+    autosense = autosense or autosense is None
+    if operation == 'retrieve':
+        yield msg.KeyValueData({'enabled': autosense})
+    elif operation == 'update':
+        enabled = inputdata['enabled']
+        if type(enabled) in (unicode, str):
+            enabled = enabled.lower() in ('true', '1', 'y', 'yes', 'enable',
+                                          'enabled')
+        if autosense == enabled:
+            return
+        cfm.set_global('discovery.autosense', enabled)
+        if enabled:
+            start_autosense()
+        else:
+            stop_autosense()
+
+
 def handle_api_request(configmanager, inputdata, operation, pathcomponents):
+    if pathcomponents == ['discovery', 'autosense']:
+        return handle_autosense_config(operation, inputdata)
     if operation == 'retrieve':
         return handle_read_api_request(pathcomponents)
     elif (operation in ('update', 'create') and
@@ -359,6 +383,7 @@ def handle_api_request(configmanager, inputdata, operation, pathcomponents):
             raise exc.InvalidArgumentException()
         rescan()
         return (msg.KeyValueData({'rescan': 'started'}),)
+
     elif operation in ('update', 'create'):
         if 'node' not in inputdata:
             raise exc.InvalidArgumentException('Missing node name in input')
@@ -394,10 +419,13 @@ def handle_read_api_request(pathcomponents):
     # TODO(jjohnson2): This should be more generalized...
     #  odd indexes into components are 'by-'*, even indexes
     # starting at 2 are parameters to previous index
+    if pathcomponents == ['discovery', 'rescan']:
+        return (msg.KeyValueData({'scanning': bool(scanner)}),)
     subcats, queryparms, indexof, coll = _parameterize_path(pathcomponents[1:])
     if len(pathcomponents) == 1:
         dirlist = [msg.ChildCollection(x + '/') for x in sorted(list(subcats))]
         dirlist.append(msg.ChildCollection('rescan'))
+        dirlist.append(msg.ChildCollection('autosense'))
         return dirlist
     if not coll:
         return show_info(queryparms['by-mac'])
@@ -695,6 +723,9 @@ def get_chained_smm_name(nodename, cfg, handler, nl=None, checkswitch=True):
         smmaddr = cd[nodename]['hardwaremanagement.manager']['value']
         pkey = cd[nodename].get('pubkeys.tls_hardwaremanager', {}).get(
             'value', None)
+        if not pkey:
+            # We cannot continue through a break in the chain
+            return None, False
         if pkey:
             cv = util.TLSCertVerifier(
                 cfg, nodename, 'pubkeys.tls_hardwaremanager').verify_cert
@@ -715,6 +746,8 @@ def get_smm_neighbor_fingerprints(smmaddr, cv):
         smmaddr = '[{0}]'.format(smmaddr)
     wc = webclient.SecureHTTPConnection(smmaddr, verifycallback=cv)
     neighs = wc.grab_json_response('/scripts/neighdata.json')
+    if not neighs:
+        return
     for idx in (4, 5):
         if 'sha256' not in neighs[idx]:
             continue
@@ -867,8 +900,9 @@ def eval_node(cfg, handler, info, nodename, manual=False):
         if enl:
             # ambiguous SMM situation according to the configuration, we need
             # to match uuid
-            encuuid = info['attributes'].get('chasis-uuid', None)
+            encuuid = info['attributes'].get('chassis-uuid', None)
             if encuuid:
+                encuuid = encuuid[0]
                 enl = list(cfg.filter_node_attributes('id.uuid=' + encuuid))
                 if len(enl) != 1:
                     # errorstr = 'No SMM by given UUID known, *yet*'
@@ -924,26 +958,25 @@ def eval_node(cfg, handler, info, nodename, manual=False):
         # but... is this really ok?  could be on an upstream port or
         # erroneously put in the enclosure with no nodes yet
         # so first, see if the candidate node is a chain host
-        if info.get('maccount', False):
-            # discovery happened through switch
-            nl = list(cfg.filter_node_attributes(
-                'enclosure.extends=' + nodename))
-            if nl:
-                # The candidate nodename is the head of a chain, we must
-                # validate the smm certificate by the switch
-                macmap.get_node_fingerprint(nodename, cfg)
-                util.handler.cert_matches(fprint, handler.https_cert)
+        if not manual:
+            if info.get('maccount', False):
+                # discovery happened through switch
+                nl = list(cfg.filter_node_attributes(
+                    'enclosure.extends=' + nodename))
+                if nl:
+                    # The candidate nodename is the head of a chain, we must
+                    # validate the smm certificate by the switch
+                    macmap.get_node_fingerprint(nodename, cfg)
+                    util.handler.cert_matches(fprint, handler.https_cert)
+                    return
+            if (info.get('maccount', False) and
+                    not handler.discoverable_by_switch(info['maccount'])):
+                errorstr = 'The detected node {0} was detected using switch, ' \
+                           'however the relevant port has too many macs learned ' \
+                           'for this type of device ({1}) to be discovered by ' \
+                           'switch.'.format(nodename, handler.devname)
+                log.log({'error': errorstr})
                 return
-        if (info.get('maccount', False) and
-                not handler.discoverable_by_switch(info['maccount'])):
-            errorstr = 'The detected node {0} was detected using switch, ' \
-                       'however the relevant port has too many macs learned ' \
-                       'for this type of device ({1}) to be discovered by ' \
-                       'switch.'.format(nodename, handler.devname)
-            if manual:
-                raise exc.InvalidArgumentException(errorstr)
-            log.log({'error': errorstr})
-            return
         if not discover_node(cfg, handler, info, nodename, manual):
             pending_nodes[nodename] = info
 
@@ -1075,12 +1108,14 @@ def newnodes(added, deleting, configmanager):
     global attribwatcher
     global needaddhandled
     global nodeaddhandler
+    _map_unique_ids()
     configmanager.remove_watcher(attribwatcher)
     allnodes = configmanager.list_nodes()
     attribwatcher = configmanager.watch_attributes(
         allnodes, ('discovery.policy', 'net*.switch',
-                   'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
-                   'pubkeys.tls_hardwaremanager', 'net*.bootable'), _recheck_nodes)
+                   'hardwaremanagement.manager', 'net*.switchport',
+                   'id.uuid', 'pubkeys.tls_hardwaremanager',
+                   'net*.bootable'), _recheck_nodes)
     if nodeaddhandler:
         needaddhandled = True
     else:
@@ -1112,7 +1147,11 @@ def _periodic_recheck(configmanager):
 
 def rescan():
     _map_unique_ids()
-    eventlet.spawn_n(slp.active_scan, safe_detected)
+    global scanner
+    if scanner:
+        return
+    else:
+        scanner = eventlet.spawn(slp.active_scan, safe_detected)
 
 
 def start_detection():
@@ -1126,14 +1165,23 @@ def start_detection():
                    'hardwaremanagement.manager', 'net*.switchport', 'id.uuid',
                    'pubkeys.tls_hardwaremanager'), _recheck_nodes)
     cfg.watch_nodecollection(newnodes)
-    eventlet.spawn_n(slp.snoop, safe_detected)
-    eventlet.spawn_n(pxe.snoop, safe_detected)
+    autosense = cfm.get_global('discovery.autosense')
+    if autosense or autosense is None:
+        start_autosense()
     if rechecker is None:
         rechecktime = util.monotonic_time() + 900
         rechecker = eventlet.spawn_after(900, _periodic_recheck, cfg)
 
     # eventlet.spawn_n(ssdp.snoop, safe_detected)
 
+def stop_autosense():
+    for watcher in list(autosensors):
+        watcher.kill()
+        autosensors.discard(watcher)
+
+def start_autosense():
+    autosensors.add(eventlet.spawn(slp.snoop, safe_detected))
+    autosensors.add(eventlet.spawn(pxe.snoop, safe_detected))
 
 
 nodes_by_fprint = {}
@@ -1155,7 +1203,7 @@ def _map_unique_ids(nodes=None):
     uuid_by_nodes = {}
     fprint_by_nodes = {}
     for uuid in nodes_by_uuid:
-        if not uuid_is_valid():
+        if not uuid_is_valid(uuid):
             continue
         node = nodes_by_uuid[uuid]
         if node in bigmap:

confluent_server/confluent/discovery/handlers/bmc.py

@@ -45,7 +45,7 @@ class NodeHandler(generic.NodeHandler):
     def config(self, nodename, reset=False):
         self._bmcconfig(nodename, reset)
 
-    def _bmcconfig(self, nodename, reset=False):
+    def _bmcconfig(self, nodename, reset=False, customconfig=None):
         # TODO(jjohnson2): set ip parameters, user/pass, alert cfg maybe
         # In general, try to use https automation, to make it consistent
         # between hypothetical secure path and today.
@@ -74,6 +74,8 @@ class NodeHandler(generic.NodeHandler):
                 ic = self._get_ipmicmd(user, passwd)
             else:
                 raise
+        if customconfig:
+            customconfig(ic)
         currusers = ic.get_users()
         lanchan = ic.get_network_channel()
         userdata = ic.xraw_command(netfn=6, command=0x44, data=(lanchan,
@@ -122,16 +124,18 @@ class NodeHandler(generic.NodeHandler):
             if currusers[uid]['name'] == newuser:
                 # Use existing account that has been created
                 newuserslot = uid
+                if newpass != passwd:  # don't mess with existing if no change
+                    ic.set_user_password(newuserslot, password=newpass)
                 break
         else:
             newuserslot = lockedusers + 1
             if newuserslot < 2:
                 newuserslot = 2
+            if newpass != passwd:  # don't mess with existing if no change
+                ic.set_user_password(newuserslot, password=newpass)
             ic.set_user_name(newuserslot, newuser)
             ic.set_user_access(newuserslot, lanchan,
                                privilege_level='administrator')
-        if newpass != passwd:  # don't mess with existing if no change
-            ic.set_user_password(newuserslot, password=newpass)
         # Now to zap others
         for uid in currusers:
             if uid != newuserslot:

confluent_server/confluent/discovery/handlers/xcc.py

@@ -13,11 +13,13 @@
 # limitations under the License.
 
 import confluent.discovery.handlers.imm as immhandler
+import confluent.util as util
 import pyghmi.exceptions as pygexc
 import pyghmi.ipmi.oem.lenovo.imm as imm
 
 
 
+
 class NodeHandler(immhandler.NodeHandler):
     devname = 'XCC'
 
@@ -41,16 +43,45 @@ class NodeHandler(immhandler.NodeHandler):
         #if ipmicmd:
         #    ipmicmd.ipmi_session.logout()
 
+    def validate_cert(self, certificate):
+        # broadly speaking, merely checks consistency moment to moment,
+        # but if https_cert gets stricter, this check means something
+        fprint = util.get_fingerprint(self.https_cert)
+        return util.cert_matches(fprint, certificate)
+
+    def set_password_policy(self, ic):
+        ruleset = {'USER_GlobalMinPassChgInt': '0'}
+        for rule in self.ruleset.split(','):
+            if '=' not in rule:
+                continue
+            name, value = rule.split('=')
+            if value.lower() in ('no', 'none', 'disable', 'disabled'):
+                value = '0'
+            if name.lower() in ('expiry', 'expiration'):
+                ruleset['USER_GlobalPassExpPeriod'] = value
+                if int(value) < 5:
+                    ruleset['USER_GlobalPassExpWarningPeriod'] = value
+            if name.lower() in ('lockout', 'loginfailures'):
+                if value.lower() in ('no', 'none', 'disable', 'disabled'):
+                    value = '0'
+                ruleset['USER_GlobalMaxLoginFailures'] = value
+        ic.register_key_handler(self.validate_cert)
+        ic.oem_init()
+        ic._oem.immhandler.wc.grab_json_response('/api/dataset', ruleset)
+
     def config(self, nodename, reset=False):
         # TODO(jjohnson2): set ip parameters, user/pass, alert cfg maybe
         # In general, try to use https automation, to make it consistent
         # between hypothetical secure path and today.
-        ic = self._bmcconfig(nodename)
+        dpp = self.configmanager.get_node_attributes(
+            nodename, 'discovery.passwordrules')
+        self.ruleset = dpp.get(nodename, {}).get(
+            'discovery.passwordrules', {}).get('value', '')
+        ic = self._bmcconfig(nodename, customconfig=self.set_password_policy)
         ff = self.info.get('attributes', {}).get('enclosure-form-factor', '')
         if ff not in ('dense-computing', [u'dense-computing']):
             return
         # Ok, we can get the enclosure uuid now..
-        ic.oem_init()
         enclosureuuid = ic._oem.immhandler.get_property(
             '/v2/ibmc/smm/chassis/uuid')
         enclosureuuid = ic._oem.immhandler.get_property(

confluent_server/confluent/discovery/protocols/slp.py

@@ -16,13 +16,13 @@
 
 import confluent.neighutil as neighutil
 import confluent.util as util
+import confluent.log as log
 import os
 import random
 import eventlet.green.select as select
 import eventlet.green.socket as socket
 import struct
-import subprocess
-
+import traceback
 
 _slp_services = set([
     'service:management-hardware.IBM:integrated-management-module2',
@@ -391,6 +391,7 @@ def snoop(handler):
     :param handler:
     :return:
     """
+    tracelog = log.Logger('trace')
     active_scan(handler)
     net = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
     net.setsockopt(IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
@@ -420,54 +421,58 @@ def snoop(handler):
     net4.bind(('', 427))
 
     while True:
-        newmacs = set([])
-        r, _, _ = select.select((net, net4), (), (), 60)
-        # clear known_peers and peerbymacaddress
-        # to avoid stale info getting in...
-        # rely upon the select(0.2) to catch rapid fire and aggregate ip
-        # addresses that come close together
-        # calling code needs to understand deeper context, as snoop
-        # will now yield dupe info over time
-        known_peers = set([])
-        peerbymacaddress = {}
-        neighutil.update_neigh()
-        while r:
-            for s in r:
-                (rsp, peer) = s.recvfrom(9000)
-                ip = peer[0].partition('%')[0]
-                if ip not in neighutil.neightable:
-                    continue
-                if peer in known_peers:
-                    continue
-                known_peers.add(peer)
-                mac = neighutil.neightable[ip]
-                if mac in peerbymacaddress:
-                    peerbymacaddress[mac]['addresses'].append(peer)
-                else:
-                    q = query_srvtypes(peer)
-                    if not q or not q[0]:
-                        # SLP might have started and not ready yet
-                        # ignore for now
-                        known_peers.discard(peer)
+        try:
+            newmacs = set([])
+            r, _, _ = select.select((net, net4), (), (), 60)
+            # clear known_peers and peerbymacaddress
+            # to avoid stale info getting in...
+            # rely upon the select(0.2) to catch rapid fire and aggregate ip
+            # addresses that come close together
+            # calling code needs to understand deeper context, as snoop
+            # will now yield dupe info over time
+            known_peers = set([])
+            peerbymacaddress = {}
+            neighutil.update_neigh()
+            while r:
+                for s in r:
+                    (rsp, peer) = s.recvfrom(9000)
+                    ip = peer[0].partition('%')[0]
+                    if ip not in neighutil.neightable:
                         continue
-                    # we want to prioritize the very well known services
-                    svcs = []
-                    for svc in q:
-                        if svc in _slp_services:
-                            svcs.insert(0, svc)
-                        else:
-                            svcs.append(svc)
-                    peerbymacaddress[mac] = {
-                        'services': svcs,
-                        'addresses': [peer],
-                    }
-                newmacs.add(mac)
-            r, _, _ = select.select((net, net4), (), (), 0.2)
-        for mac in newmacs:
-            peerbymacaddress[mac]['xid'] = 1
-            _add_attributes(peerbymacaddress[mac])
-            peerbymacaddress[mac]['hwaddr'] = mac
-            handler(peerbymacaddress[mac])
+                    if peer in known_peers:
+                        continue
+                    known_peers.add(peer)
+                    mac = neighutil.neightable[ip]
+                    if mac in peerbymacaddress:
+                        peerbymacaddress[mac]['addresses'].append(peer)
+                    else:
+                        q = query_srvtypes(peer)
+                        if not q or not q[0]:
+                            # SLP might have started and not ready yet
+                            # ignore for now
+                            known_peers.discard(peer)
+                            continue
+                        # we want to prioritize the very well known services
+                        svcs = []
+                        for svc in q:
+                            if svc in _slp_services:
+                                svcs.insert(0, svc)
+                            else:
+                                svcs.append(svc)
+                        peerbymacaddress[mac] = {
+                            'services': svcs,
+                            'addresses': [peer],
+                        }
+                    newmacs.add(mac)
+                r, _, _ = select.select((net, net4), (), (), 0.2)
+            for mac in newmacs:
+                peerbymacaddress[mac]['xid'] = 1
+                _add_attributes(peerbymacaddress[mac])
+                peerbymacaddress[mac]['hwaddr'] = mac
+                handler(peerbymacaddress[mac])
+        except Exception as e:
+            tracelog.log(traceback.format_exc(), ltype=log.DataTypes.event,
+                         event=log.Events.stacktrace)
 
 
 def active_scan(handler):

confluent_server/confluent/discovery/protocols/ssdp.py

@@ -191,7 +191,6 @@ def _parse_ssdp(peer, rsp, peerdata):
         _, code, _ = headlines[0].split(' ', 2)
     except ValueError:
         return
-    myurl = None
     if code == '200':
         if nid in peerdata:
             peerdatum = peerdata[nid]
@@ -208,7 +207,6 @@ def _parse_ssdp(peer, rsp, peerdata):
             header = header.strip()
             value = value.strip()
             if header == 'AL' or header == 'LOCATION':
-                myurl = value
                 if 'urls' not in peerdatum:
                     peerdatum['urls'] = [value]
                 elif value not in peerdatum['urls']:

confluent_server/confluent/exceptions.py

@@ -68,6 +68,11 @@ class LockedCredentials(ConfluentException):
     _apierrorstr = 'Credential store locked'
 
 
+class DegradedCollective(ConfluentException):
+    # We are in a collective with at least half of the member nodes missing
+    _apierrorstr = 'Collective does not have quorum'
+
+
 class ForbiddenRequest(ConfluentException):
     # The client request is not allowed by authorization engine
     apierrorcode = 403
@@ -101,6 +106,7 @@ class PubkeyInvalid(ConfluentException):
         super(PubkeyInvalid, self).__init__(self, text)
         self.fingerprint = fingerprint
         self.attrname = attribname
+        self.message = text
         bodydata = {'message': text,
                     'event': event,
                     'fingerprint': fingerprint,

confluent_server/confluent/firmwaremanager.py

@@ -21,13 +21,25 @@
 import confluent.exceptions as exc
 import confluent.messages as msg
 import eventlet
+import os
+import pwd
+import socket
 
 updatesbytarget = {}
 uploadsbytarget = {}
+downloadsbytarget = {}
 updatepool = eventlet.greenpool.GreenPool(256)
 
 
-def execupdate(handler, filename, updateobj, type):
+def execupdate(handler, filename, updateobj, type, owner, node):
+    if type != 'ffdc' and not os.path.exists(filename):
+        errstr =  '{0} does not appear to exist on {1}'.format(
+            filename, socket.gethostname())
+        updateobj.handle_progress({'phase': 'error', 'progress': 0.0,
+                                   'detail': errstr})
+        return
+    if type == 'ffdc' and os.path.isdir(filename):
+        filename += '/' + node + '.svcdata'
     try:
         if type == 'firmware':
             completion = handler(filename, progress=updateobj.handle_progress,
@@ -36,6 +48,9 @@ def execupdate(handler, filename, updateobj, type):
             completion = handler(filename, progress=updateobj.handle_progress)
         if completion is None:
             completion = 'complete'
+        if owner:
+            pwent = pwd.getpwnam(owner)
+            os.chown(filename, pwent.pw_uid, pwent.pw_gid)
         updateobj.handle_progress({'phase': completion, 'progress': 100.0})
     except exc.PubkeyInvalid as pi:
         errstr = 'Certificate mismatch detected, does not match value in ' \
@@ -48,18 +63,20 @@ def execupdate(handler, filename, updateobj, type):
 
 class Updater(object):
     def __init__(self, node, handler, filename, tenant=None, name=None,
-                 bank=None, type='firmware'):
+                 bank=None, type='firmware', owner=None):
         self.bank = bank
         self.node = node
         self.phase = 'initializing'
         self.detail = ''
         self.percent = 0.0
         self.updateproc = updatepool.spawn(execupdate, handler, filename,
-                                           self, type)
+                                           self, type, owner, node)
         if type == 'firmware':
             myparty = updatesbytarget
         elif type == 'mediaupload':
             myparty = uploadsbytarget
+        elif type == 'ffdc':
+            myparty = downloadsbytarget
         if (node, tenant) not in myparty:
             myparty[(node, tenant)] = {}
         if name is None:
@@ -89,6 +106,8 @@ def remove_updates(nodes, tenant, element, type='firmware'):
     upid = element[-1]
     if type == 'firmware':
         myparty = updatesbytarget
+    elif type == 'ffdc':
+        myparty = downloadsbytarget
     else:
         myparty = uploadsbytarget
     for node in nodes:
@@ -108,6 +127,9 @@ def list_updates(nodes, tenant, element, type='firmware'):
     if type == 'mediaupload':
         myparty = uploadsbytarget
         verb = 'upload'
+    elif type == 'ffdc':
+        verb = 'download'
+        myparty = downloadsbytarget
     else:
         myparty = updatesbytarget
         verb = 'update'

confluent_server/confluent/httpapi.py

@@ -785,7 +785,7 @@ def serve(bind_host, bind_port):
                 ' a second\n')
             eventlet.sleep(1)
     eventlet.wsgi.server(sock, resourcehandler, log=False, log_output=False,
-                         debug=False)
+                         debug=False, socket_timeout=60)
 
 
 class HttpApi(object):

confluent_server/confluent/main.py

@@ -33,6 +33,7 @@ import confluent.consoleserver as consoleserver
 import confluent.core as confluentcore
 import confluent.httpapi as httpapi
 import confluent.log as log
+import confluent.collective.manager as collective
 try:
     import confluent.sockapi as sockapi
 except ImportError:
@@ -228,6 +229,7 @@ def run():
         _updatepidfile()
     signal.signal(signal.SIGINT, terminate)
     signal.signal(signal.SIGTERM, terminate)
+    collective.startup()
     if dbgif:
         oumask = os.umask(0077)
         try:

confluent_server/confluent/messages.py

@@ -397,6 +397,9 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
     elif (path[:3] == ['configuration', 'management_controller', 'identifier']
             and operation != 'retrieve'):
         return InputMCI(path, nodes, inputdata)
+    elif (path[:3] == ['configuration', 'management_controller', 'hostname']
+            and operation != 'retrieve'):
+        return InputHostname(path, nodes, inputdata, configmanager)
     elif (path[:4] == ['configuration', 'management_controller',
             'net_interfaces', 'management'] and operation != 'retrieve'):
         return InputNetworkConfiguration(path, nodes, inputdata,
@@ -413,12 +416,17 @@ def get_input_message(path, operation, inputdata, nodes=None, multinode=False,
     elif (path[:3] == ['configuration', 'system', 'all'] and
             operation != 'retrieve'):
         return InputConfigChangeSet(path, inputdata, nodes, configmanager)
+    elif (path[:3] == ['configuration', 'system', 'clear'] and
+            operation != 'retrieve'):
+        return InputConfigClear(path, inputdata, nodes, configmanager)
     elif 'inventory/firmware/updates/active' in '/'.join(path) and inputdata:
         return InputFirmwareUpdate(path, nodes, inputdata)
     elif '/'.join(path).startswith('media/detach'):
         return DetachMedia(path, nodes, inputdata)
     elif '/'.join(path).startswith('media/') and inputdata:
         return InputMedia(path, nodes, inputdata)
+    elif '/'.join(path).startswith('support/servicedata') and inputdata:
+        return InputMedia(path, nodes, inputdata)
     elif inputdata:
         raise exc.InvalidArgumentException(
             'No known input handler for request')
@@ -487,6 +495,13 @@ class InputExpression(ConfluentMessage):
         nodeattr = deepcopy(self.nodeattribs[node])
         return nodeattr
 
+class InputConfigClear(ConfluentMessage):
+    def __init__(self, path, inputdata, nodes=None, configmanager=None):
+        if not inputdata:
+            raise exc.InvalidArgumentException('no request data provided')
+        if 'clear' not in inputdata or not inputdata['clear']:
+            raise exc.InvalidArgumentException('Input must be {"clear":true}')
+
 class InputConfigChangeSet(InputExpression):
     # For now, this is identical to InputExpression, later it may
     # internalize formula expansion, but not now..
@@ -719,6 +734,25 @@ class InputBMCReset(ConfluentInputMessage):
         return self.inputbynode[node]
 
 
+
+class InputHostname(ConfluentInputMessage):
+    def __init__(self, path, nodes, inputdata, configmanager):
+        self.inputbynode = {}
+        self.stripped = False
+        if not inputdata or 'hostname' not in inputdata:
+            raise exc.InvalidArgumentException('missing hostname attribute')
+        if nodes is None:
+            raise exc.InvalidArgumentException(
+                'This only supports per-node input')
+        for expanded in configmanager.expand_attrib_expression(
+                nodes, inputdata['hostname']):
+            node, value = expanded
+            self.inputbynode[node] = value
+
+    def hostname(self, node):
+        return self.inputbynode[node]
+
+
 class InputMCI(ConfluentInputMessage):
     def __init__(self, path, nodes, inputdata):
         self.inputbynode = {}
@@ -1298,6 +1332,17 @@ class MCI(ConfluentMessage):
             self.kvpairs = {name: kv}
 
 
+class Hostname(ConfluentMessage):
+    def __init__(self, name=None, hostname=None):
+        self.notnode = name is None
+        self.desc = 'BMC hostname'
+
+        kv = {'hostname': {'value': hostname}}
+        if self.notnode:
+            self.kvpairs = kv
+        else:
+            self.kvpairs = {name: kv}
+
 class DomainName(ConfluentMessage):
     def __init__(self, name=None, dn=None):
         self.notnode = name is None

confluent_server/confluent/netutil.py

@@ -122,4 +122,28 @@ def get_prefix_len_for_ip(ip):
                 nbits += 1
                 maskn = maskn << 1 & 0xffffffff
             return nbits
-    raise exc.NotImplementedException("Non local addresses not supported")
+    raise exc.NotImplementedException("Non local addresses not supported")
+
+def addresses_match(addr1, addr2):
+    """Check two network addresses for similarity
+
+    Is it zero padded in one place, not zero padded in another?  Is one place by name and another by IP??
+    Is one context getting a normal IPv4 address and another getting IPv4 in IPv6 notation?
+    This function examines the two given names, performing the required changes to compare them for equivalency
+
+    :param addr1:
+    :param addr2:
+    :return: True if the given addresses refer to the same thing
+    """
+    for addrinfo in socket.getaddrinfo(addr1, 0, 0, socket.SOCK_STREAM):
+        rootaddr1 = socket.inet_pton(addrinfo[0], addrinfo[4][0])
+        if addrinfo[0] == socket.AF_INET6 and rootaddr1[:12] == b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff':
+            # normalize to standard IPv4
+            rootaddr1 = rootaddr1[-4:]
+        for otherinfo in socket.getaddrinfo(addr2, 0, 0, socket.SOCK_STREAM):
+            otheraddr = socket.inet_pton(otherinfo[0], otherinfo[4][0])
+            if otherinfo[0] == socket.AF_INET6 and otheraddr[:12] == b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff':
+                otheraddr = otheraddr[-4:]
+            if otheraddr == rootaddr1:
+                return True
+    return False

confluent_server/confluent/networking/lldp.py

@@ -88,7 +88,7 @@ _chassisidbyswitch = {}
 
 def lenovoname(idx, desc):
     if desc.isdigit():
-        return 'Ethernet' + str(idx)
+        return 'Ethernet' + str(desc)
     return desc
 
 nameoverrides = [
@@ -151,6 +151,9 @@ def _extract_extended_desc(info, source, integritychecked):
         info['peerdescription'] = source
 
 def sanitize(val):
+    # This is pretty much the same approach net-snmp takes.
+    # if the string is printable as-is, then just give it as-is
+    # if the string has non-printable, then hexify it
     val = str(val)
     for x in val.strip('\x00'):
         if ord(x) < 32 or ord(x) > 128:
@@ -161,14 +164,14 @@ def sanitize(val):
 def _init_lldp(data, iname, idx, idxtoportid, switch):
     if iname not in data:
         data[iname] = {'port': iname, 'portid': str(idxtoportid[idx]),
-                       'chassisid': str(_chassisidbyswitch[switch])}
+                       'chassisid': _chassisidbyswitch[switch]}
 
 def _extract_neighbor_data_b(args):
     """Build LLDP data about elements connected to switch
 
     args are carried as a tuple, because of eventlet convenience
     """
-    switch, password, user, force = args
+    switch, password, user, force = args[:4]
     vintage = _neighdata.get(switch, {}).get('!!vintage', 0)
     now = util.monotonic_time()
     if vintage > (now - 60) and not force:
@@ -180,7 +183,8 @@ def _extract_neighbor_data_b(args):
         sid = str(sysid[1][6:])
     idxtoifname = {}
     idxtoportid = {}
-    _chassisidbyswitch[switch] = list(conn.walk('1.0.8802.1.1.2.1.3.2'))[0][1]
+    _chassisidbyswitch[switch] = sanitize(list(
+        conn.walk('1.0.8802.1.1.2.1.3.2'))[0][1])
     for oidindex in conn.walk('1.0.8802.1.1.2.1.3.7.1.3'):
         idx = oidindex[0][-1]
         idxtoportid[idx] = sanitize(oidindex[1])
@@ -216,17 +220,19 @@ def _extract_neighbor_data_b(args):
     _neighdata[switch] = lldpdata
 
 
-def update_switch_data(switch, configmanager, force=False):
+def update_switch_data(switch, configmanager, force=False, retexc=False):
     switchcreds = netutil.get_switchcreds(configmanager, (switch,))[0]
-    _extract_neighbor_data(switchcreds + (force,))
+    ndr = _extract_neighbor_data(switchcreds + (force, retexc))
+    if retexc and isinstance(ndr, Exception):
+        raise ndr
     return _neighdata.get(switch, {})
 
 
-def update_neighbors(configmanager, force=False):
-    return _update_neighbors_backend(configmanager, force)
+def update_neighbors(configmanager, force=False, retexc=False):
+    return _update_neighbors_backend(configmanager, force, retexc)
 
 
-def _update_neighbors_backend(configmanager, force):
+def _update_neighbors_backend(configmanager, force, retexc):
     global _neighdata
     global _neighbypeerid
     vintage = _neighdata.get('!!vintage', 0)
@@ -237,7 +243,7 @@ def _update_neighbors_backend(configmanager, force):
     _neighbypeerid = {'!!vintage': now}
     switches = netutil.list_switches(configmanager)
     switchcreds = netutil.get_switchcreds(configmanager, switches)
-    switchcreds = [ x + (force,) for x in switchcreds]
+    switchcreds = [ x + (force, retexc) for x in switchcreds]
     pool = GreenPool(64)
     for ans in pool.imap(_extract_neighbor_data, switchcreds):
         yield ans
@@ -254,9 +260,15 @@ def _extract_neighbor_data(args):
         return
     try:
         with _updatelocks[switch]:
-            _extract_neighbor_data_b(args)
-    except Exception:
-        log.logtrace()
+            return _extract_neighbor_data_b(args)
+    except Exception as e:
+        yieldexc = False
+        if len(args) >= 5:
+            yieldexc = args[4]
+        if yieldexc:
+            return e
+        else:
+            log.logtrace()
 
 if __name__ == '__main__':
     # a quick one-shot test, args are switch and snmpv1 string for now
@@ -323,7 +335,9 @@ def _handle_neighbor_query(pathcomponents, configmanager):
         # guaranteed
         if (parms['by-peerid'] not in _neighbypeerid and
                 _neighbypeerid.get('!!vintage', 0) < util.monotonic_time() - 60):
-            list(update_neighbors(configmanager))
+            for x in update_neighbors(configmanager, retexc=True):
+                if isinstance(x, Exception):
+                    raise x
         if parms['by-peerid'] not in _neighbypeerid:
             raise exc.NotFoundException('No matching peer known')
         return _dump_neighbordatum(_neighbypeerid[parms['by-peerid']])
@@ -332,9 +346,11 @@ def _handle_neighbor_query(pathcomponents, configmanager):
     if listrequested not in multi_selectors | single_selectors:
         raise exc.NotFoundException('{0} is not found'.format(listrequested))
     if 'by-switch' in parms:
-        update_switch_data(parms['by-switch'], configmanager)
+        update_switch_data(parms['by-switch'], configmanager, retexc=True)
     else:
-        list(update_neighbors(configmanager))
+        for x in update_neighbors(configmanager, retexc=True):
+            if isinstance(x, Exception):
+                raise x
     return list_info(parms, listrequested)
 
 

confluent_server/confluent/networking/macmap.py

@@ -47,6 +47,7 @@ import eventlet.semaphore
 import re
 
 _macmap = {}
+_apimacmap = {}
 _macsbyswitch = {}
 _nodesbymac = {}
 _switchportmap = {}
@@ -211,7 +212,7 @@ def _map_switch_backend(args):
                 maccounts[ifname] = 1
             else:
                 maccounts[ifname] += 1
-    _macsbyswitch[switch] = {}
+    newmacs = {}
     for mac in mactobridge:
         # We want to merge it so that when a mac appears in multiple
         # places, it is captured.
@@ -223,10 +224,10 @@ def _map_switch_backend(args):
             _macmap[mac].append((switch, ifname, maccounts[ifname]))
         else:
             _macmap[mac] = [(switch, ifname, maccounts[ifname])]
-        if ifname in _macsbyswitch[switch]:
-            _macsbyswitch[switch][ifname].append(mac)
+        if ifname in newmacs:
+            newmacs[ifname].append(mac)
         else:
-            _macsbyswitch[switch][ifname] = [mac]
+            newmacs[ifname] = [mac]
         nodename = _nodelookup(switch, ifname)
         if nodename is not None:
             if mac in _nodesbymac and _nodesbymac[mac][0] != nodename:
@@ -238,6 +239,7 @@ def _map_switch_backend(args):
                 _nodesbymac[mac] = (None, None)
             else:
                 _nodesbymac[mac] = (nodename, maccounts[ifname])
+    _macsbyswitch[switch] = newmacs
 
 
 switchbackoff = 30
@@ -295,6 +297,7 @@ def _finish_update(completions):
 
 def _full_updatemacmap(configmanager):
     global vintage
+    global _apimacmap
     global _macmap
     global _nodesbymac
     global _switchportmap
@@ -307,7 +310,6 @@ def _full_updatemacmap(configmanager):
         _macmap = {}
         _nodesbymac = {}
         _switchportmap = {}
-        _macsbyswitch = {}
         if configmanager.tenant is not None:
             raise exc.ForbiddenRequest(
                 'Network topology not available to tenants')
@@ -340,11 +342,15 @@ def _full_updatemacmap(configmanager):
                         _switchportmap[curswitch][portname] = None
                     else:
                         _switchportmap[curswitch][portname] = node
+        for switch in _macsbyswitch:
+            if switch not in switches:
+                del _macsbyswitch[switch]
         switchauth = get_switchcreds(configmanager, switches)
         pool = GreenPool(64)
         for ans in pool.imap(_map_switch, switchauth):
             vintage = util.monotonic_time()
             yield ans
+    _apimacmap = _macmap
     endtime = util.monotonic_time()
     duration = endtime - start
     duration = duration * 15  # wait 15 times as long as it takes to walk
@@ -424,7 +430,7 @@ def handle_read_api_request(pathcomponents, configmanager):
     elif pathcomponents[2] == 'by-mac':
         if len(pathcomponents) == 3:
             return [msg.ChildCollection(x.replace(':', '-'))
-                    for x in sorted(list(_macmap))]
+                    for x in sorted(list(_apimacmap))]
         elif len(pathcomponents) == 4:
             return dump_macinfo(pathcomponents[-1])
     elif pathcomponents[2] == 'by-switch':
@@ -457,12 +463,14 @@ def handle_read_api_request(pathcomponents, configmanager):
                     for x in sorted(maclist)]
         if len(pathcomponents) == 8:
             return dump_macinfo(pathcomponents[-1])
+    elif pathcomponents[2] == 'rescan':
+        return [msg.KeyValueData({'scanning': mapupdating.locked()})]
     raise exc.NotFoundException('Unrecognized path {0}'.format(
         '/'.join(pathcomponents)))
 
 
 def dump_macinfo(macaddr):
-    macaddr = macaddr.replace('-', ':')
+    macaddr = macaddr.replace('-', ':').lower()
     info = _macmap.get(macaddr, None)
     if info is None:
         raise exc.NotFoundException(

confluent_server/confluent/plugins/configuration/attributes.py

@@ -20,6 +20,7 @@ import confluent.util as util
 
 
 def retrieve(nodes, element, configmanager, inputdata):
+    configmanager.check_quorum()
     if nodes is not None:
         return retrieve_nodes(nodes, element, configmanager, inputdata)
     elif element[0] == 'nodegroups':
@@ -183,8 +184,10 @@ def _expand_expression(nodes, configmanager, inputdata):
             pernodeexpressions[expanded[0]] = expanded[1]
         for node in util.natural_sort(pernodeexpressions):
             yield msg.KeyValueData({'value': pernodeexpressions[node]}, node)
-    except ValueError as e:
-        raise exc.InvalidArgumentException(str(e))
+    except (SyntaxError, ValueError) as e:
+        raise exc.InvalidArgumentException(
+            'Bad confluent expression syntax (must use "{{" and "}}" if not '
+            'desiring confluent expansion): ' + str(e))
 
 
 

confluent_server/confluent/plugins/hardwaremanagement/ipmi.py

@@ -19,12 +19,14 @@ import confluent.firmwaremanager as firmwaremanager
 import confluent.interface.console as conapi
 import confluent.messages as msg
 import confluent.util as util
+import copy
 import eventlet
 import eventlet.event
 import eventlet.green.threading as threading
 import eventlet.greenpool as greenpool
 import eventlet.queue as queue
 import eventlet.support.greendns
+from fnmatch import fnmatch
 import pyghmi.constants as pygconstants
 import pyghmi.exceptions as pygexc
 console = eventlet.import_patched('pyghmi.ipmi.console')
@@ -32,6 +34,37 @@ ipmicommand = eventlet.import_patched('pyghmi.ipmi.command')
 import socket
 import ssl
 
+pci_cache = {}
+
+def get_dns_txt(qstring):
+    return eventlet.support.greendns.resolver.query(
+        qstring, 'TXT')[0].strings[0].replace('i=', '')
+
+def get_pci_text_from_ids(subdevice, subvendor, device, vendor):
+    fqpi = '{0}.{1}.{2}.{3}'.format(subdevice, subvendor, device, vendor)
+    if fqpi in pci_cache:
+        return pci_cache[fqpi]
+    vendorstr = None
+    try:
+        vendorstr = get_dns_txt('{0}.pci.id.ucw.cz'.format(subvendor))
+    except Exception:
+        try:
+            vendorstr = get_dns_txt('{0}.pci.id.ucw.cz'.format(vendor))
+        except Exception:
+            pass
+    devstr = None
+    try:
+        devstr = get_dns_txt(fqpi + '.pci.id.ucw.cz')
+    except Exception:
+        try:
+            devstr = get_dns_txt('{0}.{1}.pci.id.ucw.cz'.format(
+                device, vendor))
+        except Exception:
+            pass
+    if vendorstr and devstr:
+        pci_cache[fqpi] = vendorstr, devstr
+    return vendorstr, devstr
+
 
 # There is something not right with the RLocks used in pyghmi when
 # eventlet comes into play.  It seems like sometimes on acquire,
@@ -132,7 +165,7 @@ class IpmiCommandWrapper(ipmicommand.Command):
         self._inhealth = False
         self._lasthealth = None
         self._attribwatcher = cfm.watch_attributes(
-            (node,), ('secret.hardwaremanagementuser',
+            (node,), ('secret.hardwaremanagementuser', 'collective.manager',
                       'secret.hardwaremanagementpassword', 'secret.ipmikg',
                       'hardwaremanagement.manager'), self._attribschanged)
         super(self.__class__, self).__init__(**kwargs)
@@ -270,13 +303,17 @@ class IpmiConsole(conapi.Console):
                                                  kg=self.kg, force=True,
                                                  iohandler=self.handle_data)
             self.solconnection.outputlock = NullLock()
-            while not self.solconnection.connected and not self.broken:
+            while (self.solconnection and not self.solconnection.connected and
+                   not (self.broken or self.solconnection.broken or
+                        self.solconnection.ipmi_session.broken)):
                 w = eventlet.event.Event()
                 _ipmiwaiters.append(w)
-                w.wait()
-                if self.broken:
-                    break
-            if self.broken:
+                w.wait(15)
+            if (self.broken or not self.solconnection or
+                    self.solconnection.broken or
+                    self.solconnection.ipmi_session.broken):
+                if not self.error:
+                    self.error = 'Unknown error'
                 if (self.error.startswith('Incorrect password') or
                         self.error.startswith('Unauthorized name')):
                     raise exc.TargetEndpointBadCredentials
@@ -292,6 +329,7 @@ class IpmiConsole(conapi.Console):
             self.solconnection.out_handler = _donothing
             self.solconnection.close()
         self.solconnection = None
+        self.datacallback = None
         self.broken = True
         self.error = "closed"
 
@@ -344,7 +382,7 @@ def perform_request(operator, node, element,
                                cfg, results).handle_request()
         except pygexc.IpmiException as ipmiexc:
             excmsg = str(ipmiexc)
-            if excmsg == 'Session no longer connected':
+            if excmsg in ('Session no longer connected', 'timeout'):
                 results.put(msg.ConfluentTargetTimeout(node))
             else:
                 results.put(msg.ConfluentNodeError(node, excmsg))
@@ -380,6 +418,7 @@ class IpmiHandler(object):
         self.error = None
         eventlet.sleep(0)
         self.cfg = cfd[node]
+        self.current_user = cfg.current_user
         self.loggedin = False
         self.node = node
         self.element = element
@@ -390,7 +429,8 @@ class IpmiHandler(object):
         self.tenant = cfg.tenant
         tenant = cfg.tenant
         if ((node, tenant) not in persistent_ipmicmds or
-                not persistent_ipmicmds[(node, tenant)].ipmi_session.logged):
+                not persistent_ipmicmds[(node, tenant)].ipmi_session.logged or
+                persistent_ipmicmds[(node, tenant)].ipmi_session.broken):
             try:
                 persistent_ipmicmds[(node, tenant)].close_confluent()
             except KeyError:  # was no previous session
@@ -405,9 +445,10 @@ class IpmiHandler(object):
                 ipmisess = persistent_ipmicmds[(node, tenant)].ipmi_session
                 begin = util.monotonic_time()
                 while ((not (self.broken or self.loggedin)) and
-                               (util.monotonic_time() - begin) < 180):
-                    ipmisess.wait_for_rsp(180)
+                               (util.monotonic_time() - begin) < 30):
+                    ipmisess.wait_for_rsp(31 - (util.monotonic_time() - begin))
                 if not (self.broken or self.loggedin):
+                    ipmisess._mark_broken()
                     raise exc.TargetEndpointUnreachable(
                         "Login process to " + connparams['bmc'] + " died")
             except socket.gaierror as ge:
@@ -436,6 +477,10 @@ class IpmiHandler(object):
                 self.output.put(msg.ConfluentTargetTimeout(
                     self.node, self.error))
                 return
+            elif 'Invalid Session ID' in self.error:
+                self.output.put(msg.ConfluentTargetTimeout(
+                    self.node, 'Temporary Login Error'))
+                return
             elif ('Unauthorized' in self.error or
                     'Incorrect password' in self.error):
                 self.output.put(
@@ -475,6 +520,10 @@ class IpmiHandler(object):
             self.decode_alert()
         elif self.element == ['console', 'license']:
             self.handle_license()
+        elif self.element == ['support', 'servicedata']:
+            self.handle_servicedata_fetch()
+        elif self.element == ['description']:
+            self.handle_description()
         else:
             raise Exception('Not Implemented')
 
@@ -494,6 +543,14 @@ class IpmiHandler(object):
         self.output.put(msg.CreatedResource(
             'nodes/{0}/media/uploads/{1}'.format(self.node, u.name)))
 
+    def handle_servicedata_fetch(self):
+        u = firmwaremanager.Updater(
+            self.node, self.ipmicmd.get_diagnostic_data,
+            self.inputdata.filename, self.tenant, type='ffdc',
+            owner=self.current_user)
+        self.output.put(msg.CreatedResource(
+            'nodes/{0}/support/servicedata/{1}'.format(self.node, u.name)))
+
     def handle_attach_media(self):
         try:
             self.ipmicmd.attach_remote_media(self.inputdata.filename)
@@ -518,12 +575,18 @@ class IpmiHandler(object):
             return self.handle_reset()
         elif self.element[1:3] == ['management_controller', 'identifier']:
             return self.handle_identifier()
+        elif self.element[1:3] == ['management_controller', 'hostname']:
+            return self.handle_hostname()
         elif self.element[1:3] == ['management_controller', 'domain_name']:
             return self.handle_domain_name()
         elif self.element[1:3] == ['management_controller', 'ntp']:
             return self.handle_ntp()
         elif self.element[1:3] == ['system', 'all']:
             return self.handle_sysconfig()
+        elif self.element[1:3] == ['system', 'advanced']:
+            return self.handle_sysconfig(True)
+        elif self.element[1:3] == ['system', 'clear']:
+            return self.handle_sysconfigclear()
         raise Exception('Not implemented')
 
     def decode_alert(self):
@@ -595,10 +658,20 @@ class IpmiHandler(object):
                 ))
             elif self.op == 'update':
                 config = self.inputdata.netconfig(self.node)
-                self.ipmicmd.set_net_configuration(
-                                ipv4_address=config['ipv4_address'],
-                                ipv4_configuration=config['ipv4_configuration'],
-                                ipv4_gateway=config['ipv4_gateway'])
+                try:
+                    self.ipmicmd.set_net_configuration(
+                        ipv4_address=config['ipv4_address'],
+                        ipv4_configuration=config['ipv4_configuration'],
+                        ipv4_gateway=config['ipv4_gateway'])
+                except socket.error as se:
+                    self.output.put(msg.ConfluentNodeError(self.node,
+                                                           se.message))
+                except ValueError as e:
+                    if e.message == 'negative shift count':
+                        self.output.put(msg.ConfluentNodeError(
+                            self.node, 'Invalid prefix length given'))
+                    else:
+                        raise
 
     def handle_users(self):
         # Create user
@@ -800,12 +873,14 @@ class IpmiHandler(object):
             if component == 'all':
                 for invdata in self.ipmicmd.get_inventory():
                     if invdata[1] is None:
-                        newinf = {'present': False, 'information': None}
+                        newinf = {'present': False, 'information': None,
+                                  'name': invdata[0]}
+
                     else:
                         sanitize_invdata(invdata[1])
                         newinf = {'present': True, 'information': invdata[1]}
-                    newinf['name'] = invdata[0]
-                    invitems.append(newinf)
+                        newinf['name'] = invdata[1].get('name', invdata[0])
+                    self.add_invitem(invitems, newinf)
             else:
                 self.make_inventory_map()
                 compname = self.invmap.get(component, None)
@@ -814,12 +889,13 @@ class IpmiHandler(object):
                     return
                 invdata = self.ipmicmd.get_inventory_of_component(compname)
                 if invdata is None:
-                    newinf = {'present': False, 'information': None}
+                    newinf = {'present': False, 'information': None,
+                              'name': compname}
                 else:
                     sanitize_invdata(invdata)
-                    newinf = {'present': True, 'information': invdata}
-                newinf['name'] = compname
-                invitems.append(newinf)
+                    newinf = {'present': True, 'information': invdata,
+                              'name': invdata.get('name', compname)}
+                self.add_invitem(invitems, newinf)
         except ssl.SSLEOFError:
             errorneeded = msg.ConfluentNodeError(
                 self.node, 'Unable to communicate with the https server on '
@@ -836,6 +912,24 @@ class IpmiHandler(object):
         if errorneeded:
             self.output.put(errorneeded)
 
+    def add_invitem(self, invitems, newinf):
+        if newinf.get('information', None) and 'name' in newinf['information']:
+            newinf = copy.deepcopy(newinf)
+            del newinf['information']['name']
+        if fnmatch(newinf['name'], 'Adapter ??:??:??') or fnmatch(
+                newinf['name'], 'PCIeGen? x*'):
+            myinf = newinf.get('information', {})
+            sdid = myinf.get('PCI Subsystem Device ID', None)
+            svid = myinf.get('PCI Subsystem Vendor ID', None)
+            did = myinf.get('PCI Device ID', None)
+            vid = myinf.get('PCI Vendor ID', None)
+            vstr, dstr = get_pci_text_from_ids(sdid, svid, did, vid)
+            if vstr:
+                newinf['information']['PCI Vendor'] = vstr
+            if dstr:
+                newinf['name'] = dstr
+        invitems.append(newinf)
+
     def handle_sensors(self):
         if self.element[-1] == '':
             self.element = self.element[:-1]
@@ -986,6 +1080,16 @@ class IpmiHandler(object):
             self.ipmicmd.set_mci(mci)
             return
 
+    def handle_hostname(self):
+        if 'read' == self.op:
+            hostname = self.ipmicmd.get_hostname()
+            self.output.put(msg.Hostname(self.node, hostname))
+            return
+        elif 'update' == self.op:
+            hostname = self.inputdata.hostname(self.node)
+            self.ipmicmd.set_hostname(hostname)
+            return
+
     def handle_domain_name(self):
         if 'read' == self.op:
             dn = self.ipmicmd.get_domain_name()
@@ -996,10 +1100,17 @@ class IpmiHandler(object):
             self.ipmicmd.set_domain_name(dn)
             return
 
-    def handle_sysconfig(self):
+    def handle_sysconfigclear(self):
+        if 'read' == self.op:
+            raise exc.InvalidArgumentException(
+                'Cannot read the "clear" resource')
+        self.ipmicmd.clear_system_configuration()
+
+    def handle_sysconfig(self, advanced=False):
         if 'read' == self.op:
             self.output.put(msg.ConfigSet(
-                self.node, self.ipmicmd.get_system_configuration()))
+                self.node, self.ipmicmd.get_system_configuration(
+                    hideadvanced=not advanced)))
         elif 'update' == self.op:
             self.ipmicmd.set_system_configuration(
                 self.inputdata.get_attributes(self.node))
@@ -1054,6 +1165,11 @@ class IpmiHandler(object):
         self.output.put(msg.License(self.node, available))
         return
 
+    def handle_description(self):
+        dsc = self.ipmicmd.get_description()
+        self.output.put(msg.KeyValueData(dsc, self.node))
+
+
 def _str_health(health):
     if isinstance(health, str):
         return health
@@ -1098,6 +1214,9 @@ def retrieve(nodes, element, configmanager, inputdata):
     elif '/'.join(element).startswith('media/uploads'):
         return firmwaremanager.list_updates(nodes, configmanager.tenant,
                                             element, 'mediaupload')
+    elif '/'.join(element).startswith('support/servicedata'):
+        return firmwaremanager.list_updates(nodes, configmanager.tenant,
+                                            element, 'ffdc')
     else:
         return perform_requests('read', nodes, element, configmanager, inputdata)
 
@@ -1109,5 +1228,8 @@ def delete(nodes, element, configmanager, inputdata):
     elif '/'.join(element).startswith('media/uploads'):
         return firmwaremanager.remove_updates(nodes, configmanager.tenant,
                                               element, type='mediaupload')
+    elif '/'.join(element).startswith('support/servicedata'):
+        return firmwaremanager.remove_updates(nodes, configmanager.tenant,
+                                              element, type='ffdc')
     return perform_requests(
         'delete', nodes, element, configmanager, inputdata)

confluent_server/confluent/plugins/shell/ssh.py

@@ -1,6 +1,6 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
-# Copyright 2015 Lenovo
+# Copyright 2015-2018 Lenovo
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,9 +22,22 @@
 import confluent.exceptions as cexc
 import confluent.interface.console as conapi
 import confluent.log as log
+import cryptography
+
 import eventlet
 import hashlib
+import sys
+sys.modules['gssapi'] = None
 paramiko = eventlet.import_patched('paramiko')
+warnhostkey = False
+if cryptography.__version__.split('.') < ['1', '5']:
+    # older cryptography with paramiko breaks most key support except
+    # ed25519
+    warnhostkey = True
+    paramiko.transport.Transport._preferred_keys = filter(
+        lambda x: 'ed25519' in x,
+        paramiko.transport.Transport._preferred_keys)
+
 
 
 class HostKeyHandler(paramiko.client.MissingHostKeyPolicy):
@@ -63,6 +76,7 @@ class SshShell(conapi.Console):
     def __init__(self, node, config, username='', password=''):
         self.node = node
         self.ssh = None
+        self.datacallback = None
         self.nodeconfig = config
         self.username = username
         self.password = password
@@ -109,6 +123,26 @@ class SshShell(conapi.Console):
             self.username = ''
             self.password = ''
             self.datacallback('\r\nlogin as: ')
+            return
+        except cexc.PubkeyInvalid as pi:
+            self.keyaction = ''
+            self.candidatefprint = pi.fingerprint
+            self.datacallback(pi.message)
+            self.keyattrname = pi.attrname
+            self.datacallback('\r\nNew fingerprint: ' + pi.fingerprint)
+            self.inputmode = -1
+            self.datacallback('\r\nEnter "disconnect" or "accept": ')
+            return
+        except paramiko.SSHException as pi:
+            self.inputmode = -2
+            warn = str(pi)
+            if warnhostkey:
+                warn += ' (Older cryptography package on this host only ' \
+                        'works with ed25519, check ssh startup on target ' \
+                        'and permissions on /etc/ssh/*key)\r\n' \
+                        'Press Enter to close...'
+            self.datacallback('\r\n' + warn)
+
             return
         self.inputmode = 2
         self.connected = True
@@ -116,7 +150,36 @@ class SshShell(conapi.Console):
         self.rxthread = eventlet.spawn(self.recvdata)
 
     def write(self, data):
-        if self.inputmode == 0:
+        if self.inputmode == -2:
+            self.datacallback(conapi.ConsoleEvent.Disconnect)
+            return
+        elif self.inputmode == -1:
+            while len(data) and data[0] == b'\x7f' and len(self.keyaction):
+                self.datacallback('\b \b')  # erase previously echoed value
+                self.keyaction = self.keyaction[:-1]
+                data = data[1:]
+            while len(data) and data[0] == b'\x7f':
+                data = data[1:]
+            while b'\x7f' in data:
+                delidx = data.index(b'\x7f')
+                data = data[:delidx - 1] + data[delidx + 1:]
+            self.keyaction += data
+            if '\r' in self.keyaction:
+                action = self.keyaction.split('\r')[0]
+                if action.lower() == 'accept':
+                    self.nodeconfig.set_node_attributes(
+                        {self.node:
+                             {self.keyattrname: self.candidatefprint}})
+                    self.datacallback('\r\n')
+                    self.logon()
+                elif action.lower() == 'disconnect':
+                    self.datacallback(conapi.ConsoleEvent.Disconnect)
+                else:
+                    self.keyaction = ''
+                    self.datacallback('\r\nEnter "disconnect" or "accept": ')
+            elif len(data) > 0:
+                self.datacallback(data)
+        elif self.inputmode == 0:
             while len(data) and data[0] == b'\x7f' and len(self.username):
                 self.datacallback('\b \b')  # erase previously echoed value
                 self.username = self.username[:-1]
@@ -128,7 +191,7 @@ class SshShell(conapi.Console):
                 data = data[:delidx - 1] + data[delidx + 1:]
             self.username += data
             if '\r' in self.username:
-                self.username, self.password = self.username.split('\r')
+                self.username, self.password = self.username.split('\r')[:2]
                 lastdata = data.split('\r')[0]
                 if lastdata != '':
                     self.datacallback(lastdata)
@@ -155,6 +218,7 @@ class SshShell(conapi.Console):
     def close(self):
         if self.ssh is not None:
             self.ssh.close()
+        self.datacallback = None
 
 def create(nodes, element, configmanager, inputdata):
     if len(nodes) == 1:

confluent_server/confluent/shellmodule.py

@@ -116,6 +116,7 @@ class ExecConsole(conapi.Console):
                 break
         if self.subproc is not None and self.subproc.poll() is None:
             self.subproc.kill()
+        self._datacallback = None
 
 
 class Plugin(object):

confluent_server/confluent/shellserver.py

@@ -30,6 +30,9 @@ class _ShellHandler(consoleserver.ConsoleHandler):
     _genwatchattribs = False
     _logtobuffer = False
 
+    def check_collective(self, attrvalue):
+        return
+
     def log(self, *args, **kwargs):
         # suppress logging through proving a stub 'log' function
         return

confluent_server/confluent/snmputil.py

@@ -92,13 +92,22 @@ class Session(object):
                 errstr, errnum, erridx, answers = rsp
                 if errstr:
                     errstr = str(errstr)
-                    if errstr in ('unknownUserName', 'wrongDigest'):
-                        raise exc.TargetEndpointBadCredentials(errstr)
+                    finerr = errstr + ' while trying to connect to ' \
+                                      '{0}'.format(self.server)
+                    if errstr in ('Unknown USM user', 'unknownUserName',
+                                  'wrongDigest', 'Wrong SNMP PDU digest'):
+                        raise exc.TargetEndpointBadCredentials(finerr)
                     # need to do bad credential versus timeout
-                    raise exc.TargetEndpointUnreachable(errstr)
+                    raise exc.TargetEndpointUnreachable(finerr)
                 elif errnum:
-                    raise exc.ConfluentException(errnum.prettyPrint())
+                    raise exc.ConfluentException(errnum.prettyPrint() +
+                                                 ' while trying to connect to '
+                                                 '{0}'.format(self.server))
                 for ans in answers:
+                    if not obj[0].isPrefixOf(ans[0]):
+                        # PySNMP returns leftovers in a bulk command
+                        # filter out such leftovers
+                        break
                     yield ans
         except snmperr.WrongValueError:
             raise exc.TargetEndpointBadCredentials('Invalid SNMPv3 password')

confluent_server/confluent/sockapi.py

@@ -21,6 +21,8 @@
 #
 
 import atexit
+import ctypes
+import ctypes.util
 import errno
 import os
 import pwd
@@ -29,6 +31,7 @@ import struct
 import sys
 import traceback
 
+import eventlet.green.select as select
 import eventlet.green.socket as socket
 import eventlet.green.ssl as ssl
 import eventlet
@@ -41,7 +44,8 @@ import confluent.exceptions as exc
 import confluent.log as log
 import confluent.core as pluginapi
 import confluent.shellserver as shellserver
-
+import confluent.collective.manager as collective
+import confluent.util as util
 
 tracelog = None
 auditlog = None
@@ -54,6 +58,22 @@ except AttributeError:
     else:
         SO_PEERCRED = 17
 
+try:
+    # Python core TLS despite improvements still has no support for custom
+    # verify functions.... try to use PyOpenSSL where available to support
+    # client certificates with custom verify
+    import eventlet.green.OpenSSL.SSL as libssl
+    # further, not even pyopenssl exposes SSL_CTX_set_cert_verify_callback
+    # so we need to ffi that in using a strategy compatible with PyOpenSSL
+    import OpenSSL.SSL as libssln
+    import OpenSSL.crypto as crypto
+    from OpenSSL._util import ffi
+except ImportError:
+    libssl = None
+    ffi = None
+    crypto = None
+
+plainsocket = None
 
 class ClientConsole(object):
     def __init__(self, client):
@@ -82,7 +102,7 @@ def send_data(connection, data):
             raise
 
 
-def sessionhdl(connection, authname, skipauth=False):
+def sessionhdl(connection, authname, skipauth=False, cert=None):
     # For now, trying to test the console stuff, so let's just do n4.
     authenticated = False
     authdata = None
@@ -99,6 +119,15 @@ def sessionhdl(connection, authname, skipauth=False):
     while not authenticated:  # prompt for name and passphrase
         send_data(connection, {'authpassed': 0})
         response = tlvdata.recv(connection)
+        if 'collective' in response:
+            return collective.handle_connection(connection, cert,
+                                           response['collective'])
+        if 'dispatch' in response:
+            dreq = tlvdata.recvall(connection, response['dispatch']['length'])
+            return pluginapi.handle_dispatch(connection, cert, dreq,
+                                             response['dispatch']['name'])
+        if 'proxyconsole' in response:
+            return start_proxy_term(connection, cert, response['proxyconsole'])
         authname = response['username']
         passphrase = response['password']
         # note(jbjohnso): here, we need to authenticate, but not
@@ -114,6 +143,18 @@ def sessionhdl(connection, authname, skipauth=False):
             cfm = authdata[1]
     send_data(connection, {'authpassed': 1})
     request = tlvdata.recv(connection)
+    if 'collective' in request and skipauth:
+        if not libssl:
+            tlvdata.send(
+                connection,
+                {'collective': {'error': 'Server either does not have '
+                                         'python-pyopenssl installed or has an '
+                                         'incorrect version installed '
+                                         '(e.g. pyOpenSSL would need to be '
+                                         'replaced with python-pyopenssl)'}})
+            return
+        return collective.handle_connection(connection, None, request['collective'],
+                                     local=True)
     while request is not None:
         try:
             process_request(
@@ -172,7 +213,7 @@ def process_request(connection, request, cfm, authdata, authname, skipauth):
         if operation == 'start':
             return start_term(authname, cfm, connection, params, path,
                               authdata, skipauth)
-        elif operation == 'shutdown':
+        elif operation == 'shutdown' and skipauth:
             configmanager.ConfigManager.shutdown()
         else:
             hdlr = pluginapi.handle_path(path, operation, cfm, params)
@@ -187,6 +228,19 @@ def process_request(connection, request, cfm, authdata, authname, skipauth):
     send_response(hdlr, connection)
     return
 
+def start_proxy_term(connection, cert, request):
+    cert = crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
+    droneinfo = configmanager.get_collective_member(request['name'])
+    if not util.cert_matches(droneinfo['fingerprint'], cert):
+        connection.close()
+        return
+    cfm = configmanager.ConfigManager(request['tenant'])
+    ccons = ClientConsole(connection)
+    consession = consoleserver.ConsoleSession(
+        node=request['node'], configmanager=cfm, username=request['user'],
+        datacallback=ccons.sendall, skipreplay=request['skipreplay'],
+        direct=False)
+    term_interact(None, None, ccons, None, connection, consession, None)
 
 def start_term(authname, cfm, connection, params, path, authdata, skipauth):
     elems = path.split('/')
@@ -210,12 +264,16 @@ def start_term(authname, cfm, connection, params, path, authdata, skipauth):
             node=node, configmanager=cfm, username=authname,
             datacallback=ccons.sendall, skipreplay=skipreplay,
             sessionid=sessionid)
-
     else:
         raise exc.InvalidArgumentException('Invalid path {0}'.format(path))
-
     if consession is None:
         raise Exception("TODO")
+    term_interact(authdata, authname, ccons, cfm, connection, consession,
+                  skipauth)
+
+
+def term_interact(authdata, authname, ccons, cfm, connection, consession,
+                  skipauth):
     send_data(connection, {'started': 1})
     ccons.startsending()
     bufferage = consession.get_buffer_age()
@@ -226,7 +284,7 @@ def start_term(authname, cfm, connection, params, path, authdata, skipauth):
         if type(data) == dict:
             if data['operation'] == 'stop':
                 consession.destroy()
-                return
+                break
             elif data['operation'] == 'break':
                 consession.send_break()
                 continue
@@ -247,11 +305,12 @@ def start_term(authname, cfm, connection, params, path, authdata, skipauth):
                 continue
         if not data:
             consession.destroy()
-            return
+            break
         consession.write(data)
 
 
 def _tlshandler(bind_host, bind_port):
+    global plainsocket
     plainsocket = socket.socket(socket.AF_INET6)
     plainsocket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     plainsocket.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
@@ -271,13 +330,54 @@ def _tlshandler(bind_host, bind_port):
         eventlet.spawn_n(_tlsstartup, cnn)
 
 
+if ffi:
+    @ffi.callback("int(*)( X509_STORE_CTX *, void*)")
+    def verify_stub(store, misc):
+        return 1
+
+
 def _tlsstartup(cnn):
     authname = None
-    cnn = ssl.wrap_socket(cnn, keyfile="/etc/confluent/privkey.pem",
-                          certfile="/etc/confluent/srvcert.pem",
-                          ssl_version=ssl.PROTOCOL_TLSv1,
-                          server_side=True)
-    sessionhdl(cnn, authname)
+    cert = None
+    if libssl:
+        # most fully featured SSL function
+        ctx = libssl.Context(libssl.SSLv23_METHOD)
+        ctx.set_options(libssl.OP_NO_SSLv2 | libssl.OP_NO_SSLv3 |
+                        libssl.OP_NO_TLSv1 | libssl.OP_NO_TLSv1_1 |
+                        libssl.OP_CIPHER_SERVER_PREFERENCE)
+        ctx.set_cipher_list(
+            'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:'
+            'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384')
+        ctx.set_tmp_ecdh(crypto.get_elliptic_curve('secp384r1'))
+        ctx.use_certificate_file('/etc/confluent/srvcert.pem')
+        ctx.use_privatekey_file('/etc/confluent/privkey.pem')
+        ctx.set_verify(libssln.VERIFY_PEER, lambda *args: True)
+        libssln._lib.SSL_CTX_set_cert_verify_callback(ctx._context,
+                                                      verify_stub, ffi.NULL)
+        cnn = libssl.Connection(ctx, cnn)
+        cnn.set_accept_state()
+        cnn.do_handshake()
+        cert = cnn.get_peer_certificate()
+    else:
+        try:
+            # Try relatively newer python TLS function
+            ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+            ctx.options |= ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3
+            ctx.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+            ctx.options |= ssl.OP_CIPHER_SERVER_PREFERENCE
+            ctx.set_ciphers(
+                'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:'
+                'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384')
+            ctx.load_cert_chain('/etc/confluent/srvcert.pem',
+                                '/etc/confluent/privkey.pem')
+            cnn = ctx.wrap_socket(cnn, server_side=True)
+        except AttributeError:
+            # Python 2.6 era, go with best effort
+            cnn = ssl.wrap_socket(cnn, keyfile="/etc/confluent/privkey.pem",
+                                  certfile="/etc/confluent/srvcert.pem",
+                                  ssl_version=ssl.PROTOCOL_TLSv1,
+                                  server_side=True)
+    sessionhdl(cnn, authname, cert=cert)
 
 def removesocket():
     try:
@@ -336,6 +436,36 @@ class SockApi(object):
         global tracelog
         tracelog = log.Logger('trace')
         auditlog = log.Logger('audit')
+        self.tlsserver = None
+        if self.should_run_remoteapi():
+            self.start_remoteapi()
+        else:
+            eventlet.spawn_n(self.watch_for_cert)
+        self.unixdomainserver = eventlet.spawn(_unixdomainhandler)
+
+    def watch_for_cert(self):
+        libc = ctypes.CDLL(ctypes.util.find_library('c'))
+        watcher = libc.inotify_init()
+        if libc.inotify_add_watch(watcher, '/etc/confluent/', 0x100) > -1:
+            while True:
+                select.select((watcher,), (), (), 86400)
+                if self.should_run_remoteapi():
+                    os.close(watcher)
+                    self.start_remoteapi()
+                    break
+
+    def should_run_remoteapi(self):
+        return os.path.exists("/etc/confluent/srvcert.pem")
+
+    def stop_remoteapi(self):
+        if self.tlsserver is None:
+            return
+        self.tlsserver.kill()
+        plainsocket.close()
+        self.tlsserver = None
+
+    def start_remoteapi(self):
+        if self.tlsserver is not None:
+            return
         self.tlsserver = eventlet.spawn(
             _tlshandler, self.bind_host, self.bind_port)
-        self.unixdomainserver = eventlet.spawn(_unixdomainhandler)

confluent_server/confluent/util.py

@@ -24,6 +24,7 @@ import netifaces
 import os
 import re
 import socket
+import ssl
 import struct
 
 
@@ -99,6 +100,20 @@ def monotonic_time():
     return os.times()[4]
 
 
+def get_certificate_from_file(certfile):
+    cert = open(certfile, 'rb').read()
+    inpemcert = False
+    prunedcert = ''
+    for line in cert.split('\n'):
+        if '-----BEGIN CERTIFICATE-----' in line:
+            inpemcert = True
+        if inpemcert:
+            prunedcert += line
+        if '-----END CERTIFICATE-----' in line:
+            break
+    return ssl.PEM_cert_to_DER_cert(prunedcert)
+
+
 def get_fingerprint(certificate, algo='sha512'):
     if algo == 'sha256':
         return 'sha256$' + hashlib.sha256(certificate).hexdigest()

confluent_server/confluent_server.spec.tmpl

@@ -12,7 +12,7 @@ Group: Development/Libraries
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-buildroot
 Prefix: %{_prefix}
 BuildArch: noarch
-Requires: python-pyghmi >= 1.0.34, python-eventlet, python-greenlet, python-crypto >= 2.6.1, confluent_client, pyparsing, python-paramiko, python-dns, python-netifaces, python2-pyasn1 >= 0.2.3, python-pysnmp >= 4.3.4, python-pyte, python-lxml, python-eficompressor
+Requires: python-pyghmi >= 1.0.34, python-eventlet, python-greenlet, python-pycryptodomex >= 3.4.7, confluent_client, python-pyparsing, python-paramiko, python-dns, python-netifaces, python2-pyasn1 >= 0.2.3, python-pysnmp >= 4.3.4, python-pyte, python-lxml, python-eficompressor, python-setuptools
 Vendor: Jarrod Johnson <jjohnson2@lenovo.com>
 Url: http://xcat.sf.net/
 

confluent_server/makesetup

@@ -6,4 +6,6 @@ if [ "$NUMCOMMITS" != "$VERSION"  ]; then
 fi
 echo $VERSION > VERSION
 sed -e "s/#VERSION#/$VERSION/" setup.py.tmpl > setup.py
-echo '__version__ = "'$VERSION'"' > confluent/__init__.py
+if [ -f confluent/client.py ]; then 
+    echo '__version__ = "'$VERSION'"' > confluent/__init__.py
+fi

confluent_server/setup.cfg

@@ -1,22 +0,0 @@
-[metadata]
-name = confluent_server
-summary = Confluent systems management daemon
-description-file =
-    README.txt
-author = Jarrod Johnson
-author-email = jbjohnso@us.ibm.com
-home-page = http://xcat.sf.net/
-classifier =
-    Intended Audience :: Information Technology
-    Intended Audience :: System Administrators
-    License :: OSI Approved :: Apache Software License
-    Operating System :: POSIX :: Linux
-    Programming Language :: Python :: 2.6
-    Programming Language :: Python :: 2.7
-
-[files]
-packages =
-    confluent
-    confluent/interface
-    confluent/config
-

confluent_server/setup.py.tmpl

@@ -15,10 +15,12 @@ setup(
               'confluent/networking/',
               'confluent/plugins/hardwaremanagement/',
               'confluent/plugins/shell/',
+              'confluent/collective/',
               'confluent/plugins/configuration/'],
     install_requires=['paramiko', 'pycrypto>=2.6', 'confluent_client>=0.1.0', 'eventlet',
-                      'pyghmi>=0.6.5'],
-    scripts=['bin/confluent', 'bin/confluentdbutil'],
+                      'dnspython', 'netifaces', 'pyte', 'pysnmp', 'pyparsing',
+                      'pyghmi>=1.0.44'],
+    scripts=['bin/confluent', 'bin/confluentdbutil', 'bin/collective'],
     data_files=[('/etc/init.d', ['sysvinit/confluent']),
                 ('/usr/lib/sysctl.d', ['sysctl/confluent.conf']),
                 ('/usr/lib/systemd/system', ['systemd/confluent.service']),

confluent_server/systemd/confluent.service

@@ -4,7 +4,7 @@ Description=Confluent hardware manager
 
 [Service]
 Type=forking
-PIDFile=/var/run/confluent/pid
+#PIDFile=/var/run/confluent/pid
 ExecStart=/opt/confluent/bin/confluent
 ExecStop=/opt/confluent/bin/confetty shutdown /
 Restart=on-failure

confluent_web/js/consoles.js

@@ -1,38 +0,0 @@
-function getRequest(url, success) {
-    var request = new XMLHttpRequest();
-    request.open('GET', url, true);
-    request.setRequestHeader('Accept', 'application/json');
-    request.onload = function() {
-        if (this.status >= 200 && this.status <= 400) {
-            success(JSON.parse(this.responseText));
-        }
-    };
-    request.send();
-}
-
-document.addEventListener('DOMContentLoaded', function() {
-
-  getRequest("/confluent-api/nodes/", function( data) {
-	var items = [];
-	var options = [];
-	var nodename = "";
-    data["_links"]["item"].forEach( function( val, key ) {
-        console.log(val);
-        if (typeof(val) == "object") {
-		    nodename = val.href;
-        } else {
-            nodename = val;
-        }
-        console.log(nodename);
-		nodename = nodename.replace('/', '');
-        var myrow = document.createElement('div');
-        myrow.innerHTML = "<button id="+nodename+">"+nodename+"</button><br>";
-        document.getElementById("nodes").appendChild(myrow);
-        document.getElementById(nodename).addEventListener("click", function( event ) {
-            var tname = this.id;
-            var url  = "/confluent-api/nodes/" + tname + "/console/session";
-            new ConsoleWindow(url, tname);
-        });
-	});
-  });
-}); // end document

confluent_web/js/consolewindow.js

@@ -1,742 +0,0 @@
-/**
- * tty.js
- * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
- * Copyright 2014, IBM Corporation
- * Copyright 2014, Lenovo
- */
-
-;(function() {
-
-'use strict';
-/**
- * Elements
- */
-
-var document = this.document
-  , window = this
-  , root
-  , body
-  , h1
-  , open
-  , lights;
-
-/**
- * Helpers
- */
-
-var EventEmitter = Terminal.EventEmitter
-  , inherits = Terminal.inherits
-  , on = Terminal.on
-  , off = Terminal.off
-  , cancel = Terminal.cancel;
-
-function postRequest(url, data, success) {
-	var request = new XMLHttpRequest();
-	request.open('POST', url, true);
-        request.setRequestHeader('Content-Type', 'application/json');
-        request.setRequestHeader('Accept', 'application/json');
-	request.onload = function() {
-		if (this.status >= 200 && this.status < 400) {
-			success(JSON.parse(this.responseText));
-		}
-	};
-	if (data) {
-		request.send(JSON.stringify(data));
-	} else {
-		request.send("");
-	}
-        request = null;
-}
-/**
- * Console
- */
-
-function ConsoleWindow(consoleurl, nodename) {
-  var self = this;
-
-  if (!(this instanceof ConsoleWindow)) {
-    return new ConsoleWindow(consoleurl, nodename);
-  }
-
-  EventEmitter.call(this);
-
-  var el
-    , grip
-    , bar
-    , button
-    , title;
-
-  el = document.createElement('div');
-  el.className = 'window';
-
-  grip = document.createElement('div');
-  grip.className = 'grip';
-
-  bar = document.createElement('div');
-  bar.className = 'bar';
-
-  button = document.createElement('div');
-  button.innerHTML = 'x';
-  button.title = 'close';
-  button.className = 'tab';
-
-  title = document.createElement('div');
-  title.className = 'title';
-  title.innerHTML = nodename;
-
-  this.nodename = nodename;
-  this.element = el;
-  this.grip = grip;
-  this.bar = bar;
-  this.button = button;
-  this.title = title;
-  this.consoleurl = consoleurl;
-
-  this.tabs = [];
-  this.focused = null;
-
-  this.cols = 100; //Terminal.geometry[0];
-  this.rows = 30; //Terminal.geometry[1];
-
-  el.appendChild(grip);
-  el.appendChild(bar);
-  bar.appendChild(title);
-  bar.appendChild(button);
-  document.body.appendChild(el);
-
-  //tty.windows.push(this);
-
-  this.createTab();
-  this.focus();
-  this.bind();
-
-  this.tabs[0].once('open', function() {
-    //tty.emit('open window', self);
-    self.emit('open');
-  });
-}
-
-inherits(ConsoleWindow, EventEmitter);
-
-ConsoleWindow.prototype.bind = function() {
-  var self = this
-    , el = this.element
-    , bar = this.bar
-    , grip = this.grip
-    , button = this.button
-    , last = 0;
-
-  on(button, 'click', function(ev) {
-    self.destroy();
-    return cancel(ev);
-  });
-
-  on(grip, 'mousedown', function(ev) {
-    self.focus();
-    self.resizing(ev);
-    return cancel(ev);
-  });
-
-  on(el, 'mousedown', function(ev) {
-    if (ev.target !== el && ev.target !== bar) return;
-
-    self.focus();
-
-    cancel(ev);
-
-    if (new Date - last < 600) {
-      return self.maximize();
-    }
-    last = new Date;
-
-    self.drag(ev);
-
-    return cancel(ev);
-  });
-};
-
-ConsoleWindow.prototype.focus = function() {
-  // Restack
-  var parent = this.element.parentNode;
-  if (parent) {
-    parent.removeChild(this.element);
-    parent.appendChild(this.element);
-  }
-
-  // Focus Foreground Tab
-  this.focused.focus();
-
-  //tty.emit('focus window', this);
-  this.emit('focus');
-};
-
-ConsoleWindow.prototype.destroy = function() {
-  if (this.destroyed) return;
-  this.destroyed = true;
-
-  if (this.minimize) this.minimize();
-
-  //splice(tty.windows, this);
-  //if (tty.windows.length) tty.windows[0].focus();
-
-  this.element.parentNode.removeChild(this.element);
-
-  this.each(function(term) {
-    term.destroy();
-  });
-
-  //tty.emit('close window', this);
-  this.emit('close');
-};
-
-ConsoleWindow.prototype.drag = function(ev) {
-  var self = this
-    , el = this.element;
-
-  if (this.minimize) return;
-
-  var drag = {
-    left: el.offsetLeft,
-    top: el.offsetTop,
-    pageX: ev.pageX,
-    pageY: ev.pageY
-  };
-
-  el.style.opacity = '0.60';
-  el.style.cursor = 'move';
-  document.documentElement.style.cursor = 'move';
-
-  function move(ev) {
-    el.style.left =
-      (drag.left + ev.pageX - drag.pageX) + 'px';
-    var tmptop = (drag.top + ev.pageY - drag.pageY);
-    if (tmptop < 0) {
-       tmptop = 0;
-    }
-    el.style.top = tmptop + 'px';
-  }
-
-  function up() {
-    el.style.opacity = '';
-    el.style.cursor = '';
-    document.documentElement.style.cursor = '';
-
-    off(document, 'mousemove', move);
-    off(document, 'mouseup', up);
-
-    var ev = {
-      left: el.style.left.replace(/\w+/g, ''),
-      top: el.style.top.replace(/\w+/g, '')
-    };
-
-    //tty.emit('drag window', self, ev);
-    self.emit('drag', ev);
-  }
-
-  on(document, 'mousemove', move);
-  on(document, 'mouseup', up);
-};
-
-ConsoleWindow.prototype.resizing = function(ev) {
-  var self = this
-    , el = this.element
-    , term = this.focused;
-
-  if (this.minimize) delete this.minimize;
-
-  var resize = {
-    w: el.clientWidth,
-    h: el.clientHeight
-  };
-
-  el.style.overflow = 'hidden';
-  el.style.opacity = '0.70';
-  el.style.cursor = 'se-resize';
-  document.documentElement.style.cursor = 'se-resize';
-  term.element.style.height = '100%';
-
-  function move(ev) {
-    var x, y;
-    y = el.offsetHeight - term.element.clientHeight;
-    x = ev.pageX - el.offsetLeft;
-    y = (ev.pageY - el.offsetTop) - y;
-    el.style.width = x + 'px';
-    el.style.height = y + 'px';
-  }
-
-  function up() {
-    var x, y;
-
-    x = el.clientWidth / resize.w;
-    y = el.clientHeight / resize.h;
-    x = (x * term.cols) | 0;
-    y = (y * term.rows) | 0;
-
-    self.resize(x, y);
-
-    el.style.width = '';
-    el.style.height = '';
-
-    el.style.overflow = '';
-    el.style.opacity = '';
-    el.style.cursor = '';
-    document.documentElement.style.cursor = '';
-    term.element.style.height = '';
-
-    off(document, 'mousemove', move);
-    off(document, 'mouseup', up);
-  }
-
-  on(document, 'mousemove', move);
-  on(document, 'mouseup', up);
-};
-
-ConsoleWindow.prototype.maximize = function() {
-  if (this.minimize) return this.minimize();
-
-  var self = this
-    , el = this.element
-    , term = this.focused
-    , x
-    , y;
-
-  var m = {
-    cols: term.cols,
-    rows: term.rows,
-    left: el.offsetLeft,
-    top: el.offsetTop,
-    root: root.className
-  };
-
-  this.minimize = function() {
-    delete this.minimize;
-
-    el.style.left = m.left + 'px';
-    el.style.top = m.top + 'px';
-    el.style.width = '';
-    el.style.height = '';
-    term.element.style.width = '';
-    term.element.style.height = '';
-    el.style.boxSizing = '';
-    self.grip.style.display = '';
-    root.className = m.root;
-
-    self.resize(m.cols, m.rows);
-
-    //tty.emit('minimize window', self);
-    self.emit('minimize');
-  };
-
-  window.scrollTo(0, 0);
-
-  x = root.clientWidth / term.element.offsetWidth;
-  y = root.clientHeight / term.element.offsetHeight;
-  x = (x * term.cols) | 0;
-  y = (y * term.rows) | 0;
-
-  el.style.left = '0px';
-  el.style.top = '0px';
-  el.style.width = '100%';
-  el.style.height = '100%';
-  term.element.style.width = '100%';
-  term.element.style.height = '100%';
-  el.style.boxSizing = 'border-box';
-  this.grip.style.display = 'none';
-  root.className = 'maximized';
-
-  this.resize(x, y);
-
-  //tty.emit('maximize window', this);
-  this.emit('maximize');
-};
-
-ConsoleWindow.prototype.resize = function(cols, rows) {
-  this.cols = cols;
-  this.rows = rows;
-
-  this.each(function(term) {
-    term.resize(cols, rows);
-  });
-
-  //tty.emit('resize window', this, cols, rows);
-  this.emit('resize', cols, rows);
-};
-
-ConsoleWindow.prototype.each = function(func) {
-  var i = this.tabs.length;
-  while (i--) {
-    func(this.tabs[i], i);
-  }
-};
-
-ConsoleWindow.prototype.createTab = function() {
-  return new Tab(this, this.consoleurl);
-};
-
-ConsoleWindow.prototype.highlight = function() {
-  var self = this;
-
-  this.element.style.borderColor = 'orange';
-  setTimeout(function() {
-    self.element.style.borderColor = '';
-  }, 200);
-
-  this.focus();
-};
-
-ConsoleWindow.prototype.focusTab = function(next) {
-  var tabs = this.tabs
-    , i = indexOf(tabs, this.focused)
-    , l = tabs.length;
-
-  if (!next) {
-    if (tabs[--i]) return tabs[i].focus();
-    if (tabs[--l]) return tabs[l].focus();
-  } else {
-    if (tabs[++i]) return tabs[i].focus();
-    if (tabs[0]) return tabs[0].focus();
-  }
-
-  return this.focused && this.focused.focus();
-};
-
-ConsoleWindow.prototype.nextTab = function() {
-  return this.focusTab(true);
-};
-
-ConsoleWindow.prototype.previousTab = function() {
-  return this.focusTab(false);
-};
-
-/**
- * Tab
- */
-
-function Tab(win, consoleurl) {
-  var self = this;
-
-  var cols = win.cols
-    , rows = win.rows;
-
-  Terminal.call(this, {
-    cols: cols,
-    rows: rows
-  });
-
-  var button = document.createElement('div');
-  button.className = 'tab';
-  button.innerHTML = '\u2022';
-  //win.bar.appendChild(button);
-
-  on(button, 'click', function(ev) {
-    if (ev.ctrlKey || ev.altKey || ev.metaKey || ev.shiftKey) {
-      self.destroy();
-    } else {
-      self.focus();
-    }
-    return cancel(ev);
-  });
-
-  this.id = '';
-  this.consoleurl = consoleurl;
-  this.clientcount = 0;
-  this.connectstate = 'unconnected';
-  this.lasterror = ''
-  this.window = win;
-  this.button = button;
-  this.element = null;
-  this.process = '';
-  this.open();
-  this.hookKeys();
-  // Now begins the code that will embarass me when I actually know my way
-  // around javascript -jbjohnso
-  this.sessid = '';
-  this.datapending = false;
-  this.waitingdata = false;
-  this.sentdata = function(data, textStatus, jqXHR) {
-    if (this.waitingdata) {
-      postRequest(consoleurl,  { session: this.sessid, bytes: this.waitingdata }, this.sentdata);
-      this.waitingdata = false;
-    } else {
-        this.datapending = false;
-    }
-  }.bind(this);
-  this.on('data', function(data) {
-    // Send data to console from terminal
-    if (this.datapending) {
-      if (!this.waitingdata) {
-        this.waitingdata = data;
-      } else {
-        this.waitingdata = this.waitingdata + data;
-      }
-      return;
-    }
-    this.datapending = true;
-    postRequest(consoleurl,  { session: this.sessid, bytes: data }, this.sentdata);
-  }.bind(this));
-  this.gotdata = function(data, textStatus, jqXHR) {
-    if ("data" in data) {
-       this.write(data.data);
-    }
-    var updatetitle = false;
-    var updateinfo = [];
-    if ("connectstate" in data) {
-        updatetitle = true;
-        this.connectstate = data.connectstate;
-    }
-    if (this.connectstate != "connected") {
-        updateinfo.push(this.connectstate);
-    } else {
-        self.lasterror = '';
-    }
-    if ("error" in data) {
-        updatetitle = true;
-        this.lasterror = data.error
-    }
-    if (this.lasterror != '') {
-        updateinfo.push(this.lasterror);
-    }
-    if ("clientcount" in data) {
-        updatetitle = true;
-        this.clientcount = data.clientcount;
-    }
-    if (this.clientcount > 1) {
-        updateinfo.push("clients: " + this.clientcount.toString());
-    }
-    if (updatetitle == true) {
-        if (updateinfo.length > 0) {
-            this.window.title.innerHTML = this.window.nodename + " [" + updateinfo.join() + "]";
-        } else {
-            this.window.title.innerHTML = this.window.nodename;
-        }
-    }
-    postRequest(consoleurl,  { session: this.sessid }, this.gotdata);
-  }.bind(this);
-  this.gotsession = function(data, textStatus, jqXHR) {
-    this.sessid = data.session
-    postRequest(consoleurl,  { session: this.sessid }, this.gotdata);
-  }.bind(this);
-  postRequest(consoleurl,  false, this.gotsession);
-
-  win.tabs.push(this);
-};
-
-inherits(Tab, Terminal);
-
-Tab.prototype._write = Tab.prototype.write;
-
-Tab.prototype.write = function(data) {
-  if (this.window.focused !== this) this.button.style.color = 'red';
-  return this._write(data);
-};
-
-Tab.prototype._focus = Tab.prototype.focus;
-
-Tab.prototype.focus = function() {
-  if (Terminal.focus === this) return;
-
-  var win = this.window;
-
-  // maybe move to Tab.prototype.switch
-  if (win.focused !== this) {
-    if (win.focused) {
-      if (win.focused.element.parentNode) {
-        win.focused.element.parentNode.removeChild(win.focused.element);
-      }
-      win.focused.button.style.fontWeight = '';
-    }
-
-    win.element.appendChild(this.element);
-    win.focused = this;
-
-    //win.title.innerHTML = this.process;
-    this.button.style.fontWeight = 'bold';
-    this.button.style.color = '';
-  }
-
-  this._focus();
-
-  win.focus();
-
-  //tty.emit('focus tab', this);
-  this.emit('focus');
-};
-
-Tab.prototype._resize = Tab.prototype.resize;
-
-Tab.prototype.resize = function(cols, rows) {
-  //this.socket.emit('resize', this.id, cols, rows);
-  this._resize(cols, rows);
-  //tty.emit('resize tab', this, cols, rows);
-  this.emit('resize', cols, rows);
-};
-
-Tab.prototype.__destroy = Tab.prototype.destroy;
-
-Tab.prototype._destroy = function() {
-  if (this.destroyed) return;
-  this.destroyed = true;
-
-  var win = this.window;
-
-  this.button.parentNode.removeChild(this.button);
-  if (this.element.parentNode) {
-    this.element.parentNode.removeChild(this.element);
-  }
-
-  if (tty.terms[this.id]) delete tty.terms[this.id];
-  splice(win.tabs, this);
-
-  if (win.focused === this) {
-    win.previousTab();
-  }
-
-  if (!win.tabs.length) {
-    win.destroy();
-  }
-
-  this.__destroy();
-};
-
-Tab.prototype.destroy = function() {
-  if (this.destroyed) return;
-  //TODO: politely let server know of client closure
-  this._destroy();
-  //tty.emit('close tab', this);
-  this.emit('close');
-};
-
-Tab.prototype.hookKeys = function() {
-  var self = this;
-
-  // Alt-[jk] to quickly swap between windows.
-  this.on('key', function(key, ev) {
-    if (Terminal.focusKeys === false) {
-      return;
-    }
-
-    var offset
-      , i;
-
-    if (key === '\x1bj') {
-      offset = -1;
-    } else if (key === '\x1bk') {
-      offset = +1;
-    } else {
-      return;
-    }
-
-    i = indexOf(tty.windows, this.window) + offset;
-
-    this._ignoreNext();
-
-    if (tty.windows[i]) return tty.windows[i].highlight();
-
-    if (offset > 0) {
-      if (tty.windows[0]) return tty.windows[0].highlight();
-    } else {
-      i = tty.windows.length - 1;
-      if (tty.windows[i]) return tty.windows[i].highlight();
-    }
-
-    return this.window.highlight();
-  });
-
-  this.on('request paste', function(key) {
-    this.socket.emit('request paste', function(err, text) {
-      if (err) return;
-      self.send(text);
-    });
-  });
-
-  this.on('request create', function() {
-    this.window.createTab();
-  });
-
-  this.on('request term', function(key) {
-    if (this.window.tabs[key]) {
-      this.window.tabs[key].focus();
-    }
-  });
-
-  this.on('request term next', function(key) {
-    this.window.nextTab();
-  });
-
-  this.on('request term previous', function(key) {
-    this.window.previousTab();
-  });
-};
-
-Tab.prototype._ignoreNext = function() {
-  // Don't send the next key.
-  var handler = this.handler;
-  this.handler = function() {
-    this.handler = handler;
-  };
-  var showCursor = this.showCursor;
-  this.showCursor = function() {
-    this.showCursor = showCursor;
-  };
-};
-
-/**
- * Program-specific Features
- */
-
-Tab.prototype._bindMouse = Tab.prototype.bindMouse;
-
-Tab.prototype.bindMouse = function() {
-  if (!Terminal.programFeatures) return this._bindMouse();
-
-  var self = this;
-
-  var wheelEvent = 'onmousewheel' in window
-    ? 'mousewheel'
-    : 'DOMMouseScroll';
-
-  on(self.element, wheelEvent, function(ev) {
-    if (self.mouseEvents) return;
-
-    if ((ev.type === 'mousewheel' && ev.wheelDeltaY > 0)
-        || (ev.type === 'DOMMouseScroll' && ev.detail < 0)) {
-      // page up
-      self.keyDown({keyCode: 33});
-    } else {
-      // page down
-      self.keyDown({keyCode: 34});
-    }
-
-    return cancel(ev);
-  });
-
-  return this._bindMouse();
-};
-
-/**
- * Helpers
- */
-
-function indexOf(obj, el) {
-  var i = obj.length;
-  while (i--) {
-    if (obj[i] === el) return i;
-  }
-  return -1;
-}
-
-function splice(obj, el) {
-  var i = indexOf(obj, el);
-  if (~i) obj.splice(i, 1);
-}
-
-function sanitize(text) {
-  if (!text) return '';
-  return (text + '').replace(/[&<>]/g, '')
-}
-
-this.ConsoleWindow = ConsoleWindow;
-
-}).call(function() {
-    return this;
-}());