No OneTemporary
Actions

Size

434 KB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/cts/Makefile.am b/cts/Makefile.am
	index 4a58ce011d..baf5d6b2a0 100644
	--- a/cts/Makefile.am
	+++ b/cts/Makefile.am
	@@ -1,66 +1,67 @@
	#
	# Copyright 2001-2022 the Pacemaker project contributors
	#
	# The version control history for this file may have further details.
	#
	# This source code is licensed under the GNU General Public License version 2
	# or later (GPLv2+) WITHOUT ANY WARRANTY.
	#

	MAINTAINERCLEANFILES = Makefile.in

	# Test commands and globally applicable test files should be in $(testdir),
	# and command-specific test data should be in a command-specific subdirectory.
	testdir = $(datadir)/$(PACKAGE)/tests
	test_SCRIPTS = cts-cli \
	cts-exec \
	cts-fencing \
	cts-regression \
	cts-scheduler
	dist_test_DATA = README.md \
	valgrind-pcmk.suppressions

	ctsdir = $(testdir)/cts
	cts_SCRIPTS = lxc_autogen.sh

	clidir = $(testdir)/cli
	dist_cli_DATA = cli/constraints.xml \
	cli/crmadmin-cluster-remote-guest-nodes.xml \
	cli/crm_diff_new.xml \
	cli/crm_diff_old.xml \
	cli/crm_mon.xml \
	cli/crm_mon-feature_set.xml \
	cli/crm_mon-partial.xml \
	cli/crm_mon-T180.xml \
	cli/crm_mon-unmanaged.xml \
	cli/crm_resource_digests.xml \
	cli/regression.acls.exp \
	cli/regression.crm_mon.exp \
	+ cli/regression.daemons.exp \
	cli/regression.dates.exp \
	cli/regression.error_codes.exp \
	cli/regression.feature_set.exp \
	cli/regression.rules.exp \
	cli/regression.tools.exp \
	cli/regression.upgrade.exp \
	cli/regression.validity.exp \
	cli/regression.access_render.exp

	scheduler-list:
	@for T in "$(srcdir)"/scheduler/xml/*.xml; do \
	echo $$(basename $$T .xml); \
	done

	CLEANFILES = $(builddir)/.regression.failed.diff

	clean-local:
	rm -f scheduler//.pe

	SUBDIRS = benchmark lab scheduler support

	cts-support-install:
	$(MAKE) $(AM_MAKEFLAGS) -C support cts-support
	$(builddir)/support/cts-support install

	cts-support-uninstall:
	$(MAKE) $(AM_MAKEFLAGS) -C support cts-support
	$(builddir)/support/cts-support uninstall
	diff --git a/cts/cli/regression.daemons.exp b/cts/cli/regression.daemons.exp
	new file mode 100644
	index 0000000000..b088e3cb4d
	--- /dev/null
	+++ b/cts/cli/regression.daemons.exp
	@@ -0,0 +1,441 @@
	+=#=#=#= Begin test: Get CIB manager metadata =#=#=#=
	+<?xml version=""?>
	+<resource-agent name="pacemaker-based" version="">
	+ <version>1.1</version>
	+ <longdesc lang="en">Cluster options used by Pacemaker's Cluster Information Base manager</longdesc>
	+ <shortdesc lang="en">Cluster Information Base manager options</shortdesc>
	+ <parameters>
	+ <parameter name="enable-acl">
	+ <longdesc lang="en">Enable Access Control Lists (ACLs) for the CIB</longdesc>
	+ <shortdesc lang="en">Enable Access Control Lists (ACLs) for the CIB</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="cluster-ipc-limit">
	+ <longdesc lang="en">Raise this if log has "Evicting client" messages for cluster daemon PIDs (a good value is the number of resources in the cluster multiplied by the number of nodes).</longdesc>
	+ <shortdesc lang="en">Maximum IPC message backlog before disconnecting a cluster daemon</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ </parameters>
	+</resource-agent>
	+=#=#=#= End test: Get CIB manager metadata - OK (0) =#=#=#=
	+* Passed: pacemaker-based - Get CIB manager metadata
	+=#=#=#= Begin test: Get controller metadata =#=#=#=
	+<?xml version=""?>
	+<resource-agent name="pacemaker-controld" version="">
	+ <version>1.1</version>
	+ <longdesc lang="en">Cluster options used by Pacemaker's controller</longdesc>
	+ <shortdesc lang="en">Pacemaker controller options</shortdesc>
	+ <parameters>
	+ <parameter name="dc-version">
	+ <longdesc lang="en">Includes a hash which identifies the exact changeset the code was built from. Used for diagnostic purposes.</longdesc>
	+ <shortdesc lang="en">Pacemaker version on cluster node elected Designated Controller (DC)</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="cluster-infrastructure">
	+ <longdesc lang="en">Used for informational and diagnostic purposes.</longdesc>
	+ <shortdesc lang="en">The messaging stack on which Pacemaker is currently running</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="cluster-name">
	+ <longdesc lang="en">This optional value is mostly for users' convenience as desired in administration, but may also be used in Pacemaker configuration rules via the #cluster-name node attribute, and by higher-level tools and resource agents.</longdesc>
	+ <shortdesc lang="en">An arbitrary name for the cluster</shortdesc>
	+ <content type="string"/>
	+ </parameter>
	+ <parameter name="dc-deadtime">
	+ <longdesc lang="en">The optimal value will depend on the speed and load of your network and the type of switches used.</longdesc>
	+ <shortdesc lang="en">How long to wait for a response from other nodes during start-up</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="cluster-recheck-interval">
	+ <longdesc lang="en">Pacemaker is primarily event-driven, and looks ahead to know when to recheck cluster state for failure timeouts and most time-based rules. However, it will also recheck the cluster after this amount of inactivity, to evaluate rules with date specifications and serve as a fail-safe for certain types of scheduler bugs. Allowed values: Zero disables polling, while positive values are an interval in seconds(unless other units are specified, for example "5min")</longdesc>
	+ <shortdesc lang="en">Polling interval to recheck cluster state and evaluate rules with date specifications</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="load-threshold">
	+ <longdesc lang="en">The cluster will slow down its recovery process when the amount of system resources used (currently CPU) approaches this limit</longdesc>
	+ <shortdesc lang="en">Maximum amount of system load that should be used by cluster nodes</shortdesc>
	+ <content type="percentage" default=""/>
	+ </parameter>
	+ <parameter name="node-action-limit">
	+ <longdesc lang="en">Maximum number of jobs that can be scheduled per node (defaults to 2x cores)</longdesc>
	+ <shortdesc lang="en">Maximum number of jobs that can be scheduled per node (defaults to 2x cores)</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="fence-reaction">
	+ <longdesc lang="en">A cluster node may receive notification of its own fencing if fencing is misconfigured, or if fabric fencing is in use that doesn't cut cluster communication. Allowed values are "stop" to attempt to immediately stop Pacemaker and stay stopped, or "panic" to attempt to immediately reboot the local node, falling back to stop on failure.</longdesc>
	+ <shortdesc lang="en">How a cluster node should react if notified of its own fencing</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="election-timeout">
	+ <longdesc lang="en">Declare an election failed if it is not decided within this much time. If you need to adjust this value, it probably indicates the presence of a bug.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only *</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="shutdown-escalation">
	+ <longdesc lang="en">Exit immediately if shutdown does not complete within this much time. If you need to adjust this value, it probably indicates the presence of a bug.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only *</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="join-integration-timeout">
	+ <longdesc lang="en">If you need to adjust this value, it probably indicates the presence of a bug.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only *</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="join-finalization-timeout">
	+ <longdesc lang="en">If you need to adjust this value, it probably indicates the presence of a bug.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only *</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="transition-delay">
	+ <longdesc lang="en">Delay cluster recovery for this much time to allow for additional events to occur. Useful if your configuration is sensitive to the order in which ping updates arrive.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only * Enabling this option will slow down cluster recovery under all conditions</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="stonith-watchdog-timeout">
	+ <longdesc lang="en">If this is set to a positive value, lost nodes are assumed to self-fence using watchdog-based SBD within this much time. This does not require a fencing resource to be explicitly configured, though a fence_watchdog resource can be configured, to limit use to specific nodes. If this is set to 0 (the default), the cluster will never assume watchdog-based self-fencing. If this is set to a negative value, the cluster will use twice the local value of the `SBD_WATCHDOG_TIMEOUT` environment variable if that is positive, or otherwise treat this as 0. WARNING: When used, this timeout must be larger than `SBD_WATCHDOG_TIMEOUT` on all nodes that use watchdog-based SBD, and Pacemaker will refuse to start on any of those nodes where this is not true for the local value or SBD is not active. When this is set to a negative value, `SBD_WATCHDOG_TIMEOUT` must be set to the same value on all nodes that use SBD, otherwise data corruption or loss could occur.</longdesc>
	+ <shortdesc lang="en">How long before nodes can be assumed to be safely down when watchdog-based self-fencing via SBD is in use</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="stonith-max-attempts">
	+ <longdesc lang="en">How many times fencing can fail before it will no longer be immediately re-attempted on a target</longdesc>
	+ <shortdesc lang="en">How many times fencing can fail before it will no longer be immediately re-attempted on a target</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="no-quorum-policy">
	+ <longdesc lang="en">What to do when the cluster does not have quorum Allowed values: stop, freeze, ignore, demote, suicide</longdesc>
	+ <shortdesc lang="en">What to do when the cluster does not have quorum</shortdesc>
	+ <content type="select" default="">
	+ <option value="stop" />
	+ <option value="freeze" />
	+ <option value="ignore" />
	+ <option value="demote" />
	+ <option value="suicide" />
	+ </content>
	+ </parameter>
	+ <parameter name="shutdown-lock">
	+ <longdesc lang="en">When true, resources active on a node when it is cleanly shut down are kept "locked" to that node (not allowed to run elsewhere) until they start again on that node after it rejoins (or for at most shutdown-lock-limit, if set). Stonith resources and Pacemaker Remote connections are never locked. Clone and bundle instances and the promoted role of promotable clones are currently never locked, though support could be added in a future release.</longdesc>
	+ <shortdesc lang="en">Whether to lock resources to a cleanly shut down node</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ </parameters>
	+</resource-agent>
	+=#=#=#= End test: Get controller metadata - OK (0) =#=#=#=
	+* Passed: pacemaker-controld - Get controller metadata
	+=#=#=#= Begin test: Get fencer metadata =#=#=#=
	+<?xml version=""?>
	+<resource-agent name="pacemaker-fenced" version="">
	+ <version>1.1</version>
	+ <longdesc lang="en">Instance attributes available for all "stonith"-class resources and used by Pacemaker's fence daemon, formerly known as stonithd</longdesc>
	+ <shortdesc lang="en">Instance attributes available for all "stonith"-class resources</shortdesc>
	+ <parameters>
	+ <parameter name="pcmk_host_argument">
	+ <longdesc lang="en">some devices do not support the standard 'port' parameter or may provide additional ones. Use this to specify an alternate, device-specific, parameter that should indicate the machine to be fenced. A value of none can be used to tell the cluster not to supply any additional parameters.</longdesc>
	+ <shortdesc lang="en">Advanced use only: An alternate parameter to supply instead of 'port'</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_host_map">
	+ <longdesc lang="en">Eg. node1:1;node2:2,3 would tell the cluster to use port 1 for node1 and ports 2 and 3 for node2</longdesc>
	+ <shortdesc lang="en">A mapping of host names to ports numbers for devices that do not support host names.</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_host_list">
	+ <longdesc lang="en">A list of machines controlled by this device (Optional unless pcmk_host_list=static-list)</longdesc>
	+ <shortdesc lang="en">Eg. node1,node2,node3</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_host_check">
	+ <longdesc lang="en">Allowed values: dynamic-list (query the device via the 'list' command), static-list (check the pcmk_host_list attribute), status (query the device via the 'status' command), none (assume every device can fence every machine)</longdesc>
	+ <shortdesc lang="en">How to determine which machines are controlled by the device.</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_delay_max">
	+ <longdesc lang="en">Enable a delay of no more than the time specified before executing fencing actions. Pacemaker derives the overall delay by taking the value of pcmk_delay_base and adding a random delay value such that the sum is kept below this maximum.</longdesc>
	+ <shortdesc lang="en">Enable a base delay for fencing actions and specify base delay value.</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_delay_base">
	+ <longdesc lang="en">This enables a static delay for fencing actions, which can help avoid "death matches" where two nodes try to fence each other at the same time. If pcmk_delay_max is also used, a random delay will be added such that the total delay is kept below that value.This can be set to a single time value to apply to any node targeted by this device (useful if a separate device is configured for each target), or to a node map (for example, "node1:1s;node2:5") to set a different value per target.</longdesc>
	+ <shortdesc lang="en">Enable a base delay for fencing actions and specify base delay value.</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_action_limit">
	+ <longdesc lang="en">Cluster property concurrent-fencing=true needs to be configured first.Then use this to specify the maximum number of actions can be performed in parallel on this device. -1 is unlimited.</longdesc>
	+ <shortdesc lang="en">The maximum number of actions can be performed in parallel on this device</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_reboot_action">
	+ <longdesc lang="en">Some devices do not support the standard commands or may provide additional ones.\nUse this to specify an alternate, device-specific, command that implements the 'reboot' action.</longdesc>
	+ <shortdesc lang="en">Advanced use only: An alternate command to run instead of 'reboot'</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_reboot_timeout">
	+ <longdesc lang="en">Some devices need much more/less time to complete than normal.Use this to specify an alternate, device-specific, timeout for 'reboot' actions.</longdesc>
	+ <shortdesc lang="en">Advanced use only: Specify an alternate timeout to use for reboot actions instead of stonith-timeout</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_reboot_retries">
	+ <longdesc lang="en">Some devices do not support multiple connections. Operations may 'fail' if the device is busy with another task so Pacemaker will automatically retry the operation, if there is time remaining. Use this option to alter the number of times Pacemaker retries 'reboot' actions before giving up.</longdesc>
	+ <shortdesc lang="en">Advanced use only: The maximum number of times to retry the 'reboot' command within the timeout period</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_off_action">
	+ <longdesc lang="en">Some devices do not support the standard commands or may provide additional ones.Use this to specify an alternate, device-specific, command that implements the 'off' action.</longdesc>
	+ <shortdesc lang="en">Advanced use only: An alternate command to run instead of 'off'</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_off_timeout">
	+ <longdesc lang="en">Some devices need much more/less time to complete than normal.Use this to specify an alternate, device-specific, timeout for 'off' actions.</longdesc>
	+ <shortdesc lang="en">Advanced use only: Specify an alternate timeout to use for off actions instead of stonith-timeout</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_off_retries">
	+ <longdesc lang="en">Some devices do not support multiple connections. Operations may 'fail' if the device is busy with another task so Pacemaker will automatically retry the operation, if there is time remaining. Use this option to alter the number of times Pacemaker retries 'off' actions before giving up.</longdesc>
	+ <shortdesc lang="en">Advanced use only: The maximum number of times to retry the 'off' command within the timeout period</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_on_action">
	+ <longdesc lang="en">Some devices do not support the standard commands or may provide additional ones.Use this to specify an alternate, device-specific, command that implements the 'on' action.</longdesc>
	+ <shortdesc lang="en">Advanced use only: An alternate command to run instead of 'on'</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_on_timeout">
	+ <longdesc lang="en">Some devices need much more/less time to complete than normal.Use this to specify an alternate, device-specific, timeout for 'on' actions.</longdesc>
	+ <shortdesc lang="en">Advanced use only: Specify an alternate timeout to use for on actions instead of stonith-timeout</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_on_retries">
	+ <longdesc lang="en">Some devices do not support multiple connections. Operations may 'fail' if the device is busy with another task so Pacemaker will automatically retry the operation, if there is time remaining. Use this option to alter the number of times Pacemaker retries 'on' actions before giving up.</longdesc>
	+ <shortdesc lang="en">Advanced use only: The maximum number of times to retry the 'on' command within the timeout period</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_list_action">
	+ <longdesc lang="en">Some devices do not support the standard commands or may provide additional ones.Use this to specify an alternate, device-specific, command that implements the 'list' action.</longdesc>
	+ <shortdesc lang="en">Advanced use only: An alternate command to run instead of 'list'</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_list_timeout">
	+ <longdesc lang="en">Some devices need much more/less time to complete than normal.Use this to specify an alternate, device-specific, timeout for 'list' actions.</longdesc>
	+ <shortdesc lang="en">Advanced use only: Specify an alternate timeout to use for list actions instead of stonith-timeout</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_list_retries">
	+ <longdesc lang="en">Some devices do not support multiple connections. Operations may 'fail' if the device is busy with another task so Pacemaker will automatically retry the operation, if there is time remaining. Use this option to alter the number of times Pacemaker retries 'list' actions before giving up.</longdesc>
	+ <shortdesc lang="en">Advanced use only: The maximum number of times to retry the 'list' command within the timeout period</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_monitor_action">
	+ <longdesc lang="en">Some devices do not support the standard commands or may provide additional ones.Use this to specify an alternate, device-specific, command that implements the 'monitor' action.</longdesc>
	+ <shortdesc lang="en">Advanced use only: An alternate command to run instead of 'monitor'</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_monitor_timeout">
	+ <longdesc lang="en">Some devices need much more/less time to complete than normal.\nUse this to specify an alternate, device-specific, timeout for 'monitor' actions.</longdesc>
	+ <shortdesc lang="en">Advanced use only: Specify an alternate timeout to use for monitor actions instead of stonith-timeout</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_monitor_retries">
	+ <longdesc lang="en">Some devices do not support multiple connections. Operations may 'fail' if the device is busy with another task so Pacemaker will automatically retry the operation, if there is time remaining. Use this option to alter the number of times Pacemaker retries 'monitor' actions before giving up.</longdesc>
	+ <shortdesc lang="en">Advanced use only: The maximum number of times to retry the 'monitor' command within the timeout period</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_status_action">
	+ <longdesc lang="en">Some devices do not support the standard commands or may provide additional ones.Use this to specify an alternate, device-specific, command that implements the 'status' action.</longdesc>
	+ <shortdesc lang="en">Advanced use only: An alternate command to run instead of 'status'</shortdesc>
	+ <content type="string" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_status_timeout">
	+ <longdesc lang="en">Some devices need much more/less time to complete than normal.Use this to specify an alternate, device-specific, timeout for 'status' actions.</longdesc>
	+ <shortdesc lang="en">Advanced use only: Specify an alternate timeout to use for status actions instead of stonith-timeout</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="pcmk_status_retries">
	+ <longdesc lang="en">Some devices do not support multiple connections. Operations may 'fail' if the device is busy with another task so Pacemaker will automatically retry the operation, if there is time remaining. Use this option to alter the number of times Pacemaker retries 'status' actions before giving up.</longdesc>
	+ <shortdesc lang="en">Advanced use only: The maximum number of times to retry the 'status' command within the timeout period</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ </parameters>
	+</resource-agent>
	+=#=#=#= End test: Get fencer metadata - OK (0) =#=#=#=
	+* Passed: pacemaker-fenced - Get fencer metadata
	+=#=#=#= Begin test: Get scheduler metadata =#=#=#=
	+<?xml version=""?>
	+<resource-agent name="pacemaker-schedulerd" version="">
	+ <version>1.1</version>
	+ <longdesc lang="en">Cluster options used by Pacemaker's scheduler</longdesc>
	+ <shortdesc lang="en">Pacemaker scheduler options</shortdesc>
	+ <parameters>
	+ <parameter name="no-quorum-policy">
	+ <longdesc lang="en">What to do when the cluster does not have quorum Allowed values: stop, freeze, ignore, demote, suicide</longdesc>
	+ <shortdesc lang="en">What to do when the cluster does not have quorum</shortdesc>
	+ <content type="select" default="">
	+ <option value="stop" />
	+ <option value="freeze" />
	+ <option value="ignore" />
	+ <option value="demote" />
	+ <option value="suicide" />
	+ </content>
	+ </parameter>
	+ <parameter name="symmetric-cluster">
	+ <longdesc lang="en">Whether resources can run on any node by default</longdesc>
	+ <shortdesc lang="en">Whether resources can run on any node by default</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="maintenance-mode">
	+ <longdesc lang="en">Whether the cluster should refrain from monitoring, starting, and stopping resources</longdesc>
	+ <shortdesc lang="en">Whether the cluster should refrain from monitoring, starting, and stopping resources</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="start-failure-is-fatal">
	+ <longdesc lang="en">When true, the cluster will immediately ban a resource from a node if it fails to start there. When false, the cluster will instead check the resource's fail count against its migration-threshold.</longdesc>
	+ <shortdesc lang="en">Whether a start failure should prevent a resource from being recovered on the same node</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="enable-startup-probes">
	+ <longdesc lang="en">Whether the cluster should check for active resources during start-up</longdesc>
	+ <shortdesc lang="en">Whether the cluster should check for active resources during start-up</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="shutdown-lock">
	+ <longdesc lang="en">When true, resources active on a node when it is cleanly shut down are kept "locked" to that node (not allowed to run elsewhere) until they start again on that node after it rejoins (or for at most shutdown-lock-limit, if set). Stonith resources and Pacemaker Remote connections are never locked. Clone and bundle instances and the promoted role of promotable clones are currently never locked, though support could be added in a future release.</longdesc>
	+ <shortdesc lang="en">Whether to lock resources to a cleanly shut down node</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="shutdown-lock-limit">
	+ <longdesc lang="en">If shutdown-lock is true and this is set to a nonzero time duration, shutdown locks will expire after this much time has passed since the shutdown was initiated, even if the node has not rejoined.</longdesc>
	+ <shortdesc lang="en">Do not lock resources to a cleanly shut down node longer than this</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="stonith-enabled">
	+ <longdesc lang="en">If false, unresponsive nodes are immediately assumed to be harmless, and resources that were active on them may be recovered elsewhere. This can result in a "split-brain" situation, potentially leading to data loss and/or service unavailability.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only * Whether nodes may be fenced as part of recovery</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="stonith-action">
	+ <longdesc lang="en">Action to send to fence device when a node needs to be fenced ("poweroff" is a deprecated alias for "off") Allowed values: reboot, off, poweroff</longdesc>
	+ <shortdesc lang="en">Action to send to fence device when a node needs to be fenced ("poweroff" is a deprecated alias for "off")</shortdesc>
	+ <content type="select" default="">
	+ <option value="reboot" />
	+ <option value="off" />
	+ <option value="poweroff" />
	+ </content>
	+ </parameter>
	+ <parameter name="stonith-timeout">
	+ <longdesc lang="en">This value is not used by Pacemaker, but is kept for backward compatibility, and certain legacy fence agents might use it.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only * Unused by Pacemaker</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="have-watchdog">
	+ <longdesc lang="en">This is set automatically by the cluster according to whether SBD is detected to be in use. User-configured values are ignored. The value `true` is meaningful if diskless SBD is used and `stonith-watchdog-timeout` is nonzero. In that case, if fencing is required, watchdog-based self-fencing will be performed via SBD without requiring a fencing resource explicitly configured.</longdesc>
	+ <shortdesc lang="en">Whether watchdog integration is enabled</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="concurrent-fencing">
	+ <longdesc lang="en">Allow performing fencing operations in parallel</longdesc>
	+ <shortdesc lang="en">Allow performing fencing operations in parallel</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="startup-fencing">
	+ <longdesc lang="en">Setting this to false may lead to a "split-brain" situation,potentially leading to data loss and/or service unavailability.</longdesc>
	+ <shortdesc lang="en">* Advanced Use Only * Whether to fence unseen nodes at start-up</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="priority-fencing-delay">
	+ <longdesc lang="en">Apply specified delay for the fencings that are targeting the lost nodes with the highest total resource priority in case we don't have the majority of the nodes in our cluster partition, so that the more significant nodes potentially win any fencing match, which is especially meaningful under split-brain of 2-node cluster. A promoted resource instance takes the base priority + 1 on calculation if the base priority is not 0. Any static/random delays that are introduced by `pcmk_delay_base/max` configured for the corresponding fencing resources will be added to this delay. This delay should be significantly greater than, safely twice, the maximum `pcmk_delay_base/max`. By default, priority fencing delay is disabled.</longdesc>
	+ <shortdesc lang="en">Apply fencing delay targeting the lost nodes with the highest total resource priority</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="cluster-delay">
	+ <longdesc lang="en">The node elected Designated Controller (DC) will consider an action failed if it does not get a response from the node executing the action within this time (after considering the action's own timeout). The "correct" value will depend on the speed and load of your network and cluster nodes.</longdesc>
	+ <shortdesc lang="en">Maximum time for node-to-node communication</shortdesc>
	+ <content type="time" default=""/>
	+ </parameter>
	+ <parameter name="batch-limit">
	+ <longdesc lang="en">The "correct" value will depend on the speed and load of your network and cluster nodes. If set to 0, the cluster will impose a dynamically calculated limit when any node has a high load.</longdesc>
	+ <shortdesc lang="en">Maximum number of jobs that the cluster may execute in parallel across all nodes</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="migration-limit">
	+ <longdesc lang="en">The number of live migration actions that the cluster is allowed to execute in parallel on a node (-1 means no limit)</longdesc>
	+ <shortdesc lang="en">The number of live migration actions that the cluster is allowed to execute in parallel on a node (-1 means no limit)</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="stop-all-resources">
	+ <longdesc lang="en">Whether the cluster should stop all active resources</longdesc>
	+ <shortdesc lang="en">Whether the cluster should stop all active resources</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="stop-orphan-resources">
	+ <longdesc lang="en">Whether to stop resources that were removed from the configuration</longdesc>
	+ <shortdesc lang="en">Whether to stop resources that were removed from the configuration</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="stop-orphan-actions">
	+ <longdesc lang="en">Whether to cancel recurring actions removed from the configuration</longdesc>
	+ <shortdesc lang="en">Whether to cancel recurring actions removed from the configuration</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="remove-after-stop">
	+ <longdesc lang="en">Values other than default are poorly tested and potentially dangerous. This option will be removed in a future release.</longdesc>
	+ <shortdesc lang="en">* Deprecated * Whether to remove stopped resources from the executor</shortdesc>
	+ <content type="boolean" default=""/>
	+ </parameter>
	+ <parameter name="pe-error-series-max">
	+ <longdesc lang="en">Zero to disable, -1 to store unlimited.</longdesc>
	+ <shortdesc lang="en">The number of scheduler inputs resulting in errors to save</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pe-warn-series-max">
	+ <longdesc lang="en">Zero to disable, -1 to store unlimited.</longdesc>
	+ <shortdesc lang="en">The number of scheduler inputs resulting in warnings to save</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="pe-input-series-max">
	+ <longdesc lang="en">Zero to disable, -1 to store unlimited.</longdesc>
	+ <shortdesc lang="en">The number of scheduler inputs without errors or warnings to save</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="node-health-strategy">
	+ <longdesc lang="en">Requires external entities to create node attributes (named with the prefix "#health") with values "red", "yellow", or "green". Allowed values: none, migrate-on-red, only-green, progressive, custom</longdesc>
	+ <shortdesc lang="en">How cluster should react to node health attributes</shortdesc>
	+ <content type="select" default="">
	+ <option value="none" />
	+ <option value="migrate-on-red" />
	+ <option value="only-green" />
	+ <option value="progressive" />
	+ <option value="custom" />
	+ </content>
	+ </parameter>
	+ <parameter name="node-health-base">
	+ <longdesc lang="en">Only used when node-health-strategy is set to progressive.</longdesc>
	+ <shortdesc lang="en">Base health score assigned to a node</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="node-health-green">
	+ <longdesc lang="en">Only used when node-health-strategy is set to custom or progressive.</longdesc>
	+ <shortdesc lang="en">The score to use for a node health attribute whose value is "green"</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="node-health-yellow">
	+ <longdesc lang="en">Only used when node-health-strategy is set to custom or progressive.</longdesc>
	+ <shortdesc lang="en">The score to use for a node health attribute whose value is "yellow"</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="node-health-red">
	+ <longdesc lang="en">Only used when node-health-strategy is set to custom or progressive.</longdesc>
	+ <shortdesc lang="en">The score to use for a node health attribute whose value is "red"</shortdesc>
	+ <content type="integer" default=""/>
	+ </parameter>
	+ <parameter name="placement-strategy">
	+ <longdesc lang="en">How the cluster should allocate resources to nodes Allowed values: default, utilization, minimal, balanced</longdesc>
	+ <shortdesc lang="en">How the cluster should allocate resources to nodes</shortdesc>
	+ <content type="select" default="">
	+ <option value="default" />
	+ <option value="utilization" />
	+ <option value="minimal" />
	+ <option value="balanced" />
	+ </content>
	+ </parameter>
	+ </parameters>
	+</resource-agent>
	+=#=#=#= End test: Get scheduler metadata - OK (0) =#=#=#=
	+* Passed: pacemaker-schedulerd - Get scheduler metadata
	diff --git a/cts/cts-cli.in b/cts/cts-cli.in
	index a725d6cd8e..9685303442 100755
	--- a/cts/cts-cli.in
	+++ b/cts/cts-cli.in
	@@ -1,2536 +1,2564 @@
	#!@BASH_PATH@
	#
	# Copyright 2008-2022 the Pacemaker project contributors
	#
	# The version control history for this file may have further details.
	#
	# This source code is licensed under the GNU General Public License version 2
	# or later (GPLv2+) WITHOUT ANY WARRANTY.
	#

	# Set the exit status of a command to the exit code of the last program to
	# exit non-zero. This is bash-specific.
	set -o pipefail

	#
	# Note on portable usage of sed: GNU/POSIX/*BSD sed have a limited subset of
	# compatible functionality. Do not use the -i option, alternation (\\|),
	# \0, or character sequences such as \n or \s.
	#

	USAGE_TEXT="Usage: cts-cli [<options>]
	Options:
	--help Display this text, then exit
	-V, --verbose Display any differences from expected output
	-t 'TEST [...]' Run only specified tests
	- (default: 'dates error_codes tools crm_mon acls validity
	- upgrade rules feature_set').
	+ (default: 'daemons dates error_codes tools crm_mon acls
	+ validity upgrade rules feature_set').
	Other tests: agents (must be run in an installed environment).
	-p DIR Look for executables in DIR (may be specified multiple times)
	-v, --valgrind Run all commands under valgrind
	-s Save actual output as expected output"

	# If readlink supports -e (i.e. GNU), use it
	readlink -e / >/dev/null 2>/dev/null
	if [ $? -eq 0 ]; then
	test_home="$(dirname "$(readlink -e "$0")")"
	else
	test_home="$(dirname "$0")"
	fi

	: ${shadow=cts-cli}
	shadow_dir=$(mktemp -d ${TMPDIR:-/tmp}/cts-cli.shadow.XXXXXXXXXX)
	num_errors=0
	num_passed=0
	verbose=0
	-tests="dates error_codes tools crm_mon acls validity upgrade rules feature_set"
	+tests="daemons dates error_codes tools crm_mon acls validity upgrade rules "
	+tests="$tests feature_set"
	do_save=0
	XMLLINT_CMD=
	VALGRIND_CMD=
	VALGRIND_OPTS="
	-q
	--gen-suppressions=all
	--show-reachable=no
	--leak-check=full
	--trace-children=no
	--time-stamp=yes
	--num-callers=20
	--suppressions=$test_home/valgrind-pcmk.suppressions
	"

	# Temp files for saving a command's stdout/stderr in _test_assert()
	test_assert_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_outfile.XXXXXXXXXX)
	test_assert_errfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_errfile.XXXXXXXXXX)
	xmllint_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.xmllint_outfile.XXXXXXXXXX)

	# Log test errors to stderr
	export PCMK_stderr=1

	# Output when PCMK_trace_functions is undefined is different from when it's
	# empty. Later we save the value of PCMK_trace_functions, do work, and restore
	# the original value. Getting back to the initial state is simplest if we assume
	# the variable is defined.
	: ${PCMK_trace_functions=""}
	export PCMK_trace_functions

	# These constants must track crm_exit_t values
	CRM_EX_OK=0
	CRM_EX_ERROR=1
	CRM_EX_INVALID_PARAM=2
	CRM_EX_UNIMPLEMENT_FEATURE=3
	CRM_EX_INSUFFICIENT_PRIV=4
	CRM_EX_NOT_CONFIGURED=6
	CRM_EX_USAGE=64
	CRM_EX_DATAERR=65
	CRM_EX_CONFIG=78
	CRM_EX_OLD=103
	CRM_EX_DIGEST=104
	CRM_EX_NOSUCH=105
	CRM_EX_UNSAFE=107
	CRM_EX_EXISTS=108
	CRM_EX_MULTIPLE=109
	CRM_EX_EXPIRED=110
	CRM_EX_NOT_YET_IN_EFFECT=111

	reset_shadow_cib_version() {
	local SHADOWPATH

	SHADOWPATH="$(crm_shadow --file)"
	# sed -i isn't portable :-(
	cp -p "$SHADOWPATH" "${SHADOWPATH}.$$" # preserve permissions
	sed -e 's/epoch="[0-9]*"/epoch="1"/g' \
	-e 's/num_updates="[0-9]*"/num_updates="0"/g' \
	-e 's/admin_epoch="[0-9]*"/admin_epoch="0"/g' \
	"$SHADOWPATH" > "${SHADOWPATH}.$$"
	mv -- "${SHADOWPATH}.$$" "$SHADOWPATH"
	}

	# A newly created empty CIB might or might not have a rsc_defaults section
	# depending on whether the --with-resource-stickiness-default configure
	# option was used. To ensure regression tests behave the same either way,
	# delete any rsc_defaults after creating or erasing a CIB.
	delete_shadow_resource_defaults() {
	cibadmin --delete --xml-text '<rsc_defaults/>'

	# The above command might or might not bump the CIB version, so reset it
	# to ensure future changes result in the same version for comparison.
	reset_shadow_cib_version
	}

	create_shadow_cib() {
	local VALIDATE_WITH
	local SHADOW_CMD

	VALIDATE_WITH="$1"

	export CIB_shadow_dir="${shadow_dir}"

	SHADOW_CMD="$VALGRIND_CMD crm_shadow --batch --force --create-empty"
	if [ -z "$VALIDATE_WITH" ]; then
	$SHADOW_CMD "$shadow" 2>&1
	else
	$SHADOW_CMD "$shadow" --validate-with="${VALIDATE_WITH}" 2>&1
	fi

	export CIB_shadow="$shadow"
	delete_shadow_resource_defaults
	}

	function _test_assert() {
	target=$1; shift
	validate=$1; shift
	cib=$1; shift
	app=`echo "$cmd" \| sed 's/\ .*//'`
	printf "* Running: $app - $desc\n" 1>&2

	printf "=#=#=#= Begin test: $desc =#=#=#=\n"

	# Capture stderr and stdout separately, then print them consecutively
	eval $VALGRIND_CMD $cmd > "$test_assert_outfile" 2> "$test_assert_errfile"
	rc=$?
	cat "$test_assert_errfile"
	cat "$test_assert_outfile"

	if [ x$cib != x0 ]; then
	printf "=#=#=#= Current cib after: $desc =#=#=#=\n"
	CIB_user=root cibadmin -Q
	fi

	# Do not validate if running under valgrind, even if told to do so. Valgrind
	# will output a lot more stuff that is not XML, so it wouldn't validate anyway.
	if [ "$validate" = "1" ] && [ "$VALGRIND_CMD" = "" ] && [ $rc = 0 ] && [ "$XMLLINT_CMD" != "" ]; then
	# The sed command filters out the "- validates" line that xmllint will output
	# on success. grep cannot be used here because "grep -v 'validates$'" will
	# return an exit code of 1 if its input consists entirely of "- validates".
	$XMLLINT_CMD --noout --relaxng \
	"$PCMK_schema_directory/api/api-result.rng" "$test_assert_outfile" \
	> "$xmllint_outfile" 2>&1
	rc=$?

	sed -n '/validates$/ !p' "$xmllint_outfile"

	if [ $rc = 0 ]; then
	printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
	else
	printf "=#=#=#= End test: %s - Failed to validate (%d) =#=#=#=\n" "$desc" $rc
	fi
	else
	printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
	fi

	if [ $rc -ne $target ]; then
	num_errors=$(( $num_errors + 1 ))
	printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc"
	printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc (`which $app`)" 1>&2
	return
	exit $CRM_EX_ERROR
	else
	printf "* Passed: %-14s - %s\n" $app "$desc"
	num_passed=$(( $num_passed + 1 ))
	fi
	}

	function test_assert() {
	_test_assert $1 0 $2
	}

	function test_assert_validate() {
	_test_assert $1 1 $2
	}

	# Tests that depend on resource agents and must be run in an installed
	# environment
	function test_agents() {
	desc="Validate a valid resource configuration"
	cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
	test_assert $CRM_EX_OK 0

	desc="Validate a valid resource configuration (XML)"
	cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
	cmd="$cmd --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	# Make the Dummy configuration invalid (op_sleep can't be a generic string)
	export OCF_RESKEY_op_sleep=asdf

	desc="Validate an invalid resource configuration"
	cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
	test_assert $CRM_EX_NOT_CONFIGURED 0

	desc="Validate an invalid resource configuration (XML)"
	cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
	cmd="$cmd --output-as=xml"
	test_assert_validate $CRM_EX_NOT_CONFIGURED 0

	unset OCF_RESKEY_op_sleep
	export OCF_RESKEY_op_sleep
	}

	+function test_daemons() {
	+ desc="Get CIB manager metadata"
	+ cmd="pacemaker-based metadata"
	+ test_assert $CRM_EX_OK 0
	+
	+ desc="Get controller metadata"
	+ cmd="pacemaker-controld metadata"
	+ test_assert $CRM_EX_OK 0
	+
	+ desc="Get fencer metadata"
	+ cmd="pacemaker-fenced metadata"
	+ test_assert $CRM_EX_OK 0
	+
	+ desc="Get scheduler metadata"
	+ cmd="pacemaker-schedulerd metadata"
	+ test_assert $CRM_EX_OK 0
	+}
	+
	function test_crm_mon() {
	local TMPXML
	export CIB_file="$test_home/cli/crm_mon.xml"

	desc="Basic text output"
	cmd="crm_mon -1"
	test_assert $CRM_EX_OK 0

	desc="XML output"
	cmd="crm_mon --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output without node section"
	cmd="crm_mon -1 --exclude=nodes"
	test_assert $CRM_EX_OK 0

	desc="XML output without the node section"
	cmd="crm_mon --output-as=xml --exclude=nodes"
	test_assert_validate $CRM_EX_OK 0

	desc="Text output with only the node section"
	cmd="crm_mon -1 --exclude=all --include=nodes"
	test_assert $CRM_EX_OK 0

	# The above test doesn't need to be performed for other output formats. It's
	# really just a test to make sure that blank lines are correct.

	desc="Complete text output"
	cmd="crm_mon -1 --include=all"
	test_assert $CRM_EX_OK 0

	# XML includes everything already so there's no need for a complete test

	desc="Complete text output with detail"
	cmd="crm_mon -1R --include=all"
	test_assert $CRM_EX_OK 0

	# XML includes detailed output already

	desc="Complete brief text output"
	cmd="crm_mon -1 --include=all --brief"
	test_assert $CRM_EX_OK 0

	desc="Complete text output grouped by node"
	cmd="crm_mon -1 --include=all --group-by-node"
	test_assert $CRM_EX_OK 0

	# XML does not have a brief output option

	desc="Complete brief text output grouped by node"
	cmd="crm_mon -1 --include=all --group-by-node --brief"
	test_assert $CRM_EX_OK 0

	desc="XML output grouped by node"
	cmd="crm_mon -1 --output-as=xml --group-by-node"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by node"
	cmd="crm_mon -1 --include=all --node=cluster01"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by node"
	cmd="crm_mon --output-as xml --include=all --node=cluster01"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by tag"
	cmd="crm_mon -1 --include=all --node=even-nodes"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by tag"
	cmd="crm_mon --output-as=xml --include=all --node=even-nodes"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by resource tag"
	cmd="crm_mon -1 --include=all --resource=fencing-rscs"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by resource tag"
	cmd="crm_mon --output-as=xml --include=all --resource=fencing-rscs"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output filtered by node that doesn't exist"
	cmd="crm_mon -1 --node=blah"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by node that doesn't exist"
	cmd="crm_mon --output-as=xml --node=blah"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output with inactive resources"
	cmd="crm_mon -1 -r"
	test_assert $CRM_EX_OK 0

	# XML already includes inactive resources

	desc="Basic text output with inactive resources, filtered by node"
	cmd="crm_mon -1 -r --node=cluster02"
	test_assert $CRM_EX_OK 0

	# XML already includes inactive resources

	desc="Complete text output filtered by primitive resource"
	cmd="crm_mon -1 --include=all --resource=Fencing"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by primitive resource"
	cmd="crm_mon --output-as=xml --resource=Fencing"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by group resource"
	cmd="crm_mon -1 --include=all --resource=exim-group"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by group resource"
	cmd="crm_mon --output-as=xml --resource=exim-group"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by group resource member"
	cmd="crm_mon -1 --include=all --resource=Public-IP"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by group resource member"
	cmd="crm_mon --output-as=xml --resource=Email"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by clone resource"
	cmd="crm_mon -1 --include=all --resource=ping-clone"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by clone resource"
	cmd="crm_mon --output-as=xml --resource=ping-clone"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by clone resource instance"
	cmd="crm_mon -1 --include=all --resource=ping"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by clone resource instance"
	cmd="crm_mon --output-as=xml --resource=ping"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output filtered by exact clone resource instance"
	cmd="crm_mon -1 --include=all --show-detail --resource=ping:0"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by exact clone resource instance"
	cmd="crm_mon --output-as=xml --resource=ping:1"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output filtered by resource that doesn't exist"
	cmd="crm_mon -1 --resource=blah"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by resource that doesn't exist"
	cmd="crm_mon --output-as=xml --resource=blah"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output with inactive resources, filtered by tag"
	cmd="crm_mon -1 -r --resource=inactive-rscs"
	test_assert $CRM_EX_OK 0

	desc="Basic text output with inactive resources, filtered by bundle resource"
	cmd="crm_mon -1 -r --resource=httpd-bundle"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by inactive bundle resource"
	cmd="crm_mon --output-as=xml --resource=httpd-bundle"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output with inactive resources, filtered by bundled IP address resource"
	cmd="crm_mon -1 -r --resource=httpd-bundle-ip-192.168.122.131"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by bundled IP address resource"
	cmd="crm_mon --output-as=xml --resource=httpd-bundle-ip-192.168.122.132"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output with inactive resources, filtered by bundled container"
	cmd="crm_mon -1 -r --resource=httpd-bundle-docker-1"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by bundled container"
	cmd="crm_mon --output-as=xml --resource=httpd-bundle-docker-2"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output with inactive resources, filtered by bundle connection"
	cmd="crm_mon -1 -r --resource=httpd-bundle-0"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by bundle connection"
	cmd="crm_mon --output-as=xml --resource=httpd-bundle-0"
	test_assert_validate $CRM_EX_OK 0

	desc="Basic text output with inactive resources, filtered by bundled primitive resource"
	cmd="crm_mon -1 -r --resource=httpd"
	test_assert $CRM_EX_OK 0

	desc="XML output filtered by bundled primitive resource"
	cmd="crm_mon --output-as=xml --resource=httpd"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output, filtered by clone name in cloned group"
	cmd="crm_mon -1 --include=all --show-detail --resource=mysql-clone-group"
	test_assert $CRM_EX_OK 0

	desc="XML output, filtered by clone name in cloned group"
	cmd="crm_mon --output-as=xml --resource=mysql-clone-group"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output, filtered by group name in cloned group"
	cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group"
	test_assert $CRM_EX_OK 0

	desc="XML output, filtered by group name in cloned group"
	cmd="crm_mon --output-as=xml --resource=mysql-group"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output, filtered by exact group instance name in cloned group"
	cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group:1"
	test_assert $CRM_EX_OK 0

	desc="XML output, filtered by exact group instance name in cloned group"
	cmd="crm_mon --output-as=xml --resource=mysql-group:1"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output, filtered by primitive name in cloned group"
	cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy"
	test_assert $CRM_EX_OK 0

	desc="XML output, filtered by primitive name in cloned group"
	cmd="crm_mon --output-as=xml --resource=mysql-proxy"
	test_assert_validate $CRM_EX_OK 0

	desc="Complete text output, filtered by exact primitive instance name in cloned group"
	cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy:1"
	test_assert $CRM_EX_OK 0

	desc="XML output, filtered by exact primitive instance name in cloned group"
	cmd="crm_mon --output-as=xml --resource=mysql-proxy:1"
	test_assert_validate $CRM_EX_OK 0

	unset CIB_file

	export CIB_file="$test_home/cli/crm_mon-partial.xml"

	desc="Text output of partially active resources"
	cmd="crm_mon -1 --show-detail"
	test_assert $CRM_EX_OK 0

	desc="XML output of partially active resources"
	cmd="crm_mon -1 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Text output of partially active resources, with inactive resources"
	cmd="crm_mon -1 -r --show-detail"
	test_assert $CRM_EX_OK 0

	# XML already includes inactive resources

	desc="Complete brief text output, with inactive resources"
	cmd="crm_mon -1 -r --include=all --brief --show-detail"
	test_assert $CRM_EX_OK 0

	# XML does not have a brief output option

	desc="Text output of partially active group"
	cmd="crm_mon -1 --resource=partially-active-group"
	test_assert $CRM_EX_OK 0

	desc="Text output of partially active group, with inactive resources"
	cmd="crm_mon -1 --resource=partially-active-group -r"
	test_assert $CRM_EX_OK 0

	desc="Text output of active member of partially active group"
	cmd="crm_mon -1 --resource=dummy-1"
	test_assert $CRM_EX_OK 0

	desc="Text output of inactive member of partially active group"
	cmd="crm_mon -1 --resource=dummy-2 --show-detail"
	test_assert $CRM_EX_OK 0

	desc="Complete brief text output grouped by node, with inactive resources"
	cmd="crm_mon -1 -r --include=all --group-by-node --brief --show-detail"
	test_assert $CRM_EX_OK 0

	desc="Text output of partially active resources, with inactive resources, filtered by node"
	cmd="crm_mon -1 -r --node=cluster01"
	test_assert $CRM_EX_OK 0

	desc="Text output of partially active resources, filtered by node"
	cmd="crm_mon -1 --output-as=xml --node=cluster01"
	test_assert_validate $CRM_EX_OK 0

	unset CIB_file

	export CIB_file="$test_home/cli/crm_mon-unmanaged.xml"

	desc="Text output of active unmanaged resource on offline node"
	cmd="crm_mon -1"
	test_assert $CRM_EX_OK 0

	desc="XML output of active unmanaged resource on offline node"
	cmd="crm_mon -1 --output-as=xml"
	test_assert $CRM_EX_OK 0

	desc="Brief text output of active unmanaged resource on offline node"
	cmd="crm_mon -1 --brief"
	test_assert $CRM_EX_OK 0

	desc="Brief text output of active unmanaged resource on offline node, grouped by node"
	cmd="crm_mon -1 --brief --group-by-node"
	test_assert $CRM_EX_OK 0

	export CIB_file=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_mon.xml.XXXXXXXXXX)
	sed -e '/maintenance-mode/ s/false/true/' "$test_home/cli/crm_mon.xml" > $CIB_file

	desc="Text output of all resources with maintenance-mode enabled"
	cmd="crm_mon -1 -r"
	test_assert $CRM_EX_OK 0

	rm -r "$CIB_file"
	unset CIB_file

	export CIB_file="$test_home/cli/crm_mon-T180.xml"

	desc="Text output of guest node's container on different node from its"
	desc="$desc remote resource"
	cmd="crm_mon -1"
	test_assert $CRM_EX_OK 0

	desc="Complete text output of guest node's container on different node from"
	desc="$desc its remote resource"
	cmd="crm_mon -1 --show-detail"
	test_assert $CRM_EX_OK 0

	unset CIB_file
	}

	function test_error_codes() {
	# Note: At the time of this writing, crm_error returns success even for
	# unknown error codes. We don't want to cause a regression by changing that.

	# Due to the way _test_assert() formats output, we need "crm_error" to be
	# the first token of cmd. We can't start with a parenthesis or variable
	# assignment. However, in the "list result codes" tests, we also need to
	# save some output for later processing. We'll use a temp file for this.
	local TMPFILE
	TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_error_out.XXXXXXXXXX)

	# Legacy return codes
	#
	# Don't test unknown legacy code. FreeBSD includes a colon in strerror(),
	# while other distros do not.
	desc="Get legacy return code"
	cmd="crm_error -- 201"
	test_assert $CRM_EX_OK 0

	desc="Get legacy return code (XML)"
	cmd="crm_error --output-as=xml -- 201"
	test_assert_validate $CRM_EX_OK 0

	desc="Get legacy return code (with name)"
	cmd="crm_error -n -- 201"
	test_assert $CRM_EX_OK 0

	desc="Get legacy return code (with name) (XML)"
	cmd="crm_error -n --output-as=xml -- 201"
	test_assert_validate $CRM_EX_OK 0

	desc="Get multiple legacy return codes"
	cmd="crm_error -- 201 202"
	test_assert $CRM_EX_OK 0

	desc="Get multiple legacy return codes (XML)"
	cmd="crm_error --output-as=xml -- 201 202"
	test_assert_validate $CRM_EX_OK 0

	desc="Get multiple legacy return codes (with names)"
	cmd="crm_error -n -- 201 202"
	test_assert $CRM_EX_OK 0

	desc="Get multiple legacy return codes (with names) (XML)"
	cmd="crm_error -n --output-as=xml -- 201 202"
	test_assert_validate $CRM_EX_OK 0

	# We can only rely on our custom codes, so we'll spot-check codes 201-209
	desc="List legacy return codes (spot check)"
	cmd="crm_error -l \| grep 20[1-9]"
	test_assert $CRM_EX_OK 0

	desc="List legacy return codes (spot check) (XML)"
	cmd="crm_error -l --output-as=xml > $TMPFILE; rc=$?"
	cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]\|2[^0]\|20[^1-9])' $TMPFILE"
	cmd="$cmd; (exit $rc)"
	test_assert_validate $CRM_EX_OK 0

	desc="List legacy return codes (spot check) (with names)"
	cmd="crm_error -n -l \| grep 20[1-9]"
	test_assert $CRM_EX_OK 0

	desc="List legacy return codes (spot check) (with names) (XML)"
	cmd="crm_error -n -l --output-as=xml > $TMPFILE; rc=$?"
	cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]\|2[^0]\|20[^1-9])' $TMPFILE"
	cmd="$cmd; (exit $rc)"
	test_assert_validate $CRM_EX_OK 0

	# Standard Pacemaker return codes
	#
	# Don't test positive (system) error codes, which may vary by OS

	desc="Get unknown Pacemaker return code"
	cmd="crm_error -r -- -10000"
	test_assert $CRM_EX_OK 0

	desc="Get unknown Pacemaker return code (XML)"
	cmd="crm_error -r --output-as=xml -- -10000"
	test_assert_validate $CRM_EX_OK 0

	desc="Get unknown Pacemaker return code (with name)"
	cmd="crm_error -n -r -- -10000"
	test_assert $CRM_EX_OK 0

	desc="Get unknown Pacemaker return code (with name) (XML)"
	cmd="crm_error -n -r --output-as=xml -- -10000"
	test_assert_validate $CRM_EX_OK 0

	# Negative return codes require parsing out the "--" explicitly, so we need
	# to test them as a separate case
	desc="Get negative Pacemaker return code"
	cmd="crm_error -r -- -1005"
	test_assert $CRM_EX_OK 0

	desc="Get negative Pacemaker return code (XML)"
	cmd="crm_error -r --output-as=xml -- -1005"
	test_assert_validate $CRM_EX_OK 0

	# Testing name lookups for negative return codes only is sufficient
	desc="Get negative Pacemaker return code (with name)"
	cmd="crm_error -n -r -- -1005"
	test_assert $CRM_EX_OK 0

	desc="Get negative Pacemaker return code (with name) (XML)"
	cmd="crm_error -n -r --output-as=xml -- -1005"
	test_assert_validate $CRM_EX_OK 0

	# We can only rely on our custom codes (negative and zero)
	desc="List Pacemaker return codes (non-positive)"
	cmd="crm_error -l -r \| grep -E '^[[:blank:]]*(-[[:digit:]]+\|0):'"
	test_assert $CRM_EX_OK 0

	desc="List Pacemaker return codes (non-positive) (XML)"
	cmd="crm_error -l -r --output-as=xml > $TMPFILE; rc=$?"
	cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
	cmd="$cmd; (exit $rc)"
	test_assert_validate $CRM_EX_OK 0

	desc="List Pacemaker return codes (non-positive) (with names)"
	cmd="crm_error -n -l -r \| grep -E '^[[:blank:]]*(-[[:digit:]]+\|0):'"
	test_assert $CRM_EX_OK 0

	desc="List Pacemaker return codes (non-positive) (with names) (XML)"
	cmd="crm_error -n -l -r --output-as=xml > $TMPFILE; rc=$?"
	cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
	cmd="$cmd; (exit $rc)"
	test_assert_validate $CRM_EX_OK 0

	# crm_exit_t exit codes

	desc="Get unknown crm_exit_t exit code"
	cmd="crm_error -X -- -10000"
	test_assert $CRM_EX_OK 0

	desc="Get unknown crm_exit_t exit code (XML)"
	cmd="crm_error -X --output-as=xml -- -10000"
	test_assert_validate $CRM_EX_OK 0

	desc="Get unknown crm_exit_t exit code (with name)"
	cmd="crm_error -n -X -- -10000"
	test_assert $CRM_EX_OK 0

	desc="Get unknown crm_exit_t exit code (with name) (XML)"
	cmd="crm_error -n -X --output-as=xml -- -10000"
	test_assert_validate $CRM_EX_OK 0

	desc="Get crm_exit_t exit code"
	cmd="crm_error -X -- 1"
	test_assert $CRM_EX_OK 0

	desc="Get crm_exit_t exit code (XML)"
	cmd="crm_error -X --output-as=xml -- 1"
	test_assert_validate $CRM_EX_OK 0

	desc="Get crm_exit_t exit code (with name)"
	cmd="crm_error -n -X -- 1"
	test_assert $CRM_EX_OK 0

	desc="Get crm_exit_t exit code (with name) (XML)"
	cmd="crm_error -n -X --output-as=xml -- 1"
	test_assert_validate $CRM_EX_OK 0

	desc="Get all crm_exit_t exit codes"
	cmd="crm_error -l -X"
	test_assert $CRM_EX_OK 0

	desc="Get all crm_exit_t exit codes (XML)"
	cmd="crm_error -l -X --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Get all crm_exit_t exit codes (with name)"
	cmd="crm_error -l -n -X"
	test_assert $CRM_EX_OK 0

	desc="Get all crm_exit_t exit codes (with name) (XML)"
	cmd="crm_error -l -n -X --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	rm -f "$TMPFILE"
	}

	function test_tools() {
	local TMPXML
	local TMPORIG

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	TMPORIG=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.existing.xml.XXXXXXXXXX)

	create_shadow_cib

	desc="Validate CIB"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_OK

	desc="Query the value of an attribute that does not exist"
	cmd="crm_attribute -n ABCD --query --quiet"
	test_assert $CRM_EX_NOSUCH 0

	desc="Configure something before erasing"
	cmd="crm_attribute -n cluster-delay -v 60s"
	test_assert $CRM_EX_OK

	desc="Require --force for CIB erasure"
	cmd="cibadmin -E"
	test_assert $CRM_EX_UNSAFE

	desc="Allow CIB erasure with --force"
	cmd="cibadmin -E --force"
	test_assert $CRM_EX_OK 0

	# Skip outputting the resulting CIB in the previous command, and delete
	# rsc_defaults now, so tests behave the same regardless of build options.
	delete_shadow_resource_defaults

	# Verify the output after erasure
	desc="Query CIB"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_OK

	# Save a copy of the CIB for a later test
	cibadmin -Q > "$TMPORIG"

	desc="Set cluster option"
	cmd="crm_attribute -n cluster-delay -v 60s"
	test_assert $CRM_EX_OK

	desc="Query new cluster option"
	cmd="cibadmin -Q -o crm_config \| grep cib-bootstrap-options-cluster-delay"
	test_assert $CRM_EX_OK

	desc="Query cluster options"
	cmd="cibadmin -Q -o crm_config > $TMPXML"
	test_assert $CRM_EX_OK

	desc="Set no-quorum policy"
	cmd="crm_attribute -n no-quorum-policy -v ignore"
	test_assert $CRM_EX_OK

	desc="Delete nvpair"
	cmd="cibadmin -D -o crm_config --xml-text '<nvpair id=\"cib-bootstrap-options-cluster-delay\"/>'"
	test_assert $CRM_EX_OK

	desc="Create operation should fail"
	cmd="cibadmin -C -o crm_config --xml-file $TMPXML"
	test_assert $CRM_EX_EXISTS

	desc="Modify cluster options section"
	cmd="cibadmin -M -o crm_config --xml-file $TMPXML"
	test_assert $CRM_EX_OK

	desc="Query updated cluster option"
	cmd="cibadmin -Q -o crm_config \| grep cib-bootstrap-options-cluster-delay"
	test_assert $CRM_EX_OK

	desc="Set duplicate cluster option"
	cmd="crm_attribute -n cluster-delay -v 40s -s duplicate"
	test_assert $CRM_EX_OK

	desc="Setting multiply defined cluster option should fail"
	cmd="crm_attribute -n cluster-delay -v 30s"
	test_assert $CRM_EX_MULTIPLE

	desc="Set cluster option with -s"
	cmd="crm_attribute -n cluster-delay -v 30s -s duplicate"
	test_assert $CRM_EX_OK

	desc="Delete cluster option with -i"
	cmd="crm_attribute -n cluster-delay -D -i cib-bootstrap-options-cluster-delay"
	test_assert $CRM_EX_OK

	desc="Create node1 and bring it online"
	cmd="crm_simulate --live-check --in-place --node-up=node1"
	test_assert $CRM_EX_OK

	desc="Create node attribute"
	cmd="crm_attribute -n ram -v 1024M -N node1 -t nodes"
	test_assert $CRM_EX_OK

	desc="Query new node attribute"
	cmd="cibadmin -Q -o nodes \| grep node1-ram"
	test_assert $CRM_EX_OK

	desc="Set a transient (fail-count) node attribute"
	cmd="crm_attribute -n fail-count-foo -v 3 -N node1 -t status"
	test_assert $CRM_EX_OK

	desc="Query a fail count"
	cmd="crm_failcount --query -r foo -N node1"
	test_assert $CRM_EX_OK

	desc="Show node attributes with crm_simulate"
	cmd="crm_simulate --live-check --show-attrs"
	test_assert $CRM_EX_OK 0

	desc="Set a second transient node attribute"
	cmd="crm_attribute -n fail-count-bar -v 5 -N node1 -t status"
	test_assert $CRM_EX_OK

	desc="Query node attributes by pattern"
	cmd="crm_attribute -t status -P fail-count -N node1 --query"
	test_assert $CRM_EX_OK 0

	desc="Update node attributes by pattern"
	cmd="crm_attribute -t status -P fail-count -N node1 -v 10"
	test_assert $CRM_EX_OK

	desc="Delete node attributes by pattern"
	cmd="crm_attribute -t status -P fail-count -N node1 -D"
	test_assert $CRM_EX_OK

	desc="crm_attribute given invalid pattern usage"
	cmd="crm_attribute -t nodes -P fail-count -N node1 -D"
	test_assert $CRM_EX_USAGE 0

	desc="crm_attribute given invalid delete usage"
	cmd="crm_attribute -t nodes -N node1 -D"
	test_assert $CRM_EX_USAGE 0

	desc="Digest calculation"
	cmd="cibadmin -Q \| cibadmin -5 -p 2>&1 > /dev/null"
	test_assert $CRM_EX_OK

	# This update will fail because it has version numbers
	desc="Replace operation should fail"
	cmd="cibadmin -R --xml-file $TMPORIG"
	test_assert $CRM_EX_OLD

	desc="Default standby value"
	cmd="crm_standby -N node1 -G"
	test_assert $CRM_EX_OK

	desc="Set standby status"
	cmd="crm_standby -N node1 -v true"
	test_assert $CRM_EX_OK

	desc="Query standby value"
	cmd="crm_standby -N node1 -G"
	test_assert $CRM_EX_OK

	desc="Delete standby value"
	cmd="crm_standby -N node1 -D"
	test_assert $CRM_EX_OK

	desc="Create a resource"
	cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
	test_assert $CRM_EX_OK

	desc="crm_resource run with extra arguments"
	cmd="crm_resource foo bar"
	test_assert $CRM_EX_USAGE 0

	desc="crm_resource given both -r and resource config"
	cmd="crm_resource -r xyz --class ocf --provider pacemaker --agent Dummy"
	test_assert $CRM_EX_USAGE 0

	desc="crm_resource given resource config with invalid action"
	cmd="crm_resource --class ocf --provider pacemaker --agent Dummy -D"
	test_assert $CRM_EX_USAGE 0

	desc="Create a resource meta attribute"
	cmd="crm_resource -r dummy --meta -p is-managed -v false"
	test_assert $CRM_EX_OK

	desc="Query a resource meta attribute"
	cmd="crm_resource -r dummy --meta -g is-managed"
	test_assert $CRM_EX_OK

	desc="Remove a resource meta attribute"
	cmd="crm_resource -r dummy --meta -d is-managed"
	test_assert $CRM_EX_OK

	desc="Create another resource meta attribute"
	cmd="crm_resource -r dummy --meta -p target-role -v Stopped --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Show why a resource is not running"
	cmd="crm_resource -Y -r dummy --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Remove another resource meta attribute"
	cmd="crm_resource -r dummy --meta -d target-role --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Create a resource attribute"
	cmd="crm_resource -r dummy -p delay -v 10s"
	test_assert $CRM_EX_OK

	desc="List the configured resources"
	cmd="crm_resource -L"
	test_assert $CRM_EX_OK

	desc="List the configured resources in XML"
	cmd="crm_resource -L --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Implicitly list the configured resources"
	cmd="crm_resource"
	test_assert $CRM_EX_OK 0

	desc="List IDs of instantiated resources"
	cmd="crm_resource -l"
	test_assert $CRM_EX_OK 0

	desc="Show XML configuration of resource"
	cmd="crm_resource -q -r dummy"
	test_assert $CRM_EX_OK 0

	desc="Show XML configuration of resource, output as XML"
	cmd="crm_resource -q -r dummy --output-as=xml"
	test_assert $CRM_EX_OK 0

	desc="Require a destination when migrating a resource that is stopped"
	cmd="crm_resource -r dummy -M"
	test_assert $CRM_EX_USAGE

	desc="Don't support migration to non-existent locations"
	cmd="crm_resource -r dummy -M -N i.do.not.exist"
	test_assert $CRM_EX_NOSUCH

	desc="Create a fencing resource"
	cmd="cibadmin -C -o resources --xml-text '<primitive id=\"Fence\" class=\"stonith\" type=\"fence_true\"/>'"
	test_assert $CRM_EX_OK

	desc="Bring resources online"
	cmd="crm_simulate --live-check --in-place -S"
	test_assert $CRM_EX_OK

	desc="Try to move a resource to its existing location"
	cmd="crm_resource -r dummy --move --node node1"
	test_assert $CRM_EX_EXISTS

	desc="Try to move a resource that doesn't exist"
	cmd="crm_resource -r xyz --move --node node1"
	test_assert $CRM_EX_NOSUCH 0

	desc="Move a resource from its existing location"
	cmd="crm_resource -r dummy --move"
	test_assert $CRM_EX_OK

	desc="Clear out constraints generated by --move"
	cmd="crm_resource -r dummy --clear"
	test_assert $CRM_EX_OK

	desc="Default ticket granted state"
	cmd="crm_ticket -t ticketA -G granted -d false"
	test_assert $CRM_EX_OK

	desc="Set ticket granted state"
	cmd="crm_ticket -t ticketA -r --force"
	test_assert $CRM_EX_OK

	desc="Query ticket granted state"
	cmd="crm_ticket -t ticketA -G granted"
	test_assert $CRM_EX_OK

	desc="Delete ticket granted state"
	cmd="crm_ticket -t ticketA -D granted --force"
	test_assert $CRM_EX_OK

	desc="Make a ticket standby"
	cmd="crm_ticket -t ticketA -s"
	test_assert $CRM_EX_OK

	desc="Query ticket standby state"
	cmd="crm_ticket -t ticketA -G standby"
	test_assert $CRM_EX_OK

	desc="Activate a ticket"
	cmd="crm_ticket -t ticketA -a"
	test_assert $CRM_EX_OK

	desc="Delete ticket standby state"
	cmd="crm_ticket -t ticketA -D standby"
	test_assert $CRM_EX_OK

	desc="Ban a resource on unknown node"
	cmd="crm_resource -r dummy -B -N host1"
	test_assert $CRM_EX_NOSUCH

	desc="Create two more nodes and bring them online"
	cmd="crm_simulate --live-check --in-place --node-up=node2 --node-up=node3"
	test_assert $CRM_EX_OK

	desc="Ban dummy from node1"
	cmd="crm_resource -r dummy -B -N node1"
	test_assert $CRM_EX_OK

	desc="Show where a resource is running"
	cmd="crm_resource -r dummy -W"
	test_assert $CRM_EX_OK 0

	desc="Show constraints on a resource"
	cmd="crm_resource -a -r dummy"
	test_assert $CRM_EX_OK 0

	desc="Ban dummy from node2"
	cmd="crm_resource -r dummy -B -N node2 --output-as=xml"
	test_assert_validate $CRM_EX_OK

	desc="Relocate resources due to ban"
	cmd="crm_simulate --live-check --in-place -S"
	test_assert $CRM_EX_OK

	desc="Move dummy to node1"
	cmd="crm_resource -r dummy -M -N node1 --output-as=xml"
	test_assert_validate $CRM_EX_OK

	desc="Clear implicit constraints for dummy on node2"
	cmd="crm_resource -r dummy -U -N node2"
	test_assert $CRM_EX_OK

	desc="Drop the status section"
	cmd="cibadmin -R -o status --xml-text '<status/>'"
	test_assert $CRM_EX_OK 0

	desc="Create a clone"
	cmd="cibadmin -C -o resources --xml-text '<clone id=\"test-clone\"><primitive id=\"test-primitive\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/></clone>'"
	test_assert $CRM_EX_OK 0

	desc="Create a resource meta attribute"
	cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
	test_assert $CRM_EX_OK

	desc="Create a resource meta attribute in the primitive"
	cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
	test_assert $CRM_EX_OK

	desc="Update resource meta attribute with duplicates"
	cmd="crm_resource -r test-clone --meta -p is-managed -v true"
	test_assert $CRM_EX_OK

	desc="Update resource meta attribute with duplicates (force clone)"
	cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
	test_assert $CRM_EX_OK

	desc="Update child resource meta attribute with duplicates"
	cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
	test_assert $CRM_EX_OK

	desc="Delete resource meta attribute with duplicates"
	cmd="crm_resource -r test-clone --meta -d is-managed"
	test_assert $CRM_EX_OK

	desc="Delete resource meta attribute in parent"
	cmd="crm_resource -r test-primitive --meta -d is-managed"
	test_assert $CRM_EX_OK

	desc="Create a resource meta attribute in the primitive"
	cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
	test_assert $CRM_EX_OK

	desc="Update existing resource meta attribute"
	cmd="crm_resource -r test-clone --meta -p is-managed -v true"
	test_assert $CRM_EX_OK

	desc="Create a resource meta attribute in the parent"
	cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
	test_assert $CRM_EX_OK

	desc="Copy resources"
	cmd="cibadmin -Q -o resources > $TMPXML"
	test_assert $CRM_EX_OK 0

	desc="Delete resource parent meta attribute (force)"
	cmd="crm_resource -r test-clone --meta -d is-managed --force"
	test_assert $CRM_EX_OK

	desc="Restore duplicates"
	cmd="cibadmin -R -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK

	desc="Delete resource child meta attribute"
	cmd="crm_resource -r test-primitive --meta -d is-managed"
	test_assert $CRM_EX_OK

	cibadmin -C -o resources --xml-text '<group id="dummy-group"> \
	<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"\/> \
	<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"\/> \
	</group>'

	desc="Create a resource meta attribute in dummy1"
	cmd="crm_resource -r dummy1 --meta -p is-managed -v true"
	test_assert $CRM_EX_OK

	desc="Create a resource meta attribute in dummy-group"
	cmd="crm_resource -r dummy-group --meta -p is-managed -v false"
	test_assert $CRM_EX_OK

	cibadmin -D -o resource --xml-text '<group id="dummy-group">'

	desc="Specify a lifetime when moving a resource"
	cmd="crm_resource -r dummy --move --node node2 --lifetime=PT1H"
	test_assert $CRM_EX_OK

	desc="Try to move a resource previously moved with a lifetime"
	cmd="crm_resource -r dummy --move --node node1"
	test_assert $CRM_EX_OK

	desc="Ban dummy from node1 for a short time"
	cmd="crm_resource -r dummy -B -N node1 --lifetime=PT1S"
	test_assert $CRM_EX_OK

	desc="Remove expired constraints"
	sleep 2
	cmd="crm_resource --clear --expired"
	test_assert $CRM_EX_OK

	# Clear has already been tested elsewhere, but we need to get rid of the
	# constraints so testing delete works. It won't delete if there's still
	# a reference to the resource somewhere.
	desc="Clear all implicit constraints for dummy"
	cmd="crm_resource -r dummy -U"
	test_assert $CRM_EX_OK

	desc="Set a node health strategy"
	cmd="crm_attribute -n node-health-strategy -v migrate-on-red"
	test_assert $CRM_EX_OK

	desc="Set a node health attribute"
	cmd="crm_attribute -N node3 -n '#health-cts-cli' -v red"
	test_assert $CRM_EX_OK

	desc="Show why a resource is not running on an unhealthy node"
	cmd="crm_resource -N node3 -Y -r dummy --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Delete a resource"
	cmd="crm_resource -D -r dummy -t primitive"
	test_assert $CRM_EX_OK

	unset CIB_shadow
	unset CIB_shadow_dir

	desc="Create an XML patchset"
	cmd="crm_diff -o $test_home/cli/crm_diff_old.xml -n $test_home/cli/crm_diff_new.xml"
	test_assert $CRM_EX_ERROR 0

	export CIB_file="$test_home/cli/constraints.xml"

	for rsc in prim1 prim2 prim3 prim4 prim5 prim6 prim7 prim8 prim9 \
	prim10 prim11 prim12 prim13 group clone; do
	desc="Check locations and constraints for $rsc"
	cmd="crm_resource -a -r $rsc"
	test_assert $CRM_EX_OK 0

	desc="Recursively check locations and constraints for $rsc"
	cmd="crm_resource -A -r $rsc"
	test_assert $CRM_EX_OK 0

	desc="Check locations and constraints for $rsc in XML"
	cmd="crm_resource -a -r $rsc --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Recursively check locations and constraints for $rsc in XML"
	cmd="crm_resource -A -r $rsc --output-as=xml"
	test_assert_validate $CRM_EX_OK 0
	done

	unset CIB_file

	export CIB_file="$test_home/cli/crm_resource_digests.xml"

	desc="Show resource digests"
	cmd="crm_resource --digests -r rsc1 -N node1 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Show resource digests with overrides"
	cmd="$cmd CRM_meta_interval=10000 CRM_meta_timeout=20000"
	test_assert $CRM_EX_OK 0

	unset CIB_file

	export CIB_file="$test_home/cli/crmadmin-cluster-remote-guest-nodes.xml"

	desc="List all nodes"
	cmd="crmadmin -N"
	test_assert $CRM_EX_OK 0

	desc="Minimally list all nodes"
	cmd="crmadmin -N -q"
	test_assert $CRM_EX_OK 0

	desc="List all nodes as bash exports"
	cmd="crmadmin -N -B"
	test_assert $CRM_EX_OK 0

	desc="List cluster nodes"
	cmd="crmadmin -N cluster \| wc -l \| grep 6"
	test_assert $CRM_EX_OK 0

	desc="List guest nodes"
	cmd="crmadmin -N guest \| wc -l \| grep 2"
	test_assert $CRM_EX_OK 0

	desc="List remote nodes"
	cmd="crmadmin -N remote \| wc -l \| grep 3"
	test_assert $CRM_EX_OK 0

	desc="List cluster,remote nodes"
	cmd="crmadmin -N cluster,remote \| wc -l \| grep 9"
	test_assert $CRM_EX_OK 0

	desc="List guest,remote nodes"
	cmd="crmadmin -N guest,remote \| wc -l \| grep 5"
	test_assert $CRM_EX_OK 0

	unset CIB_file

	export CIB_file="$test_home/cli/crm_mon.xml"
	export CIB_shadow_dir="${shadow_dir}"

	desc="Show allocation scores with crm_simulate"
	cmd="crm_simulate -x $CIB_file --show-scores --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Show utilization with crm_simulate"
	cmd="crm_simulate -x $CIB_file --show-utilization"
	test_assert $CRM_EX_OK 0

	desc="Simulate injecting a failure"
	cmd="crm_simulate -x $CIB_file -S -i ping_monitor_10000@cluster02=1"
	test_assert $CRM_EX_OK 0

	desc="Simulate bringing a node down"
	cmd="crm_simulate -x $CIB_file -S --node-down=cluster01"
	test_assert $CRM_EX_OK 0

	desc="Simulate a node failing"
	cmd="crm_simulate -x $CIB_file -S --node-fail=cluster02"
	test_assert $CRM_EX_OK 0

	unset CIB_shadow_dir

	desc="List a promotable clone resource"
	cmd="crm_resource --locate -r promotable-clone"
	test_assert $CRM_EX_OK 0

	desc="List the primitive of a promotable clone resource"
	cmd="crm_resource --locate -r promotable-rsc"
	test_assert $CRM_EX_OK 0

	desc="List a single instance of a promotable clone resource"
	cmd="crm_resource --locate -r promotable-rsc:0"
	test_assert $CRM_EX_OK 0

	desc="List another instance of a promotable clone resource"
	cmd="crm_resource --locate -r promotable-rsc:1"
	test_assert $CRM_EX_OK 0

	desc="List a promotable clone resource in XML"
	cmd="crm_resource --locate -r promotable-clone --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="List the primitive of a promotable clone resource in XML"
	cmd="crm_resource --locate -r promotable-rsc --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="List a single instance of a promotable clone resource in XML"
	cmd="crm_resource --locate -r promotable-rsc:0 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="List another instance of a promotable clone resource in XML"
	cmd="crm_resource --locate -r promotable-rsc:1 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Try to move an instance of a cloned resource"
	cmd="crm_resource -r promotable-rsc:0 --move --node node1"
	test_assert $CRM_EX_INVALID_PARAM 0

	# Create a sandbox copy of crm_mon.xml
	cibadmin -Q > "$TMPXML"
	export CIB_file="$TMPXML"

	desc="Query a nonexistent promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
	test_assert $CRM_EX_NOSUCH 0

	desc="Query a nonexistent promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
	test_assert_validate $CRM_EX_NOSUCH 0

	desc="Delete a nonexistent promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
	test_assert $CRM_EX_OK 0

	desc="Delete a nonexistent promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Query after deleting a nonexistent promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
	test_assert $CRM_EX_NOSUCH 0

	desc="Query after deleting a nonexistent promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
	test_assert_validate $CRM_EX_NOSUCH 0

	desc="Update a nonexistent promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1"
	test_assert $CRM_EX_OK 0

	desc="Update a nonexistent promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Query after updating a nonexistent promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
	test_assert $CRM_EX_OK 0

	desc="Query after updating a nonexistent promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Update an existing promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5"
	test_assert $CRM_EX_OK 0

	desc="Update an existing promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Query after updating an existing promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
	test_assert $CRM_EX_OK 0

	desc="Query after updating an existing promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Delete an existing promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
	test_assert $CRM_EX_OK 0

	desc="Delete an existing promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Query after deleting an existing promotable score attribute"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
	test_assert $CRM_EX_NOSUCH 0

	desc="Query after deleting an existing promotable score attribute (XML)"
	cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
	test_assert_validate $CRM_EX_NOSUCH 0

	unset CIB_file

	export CIB_file="-"

	desc="Check that CIB_file=\"-\" works - crm_mon"
	cmd="cat $test_home/cli/crm_mon.xml \| crm_mon -1"
	test_assert $CRM_EX_OK 0

	desc="Check that CIB_file=\"-\" works - crm_resource"
	cmd="cat $test_home/cli/crm_resource_digests.xml \| crm_resource --digests -r rsc1 -N node1 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Check that CIB_file=\"-\" works - crmadmin"
	cmd="cat $test_home/cli/crmadmin-cluster-remote-guest-nodes.xml \| crmadmin -N \| wc -l \| grep 11"
	test_assert $CRM_EX_OK 0

	unset CIB_file
	rm -f "$TMPXML" "$TMPORIG"
	}

	INVALID_PERIODS=(
	"2019-01-01 00:00:00Z" # Start with no end
	"2019-01-01 00:00:00Z/" # Start with only a trailing slash
	"PT2S/P1M" # Two durations
	"2019-13-01 00:00:00Z/P1M" # Out-of-range month
	"20191077T15/P1M" # Out-of-range day
	"2019-10-01T25:00:00Z/P1M" # Out-of-range hour
	"2019-10-01T24:00:01Z/P1M" # Hour 24 with anything but :00:00
	"PT5H/20191001T007000Z" # Out-of-range minute
	"2019-10-01 00:00:80Z/P1M" # Out-of-range second
	"2019-10-01 00:00:10 +25:00/P1M" # Out-of-range offset hour
	"20191001T000010 -00:61/P1M" # Out-of-range offset minute
	"P1Y/2019-02-29 00:00:00Z" # Feb. 29 in non-leap-year
	"2019-01-01 00:00:00Z/P" # Duration with no values
	"P1Z/2019-02-20 00:00:00Z" # Invalid duration unit
	"P1YM/2019-02-20 00:00:00Z" # No number for duration unit
	)

	function test_dates() {
	# Ensure invalid period specifications are rejected
	for spec in '' "${INVALID_PERIODS[@]}"; do
	desc="Invalid period - [$spec]"
	cmd="iso8601 -p \"$spec\""
	test_assert $CRM_EX_INVALID_PARAM 0
	done

	desc="2014-01-01 00:30:00 - 1 Hour"
	cmd="iso8601 -d '2014-01-01 00:30:00Z' -D P-1H -E '2013-12-31 23:30:00Z'"
	test_assert $CRM_EX_OK 0

	desc="Valid date - Feb 29 in leap year"
	cmd="iso8601 -d '2020-02-29 00:00:00Z' -E '2020-02-29 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	desc="Valid date - using 'T' and offset"
	cmd="iso8601 -d '20191201T131211 -05:00' -E '2019-12-01 18:12:11Z'"
	test_assert $CRM_EX_OK 0

	desc="24:00:00 equivalent to 00:00:00 of next day"
	cmd="iso8601 -d '2019-12-31 24:00:00Z' -E '2020-01-01 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	for y in 06 07 08 09 10 11 12 13 14 15 16 17 18 40; do
	desc="20$y-W01-7"
	cmd="iso8601 -d '20$y-W01-7 00Z'"
	test_assert $CRM_EX_OK 0

	desc="20$y-W01-7 - round-trip"
	cmd="iso8601 -d '20$y-W01-7 00Z' -W -E '20$y-W01-7 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	desc="20$y-W01-1"
	cmd="iso8601 -d '20$y-W01-1 00Z'"
	test_assert $CRM_EX_OK 0

	desc="20$y-W01-1 - round-trip"
	cmd="iso8601 -d '20$y-W01-1 00Z' -W -E '20$y-W01-1 00:00:00Z'"
	test_assert $CRM_EX_OK 0
	done

	desc="2009-W53-07"
	cmd="iso8601 -d '2009-W53-7 00:00:00Z' -W -E '2009-W53-7 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	desc="epoch + 2 Years 5 Months 6 Minutes"
	cmd="iso8601 -d 'epoch' -D P2Y5MT6M -E '1972-06-01 00:06:00Z'"
	test_assert $CRM_EX_OK 0

	desc="2009-01-31 + 1 Month"
	cmd="iso8601 -d '20090131T000000Z' -D P1M -E '2009-02-28 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	desc="2009-01-31 + 2 Months"
	cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P2M -E '2009-03-31 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	desc="2009-01-31 + 3 Months"
	cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P3M -E '2009-04-30 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	desc="2009-03-31 - 1 Month"
	cmd="iso8601 -d '2009-03-31 01:00:00 +01:00' -D P-1M -E '2009-02-28 00:00:00Z'"
	test_assert $CRM_EX_OK 0

	desc="2038-01-01 + 3 Months"
	cmd="iso8601 -d '2038-01-01 00:00:00Z' -D P3M -E '2038-04-01 00:00:00Z'"
	test_assert $CRM_EX_OK 0
	}

	function test_acl_loop() {
	local TMPXML

	TMPXML="$1"

	# Make sure we're rejecting things for the right reasons
	orig_trace_fns="$PCMK_trace_functions"
	export PCMK_trace_functions=pcmk__check_acl,pcmk__apply_creation_acl

	CIB_user=root cibadmin --replace --xml-text '<resources/>'

	### no ACL ###
	export CIB_user=unknownguy
	desc="$CIB_user: Query configuration"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Set enable-acl"
	cmd="crm_attribute -n enable-acl -v false"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Set stonith-enabled"
	cmd="crm_attribute -n stonith-enabled -v false"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Create a resource"
	cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	### deny /cib permission ###
	export CIB_user=l33t-haxor
	desc="$CIB_user: Query configuration"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Set enable-acl"
	cmd="crm_attribute -n enable-acl -v false"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Set stonith-enabled"
	cmd="crm_attribute -n stonith-enabled -v false"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Create a resource"
	cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	### observer role ###
	export CIB_user=niceguy
	desc="$CIB_user: Query configuration"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_OK 0

	desc="$CIB_user: Set enable-acl"
	cmd="crm_attribute -n enable-acl -v false"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Set stonith-enabled"
	cmd="crm_attribute -n stonith-enabled -v false"
	test_assert $CRM_EX_OK

	desc="$CIB_user: Create a resource"
	cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	export CIB_user=root
	desc="$CIB_user: Query configuration"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_OK 0

	desc="$CIB_user: Set stonith-enabled"
	cmd="crm_attribute -n stonith-enabled -v true"
	test_assert $CRM_EX_OK

	desc="$CIB_user: Create a resource"
	cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
	test_assert $CRM_EX_OK

	### deny /cib permission ###
	export CIB_user=l33t-haxor

	desc="$CIB_user: Create a resource meta attribute"
	cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Query a resource meta attribute"
	cmd="crm_resource -r dummy --meta -g target-role"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	desc="$CIB_user: Remove a resource meta attribute"
	cmd="crm_resource -r dummy --meta -d target-role"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	### observer role ###
	export CIB_user=niceguy

	desc="$CIB_user: Create a resource meta attribute"
	cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
	test_assert $CRM_EX_OK

	desc="$CIB_user: Query a resource meta attribute"
	cmd="crm_resource -r dummy --meta -g target-role"
	test_assert $CRM_EX_OK

	desc="$CIB_user: Remove a resource meta attribute"
	cmd="crm_resource -r dummy --meta -d target-role"
	test_assert $CRM_EX_OK

	desc="$CIB_user: Create a resource meta attribute"
	cmd="crm_resource -r dummy --meta -p target-role -v Started"
	test_assert $CRM_EX_OK

	### read //meta_attributes ###
	export CIB_user=badidea
	desc="$CIB_user: Query configuration - implied deny"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_OK 0

	### deny /cib, read //meta_attributes ###
	export CIB_user=betteridea
	desc="$CIB_user: Query configuration - explicit deny"
	cmd="cibadmin -Q"
	test_assert $CRM_EX_OK 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --delete --xml-text '<acls/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	### observer role ###
	export CIB_user=niceguy
	desc="$CIB_user: Replace - remove acls"
	cmd="cibadmin --replace --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - create resource"
	cmd="cibadmin --replace --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" crm_attribute -n enable-acl -v false
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - modify attribute (deny)"
	cmd="cibadmin --replace --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace --xml-text '<nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - delete attribute (deny)"
	cmd="cibadmin --replace --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - create attribute (deny)"
	cmd="cibadmin --replace --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	### admin role ###
	CIB_user=bob
	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - create attribute (direct allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - modify attribute (direct allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - delete attribute (direct allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	### super_user role ###
	export CIB_user=joe

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - create attribute (inherited allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - modify attribute (inherited allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - delete attribute (inherited allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	### rsc_writer role ###
	export CIB_user=mike

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - create attribute (allow overrides deny)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - modify attribute (allow overrides deny)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - delete attribute (allow overrides deny)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK 0

	### rsc_denied role ###
	export CIB_user=chris

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - create attribute (deny overrides allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	# Set as root since setting as chris failed
	CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - modify attribute (deny overrides allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	# Set as root since setting as chris failed
	CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'

	CIB_user=root cibadmin -Q > "$TMPXML"
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
	CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql

	desc="$CIB_user: Replace - delete attribute (deny overrides allow)"
	cmd="cibadmin --replace -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_INSUFFICIENT_PRIV 0

	export PCMK_trace_functions="$orig_trace_fns"
	}

	function test_acls() {
	local SHADOWPATH
	local TMPXML

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.acls.xml.XXXXXXXXXX)

	create_shadow_cib pacemaker-1.3

	cat <<EOF > "$TMPXML"
	<acls>
	<acl_user id="l33t-haxor">
	<deny id="crook-nothing" xpath="/cib"/>
	</acl_user>
	<acl_user id="niceguy">
	<role_ref id="observer"/>
	</acl_user>
	<acl_user id="bob">
	<role_ref id="admin"/>
	</acl_user>
	<acl_user id="joe">
	<role_ref id="super_user"/>
	</acl_user>
	<acl_user id="mike">
	<role_ref id="rsc_writer"/>
	</acl_user>
	<acl_user id="chris">
	<role_ref id="rsc_denied"/>
	</acl_user>
	<acl_role id="observer">
	<read id="observer-read-1" xpath="/cib"/>
	<write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>
	<write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>
	</acl_role>
	<acl_role id="admin">
	<read id="admin-read-1" xpath="/cib"/>
	<write id="admin-write-1" xpath="//resources"/>
	</acl_role>
	<acl_role id="super_user">
	<write id="super_user-write-1" xpath="/cib"/>
	</acl_role>
	<acl_role id="rsc_writer">
	<deny id="rsc-writer-deny-1" xpath="/cib"/>
	<write id="rsc-writer-write-1" xpath="//resources"/>
	</acl_role>
	<acl_role id="rsc_denied">
	<write id="rsc-denied-write-1" xpath="/cib"/>
	<deny id="rsc-denied-deny-1" xpath="//resources"/>
	</acl_role>
	</acls>
	EOF

	desc="Configure some ACLs"
	cmd="cibadmin -M -o acls --xml-file $TMPXML"
	test_assert $CRM_EX_OK

	desc="Enable ACLs"
	cmd="crm_attribute -n enable-acl -v true"
	test_assert $CRM_EX_OK

	desc="Set cluster option"
	cmd="crm_attribute -n no-quorum-policy -v ignore"
	test_assert $CRM_EX_OK

	desc="New ACL"
	cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"badidea\"><read id=\"badidea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
	test_assert $CRM_EX_OK

	desc="Another ACL"
	cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"betteridea\"><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
	test_assert $CRM_EX_OK

	desc="Updated ACL"
	cmd="cibadmin --replace -o acls --xml-text '<acl_user id=\"betteridea\"><deny id=\"betteridea-nothing\" xpath=\"/cib\"/><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
	test_assert $CRM_EX_OK

	test_acl_loop "$TMPXML"

	printf "\n\n !#!#!#!#! Upgrading to latest CIB schema and re-testing !#!#!#!#!\n"
	printf "\nUpgrading to latest CIB schema and re-testing\n" 1>&2

	export CIB_user=root
	desc="$CIB_user: Upgrade to latest CIB schema"
	cmd="cibadmin --upgrade --force -V"
	test_assert $CRM_EX_OK

	reset_shadow_cib_version

	test_acl_loop "$TMPXML"

	unset CIB_shadow_dir
	rm -f "$TMPXML"
	}

	function test_validity() {
	local TMPGOOD
	local TMPBAD

	TMPGOOD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.good.xml.XXXXXXXXXX)
	TMPBAD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.bad.xml.XXXXXXXXXX)

	create_shadow_cib pacemaker-1.2
	orig_trace_fns="$PCMK_trace_functions"
	export PCMK_trace_functions=apply_upgrade,update_validation

	cibadmin -C -o resources --xml-text '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'
	cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
	cibadmin -C -o constraints --xml-text '<rsc_order id="ord_1-2" first="dummy1" first-action="start" then="dummy2"/>'
	cibadmin -Q > "$TMPGOOD"


	desc="Try to make resulting CIB invalid (enum violation)"
	cmd="cibadmin -M -o constraints --xml-text '<rsc_order id=\"ord_1-2\" first=\"dummy1\" first-action=\"break\" then=\"dummy2\"/>'"
	test_assert $CRM_EX_CONFIG

	sed 's\|"start"\|"break"\|' "$TMPGOOD" > "$TMPBAD"
	desc="Run crm_simulate with invalid CIB (enum violation)"
	cmd="crm_simulate -x $TMPBAD -S"
	test_assert $CRM_EX_CONFIG 0


	desc="Try to make resulting CIB invalid (unrecognized validate-with)"
	cmd="cibadmin -M --xml-text '<cib validate-with=\"pacemaker-9999.0\"/>'"
	test_assert $CRM_EX_CONFIG

	sed 's\|"pacemaker-1.2"\|"pacemaker-9999.0"\|' "$TMPGOOD" > "$TMPBAD"
	desc="Run crm_simulate with invalid CIB (unrecognized validate-with)"
	cmd="crm_simulate -x $TMPBAD -S"
	test_assert $CRM_EX_CONFIG 0


	desc="Try to make resulting CIB invalid, but possibly recoverable (valid with X.Y+1)"
	cmd="cibadmin -C -o configuration --xml-text '<tags/>'"
	test_assert $CRM_EX_CONFIG

	sed 's\|</configuration>\|<tags/></configuration>\|' "$TMPGOOD" > "$TMPBAD"
	desc="Run crm_simulate with invalid, but possibly recoverable CIB (valid with X.Y+1)"
	cmd="crm_simulate -x $TMPBAD -S"
	test_assert $CRM_EX_OK 0


	sed 's\|[ ][ ]validate-with="[^"]"\|\|' "$TMPGOOD" > "$TMPBAD"
	desc="Make resulting CIB valid, although without validate-with attribute"
	cmd="cibadmin -R --xml-file $TMPBAD"
	test_assert $CRM_EX_OK

	desc="Run crm_simulate with valid CIB, but without validate-with attribute"
	cmd="crm_simulate -x $TMPBAD -S"
	test_assert $CRM_EX_OK 0


	# this will just disable validation and accept the config, outputting
	# validation errors
	sed -e 's\|[ ][ ]validate-with="[^"]"\|\|' \
	-e 's\|$[ ][ ]epoch="[^"]$"\|\10"\|' -e 's\|"start"\|"break"\|' \
	"$TMPGOOD" > "$TMPBAD"
	desc="Make resulting CIB invalid, and without validate-with attribute"
	cmd="cibadmin -R --xml-file $TMPBAD"
	test_assert $CRM_EX_OK

	desc="Run crm_simulate with invalid CIB, also without validate-with attribute"
	cmd="crm_simulate -x $TMPBAD -S"
	test_assert $CRM_EX_OK 0

	unset CIB_shadow_dir
	rm -f "$TMPGOOD" "$TMPBAD"
	export PCMK_trace_functions="$orig_trace_fns"
	}

	test_upgrade() {
	local TMPXML

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)

	create_shadow_cib pacemaker-2.10
	orig_trace_fns="$PCMK_trace_functions"
	export PCMK_trace_functions=apply_upgrade,update_validation

	desc="Set stonith-enabled=false"
	cmd="crm_attribute -n stonith-enabled -v false"
	test_assert $CRM_EX_OK

	cat <<EOF > "$TMPXML"
	<resources>
	<primitive id="mySmartFuse" class="ocf" provider="experiment" type="SmartFuse">
	<operations>
	<op id="mySmartFuse-start" name="start" interval="0" timeout="40s"/>
	<op id="mySmartFuse-monitor-inputpower" name="monitor" interval="30s">
	<instance_attributes id="mySmartFuse-inputpower-instanceparams">
	<nvpair id="mySmartFuse-inputpower-requires" name="requires" value="inputpower"/>
	</instance_attributes>
	</op>
	<op id="mySmartFuse-monitor-outputpower" name="monitor" interval="2s">
	<instance_attributes id="mySmartFuse-outputpower-instanceparams">
	<nvpair id="mySmartFuse-outputpower-requires" name="requires" value="outputpower"/>
	</instance_attributes>
	</op>
	</operations>
	<instance_attributes id="mySmartFuse-params">
	<nvpair id="mySmartFuse-params-ip" name="ip" value="192.0.2.10"/>
	</instance_attributes>
	<!-- a bit hairy but valid -->
	<instance_attributes id-ref="mySmartFuse-outputpower-instanceparams"/>
	</primitive>
	</resources>
	EOF

	desc="Configure the initial resource"
	cmd="cibadmin -M -o resources --xml-file $TMPXML"
	test_assert $CRM_EX_OK

	desc="Upgrade to latest CIB schema (trigger 2.10.xsl + the wrapping)"
	cmd="cibadmin --upgrade --force -V -V"
	test_assert $CRM_EX_OK

	desc="Query a resource instance attribute (shall survive)"
	cmd="crm_resource -r mySmartFuse -g requires"
	test_assert $CRM_EX_OK

	unset CIB_shadow_dir
	rm -f "$TMPXML"
	export PCMK_trace_functions="$orig_trace_fns"
	}

	test_rules() {
	local TMPXML

	create_shadow_cib

	cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/></cluster_property_set>'
	cibadmin -C -o resources --xml-text '<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />'

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	cat <<EOF > "$TMPXML"
	<rsc_location id="cli-too-many-date-expressions" rsc="dummy">
	<rule id="cli-rule-too-many-date-expressions" score="INFINITY" boolean-op="or">
	<date_expression id="cli-date-expression-1" operation="gt" start="2020-01-01 01:00:00 -0500"/>
	<date_expression id="cli-date-expression-2" operation="lt" end="2019-01-01 01:00:00 -0500"/>
	</rule>
	</rsc_location>
	EOF

	cibadmin -C -o constraints -x "$TMPXML"
	rm -f "$TMPXML"

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	cat <<EOF > "$TMPXML"
	<rsc_location id="cli-prefer-dummy-expired" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-expired" score="INFINITY">
	<date_expression id="cli-prefer-lifetime-end-dummy-expired" operation="lt" end="2019-01-01 12:00:00 -05:00"/>
	</rule>
	</rsc_location>
	EOF

	cibadmin -C -o constraints -x "$TMPXML"
	rm -f "$TMPXML"

	if [ "$(uname)" == "FreeBSD" ]; then
	tomorrow=$(date -v+1d +"%F %T %z")
	else
	tomorrow=$(date --date=tomorrow +"%F %T %z")
	fi

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	cat <<EOF > "$TMPXML"
	<rsc_location id="cli-prefer-dummy-not-yet" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-not-yet" score="INFINITY">
	<date_expression id="cli-prefer-lifetime-end-dummy-not-yet" operation="gt" start="${tomorrow}"/>
	</rule>
	</rsc_location>
	EOF

	cibadmin -C -o constraints -x "$TMPXML"
	rm -f "$TMPXML"

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	cat <<EOF > "$TMPXML"
	<rsc_location id="cli-prefer-dummy-date_spec-only-years" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-date_spec-only-years" score="INFINITY">
	<date_expression id="cli-prefer-dummy-date_spec-only-years-expr" operation="date_spec">
	<date_spec id="cli-prefer-dummy-date_spec-only-years-spec" years="2019"/>
	</date_expression>
	</rule>
	</rsc_location>
	EOF

	cibadmin -C -o constraints -x "$TMPXML"
	rm -f "$TMPXML"

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	cat <<EOF > "$TMPXML"
	<rsc_location id="cli-prefer-dummy-date_spec-without-years" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-date_spec-without-years" score="INFINITY">
	<date_expression id="cli-prefer-dummy-date_spec-without-years-expr" operation="date_spec">
	<date_spec id="cli-prefer-dummy-date_spec-without-years-spec" hours="20" months="1,3,5,7"/>
	</date_expression>
	</rule>
	</rsc_location>
	EOF

	cibadmin -C -o constraints -x "$TMPXML"
	rm -f "$TMPXML"

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	cat <<EOF > "$TMPXML"
	<rsc_location id="cli-prefer-dummy-date_spec-years-moon" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-date_spec-years-moon" score="INFINITY">
	<date_expression id="cli-prefer-dummy-date_spec-years-moon-expr" operation="date_spec">
	<date_spec id="cli-prefer-dummy-date_spec-years-moon-spec" years="2019" moon="1"/>
	</date_expression>
	</rule>
	</rsc_location>
	EOF

	cibadmin -C -o constraints -x "$TMPXML"
	rm -f "$TMPXML"

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
	cat <<EOF > "$TMPXML"
	<rsc_location id="cli-no-date_expression" rsc="dummy">
	<rule id="cli-no-date_expression-rule" score="INFINITY">
	<expression id="ban-apache-expr" attribute="#uname" operation="eq" value="node3"/>
	</rule>
	</rsc_location>
	EOF

	cibadmin -C -o constraints -x "$TMPXML"
	rm -f "$TMPXML"

	desc="crm_rule given no arguments"
	cmd="crm_rule"
	test_assert $CRM_EX_USAGE 0

	desc="crm_rule given no arguments (XML)"
	cmd="crm_rule --output-as=xml"
	test_assert_validate $CRM_EX_USAGE 0

	desc="crm_rule given no rule to check"
	cmd="crm_rule -c"
	test_assert $CRM_EX_USAGE 0

	desc="crm_rule given no rule to check (XML)"
	cmd="crm_rule -c --output-as=xml"
	test_assert_validate $CRM_EX_USAGE 0

	desc="crm_rule given invalid input XML"
	cmd="crm_rule -c -r blahblah -X 'invalidxml'"
	test_assert $CRM_EX_DATAERR 0

	desc="crm_rule given invalid input XML (XML)"
	cmd="crm_rule -c -r blahblah -X 'invalidxml' --output-as=xml"
	test_assert_validate $CRM_EX_DATAERR 0

	desc="crm_rule given invalid input XML on stdin"
	cmd="echo 'invalidxml' \| crm_rule -c -r blahblah -X -"
	test_assert $CRM_EX_DATAERR 0

	desc="crm_rule given invalid input XML on stdin (XML)"
	cmd="echo 'invalidxml' \| crm_rule -c -r blahblah -X - --output-as=xml"
	test_assert_validate $CRM_EX_DATAERR 0

	desc="Try to check a rule that doesn't exist"
	cmd="crm_rule -c -r blahblah"
	test_assert $CRM_EX_NOSUCH

	desc="Try to check a rule that doesn't exist, with XML output"
	cmd="crm_rule -c -r blahblah --output-as=xml"
	test_assert_validate $CRM_EX_NOSUCH 0

	desc="Try to check a rule that has too many date_expressions"
	cmd="crm_rule -c -r cli-rule-too-many-date-expressions"
	test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

	desc="Try to check a rule that has too many date_expressions (XML)"
	cmd="crm_rule -c -r cli-rule-too-many-date-expressions --output-as=xml"
	test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

	desc="Verify basic rule is expired"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-expired"
	test_assert $CRM_EX_EXPIRED 0

	desc="Verify basic rule is expired, with XML output"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-expired --output-as=xml"
	test_assert_validate $CRM_EX_EXPIRED 0

	desc="Verify basic rule worked in the past"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101"
	test_assert $CRM_EX_OK 0

	desc="Verify basic rule worked in the past (XML)"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Verify basic rule is not yet in effect"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet"
	test_assert $CRM_EX_NOT_YET_IN_EFFECT 0

	desc="Verify basic rule is not yet in effect (XML)"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet --output-as=xml"
	test_assert_validate $CRM_EX_NOT_YET_IN_EFFECT 0

	desc="Verify date_spec rule with years has expired"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years"
	test_assert $CRM_EX_EXPIRED 0

	desc="Verify date_spec rule with years has expired (XML)"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
	test_assert_validate $CRM_EX_EXPIRED 0

	desc="Verify multiple rules at once"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years"
	test_assert $CRM_EX_EXPIRED 0

	desc="Verify multiple rules at once, with XML output"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
	test_assert_validate $CRM_EX_EXPIRED 0

	desc="Verify date_spec rule with years is in effect"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201"
	test_assert $CRM_EX_OK 0

	desc="Verify date_spec rule with years is in effect (XML)"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201 --output-as=xml"
	test_assert_validate $CRM_EX_OK 0

	desc="Try to check a rule whose date_spec does not contain years="
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years"
	test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

	desc="Try to check a rule whose date_spec does not contain years= (XML)"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years --output-as=xml"
	test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

	desc="Try to check a rule whose date_spec contains years= and moon="
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon"
	test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

	desc="Try to check a rule whose date_spec contains years= and moon= (XML)"
	cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon --output-as=xml"
	test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

	desc="Try to check a rule with no date_expression"
	cmd="crm_rule -c -r cli-no-date_expression-rule"
	test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0

	desc="Try to check a rule with no date_expression (XML)"
	cmd="crm_rule -c -r cli-no-date_expression-rule --output-as=xml"
	test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0

	unset CIB_shadow_dir
	}

	# Ensure all command output is in portable locale for comparison
	export LC_ALL="C"
	test_access_render() {
	local TMPXML

	TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.access_render.xml.XXXXXXXXXX)
	export CIB_shadow_dir="${shadow_dir}"

	$VALGRIND_CMD crm_shadow --batch --force --create-empty $shadow 2>&1
	export CIB_shadow=$shadow

	# Create a test CIB that has ACL roles
	cat <<EOF > "$TMPXML"
	<acls>
	<acl_role id="role-deny-acls">
	<acl_permission id="deny-acls" kind="deny" xpath="/cib/configuration/acls"/>
	<acl_permission id="read-rest" kind="read" xpath="/cib"/>
	</acl_role>
	<acl_target id="tony">
	<role id="role-deny-acls"/>
	</acl_target>
	</acls>
	EOF

	desc="Configure some ACLs"
	cmd="cibadmin -M -o acls --xml-file $TMPXML"
	test_assert $CRM_EX_OK

	desc="Enable ACLs"
	cmd="crm_attribute -n enable-acl -v true"
	test_assert $CRM_EX_OK

	unset CIB_user

	# Run cibadmin --show-access on the test CIB with different users (tony here)

	desc="An instance of ACLs render (into color)"
	cmd="cibadmin --force --show-access=color -Q --user tony"
	test_assert $CRM_EX_OK 0

	desc="An instance of ACLs render (into namespacing)"
	cmd="cibadmin --force --show-access=namespace -Q --user tony"
	test_assert $CRM_EX_OK 0

	desc="An instance of ACLs render (into text)"
	cmd="cibadmin --force --show-access=text -Q --user tony"
	test_assert $CRM_EX_OK 0

	unset CIB_shadow_dir
	rm -f "$TMPXML"
	}

	function test_feature_set() {
	create_shadow_cib

	# Import the initial test CIB with non-mixed versions
	desc="Import the test CIB"
	cmd="cibadmin --replace --xml-file $test_home/cli/crm_mon-feature_set.xml"
	test_assert $CRM_EX_OK

	desc="Complete text output, no mixed status"
	cmd="crm_mon -1 --show-detail"
	test_assert $CRM_EX_OK 0

	desc="XML output, no mixed status"
	cmd="crm_mon --output-as=xml"
	test_assert $CRM_EX_OK 0

	# Modify the CIB to fake that the cluster has mixed versions
	desc="Fake inconsistent feature set"
	cmd="crm_attribute --node=cluster02 --name=#feature-set --update=3.15.0 --lifetime=reboot"
	test_assert $CRM_EX_OK

	desc="Complete text output, mixed status"
	cmd="crm_mon -1 --show-detail"
	test_assert $CRM_EX_OK 0

	desc="XML output, mixed status"
	cmd="crm_mon --output-as=xml"
	test_assert $CRM_EX_OK 0

	unset CIB_shadow_dir
	}

	# Process command-line arguments
	while [ $# -gt 0 ]; do
	case "$1" in
	-t)
	tests="$2"
	shift 2
	;;
	-V\|--verbose)
	verbose=1
	shift
	;;
	-v\|--valgrind)
	export G_SLICE=always-malloc
	VALGRIND_CMD="valgrind $VALGRIND_OPTS"
	shift
	;;
	-s)
	do_save=1
	shift
	;;
	-p)
	export PATH="$2:$PATH"
	shift
	;;
	--help)
	echo "$USAGE_TEXT"
	exit $CRM_EX_OK
	;;
	*)
	echo "error: unknown option $1"
	echo
	echo "$USAGE_TEXT"
	exit $CRM_EX_USAGE
	;;
	esac
	done

	for t in $tests; do
	case "$t" in
	agents) ;;
	+ daemons) ;;
	dates) ;;
	error_codes) ;;
	tools) ;;
	acls) ;;
	validity) ;;
	upgrade) ;;
	rules) ;;
	crm_mon) ;;
	feature_set) ;;
	*)
	echo "error: unknown test $t"
	echo
	echo "$USAGE_TEXT"
	exit $CRM_EX_USAGE
	;;
	esac
	done

	XMLLINT_CMD=$(which xmllint 2>/dev/null)
	if [ $? -ne 0 ]; then
	XMLLINT_CMD=""
	echo "xmllint is missing - install it to validate command output"
	fi

	# Check whether we're running from source directory
	SRCDIR=$(dirname $test_home)
	if [ -x "$SRCDIR/tools/crm_simulate" ]; then
	- export PATH="$SRCDIR/tools:$PATH"
	- echo "Using local binaries from: $SRCDIR/tools"
	+ path_dirs="$SRCDIR/tools"
	+ for daemon in based controld fenced schedulerd; do
	+ if [ -x "$SRCDIR/daemons/$daemon/pacemaker-${daemon}" ]; then
	+ path_dirs="$path_dirs:$SRCDIR/daemons/$daemon"
	+ fi
	+ done
	+ export PATH="$path_dirs:$PATH"
	+
	+ echo "Using local binaries from: ${path_dirs//:/ }"

	if [ -x "$SRCDIR/xml" ]; then
	export PCMK_schema_directory="$SRCDIR/xml"
	echo "Using local schemas from: $PCMK_schema_directory"
	fi
	else
	export PCMK_schema_directory=@CRM_SCHEMA_DIRECTORY@
	fi

	for t in $tests; do
	echo "Testing $t"
	TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.$t.XXXXXXXXXX)
	eval TMPFILE_$t="$TMPFILE"
	test_$t > "$TMPFILE"

	# last-rc-change= is always numeric in the CIB. However, for the crm_mon
	# test we also need to compare against the XML output of the crm_mon
	# program. There, these are shown as human readable strings (like the
	# output of the `date` command).
	sed -e 's/cib-last-written.*>/>/'\
	-e 's/Last updated: .*/Last updated:/' \
	-e 's/Last change: .*/Last change:/' \
	-e 's/(version .*)/(version)/' \
	-e 's/last_update time=\".*\"/last_update time=\"\"/' \
	-e 's/last_change time=\".*\"/last_change time=\"\"/' \
	- -e 's/ api-version=\".*\" / api-version=\"X\" /' \
	- -e 's/ version="[^"]*" / version="" /' \
	+ -e 's/ api-version="[^"]*"/ api-version="X"/' \
	+ -e 's/ default="[^"]*"/ default=""/' \
	+ -e 's/ version="[^"]*"/ version=""/' \
	-e 's/request=\".$crm_[a-zA-Z0-9]$/request=\"\1/' \
	-e 's/crm_feature_set="[^"]*" //'\
	-e 's/validate-with="[^"]*" //'\
	-e 's/Created new pacemaker-.* configuration/Created new pacemaker configuration/'\
	-e 's/.$crm_time_parse_duration$@.\.c:[0-9][0-9]*)/\1/g' \
	-e 's/.$crm_time_parse_period$@.\.c:[0-9][0-9]*)/\1/g' \
	-e 's/.$crm_time_parse_sec$@.\.c:[0-9][0-9]*)/\1/g' \
	-e 's/.$log_xmllib_err$@.\.c:[0-9][0-9]*)/\1/g' \
	-e 's/.$parse_date$@.\.c:[0-9][0-9]*)/\1/g' \
	-e 's/.$pcmk__.$@.\.c:[0-9][0-9])/\1/g' \
	-e 's/.$unpack_.$@.\.c:[0-9][0-9])/\1/g' \
	-e 's/.$update_validation$@.\.c:[0-9][0-9]*)/\1/g' \
	-e 's/.$apply_upgrade$@.\.c:[0-9][0-9]*)/\1/g' \
	-e "s/ last-rc-change=['\"][-+A-Za-z0-9: ]*['\"],\{0,1\}//" \
	-e 's\|^/tmp/cts-cli\.validity\.bad.xml\.[^:]*:\|validity.bad.xml:\|'\
	-e 's/^Entity: line [0-9][0-9]*: //'\
	-e 's/$validation ([0-9][0-9]* of $[0-9][0-9]$).$/\1X\2/' \
	-e 's/^Migration will take effect until: .*/Migration will take effect until:/' \
	-e 's/ end=\"[0-9][-+: 0-9]Z\"/ end=\"\"/' \
	-e 's/ start=\"[0-9][-+: 0-9]Z\"/ start=\"\"/' \
	-e 's/^Error checking rule: Device not configured/Error checking rule: No such device or address/' \
	-e 's/Error performing operation: Device not configured/Error performing operation: No such device or address/' \
	-e 's/$Injecting attribute last-failure-ping#monitor_10000=$[0-9]*/\1/' \
	-e 's/^lt-//' \
	-e 's/ocf::/ocf:/' \
	-e 's/Masters:/Promoted:/' \
	-e 's/Slaves:/Unpromoted:/' \
	-e 's/Master/Promoted/' \
	-e 's/Slave/Unpromoted/' \
	-e 's/\x1b/\\x1b/' \
	"$TMPFILE" > "${TMPFILE}.$$"
	mv -- "${TMPFILE}.$$" "$TMPFILE"

	if [ $do_save -eq 1 ]; then
	cp "$TMPFILE" $test_home/cli/regression.$t.exp
	fi
	done

	rm -rf "${shadow_dir}"
	rm -f "${test_assert_outfile}"
	rm -f "${test_assert_errfile}"
	rm -f "${xmllint_errfile}"

	failed=0

	if [ $verbose -eq 1 ]; then
	echo -e "\n\nResults"
	fi
	for t in $tests; do
	eval TMPFILE="\$TMPFILE_$t"
	if [ $verbose -eq 1 ]; then
	diff -wu $test_home/cli/regression.$t.exp "$TMPFILE"
	else
	diff -w $test_home/cli/regression.$t.exp "$TMPFILE" >/dev/null 2>&1
	fi
	if [ $? -ne 0 ]; then
	failed=1
	fi
	done

	echo -e "\n\nSummary"
	for t in $tests; do
	eval TMPFILE="\$TMPFILE_$t"
	grep -e '^\* $Passed\\|Failed$' "$TMPFILE"
	done

	function print_or_remove_file() {

	eval TMPFILE="\$TMPFILE_$1"
	if [[ ! $(diff -wq $test_home/cli/regression.$1.exp "$TMPFILE") ]]; then
	rm -f "$TMPFILE"
	else
	echo " $TMPFILE"
	fi
	}

	if [ $num_errors -ne 0 ] && [ $failed -ne 0 ]; then
	echo "$num_errors tests failed; see output in:"
	for t in $tests; do
	print_or_remove_file "$t"
	done
	exit $CRM_EX_ERROR
	elif [ $num_errors -ne 0 ]; then
	echo "$num_errors tests failed"
	for t in $tests; do
	print_or_remove_file "$t"
	done
	exit $CRM_EX_ERROR
	elif [ $failed -eq 1 ]; then
	echo "$num_passed tests passed but output was unexpected; see output in:"
	for t in $tests; do
	print_or_remove_file "$t"
	done
	exit $CRM_EX_DIGEST
	else
	echo $num_passed tests passed
	for t in $tests; do
	eval TMPFILE="\$TMPFILE_$t"
	rm -f "$TMPFILE"
	done
	crm_shadow --force --delete $shadow >/dev/null 2>&1
	exit $CRM_EX_OK
	fi
	diff --git a/daemons/controld/controld_control.c b/daemons/controld/controld_control.c
	index 9d75a0c93d..5f83ae9819 100644
	--- a/daemons/controld/controld_control.c
	+++ b/daemons/controld/controld_control.c
	@@ -1,841 +1,850 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU General Public License version 2
	* or later (GPLv2+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <sys/param.h>
	#include <sys/types.h>
	#include <sys/stat.h>

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/pengine/rules.h>
	#include <crm/cluster/internal.h>
	#include <crm/cluster/election_internal.h>
	#include <crm/common/ipc_internal.h>

	#include <pacemaker-controld.h>

	qb_ipcs_service_t *ipcs = NULL;

	#if SUPPORT_COROSYNC
	extern gboolean crm_connect_corosync(crm_cluster_t * cluster);
	#endif

	void crm_shutdown(int nsig);
	gboolean crm_read_options(gpointer user_data);

	gboolean fsa_has_quorum = FALSE;
	crm_trigger_t *fsa_source = NULL;
	crm_trigger_t *config_read = NULL;
	bool no_quorum_suicide_escalation = FALSE;
	bool controld_shutdown_lock_enabled = false;

	/* A_HA_CONNECT */
	void
	do_ha_control(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state,
	enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	gboolean registered = FALSE;
	static crm_cluster_t *cluster = NULL;

	if (cluster == NULL) {
	cluster = calloc(1, sizeof(crm_cluster_t));
	}

	if (action & A_HA_DISCONNECT) {
	crm_cluster_disconnect(cluster);
	crm_info("Disconnected from the cluster");

	controld_set_fsa_input_flags(R_HA_DISCONNECTED);
	}

	if (action & A_HA_CONNECT) {
	crm_set_status_callback(&peer_update_callback);
	crm_set_autoreap(FALSE);

	if (is_corosync_cluster()) {
	#if SUPPORT_COROSYNC
	registered = crm_connect_corosync(cluster);
	#endif
	}

	if (registered == TRUE) {
	controld_election_init(cluster->uname);
	fsa_our_uname = cluster->uname;
	fsa_our_uuid = cluster->uuid;
	if(cluster->uuid == NULL) {
	crm_err("Could not obtain local uuid");
	registered = FALSE;
	}
	}

	if (registered == FALSE) {
	controld_set_fsa_input_flags(R_HA_DISCONNECTED);
	register_fsa_error(C_FSA_INTERNAL, I_ERROR, NULL);
	return;
	}

	populate_cib_nodes(node_update_none, __func__);
	controld_clear_fsa_input_flags(R_HA_DISCONNECTED);
	crm_info("Connected to the cluster");
	}

	if (action & ~(A_HA_CONNECT \| A_HA_DISCONNECT)) {
	crm_err("Unexpected action %s in %s", fsa_action2string(action),
	__func__);
	}
	}

	/* A_SHUTDOWN */
	void
	do_shutdown(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state, enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	/* just in case */
	controld_set_fsa_input_flags(R_SHUTDOWN);
	controld_disconnect_fencer(FALSE);
	}

	/* A_SHUTDOWN_REQ */
	void
	do_shutdown_req(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state,
	enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	xmlNode *msg = NULL;

	controld_set_fsa_input_flags(R_SHUTDOWN);
	//controld_set_fsa_input_flags(R_STAYDOWN);
	crm_info("Sending shutdown request to all peers (DC is %s)",
	(fsa_our_dc? fsa_our_dc : "not set"));
	msg = create_request(CRM_OP_SHUTDOWN_REQ, NULL, NULL, CRM_SYSTEM_CRMD, CRM_SYSTEM_CRMD, NULL);

	if (send_cluster_message(NULL, crm_msg_crmd, msg, TRUE) == FALSE) {
	register_fsa_error(C_FSA_INTERNAL, I_ERROR, NULL);
	}
	free_xml(msg);
	}

	extern char *max_generation_from;
	extern xmlNode *max_generation_xml;
	extern GHashTable *resource_history;
	extern GHashTable *voted;
	extern pcmk__output_t *logger_out;

	void
	crmd_fast_exit(crm_exit_t exit_code)
	{
	if (pcmk_is_set(fsa_input_register, R_STAYDOWN)) {
	crm_warn("Inhibiting respawn "CRM_XS" remapping exit code %d to %d",
	exit_code, CRM_EX_FATAL);
	exit_code = CRM_EX_FATAL;

	} else if ((exit_code == CRM_EX_OK)
	&& pcmk_is_set(fsa_input_register, R_IN_RECOVERY)) {
	crm_err("Could not recover from internal error");
	exit_code = CRM_EX_ERROR;
	}

	if (logger_out != NULL) {
	logger_out->finish(logger_out, exit_code, true, NULL);
	pcmk__output_free(logger_out);
	logger_out = NULL;
	}

	crm_exit(exit_code);
	}

	crm_exit_t
	crmd_exit(crm_exit_t exit_code)
	{
	GList *gIter = NULL;
	GMainLoop *mloop = crmd_mainloop;

	static bool in_progress = FALSE;

	if (in_progress && (exit_code == CRM_EX_OK)) {
	crm_debug("Exit is already in progress");
	return exit_code;

	} else if(in_progress) {
	crm_notice("Error during shutdown process, exiting now with status %d (%s)",
	exit_code, crm_exit_str(exit_code));
	crm_write_blackbox(SIGTRAP, NULL);
	crmd_fast_exit(exit_code);
	}

	in_progress = TRUE;
	crm_trace("Preparing to exit with status %d (%s)",
	exit_code, crm_exit_str(exit_code));

	/* Suppress secondary errors resulting from us disconnecting everything */
	controld_set_fsa_input_flags(R_HA_DISCONNECTED);

	/* Close all IPC servers and clients to ensure any and all shared memory files are cleaned up */

	if(ipcs) {
	crm_trace("Closing IPC server");
	mainloop_del_ipc_server(ipcs);
	ipcs = NULL;
	}

	controld_close_attrd_ipc();
	controld_shutdown_schedulerd_ipc();
	controld_disconnect_fencer(TRUE);

	if ((exit_code == CRM_EX_OK) && (crmd_mainloop == NULL)) {
	crm_debug("No mainloop detected");
	exit_code = CRM_EX_ERROR;
	}

	/* On an error, just get out.
	*
	* Otherwise, make the effort to have mainloop exit gracefully so
	* that it (mostly) cleans up after itself and valgrind has less
	* to report on - allowing real errors stand out
	*/
	if (exit_code != CRM_EX_OK) {
	crm_notice("Forcing immediate exit with status %d (%s)",
	exit_code, crm_exit_str(exit_code));
	crm_write_blackbox(SIGTRAP, NULL);
	crmd_fast_exit(exit_code);
	}

	/* Clean up as much memory as possible for valgrind */

	for (gIter = fsa_message_queue; gIter != NULL; gIter = gIter->next) {
	fsa_data_t *fsa_data = gIter->data;

	crm_info("Dropping %s: [ state=%s cause=%s origin=%s ]",
	fsa_input2string(fsa_data->fsa_input),
	fsa_state2string(fsa_state),
	fsa_cause2string(fsa_data->fsa_cause), fsa_data->origin);
	delete_fsa_input(fsa_data);
	}

	controld_clear_fsa_input_flags(R_MEMBERSHIP);
	g_list_free(fsa_message_queue); fsa_message_queue = NULL;

	metadata_cache_fini();
	controld_election_fini();

	/* Tear down the CIB manager connection, but don't free it yet -- it could
	* be used when we drain the mainloop later.
	*/

	controld_disconnect_cib_manager();

	verify_stopped(fsa_state, LOG_WARNING);
	controld_clear_fsa_input_flags(R_LRM_CONNECTED);
	lrm_state_destroy_all();

	/* This basically will not work, since mainloop has a reference to it */
	mainloop_destroy_trigger(fsa_source); fsa_source = NULL;

	mainloop_destroy_trigger(config_read); config_read = NULL;
	mainloop_destroy_trigger(transition_trigger); transition_trigger = NULL;

	pcmk__client_cleanup();
	crm_peer_destroy();

	controld_free_fsa_timers();
	te_cleanup_stonith_history_sync(NULL, TRUE);
	controld_free_sched_timer();

	free(fsa_our_dc_version); fsa_our_dc_version = NULL;
	free(fsa_our_uname); fsa_our_uname = NULL;
	free(fsa_our_uuid); fsa_our_uuid = NULL;
	free(fsa_our_dc); fsa_our_dc = NULL;

	free(fsa_cluster_name); fsa_cluster_name = NULL;

	free(te_uuid); te_uuid = NULL;
	free(failed_stop_offset); failed_stop_offset = NULL;
	free(failed_start_offset); failed_start_offset = NULL;

	free(max_generation_from); max_generation_from = NULL;
	free_xml(max_generation_xml); max_generation_xml = NULL;

	mainloop_destroy_signal(SIGPIPE);
	mainloop_destroy_signal(SIGUSR1);
	mainloop_destroy_signal(SIGTERM);
	mainloop_destroy_signal(SIGTRAP);
	/* leave SIGCHLD engaged as we might still want to drain some service-actions */

	if (mloop) {
	GMainContext *ctx = g_main_loop_get_context(crmd_mainloop);

	/* Don't re-enter this block */
	crmd_mainloop = NULL;

	/* no signals on final draining anymore */
	mainloop_destroy_signal(SIGCHLD);

	crm_trace("Draining mainloop %d %d", g_main_loop_is_running(mloop), g_main_context_pending(ctx));

	{
	int lpc = 0;

	while((g_main_context_pending(ctx) && lpc < 10)) {
	lpc++;
	crm_trace("Iteration %d", lpc);
	g_main_context_dispatch(ctx);
	}
	}

	crm_trace("Closing mainloop %d %d", g_main_loop_is_running(mloop), g_main_context_pending(ctx));
	g_main_loop_quit(mloop);

	/* Won't do anything yet, since we're inside it now */
	g_main_loop_unref(mloop);
	} else {
	mainloop_destroy_signal(SIGCHLD);
	}

	cib_delete(fsa_cib_conn);
	fsa_cib_conn = NULL;

	throttle_fini();

	/* Graceful */
	crm_trace("Done preparing for exit with status %d (%s)",
	exit_code, crm_exit_str(exit_code));
	return exit_code;
	}

	/* A_EXIT_0, A_EXIT_1 */
	void
	do_exit(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state, enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	crm_exit_t exit_code = CRM_EX_OK;
	int log_level = LOG_INFO;
	const char *exit_type = "gracefully";

	if (action & A_EXIT_1) {
	log_level = LOG_ERR;
	exit_type = "forcefully";
	exit_code = CRM_EX_ERROR;
	}

	verify_stopped(cur_state, LOG_ERR);
	do_crm_log(log_level, "Performing %s - %s exiting the controller",
	fsa_action2string(action), exit_type);

	crm_info("[%s] stopped (%d)", crm_system_name, exit_code);
	crmd_exit(exit_code);
	}

	static void sigpipe_ignore(int nsig) { return; }

	/* A_STARTUP */
	void
	do_startup(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state, enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	crm_debug("Registering Signal Handlers");
	mainloop_add_signal(SIGTERM, crm_shutdown);
	mainloop_add_signal(SIGPIPE, sigpipe_ignore);

	fsa_source = mainloop_add_trigger(G_PRIORITY_HIGH, crm_fsa_trigger, NULL);
	config_read = mainloop_add_trigger(G_PRIORITY_HIGH, crm_read_options, NULL);
	transition_trigger = mainloop_add_trigger(G_PRIORITY_LOW, te_graph_trigger, NULL);

	crm_debug("Creating CIB manager and executor objects");
	fsa_cib_conn = cib_new();

	lrm_state_init_local();
	if (controld_init_fsa_timers() == FALSE) {
	register_fsa_error(C_FSA_INTERNAL, I_ERROR, NULL);
	}
	}

	// \return libqb error code (0 on success, -errno on error)
	static int32_t
	accept_controller_client(qb_ipcs_connection_t *c, uid_t uid, gid_t gid)
	{
	crm_trace("Accepting new IPC client connection");
	if (pcmk__new_client(c, uid, gid) == NULL) {
	return -EIO;
	}
	return 0;
	}

	// \return libqb error code (0 on success, -errno on error)
	static int32_t
	dispatch_controller_ipc(qb_ipcs_connection_t * c, void *data, size_t size)
	{
	uint32_t id = 0;
	uint32_t flags = 0;
	pcmk__client_t *client = pcmk__find_client(c);

	xmlNode *msg = pcmk__client_data2xml(client, data, &id, &flags);

	if (msg == NULL) {
	pcmk__ipc_send_ack(client, id, flags, "ack", NULL, CRM_EX_PROTOCOL);
	return 0;
	}
	pcmk__ipc_send_ack(client, id, flags, "ack", NULL, CRM_EX_INDETERMINATE);

	CRM_ASSERT(client->user != NULL);
	pcmk__update_acl_user(msg, F_CRM_USER, client->user);

	crm_xml_add(msg, F_CRM_SYS_FROM, client->id);
	if (controld_authorize_ipc_message(msg, client, NULL)) {
	crm_trace("Processing IPC message from client %s",
	pcmk__client_name(client));
	route_message(C_IPC_MESSAGE, msg);
	}

	trigger_fsa();
	free_xml(msg);
	return 0;
	}

	static int32_t
	ipc_client_disconnected(qb_ipcs_connection_t *c)
	{
	pcmk__client_t *client = pcmk__find_client(c);

	if (client) {
	crm_trace("Disconnecting %sregistered client %s (%p/%p)",
	(client->userdata? "" : "un"), pcmk__client_name(client),
	c, client);
	free(client->userdata);
	pcmk__free_client(client);
	trigger_fsa();
	}
	return 0;
	}

	static void
	ipc_connection_destroyed(qb_ipcs_connection_t *c)
	{
	crm_trace("Connection %p", c);
	ipc_client_disconnected(c);
	}

	/* A_STOP */
	void
	do_stop(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state, enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	crm_trace("Closing IPC server");
	mainloop_del_ipc_server(ipcs); ipcs = NULL;
	register_fsa_input(C_FSA_INTERNAL, I_TERMINATE, NULL);
	}

	/* A_STARTED */
	void
	do_started(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state, enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	static struct qb_ipcs_service_handlers crmd_callbacks = {
	.connection_accept = accept_controller_client,
	.connection_created = NULL,
	.msg_process = dispatch_controller_ipc,
	.connection_closed = ipc_client_disconnected,
	.connection_destroyed = ipc_connection_destroyed
	};

	if (cur_state != S_STARTING) {
	crm_err("Start cancelled... %s", fsa_state2string(cur_state));
	return;

	} else if (!pcmk_is_set(fsa_input_register, R_MEMBERSHIP)) {
	crm_info("Delaying start, no membership data (%.16llx)", R_MEMBERSHIP);

	crmd_fsa_stall(TRUE);
	return;

	} else if (!pcmk_is_set(fsa_input_register, R_LRM_CONNECTED)) {
	crm_info("Delaying start, not connected to executor (%.16llx)", R_LRM_CONNECTED);

	crmd_fsa_stall(TRUE);
	return;

	} else if (!pcmk_is_set(fsa_input_register, R_CIB_CONNECTED)) {
	crm_info("Delaying start, CIB not connected (%.16llx)", R_CIB_CONNECTED);

	crmd_fsa_stall(TRUE);
	return;

	} else if (!pcmk_is_set(fsa_input_register, R_READ_CONFIG)) {
	crm_info("Delaying start, Config not read (%.16llx)", R_READ_CONFIG);

	crmd_fsa_stall(TRUE);
	return;

	} else if (!pcmk_is_set(fsa_input_register, R_PEER_DATA)) {

	crm_info("Delaying start, No peer data (%.16llx)", R_PEER_DATA);
	crmd_fsa_stall(TRUE);
	return;
	}

	crm_debug("Init server comms");
	ipcs = pcmk__serve_controld_ipc(&crmd_callbacks);
	if (ipcs == NULL) {
	crm_err("Failed to create IPC server: shutting down and inhibiting respawn");
	register_fsa_error(C_FSA_INTERNAL, I_ERROR, NULL);
	} else {
	crm_notice("Pacemaker controller successfully started and accepting connections");
	}
	controld_trigger_fencer_connect();

	controld_clear_fsa_input_flags(R_STARTING);
	register_fsa_input(msg_data->fsa_cause, I_PENDING, NULL);
	}

	/* A_RECOVER */
	void
	do_recover(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state, enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	controld_set_fsa_input_flags(R_IN_RECOVERY);
	crm_warn("Fast-tracking shutdown in response to errors");

	register_fsa_input(C_FSA_INTERNAL, I_TERMINATE, NULL);
	}

	static pcmk__cluster_option_t controller_options[] = {
	/* name, old name, type, allowed values,
	* default value, validator,
	* short description,
	* long description
	*/
	{
	"dc-version", NULL, "string", NULL, PCMK__VALUE_NONE, NULL,
	N_("Pacemaker version on cluster node elected Designated Controller (DC)"),
	N_("Includes a hash which identifies the exact changeset the code was "
	"built from. Used for diagnostic purposes.")
	},
	{
	"cluster-infrastructure", NULL, "string", NULL, "corosync", NULL,
	N_("The messaging stack on which Pacemaker is currently running"),
	N_("Used for informational and diagnostic purposes.")
	},
	{
	"cluster-name", NULL, "string", NULL, NULL, NULL,
	N_("An arbitrary name for the cluster"),
	N_("This optional value is mostly for users' convenience as desired "
	"in administration, but may also be used in Pacemaker "
	"configuration rules via the #cluster-name node attribute, and "
	"by higher-level tools and resource agents.")
	},
	{
	XML_CONFIG_ATTR_DC_DEADTIME, NULL, "time",
	NULL, "20s", pcmk__valid_interval_spec,
	N_("How long to wait for a response from other nodes during start-up"),
	N_("The optimal value will depend on the speed and load of your network "
	"and the type of switches used.")
	},
	{
	XML_CONFIG_ATTR_RECHECK, NULL, "time",
	N_("Zero disables polling, while positive values are an interval in seconds"
	"(unless other units are specified, for example \"5min\")"),
	"15min", pcmk__valid_interval_spec,
	N_("Polling interval to recheck cluster state and evaluate rules "
	"with date specifications"),
	N_("Pacemaker is primarily event-driven, and looks ahead to know when to "
	"recheck cluster state for failure timeouts and most time-based "
	"rules. However, it will also recheck the cluster after this "
	"amount of inactivity, to evaluate rules with date specifications "
	"and serve as a fail-safe for certain types of scheduler bugs.")
	},
	{
	"load-threshold", NULL, "percentage", NULL,
	"80%", pcmk__valid_percentage,
	N_("Maximum amount of system load that should be used by cluster nodes"),
	N_("The cluster will slow down its recovery process when the amount of "
	"system resources used (currently CPU) approaches this limit"),
	},
	{
	"node-action-limit", NULL, "integer", NULL,
	"0", pcmk__valid_number,
	N_("Maximum number of jobs that can be scheduled per node "
	"(defaults to 2x cores)")
	},
	{ XML_CONFIG_ATTR_FENCE_REACTION, NULL, "string", NULL, "stop", NULL,
	N_("How a cluster node should react if notified of its own fencing"),
	N_("A cluster node may receive notification of its own fencing if fencing "
	"is misconfigured, or if fabric fencing is in use that doesn't cut "
	"cluster communication. Allowed values are \"stop\" to attempt to "
	"immediately stop Pacemaker and stay stopped, or \"panic\" to attempt "
	"to immediately reboot the local node, falling back to stop on failure.")
	},
	{
	XML_CONFIG_ATTR_ELECTION_FAIL, NULL, "time", NULL,
	"2min", pcmk__valid_interval_spec,
	"* Advanced Use Only *",
	N_("Declare an election failed if it is not decided within this much "
	"time. If you need to adjust this value, it probably indicates "
	"the presence of a bug.")
	},
	{
	XML_CONFIG_ATTR_FORCE_QUIT, NULL, "time", NULL,
	"20min", pcmk__valid_interval_spec,
	"* Advanced Use Only *",
	N_("Exit immediately if shutdown does not complete within this much "
	"time. If you need to adjust this value, it probably indicates "
	"the presence of a bug.")
	},
	{
	"join-integration-timeout", "crmd-integration-timeout", "time", NULL,
	"3min", pcmk__valid_interval_spec,
	"* Advanced Use Only *",
	N_("If you need to adjust this value, it probably indicates "
	"the presence of a bug.")
	},
	{
	"join-finalization-timeout", "crmd-finalization-timeout", "time", NULL,
	"30min", pcmk__valid_interval_spec,
	"* Advanced Use Only *",
	N_("If you need to adjust this value, it probably indicates "
	"the presence of a bug.")
	},
	{
	"transition-delay", "crmd-transition-delay", "time", NULL,
	"0s", pcmk__valid_interval_spec,
	N_("* Advanced Use Only * Enabling this option will slow down "
	"cluster recovery under all conditions"),
	N_("Delay cluster recovery for this much time to allow for additional "
	"events to occur. Useful if your configuration is sensitive to "
	"the order in which ping updates arrive.")
	},
	{
	"stonith-watchdog-timeout", NULL, "time", NULL,
	"0", controld_verify_stonith_watchdog_timeout,
	N_("How long before nodes can be assumed to be safely down when "
	"watchdog-based self-fencing via SBD is in use"),
	N_("If this is set to a positive value, lost nodes are assumed to "
	"self-fence using watchdog-based SBD within this much time. This "
	"does not require a fencing resource to be explicitly configured, "
	"though a fence_watchdog resource can be configured, to limit use "
	"to specific nodes. If this is set to 0 (the default), the cluster "
	"will never assume watchdog-based self-fencing. If this is set to a "
	"negative value, the cluster will use twice the local value of the "
	"`SBD_WATCHDOG_TIMEOUT` environment variable if that is positive, "
	"or otherwise treat this as 0. WARNING: When used, this timeout "
	"must be larger than `SBD_WATCHDOG_TIMEOUT` on all nodes that use "
	"watchdog-based SBD, and Pacemaker will refuse to start on any of "
	"those nodes where this is not true for the local value or SBD is "
	"not active. When this is set to a negative value, "
	"`SBD_WATCHDOG_TIMEOUT` must be set to the same value on all nodes "
	"that use SBD, otherwise data corruption or loss could occur.")
	},
	{
	"stonith-max-attempts", NULL, "integer", NULL,
	"10", pcmk__valid_positive_number,
	N_("How many times fencing can fail before it will no longer be "
	"immediately re-attempted on a target")
	},

	// Already documented in libpe_status (other values must be kept identical)
	{
	- "no-quorum-policy", NULL, "select", "stop, freeze, ignore, demote, suicide",
	- "stop", pcmk__valid_quorum, NULL, NULL
	+ "no-quorum-policy", NULL, "select",
	+ "stop, freeze, ignore, demote, suicide", "stop", pcmk__valid_quorum,
	+ "What to do when the cluster does not have quorum", NULL
	},
	{
	XML_CONFIG_ATTR_SHUTDOWN_LOCK, NULL, "boolean", NULL,
	- "false", pcmk__valid_boolean, NULL, NULL
	+ "false", pcmk__valid_boolean,
	+ "Whether to lock resources to a cleanly shut down node",
	+ "When true, resources active on a node when it is cleanly shut down "
	+ "are kept \"locked\" to that node (not allowed to run elsewhere) "
	+ "until they start again on that node after it rejoins (or for at "
	+ "most shutdown-lock-limit, if set). Stonith resources and "
	+ "Pacemaker Remote connections are never locked. Clone and bundle "
	+ "instances and the promoted role of promotable clones are currently"
	+ " never locked, though support could be added in a future release."
	},
	};

	void
	crmd_metadata(void)
	{
	const char *desc_short = "Pacemaker controller options";
	const char *desc_long = "Cluster options used by Pacemaker's controller";

	gchar *s = pcmk__format_option_metadata("pacemaker-controld", desc_short,
	desc_long, controller_options,
	PCMK__NELEM(controller_options));
	printf("%s", s);
	g_free(s);
	}

	static const char *
	controller_option(GHashTable options, const char name)
	{
	return pcmk__cluster_option(options, controller_options,
	PCMK__NELEM(controller_options), name);
	}

	static void
	config_query_callback(xmlNode * msg, int call_id, int rc, xmlNode * output, void *user_data)
	{
	const char *value = NULL;
	GHashTable *config_hash = NULL;
	crm_time_t *now = crm_time_new(NULL);
	xmlNode *crmconfig = NULL;
	xmlNode *alerts = NULL;

	if (rc != pcmk_ok) {
	fsa_data_t *msg_data = NULL;

	crm_err("Local CIB query resulted in an error: %s", pcmk_strerror(rc));
	register_fsa_error(C_FSA_INTERNAL, I_ERROR, NULL);

	if (rc == -EACCES \|\| rc == -pcmk_err_schema_validation) {
	crm_err("The cluster is mis-configured - shutting down and staying down");
	controld_set_fsa_input_flags(R_STAYDOWN);
	}
	goto bail;
	}

	crmconfig = output;
	if ((crmconfig) &&
	(crm_element_name(crmconfig)) &&
	(strcmp(crm_element_name(crmconfig), XML_CIB_TAG_CRMCONFIG) != 0)) {
	crmconfig = first_named_child(crmconfig, XML_CIB_TAG_CRMCONFIG);
	}
	if (!crmconfig) {
	fsa_data_t *msg_data = NULL;

	crm_err("Local CIB query for " XML_CIB_TAG_CRMCONFIG " section failed");
	register_fsa_error(C_FSA_INTERNAL, I_ERROR, NULL);
	goto bail;
	}

	crm_debug("Call %d : Parsing CIB options", call_id);
	config_hash = pcmk__strkey_table(free, free);
	pe_unpack_nvpairs(crmconfig, crmconfig, XML_CIB_TAG_PROPSET, NULL,
	config_hash, CIB_OPTIONS_FIRST, FALSE, now, NULL);

	pcmk__validate_cluster_options(config_hash, controller_options,
	PCMK__NELEM(controller_options));

	value = controller_option(config_hash, XML_CONFIG_ATTR_DC_DEADTIME);
	election_trigger->period_ms = crm_parse_interval_spec(value);

	value = controller_option(config_hash, "node-action-limit");
	throttle_update_job_max(value);

	value = controller_option(config_hash, "load-threshold");
	if(value) {
	throttle_set_load_target(strtof(value, NULL) / 100.0);
	}

	value = controller_option(config_hash, "no-quorum-policy");
	if (pcmk__str_eq(value, "suicide", pcmk__str_casei) && pcmk__locate_sbd()) {
	no_quorum_suicide_escalation = TRUE;
	}

	set_fence_reaction(controller_option(config_hash,
	XML_CONFIG_ATTR_FENCE_REACTION));

	value = controller_option(config_hash, "stonith-max-attempts");
	update_stonith_max_attempts(value);

	value = controller_option(config_hash, XML_CONFIG_ATTR_FORCE_QUIT);
	shutdown_escalation_timer->period_ms = crm_parse_interval_spec(value);
	crm_debug("Shutdown escalation occurs if DC has not responded to request in %ums",
	shutdown_escalation_timer->period_ms);

	value = controller_option(config_hash, XML_CONFIG_ATTR_ELECTION_FAIL);
	controld_set_election_period(value);

	value = controller_option(config_hash, XML_CONFIG_ATTR_RECHECK);
	recheck_interval_ms = crm_parse_interval_spec(value);
	crm_debug("Re-run scheduler after %dms of inactivity", recheck_interval_ms);

	value = controller_option(config_hash, "transition-delay");
	transition_timer->period_ms = crm_parse_interval_spec(value);

	value = controller_option(config_hash, "join-integration-timeout");
	integration_timer->period_ms = crm_parse_interval_spec(value);

	value = controller_option(config_hash, "join-finalization-timeout");
	finalization_timer->period_ms = crm_parse_interval_spec(value);

	value = controller_option(config_hash, XML_CONFIG_ATTR_SHUTDOWN_LOCK);
	controld_shutdown_lock_enabled = crm_is_true(value);

	free(fsa_cluster_name);
	fsa_cluster_name = NULL;

	value = g_hash_table_lookup(config_hash, "cluster-name");
	if (value) {
	fsa_cluster_name = strdup(value);
	}

	alerts = first_named_child(output, XML_CIB_TAG_ALERTS);
	crmd_unpack_alerts(alerts);

	controld_set_fsa_input_flags(R_READ_CONFIG);
	crm_trace("Triggering FSA: %s", __func__);
	mainloop_set_trigger(fsa_source);

	g_hash_table_destroy(config_hash);
	bail:
	crm_time_free(now);
	}

	gboolean
	crm_read_options(gpointer user_data)
	{
	int call_id =
	fsa_cib_conn->cmds->query(fsa_cib_conn,
	"//" XML_CIB_TAG_CRMCONFIG " \| //" XML_CIB_TAG_ALERTS,
	NULL, cib_xpath \| cib_scope_local);

	fsa_register_cib_callback(call_id, FALSE, NULL, config_query_callback);
	crm_trace("Querying the CIB... call %d", call_id);
	return TRUE;
	}

	/* A_READCONFIG */
	void
	do_read_config(long long action,
	enum crmd_fsa_cause cause,
	enum crmd_fsa_state cur_state,
	enum crmd_fsa_input current_input, fsa_data_t * msg_data)
	{
	throttle_init();
	mainloop_set_trigger(config_read);
	}

	void
	crm_shutdown(int nsig)
	{
	if ((crmd_mainloop == NULL) \|\| !g_main_loop_is_running(crmd_mainloop)) {
	crmd_exit(CRM_EX_OK);
	return;
	}

	if (pcmk_is_set(fsa_input_register, R_SHUTDOWN)) {
	crm_err("Escalating shutdown");
	register_fsa_input_before(C_SHUTDOWN, I_ERROR, NULL);
	return;
	}

	controld_set_fsa_input_flags(R_SHUTDOWN);
	register_fsa_input(C_SHUTDOWN, I_SHUTDOWN, NULL);

	if (shutdown_escalation_timer->period_ms == 0) {
	const char *value = controller_option(NULL, XML_CONFIG_ATTR_FORCE_QUIT);

	shutdown_escalation_timer->period_ms = crm_parse_interval_spec(value);
	}

	crm_notice("Initiating controller shutdown sequence " CRM_XS
	" limit=%ums", shutdown_escalation_timer->period_ms);
	controld_start_timer(shutdown_escalation_timer);
	}
	diff --git a/include/crm/common/strings_internal.h b/include/crm/common/strings_internal.h
	index 7a8b092d1a..cd394d95fc 100644
	--- a/include/crm/common/strings_internal.h
	+++ b/include/crm/common/strings_internal.h
	@@ -1,213 +1,214 @@
	/*
	* Copyright 2015-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#ifndef PCMK__STRINGS_INTERNAL__H
	#define PCMK__STRINGS_INTERNAL__H

	#include <stdbool.h> // bool

	#include <glib.h> // guint, GList, GHashTable

	/* internal constants for generic string functions (from strings.c) */

	#define PCMK__PARSE_INT_DEFAULT -1
	#define PCMK__PARSE_DBL_DEFAULT -1.0

	/* internal generic string functions (from strings.c) */

	enum pcmk__str_flags {
	pcmk__str_none = 0,
	pcmk__str_casei = 1 << 0,
	pcmk__str_null_matches = 1 << 1,
	pcmk__str_regex = 1 << 2,
	pcmk__str_star_matches = 1 << 3,
	};

	int pcmk__scan_double(const char text, double result,
	const char default_text, char *end_text);
	int pcmk__guint_from_hash(GHashTable table, const char key, guint default_val,
	guint *result);
	bool pcmk__starts_with(const char str, const char prefix);
	bool pcmk__ends_with(const char s, const char match);
	bool pcmk__ends_with_ext(const char s, const char match);
	char pcmk__trim(char str);
	void pcmk__add_separated_word(GString **list, size_t init_size,
	const char word, const char separator);
	int pcmk__compress(const char *data, unsigned int length, unsigned int max,
	char *result, unsigned int result_len);

	int pcmk__scan_ll(const char text, long long result, long long default_value);
	int pcmk__scan_min_int(const char text, int result, int minimum);
	int pcmk__scan_port(const char text, int port);
	int pcmk__parse_ll_range(const char srcstring, long long start, long long *end);

	GHashTable *pcmk__strkey_table(GDestroyNotify key_destroy_func,
	GDestroyNotify value_destroy_func);
	GHashTable *pcmk__strikey_table(GDestroyNotify key_destroy_func,
	GDestroyNotify value_destroy_func);
	GHashTable pcmk__str_table_dup(GHashTable old_table);

	/*!
	* \internal
	* \brief Get a string value with a default if NULL
	*
	* \param[in] s String to return if non-NULL
	* \param[in] default_value String (or NULL) to return if \p s is NULL
	*
	* \return \p s if \p s is non-NULL, otherwise \p default_value
	*/
	static inline const char *
	pcmk__s(const char s, const char default_value)
	{
	return (s == NULL)? default_value : s;
	}

	/*!
	* \internal
	* \brief Create a hash table with integer keys
	*
	* \param[in] value_destroy_func Function to free a value
	*
	* \return Newly allocated hash table
	* \note It is the caller's responsibility to free the result, using
	* g_hash_table_destroy().
	*/
	static inline GHashTable *
	pcmk__intkey_table(GDestroyNotify value_destroy_func)
	{
	return g_hash_table_new_full(g_direct_hash, g_direct_equal, NULL,
	value_destroy_func);
	}

	/*!
	* \internal
	* \brief Insert a value into a hash table with integer keys
	*
	* \param[in,out] hash_table Table to insert into
	* \param[in] key Integer key to insert
	* \param[in] value Value to insert
	*
	* \return Whether the key/value was already in the table
	* \note This has the same semantics as g_hash_table_insert(). If the key
	* already exists in the table, the old value is freed and replaced.
	*/
	static inline gboolean
	pcmk__intkey_table_insert(GHashTable *hash_table, int key, gpointer value)
	{
	return g_hash_table_insert(hash_table, GINT_TO_POINTER(key), value);
	}

	/*!
	* \internal
	* \brief Look up a value in a hash table with integer keys
	*
	* \param[in] hash_table Table to check
	* \param[in] key Integer key to look for
	*
	* \return Value in table for \key (or NULL if not found)
	*/
	static inline gpointer
	pcmk__intkey_table_lookup(GHashTable *hash_table, int key)
	{
	return g_hash_table_lookup(hash_table, GINT_TO_POINTER(key));
	}

	/*!
	* \internal
	* \brief Remove a key/value from a hash table with integer keys
	*
	* \param[in,out] hash_table Table to modify
	* \param[in] key Integer key of entry to remove
	*
	* \return Whether \p key was found and removed from \p hash_table
	*/
	static inline gboolean
	pcmk__intkey_table_remove(GHashTable *hash_table, int key)
	{
	return g_hash_table_remove(hash_table, GINT_TO_POINTER(key));
	}

	gboolean pcmk__str_in_list(const gchar s, const GList lst, uint32_t flags);

	bool pcmk__strcase_any_of(const char *s, ...) G_GNUC_NULL_TERMINATED;
	bool pcmk__str_any_of(const char *s, ...) G_GNUC_NULL_TERMINATED;
	bool pcmk__char_in_any_str(int ch, ...) G_GNUC_NULL_TERMINATED;

	int pcmk__strcmp(const char s1, const char s2, uint32_t flags);
	int pcmk__numeric_strcasecmp(const char s1, const char s2);
	void pcmk__str_update(char *str, const char value);
	+void pcmk__g_strcat(GString *buffer, ...) G_GNUC_NULL_TERMINATED;

	static inline bool
	pcmk__str_eq(const char s1, const char s2, uint32_t flags)
	{
	return pcmk__strcmp(s1, s2, flags) == 0;
	}

	// Like pcmk__add_separated_word() but using a space as separator
	static inline void
	pcmk__add_word(GString *list, size_t init_size, const char word)
	{
	return pcmk__add_separated_word(list, init_size, word, " ");
	}

	/* Correctly displaying singular or plural is complicated; consider "1 node has"
	* vs. "2 nodes have". A flexible solution is to pluralize entire strings, e.g.
	*
	* if (a == 1) {
	* crm_info("singular message"):
	* } else {
	* crm_info("plural message");
	* }
	*
	* though even that's not sufficient for all languages besides English (if we
	* ever desire to do translations of output and log messages). But the following
	* convenience macros are "good enough" and more concise for many cases.
	*/

	/* Example:
	* crm_info("Found %d %s", nentries,
	* pcmk__plural_alt(nentries, "entry", "entries"));
	*/
	#define pcmk__plural_alt(i, s1, s2) (((i) == 1)? (s1) : (s2))

	// Example: crm_info("Found %d node%s", nnodes, pcmk__plural_s(nnodes));
	#define pcmk__plural_s(i) pcmk__plural_alt(i, "", "s")

	static inline int
	pcmk__str_empty(const char *s)
	{
	return (s == NULL) \|\| (s[0] == '\0');
	}

	static inline char *
	pcmk__itoa(int an_int)
	{
	return crm_strdup_printf("%d", an_int);
	}

	static inline char *
	pcmk__ftoa(double a_float)
	{
	return crm_strdup_printf("%f", a_float);
	}

	static inline char *
	pcmk__ttoa(time_t epoch_time)
	{
	return crm_strdup_printf("%lld", (long long) epoch_time);
	}

	// note this returns const not allocated
	static inline const char *
	pcmk__btoa(bool condition)
	{
	return condition? "true" : "false";
	}

	#endif /* PCMK__STRINGS_INTERNAL__H */
	diff --git a/lib/common/acl.c b/lib/common/acl.c
	index f0f29ecd3a..39f5cc730a 100644
	--- a/lib/common/acl.c
	+++ b/lib/common/acl.c
	@@ -1,862 +1,862 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h>
	#include <sys/types.h>
	#include <pwd.h>
	#include <string.h>
	#include <stdlib.h>
	#include <stdarg.h>

	#include <libxml/tree.h>

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h>
	#include "crmcommon_private.h"

	typedef struct xml_acl_s {
	enum xml_private_flags mode;
	char *xpath;
	} xml_acl_t;

	static void
	free_acl(void *data)
	{
	if (data) {
	xml_acl_t *acl = data;

	free(acl->xpath);
	free(acl);
	}
	}

	void
	pcmk__free_acls(GList *acls)
	{
	g_list_free_full(acls, free_acl);
	}

	static GList *
	create_acl(xmlNode xml, GList acls, enum xml_private_flags mode)
	{
	xml_acl_t *acl = NULL;

	const char *tag = crm_element_value(xml, XML_ACL_ATTR_TAG);
	const char *ref = crm_element_value(xml, XML_ACL_ATTR_REF);
	const char *xpath = crm_element_value(xml, XML_ACL_ATTR_XPATH);
	const char *attr = crm_element_value(xml, XML_ACL_ATTR_ATTRIBUTE);

	if (tag == NULL) {
	// @COMPAT rolling upgrades <=1.1.11
	tag = crm_element_value(xml, XML_ACL_ATTR_TAGv1);
	}
	if (ref == NULL) {
	// @COMPAT rolling upgrades <=1.1.11
	ref = crm_element_value(xml, XML_ACL_ATTR_REFv1);
	}

	if ((tag == NULL) && (ref == NULL) && (xpath == NULL)) {
	// Schema should prevent this, but to be safe ...
	crm_trace("Ignoring ACL <%s> element without selection criteria",
	crm_element_name(xml));
	return NULL;
	}

	acl = calloc(1, sizeof (xml_acl_t));
	CRM_ASSERT(acl != NULL);

	acl->mode = mode;
	if (xpath) {
	acl->xpath = strdup(xpath);
	CRM_ASSERT(acl->xpath != NULL);
	crm_trace("Unpacked ACL <%s> element using xpath: %s",
	crm_element_name(xml), acl->xpath);

	} else {
	GString *buf = g_string_sized_new(128);

	if ((ref != NULL) && (attr != NULL)) {
	// NOTE: schema currently does not allow this
	- g_string_append_printf(buf, "//%s[@" XML_ATTR_ID "='%s' and @%s]",
	- pcmk__s(tag, "*"), ref, attr);
	+ pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), "[@" XML_ATTR_ID "='",
	+ ref, "' and @", attr, "]", NULL);

	} else if (ref != NULL) {
	- g_string_append_printf(buf, "//%s[@" XML_ATTR_ID "='%s']",
	- pcmk__s(tag, "*"), ref);
	+ pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), "[@" XML_ATTR_ID "='",
	+ ref, "']", NULL);

	} else if (attr != NULL) {
	- g_string_append_printf(buf, "//%s[@%s]", pcmk__s(tag, "*"), attr);
	+ pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), "[@", attr, "]", NULL);

	} else {
	- g_string_append_printf(buf, "//%s", pcmk__s(tag, "*"));
	+ pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), NULL);
	}

	acl->xpath = strdup((const char *) buf->str);
	CRM_ASSERT(acl->xpath != NULL);

	g_string_free(buf, TRUE);
	crm_trace("Unpacked ACL <%s> element as xpath: %s",
	crm_element_name(xml), acl->xpath);
	}

	return g_list_append(acls, acl);
	}

	/*!
	* \internal
	* \brief Unpack a user, group, or role subtree of the ACLs section
	*
	* \param[in] acl_top XML of entire ACLs section
	* \param[in] acl_entry XML of ACL element being unpacked
	* \param[in,out] acls List of ACLs unpacked so far
	*
	* \return New head of (possibly modified) acls
	*
	* \note This function is recursive
	*/
	static GList *
	parse_acl_entry(xmlNode acl_top, xmlNode acl_entry, GList *acls)
	{
	xmlNode *child = NULL;

	for (child = pcmk__xe_first_child(acl_entry); child;
	child = pcmk__xe_next(child)) {
	const char *tag = crm_element_name(child);
	const char *kind = crm_element_value(child, XML_ACL_ATTR_KIND);

	if (strcmp(XML_ACL_TAG_PERMISSION, tag) == 0){
	CRM_ASSERT(kind != NULL);
	crm_trace("Unpacking ACL <%s> element of kind '%s'", tag, kind);
	tag = kind;
	} else {
	crm_trace("Unpacking ACL <%s> element", tag);
	}

	if (strcmp(XML_ACL_TAG_ROLE_REF, tag) == 0
	\|\| strcmp(XML_ACL_TAG_ROLE_REFv1, tag) == 0) {
	const char *ref_role = crm_element_value(child, XML_ATTR_ID);

	if (ref_role) {
	xmlNode *role = NULL;

	for (role = pcmk__xe_first_child(acl_top); role;
	role = pcmk__xe_next(role)) {
	if (!strcmp(XML_ACL_TAG_ROLE, (const char *) role->name)) {
	const char *role_id = crm_element_value(role,
	XML_ATTR_ID);

	if (role_id && strcmp(ref_role, role_id) == 0) {
	crm_trace("Unpacking referenced role '%s' in ACL <%s> element",
	role_id, crm_element_name(acl_entry));
	acls = parse_acl_entry(acl_top, role, acls);
	break;
	}
	}
	}
	}

	} else if (strcmp(XML_ACL_TAG_READ, tag) == 0) {
	acls = create_acl(child, acls, pcmk__xf_acl_read);

	} else if (strcmp(XML_ACL_TAG_WRITE, tag) == 0) {
	acls = create_acl(child, acls, pcmk__xf_acl_write);

	} else if (strcmp(XML_ACL_TAG_DENY, tag) == 0) {
	acls = create_acl(child, acls, pcmk__xf_acl_deny);

	} else {
	crm_warn("Ignoring unknown ACL %s '%s'",
	(kind? "kind" : "element"), tag);
	}
	}

	return acls;
	}

	/*
	<acls>
	<acl_target id="l33t-haxor"><role id="auto-l33t-haxor"/></acl_target>
	<acl_role id="auto-l33t-haxor">
	<acl_permission id="crook-nothing" kind="deny" xpath="/cib"/>
	</acl_role>
	<acl_target id="niceguy">
	<role id="observer"/>
	</acl_target>
	<acl_role id="observer">
	<acl_permission id="observer-read-1" kind="read" xpath="/cib"/>
	<acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>
	<acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>
	</acl_role>
	<acl_target id="badidea"><role id="auto-badidea"/></acl_target>
	<acl_role id="auto-badidea">
	<acl_permission id="badidea-resources" kind="read" xpath="//meta_attributes"/>
	<acl_permission id="badidea-resources-2" kind="deny" reference="dummy-meta_attributes"/>
	</acl_role>
	</acls>
	*/

	static const char *
	acl_to_text(enum xml_private_flags flags)
	{
	if (pcmk_is_set(flags, pcmk__xf_acl_deny)) {
	return "deny";

	} else if (pcmk_any_flags_set(flags, pcmk__xf_acl_write\|pcmk__xf_acl_create)) {
	return "read/write";

	} else if (pcmk_is_set(flags, pcmk__xf_acl_read)) {
	return "read";
	}
	return "none";
	}

	void
	pcmk__apply_acl(xmlNode *xml)
	{
	GList *aIter = NULL;
	xml_private_t *p = xml->doc->_private;
	xmlXPathObjectPtr xpathObj = NULL;

	if (!xml_acl_enabled(xml)) {
	crm_trace("Skipping ACLs for user '%s' because not enabled for this XML",
	p->user);
	return;
	}

	for (aIter = p->acls; aIter != NULL; aIter = aIter->next) {
	int max = 0, lpc = 0;
	xml_acl_t *acl = aIter->data;

	xpathObj = xpath_search(xml, acl->xpath);
	max = numXpathResults(xpathObj);

	for (lpc = 0; lpc < max; lpc++) {
	static struct qb_log_callsite *trace_cs = NULL;
	xmlNode *match = getXpathResult(xpathObj, lpc);

	p = match->_private;
	pcmk__set_xml_flags(p, acl->mode);

	/* Build a GString only if tracing is enabled.
	* Can't use pcmk__log_else() because the else_action would be
	* continue.
	*/
	if (trace_cs == NULL) {
	trace_cs = qb_log_callsite_get(__func__, __FILE__, "apply_acl",
	LOG_TRACE, __LINE__, 0);
	}
	if (crm_is_callsite_active(trace_cs, LOG_TRACE, 0)) {
	GString *path = pcmk__element_xpath(match);
	crm_trace("Applying %s ACL to %s matched by %s",
	acl_to_text(acl->mode), (const char *) path->str,
	acl->xpath);
	g_string_free(path, TRUE);
	}
	}
	crm_trace("Applied %s ACL %s (%d match%s)",
	acl_to_text(acl->mode), acl->xpath, max,
	((max == 1)? "" : "es"));
	freeXpathObject(xpathObj);
	}
	}

	/*!
	* \internal
	* \brief Unpack ACLs for a given user into the
	* metadata of the target XML tree
	*
	* Taking the description of ACLs from the source XML tree and
	* marking up the target XML tree with access information for the
	* given user by tacking it onto the relevant nodes
	*
	* \param[in] source XML with ACL definitions
	* \param[in,out] target XML that ACLs will be applied to
	* \param[in] user Username whose ACLs need to be unpacked
	*/
	void
	pcmk__unpack_acl(xmlNode source, xmlNode target, const char *user)
	{
	xml_private_t *p = NULL;

	if ((target == NULL) \|\| (target->doc == NULL)
	\|\| (target->doc->_private == NULL)) {
	return;
	}

	p = target->doc->_private;
	if (!pcmk_acl_required(user)) {
	crm_trace("Not unpacking ACLs because not required for user '%s'",
	user);

	} else if (p->acls == NULL) {
	xmlNode *acls = get_xpath_object("//" XML_CIB_TAG_ACLS,
	source, LOG_NEVER);

	pcmk__str_update(&p->user, user);

	if (acls) {
	xmlNode *child = NULL;

	for (child = pcmk__xe_first_child(acls); child;
	child = pcmk__xe_next(child)) {
	const char *tag = crm_element_name(child);

	if (!strcmp(tag, XML_ACL_TAG_USER)
	\|\| !strcmp(tag, XML_ACL_TAG_USERv1)) {
	const char *id = crm_element_value(child, XML_ATTR_NAME);

	if (id == NULL) {
	id = crm_element_value(child, XML_ATTR_ID);
	}

	if (id && strcmp(id, user) == 0) {
	crm_debug("Unpacking ACLs for user '%s'", id);
	p->acls = parse_acl_entry(acls, child, p->acls);
	}
	} else if (!strcmp(tag, XML_ACL_TAG_GROUP)) {
	const char *id = crm_element_value(child, XML_ATTR_NAME);

	if (id == NULL) {
	id = crm_element_value(child, XML_ATTR_ID);
	}

	if (id && pcmk__is_user_in_group(user,id)) {
	crm_debug("Unpacking ACLs for group '%s'", id);
	p->acls = parse_acl_entry(acls, child, p->acls);
	}
	}
	}
	}
	}
	}

	/*!
	* \internal
	* \brief Copy source to target and set xf_acl_enabled flag in target
	*
	* \param[in] acl_source XML with ACL definitions
	* \param[in,out] target XML that ACLs will be applied to
	* \param[in] user Username whose ACLs need to be set
	*/
	void
	pcmk__enable_acl(xmlNode acl_source, xmlNode target, const char *user)
	{
	pcmk__unpack_acl(acl_source, target, user);
	pcmk__set_xml_doc_flag(target, pcmk__xf_acl_enabled);
	pcmk__apply_acl(target);
	}

	static inline bool
	test_acl_mode(enum xml_private_flags allowed, enum xml_private_flags requested)
	{
	if (pcmk_is_set(allowed, pcmk__xf_acl_deny)) {
	return false;

	} else if (pcmk_all_flags_set(allowed, requested)) {
	return true;

	} else if (pcmk_is_set(requested, pcmk__xf_acl_read)
	&& pcmk_is_set(allowed, pcmk__xf_acl_write)) {
	return true;

	} else if (pcmk_is_set(requested, pcmk__xf_acl_create)
	&& pcmk_any_flags_set(allowed, pcmk__xf_acl_write\|pcmk__xf_created)) {
	return true;
	}
	return false;
	}

	/*!
	* \internal
	* \brief Rid XML tree of all unreadable nodes and node properties
	*
	* \param[in] xml root node to be purged of attributes
	*
	* \return true if this node or any of its children are readable
	* if false is returned, xml will be freed
	*
	* \note This function is recursive
	*/
	static bool
	purge_xml_attributes(xmlNode *xml)
	{
	xmlNode *child = NULL;
	xmlAttr *xIter = NULL;
	bool readable_children = false;
	xml_private_t *p = xml->_private;

	if (test_acl_mode(p->flags, pcmk__xf_acl_read)) {
	crm_trace("%s[@id=%s] is readable", crm_element_name(xml), ID(xml));
	return true;
	}

	xIter = xml->properties;
	while (xIter != NULL) {
	xmlAttr *tmp = xIter;
	const char prop_name = (const char )xIter->name;

	xIter = xIter->next;
	if (strcmp(prop_name, XML_ATTR_ID) == 0) {
	continue;
	}

	xmlUnsetProp(xml, tmp->name);
	}

	child = pcmk__xml_first_child(xml);
	while ( child != NULL ) {
	xmlNode *tmp = child;

	child = pcmk__xml_next(child);
	readable_children \|= purge_xml_attributes(tmp);
	}

	if (!readable_children) {
	free_xml(xml); /* Nothing readable under here, purge completely */
	}
	return readable_children;
	}

	/*!
	* \brief Copy ACL-allowed portions of specified XML
	*
	* \param[in] user Username whose ACLs should be used
	* \param[in] acl_source XML containing ACLs
	* \param[in] xml XML to be copied
	* \param[out] result Copy of XML portions readable via ACLs
	*
	* \return true if xml exists and ACLs are required for user, false otherwise
	* \note If this returns true, caller should use \p result rather than \p xml
	*/
	bool
	xml_acl_filtered_copy(const char user, xmlNode acl_source, xmlNode *xml,
	xmlNode **result)
	{
	GList *aIter = NULL;
	xmlNode *target = NULL;
	xml_private_t *doc = NULL;

	*result = NULL;
	if ((xml == NULL) \|\| !pcmk_acl_required(user)) {
	crm_trace("Not filtering XML because ACLs not required for user '%s'",
	user);
	return false;
	}

	crm_trace("Filtering XML copy using user '%s' ACLs", user);
	target = copy_xml(xml);
	if (target == NULL) {
	return true;
	}

	pcmk__enable_acl(acl_source, target, user);

	doc = target->doc->_private;
	for(aIter = doc->acls; aIter != NULL && target; aIter = aIter->next) {
	int max = 0;
	xml_acl_t *acl = aIter->data;

	if (acl->mode != pcmk__xf_acl_deny) {
	/* Nothing to do */

	} else if (acl->xpath) {
	int lpc = 0;
	xmlXPathObjectPtr xpathObj = xpath_search(target, acl->xpath);

	max = numXpathResults(xpathObj);
	for(lpc = 0; lpc < max; lpc++) {
	xmlNode *match = getXpathResult(xpathObj, lpc);

	if (!purge_xml_attributes(match) && (match == target)) {
	crm_trace("ACLs deny user '%s' access to entire XML document",
	user);
	freeXpathObject(xpathObj);
	return true;
	}
	}
	crm_trace("ACLs deny user '%s' access to %s (%d %s)",
	user, acl->xpath, max,
	pcmk__plural_alt(max, "match", "matches"));
	freeXpathObject(xpathObj);
	}
	}

	if (!purge_xml_attributes(target)) {
	crm_trace("ACLs deny user '%s' access to entire XML document", user);
	return true;
	}

	if (doc->acls) {
	g_list_free_full(doc->acls, free_acl);
	doc->acls = NULL;

	} else {
	crm_trace("User '%s' without ACLs denied access to entire XML document",
	user);
	free_xml(target);
	target = NULL;
	}

	if (target) {
	*result = target;
	}

	return true;
	}

	/*!
	* \internal
	* \brief Check whether creation of an XML element is implicitly allowed
	*
	* Check whether XML is a "scaffolding" element whose creation is implicitly
	* allowed regardless of ACLs (that is, it is not in the ACL section and has
	* no attributes other than "id").
	*
	* \param[in] xml XML element to check
	*
	* \return true if XML element is implicitly allowed, false otherwise
	*/
	static bool
	implicitly_allowed(xmlNode *xml)
	{
	GString *path = NULL;

	for (xmlAttr *prop = xml->properties; prop != NULL; prop = prop->next) {
	if (strcmp((const char *) prop->name, XML_ATTR_ID) != 0) {
	return false;
	}
	}

	path = pcmk__element_xpath(xml);
	CRM_ASSERT(path != NULL);

	if (strstr((const char *) path->str, "/" XML_CIB_TAG_ACLS "/") != NULL) {
	g_string_free(path, TRUE);
	return false;
	}

	g_string_free(path, TRUE);
	return true;
	}

	#define display_id(xml) (ID(xml)? ID(xml) : "<unset>")

	/*!
	* \internal
	* \brief Drop XML nodes created in violation of ACLs
	*
	* Given an XML element, free all of its descendent nodes created in violation
	* of ACLs, with the exception of allowing "scaffolding" elements (i.e. those
	* that aren't in the ACL section and don't have any attributes other than
	* "id").
	*
	* \param[in,out] xml XML to check
	* \param[in] check_top Whether to apply checks to argument itself
	* (if true, xml might get freed)
	*
	* \note This function is recursive
	*/
	void
	pcmk__apply_creation_acl(xmlNode *xml, bool check_top)
	{
	xml_private_t *p = xml->_private;

	if (pcmk_is_set(p->flags, pcmk__xf_created)) {
	if (implicitly_allowed(xml)) {
	crm_trace("Creation of <%s> scaffolding with id=\"%s\""
	" is implicitly allowed",
	crm_element_name(xml), display_id(xml));

	} else if (pcmk__check_acl(xml, NULL, pcmk__xf_acl_write)) {
	crm_trace("ACLs allow creation of <%s> with id=\"%s\"",
	crm_element_name(xml), display_id(xml));

	} else if (check_top) {
	crm_trace("ACLs disallow creation of <%s> with id=\"%s\"",
	crm_element_name(xml), display_id(xml));
	pcmk_free_xml_subtree(xml);
	return;

	} else {
	crm_notice("ACLs would disallow creation of %s<%s> with id=\"%s\" ",
	((xml == xmlDocGetRootElement(xml->doc))? "root element " : ""),
	crm_element_name(xml), display_id(xml));
	}
	}

	for (xmlNode *cIter = pcmk__xml_first_child(xml); cIter != NULL; ) {
	xmlNode *child = cIter;
	cIter = pcmk__xml_next(cIter); /* In case it is free'd */
	pcmk__apply_creation_acl(child, true);
	}
	}

	/*!
	* \brief Check whether or not an XML node is ACL-denied
	*
	* \param[in] xml node to check
	*
	* \return true if XML node exists and is ACL-denied, false otherwise
	*/
	bool
	xml_acl_denied(xmlNode *xml)
	{
	if (xml && xml->doc && xml->doc->_private){
	xml_private_t *p = xml->doc->_private;

	return pcmk_is_set(p->flags, pcmk__xf_acl_denied);
	}
	return false;
	}

	void
	xml_acl_disable(xmlNode *xml)
	{
	if (xml_acl_enabled(xml)) {
	xml_private_t *p = xml->doc->_private;

	/* Catch anything that was created but shouldn't have been */
	pcmk__apply_acl(xml);
	pcmk__apply_creation_acl(xml, false);
	pcmk__clear_xml_flags(p, pcmk__xf_acl_enabled);
	}
	}

	/*!
	* \brief Check whether or not an XML node is ACL-enabled
	*
	* \param[in] xml node to check
	*
	* \return true if XML node exists and is ACL-enabled, false otherwise
	*/
	bool
	xml_acl_enabled(xmlNode *xml)
	{
	if (xml && xml->doc && xml->doc->_private){
	xml_private_t *p = xml->doc->_private;

	return pcmk_is_set(p->flags, pcmk__xf_acl_enabled);
	}
	return false;
	}

	bool
	pcmk__check_acl(xmlNode xml, const char name, enum xml_private_flags mode)
	{
	CRM_ASSERT(xml);
	CRM_ASSERT(xml->doc);
	CRM_ASSERT(xml->doc->_private);

	if (pcmk__tracking_xml_changes(xml, false) && xml_acl_enabled(xml)) {
	xmlNode *parent = xml;
	xml_private_t *docp = xml->doc->_private;
	GString *xpath = NULL;

	if (docp->acls == NULL) {
	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_denied);

	pcmk__log_else(LOG_TRACE, return false);
	xpath = pcmk__element_xpath(xml);
	if (name != NULL) {
	- g_string_append_printf(xpath, "[@%s]", name);
	+ pcmk__g_strcat(xpath, "[@", name, "]", NULL);
	}

	qb_log_from_external_source(__func__, __FILE__,
	"User '%s' without ACLs denied %s "
	"access to %s", LOG_TRACE, __LINE__, 0,
	docp->user, acl_to_text(mode),
	(const char *) xpath->str);
	g_string_free(xpath, TRUE);
	return false;
	}

	/* Walk the tree upwards looking for xml_acl_* flags
	* - Creating an attribute requires write permissions for the node
	* - Creating a child requires write permissions for the parent
	*/

	if (name) {
	xmlAttr *attr = xmlHasProp(xml, (pcmkXmlStr) name);

	if (attr && mode == pcmk__xf_acl_create) {
	mode = pcmk__xf_acl_write;
	}
	}

	while (parent && parent->_private) {
	xml_private_t *p = parent->_private;
	if (test_acl_mode(p->flags, mode)) {
	return true;

	} else if (pcmk_is_set(p->flags, pcmk__xf_acl_deny)) {
	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_denied);

	pcmk__log_else(LOG_TRACE, return false);
	xpath = pcmk__element_xpath(xml);
	if (name != NULL) {
	- g_string_append_printf(xpath, "[@%s]", name);
	+ pcmk__g_strcat(xpath, "[@", name, "]", NULL);
	}

	qb_log_from_external_source(__func__, __FILE__,
	"%sACL denies user '%s' %s access "
	"to %s", LOG_TRACE, __LINE__, 0,
	(parent != xml)? "Parent ": "",
	docp->user, acl_to_text(mode),
	(const char *) xpath->str);
	g_string_free(xpath, TRUE);
	return false;
	}
	parent = parent->parent;
	}

	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_denied);

	pcmk__log_else(LOG_TRACE, return false);
	xpath = pcmk__element_xpath(xml);
	if (name != NULL) {
	- g_string_append_printf(xpath, "[@%s]", name);
	+ pcmk__g_strcat(xpath, "[@", name, "]", NULL);
	}

	qb_log_from_external_source(__func__, __FILE__,
	"Default ACL denies user '%s' %s access to "
	"%s", LOG_TRACE, __LINE__, 0,
	docp->user, acl_to_text(mode),
	(const char *) xpath->str);
	g_string_free(xpath, TRUE);
	return false;
	}

	return true;
	}

	/*!
	* \brief Check whether ACLs are required for a given user
	*
	* \param[in] User name to check
	*
	* \return true if the user requires ACLs, false otherwise
	*/
	bool
	pcmk_acl_required(const char *user)
	{
	if (pcmk__str_empty(user)) {
	crm_trace("ACLs not required because no user set");
	return false;

	} else if (!strcmp(user, CRM_DAEMON_USER) \|\| !strcmp(user, "root")) {
	crm_trace("ACLs not required for privileged user %s", user);
	return false;
	}
	crm_trace("ACLs required for %s", user);
	return true;
	}

	char *
	pcmk__uid2username(uid_t uid)
	{
	struct passwd *pwent = getpwuid(uid);

	if (pwent == NULL) {
	crm_perror(LOG_INFO, "Cannot get user details for user ID %d", uid);
	return NULL;
	}
	return strdup(pwent->pw_name);
	}

	/*!
	* \internal
	* \brief Set the ACL user field properly on an XML request
	*
	* Multiple user names are potentially involved in an XML request: the effective
	* user of the current process; the user name known from an IPC client
	* connection; and the user name obtained from the request itself, whether by
	* the current standard XML attribute name or an older legacy attribute name.
	* This function chooses the appropriate one that should be used for ACLs, sets
	* it in the request (using the standard attribute name, and the legacy name if
	* given), and returns it.
	*
	* \param[in,out] request XML request to update
	* \param[in] field Alternate name for ACL user name XML attribute
	* \param[in] peer_user User name as known from IPC connection
	*
	* \return ACL user name actually used
	*/
	const char *
	pcmk__update_acl_user(xmlNode request, const char field,
	const char *peer_user)
	{
	static const char *effective_user = NULL;
	const char *requested_user = NULL;
	const char *user = NULL;

	if (effective_user == NULL) {
	effective_user = pcmk__uid2username(geteuid());
	if (effective_user == NULL) {
	effective_user = strdup("#unprivileged");
	CRM_CHECK(effective_user != NULL, return NULL);
	crm_err("Unable to determine effective user, assuming unprivileged for ACLs");
	}
	}

	requested_user = crm_element_value(request, XML_ACL_TAG_USER);
	if (requested_user == NULL) {
	/* @COMPAT rolling upgrades <=1.1.11
	*
	* field is checked for backward compatibility with older versions that
	* did not use XML_ACL_TAG_USER.
	*/
	requested_user = crm_element_value(request, field);
	}

	if (!pcmk__is_privileged(effective_user)) {
	/* We're not running as a privileged user, set or overwrite any existing
	* value for $XML_ACL_TAG_USER
	*/
	user = effective_user;

	} else if (peer_user == NULL && requested_user == NULL) {
	/* No user known or requested, use 'effective_user' and make sure one is
	* set for the request
	*/
	user = effective_user;

	} else if (peer_user == NULL) {
	/* No user known, trusting 'requested_user' */
	user = requested_user;

	} else if (!pcmk__is_privileged(peer_user)) {
	/* The peer is not a privileged user, set or overwrite any existing
	* value for $XML_ACL_TAG_USER
	*/
	user = peer_user;

	} else if (requested_user == NULL) {
	/* Even if we're privileged, make sure there is always a value set */
	user = peer_user;

	} else {
	/* Legal delegation to 'requested_user' */
	user = requested_user;
	}

	// This requires pointer comparison, not string comparison
	if (user != crm_element_value(request, XML_ACL_TAG_USER)) {
	crm_xml_add(request, XML_ACL_TAG_USER, user);
	}

	if (field != NULL && user != crm_element_value(request, field)) {
	crm_xml_add(request, field, user);
	}

	return requested_user;
	}
	diff --git a/lib/common/cmdline.c b/lib/common/cmdline.c
	index a7cde05245..3731f3bc40 100644
	--- a/lib/common/cmdline.c
	+++ b/lib/common/cmdline.c
	@@ -1,368 +1,368 @@
	/*
	* Copyright 2019-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <ctype.h>
	#include <glib.h>

	#include <crm/crm.h>
	#include <crm/common/cmdline_internal.h>
	#include <crm/common/strings_internal.h>
	#include <crm/common/util.h>

	static gboolean
	bump_verbosity(const gchar option_name, const gchar optarg, gpointer data, GError **error) {
	pcmk__common_args_t common_args = (pcmk__common_args_t ) data;
	common_args->verbosity++;
	return TRUE;
	}

	pcmk__common_args_t *
	pcmk__new_common_args(const char *summary)
	{
	pcmk__common_args_t *args = NULL;

	args = calloc(1, sizeof(pcmk__common_args_t));
	if (args == NULL) {
	crm_exit(CRM_EX_OSERR);
	}

	args->summary = strdup(summary);
	if (args->summary == NULL) {
	free(args);
	args = NULL;
	crm_exit(CRM_EX_OSERR);
	}

	return args;
	}

	static void
	free_common_args(gpointer data) {
	pcmk__common_args_t common_args = (pcmk__common_args_t ) data;

	free(common_args->summary);
	free(common_args->output_ty);
	free(common_args->output_dest);

	if (common_args->output_as_descr != NULL) {
	free(common_args->output_as_descr);
	}

	free(common_args);
	}

	GOptionContext *
	pcmk__build_arg_context(pcmk__common_args_t common_args, const char fmts,
	GOptionGroup *output_group, const char param_string) {
	char *desc = crm_strdup_printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
	GOptionContext *context;
	GOptionGroup *main_group;

	GOptionEntry main_entries[3] = {
	{ "version", '$', 0, G_OPTION_ARG_NONE, &(common_args->version),
	"Display software version and exit",
	NULL },
	{ "verbose", 'V', G_OPTION_FLAG_NO_ARG, G_OPTION_ARG_CALLBACK, bump_verbosity,
	"Increase debug output (may be specified multiple times)",
	NULL },

	{ NULL }
	};

	main_group = g_option_group_new(NULL, "Application Options:", NULL, common_args, free_common_args);
	g_option_group_add_entries(main_group, main_entries);

	context = g_option_context_new(param_string);
	g_option_context_set_summary(context, common_args->summary);
	g_option_context_set_description(context, desc);
	g_option_context_set_main_group(context, main_group);

	if (fmts != NULL) {
	GOptionEntry output_entries[3] = {
	{ "output-as", 0, 0, G_OPTION_ARG_STRING, &(common_args->output_ty),
	NULL,
	"FORMAT" },
	{ "output-to", 0, 0, G_OPTION_ARG_STRING, &(common_args->output_dest),
	"Specify file name for output (or \"-\" for stdout)", "DEST" },

	{ NULL }
	};

	if (*output_group == NULL) {
	*output_group = g_option_group_new("output", "Output Options:", "Show output help", NULL, NULL);
	}

	common_args->output_as_descr = crm_strdup_printf("Specify output format as one of: %s", fmts);
	output_entries[0].description = common_args->output_as_descr;
	g_option_group_add_entries(*output_group, output_entries);
	g_option_context_add_group(context, *output_group);
	}

	free(desc);

	// main_group is now owned by context, we don't free it here
	// cppcheck-suppress memleak
	return context;
	}

	void
	pcmk__free_arg_context(GOptionContext *context) {
	if (context == NULL) {
	return;
	}

	g_option_context_free(context);
	}

	void
	pcmk__add_main_args(GOptionContext *context, const GOptionEntry entries[])
	{
	GOptionGroup *main_group = g_option_context_get_main_group(context);

	g_option_group_add_entries(main_group, entries);
	}

	void
	pcmk__add_arg_group(GOptionContext context, const char name,
	const char header, const char desc,
	const GOptionEntry entries[])
	{
	GOptionGroup *group = NULL;

	group = g_option_group_new(name, header, desc, NULL, NULL);
	g_option_group_add_entries(group, entries);
	g_option_context_add_group(context, group);
	// group is now owned by context, we don't free it here
	// cppcheck-suppress memleak
	}

	static gchar *
	string_replace(gchar str, const gchar sub, const gchar *repl)
	{
	/* This function just replaces all occurrences of a substring
	* with some other string. It doesn't handle cases like overlapping,
	* so don't get clever with it.
	*
	* FIXME: When glib >= 2.68 is supported, we can get rid of this
	* function and use g_string_replace instead.
	*/
	gchar **split = g_strsplit(str, sub, 0);
	gchar *retval = g_strjoinv(repl, split);

	g_strfreev(split);
	return retval;
	}

	gchar *
	pcmk__quote_cmdline(gchar **argv)
	{
	GString *gs = NULL;

	if (argv == NULL \|\| argv[0] == NULL) {
	return NULL;
	}

	gs = g_string_sized_new(100);

	for (int i = 0; argv[i] != NULL; i++) {
	if (i > 0) {
	- g_string_append(gs, " ");
	+ g_string_append_c(gs, ' ');
	}

	if (strchr(argv[i], ' ') == NULL) {
	/* The arg does not contain a space. */
	- g_string_append_printf(gs, "%s", argv[i]);
	+ g_string_append(gs, argv[i]);
	} else if (strchr(argv[i], '\'') == NULL) {
	/* The arg contains a space, but not a single quote. */
	- g_string_append_printf(gs, "'%s'", argv[i]);
	+ pcmk__g_strcat(gs, "'", argv[i], "'", NULL);
	} else {
	/* The arg contains both a space and a single quote, which needs to
	* be replaced with an escaped version. We do this instead of counting
	* on libxml to handle the escaping for various reasons:
	*
	* (1) This keeps the string as valid shell.
	* (2) We don't want to use XML entities in formats besides XML and HTML.
	* (3) The string we are feeding to libxml is something like: "a b 'c d' e".
	* It won't escape the single quotes around 'c d' here because there is
	* no need to escape quotes inside a different form of quote. If we
	* change the string to "a b 'c'd' e", we haven't changed anything - it's
	* still single quotes inside double quotes.
	*
	* On the other hand, if we replace the single quote with "'", then
	* we have introduced an ampersand which libxml will escape. This leaves
	* us with "&apos;" which is not what we want.
	*
	* It's simplest to just escape with a backslash.
	*/
	gchar *repl = string_replace(argv[i], "'", "\\\'");
	- g_string_append_printf(gs, "'%s'", repl);
	+ pcmk__g_strcat(gs, "'", repl, "'", NULL);
	g_free(repl);
	}
	}

	return g_string_free(gs, FALSE);
	}

	gchar **
	pcmk__cmdline_preproc(char const argv, const char *special) {
	GPtrArray *arr = NULL;
	bool saw_dash_dash = false;
	bool copy_option = false;

	if (argv == NULL) {
	return NULL;
	}

	if (g_get_prgname() == NULL && argv && *argv) {
	gchar basename = g_path_get_basename(argv);

	g_set_prgname(basename);
	g_free(basename);
	}

	arr = g_ptr_array_new();

	for (int i = 0; argv[i] != NULL; i++) {
	/* If this is the first time we saw "--" in the command line, set
	* a flag so we know to just copy everything after it over. We also
	* want to copy the "--" over so whatever actually parses the command
	* line when we're done knows where arguments end.
	*/
	if (saw_dash_dash == false && strcmp(argv[i], "--") == 0) {
	saw_dash_dash = true;
	}

	if (saw_dash_dash == true) {
	g_ptr_array_add(arr, g_strdup(argv[i]));
	continue;
	}

	if (copy_option == true) {
	g_ptr_array_add(arr, g_strdup(argv[i]));
	copy_option = false;
	continue;
	}

	/* This is just a dash by itself. That could indicate stdin/stdout, or
	* it could be user error. Copy it over and let glib figure it out.
	*/
	if (pcmk__str_eq(argv[i], "-", pcmk__str_casei)) {
	g_ptr_array_add(arr, g_strdup(argv[i]));
	continue;
	}

	/* This is a short argument, or perhaps several. Iterate over it
	* and explode them out into individual arguments.
	*/
	if (g_str_has_prefix(argv[i], "-") && !g_str_has_prefix(argv[i], "--")) {
	/* Skip over leading dash */
	const char *ch = argv[i]+1;

	/* This looks like the start of a number, which means it is a negative
	* number. It's probably the argument to the preceeding option, but
	* we can't know that here. Copy it over and let whatever handles
	* arguments next figure it out.
	*/
	if (ch != '\0' && ch >= '1' && *ch <= '9') {
	bool is_numeric = true;

	while (*ch != '\0') {
	if (!isdigit(*ch)) {
	is_numeric = false;
	break;
	}

	ch++;
	}

	if (is_numeric) {
	g_ptr_array_add(arr, g_strdup_printf("%s", argv[i]));
	continue;
	} else {
	/* This argument wasn't entirely numeric. Reset ch to the
	* beginning so we can process it one character at a time.
	*/
	ch = argv[i]+1;
	}
	}

	while (*ch != '\0') {
	/* This is a special short argument that takes an option. getopt
	* allows values to be interspersed with a list of arguments, but
	* glib does not. Grab both the argument and its value and
	* separate them into a new argument.
	*/
	if (special != NULL && strchr(special, *ch) != NULL) {
	/* The argument does not occur at the end of this string of
	* arguments. Take everything through the end as its value.
	*/
	if (*(ch+1) != '\0') {
	g_ptr_array_add(arr, g_strdup_printf("-%c", *ch));
	g_ptr_array_add(arr, g_strdup(ch+1));
	break;

	/* The argument occurs at the end of this string. Hopefully
	* whatever comes next in argv is its value. It may not be,
	* but that is not for us to decide.
	*/
	} else {
	g_ptr_array_add(arr, g_strdup_printf("-%c", *ch));
	copy_option = true;
	ch++;
	}

	/* This is a regular short argument. Just copy it over. */
	} else {
	g_ptr_array_add(arr, g_strdup_printf("-%c", *ch));
	ch++;
	}
	}

	/* This is a long argument, or an option, or something else.
	* Copy it over - everything else is copied, so this keeps it easy for
	* the caller to know what to do with the memory when it's done.
	*/
	} else {
	g_ptr_array_add(arr, g_strdup(argv[i]));
	}
	}

	g_ptr_array_add(arr, NULL);

	return (char **) g_ptr_array_free(arr, FALSE);
	}

	G_GNUC_PRINTF(3, 4)
	gboolean
	pcmk__force_args(GOptionContext context, GError error, const char format, ...) {
	int len = 0;
	char *buf = NULL;
	gchar **extra_args = NULL;
	va_list ap;
	gboolean retval = TRUE;

	va_start(ap, format);
	len = vasprintf(&buf, format, ap);
	CRM_ASSERT(len > 0);
	va_end(ap);

	if (!g_shell_parse_argv(buf, NULL, &extra_args, error)) {
	g_strfreev(extra_args);
	free(buf);
	return FALSE;
	}

	retval = g_option_context_parse_strv(context, &extra_args, error);

	g_strfreev(extra_args);
	free(buf);
	return retval;
	}
	diff --git a/lib/common/options.c b/lib/common/options.c
	index 68f63f19a3..8daea1b65e 100644
	--- a/lib/common/options.c
	+++ b/lib/common/options.c
	@@ -1,718 +1,726 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#ifndef _GNU_SOURCE
	# define _GNU_SOURCE
	#endif

	#include <crm_internal.h>

	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>
	#include <sys/types.h>
	#include <sys/stat.h>

	#ifdef HAVE_GETOPT_H
	# include <getopt.h>
	#endif

	#include <crm/crm.h>


	/*
	* Command-line option handling
	*/

	static char *crm_short_options = NULL;
	static const pcmk__cli_option_t *crm_long_options = NULL;
	static const char *crm_app_description = NULL;
	static const char *crm_app_usage = NULL;

	void
	pcmk__cli_option_cleanup(void)
	{
	free(crm_short_options);
	crm_short_options = NULL;
	}

	static struct option *
	create_long_opts(const pcmk__cli_option_t *long_options)
	{
	struct option *long_opts = NULL;

	#ifdef HAVE_GETOPT_H
	int index = 0, lpc = 0;

	/*
	* A previous, possibly poor, choice of '?' as the short form of --help
	* means that getopt_long() returns '?' for both --help and for "unknown option"
	*
	* This dummy entry allows us to differentiate between the two in
	* pcmk__next_cli_option() and exit with the correct error code.
	*/
	long_opts = pcmk__realloc(long_opts, (index + 1) * sizeof(struct option));
	long_opts[index].name = "__dummmy__";
	long_opts[index].has_arg = 0;
	long_opts[index].flag = 0;
	long_opts[index].val = '_';
	index++;

	// cppcheck seems not to understand the abort-logic in pcmk__realloc
	// cppcheck-suppress memleak
	for (lpc = 0; long_options[lpc].name != NULL; lpc++) {
	if (long_options[lpc].name[0] == '-') {
	continue;
	}

	long_opts = pcmk__realloc(long_opts, (index + 1) * sizeof(struct option));
	/*fprintf(stderr, "Creating %d %s = %c\n", index,
	* long_options[lpc].name, long_options[lpc].val); */
	long_opts[index].name = long_options[lpc].name;
	long_opts[index].has_arg = long_options[lpc].has_arg;
	long_opts[index].flag = long_options[lpc].flag;
	long_opts[index].val = long_options[lpc].val;
	index++;
	}

	/* Now create the list terminator */
	long_opts = pcmk__realloc(long_opts, (index + 1) * sizeof(struct option));
	long_opts[index].name = NULL;
	long_opts[index].has_arg = 0;
	long_opts[index].flag = 0;
	long_opts[index].val = 0;
	#endif

	return long_opts;
	}

	/*!
	* \internal
	* \brief Define the command-line options a daemon or tool accepts
	*
	* \param[in] short_options getopt(3)-style short option list
	* \param[in] app_usage summary of how command is invoked (for help)
	* \param[in] long_options definition of options accepted
	* \param[in] app_desc brief command description (for help)
	*/
	void
	pcmk__set_cli_options(const char short_options, const char app_usage,
	const pcmk__cli_option_t *long_options,
	const char *app_desc)
	{
	if (short_options) {
	crm_short_options = strdup(short_options);

	} else if (long_options) {
	int lpc = 0;
	int opt_string_len = 0;
	char *local_short_options = NULL;

	for (lpc = 0; long_options[lpc].name != NULL; lpc++) {
	if (long_options[lpc].val && long_options[lpc].val != '-' && long_options[lpc].val < UCHAR_MAX) {
	local_short_options = pcmk__realloc(local_short_options,
	opt_string_len + 4);
	local_short_options[opt_string_len++] = long_options[lpc].val;
	/* getopt(3) says: Two colons mean an option takes an optional arg; */
	if (long_options[lpc].has_arg == optional_argument) {
	local_short_options[opt_string_len++] = ':';
	}
	if (long_options[lpc].has_arg >= required_argument) {
	local_short_options[opt_string_len++] = ':';
	}
	local_short_options[opt_string_len] = 0;
	}
	}
	crm_short_options = local_short_options;
	crm_trace("Generated short option string: '%s'", local_short_options);
	}

	if (long_options) {
	crm_long_options = long_options;
	}
	if (app_desc) {
	crm_app_description = app_desc;
	}
	if (app_usage) {
	crm_app_usage = app_usage;
	}
	}

	int
	pcmk__next_cli_option(int argc, char *argv, int index, const char **longname)
	{
	#ifdef HAVE_GETOPT_H
	static struct option *long_opts = NULL;

	if (long_opts == NULL && crm_long_options) {
	long_opts = create_long_opts(crm_long_options);
	}

	*index = 0;
	if (long_opts) {
	int flag = getopt_long(argc, argv, crm_short_options, long_opts, index);

	switch (flag) {
	case 0:
	if (long_opts[*index].val) {
	return long_opts[*index].val;
	} else if (longname) {
	longname = long_opts[index].name;
	} else {
	crm_notice("Unhandled option --%s", long_opts[*index].name);
	return flag;
	}
	case -1: /* End of option processing */
	break;
	case ':':
	crm_trace("Missing argument");
	pcmk__cli_help('?', CRM_EX_USAGE);
	break;
	case '?':
	pcmk__cli_help('?', (*index? CRM_EX_OK : CRM_EX_USAGE));
	break;
	}
	return flag;
	}
	#endif

	if (crm_short_options) {
	return getopt(argc, argv, crm_short_options);
	}

	return -1;
	}

	void
	pcmk__cli_help(char cmd, crm_exit_t exit_code)
	{
	int i = 0;
	FILE *stream = (exit_code ? stderr : stdout);

	if (cmd == 'v' \|\| cmd == '$') {
	fprintf(stream, "Pacemaker %s\n", PACEMAKER_VERSION);
	fprintf(stream, "Written by Andrew Beekhof and "
	"the Pacemaker project contributors\n");
	goto out;
	}

	if (cmd == '!') {
	fprintf(stream, "Pacemaker %s (Build: %s): %s\n", PACEMAKER_VERSION, BUILD_VERSION, CRM_FEATURES);
	goto out;
	}

	fprintf(stream, "%s - %s\n", crm_system_name, crm_app_description);

	if (crm_app_usage) {
	fprintf(stream, "Usage: %s %s\n", crm_system_name, crm_app_usage);
	}

	if (crm_long_options) {
	fprintf(stream, "Options:\n");
	for (i = 0; crm_long_options[i].name != NULL; i++) {
	if (crm_long_options[i].flags & pcmk__option_hidden) {

	} else if (crm_long_options[i].flags & pcmk__option_paragraph) {
	fprintf(stream, "%s\n\n", crm_long_options[i].desc);

	} else if (crm_long_options[i].flags & pcmk__option_example) {
	fprintf(stream, "\t#%s\n\n", crm_long_options[i].desc);

	} else if (crm_long_options[i].val == '-' && crm_long_options[i].desc) {
	fprintf(stream, "%s\n", crm_long_options[i].desc);

	} else {
	/* is val printable as char ? */
	if (crm_long_options[i].val && crm_long_options[i].val <= UCHAR_MAX) {
	fprintf(stream, " -%c,", crm_long_options[i].val);
	} else {
	fputs(" ", stream);
	}
	fprintf(stream, " --%s%s\t%s\n", crm_long_options[i].name,
	crm_long_options[i].has_arg == optional_argument ? "[=value]" :
	crm_long_options[i].has_arg == required_argument ? "=value" : "",
	crm_long_options[i].desc ? crm_long_options[i].desc : "");
	}
	}

	} else if (crm_short_options) {
	fprintf(stream, "Usage: %s - %s\n", crm_system_name, crm_app_description);
	for (i = 0; crm_short_options[i] != 0; i++) {
	int has_arg = no_argument /* 0 */;

	if (crm_short_options[i + 1] == ':') {
	if (crm_short_options[i + 2] == ':')
	has_arg = optional_argument /* 2 */;
	else
	has_arg = required_argument /* 1 */;
	}

	fprintf(stream, " -%c %s\n", crm_short_options[i],
	has_arg == optional_argument ? "[value]" :
	has_arg == required_argument ? "{value}" : "");
	i += has_arg;
	}
	}

	fprintf(stream, "\nReport bugs to %s\n", PACKAGE_BUGREPORT);

	out:
	crm_exit(exit_code);
	while(1); // above does not return
	}


	/*
	* Environment variable option handling
	*/

	/*!
	* \internal
	* \brief Get the value of a Pacemaker environment variable option
	*
	* If an environment variable option is set, with either a PCMK_ or (for
	* backward compatibility) HA_ prefix, log and return the value.
	*
	* \param[in] option Environment variable name (without prefix)
	*
	* \return Value of environment variable option, or NULL in case of
	* option name too long or value not found
	*/
	const char *
	pcmk__env_option(const char *option)
	{
	const char *const prefixes[] = {"PCMK_", "HA_"};
	char env_name[NAME_MAX];
	const char *value = NULL;

	CRM_CHECK(!pcmk__str_empty(option), return NULL);

	for (int i = 0; i < PCMK__NELEM(prefixes); i++) {
	int rv = snprintf(env_name, NAME_MAX, "%s%s", prefixes[i], option);

	if (rv < 0) {
	crm_err("Failed to write %s%s to buffer: %s", prefixes[i], option,
	strerror(errno));
	return NULL;
	}

	if (rv >= sizeof(env_name)) {
	crm_trace("\"%s%s\" is too long", prefixes[i], option);
	continue;
	}

	value = getenv(env_name);
	if (value != NULL) {
	crm_trace("Found %s = %s", env_name, value);
	return value;
	}
	}

	crm_trace("Nothing found for %s", option);
	return NULL;
	}

	/*!
	* \brief Set or unset a Pacemaker environment variable option
	*
	* Set an environment variable option with both a PCMK_ and (for
	* backward compatibility) HA_ prefix.
	*
	* \param[in] option Environment variable name (without prefix)
	* \param[in] value New value (or NULL to unset)
	*/
	void
	pcmk__set_env_option(const char option, const char value)
	{
	const char *const prefixes[] = {"PCMK_", "HA_"};
	char env_name[NAME_MAX];

	CRM_CHECK(!pcmk__str_empty(option) && (strchr(option, '=') == NULL),
	return);

	for (int i = 0; i < PCMK__NELEM(prefixes); i++) {
	int rv = snprintf(env_name, NAME_MAX, "%s%s", prefixes[i], option);

	if (rv < 0) {
	crm_err("Failed to write %s%s to buffer: %s", prefixes[i], option,
	strerror(errno));
	return;
	}

	if (rv >= sizeof(env_name)) {
	crm_trace("\"%s%s\" is too long", prefixes[i], option);
	continue;
	}

	if (value != NULL) {
	crm_trace("Setting %s to %s", env_name, value);
	rv = setenv(env_name, value, 1);
	} else {
	crm_trace("Unsetting %s", env_name);
	rv = unsetenv(env_name);
	}

	if (rv < 0) {
	crm_err("Failed to %sset %s: %s", (value != NULL)? "" : "un",
	env_name, strerror(errno));
	}
	}
	}

	/*!
	* \internal
	* \brief Check whether Pacemaker environment variable option is enabled
	*
	* Given a Pacemaker environment variable option that can either be boolean
	* or a list of daemon names, return true if the option is enabled for a given
	* daemon.
	*
	* \param[in] daemon Daemon name (can be NULL)
	* \param[in] option Pacemaker environment variable name
	*
	* \return true if variable is enabled for daemon, otherwise false
	*/
	bool
	pcmk__env_option_enabled(const char daemon, const char option)
	{
	const char *value = pcmk__env_option(option);

	return (value != NULL)
	&& (crm_is_true(value)
	\|\| ((daemon != NULL) && (strstr(value, daemon) != NULL)));
	}


	/*
	* Cluster option handling
	*/

	bool
	pcmk__valid_interval_spec(const char *value)
	{
	(void) crm_parse_interval_spec(value);
	return errno == 0;
	}

	bool
	pcmk__valid_boolean(const char *value)
	{
	int tmp;

	return crm_str_to_boolean(value, &tmp) == 1;
	}

	bool
	pcmk__valid_number(const char *value)
	{
	if (value == NULL) {
	return false;

	} else if (pcmk_str_is_minus_infinity(value) \|\|
	pcmk_str_is_infinity(value)) {
	return true;
	}

	return pcmk__scan_ll(value, NULL, 0LL) == pcmk_rc_ok;
	}

	bool
	pcmk__valid_positive_number(const char *value)
	{
	long long num = 0LL;

	return pcmk_str_is_infinity(value)
	\|\| ((pcmk__scan_ll(value, &num, 0LL) == pcmk_rc_ok) && (num > 0));
	}

	bool
	pcmk__valid_quorum(const char *value)
	{
	return pcmk__strcase_any_of(value, "stop", "freeze", "ignore", "demote", "suicide", NULL);
	}

	bool
	pcmk__valid_script(const char *value)
	{
	struct stat st;

	if (pcmk__str_eq(value, "/dev/null", pcmk__str_casei)) {
	return true;
	}

	if (stat(value, &st) != 0) {
	crm_err("Script %s does not exist", value);
	return false;
	}

	if (S_ISREG(st.st_mode) == 0) {
	crm_err("Script %s is not a regular file", value);
	return false;
	}

	if ((st.st_mode & (S_IXUSR \| S_IXGRP)) == 0) {
	crm_err("Script %s is not executable", value);
	return false;
	}

	return true;
	}

	bool
	pcmk__valid_percentage(const char *value)
	{
	char *end = NULL;
	long number = strtol(value, &end, 10);

	if (end && (end[0] != '%')) {
	return false;
	}
	return number >= 0;
	}

	/*!
	* \internal
	* \brief Check a table of configured options for a particular option
	*
	* \param[in,out] options Name/value pairs for configured options
	* \param[in] validate If not NULL, validator function for option value
	* \param[in] name Option name to look for
	* \param[in] old_name Alternative option name to look for
	* \param[in] def_value Default to use if option not configured
	*
	* \return Option value (from supplied options table or default value)
	*/
	static const char *
	cluster_option_value(GHashTable options, bool (validate)(const char *),
	const char name, const char old_name,
	const char *def_value)
	{
	const char *value = NULL;
	char *new_value = NULL;

	CRM_ASSERT(name != NULL);

	if (options) {
	value = g_hash_table_lookup(options, name);

	if ((value == NULL) && old_name) {
	value = g_hash_table_lookup(options, old_name);
	if (value != NULL) {
	pcmk__config_warn("Support for legacy name '%s' for cluster "
	"option '%s' is deprecated and will be "
	"removed in a future release",
	old_name, name);

	// Inserting copy with current name ensures we only warn once
	new_value = strdup(value);
	g_hash_table_insert(options, strdup(name), new_value);
	value = new_value;
	}
	}

	if (value && validate && (validate(value) == FALSE)) {
	pcmk__config_err("Using default value for cluster option '%s' "
	"because '%s' is invalid", name, value);
	value = NULL;
	}

	if (value) {
	return value;
	}
	}

	// No value found, use default
	value = def_value;

	if (value == NULL) {
	crm_trace("No value or default provided for cluster option '%s'",
	name);
	return NULL;
	}

	if (validate) {
	CRM_CHECK(validate(value) != FALSE,
	crm_err("Bug: default value for cluster option '%s' is invalid", name);
	return NULL);
	}

	crm_trace("Using default value '%s' for cluster option '%s'",
	value, name);
	if (options) {
	new_value = strdup(value);
	g_hash_table_insert(options, strdup(name), new_value);
	value = new_value;
	}
	return value;
	}

	/*!
	* \internal
	* \brief Get the value of a cluster option
	*
	* \param[in,out] options Name/value pairs for configured options
	* \param[in] option_list Possible cluster options
	* \param[in] name (Primary) option name to look for
	*
	* \return Option value
	*/
	const char *
	pcmk__cluster_option(GHashTable *options,
	const pcmk__cluster_option_t *option_list,
	int len, const char *name)
	{
	const char *value = NULL;

	for (int lpc = 0; lpc < len; lpc++) {
	if (pcmk__str_eq(name, option_list[lpc].name, pcmk__str_casei)) {
	value = cluster_option_value(options, option_list[lpc].is_valid,
	option_list[lpc].name,
	option_list[lpc].alt_name,
	option_list[lpc].default_value);
	return value;
	}
	}
	CRM_CHECK(FALSE, crm_err("Bug: looking for unknown option '%s'", name));
	return NULL;
	}

	/*!
	* \internal
	* \brief Add a description element to a meta-data string
	*
	* \param[in,out] s Meta-data string to add to
	* \param[in] tag Name of element to add ("longdesc" or "shortdesc")
	* \param[in] desc Textual description to add
	- * \param[in] values If not NULL, the allowed values for the parameter
	+ * \param[in] values If not \p NULL, the allowed values for the parameter
	+ * \param[in] spaces If not \p NULL, spaces to insert at the beginning of
	+ * each line
	*/
	static void
	add_desc(GString s, const char tag, const char desc, const char values,
	const char *spaces)
	{
	char *escaped_en = crm_xml_escape(desc);

	- g_string_append_printf(s, "<%s lang=\"en\">%s",
	- tag, escaped_en);
	+ if (spaces != NULL) {
	+ g_string_append(s, spaces);
	+ }
	+ pcmk__g_strcat(s, "<", tag, " lang=\"en\">", escaped_en, NULL);
	+
	if (values != NULL) {
	- g_string_append_printf(s, " Allowed values: %s", values);
	+ pcmk__g_strcat(s, " Allowed values: ", values, NULL);
	}
	- g_string_append_printf(s, "</%s>\n", tag);
	+ pcmk__g_strcat(s, "</", tag, ">\n", NULL);

	#ifdef ENABLE_NLS
	{
	static const char *locale = NULL;

	char *localized = crm_xml_escape(_(desc));

	if (strcmp(escaped_en, localized) != 0) {
	if (locale == NULL) {
	locale = strtok(setlocale(LC_ALL, NULL), "_");
	}

	- if (spaces != NULL) {
	- g_string_append_printf(s, "%s", spaces);
	+ if (spaces != NULL) {
	+ g_string_append(s, spaces);
	}
	- g_string_append_printf(s, "<%s lang=\"%s\">%s",
	- tag, locale, localized);
	+ pcmk__g_strcat(s, "<", tag, " lang=\"", locale, "\">", localized,
	+ NULL);
	+
	if (values != NULL) {
	- g_string_append(s, _(" Allowed values: "));
	- g_string_append_printf(s, "%s", _(values));
	+ pcmk__g_strcat(s, _(" Allowed values: "), _(values), NULL);
	}
	- g_string_append_printf(s, "</%s>\n", tag);
	+ pcmk__g_strcat(s, "</", tag, ">\n", NULL);
	}
	free(localized);
	}
	#endif

	free(escaped_en);
	}

	gchar *
	pcmk__format_option_metadata(const char name, const char desc_short,
	const char *desc_long,
	pcmk__cluster_option_t *option_list, int len)
	{
	/* big enough to hold "pacemaker-schedulerd metadata" output */
	GString *s = g_string_sized_new(13000);
	- int lpc = 0;

	- g_string_append_printf(s, "<?xml version=\"1.0\"?>"
	- "<resource-agent name=\"%s\">\n"
	- " <version>%s</version>\n",
	- name, PCMK_OCF_VERSION);
	+ pcmk__g_strcat(s,
	+ "<?xml version=\"1.0\"?>\n"
	+ "<resource-agent name=\"", name, "\" "
	+ "version=\"" PACEMAKER_VERSION "\">\n"
	+ " <version>" PCMK_OCF_VERSION "</version>\n", NULL);

	- g_string_append(s, " ");
	add_desc(s, "longdesc", desc_long, NULL, " ");
	-
	- g_string_append(s, " ");
	add_desc(s, "shortdesc", desc_short, NULL, " ");

	g_string_append(s, " <parameters>\n");

	- for (lpc = 0; lpc < len; lpc++) {
	- const char *long_desc = option_list[lpc].description_long;
	-
	- if (long_desc == NULL) {
	- long_desc = option_list[lpc].description_short;
	- if (long_desc == NULL) {
	- continue; // The standard requires a parameter description
	- }
	+ for (int lpc = 0; lpc < len; lpc++) {
	+ const char *opt_name = option_list[lpc].name;
	+ const char *opt_type = option_list[lpc].type;
	+ const char *opt_values = option_list[lpc].values;
	+ const char *opt_default = option_list[lpc].default_value;
	+ const char *opt_desc_short = option_list[lpc].description_short;
	+ const char *opt_desc_long = option_list[lpc].description_long;
	+
	+ // The standard requires long and short parameter descriptions
	+ CRM_ASSERT((opt_desc_short != NULL) \|\| (opt_desc_long != NULL));
	+
	+ if (opt_desc_short == NULL) {
	+ opt_desc_short = opt_desc_long;
	+ } else if (opt_desc_long == NULL) {
	+ opt_desc_long = opt_desc_short;
	}

	- g_string_append_printf(s, " <parameter name=\"%s\">\n",
	- option_list[lpc].name);
	+ // The standard requires a parameter type
	+ CRM_ASSERT(opt_type != NULL);

	- g_string_append(s, " ");
	- add_desc(s, "longdesc", long_desc, option_list[lpc].values, " ");
	+ pcmk__g_strcat(s, " <parameter name=\"", opt_name, "\">\n", NULL);

	- g_string_append(s, " ");
	- add_desc(s, "shortdesc", option_list[lpc].description_short, NULL, " ");
	+ add_desc(s, "longdesc", opt_desc_long, opt_values, " ");
	+ add_desc(s, "shortdesc", opt_desc_short, NULL, " ");

	- if (option_list[lpc].values && !strcmp(option_list[lpc].type, "select")) {
	- char *str = strdup(option_list[lpc].values);
	- char delim[] = ", ";
	+ pcmk__g_strcat(s, " <content type=\"", opt_type, "\"", NULL);
	+ if (opt_default != NULL) {
	+ pcmk__g_strcat(s, " default=\"", opt_default, "\"", NULL);
	+ }
	+
	+ if ((opt_values != NULL) && (strcmp(opt_type, "select") == 0)) {
	+ char *str = strdup(opt_values);
	+ const char *delim = ", ";
	char *ptr = strtok(str, delim);

	- g_string_append_printf(s, " <content type=\"%s\" default=\"%s\">\n",
	- option_list[lpc].type,
	- option_list[lpc].default_value);
	+ g_string_append(s, ">\n");

	while (ptr != NULL) {
	- g_string_append_printf(s, " <option value=\"%s\" />\n", ptr);
	+ pcmk__g_strcat(s, " <option value=\"", ptr, "\" />\n",
	+ NULL);
	ptr = strtok(NULL, delim);
	}
	-
	g_string_append_printf(s, " </content>\n");
	free(str);

	} else {
	- g_string_append_printf(s, " <content type=\"%s\" default=\"%s\"/>\n",
	- option_list[lpc].type,
	- option_list[lpc].default_value
	- );
	+ g_string_append(s, "/>\n");
	}

	- g_string_append_printf(s, " </parameter>\n");
	+ g_string_append(s, " </parameter>\n");
	}
	- g_string_append_printf(s, " </parameters>\n</resource-agent>\n");
	+ g_string_append(s, " </parameters>\n</resource-agent>\n");

	return g_string_free(s, FALSE);
	}

	void
	pcmk__validate_cluster_options(GHashTable *options,
	pcmk__cluster_option_t *option_list, int len)
	{
	for (int lpc = 0; lpc < len; lpc++) {
	cluster_option_value(options, option_list[lpc].is_valid,
	option_list[lpc].name,
	option_list[lpc].alt_name,
	option_list[lpc].default_value);
	}
	}
	diff --git a/lib/common/patchset.c b/lib/common/patchset.c
	index 535a7d4502..b0e245e4c7 100644
	--- a/lib/common/patchset.c
	+++ b/lib/common/patchset.c
	@@ -1,1733 +1,1732 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h>
	#include <sys/types.h>
	#include <unistd.h>
	#include <time.h>
	#include <string.h>
	#include <stdlib.h>
	#include <stdarg.h>
	#include <bzlib.h>

	#include <libxml/parser.h>
	#include <libxml/tree.h>
	#include <libxml/xmlIO.h> /* xmlAllocOutputBuffer */

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h> // CRM_XML_LOG_BASE, etc.
	#include "crmcommon_private.h"

	static xmlNode subtract_xml_comment(xmlNode parent, xmlNode *left,
	xmlNode right, gboolean changed);

	/*
	<diff format="2.0">
	<version>
	<source admin_epoch="1" epoch="2" num_updates="3"/>
	<target admin_epoch="1" epoch="3" num_updates="0"/>
	</version>
	<change operation="add" xpath="/cib/configuration/nodes">
	<node id="node2" uname="node2" description="foo"/>
	</change>
	<change operation="add" xpath="/cib/configuration/nodes/node[node2]">
	<instance_attributes id="nodes-node"><!-- NOTE: can be a full tree -->
	<nvpair id="nodes-node2-ram" name="ram" value="1024M"/>
	</instance_attributes>
	</change>
	<change operation="update" xpath="/cib/configuration/nodes[@id='node2']">
	<change-list>
	<change-attr operation="set" name="type" value="member"/>
	<change-attr operation="unset" name="description"/>
	</change-list>
	<change-result>
	<node id="node2" uname="node2" type="member"/><!-- NOTE: not recursive -->
	</change-result>
	</change>
	<change operation="delete" xpath="/cib/configuration/nodes/node[@id='node3'] /">
	<change operation="update" xpath="/cib/configuration/resources/group[@id='g1']">
	<change-list>
	<change-attr operation="set" name="description" value="some garbage here"/>
	</change-list>
	<change-result>
	<group id="g1" description="some garbage here"/><!-- NOTE: not recursive -->
	</change-result>
	</change>
	<change operation="update" xpath="/cib/status/node_state[@id='node2]/lrm[@id='node2']/lrm_resources/lrm_resource[@id='Fence']">
	<change-list>
	<change-attr operation="set" name="oper" value="member"/>
	<change-attr operation="set" name="operation_key" value="Fence_start_0"/>
	<change-attr operation="set" name="operation" value="start"/>
	<change-attr operation="set" name="transition-key" value="2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"/>
	<change-attr operation="set" name="transition-magic" value="0:0;2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"/>
	<change-attr operation="set" name="call-id" value="2"/>
	<change-attr operation="set" name="rc-code" value="0"/>
	</change-list>
	<change-result>
	<lrm_rsc_op id="Fence_last_0" operation_key="Fence_start_0" operation="start" crm-debug-origin="crm_simulate" transition-key="2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" transition-magic="0:0;2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" call-id="2" rc-code="0" op-status="0" interval="0" exec-time="0" queue-time="0" op-digest="f2317cad3d54cec5d7d7aa7d0bf35cf8"/>
	</change-result>
	</change>
	</diff>
	*/

	// Add changes for specified XML to patchset
	static void
	add_xml_changes_to_patchset(xmlNode xml, xmlNode patchset)
	{
	xmlNode *cIter = NULL;
	xmlAttr *pIter = NULL;
	xmlNode *change = NULL;
	xml_private_t *p = xml->_private;
	const char *value = NULL;

	// If this XML node is new, just report that
	if (patchset && pcmk_is_set(p->flags, pcmk__xf_created)) {
	GString *xpath = pcmk__element_xpath(xml->parent);

	if (xpath != NULL) {
	int position = pcmk__xml_position(xml, pcmk__xf_deleted);

	change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "create");
	crm_xml_add(change, XML_DIFF_PATH, (const char *) xpath->str);
	crm_xml_add_int(change, XML_DIFF_POSITION, position);
	add_node_copy(change, xml);
	g_string_free(xpath, TRUE);
	}

	return;
	}

	// Check each of the XML node's attributes for changes
	for (pIter = pcmk__xe_first_attr(xml); pIter != NULL;
	pIter = pIter->next) {
	xmlNode *attr = NULL;

	p = pIter->_private;
	if (!pcmk_any_flags_set(p->flags, pcmk__xf_deleted\|pcmk__xf_dirty)) {
	continue;
	}

	if (change == NULL) {
	GString *xpath = pcmk__element_xpath(xml);

	if (xpath != NULL) {
	change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "modify");
	crm_xml_add(change, XML_DIFF_PATH, (const char *) xpath->str);

	change = create_xml_node(change, XML_DIFF_LIST);
	g_string_free(xpath, TRUE);
	}
	}

	attr = create_xml_node(change, XML_DIFF_ATTR);

	crm_xml_add(attr, XML_NVPAIR_ATTR_NAME, (const char *)pIter->name);
	if (p->flags & pcmk__xf_deleted) {
	crm_xml_add(attr, XML_DIFF_OP, "unset");

	} else {
	crm_xml_add(attr, XML_DIFF_OP, "set");

	value = crm_element_value(xml, (const char *) pIter->name);
	crm_xml_add(attr, XML_NVPAIR_ATTR_VALUE, value);
	}
	}

	if (change) {
	xmlNode *result = NULL;

	change = create_xml_node(change->parent, XML_DIFF_RESULT);
	result = create_xml_node(change, (const char *)xml->name);

	for (pIter = pcmk__xe_first_attr(xml); pIter != NULL;
	pIter = pIter->next) {
	p = pIter->_private;
	if (!pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	value = crm_element_value(xml, (const char *) pIter->name);
	crm_xml_add(result, (const char *)pIter->name, value);
	}
	}
	}

	// Now recursively do the same for each child node of this node
	for (cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	add_xml_changes_to_patchset(cIter, patchset);
	}

	p = xml->_private;
	if (patchset && pcmk_is_set(p->flags, pcmk__xf_moved)) {
	GString *xpath = pcmk__element_xpath(xml);

	crm_trace("%s.%s moved to position %d",
	xml->name, ID(xml), pcmk__xml_position(xml, pcmk__xf_skip));

	if (xpath != NULL) {
	change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "move");
	crm_xml_add(change, XML_DIFF_PATH, (const char *) xpath->str);
	crm_xml_add_int(change, XML_DIFF_POSITION,
	pcmk__xml_position(xml, pcmk__xf_deleted));
	g_string_free(xpath, TRUE);
	}
	}
	}

	static bool
	is_config_change(xmlNode *xml)
	{
	GList *gIter = NULL;
	xml_private_t *p = NULL;
	xmlNode *config = first_named_child(xml, XML_CIB_TAG_CONFIGURATION);

	if (config) {
	p = config->_private;
	}
	if ((p != NULL) && pcmk_is_set(p->flags, pcmk__xf_dirty)) {
	return TRUE;
	}

	if ((xml->doc != NULL) && (xml->doc->_private != NULL)) {
	p = xml->doc->_private;
	for (gIter = p->deleted_objs; gIter; gIter = gIter->next) {
	pcmk__deleted_xml_t *deleted_obj = gIter->data;

	if (strstr(deleted_obj->path,
	"/" XML_TAG_CIB "/" XML_CIB_TAG_CONFIGURATION) != NULL) {
	return TRUE;
	}
	}
	}
	return FALSE;
	}

	static void
	xml_repair_v1_diff(xmlNode last, xmlNode next, xmlNode *local_diff,
	gboolean changed)
	{
	int lpc = 0;
	xmlNode *cib = NULL;
	xmlNode *diff_child = NULL;

	const char *tag = NULL;

	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};

	if (local_diff == NULL) {
	crm_trace("Nothing to do");
	return;
	}

	tag = "diff-removed";
	diff_child = find_xml_node(local_diff, tag, FALSE);
	if (diff_child == NULL) {
	diff_child = create_xml_node(local_diff, tag);
	}

	tag = XML_TAG_CIB;
	cib = find_xml_node(diff_child, tag, FALSE);
	if (cib == NULL) {
	cib = create_xml_node(diff_child, tag);
	}

	for (lpc = 0; (last != NULL) && (lpc < PCMK__NELEM(vfields)); lpc++) {
	const char *value = crm_element_value(last, vfields[lpc]);

	crm_xml_add(diff_child, vfields[lpc], value);
	if (changed \|\| lpc == 2) {
	crm_xml_add(cib, vfields[lpc], value);
	}
	}

	tag = "diff-added";
	diff_child = find_xml_node(local_diff, tag, FALSE);
	if (diff_child == NULL) {
	diff_child = create_xml_node(local_diff, tag);
	}

	tag = XML_TAG_CIB;
	cib = find_xml_node(diff_child, tag, FALSE);
	if (cib == NULL) {
	cib = create_xml_node(diff_child, tag);
	}

	for (lpc = 0; next && lpc < PCMK__NELEM(vfields); lpc++) {
	const char *value = crm_element_value(next, vfields[lpc]);

	crm_xml_add(diff_child, vfields[lpc], value);
	}

	for (xmlAttrPtr a = pcmk__xe_first_attr(next); a != NULL; a = a->next) {
	const char p_value = crm_element_value(next, (const char ) a->name);

	xmlSetProp(cib, a->name, (pcmkXmlStr) p_value);
	}

	crm_log_xml_explicit(local_diff, "Repaired-diff");
	}

	static xmlNode *
	xml_create_patchset_v1(xmlNode source, xmlNode target, bool config,
	bool suppress)
	{
	xmlNode *patchset = diff_xml_object(source, target, suppress);

	if (patchset) {
	CRM_LOG_ASSERT(xml_document_dirty(target));
	xml_repair_v1_diff(source, target, patchset, config);
	crm_xml_add(patchset, "format", "1");
	}
	return patchset;
	}

	static xmlNode *
	xml_create_patchset_v2(xmlNode source, xmlNode target)
	{
	int lpc = 0;
	GList *gIter = NULL;
	xml_private_t *doc = NULL;

	xmlNode *v = NULL;
	xmlNode *version = NULL;
	xmlNode *patchset = NULL;
	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};

	CRM_ASSERT(target);
	if (!xml_document_dirty(target)) {
	return NULL;
	}

	CRM_ASSERT(target->doc);
	doc = target->doc->_private;

	patchset = create_xml_node(NULL, XML_TAG_DIFF);
	crm_xml_add_int(patchset, "format", 2);

	version = create_xml_node(patchset, XML_DIFF_VERSION);

	v = create_xml_node(version, XML_DIFF_VSOURCE);
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	const char *value = crm_element_value(source, vfields[lpc]);

	if (value == NULL) {
	value = "1";
	}
	crm_xml_add(v, vfields[lpc], value);
	}

	v = create_xml_node(version, XML_DIFF_VTARGET);
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	const char *value = crm_element_value(target, vfields[lpc]);

	if (value == NULL) {
	value = "1";
	}
	crm_xml_add(v, vfields[lpc], value);
	}

	for (gIter = doc->deleted_objs; gIter; gIter = gIter->next) {
	pcmk__deleted_xml_t *deleted_obj = gIter->data;
	xmlNode *change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "delete");
	crm_xml_add(change, XML_DIFF_PATH, deleted_obj->path);
	if (deleted_obj->position >= 0) {
	crm_xml_add_int(change, XML_DIFF_POSITION, deleted_obj->position);
	}
	}

	add_xml_changes_to_patchset(target, patchset);
	return patchset;
	}

	xmlNode *
	xml_create_patchset(int format, xmlNode source, xmlNode target,
	bool *config_changed, bool manage_version)
	{
	int counter = 0;
	bool config = FALSE;
	xmlNode *patch = NULL;
	const char *version = crm_element_value(source, XML_ATTR_CRM_VERSION);

	xml_acl_disable(target);
	if (!xml_document_dirty(target)) {
	crm_trace("No change %d", format);
	return NULL; /* No change */
	}

	config = is_config_change(target);
	if (config_changed) {
	*config_changed = config;
	}

	if (manage_version && config) {
	crm_trace("Config changed %d", format);
	crm_xml_add(target, XML_ATTR_NUMUPDATES, "0");

	crm_element_value_int(target, XML_ATTR_GENERATION, &counter);
	crm_xml_add_int(target, XML_ATTR_GENERATION, counter+1);

	} else if (manage_version) {
	crm_element_value_int(target, XML_ATTR_NUMUPDATES, &counter);
	crm_trace("Status changed %d - %d %s", format, counter,
	crm_element_value(source, XML_ATTR_NUMUPDATES));
	crm_xml_add_int(target, XML_ATTR_NUMUPDATES, (counter + 1));
	}

	if (format == 0) {
	if (compare_version("3.0.8", version) < 0) {
	format = 2;
	} else {
	format = 1;
	}
	crm_trace("Using patch format %d for version: %s", format, version);
	}

	switch (format) {
	case 1:
	patch = xml_create_patchset_v1(source, target, config, FALSE);
	break;
	case 2:
	patch = xml_create_patchset_v2(source, target);
	break;
	default:
	crm_err("Unknown patch format: %d", format);
	return NULL;
	}
	return patch;
	}

	void
	patchset_process_digest(xmlNode patch, xmlNode source, xmlNode *target,
	bool with_digest)
	{
	int format = 1;
	const char *version = NULL;
	char *digest = NULL;

	if ((patch == NULL) \|\| (source == NULL) \|\| (target == NULL)) {
	return;
	}

	/* We should always call xml_accept_changes() before calculating a digest.
	* Otherwise, with an on-tracking dirty target, we could get a wrong digest.
	*/
	CRM_LOG_ASSERT(!xml_document_dirty(target));

	crm_element_value_int(patch, "format", &format);
	if ((format > 1) && !with_digest) {
	return;
	}

	version = crm_element_value(source, XML_ATTR_CRM_VERSION);
	digest = calculate_xml_versioned_digest(target, FALSE, TRUE, version);

	crm_xml_add(patch, XML_ATTR_DIGEST, digest);
	free(digest);

	return;
	}

	void
	xml_log_patchset(uint8_t log_level, const char function, xmlNode patchset)
	{
	int format = 1;
	xmlNode *child = NULL;
	xmlNode *added = NULL;
	xmlNode *removed = NULL;
	gboolean is_first = TRUE;

	int add[] = { 0, 0, 0 };
	int del[] = { 0, 0, 0 };

	const char *fmt = NULL;
	const char *digest = NULL;
	int options = xml_log_option_formatted;

	static struct qb_log_callsite *patchset_cs = NULL;

	if (log_level == LOG_NEVER) {
	return;
	}
	if (patchset_cs == NULL) {
	patchset_cs = qb_log_callsite_get(function, __FILE__, "xml-patchset",
	log_level, __LINE__, 0);
	}

	if (patchset == NULL) {
	crm_trace("Empty patch");
	return;

	} else if ((log_level != LOG_STDOUT)
	&& !crm_is_callsite_active(patchset_cs, log_level, 0)) {
	return;
	}

	xml_patch_versions(patchset, add, del);
	fmt = crm_element_value(patchset, "format");
	digest = crm_element_value(patchset, XML_ATTR_DIGEST);

	if ((add[2] != del[2]) \|\| (add[1] != del[1]) \|\| (add[0] != del[0])) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"Diff: --- %d.%d.%d %s", del[0], del[1], del[2], fmt);
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"Diff: +++ %d.%d.%d %s",
	add[0], add[1], add[2], digest);

	} else if ((patchset != NULL) && (add[0] \|\| add[1] \|\| add[2])) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"%s: Local-only Change: %d.%d.%d",
	(function? function : ""), add[0], add[1], add[2]);
	}

	crm_element_value_int(patchset, "format", &format);
	if (format == 2) {
	xmlNode *change = NULL;

	for (change = pcmk__xml_first_child(patchset); change != NULL;
	change = pcmk__xml_next(change)) {
	const char *op = crm_element_value(change, XML_DIFF_OP);
	const char *xpath = crm_element_value(change, XML_DIFF_PATH);

	if (op == NULL) {
	} else if (strcmp(op, "create") == 0) {
	int lpc = 0, max = 0;
	char *prefix = crm_strdup_printf("++ %s: ", xpath);

	max = strlen(prefix);
	pcmk__xml_log(log_level, __FILE__, function, __LINE__, prefix,
	change->children, 0,
	xml_log_option_formatted\|xml_log_option_open);

	for (lpc = 2; lpc < max; lpc++) {
	prefix[lpc] = ' ';
	}

	pcmk__xml_log(log_level, __FILE__, function, __LINE__, prefix,
	change->children, 0,
	xml_log_option_formatted\|xml_log_option_close
	\|xml_log_option_children);
	free(prefix);

	} else if (strcmp(op, "move") == 0) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"+~ %s moved to offset %s", xpath,
	crm_element_value(change, XML_DIFF_POSITION));

	} else if (strcmp(op, "modify") == 0) {
	xmlNode *clist = first_named_child(change, XML_DIFF_LIST);
	- GString *buffer_set = g_string_sized_new(256);
	- GString *buffer_unset = g_string_sized_new(256);
	+ GString *buffer_set = NULL;
	+ GString *buffer_unset = NULL;

	for (child = pcmk__xml_first_child(clist); child != NULL;
	child = pcmk__xml_next(child)) {
	const char *name = crm_element_value(child, "name");

	op = crm_element_value(child, XML_DIFF_OP);
	if (op == NULL) {
	- } else if (strcmp(op, "set") == 0) {
	+ continue;
	+ }
	+
	+ if (strcmp(op, "set") == 0) {
	const char *value = crm_element_value(child, "value");

	- if (buffer_set->len > 0) {
	- g_string_append(buffer_set, ", ");
	- }
	- g_string_append_printf(buffer_set, "@%s=%s", name, value);
	+ pcmk__add_separated_word(&buffer_set, 256, "@", ", ");
	+ pcmk__g_strcat(buffer_set, name, "=", value, NULL);

	} else if (strcmp(op, "unset") == 0) {
	- if (buffer_unset->len > 0) {
	- g_string_append(buffer_unset, ", ");
	- }
	- g_string_append_printf(buffer_unset, "@%s", name);
	+ pcmk__add_separated_word(&buffer_unset, 256, "@", ", ");
	+ g_string_append(buffer_unset, name);
	}
	}

	- if (buffer_set->len > 0) {
	+ if (buffer_set != NULL) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"+ %s: %s", xpath,
	(const char *) buffer_set->str);
	+ g_string_free(buffer_set, TRUE);
	}
	- if (buffer_unset->len > 0) {
	+ if (buffer_unset != NULL) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"-- %s: %s", xpath,
	(const char *) buffer_unset->str);
	+ g_string_free(buffer_unset, TRUE);
	}
	- g_string_free(buffer_set, TRUE);
	- g_string_free(buffer_unset, TRUE);

	} else if (strcmp(op, "delete") == 0) {
	int position = -1;

	crm_element_value_int(change, XML_DIFF_POSITION, &position);
	if (position >= 0) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"-- %s (%d)", xpath, position);

	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"-- %s", xpath);
	}
	}
	}
	return;
	}

	if ((log_level < LOG_DEBUG) \|\| (function == NULL)) {
	options \|= xml_log_option_diff_short;
	}

	removed = find_xml_node(patchset, "diff-removed", FALSE);
	for (child = pcmk__xml_first_child(removed); child != NULL;
	child = pcmk__xml_next(child)) {
	log_data_element(log_level, __FILE__, function, __LINE__, "- ", child,
	0, options\|xml_log_option_diff_minus);
	if (is_first) {
	is_first = FALSE;
	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, " --- ");
	}
	}

	is_first = TRUE;
	added = find_xml_node(patchset, "diff-added", FALSE);
	for (child = pcmk__xml_first_child(added); child != NULL;
	child = pcmk__xml_next(child)) {
	log_data_element(log_level, __FILE__, function, __LINE__, "+ ", child,
	0, options\|xml_log_option_diff_plus);
	if (is_first) {
	is_first = FALSE;
	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, " +++ ");
	}
	}
	}

	// Return true if attribute name is not "id"
	static bool
	not_id(xmlAttrPtr attr, void *user_data)
	{
	return strcmp((const char *) attr->name, XML_ATTR_ID) != 0;
	}

	// Apply the removals section of an v1 patchset to an XML node
	static void
	process_v1_removals(xmlNode target, xmlNode patch)
	{
	xmlNode *patch_child = NULL;
	xmlNode *cIter = NULL;

	char *id = NULL;
	const char *name = NULL;
	const char *value = NULL;

	if ((target == NULL) \|\| (patch == NULL)) {
	return;
	}

	if (target->type == XML_COMMENT_NODE) {
	gboolean dummy;

	subtract_xml_comment(target->parent, target, patch, &dummy);
	}

	name = crm_element_name(target);
	CRM_CHECK(name != NULL, return);
	CRM_CHECK(pcmk__str_eq(crm_element_name(target), crm_element_name(patch),
	pcmk__str_casei),
	return);
	CRM_CHECK(pcmk__str_eq(ID(target), ID(patch), pcmk__str_casei), return);

	// Check for XML_DIFF_MARKER in a child
	id = crm_element_value_copy(target, XML_ATTR_ID);
	value = crm_element_value(patch, XML_DIFF_MARKER);
	if ((value != NULL) && (strcmp(value, "removed:top") == 0)) {
	crm_trace("We are the root of the deletion: %s.id=%s", name, id);
	free_xml(target);
	free(id);
	return;
	}

	// Removing then restoring id would change ordering of properties
	pcmk__xe_remove_matching_attrs(patch, not_id, NULL);

	// Changes to child objects
	cIter = pcmk__xml_first_child(target);
	while (cIter) {
	xmlNode *target_child = cIter;

	cIter = pcmk__xml_next(cIter);
	patch_child = pcmk__xml_match(patch, target_child, false);
	process_v1_removals(target_child, patch_child);
	}
	free(id);
	}

	// Apply the additions section of an v1 patchset to an XML node
	static void
	process_v1_additions(xmlNode parent, xmlNode target, xmlNode *patch)
	{
	xmlNode *patch_child = NULL;
	xmlNode *target_child = NULL;
	xmlAttrPtr xIter = NULL;

	const char *id = NULL;
	const char *name = NULL;
	const char *value = NULL;

	if (patch == NULL) {
	return;
	} else if ((parent == NULL) && (target == NULL)) {
	return;
	}

	// Check for XML_DIFF_MARKER in a child
	value = crm_element_value(patch, XML_DIFF_MARKER);
	if ((target == NULL) && (value != NULL)
	&& (strcmp(value, "added:top") == 0)) {
	id = ID(patch);
	name = crm_element_name(patch);
	crm_trace("We are the root of the addition: %s.id=%s", name, id);
	add_node_copy(parent, patch);
	return;

	} else if (target == NULL) {
	id = ID(patch);
	name = crm_element_name(patch);
	crm_err("Could not locate: %s.id=%s", name, id);
	return;
	}

	if (target->type == XML_COMMENT_NODE) {
	pcmk__xc_update(parent, target, patch);
	}

	name = crm_element_name(target);
	CRM_CHECK(name != NULL, return);
	CRM_CHECK(pcmk__str_eq(crm_element_name(target), crm_element_name(patch),
	pcmk__str_casei),
	return);
	CRM_CHECK(pcmk__str_eq(ID(target), ID(patch), pcmk__str_casei), return);

	for (xIter = pcmk__xe_first_attr(patch); xIter != NULL;
	xIter = xIter->next) {
	const char p_name = (const char ) xIter->name;
	const char *p_value = crm_element_value(patch, p_name);

	xml_remove_prop(target, p_name); // Preserve patch order
	crm_xml_add(target, p_name, p_value);
	}

	// Changes to child objects
	for (patch_child = pcmk__xml_first_child(patch); patch_child != NULL;
	patch_child = pcmk__xml_next(patch_child)) {

	target_child = pcmk__xml_match(target, patch_child, false);
	process_v1_additions(target, target_child, patch_child);
	}
	}

	/*!
	* \internal
	* \brief Find additions or removals in a patch set
	*
	* \param[in] patchset XML of patch
	* \param[in] format Patch version
	* \param[in] added TRUE if looking for additions, FALSE if removals
	* \param[in,out] patch_node Will be set to node if found
	*
	* \return TRUE if format is valid, FALSE if invalid
	*/
	static bool
	find_patch_xml_node(const xmlNode *patchset, int format, bool added,
	xmlNode **patch_node)
	{
	xmlNode *cib_node;
	const char *label;

	switch (format) {
	case 1:
	label = added? "diff-added" : "diff-removed";
	*patch_node = find_xml_node(patchset, label, FALSE);
	cib_node = find_xml_node(*patch_node, "cib", FALSE);
	if (cib_node != NULL) {
	*patch_node = cib_node;
	}
	break;
	case 2:
	label = added? "target" : "source";
	*patch_node = find_xml_node(patchset, "version", FALSE);
	patch_node = find_xml_node(patch_node, label, FALSE);
	break;
	default:
	crm_warn("Unknown patch format: %d", format);
	*patch_node = NULL;
	return FALSE;
	}
	return TRUE;
	}

	// Get CIB versions used for additions and deletions in a patchset
	bool
	xml_patch_versions(const xmlNode *patchset, int add[3], int del[3])
	{
	int lpc = 0;
	int format = 1;
	xmlNode *tmp = NULL;

	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};


	crm_element_value_int(patchset, "format", &format);

	/* Process removals */
	if (!find_patch_xml_node(patchset, format, FALSE, &tmp)) {
	return -EINVAL;
	}
	if (tmp != NULL) {
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	crm_element_value_int(tmp, vfields[lpc], &(del[lpc]));
	crm_trace("Got %d for del[%s]", del[lpc], vfields[lpc]);
	}
	}

	/* Process additions */
	if (!find_patch_xml_node(patchset, format, TRUE, &tmp)) {
	return -EINVAL;
	}
	if (tmp != NULL) {
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	crm_element_value_int(tmp, vfields[lpc], &(add[lpc]));
	crm_trace("Got %d for add[%s]", add[lpc], vfields[lpc]);
	}
	}
	return pcmk_ok;
	}

	/*!
	* \internal
	* \brief Check whether patchset can be applied to current CIB
	*
	* \param[in] xml Root of current CIB
	* \param[in] patchset Patchset to check
	* \param[in] format Patchset version
	*
	* \return Standard Pacemaker return code
	*/
	static int
	xml_patch_version_check(const xmlNode xml, const xmlNode patchset, int format)
	{
	int lpc = 0;
	bool changed = FALSE;

	int this[] = { 0, 0, 0 };
	int add[] = { 0, 0, 0 };
	int del[] = { 0, 0, 0 };

	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};

	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	crm_element_value_int(xml, vfields[lpc], &(this[lpc]));
	crm_trace("Got %d for this[%s]", this[lpc], vfields[lpc]);
	if (this[lpc] < 0) {
	this[lpc] = 0;
	}
	}

	/* Set some defaults in case nothing is present */
	add[0] = this[0];
	add[1] = this[1];
	add[2] = this[2] + 1;
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	del[lpc] = this[lpc];
	}

	xml_patch_versions(patchset, add, del);

	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	if (this[lpc] < del[lpc]) {
	crm_debug("Current %s is too low (%d.%d.%d < %d.%d.%d --> %d.%d.%d)",
	vfields[lpc], this[0], this[1], this[2],
	del[0], del[1], del[2], add[0], add[1], add[2]);
	return pcmk_rc_diff_resync;

	} else if (this[lpc] > del[lpc]) {
	crm_info("Current %s is too high (%d.%d.%d > %d.%d.%d --> %d.%d.%d) %p",
	vfields[lpc], this[0], this[1], this[2],
	del[0], del[1], del[2], add[0], add[1], add[2], patchset);
	crm_log_xml_info(patchset, "OldPatch");
	return pcmk_rc_old_data;
	}
	}

	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	if (add[lpc] > del[lpc]) {
	changed = TRUE;
	}
	}

	if (!changed) {
	crm_notice("Versions did not change in patch %d.%d.%d",
	add[0], add[1], add[2]);
	return pcmk_rc_old_data;
	}

	crm_debug("Can apply patch %d.%d.%d to %d.%d.%d",
	add[0], add[1], add[2], this[0], this[1], this[2]);
	return pcmk_rc_ok;
	}

	/*!
	* \internal
	* \brief Apply a version 1 patchset to an XML node
	*
	* \param[in,out] xml XML to apply patchset to
	* \param[in] patchset Patchset to apply
	*
	* \return Standard Pacemaker return code
	*/
	static int
	apply_v1_patchset(xmlNode xml, const xmlNode patchset)
	{
	int rc = pcmk_rc_ok;
	int root_nodes_seen = 0;

	xmlNode *child_diff = NULL;
	xmlNode *added = find_xml_node(patchset, "diff-added", FALSE);
	xmlNode *removed = find_xml_node(patchset, "diff-removed", FALSE);
	xmlNode *old = copy_xml(xml);

	crm_trace("Subtraction Phase");
	for (child_diff = pcmk__xml_first_child(removed); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, rc = FALSE);
	if (root_nodes_seen == 0) {
	process_v1_removals(xml, child_diff);
	}
	root_nodes_seen++;
	}

	if (root_nodes_seen > 1) {
	crm_err("(-) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	rc = ENOTUNIQ;
	}

	root_nodes_seen = 0;
	crm_trace("Addition Phase");
	if (rc == pcmk_rc_ok) {
	xmlNode *child_diff = NULL;

	for (child_diff = pcmk__xml_first_child(added); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, rc = FALSE);
	if (root_nodes_seen == 0) {
	process_v1_additions(NULL, xml, child_diff);
	}
	root_nodes_seen++;
	}
	}

	if (root_nodes_seen > 1) {
	crm_err("(+) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	rc = ENOTUNIQ;
	}

	purge_diff_markers(xml); // Purge prior to checking digest

	free_xml(old);
	return rc;
	}

	// Return first child matching element name and optionally id or position
	static xmlNode *
	first_matching_xml_child(const xmlNode parent, const char name,
	const char *id, int position)
	{
	xmlNode *cIter = NULL;

	for (cIter = pcmk__xml_first_child(parent); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	if (strcmp((const char *) cIter->name, name) != 0) {
	continue;
	} else if (id) {
	const char *cid = ID(cIter);

	if ((cid == NULL) \|\| (strcmp(cid, id) != 0)) {
	continue;
	}
	}

	// "position" makes sense only for XML comments for now
	if ((cIter->type == XML_COMMENT_NODE)
	&& (position >= 0)
	&& (pcmk__xml_position(cIter, pcmk__xf_skip) != position)) {
	continue;
	}

	return cIter;
	}
	return NULL;
	}

	/*!
	* \internal
	* \brief Simplified, more efficient alternative to get_xpath_object()
	*
	* \param[in] top Root of XML to search
	* \param[in] key Search xpath
	* \param[in] target_position If deleting, where to delete
	*
	* \return XML child matching xpath if found, NULL otherwise
	*
	* \note This only works on simplified xpaths found in v2 patchset diffs,
	* i.e. the only allowed search predicate is [@id='XXX'].
	*/
	static xmlNode *
	search_v2_xpath(const xmlNode top, const char key, int target_position)
	{
	xmlNode target = (xmlNode ) top->doc;
	const char *current = key;
	char *section;
	char *remainder;
	char *id;
	char *tag;
	char *path = NULL;
	int rc;
	size_t key_len;

	CRM_CHECK(key != NULL, return NULL);
	key_len = strlen(key);

	/* These are scanned from key after a slash, so they can't be bigger
	* than key_len - 1 characters plus a null terminator.
	*/

	remainder = calloc(key_len, sizeof(char));
	CRM_ASSERT(remainder != NULL);

	section = calloc(key_len, sizeof(char));
	CRM_ASSERT(section != NULL);

	id = calloc(key_len, sizeof(char));
	CRM_ASSERT(id != NULL);

	tag = calloc(key_len, sizeof(char));
	CRM_ASSERT(tag != NULL);

	do {
	// Look for /NEXT_COMPONENT/REMAINING_COMPONENTS
	rc = sscanf(current, "/%[^/]%s", section, remainder);
	if (rc > 0) {
	// Separate FIRST_COMPONENT into TAG[@id='ID']
	int f = sscanf(section, "%[^[][@id='%[^']", tag, id);
	int current_position = -1;

	/* The target position is for the final component tag, so only use
	* it if there is nothing left to search after this component.
	*/
	if ((rc == 1) && (target_position >= 0)) {
	current_position = target_position;
	}

	switch (f) {
	case 1:
	target = first_matching_xml_child(target, tag, NULL,
	current_position);
	break;
	case 2:
	target = first_matching_xml_child(target, tag, id,
	current_position);
	break;
	default:
	// This should not be possible
	target = NULL;
	break;
	}
	current = remainder;
	}

	// Continue if something remains to search, and we've matched so far
	} while ((rc == 2) && target);

	if (target) {
	crm_trace("Found %s for %s",
	(path = (char *) xmlGetNodePath(target)), key);
	free(path);
	} else {
	crm_debug("No match for %s", key);
	}

	free(remainder);
	free(section);
	free(tag);
	free(id);
	return target;
	}

	typedef struct xml_change_obj_s {
	const xmlNode *change;
	xmlNode *match;
	} xml_change_obj_t;

	static gint
	sort_change_obj_by_position(gconstpointer a, gconstpointer b)
	{
	const xml_change_obj_t *change_obj_a = a;
	const xml_change_obj_t *change_obj_b = b;
	int position_a = -1;
	int position_b = -1;

	crm_element_value_int(change_obj_a->change, XML_DIFF_POSITION, &position_a);
	crm_element_value_int(change_obj_b->change, XML_DIFF_POSITION, &position_b);

	if (position_a < position_b) {
	return -1;

	} else if (position_a > position_b) {
	return 1;
	}

	return 0;
	}

	/*!
	* \internal
	* \brief Apply a version 2 patchset to an XML node
	*
	* \param[in,out] xml XML to apply patchset to
	* \param[in] patchset Patchset to apply
	*
	* \return Standard Pacemaker return code
	*/
	static int
	apply_v2_patchset(xmlNode xml, const xmlNode patchset)
	{
	int rc = pcmk_rc_ok;
	const xmlNode *change = NULL;
	GList *change_objs = NULL;
	GList *gIter = NULL;

	for (change = pcmk__xml_first_child(patchset); change != NULL;
	change = pcmk__xml_next(change)) {
	xmlNode *match = NULL;
	const char *op = crm_element_value(change, XML_DIFF_OP);
	const char *xpath = crm_element_value(change, XML_DIFF_PATH);
	int position = -1;

	if (op == NULL) {
	continue;
	}

	crm_trace("Processing %s %s", change->name, op);

	// "delete" changes for XML comments are generated with "position"
	if (strcmp(op, "delete") == 0) {
	crm_element_value_int(change, XML_DIFF_POSITION, &position);
	}
	match = search_v2_xpath(xml, xpath, position);
	crm_trace("Performing %s on %s with %p", op, xpath, match);

	if ((match == NULL) && (strcmp(op, "delete") == 0)) {
	crm_debug("No %s match for %s in %p", op, xpath, xml->doc);
	continue;

	} else if (match == NULL) {
	crm_err("No %s match for %s in %p", op, xpath, xml->doc);
	rc = pcmk_rc_diff_failed;
	continue;

	} else if ((strcmp(op, "create") == 0) \|\| (strcmp(op, "move") == 0)) {
	// Delay the adding of a "create" object
	xml_change_obj_t *change_obj = calloc(1, sizeof(xml_change_obj_t));

	CRM_ASSERT(change_obj != NULL);

	change_obj->change = change;
	change_obj->match = match;

	change_objs = g_list_append(change_objs, change_obj);

	if (strcmp(op, "move") == 0) {
	// Temporarily put the "move" object after the last sibling
	if ((match->parent != NULL) && (match->parent->last != NULL)) {
	xmlAddNextSibling(match->parent->last, match);
	}
	}

	} else if (strcmp(op, "delete") == 0) {
	free_xml(match);

	} else if (strcmp(op, "modify") == 0) {
	xmlNode *attrs = NULL;

	attrs = pcmk__xml_first_child(first_named_child(change,
	XML_DIFF_RESULT));
	if (attrs == NULL) {
	rc = ENOMSG;
	continue;
	}
	pcmk__xe_remove_matching_attrs(match, NULL, NULL); // Remove all

	for (xmlAttrPtr pIter = pcmk__xe_first_attr(attrs); pIter != NULL;
	pIter = pIter->next) {
	const char name = (const char ) pIter->name;
	const char *value = crm_element_value(attrs, name);

	crm_xml_add(match, name, value);
	}

	} else {
	crm_err("Unknown operation: %s", op);
	rc = pcmk_rc_diff_failed;
	}
	}

	// Changes should be generated in the right order. Double checking.
	change_objs = g_list_sort(change_objs, sort_change_obj_by_position);

	for (gIter = change_objs; gIter; gIter = gIter->next) {
	xml_change_obj_t *change_obj = gIter->data;
	xmlNode *match = change_obj->match;
	const char *op = NULL;
	const char *xpath = NULL;

	change = change_obj->change;

	op = crm_element_value(change, XML_DIFF_OP);
	xpath = crm_element_value(change, XML_DIFF_PATH);

	crm_trace("Continue performing %s on %s with %p", op, xpath, match);

	if (strcmp(op, "create") == 0) {
	int position = 0;
	xmlNode *child = NULL;
	xmlNode *match_child = NULL;

	match_child = match->children;
	crm_element_value_int(change, XML_DIFF_POSITION, &position);

	while ((match_child != NULL)
	&& (position != pcmk__xml_position(match_child, pcmk__xf_skip))) {
	match_child = match_child->next;
	}

	child = xmlDocCopyNode(change->children, match->doc, 1);
	if (match_child) {
	crm_trace("Adding %s at position %d", child->name, position);
	xmlAddPrevSibling(match_child, child);

	} else if (match->last) {
	crm_trace("Adding %s at position %d (end)",
	child->name, position);
	xmlAddNextSibling(match->last, child);

	} else {
	crm_trace("Adding %s at position %d (first)",
	child->name, position);
	CRM_LOG_ASSERT(position == 0);
	xmlAddChild(match, child);
	}
	pcmk__mark_xml_created(child);

	} else if (strcmp(op, "move") == 0) {
	int position = 0;

	crm_element_value_int(change, XML_DIFF_POSITION, &position);
	if (position != pcmk__xml_position(match, pcmk__xf_skip)) {
	xmlNode *match_child = NULL;
	int p = position;

	if (p > pcmk__xml_position(match, pcmk__xf_skip)) {
	p++; // Skip ourselves
	}

	CRM_ASSERT(match->parent != NULL);
	match_child = match->parent->children;

	while ((match_child != NULL)
	&& (p != pcmk__xml_position(match_child, pcmk__xf_skip))) {
	match_child = match_child->next;
	}

	crm_trace("Moving %s to position %d (was %d, prev %p, %s %p)",
	match->name, position,
	pcmk__xml_position(match, pcmk__xf_skip),
	match->prev, (match_child? "next":"last"),
	(match_child? match_child : match->parent->last));

	if (match_child) {
	xmlAddPrevSibling(match_child, match);

	} else {
	CRM_ASSERT(match->parent->last != NULL);
	xmlAddNextSibling(match->parent->last, match);
	}

	} else {
	crm_trace("%s is already in position %d",
	match->name, position);
	}

	if (position != pcmk__xml_position(match, pcmk__xf_skip)) {
	crm_err("Moved %s.%s to position %d instead of %d (%p)",
	match->name, ID(match),
	pcmk__xml_position(match, pcmk__xf_skip),
	position, match->prev);
	rc = pcmk_rc_diff_failed;
	}
	}
	}

	g_list_free_full(change_objs, free);
	return rc;
	}

	int
	xml_apply_patchset(xmlNode xml, xmlNode patchset, bool check_version)
	{
	int format = 1;
	int rc = pcmk_ok;
	xmlNode *old = NULL;
	const char *digest = crm_element_value(patchset, XML_ATTR_DIGEST);

	if (patchset == NULL) {
	return rc;
	}

	xml_log_patchset(LOG_TRACE, __func__, patchset);

	crm_element_value_int(patchset, "format", &format);
	if (check_version) {
	rc = pcmk_rc2legacy(xml_patch_version_check(xml, patchset, format));
	if (rc != pcmk_ok) {
	return rc;
	}
	}

	if (digest) {
	// Make it available for logging if result doesn't have expected digest
	old = copy_xml(xml);
	}

	if (rc == pcmk_ok) {
	switch (format) {
	case 1:
	rc = pcmk_rc2legacy(apply_v1_patchset(xml, patchset));
	break;
	case 2:
	rc = pcmk_rc2legacy(apply_v2_patchset(xml, patchset));
	break;
	default:
	crm_err("Unknown patch format: %d", format);
	rc = -EINVAL;
	}
	}

	if ((rc == pcmk_ok) && (digest != NULL)) {
	static struct qb_log_callsite *digest_cs = NULL;

	char *new_digest = NULL;
	char *version = crm_element_value_copy(xml, XML_ATTR_CRM_VERSION);

	if (digest_cs == NULL) {
	digest_cs = qb_log_callsite_get(__func__, __FILE__, "diff-digest",
	LOG_TRACE, __LINE__,
	crm_trace_nonlog);
	}

	new_digest = calculate_xml_versioned_digest(xml, FALSE, TRUE, version);
	if (!pcmk__str_eq(new_digest, digest, pcmk__str_casei)) {
	crm_info("v%d digest mis-match: expected %s, calculated %s",
	format, digest, new_digest);
	rc = -pcmk_err_diff_failed;

	if ((digest_cs != NULL) && digest_cs->targets) {
	save_xml_to_file(old, "PatchDigest:input", NULL);
	save_xml_to_file(xml, "PatchDigest:result", NULL);
	save_xml_to_file(patchset, "PatchDigest:diff", NULL);

	} else {
	crm_trace("%p %.6x", digest_cs,
	((digest_cs != NULL)? digest_cs->targets : 0));
	}

	} else {
	crm_trace("v%d digest matched: expected %s, calculated %s",
	format, digest, new_digest);
	}
	free(new_digest);
	free(version);
	}
	free_xml(old);
	return rc;
	}

	void
	purge_diff_markers(xmlNode *a_node)
	{
	xmlNode *child = NULL;

	CRM_CHECK(a_node != NULL, return);

	xml_remove_prop(a_node, XML_DIFF_MARKER);
	for (child = pcmk__xml_first_child(a_node); child != NULL;
	child = pcmk__xml_next(child)) {
	purge_diff_markers(child);
	}
	}

	xmlNode *
	diff_xml_object(xmlNode old, xmlNode new, gboolean suppress)
	{
	xmlNode *tmp1 = NULL;
	xmlNode *diff = create_xml_node(NULL, "diff");
	xmlNode *removed = create_xml_node(diff, "diff-removed");
	xmlNode *added = create_xml_node(diff, "diff-added");

	crm_xml_add(diff, XML_ATTR_CRM_VERSION, CRM_FEATURE_SET);

	tmp1 = subtract_xml_object(removed, old, new, FALSE, NULL, "removed:top");
	if (suppress && (tmp1 != NULL) && can_prune_leaf(tmp1)) {
	free_xml(tmp1);
	}

	tmp1 = subtract_xml_object(added, new, old, TRUE, NULL, "added:top");
	if (suppress && (tmp1 != NULL) && can_prune_leaf(tmp1)) {
	free_xml(tmp1);
	}

	if ((added->children == NULL) && (removed->children == NULL)) {
	free_xml(diff);
	diff = NULL;
	}

	return diff;
	}

	static xmlNode *
	subtract_xml_comment(xmlNode parent, xmlNode left, xmlNode *right,
	gboolean *changed)
	{
	CRM_CHECK(left != NULL, return NULL);
	CRM_CHECK(left->type == XML_COMMENT_NODE, return NULL);

	if ((right == NULL) \|\| !pcmk__str_eq((const char *)left->content,
	(const char *)right->content,
	pcmk__str_casei)) {
	xmlNode *deleted = NULL;

	deleted = add_node_copy(parent, left);
	*changed = TRUE;

	return deleted;
	}

	return NULL;
	}

	xmlNode *
	subtract_xml_object(xmlNode parent, xmlNode left, xmlNode *right,
	gboolean full, gboolean changed, const char marker)
	{
	gboolean dummy = FALSE;
	xmlNode *diff = NULL;
	xmlNode *right_child = NULL;
	xmlNode *left_child = NULL;
	xmlAttrPtr xIter = NULL;

	const char *id = NULL;
	const char *name = NULL;
	const char *value = NULL;
	const char *right_val = NULL;

	if (changed == NULL) {
	changed = &dummy;
	}

	if (left == NULL) {
	return NULL;
	}

	if (left->type == XML_COMMENT_NODE) {
	return subtract_xml_comment(parent, left, right, changed);
	}

	id = ID(left);
	if (right == NULL) {
	xmlNode *deleted = NULL;

	crm_trace("Processing <%s id=%s> (complete copy)",
	crm_element_name(left), id);
	deleted = add_node_copy(parent, left);
	crm_xml_add(deleted, XML_DIFF_MARKER, marker);

	*changed = TRUE;
	return deleted;
	}

	name = crm_element_name(left);
	CRM_CHECK(name != NULL, return NULL);
	CRM_CHECK(pcmk__str_eq(crm_element_name(left), crm_element_name(right),
	pcmk__str_casei),
	return NULL);

	// Check for XML_DIFF_MARKER in a child
	value = crm_element_value(right, XML_DIFF_MARKER);
	if ((value != NULL) && (strcmp(value, "removed:top") == 0)) {
	crm_trace("We are the root of the deletion: %s.id=%s", name, id);
	*changed = TRUE;
	return NULL;
	}

	// @TODO Avoiding creating the full hierarchy would save work here
	diff = create_xml_node(parent, name);

	// Changes to child objects
	for (left_child = pcmk__xml_first_child(left); left_child != NULL;
	left_child = pcmk__xml_next(left_child)) {
	gboolean child_changed = FALSE;

	right_child = pcmk__xml_match(right, left_child, false);
	subtract_xml_object(diff, left_child, right_child, full, &child_changed,
	marker);
	if (child_changed) {
	*changed = TRUE;
	}
	}

	if (!*changed) {
	/* Nothing to do */

	} else if (full) {
	xmlAttrPtr pIter = NULL;

	for (pIter = pcmk__xe_first_attr(left); pIter != NULL;
	pIter = pIter->next) {
	const char p_name = (const char )pIter->name;
	const char *p_value = pcmk__xml_attr_value(pIter);

	xmlSetProp(diff, (pcmkXmlStr) p_name, (pcmkXmlStr) p_value);
	}

	// We have everything we need
	goto done;
	}

	// Changes to name/value pairs
	for (xIter = pcmk__xe_first_attr(left); xIter != NULL;
	xIter = xIter->next) {
	const char prop_name = (const char ) xIter->name;
	xmlAttrPtr right_attr = NULL;
	xml_private_t *p = NULL;

	if (strcmp(prop_name, XML_ATTR_ID) == 0) {
	// id already obtained when present ~ this case, so just reuse
	xmlSetProp(diff, (pcmkXmlStr) XML_ATTR_ID, (pcmkXmlStr) id);
	continue;
	}

	if (pcmk__xa_filterable(prop_name)) {
	continue;
	}

	right_attr = xmlHasProp(right, (pcmkXmlStr) prop_name);
	if (right_attr) {
	p = right_attr->_private;
	}

	right_val = crm_element_value(right, prop_name);
	if ((right_val == NULL) \|\| (p && pcmk_is_set(p->flags, pcmk__xf_deleted))) {
	/* new */
	*changed = TRUE;
	if (full) {
	xmlAttrPtr pIter = NULL;

	for (pIter = pcmk__xe_first_attr(left); pIter != NULL;
	pIter = pIter->next) {
	const char p_name = (const char ) pIter->name;
	const char *p_value = pcmk__xml_attr_value(pIter);

	xmlSetProp(diff, (pcmkXmlStr) p_name, (pcmkXmlStr) p_value);
	}
	break;

	} else {
	const char *left_value = crm_element_value(left, prop_name);

	xmlSetProp(diff, (pcmkXmlStr) prop_name, (pcmkXmlStr) value);
	crm_xml_add(diff, prop_name, left_value);
	}

	} else {
	/* Only now do we need the left value */
	const char *left_value = crm_element_value(left, prop_name);

	if (strcmp(left_value, right_val) == 0) {
	/* unchanged */

	} else {
	*changed = TRUE;
	if (full) {
	xmlAttrPtr pIter = NULL;

	crm_trace("Changes detected to %s in <%s id=%s>", prop_name,
	crm_element_name(left), id);
	for (pIter = pcmk__xe_first_attr(left); pIter != NULL;
	pIter = pIter->next) {
	const char p_name = (const char ) pIter->name;
	const char *p_value = pcmk__xml_attr_value(pIter);

	xmlSetProp(diff, (pcmkXmlStr) p_name,
	(pcmkXmlStr) p_value);
	}
	break;

	} else {
	crm_trace("Changes detected to %s (%s -> %s) in <%s id=%s>",
	prop_name, left_value, right_val,
	crm_element_name(left), id);
	crm_xml_add(diff, prop_name, left_value);
	}
	}
	}
	}

	if (!*changed) {
	free_xml(diff);
	return NULL;

	} else if (!full && (id != NULL)) {
	crm_xml_add(diff, XML_ATTR_ID, id);
	}
	done:
	return diff;
	}

	// Deprecated functions kept only for backward API compatibility
	// LCOV_EXCL_START

	#include <crm/common/xml_compat.h>

	gboolean
	apply_xml_diff(xmlNode old_xml, xmlNode diff, xmlNode **new_xml)
	{
	gboolean result = TRUE;
	int root_nodes_seen = 0;
	static struct qb_log_callsite *digest_cs = NULL;
	const char *digest = crm_element_value(diff, XML_ATTR_DIGEST);
	const char *version = crm_element_value(diff, XML_ATTR_CRM_VERSION);

	xmlNode *child_diff = NULL;
	xmlNode *added = find_xml_node(diff, "diff-added", FALSE);
	xmlNode *removed = find_xml_node(diff, "diff-removed", FALSE);

	CRM_CHECK(new_xml != NULL, return FALSE);
	if (digest_cs == NULL) {
	digest_cs = qb_log_callsite_get(__func__, __FILE__, "diff-digest",
	LOG_TRACE, __LINE__, crm_trace_nonlog);
	}

	crm_trace("Subtraction Phase");
	for (child_diff = pcmk__xml_first_child(removed); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, result = FALSE);
	if (root_nodes_seen == 0) {
	*new_xml = subtract_xml_object(NULL, old_xml, child_diff, FALSE,
	NULL, NULL);
	}
	root_nodes_seen++;
	}

	if (root_nodes_seen == 0) {
	*new_xml = copy_xml(old_xml);

	} else if (root_nodes_seen > 1) {
	crm_err("(-) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	result = FALSE;
	}

	root_nodes_seen = 0;
	crm_trace("Addition Phase");
	if (result) {
	xmlNode *child_diff = NULL;

	for (child_diff = pcmk__xml_first_child(added); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, result = FALSE);
	if (root_nodes_seen == 0) {
	pcmk__xml_update(NULL, *new_xml, child_diff, true);
	}
	root_nodes_seen++;
	}
	}

	if (root_nodes_seen > 1) {
	crm_err("(+) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	result = FALSE;

	} else if (result && (digest != NULL)) {
	char *new_digest = NULL;

	purge_diff_markers(*new_xml); // Purge now so diff is ok
	new_digest = calculate_xml_versioned_digest(*new_xml, FALSE, TRUE,
	version);
	if (!pcmk__str_eq(new_digest, digest, pcmk__str_casei)) {
	crm_info("Digest mis-match: expected %s, calculated %s",
	digest, new_digest);
	result = FALSE;

	crm_trace("%p %.6x", digest_cs, digest_cs ? digest_cs->targets : 0);
	if ((digest_cs != NULL) && digest_cs->targets) {
	save_xml_to_file(old_xml, "diff:original", NULL);
	save_xml_to_file(diff, "diff:input", NULL);
	save_xml_to_file(*new_xml, "diff:new", NULL);
	}

	} else {
	crm_trace("Digest matched: expected %s, calculated %s",
	digest, new_digest);
	}
	free(new_digest);

	} else if (result) {
	purge_diff_markers(*new_xml); // Purge now so diff is ok
	}

	return result;
	}

	// LCOV_EXCL_STOP
	// End deprecated API
	diff --git a/lib/common/strings.c b/lib/common/strings.c
	index 3f6d878fea..3abc5bc8a3 100644
	--- a/lib/common/strings.c
	+++ b/lib/common/strings.c
	@@ -1,1331 +1,1360 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#ifndef _GNU_SOURCE
	# define _GNU_SOURCE
	#endif

	#include <regex.h>
	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>
	#include <ctype.h>
	#include <float.h> // DBL_MIN
	#include <limits.h>
	#include <math.h> // fabs()
	#include <bzlib.h>
	#include <sys/types.h>

	/*!
	* \internal
	* \brief Scan a long long integer from a string
	*
	* \param[in] text String to scan
	* \param[out] result If not NULL, where to store scanned value
	* \param[in] default_value Value to use if text is NULL or invalid
	* \param[out] end_text If not NULL, where to store pointer to first
	* non-integer character
	*
	* \return Standard Pacemaker return code (\c pcmk_rc_ok on success,
	* \c EINVAL on failed string conversion due to invalid input,
	* or \c EOVERFLOW on arithmetic overflow)
	* \note Sets \c errno on error
	*/
	static int
	scan_ll(const char text, long long result, long long default_value,
	char **end_text)
	{
	long long local_result = default_value;
	char *local_end_text = NULL;
	int rc = pcmk_rc_ok;

	errno = 0;
	if (text != NULL) {
	local_result = strtoll(text, &local_end_text, 10);
	if (errno == ERANGE) {
	rc = EOVERFLOW;
	crm_warn("Integer parsed from '%s' was clipped to %lld",
	text, local_result);

	} else if (errno != 0) {
	rc = errno;
	local_result = default_value;
	crm_warn("Could not parse integer from '%s' (using %lld instead): "
	"%s", text, default_value, pcmk_rc_str(rc));

	} else if (local_end_text == text) {
	rc = EINVAL;
	local_result = default_value;
	crm_warn("Could not parse integer from '%s' (using %lld instead): "
	"No digits found", text, default_value);
	}

	if ((end_text == NULL) && !pcmk__str_empty(local_end_text)) {
	crm_warn("Characters left over after parsing '%s': '%s'",
	text, local_end_text);
	}
	errno = rc;
	}
	if (end_text != NULL) {
	*end_text = local_end_text;
	}
	if (result != NULL) {
	*result = local_result;
	}
	return rc;
	}

	/*!
	* \internal
	* \brief Scan a long long integer value from a string
	*
	* \param[in] text The string to scan (may be NULL)
	* \param[out] result Where to store result (or NULL to ignore)
	* \param[in] default_value Value to use if text is NULL or invalid
	*
	* \return Standard Pacemaker return code
	*/
	int
	pcmk__scan_ll(const char text, long long result, long long default_value)
	{
	long long local_result = default_value;
	int rc = pcmk_rc_ok;

	if (text != NULL) {
	rc = scan_ll(text, &local_result, default_value, NULL);
	if (rc != pcmk_rc_ok) {
	local_result = default_value;
	}
	}
	if (result != NULL) {
	*result = local_result;
	}
	return rc;
	}

	/*!
	* \internal
	* \brief Scan an integer value from a string, constrained to a minimum
	*
	* \param[in] text The string to scan (may be NULL)
	* \param[out] result Where to store result (or NULL to ignore)
	* \param[in] minimum Value to use as default and minimum
	*
	* \return Standard Pacemaker return code
	* \note If the value is larger than the maximum integer, EOVERFLOW will be
	* returned and \p result will be set to the maximum integer.
	*/
	int
	pcmk__scan_min_int(const char text, int result, int minimum)
	{
	int rc;
	long long result_ll;

	rc = pcmk__scan_ll(text, &result_ll, (long long) minimum);

	if (result_ll < (long long) minimum) {
	crm_warn("Clipped '%s' to minimum acceptable value %d", text, minimum);
	result_ll = (long long) minimum;

	} else if (result_ll > INT_MAX) {
	crm_warn("Clipped '%s' to maximum integer %d", text, INT_MAX);
	result_ll = (long long) INT_MAX;
	rc = EOVERFLOW;
	}

	if (result != NULL) {
	*result = (int) result_ll;
	}
	return rc;
	}

	/*!
	* \internal
	* \brief Scan a TCP port number from a string
	*
	* \param[in] text The string to scan
	* \param[out] port Where to store result (or NULL to ignore)
	*
	* \return Standard Pacemaker return code
	* \note \p port will be -1 if \p text is NULL or invalid
	*/
	int
	pcmk__scan_port(const char text, int port)
	{
	long long port_ll;
	int rc = pcmk__scan_ll(text, &port_ll, -1LL);

	if ((text != NULL) && (rc == pcmk_rc_ok) // wasn't default or invalid
	&& ((port_ll < 0LL) \|\| (port_ll > 65535LL))) {
	crm_warn("Ignoring port specification '%s' "
	"not in valid range (0-65535)", text);
	rc = (port_ll < 0LL)? pcmk_rc_before_range : pcmk_rc_after_range;
	port_ll = -1LL;
	}
	if (port != NULL) {
	*port = (int) port_ll;
	}
	return rc;
	}

	/*!
	* \internal
	* \brief Scan a double-precision floating-point value from a string
	*
	* \param[in] text The string to parse
	* \param[out] result Parsed value on success, or
	* \c PCMK__PARSE_DBL_DEFAULT on error
	* \param[in] default_text Default string to parse if \p text is
	* \c NULL
	* \param[out] end_text If not \c NULL, where to store a pointer
	* to the position immediately after the
	* value
	*
	* \return Standard Pacemaker return code (\c pcmk_rc_ok on success,
	* \c EINVAL on failed string conversion due to invalid input,
	* \c EOVERFLOW on arithmetic overflow, \c pcmk_rc_underflow
	* on arithmetic underflow, or \c errno from \c strtod() on
	* other parse errors)
	*/
	int
	pcmk__scan_double(const char text, double result, const char *default_text,
	char **end_text)
	{
	int rc = pcmk_rc_ok;
	char *local_end_text = NULL;

	CRM_ASSERT(result != NULL);
	*result = PCMK__PARSE_DBL_DEFAULT;

	text = (text != NULL) ? text : default_text;

	if (text == NULL) {
	rc = EINVAL;
	crm_debug("No text and no default conversion value supplied");

	} else {
	errno = 0;
	*result = strtod(text, &local_end_text);

	if (errno == ERANGE) {
	/*
	* Overflow: strtod() returns +/- HUGE_VAL and sets errno to
	* ERANGE
	*
	* Underflow: strtod() returns "a value whose magnitude is
	* no greater than the smallest normalized
	* positive" double. Whether ERANGE is set is
	* implementation-defined.
	*/
	const char *over_under;

	if (fabs(*result) > DBL_MIN) {
	rc = EOVERFLOW;
	over_under = "over";
	} else {
	rc = pcmk_rc_underflow;
	over_under = "under";
	}

	crm_debug("Floating-point value parsed from '%s' would %sflow "
	"(using %g instead)", text, over_under, *result);

	} else if (errno != 0) {
	rc = errno;
	// strtod() set *result = 0 on parse failure
	*result = PCMK__PARSE_DBL_DEFAULT;

	crm_debug("Could not parse floating-point value from '%s' (using "
	"%.1f instead): %s", text, PCMK__PARSE_DBL_DEFAULT,
	pcmk_rc_str(rc));

	} else if (local_end_text == text) {
	// errno == 0, but nothing was parsed
	rc = EINVAL;
	*result = PCMK__PARSE_DBL_DEFAULT;

	crm_debug("Could not parse floating-point value from '%s' (using "
	"%.1f instead): No digits found", text,
	PCMK__PARSE_DBL_DEFAULT);

	} else if (fabs(*result) <= DBL_MIN) {
	/*
	* errno == 0 and text was parsed, but value might have
	* underflowed.
	*
	* ERANGE might not be set for underflow. Check magnitude
	* of *result, but also make sure the input number is not
	* actually zero (0 <= DBL_MIN is not underflow).
	*
	* This check must come last. A parse failure in strtod()
	* also sets *result == 0, so a parse failure would match
	* this test condition prematurely.
	*/
	for (const char *p = text; p != local_end_text; p++) {
	if (strchr("0.eE", *p) == NULL) {
	rc = pcmk_rc_underflow;
	crm_debug("Floating-point value parsed from '%s' would "
	"underflow (using %g instead)", text, *result);
	break;
	}
	}

	} else {
	crm_trace("Floating-point value parsed successfully from "
	"'%s': %g", text, *result);
	}

	if ((end_text == NULL) && !pcmk__str_empty(local_end_text)) {
	crm_debug("Characters left over after parsing '%s': '%s'",
	text, local_end_text);
	}
	}

	if (end_text != NULL) {
	*end_text = local_end_text;
	}

	return rc;
	}

	/*!
	* \internal
	* \brief Parse a guint from a string stored in a hash table
	*
	* \param[in,out] table Hash table to search
	* \param[in] key Hash table key to use to retrieve string
	* \param[in] default_val What to use if key has no entry in table
	* \param[out] result If not NULL, where to store parsed integer
	*
	* \return Standard Pacemaker return code
	*/
	int
	pcmk__guint_from_hash(GHashTable table, const char key, guint default_val,
	guint *result)
	{
	const char *value;
	long long value_ll;
	int rc = pcmk_rc_ok;

	CRM_CHECK((table != NULL) && (key != NULL), return EINVAL);

	if (result != NULL) {
	*result = default_val;
	}

	value = g_hash_table_lookup(table, key);
	if (value == NULL) {
	return pcmk_rc_ok;
	}

	rc = pcmk__scan_ll(value, &value_ll, 0LL);
	if (rc != pcmk_rc_ok) {
	return rc;
	}

	if ((value_ll < 0) \|\| (value_ll > G_MAXUINT)) {
	crm_warn("Could not parse non-negative integer from %s", value);
	return ERANGE;
	}

	if (result != NULL) {
	*result = (guint) value_ll;
	}
	return pcmk_rc_ok;
	}

	#ifndef NUMCHARS
	# define NUMCHARS "0123456789."
	#endif

	#ifndef WHITESPACE
	# define WHITESPACE " \t\n\r\f"
	#endif

	/*!
	* \brief Parse a time+units string and return milliseconds equivalent
	*
	* \param[in] input String with a number and optional unit (optionally
	* with whitespace before and/or after the number). If
	* missing, the unit defaults to seconds.
	*
	* \return Milliseconds corresponding to string expression, or
	* PCMK__PARSE_INT_DEFAULT on error
	*/
	long long
	crm_get_msec(const char *input)
	{
	const char *num_start = NULL;
	const char *units;
	long long multiplier = 1000;
	long long divisor = 1;
	long long msec = PCMK__PARSE_INT_DEFAULT;
	size_t num_len = 0;
	char *end_text = NULL;

	if (input == NULL) {
	return PCMK__PARSE_INT_DEFAULT;
	}

	num_start = input + strspn(input, WHITESPACE);
	num_len = strspn(num_start, NUMCHARS);
	if (num_len < 1) {
	return PCMK__PARSE_INT_DEFAULT;
	}
	units = num_start + num_len;
	units += strspn(units, WHITESPACE);

	if (!strncasecmp(units, "ms", 2) \|\| !strncasecmp(units, "msec", 4)) {
	multiplier = 1;
	divisor = 1;
	} else if (!strncasecmp(units, "us", 2) \|\| !strncasecmp(units, "usec", 4)) {
	multiplier = 1;
	divisor = 1000;
	} else if (!strncasecmp(units, "s", 1) \|\| !strncasecmp(units, "sec", 3)) {
	multiplier = 1000;
	divisor = 1;
	} else if (!strncasecmp(units, "m", 1) \|\| !strncasecmp(units, "min", 3)) {
	multiplier = 60 * 1000;
	divisor = 1;
	} else if (!strncasecmp(units, "h", 1) \|\| !strncasecmp(units, "hr", 2)) {
	multiplier = 60 * 60 * 1000;
	divisor = 1;
	} else if ((units != '\0') && (units != '\n') && (*units != '\r')) {
	return PCMK__PARSE_INT_DEFAULT;
	}

	scan_ll(num_start, &msec, PCMK__PARSE_INT_DEFAULT, &end_text);
	if (msec > (LLONG_MAX / multiplier)) {
	// Arithmetics overflow while multiplier/divisor mutually exclusive
	return LLONG_MAX;
	}
	msec *= multiplier;
	msec /= divisor;
	return msec;
	}

	gboolean
	crm_is_true(const char *s)
	{
	gboolean ret = FALSE;

	if (s != NULL) {
	crm_str_to_boolean(s, &ret);
	}
	return ret;
	}

	int
	crm_str_to_boolean(const char s, int ret)
	{
	if (s == NULL) {
	return -1;

	} else if (strcasecmp(s, "true") == 0
	\|\| strcasecmp(s, "on") == 0
	\|\| strcasecmp(s, "yes") == 0 \|\| strcasecmp(s, "y") == 0 \|\| strcasecmp(s, "1") == 0) {
	*ret = TRUE;
	return 1;

	} else if (strcasecmp(s, "false") == 0
	\|\| strcasecmp(s, "off") == 0
	\|\| strcasecmp(s, "no") == 0 \|\| strcasecmp(s, "n") == 0 \|\| strcasecmp(s, "0") == 0) {
	*ret = FALSE;
	return 1;
	}
	return -1;
	}

	/*!
	* \internal
	* \brief Replace any trailing newlines in a string with \0's
	*
	* \param[in,out] str String to trim
	*
	* \return \p str
	*/
	char *
	pcmk__trim(char *str)
	{
	int len;

	if (str == NULL) {
	return str;
	}

	for (len = strlen(str) - 1; len >= 0 && str[len] == '\n'; len--) {
	str[len] = '\0';
	}

	return str;
	}

	/*!
	* \brief Check whether a string starts with a certain sequence
	*
	* \param[in] str String to check
	* \param[in] prefix Sequence to match against beginning of \p str
	*
	* \return \c true if \p str begins with match, \c false otherwise
	* \note This is equivalent to !strncmp(s, prefix, strlen(prefix))
	* but is likely less efficient when prefix is a string literal
	* if the compiler optimizes away the strlen() at compile time,
	* and more efficient otherwise.
	*/
	bool
	pcmk__starts_with(const char str, const char prefix)
	{
	const char *s = str;
	const char *p = prefix;

	if (!s \|\| !p) {
	return false;
	}
	while (s && p) {
	if (s++ != p++) {
	return false;
	}
	}
	return (*p == 0);
	}

	static inline bool
	ends_with(const char s, const char match, bool as_extension)
	{
	if (pcmk__str_empty(match)) {
	return true;
	} else if (s == NULL) {
	return false;
	} else {
	size_t slen, mlen;

	/* Besides as_extension, we could also check
	!strchr(&match[1], match[0]) but that would be inefficient.
	*/
	if (as_extension) {
	s = strrchr(s, match[0]);
	return (s == NULL)? false : !strcmp(s, match);
	}

	mlen = strlen(match);
	slen = strlen(s);
	return ((slen >= mlen) && !strcmp(s + slen - mlen, match));
	}
	}

	/*!
	* \internal
	* \brief Check whether a string ends with a certain sequence
	*
	* \param[in] s String to check
	* \param[in] match Sequence to match against end of \p s
	*
	* \return \c true if \p s ends case-sensitively with match, \c false otherwise
	* \note pcmk__ends_with_ext() can be used if the first character of match
	* does not recur in match.
	*/
	bool
	pcmk__ends_with(const char s, const char match)
	{
	return ends_with(s, match, false);
	}

	/*!
	* \internal
	* \brief Check whether a string ends with a certain "extension"
	*
	* \param[in] s String to check
	* \param[in] match Extension to match against end of \p s, that is,
	* its first character must not occur anywhere
	* in the rest of that very sequence (example: file
	* extension where the last dot is its delimiter,
	* e.g., ".html"); incorrect results may be
	* returned otherwise.
	*
	* \return \c true if \p s ends (verbatim, i.e., case sensitively)
	* with "extension" designated as \p match (including empty
	* string), \c false otherwise
	*
	* \note Main incentive to prefer this function over \c pcmk__ends_with()
	* where possible is the efficiency (at the cost of added
	* restriction on \p match as stated; the complexity class
	* remains the same, though: BigO(M+N) vs. BigO(M+2N)).
	*/
	bool
	pcmk__ends_with_ext(const char s, const char match)
	{
	return ends_with(s, match, true);
	}

	/*!
	* \internal
	* \brief Create a hash of a string suitable for use with GHashTable
	*
	* \param[in] v String to hash
	*
	* \return A hash of \p v compatible with g_str_hash() before glib 2.28
	* \note glib changed their hash implementation:
	*
	* https://gitlab.gnome.org/GNOME/glib/commit/354d655ba8a54b754cb5a3efb42767327775696c
	*
	* Note that the new g_str_hash is presumably a better hash (it's actually
	* a correct implementation of DJB's hash), but we need to preserve existing
	* behaviour, because the hash key ultimately determines the "sort" order
	* when iterating through GHashTables, which affects allocation of scores to
	* clone instances when iterating through rsc->allowed_nodes. It (somehow)
	* also appears to have some minor impact on the ordering of a few
	* pseudo_event IDs in the transition graph.
	*/
	static guint
	pcmk__str_hash(gconstpointer v)
	{
	const signed char *p;
	guint32 h = 0;

	for (p = v; *p != '\0'; p++)
	h = (h << 5) - h + *p;

	return h;
	}

	/*!
	* \internal
	* \brief Create a hash table with case-sensitive strings as keys
	*
	* \param[in] key_destroy_func Function to free a key
	* \param[in] value_destroy_func Function to free a value
	*
	* \return Newly allocated hash table
	* \note It is the caller's responsibility to free the result, using
	* g_hash_table_destroy().
	*/
	GHashTable *
	pcmk__strkey_table(GDestroyNotify key_destroy_func,
	GDestroyNotify value_destroy_func)
	{
	return g_hash_table_new_full(pcmk__str_hash, g_str_equal,
	key_destroy_func, value_destroy_func);
	}

	/* used with hash tables where case does not matter */
	static gboolean
	pcmk__strcase_equal(gconstpointer a, gconstpointer b)
	{
	return pcmk__str_eq((const char )a, (const char )b, pcmk__str_casei);
	}

	static guint
	pcmk__strcase_hash(gconstpointer v)
	{
	const signed char *p;
	guint32 h = 0;

	for (p = v; *p != '\0'; p++)
	h = (h << 5) - h + g_ascii_tolower(*p);

	return h;
	}

	/*!
	* \internal
	* \brief Create a hash table with case-insensitive strings as keys
	*
	* \param[in] key_destroy_func Function to free a key
	* \param[in] value_destroy_func Function to free a value
	*
	* \return Newly allocated hash table
	* \note It is the caller's responsibility to free the result, using
	* g_hash_table_destroy().
	*/
	GHashTable *
	pcmk__strikey_table(GDestroyNotify key_destroy_func,
	GDestroyNotify value_destroy_func)
	{
	return g_hash_table_new_full(pcmk__strcase_hash, pcmk__strcase_equal,
	key_destroy_func, value_destroy_func);
	}

	static void
	copy_str_table_entry(gpointer key, gpointer value, gpointer user_data)
	{
	if (key && value && user_data) {
	g_hash_table_insert((GHashTable*)user_data, strdup(key), strdup(value));
	}
	}

	/*!
	* \internal
	* \brief Copy a hash table that uses dynamically allocated strings
	*
	* \param[in,out] old_table Hash table to duplicate
	*
	* \return New hash table with copies of everything in \p old_table
	* \note This assumes the hash table uses dynamically allocated strings -- that
	* is, both the key and value free functions are free().
	*/
	GHashTable *
	pcmk__str_table_dup(GHashTable *old_table)
	{
	GHashTable *new_table = NULL;

	if (old_table) {
	new_table = pcmk__strkey_table(free, free);
	g_hash_table_foreach(old_table, copy_str_table_entry, new_table);
	}
	return new_table;
	}

	/*!
	* \internal
	* \brief Add a word to a string list of words
	*
	* \param[in,out] list Pointer to current string list (may not be \p NULL)
	* \param[in] init_size \p list will be initialized to at least this size,
	* if it needs initialization (if 0, use GLib's default
	* initial string size)
	* \param[in] word String to add to \p list (\p list will be
	* unchanged if this is \p NULL or the empty string)
	* \param[in] separator String to separate words in \p list
	* (a space will be used if this is NULL)
	*
	* \note \p word may contain \p separator, though that would be a bad idea if
	* the string needs to be parsed later.
	*/
	void
	pcmk__add_separated_word(GString *list, size_t init_size, const char word,
	const char *separator)
	{
	CRM_ASSERT(list != NULL);

	if (pcmk__str_empty(word)) {
	return;
	}

	if (*list == NULL) {
	if (init_size > 0) {
	*list = g_string_sized_new(init_size);
	} else {
	*list = g_string_new(NULL);
	}
	}

	if ((*list)->len == 0) {
	// Don't add a separator before the first word in the list
	separator = "";

	} else if (separator == NULL) {
	// Default to space-separated
	separator = " ";
	}

	g_string_append(*list, separator);
	g_string_append(*list, word);
	}

	/*!
	* \internal
	* \brief Compress data
	*
	* \param[in] data Data to compress
	* \param[in] length Number of characters of data to compress
	* \param[in] max Maximum size of compressed data (or 0 to estimate)
	* \param[out] result Where to store newly allocated compressed result
	* \param[out] result_len Where to store actual compressed length of result
	*
	* \return Standard Pacemaker return code
	*/
	int
	pcmk__compress(const char *data, unsigned int length, unsigned int max,
	char *result, unsigned int result_len)
	{
	int rc;
	char *compressed = NULL;
	char *uncompressed = strdup(data);
	#ifdef CLOCK_MONOTONIC
	struct timespec after_t;
	struct timespec before_t;
	#endif

	if (max == 0) {
	max = (length * 1.01) + 601; // Size guaranteed to hold result
	}

	#ifdef CLOCK_MONOTONIC
	clock_gettime(CLOCK_MONOTONIC, &before_t);
	#endif

	compressed = calloc((size_t) max, sizeof(char));
	CRM_ASSERT(compressed);

	*result_len = max;
	rc = BZ2_bzBuffToBuffCompress(compressed, result_len, uncompressed, length,
	CRM_BZ2_BLOCKS, 0, CRM_BZ2_WORK);
	free(uncompressed);
	if (rc != BZ_OK) {
	crm_err("Compression of %d bytes failed: %s " CRM_XS " bzerror=%d",
	length, bz2_strerror(rc), rc);
	free(compressed);
	return pcmk_rc_error;
	}

	#ifdef CLOCK_MONOTONIC
	clock_gettime(CLOCK_MONOTONIC, &after_t);

	crm_trace("Compressed %d bytes into %d (ratio %d:1) in %.0fms",
	length, result_len, length / (result_len),
	(after_t.tv_sec - before_t.tv_sec) * 1000 +
	(after_t.tv_nsec - before_t.tv_nsec) / 1e6);
	#else
	crm_trace("Compressed %d bytes into %d (ratio %d:1)",
	length, result_len, length / (result_len));
	#endif

	*result = compressed;
	return pcmk_rc_ok;
	}

	char *
	crm_strdup_printf(char const *format, ...)
	{
	va_list ap;
	int len = 0;
	char *string = NULL;

	va_start(ap, format);
	len = vasprintf (&string, format, ap);
	CRM_ASSERT(len > 0);
	va_end(ap);
	return string;
	}

	int
	pcmk__parse_ll_range(const char srcstring, long long start, long long *end)
	{
	char *remainder = NULL;

	CRM_ASSERT(start != NULL && end != NULL);

	*start = PCMK__PARSE_INT_DEFAULT;
	*end = PCMK__PARSE_INT_DEFAULT;

	crm_trace("Attempting to decode: [%s]", srcstring);
	if (pcmk__str_empty(srcstring) \|\| !strcmp(srcstring, "-")) {
	return pcmk_rc_unknown_format;
	}

	/* String starts with a dash, so this is either a range with
	* no beginning or garbage.
	* */
	if (*srcstring == '-') {
	int rc = scan_ll(srcstring+1, end, PCMK__PARSE_INT_DEFAULT, &remainder);

	if (rc != pcmk_rc_ok \|\| *remainder != '\0') {
	return pcmk_rc_unknown_format;
	} else {
	return pcmk_rc_ok;
	}
	}

	if (scan_ll(srcstring, start, PCMK__PARSE_INT_DEFAULT,
	&remainder) != pcmk_rc_ok) {
	return pcmk_rc_unknown_format;
	}

	if (remainder && remainder == '-') {
	if (*(remainder+1)) {
	char *more_remainder = NULL;
	int rc = scan_ll(remainder+1, end, PCMK__PARSE_INT_DEFAULT,
	&more_remainder);

	if (rc != pcmk_rc_ok \|\| *more_remainder != '\0') {
	return pcmk_rc_unknown_format;
	}
	}
	} else if (remainder && remainder != '-') {
	*start = PCMK__PARSE_INT_DEFAULT;
	return pcmk_rc_unknown_format;
	} else {
	/* The input string contained only one number. Set start and end
	* to the same value and return pcmk_rc_ok. This gives the caller
	* a way to tell this condition apart from a range with no end.
	*/
	end = start;
	}

	return pcmk_rc_ok;
	}

	/*!
	* \internal
	* \brief Find a string in a list of strings
	*
	* \note This function takes the same flags and has the same behavior as
	* pcmk__str_eq().
	*
	* \note No matter what input string or flags are provided, an empty
	* list will always return FALSE.
	*
	* \param[in] s String to search for
	* \param[in] lst List to search
	* \param[in] flags A bitfield of pcmk__str_flags to modify operation
	*
	* \return \c TRUE if \p s is in \p lst, or \c FALSE otherwise
	*/
	gboolean
	pcmk__str_in_list(const gchar s, const GList lst, uint32_t flags)
	{
	for (const GList *ele = lst; ele != NULL; ele = ele->next) {
	if (pcmk__str_eq(s, ele->data, flags)) {
	return TRUE;
	}
	}

	return FALSE;
	}

	static bool
	str_any_of(const char *s, va_list args, uint32_t flags)
	{
	if (s == NULL) {
	return pcmk_is_set(flags, pcmk__str_null_matches);
	}

	while (1) {
	const char ele = va_arg(args, const char );

	if (ele == NULL) {
	break;
	} else if (pcmk__str_eq(s, ele, flags)) {
	return true;
	}
	}

	return false;
	}

	/*!
	* \internal
	* \brief Is a string a member of a list of strings?
	*
	* \param[in] s String to search for in \p ...
	* \param[in] ... Strings to compare \p s against. The final string
	* must be NULL.
	*
	* \note The comparison is done case-insensitively. The function name is
	* meant to be reminiscent of strcasecmp.
	*
	* \return \c true if \p s is in \p ..., or \c false otherwise
	*/
	bool
	pcmk__strcase_any_of(const char *s, ...)
	{
	va_list ap;
	bool rc;

	va_start(ap, s);
	rc = str_any_of(s, ap, pcmk__str_casei);
	va_end(ap);
	return rc;
	}

	/*!
	* \internal
	* \brief Is a string a member of a list of strings?
	*
	* \param[in] s String to search for in \p ...
	* \param[in] ... Strings to compare \p s against. The final string
	* must be NULL.
	*
	* \note The comparison is done taking case into account.
	*
	* \return \c true if \p s is in \p ..., or \c false otherwise
	*/
	bool
	pcmk__str_any_of(const char *s, ...)
	{
	va_list ap;
	bool rc;

	va_start(ap, s);
	rc = str_any_of(s, ap, pcmk__str_none);
	va_end(ap);
	return rc;
	}

	/*!
	* \internal
	* \brief Check whether a character is in any of a list of strings
	*
	* \param[in] ch Character (ASCII) to search for
	* \param[in] ... Strings to search. Final argument must be
	* \c NULL.
	*
	* \return \c true if any of \p ... contain \p ch, \c false otherwise
	* \note \p ... must contain at least one argument (\c NULL).
	*/
	bool
	pcmk__char_in_any_str(int ch, ...)
	{
	bool rc = false;
	va_list ap;

	/*
	* Passing a char to va_start() can generate compiler warnings,
	* so ch is declared as an int.
	*/
	va_start(ap, ch);

	while (1) {
	const char ele = va_arg(ap, const char );

	if (ele == NULL) {
	break;
	} else if (strchr(ele, ch) != NULL) {
	rc = true;
	break;
	}
	}

	va_end(ap);
	return rc;
	}

	/*!
	* \internal
	* \brief Sort strings, with numeric portions sorted numerically
	*
	* Sort two strings case-insensitively like strcasecmp(), but with any numeric
	* portions of the string sorted numerically. This is particularly useful for
	* node names (for example, "node10" will sort higher than "node9" but lower
	* than "remotenode9").
	*
	* \param[in] s1 First string to compare (must not be NULL)
	* \param[in] s2 Second string to compare (must not be NULL)
	*
	* \retval -1 \p s1 comes before \p s2
	* \retval 0 \p s1 and \p s2 are equal
	* \retval 1 \p s1 comes after \p s2
	*/
	int
	pcmk__numeric_strcasecmp(const char s1, const char s2)
	{
	CRM_ASSERT((s1 != NULL) && (s2 != NULL));

	while (s1 && s2) {
	if (isdigit(s1) && isdigit(s2)) {
	// If node names contain a number, sort numerically

	char *end1 = NULL;
	char *end2 = NULL;
	long num1 = strtol(s1, &end1, 10);
	long num2 = strtol(s2, &end2, 10);

	// allow ordering e.g. 007 > 7
	size_t len1 = end1 - s1;
	size_t len2 = end2 - s2;

	if (num1 < num2) {
	return -1;
	} else if (num1 > num2) {
	return 1;
	} else if (len1 < len2) {
	return -1;
	} else if (len1 > len2) {
	return 1;
	}
	s1 = end1;
	s2 = end2;
	} else {
	// Compare non-digits case-insensitively
	int lower1 = tolower(*s1);
	int lower2 = tolower(*s2);

	if (lower1 < lower2) {
	return -1;
	} else if (lower1 > lower2) {
	return 1;
	}
	++s1;
	++s2;
	}
	}
	if (!s1 && s2) {
	return -1;
	} else if (s1 && !s2) {
	return 1;
	}
	return 0;
	}

	/*!
	* \internal
	* \brief Sort strings.
	*
	* This is your one-stop function for string comparison. By default, this
	* function works like \p g_strcmp0. That is, like \p strcmp but a \p NULL
	* string sorts before a non-<tt>NULL</tt> string.
	*
	* The \p pcmk__str_none flag produces the default behavior. Behavior can be
	* changed with various flags:
	*
	* - \p pcmk__str_regex - The second string is a regular expression that the
	* first string will be matched against.
	* - \p pcmk__str_casei - By default, comparisons are done taking case into
	* account. This flag makes comparisons case-
	* insensitive. This can be combined with
	* \p pcmk__str_regex.
	* - \p pcmk__str_null_matches - If one string is \p NULL and the other is not,
	* still return \p 0.
	* - \p pcmk__str_star_matches - If one string is \p "*" and the other is not,
	* still return \p 0.
	*
	* \param[in] s1 First string to compare
	* \param[in] s2 Second string to compare, or a regular expression to
	* match if \p pcmk__str_regex is set
	* \param[in] flags A bitfield of \p pcmk__str_flags to modify operation
	*
	* \retval negative \p s1 is \p NULL or comes before \p s2
	* \retval 0 \p s1 and \p s2 are equal, or \p s1 is found in \p s2 if
	* \c pcmk__str_regex is set
	* \retval positive \p s2 is \p NULL or \p s1 comes after \p s2, or \p s2
	* is an invalid regular expression, or \p s1 was not found
	* in \p s2 if \p pcmk__str_regex is set.
	*/
	int
	pcmk__strcmp(const char s1, const char s2, uint32_t flags)
	{
	/* If this flag is set, the second string is a regex. */
	if (pcmk_is_set(flags, pcmk__str_regex)) {
	regex_t r_patt;
	int reg_flags = REG_EXTENDED \| REG_NOSUB;
	int regcomp_rc = 0;
	int rc = 0;

	if (s1 == NULL \|\| s2 == NULL) {
	return 1;
	}

	if (pcmk_is_set(flags, pcmk__str_casei)) {
	reg_flags \|= REG_ICASE;
	}
	regcomp_rc = regcomp(&r_patt, s2, reg_flags);
	if (regcomp_rc != 0) {
	rc = 1;
	crm_err("Bad regex '%s' for update: %s", s2, strerror(regcomp_rc));
	} else {
	rc = regexec(&r_patt, s1, 0, NULL, 0);

	if (rc != 0) {
	rc = 1;
	}
	}

	regfree(&r_patt);
	return rc;
	}

	/* If the strings are the same pointer, return 0 immediately. */
	if (s1 == s2) {
	return 0;
	}

	/* If this flag is set, return 0 if either (or both) of the input strings
	* are NULL. If neither one is NULL, we need to continue and compare
	* them normally.
	*/
	if (pcmk_is_set(flags, pcmk__str_null_matches)) {
	if (s1 == NULL \|\| s2 == NULL) {
	return 0;
	}
	}

	/* Handle the cases where one is NULL and the str_null_matches flag is not set.
	* A NULL string always sorts to the beginning.
	*/
	if (s1 == NULL) {
	return -1;
	} else if (s2 == NULL) {
	return 1;
	}

	/* If this flag is set, return 0 if either (or both) of the input strings
	* are "*". If neither one is, we need to continue and compare them
	* normally.
	*/
	if (pcmk_is_set(flags, pcmk__str_star_matches)) {
	if (strcmp(s1, "") == 0 \|\| strcmp(s2, "") == 0) {
	return 0;
	}
	}

	if (pcmk_is_set(flags, pcmk__str_casei)) {
	return strcasecmp(s1, s2);
	} else {
	return strcmp(s1, s2);
	}
	}

	/*!
	* \internal
	* \brief Update a dynamically allocated string with a new value
	*
	* Given a dynamically allocated string and a new value for it, if the string
	* is different from the new value, free the string and replace it with either a
	* newly allocated duplicate of the value or NULL as appropriate.
	*
	* \param[in,out] str Pointer to dynamically allocated string
	* \param[in] value New value to duplicate (or NULL)
	*
	* \note The caller remains responsibile for freeing \p *str.
	*/
	void
	pcmk__str_update(char *str, const char value)
	{
	if ((str != NULL) && !pcmk__str_eq(*str, value, pcmk__str_none)) {
	free(*str);
	if (value == NULL) {
	*str = NULL;
	} else {
	*str = strdup(value);
	CRM_ASSERT(*str != NULL);
	}
	}
	}

	+/*!
	+ * \internal
	+ * \brief Append a list of strings to a destination \p GString
	+ *
	+ * \param[in,out] buffer Where to append the strings (must not be \p NULL)
	+ * \param[in] ... A <tt>NULL</tt>-terminated list of strings
	+ *
	+ * \note This tends to be more efficient than a single call to
	+ * \p g_string_append_printf().
	+ */
	+void
	+pcmk__g_strcat(GString *buffer, ...)
	+{
	+ va_list ap;
	+
	+ CRM_ASSERT(buffer != NULL);
	+ va_start(ap, buffer);
	+
	+ while (true) {
	+ const char ele = va_arg(ap, const char );
	+
	+ if (ele == NULL) {
	+ break;
	+ }
	+ g_string_append(buffer, ele);
	+ }
	+ va_end(ap);
	+}
	+
	// Deprecated functions kept only for backward API compatibility
	// LCOV_EXCL_START

	#include <crm/common/util_compat.h>

	gboolean
	safe_str_neq(const char a, const char b)
	{
	if (a == b) {
	return FALSE;

	} else if (a == NULL \|\| b == NULL) {
	return TRUE;

	} else if (strcasecmp(a, b) == 0) {
	return FALSE;
	}
	return TRUE;
	}

	gboolean
	crm_str_eq(const char a, const char b, gboolean use_case)
	{
	if (use_case) {
	return g_strcmp0(a, b) == 0;

	/* TODO - Figure out which calls, if any, really need to be case independent */
	} else if (a == b) {
	return TRUE;

	} else if (a == NULL \|\| b == NULL) {
	/* shouldn't be comparing NULLs */
	return FALSE;

	} else if (strcasecmp(a, b) == 0) {
	return TRUE;
	}
	return FALSE;
	}

	char *
	crm_itoa_stack(int an_int, char *buffer, size_t len)
	{
	if (buffer != NULL) {
	snprintf(buffer, len, "%d", an_int);
	}
	return buffer;
	}

	guint
	g_str_hash_traditional(gconstpointer v)
	{
	return pcmk__str_hash(v);
	}

	gboolean
	crm_strcase_equal(gconstpointer a, gconstpointer b)
	{
	return pcmk__strcase_equal(a, b);
	}

	guint
	crm_strcase_hash(gconstpointer v)
	{
	return pcmk__strcase_hash(v);
	}

	GHashTable *
	crm_str_table_dup(GHashTable *old_table)
	{
	return pcmk__str_table_dup(old_table);
	}

	long long
	crm_parse_ll(const char text, const char default_text)
	{
	long long result;

	if (text == NULL) {
	text = default_text;
	if (text == NULL) {
	crm_err("No default conversion value supplied");
	errno = EINVAL;
	return PCMK__PARSE_INT_DEFAULT;
	}
	}
	scan_ll(text, &result, PCMK__PARSE_INT_DEFAULT, NULL);
	return result;
	}

	int
	crm_parse_int(const char text, const char default_text)
	{
	long long result = crm_parse_ll(text, default_text);

	if (result < INT_MIN) {
	// If errno is ERANGE, crm_parse_ll() has already logged a message
	if (errno != ERANGE) {
	crm_err("Conversion of %s was clipped: %lld", text, result);
	errno = ERANGE;
	}
	return INT_MIN;

	} else if (result > INT_MAX) {
	// If errno is ERANGE, crm_parse_ll() has already logged a message
	if (errno != ERANGE) {
	crm_err("Conversion of %s was clipped: %lld", text, result);
	errno = ERANGE;
	}
	return INT_MAX;
	}

	return (int) result;
	}

	char *
	crm_strip_trailing_newline(char *str)
	{
	return pcmk__trim(str);
	}

	int
	pcmk_numeric_strcasecmp(const char s1, const char s2)
	{
	return pcmk__numeric_strcasecmp(s1, s2);
	}

	// LCOV_EXCL_STOP
	// End deprecated API
	diff --git a/lib/common/tests/strings/Makefile.am b/lib/common/tests/strings/Makefile.am
	index 06c9e392c1..9abb8e9a18 100644
	--- a/lib/common/tests/strings/Makefile.am
	+++ b/lib/common/tests/strings/Makefile.am
	@@ -1,40 +1,41 @@
	#
	# Copyright 2020-2022 the Pacemaker project contributors
	#
	# The version control history for this file may have further details.
	#
	# This source code is licensed under the GNU General Public License version 2
	# or later (GPLv2+) WITHOUT ANY WARRANTY.
	#

	include $(top_srcdir)/mk/tap.mk
	include $(top_srcdir)/mk/unittest.mk

	# Add "_test" to the end of all test program names to simplify .gitignore.
	check_PROGRAMS = \
	crm_get_msec_test \
	crm_is_true_test \
	crm_str_to_boolean_test \
	pcmk__add_word_test \
	pcmk__btoa_test \
	pcmk__char_in_any_str_test \
	pcmk__compress_test \
	pcmk__ends_with_test \
	+ pcmk__g_strcat_test \
	pcmk__guint_from_hash_test \
	pcmk__numeric_strcasecmp_test \
	pcmk__parse_ll_range_test \
	pcmk__s_test \
	pcmk__scan_double_test \
	pcmk__scan_min_int_test \
	pcmk__scan_port_test \
	pcmk__starts_with_test \
	pcmk__str_any_of_test \
	pcmk__str_in_list_test \
	pcmk__str_table_dup_test \
	pcmk__str_update_test \
	pcmk__strcmp_test \
	pcmk__strkey_table_test \
	pcmk__strikey_table_test \
	pcmk__trim_test

	TESTS = $(check_PROGRAMS)
	diff --git a/lib/common/tests/strings/pcmk__g_strcat_test.c b/lib/common/tests/strings/pcmk__g_strcat_test.c
	new file mode 100644
	index 0000000000..7770075183
	--- /dev/null
	+++ b/lib/common/tests/strings/pcmk__g_strcat_test.c
	@@ -0,0 +1,73 @@
	+/*
	+ * Copyright 2020-2022 the Pacemaker project contributors
	+ *
	+ * The version control history for this file may have further details.
	+ *
	+ * This source code is licensed under the GNU Lesser General Public License
	+ * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	+ */
	+
	+#include <crm_internal.h>
	+
	+#include <crm/common/unittest_internal.h>
	+
	+static void
	+add_to_null(void **state)
	+{
	+ pcmk__assert_asserts(pcmk__g_strcat(NULL, NULL));
	+ pcmk__assert_asserts(pcmk__g_strcat(NULL, "hello", NULL));
	+}
	+
	+static void
	+add_nothing(void **state)
	+{
	+ GString *buf = g_string_new(NULL);
	+
	+ // Start with empty string
	+ pcmk__g_strcat(buf, NULL);
	+ assert_string_equal((const char *) buf->str, "");
	+
	+ pcmk__g_strcat(buf, "", NULL);
	+ assert_string_equal((const char *) buf->str, "");
	+
	+ // Start with populated string
	+ g_string_append(buf, "hello");
	+ pcmk__g_strcat(buf, NULL);
	+ assert_string_equal((const char *) buf->str, "hello");
	+
	+ pcmk__g_strcat(buf, "", NULL);
	+ assert_string_equal((const char *) buf->str, "hello");
	+ g_string_free(buf, TRUE);
	+}
	+
	+static void
	+add_words(void **state)
	+{
	+ GString *buf = g_string_new(NULL);
	+
	+ // Verify a call with multiple words
	+ pcmk__g_strcat(buf, "hello", " ", NULL);
	+ assert_string_equal((const char *) buf->str, "hello ");
	+
	+ // Verify that a second call doesn't overwrite the first one
	+ pcmk__g_strcat(buf, "world", NULL);
	+ assert_string_equal((const char *) buf->str, "hello world");
	+ g_string_free(buf, TRUE);
	+}
	+
	+static void
	+stop_early(void **state)
	+{
	+ GString *buf = g_string_new(NULL);
	+
	+ // NULL anywhere after buf in the arg list should cause a return
	+ pcmk__g_strcat(buf, "hello", NULL, " world", NULL);
	+ assert_string_equal((const char *) buf->str, "hello");
	+ g_string_free(buf, TRUE);
	+}
	+
	+PCMK__UNIT_TEST(NULL, NULL,
	+ cmocka_unit_test(add_to_null),
	+ cmocka_unit_test(add_nothing),
	+ cmocka_unit_test(add_words),
	+ cmocka_unit_test(stop_early))
	diff --git a/lib/common/xml.c b/lib/common/xml.c
	index c254a953ec..984948d2db 100644
	--- a/lib/common/xml.c
	+++ b/lib/common/xml.c
	@@ -1,3091 +1,3091 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h>
	#include <sys/types.h>
	#include <unistd.h>
	#include <time.h>
	#include <string.h>
	#include <stdlib.h>
	#include <stdarg.h>
	#include <bzlib.h>

	#include <libxml/parser.h>
	#include <libxml/tree.h>
	#include <libxml/xmlIO.h> /* xmlAllocOutputBuffer */

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h> // PCMK__XML_LOG_BASE, etc.
	#include "crmcommon_private.h"

	// Define this as 1 in development to get insanely verbose trace messages
	#ifndef XML_PARSER_DEBUG
	#define XML_PARSER_DEBUG 0
	#endif


	/* @TODO XML_PARSE_RECOVER allows some XML errors to be silently worked around
	* by libxml2, which is potentially ambiguous and dangerous. We should drop it
	* when we can break backward compatibility with configurations that might be
	* relying on it (i.e. pacemaker 3.0.0).
	*
	* It might be a good idea to have a transitional period where we first try
	* parsing without XML_PARSE_RECOVER, and if that fails, try parsing again with
	* it, logging a warning if it succeeds.
	*/
	#define PCMK__XML_PARSE_OPTS (XML_PARSE_NOBLANKS \| XML_PARSE_RECOVER)

	bool
	pcmk__tracking_xml_changes(xmlNode *xml, bool lazy)
	{
	if(xml == NULL \|\| xml->doc == NULL \|\| xml->doc->_private == NULL) {
	return FALSE;
	} else if (!pcmk_is_set(((xml_private_t *)xml->doc->_private)->flags,
	pcmk__xf_tracking)) {
	return FALSE;
	} else if (lazy && !pcmk_is_set(((xml_private_t *)xml->doc->_private)->flags,
	pcmk__xf_lazy)) {
	return FALSE;
	}
	return TRUE;
	}

	/*!
	* \internal
	* \brief Append spaces to a buffer
	*
	* Spaces are appended only if the \p xml_log_option_formatted flag is set.
	*
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the spaces (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static inline void
	insert_prefix(int options, GString *buffer, int depth)
	{
	int spaces = 0;

	if (!pcmk_is_set(options, xml_log_option_formatted)) {
	return;
	}
	CRM_ASSERT(buffer != NULL);
	CRM_CHECK(depth >= 0, depth = 0);

	/* With -O2, this loop is faster than one g_string_append_printf() call with
	* width == 2 * depth
	*/
	spaces = 2 * depth;
	for (int lpc = 0; lpc < spaces; lpc++) {
	g_string_append_c(buffer, ' ');
	}
	}

	static inline void
	set_parent_flag(xmlNode *xml, long flag)
	{
	for(; xml; xml = xml->parent) {
	xml_private_t *p = xml->_private;

	if(p == NULL) {
	/* During calls to xmlDocCopyNode(), _private will be unset for parent nodes */
	} else {
	pcmk__set_xml_flags(p, flag);
	}
	}
	}

	void
	pcmk__set_xml_doc_flag(xmlNode *xml, enum xml_private_flags flag)
	{
	if(xml && xml->doc && xml->doc->_private){
	/* During calls to xmlDocCopyNode(), xml->doc may be unset */
	xml_private_t *p = xml->doc->_private;

	pcmk__set_xml_flags(p, flag);
	}
	}

	// Mark document, element, and all element's parents as changed
	static inline void
	mark_xml_node_dirty(xmlNode *xml)
	{
	pcmk__set_xml_doc_flag(xml, pcmk__xf_dirty);
	set_parent_flag(xml, pcmk__xf_dirty);
	}

	// Clear flags on XML node and its children
	static void
	reset_xml_node_flags(xmlNode *xml)
	{
	xmlNode *cIter = NULL;
	xml_private_t *p = xml->_private;

	if (p) {
	p->flags = 0;
	}

	for (cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	reset_xml_node_flags(cIter);
	}
	}

	// Set xpf_created flag on XML node and any children
	void
	pcmk__mark_xml_created(xmlNode *xml)
	{
	xmlNode *cIter = NULL;
	xml_private_t *p = xml->_private;

	if (p && pcmk__tracking_xml_changes(xml, FALSE)) {
	if (!pcmk_is_set(p->flags, pcmk__xf_created)) {
	pcmk__set_xml_flags(p, pcmk__xf_created);
	mark_xml_node_dirty(xml);
	}
	for (cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	pcmk__mark_xml_created(cIter);
	}
	}
	}

	void
	pcmk__mark_xml_attr_dirty(xmlAttr *a)
	{
	xmlNode *parent = a->parent;
	xml_private_t *p = NULL;

	p = a->_private;
	pcmk__set_xml_flags(p, pcmk__xf_dirty\|pcmk__xf_modified);
	pcmk__clear_xml_flags(p, pcmk__xf_deleted);
	mark_xml_node_dirty(parent);
	}

	#define XML_PRIVATE_MAGIC (long) 0x81726354

	// Free an XML object previously marked as deleted
	static void
	free_deleted_object(void *data)
	{
	if(data) {
	pcmk__deleted_xml_t *deleted_obj = data;

	free(deleted_obj->path);
	free(deleted_obj);
	}
	}

	// Free and NULL user, ACLs, and deleted objects in an XML node's private data
	static void
	reset_xml_private_data(xml_private_t *p)
	{
	if(p) {
	CRM_ASSERT(p->check == XML_PRIVATE_MAGIC);

	free(p->user);
	p->user = NULL;

	if(p->acls) {
	pcmk__free_acls(p->acls);
	p->acls = NULL;
	}

	if(p->deleted_objs) {
	g_list_free_full(p->deleted_objs, free_deleted_object);
	p->deleted_objs = NULL;
	}
	}
	}

	// Free all private data associated with an XML node
	static void
	free_private_data(xmlNode *node)
	{
	/* need to explicitly avoid our custom _private field cleanup when
	called from internal XSLT cleanup (xsltApplyStylesheetInternal
	-> xsltFreeTransformContext -> xsltFreeRVTs -> xmlFreeDoc)
	onto result tree fragments, represented as standalone documents
	with otherwise infeasible space-prefixed name (xsltInternals.h:
	XSLT_MARK_RES_TREE_FRAG) and carrying it's own load at _private
	field -- later assert on the XML_PRIVATE_MAGIC would explode */
	if (node->type != XML_DOCUMENT_NODE \|\| node->name == NULL
	\|\| node->name[0] != ' ') {
	reset_xml_private_data(node->_private);
	free(node->_private);
	}
	}

	// Allocate and initialize private data for an XML node
	static void
	new_private_data(xmlNode *node)
	{
	xml_private_t *p = NULL;

	switch(node->type) {
	case XML_ELEMENT_NODE:
	case XML_DOCUMENT_NODE:
	case XML_ATTRIBUTE_NODE:
	case XML_COMMENT_NODE:
	p = calloc(1, sizeof(xml_private_t));
	p->check = XML_PRIVATE_MAGIC;
	/* Flags will be reset if necessary when tracking is enabled */
	pcmk__set_xml_flags(p, pcmk__xf_dirty\|pcmk__xf_created);
	node->_private = p;
	break;
	case XML_TEXT_NODE:
	case XML_DTD_NODE:
	case XML_CDATA_SECTION_NODE:
	break;
	default:
	/* Ignore */
	crm_trace("Ignoring %p %d", node, node->type);
	CRM_LOG_ASSERT(node->type == XML_ELEMENT_NODE);
	break;
	}

	if(p && pcmk__tracking_xml_changes(node, FALSE)) {
	/* XML_ELEMENT_NODE doesn't get picked up here, node->doc is
	* not hooked up at the point we are called
	*/
	mark_xml_node_dirty(node);
	}
	}

	void
	xml_track_changes(xmlNode * xml, const char user, xmlNode acl_source, bool enforce_acls)
	{
	xml_accept_changes(xml);
	crm_trace("Tracking changes%s to %p", enforce_acls?" with ACLs":"", xml);
	pcmk__set_xml_doc_flag(xml, pcmk__xf_tracking);
	if(enforce_acls) {
	if(acl_source == NULL) {
	acl_source = xml;
	}
	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_enabled);
	pcmk__unpack_acl(acl_source, xml, user);
	pcmk__apply_acl(xml);
	}
	}

	bool xml_tracking_changes(xmlNode * xml)
	{
	return (xml != NULL) && (xml->doc != NULL) && (xml->doc->_private != NULL)
	&& pcmk_is_set(((xml_private_t *)(xml->doc->_private))->flags,
	pcmk__xf_tracking);
	}

	bool xml_document_dirty(xmlNode *xml)
	{
	return (xml != NULL) && (xml->doc != NULL) && (xml->doc->_private != NULL)
	&& pcmk_is_set(((xml_private_t *)(xml->doc->_private))->flags,
	pcmk__xf_dirty);
	}

	/*!
	* \internal
	* \brief Return ordinal position of an XML node among its siblings
	*
	* \param[in] xml XML node to check
	* \param[in] ignore_if_set Don't count siblings with this flag set
	*
	* \return Ordinal position of \p xml (starting with 0)
	*/
	int
	pcmk__xml_position(xmlNode *xml, enum xml_private_flags ignore_if_set)
	{
	int position = 0;
	xmlNode *cIter = NULL;

	for(cIter = xml; cIter->prev; cIter = cIter->prev) {
	xml_private_t p = ((xmlNode)cIter->prev)->_private;

	if (!pcmk_is_set(p->flags, ignore_if_set)) {
	position++;
	}
	}

	return position;
	}

	// This also clears attribute's flags if not marked as deleted
	static bool
	marked_as_deleted(xmlAttrPtr a, void *user_data)
	{
	xml_private_t *p = a->_private;

	if (pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	return true;
	}
	p->flags = pcmk__xf_none;
	return false;
	}

	// Remove all attributes marked as deleted from an XML node
	static void
	accept_attr_deletions(xmlNode *xml)
	{
	// Clear XML node's flags
	((xml_private_t *) xml->_private)->flags = pcmk__xf_none;

	// Remove this XML node's attributes that were marked as deleted
	pcmk__xe_remove_matching_attrs(xml, marked_as_deleted, NULL);

	// Recursively do the same for this XML node's children
	for (xmlNodePtr cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	accept_attr_deletions(cIter);
	}
	}

	/*!
	* \internal
	* \brief Find first child XML node matching another given XML node
	*
	* \param[in] haystack XML whose children should be checked
	* \param[in] needle XML to match (comment content or element name and ID)
	* \param[in] exact If true and needle is a comment, position must match
	*/
	xmlNode *
	pcmk__xml_match(xmlNode haystack, xmlNode needle, bool exact)
	{
	CRM_CHECK(needle != NULL, return NULL);

	if (needle->type == XML_COMMENT_NODE) {
	return pcmk__xc_match(haystack, needle, exact);

	} else {
	const char *id = ID(needle);
	const char *attr = (id == NULL)? NULL : XML_ATTR_ID;

	return pcmk__xe_match(haystack, crm_element_name(needle), attr, id);
	}
	}

	void
	xml_log_changes(uint8_t log_level, const char function, xmlNode xml)
	{
	GList *gIter = NULL;
	xml_private_t *doc = NULL;

	if (log_level == LOG_NEVER) {
	return;
	}

	CRM_ASSERT(xml);
	CRM_ASSERT(xml->doc);

	doc = xml->doc->_private;
	if (!pcmk_is_set(doc->flags, pcmk__xf_dirty)) {
	return;
	}

	for(gIter = doc->deleted_objs; gIter; gIter = gIter->next) {
	pcmk__deleted_xml_t *deleted_obj = gIter->data;

	if (deleted_obj->position >= 0) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, "-- %s (%d)",
	deleted_obj->path, deleted_obj->position);

	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, "-- %s",
	deleted_obj->path);
	}
	}

	log_data_element(log_level, __FILE__, function, __LINE__, "+ ", xml, 0,
	xml_log_option_formatted\|xml_log_option_dirty_add);
	}

	void
	xml_accept_changes(xmlNode * xml)
	{
	xmlNode *top = NULL;
	xml_private_t *doc = NULL;

	if(xml == NULL) {
	return;
	}

	crm_trace("Accepting changes to %p", xml);
	doc = xml->doc->_private;
	top = xmlDocGetRootElement(xml->doc);

	reset_xml_private_data(xml->doc->_private);

	if (!pcmk_is_set(doc->flags, pcmk__xf_dirty)) {
	doc->flags = pcmk__xf_none;
	return;
	}

	doc->flags = pcmk__xf_none;
	accept_attr_deletions(top);
	}

	xmlNode *
	find_xml_node(const xmlNode root, const char search_path, gboolean must_find)
	{
	xmlNode *a_child = NULL;
	const char *name = "NULL";

	if (root != NULL) {
	name = crm_element_name(root);
	}

	if (search_path == NULL) {
	crm_warn("Will never find <NULL>");
	return NULL;
	}

	for (a_child = pcmk__xml_first_child(root); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	if (strcmp((const char *)a_child->name, search_path) == 0) {
	/* crm_trace("returning node (%s).", crm_element_name(a_child)); */
	return a_child;
	}
	}

	if (must_find) {
	crm_warn("Could not find %s in %s.", search_path, name);
	} else if (root != NULL) {
	crm_trace("Could not find %s in %s.", search_path, name);
	} else {
	crm_trace("Could not find %s in <NULL>.", search_path);
	}

	return NULL;
	}

	#define attr_matches(c, n, v) pcmk__str_eq(crm_element_value((c), (n)), \
	(v), pcmk__str_none)

	/*!
	* \internal
	* \brief Find first XML child element matching given criteria
	*
	* \param[in] parent XML element to search
	* \param[in] node_name If not NULL, only match children of this type
	* \param[in] attr_n If not NULL, only match children with an attribute
	* of this name and a value of \p attr_v
	* \param[in] attr_v If \p attr_n and this are not NULL, only match children
	* with an attribute named \p attr_n and this value
	*
	* \return Matching XML child element, or NULL if none found
	*/
	xmlNode *
	pcmk__xe_match(xmlNode parent, const char node_name,
	const char attr_n, const char attr_v)
	{
	/* ensure attr_v specified when attr_n is */
	CRM_CHECK(attr_n == NULL \|\| attr_v != NULL, return NULL);

	for (xmlNode *child = pcmk__xml_first_child(parent); child != NULL;
	child = pcmk__xml_next(child)) {
	if (pcmk__str_eq(node_name, (const char *) (child->name),
	pcmk__str_null_matches)
	&& ((attr_n == NULL) \|\| attr_matches(child, attr_n, attr_v))) {
	return child;
	}
	}
	crm_trace("XML child node <%s%s%s%s%s> not found in %s",
	(node_name? node_name : "(any)"),
	(attr_n? " " : ""),
	(attr_n? attr_n : ""),
	(attr_n? "=" : ""),
	(attr_n? attr_v : ""),
	crm_element_name(parent));
	return NULL;
	}

	void
	copy_in_properties(xmlNode * target, xmlNode * src)
	{
	if (src == NULL) {
	crm_warn("No node to copy properties from");

	} else if (target == NULL) {
	crm_err("No node to copy properties into");

	} else {
	for (xmlAttrPtr a = pcmk__xe_first_attr(src); a != NULL; a = a->next) {
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);

	expand_plus_plus(target, p_name, p_value);
	if (xml_acl_denied(target)) {
	crm_trace("Cannot copy %s=%s to %s", p_name, p_value, target->name);
	return;
	}
	}
	}

	return;
	}

	/*!
	* \brief Parse integer assignment statements on this node and all its child
	* nodes
	*
	* \param[in] target root XML node to be processed
	*
	* \note This function is recursive
	*/
	void
	fix_plus_plus_recursive(xmlNode * target)
	{
	/* TODO: Remove recursion and use xpath searches for value++ */
	xmlNode *child = NULL;

	for (xmlAttrPtr a = pcmk__xe_first_attr(target); a != NULL; a = a->next) {
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);

	expand_plus_plus(target, p_name, p_value);
	}
	for (child = pcmk__xml_first_child(target); child != NULL;
	child = pcmk__xml_next(child)) {
	fix_plus_plus_recursive(child);
	}
	}

	/*!
	* \brief Update current XML attribute value per parsed integer assignment
	statement
	*
	* \param[in,out] target an XML node, containing a XML attribute that is
	* initialized to some numeric value, to be processed
	* \param[in] name name of the XML attribute, e.g. X, whose value
	* should be updated
	* \param[in] value assignment statement, e.g. "X++" or
	* "X+=5", to be applied to the initialized value.
	*
	* \note The original XML attribute value is treated as 0 if non-numeric and
	* truncated to be an integer if decimal-point-containing.
	* \note The final XML attribute value is truncated to not exceed 1000000.
	* \note Undefined behavior if unexpected input.
	*/
	void
	expand_plus_plus(xmlNode * target, const char name, const char value)
	{
	int offset = 1;
	int name_len = 0;
	int int_value = 0;
	int value_len = 0;

	const char *old_value = NULL;

	if (target == NULL \|\| value == NULL \|\| name == NULL) {
	return;
	}

	old_value = crm_element_value(target, name);

	if (old_value == NULL) {
	/* if no previous value, set unexpanded */
	goto set_unexpanded;

	} else if (strstr(value, name) != value) {
	goto set_unexpanded;
	}

	name_len = strlen(name);
	value_len = strlen(value);
	if (value_len < (name_len + 2)
	\|\| value[name_len] != '+' \|\| (value[name_len + 1] != '+' && value[name_len + 1] != '=')) {
	goto set_unexpanded;
	}

	/* if we are expanding ourselves,
	* then no previous value was set and leave int_value as 0
	*/
	if (old_value != value) {
	int_value = char2score(old_value);
	}

	if (value[name_len + 1] != '+') {
	const char *offset_s = value + (name_len + 2);

	offset = char2score(offset_s);
	}
	int_value += offset;

	if (int_value > INFINITY) {
	int_value = (int)INFINITY;
	}

	crm_xml_add_int(target, name, int_value);
	return;

	set_unexpanded:
	if (old_value == value) {
	/* the old value is already set, nothing to do */
	return;
	}
	crm_xml_add(target, name, value);
	return;
	}

	/*!
	* \internal
	* \brief Remove an XML element's attributes that match some criteria
	*
	* \param[in,out] element XML element to modify
	* \param[in] match If not NULL, only remove attributes for which
	* this function returns true
	* \param[in] user_data Data to pass to \p match
	*/
	void
	pcmk__xe_remove_matching_attrs(xmlNode *element,
	bool (match)(xmlAttrPtr, void ),
	void *user_data)
	{
	xmlAttrPtr next = NULL;

	for (xmlAttrPtr a = pcmk__xe_first_attr(element); a != NULL; a = next) {
	next = a->next; // Grab now because attribute might get removed
	if ((match == NULL) \|\| match(a, user_data)) {
	if (!pcmk__check_acl(element, NULL, pcmk__xf_acl_write)) {
	crm_trace("ACLs prevent removal of attributes (%s and "
	"possibly others) from %s element",
	(const char ) a->name, (const char ) element->name);
	return; // ACLs apply to element, not particular attributes
	}

	if (pcmk__tracking_xml_changes(element, false)) {
	// Leave (marked for removal) until after diff is calculated
	set_parent_flag(element, pcmk__xf_dirty);
	pcmk__set_xml_flags((xml_private_t *) a->_private,
	pcmk__xf_deleted);
	} else {
	xmlRemoveProp(a);
	}
	}
	}
	}

	xmlDoc *
	getDocPtr(xmlNode * node)
	{
	xmlDoc *doc = NULL;

	CRM_CHECK(node != NULL, return NULL);

	doc = node->doc;
	if (doc == NULL) {
	doc = xmlNewDoc((pcmkXmlStr) "1.0");
	xmlDocSetRootElement(doc, node);
	xmlSetTreeDoc(node, doc);
	}
	return doc;
	}

	xmlNode *
	add_node_copy(xmlNode * parent, xmlNode * src_node)
	{
	xmlNode *child = NULL;
	xmlDoc *doc = getDocPtr(parent);

	CRM_CHECK(src_node != NULL, return NULL);

	child = xmlDocCopyNode(src_node, doc, 1);
	xmlAddChild(parent, child);
	pcmk__mark_xml_created(child);
	return child;
	}

	int
	add_node_nocopy(xmlNode * parent, const char name, xmlNode child)
	{
	add_node_copy(parent, child);
	free_xml(child);
	return 1;
	}

	xmlNode *
	create_xml_node(xmlNode * parent, const char *name)
	{
	xmlDoc *doc = NULL;
	xmlNode *node = NULL;

	if (pcmk__str_empty(name)) {
	CRM_CHECK(name != NULL && name[0] == 0, return NULL);
	return NULL;
	}

	if (parent == NULL) {
	doc = xmlNewDoc((pcmkXmlStr) "1.0");
	node = xmlNewDocRawNode(doc, NULL, (pcmkXmlStr) name, NULL);
	xmlDocSetRootElement(doc, node);

	} else {
	doc = getDocPtr(parent);
	node = xmlNewDocRawNode(doc, NULL, (pcmkXmlStr) name, NULL);
	xmlAddChild(parent, node);
	}
	pcmk__mark_xml_created(node);
	return node;
	}

	xmlNode *
	pcmk_create_xml_text_node(xmlNode * parent, const char name, const char content)
	{
	xmlNode *node = create_xml_node(parent, name);

	if (node != NULL) {
	xmlNodeSetContent(node, (pcmkXmlStr) content);
	}

	return node;
	}

	xmlNode *
	pcmk_create_html_node(xmlNode * parent, const char element_name, const char id,
	const char class_name, const char text)
	{
	xmlNode *node = pcmk_create_xml_text_node(parent, element_name, text);

	if (class_name != NULL) {
	crm_xml_add(node, "class", class_name);
	}

	if (id != NULL) {
	crm_xml_add(node, "id", id);
	}

	return node;
	}

	/*!
	* Free an XML element and all of its children, removing it from its parent
	*
	* \param[in] xml XML element to free
	*/
	void
	pcmk_free_xml_subtree(xmlNode *xml)
	{
	xmlUnlinkNode(xml); // Detaches from parent and siblings
	xmlFreeNode(xml); // Frees
	}

	static void
	free_xml_with_position(xmlNode * child, int position)
	{
	if (child != NULL) {
	xmlNode *top = NULL;
	xmlDoc *doc = child->doc;
	xml_private_t *p = child->_private;

	if (doc != NULL) {
	top = xmlDocGetRootElement(doc);
	}

	if (doc != NULL && top == child) {
	/* Free everything */
	xmlFreeDoc(doc);

	} else if (pcmk__check_acl(child, NULL, pcmk__xf_acl_write) == FALSE) {
	GString *xpath = NULL;

	pcmk__log_else(LOG_TRACE, return);
	xpath = pcmk__element_xpath(child);
	qb_log_from_external_source(__func__, __FILE__,
	"Cannot remove %s %x", LOG_TRACE,
	__LINE__, 0, (const char *) xpath->str,
	p->flags);
	g_string_free(xpath, TRUE);
	return;

	} else {
	if (doc && pcmk__tracking_xml_changes(child, FALSE)
	&& !pcmk_is_set(p->flags, pcmk__xf_created)) {

	GString *xpath = pcmk__element_xpath(child);

	if (xpath != NULL) {
	pcmk__deleted_xml_t *deleted_obj = NULL;

	crm_trace("Deleting %s %p from %p",
	(const char *) xpath->str, child, doc);

	deleted_obj = calloc(1, sizeof(pcmk__deleted_xml_t));
	deleted_obj->path = strdup((const char *) xpath->str);

	CRM_ASSERT(deleted_obj->path != NULL);
	g_string_free(xpath, TRUE);

	deleted_obj->position = -1;
	/* Record the "position" only for XML comments for now */
	if (child->type == XML_COMMENT_NODE) {
	if (position >= 0) {
	deleted_obj->position = position;

	} else {
	deleted_obj->position = pcmk__xml_position(child,
	pcmk__xf_skip);
	}
	}

	p = doc->_private;
	p->deleted_objs = g_list_append(p->deleted_objs, deleted_obj);
	pcmk__set_xml_doc_flag(child, pcmk__xf_dirty);
	}
	}
	pcmk_free_xml_subtree(child);
	}
	}
	}


	void
	free_xml(xmlNode * child)
	{
	free_xml_with_position(child, -1);
	}

	xmlNode *
	copy_xml(xmlNode * src)
	{
	xmlDoc *doc = xmlNewDoc((pcmkXmlStr) "1.0");
	xmlNode *copy = xmlDocCopyNode(src, doc, 1);

	xmlDocSetRootElement(doc, copy);
	xmlSetTreeDoc(copy, doc);
	return copy;
	}

	static void
	log_xmllib_err(void ctx, const char fmt, ...)
	G_GNUC_PRINTF(2, 3);

	// Log an XML library error
	static void
	log_xmllib_err(void ctx, const char fmt, ...)
	{
	va_list ap;
	static struct qb_log_callsite *xml_error_cs = NULL;

	if (xml_error_cs == NULL) {
	xml_error_cs = qb_log_callsite_get(
	__func__, __FILE__, "xml library error", LOG_TRACE, __LINE__, crm_trace_nonlog);
	}

	va_start(ap, fmt);
	if (xml_error_cs && xml_error_cs->targets) {
	PCMK__XML_LOG_BASE(LOG_ERR, TRUE,
	crm_abort(__FILE__, __PRETTY_FUNCTION__, __LINE__, "xml library error",
	TRUE, TRUE),
	"XML Error: ", fmt, ap);
	} else {
	PCMK__XML_LOG_BASE(LOG_ERR, TRUE, 0, "XML Error: ", fmt, ap);
	}
	va_end(ap);
	}

	xmlNode *
	string2xml(const char *input)
	{
	xmlNode *xml = NULL;
	xmlDocPtr output = NULL;
	xmlParserCtxtPtr ctxt = NULL;
	xmlErrorPtr last_error = NULL;

	if (input == NULL) {
	crm_err("Can't parse NULL input");
	return NULL;
	}

	/* create a parser context */
	ctxt = xmlNewParserCtxt();
	CRM_CHECK(ctxt != NULL, return NULL);

	xmlCtxtResetLastError(ctxt);
	xmlSetGenericErrorFunc(ctxt, log_xmllib_err);
	output = xmlCtxtReadDoc(ctxt, (pcmkXmlStr) input, NULL, NULL,
	PCMK__XML_PARSE_OPTS);
	if (output) {
	xml = xmlDocGetRootElement(output);
	}
	last_error = xmlCtxtGetLastError(ctxt);
	if (last_error && last_error->code != XML_ERR_OK) {
	/* crm_abort(__FILE__,__func__,__LINE__, "last_error->code != XML_ERR_OK", TRUE, TRUE); */
	/*
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlErrorLevel
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlParserErrors
	*/
	crm_warn("Parsing failed (domain=%d, level=%d, code=%d): %s",
	last_error->domain, last_error->level, last_error->code, last_error->message);

	if (last_error->code == XML_ERR_DOCUMENT_EMPTY) {
	CRM_LOG_ASSERT("Cannot parse an empty string");

	} else if (last_error->code != XML_ERR_DOCUMENT_END) {
	crm_err("Couldn't%s parse %d chars: %s", xml ? " fully" : "", (int)strlen(input),
	input);
	if (xml != NULL) {
	crm_log_xml_err(xml, "Partial");
	}

	} else {
	int len = strlen(input);
	int lpc = 0;

	while(lpc < len) {
	crm_warn("Parse error[+%.3d]: %.80s", lpc, input+lpc);
	lpc += 80;
	}

	CRM_LOG_ASSERT("String parsing error");
	}
	}

	xmlFreeParserCtxt(ctxt);
	return xml;
	}

	xmlNode *
	stdin2xml(void)
	{
	size_t data_length = 0;
	size_t read_chars = 0;

	char *xml_buffer = NULL;
	xmlNode *xml_obj = NULL;

	do {
	xml_buffer = pcmk__realloc(xml_buffer, data_length + PCMK__BUFFER_SIZE);
	read_chars = fread(xml_buffer + data_length, 1, PCMK__BUFFER_SIZE,
	stdin);
	data_length += read_chars;
	} while (read_chars == PCMK__BUFFER_SIZE);

	if (data_length == 0) {
	crm_warn("No XML supplied on stdin");
	free(xml_buffer);
	return NULL;
	}

	xml_buffer[data_length] = '\0';
	xml_obj = string2xml(xml_buffer);
	free(xml_buffer);

	crm_log_xml_trace(xml_obj, "Created fragment");
	return xml_obj;
	}

	static char *
	decompress_file(const char *filename)
	{
	char *buffer = NULL;
	int rc = 0;
	size_t length = 0, read_len = 0;
	BZFILE *bz_file = NULL;
	FILE *input = fopen(filename, "r");

	if (input == NULL) {
	crm_perror(LOG_ERR, "Could not open %s for reading", filename);
	return NULL;
	}

	bz_file = BZ2_bzReadOpen(&rc, input, 0, 0, NULL, 0);
	if (rc != BZ_OK) {
	crm_err("Could not prepare to read compressed %s: %s "
	CRM_XS " bzerror=%d", filename, bz2_strerror(rc), rc);
	BZ2_bzReadClose(&rc, bz_file);
	fclose(input);
	return NULL;
	}

	rc = BZ_OK;
	// cppcheck seems not to understand the abort-logic in pcmk__realloc
	// cppcheck-suppress memleak
	while (rc == BZ_OK) {
	buffer = pcmk__realloc(buffer, PCMK__BUFFER_SIZE + length + 1);
	read_len = BZ2_bzRead(&rc, bz_file, buffer + length, PCMK__BUFFER_SIZE);

	crm_trace("Read %ld bytes from file: %d", (long)read_len, rc);

	if (rc == BZ_OK \|\| rc == BZ_STREAM_END) {
	length += read_len;
	}
	}

	buffer[length] = '\0';

	if (rc != BZ_STREAM_END) {
	crm_err("Could not read compressed %s: %s "
	CRM_XS " bzerror=%d", filename, bz2_strerror(rc), rc);
	free(buffer);
	buffer = NULL;
	}

	BZ2_bzReadClose(&rc, bz_file);
	fclose(input);
	return buffer;
	}

	/*!
	* \internal
	* \brief Remove XML text nodes from specified XML and all its children
	*
	* \param[in,out] xml XML to strip text from
	*/
	void
	pcmk__strip_xml_text(xmlNode *xml)
	{
	xmlNode *iter = xml->children;

	while (iter) {
	xmlNode *next = iter->next;

	switch (iter->type) {
	case XML_TEXT_NODE:
	/* Remove it */
	pcmk_free_xml_subtree(iter);
	break;

	case XML_ELEMENT_NODE:
	/* Search it */
	pcmk__strip_xml_text(iter);
	break;

	default:
	/* Leave it */
	break;
	}

	iter = next;
	}
	}

	xmlNode *
	filename2xml(const char *filename)
	{
	xmlNode *xml = NULL;
	xmlDocPtr output = NULL;
	bool uncompressed = true;
	xmlParserCtxtPtr ctxt = NULL;
	xmlErrorPtr last_error = NULL;

	/* create a parser context */
	ctxt = xmlNewParserCtxt();
	CRM_CHECK(ctxt != NULL, return NULL);

	xmlCtxtResetLastError(ctxt);
	xmlSetGenericErrorFunc(ctxt, log_xmllib_err);

	if (filename) {
	uncompressed = !pcmk__ends_with_ext(filename, ".bz2");
	}

	if (pcmk__str_eq(filename, "-", pcmk__str_null_matches)) {
	/* STDIN_FILENO == fileno(stdin) */
	output = xmlCtxtReadFd(ctxt, STDIN_FILENO, "unknown.xml", NULL,
	PCMK__XML_PARSE_OPTS);

	} else if (uncompressed) {
	output = xmlCtxtReadFile(ctxt, filename, NULL, PCMK__XML_PARSE_OPTS);

	} else {
	char *input = decompress_file(filename);

	output = xmlCtxtReadDoc(ctxt, (pcmkXmlStr) input, NULL, NULL,
	PCMK__XML_PARSE_OPTS);
	free(input);
	}

	if (output && (xml = xmlDocGetRootElement(output))) {
	pcmk__strip_xml_text(xml);
	}

	last_error = xmlCtxtGetLastError(ctxt);
	if (last_error && last_error->code != XML_ERR_OK) {
	/* crm_abort(__FILE__,__func__,__LINE__, "last_error->code != XML_ERR_OK", TRUE, TRUE); */
	/*
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlErrorLevel
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlParserErrors
	*/
	crm_err("Parsing failed (domain=%d, level=%d, code=%d): %s",
	last_error->domain, last_error->level, last_error->code, last_error->message);

	if (last_error && last_error->code != XML_ERR_OK) {
	crm_err("Couldn't%s parse %s", xml ? " fully" : "", filename);
	if (xml != NULL) {
	crm_log_xml_err(xml, "Partial");
	}
	}
	}

	xmlFreeParserCtxt(ctxt);
	return xml;
	}

	/*!
	* \internal
	* \brief Add a "last written" attribute to an XML element, set to current time
	*
	* \param[in] xe XML element to add attribute to
	*
	* \return Value that was set, or NULL on error
	*/
	const char *
	pcmk__xe_add_last_written(xmlNode *xe)
	{
	const char *now_str = pcmk__epoch2str(NULL);

	return crm_xml_add(xe, XML_CIB_ATTR_WRITTEN,
	now_str ? now_str : "Could not determine current time");
	}

	/*!
	* \brief Sanitize a string so it is usable as an XML ID
	*
	* \param[in,out] id String to sanitize
	*/
	void
	crm_xml_sanitize_id(char *id)
	{
	char *c;

	for (c = id; *c; ++c) {
	/* @TODO Sanitize more comprehensively */
	switch (*c) {
	case ':':
	case '#':
	*c = '.';
	}
	}
	}

	/*!
	* \brief Set the ID of an XML element using a format
	*
	* \param[in,out] xml XML element
	* \param[in] fmt printf-style format
	* \param[in] ... any arguments required by format
	*/
	void
	crm_xml_set_id(xmlNode xml, const char format, ...)
	{
	va_list ap;
	int len = 0;
	char *id = NULL;

	/* equivalent to crm_strdup_printf() */
	va_start(ap, format);
	len = vasprintf(&id, format, ap);
	va_end(ap);
	CRM_ASSERT(len > 0);

	crm_xml_sanitize_id(id);
	crm_xml_add(xml, XML_ATTR_ID, id);
	free(id);
	}

	/*!
	* \internal
	* \brief Write XML to a file stream
	*
	* \param[in] xml_node XML to write
	* \param[in] filename Name of file being written (for logging only)
	* \param[in] stream Open file stream corresponding to filename
	* \param[in] compress Whether to compress XML before writing
	* \param[out] nbytes Number of bytes written
	*
	* \return Standard Pacemaker return code
	*/
	static int
	write_xml_stream(xmlNode xml_node, const char filename, FILE *stream,
	bool compress, unsigned int *nbytes)
	{
	int rc = pcmk_rc_ok;
	char *buffer = NULL;

	*nbytes = 0;
	crm_log_xml_trace(xml_node, "writing");

	buffer = dump_xml_formatted(xml_node);
	CRM_CHECK(buffer && strlen(buffer),
	crm_log_xml_warn(xml_node, "formatting failed");
	rc = pcmk_rc_error;
	goto bail);

	if (compress) {
	unsigned int in = 0;
	BZFILE *bz_file = NULL;

	rc = BZ_OK;
	bz_file = BZ2_bzWriteOpen(&rc, stream, 5, 0, 30);
	if (rc != BZ_OK) {
	crm_warn("Not compressing %s: could not prepare file stream: %s "
	CRM_XS " bzerror=%d", filename, bz2_strerror(rc), rc);
	} else {
	BZ2_bzWrite(&rc, bz_file, buffer, strlen(buffer));
	if (rc != BZ_OK) {
	crm_warn("Not compressing %s: could not compress data: %s "
	CRM_XS " bzerror=%d errno=%d",
	filename, bz2_strerror(rc), rc, errno);
	}
	}

	if (rc == BZ_OK) {
	BZ2_bzWriteClose(&rc, bz_file, 0, &in, nbytes);
	if (rc != BZ_OK) {
	crm_warn("Not compressing %s: could not write compressed data: %s "
	CRM_XS " bzerror=%d errno=%d",
	filename, bz2_strerror(rc), rc, errno);
	*nbytes = 0; // retry without compression
	} else {
	crm_trace("Compressed XML for %s from %u bytes to %u",
	filename, in, *nbytes);
	}
	}
	rc = pcmk_rc_ok; // Either true, or we'll retry without compression
	}

	if (*nbytes == 0) {
	rc = fprintf(stream, "%s", buffer);
	if (rc < 0) {
	rc = errno;
	crm_perror(LOG_ERR, "writing %s", filename);
	} else {
	*nbytes = (unsigned int) rc;
	rc = pcmk_rc_ok;
	}
	}

	bail:

	if (fflush(stream) != 0) {
	rc = errno;
	crm_perror(LOG_ERR, "flushing %s", filename);
	}

	/* Don't report error if the file does not support synchronization */
	if (fsync(fileno(stream)) < 0 && errno != EROFS && errno != EINVAL) {
	rc = errno;
	crm_perror(LOG_ERR, "synchronizing %s", filename);
	}

	fclose(stream);

	crm_trace("Saved %d bytes to %s as XML", *nbytes, filename);
	free(buffer);

	return rc;
	}

	/*!
	* \brief Write XML to a file descriptor
	*
	* \param[in] xml_node XML to write
	* \param[in] filename Name of file being written (for logging only)
	* \param[in] fd Open file descriptor corresponding to filename
	* \param[in] compress Whether to compress XML before writing
	*
	* \return Number of bytes written on success, -errno otherwise
	*/
	int
	write_xml_fd(xmlNode * xml_node, const char *filename, int fd, gboolean compress)
	{
	FILE *stream = NULL;
	unsigned int nbytes = 0;
	int rc = pcmk_rc_ok;

	CRM_CHECK(xml_node && (fd > 0), return -EINVAL);
	stream = fdopen(fd, "w");
	if (stream == NULL) {
	return -errno;
	}
	rc = write_xml_stream(xml_node, filename, stream, compress, &nbytes);
	if (rc != pcmk_rc_ok) {
	return pcmk_rc2legacy(rc);
	}
	return (int) nbytes;
	}

	/*!
	* \brief Write XML to a file
	*
	* \param[in] xml_node XML to write
	* \param[in] filename Name of file to write
	* \param[in] compress Whether to compress XML before writing
	*
	* \return Number of bytes written on success, -errno otherwise
	*/
	int
	write_xml_file(xmlNode * xml_node, const char *filename, gboolean compress)
	{
	FILE *stream = NULL;
	unsigned int nbytes = 0;
	int rc = pcmk_rc_ok;

	CRM_CHECK(xml_node && filename, return -EINVAL);
	stream = fopen(filename, "w");
	if (stream == NULL) {
	return -errno;
	}
	rc = write_xml_stream(xml_node, filename, stream, compress, &nbytes);
	if (rc != pcmk_rc_ok) {
	return pcmk_rc2legacy(rc);
	}
	return (int) nbytes;
	}

	// Replace a portion of a dynamically allocated string (reallocating memory)
	static char *
	replace_text(char text, int start, size_t length, const char *replace)
	{
	size_t offset = strlen(replace) - 1; // We have space for 1 char already

	*length += offset;
	text = pcmk__realloc(text, *length);

	for (size_t lpc = (*length) - 1; lpc > (start + offset); lpc--) {
	text[lpc] = text[lpc - offset];
	}

	memcpy(text + start, replace, offset + 1);
	return text;
	}

	/*!
	* \brief Replace special characters with their XML escape sequences
	*
	* \param[in] text Text to escape
	*
	* \return Newly allocated string equivalent to \p text but with special
	* characters replaced with XML escape sequences (or NULL if \p text
	* is NULL)
	*/
	char *
	crm_xml_escape(const char *text)
	{
	size_t length;
	char *copy;

	/*
	* When xmlCtxtReadDoc() parses < and friends in a
	* value, it converts them to their human readable
	* form.
	*
	* If one uses xmlNodeDump() to convert it back to a
	* string, all is well, because special characters are
	* converted back to their escape sequences.
	*
	* However xmlNodeDump() is randomly dog slow, even with the same
	* input. So we need to replicate the escaping in our custom
	* version so that the result can be re-parsed by xmlCtxtReadDoc()
	* when necessary.
	*/

	if (text == NULL) {
	return NULL;
	}

	length = 1 + strlen(text);
	copy = strdup(text);
	CRM_ASSERT(copy != NULL);
	for (size_t index = 0; index < length; index++) {
	if(copy[index] & 0x80 && copy[index+1] & 0x80){
	index++;
	break;
	}
	switch (copy[index]) {
	case 0:
	break;
	case '<':
	copy = replace_text(copy, index, &length, "<");
	break;
	case '>':
	copy = replace_text(copy, index, &length, ">");
	break;
	case '"':
	copy = replace_text(copy, index, &length, """);
	break;
	case '\'':
	copy = replace_text(copy, index, &length, "'");
	break;
	case '&':
	copy = replace_text(copy, index, &length, "&");
	break;
	case '\t':
	/* Might as well just expand to a few spaces... */
	copy = replace_text(copy, index, &length, " ");
	break;
	case '\n':
	copy = replace_text(copy, index, &length, "\\n");
	break;
	case '\r':
	copy = replace_text(copy, index, &length, "\\r");
	break;
	default:
	/* Check for and replace non-printing characters with their octal equivalent */
	if(copy[index] < ' ' \|\| copy[index] > '~') {
	char *replace = crm_strdup_printf("\\%.3o", copy[index]);

	copy = replace_text(copy, index, &length, replace);
	free(replace);
	}
	}
	}
	return copy;
	}

	/* Keep this inline. De-inlining resulted in a 0.6% average slowdown in
	* crm_simulate on cts/scheduler/xml during testing.
	*/

	/*!
	* \internal
	* \brief Append an XML attribute to a buffer
	*
	* \param[in] attr Attribute to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	*/
	static inline void
	dump_xml_attr(const xmlAttr attr, int options, GString buffer)
	{
	char *p_value = NULL;
	const char *p_name = NULL;
	xml_private_t *p = NULL;

	CRM_ASSERT(buffer != NULL);
	if (attr == NULL \|\| attr->children == NULL) {
	return;
	}

	p = attr->_private;
	if (p && pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	return;
	}

	p_name = (const char *) attr->name;
	p_value = crm_xml_escape((const char *)attr->children->content);
	- g_string_append_printf(buffer, " %s=\"%s\"", p_name,
	- pcmk__s(p_value, "<null>"));
	+ pcmk__g_strcat(buffer, " ", p_name, "=\"", pcmk__s(p_value, "<null>"), "\"",
	+ NULL);

	free(p_value);
	}

	// Log an XML element or comment (and any children) in a formatted way
	static void
	log_xml_node_and_children(GString buffer, int log_level, const char file,
	const char function, int line, const char prefix,
	const xmlNode *data, int depth, int options)
	{
	const char *name = NULL;
	const char *hidden = NULL;

	xmlNode *child = NULL;

	CRM_ASSERT(buffer != NULL);

	if ((data == NULL) \|\| (log_level == LOG_NEVER)
	\|\| ((data->type != XML_COMMENT_NODE)
	&& (data->type != XML_ELEMENT_NODE))) {
	return;
	}

	name = crm_element_name(data);

	g_string_truncate(buffer, 0);

	if (pcmk_is_set(options, xml_log_option_open)) {
	insert_prefix(options, buffer, depth);

	if (data->type == XML_COMMENT_NODE) {
	- g_string_append_printf(buffer, "<!--%s-->",
	- (const gchar *) data->content);
	+ pcmk__g_strcat(buffer, "<!--", (const char *) data->content, "-->",
	+ NULL);

	} else {
	- g_string_append_printf(buffer, "<%s", name);
	+ pcmk__g_strcat(buffer, "<", name, NULL);

	hidden = crm_element_value(data, "hidden");
	for (xmlAttrPtr a = pcmk__xe_first_attr(data); a != NULL;
	a = a->next) {

	xml_private_t *p = a->_private;
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);
	char *p_copy = NULL;

	if (pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	continue;
	} else if (pcmk_any_flags_set(options,
	xml_log_option_diff_plus
	\|xml_log_option_diff_minus)
	&& (strcmp(XML_DIFF_MARKER, p_name) == 0)) {
	continue;

	} else if (hidden != NULL && p_name[0] != 0 && strstr(hidden, p_name) != NULL) {
	p_copy = strdup("*****");

	} else {
	p_copy = crm_xml_escape(p_value);
	}

	- g_string_append_printf(buffer, " %s=\"%s\"", p_name,
	- pcmk__s(p_copy, "<null>"));
	+ pcmk__g_strcat(buffer, " ", p_name, "=\"",
	+ pcmk__s(p_copy, "<null>"), "\"", NULL);
	free(p_copy);
	}

	if(xml_has_children(data) == FALSE) {
	g_string_append(buffer, "/>");

	} else if (pcmk_is_set(options, xml_log_option_children)) {
	g_string_append_c(buffer, '>');

	} else {
	g_string_append(buffer, "/>");
	}
	}

	do_crm_log_alias(log_level, file, function, line, "%s %s", prefix,
	(const char *) buffer->str);
	}

	if(data->type == XML_COMMENT_NODE) {
	return;

	} else if(xml_has_children(data) == FALSE) {
	return;

	} else if (pcmk_is_set(options, xml_log_option_children)) {
	for (child = pcmk__xml_first_child(data); child != NULL;
	child = pcmk__xml_next(child)) {

	log_xml_node_and_children(buffer, log_level, file, function, line,
	prefix, child, depth + 1,
	options\|xml_log_option_open
	\|xml_log_option_close);
	}
	}

	if (pcmk_is_set(options, xml_log_option_close)) {
	g_string_truncate(buffer, 0);

	insert_prefix(options, buffer, depth);
	- g_string_append_printf(buffer, "</%s>", name);
	+ pcmk__g_strcat(buffer, "</", name, ">", NULL);

	do_crm_log_alias(log_level, file, function, line, "%s %s", prefix,
	(const char *) buffer->str);
	}
	}

	// Log an XML element or comment (and any children) in a formatted way
	void
	pcmk__xml_log(int log_level, const char file, const char function, int line,
	const char prefix, const xmlNode data, int depth, int options)
	{
	/* Allocate a buffer once, for log_xml_node_and_children() to truncate and
	* reuse in recursive calls
	*/
	GString *buffer = g_string_sized_new(1024);

	log_xml_node_and_children(buffer, log_level, file, function, line, prefix,
	data, depth, options);

	g_string_free(buffer, TRUE);
	}

	// Log XML portions that have been marked as changed
	static void
	log_xml_changes(int log_level, const char file, const char function, int line,
	const char prefix, const xmlNode data, int depth, int options)
	{
	xml_private_t *p;
	char *prefix_m = NULL;
	xmlNode *child = NULL;

	if ((data == NULL) \|\| (log_level == LOG_NEVER)) {
	return;
	}

	p = data->_private;

	prefix_m = strdup(prefix);
	prefix_m[1] = '+';

	if (pcmk_all_flags_set(p->flags, pcmk__xf_dirty\|pcmk__xf_created)) {
	/* Continue and log full subtree */
	pcmk__xml_log(log_level, file, function, line, prefix_m, data, depth,
	options\|xml_log_option_open\|xml_log_option_close
	\|xml_log_option_children);

	} else if (pcmk_is_set(p->flags, pcmk__xf_dirty)) {
	int spaces = 0;
	char *prefix_del = NULL;
	char *prefix_moved = NULL;
	const char *flags = prefix;

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	CRM_CHECK(depth >= 0, depth = 0);
	spaces = 2 * depth;
	}

	prefix_del = strdup(prefix);
	prefix_del[0] = '-';
	prefix_del[1] = '-';
	prefix_moved = strdup(prefix);
	prefix_moved[1] = '~';

	if (pcmk_is_set(p->flags, pcmk__xf_moved)) {
	flags = prefix_moved;
	} else {
	flags = prefix;
	}

	pcmk__xml_log(log_level, file, function, line, flags, data, depth,
	options\|xml_log_option_open);

	for (xmlAttrPtr a = pcmk__xe_first_attr(data); a != NULL; a = a->next) {
	const char aname = (const char) a->name;

	p = a->_private;
	if (pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	const char *value = crm_element_value(data, aname);
	flags = prefix_del;
	do_crm_log_alias(log_level, file, function, line,
	"%s %*s @%s=%s", flags, spaces, "", aname,
	value);

	} else if (pcmk_is_set(p->flags, pcmk__xf_dirty)) {
	const char *value = crm_element_value(data, aname);

	if (pcmk_is_set(p->flags, pcmk__xf_created)) {
	flags = prefix_m;

	} else if (pcmk_is_set(p->flags, pcmk__xf_modified)) {
	flags = prefix;

	} else if (pcmk_is_set(p->flags, pcmk__xf_moved)) {
	flags = prefix_moved;

	} else {
	flags = prefix;
	}
	do_crm_log_alias(log_level, file, function, line,
	"%s %*s @%s=%s", flags, spaces, "", aname,
	value);
	}
	}
	free(prefix_moved);
	free(prefix_del);

	for (child = pcmk__xml_first_child(data); child != NULL;
	child = pcmk__xml_next(child)) {
	log_xml_changes(log_level, file, function, line, prefix, child,
	depth + 1, options);
	}

	pcmk__xml_log(log_level, file, function, line, prefix, data, depth,
	options\|xml_log_option_close);

	} else {
	for (child = pcmk__xml_first_child(data); child != NULL;
	child = pcmk__xml_next(child)) {
	log_xml_changes(log_level, file, function, line, prefix, child,
	depth + 1, options);
	}
	}

	free(prefix_m);

	}

	void
	log_data_element(int log_level, const char file, const char function,
	int line, const char prefix, const xmlNode data, int depth,
	int options)
	{
	xmlNode *a_child = NULL;

	char *prefix_m = NULL;

	if (log_level == LOG_NEVER) {
	return;
	}

	if (prefix == NULL) {
	prefix = "";
	}

	/* Since we use the same file and line, to avoid confusing libqb, we need to use the same format strings */
	if (data == NULL) {
	do_crm_log_alias(log_level, file, function, line, "%s: %s", prefix,
	"No data to dump as XML");
	return;
	}

	if (pcmk_is_set(options, xml_log_option_dirty_add)) {
	log_xml_changes(log_level, file, function, line, prefix, data, depth,
	options);
	return;
	}

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	if (pcmk_is_set(options, xml_log_option_diff_plus)
	&& (data->children == NULL \|\| crm_element_value(data, XML_DIFF_MARKER))) {
	options \|= xml_log_option_diff_all;
	prefix_m = strdup(prefix);
	prefix_m[1] = '+';
	prefix = prefix_m;

	} else if (pcmk_is_set(options, xml_log_option_diff_minus)
	&& (data->children == NULL \|\| crm_element_value(data, XML_DIFF_MARKER))) {
	options \|= xml_log_option_diff_all;
	prefix_m = strdup(prefix);
	prefix_m[1] = '-';
	prefix = prefix_m;
	}
	}

	if (pcmk_is_set(options, xml_log_option_diff_short)
	&& !pcmk_is_set(options, xml_log_option_diff_all)) {
	/* Still searching for the actual change */
	for (a_child = pcmk__xml_first_child(data); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	log_data_element(log_level, file, function, line, prefix, a_child, depth + 1, options);
	}
	} else {
	pcmk__xml_log(log_level, file, function, line, prefix, data, depth,
	options\|xml_log_option_open\|xml_log_option_close
	\|xml_log_option_children);
	}
	free(prefix_m);
	}

	/*!
	* \internal
	* \brief Append filtered XML attributes to a buffer
	*
	* \param[in] data XML element whose attributes to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	*/
	static void
	dump_filtered_xml(const xmlNode data, int options, GString buffer)
	{
	CRM_ASSERT(buffer != NULL);

	for (const xmlAttr *a = pcmk__xe_first_attr(data); a != NULL; a = a->next) {
	if (!pcmk__xa_filterable((const char *) (a->name))) {
	dump_xml_attr(a, options, buffer);
	}
	}
	}

	/*!
	* \internal
	* \brief Append a string representation of an XML element to a buffer
	*
	* \param[in] data XML whose representation to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_element(const xmlNode data, int options, GString buffer, int depth)
	{
	const char *name = NULL;

	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	name = crm_element_name(data);
	CRM_ASSERT(name != NULL);

	insert_prefix(options, buffer, depth);
	- g_string_append_printf(buffer, "<%s", name);
	+ pcmk__g_strcat(buffer, "<", name, NULL);

	if (options & xml_log_option_filtered) {
	dump_filtered_xml(data, options, buffer);

	} else {
	for (const xmlAttr *a = pcmk__xe_first_attr(data); a != NULL;
	a = a->next) {

	dump_xml_attr(a, options, buffer);
	}
	}

	if (data->children == NULL) {
	g_string_append(buffer, "/>");

	} else {
	g_string_append_c(buffer, '>');
	}

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}

	if (data->children) {
	xmlNode *xChild = NULL;
	for(xChild = data->children; xChild != NULL; xChild = xChild->next) {
	pcmk__xml2text(xChild, options, buffer, depth + 1);
	}

	insert_prefix(options, buffer, depth);
	- g_string_append_printf(buffer, "</%s>", name);
	+ pcmk__g_strcat(buffer, "</", name, ">", NULL);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}
	}

	/*!
	* \internal
	* \brief Append XML text content to a buffer
	*
	* \param[in] data XML whose content to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_text(const xmlNode data, int options, GString buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	insert_prefix(options, buffer, depth);
	g_string_append(buffer, (const gchar *) data->content);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}

	/*!
	* \internal
	* \brief Append XML CDATA content to a buffer
	*
	* \param[in] data XML whose content to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_cdata(const xmlNode data, int options, GString buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	insert_prefix(options, buffer, depth);
	- g_string_append_printf(buffer, "<![CDATA[%s]]>",
	- (const gchar *) data->content);
	+ pcmk__g_strcat(buffer, "<![CDATA[", (const char *) data->content, "]]>",
	+ NULL);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}

	/*!
	* \internal
	* \brief Append an XML comment to a buffer
	*
	* \param[in] data XML whose content to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_comment(const xmlNode data, int options, GString buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	insert_prefix(options, buffer, depth);
	- g_string_append_printf(buffer, "<!--%s-->", (const gchar *) data->content);
	+ pcmk__g_strcat(buffer, "<!--", (const char *) data->content, "-->", NULL);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}

	#define PCMK__XMLDUMP_STATS 0

	/*!
	* \internal
	* \brief Create a text representation of an XML object
	*
	* \param[in] data XML to convert
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to store the text (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	void
	pcmk__xml2text(xmlNodePtr data, int options, GString *buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	return;
	}

	if (!pcmk_is_set(options, xml_log_option_filtered)
	&& pcmk_is_set(options, xml_log_option_full_fledged)) {
	/* libxml's serialization reuse is a good idea, sadly we cannot
	apply it for the filtered cases (preceding filtering pass
	would preclude further reuse of such in-situ modified XML
	in generic context and is likely not a win performance-wise),
	and there's also a historically unstable throughput argument
	(likely stemming from memory allocation overhead, eventhough
	that shall be minimized with defaults preset in crm_xml_init) */
	#if (PCMK__XMLDUMP_STATS - 0)
	time_t next, new = time(NULL);
	#endif
	xmlDoc *doc;
	xmlOutputBuffer *xml_buffer;

	doc = getDocPtr(data);
	/* doc will only be NULL if data is */
	CRM_CHECK(doc != NULL, return);

	xml_buffer = xmlAllocOutputBuffer(NULL);
	CRM_ASSERT(xml_buffer != NULL);

	/* XXX we could setup custom allocation scheme for the particular
	buffer, but it's subsumed with crm_xml_init that needs to
	be invoked prior to entering this function as such, since
	its other branch vitally depends on it -- what can be done
	about this all is to have a facade parsing functions that
	would 100% mark entering libxml code for us, since we don't
	do anything as crazy as swapping out the binary form of the
	parsed tree (but those would need to be strictly used as
	opposed to libxml's raw functions) */

	xmlNodeDumpOutput(xml_buffer, doc, data, 0,
	(options & xml_log_option_formatted), NULL);
	/* attempt adding final NL - failing shouldn't be fatal here */
	(void) xmlOutputBufferWrite(xml_buffer, sizeof("\n") - 1, "\n");
	if (xml_buffer->buffer != NULL) {
	g_string_append(buffer,
	(const gchar *) xmlBufContent(xml_buffer->buffer));
	}

	#if (PCMK__XMLDUMP_STATS - 0)
	next = time(NULL);
	if ((now + 1) < next) {
	crm_log_xml_trace(data, "Long time");
	crm_err("xmlNodeDumpOutput() -> %lld bytes took %ds",
	(long long) buffer->len, next - now);
	}
	#endif

	/* asserted allocation before so there should be something to remove */
	(void) xmlOutputBufferClose(xml_buffer);
	return;
	}

	switch(data->type) {
	case XML_ELEMENT_NODE:
	/* Handle below */
	dump_xml_element(data, options, buffer, depth);
	break;
	case XML_TEXT_NODE:
	/* if option xml_log_option_text is enabled, then dump XML_TEXT_NODE */
	if (options & xml_log_option_text) {
	dump_xml_text(data, options, buffer, depth);
	}
	break;
	case XML_COMMENT_NODE:
	dump_xml_comment(data, options, buffer, depth);
	break;
	case XML_CDATA_SECTION_NODE:
	dump_xml_cdata(data, options, buffer, depth);
	break;
	default:
	crm_warn("Unhandled type: %d", data->type);
	break;

	/*
	XML_ATTRIBUTE_NODE = 2
	XML_ENTITY_REF_NODE = 5
	XML_ENTITY_NODE = 6
	XML_PI_NODE = 7
	XML_DOCUMENT_NODE = 9
	XML_DOCUMENT_TYPE_NODE = 10
	XML_DOCUMENT_FRAG_NODE = 11
	XML_NOTATION_NODE = 12
	XML_HTML_DOCUMENT_NODE = 13
	XML_DTD_NODE = 14
	XML_ELEMENT_DECL = 15
	XML_ATTRIBUTE_DECL = 16
	XML_ENTITY_DECL = 17
	XML_NAMESPACE_DECL = 18
	XML_XINCLUDE_START = 19
	XML_XINCLUDE_END = 20
	XML_DOCB_DOCUMENT_NODE = 21
	*/
	}
	}

	char *
	dump_xml_formatted_with_text(xmlNode * an_xml_node)
	{
	char *buffer = NULL;
	GString *g_buffer = g_string_sized_new(1024);

	pcmk__xml2text(an_xml_node,
	xml_log_option_formatted\|xml_log_option_full_fledged,
	g_buffer, 0);

	if (g_buffer != NULL) {
	buffer = strdup((const char *) g_buffer->str);
	g_string_free(g_buffer, TRUE);
	}
	return buffer;
	}

	char *
	dump_xml_formatted(xmlNode * an_xml_node)
	{
	char *buffer = NULL;
	GString *g_buffer = g_string_sized_new(1024);

	pcmk__xml2text(an_xml_node, xml_log_option_formatted, g_buffer, 0);

	if (g_buffer != NULL) {
	buffer = strdup((const char *) g_buffer->str);
	g_string_free(g_buffer, TRUE);
	}
	return buffer;
	}

	char *
	dump_xml_unformatted(xmlNode * an_xml_node)
	{
	char *buffer = NULL;
	GString *g_buffer = g_string_sized_new(1024);

	pcmk__xml2text(an_xml_node, 0, g_buffer, 0);

	if (g_buffer != NULL) {
	buffer = strdup((const char *) g_buffer->str);
	g_string_free(g_buffer, TRUE);
	}
	return buffer;
	}

	gboolean
	xml_has_children(const xmlNode * xml_root)
	{
	if (xml_root != NULL && xml_root->children != NULL) {
	return TRUE;
	}
	return FALSE;
	}

	void
	xml_remove_prop(xmlNode * obj, const char *name)
	{
	if (pcmk__check_acl(obj, NULL, pcmk__xf_acl_write) == FALSE) {
	crm_trace("Cannot remove %s from %s", name, obj->name);

	} else if (pcmk__tracking_xml_changes(obj, FALSE)) {
	/* Leave in place (marked for removal) until after the diff is calculated */
	xml_private_t *p = NULL;
	xmlAttr *attr = xmlHasProp(obj, (pcmkXmlStr) name);

	p = attr->_private;
	set_parent_flag(obj, pcmk__xf_dirty);
	pcmk__set_xml_flags(p, pcmk__xf_deleted);
	} else {
	xmlUnsetProp(obj, (pcmkXmlStr) name);
	}
	}

	void
	save_xml_to_file(xmlNode * xml, const char desc, const char filename)
	{
	char *f = NULL;

	if (filename == NULL) {
	char *uuid = crm_generate_uuid();

	f = crm_strdup_printf("%s/%s", pcmk__get_tmpdir(), uuid);
	filename = f;
	free(uuid);
	}

	crm_info("Saving %s to %s", desc, filename);
	write_xml_file(xml, filename, FALSE);
	free(f);
	}

	/*!
	* \internal
	* \brief Set a flag on all attributes of an XML element
	*
	* \param[in,out] xml XML node to set flags on
	* \param[in] flag XML private flag to set
	*/
	static void
	set_attrs_flag(xmlNode *xml, enum xml_private_flags flag)
	{
	for (xmlAttr *attr = pcmk__xe_first_attr(xml); attr; attr = attr->next) {
	pcmk__set_xml_flags((xml_private_t *) (attr->_private), flag);
	}
	}

	/*!
	* \internal
	* \brief Add an XML attribute to a node, marked as deleted
	*
	* When calculating XML changes, we need to know when an attribute has been
	* deleted. Add the attribute back to the new XML, so that we can check the
	* removal against ACLs, and mark it as deleted for later removal after
	* differences have been calculated.
	*/
	static void
	mark_attr_deleted(xmlNode new_xml, const char element, const char *attr_name,
	const char *old_value)
	{
	xml_private_t *p = new_xml->doc->_private;
	xmlAttr *attr = NULL;

	// Prevent the dirty flag being set recursively upwards
	pcmk__clear_xml_flags(p, pcmk__xf_tracking);

	// Restore the old value (and the tracking flag)
	attr = xmlSetProp(new_xml, (pcmkXmlStr) attr_name, (pcmkXmlStr) old_value);
	pcmk__set_xml_flags(p, pcmk__xf_tracking);

	// Reset flags (so the attribute doesn't appear as newly created)
	p = attr->_private;
	p->flags = 0;

	// Check ACLs and mark restored value for later removal
	xml_remove_prop(new_xml, attr_name);

	crm_trace("XML attribute %s=%s was removed from %s",
	attr_name, old_value, element);
	}

	/*
	* \internal
	* \brief Check ACLs for a changed XML attribute
	*/
	static void
	mark_attr_changed(xmlNode new_xml, const char element, const char *attr_name,
	const char *old_value)
	{
	char *vcopy = crm_element_value_copy(new_xml, attr_name);

	crm_trace("XML attribute %s was changed from '%s' to '%s' in %s",
	attr_name, old_value, vcopy, element);

	// Restore the original value
	xmlSetProp(new_xml, (pcmkXmlStr) attr_name, (pcmkXmlStr) old_value);

	// Change it back to the new value, to check ACLs
	crm_xml_add(new_xml, attr_name, vcopy);
	free(vcopy);
	}

	/*!
	* \internal
	* \brief Mark an XML attribute as having changed position
	*/
	static void
	mark_attr_moved(xmlNode new_xml, const char element, xmlAttr *old_attr,
	xmlAttr *new_attr, int p_old, int p_new)
	{
	xml_private_t *p = new_attr->_private;

	crm_trace("XML attribute %s moved from position %d to %d in %s",
	old_attr->name, p_old, p_new, element);

	// Mark document, element, and all element's parents as changed
	mark_xml_node_dirty(new_xml);

	// Mark attribute as changed
	pcmk__set_xml_flags(p, pcmk__xf_dirty\|pcmk__xf_moved);

	p = (p_old > p_new)? old_attr->_private : new_attr->_private;
	pcmk__set_xml_flags(p, pcmk__xf_skip);
	}

	/*!
	* \internal
	* \brief Calculate differences in all previously existing XML attributes
	*/
	static void
	xml_diff_old_attrs(xmlNode old_xml, xmlNode new_xml)
	{
	xmlAttr *attr_iter = pcmk__xe_first_attr(old_xml);

	while (attr_iter != NULL) {
	xmlAttr *old_attr = attr_iter;
	xmlAttr *new_attr = xmlHasProp(new_xml, attr_iter->name);
	const char name = (const char ) attr_iter->name;
	const char *old_value = crm_element_value(old_xml, name);

	attr_iter = attr_iter->next;
	if (new_attr == NULL) {
	mark_attr_deleted(new_xml, (const char *) old_xml->name, name,
	old_value);

	} else {
	xml_private_t *p = new_attr->_private;
	int new_pos = pcmk__xml_position((xmlNode*) new_attr,
	pcmk__xf_skip);
	int old_pos = pcmk__xml_position((xmlNode*) old_attr,
	pcmk__xf_skip);
	const char *new_value = crm_element_value(new_xml, name);

	// This attribute isn't new
	pcmk__clear_xml_flags(p, pcmk__xf_created);

	if (strcmp(new_value, old_value) != 0) {
	mark_attr_changed(new_xml, (const char *) old_xml->name, name,
	old_value);

	} else if ((old_pos != new_pos)
	&& !pcmk__tracking_xml_changes(new_xml, TRUE)) {
	mark_attr_moved(new_xml, (const char *) old_xml->name,
	old_attr, new_attr, old_pos, new_pos);
	}
	}
	}
	}

	/*!
	* \internal
	* \brief Check all attributes in new XML for creation
	*/
	static void
	mark_created_attrs(xmlNode *new_xml)
	{
	xmlAttr *attr_iter = pcmk__xe_first_attr(new_xml);

	while (attr_iter != NULL) {
	xmlAttr *new_attr = attr_iter;
	xml_private_t *p = attr_iter->_private;

	attr_iter = attr_iter->next;
	if (pcmk_is_set(p->flags, pcmk__xf_created)) {
	const char attr_name = (const char ) new_attr->name;

	crm_trace("Created new attribute %s=%s in %s",
	attr_name, crm_element_value(new_xml, attr_name),
	new_xml->name);

	/* Check ACLs (we can't use the remove-then-create trick because it
	* would modify the attribute position).
	*/
	if (pcmk__check_acl(new_xml, attr_name, pcmk__xf_acl_write)) {
	pcmk__mark_xml_attr_dirty(new_attr);
	} else {
	// Creation was not allowed, so remove the attribute
	xmlUnsetProp(new_xml, new_attr->name);
	}
	}
	}
	}

	/*!
	* \internal
	* \brief Calculate differences in attributes between two XML nodes
	*/
	static void
	xml_diff_attrs(xmlNode old_xml, xmlNode new_xml)
	{
	set_attrs_flag(new_xml, pcmk__xf_created); // cleared later if not really new
	xml_diff_old_attrs(old_xml, new_xml);
	mark_created_attrs(new_xml);
	}

	/*!
	* \internal
	* \brief Add an XML child element to a node, marked as deleted
	*
	* When calculating XML changes, we need to know when a child element has been
	* deleted. Add the child back to the new XML, so that we can check the removal
	* against ACLs, and mark it as deleted for later removal after differences have
	* been calculated.
	*/
	static void
	mark_child_deleted(xmlNode old_child, xmlNode new_parent)
	{
	// Re-create the child element so we can check ACLs
	xmlNode *candidate = add_node_copy(new_parent, old_child);

	// Clear flags on new child and its children
	reset_xml_node_flags(candidate);

	// Check whether ACLs allow the deletion
	pcmk__apply_acl(xmlDocGetRootElement(candidate->doc));

	// Remove the child again (which will track it in document's deleted_objs)
	free_xml_with_position(candidate,
	pcmk__xml_position(old_child, pcmk__xf_skip));

	if (pcmk__xml_match(new_parent, old_child, true) == NULL) {
	pcmk__set_xml_flags((xml_private_t *) (old_child->_private),
	pcmk__xf_skip);
	}
	}

	static void
	mark_child_moved(xmlNode old_child, xmlNode new_parent, xmlNode *new_child,
	int p_old, int p_new)
	{
	xml_private_t *p = new_child->_private;

	crm_trace("Child element %s with id='%s' moved from position %d to %d under %s",
	new_child->name, (ID(new_child)? ID(new_child) : "<no id>"),
	p_old, p_new, new_parent->name);
	mark_xml_node_dirty(new_parent);
	pcmk__set_xml_flags(p, pcmk__xf_moved);

	if (p_old > p_new) {
	p = old_child->_private;
	} else {
	p = new_child->_private;
	}
	pcmk__set_xml_flags(p, pcmk__xf_skip);
	}

	// Given original and new XML, mark new XML portions that have changed
	static void
	mark_xml_changes(xmlNode old_xml, xmlNode new_xml, bool check_top)
	{
	xmlNode *cIter = NULL;
	xml_private_t *p = NULL;

	CRM_CHECK(new_xml != NULL, return);
	if (old_xml == NULL) {
	pcmk__mark_xml_created(new_xml);
	pcmk__apply_creation_acl(new_xml, check_top);
	return;
	}

	p = new_xml->_private;
	CRM_CHECK(p != NULL, return);

	if(p->flags & pcmk__xf_processed) {
	/* Avoid re-comparing nodes */
	return;
	}
	pcmk__set_xml_flags(p, pcmk__xf_processed);

	xml_diff_attrs(old_xml, new_xml);

	// Check for differences in the original children
	for (cIter = pcmk__xml_first_child(old_xml); cIter != NULL; ) {
	xmlNode *old_child = cIter;
	xmlNode *new_child = pcmk__xml_match(new_xml, cIter, true);

	cIter = pcmk__xml_next(cIter);
	if(new_child) {
	mark_xml_changes(old_child, new_child, TRUE);

	} else {
	mark_child_deleted(old_child, new_xml);
	}
	}

	// Check for moved or created children
	for (cIter = pcmk__xml_first_child(new_xml); cIter != NULL; ) {
	xmlNode *new_child = cIter;
	xmlNode *old_child = pcmk__xml_match(old_xml, cIter, true);

	cIter = pcmk__xml_next(cIter);
	if(old_child == NULL) {
	// This is a newly created child
	p = new_child->_private;
	pcmk__set_xml_flags(p, pcmk__xf_skip);
	mark_xml_changes(old_child, new_child, TRUE);

	} else {
	/* Check for movement, we already checked for differences */
	int p_new = pcmk__xml_position(new_child, pcmk__xf_skip);
	int p_old = pcmk__xml_position(old_child, pcmk__xf_skip);

	if(p_old != p_new) {
	mark_child_moved(old_child, new_xml, new_child, p_old, p_new);
	}
	}
	}
	}

	void
	xml_calculate_significant_changes(xmlNode old_xml, xmlNode new_xml)
	{
	pcmk__set_xml_doc_flag(new_xml, pcmk__xf_lazy);
	xml_calculate_changes(old_xml, new_xml);
	}

	void
	xml_calculate_changes(xmlNode old_xml, xmlNode new_xml)
	{
	CRM_CHECK(pcmk__str_eq(crm_element_name(old_xml), crm_element_name(new_xml), pcmk__str_casei),
	return);
	CRM_CHECK(pcmk__str_eq(ID(old_xml), ID(new_xml), pcmk__str_casei), return);

	if(xml_tracking_changes(new_xml) == FALSE) {
	xml_track_changes(new_xml, NULL, NULL, FALSE);
	}

	mark_xml_changes(old_xml, new_xml, FALSE);
	}

	gboolean
	can_prune_leaf(xmlNode * xml_node)
	{
	xmlNode *cIter = NULL;
	gboolean can_prune = TRUE;
	const char *name = crm_element_name(xml_node);

	if (pcmk__strcase_any_of(name, XML_TAG_RESOURCE_REF, XML_CIB_TAG_OBJ_REF,
	XML_ACL_TAG_ROLE_REF, XML_ACL_TAG_ROLE_REFv1, NULL)) {
	return FALSE;
	}

	for (xmlAttrPtr a = pcmk__xe_first_attr(xml_node); a != NULL; a = a->next) {
	const char p_name = (const char ) a->name;

	if (strcmp(p_name, XML_ATTR_ID) == 0) {
	continue;
	}
	can_prune = FALSE;
	}

	cIter = pcmk__xml_first_child(xml_node);
	while (cIter) {
	xmlNode *child = cIter;

	cIter = pcmk__xml_next(cIter);
	if (can_prune_leaf(child)) {
	free_xml(child);
	} else {
	can_prune = FALSE;
	}
	}
	return can_prune;
	}

	/*!
	* \internal
	* \brief Find a comment with matching content in specified XML
	*
	* \param[in] root XML to search
	* \param[in] search_comment Comment whose content should be searched for
	* \param[in] exact If true, comment must also be at same position
	*/
	xmlNode *
	pcmk__xc_match(xmlNode root, xmlNode search_comment, bool exact)
	{
	xmlNode *a_child = NULL;
	int search_offset = pcmk__xml_position(search_comment, pcmk__xf_skip);

	CRM_CHECK(search_comment->type == XML_COMMENT_NODE, return NULL);

	for (a_child = pcmk__xml_first_child(root); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	if (exact) {
	int offset = pcmk__xml_position(a_child, pcmk__xf_skip);
	xml_private_t *p = a_child->_private;

	if (offset < search_offset) {
	continue;

	} else if (offset > search_offset) {
	return NULL;
	}

	if (pcmk_is_set(p->flags, pcmk__xf_skip)) {
	continue;
	}
	}

	if (a_child->type == XML_COMMENT_NODE
	&& pcmk__str_eq((const char )a_child->content, (const char )search_comment->content, pcmk__str_casei)) {
	return a_child;

	} else if (exact) {
	return NULL;
	}
	}

	return NULL;
	}

	/*!
	* \internal
	* \brief Make one XML comment match another (in content)
	*
	* \param[in,out] parent If \p target is NULL and this is not, add or update
	* comment child of this XML node that matches \p update
	* \param[in,out] target If not NULL, update this XML comment node
	* \param[in] update Make comment content match this (must not be NULL)
	*
	* \note At least one of \parent and \target must be non-NULL
	*/
	void
	pcmk__xc_update(xmlNode parent, xmlNode target, xmlNode *update)
	{
	CRM_CHECK(update != NULL, return);
	CRM_CHECK(update->type == XML_COMMENT_NODE, return);

	if (target == NULL) {
	target = pcmk__xc_match(parent, update, false);
	}

	if (target == NULL) {
	add_node_copy(parent, update);

	} else if (!pcmk__str_eq((const char )target->content, (const char )update->content, pcmk__str_casei)) {
	xmlFree(target->content);
	target->content = xmlStrdup(update->content);
	}
	}

	/*!
	* \internal
	* \brief Make one XML tree match another (in children and attributes)
	*
	* \param[in,out] parent If \p target is NULL and this is not, add or update
	* child of this XML node that matches \p update
	* \param[in,out] target If not NULL, update this XML
	* \param[in] update Make the desired XML match this (must not be NULL)
	* \param[in] as_diff If false, expand "++" when making attributes match
	*
	* \note At least one of \parent and \target must be non-NULL
	*/
	void
	pcmk__xml_update(xmlNode parent, xmlNode target, xmlNode *update,
	bool as_diff)
	{
	xmlNode *a_child = NULL;
	const char *object_name = NULL,
	*object_href = NULL,
	*object_href_val = NULL;

	#if XML_PARSER_DEBUG
	crm_log_xml_trace(update, "update:");
	crm_log_xml_trace(target, "target:");
	#endif

	CRM_CHECK(update != NULL, return);

	if (update->type == XML_COMMENT_NODE) {
	pcmk__xc_update(parent, target, update);
	return;
	}

	object_name = crm_element_name(update);
	object_href_val = ID(update);
	if (object_href_val != NULL) {
	object_href = XML_ATTR_ID;
	} else {
	object_href_val = crm_element_value(update, XML_ATTR_IDREF);
	object_href = (object_href_val == NULL) ? NULL : XML_ATTR_IDREF;
	}

	CRM_CHECK(object_name != NULL, return);
	CRM_CHECK(target != NULL \|\| parent != NULL, return);

	if (target == NULL) {
	target = pcmk__xe_match(parent, object_name,
	object_href, object_href_val);
	}

	if (target == NULL) {
	target = create_xml_node(parent, object_name);
	CRM_CHECK(target != NULL, return);
	#if XML_PARSER_DEBUG
	crm_trace("Added <%s%s%s%s%s/>", pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");

	} else {
	crm_trace("Found node <%s%s%s%s%s/> to update",
	pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");
	#endif
	}

	CRM_CHECK(pcmk__str_eq(crm_element_name(target), crm_element_name(update),
	pcmk__str_casei),
	return);

	if (as_diff == FALSE) {
	/* So that expand_plus_plus() gets called */
	copy_in_properties(target, update);

	} else {
	/* No need for expand_plus_plus(), just raw speed */
	for (xmlAttrPtr a = pcmk__xe_first_attr(update); a != NULL;
	a = a->next) {
	const char *p_value = pcmk__xml_attr_value(a);

	/* Remove it first so the ordering of the update is preserved */
	xmlUnsetProp(target, a->name);
	xmlSetProp(target, a->name, (pcmkXmlStr) p_value);
	}
	}

	for (a_child = pcmk__xml_first_child(update); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	#if XML_PARSER_DEBUG
	crm_trace("Updating child <%s%s%s%s%s/>",
	pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");
	#endif
	pcmk__xml_update(target, NULL, a_child, as_diff);
	}

	#if XML_PARSER_DEBUG
	crm_trace("Finished with <%s%s%s%s%s/>", pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");
	#endif
	}

	gboolean
	update_xml_child(xmlNode * child, xmlNode * to_update)
	{
	gboolean can_update = TRUE;
	xmlNode *child_of_child = NULL;

	CRM_CHECK(child != NULL, return FALSE);
	CRM_CHECK(to_update != NULL, return FALSE);

	if (!pcmk__str_eq(crm_element_name(to_update), crm_element_name(child), pcmk__str_none)) {
	can_update = FALSE;

	} else if (!pcmk__str_eq(ID(to_update), ID(child), pcmk__str_none)) {
	can_update = FALSE;

	} else if (can_update) {
	#if XML_PARSER_DEBUG
	crm_log_xml_trace(child, "Update match found...");
	#endif
	pcmk__xml_update(NULL, child, to_update, false);
	}

	for (child_of_child = pcmk__xml_first_child(child); child_of_child != NULL;
	child_of_child = pcmk__xml_next(child_of_child)) {
	/* only update the first one */
	if (can_update) {
	break;
	}
	can_update = update_xml_child(child_of_child, to_update);
	}

	return can_update;
	}

	int
	find_xml_children(xmlNode ** children, xmlNode * root,
	const char tag, const char field, const char *value, gboolean search_matches)
	{
	int match_found = 0;

	CRM_CHECK(root != NULL, return FALSE);
	CRM_CHECK(children != NULL, return FALSE);

	if (tag != NULL && !pcmk__str_eq(tag, crm_element_name(root), pcmk__str_casei)) {

	} else if (value != NULL && !pcmk__str_eq(value, crm_element_value(root, field), pcmk__str_casei)) {

	} else {
	if (*children == NULL) {
	*children = create_xml_node(NULL, __func__);
	}
	add_node_copy(*children, root);
	match_found = 1;
	}

	if (search_matches \|\| match_found == 0) {
	xmlNode *child = NULL;

	for (child = pcmk__xml_first_child(root); child != NULL;
	child = pcmk__xml_next(child)) {
	match_found += find_xml_children(children, child, tag, field, value, search_matches);
	}
	}

	return match_found;
	}

	gboolean
	replace_xml_child(xmlNode * parent, xmlNode * child, xmlNode * update, gboolean delete_only)
	{
	gboolean can_delete = FALSE;
	xmlNode *child_of_child = NULL;

	const char *up_id = NULL;
	const char *child_id = NULL;
	const char *right_val = NULL;

	CRM_CHECK(child != NULL, return FALSE);
	CRM_CHECK(update != NULL, return FALSE);

	up_id = ID(update);
	child_id = ID(child);

	if (up_id == NULL \|\| (child_id && strcmp(child_id, up_id) == 0)) {
	can_delete = TRUE;
	}
	if (!pcmk__str_eq(crm_element_name(update), crm_element_name(child), pcmk__str_casei)) {
	can_delete = FALSE;
	}
	if (can_delete && delete_only) {
	for (xmlAttrPtr a = pcmk__xe_first_attr(update); a != NULL;
	a = a->next) {
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);

	right_val = crm_element_value(child, p_name);
	if (!pcmk__str_eq(p_value, right_val, pcmk__str_casei)) {
	can_delete = FALSE;
	}
	}
	}

	if (can_delete && parent != NULL) {
	crm_log_xml_trace(child, "Delete match found...");
	if (delete_only \|\| update == NULL) {
	free_xml(child);

	} else {
	xmlNode *tmp = copy_xml(update);
	xmlDoc *doc = tmp->doc;
	xmlNode *old = NULL;

	xml_accept_changes(tmp);
	old = xmlReplaceNode(child, tmp);

	if(xml_tracking_changes(tmp)) {
	/* Replaced sections may have included relevant ACLs */
	pcmk__apply_acl(tmp);
	}

	xml_calculate_changes(old, tmp);
	xmlDocSetRootElement(doc, old);
	free_xml(old);
	}
	child = NULL;
	return TRUE;

	} else if (can_delete) {
	crm_log_xml_debug(child, "Cannot delete the search root");
	can_delete = FALSE;
	}

	child_of_child = pcmk__xml_first_child(child);
	while (child_of_child) {
	xmlNode *next = pcmk__xml_next(child_of_child);

	can_delete = replace_xml_child(child, child_of_child, update, delete_only);

	/* only delete the first one */
	if (can_delete) {
	child_of_child = NULL;
	} else {
	child_of_child = next;
	}
	}

	return can_delete;
	}

	xmlNode *
	sorted_xml(xmlNode input, xmlNode parent, gboolean recursive)
	{
	xmlNode *child = NULL;
	GSList *nvpairs = NULL;
	xmlNode *result = NULL;
	const char *name = NULL;

	CRM_CHECK(input != NULL, return NULL);

	name = crm_element_name(input);
	CRM_CHECK(name != NULL, return NULL);

	result = create_xml_node(parent, name);
	nvpairs = pcmk_xml_attrs2nvpairs(input);
	nvpairs = pcmk_sort_nvpairs(nvpairs);
	pcmk_nvpairs2xml_attrs(nvpairs, result);
	pcmk_free_nvpairs(nvpairs);

	for (child = pcmk__xml_first_child(input); child != NULL;
	child = pcmk__xml_next(child)) {

	if (recursive) {
	sorted_xml(child, result, recursive);
	} else {
	add_node_copy(result, child);
	}
	}

	return result;
	}

	xmlNode *
	first_named_child(const xmlNode parent, const char name)
	{
	xmlNode *match = NULL;

	for (match = pcmk__xe_first_child(parent); match != NULL;
	match = pcmk__xe_next(match)) {
	/*
	* name == NULL gives first child regardless of name; this is
	* semantically incorrect in this function, but may be necessary
	* due to prior use of xml_child_iter_filter
	*/
	if (pcmk__str_eq(name, (const char *)match->name, pcmk__str_null_matches)) {
	return match;
	}
	}
	return NULL;
	}

	/*!
	* \brief Get next instance of same XML tag
	*
	* \param[in] sibling XML tag to start from
	*
	* \return Next sibling XML tag with same name
	*/
	xmlNode *
	crm_next_same_xml(const xmlNode *sibling)
	{
	xmlNode *match = pcmk__xe_next(sibling);
	const char *name = crm_element_name(sibling);

	while (match != NULL) {
	if (!strcmp(crm_element_name(match), name)) {
	return match;
	}
	match = pcmk__xe_next(match);
	}
	return NULL;
	}

	void
	crm_xml_init(void)
	{
	static bool init = true;

	if(init) {
	init = false;
	/* The default allocator XML_BUFFER_ALLOC_EXACT does far too many
	* pcmk__realloc()s and it can take upwards of 18 seconds (yes, seconds)
	* to dump a 28kb tree which XML_BUFFER_ALLOC_DOUBLEIT can do in
	* less than 1 second.
	*/
	xmlSetBufferAllocationScheme(XML_BUFFER_ALLOC_DOUBLEIT);

	/* Populate and free the _private field when nodes are created and destroyed */
	xmlDeregisterNodeDefault(free_private_data);
	xmlRegisterNodeDefault(new_private_data);

	crm_schema_init();
	}
	}

	void
	crm_xml_cleanup(void)
	{
	crm_schema_cleanup();
	xmlCleanupParser();
	}

	#define XPATH_MAX 512

	xmlNode *
	expand_idref(xmlNode * input, xmlNode * top)
	{
	const char *tag = NULL;
	const char *ref = NULL;
	xmlNode *result = input;

	if (result == NULL) {
	return NULL;

	} else if (top == NULL) {
	top = input;
	}

	tag = crm_element_name(result);
	ref = crm_element_value(result, XML_ATTR_IDREF);

	if (ref != NULL) {
	char *xpath_string = crm_strdup_printf("//%s[@id='%s']", tag, ref);

	result = get_xpath_object(xpath_string, top, LOG_ERR);
	if (result == NULL) {
	char nodePath = (char )xmlGetNodePath(top);

	crm_err("No match for %s found in %s: Invalid configuration",
	xpath_string, pcmk__s(nodePath, "unrecognizable path"));
	free(nodePath);
	}
	free(xpath_string);
	}
	return result;
	}

	char *
	pcmk__xml_artefact_root(enum pcmk__xml_artefact_ns ns)
	{
	static const char *base = NULL;
	char *ret = NULL;

	if (base == NULL) {
	base = getenv("PCMK_schema_directory");
	}
	if (pcmk__str_empty(base)) {
	base = CRM_SCHEMA_DIRECTORY;
	}

	switch (ns) {
	case pcmk__xml_artefact_ns_legacy_rng:
	case pcmk__xml_artefact_ns_legacy_xslt:
	ret = strdup(base);
	break;
	case pcmk__xml_artefact_ns_base_rng:
	case pcmk__xml_artefact_ns_base_xslt:
	ret = crm_strdup_printf("%s/base", base);
	break;
	default:
	crm_err("XML artefact family specified as %u not recognized", ns);
	}
	return ret;
	}

	char *
	pcmk__xml_artefact_path(enum pcmk__xml_artefact_ns ns, const char *filespec)
	{
	char base = pcmk__xml_artefact_root(ns), ret = NULL;

	switch (ns) {
	case pcmk__xml_artefact_ns_legacy_rng:
	case pcmk__xml_artefact_ns_base_rng:
	ret = crm_strdup_printf("%s/%s.rng", base, filespec);
	break;
	case pcmk__xml_artefact_ns_legacy_xslt:
	case pcmk__xml_artefact_ns_base_xslt:
	ret = crm_strdup_printf("%s/%s.xsl", base, filespec);
	break;
	default:
	crm_err("XML artefact family specified as %u not recognized", ns);
	}
	free(base);

	return ret;
	}

	void
	pcmk__xe_set_propv(xmlNodePtr node, va_list pairs)
	{
	while (true) {
	const char name, value;

	name = va_arg(pairs, const char *);
	if (name == NULL) {
	return;
	}

	value = va_arg(pairs, const char *);
	if (value != NULL) {
	crm_xml_add(node, name, value);
	}
	}
	}

	void
	pcmk__xe_set_props(xmlNodePtr node, ...)
	{
	va_list pairs;
	va_start(pairs, node);
	pcmk__xe_set_propv(node, pairs);
	va_end(pairs);
	}

	int
	pcmk__xe_foreach_child(xmlNode xml, const char child_element_name,
	int (handler)(xmlNode xml, void *userdata),
	void *userdata)
	{
	xmlNode *children = (xml? xml->children : NULL);

	CRM_ASSERT(handler != NULL);

	for (xmlNode *node = children; node != NULL; node = node->next) {
	if (node->type == XML_ELEMENT_NODE &&
	pcmk__str_eq(child_element_name, (const char *) node->name, pcmk__str_null_matches)) {
	int rc = handler(node, userdata);

	if (rc != pcmk_rc_ok) {
	return rc;
	}
	}
	}

	return pcmk_rc_ok;
	}

	// Deprecated functions kept only for backward API compatibility
	// LCOV_EXCL_START

	#include <crm/common/xml_compat.h>

	xmlNode *
	find_entity(xmlNode parent, const char node_name, const char *id)
	{
	return pcmk__xe_match(parent, node_name,
	((id == NULL)? id : XML_ATTR_ID), id);
	}

	void
	crm_destroy_xml(gpointer data)
	{
	free_xml(data);
	}

	// LCOV_EXCL_STOP
	// End deprecated API
	diff --git a/lib/common/xpath.c b/lib/common/xpath.c
	index 55d7cebedc..08f7125186 100644
	--- a/lib/common/xpath.c
	+++ b/lib/common/xpath.c
	@@ -1,378 +1,378 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>
	#include <stdio.h>
	#include <string.h>
	#include <crm/msg_xml.h>
	#include <crm/common/xml_internal.h>
	#include "crmcommon_private.h"

	/*
	* From xpath2.c
	*
	* All the elements returned by an XPath query are pointers to
	* elements from the tree except namespace nodes where the XPath
	* semantic is different from the implementation in libxml2 tree.
	* As a result when a returned node set is freed when
	* xmlXPathFreeObject() is called, that routine must check the
	* element type. But node from the returned set may have been removed
	* by xmlNodeSetContent() resulting in access to freed data.
	*
	* This can be exercised by running
	* valgrind xpath2 test3.xml '//discarded' discarded
	*
	* There is 2 ways around it:
	* - make a copy of the pointers to the nodes from the result set
	* then call xmlXPathFreeObject() and then modify the nodes
	* or
	* - remove the references from the node set, if they are not
	namespace nodes, before calling xmlXPathFreeObject().
	*/
	void
	freeXpathObject(xmlXPathObjectPtr xpathObj)
	{
	int lpc, max = numXpathResults(xpathObj);

	if (xpathObj == NULL) {
	return;
	}

	for (lpc = 0; lpc < max; lpc++) {
	if (xpathObj->nodesetval->nodeTab[lpc] && xpathObj->nodesetval->nodeTab[lpc]->type != XML_NAMESPACE_DECL) {
	xpathObj->nodesetval->nodeTab[lpc] = NULL;
	}
	}

	/* _Now_ it's safe to free it */
	xmlXPathFreeObject(xpathObj);
	}

	xmlNode *
	getXpathResult(xmlXPathObjectPtr xpathObj, int index)
	{
	xmlNode *match = NULL;
	int max = numXpathResults(xpathObj);

	CRM_CHECK(index >= 0, return NULL);
	CRM_CHECK(xpathObj != NULL, return NULL);

	if (index >= max) {
	crm_err("Requested index %d of only %d items", index, max);
	return NULL;

	} else if(xpathObj->nodesetval->nodeTab[index] == NULL) {
	/* Previously requested */
	return NULL;
	}

	match = xpathObj->nodesetval->nodeTab[index];
	CRM_CHECK(match != NULL, return NULL);

	if (xpathObj->nodesetval->nodeTab[index]->type != XML_NAMESPACE_DECL) {
	/* See the comment for freeXpathObject() */
	xpathObj->nodesetval->nodeTab[index] = NULL;
	}

	if (match->type == XML_DOCUMENT_NODE) {
	/* Will happen if section = '/' */
	match = match->children;

	} else if (match->type != XML_ELEMENT_NODE
	&& match->parent && match->parent->type == XML_ELEMENT_NODE) {
	/* Return the parent instead */
	match = match->parent;

	} else if (match->type != XML_ELEMENT_NODE) {
	/* We only support searching nodes */
	crm_err("We only support %d not %d", XML_ELEMENT_NODE, match->type);
	match = NULL;
	}
	return match;
	}

	void
	dedupXpathResults(xmlXPathObjectPtr xpathObj)
	{
	int lpc, max = numXpathResults(xpathObj);

	if (xpathObj == NULL) {
	return;
	}

	for (lpc = 0; lpc < max; lpc++) {
	xmlNode *xml = NULL;
	gboolean dedup = FALSE;

	if (xpathObj->nodesetval->nodeTab[lpc] == NULL) {
	continue;
	}

	xml = xpathObj->nodesetval->nodeTab[lpc]->parent;

	for (; xml; xml = xml->parent) {
	int lpc2 = 0;

	for (lpc2 = 0; lpc2 < max; lpc2++) {
	if (xpathObj->nodesetval->nodeTab[lpc2] == xml) {
	xpathObj->nodesetval->nodeTab[lpc] = NULL;
	dedup = TRUE;
	break;
	}
	}

	if (dedup) {
	break;
	}
	}
	}
	}

	/* the caller needs to check if the result contains a xmlDocPtr or xmlNodePtr */
	xmlXPathObjectPtr
	xpath_search(xmlNode * xml_top, const char *path)
	{
	xmlDocPtr doc = NULL;
	xmlXPathObjectPtr xpathObj = NULL;
	xmlXPathContextPtr xpathCtx = NULL;
	const xmlChar *xpathExpr = (pcmkXmlStr) path;

	CRM_CHECK(path != NULL, return NULL);
	CRM_CHECK(xml_top != NULL, return NULL);
	CRM_CHECK(strlen(path) > 0, return NULL);

	doc = getDocPtr(xml_top);

	xpathCtx = xmlXPathNewContext(doc);
	CRM_ASSERT(xpathCtx != NULL);

	xpathObj = xmlXPathEvalExpression(xpathExpr, xpathCtx);
	xmlXPathFreeContext(xpathCtx);
	return xpathObj;
	}

	/*!
	* \brief Run a supplied function for each result of an xpath search
	*
	* \param[in,out] xml XML to search
	* \param[in] xpath XPath search string
	* \param[in] helper Function to call for each result
	* \param[in,out] user_data Data to pass to supplied function
	*
	* \note The helper function will be passed the XML node of the result,
	* and the supplied user_data. This function does not otherwise
	* use user_data.
	*/
	void
	crm_foreach_xpath_result(xmlNode xml, const char xpath,
	void (helper)(xmlNode, void), void user_data)
	{
	xmlXPathObjectPtr xpathObj = xpath_search(xml, xpath);
	int nresults = numXpathResults(xpathObj);
	int i;

	for (i = 0; i < nresults; i++) {
	xmlNode *result = getXpathResult(xpathObj, i);

	CRM_LOG_ASSERT(result != NULL);
	if (result) {
	(*helper)(result, user_data);
	}
	}
	freeXpathObject(xpathObj);
	}

	xmlNode *
	get_xpath_object_relative(const char xpath, xmlNode xml_obj, int error_level)
	{
	xmlNode *result = NULL;
	char *xpath_full = NULL;
	char *xpath_prefix = NULL;

	if (xml_obj == NULL \|\| xpath == NULL) {
	return NULL;
	}

	xpath_prefix = (char *)xmlGetNodePath(xml_obj);

	xpath_full = crm_strdup_printf("%s%s", xpath_prefix, xpath);

	result = get_xpath_object(xpath_full, xml_obj, error_level);

	free(xpath_prefix);
	free(xpath_full);
	return result;
	}

	xmlNode *
	get_xpath_object(const char xpath, xmlNode xml_obj, int error_level)
	{
	int max;
	xmlNode *result = NULL;
	xmlXPathObjectPtr xpathObj = NULL;
	char *nodePath = NULL;
	char *matchNodePath = NULL;

	if (xpath == NULL) {
	return xml_obj; /* or return NULL? */
	}

	xpathObj = xpath_search(xml_obj, xpath);
	nodePath = (char *)xmlGetNodePath(xml_obj);
	max = numXpathResults(xpathObj);

	if (max < 1) {
	if (error_level < LOG_NEVER) {
	do_crm_log(error_level, "No match for %s in %s",
	xpath, pcmk__s(nodePath, "unknown path"));
	crm_log_xml_explicit(xml_obj, "Unexpected Input");
	}

	} else if (max > 1) {
	if (error_level < LOG_NEVER) {
	int lpc = 0;

	do_crm_log(error_level, "Too many matches for %s in %s",
	xpath, pcmk__s(nodePath, "unknown path"));

	for (lpc = 0; lpc < max; lpc++) {
	xmlNode *match = getXpathResult(xpathObj, lpc);

	CRM_LOG_ASSERT(match != NULL);
	if (match != NULL) {
	matchNodePath = (char *) xmlGetNodePath(match);
	do_crm_log(error_level, "%s[%d] = %s",
	xpath, lpc,
	pcmk__s(matchNodePath, "unrecognizable match"));
	free(matchNodePath);
	}
	}
	crm_log_xml_explicit(xml_obj, "Bad Input");
	}

	} else {
	result = getXpathResult(xpathObj, 0);
	}

	freeXpathObject(xpathObj);
	free(nodePath);

	return result;
	}

	/*!
	* \internal
	* \brief Get an XPath string that matches an XML element as closely as possible
	*
	* \param[in] xml The XML element for which to build an XPath string
	*
	* \return A \p GString that matches \p xml, or \p NULL if \p xml is \p NULL.
	*
	* \note The caller is responsible for freeing the string using
	* \p g_string_free().
	*/
	GString *
	pcmk__element_xpath(const xmlNode *xml)
	{
	const xmlNode *parent = NULL;
	GString *xpath = NULL;
	const char *id = NULL;

	if (xml == NULL) {
	return NULL;
	}

	parent = xml->parent;
	xpath = pcmk__element_xpath(parent);
	if (xpath == NULL) {
	xpath = g_string_sized_new(256);
	}

	// Build xpath like "/" -> "/cib" -> "/cib/configuration"
	if (parent == NULL) {
	g_string_append_c(xpath, '/');
	} else if (parent->parent == NULL) {
	g_string_append(xpath, TYPE(xml));
	} else {
	- g_string_append_printf(xpath, "/%s", TYPE(xml));
	+ pcmk__g_strcat(xpath, "/", TYPE(xml), NULL);
	}

	id = ID(xml);
	if (id != NULL) {
	- g_string_append_printf(xpath, "[@" XML_ATTR_ID "='%s']", id);
	+ pcmk__g_strcat(xpath, "[@" XML_ATTR_ID "='", id, "']", NULL);
	}

	return xpath;
	}

	char *
	pcmk__xpath_node_id(const char xpath, const char node)
	{
	char *retval = NULL;
	char *patt = NULL;
	char *start = NULL;
	char *end = NULL;

	if (node == NULL \|\| xpath == NULL) {
	return retval;
	}

	patt = crm_strdup_printf("/%s[@id=", node);
	start = strstr(xpath, patt);

	if (!start) {
	free(patt);
	return retval;
	}

	start += strlen(patt);
	start++;

	end = strstr(start, "\'");
	CRM_ASSERT(end);
	retval = strndup(start, end-start);

	free(patt);
	return retval;
	}

	// Deprecated functions kept only for backward API compatibility
	// LCOV_EXCL_START

	#include <crm/common/xml_compat.h>

	/*!
	* \deprecated This function will be removed in a future release
	* \brief Get an XPath string that matches an XML element as closely as possible
	*
	* \param[in] xml The XML element for which to build an XPath string
	*
	* \return A string that matches \p xml, or \p NULL if \p xml is \p NULL.
	*
	* \note The caller is responsible for freeing the string using free().
	*/
	char *
	xml_get_path(const xmlNode *xml)
	{
	char *path = NULL;
	GString *g_path = pcmk__element_xpath(xml);

	if (g_path == NULL) {
	return NULL;
	}

	path = strdup((const char *) g_path->str);
	CRM_ASSERT(path != NULL);

	g_string_free(g_path, TRUE);
	return path;
	}

	// LCOV_EXCL_STOP
	// End deprecated API

File Metadata

Mime Type: text/x-diff
Expires: Sat, Nov 23, 4:43 PM (14 h, 16 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1018929
Default Alt Text: (434 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions