No OneTemporary
Actions

Size

245 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/daemons/fenced/fenced_commands.c b/daemons/fenced/fenced_commands.c
	index 366eace200..0deee57190 100644
	--- a/daemons/fenced/fenced_commands.c
	+++ b/daemons/fenced/fenced_commands.c
	@@ -1,2907 +1,2913 @@
	/*
	* Copyright 2009-2020 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU General Public License version 2
	* or later (GPLv2+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <sys/param.h>
	#include <stdio.h>
	#include <sys/types.h>
	#include <sys/wait.h>
	#include <sys/stat.h>
	#include <unistd.h>
	#include <sys/utsname.h>

	#include <stdlib.h>
	#include <errno.h>
	#include <fcntl.h>
	#include <ctype.h>

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/ipc.h>
	#include <crm/common/ipc_internal.h>
	#include <crm/cluster/internal.h>
	#include <crm/common/mainloop.h>

	#include <crm/stonith-ng.h>
	#include <crm/fencing/internal.h>
	#include <crm/common/xml.h>

	#include <pacemaker-fenced.h>

	GHashTable *device_list = NULL;
	GHashTable *topology = NULL;
	GList *cmd_list = NULL;

	struct device_search_s {
	/* target of fence action */
	char *host;
	/* requested fence action */
	char *action;
	/* timeout to use if a device is queried dynamically for possible targets */
	int per_device_timeout;
	/* number of registered fencing devices at time of request */
	int replies_needed;
	/* number of device replies received so far */
	int replies_received;
	/* whether the target is eligible to perform requested action (or off) */
	bool allow_suicide;

	/* private data to pass to search callback function */
	void *user_data;
	/* function to call when all replies have been received */
	void (callback) (GList devices, void *user_data);
	/* devices capable of performing requested action (or off if remapping) */
	GListPtr capable;
	};

	static gboolean stonith_device_dispatch(gpointer user_data);
	static void st_child_done(GPid pid, int rc, const char *output, gpointer user_data);
	static void stonith_send_reply(xmlNode * reply, int call_options, const char *remote_peer,
	const char *client_id);

	static void search_devices_record_result(struct device_search_s search, const char device,
	gboolean can_fence);

	typedef struct async_command_s {

	int id;
	int pid;
	int fd_stdout;
	int options;
	int default_timeout; /* seconds */
	int timeout; /* seconds */

	int start_delay; /* seconds */
	int delay_id;

	char *op;
	char *origin;
	char *client;
	char *client_name;
	char *remote_op_id;

	char *victim;
	uint32_t victim_nodeid;
	char *action;
	char *device;
	char *mode;

	GListPtr device_list;
	GListPtr device_next;

	void *internal_user_data;
	void (done_cb) (GPid pid, int rc, const char output, gpointer user_data);
	guint timer_sigterm;
	guint timer_sigkill;
	/*! If the operation timed out, this is the last signal
	* we sent to the process to get it to terminate */
	int last_timeout_signo;

	stonith_device_t *active_on;
	stonith_device_t *activating_on;
	} async_command_t;

	static xmlNode stonith_construct_async_reply(async_command_t cmd, const char *output,
	xmlNode * data, int rc);

	static gboolean
	is_action_required(const char action, stonith_device_t device)
	{
	return device && device->automatic_unfencing && pcmk__str_eq(action, "on",
	pcmk__str_casei);
	}

	static int
	get_action_delay_max(stonith_device_t * device, const char * action)
	{
	const char *value = NULL;
	int delay_max = 0;

	if (!pcmk__strcase_any_of(action, "off", "reboot", NULL)) {
	return 0;
	}

	value = g_hash_table_lookup(device->params, PCMK_STONITH_DELAY_MAX);
	if (value) {
	delay_max = crm_parse_interval_spec(value) / 1000;
	}

	return delay_max;
	}

	static int
	get_action_delay_base(stonith_device_t * device, const char * action)
	{
	const char *value = NULL;
	int delay_base = 0;

	if (!pcmk__strcase_any_of(action, "off", "reboot", NULL)) {
	return 0;
	}

	value = g_hash_table_lookup(device->params, PCMK_STONITH_DELAY_BASE);
	if (value) {
	delay_base = crm_parse_interval_spec(value) / 1000;
	}

	return delay_base;
	}

	/*!
	* \internal
	* \brief Override STONITH timeout with pcmk_*_timeout if available
	*
	* \param[in] device STONITH device to use
	* \param[in] action STONITH action name
	* \param[in] default_timeout Timeout to use if device does not have
	* a pcmk_*_timeout parameter for action
	*
	* \return Value of pcmk_(action)_timeout if available, otherwise default_timeout
	* \note For consistency, it would be nice if reboot/off/on timeouts could be
	* set the same way as start/stop/monitor timeouts, i.e. with an
	* <operation> entry in the fencing resource configuration. However that
	* is insufficient because fencing devices may be registered directly via
	* the fencer's register_device() API instead of going through the CIB
	* (e.g. stonith_admin uses it for its -R option, and the executor uses it
	* to ensure a device is registered when a command is issued). As device
	* properties, pcmk_*_timeout parameters can be grabbed by the fencer when
	* the device is registered, whether by CIB change or API call.
	*/
	static int
	get_action_timeout(stonith_device_t * device, const char *action, int default_timeout)
	{
	if (action && device && device->params) {
	char buffer[64] = { 0, };
	const char *value = NULL;

	/* If "reboot" was requested but the device does not support it,
	* we will remap to "off", so check timeout for "off" instead
	*/
	if (pcmk__str_eq(action, "reboot", pcmk__str_casei)
	&& !pcmk_is_set(device->flags, st_device_supports_reboot)) {
	crm_trace("%s doesn't support reboot, using timeout for off instead",
	device->id);
	action = "off";
	}

	/* If the device config specified an action-specific timeout, use it */
	snprintf(buffer, sizeof(buffer), "pcmk_%s_timeout", action);
	value = g_hash_table_lookup(device->params, buffer);
	if (value) {
	return atoi(value);
	}
	}
	return default_timeout;
	}

	static void
	free_async_command(async_command_t * cmd)
	{
	if (!cmd) {
	return;
	}

	if (cmd->delay_id) {
	g_source_remove(cmd->delay_id);
	}

	cmd_list = g_list_remove(cmd_list, cmd);

	g_list_free_full(cmd->device_list, free);
	free(cmd->device);
	free(cmd->action);
	free(cmd->victim);
	free(cmd->remote_op_id);
	free(cmd->client);
	free(cmd->client_name);
	free(cmd->origin);
	free(cmd->mode);
	free(cmd->op);
	free(cmd);
	}

	static async_command_t *
	create_async_command(xmlNode * msg)
	{
	async_command_t *cmd = NULL;
	xmlNode *op = get_xpath_object("//@" F_STONITH_ACTION, msg, LOG_ERR);
	const char *action = crm_element_value(op, F_STONITH_ACTION);

	CRM_CHECK(action != NULL, crm_log_xml_warn(msg, "NoAction"); return NULL);

	crm_log_xml_trace(msg, "Command");
	cmd = calloc(1, sizeof(async_command_t));
	crm_element_value_int(msg, F_STONITH_CALLID, &(cmd->id));
	crm_element_value_int(msg, F_STONITH_CALLOPTS, &(cmd->options));
	crm_element_value_int(msg, F_STONITH_TIMEOUT, &(cmd->default_timeout));
	cmd->timeout = cmd->default_timeout;
	// Value -1 means disable any static/random fencing delays
	crm_element_value_int(msg, F_STONITH_DELAY, &(cmd->start_delay));

	cmd->origin = crm_element_value_copy(msg, F_ORIG);
	cmd->remote_op_id = crm_element_value_copy(msg, F_STONITH_REMOTE_OP_ID);
	cmd->client = crm_element_value_copy(msg, F_STONITH_CLIENTID);
	cmd->client_name = crm_element_value_copy(msg, F_STONITH_CLIENTNAME);
	cmd->op = crm_element_value_copy(msg, F_STONITH_OPERATION);
	cmd->action = strdup(action);
	cmd->victim = crm_element_value_copy(op, F_STONITH_TARGET);
	cmd->mode = crm_element_value_copy(op, F_STONITH_MODE);
	cmd->device = crm_element_value_copy(op, F_STONITH_DEVICE);

	CRM_CHECK(cmd->op != NULL, crm_log_xml_warn(msg, "NoOp"); free_async_command(cmd); return NULL);
	CRM_CHECK(cmd->client != NULL, crm_log_xml_warn(msg, "NoClient"));

	cmd->done_cb = st_child_done;
	cmd_list = g_list_append(cmd_list, cmd);
	return cmd;
	}

	static int
	get_action_limit(stonith_device_t * device)
	{
	const char *value = NULL;
	int action_limit = 1;

	value = g_hash_table_lookup(device->params, PCMK_STONITH_ACTION_LIMIT);
	if (value) {
	action_limit = crm_parse_int(value, "1");
	if (action_limit == 0) {
	/* pcmk_action_limit should not be 0. Enforce it to be 1. */
	action_limit = 1;
	}
	}

	return action_limit;
	}

	static int
	get_active_cmds(stonith_device_t * device)
	{
	int counter = 0;
	GListPtr gIter = NULL;
	GListPtr gIterNext = NULL;

	CRM_CHECK(device != NULL, return 0);

	for (gIter = cmd_list; gIter != NULL; gIter = gIterNext) {
	async_command_t *cmd = gIter->data;

	gIterNext = gIter->next;

	if (cmd->active_on == device) {
	counter++;
	}
	}

	return counter;
	}

	static void
	fork_cb(GPid pid, gpointer user_data)
	{
	async_command_t cmd = (async_command_t ) user_data;
	stonith_device_t * device =
	/* in case of a retry we've done the move from
	activating_on to active_on already
	*/
	cmd->activating_on?cmd->activating_on:cmd->active_on;

	CRM_ASSERT(device);
	crm_debug("Operation '%s'%s%s on %s now running with pid=%d, timeout=%ds",
	cmd->action, cmd->victim ? " targeting " : "", cmd->victim ? cmd->victim : "",
	device->id, pid, cmd->timeout);
	cmd->active_on = device;
	cmd->activating_on = NULL;
	}

	static gboolean
	stonith_device_execute(stonith_device_t * device)
	{
	int exec_rc = 0;
	const char *action_str = NULL;
	const char *host_arg = NULL;
	async_command_t *cmd = NULL;
	stonith_action_t *action = NULL;
	int active_cmds = 0;
	int action_limit = 0;
	GListPtr gIter = NULL;
	GListPtr gIterNext = NULL;

	CRM_CHECK(device != NULL, return FALSE);

	active_cmds = get_active_cmds(device);
	action_limit = get_action_limit(device);
	if (action_limit > -1 && active_cmds >= action_limit) {
	crm_trace("%s is over its action limit of %d (%u active action%s)",
	device->id, action_limit, active_cmds,
	pcmk__plural_s(active_cmds));
	return TRUE;
	}

	for (gIter = device->pending_ops; gIter != NULL; gIter = gIterNext) {
	async_command_t *pending_op = gIter->data;

	gIterNext = gIter->next;

	if (pending_op && pending_op->delay_id) {
	crm_trace
	("Operation '%s'%s%s on %s was asked to run too early, waiting for start_delay timeout of %ds",
	pending_op->action, pending_op->victim ? " targeting " : "",
	pending_op->victim ? pending_op->victim : "",
	device->id, pending_op->start_delay);
	continue;
	}

	device->pending_ops = g_list_remove_link(device->pending_ops, gIter);
	g_list_free_1(gIter);

	cmd = pending_op;
	break;
	}

	if (cmd == NULL) {
	crm_trace("Nothing further to do for %s for now", device->id);
	return TRUE;
	}

	if(pcmk__str_eq(device->agent, STONITH_WATCHDOG_AGENT, pcmk__str_casei)) {
	if(pcmk__str_eq(cmd->action, "reboot", pcmk__str_casei)) {
	pcmk__panic(__func__);
	goto done;

	} else if(pcmk__str_eq(cmd->action, "off", pcmk__str_casei)) {
	pcmk__panic(__func__);
	goto done;

	} else {
	crm_info("Faking success for %s watchdog operation", cmd->action);
	cmd->done_cb(0, 0, NULL, cmd);
	goto done;
	}
	}

	#if SUPPORT_CIBSECRETS
	if (pcmk__substitute_secrets(device->id, device->params) != pcmk_rc_ok) {
	/* replacing secrets failed! */
	if (pcmk__str_eq(cmd->action, "stop", pcmk__str_casei)) {
	/* don't fail on stop! */
	- crm_info("proceeding with the stop operation for %s", device->id);
	+ crm_info("Proceeding with stop operation for %s", device->id);

	} else {
	- crm_err("failed to get secrets for %s, "
	- "considering resource not configured", device->id);
	+ crm_err("Considering %s unconfigured: Failed to get secrets",
	+ device->id);
	exec_rc = PCMK_OCF_NOT_CONFIGURED;
	cmd->done_cb(0, exec_rc, NULL, cmd);
	goto done;
	}
	}
	#endif

	action_str = cmd->action;
	if (pcmk__str_eq(cmd->action, "reboot", pcmk__str_casei)
	&& !pcmk_is_set(device->flags, st_device_supports_reboot)) {

	crm_warn("Agent '%s' does not advertise support for 'reboot', performing 'off' action instead", device->agent);
	action_str = "off";
	}

	if (pcmk_is_set(device->flags, st_device_supports_parameter_port)) {
	host_arg = "port";

	} else if (pcmk_is_set(device->flags, st_device_supports_parameter_plug)) {
	host_arg = "plug";
	}

	action = stonith_action_create(device->agent,
	action_str,
	cmd->victim,
	cmd->victim_nodeid,
	cmd->timeout, device->params,
	device->aliases, host_arg);

	/* for async exec, exec_rc is negative for early error exit
	otherwise handling of success/errors is done via callbacks */
	cmd->activating_on = device;
	exec_rc = stonith_action_execute_async(action, (void *)cmd,
	cmd->done_cb, fork_cb);

	if (exec_rc < 0) {
	crm_warn("Operation '%s'%s%s on %s failed: %s (%d)",
	cmd->action, cmd->victim ? " targeting " : "", cmd->victim ? cmd->victim : "",
	device->id, pcmk_strerror(exec_rc), exec_rc);
	cmd->activating_on = NULL;
	cmd->done_cb(0, exec_rc, NULL, cmd);
	}

	done:
	/* Device might get triggered to work by multiple fencing commands
	* simultaneously. Trigger the device again to make sure any
	* remaining concurrent commands get executed. */
	if (device->pending_ops) {
	mainloop_set_trigger(device->work);
	}
	return TRUE;
	}

	static gboolean
	stonith_device_dispatch(gpointer user_data)
	{
	return stonith_device_execute(user_data);
	}

	static gboolean
	start_delay_helper(gpointer data)
	{
	async_command_t *cmd = data;
	stonith_device_t *device = NULL;

	cmd->delay_id = 0;
	device = cmd->device ? g_hash_table_lookup(device_list, cmd->device) : NULL;

	if (device) {
	mainloop_set_trigger(device->work);
	}

	return FALSE;
	}

	static void
	schedule_stonith_command(async_command_t * cmd, stonith_device_t * device)
	{
	int delay_max = 0;
	int delay_base = 0;
	int requested_delay = cmd->start_delay;

	CRM_CHECK(cmd != NULL, return);
	CRM_CHECK(device != NULL, return);

	if (cmd->device) {
	free(cmd->device);
	}

	if (device->include_nodeid && cmd->victim) {
	crm_node_t *node = crm_get_peer(0, cmd->victim);

	cmd->victim_nodeid = node->id;
	}

	cmd->device = strdup(device->id);
	cmd->timeout = get_action_timeout(device, cmd->action, cmd->default_timeout);

	if (cmd->remote_op_id) {
	crm_debug("Scheduling '%s' action%s%s on %s for remote peer %s "
	"with op id %.8s and timeout %ds",
	cmd->action,
	cmd->victim ? " targeting " : "", cmd->victim ? cmd->victim : "",
	device->id, cmd->origin, cmd->remote_op_id, cmd->timeout);
	} else {
	crm_debug("Scheduling '%s' action%s%s on %s for %s (timeout=%ds)",
	cmd->action,
	cmd->victim ? " targeting " : "", cmd->victim ? cmd->victim : "",
	device->id, cmd->client, cmd->timeout);
	}

	device->pending_ops = g_list_append(device->pending_ops, cmd);
	mainloop_set_trigger(device->work);

	// Value -1 means disable any static/random fencing delays
	if (requested_delay < 0) {
	return;
	}

	delay_max = get_action_delay_max(device, cmd->action);
	delay_base = get_action_delay_base(device, cmd->action);
	if (delay_max == 0) {
	delay_max = delay_base;
	}
	if (delay_max < delay_base) {
	- crm_warn("Base-delay (%ds) is larger than max-delay (%ds) "
	- "for %s on %s - limiting to max-delay",
	+ crm_warn(PCMK_STONITH_DELAY_BASE " (%ds) is larger than "
	+ PCMK_STONITH_DELAY_MAX " (%ds) for %s on %s "
	+ "(limiting to maximum delay)",
	delay_base, delay_max, cmd->action, device->id);
	delay_base = delay_max;
	}
	if (delay_max > 0) {
	// coverity[dont_call] We're not using rand() for security
	cmd->start_delay +=
	((delay_max != delay_base)?(rand() % (delay_max - delay_base)):0)
	+ delay_base;
	}

	if (cmd->start_delay > 0) {
	- crm_notice("Delaying '%s' action%s%s on %s for %ds (timeout=%ds, "
	- "requested_delay=%ds, base=%ds, max=%ds)",
	+ crm_notice("Delaying '%s' action%s%s on %s for %ds " CRM_XS
	+ " timeout=%ds requested_delay=%ds base=%ds max=%ds",
	cmd->action,
	cmd->victim ? " targeting " : "", cmd->victim ? cmd->victim : "",
	device->id, cmd->start_delay, cmd->timeout,
	requested_delay, delay_base, delay_max);
	cmd->delay_id =
	g_timeout_add_seconds(cmd->start_delay, start_delay_helper, cmd);
	}
	}

	static void
	free_device(gpointer data)
	{
	GListPtr gIter = NULL;
	stonith_device_t *device = data;

	g_hash_table_destroy(device->params);
	g_hash_table_destroy(device->aliases);

	for (gIter = device->pending_ops; gIter != NULL; gIter = gIter->next) {
	async_command_t *cmd = gIter->data;

	crm_warn("Removal of device '%s' purged operation '%s'", device->id, cmd->action);
	cmd->done_cb(0, -ENODEV, NULL, cmd);
	}
	g_list_free(device->pending_ops);

	g_list_free_full(device->targets, free);

	mainloop_destroy_trigger(device->work);

	free_xml(device->agent_metadata);
	free(device->namespace);
	free(device->on_target_actions);
	free(device->agent);
	free(device->id);
	free(device);
	}

	void free_device_list(void)
	{
	if (device_list != NULL) {
	g_hash_table_destroy(device_list);
	device_list = NULL;
	}
	}

	void
	init_device_list(void)
	{
	if (device_list == NULL) {
	device_list = g_hash_table_new_full(crm_str_hash, g_str_equal, NULL,
	free_device);
	}
	}

	static GHashTable *
	build_port_aliases(const char hostmap, GListPtr targets)
	{
	char *name = NULL;
	int last = 0, lpc = 0, max = 0, added = 0;
	GHashTable *aliases = crm_strcase_table_new();

	if (hostmap == NULL) {
	return aliases;
	}

	max = strlen(hostmap);
	for (; lpc <= max; lpc++) {
	switch (hostmap[lpc]) {
	/* Assignment chars */
	case '=':
	case ':':
	if (lpc > last) {
	free(name);
	name = calloc(1, 1 + lpc - last);
	memcpy(name, hostmap + last, lpc - last);
	}
	last = lpc + 1;
	break;

	/* Delimeter chars */
	/* case ',': Potentially used to specify multiple ports */
	case 0:
	case ';':
	case ' ':
	case '\t':
	if (name) {
	char *value = NULL;

	value = calloc(1, 1 + lpc - last);
	memcpy(value, hostmap + last, lpc - last);

	crm_debug("Adding alias '%s'='%s'", name, value);
	g_hash_table_replace(aliases, name, value);
	if (targets) {
	targets = g_list_append(targets, strdup(value));
	}
	value = NULL;
	name = NULL;
	added++;

	} else if (lpc > last) {
	crm_debug("Parse error at offset %d near '%s'", lpc - last, hostmap + last);
	}

	last = lpc + 1;
	break;
	}

	if (hostmap[lpc] == 0) {
	break;
	}
	}

	if (added == 0) {
	crm_info("No host mappings detected in '%s'", hostmap);
	}

	free(name);
	return aliases;
	}

	GHashTable *metadata_cache = NULL;

	void
	free_metadata_cache(void) {
	if (metadata_cache != NULL) {
	g_hash_table_destroy(metadata_cache);
	metadata_cache = NULL;
	}
	}

	static void
	init_metadata_cache(void) {
	if (metadata_cache == NULL) {
	metadata_cache = crm_str_table_new();
	}
	}

	static xmlNode *
	get_agent_metadata(const char *agent)
	{
	xmlNode *xml = NULL;
	char *buffer = NULL;

	init_metadata_cache();
	buffer = g_hash_table_lookup(metadata_cache, agent);
	if(pcmk__str_eq(agent, STONITH_WATCHDOG_AGENT, pcmk__str_casei)) {
	return NULL;

	} else if(buffer == NULL) {
	stonith_t *st = stonith_api_new();
	int rc;

	if (st == NULL) {
	crm_warn("Could not get agent meta-data: "
	"API memory allocation failed");
	return NULL;
	}
	rc = st->cmds->metadata(st, st_opt_sync_call, agent, NULL, &buffer, 10);
	stonith_api_delete(st);
	if (rc \|\| !buffer) {
	crm_err("Could not retrieve metadata for fencing agent %s", agent);
	return NULL;
	}
	g_hash_table_replace(metadata_cache, strdup(agent), buffer);
	}

	xml = string2xml(buffer);

	return xml;
	}

	static gboolean
	is_nodeid_required(xmlNode * xml)
	{
	xmlXPathObjectPtr xpath = NULL;

	if (stand_alone) {
	return FALSE;
	}

	if (!xml) {
	return FALSE;
	}

	xpath = xpath_search(xml, "//parameter[@name='nodeid']");
	if (numXpathResults(xpath) <= 0) {
	freeXpathObject(xpath);
	return FALSE;
	}

	freeXpathObject(xpath);
	return TRUE;
	}

	#define MAX_ACTION_LEN 256

	static char *
	add_action(char actions, const char action)
	{
	int offset = 0;

	if (actions == NULL) {
	actions = calloc(1, MAX_ACTION_LEN);
	} else {
	offset = strlen(actions);
	}

	if (offset > 0) {
	offset += snprintf(actions+offset, MAX_ACTION_LEN - offset, " ");
	}
	offset += snprintf(actions+offset, MAX_ACTION_LEN - offset, "%s", action);

	return actions;
	}

	static void
	read_action_metadata(stonith_device_t *device)
	{
	xmlXPathObjectPtr xpath = NULL;
	int max = 0;
	int lpc = 0;

	if (device->agent_metadata == NULL) {
	return;
	}

	xpath = xpath_search(device->agent_metadata, "//action");
	max = numXpathResults(xpath);

	if (max <= 0) {
	freeXpathObject(xpath);
	return;
	}

	for (lpc = 0; lpc < max; lpc++) {
	const char *on_target = NULL;
	const char *action = NULL;
	xmlNode *match = getXpathResult(xpath, lpc);

	CRM_LOG_ASSERT(match != NULL);
	if(match == NULL) { continue; };

	on_target = crm_element_value(match, "on_target");
	action = crm_element_value(match, "name");

	if(pcmk__str_eq(action, "list", pcmk__str_casei)) {
	stonith__set_device_flags(device->flags, device->id,
	st_device_supports_list);
	} else if(pcmk__str_eq(action, "status", pcmk__str_casei)) {
	stonith__set_device_flags(device->flags, device->id,
	st_device_supports_status);
	} else if(pcmk__str_eq(action, "reboot", pcmk__str_casei)) {
	stonith__set_device_flags(device->flags, device->id,
	st_device_supports_reboot);
	} else if (pcmk__str_eq(action, "on", pcmk__str_casei)) {
	/* "automatic" means the cluster will unfence node when it joins */
	const char *automatic = crm_element_value(match, "automatic");

	/* "required" is a deprecated synonym for "automatic" */
	const char *required = crm_element_value(match, "required");

	if (crm_is_true(automatic) \|\| crm_is_true(required)) {
	device->automatic_unfencing = TRUE;
	}
	}

	if (action && crm_is_true(on_target)) {
	device->on_target_actions = add_action(device->on_target_actions, action);
	}
	}

	freeXpathObject(xpath);
	}

	/*!
	* \internal
	* \brief Set a pcmk_*_action parameter if not already set
	*
	* \param[in,out] params Device parameters
	* \param[in] action Name of action
	* \param[in] value Value to use if action is not already set
	*/
	static void
	map_action(GHashTable params, const char action, const char *value)
	{
	char *key = crm_strdup_printf("pcmk_%s_action", action);

	if (g_hash_table_lookup(params, key)) {
	crm_warn("Ignoring %s='%s', see %s instead",
	STONITH_ATTR_ACTION_OP, value, key);
	free(key);
	} else {
	crm_warn("Mapping %s='%s' to %s='%s'",
	STONITH_ATTR_ACTION_OP, value, key, value);
	g_hash_table_insert(params, key, strdup(value));
	}
	}

	/*!
	* \internal
	* \brief Create device parameter table from XML
	*
	* \param[in] name Device name (used for logging only)
	* \param[in,out] params Device parameters
	*/
	static GHashTable *
	xml2device_params(const char name, xmlNode dev)
	{
	GHashTable *params = xml2list(dev);
	const char *value;

	/* Action should never be specified in the device configuration,
	* but we support it for users who are familiar with other software
	* that worked that way.
	*/
	value = g_hash_table_lookup(params, STONITH_ATTR_ACTION_OP);
	if (value != NULL) {
	crm_warn("%s has '%s' parameter, which should never be specified in configuration",
	name, STONITH_ATTR_ACTION_OP);

	if (*value == '\0') {
	crm_warn("Ignoring empty '%s' parameter", STONITH_ATTR_ACTION_OP);

	} else if (strcmp(value, "reboot") == 0) {
	crm_warn("Ignoring %s='reboot' (see stonith-action cluster property instead)",
	STONITH_ATTR_ACTION_OP);

	} else if (strcmp(value, "off") == 0) {
	map_action(params, "reboot", value);

	} else {
	map_action(params, "off", value);
	map_action(params, "reboot", value);
	}

	g_hash_table_remove(params, STONITH_ATTR_ACTION_OP);
	}

	return params;
	}

	static stonith_device_t *
	build_device_from_xml(xmlNode * msg)
	{
	const char *value;
	xmlNode *dev = get_xpath_object("//" F_STONITH_DEVICE, msg, LOG_ERR);
	stonith_device_t *device = NULL;
	char *agent = crm_element_value_copy(dev, "agent");

	CRM_CHECK(agent != NULL, return device);

	device = calloc(1, sizeof(stonith_device_t));

	CRM_CHECK(device != NULL, {free(agent); return device;});

	device->id = crm_element_value_copy(dev, XML_ATTR_ID);
	device->agent = agent;
	device->namespace = crm_element_value_copy(dev, "namespace");
	device->params = xml2device_params(device->id, dev);

	value = g_hash_table_lookup(device->params, PCMK_STONITH_HOST_LIST);
	if (value) {
	device->targets = stonith__parse_targets(value);
	}

	value = g_hash_table_lookup(device->params, PCMK_STONITH_HOST_MAP);
	device->aliases = build_port_aliases(value, &(device->targets));

	device->agent_metadata = get_agent_metadata(device->agent);
	if (device->agent_metadata) {
	read_action_metadata(device);
	stonith__device_parameter_flags(&(device->flags), device->id,
	device->agent_metadata);
	}

	value = g_hash_table_lookup(device->params, "nodeid");
	if (!value) {
	device->include_nodeid = is_nodeid_required(device->agent_metadata);
	}

	value = crm_element_value(dev, "rsc_provides");
	if (pcmk__str_eq(value, "unfencing", pcmk__str_casei)) {
	device->automatic_unfencing = TRUE;
	}

	if (is_action_required("on", device)) {
	- crm_info("The fencing device '%s' requires unfencing", device->id);
	+ crm_info("Fencing device '%s' requires unfencing", device->id);
	}

	if (device->on_target_actions) {
	- crm_info("The fencing device '%s' requires actions (%s) to be executed on the target node",
	- device->id, device->on_target_actions);
	+ crm_info("Fencing device '%s' requires actions (%s) to be executed "
	+ "on target", device->id, device->on_target_actions);
	}

	device->work = mainloop_add_trigger(G_PRIORITY_HIGH, stonith_device_dispatch, device);
	/* TODO: Hook up priority */

	return device;
	}

	static const char *
	target_list_type(stonith_device_t * dev)
	{
	const char *check_type = NULL;

	check_type = g_hash_table_lookup(dev->params, PCMK_STONITH_HOST_CHECK);

	if (check_type == NULL) {

	if (g_hash_table_lookup(dev->params, PCMK_STONITH_HOST_LIST)) {
	check_type = "static-list";
	} else if (g_hash_table_lookup(dev->params, PCMK_STONITH_HOST_MAP)) {
	check_type = "static-list";
	} else if (pcmk_is_set(dev->flags, st_device_supports_list)) {
	check_type = "dynamic-list";
	} else if (pcmk_is_set(dev->flags, st_device_supports_status)) {
	check_type = "status";
	} else {
	check_type = "none";
	}
	}

	return check_type;
	}

	static void
	schedule_internal_command(const char *origin,
	stonith_device_t * device,
	const char *action,
	const char *victim,
	int timeout,
	void *internal_user_data,
	void (done_cb) (GPid pid, int rc, const char output,
	gpointer user_data))
	{
	async_command_t *cmd = NULL;

	cmd = calloc(1, sizeof(async_command_t));

	cmd->id = -1;
	cmd->default_timeout = timeout ? timeout : 60;
	cmd->timeout = cmd->default_timeout;
	cmd->action = strdup(action);
	cmd->victim = victim ? strdup(victim) : NULL;
	cmd->device = strdup(device->id);
	cmd->origin = strdup(origin);
	cmd->client = strdup(crm_system_name);
	cmd->client_name = strdup(crm_system_name);

	cmd->internal_user_data = internal_user_data;
	cmd->done_cb = done_cb; /* cmd, not internal_user_data, is passed to 'done_cb' as the userdata */

	schedule_stonith_command(cmd, device);
	}

	gboolean
	string_in_list(GListPtr list, const char *item)
	{
	int lpc = 0;
	int max = g_list_length(list);

	for (lpc = 0; lpc < max; lpc++) {
	const char *value = g_list_nth_data(list, lpc);

	if (pcmk__str_eq(item, value, pcmk__str_casei)) {
	return TRUE;
	} else {
	crm_trace("%d: '%s' != '%s'", lpc, item, value);
	}
	}
	return FALSE;
	}

	static void
	status_search_cb(GPid pid, int rc, const char *output, gpointer user_data)
	{
	async_command_t *cmd = user_data;
	struct device_search_s *search = cmd->internal_user_data;
	stonith_device_t *dev = cmd->device ? g_hash_table_lookup(device_list, cmd->device) : NULL;
	gboolean can = FALSE;

	free_async_command(cmd);

	if (!dev) {
	search_devices_record_result(search, NULL, FALSE);
	return;
	}

	mainloop_set_trigger(dev->work);

	if (rc == 1 /* unknown */ ) {
	crm_trace("Host %s is not known by %s", search->host, dev->id);

	} else if (rc == 0 /* active / \|\| rc == 2 / inactive */ ) {
	crm_trace("Host %s is known by %s", search->host, dev->id);
	can = TRUE;

	} else {
	crm_notice("Unknown result when testing if %s can fence %s: rc=%d", dev->id, search->host,
	rc);
	}
	search_devices_record_result(search, dev->id, can);
	}

	static void
	dynamic_list_search_cb(GPid pid, int rc, const char *output, gpointer user_data)
	{
	async_command_t *cmd = user_data;
	struct device_search_s *search = cmd->internal_user_data;
	stonith_device_t *dev = cmd->device ? g_hash_table_lookup(device_list, cmd->device) : NULL;
	gboolean can_fence = FALSE;

	free_async_command(cmd);

	/* Host/alias must be in the list output to be eligible to be fenced
	*
	* Will cause problems if down'd nodes aren't listed or (for virtual nodes)
	* if the guest is still listed despite being moved to another machine
	*/
	if (!dev) {
	search_devices_record_result(search, NULL, FALSE);
	return;
	}

	mainloop_set_trigger(dev->work);

	/* If we successfully got the targets earlier, don't disable. */
	if (rc != 0 && !dev->targets) {
	- crm_notice("Disabling port list queries for %s (%d): %s", dev->id, rc, output);
	+ crm_notice("Disabling port list queries for %s: %s "
	+ CRM_XS " rc=%d", dev->id, output, rc);
	/* Fall back to status */
	g_hash_table_replace(dev->params,
	strdup(PCMK_STONITH_HOST_CHECK), strdup("status"));

	g_list_free_full(dev->targets, free);
	dev->targets = NULL;
	} else if (!rc) {
	crm_info("Refreshing port list for %s", dev->id);
	g_list_free_full(dev->targets, free);
	dev->targets = stonith__parse_targets(output);
	dev->targets_age = time(NULL);
	}

	if (dev->targets) {
	const char *alias = g_hash_table_lookup(dev->aliases, search->host);

	if (!alias) {
	alias = search->host;
	}
	if (string_in_list(dev->targets, alias)) {
	can_fence = TRUE;
	}
	}
	search_devices_record_result(search, dev->id, can_fence);
	}

	/*!
	* \internal
	* \brief Returns true if any key in first is not in second or second has a different value for key
	*/
	static int
	device_params_diff(GHashTable first, GHashTable second) {
	char *key = NULL;
	char *value = NULL;
	GHashTableIter gIter;

	g_hash_table_iter_init(&gIter, first);
	while (g_hash_table_iter_next(&gIter, (void )&key, (void )&value)) {

	if(strstr(key, "CRM_meta") == key) {
	continue;
	} else if(strcmp(key, "crm_feature_set") == 0) {
	continue;
	} else {
	char *other_value = g_hash_table_lookup(second, key);

	if (!other_value \|\| !pcmk__str_eq(other_value, value, pcmk__str_casei)) {
	crm_trace("Different value for %s: %s != %s", key, other_value, value);
	return 1;
	}
	}
	}

	return 0;
	}

	/*!
	* \internal
	* \brief Checks to see if an identical device already exists in the device_list
	*/
	static stonith_device_t *
	device_has_duplicate(stonith_device_t * device)
	{
	stonith_device_t *dup = g_hash_table_lookup(device_list, device->id);

	if (!dup) {
	crm_trace("No match for %s", device->id);
	return NULL;

	} else if (!pcmk__str_eq(dup->agent, device->agent, pcmk__str_casei)) {
	crm_trace("Different agent: %s != %s", dup->agent, device->agent);
	return NULL;
	}

	/* Use calculate_operation_digest() here? */
	if (device_params_diff(device->params, dup->params) \|\|
	device_params_diff(dup->params, device->params)) {
	return NULL;
	}

	crm_trace("Match");
	return dup;
	}

	int
	stonith_device_register(xmlNode * msg, const char **desc, gboolean from_cib)
	{
	stonith_device_t *dup = NULL;
	stonith_device_t *device = build_device_from_xml(msg);
	guint ndevices = 0;

	CRM_CHECK(device != NULL, return -ENOMEM);

	dup = device_has_duplicate(device);
	if (dup) {
	ndevices = g_hash_table_size(device_list);
	crm_debug("Device '%s' already in device list (%d active device%s)",
	device->id, ndevices, pcmk__plural_s(ndevices));
	free_device(device);
	device = dup;

	} else {
	stonith_device_t *old = g_hash_table_lookup(device_list, device->id);

	if (from_cib && old && old->api_registered) {
	/* If the cib is writing over an entry that is shared with a stonith client,
	* copy any pending ops that currently exist on the old entry to the new one.
	* Otherwise the pending ops will be reported as failures
	*/
	- crm_info("Overwriting an existing entry for %s from the cib", device->id);
	+ crm_info("Overwriting existing entry for %s from CIB", device->id);
	device->pending_ops = old->pending_ops;
	device->api_registered = TRUE;
	old->pending_ops = NULL;
	if (device->pending_ops) {
	mainloop_set_trigger(device->work);
	}
	}
	g_hash_table_replace(device_list, device->id, device);

	ndevices = g_hash_table_size(device_list);
	crm_notice("Added '%s' to device list (%d active device%s)",
	device->id, ndevices, pcmk__plural_s(ndevices));
	}
	if (desc) {
	*desc = device->id;
	}

	if (from_cib) {
	device->cib_registered = TRUE;
	} else {
	device->api_registered = TRUE;
	}

	return pcmk_ok;
	}

	int
	stonith_device_remove(const char *id, gboolean from_cib)
	{
	stonith_device_t *device = g_hash_table_lookup(device_list, id);
	guint ndevices = 0;

	if (!device) {
	ndevices = g_hash_table_size(device_list);
	crm_info("Device '%s' not found (%d active device%s)",
	id, ndevices, pcmk__plural_s(ndevices));
	return pcmk_ok;
	}

	if (from_cib) {
	device->cib_registered = FALSE;
	} else {
	device->verified = FALSE;
	device->api_registered = FALSE;
	}

	if (!device->cib_registered && !device->api_registered) {
	g_hash_table_remove(device_list, id);
	ndevices = g_hash_table_size(device_list);
	crm_info("Removed '%s' from device list (%d active device%s)",
	id, ndevices, pcmk__plural_s(ndevices));
	} else {
	crm_trace("Not removing '%s' from device list (%d active) because "
	"still registered via:%s%s",
	id, g_hash_table_size(device_list),
	(device->cib_registered? " cib" : ""),
	(device->api_registered? " api" : ""));
	}
	return pcmk_ok;
	}

	/*!
	* \internal
	* \brief Return the number of stonith levels registered for a node
	*
	* \param[in] tp Node's topology table entry
	*
	* \return Number of non-NULL levels in topology entry
	* \note This function is used only for log messages.
	*/
	static int
	count_active_levels(stonith_topology_t * tp)
	{
	int lpc = 0;
	int count = 0;

	for (lpc = 0; lpc < ST_LEVEL_MAX; lpc++) {
	if (tp->levels[lpc] != NULL) {
	count++;
	}
	}
	return count;
	}

	static void
	free_topology_entry(gpointer data)
	{
	stonith_topology_t *tp = data;

	int lpc = 0;

	for (lpc = 0; lpc < ST_LEVEL_MAX; lpc++) {
	if (tp->levels[lpc] != NULL) {
	g_list_free_full(tp->levels[lpc], free);
	}
	}
	free(tp->target);
	free(tp->target_value);
	free(tp->target_pattern);
	free(tp->target_attribute);
	free(tp);
	}

	void
	free_topology_list(void)
	{
	if (topology != NULL) {
	g_hash_table_destroy(topology);
	topology = NULL;
	}
	}

	void
	init_topology_list(void)
	{
	if (topology == NULL) {
	topology = g_hash_table_new_full(crm_str_hash, g_str_equal, NULL,
	free_topology_entry);
	}
	}

	char stonith_level_key(xmlNode level, int mode)
	{
	if(mode == -1) {
	mode = stonith_level_kind(level);
	}

	switch(mode) {
	case 0:
	return crm_element_value_copy(level, XML_ATTR_STONITH_TARGET);
	case 1:
	return crm_element_value_copy(level, XML_ATTR_STONITH_TARGET_PATTERN);
	case 2:
	{
	const char *name = crm_element_value(level, XML_ATTR_STONITH_TARGET_ATTRIBUTE);
	const char *value = crm_element_value(level, XML_ATTR_STONITH_TARGET_VALUE);

	if(name && value) {
	return crm_strdup_printf("%s=%s", name, value);
	}
	}
	default:
	return crm_strdup_printf("Unknown-%d-%s", mode, ID(level));
	}
	}

	int stonith_level_kind(xmlNode * level)
	{
	int mode = 0;
	const char *target = crm_element_value(level, XML_ATTR_STONITH_TARGET);

	if(target == NULL) {
	mode++;
	target = crm_element_value(level, XML_ATTR_STONITH_TARGET_PATTERN);
	}

	if(stand_alone == FALSE && target == NULL) {

	mode++;

	if(crm_element_value(level, XML_ATTR_STONITH_TARGET_ATTRIBUTE) == NULL) {
	mode++;

	} else if(crm_element_value(level, XML_ATTR_STONITH_TARGET_VALUE) == NULL) {
	mode++;
	}
	}

	return mode;
	}

	static stonith_key_value_t *
	parse_device_list(const char *devices)
	{
	int lpc = 0;
	int max = 0;
	int last = 0;
	stonith_key_value_t *output = NULL;

	if (devices == NULL) {
	return output;
	}

	max = strlen(devices);
	for (lpc = 0; lpc <= max; lpc++) {
	if (devices[lpc] == ',' \|\| devices[lpc] == 0) {
	char *line = strndup(devices + last, lpc - last);

	output = stonith_key_value_add(output, NULL, line);
	free(line);

	last = lpc + 1;
	}
	}

	return output;
	}

	/*!
	* \internal
	* \brief Register a STONITH level for a target
	*
	* Given an XML request specifying the target name, level index, and device IDs
	* for the level, this will create an entry for the target in the global topology
	* table if one does not already exist, then append the specified device IDs to
	* the entry's device list for the specified level.
	*
	* \param[in] msg XML request for STONITH level registration
	* \param[out] desc If not NULL, will be set to string representation ("TARGET[LEVEL]")
	*
	* \return pcmk_ok on success, -EINVAL if XML does not specify valid level index
	*/
	int
	stonith_level_register(xmlNode msg, char *desc)
	{
	int id = 0;
	xmlNode *level;
	int mode;
	char *target;

	stonith_topology_t *tp;
	stonith_key_value_t *dIter = NULL;
	stonith_key_value_t *devices = NULL;

	/* Allow the XML here to point to the level tag directly, or wrapped in
	* another tag. If directly, don't search by xpath, because it might give
	* multiple hits (e.g. if the XML is the CIB).
	*/
	if (pcmk__str_eq(TYPE(msg), XML_TAG_FENCING_LEVEL, pcmk__str_casei)) {
	level = msg;
	} else {
	level = get_xpath_object("//" XML_TAG_FENCING_LEVEL, msg, LOG_ERR);
	}
	CRM_CHECK(level != NULL, return -EINVAL);

	mode = stonith_level_kind(level);
	target = stonith_level_key(level, mode);
	crm_element_value_int(level, XML_ATTR_STONITH_INDEX, &id);

	if (desc) {
	*desc = crm_strdup_printf("%s[%d]", target, id);
	}

	/* Sanity-check arguments */
	if (mode >= 3 \|\| (id <= 0) \|\| (id >= ST_LEVEL_MAX)) {
	crm_trace("Could not add %s[%d] (%d) to the topology (%d active entries)", target, id, mode, g_hash_table_size(topology));
	free(target);
	crm_log_xml_err(level, "Bad topology");
	return -EINVAL;
	}

	/* Find or create topology table entry */
	tp = g_hash_table_lookup(topology, target);
	if (tp == NULL) {
	tp = calloc(1, sizeof(stonith_topology_t));
	tp->kind = mode;
	tp->target = target;
	tp->target_value = crm_element_value_copy(level, XML_ATTR_STONITH_TARGET_VALUE);
	tp->target_pattern = crm_element_value_copy(level, XML_ATTR_STONITH_TARGET_PATTERN);
	tp->target_attribute = crm_element_value_copy(level, XML_ATTR_STONITH_TARGET_ATTRIBUTE);

	g_hash_table_replace(topology, tp->target, tp);
	crm_trace("Added %s (%d) to the topology (%d active entries)",
	target, mode, g_hash_table_size(topology));
	} else {
	free(target);
	}

	if (tp->levels[id] != NULL) {
	crm_info("Adding to the existing %s[%d] topology entry",
	tp->target, id);
	}

	devices = parse_device_list(crm_element_value(level, XML_ATTR_STONITH_DEVICES));
	for (dIter = devices; dIter; dIter = dIter->next) {
	const char *device = dIter->value;

	crm_trace("Adding device '%s' for %s[%d]", device, tp->target, id);
	tp->levels[id] = g_list_append(tp->levels[id], strdup(device));
	}
	stonith_key_value_freeall(devices, 1, 1);

	{
	int nlevels = count_active_levels(tp);

	crm_info("Target %s has %d active fencing level%s",
	tp->target, nlevels, pcmk__plural_s(nlevels));
	}
	return pcmk_ok;
	}

	int
	stonith_level_remove(xmlNode msg, char *desc)
	{
	int id = 0;
	stonith_topology_t *tp;
	char *target;

	/* Unlike additions, removal requests should always have one level tag */
	xmlNode *level = get_xpath_object("//" XML_TAG_FENCING_LEVEL, msg, LOG_ERR);

	CRM_CHECK(level != NULL, return -EINVAL);

	target = stonith_level_key(level, -1);
	crm_element_value_int(level, XML_ATTR_STONITH_INDEX, &id);
	if (desc) {
	*desc = crm_strdup_printf("%s[%d]", target, id);
	}

	/* Sanity-check arguments */
	if (id >= ST_LEVEL_MAX) {
	free(target);
	return -EINVAL;
	}

	tp = g_hash_table_lookup(topology, target);
	if (tp == NULL) {
	guint nentries = g_hash_table_size(topology);

	crm_info("No fencing topology found for %s (%d active %s)",
	target, nentries,
	pcmk__plural_alt(nentries, "entry", "entries"));

	} else if (id == 0 && g_hash_table_remove(topology, target)) {
	guint nentries = g_hash_table_size(topology);

	crm_info("Removed all fencing topology entries related to %s "
	"(%d active %s remaining)", target, nentries,
	pcmk__plural_alt(nentries, "entry", "entries"));

	} else if (id > 0 && tp->levels[id] != NULL) {
	guint nlevels;

	g_list_free_full(tp->levels[id], free);
	tp->levels[id] = NULL;

	nlevels = count_active_levels(tp);
	crm_info("Removed level %d from fencing topology for %s "
	"(%d active level%s remaining)",
	id, target, nlevels, pcmk__plural_s(nlevels));
	}

	free(target);
	return pcmk_ok;
	}

	/*!
	* \internal
	* \brief Schedule an (asynchronous) action directly on a stonith device
	*
	* Handle a STONITH_OP_EXEC API message by scheduling a requested agent action
	* directly on a specified device. Only list, monitor, and status actions are
	* expected to use this call, though it should work with any agent command.
	*
	* \param[in] msg API message XML with desired action
	* \param[out] output Unused
	*
	* \return -EINPROGRESS on success, -errno otherwise
	* \note If the action is monitor, the device must be registered via the API
	* (CIB registration is not sufficient), because monitor should not be
	* possible unless the device is "started" (API registered).
	*/
	static int
	stonith_device_action(xmlNode * msg, char **output)
	{
	xmlNode *dev = get_xpath_object("//" F_STONITH_DEVICE, msg, LOG_ERR);
	xmlNode *op = get_xpath_object("//@" F_STONITH_ACTION, msg, LOG_ERR);
	const char *id = crm_element_value(dev, F_STONITH_DEVICE);
	const char *action = crm_element_value(op, F_STONITH_ACTION);
	async_command_t *cmd = NULL;
	stonith_device_t *device = NULL;

	if ((id == NULL) \|\| (action == NULL)) {
	crm_info("Malformed API action request: device %s, action %s",
	(id? id : "not specified"),
	(action? action : "not specified"));
	return -EPROTO;
	}

	device = g_hash_table_lookup(device_list, id);
	if ((device == NULL)
	\|\| (!device->api_registered && !strcmp(action, "monitor"))) {

	// Monitors may run only on "started" (API-registered) devices
	crm_info("Ignoring API '%s' action request because device %s not found",
	action, id);
	return -ENODEV;
	}

	cmd = create_async_command(msg);
	if (cmd == NULL) {
	return -EPROTO;
	}

	schedule_stonith_command(cmd, device);
	return -EINPROGRESS;
	}

	static void
	search_devices_record_result(struct device_search_s search, const char device, gboolean can_fence)
	{
	search->replies_received++;

	if (can_fence && device) {
	search->capable = g_list_append(search->capable, strdup(device));
	}

	if (search->replies_needed == search->replies_received) {

	guint ndevices = g_list_length(search->capable);

	crm_debug("Search found %d device%s that can perform '%s' targeting %s",
	ndevices, pcmk__plural_s(ndevices),
	(search->action? search->action : "unknown action"),
	(search->host? search->host : "any node"));

	search->callback(search->capable, search->user_data);
	free(search->host);
	free(search->action);
	free(search);
	}
	}

	/*!
	* \internal
	* \brief Check whether the local host is allowed to execute a fencing action
	*
	* \param[in] device Fence device to check
	* \param[in] action Fence action to check
	* \param[in] target Hostname of fence target
	* \param[in] allow_suicide Whether self-fencing is allowed for this operation
	*
	* \return TRUE if local host is allowed to execute action, FALSE otherwise
	*/
	static gboolean
	localhost_is_eligible(const stonith_device_t device, const char action,
	const char *target, gboolean allow_suicide)
	{
	gboolean localhost_is_target = pcmk__str_eq(target, stonith_our_uname,
	pcmk__str_casei);

	if (device && action && device->on_target_actions
	&& strstr(device->on_target_actions, action)) {
	if (!localhost_is_target) {
	crm_trace("'%s' operation with %s can only be executed for localhost not %s",
	action, device->id, target);
	return FALSE;
	}

	} else if (localhost_is_target && !allow_suicide) {
	crm_trace("'%s' operation does not support self-fencing", action);
	return FALSE;
	}
	return TRUE;
	}

	static void
	can_fence_host_with_device(stonith_device_t * dev, struct device_search_s *search)
	{
	gboolean can = FALSE;
	const char *check_type = NULL;
	const char *host = search->host;
	const char *alias = NULL;

	CRM_LOG_ASSERT(dev != NULL);

	if (dev == NULL) {
	goto search_report_results;
	} else if (host == NULL) {
	can = TRUE;
	goto search_report_results;
	}

	/* Short-circuit query if this host is not allowed to perform the action */
	if (pcmk__str_eq(search->action, "reboot", pcmk__str_casei)) {
	/* A "reboot" might get remapped to "off" then "on", so short-circuit
	* only if all three are disallowed. If only one or two are disallowed,
	* we'll report that with the results. We never allow suicide for
	* remapped "on" operations because the host is off at that point.
	*/
	if (!localhost_is_eligible(dev, "reboot", host, search->allow_suicide)
	&& !localhost_is_eligible(dev, "off", host, search->allow_suicide)
	&& !localhost_is_eligible(dev, "on", host, FALSE)) {
	goto search_report_results;
	}
	} else if (!localhost_is_eligible(dev, search->action, host,
	search->allow_suicide)) {
	goto search_report_results;
	}

	alias = g_hash_table_lookup(dev->aliases, host);
	if (alias == NULL) {
	alias = host;
	}

	check_type = target_list_type(dev);

	if (pcmk__str_eq(check_type, "none", pcmk__str_casei)) {
	can = TRUE;

	} else if (pcmk__str_eq(check_type, "static-list", pcmk__str_casei)) {

	/* Presence in the hostmap is sufficient
	* Only use if all hosts on which the device can be active can always fence all listed hosts
	*/

	if (string_in_list(dev->targets, host)) {
	can = TRUE;
	} else if (g_hash_table_lookup(dev->params, PCMK_STONITH_HOST_MAP)
	&& g_hash_table_lookup(dev->aliases, host)) {
	can = TRUE;
	}

	} else if (pcmk__str_eq(check_type, "dynamic-list", pcmk__str_casei)) {
	time_t now = time(NULL);

	if (dev->targets == NULL \|\| dev->targets_age + 60 < now) {
	crm_trace("Running '%s' to check whether %s is eligible to fence %s (%s)",
	check_type, dev->id, search->host, search->action);

	schedule_internal_command(__func__, dev, "list", NULL,
	search->per_device_timeout, search, dynamic_list_search_cb);

	/* we'll respond to this search request async in the cb */
	return;
	}

	if (string_in_list(dev->targets, alias)) {
	can = TRUE;
	}

	} else if (pcmk__str_eq(check_type, "status", pcmk__str_casei)) {
	crm_trace("Running '%s' to check whether %s is eligible to fence %s (%s)",
	check_type, dev->id, search->host, search->action);
	schedule_internal_command(__func__, dev, "status", search->host,
	search->per_device_timeout, search, status_search_cb);
	/* we'll respond to this search request async in the cb */
	return;
	} else {
	crm_err("Invalid value for " PCMK_STONITH_HOST_CHECK ": %s", check_type);
	check_type = "Invalid " PCMK_STONITH_HOST_CHECK;
	}

	if (pcmk__str_eq(host, alias, pcmk__str_casei)) {
	crm_notice("%s is%s eligible to fence (%s) %s: %s",
	dev->id, (can? "" : " not"), search->action, host,
	check_type);
	} else {
	crm_notice("%s is%s eligible to fence (%s) %s (aka. '%s'): %s",
	dev->id, (can? "" : " not"), search->action, host, alias,
	check_type);
	}

	search_report_results:
	search_devices_record_result(search, dev ? dev->id : NULL, can);
	}

	static void
	search_devices(gpointer key, gpointer value, gpointer user_data)
	{
	stonith_device_t *dev = value;
	struct device_search_s *search = user_data;

	can_fence_host_with_device(dev, search);
	}

	#define DEFAULT_QUERY_TIMEOUT 20
	static void
	get_capable_devices(const char host, const char action, int timeout, bool suicide, void *user_data,
	void (callback) (GList devices, void *user_data))
	{
	struct device_search_s *search;
	int per_device_timeout = DEFAULT_QUERY_TIMEOUT;
	int devices_needing_async_query = 0;
	char *key = NULL;
	const char *check_type = NULL;
	GHashTableIter gIter;
	stonith_device_t *device = NULL;
	guint ndevices = g_hash_table_size(device_list);

	if (ndevices == 0) {
	callback(NULL, user_data);
	return;
	}

	search = calloc(1, sizeof(struct device_search_s));
	if (!search) {
	callback(NULL, user_data);
	return;
	}

	g_hash_table_iter_init(&gIter, device_list);
	while (g_hash_table_iter_next(&gIter, (void )&key, (void )&device)) {
	check_type = target_list_type(device);
	if (pcmk__strcase_any_of(check_type, "status", "dynamic-list", NULL)) {
	devices_needing_async_query++;
	}
	}

	/* If we have devices that require an async event in order to know what
	* nodes they can fence, we have to give the events a timeout. The total
	* query timeout is divided among those events. */
	if (devices_needing_async_query) {
	per_device_timeout = timeout / devices_needing_async_query;
	if (!per_device_timeout) {
	crm_err("Fencing timeout %ds is too low; using %ds, "
	"but consider raising to at least %ds",
	timeout, DEFAULT_QUERY_TIMEOUT,
	DEFAULT_QUERY_TIMEOUT * devices_needing_async_query);
	per_device_timeout = DEFAULT_QUERY_TIMEOUT;
	} else if (per_device_timeout < DEFAULT_QUERY_TIMEOUT) {
	crm_notice("Fencing timeout %ds is low for the current "
	"configuration; consider raising to at least %ds",
	timeout, DEFAULT_QUERY_TIMEOUT * devices_needing_async_query);
	}
	}

	search->host = host ? strdup(host) : NULL;
	search->action = action ? strdup(action) : NULL;
	search->per_device_timeout = per_device_timeout;
	/* We are guaranteed this many replies. Even if a device gets
	* unregistered some how during the async search, we will get
	* the correct number of replies. */
	search->replies_needed = ndevices;
	search->allow_suicide = suicide;
	search->callback = callback;
	search->user_data = user_data;
	/* kick off the search */

	crm_debug("Searching %d device%s to see which can execute '%s' targeting %s",
	ndevices, pcmk__plural_s(ndevices),
	(search->action? search->action : "unknown action"),
	(search->host? search->host : "any node"));
	g_hash_table_foreach(device_list, search_devices, search);
	}

	struct st_query_data {
	xmlNode *reply;
	char *remote_peer;
	char *client_id;
	char *target;
	char *action;
	int call_options;
	};

	/*!
	* \internal
	* \brief Add action-specific attributes to query reply XML
	*
	* \param[in,out] xml XML to add attributes to
	* \param[in] action Fence action
	* \param[in] device Fence device
	*/
	static void
	add_action_specific_attributes(xmlNode xml, const char action,
	stonith_device_t *device)
	{
	int action_specific_timeout;
	int delay_max;
	int delay_base;

	CRM_CHECK(xml && action && device, return);

	if (is_action_required(action, device)) {
	crm_trace("Action '%s' is required on %s", action, device->id);
	crm_xml_add_int(xml, F_STONITH_DEVICE_REQUIRED, 1);
	}

	action_specific_timeout = get_action_timeout(device, action, 0);
	if (action_specific_timeout) {
	crm_trace("Action '%s' has timeout %dms on %s",
	action, action_specific_timeout, device->id);
	crm_xml_add_int(xml, F_STONITH_ACTION_TIMEOUT, action_specific_timeout);
	}

	delay_max = get_action_delay_max(device, action);
	if (delay_max > 0) {
	crm_trace("Action '%s' has maximum random delay %dms on %s",
	action, delay_max, device->id);
	crm_xml_add_int(xml, F_STONITH_DELAY_MAX, delay_max / 1000);
	}

	delay_base = get_action_delay_base(device, action);
	if (delay_base > 0) {
	crm_xml_add_int(xml, F_STONITH_DELAY_BASE, delay_base / 1000);
	}

	if ((delay_max > 0) && (delay_base == 0)) {
	crm_trace("Action '%s' has maximum random delay %dms on %s",
	action, delay_max, device->id);
	} else if ((delay_max == 0) && (delay_base > 0)) {
	crm_trace("Action '%s' has a static delay of %dms on %s",
	action, delay_base, device->id);
	} else if ((delay_max > 0) && (delay_base > 0)) {
	crm_trace("Action '%s' has a minimum delay of %dms and a randomly chosen "
	"maximum delay of %dms on %s",
	action, delay_base, delay_max, device->id);
	}
	}

	/*!
	* \internal
	* \brief Add "disallowed" attribute to query reply XML if appropriate
	*
	* \param[in,out] xml XML to add attribute to
	* \param[in] action Fence action
	* \param[in] device Fence device
	* \param[in] target Fence target
	* \param[in] allow_suicide Whether self-fencing is allowed
	*/
	static void
	add_disallowed(xmlNode xml, const char action, stonith_device_t *device,
	const char *target, gboolean allow_suicide)
	{
	if (!localhost_is_eligible(device, action, target, allow_suicide)) {
	crm_trace("Action '%s' on %s is disallowed for local host",
	action, device->id);
	crm_xml_add(xml, F_STONITH_ACTION_DISALLOWED, XML_BOOLEAN_TRUE);
	}
	}

	/*!
	* \internal
	* \brief Add child element with action-specific values to query reply XML
	*
	* \param[in,out] xml XML to add attribute to
	* \param[in] action Fence action
	* \param[in] device Fence device
	* \param[in] target Fence target
	* \param[in] allow_suicide Whether self-fencing is allowed
	*/
	static void
	add_action_reply(xmlNode xml, const char action, stonith_device_t *device,
	const char *target, gboolean allow_suicide)
	{
	xmlNode *child = create_xml_node(xml, F_STONITH_ACTION);

	crm_xml_add(child, XML_ATTR_ID, action);
	add_action_specific_attributes(child, action, device);
	add_disallowed(child, action, device, target, allow_suicide);
	}

	static void
	stonith_query_capable_device_cb(GList * devices, void *user_data)
	{
	struct st_query_data *query = user_data;
	int available_devices = 0;
	xmlNode *dev = NULL;
	xmlNode *list = NULL;
	GListPtr lpc = NULL;

	/* Pack the results into XML */
	list = create_xml_node(NULL, __func__);
	crm_xml_add(list, F_STONITH_TARGET, query->target);
	for (lpc = devices; lpc != NULL; lpc = lpc->next) {
	stonith_device_t *device = g_hash_table_lookup(device_list, lpc->data);
	const char *action = query->action;

	if (!device) {
	/* It is possible the device got unregistered while
	* determining who can fence the target */
	continue;
	}

	available_devices++;

	dev = create_xml_node(list, F_STONITH_DEVICE);
	crm_xml_add(dev, XML_ATTR_ID, device->id);
	crm_xml_add(dev, "namespace", device->namespace);
	crm_xml_add(dev, "agent", device->agent);
	crm_xml_add_int(dev, F_STONITH_DEVICE_VERIFIED, device->verified);

	/* If the originating fencer wants to reboot the node, and we have a
	* capable device that doesn't support "reboot", remap to "off" instead.
	*/
	if (!pcmk_is_set(device->flags, st_device_supports_reboot)
	&& pcmk__str_eq(query->action, "reboot", pcmk__str_casei)) {
	crm_trace("%s doesn't support reboot, using values for off instead",
	device->id);
	action = "off";
	}

	/* Add action-specific values if available */
	add_action_specific_attributes(dev, action, device);
	if (pcmk__str_eq(query->action, "reboot", pcmk__str_casei)) {
	/* A "reboot" might get remapped to "off" then "on", so after
	* sending the "reboot"-specific values in the main element, we add
	* sub-elements for "off" and "on" values.
	*
	* We short-circuited earlier if "reboot", "off" and "on" are all
	* disallowed for the local host. However if only one or two are
	* disallowed, we send back the results and mark which ones are
	* disallowed. If "reboot" is disallowed, this might cause problems
	* with older fencer versions, which won't check for it. Older
	* versions will ignore "off" and "on", so they are not a problem.
	*/
	add_disallowed(dev, action, device, query->target,
	pcmk_is_set(query->call_options, st_opt_allow_suicide));
	add_action_reply(dev, "off", device, query->target,
	pcmk_is_set(query->call_options, st_opt_allow_suicide));
	add_action_reply(dev, "on", device, query->target, FALSE);
	}

	/* A query without a target wants device parameters */
	if (query->target == NULL) {
	xmlNode *attrs = create_xml_node(dev, XML_TAG_ATTRS);

	g_hash_table_foreach(device->params, hash2field, attrs);
	}
	}

	crm_xml_add_int(list, F_STONITH_AVAILABLE_DEVICES, available_devices);
	if (query->target) {
	crm_debug("Found %d matching device%s for target '%s'",
	available_devices, pcmk__plural_s(available_devices),
	query->target);
	} else {
	crm_debug("%d device%s installed",
	available_devices, pcmk__plural_s(available_devices));
	}

	if (list != NULL) {
	crm_log_xml_trace(list, "Add query results");
	add_message_xml(query->reply, F_STONITH_CALLDATA, list);
	}
	stonith_send_reply(query->reply, query->call_options, query->remote_peer, query->client_id);

	free_xml(query->reply);
	free(query->remote_peer);
	free(query->client_id);
	free(query->target);
	free(query->action);
	free(query);
	free_xml(list);
	g_list_free_full(devices, free);
	}

	static void
	stonith_query(xmlNode * msg, const char remote_peer, const char client_id, int call_options)
	{
	struct st_query_data *query = NULL;
	const char *action = NULL;
	const char *target = NULL;
	int timeout = 0;
	xmlNode *dev = get_xpath_object("//@" F_STONITH_ACTION, msg, LOG_NEVER);

	crm_element_value_int(msg, F_STONITH_TIMEOUT, &timeout);
	if (dev) {
	const char *device = crm_element_value(dev, F_STONITH_DEVICE);

	target = crm_element_value(dev, F_STONITH_TARGET);
	action = crm_element_value(dev, F_STONITH_ACTION);
	if (device && pcmk__str_eq(device, "manual_ack", pcmk__str_casei)) {
	/* No query or reply necessary */
	return;
	}
	}

	crm_log_xml_debug(msg, "Query");
	query = calloc(1, sizeof(struct st_query_data));

	query->reply = stonith_construct_reply(msg, NULL, NULL, pcmk_ok);
	query->remote_peer = remote_peer ? strdup(remote_peer) : NULL;
	query->client_id = client_id ? strdup(client_id) : NULL;
	query->target = target ? strdup(target) : NULL;
	query->action = action ? strdup(action) : NULL;
	query->call_options = call_options;

	get_capable_devices(target, action, timeout,
	pcmk_is_set(call_options, st_opt_allow_suicide),
	query, stonith_query_capable_device_cb);
	}

	#define ST_LOG_OUTPUT_MAX 512
	static void
	log_operation(async_command_t * cmd, int rc, int pid, const char next, const char output, gboolean op_merged)
	{
	if (rc == 0) {
	next = NULL;
	}

	if (cmd->victim != NULL) {
	do_crm_log(rc == 0 ? LOG_NOTICE : LOG_ERR,
	"Operation '%s' [%d] (call %d from %s) for host '%s' with device '%s' returned%s: %d (%s)%s%s",
	cmd->action, pid, cmd->id, cmd->client_name, cmd->victim,
	cmd->device, (op_merged? " (merged)" : ""),
	rc, pcmk_strerror(rc),
	(next? ", retrying with " : ""), (next ? next : ""));
	} else {
	do_crm_log_unlikely(rc == 0 ? LOG_DEBUG : LOG_NOTICE,
	"Operation '%s' [%d] for device '%s' returned%s: %d (%s)%s%s",
	cmd->action, pid, cmd->device,
	(op_merged? " (merged)" : ""),
	rc, pcmk_strerror(rc),
	(next? ", retrying with " : ""), (next ? next : ""));
	}

	if (output) {
	- /* Logging the whole string confuses syslog when the string is xml */
	- char *prefix = crm_strdup_printf("%s:%d", cmd->device, pid);
	+ // Output may have multiple lines
	+ char *prefix = crm_strdup_printf("%s[%d]", cmd->device, pid);

	crm_log_output(rc == 0 ? LOG_DEBUG : LOG_WARNING, prefix, output);
	free(prefix);
	}
	}

	static void
	stonith_send_async_reply(async_command_t * cmd, const char *output, int rc, GPid pid, int options)
	{
	xmlNode *reply = NULL;
	gboolean bcast = FALSE;

	reply = stonith_construct_async_reply(cmd, output, NULL, rc);

	if (pcmk__str_eq(cmd->action, "metadata", pcmk__str_casei)) {
	/* Too verbose to log */
	crm_trace("Metadata query for %s", cmd->device);
	output = NULL;

	} else if (pcmk__str_any_of(cmd->action, "monitor", "list", "status", NULL)) {
	crm_trace("Never broadcast '%s' replies", cmd->action);

	} else if (!stand_alone && pcmk__str_eq(cmd->origin, cmd->victim, pcmk__str_casei) && !pcmk__str_eq(cmd->action, "on", pcmk__str_casei)) {
	crm_trace("Broadcast '%s' reply for %s", cmd->action, cmd->victim);
	crm_xml_add(reply, F_SUBTYPE, "broadcast");
	bcast = TRUE;
	}

	log_operation(cmd, rc, pid, NULL, output, (options & st_reply_opt_merged ? TRUE : FALSE));
	crm_log_xml_trace(reply, "Reply");

	if (options & st_reply_opt_merged) {
	crm_xml_add(reply, F_STONITH_MERGED, "true");
	}

	if (bcast) {
	crm_xml_add(reply, F_STONITH_OPERATION, T_STONITH_NOTIFY);
	send_cluster_message(NULL, crm_msg_stonith_ng, reply, FALSE);

	} else if (cmd->origin) {
	crm_trace("Directed reply to %s", cmd->origin);
	send_cluster_message(crm_get_peer(0, cmd->origin), crm_msg_stonith_ng, reply, FALSE);

	} else {
	crm_trace("Directed local %ssync reply to %s",
	(cmd->options & st_opt_sync_call) ? "" : "a-", cmd->client_name);
	do_local_reply(reply, cmd->client, cmd->options & st_opt_sync_call, FALSE);
	}

	if (stand_alone) {
	/* Do notification with a clean data object */
	xmlNode *notify_data = create_xml_node(NULL, T_STONITH_NOTIFY_FENCE);

	crm_xml_add_int(notify_data, F_STONITH_RC, rc);
	crm_xml_add(notify_data, F_STONITH_TARGET, cmd->victim);
	crm_xml_add(notify_data, F_STONITH_OPERATION, cmd->op);
	crm_xml_add(notify_data, F_STONITH_DELEGATE, "localhost");
	crm_xml_add(notify_data, F_STONITH_DEVICE, cmd->device);
	crm_xml_add(notify_data, F_STONITH_REMOTE_OP_ID, cmd->remote_op_id);
	crm_xml_add(notify_data, F_STONITH_ORIGIN, cmd->client);

	do_stonith_notify(0, T_STONITH_NOTIFY_FENCE, rc, notify_data);
	do_stonith_notify(0, T_STONITH_NOTIFY_HISTORY, 0, NULL);
	}

	free_xml(reply);
	}

	static void
	cancel_stonith_command(async_command_t * cmd)
	{
	stonith_device_t *device;

	CRM_CHECK(cmd != NULL, return);

	if (!cmd->device) {
	return;
	}

	device = g_hash_table_lookup(device_list, cmd->device);

	if (device) {
	crm_trace("Cancel scheduled '%s' action on %s", cmd->action, device->id);
	device->pending_ops = g_list_remove(device->pending_ops, cmd);
	}
	}

	static void
	st_child_done(GPid pid, int rc, const char *output, gpointer user_data)
	{
	stonith_device_t *device = NULL;
	stonith_device_t *next_device = NULL;
	async_command_t *cmd = user_data;

	GListPtr gIter = NULL;
	GListPtr gIterNext = NULL;

	CRM_CHECK(cmd != NULL, return);

	cmd->active_on = NULL;

	/* The device is ready to do something else now */
	device = g_hash_table_lookup(device_list, cmd->device);
	if (device) {
	if (!device->verified && (rc == pcmk_ok) &&
	(pcmk__strcase_any_of(cmd->action, "list", "monitor", "status", NULL))) {

	device->verified = TRUE;
	}

	mainloop_set_trigger(device->work);
	}

	crm_debug("Operation '%s' on '%s' completed with rc=%d (%d remaining)",
	cmd->action, cmd->device, rc, g_list_length(cmd->device_next));

	if (rc == 0) {
	GListPtr iter;
	/* see if there are any required devices left to execute for this op */
	for (iter = cmd->device_next; iter != NULL; iter = iter->next) {
	next_device = g_hash_table_lookup(device_list, iter->data);

	if (next_device != NULL && is_action_required(cmd->action, next_device)) {
	cmd->device_next = iter->next;
	break;
	}
	next_device = NULL;
	}

	} else if (rc != 0 && cmd->device_next && (is_action_required(cmd->action, device) == FALSE)) {
	/* if this device didn't work out, see if there are any others we can try.
	* if the failed device was 'required', we can't pick another device. */
	next_device = g_hash_table_lookup(device_list, cmd->device_next->data);
	cmd->device_next = cmd->device_next->next;
	}

	/* this operation requires more fencing, hooray! */
	if (next_device) {
	log_operation(cmd, rc, pid, next_device->id, output, FALSE);

	schedule_stonith_command(cmd, next_device);
	/* Prevent cmd from being freed */
	cmd = NULL;
	goto done;
	}

	stonith_send_async_reply(cmd, output, rc, pid, st_reply_opt_none);

	if (rc != 0) {
	goto done;
	}

	/* Check to see if any operations are scheduled to do the exact
	* same thing that just completed. If so, rather than
	* performing the same fencing operation twice, return the result
	* of this operation for all pending commands it matches. */
	for (gIter = cmd_list; gIter != NULL; gIter = gIterNext) {
	async_command_t *cmd_other = gIter->data;

	gIterNext = gIter->next;

	if (cmd == cmd_other) {
	continue;
	}

	/* A pending scheduled command matches the command that just finished if.
	* 1. The client connections are different.
	* 2. The node victim is the same.
	* 3. The fencing action is the same.
	* 4. The device scheduled to execute the action is the same.
	*/
	if (pcmk__str_eq(cmd->client, cmd_other->client, pcmk__str_casei) \|\|
	!pcmk__str_eq(cmd->victim, cmd_other->victim, pcmk__str_casei) \|\|
	!pcmk__str_eq(cmd->action, cmd_other->action, pcmk__str_casei) \|\|
	!pcmk__str_eq(cmd->device, cmd_other->device, pcmk__str_casei)) {

	continue;
	}

	/* Duplicate merging will do the right thing for either type of remapped
	* reboot. If the executing fencer remapped an unsupported reboot to
	* off, then cmd->action will be reboot and will be merged with any
	* other reboot requests. If the originating fencer remapped a
	* topology reboot to off then on, we will get here once with
	* cmd->action "off" and once with "on", and they will be merged
	* separately with similar requests.
	*/
	crm_notice("Merging fencing action '%s' targeting %s originating from "
	"client %s with identical fencing request from client %s",
	cmd_other->action, cmd_other->victim, cmd_other->client_name,
	cmd->client_name);

	cmd_list = g_list_remove_link(cmd_list, gIter);

	stonith_send_async_reply(cmd_other, output, rc, pid, st_reply_opt_merged);
	cancel_stonith_command(cmd_other);

	free_async_command(cmd_other);
	g_list_free_1(gIter);
	}

	done:
	free_async_command(cmd);
	}

	static gint
	sort_device_priority(gconstpointer a, gconstpointer b)
	{
	const stonith_device_t *dev_a = a;
	const stonith_device_t *dev_b = b;

	if (dev_a->priority > dev_b->priority) {
	return -1;
	} else if (dev_a->priority < dev_b->priority) {
	return 1;
	}
	return 0;
	}

	static void
	stonith_fence_get_devices_cb(GList * devices, void *user_data)
	{
	async_command_t *cmd = user_data;
	stonith_device_t *device = NULL;
	guint ndevices = g_list_length(devices);

	crm_info("Found %d matching device%s for target '%s'",
	ndevices, pcmk__plural_s(ndevices), cmd->victim);

	if (devices != NULL) {
	/* Order based on priority */
	devices = g_list_sort(devices, sort_device_priority);
	device = g_hash_table_lookup(device_list, devices->data);

	if (device) {
	cmd->device_list = devices;
	cmd->device_next = devices->next;
	devices = NULL; /* list owned by cmd now */
	}
	}

	/* we have a device, schedule it for fencing. */
	if (device) {
	schedule_stonith_command(cmd, device);
	/* in progress */
	return;
	}

	/* no device found! */
	stonith_send_async_reply(cmd, NULL, -ENODEV, 0, st_reply_opt_none);

	free_async_command(cmd);
	g_list_free_full(devices, free);
	}

	static int
	stonith_fence(xmlNode * msg)
	{
	const char *device_id = NULL;
	stonith_device_t *device = NULL;
	async_command_t *cmd = create_async_command(msg);
	xmlNode *dev = get_xpath_object("//@" F_STONITH_TARGET, msg, LOG_ERR);

	if (cmd == NULL) {
	return -EPROTO;
	}

	device_id = crm_element_value(dev, F_STONITH_DEVICE);
	if (device_id) {
	device = g_hash_table_lookup(device_list, device_id);
	if (device == NULL) {
	crm_err("Requested device '%s' is not available", device_id);
	return -ENODEV;
	}
	schedule_stonith_command(cmd, device);

	} else {
	const char *host = crm_element_value(dev, F_STONITH_TARGET);

	if (cmd->options & st_opt_cs_nodeid) {
	int nodeid = crm_atoi(host, NULL);
	crm_node_t *node = crm_find_known_peer_full(nodeid, NULL, CRM_GET_PEER_ANY);

	if (node) {
	host = node->uname;
	}
	}

	/* If we get to here, then self-fencing is implicitly allowed */
	get_capable_devices(host, cmd->action, cmd->default_timeout,
	TRUE, cmd, stonith_fence_get_devices_cb);
	}

	return -EINPROGRESS;
	}

	xmlNode *
	stonith_construct_reply(xmlNode * request, const char output, xmlNode data, int rc)
	{
	xmlNode *reply = NULL;

	reply = create_xml_node(NULL, T_STONITH_REPLY);

	crm_xml_add(reply, "st_origin", __func__);
	crm_xml_add(reply, F_TYPE, T_STONITH_NG);
	crm_xml_add(reply, "st_output", output);
	crm_xml_add_int(reply, F_STONITH_RC, rc);

	if (request == NULL) {
	/* Most likely, this is the result of a stonith operation that was
	* initiated before we came up. Unfortunately that means we lack enough
	* information to provide clients with a full result.
	*
	* @TODO Maybe synchronize this information at start-up?
	*/
	crm_warn("Missing request information for client notifications for "
	"operation with result %d (initiated before we came up?)", rc);

	} else {
	const char *name = NULL;
	const char *value = NULL;

	const char *names[] = {
	F_STONITH_OPERATION,
	F_STONITH_CALLID,
	F_STONITH_CLIENTID,
	F_STONITH_CLIENTNAME,
	F_STONITH_REMOTE_OP_ID,
	F_STONITH_CALLOPTS
	};

	crm_trace("Creating a result reply with%s reply output (rc=%d)",
	(data? "" : "out"), rc);
	for (int lpc = 0; lpc < DIMOF(names); lpc++) {
	name = names[lpc];
	value = crm_element_value(request, name);
	crm_xml_add(reply, name, value);
	}
	if (data != NULL) {
	add_message_xml(reply, F_STONITH_CALLDATA, data);
	}
	}
	return reply;
	}

	static xmlNode *
	stonith_construct_async_reply(async_command_t * cmd, const char output, xmlNode data, int rc)
	{
	xmlNode *reply = NULL;

	crm_trace("Creating a basic reply");
	reply = create_xml_node(NULL, T_STONITH_REPLY);

	crm_xml_add(reply, "st_origin", __func__);
	crm_xml_add(reply, F_TYPE, T_STONITH_NG);

	crm_xml_add(reply, F_STONITH_OPERATION, cmd->op);
	crm_xml_add(reply, F_STONITH_DEVICE, cmd->device);
	crm_xml_add(reply, F_STONITH_REMOTE_OP_ID, cmd->remote_op_id);
	crm_xml_add(reply, F_STONITH_CLIENTID, cmd->client);
	crm_xml_add(reply, F_STONITH_CLIENTNAME, cmd->client_name);
	crm_xml_add(reply, F_STONITH_TARGET, cmd->victim);
	crm_xml_add(reply, F_STONITH_ACTION, cmd->op);
	crm_xml_add(reply, F_STONITH_ORIGIN, cmd->origin);
	crm_xml_add_int(reply, F_STONITH_CALLID, cmd->id);
	crm_xml_add_int(reply, F_STONITH_CALLOPTS, cmd->options);

	crm_xml_add_int(reply, F_STONITH_RC, rc);

	crm_xml_add(reply, "st_output", output);

	if (data != NULL) {
	crm_info("Attaching reply output");
	add_message_xml(reply, F_STONITH_CALLDATA, data);
	}
	return reply;
	}

	bool fencing_peer_active(crm_node_t *peer)
	{
	if (peer == NULL) {
	return FALSE;
	} else if (peer->uname == NULL) {
	return FALSE;
	} else if (pcmk_is_set(peer->processes, crm_get_cluster_proc())) {
	return TRUE;
	}
	return FALSE;
	}

	/*!
	* \internal
	* \brief Determine if we need to use an alternate node to
	* fence the target. If so return that node's uname
	*
	* \retval NULL, no alternate host
	* \retval uname, uname of alternate host to use
	*/
	static const char *
	check_alternate_host(const char *target)
	{
	const char *alternate_host = NULL;

	crm_trace("Checking if we (%s) can fence %s", stonith_our_uname, target);
	if (find_topology_for_host(target) && pcmk__str_eq(target, stonith_our_uname, pcmk__str_casei)) {
	GHashTableIter gIter;
	crm_node_t *entry = NULL;

	g_hash_table_iter_init(&gIter, crm_peer_cache);
	while (g_hash_table_iter_next(&gIter, NULL, (void **)&entry)) {
	crm_trace("Checking for %s.%d != %s", entry->uname, entry->id, target);
	if (fencing_peer_active(entry)
	&& !pcmk__str_eq(entry->uname, target, pcmk__str_casei)) {
	alternate_host = entry->uname;
	break;
	}
	}
	if (alternate_host == NULL) {
	- crm_err("No alternate host available to handle complex self fencing request");
	+ crm_err("No alternate host available to handle request "
	+ "for self-fencing with topology");
	g_hash_table_iter_init(&gIter, crm_peer_cache);
	while (g_hash_table_iter_next(&gIter, NULL, (void **)&entry)) {
	crm_notice("Peer[%d] %s", entry->id, entry->uname);
	}
	}
	}

	return alternate_host;
	}

	static void
	stonith_send_reply(xmlNode * reply, int call_options, const char *remote_peer,
	const char *client_id)
	{
	if (remote_peer) {
	send_cluster_message(crm_get_peer(0, remote_peer), crm_msg_stonith_ng, reply, FALSE);
	} else {
	do_local_reply(reply, client_id,
	pcmk_is_set(call_options, st_opt_sync_call),
	(remote_peer != NULL));
	}
	}

	static void
	remove_relay_op(xmlNode * request)
	{
	xmlNode *dev = get_xpath_object("//@" F_STONITH_ACTION, request, LOG_TRACE);
	const char *relay_op_id = NULL;
	const char *op_id = NULL;
	const char *client_name = NULL;
	const char *target = NULL;
	remote_fencing_op_t *relay_op = NULL;

	if (dev) {
	target = crm_element_value(dev, F_STONITH_TARGET);
	}

	relay_op_id = crm_element_value(request, F_STONITH_REMOTE_OP_ID_RELAY);
	op_id = crm_element_value(request, F_STONITH_REMOTE_OP_ID);
	client_name = crm_element_value(request, F_STONITH_CLIENTNAME);

	/* Delete RELAY operation. */
	if (relay_op_id && target && pcmk__str_eq(target, stonith_our_uname, pcmk__str_casei)) {
	relay_op = g_hash_table_lookup(stonith_remote_op_list, relay_op_id);

	if (relay_op) {
	GHashTableIter iter;
	remote_fencing_op_t *list_op = NULL;
	g_hash_table_iter_init(&iter, stonith_remote_op_list);

	/* If the operation to be deleted is registered as a duplicate, delete the registration. */
	while (g_hash_table_iter_next(&iter, NULL, (void **)&list_op)) {
	GListPtr dup_iter = NULL;
	if (list_op != relay_op) {
	for (dup_iter = list_op->duplicates; dup_iter != NULL; dup_iter = dup_iter->next) {
	remote_fencing_op_t *other = dup_iter->data;
	if (other == relay_op) {
	other->duplicates = g_list_remove(other->duplicates, relay_op);
	break;
	}
	}
	}
	}
	- crm_info("Delete the relay op : %s - %s of %s for %s.(replaced by op : %s - %s of %s for %s)",
	- relay_op->id, relay_op->action, relay_op->target, relay_op->client_name,
	- op_id, relay_op->action, target, client_name);
	+ crm_debug("Deleting relay op %s ('%s' targeting %s for %s), "
	+ "replaced by op %s ('%s' targeting %s for %s)",
	+ relay_op->id, relay_op->action, relay_op->target,
	+ relay_op->client_name, op_id, relay_op->action, target,
	+ client_name);

	g_hash_table_remove(stonith_remote_op_list, relay_op_id);
	}
	}
	}

	static int
	handle_request(pcmk__client_t *client, uint32_t id, uint32_t flags,
	xmlNode request, const char remote_peer)
	{
	int call_options = 0;
	int rc = -EOPNOTSUPP;

	xmlNode *data = NULL;
	xmlNode *reply = NULL;

	char *output = NULL;
	const char *op = crm_element_value(request, F_STONITH_OPERATION);
	const char *client_id = crm_element_value(request, F_STONITH_CLIENTID);

	#if ENABLE_ACL
	/* IPC commands related to fencing configuration may be done only by
	* privileged users (i.e. root or hacluster) when ACLs are supported,
	* because all other users should go through the CIB to have ACLs applied.
	*
	* If no client was given, this is a peer request, which is always allowed.
	*/
	bool allowed = (client == NULL)
	\|\| pcmk_is_set(client->flags, pcmk__client_privileged);
	#else
	bool allowed = true;
	#endif

	crm_element_value_int(request, F_STONITH_CALLOPTS, &call_options);

	if (pcmk_is_set(call_options, st_opt_sync_call)) {
	CRM_ASSERT(client == NULL \|\| client->request_id == id);
	}

	if (pcmk__str_eq(op, CRM_OP_REGISTER, pcmk__str_none)) {
	xmlNode *reply = create_xml_node(NULL, "reply");

	CRM_ASSERT(client);
	crm_xml_add(reply, F_STONITH_OPERATION, CRM_OP_REGISTER);
	crm_xml_add(reply, F_STONITH_CLIENTID, client->id);
	pcmk__ipc_send_xml(client, id, reply, flags);
	client->request_id = 0;
	free_xml(reply);
	return 0;

	} else if (pcmk__str_eq(op, STONITH_OP_EXEC, pcmk__str_none)) {
	rc = stonith_device_action(request, &output);

	} else if (pcmk__str_eq(op, STONITH_OP_TIMEOUT_UPDATE, pcmk__str_none)) {
	const char *call_id = crm_element_value(request, F_STONITH_CALLID);
	const char *client_id = crm_element_value(request, F_STONITH_CLIENTID);
	int op_timeout = 0;

	crm_element_value_int(request, F_STONITH_TIMEOUT, &op_timeout);
	do_stonith_async_timeout_update(client_id, call_id, op_timeout);
	return 0;

	} else if (pcmk__str_eq(op, STONITH_OP_QUERY, pcmk__str_none)) {
	if (remote_peer) {
	create_remote_stonith_op(client_id, request, TRUE); /* Record it for the future notification */
	}

	/* Delete the DC node RELAY operation. */
	remove_relay_op(request);

	stonith_query(request, remote_peer, client_id, call_options);
	return 0;

	} else if (pcmk__str_eq(op, T_STONITH_NOTIFY, pcmk__str_none)) {
	const char *flag_name = NULL;

	CRM_ASSERT(client);
	flag_name = crm_element_value(request, F_STONITH_NOTIFY_ACTIVATE);
	if (flag_name) {
	crm_debug("Enabling %s callbacks for client %s",
	flag_name, pcmk__client_name(client));
	pcmk__set_client_flags(client, get_stonith_flag(flag_name));
	}

	flag_name = crm_element_value(request, F_STONITH_NOTIFY_DEACTIVATE);
	if (flag_name) {
	crm_debug("Disabling %s callbacks for client %s",
	flag_name, pcmk__client_name(client));
	pcmk__clear_client_flags(client, get_stonith_flag(flag_name));
	}

	pcmk__ipc_send_ack(client, id, flags, "ack", CRM_EX_OK);
	return 0;

	} else if (pcmk__str_eq(op, STONITH_OP_RELAY, pcmk__str_none)) {
	xmlNode *dev = get_xpath_object("//@" F_STONITH_TARGET, request, LOG_TRACE);

	crm_notice("Received forwarded fencing request from "
	"%s%s to fence (%s) peer %s",
	((client == NULL)? "peer" : "client"),
	((client == NULL)? remote_peer : pcmk__client_name(client)),
	crm_element_value(dev, F_STONITH_ACTION),
	crm_element_value(dev, F_STONITH_TARGET));

	if (initiate_remote_stonith_op(NULL, request, FALSE) != NULL) {
	rc = -EINPROGRESS;
	}

	} else if (pcmk__str_eq(op, STONITH_OP_FENCE, pcmk__str_none)) {

	if (remote_peer \|\| stand_alone) {
	rc = stonith_fence(request);

	} else if (call_options & st_opt_manual_ack) {
	remote_fencing_op_t *rop = NULL;
	xmlNode *dev = get_xpath_object("//@" F_STONITH_TARGET, request, LOG_TRACE);
	const char *target = crm_element_value(dev, F_STONITH_TARGET);

	crm_notice("Received manual confirmation that %s is fenced", target);
	rop = initiate_remote_stonith_op(client, request, TRUE);
	rc = stonith_manual_ack(request, rop);

	} else {
	const char *alternate_host = NULL;
	xmlNode *dev = get_xpath_object("//@" F_STONITH_TARGET, request, LOG_TRACE);
	const char *target = crm_element_value(dev, F_STONITH_TARGET);
	const char *action = crm_element_value(dev, F_STONITH_ACTION);
	const char *device = crm_element_value(dev, F_STONITH_DEVICE);

	if (client) {
	int tolerance = 0;

	crm_notice("Client %s wants to fence (%s) %s using %s",
	pcmk__client_name(client), action,
	target, (device? device : "any device"));

	crm_element_value_int(dev, F_STONITH_TOLERANCE, &tolerance);

	if (stonith_check_fence_tolerance(tolerance, target, action)) {
	rc = 0;
	goto done;
	}

	} else {
	crm_notice("Peer %s wants to fence (%s) '%s' with device '%s'",
	remote_peer, action, target, device ? device : "(any)");
	}

	alternate_host = check_alternate_host(target);

	if (alternate_host && client) {
	const char *client_id = NULL;
	remote_fencing_op_t *op = NULL;

	- crm_notice("Forwarding complex self fencing request to peer %s", alternate_host);
	+ crm_notice("Forwarding self-fencing request to peer %s"
	+ "due to topology", alternate_host);

	if (client->id) {
	client_id = client->id;
	} else {
	client_id = crm_element_value(request, F_STONITH_CLIENTID);
	}

	/* Create an operation for RELAY and send the ID in the RELAY message. */
	/* When a QUERY response is received, delete the RELAY operation to avoid the existence of duplicate operations. */
	op = create_remote_stonith_op(client_id, request, FALSE);

	crm_xml_add(request, F_STONITH_OPERATION, STONITH_OP_RELAY);
	crm_xml_add(request, F_STONITH_CLIENTID, client->id);
	crm_xml_add(request, F_STONITH_REMOTE_OP_ID, op->id);
	send_cluster_message(crm_get_peer(0, alternate_host), crm_msg_stonith_ng, request,
	FALSE);
	rc = -EINPROGRESS;

	} else if (initiate_remote_stonith_op(client, request, FALSE) != NULL) {
	rc = -EINPROGRESS;
	}
	}

	} else if (pcmk__str_eq(op, STONITH_OP_FENCE_HISTORY, pcmk__str_none)) {
	rc = stonith_fence_history(request, &data, remote_peer, call_options);
	if (call_options & st_opt_discard_reply) {
	/* we don't expect answers to the broadcast
	* we might have sent out
	*/
	free_xml(data);
	return pcmk_ok;
	}

	} else if (pcmk__str_eq(op, STONITH_OP_DEVICE_ADD, pcmk__str_none)) {
	const char *device_id = NULL;

	if (allowed) {
	rc = stonith_device_register(request, &device_id, FALSE);
	} else {
	rc = -EACCES;
	}
	do_stonith_notify_device(call_options, op, rc, device_id);

	} else if (pcmk__str_eq(op, STONITH_OP_DEVICE_DEL, pcmk__str_none)) {
	xmlNode *dev = get_xpath_object("//" F_STONITH_DEVICE, request, LOG_ERR);
	const char *device_id = crm_element_value(dev, XML_ATTR_ID);

	if (allowed) {
	rc = stonith_device_remove(device_id, FALSE);
	} else {
	rc = -EACCES;
	}
	do_stonith_notify_device(call_options, op, rc, device_id);

	} else if (pcmk__str_eq(op, STONITH_OP_LEVEL_ADD, pcmk__str_none)) {
	char *device_id = NULL;

	if (allowed) {
	rc = stonith_level_register(request, &device_id);
	} else {
	rc = -EACCES;
	}
	do_stonith_notify_level(call_options, op, rc, device_id);
	free(device_id);

	} else if (pcmk__str_eq(op, STONITH_OP_LEVEL_DEL, pcmk__str_none)) {
	char *device_id = NULL;

	if (allowed) {
	rc = stonith_level_remove(request, &device_id);
	} else {
	rc = -EACCES;
	}
	do_stonith_notify_level(call_options, op, rc, device_id);

	} else if(pcmk__str_eq(op, CRM_OP_RM_NODE_CACHE, pcmk__str_casei)) {
	int node_id = 0;
	const char *name = NULL;

	crm_element_value_int(request, XML_ATTR_ID, &node_id);
	name = crm_element_value(request, XML_ATTR_UNAME);
	reap_crm_member(node_id, name);

	return pcmk_ok;

	} else {
	crm_err("Unknown IPC request %s from %s %s", op,
	((client == NULL)? "peer" : "client"),
	((client == NULL)? remote_peer : pcmk__client_name(client)));
	}

	done:

	if (rc == -EACCES) {
	crm_warn("Rejecting IPC request '%s' from unprivileged client %s",
	crm_str(op), pcmk__client_name(client));
	}

	/* Always reply unless the request is in process still.
	* If in progress, a reply will happen async after the request
	* processing is finished */
	if (rc != -EINPROGRESS) {
	crm_trace("Reply handling: %p %u %u %d %d %s", client, client?client->request_id:0,
	id, pcmk_is_set(call_options, st_opt_sync_call), call_options,
	crm_element_value(request, F_STONITH_CALLOPTS));

	if (pcmk_is_set(call_options, st_opt_sync_call)) {
	CRM_ASSERT(client == NULL \|\| client->request_id == id);
	}
	reply = stonith_construct_reply(request, output, data, rc);
	stonith_send_reply(reply, call_options, remote_peer, client_id);
	}

	free(output);
	free_xml(data);
	free_xml(reply);

	return rc;
	}

	static void
	handle_reply(pcmk__client_t client, xmlNode request, const char *remote_peer)
	{
	const char *op = crm_element_value(request, F_STONITH_OPERATION);

	if (pcmk__str_eq(op, STONITH_OP_QUERY, pcmk__str_none)) {
	process_remote_stonith_query(request);
	} else if (pcmk__str_eq(op, T_STONITH_NOTIFY, pcmk__str_none)) {
	process_remote_stonith_exec(request);
	} else if (pcmk__str_eq(op, STONITH_OP_FENCE, pcmk__str_none)) {
	/* Reply to a complex fencing op */
	process_remote_stonith_exec(request);
	} else {
	crm_err("Unknown %s reply from %s %s", op,
	((client == NULL)? "peer" : "client"),
	((client == NULL)? remote_peer : pcmk__client_name(client)));
	crm_log_xml_warn(request, "UnknownOp");
	}
	}

	void
	stonith_command(pcmk__client_t *client, uint32_t id, uint32_t flags,
	xmlNode request, const char remote_peer)
	{
	int call_options = 0;
	int rc = 0;
	gboolean is_reply = FALSE;

	/* Copy op for reporting. The original might get freed by handle_reply()
	* before we use it in crm_debug():
	* handle_reply()
	* \|- process_remote_stonith_exec()
	* \|-- remote_op_done()
	* \|--- handle_local_reply_and_notify()
	* \|---- crm_xml_add(...F_STONITH_OPERATION...)
	* \|--- free_xml(op->request)
	*/
	char *op = crm_element_value_copy(request, F_STONITH_OPERATION);

	if (get_xpath_object("//" T_STONITH_REPLY, request, LOG_NEVER)) {
	is_reply = TRUE;
	}

	crm_element_value_int(request, F_STONITH_CALLOPTS, &call_options);
	crm_debug("Processing %s%s %u from %s %s with call options 0x%08x",
	op, (is_reply? " reply" : ""), id,
	((client == NULL)? "peer" : "client"),
	((client == NULL)? remote_peer : pcmk__client_name(client)),
	call_options);

	if (pcmk_is_set(call_options, st_opt_sync_call)) {
	CRM_ASSERT(client == NULL \|\| client->request_id == id);
	}

	if (is_reply) {
	handle_reply(client, request, remote_peer);
	} else {
	rc = handle_request(client, id, flags, request, remote_peer);
	}

	crm_debug("Processed %s%s from %s %s: %s (rc=%d)",
	op, (is_reply? " reply" : ""),
	((client == NULL)? "peer" : "client"),
	((client == NULL)? remote_peer : pcmk__client_name(client)),
	((rc > 0)? "" : pcmk_strerror(rc)), rc);
	free(op);
	}
	diff --git a/daemons/fenced/fenced_history.c b/daemons/fenced/fenced_history.c
	index 3bc59343b8..c052a2bbb7 100644
	--- a/daemons/fenced/fenced_history.c
	+++ b/daemons/fenced/fenced_history.c
	@@ -1,491 +1,491 @@
	/*
	* Copyright 2009-2020 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU General Public License version 2
	* or later (GPLv2+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h>
	#include <unistd.h>
	#include <stdlib.h>

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/ipc.h>
	#include <crm/common/ipc_internal.h>
	#include <crm/cluster/internal.h>

	#include <crm/stonith-ng.h>
	#include <crm/fencing/internal.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h>

	#include <pacemaker-fenced.h>

	#define MAX_STONITH_HISTORY 500

	/*!
	* \internal
	* \brief Send a broadcast to all nodes to trigger cleanup or
	* history synchronisation
	*
	* \param[in] history Optional history to be attached
	* \param[in] callopts We control cleanup via a flag in the callopts
	* \param[in] target Cleanup can be limited to certain fence-targets
	*/
	static void
	stonith_send_broadcast_history(xmlNode *history,
	int callopts,
	const char *target)
	{
	xmlNode *bcast = create_xml_node(NULL, "stonith_command");
	xmlNode *data = create_xml_node(NULL, __func__);

	if (target) {
	crm_xml_add(data, F_STONITH_TARGET, target);
	}
	crm_xml_add(bcast, F_TYPE, T_STONITH_NG);
	crm_xml_add(bcast, F_SUBTYPE, "broadcast");
	crm_xml_add(bcast, F_STONITH_OPERATION, STONITH_OP_FENCE_HISTORY);
	crm_xml_add_int(bcast, F_STONITH_CALLOPTS, callopts);
	if (history) {
	add_node_copy(data, history);
	}
	add_message_xml(bcast, F_STONITH_CALLDATA, data);
	send_cluster_message(NULL, crm_msg_stonith_ng, bcast, FALSE);

	free_xml(data);
	free_xml(bcast);
	}

	static gboolean
	stonith_remove_history_entry (gpointer key,
	gpointer value,
	gpointer user_data)
	{
	remote_fencing_op_t *op = value;
	const char target = (const char ) user_data;

	if ((op->state == st_failed) \|\| (op->state == st_done)) {
	if ((target) && (strcmp(op->target, target) != 0)) {
	return FALSE;
	}
	return TRUE;
	}

	return FALSE; /* don't clean pending operations */
	}

	/*!
	* \internal
	* \brief Send out a cleanup broadcast or do a local history-cleanup
	*
	* \param[in] target Cleanup can be limited to certain fence-targets
	* \param[in] broadcast Send out a cleanup broadcast
	*/
	static void
	stonith_fence_history_cleanup(const char *target,
	gboolean broadcast)
	{
	if (broadcast) {
	stonith_send_broadcast_history(NULL,
	st_opt_cleanup \| st_opt_discard_reply,
	target);
	/* we'll do the local clean when we receive back our own broadcast */
	} else if (stonith_remote_op_list) {
	g_hash_table_foreach_remove(stonith_remote_op_list,
	stonith_remove_history_entry,
	(gpointer) target);
	do_stonith_notify(0, T_STONITH_NOTIFY_HISTORY, 0, NULL);
	}
	}

	/* keeping the length of fence-history within bounds
	* =================================================
	*
	* If things are really running wild a lot of fencing-attempts
	* might fill up the hash-map, eventually using up a lot
	* of memory and creating huge history-sync messages.
	* Before the history being synced across nodes at least
	* the reboot of a cluster-node helped keeping the
	* history within bounds even though not in a reliable
	* manner.
	*
	* stonith_remote_op_list isn't sorted for time-stamps
	* thus it would be kind of expensive to delete e.g.
	* the oldest entry if it would grow past MAX_STONITH_HISTORY
	* entries.
	* It is more efficient to purge MAX_STONITH_HISTORY/2
	* entries whenever the list grows beyond MAX_STONITH_HISTORY.
	* (sort for age + purge the MAX_STONITH_HISTORY/2 oldest)
	* That done on a per-node-base might raise the
	* probability of large syncs to occur.
	* Things like introducing a broadcast to purge
	* MAX_STONITH_HISTORY/2 entries or not sync above a certain
	* threshold coming to mind ...
	* Simplest thing though is to purge the full history
	* throughout the cluster once MAX_STONITH_HISTORY is reached.
	* On the other hand this leads to purging the history in
	* situations where it would be handy to have it probably.
	*/


	static int
	op_time_sort(const void a_voidp, const void b_voidp)
	{
	const remote_fencing_op_t a = (const remote_fencing_op_t ) a_voidp;
	const remote_fencing_op_t b = (const remote_fencing_op_t ) b_voidp;
	gboolean a_pending = ((a)->state != st_failed) && ((a)->state != st_done);
	gboolean b_pending = ((b)->state != st_failed) && ((b)->state != st_done);

	if (a_pending && b_pending) {
	return 0;
	} else if (a_pending) {
	return -1;
	} else if (b_pending) {
	return 1;
	} else if ((b)->completed == (a)->completed) {
	return 0;
	} else if ((b)->completed > (a)->completed) {
	return 1;
	}

	return -1;
	}


	/*!
	* \internal
	* \brief Do a local history-trim to MAX_STONITH_HISTORY / 2 entries
	* once over MAX_STONITH_HISTORY
	*/
	void
	stonith_fence_history_trim(void)
	{
	guint num_ops;

	if (!stonith_remote_op_list) {
	return;
	}
	num_ops = g_hash_table_size(stonith_remote_op_list);
	if (num_ops > MAX_STONITH_HISTORY) {
	remote_fencing_op_t *ops[num_ops];
	remote_fencing_op_t *op = NULL;
	GHashTableIter iter;
	int i;

	crm_trace("Fencing History growing beyond limit of %d so purge "
	"half of failed/successful attempts", MAX_STONITH_HISTORY);

	/* write all ops into an array */
	i = 0;
	g_hash_table_iter_init(&iter, stonith_remote_op_list);
	while (g_hash_table_iter_next(&iter, NULL, (void **)&op)) {
	ops[i++] = op;
	}
	/* run quicksort over the array so that we get pending ops
	* first and then sorted most recent to oldest
	*/
	qsort(ops, num_ops, sizeof(remote_fencing_op_t *), op_time_sort);
	/* purgest oldest half of the history entries */
	for (i = MAX_STONITH_HISTORY / 2; i < num_ops; i++) {
	/* keep pending ops even if they shouldn't fill more than
	* half of our buffer
	*/
	if ((ops[i]->state == st_failed) \|\| (ops[i]->state == st_done)) {
	g_hash_table_remove(stonith_remote_op_list, ops[i]->id);
	}
	}
	/* we've just purged valid data from the list so there is no need
	* to create a notification - if displayed it can stay
	*/
	}
	}

	/*!
	* \internal
	* \brief Convert xml fence-history to a hash-table like stonith_remote_op_list
	*
	* \param[in] history Fence-history in xml
	*
	* \return Fence-history as hash-table
	*/
	static GHashTable *
	stonith_xml_history_to_list(xmlNode *history)
	{
	xmlNode *xml_op = NULL;
	GHashTable *rv = NULL;

	init_stonith_remote_op_hash_table(&rv);

	CRM_LOG_ASSERT(rv != NULL);

	for (xml_op = pcmk__xml_first_child(history); xml_op != NULL;
	xml_op = pcmk__xml_next(xml_op)) {
	remote_fencing_op_t *op = NULL;
	char *id = crm_element_value_copy(xml_op, F_STONITH_REMOTE_OP_ID);
	int state;
	long long completed;

	if (!id) {
	- crm_warn("History to convert to hashtable has no id in entry");
	+ crm_warn("Malformed fencing history received from peer");
	continue;
	}

	crm_trace("Attaching op %s to hashtable", id);

	op = calloc(1, sizeof(remote_fencing_op_t));

	op->id = id;
	op->target = crm_element_value_copy(xml_op, F_STONITH_TARGET);
	op->action = crm_element_value_copy(xml_op, F_STONITH_ACTION);
	op->originator = crm_element_value_copy(xml_op, F_STONITH_ORIGIN);
	op->delegate = crm_element_value_copy(xml_op, F_STONITH_DELEGATE);
	op->client_name = crm_element_value_copy(xml_op, F_STONITH_CLIENTNAME);
	crm_element_value_ll(xml_op, F_STONITH_DATE, &completed);
	op->completed = (time_t) completed;
	crm_element_value_int(xml_op, F_STONITH_STATE, &state);
	op->state = (enum op_state) state;

	g_hash_table_replace(rv, id, op);
	CRM_LOG_ASSERT(g_hash_table_lookup(rv, id) != NULL);
	}

	return rv;
	}

	/*!
	* \internal
	* \brief Craft xml difference between local fence-history and a history
	* coming from remote
	*
	* \param[in] remote_history Fence-history as hash-table (may be NULL)
	* \param[in] add_id If crafting the answer for an API
	* history-request there is no need for the id
	* \param[in] target Optionally limit to certain fence-target
	*
	* \return The fence-history as xml
	*/
	static xmlNode *
	stonith_local_history_diff(GHashTable *remote_history,
	gboolean add_id,
	const char *target)
	{
	xmlNode *history = NULL;
	int cnt = 0;

	if (stonith_remote_op_list) {
	GHashTableIter iter;
	remote_fencing_op_t *op = NULL;

	history = create_xml_node(NULL, F_STONITH_HISTORY_LIST);

	g_hash_table_iter_init(&iter, stonith_remote_op_list);
	while (g_hash_table_iter_next(&iter, NULL, (void **)&op)) {
	xmlNode *entry = NULL;

	if (remote_history &&
	g_hash_table_lookup(remote_history, op->id)) {
	continue; /* skip entries broadcasted already */
	}

	if (!pcmk__str_eq(target, op->target, pcmk__str_null_matches)) {
	continue;
	}

	cnt++;
	crm_trace("Attaching op %s", op->id);
	entry = create_xml_node(history, STONITH_OP_EXEC);
	if (add_id) {
	crm_xml_add(entry, F_STONITH_REMOTE_OP_ID, op->id);
	}
	crm_xml_add(entry, F_STONITH_TARGET, op->target);
	crm_xml_add(entry, F_STONITH_ACTION, op->action);
	crm_xml_add(entry, F_STONITH_ORIGIN, op->originator);
	crm_xml_add(entry, F_STONITH_DELEGATE, op->delegate);
	crm_xml_add(entry, F_STONITH_CLIENTNAME, op->client_name);
	crm_xml_add_ll(entry, F_STONITH_DATE, op->completed);
	crm_xml_add_int(entry, F_STONITH_STATE, op->state);
	}
	}

	if (cnt == 0) {
	free_xml(history);
	return NULL;
	} else {
	return history;
	}
	}

	/*!
	* \internal
	* \brief Merge fence-history coming from remote into local history
	*
	* \param[in] history Hash-table holding remote history to be merged in
	*/
	static void
	stonith_merge_in_history_list(GHashTable *history)
	{
	GHashTableIter iter;
	remote_fencing_op_t *op = NULL;
	gboolean updated = FALSE;

	if (!history) {
	return;
	}

	init_stonith_remote_op_hash_table(&stonith_remote_op_list);

	g_hash_table_iter_init(&iter, history);
	while (g_hash_table_iter_next(&iter, NULL, (void **)&op)) {
	remote_fencing_op_t *stored_op =
	g_hash_table_lookup(stonith_remote_op_list, op->id);

	if (stored_op) {
	continue; // Skip existent (@TODO state-merging might be desirable)
	}

	updated = TRUE;
	g_hash_table_iter_steal(&iter);

	if ((op->state != st_failed) &&
	(op->state != st_done) &&
	pcmk__str_eq(op->originator, stonith_our_uname, pcmk__str_casei)) {
	crm_warn("Failing pending operation %.8s originated by us but "
	"known only from peer history", op->id);
	op->state = st_failed;
	op->completed = time(NULL);
	/* use -EHOSTUNREACH to not introduce a new return-code that might
	trigger unexpected results at other places and to prevent
	remote_op_done from setting the delegate if not present
	*/
	stonith_bcast_result_to_peers(op, -EHOSTUNREACH, FALSE);
	}

	g_hash_table_insert(stonith_remote_op_list, op->id, op);
	/* we could trim the history here but if we bail
	* out after trim we might miss more recent entries
	* of those that might still be in the list
	* if we don't bail out trimming once is more
	* efficient and memory overhead is minimal as
	* we are just moving pointers from one hash to
	* another
	*/
	}
	stonith_fence_history_trim();
	if (updated) {
	do_stonith_notify(0, T_STONITH_NOTIFY_HISTORY, 0, NULL);
	}
	g_hash_table_destroy(history); /* remove what is left */
	}

	/*!
	* \internal
	* \brief Handle fence-history messages (either from API or coming in as
	* broadcasts
	*
	* \param[in] msg Request message
	* \param[in] output In case of a request from the API used to craft
	* a reply from
	* \param[in] remote_peer
	* \param[in] options call-options from the request
	*
	* \return always success as there is actully nothing that can go really wrong
	*/
	int
	stonith_fence_history(xmlNode msg, xmlNode *output,
	const char *remote_peer, int options)
	{
	int rc = 0;
	const char *target = NULL;
	xmlNode *dev = get_xpath_object("//@" F_STONITH_TARGET, msg, LOG_NEVER);
	xmlNode *out_history = NULL;

	if (dev) {
	target = crm_element_value(dev, F_STONITH_TARGET);
	if (target && (options & st_opt_cs_nodeid)) {
	int nodeid = crm_atoi(target, NULL);
	crm_node_t *node = crm_find_known_peer_full(nodeid, NULL, CRM_GET_PEER_ANY);

	if (node) {
	target = node->uname;
	}
	}
	}

	if (options & st_opt_cleanup) {
	crm_trace("Cleaning up operations on %s in %p", target,
	stonith_remote_op_list);

	stonith_fence_history_cleanup(target,
	crm_element_value(msg, F_STONITH_CALLID) != NULL);
	} else if (options & st_opt_broadcast) {
	/* there is no clear sign atm for when a history sync
	is done so send a notification for anything
	that smells like history-sync
	*/
	do_stonith_notify(0, T_STONITH_NOTIFY_HISTORY_SYNCED, 0, NULL);
	if (crm_element_value(msg, F_STONITH_CALLID)) {
	/* this is coming from the stonith-API
	*
	* craft a broadcast with node's history
	* so that every node can merge and broadcast
	* what it has on top
	*/
	out_history = stonith_local_history_diff(NULL, TRUE, NULL);
	crm_trace("Broadcasting history to peers");
	stonith_send_broadcast_history(out_history,
	st_opt_broadcast \| st_opt_discard_reply,
	NULL);
	} else if (remote_peer &&
	!pcmk__str_eq(remote_peer, stonith_our_uname, pcmk__str_casei)) {
	xmlNode *history = get_xpath_object("//" F_STONITH_HISTORY_LIST,
	msg, LOG_NEVER);
	GHashTable *received_history =
	history?stonith_xml_history_to_list(history):NULL;

	/* either a broadcast created directly upon stonith-API request
	* or a diff as response to such a thing
	*
	* in both cases it may have a history or not
	* if we have differential data
	* merge in what we've received and stop
	* otherwise broadcast what we have on top
	* marking as differential and merge in afterwards
	*/
	if (!history \|\|
	!crm_is_true(crm_element_value(history,
	F_STONITH_DIFFERENTIAL))) {
	out_history =
	stonith_local_history_diff(received_history, TRUE, NULL);
	if (out_history) {
	crm_trace("Broadcasting history-diff to peers");
	crm_xml_add(out_history, F_STONITH_DIFFERENTIAL,
	XML_BOOLEAN_TRUE);
	stonith_send_broadcast_history(out_history,
	st_opt_broadcast \| st_opt_discard_reply,
	NULL);
	} else {
	crm_trace("History-diff is empty - skip broadcast");
	}
	}
	stonith_merge_in_history_list(received_history);
	} else {
	crm_trace("Skipping history-query-broadcast (%s%s)"
	" we sent ourselves",
	remote_peer?"remote-peer=":"local-ipc",
	remote_peer?remote_peer:"");
	}
	} else {
	/* plain history request */
	crm_trace("Looking for operations on %s in %p", target,
	stonith_remote_op_list);
	*output = stonith_local_history_diff(NULL, FALSE, target);
	}
	free_xml(out_history);
	return rc;
	}
	diff --git a/daemons/fenced/fenced_remote.c b/daemons/fenced/fenced_remote.c
	index 8491d8d9f9..678724e040 100644
	--- a/daemons/fenced/fenced_remote.c
	+++ b/daemons/fenced/fenced_remote.c
	@@ -1,2174 +1,2170 @@
	/*
	* Copyright 2009-2020 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU General Public License version 2
	* or later (GPLv2+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <sys/param.h>
	#include <stdio.h>
	#include <sys/types.h>
	#include <sys/wait.h>
	#include <sys/stat.h>
	#include <unistd.h>
	#include <sys/utsname.h>

	#include <stdlib.h>
	#include <errno.h>
	#include <fcntl.h>
	#include <ctype.h>
	#include <regex.h>

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/ipc.h>
	#include <crm/common/ipc_internal.h>
	#include <crm/cluster/internal.h>

	#include <crm/stonith-ng.h>
	#include <crm/fencing/internal.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h>

	#include <crm/common/util.h>
	#include <pacemaker-fenced.h>

	#define TIMEOUT_MULTIPLY_FACTOR 1.2

	/* When one fencer queries its peers for devices able to handle a fencing
	* request, each peer will reply with a list of such devices available to it.
	* Each reply will be parsed into a st_query_result_t, with each device's
	* information kept in a device_properties_t.
	*/

	typedef struct device_properties_s {
	/* Whether access to this device has been verified */
	gboolean verified;

	/* The remaining members are indexed by the operation's "phase" */

	/* Whether this device has been executed in each phase */
	gboolean executed[st_phase_max];
	/* Whether this device is disallowed from executing in each phase */
	gboolean disallowed[st_phase_max];
	/* Action-specific timeout for each phase */
	int custom_action_timeout[st_phase_max];
	/* Action-specific maximum random delay for each phase */
	int delay_max[st_phase_max];
	/* Action-specific base delay for each phase */
	int delay_base[st_phase_max];
	} device_properties_t;

	typedef struct st_query_result_s {
	/* Name of peer that sent this result */
	char *host;
	/* Only try peers for non-topology based operations once */
	gboolean tried;
	/* Number of entries in the devices table */
	int ndevices;
	/* Devices available to this host that are capable of fencing the target */
	GHashTable *devices;
	} st_query_result_t;

	GHashTable *stonith_remote_op_list = NULL;

	void call_remote_stonith(remote_fencing_op_t * op, st_query_result_t * peer, int rc);
	static void remote_op_done(remote_fencing_op_t * op, xmlNode * data, int rc, int dup);
	extern xmlNode stonith_create_op(int call_id, const char token, const char op, xmlNode data,
	int call_options);

	static void report_timeout_period(remote_fencing_op_t * op, int op_timeout);
	static int get_op_total_timeout(const remote_fencing_op_t *op,
	const st_query_result_t *chosen_peer);

	static gint
	sort_strings(gconstpointer a, gconstpointer b)
	{
	return strcmp(a, b);
	}

	static void
	free_remote_query(gpointer data)
	{
	if (data) {
	st_query_result_t *query = data;

	crm_trace("Free'ing query result from %s", query->host);
	g_hash_table_destroy(query->devices);
	free(query->host);
	free(query);
	}
	}

	void
	free_stonith_remote_op_list()
	{
	if (stonith_remote_op_list != NULL) {
	g_hash_table_destroy(stonith_remote_op_list);
	stonith_remote_op_list = NULL;
	}
	}

	struct peer_count_data {
	const remote_fencing_op_t *op;
	gboolean verified_only;
	int count;
	};

	/*!
	* \internal
	* \brief Increment a counter if a device has not been executed yet
	*
	* \param[in] key Device ID (ignored)
	* \param[in] value Device properties
	* \param[in] user_data Peer count data
	*/
	static void
	count_peer_device(gpointer key, gpointer value, gpointer user_data)
	{
	device_properties_t props = (device_properties_t)value;
	struct peer_count_data *data = user_data;

	if (!props->executed[data->op->phase]
	&& (!data->verified_only \|\| props->verified)) {
	++(data->count);
	}
	}

	/*!
	* \internal
	* \brief Check the number of available devices in a peer's query results
	*
	* \param[in] op Operation that results are for
	* \param[in] peer Peer to count
	* \param[in] verified_only Whether to count only verified devices
	*
	* \return Number of devices available to peer that were not already executed
	*/
	static int
	count_peer_devices(const remote_fencing_op_t op, const st_query_result_t peer,
	gboolean verified_only)
	{
	struct peer_count_data data;

	data.op = op;
	data.verified_only = verified_only;
	data.count = 0;
	if (peer) {
	g_hash_table_foreach(peer->devices, count_peer_device, &data);
	}
	return data.count;
	}

	/*!
	* \internal
	* \brief Search for a device in a query result
	*
	* \param[in] op Operation that result is for
	* \param[in] peer Query result for a peer
	* \param[in] device Device ID to search for
	*
	* \return Device properties if found, NULL otherwise
	*/
	static device_properties_t *
	find_peer_device(const remote_fencing_op_t op, const st_query_result_t peer,
	const char *device)
	{
	device_properties_t *props = g_hash_table_lookup(peer->devices, device);

	return (props && !props->executed[op->phase]
	&& !props->disallowed[op->phase])? props : NULL;
	}

	/*!
	* \internal
	* \brief Find a device in a peer's device list and mark it as executed
	*
	* \param[in] op Operation that peer result is for
	* \param[in,out] peer Peer with results to search
	* \param[in] device ID of device to mark as done
	* \param[in] verified_devices_only Only consider verified devices
	*
	* \return TRUE if device was found and marked, FALSE otherwise
	*/
	static gboolean
	grab_peer_device(const remote_fencing_op_t op, st_query_result_t peer,
	const char *device, gboolean verified_devices_only)
	{
	device_properties_t *props = find_peer_device(op, peer, device);

	if ((props == NULL) \|\| (verified_devices_only && !props->verified)) {
	return FALSE;
	}

	crm_trace("Removing %s from %s (%d remaining)",
	device, peer->host, count_peer_devices(op, peer, FALSE));
	props->executed[op->phase] = TRUE;
	return TRUE;
	}

	static void
	clear_remote_op_timers(remote_fencing_op_t * op)
	{
	if (op->query_timer) {
	g_source_remove(op->query_timer);
	op->query_timer = 0;
	}
	if (op->op_timer_total) {
	g_source_remove(op->op_timer_total);
	op->op_timer_total = 0;
	}
	if (op->op_timer_one) {
	g_source_remove(op->op_timer_one);
	op->op_timer_one = 0;
	}
	}

	static void
	free_remote_op(gpointer data)
	{
	remote_fencing_op_t *op = data;

	- crm_trace("Free'ing op %s for %s", op->id, op->target);
	crm_log_xml_debug(op->request, "Destroying");

	clear_remote_op_timers(op);

	free(op->id);
	free(op->action);
	free(op->delegate);
	free(op->target);
	free(op->client_id);
	free(op->client_name);
	free(op->originator);

	if (op->query_results) {
	g_list_free_full(op->query_results, free_remote_query);
	}
	if (op->request) {
	free_xml(op->request);
	op->request = NULL;
	}
	if (op->devices_list) {
	g_list_free_full(op->devices_list, free);
	op->devices_list = NULL;
	}
	g_list_free_full(op->automatic_list, free);
	g_list_free(op->duplicates);
	free(op);
	}

	void
	init_stonith_remote_op_hash_table(GHashTable **table)
	{
	if (*table == NULL) {
	*table = g_hash_table_new_full(crm_str_hash, g_str_equal, NULL, free_remote_op);
	}
	}

	/*!
	* \internal
	* \brief Return an operation's originally requested action (before any remap)
	*
	* \param[in] op Operation to check
	*
	* \return Operation's original action
	*/
	static const char *
	op_requested_action(const remote_fencing_op_t *op)
	{
	return ((op->phase > st_phase_requested)? "reboot" : op->action);
	}

	/*!
	* \internal
	* \brief Remap a "reboot" operation to the "off" phase
	*
	* \param[in,out] op Operation to remap
	*/
	static void
	op_phase_off(remote_fencing_op_t *op)
	{
	crm_info("Remapping multiple-device reboot targeting %s to 'off' "
	CRM_XS " id=%.8s", op->target, op->id);
	op->phase = st_phase_off;

	/* Happily, "off" and "on" are shorter than "reboot", so we can reuse the
	* memory allocation at each phase.
	*/
	strcpy(op->action, "off");
	}

	/*!
	* \internal
	* \brief Advance a remapped reboot operation to the "on" phase
	*
	* \param[in,out] op Operation to remap
	*/
	static void
	op_phase_on(remote_fencing_op_t *op)
	{
	GListPtr iter = NULL;

	crm_info("Remapped 'off' targeting %s complete, "
	"remapping to 'on' for %s " CRM_XS " id=%.8s",
	op->target, op->client_name, op->id);
	op->phase = st_phase_on;
	strcpy(op->action, "on");

	/* Skip devices with automatic unfencing, because the cluster will handle it
	* when the node rejoins.
	*/
	for (iter = op->automatic_list; iter != NULL; iter = iter->next) {
	GListPtr match = g_list_find_custom(op->devices_list, iter->data,
	sort_strings);

	if (match) {
	op->devices_list = g_list_remove(op->devices_list, match->data);
	}
	}
	g_list_free_full(op->automatic_list, free);
	op->automatic_list = NULL;

	/* Rewind device list pointer */
	op->devices = op->devices_list;
	}

	/*!
	* \internal
	* \brief Reset a remapped reboot operation
	*
	* \param[in,out] op Operation to reset
	*/
	static void
	undo_op_remap(remote_fencing_op_t *op)
	{
	if (op->phase > 0) {
	crm_info("Undoing remap of reboot targeting %s for %s "
	CRM_XS " id=%.8s", op->target, op->client_name, op->id);
	op->phase = st_phase_requested;
	strcpy(op->action, "reboot");
	}
	}

	static xmlNode *
	create_op_done_notify(remote_fencing_op_t * op, int rc)
	{
	xmlNode *notify_data = create_xml_node(NULL, T_STONITH_NOTIFY_FENCE);

	crm_xml_add_int(notify_data, "state", op->state);
	crm_xml_add_int(notify_data, F_STONITH_RC, rc);
	crm_xml_add(notify_data, F_STONITH_TARGET, op->target);
	crm_xml_add(notify_data, F_STONITH_ACTION, op->action);
	crm_xml_add(notify_data, F_STONITH_DELEGATE, op->delegate);
	crm_xml_add(notify_data, F_STONITH_REMOTE_OP_ID, op->id);
	crm_xml_add(notify_data, F_STONITH_ORIGIN, op->originator);
	crm_xml_add(notify_data, F_STONITH_CLIENTID, op->client_id);
	crm_xml_add(notify_data, F_STONITH_CLIENTNAME, op->client_name);

	return notify_data;
	}

	void
	stonith_bcast_result_to_peers(remote_fencing_op_t * op, int rc, gboolean op_merged)
	{
	static int count = 0;
	xmlNode *bcast = create_xml_node(NULL, T_STONITH_REPLY);
	xmlNode *notify_data = create_op_done_notify(op, rc);

	count++;
	crm_trace("Broadcasting result to peers");
	crm_xml_add(bcast, F_TYPE, T_STONITH_NOTIFY);
	crm_xml_add(bcast, F_SUBTYPE, "broadcast");
	crm_xml_add(bcast, F_STONITH_OPERATION, T_STONITH_NOTIFY);
	crm_xml_add_int(bcast, "count", count);

	if (op_merged) {
	crm_xml_add(bcast, F_STONITH_MERGED, "true");
	}

	add_message_xml(bcast, F_STONITH_CALLDATA, notify_data);
	send_cluster_message(NULL, crm_msg_stonith_ng, bcast, FALSE);
	free_xml(notify_data);
	free_xml(bcast);

	return;
	}

	static void
	handle_local_reply_and_notify(remote_fencing_op_t * op, xmlNode * data, int rc)
	{
	xmlNode *notify_data = NULL;
	xmlNode *reply = NULL;

	if (op->notify_sent == TRUE) {
	/* nothing to do */
	return;
	}

	/* Do notification with a clean data object */
	notify_data = create_op_done_notify(op, rc);
	crm_xml_add_int(data, "state", op->state);
	crm_xml_add(data, F_STONITH_TARGET, op->target);
	crm_xml_add(data, F_STONITH_OPERATION, op->action);

	reply = stonith_construct_reply(op->request, NULL, data, rc);
	crm_xml_add(reply, F_STONITH_DELEGATE, op->delegate);

	/* Send fencing OP reply to local client that initiated fencing */
	do_local_reply(reply, op->client_id, op->call_options & st_opt_sync_call, FALSE);

	/* bcast to all local clients that the fencing operation happend */
	do_stonith_notify(0, T_STONITH_NOTIFY_FENCE, rc, notify_data);
	do_stonith_notify(0, T_STONITH_NOTIFY_HISTORY, 0, NULL);

	/* mark this op as having notify's already sent */
	op->notify_sent = TRUE;
	free_xml(reply);
	free_xml(notify_data);
	}

	static void
	handle_duplicates(remote_fencing_op_t * op, xmlNode * data, int rc)
	{
	GListPtr iter = NULL;

	for (iter = op->duplicates; iter != NULL; iter = iter->next) {
	remote_fencing_op_t *other = iter->data;

	if (other->state == st_duplicate) {
	other->state = op->state;
	crm_debug("Performing duplicate notification for %s@%s: %s "
	CRM_XS " id=%.8s",
	other->client_name, other->originator,
	pcmk_strerror(rc), other->id);
	remote_op_done(other, data, rc, TRUE);

	} else {
	// Possible if (for example) it timed out already
	crm_err("Skipping duplicate notification for %s@%s "
	CRM_XS " state=%s id=%.8s",
	other->client_name, other->originator,
	stonith_op_state_str(other->state), other->id);
	}
	}
	}

	/*!
	* \internal
	* \brief Finalize a remote operation.
	*
	* \description This function has two code paths.
	*
	* Path 1. This node is the owner of the operation and needs
	* to notify the cpg group via a broadcast as to the operation's
	* results.
	*
	* Path 2. The cpg broadcast is received. All nodes notify their local
	* stonith clients the operation results.
	*
	* So, The owner of the operation first notifies the cluster of the result,
	* and once that cpg notify is received back it notifies all the local clients.
	*
	* Nodes that are passive watchers of the operation will receive the
	* broadcast and only need to notify their local clients the operation finished.
	*
	* \param op, The fencing operation to finalize
	* \param data, The xml msg reply (if present) of the last delegated fencing
	* operation.
	* \param dup, Is this operation a duplicate, if so treat it a little differently
	* making sure the broadcast is not sent out.
	*/
	static void
	remote_op_done(remote_fencing_op_t * op, xmlNode * data, int rc, int dup)
	{
	int level = LOG_ERR;
	const char *subt = NULL;
	xmlNode *local_data = NULL;
	gboolean op_merged = FALSE;

	op->completed = time(NULL);
	clear_remote_op_timers(op);
	undo_op_remap(op);

	if (op->notify_sent == TRUE) {
	crm_err("Already sent notifications for '%s' targeting %s by %s for "
	"client %s@%s: %s " CRM_XS " rc=%d state=%s id=%.8s",
	op->action, op->target,
	(op->delegate? op->delegate : "unknown node"),
	op->client_name, op->originator, pcmk_strerror(rc),
	rc, stonith_op_state_str(op->state), op->id);
	goto remote_op_done_cleanup;
	}

	if (!op->delegate && data && rc != -ENODEV && rc != -EHOSTUNREACH) {
	xmlNode *ndata = get_xpath_object("//@" F_STONITH_DELEGATE, data,
	LOG_NEVER);
	if(ndata) {
	op->delegate = crm_element_value_copy(ndata, F_STONITH_DELEGATE);
	} else {
	op->delegate = crm_element_value_copy(data, F_ORIG);
	}
	}

	if (data == NULL) {
	data = create_xml_node(NULL, "remote-op");
	local_data = data;
	}

	if(dup) {
	op_merged = TRUE;
	} else if (crm_element_value(data, F_STONITH_MERGED)) {
	op_merged = TRUE;
	}

	/* Tell everyone the operation is done, we will continue
	* with doing the local notifications once we receive
	* the broadcast back. */
	subt = crm_element_value(data, F_SUBTYPE);
	if (dup == FALSE && !pcmk__str_eq(subt, "broadcast", pcmk__str_casei)) {
	/* Defer notification until the bcast message arrives */
	stonith_bcast_result_to_peers(op, rc, (op_merged? TRUE: FALSE));
	goto remote_op_done_cleanup;
	}

	if (rc == pcmk_ok \|\| dup) {
	level = LOG_NOTICE;
	} else if (!pcmk__str_eq(op->originator, stonith_our_uname, pcmk__str_casei)) {
	level = LOG_NOTICE;
	}

	do_crm_log(level, "Operation '%s'%s%s by %s for %s@%s%s: %s "
	CRM_XS " id=%.8s", op->action, (op->target? " targeting " : ""),
	(op->target? op->target : ""),
	(op->delegate? op->delegate : "unknown node"),
	op->client_name, op->originator,
	(op_merged? " (merged)" : ""), pcmk_strerror(rc), op->id);

	handle_local_reply_and_notify(op, data, rc);

	if (dup == FALSE) {
	handle_duplicates(op, data, rc);
	}

	/* Free non-essential parts of the record
	* Keep the record around so we can query the history
	*/
	if (op->query_results) {
	g_list_free_full(op->query_results, free_remote_query);
	op->query_results = NULL;
	}

	if (op->request) {
	free_xml(op->request);
	op->request = NULL;
	}

	remote_op_done_cleanup:
	free_xml(local_data);
	}

	static gboolean
	remote_op_watchdog_done(gpointer userdata)
	{
	remote_fencing_op_t *op = userdata;

	op->op_timer_one = 0;

	crm_notice("Self-fencing (%s) by %s for %s assumed complete "
	CRM_XS " id=%.8s",
	op->action, op->target, op->client_name, op->id);
	op->state = st_done;
	remote_op_done(op, NULL, pcmk_ok, FALSE);
	return FALSE;
	}

	static gboolean
	remote_op_timeout_one(gpointer userdata)
	{
	remote_fencing_op_t *op = userdata;

	op->op_timer_one = 0;

	crm_notice("Peer's '%s' action targeting %s for client %s timed out " CRM_XS
	" id=%.8s", op->action, op->target, op->client_name, op->id);
	call_remote_stonith(op, NULL, pcmk_ok);
	return FALSE;
	}

	static gboolean
	remote_op_timeout(gpointer userdata)
	{
	remote_fencing_op_t *op = userdata;

	op->op_timer_total = 0;

	if (op->state == st_done) {
	crm_debug("Action '%s' targeting %s for client %s already completed "
	CRM_XS " id=%.8s",
	op->action, op->target, op->client_name, op->id);
	return FALSE;
	}

	crm_debug("Action '%s' targeting %s for client %s timed out "
	CRM_XS " id=%.8s",
	op->action, op->target, op->client_name, op->id);

	if (op->phase == st_phase_on) {
	/* A remapped reboot operation timed out in the "on" phase, but the
	* "off" phase completed successfully, so quit trying any further
	* devices, and return success.
	*/
	remote_op_done(op, NULL, pcmk_ok, FALSE);
	return FALSE;
	}

	op->state = st_failed;

	remote_op_done(op, NULL, -ETIME, FALSE);

	return FALSE;
	}

	static gboolean
	remote_op_query_timeout(gpointer data)
	{
	remote_fencing_op_t *op = data;

	op->query_timer = 0;
	if (op->state == st_done) {
	crm_debug("Operation %.8s targeting %s already completed",
	op->id, op->target);
	} else if (op->state == st_exec) {
	crm_debug("Operation %.8s targeting %s already in progress",
	op->id, op->target);
	} else if (op->query_results) {
	crm_debug("Query %.8s targeting %s complete (state=%s)",
	op->id, op->target, stonith_op_state_str(op->state));
	call_remote_stonith(op, NULL, pcmk_ok);
	} else {
	crm_debug("Query %.8s targeting %s timed out (state=%s)",
	op->id, op->target, stonith_op_state_str(op->state));
	if (op->op_timer_total) {
	g_source_remove(op->op_timer_total);
	op->op_timer_total = 0;
	}
	remote_op_timeout(op);
	}

	return FALSE;
	}

	static gboolean
	topology_is_empty(stonith_topology_t *tp)
	{
	int i;

	if (tp == NULL) {
	return TRUE;
	}

	for (i = 0; i < ST_LEVEL_MAX; i++) {
	if (tp->levels[i] != NULL) {
	return FALSE;
	}
	}
	return TRUE;
	}

	/*!
	* \internal
	* \brief Add a device to an operation's automatic unfencing list
	*
	* \param[in,out] op Operation to modify
	* \param[in] device Device ID to add
	*/
	static void
	add_required_device(remote_fencing_op_t op, const char device)
	{
	GListPtr match = g_list_find_custom(op->automatic_list, device,
	sort_strings);

	if (!match) {
	op->automatic_list = g_list_prepend(op->automatic_list, strdup(device));
	}
	}

	/*!
	* \internal
	* \brief Remove a device from the automatic unfencing list
	*
	* \param[in,out] op Operation to modify
	* \param[in] device Device ID to remove
	*/
	static void
	remove_required_device(remote_fencing_op_t op, const char device)
	{
	GListPtr match = g_list_find_custom(op->automatic_list, device,
	sort_strings);

	if (match) {
	op->automatic_list = g_list_remove(op->automatic_list, match->data);
	}
	}

	/* deep copy the device list */
	static void
	set_op_device_list(remote_fencing_op_t * op, GListPtr devices)
	{
	GListPtr lpc = NULL;

	if (op->devices_list) {
	g_list_free_full(op->devices_list, free);
	op->devices_list = NULL;
	}
	for (lpc = devices; lpc != NULL; lpc = lpc->next) {
	op->devices_list = g_list_append(op->devices_list, strdup(lpc->data));
	}
	op->devices = op->devices_list;
	}

	/*!
	* \internal
	* \brief Check whether a node matches a topology target
	*
	* \param[in] tp Topology table entry to check
	* \param[in] node Name of node to check
	*
	* \return TRUE if node matches topology target
	*/
	static gboolean
	topology_matches(const stonith_topology_t tp, const char node)
	{
	regex_t r_patt;

	CRM_CHECK(node && tp && tp->target, return FALSE);
	switch(tp->kind) {
	case 2:
	/* This level targets by attribute, so tp->target is a NAME=VALUE pair
	* of a permanent attribute applied to targeted nodes. The test below
	* relies on the locally cached copy of the CIB, so if fencing needs to
	* be done before the initial CIB is received or after a malformed CIB
	* is received, then the topology will be unable to be used.
	*/
	if (node_has_attr(node, tp->target_attribute, tp->target_value)) {
	crm_notice("Matched %s with %s by attribute", node, tp->target);
	return TRUE;
	}
	break;
	case 1:
	/* This level targets by name, so tp->target is a regular expression
	* matching names of nodes to be targeted.
	*/

	if (regcomp(&r_patt, tp->target_pattern, REG_EXTENDED\|REG_NOSUB)) {
	crm_info("Bad regex '%s' for fencing level", tp->target);
	} else {
	int status = regexec(&r_patt, node, 0, NULL, 0);

	regfree(&r_patt);
	if (status == 0) {
	crm_notice("Matched %s with %s by name", node, tp->target);
	return TRUE;
	}
	}
	break;
	case 0:
	crm_trace("Testing %s against %s", node, tp->target);
	return pcmk__str_eq(tp->target, node, pcmk__str_casei);
	}
	crm_trace("No match for %s with %s", node, tp->target);
	return FALSE;
	}

	stonith_topology_t *
	find_topology_for_host(const char *host)
	{
	GHashTableIter tIter;
	stonith_topology_t *tp = g_hash_table_lookup(topology, host);

	if(tp != NULL) {
	crm_trace("Found %s for %s in %d entries", tp->target, host, g_hash_table_size(topology));
	return tp;
	}

	g_hash_table_iter_init(&tIter, topology);
	while (g_hash_table_iter_next(&tIter, NULL, (gpointer *) & tp)) {
	if (topology_matches(tp, host)) {
	crm_trace("Found %s for %s in %d entries", tp->target, host, g_hash_table_size(topology));
	return tp;
	}
	}

	crm_trace("No matches for %s in %d topology entries", host, g_hash_table_size(topology));
	return NULL;
	}

	/*!
	* \internal
	* \brief Set fencing operation's device list to target's next topology level
	*
	* \param[in,out] op Remote fencing operation to modify
	* \param[in] empty_ok If true, an operation without a target (i.e.
	* queries) or a target without a topology will get a
	* pcmk_rc_ok return value instead of ENODEV
	*
	* \return Standard Pacemaker return value
	*/
	static int
	advance_topology_level(remote_fencing_op_t *op, bool empty_ok)
	{
	stonith_topology_t *tp = NULL;

	if (op->target) {
	tp = find_topology_for_host(op->target);
	}
	if (topology_is_empty(tp)) {
	return empty_ok? pcmk_rc_ok : ENODEV;
	}

	CRM_ASSERT(tp->levels != NULL);

	stonith__set_call_options(op->call_options, op->id, st_opt_topology);

	/* This is a new level, so undo any remapping left over from previous */
	undo_op_remap(op);

	do {
	op->level++;

	} while (op->level < ST_LEVEL_MAX && tp->levels[op->level] == NULL);

	if (op->level < ST_LEVEL_MAX) {
	crm_trace("Attempting fencing level %d targeting %s (%d devices) "
	"for client %s@%s (id=%.8s)",
	op->level, op->target, g_list_length(tp->levels[op->level]),
	op->client_name, op->originator, op->id);
	set_op_device_list(op, tp->levels[op->level]);

	// The requested delay has been applied for the first fencing level
	if (op->level > 1 && op->delay > 0) {
	op->delay = 0;
	}

	if (g_list_next(op->devices_list) && pcmk__str_eq(op->action, "reboot", pcmk__str_casei)) {
	/* A reboot has been requested for a topology level with multiple
	* devices. Instead of rebooting the devices sequentially, we will
	* turn them all off, then turn them all on again. (Think about
	* switched power outlets for redundant power supplies.)
	*/
	op_phase_off(op);
	}
	return pcmk_rc_ok;
	}

	crm_notice("All fencing options targeting %s for client %s@%s failed "
	CRM_XS " id=%.8s",
	op->target, op->client_name, op->originator, op->id);
	return ENODEV;
	}

	/*!
	* \brief Check to see if this operation is a duplicate of another in flight
	* operation. If so merge this operation into the inflight operation, and mark
	* it as a duplicate.
	*/
	static void
	merge_duplicates(remote_fencing_op_t * op)
	{
	GHashTableIter iter;
	remote_fencing_op_t *other = NULL;

	time_t now = time(NULL);

	g_hash_table_iter_init(&iter, stonith_remote_op_list);
	while (g_hash_table_iter_next(&iter, NULL, (void **)&other)) {
	const char *other_action = op_requested_action(other);

	if (other->state > st_exec) {
	crm_trace("%.8s not duplicate of %.8s: not in progress",
	op->id, other->id);
	continue;
	}
	if (!pcmk__str_eq(op->target, other->target, pcmk__str_casei)) {
	crm_trace("%.8s not duplicate of %.8s: node %s vs. %s",
	op->id, other->id, op->target, other->target);
	continue;
	}
	if (!pcmk__str_eq(op->action, other_action, pcmk__str_casei)) {
	crm_trace("%.8s not duplicate of %.8s: action %s vs. %s",
	op->id, other->id, op->action, other_action);
	continue;
	}
	if (pcmk__str_eq(op->client_name, other->client_name, pcmk__str_casei)) {
	crm_trace("%.8s not duplicate of %.8s: same client %s",
	op->id, other->id, op->client_name);
	continue;
	}
	if (pcmk__str_eq(other->target, other->originator, pcmk__str_casei)) {
	crm_trace("%.8s not duplicate of %.8s: suicide for %s",
	op->id, other->id, other->target);
	continue;
	}
	if (!fencing_peer_active(crm_get_peer(0, other->originator))) {
	crm_notice("Failing action '%s' targeting %s originating from "
	"client %s@%s: Originator is dead " CRM_XS " id=%.8s",
	other->action, other->target, other->client_name,
	other->originator, other->id);
	crm_trace("%.8s not duplicate of %.8s: originator dead",
	op->id, other->id);
	other->state = st_failed;
	continue;
	}
	if ((other->total_timeout > 0)
	&& (now > (other->total_timeout + other->created))) {
	crm_trace("%.8s not duplicate of %.8s: old (%ld vs. %ld + %d)",
	op->id, other->id, now, other->created,
	other->total_timeout);
	continue;
	}

	/* There is another in-flight request to fence the same host
	* Piggyback on that instead. If it fails, so do we.
	*/
	other->duplicates = g_list_append(other->duplicates, op);
	if (other->total_timeout == 0) {
	other->total_timeout = op->total_timeout =
	TIMEOUT_MULTIPLY_FACTOR * get_op_total_timeout(op, NULL);
	crm_trace("Best guess as to timeout used for %.8s: %d",
	other->id, other->total_timeout);
	}
	crm_notice("Merging fencing action '%s' targeting %s originating from "
	"client %s with identical request from %s@%s "
	CRM_XS " original=%.8s duplicate=%.8s total_timeout=%ds",
	op->action, op->target, op->client_name,
	other->client_name, other->originator,
	op->id, other->id, other->total_timeout);
	report_timeout_period(op, other->total_timeout);
	op->state = st_duplicate;
	}
	}

	static uint32_t fencing_active_peers(void)
	{
	uint32_t count = 0;
	crm_node_t *entry;
	GHashTableIter gIter;

	g_hash_table_iter_init(&gIter, crm_peer_cache);
	while (g_hash_table_iter_next(&gIter, NULL, (void **)&entry)) {
	if(fencing_peer_active(entry)) {
	count++;
	}
	}
	return count;
	}

	int
	stonith_manual_ack(xmlNode * msg, remote_fencing_op_t * op)
	{
	xmlNode *dev = get_xpath_object("//@" F_STONITH_TARGET, msg, LOG_ERR);

	op->state = st_done;
	op->completed = time(NULL);
	op->delegate = strdup("a human");

	crm_notice("Injecting manual confirmation that %s is safely off/down",
	crm_element_value(dev, F_STONITH_TARGET));

	remote_op_done(op, msg, pcmk_ok, FALSE);

	/* Replies are sent via done_cb->stonith_send_async_reply()->do_local_reply() */
	return -EINPROGRESS;
	}

	/*!
	* \internal
	* \brief Create a new remote stonith operation
	*
	* \param[in] client ID of local stonith client that initiated the operation
	* \param[in] request The request from the client that started the operation
	* \param[in] peer TRUE if this operation is owned by another stonith peer
	* (an operation owned by one peer is stored on all peers,
	* but only the owner executes it; all nodes get the results
	* once the owner finishes execution)
	*/
	void *
	create_remote_stonith_op(const char client, xmlNode request, gboolean peer)
	{
	remote_fencing_op_t *op = NULL;
	xmlNode *dev = get_xpath_object("//@" F_STONITH_TARGET, request, LOG_NEVER);
	int call_options = 0;
	const char *operation = NULL;

	init_stonith_remote_op_hash_table(&stonith_remote_op_list);

	/* If this operation is owned by another node, check to make
	* sure we haven't already created this operation. */
	if (peer && dev) {
	const char *op_id = crm_element_value(dev, F_STONITH_REMOTE_OP_ID);

	CRM_CHECK(op_id != NULL, return NULL);

	op = g_hash_table_lookup(stonith_remote_op_list, op_id);
	if (op) {
	crm_debug("Reusing existing remote fencing op %.8s for %s",
	op_id, ((client == NULL)? "unknown client" : client));
	return op;
	}
	}

	op = calloc(1, sizeof(remote_fencing_op_t));
	CRM_ASSERT(op != NULL);

	crm_element_value_int(request, F_STONITH_TIMEOUT, &(op->base_timeout));
	// Value -1 means disable any static/random fencing delays
	crm_element_value_int(request, F_STONITH_DELAY, &(op->delay));

	if (peer && dev) {
	op->id = crm_element_value_copy(dev, F_STONITH_REMOTE_OP_ID);
	} else {
	op->id = crm_generate_uuid();
	}

	g_hash_table_replace(stonith_remote_op_list, op->id, op);

	op->state = st_query;
	op->replies_expected = fencing_active_peers();
	op->action = crm_element_value_copy(dev, F_STONITH_ACTION);
	op->originator = crm_element_value_copy(dev, F_STONITH_ORIGIN);
	op->delegate = crm_element_value_copy(dev, F_STONITH_DELEGATE); /* May not be set */
	op->created = time(NULL);

	if (op->originator == NULL) {
	/* Local or relayed request */
	op->originator = strdup(stonith_our_uname);
	}

	CRM_LOG_ASSERT(client != NULL);
	if (client) {
	op->client_id = strdup(client);
	}


	/* For a RELAY operation, set fenced on the client. */
	operation = crm_element_value(request, F_STONITH_OPERATION);

	if (pcmk__str_eq(operation, STONITH_OP_RELAY, pcmk__str_none)) {
	op->client_name = crm_strdup_printf("%s.%lu", crm_system_name,
	(unsigned long) getpid());
	} else {
	op->client_name = crm_element_value_copy(request, F_STONITH_CLIENTNAME);
	}

	op->target = crm_element_value_copy(dev, F_STONITH_TARGET);
	op->request = copy_xml(request); /* TODO: Figure out how to avoid this */
	crm_element_value_int(request, F_STONITH_CALLOPTS, &call_options);
	op->call_options = call_options;

	crm_element_value_int(request, F_STONITH_CALLID, &(op->client_callid));

	crm_trace("%s new fencing op %s ('%s' targeting %s for client %s, "
	"base timeout %d, %u %s expected)",
	(peer && dev)? "Recorded" : "Generated", op->id, op->action,
	op->target, op->client_name, op->base_timeout,
	op->replies_expected,
	pcmk__plural_alt(op->replies_expected, "reply", "replies"));

	if (op->call_options & st_opt_cs_nodeid) {
	int nodeid = crm_atoi(op->target, NULL);
	crm_node_t *node = crm_find_known_peer_full(nodeid, NULL, CRM_GET_PEER_ANY);

	/* Ensure the conversion only happens once */
	stonith__clear_call_options(op->call_options, op->id, st_opt_cs_nodeid);

	if (node && node->uname) {
	free(op->target);
	op->target = strdup(node->uname);

	} else {
	crm_warn("Could not expand nodeid '%s' into a host name", op->target);
	}
	}

	/* check to see if this is a duplicate operation of another in-flight operation */
	merge_duplicates(op);

	if (op->state != st_duplicate) {
	/* kick history readers */
	do_stonith_notify(0, T_STONITH_NOTIFY_HISTORY, 0, NULL);
	}

	/* safe to trim as long as that doesn't touch pending ops */
	stonith_fence_history_trim();

	return op;
	}

	remote_fencing_op_t *
	initiate_remote_stonith_op(pcmk__client_t client, xmlNode request,
	gboolean manual_ack)
	{
	int query_timeout = 0;
	xmlNode *query = NULL;
	const char *client_id = NULL;
	remote_fencing_op_t *op = NULL;
	const char *relay_op_id = NULL;
	const char *operation = NULL;

	if (client) {
	client_id = client->id;
	} else {
	client_id = crm_element_value(request, F_STONITH_CLIENTID);
	}

	CRM_LOG_ASSERT(client_id != NULL);
	op = create_remote_stonith_op(client_id, request, FALSE);
	op->owner = TRUE;
	if (manual_ack) {
	crm_notice("Processing manual confirmation of fencing targeting %s "
	CRM_XS " id=%.8s", op->target, op->id);
	return op;
	}

	CRM_CHECK(op->action, return NULL);

	if (advance_topology_level(op, true) != pcmk_rc_ok) {
	op->state = st_failed;
	}

	switch (op->state) {
	case st_failed:
	crm_warn("Could not request peer fencing (%s) targeting %s "
	CRM_XS " id=%.8s", op->action, op->target, op->id);
	remote_op_done(op, NULL, -EINVAL, FALSE);
	return op;

	case st_duplicate:
	crm_info("Requesting peer fencing (%s) targeting %s (duplicate) "
	CRM_XS " id=%.8s", op->action, op->target, op->id);
	return op;

	default:
	crm_notice("Requesting peer fencing (%s) targeting %s "
	CRM_XS " id=%.8s state=%s base_timeout=%d",
	op->action, op->target, op->id,
	stonith_op_state_str(op->state), op->base_timeout);
	}

	query = stonith_create_op(op->client_callid, op->id, STONITH_OP_QUERY,
	NULL, op->call_options);

	crm_xml_add(query, F_STONITH_REMOTE_OP_ID, op->id);
	crm_xml_add(query, F_STONITH_TARGET, op->target);
	crm_xml_add(query, F_STONITH_ACTION, op_requested_action(op));
	crm_xml_add(query, F_STONITH_ORIGIN, op->originator);
	crm_xml_add(query, F_STONITH_CLIENTID, op->client_id);
	crm_xml_add(query, F_STONITH_CLIENTNAME, op->client_name);
	crm_xml_add_int(query, F_STONITH_TIMEOUT, op->base_timeout);

	/* In case of RELAY operation, RELAY information is added to the query to delete the original operation of RELAY. */
	operation = crm_element_value(request, F_STONITH_OPERATION);
	if (pcmk__str_eq(operation, STONITH_OP_RELAY, pcmk__str_none)) {
	relay_op_id = crm_element_value(request, F_STONITH_REMOTE_OP_ID);
	if (relay_op_id) {
	crm_xml_add(query, F_STONITH_REMOTE_OP_ID_RELAY, relay_op_id);
	}
	}

	send_cluster_message(NULL, crm_msg_stonith_ng, query, FALSE);
	free_xml(query);

	query_timeout = op->base_timeout * TIMEOUT_MULTIPLY_FACTOR;
	op->query_timer = g_timeout_add((1000 * query_timeout), remote_op_query_timeout, op);

	return op;
	}

	enum find_best_peer_options {
	/! Skip checking the target peer for capable fencing devices /
	FIND_PEER_SKIP_TARGET = 0x0001,
	/! Only check the target peer for capable fencing devices /
	FIND_PEER_TARGET_ONLY = 0x0002,
	/! Skip peers and devices that are not verified /
	FIND_PEER_VERIFIED_ONLY = 0x0004,
	};

	static st_query_result_t *
	find_best_peer(const char device, remote_fencing_op_t op, enum find_best_peer_options options)
	{
	GListPtr iter = NULL;
	gboolean verified_devices_only = (options & FIND_PEER_VERIFIED_ONLY) ? TRUE : FALSE;

	if (!device && pcmk_is_set(op->call_options, st_opt_topology)) {
	return NULL;
	}

	for (iter = op->query_results; iter != NULL; iter = iter->next) {
	st_query_result_t *peer = iter->data;

	crm_trace("Testing result from %s targeting %s with %d device%s: %d %x",
	peer->host, op->target, peer->ndevices,
	pcmk__plural_s(peer->ndevices), peer->tried, options);
	if ((options & FIND_PEER_SKIP_TARGET) && pcmk__str_eq(peer->host, op->target, pcmk__str_casei)) {
	continue;
	}
	if ((options & FIND_PEER_TARGET_ONLY) && !pcmk__str_eq(peer->host, op->target, pcmk__str_casei)) {
	continue;
	}

	if (pcmk_is_set(op->call_options, st_opt_topology)) {

	if (grab_peer_device(op, peer, device, verified_devices_only)) {
	return peer;
	}

	} else if ((peer->tried == FALSE)
	&& count_peer_devices(op, peer, verified_devices_only)) {

	/* No topology: Use the current best peer */
	crm_trace("Simple fencing");
	return peer;
	}
	}

	return NULL;
	}

	static st_query_result_t *
	stonith_choose_peer(remote_fencing_op_t * op)
	{
	const char *device = NULL;
	st_query_result_t *peer = NULL;
	uint32_t active = fencing_active_peers();

	do {
	if (op->devices) {
	device = op->devices->data;
	crm_trace("Checking for someone to fence (%s) %s with %s",
	op->action, op->target, device);
	} else {
	crm_trace("Checking for someone to fence (%s) %s",
	op->action, op->target);
	}

	/* Best choice is a peer other than the target with verified access */
	peer = find_best_peer(device, op, FIND_PEER_SKIP_TARGET\|FIND_PEER_VERIFIED_ONLY);
	if (peer) {
	crm_trace("Found verified peer %s for %s", peer->host, device?device:"<any>");
	return peer;
	}

	if(op->query_timer != 0 && op->replies < QB_MIN(op->replies_expected, active)) {
	crm_trace("Waiting before looking for unverified devices to fence %s", op->target);
	return NULL;
	}

	/* If no other peer has verified access, next best is unverified access */
	peer = find_best_peer(device, op, FIND_PEER_SKIP_TARGET);
	if (peer) {
	crm_trace("Found best unverified peer %s", peer->host);
	return peer;
	}

	/* If no other peer can do it, last option is self-fencing
	* (which is never allowed for the "on" phase of a remapped reboot)
	*/
	if (op->phase != st_phase_on) {
	peer = find_best_peer(device, op, FIND_PEER_TARGET_ONLY);
	if (peer) {
	crm_trace("%s will fence itself", peer->host);
	return peer;
	}
	}

	/* Try the next fencing level if there is one (unless we're in the "on"
	* phase of a remapped "reboot", because we ignore errors in that case)
	*/
	} while ((op->phase != st_phase_on)
	&& pcmk_is_set(op->call_options, st_opt_topology)
	&& (advance_topology_level(op, false) == pcmk_rc_ok));

	crm_notice("Couldn't find anyone to fence (%s) %s with %s",
	op->action, op->target, (device? device : "any device"));
	return NULL;
	}

	static int
	get_device_timeout(const remote_fencing_op_t op, const st_query_result_t peer,
	const char *device)
	{
	device_properties_t *props;

	if (!peer \|\| !device) {
	return op->base_timeout;
	}

	props = g_hash_table_lookup(peer->devices, device);
	if (!props) {
	return op->base_timeout;
	}

	return (props->custom_action_timeout[op->phase]?
	props->custom_action_timeout[op->phase] : op->base_timeout)
	+ props->delay_max[op->phase];
	}

	struct timeout_data {
	const remote_fencing_op_t *op;
	const st_query_result_t *peer;
	int total_timeout;
	};

	/*!
	* \internal
	* \brief Add timeout to a total if device has not been executed yet
	*
	* \param[in] key GHashTable key (device ID)
	* \param[in] value GHashTable value (device properties)
	* \param[in] user_data Timeout data
	*/
	static void
	add_device_timeout(gpointer key, gpointer value, gpointer user_data)
	{
	const char *device_id = key;
	device_properties_t *props = value;
	struct timeout_data *timeout = user_data;

	if (!props->executed[timeout->op->phase]
	&& !props->disallowed[timeout->op->phase]) {
	timeout->total_timeout += get_device_timeout(timeout->op,
	timeout->peer, device_id);
	}
	}

	static int
	get_peer_timeout(const remote_fencing_op_t op, const st_query_result_t peer)
	{
	struct timeout_data timeout;

	timeout.op = op;
	timeout.peer = peer;
	timeout.total_timeout = 0;

	g_hash_table_foreach(peer->devices, add_device_timeout, &timeout);

	return (timeout.total_timeout? timeout.total_timeout : op->base_timeout);
	}

	static int
	get_op_total_timeout(const remote_fencing_op_t *op,
	const st_query_result_t *chosen_peer)
	{
	int total_timeout = 0;
	stonith_topology_t *tp = find_topology_for_host(op->target);

	if (pcmk_is_set(op->call_options, st_opt_topology) && tp) {
	int i;
	GListPtr device_list = NULL;
	GListPtr iter = NULL;

	/* Yep, this looks scary, nested loops all over the place.
	* Here is what is going on.
	* Loop1: Iterate through fencing levels.
	* Loop2: If a fencing level has devices, loop through each device
	* Loop3: For each device in a fencing level, see what peer owns it
	* and what that peer has reported the timeout is for the device.
	*/
	for (i = 0; i < ST_LEVEL_MAX; i++) {
	if (!tp->levels[i]) {
	continue;
	}
	for (device_list = tp->levels[i]; device_list; device_list = device_list->next) {
	for (iter = op->query_results; iter != NULL; iter = iter->next) {
	const st_query_result_t *peer = iter->data;

	if (find_peer_device(op, peer, device_list->data)) {
	total_timeout += get_device_timeout(op, peer,
	device_list->data);
	break;
	}
	} /* End Loop3: match device with peer that owns device, find device's timeout period */
	} /* End Loop2: iterate through devices at a specific level */
	} /End Loop1: iterate through fencing levels /

	} else if (chosen_peer) {
	total_timeout = get_peer_timeout(op, chosen_peer);
	} else {
	total_timeout = op->base_timeout;
	}

	return total_timeout ? total_timeout : op->base_timeout;
	}

	static void
	report_timeout_period(remote_fencing_op_t * op, int op_timeout)
	{
	GListPtr iter = NULL;
	xmlNode *update = NULL;
	const char *client_node = NULL;
	const char *client_id = NULL;
	const char *call_id = NULL;

	if (op->call_options & st_opt_sync_call) {
	/* There is no reason to report the timeout for a synchronous call. It
	* is impossible to use the reported timeout to do anything when the client
	* is blocking for the response. This update is only important for
	* async calls that require a callback to report the results in. */
	return;
	} else if (!op->request) {
	return;
	}

	crm_trace("Reporting timeout for %s (id=%.8s)", op->client_name, op->id);
	client_node = crm_element_value(op->request, F_STONITH_CLIENTNODE);
	call_id = crm_element_value(op->request, F_STONITH_CALLID);
	client_id = crm_element_value(op->request, F_STONITH_CLIENTID);
	if (!client_node \|\| !call_id \|\| !client_id) {
	return;
	}

	if (pcmk__str_eq(client_node, stonith_our_uname, pcmk__str_casei)) {
	/* The client is connected to this node, send the update direclty to them */
	do_stonith_async_timeout_update(client_id, call_id, op_timeout);
	return;
	}

	/* The client is connected to another node, relay this update to them */
	update = stonith_create_op(op->client_callid, op->id, STONITH_OP_TIMEOUT_UPDATE, NULL, 0);
	crm_xml_add(update, F_STONITH_REMOTE_OP_ID, op->id);
	crm_xml_add(update, F_STONITH_CLIENTID, client_id);
	crm_xml_add(update, F_STONITH_CALLID, call_id);
	crm_xml_add_int(update, F_STONITH_TIMEOUT, op_timeout);

	send_cluster_message(crm_get_peer(0, client_node), crm_msg_stonith_ng, update, FALSE);

	free_xml(update);

	for (iter = op->duplicates; iter != NULL; iter = iter->next) {
	remote_fencing_op_t *dup = iter->data;

	crm_trace("Reporting timeout for duplicate %.8s to client %s",
	dup->id, dup->client_name);
	report_timeout_period(iter->data, op_timeout);
	}
	}

	/*!
	* \internal
	* \brief Advance an operation to the next device in its topology
	*
	* \param[in,out] op Operation to advance
	* \param[in] device ID of device just completed
	* \param[in] msg XML reply that contained device result (if available)
	* \param[in] rc Return code of device's execution
	*/
	static void
	advance_topology_device_in_level(remote_fencing_op_t op, const char device,
	xmlNode *msg, int rc)
	{
	/* Advance to the next device at this topology level, if any */
	if (op->devices) {
	op->devices = op->devices->next;
	}

	/* Handle automatic unfencing if an "on" action was requested */
	if ((op->phase == st_phase_requested) && pcmk__str_eq(op->action, "on", pcmk__str_casei)) {
	/* If the device we just executed was required, it's not anymore */
	remove_required_device(op, device);

	/* If there are no more devices at this topology level, run through any
	* remaining devices with automatic unfencing
	*/
	if (op->devices == NULL) {
	op->devices = op->automatic_list;
	}
	}

	if ((op->devices == NULL) && (op->phase == st_phase_off)) {
	/* We're done with this level and with required devices, but we had
	* remapped "reboot" to "off", so start over with "on". If any devices
	* need to be turned back on, op->devices will be non-NULL after this.
	*/
	op_phase_on(op);
	}

	if (op->devices) {
	/* Necessary devices remain, so execute the next one */
	crm_trace("Next targeting %s on behalf of %s@%s (rc was %d)",
	op->target, op->client_name, op->originator, rc);

	// The requested delay has been applied for the first device
	if (op->delay > 0) {
	op->delay = 0;
	}

	call_remote_stonith(op, NULL, pcmk_ok);
	} else {
	/* We're done with all devices and phases, so finalize operation */
	crm_trace("Marking complex fencing op targeting %s as complete",
	op->target);
	op->state = st_done;
	remote_op_done(op, msg, rc, FALSE);
	}
	}

	void
	call_remote_stonith(remote_fencing_op_t * op, st_query_result_t * peer, int rc)
	{
	const char *device = NULL;
	int timeout = op->base_timeout;

	crm_trace("Action %.8s targeting %s for %s is %s",
	op->id, op->target, op->client_name,
	stonith_op_state_str(op->state));
	if ((peer == NULL) && !pcmk_is_set(op->call_options, st_opt_topology)) {
	peer = stonith_choose_peer(op);
	}

	if (!op->op_timer_total) {
	int total_timeout = get_op_total_timeout(op, peer);

	op->total_timeout = TIMEOUT_MULTIPLY_FACTOR * total_timeout;
	op->op_timer_total = g_timeout_add(1000 * op->total_timeout, remote_op_timeout, op);
	report_timeout_period(op, op->total_timeout);
	crm_info("Total timeout set to %d for peer's fencing targeting %s for %s"
	CRM_XS "id=%.8s",
	total_timeout, op->target, op->client_name, op->id);
	}

	if (pcmk_is_set(op->call_options, st_opt_topology) && op->devices) {
	/* Ignore any peer preference, they might not have the device we need */
	/* When using topology, stonith_choose_peer() removes the device from
	* further consideration, so be sure to calculate timeout beforehand */
	peer = stonith_choose_peer(op);

	device = op->devices->data;
	timeout = get_device_timeout(op, peer, device);
	}

	if (peer) {
	int timeout_one = 0;
	xmlNode *remote_op = stonith_create_op(op->client_callid, op->id, STONITH_OP_FENCE, NULL, 0);

	crm_xml_add(remote_op, F_STONITH_REMOTE_OP_ID, op->id);
	crm_xml_add(remote_op, F_STONITH_TARGET, op->target);
	crm_xml_add(remote_op, F_STONITH_ACTION, op->action);
	crm_xml_add(remote_op, F_STONITH_ORIGIN, op->originator);
	crm_xml_add(remote_op, F_STONITH_CLIENTID, op->client_id);
	crm_xml_add(remote_op, F_STONITH_CLIENTNAME, op->client_name);
	crm_xml_add_int(remote_op, F_STONITH_TIMEOUT, timeout);
	crm_xml_add_int(remote_op, F_STONITH_CALLOPTS, op->call_options);
	crm_xml_add_int(remote_op, F_STONITH_DELAY, op->delay);

	if (device) {
	timeout_one = TIMEOUT_MULTIPLY_FACTOR *
	get_device_timeout(op, peer, device);
	crm_notice("Requesting that %s perform '%s' action targeting %s "
	"using '%s' " CRM_XS " for client %s (%ds)",
	peer->host, op->action, op->target, device,
	op->client_name, timeout_one);
	crm_xml_add(remote_op, F_STONITH_DEVICE, device);
	crm_xml_add(remote_op, F_STONITH_MODE, "slave");

	} else {
	timeout_one = TIMEOUT_MULTIPLY_FACTOR * get_peer_timeout(op, peer);
	crm_notice("Requesting that %s perform '%s' action targeting %s "
	CRM_XS " for client %s (%ds, %lds)",
	peer->host, op->action, op->target, op->client_name,
	timeout_one, stonith_watchdog_timeout_ms);
	crm_xml_add(remote_op, F_STONITH_MODE, "smart");
	}

	op->state = st_exec;
	if (op->op_timer_one) {
	g_source_remove(op->op_timer_one);
	}

	if(stonith_watchdog_timeout_ms > 0 && device && pcmk__str_eq(device, "watchdog", pcmk__str_casei)) {
	crm_notice("Waiting %lds for %s to self-fence (%s) for client %s "
	CRM_XS " id=%.8s", (stonith_watchdog_timeout_ms / 1000),
	op->target, op->action, op->client_name, op->id);
	op->op_timer_one = g_timeout_add(stonith_watchdog_timeout_ms, remote_op_watchdog_done, op);

	/* TODO check devices to verify watchdog will be in use */
	} else if(stonith_watchdog_timeout_ms > 0
	&& pcmk__str_eq(peer->host, op->target, pcmk__str_casei)
	&& !pcmk__str_eq(op->action, "on", pcmk__str_casei)) {
	crm_notice("Waiting %lds for %s to self-fence (%s) for client %s "
	CRM_XS " id=%.8s", (stonith_watchdog_timeout_ms / 1000),
	op->target, op->action, op->client_name, op->id);
	op->op_timer_one = g_timeout_add(stonith_watchdog_timeout_ms, remote_op_watchdog_done, op);

	} else {
	op->op_timer_one = g_timeout_add((1000 * timeout_one), remote_op_timeout_one, op);
	}


	send_cluster_message(crm_get_peer(0, peer->host), crm_msg_stonith_ng, remote_op, FALSE);
	peer->tried = TRUE;
	free_xml(remote_op);
	return;

	} else if (op->phase == st_phase_on) {
	/* A remapped "on" cannot be executed, but the node was already
	* turned off successfully, so ignore the error and continue.
	*/
	crm_warn("Ignoring %s 'on' failure (no capable peers) targeting %s "
	"after successful 'off'", device, op->target);
	advance_topology_device_in_level(op, device, NULL, pcmk_ok);
	return;

	} else if (op->owner == FALSE) {
	crm_err("Fencing (%s) targeting %s for client %s is not ours to control",
	op->action, op->target, op->client_name);

	} else if (op->query_timer == 0) {
	/* We've exhausted all available peers */
	crm_info("No remaining peers capable of fencing (%s) %s for client %s "
	CRM_XS " state=%s", op->action, op->target, op->client_name,
	stonith_op_state_str(op->state));
	CRM_LOG_ASSERT(op->state < st_done);
	remote_op_timeout(op);

	} else if(op->replies >= op->replies_expected \|\| op->replies >= fencing_active_peers()) {
	// int rc = -EHOSTUNREACH;

	/* if the operation never left the query state,
	* but we have all the expected replies, then no devices
	* are available to execute the fencing operation. */

	if(stonith_watchdog_timeout_ms && pcmk__str_eq(device, "watchdog", pcmk__str_null_matches \| pcmk__str_casei)) {
	crm_notice("Waiting %lds for %s to self-fence (%s) for client %s "
	CRM_XS " id=%.8s", (stonith_watchdog_timeout_ms / 1000),
	op->target, op->action, op->client_name, op->id);
	op->op_timer_one = g_timeout_add(stonith_watchdog_timeout_ms, remote_op_watchdog_done, op);
	return;
	}

	if (op->state == st_query) {
	crm_info("No peers (out of %d) have devices capable of fencing "
	"(%s) %s for client %s " CRM_XS " state=%s",
	op->replies, op->action, op->target, op->client_name,
	stonith_op_state_str(op->state));

	rc = -ENODEV;
	} else {
	if (pcmk_is_set(op->call_options, st_opt_topology)) {
	rc = -EHOSTUNREACH;
	}

	crm_info("No peers (out of %d) are capable of fencing (%s) %s "
	"for client %s " CRM_XS " state=%s",
	op->replies, op->action, op->target, op->client_name,
	stonith_op_state_str(op->state));
	}

	op->state = st_failed;
	remote_op_done(op, NULL, rc, FALSE);

	} else {
	crm_info("Waiting for additional peers capable of fencing (%s) %s%s%s "
	"for client %s " CRM_XS " id=%.8s",
	op->action, op->target, (device? " with " : ""),
	(device? device : ""), op->client_name, op->id);
	}
	}

	/*!
	* \internal
	* \brief Comparison function for sorting query results
	*
	* \param[in] a GList item to compare
	* \param[in] b GList item to compare
	*
	* \return Per the glib documentation, "a negative integer if the first value
	* comes before the second, 0 if they are equal, or a positive integer
	* if the first value comes after the second."
	*/
	static gint
	sort_peers(gconstpointer a, gconstpointer b)
	{
	const st_query_result_t *peer_a = a;
	const st_query_result_t *peer_b = b;

	return (peer_b->ndevices - peer_a->ndevices);
	}

	/*!
	* \internal
	* \brief Determine if all the devices in the topology are found or not
	*/
	static gboolean
	all_topology_devices_found(remote_fencing_op_t * op)
	{
	GListPtr device = NULL;
	GListPtr iter = NULL;
	device_properties_t *match = NULL;
	stonith_topology_t *tp = NULL;
	gboolean skip_target = FALSE;
	int i;

	tp = find_topology_for_host(op->target);
	if (!tp) {
	return FALSE;
	}
	if (pcmk__strcase_any_of(op->action, "off", "reboot", NULL)) {
	/* Don't count the devices on the target node if we are killing
	* the target node. */
	skip_target = TRUE;
	}

	for (i = 0; i < ST_LEVEL_MAX; i++) {
	for (device = tp->levels[i]; device; device = device->next) {
	match = NULL;
	for (iter = op->query_results; iter && !match; iter = iter->next) {
	st_query_result_t *peer = iter->data;

	if (skip_target && pcmk__str_eq(peer->host, op->target, pcmk__str_casei)) {
	continue;
	}
	match = find_peer_device(op, peer, device->data);
	}
	if (!match) {
	return FALSE;
	}
	}
	}

	return TRUE;
	}

	/*!
	* \internal
	* \brief Parse action-specific device properties from XML
	*
	* \param[in] msg XML element containing the properties
	* \param[in] peer Name of peer that sent XML (for logs)
	* \param[in] device Device ID (for logs)
	* \param[in] action Action the properties relate to (for logs)
	* \param[in] phase Phase the properties relate to
	* \param[in,out] props Device properties to update
	*/
	static void
	parse_action_specific(xmlNode xml, const char peer, const char *device,
	const char action, remote_fencing_op_t op,
	enum st_remap_phase phase, device_properties_t *props)
	{
	props->custom_action_timeout[phase] = 0;
	crm_element_value_int(xml, F_STONITH_ACTION_TIMEOUT,
	&props->custom_action_timeout[phase]);
	if (props->custom_action_timeout[phase]) {
	crm_trace("Peer %s with device %s returned %s action timeout %d",
	peer, device, action, props->custom_action_timeout[phase]);
	}

	props->delay_max[phase] = 0;
	crm_element_value_int(xml, F_STONITH_DELAY_MAX, &props->delay_max[phase]);
	if (props->delay_max[phase]) {
	crm_trace("Peer %s with device %s returned maximum of random delay %d for %s",
	peer, device, props->delay_max[phase], action);
	}

	props->delay_base[phase] = 0;
	crm_element_value_int(xml, F_STONITH_DELAY_BASE, &props->delay_base[phase]);
	if (props->delay_base[phase]) {
	crm_trace("Peer %s with device %s returned base delay %d for %s",
	peer, device, props->delay_base[phase], action);
	}

	/* Handle devices with automatic unfencing */
	if (pcmk__str_eq(action, "on", pcmk__str_casei)) {
	int required = 0;

	crm_element_value_int(xml, F_STONITH_DEVICE_REQUIRED, &required);
	if (required) {
	crm_trace("Peer %s requires device %s to execute for action %s",
	peer, device, action);
	add_required_device(op, device);
	}
	}

	/* If a reboot is remapped to off+on, it's possible that a node is allowed
	* to perform one action but not another.
	*/
	if (crm_is_true(crm_element_value(xml, F_STONITH_ACTION_DISALLOWED))) {
	props->disallowed[phase] = TRUE;
	crm_trace("Peer %s is disallowed from executing %s for device %s",
	peer, action, device);
	}
	}

	/*!
	* \internal
	* \brief Parse one device's properties from peer's XML query reply
	*
	* \param[in] xml XML node containing device properties
	* \param[in,out] op Operation that query and reply relate to
	* \param[in,out] result Peer's results
	* \param[in] device ID of device being parsed
	*/
	static void
	add_device_properties(xmlNode xml, remote_fencing_op_t op,
	st_query_result_t result, const char device)
	{
	xmlNode *child;
	int verified = 0;
	device_properties_t *props = calloc(1, sizeof(device_properties_t));

	/* Add a new entry to this result's devices list */
	CRM_ASSERT(props != NULL);
	g_hash_table_insert(result->devices, strdup(device), props);

	/* Peers with verified (monitored) access will be preferred */
	crm_element_value_int(xml, F_STONITH_DEVICE_VERIFIED, &verified);
	if (verified) {
	crm_trace("Peer %s has confirmed a verified device %s",
	result->host, device);
	props->verified = TRUE;
	}

	/* Parse action-specific device properties */
	parse_action_specific(xml, result->host, device, op_requested_action(op),
	op, st_phase_requested, props);
	for (child = pcmk__xml_first_child(xml); child != NULL;
	child = pcmk__xml_next(child)) {
	/* Replies for "reboot" operations will include the action-specific
	* values for "off" and "on" in child elements, just in case the reboot
	* winds up getting remapped.
	*/
	if (pcmk__str_eq(ID(child), "off", pcmk__str_casei)) {
	parse_action_specific(child, result->host, device, "off",
	op, st_phase_off, props);
	} else if (pcmk__str_eq(ID(child), "on", pcmk__str_casei)) {
	parse_action_specific(child, result->host, device, "on",
	op, st_phase_on, props);
	}
	}
	}

	/*!
	* \internal
	* \brief Parse a peer's XML query reply and add it to operation's results
	*
	* \param[in,out] op Operation that query and reply relate to
	* \param[in] host Name of peer that sent this reply
	* \param[in] ndevices Number of devices expected in reply
	* \param[in] xml XML node containing device list
	*
	* \return Newly allocated result structure with parsed reply
	*/
	static st_query_result_t *
	add_result(remote_fencing_op_t op, const char host, int ndevices, xmlNode *xml)
	{
	st_query_result_t *result = calloc(1, sizeof(st_query_result_t));
	xmlNode *child;

	// cppcheck seems not to understand the abort logic in CRM_CHECK
	// cppcheck-suppress memleak
	CRM_CHECK(result != NULL, return NULL);
	result->host = strdup(host);
	result->devices = crm_str_table_new();

	/* Each child element describes one capable device available to the peer */
	for (child = pcmk__xml_first_child(xml); child != NULL;
	child = pcmk__xml_next(child)) {
	const char *device = ID(child);

	if (device) {
	add_device_properties(child, op, result, device);
	}
	}

	result->ndevices = g_hash_table_size(result->devices);
	CRM_CHECK(ndevices == result->ndevices,
	crm_err("Query claimed to have %d device%s but %d found",
	ndevices, pcmk__plural_s(ndevices), result->ndevices));

	op->query_results = g_list_insert_sorted(op->query_results, result, sort_peers);
	return result;
	}

	/*!
	* \internal
	* \brief Handle a peer's reply to our fencing query
	*
	* Parse a query result from XML and store it in the remote operation
	* table, and when enough replies have been received, issue a fencing request.
	*
	* \param[in] msg XML reply received
	*
	* \return pcmk_ok on success, -errno on error
	*
	* \note See initiate_remote_stonith_op() for how the XML query was initially
	* formed, and stonith_query() for how the peer formed its XML reply.
	*/
	int
	process_remote_stonith_query(xmlNode * msg)
	{
	int ndevices = 0;
	gboolean host_is_target = FALSE;
	gboolean have_all_replies = FALSE;
	const char *id = NULL;
	const char *host = NULL;
	remote_fencing_op_t *op = NULL;
	st_query_result_t *result = NULL;
	uint32_t replies_expected;
	xmlNode *dev = get_xpath_object("//@" F_STONITH_REMOTE_OP_ID, msg, LOG_ERR);

	CRM_CHECK(dev != NULL, return -EPROTO);

	id = crm_element_value(dev, F_STONITH_REMOTE_OP_ID);
	CRM_CHECK(id != NULL, return -EPROTO);

	dev = get_xpath_object("//@" F_STONITH_AVAILABLE_DEVICES, msg, LOG_ERR);
	CRM_CHECK(dev != NULL, return -EPROTO);
	crm_element_value_int(dev, F_STONITH_AVAILABLE_DEVICES, &ndevices);

	op = g_hash_table_lookup(stonith_remote_op_list, id);
	if (op == NULL) {
	crm_debug("Received query reply for unknown or expired operation %s",
	id);
	return -EOPNOTSUPP;
	}

	replies_expected = fencing_active_peers();
	if (op->replies_expected < replies_expected) {
	replies_expected = op->replies_expected;
	}
	if ((++op->replies >= replies_expected) && (op->state == st_query)) {
	have_all_replies = TRUE;
	}
	host = crm_element_value(msg, F_ORIG);
	host_is_target = pcmk__str_eq(host, op->target, pcmk__str_casei);

	crm_info("Query result %d of %d from %s for %s/%s (%d device%s) %s",
	op->replies, replies_expected, host,
	op->target, op->action, ndevices, pcmk__plural_s(ndevices), id);
	if (ndevices > 0) {
	result = add_result(op, host, ndevices, dev);
	}

	if (pcmk_is_set(op->call_options, st_opt_topology)) {
	/* If we start the fencing before all the topology results are in,
	* it is possible fencing levels will be skipped because of the missing
	* query results. */
	if (op->state == st_query && all_topology_devices_found(op)) {
	/* All the query results are in for the topology, start the fencing ops. */
	crm_trace("All topology devices found");
	call_remote_stonith(op, result, pcmk_ok);

	} else if (have_all_replies) {
	crm_info("All topology query replies have arrived, continuing (%d expected/%d received) ",
	replies_expected, op->replies);
	call_remote_stonith(op, NULL, pcmk_ok);
	}

	} else if (op->state == st_query) {
	int nverified = count_peer_devices(op, result, TRUE);

	/* We have a result for a non-topology fencing op that looks promising,
	* go ahead and start fencing before query timeout */
	if (result && (host_is_target == FALSE) && nverified) {
	/* we have a verified device living on a peer that is not the target */
	crm_trace("Found %d verified device%s",
	nverified, pcmk__plural_s(nverified));
	call_remote_stonith(op, result, pcmk_ok);

	} else if (have_all_replies) {
	crm_info("All query replies have arrived, continuing (%d expected/%d received) ",
	replies_expected, op->replies);
	call_remote_stonith(op, NULL, pcmk_ok);

	} else {
	crm_trace("Waiting for more peer results before launching fencing operation");
	}

	} else if (result && (op->state == st_done)) {
	crm_info("Discarding query result from %s (%d device%s): "
	"Operation is %s", result->host,
	result->ndevices, pcmk__plural_s(result->ndevices),
	stonith_op_state_str(op->state));
	}

	return pcmk_ok;
	}

	/*!
	* \internal
	* \brief Handle a peer's reply to a fencing request
	*
	* Parse a fencing reply from XML, and either finalize the operation
	* or attempt another device as appropriate.
	*
	* \param[in] msg XML reply received
	*
	* \return pcmk_ok on success, -errno on error
	*/
	int
	process_remote_stonith_exec(xmlNode * msg)
	{
	int rc = 0;
	const char *id = NULL;
	const char *device = NULL;
	remote_fencing_op_t *op = NULL;
	xmlNode *dev = get_xpath_object("//@" F_STONITH_REMOTE_OP_ID, msg, LOG_ERR);

	CRM_CHECK(dev != NULL, return -EPROTO);

	id = crm_element_value(dev, F_STONITH_REMOTE_OP_ID);
	CRM_CHECK(id != NULL, return -EPROTO);

	dev = get_xpath_object("//@" F_STONITH_RC, msg, LOG_ERR);
	CRM_CHECK(dev != NULL, return -EPROTO);

	crm_element_value_int(dev, F_STONITH_RC, &rc);

	device = crm_element_value(dev, F_STONITH_DEVICE);

	if (stonith_remote_op_list) {
	op = g_hash_table_lookup(stonith_remote_op_list, id);
	}

	if (op == NULL && rc == pcmk_ok) {
	/* Record successful fencing operations */
	const char *client_id = crm_element_value(dev, F_STONITH_CLIENTID);

	op = create_remote_stonith_op(client_id, dev, TRUE);
	}

	if (op == NULL) {
	/* Could be for an event that began before we started */
	/* TODO: Record the op for later querying */
	crm_info("Received peer result of unknown or expired operation %s", id);
	return -EOPNOTSUPP;
	}

	if (op->devices && device && !pcmk__str_eq(op->devices->data, device, pcmk__str_casei)) {
	crm_err("Received outdated reply for device %s (instead of %s) to "
	"fence (%s) %s. Operation already timed out at peer level.",
	device, (const char *) op->devices->data, op->action, op->target);
	return rc;
	}

	if (pcmk__str_eq(crm_element_value(msg, F_SUBTYPE), "broadcast", pcmk__str_casei)) {
	crm_debug("Finalizing action '%s' targeting %s on behalf of %s@%s: %s "
	CRM_XS " rc=%d id=%.8s",
	op->action, op->target, op->client_name, op->originator,
	pcmk_strerror(rc), rc, op->id);
	if (rc == pcmk_ok) {
	op->state = st_done;
	} else {
	op->state = st_failed;
	}
	remote_op_done(op, msg, rc, FALSE);
	return pcmk_ok;
	} else if (!pcmk__str_eq(op->originator, stonith_our_uname, pcmk__str_casei)) {
	/* If this isn't a remote level broadcast, and we are not the
	* originator of the operation, we should not be receiving this msg. */
	crm_err("Received non-broadcast fencing result for operation %.8s "
	"we do not own (device %s targeting %s)",
	op->id, device, op->target);
	return rc;
	}

	if (pcmk_is_set(op->call_options, st_opt_topology)) {
	const char *device = crm_element_value(msg, F_STONITH_DEVICE);

	crm_notice("Action '%s' targeting %s using %s on behalf of %s@%s: %s "
	CRM_XS " rc=%d",
	op->action, op->target, device, op->client_name,
	op->originator, pcmk_strerror(rc), rc);

	/* We own the op, and it is complete. broadcast the result to all nodes
	* and notify our local clients. */
	if (op->state == st_done) {
	remote_op_done(op, msg, rc, FALSE);
	return rc;
	}

	if ((op->phase == 2) && (rc != pcmk_ok)) {
	/* A remapped "on" failed, but the node was already turned off
	* successfully, so ignore the error and continue.
	*/
	crm_warn("Ignoring %s 'on' failure (exit code %d) targeting %s "
	"after successful 'off'", device, rc, op->target);
	rc = pcmk_ok;
	}

	if (rc == pcmk_ok) {
	/* An operation completed successfully. Try another device if
	* necessary, otherwise mark the operation as done. */
	advance_topology_device_in_level(op, device, msg, rc);
	return rc;
	} else {
	/* This device failed, time to try another topology level. If no other
	* levels are available, mark this operation as failed and report results. */
	if (advance_topology_level(op, false) != pcmk_rc_ok) {
	op->state = st_failed;
	remote_op_done(op, msg, rc, FALSE);
	return rc;
	}
	}
	} else if (rc == pcmk_ok && op->devices == NULL) {
	crm_trace("All done for %s", op->target);

	op->state = st_done;
	remote_op_done(op, msg, rc, FALSE);
	return rc;
	} else if (rc == -ETIME && op->devices == NULL) {
	/* If the operation timed out don't bother retrying other peers. */
	op->state = st_failed;
	remote_op_done(op, msg, rc, FALSE);
	return rc;
	} else {
	/* fall-through and attempt other fencing action using another peer */
	}

	/* Retry on failure */
	crm_trace("Next for %s on behalf of %s@%s (rc was %d)", op->target, op->originator,
	op->client_name, rc);
	call_remote_stonith(op, NULL, rc);
	return rc;
	}

	gboolean
	stonith_check_fence_tolerance(int tolerance, const char target, const char action)
	{
	GHashTableIter iter;
	time_t now = time(NULL);
	remote_fencing_op_t *rop = NULL;

	- crm_trace("tolerance=%d, stonith_remote_op_list=%p", tolerance,
	- stonith_remote_op_list);
	-
	if (tolerance <= 0 \|\| !stonith_remote_op_list \|\| target == NULL \|\|
	action == NULL) {
	return FALSE;
	}

	g_hash_table_iter_init(&iter, stonith_remote_op_list);
	while (g_hash_table_iter_next(&iter, NULL, (void **)&rop)) {
	if (strcmp(rop->target, target) != 0) {
	continue;
	} else if (rop->state != st_done) {
	continue;
	/* We don't have to worry about remapped reboots here
	* because if state is done, any remapping has been undone
	*/
	} else if (strcmp(rop->action, action) != 0) {
	continue;
	} else if ((rop->completed + tolerance) < now) {
	continue;
	}

	crm_notice("Target %s was fenced (%s) less than %ds ago by %s on behalf of %s",
	target, action, tolerance, rop->delegate, rop->originator);
	return TRUE;
	}
	return FALSE;
	}
	diff --git a/daemons/fenced/pacemaker-fenced.c b/daemons/fenced/pacemaker-fenced.c
	index 4a69ecb15f..932925b97c 100644
	--- a/daemons/fenced/pacemaker-fenced.c
	+++ b/daemons/fenced/pacemaker-fenced.c
	@@ -1,1547 +1,1547 @@
	/*
	* Copyright 2009-2020 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU General Public License version 2
	* or later (GPLv2+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <sys/param.h>
	#include <stdio.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <unistd.h>
	#include <sys/utsname.h>

	#include <stdlib.h>
	#include <errno.h>
	#include <fcntl.h>
	#include <inttypes.h> // PRIu32, PRIx32

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/ipc.h>
	#include <crm/common/ipc_internal.h>
	#include <crm/cluster/internal.h>

	#include <crm/stonith-ng.h>
	#include <crm/fencing/internal.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h>

	#include <crm/common/mainloop.h>

	#include <crm/cib/internal.h>
	#include <crm/pengine/status.h>
	#include <pacemaker-internal.h>

	#include <pacemaker-fenced.h>

	char *stonith_our_uname = NULL;
	char *stonith_our_uuid = NULL;
	long stonith_watchdog_timeout_ms = 0;

	static GMainLoop *mainloop = NULL;

	gboolean stand_alone = FALSE;
	static gboolean no_cib_connect = FALSE;
	static gboolean stonith_shutdown_flag = FALSE;

	static qb_ipcs_service_t *ipcs = NULL;
	static xmlNode *local_cib = NULL;
	static pe_working_set_t *fenced_data_set = NULL;

	static cib_t *cib_api = NULL;

	static void stonith_shutdown(int nsig);
	static void stonith_cleanup(void);

	static int32_t
	st_ipc_accept(qb_ipcs_connection_t * c, uid_t uid, gid_t gid)
	{
	if (stonith_shutdown_flag) {
	crm_info("Ignoring new client [%d] during shutdown",
	pcmk__client_pid(c));
	return -EPERM;
	}

	if (pcmk__new_client(c, uid, gid) == NULL) {
	return -EIO;
	}
	return 0;
	}

	/* Exit code means? */
	static int32_t
	st_ipc_dispatch(qb_ipcs_connection_t * qbc, void *data, size_t size)
	{
	uint32_t id = 0;
	uint32_t flags = 0;
	int call_options = 0;
	xmlNode *request = NULL;
	pcmk__client_t *c = pcmk__find_client(qbc);
	const char *op = NULL;

	if (c == NULL) {
	crm_info("Invalid client: %p", qbc);
	return 0;
	}

	request = pcmk__client_data2xml(c, data, &id, &flags);
	if (request == NULL) {
	pcmk__ipc_send_ack(c, id, flags, "nack", CRM_EX_PROTOCOL);
	return 0;
	}


	op = crm_element_value(request, F_CRM_TASK);
	if(pcmk__str_eq(op, CRM_OP_RM_NODE_CACHE, pcmk__str_casei)) {
	crm_xml_add(request, F_TYPE, T_STONITH_NG);
	crm_xml_add(request, F_STONITH_OPERATION, op);
	crm_xml_add(request, F_STONITH_CLIENTID, c->id);
	crm_xml_add(request, F_STONITH_CLIENTNAME, pcmk__client_name(c));
	crm_xml_add(request, F_STONITH_CLIENTNODE, stonith_our_uname);

	send_cluster_message(NULL, crm_msg_stonith_ng, request, FALSE);
	free_xml(request);
	return 0;
	}

	if (c->name == NULL) {
	const char *value = crm_element_value(request, F_STONITH_CLIENTNAME);

	if (value == NULL) {
	value = "unknown";
	}
	c->name = crm_strdup_printf("%s.%u", value, c->pid);
	}

	crm_element_value_int(request, F_STONITH_CALLOPTS, &call_options);
	crm_trace("Flags 0x%08" PRIx32 "/0x%08x for command %" PRIu32
	" from client %s", flags, call_options, id, pcmk__client_name(c));

	if (pcmk_is_set(call_options, st_opt_sync_call)) {
	CRM_ASSERT(flags & crm_ipc_client_response);
	CRM_LOG_ASSERT(c->request_id == 0); /* This means the client has two synchronous events in-flight */
	c->request_id = id; /* Reply only to the last one */
	}

	crm_xml_add(request, F_STONITH_CLIENTID, c->id);
	crm_xml_add(request, F_STONITH_CLIENTNAME, pcmk__client_name(c));
	crm_xml_add(request, F_STONITH_CLIENTNODE, stonith_our_uname);

	stonith_command(c, id, flags, request, NULL);

	free_xml(request);
	return 0;
	}

	/* Error code means? */
	static int32_t
	st_ipc_closed(qb_ipcs_connection_t * c)
	{
	pcmk__client_t *client = pcmk__find_client(c);

	if (client == NULL) {
	return 0;
	}

	crm_trace("Connection %p closed", c);
	pcmk__free_client(client);

	/* 0 means: yes, go ahead and destroy the connection */
	return 0;
	}

	static void
	st_ipc_destroy(qb_ipcs_connection_t * c)
	{
	crm_trace("Connection %p destroyed", c);
	st_ipc_closed(c);
	}

	static void
	stonith_peer_callback(xmlNode * msg, void *private_data)
	{
	const char *remote_peer = crm_element_value(msg, F_ORIG);
	const char *op = crm_element_value(msg, F_STONITH_OPERATION);

	if (pcmk__str_eq(op, "poke", pcmk__str_none)) {
	return;
	}

	crm_log_xml_trace(msg, "Peer[inbound]");
	stonith_command(NULL, 0, 0, msg, remote_peer);
	}

	#if SUPPORT_COROSYNC
	static void
	stonith_peer_ais_callback(cpg_handle_t handle,
	const struct cpg_name *groupName,
	uint32_t nodeid, uint32_t pid, void *msg, size_t msg_len)
	{
	uint32_t kind = 0;
	xmlNode *xml = NULL;
	const char *from = NULL;
	char *data = pcmk_message_common_cs(handle, nodeid, pid, msg, &kind, &from);

	if(data == NULL) {
	return;
	}
	if (kind == crm_class_cluster) {
	xml = string2xml(data);
	if (xml == NULL) {
	crm_err("Invalid XML: '%.120s'", data);
	free(data);
	return;
	}
	crm_xml_add(xml, F_ORIG, from);
	/* crm_xml_add_int(xml, F_SEQ, wrapper->id); */
	stonith_peer_callback(xml, NULL);
	}

	free_xml(xml);
	free(data);
	return;
	}

	static void
	stonith_peer_cs_destroy(gpointer user_data)
	{
	crm_crit("Lost connection to cluster layer, shutting down");
	stonith_shutdown(0);
	}
	#endif

	void
	do_local_reply(xmlNode * notify_src, const char *client_id, gboolean sync_reply, gboolean from_peer)
	{
	/* send callback to originating child */
	pcmk__client_t *client_obj = NULL;
	int local_rc = pcmk_rc_ok;

	crm_trace("Sending response");
	client_obj = pcmk__find_client_by_id(client_id);

	crm_trace("Sending callback to request originator");
	if (client_obj == NULL) {
	local_rc = EPROTO;
	crm_trace("No client to sent the response to. F_STONITH_CLIENTID not set.");

	} else {
	int rid = 0;

	if (sync_reply) {
	CRM_LOG_ASSERT(client_obj->request_id);

	rid = client_obj->request_id;
	client_obj->request_id = 0;

	crm_trace("Sending response %d to client %s%s",
	rid, pcmk__client_name(client_obj),
	(from_peer? " (originator of delegated request)" : ""));

	} else {
	crm_trace("Sending an event to client %s%s",
	pcmk__client_name(client_obj),
	(from_peer? " (originator of delegated request)" : ""));
	}

	local_rc = pcmk__ipc_send_xml(client_obj, rid, notify_src,
	(sync_reply? crm_ipc_flags_none
	: crm_ipc_server_event));
	}

	if ((local_rc != pcmk_rc_ok) && (client_obj != NULL)) {
	crm_warn("%s reply to client %s failed: %s",
	(sync_reply? "Synchronous" : "Asynchronous"),
	pcmk__client_name(client_obj), pcmk_rc_str(local_rc));
	}
	}

	uint64_t
	get_stonith_flag(const char *name)
	{
	if (pcmk__str_eq(name, T_STONITH_NOTIFY_FENCE, pcmk__str_casei)) {
	return st_callback_notify_fence;

	} else if (pcmk__str_eq(name, STONITH_OP_DEVICE_ADD, pcmk__str_casei)) {
	return st_callback_device_add;

	} else if (pcmk__str_eq(name, STONITH_OP_DEVICE_DEL, pcmk__str_casei)) {
	return st_callback_device_del;

	} else if (pcmk__str_eq(name, T_STONITH_NOTIFY_HISTORY, pcmk__str_casei)) {
	return st_callback_notify_history;

	} else if (pcmk__str_eq(name, T_STONITH_NOTIFY_HISTORY_SYNCED, pcmk__str_casei)) {
	return st_callback_notify_history_synced;

	}
	return st_callback_unknown;
	}

	static void
	stonith_notify_client(gpointer key, gpointer value, gpointer user_data)
	{

	xmlNode *update_msg = user_data;
	pcmk__client_t *client = value;
	const char *type = NULL;

	CRM_CHECK(client != NULL, return);
	CRM_CHECK(update_msg != NULL, return);

	type = crm_element_value(update_msg, F_SUBTYPE);
	CRM_CHECK(type != NULL, crm_log_xml_err(update_msg, "notify"); return);

	if (client->ipcs == NULL) {
	crm_trace("Skipping client with NULL channel");
	return;
	}

	if (pcmk_is_set(client->flags, get_stonith_flag(type))) {
	int rc = pcmk__ipc_send_xml(client, 0, update_msg,
	crm_ipc_server_event\|crm_ipc_server_error);

	if (rc != pcmk_rc_ok) {
	crm_warn("%s notification of client %s failed: %s "
	CRM_XS " id=%.8s rc=%d", type, pcmk__client_name(client),
	pcmk_rc_str(rc), client->id, rc);
	} else {
	crm_trace("Sent %s notification to client %s",
	type, pcmk__client_name(client));
	}
	}
	}

	void
	do_stonith_async_timeout_update(const char client_id, const char call_id, int timeout)
	{
	pcmk__client_t *client = NULL;
	xmlNode *notify_data = NULL;

	if (!timeout \|\| !call_id \|\| !client_id) {
	return;
	}

	client = pcmk__find_client_by_id(client_id);
	if (!client) {
	return;
	}

	notify_data = create_xml_node(NULL, T_STONITH_TIMEOUT_VALUE);
	crm_xml_add(notify_data, F_TYPE, T_STONITH_TIMEOUT_VALUE);
	crm_xml_add(notify_data, F_STONITH_CALLID, call_id);
	crm_xml_add_int(notify_data, F_STONITH_TIMEOUT, timeout);

	crm_trace("timeout update is %d for client %s and call id %s", timeout, client_id, call_id);

	if (client) {
	pcmk__ipc_send_xml(client, 0, notify_data, crm_ipc_server_event);
	}

	free_xml(notify_data);
	}

	void
	do_stonith_notify(int options, const char type, int result, xmlNode data)
	{
	/* TODO: Standardize the contents of data */
	xmlNode *update_msg = create_xml_node(NULL, "notify");

	CRM_CHECK(type != NULL,;);

	crm_xml_add(update_msg, F_TYPE, T_STONITH_NOTIFY);
	crm_xml_add(update_msg, F_SUBTYPE, type);
	crm_xml_add(update_msg, F_STONITH_OPERATION, type);
	crm_xml_add_int(update_msg, F_STONITH_RC, result);

	if (data != NULL) {
	add_message_xml(update_msg, F_STONITH_CALLDATA, data);
	}

	crm_trace("Notifying clients");
	pcmk__foreach_ipc_client(stonith_notify_client, update_msg);
	free_xml(update_msg);
	crm_trace("Notify complete");
	}

	static void
	do_stonith_notify_config(int options, const char *op, int rc,
	const char *desc, int active)
	{
	xmlNode *notify_data = create_xml_node(NULL, op);

	CRM_CHECK(notify_data != NULL, return);

	crm_xml_add(notify_data, F_STONITH_DEVICE, desc);
	crm_xml_add_int(notify_data, F_STONITH_ACTIVE, active);

	do_stonith_notify(options, op, rc, notify_data);
	free_xml(notify_data);
	}

	void
	do_stonith_notify_device(int options, const char op, int rc, const char desc)
	{
	do_stonith_notify_config(options, op, rc, desc, g_hash_table_size(device_list));
	}

	void
	do_stonith_notify_level(int options, const char op, int rc, const char desc)
	{
	do_stonith_notify_config(options, op, rc, desc, g_hash_table_size(topology));
	}

	static void
	topology_remove_helper(const char *node, int level)
	{
	int rc;
	char *desc = NULL;
	xmlNode *data = create_xml_node(NULL, XML_TAG_FENCING_LEVEL);

	crm_xml_add(data, F_STONITH_ORIGIN, __func__);
	crm_xml_add_int(data, XML_ATTR_STONITH_INDEX, level);
	crm_xml_add(data, XML_ATTR_STONITH_TARGET, node);

	rc = stonith_level_remove(data, &desc);
	do_stonith_notify_level(0, STONITH_OP_LEVEL_DEL, rc, desc);

	free_xml(data);
	free(desc);
	}

	static void
	remove_cib_device(xmlXPathObjectPtr xpathObj)
	{
	int max = numXpathResults(xpathObj), lpc = 0;

	for (lpc = 0; lpc < max; lpc++) {
	const char *rsc_id = NULL;
	const char *standard = NULL;
	xmlNode *match = getXpathResult(xpathObj, lpc);

	CRM_LOG_ASSERT(match != NULL);
	if(match != NULL) {
	standard = crm_element_value(match, XML_AGENT_ATTR_CLASS);
	}

	if (!pcmk__str_eq(standard, PCMK_RESOURCE_CLASS_STONITH, pcmk__str_casei)) {
	continue;
	}

	rsc_id = crm_element_value(match, XML_ATTR_ID);

	stonith_device_remove(rsc_id, TRUE);
	}
	}

	static void
	handle_topology_change(xmlNode *match, bool remove)
	{
	int rc;
	char *desc = NULL;

	CRM_CHECK(match != NULL, return);
	crm_trace("Updating %s", ID(match));

	if(remove) {
	int index = 0;
	char *key = stonith_level_key(match, -1);

	crm_element_value_int(match, XML_ATTR_STONITH_INDEX, &index);
	topology_remove_helper(key, index);
	free(key);
	}

	rc = stonith_level_register(match, &desc);
	do_stonith_notify_level(0, STONITH_OP_LEVEL_ADD, rc, desc);

	free(desc);
	}

	static void
	remove_fencing_topology(xmlXPathObjectPtr xpathObj)
	{
	int max = numXpathResults(xpathObj), lpc = 0;

	for (lpc = 0; lpc < max; lpc++) {
	xmlNode *match = getXpathResult(xpathObj, lpc);

	CRM_LOG_ASSERT(match != NULL);
	if (match && crm_element_value(match, XML_DIFF_MARKER)) {
	/* Deletion */
	int index = 0;
	char *target = stonith_level_key(match, -1);

	crm_element_value_int(match, XML_ATTR_STONITH_INDEX, &index);
	if (target == NULL) {
	crm_err("Invalid fencing target in element %s", ID(match));

	} else if (index <= 0) {
	crm_err("Invalid level for %s in element %s", target, ID(match));

	} else {
	topology_remove_helper(target, index);
	}
	/* } else { Deal with modifications during the 'addition' stage */
	}
	}
	}

	static void
	register_fencing_topology(xmlXPathObjectPtr xpathObj)
	{
	int max = numXpathResults(xpathObj), lpc = 0;

	for (lpc = 0; lpc < max; lpc++) {
	xmlNode *match = getXpathResult(xpathObj, lpc);

	handle_topology_change(match, TRUE);
	}
	}

	/* Fencing
	<diff crm_feature_set="3.0.6">
	<diff-removed>
	<fencing-topology>
	<fencing-level id="f-p1.1" target="pcmk-1" index="1" devices="poison-pill" __crm_diff_marker__="removed:top"/>
	<fencing-level id="f-p1.2" target="pcmk-1" index="2" devices="power" __crm_diff_marker__="removed:top"/>
	<fencing-level devices="disk,network" id="f-p2.1"/>
	</fencing-topology>
	</diff-removed>
	<diff-added>
	<fencing-topology>
	<fencing-level id="f-p.1" target="pcmk-1" index="1" devices="poison-pill" __crm_diff_marker__="added:top"/>
	<fencing-level id="f-p2.1" target="pcmk-2" index="1" devices="disk,something"/>
	<fencing-level id="f-p3.1" target="pcmk-2" index="2" devices="power" __crm_diff_marker__="added:top"/>
	</fencing-topology>
	</diff-added>
	</diff>
	*/

	static void
	fencing_topology_init(void)
	{
	xmlXPathObjectPtr xpathObj = NULL;
	const char *xpath = "//" XML_TAG_FENCING_LEVEL;

	crm_trace("Full topology refresh");
	free_topology_list();
	init_topology_list();

	/* Grab everything */
	xpathObj = xpath_search(local_cib, xpath);
	register_fencing_topology(xpathObj);

	freeXpathObject(xpathObj);
	}

	#define rsc_name(x) x->clone_name?x->clone_name:x->id

	/*!
	* \internal
	* \brief Check whether our uname is in a resource's allowed node list
	*
	* \param[in] rsc Resource to check
	*
	* \return Pointer to node object if found, NULL otherwise
	*/
	static pe_node_t *
	our_node_allowed_for(pe_resource_t *rsc)
	{
	GHashTableIter iter;
	pe_node_t *node = NULL;

	if (rsc && stonith_our_uname) {
	g_hash_table_iter_init(&iter, rsc->allowed_nodes);
	while (g_hash_table_iter_next(&iter, NULL, (void **)&node)) {
	if (node && strcmp(node->details->uname, stonith_our_uname) == 0) {
	break;
	}
	node = NULL;
	}
	}
	return node;
	}

	/*!
	* \internal
	* \brief If a resource or any of its children are STONITH devices, update their
	* definitions given a cluster working set.
	*
	* \param[in] rsc Resource to check
	* \param[in] data_set Cluster working set with device information
	*/
	static void cib_device_update(pe_resource_t rsc, pe_working_set_t data_set)
	{
	pe_node_t *node = NULL;
	const char *value = NULL;
	const char *rclass = NULL;
	pe_node_t *parent = NULL;
	gboolean remove = TRUE;

	/* If this is a complex resource, check children rather than this resource itself.
	* TODO: Mark each installed device and remove if untouched when this process finishes.
	*/
	if(rsc->children) {
	GListPtr gIter = NULL;
	for (gIter = rsc->children; gIter != NULL; gIter = gIter->next) {
	cib_device_update(gIter->data, data_set);
	if(pe_rsc_is_clone(rsc)) {
	crm_trace("Only processing one copy of the clone %s", rsc->id);
	break;
	}
	}
	return;
	}

	/* We only care about STONITH resources. */
	rclass = crm_element_value(rsc->xml, XML_AGENT_ATTR_CLASS);
	if (!pcmk__str_eq(rclass, PCMK_RESOURCE_CLASS_STONITH, pcmk__str_casei)) {
	return;
	}

	/* If this STONITH resource is disabled, just remove it. */
	if (pe__resource_is_disabled(rsc)) {
	crm_info("Device %s has been disabled", rsc->id);
	goto update_done;
	}

	/* Check whether our node is allowed for this resource (and its parent if in a group) */
	node = our_node_allowed_for(rsc);
	if (rsc->parent && (rsc->parent->variant == pe_group)) {
	parent = our_node_allowed_for(rsc->parent);
	}

	if(node == NULL) {
	/* Our node is disallowed, so remove the device */
	GHashTableIter iter;

	crm_info("Device %s has been disabled on %s: unknown", rsc->id, stonith_our_uname);
	g_hash_table_iter_init(&iter, rsc->allowed_nodes);
	while (g_hash_table_iter_next(&iter, NULL, (void **)&node)) {
	crm_trace("Available: %s = %d", node->details->uname, node->weight);
	}

	goto update_done;

	} else if(node->weight < 0 \|\| (parent && parent->weight < 0)) {
	/* Our node (or its group) is disallowed by score, so remove the device */
	char *score = score2char((node->weight < 0) ? node->weight : parent->weight);

	crm_info("Device %s has been disabled on %s: score=%s", rsc->id, stonith_our_uname, score);
	free(score);

	goto update_done;

	} else {
	/* Our node is allowed, so update the device information */
	int rc;
	xmlNode *data;
	GHashTableIter gIter;
	stonith_key_value_t *params = NULL;

	const char *name = NULL;
	const char *agent = crm_element_value(rsc->xml, XML_EXPR_ATTR_TYPE);
	const char *rsc_provides = NULL;

	crm_debug("Device %s is allowed on %s: score=%d", rsc->id, stonith_our_uname, node->weight);
	get_rsc_attributes(rsc->parameters, rsc, node, data_set);
	get_meta_attributes(rsc->meta, rsc, node, data_set);

	rsc_provides = g_hash_table_lookup(rsc->meta, PCMK_STONITH_PROVIDES);

	g_hash_table_iter_init(&gIter, rsc->parameters);
	while (g_hash_table_iter_next(&gIter, (gpointer ) & name, (gpointer ) & value)) {
	if (!name \|\| !value) {
	continue;
	}
	params = stonith_key_value_add(params, name, value);
	crm_trace(" %s=%s", name, value);
	}

	remove = FALSE;
	data = create_device_registration_xml(rsc_name(rsc), st_namespace_any,
	agent, params, rsc_provides);
	stonith_key_value_freeall(params, 1, 1);
	rc = stonith_device_register(data, NULL, TRUE);
	CRM_ASSERT(rc == pcmk_ok);
	free_xml(data);
	}

	update_done:

	if(remove && g_hash_table_lookup(device_list, rsc_name(rsc))) {
	stonith_device_remove(rsc_name(rsc), TRUE);
	}
	}

	/*!
	* \internal
	* \brief Update all STONITH device definitions based on current CIB
	*/
	static void
	cib_devices_update(void)
	{
	GListPtr gIter = NULL;

	crm_info("Updating devices to version %s.%s.%s",
	crm_element_value(local_cib, XML_ATTR_GENERATION_ADMIN),
	crm_element_value(local_cib, XML_ATTR_GENERATION),
	crm_element_value(local_cib, XML_ATTR_NUMUPDATES));

	CRM_ASSERT(fenced_data_set != NULL);
	fenced_data_set->input = local_cib;
	fenced_data_set->now = crm_time_new(NULL);
	fenced_data_set->localhost = stonith_our_uname;
	pe__set_working_set_flags(fenced_data_set, pe_flag_quick_location);

	cluster_status(fenced_data_set);
	pcmk__schedule_actions(fenced_data_set, NULL, NULL);

	for (gIter = fenced_data_set->resources; gIter != NULL; gIter = gIter->next) {
	cib_device_update(gIter->data, fenced_data_set);
	}
	fenced_data_set->input = NULL; // Wasn't a copy, so don't let API free it
	pe_reset_working_set(fenced_data_set);
	}

	static void
	update_cib_stonith_devices_v2(const char event, xmlNode msg)
	{
	xmlNode *change = NULL;
	char *reason = NULL;
	bool needs_update = FALSE;
	xmlNode *patchset = get_message_xml(msg, F_CIB_UPDATE_RESULT);

	for (change = pcmk__xml_first_child(patchset); change != NULL;
	change = pcmk__xml_next(change)) {
	const char *op = crm_element_value(change, XML_DIFF_OP);
	const char *xpath = crm_element_value(change, XML_DIFF_PATH);
	const char *shortpath = NULL;

	if ((op == NULL) \|\|
	(strcmp(op, "move") == 0) \|\|
	strstr(xpath, "/"XML_CIB_TAG_STATUS)) {
	continue;
	} else if (pcmk__str_eq(op, "delete", pcmk__str_casei) && strstr(xpath, "/"XML_CIB_TAG_RESOURCE)) {
	const char *rsc_id = NULL;
	char *search = NULL;
	char *mutable = NULL;

	if (strstr(xpath, XML_TAG_ATTR_SETS) \|\|
	strstr(xpath, XML_TAG_META_SETS)) {
	needs_update = TRUE;
	reason = strdup("(meta) attribute deleted from resource");
	break;
	}
	mutable = strdup(xpath);
	rsc_id = strstr(mutable, "primitive[@id=\'");
	if (rsc_id != NULL) {
	rsc_id += strlen("primitive[@id=\'");
	search = strchr(rsc_id, '\'');
	}
	if (search != NULL) {
	*search = 0;
	stonith_device_remove(rsc_id, TRUE);
	} else {
	crm_warn("Ignoring malformed CIB update (resource deletion)");
	}
	free(mutable);

	} else if (strstr(xpath, "/"XML_CIB_TAG_RESOURCES) \|\|
	strstr(xpath, "/"XML_CIB_TAG_CONSTRAINTS) \|\|
	strstr(xpath, "/"XML_CIB_TAG_RSCCONFIG)) {
	shortpath = strrchr(xpath, '/'); CRM_ASSERT(shortpath);
	reason = crm_strdup_printf("%s %s", op, shortpath+1);
	needs_update = TRUE;
	break;
	}
	}

	if(needs_update) {
	- crm_info("Updating device list from the cib: %s", reason);
	+ crm_info("Updating device list from CIB: %s", reason);
	cib_devices_update();
	} else {
	- crm_trace("No updates for device list found in cib");
	+ crm_trace("No updates for device list found in CIB");
	}
	free(reason);
	}


	static void
	update_cib_stonith_devices_v1(const char event, xmlNode msg)
	{
	const char *reason = "none";
	gboolean needs_update = FALSE;
	xmlXPathObjectPtr xpath_obj = NULL;

	/* process new constraints */
	xpath_obj = xpath_search(msg, "//" F_CIB_UPDATE_RESULT "//" XML_CONS_TAG_RSC_LOCATION);
	if (numXpathResults(xpath_obj) > 0) {
	int max = numXpathResults(xpath_obj), lpc = 0;

	/* Safest and simplest to always recompute */
	needs_update = TRUE;
	reason = "new location constraint";

	for (lpc = 0; lpc < max; lpc++) {
	xmlNode *match = getXpathResult(xpath_obj, lpc);

	crm_log_xml_trace(match, "new constraint");
	}
	}
	freeXpathObject(xpath_obj);

	/* process deletions */
	xpath_obj = xpath_search(msg, "//" F_CIB_UPDATE_RESULT "//" XML_TAG_DIFF_REMOVED "//" XML_CIB_TAG_RESOURCE);
	if (numXpathResults(xpath_obj) > 0) {
	remove_cib_device(xpath_obj);
	}
	freeXpathObject(xpath_obj);

	/* process additions */
	xpath_obj = xpath_search(msg, "//" F_CIB_UPDATE_RESULT "//" XML_TAG_DIFF_ADDED "//" XML_CIB_TAG_RESOURCE);
	if (numXpathResults(xpath_obj) > 0) {
	int max = numXpathResults(xpath_obj), lpc = 0;

	for (lpc = 0; lpc < max; lpc++) {
	const char *rsc_id = NULL;
	const char *standard = NULL;
	xmlNode *match = getXpathResult(xpath_obj, lpc);

	rsc_id = crm_element_value(match, XML_ATTR_ID);
	standard = crm_element_value(match, XML_AGENT_ATTR_CLASS);

	if (!pcmk__str_eq(standard, PCMK_RESOURCE_CLASS_STONITH, pcmk__str_casei)) {
	continue;
	}

	crm_trace("Fencing resource %s was added or modified", rsc_id);
	reason = "new resource";
	needs_update = TRUE;
	}
	}
	freeXpathObject(xpath_obj);

	if(needs_update) {
	- crm_info("Updating device list from the cib: %s", reason);
	+ crm_info("Updating device list from CIB: %s", reason);
	cib_devices_update();
	}
	}

	static void
	update_cib_stonith_devices(const char event, xmlNode msg)
	{
	int format = 1;
	xmlNode *patchset = get_message_xml(msg, F_CIB_UPDATE_RESULT);

	CRM_ASSERT(patchset);
	crm_element_value_int(patchset, "format", &format);
	switch(format) {
	case 1:
	update_cib_stonith_devices_v1(event, msg);
	break;
	case 2:
	update_cib_stonith_devices_v2(event, msg);
	break;
	default:
	crm_warn("Unknown patch format: %d", format);
	}
	}

	/* Needs to hold node name + attribute name + attribute value + 75 */
	#define XPATH_MAX 512

	/*!
	* \internal
	* \brief Check whether a node has a specific attribute name/value
	*
	* \param[in] node Name of node to check
	* \param[in] name Name of an attribute to look for
	* \param[in] value The value the named attribute needs to be set to in order to be considered a match
	*
	* \return TRUE if the locally cached CIB has the specified node attribute
	*/
	gboolean
	node_has_attr(const char node, const char name, const char *value)
	{
	char xpath[XPATH_MAX];
	xmlNode *match;
	int n;

	CRM_CHECK(local_cib != NULL, return FALSE);

	/* Search for the node's attributes in the CIB. While the schema allows
	* multiple sets of instance attributes, and allows instance attributes to
	* use id-ref to reference values elsewhere, that is intended for resources,
	* so we ignore that here.
	*/
	n = snprintf(xpath, XPATH_MAX, "//" XML_CIB_TAG_NODES
	"/" XML_CIB_TAG_NODE "[@uname='%s']/" XML_TAG_ATTR_SETS
	"/" XML_CIB_TAG_NVPAIR "[@name='%s' and @value='%s']",
	node, name, value);
	match = get_xpath_object(xpath, local_cib, LOG_NEVER);

	CRM_CHECK(n < XPATH_MAX, return FALSE);
	return (match != NULL);
	}

	static void
	update_fencing_topology(const char event, xmlNode msg)
	{
	int format = 1;
	const char *xpath;
	xmlXPathObjectPtr xpathObj = NULL;
	xmlNode *patchset = get_message_xml(msg, F_CIB_UPDATE_RESULT);

	CRM_ASSERT(patchset);
	crm_element_value_int(patchset, "format", &format);

	if(format == 1) {
	/* Process deletions (only) */
	xpath = "//" F_CIB_UPDATE_RESULT "//" XML_TAG_DIFF_REMOVED "//" XML_TAG_FENCING_LEVEL;
	xpathObj = xpath_search(msg, xpath);

	remove_fencing_topology(xpathObj);
	freeXpathObject(xpathObj);

	/* Process additions and changes */
	xpath = "//" F_CIB_UPDATE_RESULT "//" XML_TAG_DIFF_ADDED "//" XML_TAG_FENCING_LEVEL;
	xpathObj = xpath_search(msg, xpath);

	register_fencing_topology(xpathObj);
	freeXpathObject(xpathObj);

	} else if(format == 2) {
	xmlNode *change = NULL;
	int add[] = { 0, 0, 0 };
	int del[] = { 0, 0, 0 };

	xml_patch_versions(patchset, add, del);

	for (change = pcmk__xml_first_child(patchset); change != NULL;
	change = pcmk__xml_next(change)) {
	const char *op = crm_element_value(change, XML_DIFF_OP);
	const char *xpath = crm_element_value(change, XML_DIFF_PATH);

	if(op == NULL) {
	continue;

	} else if(strstr(xpath, "/" XML_TAG_FENCING_LEVEL) != NULL) {
	/* Change to a specific entry */

	crm_trace("Handling %s operation %d.%d.%d for %s", op, add[0], add[1], add[2], xpath);
	if(strcmp(op, "move") == 0) {
	continue;

	} else if(strcmp(op, "create") == 0) {
	handle_topology_change(change->children, FALSE);

	} else if(strcmp(op, "modify") == 0) {
	xmlNode *match = first_named_child(change, XML_DIFF_RESULT);

	if(match) {
	handle_topology_change(match->children, TRUE);
	}

	} else if(strcmp(op, "delete") == 0) {
	/* Nuclear option, all we have is the path and an id... not enough to remove a specific entry */
	crm_info("Re-initializing fencing topology after %s operation %d.%d.%d for %s",
	op, add[0], add[1], add[2], xpath);
	fencing_topology_init();
	return;
	}

	} else if (strstr(xpath, "/" XML_TAG_FENCING_TOPOLOGY) != NULL) {
	/* Change to the topology in general */
	crm_info("Re-initializing fencing topology after top-level %s operation %d.%d.%d for %s",
	op, add[0], add[1], add[2], xpath);
	fencing_topology_init();
	return;

	} else if (strstr(xpath, "/" XML_CIB_TAG_CONFIGURATION)) {
	/* Changes to the whole config section, possibly including the topology as a whild */
	if(first_named_child(change, XML_TAG_FENCING_TOPOLOGY) == NULL) {
	crm_trace("Nothing for us in %s operation %d.%d.%d for %s.",
	op, add[0], add[1], add[2], xpath);

	} else if(strcmp(op, "delete") == 0 \|\| strcmp(op, "create") == 0) {
	crm_info("Re-initializing fencing topology after top-level %s operation %d.%d.%d for %s.",
	op, add[0], add[1], add[2], xpath);
	fencing_topology_init();
	return;
	}

	} else {
	crm_trace("Nothing for us in %s operation %d.%d.%d for %s",
	op, add[0], add[1], add[2], xpath);
	}
	}

	} else {
	crm_warn("Unknown patch format: %d", format);
	}
	}
	static bool have_cib_devices = FALSE;

	static void
	update_cib_cache_cb(const char event, xmlNode msg)
	{
	int rc = pcmk_ok;
	xmlNode *stonith_enabled_xml = NULL;
	xmlNode *stonith_watchdog_xml = NULL;
	const char *stonith_enabled_s = NULL;
	static gboolean stonith_enabled_saved = TRUE;

	if(!have_cib_devices) {
	crm_trace("Skipping updates until we get a full dump");
	return;

	} else if(msg == NULL) {
	crm_trace("Missing %s update", event);
	return;
	}

	/* Maintain a local copy of the CIB so that we have full access
	* to device definitions, location constraints, and node attributes
	*/
	if (local_cib != NULL) {
	int rc = pcmk_ok;
	xmlNode *patchset = NULL;

	crm_element_value_int(msg, F_CIB_RC, &rc);
	if (rc != pcmk_ok) {
	return;
	}

	patchset = get_message_xml(msg, F_CIB_UPDATE_RESULT);
	xml_log_patchset(LOG_TRACE, "Config update", patchset);
	rc = xml_apply_patchset(local_cib, patchset, TRUE);
	switch (rc) {
	case pcmk_ok:
	case -pcmk_err_old_data:
	break;
	case -pcmk_err_diff_resync:
	case -pcmk_err_diff_failed:
	crm_notice("[%s] Patch aborted: %s (%d)", event, pcmk_strerror(rc), rc);
	free_xml(local_cib);
	local_cib = NULL;
	break;
	default:
	crm_warn("[%s] ABORTED: %s (%d)", event, pcmk_strerror(rc), rc);
	free_xml(local_cib);
	local_cib = NULL;
	}
	}

	if (local_cib == NULL) {
	- crm_trace("Re-requesting the full cib");
	+ crm_trace("Re-requesting full CIB");
	rc = cib_api->cmds->query(cib_api, NULL, &local_cib, cib_scope_local \| cib_sync_call);
	if(rc != pcmk_ok) {
	crm_err("Couldn't retrieve the CIB: %s (%d)", pcmk_strerror(rc), rc);
	return;
	}
	CRM_ASSERT(local_cib != NULL);
	stonith_enabled_saved = FALSE; /* Trigger a full refresh below */
	}

	crm_peer_caches_refresh(local_cib);

	stonith_enabled_xml = get_xpath_object("//nvpair[@name='stonith-enabled']",
	local_cib, LOG_NEVER);
	if (stonith_enabled_xml) {
	stonith_enabled_s = crm_element_value(stonith_enabled_xml, XML_NVPAIR_ATTR_VALUE);
	}

	if (stonith_enabled_s == NULL \|\| crm_is_true(stonith_enabled_s)) {
	long timeout_ms = 0;
	const char *value = NULL;

	stonith_watchdog_xml = get_xpath_object("//nvpair[@name='stonith-watchdog-timeout']",
	local_cib, LOG_NEVER);
	if (stonith_watchdog_xml) {
	value = crm_element_value(stonith_watchdog_xml, XML_NVPAIR_ATTR_VALUE);
	}

	if(value) {
	timeout_ms = crm_get_msec(value);
	}
	if (timeout_ms < 0) {
	timeout_ms = pcmk__auto_watchdog_timeout();
	}

	if(timeout_ms != stonith_watchdog_timeout_ms) {
	crm_notice("New watchdog timeout %lds (was %lds)", timeout_ms/1000, stonith_watchdog_timeout_ms/1000);
	stonith_watchdog_timeout_ms = timeout_ms;
	}

	} else {
	stonith_watchdog_timeout_ms = 0;
	}

	if (stonith_enabled_s && crm_is_true(stonith_enabled_s) == FALSE) {
	crm_trace("Ignoring CIB updates while fencing is disabled");
	stonith_enabled_saved = FALSE;
	return;

	} else if (stonith_enabled_saved == FALSE) {
	crm_info("Updating fencing device and topology lists "
	"now that fencing is enabled");
	stonith_enabled_saved = TRUE;
	fencing_topology_init();
	cib_devices_update();

	} else {
	update_fencing_topology(event, msg);
	update_cib_stonith_devices(event, msg);
	}
	}

	static void
	init_cib_cache_cb(xmlNode * msg, int call_id, int rc, xmlNode * output, void *user_data)
	{
	- crm_info("Updating device list from the cib: init");
	+ crm_info("Updating device list from CIB");
	have_cib_devices = TRUE;
	local_cib = copy_xml(output);

	crm_peer_caches_refresh(local_cib);

	fencing_topology_init();
	cib_devices_update();
	}

	static void
	stonith_shutdown(int nsig)
	{
	crm_info("Terminating with %d clients", pcmk__ipc_client_count());
	stonith_shutdown_flag = TRUE;
	if (mainloop != NULL && g_main_loop_is_running(mainloop)) {
	g_main_loop_quit(mainloop);
	} else {
	stonith_cleanup();
	crm_exit(CRM_EX_OK);
	}
	}

	static void
	cib_connection_destroy(gpointer user_data)
	{
	if (stonith_shutdown_flag) {
	crm_info("Connection to the CIB manager closed");
	return;
	} else {
	crm_crit("Lost connection to the CIB manager, shutting down");
	}
	if (cib_api) {
	cib_api->cmds->signoff(cib_api);
	}
	stonith_shutdown(0);
	}

	static void
	stonith_cleanup(void)
	{
	if (cib_api) {
	cib_api->cmds->del_notify_callback(cib_api, T_CIB_DIFF_NOTIFY, update_cib_cache_cb);
	cib_api->cmds->signoff(cib_api);
	}

	if (ipcs) {
	qb_ipcs_destroy(ipcs);
	}

	crm_peer_destroy();
	pcmk__client_cleanup();
	free_stonith_remote_op_list();
	free_topology_list();
	free_device_list();
	free_metadata_cache();

	free(stonith_our_uname);
	stonith_our_uname = NULL;

	free_xml(local_cib);
	local_cib = NULL;
	}

	static pcmk__cli_option_t long_options[] = {
	// long option, argument type, storage, short option, description, flags
	{
	"stand-alone", no_argument, 0, 's',
	NULL, pcmk__option_default
	},
	{
	"stand-alone-w-cpg", no_argument, 0, 'c',
	NULL, pcmk__option_default
	},
	{
	"logfile", required_argument, 0, 'l',
	NULL, pcmk__option_default
	},
	{
	"verbose", no_argument, 0, 'V',
	NULL, pcmk__option_default
	},
	{
	"version", no_argument, 0, '$',
	NULL, pcmk__option_default
	},
	{
	"help", no_argument, 0, '?',
	NULL, pcmk__option_default
	},
	{ 0, 0, 0, 0 }
	};

	static void
	setup_cib(void)
	{
	int rc, retries = 0;

	cib_api = cib_new();
	if (cib_api == NULL) {
	crm_err("No connection to the CIB manager");
	return;
	}

	do {
	sleep(retries);
	rc = cib_api->cmds->signon(cib_api, CRM_SYSTEM_STONITHD, cib_command);
	} while (rc == -ENOTCONN && ++retries < 5);

	if (rc != pcmk_ok) {
	crm_err("Could not connect to the CIB manager: %s (%d)", pcmk_strerror(rc), rc);

	} else if (pcmk_ok !=
	cib_api->cmds->add_notify_callback(cib_api, T_CIB_DIFF_NOTIFY, update_cib_cache_cb)) {
	crm_err("Could not set CIB notification callback");

	} else {
	rc = cib_api->cmds->query(cib_api, NULL, NULL, cib_scope_local);
	cib_api->cmds->register_callback(cib_api, rc, 120, FALSE, NULL, "init_cib_cache_cb",
	init_cib_cache_cb);
	cib_api->cmds->set_connection_dnotify(cib_api, cib_connection_destroy);
	crm_info("Watching for fencing topology changes");
	}
	}

	struct qb_ipcs_service_handlers ipc_callbacks = {
	.connection_accept = st_ipc_accept,
	.connection_created = NULL,
	.msg_process = st_ipc_dispatch,
	.connection_closed = st_ipc_closed,
	.connection_destroyed = st_ipc_destroy
	};

	/*!
	* \internal
	* \brief Callback for peer status changes
	*
	* \param[in] type What changed
	* \param[in] node What peer had the change
	* \param[in] data Previous value of what changed
	*/
	static void
	st_peer_update_callback(enum crm_status_type type, crm_node_t * node, const void *data)
	{
	if ((type != crm_status_processes)
	&& !pcmk_is_set(node->flags, crm_remote_node)) {
	/*
	* This is a hack until we can send to a nodeid and/or we fix node name lookups
	* These messages are ignored in stonith_peer_callback()
	*/
	xmlNode *query = create_xml_node(NULL, "stonith_command");

	crm_xml_add(query, F_XML_TAGNAME, "stonith_command");
	crm_xml_add(query, F_TYPE, T_STONITH_NG);
	crm_xml_add(query, F_STONITH_OPERATION, "poke");

	crm_debug("Broadcasting our uname because of node %u", node->id);
	send_cluster_message(NULL, crm_msg_stonith_ng, query, FALSE);

	free_xml(query);
	}
	}

	int
	main(int argc, char **argv)
	{
	int flag;
	int lpc = 0;
	int argerr = 0;
	int option_index = 0;
	crm_cluster_t cluster;
	const char *actions[] = { "reboot", "off", "on", "list", "monitor", "status" };
	crm_ipc_t *old_instance = NULL;

	crm_log_preinit(NULL, argc, argv);
	pcmk__set_cli_options(NULL, "[options]", long_options,
	"daemon for executing fencing devices in a "
	"Pacemaker cluster");

	while (1) {
	flag = pcmk__next_cli_option(argc, argv, &option_index, NULL);
	if (flag == -1) {
	break;
	}

	switch (flag) {
	case 'V':
	crm_bump_log_level(argc, argv);
	break;
	case 'l':
	crm_add_logfile(optarg);
	break;
	case 's':
	stand_alone = TRUE;
	break;
	case 'c':
	stand_alone = FALSE;
	no_cib_connect = TRUE;
	break;
	case '$':
	case '?':
	pcmk__cli_help(flag, CRM_EX_OK);
	break;
	default:
	++argerr;
	break;
	}
	}

	if (argc - optind == 1 && pcmk__str_eq("metadata", argv[optind], pcmk__str_casei)) {
	printf("<?xml version=\"1.0\"?><!DOCTYPE resource-agent SYSTEM \"ra-api-1.dtd\">\n");
	printf("<resource-agent name=\"pacemaker-fenced\">\n");
	printf(" <version>1.0</version>\n");
	printf(" <longdesc lang=\"en\">Instance attributes available for all \"stonith\"-class resources"
	" and used by Pacemaker's fence daemon, formerly known as stonithd</longdesc>\n");
	printf(" <shortdesc lang=\"en\">Instance attributes available for all \"stonith\"-class resources</shortdesc>\n");
	printf(" <parameters>\n");

	#if 0
	// priority is not implemented yet
	printf(" <parameter name=\"priority\" unique=\"0\">\n");
	printf(" <shortdesc lang=\"en\">Devices that are not in a topology "
	"are tried in order of highest to lowest integer priority</shortdesc>\n");
	printf(" <content type=\"integer\" default=\"0\"/>\n");
	printf(" </parameter>\n");
	#endif

	printf(" <parameter name=\"%s\" unique=\"0\">\n",
	PCMK_STONITH_HOST_ARGUMENT);
	printf
	(" <shortdesc lang=\"en\">Advanced use only: An alternate parameter to supply instead of 'port'</shortdesc>\n");
	printf
	(" <longdesc lang=\"en\">Some devices do not support the standard 'port' parameter or may provide additional ones.\n"
	"Use this to specify an alternate, device-specific, parameter that should indicate the machine to be fenced.\n"
	"A value of 'none' can be used to tell the cluster not to supply any additional parameters.\n"
	" </longdesc>\n");
	printf(" <content type=\"string\" default=\"port\"/>\n");
	printf(" </parameter>\n");

	printf(" <parameter name=\"%s\" unique=\"0\">\n",
	PCMK_STONITH_HOST_MAP);
	printf
	(" <shortdesc lang=\"en\">A mapping of host names to ports numbers for devices that do not support host names.</shortdesc>\n");
	printf
	(" <longdesc lang=\"en\">Eg. node1:1;node2:2,3 would tell the cluster to use port 1 for node1 and ports 2 and 3 for node2</longdesc>\n");
	printf(" <content type=\"string\" default=\"\"/>\n");
	printf(" </parameter>\n");

	printf(" <parameter name=\"%s\" unique=\"0\">\n",
	PCMK_STONITH_HOST_LIST);
	printf(" <shortdesc lang=\"en\">A list of machines controlled by "
	"this device (Optional unless %s=static-list).</shortdesc>\n",
	PCMK_STONITH_HOST_CHECK);
	printf(" <content type=\"string\" default=\"\"/>\n");
	printf(" </parameter>\n");

	printf(" <parameter name=\"%s\" unique=\"0\">\n",
	PCMK_STONITH_HOST_CHECK);
	printf
	(" <shortdesc lang=\"en\">How to determine which machines are controlled by the device.</shortdesc>\n");
	printf(" <longdesc lang=\"en\">Allowed values: dynamic-list "
	"(query the device via the 'list' command), static-list "
	"(check the " PCMK_STONITH_HOST_LIST " attribute), status "
	"(query the device via the 'status' command), none (assume "
	"every device can fence every machine)</longdesc>\n");
	printf(" <content type=\"string\" default=\"dynamic-list\"/>\n");
	printf(" </parameter>\n");

	printf(" <parameter name=\"%s\" unique=\"0\">\n",
	PCMK_STONITH_DELAY_MAX);
	printf(" <shortdesc lang=\"en\">Enable a random delay for "
	"fencing actions and specify the maximum of random "
	"delay.</shortdesc>\n");
	printf(" <longdesc lang=\"en\">This prevents double fencing when "
	"using slow devices such as sbd.\nUse this to enable a random "
	"delay for fencing actions.\nThe overall delay is derived from "
	"this random delay value adding a static delay so that the sum "
	"is kept below the maximum delay.</longdesc>\n");
	printf(" <content type=\"time\" default=\"0s\"/>\n");
	printf(" </parameter>\n");

	printf(" <parameter name=\"%s\" unique=\"0\">\n",
	PCMK_STONITH_DELAY_BASE);
	printf(" <shortdesc lang=\"en\">Enable a base delay for "
	"fencing actions and specify base delay value.</shortdesc>\n");
	printf(" <longdesc lang=\"en\">This prevents double fencing when "
	"different delays are configured on the nodes.\nUse this to "
	"enable a static delay for fencing actions.\nThe overall delay "
	"is derived from a random delay value adding this static delay "
	"so that the sum is kept below the maximum delay.</longdesc>\n");
	printf(" <content type=\"time\" default=\"0s\"/>\n");
	printf(" </parameter>\n");

	printf(" <parameter name=\"%s\" unique=\"0\">\n",
	PCMK_STONITH_ACTION_LIMIT);
	printf
	(" <shortdesc lang=\"en\">The maximum number of actions can be performed in parallel on this device</shortdesc>\n");
	printf
	(" <longdesc lang=\"en\">Cluster property concurrent-fencing=true needs to be configured first.\n"
	"Then use this to specify the maximum number of actions can be performed in parallel on this device. -1 is unlimited.</longdesc>\n");
	printf(" <content type=\"integer\" default=\"1\"/>\n");
	printf(" </parameter>\n");


	for (lpc = 0; lpc < DIMOF(actions); lpc++) {
	printf(" <parameter name=\"pcmk_%s_action\" unique=\"0\">\n", actions[lpc]);
	printf
	(" <shortdesc lang=\"en\">Advanced use only: An alternate command to run instead of '%s'</shortdesc>\n",
	actions[lpc]);
	printf
	(" <longdesc lang=\"en\">Some devices do not support the standard commands or may provide additional ones.\n"
	"Use this to specify an alternate, device-specific, command that implements the '%s' action.</longdesc>\n",
	actions[lpc]);
	printf(" <content type=\"string\" default=\"%s\"/>\n", actions[lpc]);
	printf(" </parameter>\n");

	printf(" <parameter name=\"pcmk_%s_timeout\" unique=\"0\">\n", actions[lpc]);
	printf
	(" <shortdesc lang=\"en\">Advanced use only: Specify an alternate timeout to use for %s actions instead of stonith-timeout</shortdesc>\n",
	actions[lpc]);
	printf
	(" <longdesc lang=\"en\">Some devices need much more/less time to complete than normal.\n"
	"Use this to specify an alternate, device-specific, timeout for '%s' actions.</longdesc>\n",
	actions[lpc]);
	printf(" <content type=\"time\" default=\"60s\"/>\n");
	printf(" </parameter>\n");

	printf(" <parameter name=\"pcmk_%s_retries\" unique=\"0\">\n", actions[lpc]);
	printf
	(" <shortdesc lang=\"en\">Advanced use only: The maximum number of times to retry the '%s' command within the timeout period</shortdesc>\n",
	actions[lpc]);
	printf(" <longdesc lang=\"en\">Some devices do not support multiple connections."
	" Operations may 'fail' if the device is busy with another task so Pacemaker will automatically retry the operation, if there is time remaining."
	" Use this option to alter the number of times Pacemaker retries '%s' actions before giving up."
	"</longdesc>\n", actions[lpc]);
	printf(" <content type=\"integer\" default=\"2\"/>\n");
	printf(" </parameter>\n");
	}

	printf(" </parameters>\n");
	printf("</resource-agent>\n");
	return CRM_EX_OK;
	}

	if (optind != argc) {
	++argerr;
	}

	if (argerr) {
	pcmk__cli_help('?', CRM_EX_USAGE);
	}

	crm_log_init(NULL, LOG_INFO, TRUE, FALSE, argc, argv, FALSE);

	crm_notice("Starting Pacemaker fencer");

	old_instance = crm_ipc_new("stonith-ng", 0);
	if (crm_ipc_connect(old_instance)) {
	/* IPC end-point already up */
	crm_ipc_close(old_instance);
	crm_ipc_destroy(old_instance);
	crm_err("pacemaker-fenced is already active, aborting startup");
	crm_exit(CRM_EX_OK);
	} else {
	/* not up or not authentic, we'll proceed either way */
	crm_ipc_destroy(old_instance);
	old_instance = NULL;
	}

	mainloop_add_signal(SIGTERM, stonith_shutdown);

	crm_peer_init();

	fenced_data_set = pe_new_working_set();
	CRM_ASSERT(fenced_data_set != NULL);
	pe__set_working_set_flags(fenced_data_set,
	pe_flag_no_counts\|pe_flag_no_compat);

	if (stand_alone == FALSE) {

	if (is_corosync_cluster()) {
	#if SUPPORT_COROSYNC
	cluster.destroy = stonith_peer_cs_destroy;
	cluster.cpg.cpg_deliver_fn = stonith_peer_ais_callback;
	cluster.cpg.cpg_confchg_fn = pcmk_cpg_membership;
	#endif
	}

	crm_set_status_callback(&st_peer_update_callback);

	if (crm_cluster_connect(&cluster) == FALSE) {
	crm_crit("Cannot sign in to the cluster... terminating");
	crm_exit(CRM_EX_FATAL);
	}
	stonith_our_uname = cluster.uname;
	stonith_our_uuid = cluster.uuid;

	if (no_cib_connect == FALSE) {
	setup_cib();
	}

	} else {
	stonith_our_uname = strdup("localhost");
	}

	init_device_list();
	init_topology_list();

	if(stonith_watchdog_timeout_ms > 0) {
	int rc;
	xmlNode *xml;
	stonith_key_value_t *params = NULL;

	params = stonith_key_value_add(params, PCMK_STONITH_HOST_LIST,
	stonith_our_uname);

	xml = create_device_registration_xml("watchdog", st_namespace_internal,
	STONITH_WATCHDOG_AGENT, params,
	NULL);
	stonith_key_value_freeall(params, 1, 1);
	rc = stonith_device_register(xml, NULL, FALSE);
	free_xml(xml);
	if (rc != pcmk_ok) {
	crm_crit("Cannot register watchdog pseudo fence agent");
	crm_exit(CRM_EX_FATAL);
	}
	}

	pcmk__serve_fenced_ipc(&ipcs, &ipc_callbacks);

	/* Create the mainloop and run it... */
	mainloop = g_main_loop_new(NULL, FALSE);
	crm_notice("Pacemaker fencer successfully started and accepting connections");
	g_main_loop_run(mainloop);

	stonith_cleanup();
	pe_free_working_set(fenced_data_set);
	crm_exit(CRM_EX_OK);
	}

File Metadata

Mime Type: text/x-diff
Expires: Mon, Apr 21, 9:32 AM (16 h, 7 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1664744
Default Alt Text: (245 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions