No OneTemporary
Actions

Size

260 KB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/cts/cli/regression.rules.exp b/cts/cli/regression.rules.exp
	index 8500d876c8..b99c634772 100644
	--- a/cts/cli/regression.rules.exp
	+++ b/cts/cli/regression.rules.exp
	@@ -1,211 +1,196 @@
	=#=#=#= Begin test: crm_rule given no arguments =#=#=#=
	crm_rule: No mode operation given
	=#=#=#= End test: crm_rule given no arguments - Incorrect usage (64) =#=#=#=
	* Passed: crm_rule - crm_rule given no arguments
	=#=#=#= Begin test: crm_rule given no arguments (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule --output-as=xml">
	<status code="64" message="Incorrect usage">
	<errors>
	<error>crm_rule: No mode operation given</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: crm_rule given no arguments (XML) - Incorrect usage (64) =#=#=#=
	* Passed: crm_rule - crm_rule given no arguments (XML)
	=#=#=#= Begin test: crm_rule given no rule to check =#=#=#=
	crm_rule: --check requires use of --rule=
	=#=#=#= End test: crm_rule given no rule to check - Incorrect usage (64) =#=#=#=
	* Passed: crm_rule - crm_rule given no rule to check
	=#=#=#= Begin test: crm_rule given no rule to check (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c --output-as=xml">
	<status code="64" message="Incorrect usage">
	<errors>
	<error>crm_rule: --check requires use of --rule=</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: crm_rule given no rule to check (XML) - Incorrect usage (64) =#=#=#=
	* Passed: crm_rule - crm_rule given no rule to check (XML)
	=#=#=#= Begin test: crm_rule given invalid input XML =#=#=#=
	pcmk__log_xmllib_err error: XML Error: Entity: line 1: parser error : Start tag expected, '<' not found
	pcmk__log_xmllib_err error: XML Error: invalidxml
	pcmk__log_xmllib_err error: XML Error: ^
	crm_rule: Couldn't parse input string: invalidxml
	=#=#=#= End test: crm_rule given invalid input XML - Invalid data given (65) =#=#=#=
	* Passed: crm_rule - crm_rule given invalid input XML
	=#=#=#= Begin test: crm_rule given invalid input XML (XML) =#=#=#=
	pcmk__log_xmllib_err error: XML Error: Entity: line 1: parser error : Start tag expected, '<' not found
	pcmk__log_xmllib_err error: XML Error: invalidxml
	pcmk__log_xmllib_err error: XML Error: ^
	<pacemaker-result api-version="X" request="crm_rule -c -r blahblah -X invalidxml --output-as=xml">
	<status code="65" message="Invalid data given">
	<errors>
	<error>crm_rule: Couldn't parse input string: invalidxml</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: crm_rule given invalid input XML (XML) - Invalid data given (65) =#=#=#=
	* Passed: crm_rule - crm_rule given invalid input XML (XML)
	=#=#=#= Begin test: crm_rule given invalid input XML on stdin =#=#=#=
	pcmk__log_xmllib_err error: XML Error: Entity: line 1: parser error : Start tag expected, '<' not found
	pcmk__log_xmllib_err error: XML Error: invalidxml
	pcmk__log_xmllib_err error: XML Error: ^
	crm_rule: Couldn't parse input from STDIN
	=#=#=#= End test: crm_rule given invalid input XML on stdin - Invalid data given (65) =#=#=#=
	* Passed: crm_rule - crm_rule given invalid input XML on stdin
	=#=#=#= Begin test: crm_rule given invalid input XML on stdin (XML) =#=#=#=
	pcmk__log_xmllib_err error: XML Error: Entity: line 1: parser error : Start tag expected, '<' not found
	pcmk__log_xmllib_err error: XML Error: invalidxml
	pcmk__log_xmllib_err error: XML Error: ^
	<pacemaker-result api-version="X" request="crm_rule -c -r blahblah -X - --output-as=xml">
	<status code="65" message="Invalid data given">
	<errors>
	<error>crm_rule: Couldn't parse input from STDIN</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: crm_rule given invalid input XML on stdin (XML) - Invalid data given (65) =#=#=#=
	* Passed: crm_rule - crm_rule given invalid input XML on stdin (XML)
	=#=#=#= Begin test: Try to check a rule that doesn't exist =#=#=#=
	Could not determine whether rule blahblah is in effect: Rule not found
	=#=#=#= End test: Try to check a rule that doesn't exist - No such object (105) =#=#=#=
	* Passed: crm_rule - Try to check a rule that doesn't exist
	=#=#=#= Begin test: Try to check a rule that doesn't exist (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r blahblah --output-as=xml">
	<rule-check rule-id="blahblah" rc="105"/>
	<status code="105" message="No such object">
	<errors>
	<error>Could not determine whether rule blahblah is in effect: Rule not found</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: Try to check a rule that doesn't exist (XML) - No such object (105) =#=#=#=
	* Passed: crm_rule - Try to check a rule that doesn't exist (XML)
	=#=#=#= Begin test: Try to check a rule that has too many date_expressions =#=#=#=
	Could not determine whether rule cli-rule-too-many-date-expressions is in effect: Rule has more than one date expression
	=#=#=#= End test: Try to check a rule that has too many date_expressions - Unimplemented (3) =#=#=#=
	* Passed: crm_rule - Try to check a rule that has too many date_expressions
	=#=#=#= Begin test: Try to check a rule that has too many date_expressions (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-rule-too-many-date-expressions --output-as=xml">
	<rule-check rule-id="cli-rule-too-many-date-expressions" rc="3"/>
	<status code="3" message="Unimplemented">
	<errors>
	<error>Could not determine whether rule cli-rule-too-many-date-expressions is in effect: Rule has more than one date expression</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: Try to check a rule that has too many date_expressions (XML) - Unimplemented (3) =#=#=#=
	* Passed: crm_rule - Try to check a rule that has too many date_expressions (XML)
	=#=#=#= Begin test: Verify basic rule is expired =#=#=#=
	Rule cli-prefer-rule-dummy-expired is expired
	=#=#=#= End test: Verify basic rule is expired - Requested item has expired (110) =#=#=#=
	* Passed: crm_rule - Verify basic rule is expired
	=#=#=#= Begin test: Verify basic rule is expired (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-expired --output-as=xml">
	<rule-check rule-id="cli-prefer-rule-dummy-expired" rc="110"/>
	<status code="110" message="Requested item has expired"/>
	</pacemaker-result>
	=#=#=#= End test: Verify basic rule is expired (XML) - Requested item has expired (110) =#=#=#=
	* Passed: crm_rule - Verify basic rule is expired (XML)
	=#=#=#= Begin test: Verify basic rule worked in the past =#=#=#=
	Rule cli-prefer-rule-dummy-expired is still in effect
	=#=#=#= End test: Verify basic rule worked in the past - OK (0) =#=#=#=
	* Passed: crm_rule - Verify basic rule worked in the past
	=#=#=#= Begin test: Verify basic rule worked in the past (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101 --output-as=xml">
	<rule-check rule-id="cli-prefer-rule-dummy-expired" rc="0"/>
	<status code="0" message="OK"/>
	</pacemaker-result>
	=#=#=#= End test: Verify basic rule worked in the past (XML) - OK (0) =#=#=#=
	* Passed: crm_rule - Verify basic rule worked in the past (XML)
	=#=#=#= Begin test: Verify basic rule is not yet in effect =#=#=#=
	Rule cli-prefer-rule-dummy-not-yet has not yet taken effect
	=#=#=#= End test: Verify basic rule is not yet in effect - Requested item is not yet in effect (111) =#=#=#=
	* Passed: crm_rule - Verify basic rule is not yet in effect
	=#=#=#= Begin test: Verify basic rule is not yet in effect (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-not-yet --output-as=xml">
	<rule-check rule-id="cli-prefer-rule-dummy-not-yet" rc="111"/>
	<status code="111" message="Requested item is not yet in effect"/>
	</pacemaker-result>
	=#=#=#= End test: Verify basic rule is not yet in effect (XML) - Requested item is not yet in effect (111) =#=#=#=
	* Passed: crm_rule - Verify basic rule is not yet in effect (XML)
	=#=#=#= Begin test: Verify date_spec rule with years has expired =#=#=#=
	Rule cli-prefer-rule-dummy-date_spec-only-years is expired
	=#=#=#= End test: Verify date_spec rule with years has expired - Requested item has expired (110) =#=#=#=
	* Passed: crm_rule - Verify date_spec rule with years has expired
	=#=#=#= Begin test: Verify date_spec rule with years has expired (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml">
	<rule-check rule-id="cli-prefer-rule-dummy-date_spec-only-years" rc="110"/>
	<status code="110" message="Requested item has expired"/>
	</pacemaker-result>
	=#=#=#= End test: Verify date_spec rule with years has expired (XML) - Requested item has expired (110) =#=#=#=
	* Passed: crm_rule - Verify date_spec rule with years has expired (XML)
	=#=#=#= Begin test: Verify multiple rules at once =#=#=#=
	Rule cli-prefer-rule-dummy-not-yet has not yet taken effect
	Rule cli-prefer-rule-dummy-date_spec-only-years is expired
	=#=#=#= End test: Verify multiple rules at once - Requested item has expired (110) =#=#=#=
	* Passed: crm_rule - Verify multiple rules at once
	=#=#=#= Begin test: Verify multiple rules at once (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml">
	<rule-check rule-id="cli-prefer-rule-dummy-not-yet" rc="111"/>
	<rule-check rule-id="cli-prefer-rule-dummy-date_spec-only-years" rc="110"/>
	<status code="110" message="Requested item has expired"/>
	</pacemaker-result>
	=#=#=#= End test: Verify multiple rules at once (XML) - Requested item has expired (110) =#=#=#=
	* Passed: crm_rule - Verify multiple rules at once (XML)
	=#=#=#= Begin test: Verify date_spec rule with years is in effect =#=#=#=
	Rule cli-prefer-rule-dummy-date_spec-only-years satisfies conditions
	=#=#=#= End test: Verify date_spec rule with years is in effect - OK (0) =#=#=#=
	* Passed: crm_rule - Verify date_spec rule with years is in effect
	=#=#=#= Begin test: Verify date_spec rule with years is in effect (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201 --output-as=xml">
	<rule-check rule-id="cli-prefer-rule-dummy-date_spec-only-years" rc="0"/>
	<status code="0" message="OK"/>
	</pacemaker-result>
	=#=#=#= End test: Verify date_spec rule with years is in effect (XML) - OK (0) =#=#=#=
	* Passed: crm_rule - Verify date_spec rule with years is in effect (XML)
	=#=#=#= Begin test: Try to check a rule whose date_spec does not contain years= =#=#=#=
	Could not determine whether rule cli-prefer-rule-dummy-date_spec-without-years is in effect: Rule must either not use date_spec, or use date_spec with years= but not moon=
	=#=#=#= End test: Try to check a rule whose date_spec does not contain years= - Unimplemented (3) =#=#=#=
	* Passed: crm_rule - Try to check a rule whose date_spec does not contain years=
	=#=#=#= Begin test: Try to check a rule whose date_spec does not contain years= (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years --output-as=xml">
	<rule-check rule-id="cli-prefer-rule-dummy-date_spec-without-years" rc="3"/>
	<status code="3" message="Unimplemented">
	<errors>
	<error>Could not determine whether rule cli-prefer-rule-dummy-date_spec-without-years is in effect: Rule must either not use date_spec, or use date_spec with years= but not moon=</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: Try to check a rule whose date_spec does not contain years= (XML) - Unimplemented (3) =#=#=#=
	* Passed: crm_rule - Try to check a rule whose date_spec does not contain years= (XML)
	-=#=#=#= Begin test: Try to check a rule whose date_spec contains years= and moon= =#=#=#=
	-Could not determine whether rule cli-prefer-rule-dummy-date_spec-years-moon is in effect: Rule must either not use date_spec, or use date_spec with years= but not moon=
	-=#=#=#= End test: Try to check a rule whose date_spec contains years= and moon= - Unimplemented (3) =#=#=#=
	-* Passed: crm_rule - Try to check a rule whose date_spec contains years= and moon=
	-=#=#=#= Begin test: Try to check a rule whose date_spec contains years= and moon= (XML) =#=#=#=
	-<pacemaker-result api-version="X" request="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon --output-as=xml">
	- <rule-check rule-id="cli-prefer-rule-dummy-date_spec-years-moon" rc="3"/>
	- <status code="3" message="Unimplemented">
	- <errors>
	- <error>Could not determine whether rule cli-prefer-rule-dummy-date_spec-years-moon is in effect: Rule must either not use date_spec, or use date_spec with years= but not moon=</error>
	- </errors>
	- </status>
	-</pacemaker-result>
	-=#=#=#= End test: Try to check a rule whose date_spec contains years= and moon= (XML) - Unimplemented (3) =#=#=#=
	-* Passed: crm_rule - Try to check a rule whose date_spec contains years= and moon= (XML)
	=#=#=#= Begin test: Try to check a rule with no date_expression =#=#=#=
	Could not determine whether rule cli-no-date_expression-rule is in effect: Rule does not have a date expression
	=#=#=#= End test: Try to check a rule with no date_expression - Unimplemented (3) =#=#=#=
	* Passed: crm_rule - Try to check a rule with no date_expression
	=#=#=#= Begin test: Try to check a rule with no date_expression (XML) =#=#=#=
	<pacemaker-result api-version="X" request="crm_rule -c -r cli-no-date_expression-rule --output-as=xml">
	<rule-check rule-id="cli-no-date_expression-rule" rc="3"/>
	<status code="3" message="Unimplemented">
	<errors>
	<error>Could not determine whether rule cli-no-date_expression-rule is in effect: Rule does not have a date expression</error>
	</errors>
	</status>
	</pacemaker-result>
	=#=#=#= End test: Try to check a rule with no date_expression (XML) - Unimplemented (3) =#=#=#=
	* Passed: crm_rule - Try to check a rule with no date_expression (XML)
	diff --git a/cts/cts-cli.in b/cts/cts-cli.in
	index 5f1f860b17..958168dd1a 100644
	--- a/cts/cts-cli.in
	+++ b/cts/cts-cli.in
	@@ -1,3410 +1,3399 @@
	#!@PYTHON@
	"""Regression tests for Pacemaker's command line tools."""

	# pylint doesn't like the module name "cts-cli" which is an invalid complaint for this file
	# but probably something we want to continue warning about elsewhere
	# pylint: disable=invalid-name
	# pacemaker imports need to come after we modify sys.path, which pylint will complain about.
	# pylint: disable=wrong-import-position
	# We know this is a very long file.
	# pylint: disable=too-many-lines

	__copyright__ = "Copyright 2024 the Pacemaker project contributors"
	__license__ = "GNU General Public License version 2 or later (GPLv2+) WITHOUT ANY WARRANTY"

	import argparse
	from contextlib import contextmanager
	from datetime import datetime, timedelta
	import fileinput
	from functools import partial
	from gettext import ngettext
	from multiprocessing import Pool, cpu_count
	import os
	import pathlib
	import re
	from shutil import copyfile
	import signal
	from string import Formatter
	import subprocess
	import sys
	from tempfile import NamedTemporaryFile, TemporaryDirectory, mkstemp
	import types

	# These imports allow running from a source checkout after running `make`.
	if os.path.exists("@abs_top_srcdir@/python"):
	sys.path.insert(0, "@abs_top_srcdir@/python")

	# pylint: disable=comparison-of-constants,comparison-with-itself,condition-evals-to-constant
	if os.path.exists("@abs_top_builddir@/python") and "@abs_top_builddir@" != "@abs_top_srcdir@":
	sys.path.insert(0, "@abs_top_builddir@/python")

	from pacemaker._cts.errors import XmlValidationError
	from pacemaker._cts.validate import validate
	from pacemaker.buildoptions import BuildOptions
	from pacemaker.exitstatus import ExitStatus

	# Individual tool tests are split out, but can also be accessed as a group with "tools"
	tools_tests = ["cibadmin", "crm_attribute", "crm_standby", "crm_resource",
	"crm_ticket", "crmadmin", "crm_shadow", "crm_verify"]
	# The default list of tests to run, in the order they should be run
	default_tests = ["access_render", "daemons", "dates", "error_codes"] + tools_tests + \
	["crm_mon", "acls", "validity", "upgrade", "rules", "feature_set"]
	other_tests = ["agents"]

	# The directory containing this program
	test_home = os.path.dirname(os.path.realpath(__file__))

	# The name of the shadow CIB
	SHADOW_NAME = "cts-cli"

	# Arguments to pass to valgrind
	VALGRIND_ARGS = ["-q", "--gen-suppressions=all", "--show-reachable=no", "--leak-check=full",
	"--trace-children=no", "--time-stamp=yes", "--num-callers=20",
	"--suppressions=%s/valgrind-pcmk.suppressions" % test_home]


	class PluralFormatter(Formatter):
	"""
	Special string formatting class for selecting singular vs. plurals.

	Use like so:
	fmt = PluralFormatter()
	print(fmt.format("{0} {0}:plural,test,tests} succeeded", n_tests))
	"""

	def format_field(self, value, format_spec):
	"""Convert a value to a formatted representation."""
	if format_spec.startswith("plural,"):
	eles = format_spec.split(',')
	if len(eles) == 2:
	singular = eles[1]
	plural = singular + "s"
	else:
	singular = eles[1]
	plural = eles[2]

	return ngettext(singular, plural, value)

	return super().format_field(value, format_spec)


	def apply_substitutions(s, extra=None):
	"""Apply text substitutions to an input string and return it."""
	substitutions = {
	"cts_cli_data": "%s/cli" % test_home,
	"shadow": SHADOW_NAME,
	"test_home": test_home,
	}

	if extra is not None:
	substitutions.update(extra)

	return s.format(**substitutions)


	def cleanup_shadow_dir():
	"""Remove any previously created shadow CIB directory."""
	subprocess.run(["crm_shadow", "--force", "--delete", SHADOW_NAME],
	stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
	check=True)


	def copy_existing_cib(existing):
	"""
	Generate a CIB by copying an existing one to a temporary location.

	This is suitable for use with the cib_gen= parameter to the TestGroup class.
	"""
	(fp, new) = mkstemp(prefix="cts-cli.cib.xml.")
	os.close(fp)
	copyfile(apply_substitutions(existing), new)
	return new


	def current_cib():
	"""Return the complete current CIB."""
	with environ({"CIB_user": "root"}):
	return subprocess.check_output(["cibadmin", "-Q"], encoding="utf-8")


	def make_test_group(desc, cmd, classes, **kwargs):
	"""
	Create a TestGroup that replicates the same test for multiple classes.

	The given description, cmd, and kwargs will be passed as arguments to each
	Test subclass in the classes parameter. The resulting objects will then be
	added to a TestGroup and returned.

	The main purpose of this function is to be able to run the same test for
	both text and XML formats without having to duplicate everything. Thus, the
	cmd string may contain "{fmt}", which will have any --output-as= class
	variable substituted in.
	"""
	tests = []

	for c in classes:
	obj = c(desc, apply_substitutions(cmd, extra={"fmt": c.format_args}),
	**kwargs)
	tests.append(obj)

	return TestGroup(tests)


	def create_shadow_cib(shadow_dir, create_empty=True, validate_with=None,
	valgrind=False):
	"""
	Create a shadow CIB file.

	Keyword arguments:
	create_empty -- If True, the shadow CIB will be empty. Otherwise, the
	shadow CIB will be a copy of the currently active
	cluster configuration.
	validate_with -- If not None, the schema version to validate the CIB
	against
	valgrind -- If True, run the create operation under valgrind
	"""
	args = ["crm_shadow", "--batch", "--force"]

	if create_empty:
	args += ["--create-empty", SHADOW_NAME]
	else:
	args += ["--create", SHADOW_NAME]

	if validate_with is not None:
	args += ["--validate-with", validate_with]

	if valgrind:
	args = ["valgrind"] + VALGRIND_ARGS + args

	os.environ["CIB_shadow_dir"] = shadow_dir
	os.environ["CIB_shadow"] = SHADOW_NAME

	subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
	check=True)
	delete_shadow_resource_defaults()


	def delete_shadow_resource_defaults():
	"""Clear out the rsc_defaults section from a shadow CIB file."""
	# A newly created empty CIB might or might not have a rsc_defaults section
	# depending on whether the --with-resource-stickiness-default configure
	# option was used. To ensure regression tests behave the same either way,
	# delete any rsc_defaults after creating or erasing a CIB.
	subprocess.run(["cibadmin", "--delete", "--xml-text", "<rsc_defaults/>"],
	stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
	check=True)

	# The above command might or might not bump the CIB version, so reset it
	# to ensure future changes result in the same version for comparison.
	reset_shadow_cib_version()


	def reset_shadow_cib_version():
	"""Set various version numbers in a shadow CIB file back to 0."""
	with fileinput.input(files=[shadow_path()], inplace=True) as f:
	for line in f:
	line = re.sub('epoch="[0-9]*"', 'epoch="1"', line)
	line = re.sub('num_updates="[0-9]*"', 'num_updates="0"', line)
	line = re.sub('admin_epoch="[0-9]*"', 'admin_epoch="0"', line)
	print(line, end='')


	def run_cmd_list(cmds):
	"""
	Run one or more shell commands.

	cmds can be:
	* A string
	* A Python function
	* A list of the above

	Raises subprocess.CalledProcessError on error.
	"""
	if cmds is None:
	return

	if isinstance(cmds, (str, types.FunctionType)):
	cmds = [cmds]

	for c in cmds:
	if isinstance(c, types.FunctionType):
	c()
	else:
	subprocess.run(apply_substitutions(c), stdout=subprocess.PIPE, stderr=subprocess.PIPE,
	shell=True, universal_newlines=True, check=True)


	def sanitize_output(s):
	"""
	Replace content in the output expected to change between test runs.

	This is stuff like version numbers, timestamps, source line numbers,
	build options, system names and messages, etc.
	"""
	# A list of tuples of regular expressions and their replacements.
	replacements = [
	(r'Created new pacemaker-.* configuration', r'Created new pacemaker configuration'),
	(r'Device not configured', r'No such device or address'),
	(r'^Entity: line [0-9]+: ', r''),
	(r'Last change: .*', r'Last change:'),
	(r'Last updated: .*', r'Last updated:'),
	(r'^Migration will take effect until: .*', r'Migration will take effect until:'),
	(r'(\* Possible values.: .)$default: [^)]*$', r'\1(default: )'),
	(r"""-X '.*'""", r"""-X '...'"""),
	(r' api-version="[^"]*"', r' api-version="X"'),
	(r'$apply_upgrade@.*\.c:[0-9]+$', r'apply_upgrade'),
	(r'$invert_action@.*\.c:[0-9]+$', r'invert_action'),
	(r'$pcmk__update_schema@.*\.c:[0-9]+$', r'pcmk__update_schema'),
	(r'(<change-attr name="crm_feature_set" .* value=")[0-9.]*"', r'\1"'),
	(r'(<change-attr name="validate-with" .* value="pacemaker-)[0-9.]+"', r'\1X"'),
	(r'(<cib.) cib-last-written="[^"]"', r'\1'),
	(r'crm_feature_set="[^"]*" ', r''),
	(r'@crm_feature_set=[0-9.]+, ', r''),
	(r'$crm_time_parse_duration@.*\.c:[0-9]+$', r'crm_time_parse_duration'),
	(r'$crm_time_parse_period@.*\.c:[0-9]+$', r'crm_time_parse_period'),
	(r'$crm_time_parse_sec@.*\.c:[0-9]+$', r'crm_time_parse_sec'),
	(r' default="[^"]*"', r' default=""'),
	(r' end="[0-9][-+: 0-9]Z"', r' end=""'),
	(r'last_change time=".*"', r'last_change time=""'),
	(r'last_update time=".*"', r'last_update time=""'),
	(r' last-rc-change=[\'"][-+A-Za-z0-9: ]*[\'"],?', r''),
	(r'$parse_date@.*\.c:[0-9]+$', r'parse_date'),
	(r'$(pcmk__.)@.\.c:[0-9]+$', r'\1'),
	(r'.*Relax-NG validity error : ', r''),
	(r'request=".*(crm_?[a-zA-Z0-9]+) ', r'request="\1 '),
	(r'request=".*iso8601', r'request="iso8601'),
	(r' start="[0-9][-+: 0-9]Z"', r' start=""'),
	(r'/tmp/cts-cli\.[^/]*/shadow.cts-cli', r'/tmp/cts-cli.shadow/shadow.cts-cli'),
	(r'^/tmp/cts-cli\.xmllint\.[^:]*:', r'/tmp/cts-cli.xmllint:'),
	(r'^/tmp/cts-cli\.xmllint\.[^ ]* fails to validate', r'/tmp/cts-cli.xmllint fails to validate'),
	(r'.$(unpack_.)@.*\.c:[0-9]+$', r'\1'),
	(r' validate-with="[^"]*"', r''),
	(r'(@validate-with=pacemaker-)[0-9.]+,', r'\1X,'),
	(r' version="[^"]*"', r' version=""'),
	(r'$version .*$', r'(version)'),
	(r'--xml-file .cli/(.)\.xml', r'--xml-file \1.xml'),
	]

	new_output = []

	for line in s:
	# @TODO Add a way to suppress this message within cibadmin, and then drop
	# the handling here.
	if line.startswith("The supplied command can provide skewed result"):
	continue

	for (pattern, repl) in replacements:
	line = re.sub(pattern, repl, line)

	new_output.append(line)

	return new_output


	def shadow_path():
	"""Return the current shadow CIB path."""
	p = subprocess.check_output(["crm_shadow", "--file"], encoding="utf-8")
	return p.strip()


	def write_cib(s):
	"""
	Generate a CIB by writing a string to a temporary location.

	This is suitable for use with the cib_gen= parameter to the TestGroup class.
	"""
	(fp, new) = mkstemp(prefix="cts-cli.cib.xml.")
	os.write(fp, s.encode())
	os.close(fp)
	return new


	@contextmanager
	def environ(env):
	"""
	Run code in an environment modified with the provided dict.

	This context manager augments the current process environment with the provided
	dict, allowing code to be constructed like so:

	e = {"CIB_user": "xyx"}
	with environ(e):
	...

	When the context manager exits, the previous environment will be restored.

	It is possible to remove an environment key (whether it was in the environment by
	default, or given with a nested call to this context) by passing None for the
	value. Additionally, this context manager accepts None for the env parameter,
	in which case nothing will be done.

	Finally, note that values in env will be passed to apply_substitutions before
	being set in the environment.
	"""
	if env is None:
	env = {}
	original_env = {}
	else:
	original_env = os.environ.copy()

	for k, v in env.items():
	if v is None:
	os.environ.pop(k)
	else:
	os.environ[k] = apply_substitutions(v)

	try:
	yield
	finally:
	for k, v in original_env.items():
	if v is None:
	os.environ.pop(k)
	else:
	os.environ[k] = v


	class StdinCmd:
	"""
	A class for defining a command that should be run later.

	subprocess.Popen (and its various helper functions) start running the command
	immediately, which doesn't work if we want to provide the command when a Test
	is created, but delay its execution until the environment is defined when the
	Test is run.

	This class allows us to do that.
	"""

	def __init__(self, cmd):
	"""Create a new StdinCmd instance.

	Arguments:
	cmd -- The command string to run later. This string will be passed
	to apply_substitutions before being executed.
	"""
	self._cmd = cmd

	def run(self):
	"""Run this command, returning a subprocess.Popen object."""
	return subprocess.Popen(apply_substitutions(self._cmd), shell=True,
	encoding="utf-8", stdout=subprocess.PIPE)


	class Test:
	"""A base class for defining a single command line regression test."""

	format_args = ""

	def __init__(self, desc, cmd, expected_rc=ExitStatus.OK, update_cib=False,
	setup=None, teardown=None, stdin=None, env=None):
	"""
	Create a new Test instance.

	Arguments:
	desc -- A short human-readable description of this test
	cmd -- The command to run for this test, as a string. This string
	will be passed to apply_substitutions before being executed.

	Keyword arguments:
	expected_rc -- The expected return value of cmd
	update_cib -- If True, the resulting CIB will be printed after
	performing the test
	setup -- A shell command to be run in the same environment as
	cmd, immediately before the test. Valid types are:
	a string, a Python function, or a list of the above
	teardown -- Like setup, but runs immediately after the test
	stdin -- If not None, the text to feed to cmd as its stdin
	env -- If not None, a dict of values to be added to the test
	environment. This will be added when the test is run
	and will override anything given to the TestGroup.
	"""
	self.desc = desc
	self.cmd = cmd
	self.expected_rc = expected_rc
	self.update_cib = update_cib

	self._setup = setup
	self._teardown = teardown
	self._stdin = stdin

	if env is None:
	self._env = {}
	else:
	self._env = env

	self._output = None

	@property
	def output(self):
	"""Return the test's detailed output."""
	return self._output

	def _log_end_test(self, rc):
	"""Log a message when a test ends."""
	if isinstance(rc, ExitStatus):
	rc_str = str(rc)
	else:
	if rc < 0:
	rc = abs(rc)
	rc_str = signal.strsignal(rc)
	else:
	rc = ExitStatus(rc)
	rc_str = str(rc)

	self._output.append("=#=#=#= End test: %s - %s (%d) =#=#=#=" % (self.desc, rc_str, rc))

	def _log_start_test(self):
	"""Log a message when a test starts."""
	self._output.append("=#=#=#= Begin test: %s =#=#=#=" % self.desc)

	def _log_test_failed(self, app, rc):
	"""Log a message when a test fails."""
	self._output.append("* Failed (rc=%.3d): %-23s - %s" % (rc, app, self.desc))

	def _log_test_passed(self, app):
	"""Log a message when a test passes."""
	self._output.append("* Passed: %-21s - %s" % (app, self.desc))

	# pylint: disable=unused-argument
	def _validate_hook(self, rc, _stdout, _stderr, valgrind=False):
	"""Validate test output."""
	self._log_end_test(rc)
	return rc

	def _run_setup_teardown(self, cmd, app):
	"""
	Run any setup or teardown command required by this test.

	On success (or if no command is present), return True. On failure,
	return False and log the stdout/stderr of the command for debugging.

	Arguments:
	cmd -- The setup/teardown command(s) to run
	app -- The base name of the test command, for logging purposes
	"""
	try:
	run_cmd_list(cmd)
	return True
	except subprocess.CalledProcessError as exn:
	rc = exn.returncode

	self._output.extend(exn.stderr.splitlines())
	self._output.extend(exn.stdout.splitlines())
	self._log_test_failed(app, rc)
	return False

	def run(self, group, env=None, valgrind=False):
	"""
	Run this test.

	Basic output is printed to stdout, while detailed output is available
	in the self.output property after this function has been run. Return
	True if the return code matches self.expected_rc, and False otherwise.

	Arguments:
	group -- The name of the group this test is a part of, for logging purposes

	Keyword arguments:
	env -- If not None, a dict of values to be added to the test environment
	"""
	self._output = []

	cmd = apply_substitutions(self.cmd)
	app = cmd.split(" ")[0]

	test_id = "%s(%s)" % (app, group)
	print("* Running: %-31s - %s" % (test_id, self.desc))
	self._log_start_test()

	# Add any environment variables specified in Test.__init__
	if env is None:
	env = self._env
	else:
	env = env.update(self._env)

	with environ(env):
	# Run the setup hook, if any
	if not self._run_setup_teardown(self._setup, app):
	return False

	# Define basic arguments for all forms of running this test.
	kwargs = {"stdout": subprocess.PIPE, "stderr": subprocess.PIPE,
	"shell": True, "universal_newlines": True, "check": False}
	stdin_p = None

	# Handle the stdin= parameter.
	if isinstance(self._stdin, StdinCmd):
	stdin_p = self._stdin.run()
	kwargs["stdin"] = stdin_p.stdout
	elif isinstance(self._stdin, pathlib.Path):
	kwargs["input"] = self._stdin.read_text()
	else:
	kwargs["input"] = self._stdin

	if valgrind:
	cmd = "valgrind %s %s" % (" ".join(VALGRIND_ARGS), cmd)

	# Run the test command
	# We handle the "check" argument above in the kwargs dict.
	# pylint: disable-msg=subprocess-run-check
	cmd_p = subprocess.run(cmd, **kwargs)
	rc = cmd_p.returncode

	if stdin_p is not None:
	stdin_p.stdout.close()

	self._output.extend(cmd_p.stderr.splitlines())
	self._output.extend(cmd_p.stdout.splitlines())

	# Run the teardown hook, if any
	if not self._run_setup_teardown(self._teardown, app):
	return False

	if self.update_cib:
	self._output.append("=#=#=#= Current cib after: %s =#=#=#=" % self.desc)
	self._output.extend(current_cib().splitlines())

	self._validate_hook(rc, cmd_p.stdout, cmd_p.stderr, valgrind=valgrind)

	if rc == self.expected_rc:
	self._log_test_passed(app)
	return True

	self._log_test_failed(app, rc)
	return False


	class AclTest(Test):
	"""
	A Test subclass specialized for running certain ACL tests.

	Differences from the Test class:

	* Does not use the stdin= parameter.
	* Runs the setup and teardown hooks in an environment that also sets
	CIB_user=root, CIB_shadow="", and CIB_file to a temporary file.
	* The setup hooks should construct a new CIB and write it to that
	temporary file.
	* Prints the input CIB before running the test.
	"""

	def run(self, group, env=None, valgrind=False):
	"""
	Run this test.

	Basic output is printed to stdout, while detailed output is available
	in the self.output property after this function has been run. Return
	True if the return code matches self.expected_rc, and False otherwise.

	Arguments:
	group -- The name of the group this test is a part of, for logging purposes

	Keyword arguments:
	env -- If not None, a dict of values to be added to the test environment
	"""
	self._output = []

	cmd = apply_substitutions(self.cmd)
	app = cmd.split(" ")[0]

	test_id = "%s(%s)" % (app, group)
	print("* Running: %-31s - %s" % (test_id, self.desc))

	# Add any environment variables specified in Test.__init__
	if env is None:
	env = self._env
	else:
	env = env.update(self._env)

	with environ(env):
	with NamedTemporaryFile(prefix="cts-cli.cib.") as fp:
	fp.write(current_cib().encode())
	fp.flush()

	# Run the setup hook, if any. Typically, this is something that
	# modifies the existing CIB. We need to do these modifications
	# in a different environment from what the test will run in, since
	# the test may not have the permissions necessary to do the
	# modifications.
	with environ({"CIB_user": "root", "CIB_file": fp.name, "CIB_shadow": None}):
	if not self._run_setup_teardown(self._setup, app):
	return False

	# At the least, print the CIB that will be the test input.
	self._output.extend(current_cib().splitlines())

	# Note: This is positioned differently from where it is in Test.run.
	self._log_start_test()

	# Define basic arguments for running this test.
	kwargs = {"stdout": subprocess.PIPE, "stderr": subprocess.PIPE,
	"shell": True, "universal_newlines": True, "check": False}

	# Read in the potentially modified CIB as the stdin for the test.
	fp.seek(0)
	kwargs["input"] = fp.read().decode(encoding="utf-8")

	if valgrind:
	cmd = "valgrind %s %s" % (" ".join(VALGRIND_ARGS), cmd)

	# Run the test command
	# We handle the "check" argument above in the kwargs dict.
	# pylint: disable-msg=subprocess-run-check
	cmd_p = subprocess.run(cmd, **kwargs)
	rc = cmd_p.returncode

	self._output.extend(cmd_p.stderr.splitlines())
	self._output.extend(cmd_p.stdout.splitlines())

	# Run the teardown hook, if any
	with environ({"CIB_user": "root", "CIB_file": fp.name, "CIB_shadow": None}):
	if not self._run_setup_teardown(self._teardown, app):
	return False

	if self.update_cib:
	self._output.append("=#=#=#= Current cib after: %s =#=#=#=" % self.desc)
	self._output.extend(current_cib().splitlines())

	self._validate_hook(rc, cmd_p.stdout, cmd_p.stderr, valgrind=valgrind)

	if rc == self.expected_rc:
	self._log_test_passed(app)
	return True

	self._log_test_failed(app, rc)
	return False


	class ValidatingTest(Test):
	"""A Test subclass that additionally runs test results through xmllint."""

	format_args = "--output-as=xml"

	def __init__(self, desc, cmd, **kwargs):
	"""Create a new ValidatingTest instance."""
	Test.__init__(self, desc + " (XML)", cmd, **kwargs)

	def _validate_hook(self, rc, stdout, stderr, valgrind=False):
	"""Validate test output with xmllint."""
	# Do not validate if running under valgrind, even if told to do so. Valgrind
	# will output a lot more stuff that is not XML, so it wouldn't validate
	# anyway.
	if valgrind:
	return Test._validate_hook(self, rc, stdout, stderr, valgrind=valgrind)

	try:
	validate(stdout)
	# We only care about the return code from validation if there was an error,
	# which will be dealt with below. Here, we want to log the original return
	# code from the test itself.
	self._log_end_test(rc)
	return 0
	except XmlValidationError as e:
	self._output.append("=#=#=#= End test: %s - Failed to validate (%d) =#=#=#=" % (self.desc, e.exit_code))
	self._output.extend(e.output.splitlines())
	return e.exit_code


	class TestGroup:
	"""A base class for a group of related tests."""

	def __init__(self, tests, cib_gen=None, env=None, setup=None, teardown=None):
	"""
	Create a new TestGroup instance.

	Arguments:
	tests -- A list of Test instances

	Keyword arguments:
	cib_gen -- If not None, a function that generates a CIB file and returns the
	name of that CIB. This will be added to the test environment as
	CIB_file and used for all tests in this group. The file will then
	be deleted after all tests have been run.
	env -- If not None, a dict of values to be added to the test environment
	setup -- A command string, python function, or list of the previous
	types to run immediately before the test. This will be run in
	the same environment as cmd.
	teardown -- Like setup, but runs immediately after the tests
	"""
	self.tests = tests
	self._cib_gen = cib_gen
	self._env = env
	self._setup = setup
	self._teardown = teardown

	self._successes = None
	self._failures = None
	self._output = None

	@property
	def failures(self):
	"""Return the number of member tests that failed."""
	return self._failures

	@property
	def output(self):
	"""Return the test's detailed output."""
	return self._output

	@property
	def successes(self):
	"""Return the number of member tests that succeeded."""
	return self._successes

	def _run_setup_teardown(self, cmd):
	"""
	Run any setup or teardown command required by this test group.

	On success (or if no command is present), return True. On failure,
	return False and log the stdout/stderr of the command for debugging.

	Arguments:
	cmd -- The setup/teardown command(s) to run
	"""
	try:
	run_cmd_list(cmd)
	return True
	except subprocess.CalledProcessError as exn:
	self._output.extend(exn.stderr.splitlines())
	self._output.extend(exn.stdout.splitlines())
	return False

	def run(self, group, valgrind=False):
	"""
	Run all Test instances that are a part of this regression test.

	Additionally, record their stdout and stderr in the self.output property
	and the total number of tests that passed and failed.

	Arguments:
	group -- The name of the group this test is a part of, for logging purposes
	"""
	self._failures = 0
	self._successes = 0
	self._output = []

	cib_file = None

	with environ(self._env):
	# If we were given a way to generate a CIB, do that now and add it to the
	# environment.
	if self._cib_gen is not None:
	cib_file = self._cib_gen()
	os.environ.update({"CIB_file": cib_file})

	# Run the setup hook, if any
	if not self._run_setup_teardown(self._setup):
	return False

	# Run the tests
	for t in self.tests:
	rc = t.run(group, valgrind=valgrind)

	if isinstance(t, TestGroup):
	self._successes += t.successes
	self._failures += t.failures
	else:
	if rc:
	self._successes += 1
	else:
	self._failures += 1

	self._output.extend(t.output)

	if cib_file is not None:
	os.environ.pop("CIB_file")
	os.unlink(cib_file)

	# Run the teardown hook, if any
	if self._run_setup_teardown(self._teardown):
	return False

	return True


	class ShadowTestGroup(TestGroup):
	"""A group of related tests that require a shadow CIB."""

	def __init__(self, tests, **kwargs):
	"""
	Create a new ShadowTestGroup instance.

	Arguments:
	tests -- A list of Test instances

	Keyword arguments:
	create -- If True, create a shadow CIB file (see create_empty).
	Otherwise, just create a temp directory and set environment
	variables.
	create_empty -- If True, the shadow CIB will be empty. Otherwise, the
	shadow CIB will be a copy of the currently active
	cluster configuration.
	validate_with -- If not None, the schema version to validate the CIB
	against
	"""
	self._create = kwargs.pop("create", True)
	self._create_empty = kwargs.pop("create_empty", True)
	self._validate_with = kwargs.pop("validate_with", None)
	TestGroup.__init__(self, tests, **kwargs)

	def run(self, group, valgrind=False):
	"""
	Run all Test instances that are a part of this regression test.

	Additionally, record their stdout and stderr in the self.output property
	and the total number of tests that passed and failed.

	Arguments:
	group -- The name of the group this test is a part of, for logging purposes
	"""
	with TemporaryDirectory(prefix="cts-cli.shadow.") as shadow_dir:
	if self._create:
	create_shadow_cib(shadow_dir, create_empty=self._create_empty,
	validate_with=self._validate_with, valgrind=valgrind)
	else:
	os.environ["CIB_shadow_dir"] = shadow_dir
	os.environ["CIB_shadow"] = SHADOW_NAME

	rc = TestGroup.run(self, group, valgrind=valgrind)

	if self._create:
	cleanup_shadow_dir()

	os.environ.pop("CIB_shadow_dir")
	os.environ.pop("CIB_shadow")
	return rc


	class RegressionTest:
	"""A base class for testing a single command line tool."""

	def __init__(self):
	"""Create a new RegressionTest instance."""
	self._identical = None
	self._successes = None
	self._failures = None

	self._tempfile = None
	self._output = None

	@property
	def failures(self):
	"""Return the number of member tests that failed."""
	return self._failures

	@property
	def identical(self):
	"""Return whether the expected output matches the actual output."""
	return self._identical

	@property
	def name(self):
	"""
	Return the name of this regression test.

	This should be a unique, very short, single word name without any special
	characters. It must match the name of some word in the default_tests
	list because it may be given with the -r option on the command line
	to select only certain tests to run.

	All subclasses must define this property.
	"""
	raise NotImplementedError

	@property
	def results_file(self):
	"""Return the location where the regression test results are stored."""
	return self._tempfile

	@property
	def successes(self):
	"""Return the number of member tests that succeeded."""
	return self._successes

	@property
	def summary(self):
	"""Return a list of all Passed/Failed lines for tests in this regression test."""
	retval = []

	for line in self._output:
	if line.startswith("* Failed") or line.startswith("* Passed"):
	retval.append(line)

	return retval

	@property
	def tests(self):
	"""A list of Test and TestGroup instances to be run as part of this regression test."""
	return []

	def cleanup(self):
	"""Remove the temp file where test output is stored."""
	os.remove(self._tempfile)
	self._tempfile = None

	def diff(self, verbose=False):
	"""
	Compare the results of this regression test to the expected results.

	Arguments:
	verbose -- If True, the diff will be written to stdout
	"""
	args = ["diff", "-wu", "%s/cli/regression.%s.exp" % (test_home, self.name), self.results_file]

	try:
	if verbose:
	subprocess.run(args, check=True)
	else:
	subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
	check=True)

	self._identical = True
	except subprocess.CalledProcessError:
	self._identical = False

	def process_results(self, verbose):
	"""If actual output differs from expected output, print the actual output."""
	if self.identical:
	self.cleanup()
	return

	print(" %s" % self.results_file)

	if verbose:
	print("======================================================")
	with open(self.results_file, encoding="utf-8") as f:
	print(f.read())
	print("======================================================")

	def run(self, valgrind=False):
	"""
	Run all Test and TestGroup instances that are a part of this regression test.

	Additionally, record their stdout and stderr in the self.output property
	and the total number of tests that passed and failed.
	"""
	self._failures = 0
	self._successes = 0
	self._output = []

	for t in self.tests:
	rc = t.run(self.name, valgrind=valgrind)

	if isinstance(t, TestGroup):
	self._successes += t.successes
	self._failures += t.failures
	else:
	if rc:
	self._successes += 1
	else:
	self._failures += 1

	self._output.extend(t.output)

	self._output = sanitize_output(self._output)

	def write(self):
	"""
	Write test results to a temporary file and set self.results to its location.

	If self.run() has not yet been called, or there is otherwise no output,
	self.results will be None
	"""
	if not self._output:
	self._tempfile = None
	return

	s = "\n".join(self._output).encode()
	s += b"\n"

	(fp, self._tempfile) = mkstemp(prefix="cts-cli.%s." % self.name)
	os.write(fp, s)
	os.close(fp)


	class AccessRenderRegressionTest(RegressionTest):
	"""A class for testing rendering of ACLs."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "access_render"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	acl_cib = """
	<acls>
	<acl_role id="role-deny-acls-write-resources">
	<acl_permission id="deny-acls" kind="deny" xpath="/cib/configuration/acls"/>
	<acl_permission id="write-resources" kind="write"
	xpath="/cib/configuration/resources"/>
	<acl_permission id="read-rest" kind="read" xpath="/cib"/>
	</acl_role>
	<acl_target id="tony">
	<role id="role-deny-acls-write-resources"/>
	</acl_target>
	</acls>
	"""

	# Create a test CIB that has ACL roles
	basic_tests = [
	Test("Configure some ACLs", "cibadmin -M -o acls -p", update_cib=True,
	stdin=acl_cib),
	Test("Enable ACLs", "crm_attribute -n enable-acl -v true",
	update_cib=True),
	# Run cibadmin --show-access on the test CIB as an ACL-restricted user
	Test("An instance of ACLs render (into color)",
	"cibadmin --force --show-access=color -Q --user tony"),
	Test("An instance of ACLs render (into namespacing)",
	"cibadmin --force --show-access=namespace -Q --user tony"),
	Test("An instance of ACLs render (into text)",
	"cibadmin --force --show-access=text -Q --user tony"),
	]

	return [
	ShadowTestGroup(basic_tests),
	]


	class DaemonsRegressionTest(RegressionTest):
	"""A class for testing command line options of pacemaker daemons."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "daemons"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	return [
	Test("Get CIB manager metadata", "pacemaker-based metadata"),
	Test("Get controller metadata", "pacemaker-controld metadata"),
	Test("Get fencer metadata", "pacemaker-fenced metadata"),
	Test("Get scheduler metadata", "pacemaker-schedulerd metadata"),
	]


	class DatesRegressionTest(RegressionTest):
	"""A class for testing handling of ISO8601 dates."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "dates"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	invalid_periods = [
	"",
	"2019-01-01 00:00:00Z", # Start with no end
	"2019-01-01 00:00:00Z/", # Start with only a trailing slash
	"PT2S/P1M", # Two durations
	"2019-13-01 00:00:00Z/P1M", # Out-of-range month
	"20191077T15/P1M", # Out-of-range day
	"2019-10-01T25:00:00Z/P1M", # Out-of-range hour
	"2019-10-01T24:00:01Z/P1M", # Hour 24 with anything but :00:00
	"PT5H/20191001T007000Z", # Out-of-range minute
	"2019-10-01 00:00:80Z/P1M", # Out-of-range second
	"2019-10-01 00:00:10 +25:00/P1M", # Out-of-range offset hour
	"20191001T000010 -00:61/P1M", # Out-of-range offset minute
	"P1Y/2019-02-29 00:00:00Z", # Feb. 29 in non-leap-year
	"2019-01-01 00:00:00Z/P", # Duration with no values
	"P1Z/2019-02-20 00:00:00Z", # Invalid duration unit
	"P1YM/2019-02-20 00:00:00Z", # No number for duration unit
	]

	# Ensure invalid period specifications are rejected
	invalid_period_tests = []
	for p in invalid_periods:
	invalid_period_tests.append(Test("Invalid period - [%s]" % p,
	"iso8601 -p '%s'" % p,
	expected_rc=ExitStatus.INVALID_PARAM))

	year_tests = []
	for y in ["06", "07", "08", "09", "10", "11", "12", "13", "14", "15", "16", "17", "18", "40"]:
	year_tests.extend([
	Test("20%s-W01-7" % y,
	"iso8601 -d '20%s-W01-7 00Z'" % y),
	Test("20%s-W01-7 - round-trip" % y,
	"iso8601 -d '20%s-W01-7 00Z' -W -E '20%s-W01-7 00:00:00Z'" % (y, y)),
	Test("20%s-W01-1" % y,
	"iso8601 -d '20%s-W01-1 00Z'" % y),
	Test("20%s-W01-1 - round-trip" % y,
	"iso8601 -d '20%s-W01-1 00Z' -W -E '20%s-W01-1 00:00:00Z'" % (y, y))
	])

	return invalid_period_tests + [
	make_test_group("'2005-040/2005-043' period", "iso8601 {fmt} -p '2005-040/2005-043'",
	[Test, ValidatingTest]),
	Test("2014-01-01 00:30:00 - 1 Hour",
	"iso8601 -d '2014-01-01 00:30:00Z' -D P-1H -E '2013-12-31 23:30:00Z'"),
	Test("Valid date - Feb 29 in leap year",
	"iso8601 -d '2020-02-29 00:00:00Z' -E '2020-02-29 00:00:00Z'"),
	Test("Valid date - using 'T' and offset",
	"iso8601 -d '20191201T131211 -05:00' -E '2019-12-01 18:12:11Z'"),
	Test("24:00:00 equivalent to 00:00:00 of next day",
	"iso8601 -d '2019-12-31 24:00:00Z' -E '2020-01-01 00:00:00Z'"),
	] + year_tests + [
	make_test_group("2009-W53-07",
	"iso8601 {fmt} -d '2009-W53-7 00:00:00Z' -W -E '2009-W53-7 00:00:00Z'",
	[Test, ValidatingTest]),
	Test("epoch + 2 Years 5 Months 6 Minutes",
	"iso8601 -d 'epoch' -D P2Y5MT6M -E '1972-06-01 00:06:00Z'"),
	Test("2009-01-31 + 1 Month",
	"iso8601 -d '20090131T000000Z' -D P1M -E '2009-02-28 00:00:00Z'"),
	Test("2009-01-31 + 2 Months",
	"iso8601 -d '2009-01-31 00:00:00Z' -D P2M -E '2009-03-31 00:00:00Z'"),
	Test("2009-01-31 + 3 Months",
	"iso8601 -d '2009-01-31 00:00:00Z' -D P3M -E '2009-04-30 00:00:00Z'"),
	make_test_group("2009-03-31 - 1 Month",
	"iso8601 {fmt} -d '2009-03-31 01:00:00 +01:00' -D P-1M -E '2009-02-28 00:00:00Z'",
	[Test, ValidatingTest]),
	make_test_group("2038-01-01 + 3 Months",
	"iso8601 {fmt} -d '2038-01-01 00:00:00Z' -D P3M -E '2038-04-01 00:00:00Z'",
	[Test, ValidatingTest]),
	]


	class ErrorCodeRegressionTest(RegressionTest):
	"""A class for testing error code reporting."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "error_codes"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	# Legacy return codes
	#
	# Don't test unknown legacy code. FreeBSD includes a colon in strerror(),
	# while other distros do not.
	legacy_tests = [
	make_test_group("Get legacy return code", "crm_error {fmt} 201",
	[Test, ValidatingTest]),
	make_test_group("Get legacy return code (with name)", "crm_error -n {fmt} 201",
	[Test, ValidatingTest]),
	make_test_group("Get multiple legacy return codes", "crm_error {fmt} 201 202",
	[Test, ValidatingTest]),
	make_test_group("Get multiple legacy return codes (with names)",
	"crm_error -n {fmt} 201 202",
	[Test, ValidatingTest]),
	# We can only rely on our custom codes, so we'll spot-check codes 201-209
	Test("List legacy return codes (spot check)",
	"crm_error -l \| grep 20[1-9]"),
	ValidatingTest("List legacy return codes (spot check)",
	"crm_error -l --output-as=xml \| grep -Ev '<result-code.*code=\"([^2]\|2[^0]\|20[^1-9])'"),
	Test("List legacy return codes (spot check) (with names)",
	"crm_error -n -l \| grep 20[1-9]"),
	ValidatingTest("List legacy return codes (spot check) (with names)",
	"crm_error -n -l --output-as=xml \| grep -Ev '<result-code.*code=\"([^2]\|2[^0]\|20[^1-9])'"),
	]

	# Standard Pacemaker return codes
	#
	# Don't test positive (system) error codes, which may vary by OS
	standard_tests = [
	make_test_group("Get unknown Pacemaker return code", "crm_error -r {fmt} -- -10000",
	[Test, ValidatingTest]),
	make_test_group("Get unknown Pacemaker return code (with name)",
	"crm_error -n -r {fmt} -- -10000",
	[Test, ValidatingTest]),
	# Negative return codes require parsing out the "--" explicitly, so we need
	# to test them as a separate case
	make_test_group("Get negative Pacemaker return code", "crm_error -r {fmt} -- -1005",
	[Test, ValidatingTest]),
	# Testing name lookups for negative return codes only is sufficient
	make_test_group("Get negative Pacemaker return code (with name)",
	"crm_error -n -r {fmt} -- -1005",
	[Test, ValidatingTest]),
	# We can only rely on our custom codes (negative and zero)
	Test("List Pacemaker return codes (non-positive)",
	"crm_error -l -r \| grep -E '^[[:blank:]]*(-[[:digit:]]+\|0):'"),
	ValidatingTest("List Pacemaker return codes (non-positive)",
	"crm_error -l -r --output-as=xml \| grep -E -v '<result-code.*code=\"[[:digit:]]'"),
	Test("List Pacemaker return codes (non-positive) (with names)",
	"crm_error -n -l -r \| grep -E '^[[:blank:]]*(-[[:digit:]]+\|0):'"),
	ValidatingTest("List Pacemaker return codes (non-positive) (with names)",
	"crm_error -n -l -r --output-as=xml \| grep -E -v '<result-code.*code=\"[[:digit:]]'"),
	]

	# crm_exit_t exit codes
	crm_exit_t_tests = [
	make_test_group("Get unknown crm_exit_t exit code", "crm_error -X {fmt} -- -10000",
	[Test, ValidatingTest]),
	make_test_group("Get unknown crm_exit_t exit code (with name)",
	"crm_error -n -X {fmt} -- -10000",
	[Test, ValidatingTest]),
	make_test_group("Get crm_exit_t exit code", "crm_error -X {fmt} 1",
	[Test, ValidatingTest]),
	make_test_group("Get crm_exit_t exit code (with name)",
	"crm_error -n -X {fmt} 1",
	[Test, ValidatingTest]),
	make_test_group("Get all crm_exit_t exit codes", "crm_error -l -X {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Get all crm_exit_t exit codes (with name)",
	"crm_error -l -n -X {fmt}",
	[Test, ValidatingTest]),
	]

	return legacy_tests + standard_tests + crm_exit_t_tests


	class CibadminRegressionTest(RegressionTest):
	"""A class for testing cibadmin."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "cibadmin"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	basic_tests = [
	Test("Validate CIB", "cibadmin -Q", update_cib=True),
	Test("Digest calculation", "cibadmin -Q \| cibadmin -5 -p 2>&1"),
	Test("Require --force for CIB erasure", "cibadmin -E",
	expected_rc=ExitStatus.UNSAFE, update_cib=True),
	Test("Allow CIB erasure with --force", "cibadmin -E --force"),
	# Verify the output after erasure
	Test("Query CIB", "cibadmin -Q",
	setup=delete_shadow_resource_defaults,
	update_cib=True),
	]

	# Add some stuff to the empty CIB so we know that erasing it did something.
	basic_tests_setup = [
	"""cibadmin -C -o nodes --xml-text '<node id="node1" uname="node1"/>'""",
	"""cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/></cluster_property_set>'""",
	"""cibadmin -C -o resources --xml-text '<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />'"""
	]

	return [
	ShadowTestGroup(basic_tests, setup=basic_tests_setup),
	]


	class CrmAttributeRegressionTest(RegressionTest):
	"""A class for testing crm_attribute."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crm_attribute"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	options_tests = [
	make_test_group("List all available options (invalid type)",
	"crm_attribute --list-options=asdf {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.USAGE),
	make_test_group("List non-advanced cluster options",
	"crm_attribute --list-options=cluster {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List all available cluster options",
	"crm_attribute --list-options=cluster --all {fmt}",
	[Test, ValidatingTest]),
	Test("Return usage error if both -p and OCF_RESOURCE_INSTANCE are empty strings",
	"crm_attribute -N cluster01 -p '' -G",
	expected_rc=ExitStatus.USAGE),
	]

	value_update_tests = [
	Test("Query the value of an attribute that does not exist",
	"crm_attribute -n ABCD --query --quiet",
	expected_rc=ExitStatus.NOSUCH),
	Test("Configure something before erasing",
	"crm_attribute -n test_attr -v 5", update_cib=True),
	Test("Test '++' XML attribute update syntax",
	"""cibadmin -M --score --xml-text='<cib admin_epoch="admin_epoch++"/>'""",
	update_cib=True),
	Test("Test '+=' XML attribute update syntax",
	"""cibadmin -M --score --xml-text='<cib admin_epoch="admin_epoch+=2"/>'""",
	update_cib=True),
	make_test_group("Test '++' nvpair value update syntax",
	"crm_attribute -n test_attr -v 'value++' --score {fmt}",
	[Test, ValidatingTest], update_cib=True),
	make_test_group("Test '+=' nvpair value update syntax",
	"crm_attribute -n test_attr -v 'value+=2' --score {fmt}",
	[Test, ValidatingTest], update_cib=True),
	Test("Test '++' XML attribute update syntax (--score not set)",
	"""cibadmin -M --xml-text='<cib admin_epoch="admin_epoch++"/>'""",
	update_cib=True),
	Test("Test '+=' XML attribute update syntax (--score not set)",
	"""cibadmin -M --xml-text='<cib admin_epoch="admin_epoch+=2"/>'""",
	update_cib=True),
	make_test_group("Test '++' nvpair value update syntax (--score not set)",
	"crm_attribute -n test_attr -v 'value++' {fmt}",
	[Test, ValidatingTest], update_cib=True),
	make_test_group("Test '+=' nvpair value update syntax (--score not set)",
	"crm_attribute -n test_attr -v 'value+=2' {fmt}",
	[Test, ValidatingTest], update_cib=True),
	]

	query_set_tests = [
	Test("Set cluster option", "crm_attribute -n cluster-delay -v 60s",
	update_cib=True),
	Test("Query new cluster option",
	"cibadmin -Q -o crm_config \| grep cib-bootstrap-options-cluster-delay"),
	Test("Set no-quorum policy",
	"crm_attribute -n no-quorum-policy -v ignore", update_cib=True),
	Test("Delete nvpair",
	"""cibadmin -D -o crm_config --xml-text '<nvpair id="cib-bootstrap-options-cluster-delay"/>'""",
	update_cib=True),
	Test("Create operation should fail",
	"""cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-no-quorum-policy" name="no-quorum-policy" value="ignore"/></cluster_property_set>'""",
	expected_rc=ExitStatus.EXISTS, update_cib=True),
	Test("Modify cluster options section",
	"""cibadmin -M -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-cluster-delay" name="cluster-delay" value="60s"/></cluster_property_set>'""",
	update_cib=True),
	Test("Query updated cluster option",
	"cibadmin -Q -o crm_config \| grep cib-bootstrap-options-cluster-delay",
	update_cib=True),
	Test("Set duplicate cluster option",
	"crm_attribute -n cluster-delay -v 40s -s duplicate",
	update_cib=True),
	Test("Setting multiply defined cluster option should fail",
	"crm_attribute -n cluster-delay -v 30s",
	expected_rc=ExitStatus.MULTIPLE, update_cib=True),
	Test("Set cluster option with -s",
	"crm_attribute -n cluster-delay -v 30s -s duplicate",
	update_cib=True),
	Test("Delete cluster option with -i",
	"crm_attribute -n cluster-delay -D -i cib-bootstrap-options-cluster-delay",
	update_cib=True),
	Test("Create node1 and bring it online",
	"crm_simulate --live-check --in-place --node-up=node1",
	update_cib=True),
	Test("Create node attribute",
	"crm_attribute -n ram -v 1024M -N node1 -t nodes",
	update_cib=True),
	Test("Query new node attribute",
	"cibadmin -Q -o nodes \| grep node1-ram",
	update_cib=True),
	Test("Create second node attribute",
	"crm_attribute -n rattr -v XYZ -N node1 -t nodes",
	update_cib=True),
	Test("Query node attributes by pattern",
	"crm_attribute -t nodes -P 'ra.*' -N node1 --query"),
	Test("Update node attributes by pattern",
	"crm_attribute -t nodes -P 'rat.*' -N node1 -v 10",
	update_cib=True),
	Test("Delete node attributes by pattern",
	"crm_attribute -t nodes -P 'rat.*' -N node1 -D",
	update_cib=True),
	Test("Set a transient (fail-count) node attribute",
	"crm_attribute -n fail-count-foo -v 3 -N node1 -t status",
	update_cib=True),
	Test("Query a fail count", "crm_failcount --query -r foo -N node1",
	update_cib=True),
	Test("Show node attributes with crm_simulate",
	"crm_simulate --live-check --show-attrs"),
	Test("Set a second transient node attribute",
	"crm_attribute -n fail-count-bar -v 5 -N node1 -t status",
	update_cib=True),
	Test("Query transient node attributes by pattern",
	"crm_attribute -t status -P fail-count -N node1 --query"),
	Test("Update transient node attributes by pattern",
	"crm_attribute -t status -P fail-count -N node1 -v 10",
	update_cib=True),
	Test("Delete transient node attributes by pattern",
	"crm_attribute -t status -P fail-count -N node1 -D",
	update_cib=True),
	Test("crm_attribute given invalid delete usage",
	"crm_attribute -t nodes -N node1 -D",
	expected_rc=ExitStatus.USAGE),
	Test("Set a utilization node attribute",
	"crm_attribute -n cpu -v 1 -N node1 -z",
	update_cib=True),
	Test("Query utilization node attribute",
	"crm_attribute --query -n cpu -N node1 -z"),
	# This update will fail because it has version numbers
	Test("Replace operation should fail",
	"""cibadmin -Q \| sed -e 's/epoch="[^"]*"/epoch="1"/' \| cibadmin -R -p""",
	expected_rc=ExitStatus.OLD),
	]

	promotable_tests = [
	make_test_group("Query a nonexistent promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -G {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	make_test_group("Delete a nonexistent promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -D {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Query after deleting a nonexistent promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -G {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	make_test_group("Update a nonexistent promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -v 1 {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Query after updating a nonexistent promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -G {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Update an existing promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -v 5 {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Query after updating an existing promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -G {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Delete an existing promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -D {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Query after deleting an existing promotable score attribute",
	"crm_attribute -N cluster01 -p promotable-rsc -G {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	]

	# Test for an issue with legacy command line parsing when the resource is
	# specified in the environment (CLBZ#5509)
	ocf_rsc_instance_tests = [
	make_test_group("Update a promotable score attribute to -INFINITY",
	"crm_attribute -N cluster01 -p -v -INFINITY {fmt}",
	[Test, ValidatingTest],
	env={"OCF_RESOURCE_INSTANCE": "promotable-rsc"}),
	make_test_group("Query after updating a promotable score attribute to -INFINITY",
	"crm_attribute -N cluster01 -p -G {fmt}",
	[Test, ValidatingTest],
	env={"OCF_RESOURCE_INSTANCE": "promotable-rsc"}),
	Test("Try OCF_RESOURCE_INSTANCE if -p is specified with an empty string",
	"crm_attribute -N cluster01 -p '' -G",
	env={"OCF_RESOURCE_INSTANCE": "promotable-rsc"}),
	]

	return options_tests + [
	ShadowTestGroup(value_update_tests),
	ShadowTestGroup(query_set_tests),
	TestGroup(promotable_tests + ocf_rsc_instance_tests,
	env={"OCF_RESOURCE_INSTANCE": "promotable-rsc"},
	cib_gen=partial(copy_existing_cib, "{cts_cli_data}/crm_mon.xml")),
	]


	class CrmStandbyRegressionTest(RegressionTest):
	"""A class for testing crm_standby."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crm_standby"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	basic_tests = [
	Test("Default standby value", "crm_standby -N node1 -G"),
	Test("Set standby status", "crm_standby -N node1 -v true",
	update_cib=True),
	Test("Query standby value", "crm_standby -N node1 -G"),
	Test("Delete standby value", "crm_standby -N node1 -D",
	update_cib=True),
	]

	return [
	ShadowTestGroup(basic_tests,
	setup="""cibadmin -C -o nodes --xml-text '<node id="node1" uname="node1"/>'"""),
	]


	class CrmResourceRegressionTest(RegressionTest):
	"""A class for testing crm_resource."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crm_resource"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	options_tests = [
	Test("crm_resource run with extra arguments", "crm_resource foo bar",
	expected_rc=ExitStatus.USAGE),
	Test("List all available resource options (invalid type)",
	"crm_resource --list-options=asdf",
	expected_rc=ExitStatus.USAGE),
	Test("List all available resource options (invalid type)",
	"crm_resource --list-options=asdf --output-as=xml",
	expected_rc=ExitStatus.USAGE),
	make_test_group("List non-advanced primitive meta-attributes",
	"crm_resource --list-options=primitive {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List all available primitive meta-attributes",
	"crm_resource --list-options=primitive --all {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List non-advanced fencing parameters",
	"crm_resource --list-options=fencing {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List all available fencing parameters",
	"crm_resource --list-options=fencing --all {fmt}",
	[Test, ValidatingTest]),
	]

	basic_tests = [
	Test("Create a resource",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	update_cib=True),
	Test("crm_resource given both -r and resource config",
	"crm_resource -r xyz --class ocf --provider pacemaker --agent Dummy",
	expected_rc=ExitStatus.USAGE),
	Test("crm_resource given resource config with invalid action",
	"crm_resource --class ocf --provider pacemaker --agent Dummy -D",
	expected_rc=ExitStatus.USAGE),
	Test("Create a resource meta attribute",
	"crm_resource -r dummy --meta -p is-managed -v false",
	update_cib=True),
	Test("Query a resource meta attribute",
	"crm_resource -r dummy --meta -g is-managed",
	update_cib=True),
	Test("Remove a resource meta attribute",
	"crm_resource -r dummy --meta -d is-managed",
	update_cib=True),
	ValidatingTest("Create another resource meta attribute",
	"crm_resource -r dummy --meta -p target-role -v Stopped --output-as=xml"),
	ValidatingTest("Show why a resource is not running",
	"crm_resource -Y -r dummy --output-as=xml"),
	ValidatingTest("Remove another resource meta attribute",
	"crm_resource -r dummy --meta -d target-role --output-as=xml"),
	ValidatingTest("Get a non-existent attribute from a resource element",
	"crm_resource -r dummy --get-parameter nonexistent --element --output-as=xml"),
	make_test_group("Get a non-existent attribute from a resource element",
	"crm_resource -r dummy --get-parameter nonexistent --element {fmt}",
	[Test, ValidatingTest], update_cib=True),
	Test("Get an existent attribute from a resource element",
	"crm_resource -r dummy --get-parameter class --element",
	update_cib=True),
	ValidatingTest("Set a non-existent attribute for a resource element",
	"crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml",
	update_cib=True),
	ValidatingTest("Set an existent attribute for a resource element",
	"crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml",
	update_cib=True),
	ValidatingTest("Delete an existent attribute for a resource element",
	"crm_resource -r dummy -d description --element --output-as=xml",
	update_cib=True),
	ValidatingTest("Delete a non-existent attribute for a resource element",
	"crm_resource -r dummy -d description --element --output-as=xml",
	update_cib=True),
	Test("Set a non-existent attribute for a resource element",
	"crm_resource -r dummy --set-parameter=description -v test_description --element",
	update_cib=True),
	Test("Set an existent attribute for a resource element",
	"crm_resource -r dummy --set-parameter=description -v test_description --element",
	update_cib=True),
	Test("Delete an existent attribute for a resource element",
	"crm_resource -r dummy -d description --element",
	update_cib=True),
	Test("Delete a non-existent attribute for a resource element",
	"crm_resource -r dummy -d description --element",
	update_cib=True),
	Test("Create a resource attribute", "crm_resource -r dummy -p delay -v 10s",
	update_cib=True),
	make_test_group("List the configured resources", "crm_resource -L {fmt}",
	[Test, ValidatingTest], update_cib=True),
	Test("Implicitly list the configured resources", "crm_resource"),
	Test("List IDs of instantiated resources", "crm_resource -l"),
	make_test_group("Show XML configuration of resource", "crm_resource -q -r dummy {fmt}",
	[Test, ValidatingTest]),
	Test("Require a destination when migrating a resource that is stopped",
	"crm_resource -r dummy -M",
	update_cib=True, expected_rc=ExitStatus.USAGE),
	Test("Don't support migration to non-existent locations",
	"crm_resource -r dummy -M -N i.do.not.exist",
	update_cib=True, expected_rc=ExitStatus.NOSUCH),
	Test("Create a fencing resource",
	"""cibadmin -C -o resources --xml-text '<primitive id="Fence" class="stonith" type="fence_true"/>'""",
	update_cib=True),
	Test("Bring resources online", "crm_simulate --live-check --in-place",
	update_cib=True),
	Test("Try to move a resource to its existing location",
	"crm_resource -r dummy --move --node node1",
	update_cib=True, expected_rc=ExitStatus.EXISTS),
	Test("Try to move a resource that doesn't exist",
	"crm_resource -r xyz --move --node node1",
	expected_rc=ExitStatus.NOSUCH),
	Test("Move a resource from its existing location",
	"crm_resource -r dummy --move",
	update_cib=True),
	Test("Clear out constraints generated by --move",
	"crm_resource -r dummy --clear",
	update_cib=True),
	Test("Ban a resource on unknown node",
	"crm_resource -r dummy -B -N host1",
	expected_rc=ExitStatus.NOSUCH),
	Test("Create two more nodes and bring them online",
	"crm_simulate --live-check --in-place --node-up=node2 --node-up=node3",
	update_cib=True),
	Test("Ban dummy from node1", "crm_resource -r dummy -B -N node1",
	update_cib=True),
	Test("Show where a resource is running", "crm_resource -r dummy -W"),
	Test("Show constraints on a resource", "crm_resource -a -r dummy"),
	ValidatingTest("Ban dummy from node2",
	"crm_resource -r dummy -B -N node2 --output-as=xml",
	update_cib=True),
	Test("Relocate resources due to ban",
	"crm_simulate --live-check --in-place -S",
	update_cib=True),
	ValidatingTest("Move dummy to node1",
	"crm_resource -r dummy -M -N node1 --output-as=xml",
	update_cib=True),
	Test("Clear implicit constraints for dummy on node2",
	"crm_resource -r dummy -U -N node2",
	update_cib=True),
	Test("Drop the status section",
	"cibadmin -R -o status --xml-text '<status/>'"),
	Test("Create a clone",
	"""cibadmin -C -o resources --xml-text '<clone id="test-clone"><primitive id="test-primitive" class="ocf" provider="pacemaker" type="Dummy"/></clone>'"""),
	Test("Create a resource meta attribute",
	"crm_resource -r test-primitive --meta -p is-managed -v false",
	update_cib=True),
	Test("Create a resource meta attribute in the primitive",
	"crm_resource -r test-primitive --meta -p is-managed -v false --force",
	update_cib=True),
	Test("Update resource meta attribute with duplicates",
	"crm_resource -r test-clone --meta -p is-managed -v true",
	update_cib=True),
	Test("Update resource meta attribute with duplicates (force clone)",
	"crm_resource -r test-clone --meta -p is-managed -v true --force",
	update_cib=True),
	Test("Update child resource meta attribute with duplicates",
	"crm_resource -r test-primitive --meta -p is-managed -v false",
	update_cib=True),
	Test("Delete resource meta attribute with duplicates",
	"crm_resource -r test-clone --meta -d is-managed",
	update_cib=True),
	Test("Delete resource meta attribute in parent",
	"crm_resource -r test-primitive --meta -d is-managed",
	update_cib=True),
	Test("Create a resource meta attribute in the primitive",
	"crm_resource -r test-primitive --meta -p is-managed -v false --force",
	update_cib=True),
	Test("Update existing resource meta attribute",
	"crm_resource -r test-clone --meta -p is-managed -v true",
	update_cib=True),
	Test("Create a resource meta attribute in the parent",
	"crm_resource -r test-clone --meta -p is-managed -v true --force",
	update_cib=True),
	Test("Delete resource parent meta attribute (force)",
	"crm_resource -r test-clone --meta -d is-managed --force",
	update_cib=True),
	# Restore meta-attributes before running this test
	Test("Delete resource child meta attribute",
	"crm_resource -r test-primitive --meta -d is-managed",
	setup=["crm_resource -r test-primitive --meta -p is-managed -v true --force",
	"crm_resource -r test-clone --meta -p is-managed -v true --force"],
	update_cib=True),
	Test("Create the dummy-group resource group",
	"""cibadmin -C -o resources --xml-text '<group id="dummy-group">"""
	"""<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>"""
	"""<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>"""
	"""</group>'""",
	update_cib=True),
	Test("Create a resource meta attribute in dummy1",
	"crm_resource -r dummy1 --meta -p is-managed -v true",
	update_cib=True),
	Test("Create a resource meta attribute in dummy-group",
	"crm_resource -r dummy-group --meta -p is-managed -v false",
	update_cib=True),
	Test("Delete the dummy-group resource group",
	"cibadmin -D -o resources --xml-text '<group id=\"dummy-group\"/>'",
	update_cib=True),
	Test("Specify a lifetime when moving a resource",
	"crm_resource -r dummy --move --node node2 --lifetime=PT1H",
	update_cib=True),
	Test("Try to move a resource previously moved with a lifetime",
	"crm_resource -r dummy --move --node node1",
	update_cib=True),
	Test("Ban dummy from node1 for a short time",
	"crm_resource -r dummy -B -N node1 --lifetime=PT1S",
	update_cib=True),
	Test("Remove expired constraints",
	"sleep 2 && crm_resource --clear --expired",
	update_cib=True),
	# Clear has already been tested elsewhere, but we need to get rid of the
	# constraints so testing delete works. It won't delete if there's still
	# a reference to the resource somewhere.
	Test("Clear all implicit constraints for dummy",
	"crm_resource -r dummy -U",
	update_cib=True),
	Test("Set a node health strategy",
	"crm_attribute -n node-health-strategy -v migrate-on-red",
	update_cib=True),
	Test("Set a node health attribute",
	"crm_attribute -N node3 -n '#health-cts-cli' -v red",
	update_cib=True),
	ValidatingTest("Show why a resource is not running on an unhealthy node",
	"crm_resource -N node3 -Y -r dummy --output-as=xml"),
	Test("Delete a resource",
	"crm_resource -D -r dummy -t primitive",
	update_cib=True),
	]

	constraint_tests = []
	for rsc in ["prim1", "prim2", "prim3", "prim4", "prim5", "prim6", "prim7",
	"prim8", "prim9", "prim10", "prim11", "prim12", "prim13",
	"group", "clone"]:
	constraint_tests.extend([
	make_test_group("Check locations and constraints for %s" % rsc,
	"crm_resource -a -r %s {fmt}" % rsc,
	[Test, ValidatingTest]),
	make_test_group("Recursively check locations and constraints for %s" % rsc,
	"crm_resource -A -r %s {fmt}" % rsc,
	[Test, ValidatingTest]),
	])

	constraint_tests.extend([
	Test("Check locations and constraints for group member (referring to group)",
	"crm_resource -a -r gr2"),
	Test("Check locations and constraints for group member (without referring to group)",
	"crm_resource -a -r gr2 --force"),
	])

	colocation_tests = [
	ValidatingTest("Set a meta-attribute for primitive and resources colocated with it",
	"crm_resource -r prim5 --meta --set-parameter=target-role -v Stopped --recursive --output-as=xml"),
	Test("Set a meta-attribute for group and resource colocated with it",
	"crm_resource -r group --meta --set-parameter=target-role -v Stopped --recursive"),
	ValidatingTest("Set a meta-attribute for clone and resource colocated with it",
	"crm_resource -r clone --meta --set-parameter=target-role -v Stopped --recursive --output-as=xml"),
	]

	digest_tests = [
	ValidatingTest("Show resource digests",
	"crm_resource --digests -r rsc1 -N node1 --output-as=xml"),
	Test("Show resource digests with overrides",
	"crm_resource --digests -r rsc1 -N node1 --output-as=xml CRM_meta_interval=10000 CRM_meta_timeout=20000"),
	make_test_group("Show resource operations", "crm_resource --list-operations {fmt}",
	[Test, ValidatingTest]),
	]

	basic2_tests = [
	make_test_group("List a promotable clone resource",
	"crm_resource --locate -r promotable-clone {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List the primitive of a promotable clone resource",
	"crm_resource --locate -r promotable-rsc {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List a single instance of a promotable clone resource",
	"crm_resource --locate -r promotable-rsc:0 {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List another instance of a promotable clone resource",
	"crm_resource --locate -r promotable-rsc:1 {fmt}",
	[Test, ValidatingTest]),
	Test("Try to move an instance of a cloned resource",
	"crm_resource -r promotable-rsc:0 --move --node node1",
	expected_rc=ExitStatus.INVALID_PARAM),
	]

	basic_tests_setup = [
	"crm_attribute -n no-quorum-policy -v ignore",
	"crm_simulate --live-check --in-place --node-up=node1"
	]

	return options_tests + [
	ShadowTestGroup(basic_tests, setup=basic_tests_setup),
	TestGroup(constraint_tests, env={"CIB_file": "{cts_cli_data}/constraints.xml"}),
	TestGroup(colocation_tests, cib_gen=partial(copy_existing_cib, "{cts_cli_data}/constraints.xml")),
	TestGroup(digest_tests, env={"CIB_file": "{cts_cli_data}/crm_resource_digests.xml"}),
	TestGroup(basic2_tests, env={"CIB_file": "{cts_cli_data}/crm_mon.xml"}),
	ValidatingTest("Check that CIB_file=\"-\" works - crm_resource",
	"crm_resource --digests -r rsc1 -N node1 --output-as=xml",
	env={"CIB_file": "-"},
	stdin=pathlib.Path(apply_substitutions("{cts_cli_data}/crm_resource_digests.xml"))),
	]


	class CrmTicketRegressionTest(RegressionTest):
	"""A class for testing crm_ticket."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crm_ticket"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	basic_tests = [
	Test("Default ticket granted state",
	"crm_ticket -t ticketA -G granted -d false"),
	Test("Set ticket granted state", "crm_ticket -t ticketA -r --force",
	update_cib=True),
	make_test_group("List ticket IDs", "crm_ticket -w {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Query ticket state", "crm_ticket -t ticketA -q {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Query ticket granted state",
	"crm_ticket -t ticketA -G granted {fmt}",
	[Test, ValidatingTest]),
	Test("Delete ticket granted state",
	"crm_ticket -t ticketA -D granted --force",
	update_cib=True),
	Test("Make a ticket standby", "crm_ticket -t ticketA -s",
	update_cib=True),
	Test("Query ticket standby state", "crm_ticket -t ticketA -G standby"),
	Test("Activate a ticket", "crm_ticket -t ticketA -a",
	update_cib=True),
	make_test_group("List ticket details", "crm_ticket -L -t ticketA {fmt}",
	[Test, ValidatingTest]),
	Test("Add a second ticket", "crm_ticket -t ticketB -G granted -d false",
	update_cib=True),
	Test("Set second ticket granted state",
	"crm_ticket -t ticketB -r --force",
	update_cib=True),
	make_test_group("List tickets", "crm_ticket -l {fmt}",
	[Test, ValidatingTest]),
	Test("Delete second ticket",
	"""cibadmin --delete --xml-text '<ticket_state id="ticketB"/>'""",
	update_cib=True),
	Test("Delete ticket standby state", "crm_ticket -t ticketA -D standby",
	update_cib=True),
	Test("Add a constraint to a ticket",
	"""cibadmin -C -o constraints --xml-text '<rsc_ticket id="dummy-dep-ticketA" rsc="dummy" rsc-role="Started" ticket="ticketA" loss-policy="freeze"/>'""",
	update_cib=True),
	make_test_group("Query ticket constraints", "crm_ticket -t ticketA -c {fmt}",
	[Test, ValidatingTest]),
	Test("Delete ticket constraint",
	"""cibadmin --delete --xml-text '<rsc_ticket id="dummy-dep-ticketA"/>'""",
	update_cib=True),
	]

	basic_tests_setup = [
	"""cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/></cluster_property_set>'""",
	"""cibadmin -C -o resources --xml-text '<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />'"""
	]

	return [
	ShadowTestGroup(basic_tests, setup=basic_tests_setup),
	]


	class CrmadminRegressionTest(RegressionTest):
	"""A class for testing crmadmin."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crmadmin"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	basic_tests = [
	make_test_group("List all nodes", "crmadmin -N {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Minimally list all nodes", "crmadmin -N -q {fmt}",
	[Test, ValidatingTest]),
	Test("List all nodes as bash exports", "crmadmin -N -B"),
	make_test_group("List cluster nodes",
	"crmadmin -N cluster {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List guest nodes",
	"crmadmin -N guest {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List remote nodes",
	"crmadmin -N remote {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List cluster,remote nodes",
	"crmadmin -N cluster,remote {fmt}",
	[Test, ValidatingTest]),
	make_test_group("List guest,remote nodes",
	"crmadmin -N guest,remote {fmt}",
	[Test, ValidatingTest]),
	]

	return [
	TestGroup(basic_tests,
	env={"CIB_file": "{cts_cli_data}/crmadmin-cluster-remote-guest-nodes.xml"}),
	Test("Check that CIB_file=\"-\" works", "crmadmin -N",
	env={"CIB_file": "-"},
	stdin=pathlib.Path(apply_substitutions("{cts_cli_data}/crmadmin-cluster-remote-guest-nodes.xml"))),
	]


	class CrmShadowRegressionTest(RegressionTest):
	"""A class for testing crm_shadow."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crm_shadow"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	no_instance_tests = [
	make_test_group("Get active shadow instance (no active instance)",
	"crm_shadow --which {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	make_test_group("Get active shadow instance's file name (no active instance)",
	"crm_shadow --file {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	make_test_group("Get active shadow instance's contents (no active instance)",
	"crm_shadow --display {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	make_test_group("Get active shadow instance's diff (no active instance)",
	"crm_shadow --diff {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	]

	# Create new shadow instance based on active CIB
	# Don't use create_shadow_cib() here; test explicitly
	new_instance_tests = [
	make_test_group("Create copied shadow instance",
	"crm_shadow --create {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force"),
	# Query shadow instance based on active CIB
	make_test_group("Get active shadow instance (copied)",
	"crm_shadow --which {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Get active shadow instance's file name (copied)",
	"crm_shadow --file {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Get active shadow instance's contents (copied)",
	"crm_shadow --display {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Get active shadow instance's diff (copied)",
	"crm_shadow --diff {fmt}",
	[Test, ValidatingTest]),
	]

	# Make some changes to the shadow file
	modify_cib = """export CIB_file=$(crm_shadow --file) && """ \
	"""cibadmin --modify --xml-text '<primitive id="dummy" description="desc"/>' && """ \
	"""cibadmin --delete --xml-text '<op_defaults/>' && """ \
	"""cibadmin --create -o resources --xml-text '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>' && """ \
	"""cibadmin --create -o status --xml-text '<node_state id="3" uname="cluster03" in_ccm="true" crmd="online" crm-debug-origin="do_update_resource" join="member" expected="member"/>'"""

	more_tests = [
	# We can't use make_test_group() here because we only want to run
	# the modify_cib setup code once, and make_test_group will pass all
	# kwargs to every instance it creates.
	Test("Get active shadow instance's diff (after changes)",
	"crm_shadow --diff",
	setup=modify_cib, expected_rc=ExitStatus.ERROR),
	ValidatingTest("Get active shadow instance's diff (after changes)",
	"crm_shadow --diff --output-as=xml",
	expected_rc=ExitStatus.ERROR),
	TestGroup([
	# Commit the modified shadow CIB to a temp active CIB file
	Test("Commit shadow instance",
	"crm_shadow --commit {shadow}",
	expected_rc=ExitStatus.USAGE),
	Test("Commit shadow instance (force)",
	"crm_shadow --commit {shadow} --force"),
	Test("Get active shadow instance's diff (after commit)",
	"crm_shadow --diff",
	expected_rc=ExitStatus.ERROR),
	Test("Commit shadow instance (force) (all)",
	"crm_shadow --commit {shadow} --force --all"),
	Test("Get active shadow instance's diff (after commit all)",
	"crm_shadow --diff",
	expected_rc=ExitStatus.ERROR),
	], cib_gen=partial(copy_existing_cib, "{cts_cli_data}/crm_mon.xml")),
	TestGroup([
	# Repeat sequence with XML output
	ValidatingTest("Commit shadow instance",
	"crm_shadow --commit {shadow} --output-as=xml",
	expected_rc=ExitStatus.USAGE),
	ValidatingTest("Commit shadow instance (force)",
	"crm_shadow --commit {shadow} --force --output-as=xml"),
	ValidatingTest("Get active shadow instance's diff (after commit)",
	"crm_shadow --diff --output-as=xml",
	expected_rc=ExitStatus.ERROR),
	ValidatingTest("Commit shadow instance (force) (all)",
	"crm_shadow --commit {shadow} --force --all --output-as=xml"),
	ValidatingTest("Get active shadow instance's diff (after commit all)",
	"crm_shadow --diff --output-as=xml",
	expected_rc=ExitStatus.ERROR),
	# Commit an inactive shadow instance with no active instance
	make_test_group("Commit shadow instance (no active instance)",
	"crm_shadow --commit {shadow} {fmt}",
	[Test, ValidatingTest],
	env={"CIB_shadow": None},
	expected_rc=ExitStatus.USAGE),
	make_test_group("Commit shadow instance (no active instance) (force)",
	"crm_shadow --commit {shadow} --force {fmt}",
	[Test, ValidatingTest],
	env={"CIB_shadow": None}),
	# Commit an inactive shadow instance with an active instance
	make_test_group("Commit shadow instance (mismatch)",
	"crm_shadow --commit {shadow} {fmt}",
	[Test, ValidatingTest],
	env={"CIB_shadow": "nonexistent_shadow"},
	expected_rc=ExitStatus.USAGE),
	make_test_group("Commit shadow instance (mismatch) (force)",
	"crm_shadow --commit {shadow} --force {fmt}",
	[Test, ValidatingTest],
	env={"CIB_shadow": "nonexistent_shadow"}),
	# Commit an active shadow instance whose shadow file is missing
	make_test_group("Commit shadow instance (nonexistent shadow file)",
	"crm_shadow --commit nonexistent_shadow {fmt}",
	[Test, ValidatingTest],
	env={"CIB_shadow": "nonexistent_shadow"},
	expected_rc=ExitStatus.USAGE),
	make_test_group("Commit shadow instance (nonexistent shadow file) (force)",
	"crm_shadow --commit nonexistent_shadow --force {fmt}",
	[Test, ValidatingTest],
	env={"CIB_shadow": "nonexistent_shadow"},
	expected_rc=ExitStatus.NOSUCH),
	make_test_group("Get active shadow instance's diff (nonexistent shadow file)",
	"crm_shadow --diff {fmt}",
	[Test, ValidatingTest],
	env={"CIB_shadow": "nonexistent_shadow"},
	expected_rc=ExitStatus.NOSUCH),
	# Commit an active shadow instance when the CIB file is missing
	make_test_group("Commit shadow instance (nonexistent CIB file)",
	"crm_shadow --commit {shadow} {fmt}",
	[Test, ValidatingTest],
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"},
	expected_rc=ExitStatus.USAGE),
	make_test_group("Commit shadow instance (nonexistent CIB file) (force)",
	"crm_shadow --commit {shadow} --force {fmt}",
	[Test, ValidatingTest],
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"},
	expected_rc=ExitStatus.NOSUCH),
	make_test_group("Get active shadow instance's diff (nonexistent CIB file)",
	"crm_shadow --diff {fmt}",
	[Test, ValidatingTest],
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"},
	expected_rc=ExitStatus.NOSUCH),
	], cib_gen=partial(copy_existing_cib, "{cts_cli_data}/crm_mon.xml")),
	]

	delete_1_tests = [
	# Delete an active shadow instance
	Test("Delete shadow instance", "crm_shadow --delete {shadow}",
	expected_rc=ExitStatus.USAGE),
	Test("Delete shadow instance (force)", "crm_shadow --delete {shadow} --force"),
	ShadowTestGroup([
	ValidatingTest("Delete shadow instance",
	"crm_shadow --delete {shadow} --output-as=xml",
	expected_rc=ExitStatus.USAGE),
	ValidatingTest("Delete shadow instance (force)",
	"crm_shadow --delete {shadow} --force --output-as=xml"),
	])
	]

	delete_2_tests = [
	# Delete an inactive shadow instance with no active instance
	Test("Delete shadow instance (no active instance)",
	"crm_shadow --delete {shadow}",
	expected_rc=ExitStatus.USAGE),
	Test("Delete shadow instance (no active instance) (force)",
	"crm_shadow --delete {shadow} --force"),
	]

	delete_3_tests = [
	ValidatingTest("Delete shadow instance (no active instance)",
	"crm_shadow --delete {shadow} --output-as=xml",
	expected_rc=ExitStatus.USAGE),
	ValidatingTest("Delete shadow instance (no active instance) (force)",
	"crm_shadow --delete {shadow} --force --output-as=xml"),
	]

	delete_4_tests = [
	# Delete an inactive shadow instance with an active instance
	Test("Delete shadow instance (mismatch)",
	"crm_shadow --delete {shadow}",
	expected_rc=ExitStatus.USAGE),
	Test("Delete shadow instance (mismatch) (force)",
	"crm_shadow --delete {shadow} --force"),
	]

	delete_5_tests = [
	ValidatingTest("Delete shadow instance (mismatch)",
	"crm_shadow --delete {shadow} --output-as=xml",
	expected_rc=ExitStatus.USAGE),
	ValidatingTest("Delete shadow instance (mismatch) (force)",
	"crm_shadow --delete {shadow} --force --output-as=xml"),
	# Delete an active shadow instance whose shadow file is missing
	Test("Delete shadow instance (nonexistent shadow file)",
	"crm_shadow --delete nonexistent_shadow",
	expected_rc=ExitStatus.USAGE),
	Test("Delete shadow instance (nonexistent shadow file) (force)",
	"crm_shadow --delete nonexistent_shadow --force"),
	ValidatingTest("Delete shadow instance (nonexistent shadow file)",
	"crm_shadow --delete nonexistent_shadow --output-as=xml",
	expected_rc=ExitStatus.USAGE),
	ValidatingTest("Delete shadow instance (nonexistent shadow file) (force)",
	"crm_shadow --delete nonexistent_shadow --force --output-as=xml"),
	]

	delete_6_tests = [
	# Delete an active shadow instance when the CIB file is missing
	Test("Delete shadow instance (nonexistent CIB file)",
	"crm_shadow --delete {shadow}",
	expected_rc=ExitStatus.USAGE),
	Test("Delete shadow instance (nonexistent CIB file) (force)",
	"crm_shadow --delete {shadow} --force"),
	]

	delete_7_tests = [
	ValidatingTest("Delete shadow instance (nonexistent CIB file)",
	"crm_shadow --delete {shadow} --output-as=xml",
	expected_rc=ExitStatus.USAGE),
	ValidatingTest("Delete shadow instance (nonexistent CIB file) (force)",
	"crm_shadow --delete {shadow} --force --output-as=xml"),
	]

	create_1_tests = [
	# Create new shadow instance based on active CIB with no instance active
	make_test_group("Create copied shadow instance (no active instance)",
	"crm_shadow --create {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force",
	env={"CIB_shadow": None}),
	# Create new shadow instance based on active CIB with other instance active
	make_test_group("Create copied shadow instance (mismatch)",
	"crm_shadow --create {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force",
	env={"CIB_shadow": "nonexistent_shadow"}),
	# Create new shadow instance based on CIB (shadow file already exists)
	make_test_group("Create copied shadow instance (file already exists)",
	"crm_shadow --create {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.CANTCREAT),
	make_test_group("Create copied shadow instance (file already exists) (force)",
	"crm_shadow --create {shadow} --batch --force {fmt}",
	[Test, ValidatingTest]),
	# Create new shadow instance based on active CIB when the CIB file is missing
	make_test_group("Create copied shadow instance (nonexistent CIB file) (force)",
	"crm_shadow --create {shadow} --batch --force {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.NOSUCH,
	setup="crm_shadow --delete {shadow} --force",
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"}),
	]

	create_2_tests = [
	# Create new empty shadow instance
	make_test_group("Create empty shadow instance",
	"crm_shadow --create-empty {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force"),
	# Create empty shadow instance with no active instance
	make_test_group("Create empty shadow instance (no active instance)",
	"crm_shadow --create-empty {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force",
	env={"CIB_shadow": None}),
	# Create empty shadow instance with other instance active
	make_test_group("Create empty shadow instance (mismatch)",
	"crm_shadow --create-empty {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force",
	env={"CIB_shadow": "nonexistent_shadow"}),
	# Create empty shadow instance when the CIB file is missing
	make_test_group("Create empty shadow instance (nonexistent CIB file)",
	"crm_shadow --create-empty {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force",
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"}),
	# Create empty shadow instance (shadow file already exists)
	make_test_group("Create empty shadow instance (file already exists)",
	"crm_shadow --create-empty {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.CANTCREAT),
	make_test_group("Create empty shadow instance (file already exists) (force)",
	"crm_shadow --create-empty {shadow} --batch --force {fmt}",
	[Test, ValidatingTest]),
	# Query shadow instance with an empty CIB.
	# --which and --file queries were done earlier.
	TestGroup([
	make_test_group("Get active shadow instance's contents (empty CIB)",
	"crm_shadow --display {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Get active shadow instance's diff (empty CIB)",
	"crm_shadow --diff {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.ERROR),
	], setup=delete_shadow_resource_defaults),
	]

	reset_1_tests = [
	Test("Resetting active shadow instance to active CIB requires force",
	"crm_shadow --reset {shadow} --batch",
	expected_rc=ExitStatus.USAGE),
	Test("Reset active shadow instance to active CIB",
	"crm_shadow --reset {shadow} --batch --force"),
	Test("Active shadow instance no different from active CIB after reset",
	"crm_shadow --diff"),
	Test("Active shadow instance differs from active CIB after change",
	"crm_shadow --diff",
	setup="crm_attribute -n admin_epoch -v 99",
	expected_rc=ExitStatus.ERROR),

	ValidatingTest("Reset active shadow instance to active CIB",
	"crm_shadow --reset {shadow} --batch --force --output-as=xml"),
	ValidatingTest("Active shadow instance no different from active CIB after reset",
	"crm_shadow --diff --output-as=xml"),
	ValidatingTest("Active shadow instance differs from active CIB after change",
	"crm_shadow --diff --output-as=xml",
	setup="crm_attribute -n admin_epoch -v 199",
	expected_rc=ExitStatus.ERROR),

	make_test_group("Reset shadow instance to active CIB with nonexistent shadow file",
	"crm_shadow --reset {shadow} --batch --force {fmt}",
	[Test, ValidatingTest],
	setup="crm_shadow --delete {shadow} --force"),
	Test("Active shadow instance no different from active CIB after force-reset",
	"crm_shadow --diff"),
	]

	reset_2_tests = [
	make_test_group("Reset inactive shadow instance (none active) to active CIB",
	"crm_shadow --reset {shadow} --force --batch {fmt}",
	[Test, ValidatingTest]),
	]

	reset_3_tests = [
	make_test_group("Reset inactive shadow instance while another instance active",
	"crm_shadow --reset {shadow} --batch --force {fmt}",
	[Test, ValidatingTest]),
	]

	reset_4_tests = [
	make_test_group("Reset shadow instance with nonexistent CIB",
	"crm_shadow --reset {shadow} --batch --force {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.NOSUCH),
	]

	# Switch shadow instances
	switch_tests = [
	make_test_group("Switch to new shadow instance",
	"crm_shadow --switch {shadow} --batch {fmt}",
	[Test, ValidatingTest]),
	TestGroup([
	make_test_group("Switch to nonexistent shadow instance",
	"crm_shadow --switch {shadow} --batch {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.NOSUCH),
	make_test_group("Switch to nonexistent shadow instance (force)",
	"crm_shadow --switch {shadow} --batch --force {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.NOSUCH),
	], setup="crm_shadow --delete {shadow} --force"),
	]

	return no_instance_tests + [
	ShadowTestGroup(new_instance_tests + more_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml"},
	create=False),
	ShadowTestGroup(delete_1_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml"}),
	ShadowTestGroup(delete_2_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml",
	"CIB_shadow": None}),
	ShadowTestGroup(delete_3_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml",
	"CIB_shadow": None}),
	ShadowTestGroup(delete_4_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml",
	"CIB_shadow": "nonexistent_shadow"}),
	ShadowTestGroup(delete_5_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml",
	"CIB_shadow": "nonexistent_shadow"}),
	ShadowTestGroup(delete_6_tests,
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"}),
	ShadowTestGroup(delete_7_tests,
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"}),
	ShadowTestGroup(create_1_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml"},
	create=False),
	ShadowTestGroup(create_2_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml"},
	create=False),
	ShadowTestGroup(reset_1_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml"}),
	ShadowTestGroup(reset_2_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml",
	"CIB_shadow": None}),
	ShadowTestGroup(reset_3_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml",
	"CIB_shadow": "nonexistent_shadow"}),
	ShadowTestGroup(reset_4_tests,
	env={"CIB_file": "{cts_cli_data}/nonexistent_cib.xml"}),
	ShadowTestGroup(switch_tests,
	env={"CIB_shadow": "nonexistent_shadow"},
	create_empty=True),
	]


	class CrmVerifyRegressionTest(RegressionTest):
	"""A class for testing crm_verify."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crm_verify"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	invalid_tests = [
	Test("Verbosely verify a file-specified configuration with an unallowed fencing level ID",
	"crm_verify --xml-file {cts_cli_data}/crm_verify_invalid_fencing_topology.xml --verbose",
	expected_rc=ExitStatus.CONFIG),
	make_test_group("Verify a file-specified invalid configuration",
	"crm_verify --xml-file {cts_cli_data}/crm_verify_invalid_bz.xml {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.CONFIG),
	make_test_group("Verify a file-specified invalid configuration (verbose)",
	"crm_verify --xml-file {cts_cli_data}/crm_verify_invalid_bz.xml --verbose {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.CONFIG),
	make_test_group("Verify a file-specified invalid configuration (quiet)",
	"crm_verify --xml-file {cts_cli_data}/crm_verify_invalid_bz.xml --quiet {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.CONFIG),
	ValidatingTest("Verify another file-specified invalid configuration",
	"crm_verify --xml-file {cts_cli_data}/crm_verify_invalid_no_stonith.xml --output-as=xml",
	expected_rc=ExitStatus.CONFIG),
	]

	with open("%s/cli/crm_mon.xml" % test_home, encoding="utf-8") as f:
	cib_contents = f.read()

	valid_tests = [
	ValidatingTest("Verify a file-specified valid configuration",
	"crm_verify --xml-file {cts_cli_data}/crm_mon.xml --output-as=xml"),
	ValidatingTest("Verify a piped-in valid configuration",
	"crm_verify -p --output-as=xml",
	stdin=pathlib.Path(apply_substitutions("{cts_cli_data}/crm_mon.xml"))),
	ValidatingTest("Verbosely verify a file-specified valid configuration",
	"crm_verify --xml-file {cts_cli_data}/crm_mon.xml --output-as=xml --verbose"),
	ValidatingTest("Verbosely verify a piped-in valid configuration",
	"crm_verify -p --output-as=xml --verbose",
	stdin=pathlib.Path(apply_substitutions("{cts_cli_data}/crm_mon.xml"))),
	ValidatingTest("Verify a string-supplied valid configuration",
	"crm_verify -X '%s' --output-as=xml" % cib_contents),
	ValidatingTest("Verbosely verify a string-supplied valid configuration",
	"crm_verify -X '%s' --output-as=xml --verbose" % cib_contents),
	]

	return invalid_tests + valid_tests


	class CrmMonRegressionTest(RegressionTest):
	"""A class for testing crm_mon."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "crm_mon"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	basic_tests = [
	make_test_group("Basic output", "crm_mon -1 {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Output without node section",
	"crm_mon -1 --exclude=nodes {fmt}",
	[Test, ValidatingTest]),
	# The next test doesn't need to be performed for other output formats. It's
	# really just a test to make sure that blank lines are correct.
	Test("Output with only the node section",
	"crm_mon -1 --exclude=all --include=nodes"),
	# XML includes everything already so there's no need for a complete test
	Test("Complete text output", "crm_mon -1 --include=all"),
	# XML includes detailed output already
	Test("Complete text output with detail", "crm_mon -1R --include=all"),
	Test("Complete brief text output", "crm_mon -1 --include=all --brief"),
	Test("Complete text output grouped by node",
	"crm_mon -1 --include=all --group-by-node"),
	# XML does not have a brief output option
	Test("Complete brief text output grouped by node",
	"crm_mon -1 --include=all --group-by-node --brief"),
	ValidatingTest("Output grouped by node",
	"crm_mon --output-as=xml --group-by-node"),
	make_test_group("Complete output filtered by node",
	"crm_mon -1 --include=all --node=cluster01 {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Complete output filtered by tag",
	"crm_mon -1 --include=all --node=even-nodes {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Complete output filtered by resource tag",
	"crm_mon -1 --include=all --resource=fencing-rscs {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Output filtered by node that doesn't exist",
	"crm_mon -1 --node=blah {fmt}",
	[Test, ValidatingTest]),
	Test("Basic text output with inactive resources", "crm_mon -1 -r"),
	# XML already includes inactive resources
	Test("Basic text output with inactive resources, filtered by node",
	"crm_mon -1 -r --node=cluster02"),
	make_test_group("Complete output filtered by primitive resource",
	"crm_mon -1 --include=all --resource=Fencing {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Complete output filtered by group resource",
	"crm_mon -1 --include=all --resource=exim-group {fmt}",
	[Test, ValidatingTest]),
	Test("Complete text output filtered by group resource member",
	"crm_mon -1 --include=all --resource=Public-IP"),
	ValidatingTest("Output filtered by group resource member",
	"crm_mon --output-as=xml --resource=Email"),
	make_test_group("Complete output filtered by clone resource",
	"crm_mon -1 --include=all --resource=ping-clone {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Complete output filtered by clone resource instance",
	"crm_mon -1 --include=all --resource=ping {fmt}",
	[Test, ValidatingTest]),
	Test("Complete text output filtered by exact clone resource instance",
	"crm_mon -1 --include=all --show-detail --resource=ping:0"),
	ValidatingTest("Output filtered by exact clone resource instance",
	"crm_mon --output-as=xml --resource=ping:1"),
	make_test_group("Output filtered by resource that doesn't exist",
	"crm_mon -1 --resource=blah {fmt}",
	[Test, ValidatingTest]),
	Test("Basic text output with inactive resources, filtered by tag",
	"crm_mon -1 -r --resource=inactive-rscs"),
	Test("Basic text output with inactive resources, filtered by bundle resource",
	"crm_mon -1 -r --resource=httpd-bundle"),
	ValidatingTest("Output filtered by inactive bundle resource",
	"crm_mon --output-as=xml --resource=httpd-bundle"),
	Test("Basic text output with inactive resources, filtered by bundled IP address resource",
	"crm_mon -1 -r --resource=httpd-bundle-ip-192.168.122.131"),
	ValidatingTest("Output filtered by bundled IP address resource",
	"crm_mon --output-as=xml --resource=httpd-bundle-ip-192.168.122.132"),
	Test("Basic text output with inactive resources, filtered by bundled container",
	"crm_mon -1 -r --resource=httpd-bundle-docker-1"),
	ValidatingTest("Output filtered by bundled container",
	"crm_mon --output-as=xml --resource=httpd-bundle-docker-2"),
	Test("Basic text output with inactive resources, filtered by bundle connection",
	"crm_mon -1 -r --resource=httpd-bundle-0"),
	ValidatingTest("Output filtered by bundle connection",
	"crm_mon --output-as=xml --resource=httpd-bundle-0"),
	Test("Basic text output with inactive resources, filtered by bundled primitive resource",
	"crm_mon -1 -r --resource=httpd"),
	ValidatingTest("Output filtered by bundled primitive resource",
	"crm_mon --output-as=xml --resource=httpd"),
	Test("Complete text output, filtered by clone name in cloned group",
	"crm_mon -1 --include=all --show-detail --resource=mysql-clone-group"),
	ValidatingTest("Output, filtered by clone name in cloned group",
	"crm_mon --output-as=xml --resource=mysql-clone-group"),
	Test("Complete text output, filtered by group name in cloned group",
	"crm_mon -1 --include=all --show-detail --resource=mysql-group"),
	ValidatingTest("Output, filtered by group name in cloned group",
	"crm_mon --output-as=xml --resource=mysql-group"),
	Test("Complete text output, filtered by exact group instance name in cloned group",
	"crm_mon -1 --include=all --show-detail --resource=mysql-group:1"),
	ValidatingTest("Output, filtered by exact group instance name in cloned group",
	"crm_mon --output-as=xml --resource=mysql-group:1"),
	Test("Complete text output, filtered by primitive name in cloned group",
	"crm_mon -1 --include=all --show-detail --resource=mysql-proxy"),
	ValidatingTest("Output, filtered by primitive name in cloned group",
	"crm_mon --output-as=xml --resource=mysql-proxy"),
	Test("Complete text output, filtered by exact primitive instance name in cloned group",
	"crm_mon -1 --include=all --show-detail --resource=mysql-proxy:1"),
	ValidatingTest("Output, filtered by exact primitive instance name in cloned group",
	"crm_mon --output-as=xml --resource=mysql-proxy:1"),
	]

	partial_tests = [
	Test("Output of partially active resources", "crm_mon -1 --show-detail"),
	ValidatingTest("Output of partially active resources", "crm_mon --output-as=xml"),
	Test("Output of partially active resources, with inactive resources",
	"crm_mon -1 -r --show-detail"),
	# XML already includes inactive resources
	Test("Complete brief text output, with inactive resources",
	"crm_mon -1 -r --include=all --brief --show-detail"),
	# XML does not have a brief output option
	Test("Text output of partially active group", "crm_mon -1 --resource=partially-active-group"),
	Test("Text output of partially active group, with inactive resources",
	"crm_mon -1 --resource=partially-active-group -r"),
	Test("Text output of active member of partially active group",
	"crm_mon -1 --resource=dummy-1"),
	Test("Text output of inactive member of partially active group",
	"crm_mon -1 --resource=dummy-2 --show-detail"),
	Test("Complete brief text output grouped by node, with inactive resources",
	"crm_mon -1 -r --include=all --group-by-node --brief --show-detail"),
	Test("Text output of partially active resources, with inactive resources, filtered by node",
	"crm_mon -1 -r --node=cluster01"),
	ValidatingTest("Output of partially active resources, filtered by node",
	"crm_mon --output-as=xml --node=cluster01"),
	]

	unmanaged_tests = [
	make_test_group("Output of active unmanaged resource on offline node",
	"crm_mon -1 {fmt}",
	[Test, ValidatingTest]),
	Test("Brief text output of active unmanaged resource on offline node",
	"crm_mon -1 --brief"),
	Test("Brief text output of active unmanaged resource on offline node, grouped by node",
	"crm_mon -1 --brief --group-by-node"),
	]

	maint1_tests = [
	make_test_group("Output of all resources with maintenance-mode enabled",
	"crm_mon -1 -r {fmt}",
	[Test, ValidatingTest],
	setup="crm_attribute -n maintenance-mode -v true",
	teardown="crm_attribute -n maintenance-mode -v false"),
	make_test_group("Output of all resources with maintenance enabled for a node",
	"crm_mon -1 -r {fmt}",
	[Test, ValidatingTest],
	setup="crm_attribute -n maintenance -N cluster02 -v true",
	teardown="crm_attribute -n maintenance -N cluster02 -v false"),
	]

	maint2_tests = [
	# The fence resource is excluded, for comparison
	make_test_group("Output of all resources with maintenance meta attribute true",
	"crm_mon -1 -r {fmt}",
	[Test, ValidatingTest]),
	]

	t180_tests = [
	Test("Text output of guest node's container on different node from its remote resource",
	"crm_mon -1"),
	Test("Complete text output of guest node's container on different node from its remote resource",
	"crm_mon -1 --show-detail"),
	]

	return [
	TestGroup(basic_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon.xml"}),
	Test("Check that CIB_file=\"-\" works", "crm_mon -1",
	env={"CIB_file": "-"},
	stdin=pathlib.Path(apply_substitutions("{cts_cli_data}/crm_mon.xml"))),
	TestGroup(partial_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon-partial.xml"}),
	TestGroup(unmanaged_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon-unmanaged.xml"}),
	TestGroup(maint1_tests,
	cib_gen=partial(copy_existing_cib, "{cts_cli_data}/crm_mon.xml")),
	TestGroup(maint2_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon-rsc-maint.xml"}),
	TestGroup(t180_tests,
	env={"CIB_file": "{cts_cli_data}/crm_mon-T180.xml"}),
	]


	class AclsRegressionTest(RegressionTest):
	"""A class for testing access control lists."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "acls"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	acl_cib = """
	<acls>
	<acl_target id="l33t-haxor">
	<role id="nothing"/>
	</acl_target>
	<acl_target id="niceguy">
	<role id="observer"/>
	</acl_target>
	<acl_target id="bob">
	<role id="admin"/>
	</acl_target>
	<acl_target id="joe">
	<role id="super_user"/>
	</acl_target>
	<acl_target id="mike">
	<role id="rsc_writer"/>
	</acl_target>
	<acl_target id="chris">
	<role id="rsc_denied"/>
	</acl_target>
	<acl_role id="nothing">
	<acl_permission id="nothing-deny" kind="deny" xpath="/cib"/>
	</acl_role>
	<acl_role id="observer">
	<acl_permission id="observer-read-1" kind="read" xpath="/cib"/>
	<acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>
	<acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>
	</acl_role>
	<acl_role id="admin">
	<acl_permission id="admin-read-1" kind="read" xpath="/cib"/>
	<acl_permission id="admin-write-1" kind="write" xpath="//resources"/>
	</acl_role>
	<acl_role id="super_user">
	<acl_permission id="super_user-write-1" kind="write" xpath="/cib"/>
	</acl_role>
	<acl_role id="rsc_writer">
	<acl_permission id="rsc-writer-deny-1" kind="deny" xpath="/cib"/>
	<acl_permission id="rsc-writer-write-1" kind="write" xpath="//resources"/>
	</acl_role>
	<acl_role id="rsc_denied">
	<acl_permission id="rsc-denied-write-1" kind="write" xpath="/cib"/>
	<acl_permission id="rsc-denied-deny-1" kind="deny" xpath="//resources"/>
	</acl_role>
	</acls>
	"""

	basic_tests = [
	Test("Configure some ACLs", "cibadmin -M -o acls -p",
	update_cib=True, stdin=acl_cib),
	Test("Enable ACLs", "crm_attribute -n enable-acl -v true",
	update_cib=True),
	Test("Set cluster option", "crm_attribute -n no-quorum-policy -v ignore",
	update_cib=True),
	Test("New ACL role",
	"""cibadmin --create -o acls --xml-text '<acl_role id="badidea-role"><acl_permission id="badidea-resources" kind="read" xpath="//meta_attributes"/></acl_role>'""",
	update_cib=True),
	Test("New ACL target",
	"""cibadmin --create -o acls --xml-text '<acl_target id="badidea"><role id="badidea-role"/></acl_target>'""",
	update_cib=True),
	Test("Another ACL role",
	"""cibadmin --create -o acls --xml-text '<acl_role id="betteridea-role"><acl_permission id="betteridea-resources" kind="read" xpath="//meta_attributes"/></acl_role>'""",
	update_cib=True),
	Test("Another ACL target",
	"""cibadmin --create -o acls --xml-text '<acl_target id="betteridea"><role id="betteridea-role"/></acl_target>'""",
	update_cib=True),
	Test("Updated ACL",
	"""cibadmin --replace -o acls --xml-text '<acl_role id="betteridea-role"><acl_permission id="betteridea-nothing" kind="deny" xpath="/cib"/><acl_permission id="betteridea-resources" kind="read" xpath="//meta_attributes"/></acl_role>'""",
	update_cib=True),
	]

	no_acl_tests = [
	Test("unknownguy: Query configuration", "cibadmin -Q",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("unknownguy: Set enable-acl",
	"crm_attribute -n enable-acl -v false",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("unknownguy: Set stonith-enabled",
	"crm_attribute -n stonith-enabled -v false",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("unknownguy: Create a resource",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	]

	deny_cib_tests = [
	Test("l33t-haxor: Query configuration",
	"cibadmin -Q",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("l33t-haxor: Set enable-acl",
	"crm_attribute -n enable-acl -v false",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("l33t-haxor: Set stonith-enabled",
	"crm_attribute -n stonith-enabled -v false",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("l33t-haxor: Create a resource",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	]

	observer_tests = [
	Test("niceguy: Query configuration", "cibadmin -Q"),
	Test("niceguy: Set enable-acl",
	"crm_attribute -n enable-acl -v false",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("niceguy: Set stonith-enabled",
	"crm_attribute -n stonith-enabled -v false",
	update_cib=True),
	Test("niceguy: Create a resource",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("root: Query configuration", "cibadmin -Q",
	env={"CIB_user": "root"}),
	Test("root: Set stonith-enabled", "crm_attribute -n stonith-enabled -v true",
	update_cib=True, env={"CIB_user": "root"}),
	Test("root: Create a resource",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	update_cib=True, env={"CIB_user": "root"}),

	# For use with later tests
	Test("root: Create another resource (with description)",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy_desc" class="ocf" provider="pacemaker" type="Dummy" description="resource with description"/>'""",
	update_cib=True, env={"CIB_user": "root"}),
	]

	deny_cib_2_tests = [
	Test("l33t-haxor: Create a resource meta attribute",
	"crm_resource -r dummy --meta -p target-role -v Stopped",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("l33t-haxor: Query a resource meta attribute",
	"crm_resource -r dummy --meta -g target-role",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	Test("l33t-haxor: Remove a resource meta attribute",
	"crm_resource -r dummy --meta -d target-role",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	]

	observer_2_tests = [
	Test("niceguy: Create a resource meta attribute",
	"crm_resource -r dummy --meta -p target-role -v Stopped",
	update_cib=True),
	Test("niceguy: Query a resource meta attribute",
	"crm_resource -r dummy --meta -g target-role",
	update_cib=True),
	Test("niceguy: Remove a resource meta attribute",
	"crm_resource -r dummy --meta -d target-role",
	update_cib=True),
	Test("niceguy: Create a resource meta attribute",
	"crm_resource -r dummy --meta -p target-role -v Started",
	update_cib=True),
	]

	read_meta_tests = [
	Test("badidea: Query configuration - implied deny", "cibadmin -Q"),
	]

	deny_cib_3_tests = [
	Test("betteridea: Query configuration - explicit deny", "cibadmin -Q"),
	]

	replace_tests = [
	TestGroup([
	AclTest("niceguy: Replace - remove acls",
	"cibadmin --replace -p",
	setup="cibadmin --delete --xml-text '<acls/>'",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	AclTest("niceguy: Replace - create resource",
	"cibadmin --replace -p",
	setup="""cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	AclTest("niceguy: Replace - modify attribute (deny)",
	"cibadmin --replace -p",
	setup="crm_attribute -n enable-acl -v false",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	AclTest("niceguy: Replace - delete attribute (deny)",
	"cibadmin --replace -p",
	setup="""cibadmin --replace --xml-text '<primitive id="dummy_desc" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	AclTest("niceguy: Replace - create attribute (deny)",
	"cibadmin --replace -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	], env={"CIB_user": "niceguy"}),

	# admin role
	TestGroup([
	AclTest("bob: Replace - create attribute (direct allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'"""),
	AclTest("bob: Replace - modify attribute (direct allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'"""),
	AclTest("bob: Replace - delete attribute (direct allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'"""),
	], env={"CIB_user": "bob"}),

	# super_user role
	TestGroup([
	AclTest("joe: Replace - create attribute (inherited allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'"""),
	AclTest("joe: Replace - modify attribute (inherited allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'"""),
	AclTest("joe: Replace - delete attribute (inherited allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'"""),
	], env={"CIB_user": "joe"}),

	# rsc_writer role
	TestGroup([
	AclTest("mike: Replace - create attribute (allow overrides deny)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'"""),
	AclTest("mike: Replace - modify attribute (allow overrides deny)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'"""),
	AclTest("mike: Replace - delete attribute (allow overrides deny)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'"""),
	# Create an additional resource for deny-overrides-allow testing
	AclTest("mike: Create another resource",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy" description="nothing interesting"/>'""",
	update_cib=True),
	], env={"CIB_user": "mike"}),

	# rsc_denied role
	TestGroup([
	AclTest("chris: Replace - create attribute (deny overrides allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	AclTest("chris: Replace - modify attribute (deny overrides allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	AclTest("chris: Replace - delete attribute (deny overrides allow)",
	"cibadmin --replace -o resources -p",
	setup="""cibadmin --replace -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	expected_rc=ExitStatus.INSUFFICIENT_PRIV),
	], env={"CIB_user": "chris"}),
	]

	loop_tests = [
	# no ACL
	TestGroup(no_acl_tests, env={"CIB_user": "unknownguy"}),
	# deny /cib permission
	TestGroup(deny_cib_tests, env={"CIB_user": "l33t-haxor"}),
	# observer role
	TestGroup(observer_tests, env={"CIB_user": "niceguy"}),
	# deny /cib permission
	TestGroup(deny_cib_2_tests, env={"CIB_user": "l33t-haxor"}),
	# observer role
	TestGroup(observer_2_tests, env={"CIB_user": "niceguy"}),
	# read //meta_attributes
	TestGroup(read_meta_tests, env={"CIB_user": "badidea"}),
	# deny /cib, read //meta_attributes
	TestGroup(deny_cib_3_tests, env={"CIB_user": "betteridea"}),
	] + replace_tests

	return [
	ShadowTestGroup(basic_tests + [
	TestGroup(loop_tests,
	env={"PCMK_trace_functions": "pcmk__check_acl,pcmk__apply_creation_acl"})]),
	]


	class ValidityRegressionTest(RegressionTest):
	"""A class for testing CIB validity."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "validity"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	basic_tests = [
	# sanitize_output() strips out validate-with, so there's no point in
	# outputting the CIB after tests that modify it
	Test("Try to set unrecognized validate-with",
	"cibadmin -M --xml-text '<cib validate-with=\"pacemaker-9999.0\"/>'",
	expected_rc=ExitStatus.CONFIG),
	Test("Try to remove validate-with attribute",
	"cibadmin -R -p",
	stdin=StdinCmd("""cibadmin -Q \| sed 's#validate-with="[^"]*"##'"""),
	expected_rc=ExitStatus.CONFIG),

	Test("Try to use rsc_order first-action value disallowed by schema",
	"cibadmin -M -o constraints --xml-text '<rsc_order "
	"id=\"ord_1-2\" first=\"dummy1\" first-action=\"break\" "
	"then=\"dummy2\"/>'",
	expected_rc=ExitStatus.CONFIG, update_cib=True),
	Test("Try to use configuration legal only with schema after configured one",
	"cibadmin -C -o configuration --xml-text '<tags/>'",
	expected_rc=ExitStatus.CONFIG, update_cib=True),
	Test("Disable schema validation",
	"cibadmin -M --xml-text '<cib validate-with=\"none\"/>'",
	expected_rc=ExitStatus.OK),
	Test("Set invalid rsc_order first-action value (schema validation disabled)",
	"cibadmin -M -o constraints --xml-text '<rsc_order "
	"id=\"ord_1-2\" first=\"dummy1\" first-action=\"break\" "
	"then=\"dummy2\"/>'",
	expected_rc=ExitStatus.OK, update_cib=True),
	Test("Run crm_simulate with invalid rsc_order first-action "
	"(schema validation disabled)",
	"crm_simulate -SL",
	expected_rc=ExitStatus.OK),
	]

	basic_tests_setup = [
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	"""cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'""",
	"""cibadmin -C -o constraints --xml-text '<rsc_order id="ord_1-2" first="dummy1" first-action="start" then="dummy2"/>'""",
	]

	return [
	ShadowTestGroup(basic_tests, validate_with="pacemaker-1.2",
	setup=basic_tests_setup,
	env={"PCMK_trace_functions": "apply_upgrade,pcmk__update_schema,invert_action"}),
	]


	class UpgradeRegressionTest(RegressionTest):
	"""A class for testing upgrading the CIB."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "upgrade"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	resource_cib = """
	<resources>
	<primitive id="mySmartFuse" class="ocf" provider="experiment" type="SmartFuse">
	<operations>
	<op id="mySmartFuse-start" name="start" interval="0" timeout="40s"/>
	<op id="mySmartFuse-monitor-inputpower" name="monitor" interval="30s">
	<instance_attributes id="mySmartFuse-inputpower-instanceparams">
	<nvpair id="mySmartFuse-inputpower-requires" name="requires" value="inputpower"/>
	</instance_attributes>
	</op>
	<op id="mySmartFuse-monitor-outputpower" name="monitor" interval="2s">
	<instance_attributes id="mySmartFuse-outputpower-instanceparams">
	<nvpair id="mySmartFuse-outputpower-requires" name="requires" value="outputpower"/>
	</instance_attributes>
	</op>
	</operations>
	<instance_attributes id="mySmartFuse-params">
	<nvpair id="mySmartFuse-params-ip" name="ip" value="192.0.2.10"/>
	</instance_attributes>
	<!-- a bit hairy but valid -->
	<instance_attributes id-ref="mySmartFuse-outputpower-instanceparams"/>
	</primitive>
	</resources>
	"""

	basic_tests = [
	Test("Set stonith-enabled=false", "crm_attribute -n stonith-enabled -v false",
	update_cib=True),
	Test("Configure the initial resource", "cibadmin -M -o resources -p",
	update_cib=True, stdin=resource_cib),
	Test("Upgrade to latest CIB schema (trigger 2.10.xsl + the wrapping)",
	"cibadmin --upgrade --force -V -V",
	update_cib=True),
	Test("Query a resource instance attribute (shall survive)",
	"crm_resource -r mySmartFuse -g requires",
	update_cib=True),
	]

	return [
	ShadowTestGroup(basic_tests, validate_with="pacemaker-2.10",
	env={"PCMK_trace_functions": "apply_upgrade,pcmk__update_schema"})
	]


	class RulesRegressionTest(RegressionTest):
	"""A class for testing support for CIB rules."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "rules"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	tomorrow = datetime.now() + timedelta(days=1)

	rule_cib = """<cib epoch="1" num_updates="0" admin_epoch="0" validate-with="pacemaker-3.9">
	<configuration>
	<crm_config>
	<cluster_property_set id="cib-bootstrap-options">
	<nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/>
	</cluster_property_set>
	</crm_config>
	<nodes/>
	<resources>
	<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />
	</resources>
	<constraints>
	<rsc_location id="cli-too-many-date-expressions" rsc="dummy">
	<rule id="cli-rule-too-many-date-expressions" score="INFINITY" boolean-op="or">
	<date_expression id="cli-date-expression-1" operation="gt" start="2020-01-01 01:00:00 -0500"/>
	<date_expression id="cli-date-expression-2" operation="lt" end="2019-01-01 01:00:00 -0500"/>
	</rule>
	</rsc_location>
	<rsc_location id="cli-prefer-dummy-expired" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-expired" score="INFINITY">
	<date_expression id="cli-prefer-lifetime-end-dummy-expired" operation="lt" end="2019-01-01 12:00:00 -05:00"/>
	</rule>
	</rsc_location>
	<rsc_location id="cli-prefer-dummy-not-yet" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-not-yet" score="INFINITY">
	<date_expression id="cli-prefer-lifetime-end-dummy-not-yet" operation="gt" start="%s"/>
	</rule>
	</rsc_location>
	<rsc_location id="cli-prefer-dummy-date_spec-only-years" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-date_spec-only-years" score="INFINITY">
	<date_expression id="cli-prefer-dummy-date_spec-only-years-expr" operation="date_spec">
	<date_spec id="cli-prefer-dummy-date_spec-only-years-spec" years="2019"/>
	</date_expression>
	</rule>
	</rsc_location>
	<rsc_location id="cli-prefer-dummy-date_spec-without-years" rsc="dummy">
	<rule id="cli-prefer-rule-dummy-date_spec-without-years" score="INFINITY">
	<date_expression id="cli-prefer-dummy-date_spec-without-years-expr" operation="date_spec">
	<date_spec id="cli-prefer-dummy-date_spec-without-years-spec" hours="20" months="1,3,5,7"/>
	</date_expression>
	</rule>
	</rsc_location>
	- <rsc_location id="cli-prefer-dummy-date_spec-years-moon" rsc="dummy">
	- <rule id="cli-prefer-rule-dummy-date_spec-years-moon" score="INFINITY">
	- <date_expression id="cli-prefer-dummy-date_spec-years-moon-expr" operation="date_spec">
	- <date_spec id="cli-prefer-dummy-date_spec-years-moon-spec" years="2019" moon="1"/>
	- </date_expression>
	- </rule>
	- </rsc_location>
	<rsc_location id="cli-no-date_expression" rsc="dummy">
	<rule id="cli-no-date_expression-rule" score="INFINITY">
	<expression id="ban-apache-expr" attribute="#uname" operation="eq" value="node3"/>
	</rule>
	</rsc_location>
	</constraints>
	</configuration>
	<status/>
	</cib>""" % tomorrow.strftime("%F %T %z")

	usage_tests = [
	make_test_group("crm_rule given no arguments", "crm_rule {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.USAGE),
	make_test_group("crm_rule given no rule to check", "crm_rule -c {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.USAGE),
	make_test_group("crm_rule given invalid input XML",
	"crm_rule -c -r blahblah -X invalidxml {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.DATAERR),
	make_test_group("crm_rule given invalid input XML on stdin",
	"crm_rule -c -r blahblah -X - {fmt}",
	[Test, ValidatingTest],
	stdin=StdinCmd("echo invalidxml"),
	expected_rc=ExitStatus.DATAERR),
	]

	basic_tests = [
	make_test_group("Try to check a rule that doesn't exist",
	"crm_rule -c -r blahblah {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.NOSUCH),
	make_test_group("Try to check a rule that has too many date_expressions",
	"crm_rule -c -r cli-rule-too-many-date-expressions {fmt}",
	[Test, ValidatingTest], expected_rc=ExitStatus.UNIMPLEMENT_FEATURE),
	make_test_group("Verify basic rule is expired",
	"crm_rule -c -r cli-prefer-rule-dummy-expired {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.EXPIRED),
	make_test_group("Verify basic rule worked in the past",
	"crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101 {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Verify basic rule is not yet in effect",
	"crm_rule -c -r cli-prefer-rule-dummy-not-yet {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.NOT_YET_IN_EFFECT),
	make_test_group("Verify date_spec rule with years has expired",
	"crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.EXPIRED),
	make_test_group("Verify multiple rules at once",
	"crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.EXPIRED),
	make_test_group("Verify date_spec rule with years is in effect",
	"crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201 {fmt}",
	[Test, ValidatingTest]),
	make_test_group("Try to check a rule whose date_spec does not contain years=",
	"crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.UNIMPLEMENT_FEATURE),
	- make_test_group("Try to check a rule whose date_spec contains years= and moon=",
	- "crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon {fmt}",
	- [Test, ValidatingTest],
	- expected_rc=ExitStatus.UNIMPLEMENT_FEATURE),
	make_test_group("Try to check a rule with no date_expression",
	"crm_rule -c -r cli-no-date_expression-rule {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.UNIMPLEMENT_FEATURE),
	]

	return usage_tests + [
	TestGroup(basic_tests, cib_gen=partial(write_cib, rule_cib))
	]


	class FeatureSetRegressionTest(RegressionTest):
	"""A class for testing support for version-specific features."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "feature_set"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	basic_tests = [
	# Import the test CIB
	Test("Import the test CIB",
	"cibadmin --replace --xml-file {cts_cli_data}/crm_mon-feature_set.xml",
	update_cib=True),
	Test("Complete text output, no mixed status",
	"crm_mon -1 --show-detail"),
	ValidatingTest("Output, no mixed status", "crm_mon --output-as=xml"),
	# Modify the CIB to fake that the cluster has mixed versions
	Test("Fake inconsistent feature set",
	"crm_attribute --node=cluster02 --name=#feature-set --update=3.15.0 --lifetime=reboot",
	update_cib=True),
	Test("Complete text output, mixed status",
	"crm_mon -1 --show-detail"),
	ValidatingTest("Output, mixed status", "crm_mon --output-as=xml"),
	]

	return [
	ShadowTestGroup(basic_tests),
	]


	# Tests that depend on resource agents and must be run in an installed
	# environment
	class AgentRegressionTest(RegressionTest):
	"""A class for testing resource agents."""

	@property
	def name(self):
	"""Return the name of this regression test."""
	return "agents"

	@property
	def tests(self):
	"""A list of Test instances to be run as part of this regression test."""
	return [
	make_test_group("Validate a valid resource configuration",
	"crm_resource --validate --class ocf --provider pacemaker --agent Dummy {fmt}",
	[Test, ValidatingTest]),
	# Make the Dummy configuration invalid (op_sleep can't be a generic string)
	make_test_group("Validate an invalid resource configuration",
	"crm_resource --validate --class ocf --provider pacemaker --agent Dummy {fmt}",
	[Test, ValidatingTest],
	expected_rc=ExitStatus.NOT_CONFIGURED,
	env={"OCF_RESKEY_op_sleep": "asdf"}),
	]


	def build_options():
	"""Handle command line arguments."""
	parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter,
	description="Command line tool regression tests",
	epilog="Default tests: %s\n"
	"Other tests: agents (must be run in an installed environment)" %
	" ".join(default_tests))
	parser.add_argument("-j", "--jobs", metavar="JOBS", default=cpu_count() - 1, type=int,
	help="The number of tests to run simultaneously")
	parser.add_argument("-p", "--path", metavar="DIR", action="append",
	help="Look for executables in DIR (may be specified multiple times)")
	parser.add_argument("-r", "--run-only", metavar="TEST", choices=default_tests + ["tools"] + other_tests,
	action="append",
	help="Run only specified tests (may be specified multiple times)")
	parser.add_argument("-s", "--save", action="store_true",
	help="Save actual output as expected output")
	parser.add_argument("-v", "--valgrind", action="store_true",
	help="Run all commands under valgrind")
	parser.add_argument("-V", "--verbose", action="store_true",
	help="Display any differences from expected output")

	args = parser.parse_args()

	if args.path is None:
	args.path = []

	return args


	def setup_environment(valgrind):
	"""Set various environment variables needed for operation."""
	if valgrind:
	os.environ["G_SLICE"] = "always-malloc"

	# Ensure all command output is in portable locale for comparison
	os.environ["LC_ALL"] = "C"

	# Log test errors to stderr
	os.environ["PCMK_stderr"] = "1"

	# Because we will change the value of PCMK_trace_functions and then reset it
	# back to some initial value at various points, it's easiest to assume it is
	# defined but empty by default
	if "PCMK_trace_functions" not in os.environ:
	os.environ["PCMK_trace_functions"] = ""


	def path_prepend(p):
	"""Add another directory to the front of $PATH."""
	old = os.environ["PATH"]
	os.environ["PATH"] = "%s:%s" % (p, old)


	def setup_path(opts_path):
	"""Set the PATH environment variable appropriately for the tests."""
	srcdir = os.path.dirname(test_home)

	# Add any search paths given on the command line
	for p in opts_path:
	path_prepend(p)

	if os.path.exists("%s/tools/crm_simulate" % srcdir):
	print("Using local binaries from: %s" % srcdir)

	path_prepend("%s/tools" % srcdir)

	for daemon in ["based", "controld", "fenced", "schedulerd"]:
	path_prepend("%s/daemons/%s" % (srcdir, daemon))

	print("Using local schemas from: %s/xml" % srcdir)
	os.environ["PCMK_schema_directory"] = "%s/xml" % srcdir
	else:
	path_prepend(BuildOptions.DAEMON_DIR)
	os.environ["PCMK_schema_directory"] = BuildOptions.SCHEMA_DIR


	def _run_one(valgrind, r):
	"""Run and return a TestGroup object."""
	# See comments in run_regression_tests.
	r.run(valgrind=valgrind)
	return r


	def run_regression_tests(regs, jobs, valgrind=False):
	"""Run the given tests and return the modified objects."""
	executed = []

	with Pool(processes=jobs) as pool:
	# What we really want to do here is:
	# pool.map(lambda r: r.run(),regs)
	#
	# However, multiprocessing uses pickle somehow in its operation, and python
	# doesn't want to pickle a lambda (nor a nested function within this one).
	# Thus, we need to use the _run_one wrapper at the file level just to call
	# run(). Further, if we don't return the modified object from that and then
	# return the list of modified objects here, it looks like the rest of the
	# program will use the originals, before this was ever run.
	executed = pool.map(partial(_run_one, valgrind), regs)

	return executed


	def results(regs, save, verbose):
	"""Print the output from each regression test, returning the number whose output differs."""
	output_differs = 0

	if verbose:
	print("\n\nResults")

	for r in regs:
	r.write()

	if save:
	dest = "%s/cli/regression.%s.exp" % (test_home, r.name)
	copyfile(r.results_file, dest)

	r.diff()
	if not r.identical:
	output_differs += 1

	return output_differs


	def summary(regs, output_differs, verbose):
	"""Print the summary output for the entire test run."""
	test_failures = 0
	test_successes = 0

	for r in regs:
	test_failures += r.failures
	test_successes += r.successes

	print("\n\nSummary")

	# First, print all the Passed/Failed lines from each Test run.
	for r in regs:
	print("\n".join(r.summary))

	fmt = PluralFormatter()

	# Then, print information specific to each result possibility. Basically,
	# if there were failures then we print the output differences, leave the
	# failed output files in place, and exit with an error. Otherwise, clean up
	# anything that passed.
	if test_failures > 0 and output_differs > 0:
	print(fmt.format("{0} {0:plural,test} failed; see output in:",
	test_failures))

	for r in regs:
	r.process_results(verbose)

	return ExitStatus.ERROR

	if test_failures > 0:
	print(fmt.format("{0} {0:plural,test} failed", test_failures))

	for r in regs:
	r.process_results(verbose)

	return ExitStatus.ERROR

	if output_differs:
	print(fmt.format("{0} {0:plural,test} passed but output was "
	"unexpected; see output in:", test_successes))

	for r in regs:
	r.process_results(verbose)

	return ExitStatus.DIGEST

	print(fmt.format("{0} {0:plural,test} passed", test_successes))

	for r in regs:
	r.cleanup()

	return ExitStatus.OK


	regression_classes = [
	AccessRenderRegressionTest,
	DaemonsRegressionTest,
	DatesRegressionTest,
	ErrorCodeRegressionTest,
	CibadminRegressionTest,
	CrmAttributeRegressionTest,
	CrmStandbyRegressionTest,
	CrmResourceRegressionTest,
	CrmTicketRegressionTest,
	CrmadminRegressionTest,
	CrmShadowRegressionTest,
	CrmVerifyRegressionTest,
	CrmMonRegressionTest,
	AclsRegressionTest,
	ValidityRegressionTest,
	UpgradeRegressionTest,
	RulesRegressionTest,
	FeatureSetRegressionTest,
	AgentRegressionTest,
	]


	def main():
	"""Run command line regression tests as specified by arguments."""
	opts = build_options()

	setup_environment(opts.valgrind)
	setup_path(opts.path)

	# Filter the list of all regression test classes to include only those that
	# were requested on the command line. If empty, this defaults to default_tests.
	if not opts.run_only:
	opts.run_only = default_tests

	if opts.run_only == ["tools"]:
	opts.run_only = tools_tests

	regs = []
	for cls in regression_classes:
	obj = cls()

	if obj.name in opts.run_only:
	regs.append(obj)

	regs = run_regression_tests(regs, max(1, opts.jobs), valgrind=opts.valgrind)
	output_differs = results(regs, opts.save, opts.verbose)
	rc = summary(regs, output_differs, opts.verbose)

	sys.exit(rc)


	if __name__ == "__main__":
	main()

	# vim: set filetype=python expandtab tabstop=4 softtabstop=4 shiftwidth=4 textwidth=120:
	diff --git a/cts/schemas/test-3/ref.err/moon.ref.err-0 b/cts/schemas/test-3/ref.err/moon.ref.err-0
	new file mode 100644
	index 0000000000..e69de29bb2
	diff --git a/cts/schemas/test-3/ref.err/moon.ref.err-1 b/cts/schemas/test-3/ref.err/moon.ref.err-1
	new file mode 100644
	index 0000000000..e69de29bb2
	diff --git a/cts/schemas/test-3/ref.err/moon.ref.err-2 b/cts/schemas/test-3/ref.err/moon.ref.err-2
	new file mode 100644
	index 0000000000..e69de29bb2
	diff --git a/cts/schemas/test-3/ref.err/moon.ref.err-3 b/cts/schemas/test-3/ref.err/moon.ref.err-3
	new file mode 100644
	index 0000000000..e69de29bb2
	diff --git a/cts/schemas/test-3/ref.err/moon.ref.err-4 b/cts/schemas/test-3/ref.err/moon.ref.err-4
	new file mode 100644
	index 0000000000..e69de29bb2
	diff --git a/cts/schemas/test-3/ref.err/moon.ref.err-99 b/cts/schemas/test-3/ref.err/moon.ref.err-99
	new file mode 100644
	index 0000000000..e69de29bb2
	diff --git a/cts/schemas/test-3/ref/moon.ref-0 b/cts/schemas/test-3/ref/moon.ref-0
	new file mode 100644
	index 0000000000..6499dffd33
	--- /dev/null
	+++ b/cts/schemas/test-3/ref/moon.ref-0
	@@ -0,0 +1,33 @@
	+<cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="16" num_updates="0" admin_epoch="0" original="1">
	+ <configuration original="1">
	+ <!-- The essential elements of this test are:
	+ * There is a rule containing a date_spec with every possible attribute
	+ specified, including phase of the moon.
	+ * There is a rule containing a date_spec with only phase of the moon
	+ specified.
	+
	+ In this situation, the moon attribute should be deleted from the
	+ date_spec of each rule. No other attributes should change.
	+ -->
	+ <crm_config original="1">
	+ <cluster_property_set id="cluster-properties1" original="1">
	+ <rule id="cluster-properties1-rule" original="1">
	+ <date_expression id="cluster-properties1-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties1-rule-expr-date_spec" seconds="0-59" minutes="0-59" hours="0-23" monthdays="1-31" weekdays="1-7" yeardays="1-366" months="1-12" weeks="1-53" years="2024" weekyears="2024" moon="0-7" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ <cluster_property_set id="cluster-properties2" original="1">
	+ <rule id="cluster-properties2-rule" original="1">
	+ <date_expression id="cluster-properties2-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties2-rule-expr-date_spec" moon="0-7" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ </crm_config>
	+ <nodes original="1"/>
	+ <resources original="1"/>
	+ <constraints original="1"/>
	+ </configuration>
	+ <status original="1"/>
	+</cib>
	diff --git a/cts/schemas/test-3/ref/moon.ref-1 b/cts/schemas/test-3/ref/moon.ref-1
	new file mode 100644
	index 0000000000..981e14f3bd
	--- /dev/null
	+++ b/cts/schemas/test-3/ref/moon.ref-1
	@@ -0,0 +1,33 @@
	+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="16" num_updates="0" admin_epoch="0" original="1">
	+ <configuration original="1">
	+ <!-- The essential elements of this test are:
	+ * There is a rule containing a date_spec with every possible attribute
	+ specified, including phase of the moon.
	+ * There is a rule containing a date_spec with only phase of the moon
	+ specified.
	+
	+ In this situation, the moon attribute should be deleted from the
	+ date_spec of each rule. No other attributes should change.
	+ -->
	+ <crm_config original="1">
	+ <cluster_property_set id="cluster-properties1" original="1">
	+ <rule id="cluster-properties1-rule" original="1">
	+ <date_expression id="cluster-properties1-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties1-rule-expr-date_spec" seconds="0-59" minutes="0-59" hours="0-23" monthdays="1-31" weekdays="1-7" yeardays="1-366" months="1-12" weeks="1-53" years="2024" weekyears="2024" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ <cluster_property_set id="cluster-properties2" original="1">
	+ <rule id="cluster-properties2-rule" original="1">
	+ <date_expression id="cluster-properties2-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties2-rule-expr-date_spec" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ </crm_config>
	+ <nodes original="1"/>
	+ <resources original="1"/>
	+ <constraints original="1"/>
	+ </configuration>
	+ <status original="1"/>
	+</cib>
	diff --git a/cts/schemas/test-3/ref/moon.ref-2 b/cts/schemas/test-3/ref/moon.ref-2
	new file mode 100644
	index 0000000000..981e14f3bd
	--- /dev/null
	+++ b/cts/schemas/test-3/ref/moon.ref-2
	@@ -0,0 +1,33 @@
	+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="16" num_updates="0" admin_epoch="0" original="1">
	+ <configuration original="1">
	+ <!-- The essential elements of this test are:
	+ * There is a rule containing a date_spec with every possible attribute
	+ specified, including phase of the moon.
	+ * There is a rule containing a date_spec with only phase of the moon
	+ specified.
	+
	+ In this situation, the moon attribute should be deleted from the
	+ date_spec of each rule. No other attributes should change.
	+ -->
	+ <crm_config original="1">
	+ <cluster_property_set id="cluster-properties1" original="1">
	+ <rule id="cluster-properties1-rule" original="1">
	+ <date_expression id="cluster-properties1-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties1-rule-expr-date_spec" seconds="0-59" minutes="0-59" hours="0-23" monthdays="1-31" weekdays="1-7" yeardays="1-366" months="1-12" weeks="1-53" years="2024" weekyears="2024" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ <cluster_property_set id="cluster-properties2" original="1">
	+ <rule id="cluster-properties2-rule" original="1">
	+ <date_expression id="cluster-properties2-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties2-rule-expr-date_spec" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ </crm_config>
	+ <nodes original="1"/>
	+ <resources original="1"/>
	+ <constraints original="1"/>
	+ </configuration>
	+ <status original="1"/>
	+</cib>
	diff --git a/cts/schemas/test-3/ref/moon.ref-3 b/cts/schemas/test-3/ref/moon.ref-3
	new file mode 100644
	index 0000000000..981e14f3bd
	--- /dev/null
	+++ b/cts/schemas/test-3/ref/moon.ref-3
	@@ -0,0 +1,33 @@
	+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="16" num_updates="0" admin_epoch="0" original="1">
	+ <configuration original="1">
	+ <!-- The essential elements of this test are:
	+ * There is a rule containing a date_spec with every possible attribute
	+ specified, including phase of the moon.
	+ * There is a rule containing a date_spec with only phase of the moon
	+ specified.
	+
	+ In this situation, the moon attribute should be deleted from the
	+ date_spec of each rule. No other attributes should change.
	+ -->
	+ <crm_config original="1">
	+ <cluster_property_set id="cluster-properties1" original="1">
	+ <rule id="cluster-properties1-rule" original="1">
	+ <date_expression id="cluster-properties1-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties1-rule-expr-date_spec" seconds="0-59" minutes="0-59" hours="0-23" monthdays="1-31" weekdays="1-7" yeardays="1-366" months="1-12" weeks="1-53" years="2024" weekyears="2024" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ <cluster_property_set id="cluster-properties2" original="1">
	+ <rule id="cluster-properties2-rule" original="1">
	+ <date_expression id="cluster-properties2-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties2-rule-expr-date_spec" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ </crm_config>
	+ <nodes original="1"/>
	+ <resources original="1"/>
	+ <constraints original="1"/>
	+ </configuration>
	+ <status original="1"/>
	+</cib>
	diff --git a/cts/schemas/test-3/ref/moon.ref-4 b/cts/schemas/test-3/ref/moon.ref-4
	new file mode 100644
	index 0000000000..981e14f3bd
	--- /dev/null
	+++ b/cts/schemas/test-3/ref/moon.ref-4
	@@ -0,0 +1,33 @@
	+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="16" num_updates="0" admin_epoch="0" original="1">
	+ <configuration original="1">
	+ <!-- The essential elements of this test are:
	+ * There is a rule containing a date_spec with every possible attribute
	+ specified, including phase of the moon.
	+ * There is a rule containing a date_spec with only phase of the moon
	+ specified.
	+
	+ In this situation, the moon attribute should be deleted from the
	+ date_spec of each rule. No other attributes should change.
	+ -->
	+ <crm_config original="1">
	+ <cluster_property_set id="cluster-properties1" original="1">
	+ <rule id="cluster-properties1-rule" original="1">
	+ <date_expression id="cluster-properties1-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties1-rule-expr-date_spec" seconds="0-59" minutes="0-59" hours="0-23" monthdays="1-31" weekdays="1-7" yeardays="1-366" months="1-12" weeks="1-53" years="2024" weekyears="2024" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ <cluster_property_set id="cluster-properties2" original="1">
	+ <rule id="cluster-properties2-rule" original="1">
	+ <date_expression id="cluster-properties2-rule-expr" operation="date_spec" original="1">
	+ <date_spec id="cluster-properties2-rule-expr-date_spec" original="1"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ </crm_config>
	+ <nodes original="1"/>
	+ <resources original="1"/>
	+ <constraints original="1"/>
	+ </configuration>
	+ <status original="1"/>
	+</cib>
	diff --git a/cts/schemas/test-3/ref/moon.ref-99 b/cts/schemas/test-3/ref/moon.ref-99
	new file mode 100644
	index 0000000000..b50df09fbd
	--- /dev/null
	+++ b/cts/schemas/test-3/ref/moon.ref-99
	@@ -0,0 +1,33 @@
	+<cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="16" num_updates="0" admin_epoch="0">
	+ <configuration>
	+ <!-- The essential elements of this test are:
	+ * There is a rule containing a date_spec with every possible attribute
	+ specified, including phase of the moon.
	+ * There is a rule containing a date_spec with only phase of the moon
	+ specified.
	+
	+ In this situation, the moon attribute should be deleted from the
	+ date_spec of each rule. No other attributes should change.
	+ -->
	+ <crm_config>
	+ <cluster_property_set id="cluster-properties1">
	+ <rule id="cluster-properties1-rule">
	+ <date_expression id="cluster-properties1-rule-expr" operation="date_spec">
	+ <date_spec id="cluster-properties1-rule-expr-date_spec" seconds="0-59" minutes="0-59" hours="0-23" monthdays="1-31" weekdays="1-7" yeardays="1-366" months="1-12" weeks="1-53" years="2024" weekyears="2024"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ <cluster_property_set id="cluster-properties2">
	+ <rule id="cluster-properties2-rule">
	+ <date_expression id="cluster-properties2-rule-expr" operation="date_spec">
	+ <date_spec id="cluster-properties2-rule-expr-date_spec"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ </crm_config>
	+ <nodes/>
	+ <resources/>
	+ <constraints/>
	+ </configuration>
	+ <status/>
	+</cib>
	diff --git a/cts/schemas/test-3/xml/moon.xml b/cts/schemas/test-3/xml/moon.xml
	new file mode 100644
	index 0000000000..1c34be9a95
	--- /dev/null
	+++ b/cts/schemas/test-3/xml/moon.xml
	@@ -0,0 +1,34 @@
	+<cib crm_feature_set="3.19.7" validate-with="pacemaker-3.10" epoch="16" num_updates="0" admin_epoch="0">
	+ <configuration>
	+ <!-- The essential elements of this test are:
	+ * There is a rule containing a date_spec with every possible attribute
	+ specified, including phase of the moon.
	+ * There is a rule containing a date_spec with only phase of the moon
	+ specified.
	+
	+ In this situation, the moon attribute should be deleted from the
	+ date_spec of each rule. No other attributes should change.
	+ -->
	+ <crm_config>
	+ <cluster_property_set id="cluster-properties1">
	+ <rule id="cluster-properties1-rule">
	+ <date_expression id="cluster-properties1-rule-expr" operation="date_spec">
	+ <date_spec id="cluster-properties1-rule-expr-date_spec" seconds="0-59" minutes="0-59" hours="0-23" monthdays="1-31" weekdays="1-7" yeardays="1-366" months="1-12" weeks="1-53" years="2024" weekyears="2024" moon="0-7"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ <cluster_property_set id="cluster-properties2">
	+ <rule id="cluster-properties2-rule">
	+ <date_expression id="cluster-properties2-rule-expr" operation="date_spec">
	+ <date_spec id="cluster-properties2-rule-expr-date_spec" moon="0-7"/>
	+ </date_expression>
	+ </rule>
	+ </cluster_property_set>
	+ </crm_config>
	+ <nodes/>
	+ <resources/>
	+ <constraints/>
	+ </configuration>
	+ <status/>
	+</cib>
	+
	diff --git a/lib/common/rules.c b/lib/common/rules.c
	index 691df868b1..5ccc35e615 100644
	--- a/lib/common/rules.c
	+++ b/lib/common/rules.c
	@@ -1,1421 +1,1422 @@
	/*
	* Copyright 2004-2024 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h> // NULL, size_t
	#include <stdbool.h> // bool
	#include <ctype.h> // isdigit()
	#include <regex.h> // regmatch_t
	#include <stdint.h> // uint32_t
	#include <inttypes.h> // PRIu32
	#include <glib.h> // gboolean, FALSE
	#include <libxml/tree.h> // xmlNode

	#include <crm/common/scheduler.h>

	#include <crm/common/iso8601_internal.h>
	#include <crm/common/nvpair_internal.h>
	#include <crm/common/scheduler_internal.h>
	#include "crmcommon_private.h"

	/*!
	* \internal
	* \brief Get the condition type corresponding to given condition XML
	*
	* \param[in] condition Rule condition XML
	*
	* \return Condition type corresponding to \p condition
	*/
	enum expression_type
	pcmk__condition_type(const xmlNode *condition)
	{
	const char *name = NULL;

	// Expression types based on element name

	if (pcmk__xe_is(condition, PCMK_XE_DATE_EXPRESSION)) {
	return pcmk__condition_datetime;

	} else if (pcmk__xe_is(condition, PCMK_XE_RSC_EXPRESSION)) {
	return pcmk__condition_resource;

	} else if (pcmk__xe_is(condition, PCMK_XE_OP_EXPRESSION)) {
	return pcmk__condition_operation;

	} else if (pcmk__xe_is(condition, PCMK_XE_RULE)) {
	return pcmk__condition_rule;

	} else if (!pcmk__xe_is(condition, PCMK_XE_EXPRESSION)) {
	return pcmk__condition_unknown;
	}

	// Expression types based on node attribute name

	name = crm_element_value(condition, PCMK_XA_ATTRIBUTE);

	if (pcmk__str_any_of(name, CRM_ATTR_UNAME, CRM_ATTR_KIND, CRM_ATTR_ID,
	NULL)) {
	return pcmk__condition_location;
	}

	return pcmk__condition_attribute;
	}

	/*!
	* \internal
	* \brief Get parent XML element's ID for logging purposes
	*
	* \param[in] xml XML of a subelement
	*
	* \return ID of \p xml's parent for logging purposes (guaranteed non-NULL)
	*/
	static const char *
	loggable_parent_id(const xmlNode *xml)
	{
	// Default if called without parent (likely for unit testing)
	const char *parent_id = "implied";

	if ((xml != NULL) && (xml->parent != NULL)) {
	parent_id = pcmk__xe_id(xml->parent);
	if (parent_id == NULL) { // Not possible with schema validation enabled
	parent_id = "without ID";
	}
	}
	return parent_id;
	}

	/*!
	* \internal
	* \brief Get the moon phase corresponding to a given date/time
	*
	* \param[in] now Date/time to get moon phase for
	*
	* \return Phase of the moon corresponding to \p now, where 0 is the new moon
	* and 7 is the full moon
	* \deprecated This feature has been deprecated since 2.1.6.
	*/
	static int
	phase_of_the_moon(const crm_time_t *now)
	{
	/* As per the nethack rules:
	* - A moon period is 29.53058 days ~= 30
	* - A year is 365.2422 days
	* - Number of days moon phase advances on first day of year compared to
	* preceding year is (365.2422 - 12 * 29.53058) ~= 11
	* - Number of years until same phases fall on the same days of the month
	* is 18.6 ~= 19
	* - Moon phase on first day of year (epact) ~= (11 * (year%19) + 29) % 30
	* (29 as initial condition)
	* - Current phase in days = first day phase + days elapsed in year
	* - 6 moons ~= 177 days ~= 8 reported phases * 22 (+ 11/22 for rounding)
	*/
	uint32_t epact, diy, goldn;
	uint32_t y;

	crm_time_get_ordinal(now, &y, &diy);
	goldn = (y % 19) + 1;
	epact = (11 * goldn + 18) % 30;
	if (((epact == 25) && (goldn > 11)) \|\| (epact == 24)) {
	epact++;
	}
	return (((((diy + epact) * 6) + 11) % 177) / 22) & 7;
	}

	/*!
	* \internal
	* \brief Check an integer value against a range from a date specification
	*
	* \param[in] date_spec XML of PCMK_XE_DATE_SPEC element to check
	* \param[in] id XML ID of parent date expression for logging purposes
	* \param[in] attr Name of XML attribute with range to check against
	* \param[in] value Value to compare against range
	*
	* \return Standard Pacemaker return code (specifically, pcmk_rc_before_range,
	* pcmk_rc_after_range, or pcmk_rc_ok to indicate that result is either
	* within range or undetermined)
	* \note We return pcmk_rc_ok for an undetermined result so we can continue
	* checking the next range attribute.
	*/
	static int
	check_range(const xmlNode date_spec, const char id, const char *attr,
	uint32_t value)
	{
	int rc = pcmk_rc_ok;
	const char *range = crm_element_value(date_spec, attr);
	long long low, high;

	if (range == NULL) {
	// Attribute not present

	} else if (pcmk__parse_ll_range(range, &low, &high) != pcmk_rc_ok) {
	// Invalid range
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s "
	"as not passing because '%s' is not a valid range "
	"for " PCMK_XE_DATE_SPEC " attribute %s",
	id, range, attr);
	rc = pcmk_rc_unpack_error;

	} else if ((low != -1) && (value < low)) {
	rc = pcmk_rc_before_range;

	} else if ((high != -1) && (value > high)) {
	rc = pcmk_rc_after_range;
	}

	crm_trace(PCMK_XE_DATE_EXPRESSION " %s: " PCMK_XE_DATE_SPEC
	" %s='%s' for %" PRIu32 ": %s",
	id, attr, pcmk__s(range, ""), value, pcmk_rc_str(rc));
	return rc;
	}

	/*!
	* \internal
	* \brief Evaluate a date specification for a given date/time
	*
	* \param[in] date_spec XML of PCMK_XE_DATE_SPEC element to evaluate
	* \param[in] now Time to check
	*
	* \return Standard Pacemaker return code (specifically, EINVAL for NULL
	* arguments, pcmk_rc_unpack_error if the specification XML is invalid,
	* \c pcmk_rc_ok if \p now is within the specification's ranges, or
	* \c pcmk_rc_before_range or \c pcmk_rc_after_range as appropriate)
	*/
	int
	pcmk__evaluate_date_spec(const xmlNode date_spec, const crm_time_t now)
	{
	const char *id = NULL;
	const char *parent_id = loggable_parent_id(date_spec);

	// Range attributes that can be specified for a PCMK_XE_DATE_SPEC element
	struct range {
	const char *attr;
	uint32_t value;
	} ranges[] = {
	{ PCMK_XA_YEARS, 0U },
	{ PCMK_XA_MONTHS, 0U },
	{ PCMK_XA_MONTHDAYS, 0U },
	{ PCMK_XA_HOURS, 0U },
	{ PCMK_XA_MINUTES, 0U },
	{ PCMK_XA_SECONDS, 0U },
	{ PCMK_XA_YEARDAYS, 0U },
	{ PCMK_XA_WEEKYEARS, 0U },
	{ PCMK_XA_WEEKS, 0U },
	{ PCMK_XA_WEEKDAYS, 0U },
	{ PCMK__XA_MOON, 0U },
	};

	if ((date_spec == NULL) \|\| (now == NULL)) {
	return EINVAL;
	}

	// Get specification ID (for logging)
	id = pcmk__xe_id(date_spec);
	if (pcmk__str_empty(id)) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_XE_DATE_SPEC
	" subelement has no " PCMK_XA_ID, parent_id);
	return pcmk_rc_unpack_error;
	}

	// Year, month, day
	crm_time_get_gregorian(now, &(ranges[0].value), &(ranges[1].value),
	&(ranges[2].value));

	// Hour, minute, second
	crm_time_get_timeofday(now, &(ranges[3].value), &(ranges[4].value),
	&(ranges[5].value));

	// Year (redundant) and day of year
	crm_time_get_ordinal(now, &(ranges[0].value), &(ranges[6].value));

	// Week year, week of week year, day of week
	crm_time_get_isoweek(now, &(ranges[7].value), &(ranges[8].value),
	&(ranges[9].value));

	// Moon phase (deprecated)
	ranges[10].value = phase_of_the_moon(now);
	if (crm_element_value(date_spec, PCMK__XA_MOON) != NULL) {
	+ // @COMPAT Not possible with schema validation enabled
	pcmk__config_warn("Support for '" PCMK__XA_MOON "' in "
	PCMK_XE_DATE_SPEC " elements (such as %s) is "
	"deprecated and will be removed in a future release "
	"of Pacemaker", id);
	}

	for (int i = 0; i < PCMK__NELEM(ranges); ++i) {
	int rc = check_range(date_spec, parent_id, ranges[i].attr,
	ranges[i].value);

	if (rc != pcmk_rc_ok) {
	return rc;
	}
	}

	// All specified ranges passed, or none were given (also considered a pass)
	return pcmk_rc_ok;
	}

	#define ADD_COMPONENT(component) do { \
	int rc = pcmk__add_time_from_xml(*end, component, duration); \
	if (rc != pcmk_rc_ok) { \
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s " \
	"as not passing because " PCMK_XE_DURATION \
	" %s attribute %s is invalid: %s", \
	parent_id, id, \
	pcmk__time_component_attr(component), \
	pcmk_rc_str(rc)); \
	crm_time_free(*end); \
	*end = NULL; \
	return rc; \
	} \
	} while (0)

	/*!
	* \internal
	* \brief Given a duration and a start time, calculate the end time
	*
	* \param[in] duration XML of PCMK_XE_DURATION element
	* \param[in] start Start time
	* \param[out] end Where to store end time (\p *end must be NULL
	* initially)
	*
	* \return Standard Pacemaker return code
	* \note The caller is responsible for freeing \p *end using crm_time_free().
	*/
	int
	pcmk__unpack_duration(const xmlNode duration, const crm_time_t start,
	crm_time_t **end)
	{
	const char *id = NULL;
	const char *parent_id = loggable_parent_id(duration);

	if ((start == NULL) \|\| (duration == NULL)
	\|\| (end == NULL) \|\| (*end != NULL)) {
	return EINVAL;
	}

	// Get duration ID (for logging)
	id = pcmk__xe_id(duration);
	if (pcmk__str_empty(id)) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s "
	"as not passing because " PCMK_XE_DURATION
	" subelement has no " PCMK_XA_ID, parent_id);
	return pcmk_rc_unpack_error;
	}

	*end = pcmk_copy_time(start);

	ADD_COMPONENT(pcmk__time_years);
	ADD_COMPONENT(pcmk__time_months);
	ADD_COMPONENT(pcmk__time_weeks);
	ADD_COMPONENT(pcmk__time_days);
	ADD_COMPONENT(pcmk__time_hours);
	ADD_COMPONENT(pcmk__time_minutes);
	ADD_COMPONENT(pcmk__time_seconds);

	return pcmk_rc_ok;
	}

	/*!
	* \internal
	* \brief Evaluate a range check for a given date/time
	*
	* \param[in] date_expression XML of PCMK_XE_DATE_EXPRESSION element
	* \param[in] id Expression ID for logging purposes
	* \param[in] now Date/time to compare
	* \param[in,out] next_change If not NULL, set this to when the evaluation
	* will change, if known and earlier than the
	* original value
	*
	* \return Standard Pacemaker return code
	*/
	static int
	evaluate_in_range(const xmlNode date_expression, const char id,
	const crm_time_t now, crm_time_t next_change)
	{
	crm_time_t *start = NULL;
	crm_time_t *end = NULL;

	if (pcmk__xe_get_datetime(date_expression, PCMK_XA_START,
	&start) != pcmk_rc_ok) {
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_XA_START " is invalid", id);
	return pcmk_rc_unpack_error;
	}

	if (pcmk__xe_get_datetime(date_expression, PCMK_XA_END,
	&end) != pcmk_rc_ok) {
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_XA_END " is invalid", id);
	crm_time_free(start);
	return pcmk_rc_unpack_error;
	}

	if ((start == NULL) && (end == NULL)) {
	// Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_VALUE_IN_RANGE
	" requires at least one of " PCMK_XA_START " or "
	PCMK_XA_END, id);
	return pcmk_rc_unpack_error;
	}

	if (end == NULL) {
	xmlNode *duration = pcmk__xe_first_child(date_expression,
	PCMK_XE_DURATION, NULL, NULL);

	if (duration != NULL) {
	int rc = pcmk__unpack_duration(duration, start, &end);

	if (rc != pcmk_rc_ok) {
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION
	" %s as not passing because duration "
	"is invalid", id);
	crm_time_free(start);
	return rc;
	}
	}
	}

	if ((start != NULL) && (crm_time_compare(now, start) < 0)) {
	pcmk__set_time_if_earlier(next_change, start);
	crm_time_free(start);
	crm_time_free(end);
	return pcmk_rc_before_range;
	}

	if (end != NULL) {
	if (crm_time_compare(now, end) > 0) {
	crm_time_free(start);
	crm_time_free(end);
	return pcmk_rc_after_range;
	}

	// Evaluation doesn't change until second after end
	if (next_change != NULL) {
	crm_time_add_seconds(end, 1);
	pcmk__set_time_if_earlier(next_change, end);
	}
	}

	crm_time_free(start);
	crm_time_free(end);
	return pcmk_rc_within_range;
	}

	/*!
	* \internal
	* \brief Evaluate a greater-than check for a given date/time
	*
	* \param[in] date_expression XML of PCMK_XE_DATE_EXPRESSION element
	* \param[in] id Expression ID for logging purposes
	* \param[in] now Date/time to compare
	* \param[in,out] next_change If not NULL, set this to when the evaluation
	* will change, if known and earlier than the
	* original value
	*
	* \return Standard Pacemaker return code
	*/
	static int
	evaluate_gt(const xmlNode date_expression, const char id,
	const crm_time_t now, crm_time_t next_change)
	{
	crm_time_t *start = NULL;

	if (pcmk__xe_get_datetime(date_expression, PCMK_XA_START,
	&start) != pcmk_rc_ok) {
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_XA_START " is invalid",
	id);
	return pcmk_rc_unpack_error;
	}

	if (start == NULL) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_VALUE_GT " requires "
	PCMK_XA_START, id);
	return pcmk_rc_unpack_error;
	}

	if (crm_time_compare(now, start) > 0) {
	crm_time_free(start);
	return pcmk_rc_within_range;
	}

	// Evaluation doesn't change until second after start time
	crm_time_add_seconds(start, 1);
	pcmk__set_time_if_earlier(next_change, start);
	crm_time_free(start);
	return pcmk_rc_before_range;
	}

	/*!
	* \internal
	* \brief Evaluate a less-than check for a given date/time
	*
	* \param[in] date_expression XML of PCMK_XE_DATE_EXPRESSION element
	* \param[in] id Expression ID for logging purposes
	* \param[in] now Date/time to compare
	* \param[in,out] next_change If not NULL, set this to when the evaluation
	* will change, if known and earlier than the
	* original value
	*
	* \return Standard Pacemaker return code
	*/
	static int
	evaluate_lt(const xmlNode date_expression, const char id,
	const crm_time_t now, crm_time_t next_change)
	{
	crm_time_t *end = NULL;

	if (pcmk__xe_get_datetime(date_expression, PCMK_XA_END,
	&end) != pcmk_rc_ok) {
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_XA_END " is invalid", id);
	return pcmk_rc_unpack_error;
	}

	if (end == NULL) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s as not "
	"passing because " PCMK_VALUE_GT " requires "
	PCMK_XA_END, id);
	return pcmk_rc_unpack_error;
	}

	if (crm_time_compare(now, end) < 0) {
	pcmk__set_time_if_earlier(next_change, end);
	crm_time_free(end);
	return pcmk_rc_within_range;
	}

	crm_time_free(end);
	return pcmk_rc_after_range;
	}

	/*!
	* \internal
	* \brief Evaluate a rule's date expression for a given date/time
	*
	* \param[in] date_expression XML of a PCMK_XE_DATE_EXPRESSION element
	* \param[in] now Time to use for evaluation
	* \param[in,out] next_change If not NULL, set this to when the evaluation
	* will change, if known and earlier than the
	* original value
	*
	* \return Standard Pacemaker return code (unlike most other evaluation
	* functions, this can return either pcmk_rc_ok or pcmk_rc_within_range
	* on success)
	*/
	int
	pcmk__evaluate_date_expression(const xmlNode *date_expression,
	const crm_time_t now, crm_time_t next_change)
	{
	const char *id = NULL;
	const char *op = NULL;
	int rc = pcmk_rc_ok;

	if ((date_expression == NULL) \|\| (now == NULL)) {
	return EINVAL;
	}

	// Get expression ID (for logging)
	id = pcmk__xe_id(date_expression);
	if (pcmk__str_empty(id)) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " without "
	PCMK_XA_ID " as not passing");
	return pcmk_rc_unpack_error;
	}

	op = crm_element_value(date_expression, PCMK_XA_OPERATION);
	if (pcmk__str_eq(op, PCMK_VALUE_IN_RANGE,
	pcmk__str_null_matches\|pcmk__str_casei)) {
	rc = evaluate_in_range(date_expression, id, now, next_change);

	} else if (pcmk__str_eq(op, PCMK_VALUE_DATE_SPEC, pcmk__str_casei)) {
	xmlNode *date_spec = pcmk__xe_first_child(date_expression,
	PCMK_XE_DATE_SPEC, NULL,
	NULL);

	if (date_spec == NULL) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION " %s "
	"as not passing because " PCMK_VALUE_DATE_SPEC
	" operations require a " PCMK_XE_DATE_SPEC
	" subelement", id);
	return pcmk_rc_unpack_error;
	}

	// @TODO set next_change appropriately
	rc = pcmk__evaluate_date_spec(date_spec, now);

	} else if (pcmk__str_eq(op, PCMK_VALUE_GT, pcmk__str_casei)) {
	rc = evaluate_gt(date_expression, id, now, next_change);

	} else if (pcmk__str_eq(op, PCMK_VALUE_LT, pcmk__str_casei)) {
	rc = evaluate_lt(date_expression, id, now, next_change);

	} else { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_DATE_EXPRESSION
	" %s as not passing because '%s' is not a valid "
	PCMK_XE_OPERATION, id, op);
	return pcmk_rc_unpack_error;
	}

	crm_trace(PCMK_XE_DATE_EXPRESSION " %s (%s): %s (%d)",
	id, op, pcmk_rc_str(rc), rc);
	return rc;
	}

	/*!
	* \internal
	* \brief Go through submatches in a string, either counting how many bytes
	* would be needed for the expansion, or performing the expansion,
	* as requested
	*
	* \param[in] string String possibly containing submatch variables
	* \param[in] match String that matched the regular expression
	* \param[in] submatches Regular expression submatches (as set by regexec())
	* \param[in] nmatches Number of entries in \p submatches[]
	* \param[out] expansion If not NULL, expand string here (must be
	* pre-allocated to appropriate size)
	* \param[out] nbytes If not NULL, set to size needed for expansion
	*
	* \return true if any expansion is needed, otherwise false
	*/
	static bool
	process_submatches(const char string, const char match,
	const regmatch_t submatches[], int nmatches,
	char expansion, size_t nbytes)
	{
	bool expanded = false;
	const char *src = string;

	if (nbytes != NULL) {
	*nbytes = 1; // Include space for terminator
	}

	while (*src != '\0') {
	int submatch = 0;
	size_t match_len = 0;

	if ((src[0] != '%') \|\| !isdigit(src[1])) {
	/* src does not point to the first character of a %N sequence,
	* so expand this character as-is
	*/
	if (expansion != NULL) {
	expansion++ = src;
	}
	if (nbytes != NULL) {
	++(*nbytes);
	}
	++src;
	continue;
	}

	submatch = src[1] - '0';
	src += 2; // Skip over %N sequence in source string
	expanded = true; // Expansion will be different from source

	// Omit sequence from expansion unless it has a non-empty match
	if ((nmatches <= submatch) // Not enough submatches
	\|\| (submatches[submatch].rm_so < 0) // Pattern did not match
	\|\| (submatches[submatch].rm_eo
	<= submatches[submatch].rm_so)) { // Match was empty
	continue;
	}

	match_len = submatches[submatch].rm_eo - submatches[submatch].rm_so;
	if (nbytes != NULL) {
	*nbytes += match_len;
	}
	if (expansion != NULL) {
	memcpy(expansion, match + submatches[submatch].rm_so,
	match_len);
	expansion += match_len;
	}
	}

	return expanded;
	}

	/*!
	* \internal
	* \brief Expand any regular expression submatches (%0-%9) in a string
	*
	* \param[in] string String possibly containing submatch variables
	* \param[in] match String that matched the regular expression
	* \param[in] submatches Regular expression submatches (as set by regexec())
	* \param[in] nmatches Number of entries in \p submatches[]
	*
	* \return Newly allocated string identical to \p string with submatches
	* expanded on success, or NULL if no expansions were needed
	* \note The caller is responsible for freeing the result with free()
	*/
	char *
	pcmk__replace_submatches(const char string, const char match,
	const regmatch_t submatches[], int nmatches)
	{
	size_t nbytes = 0;
	char *result = NULL;

	if (pcmk__str_empty(string) \|\| pcmk__str_empty(match)) {
	return NULL; // Nothing to expand
	}

	// Calculate how much space will be needed for expanded string
	if (!process_submatches(string, match, submatches, nmatches, NULL,
	&nbytes)) {
	return NULL; // No expansions needed
	}

	// Allocate enough space for expanded string
	result = pcmk__assert_alloc(nbytes, sizeof(char));

	// Expand submatches
	(void) process_submatches(string, match, submatches, nmatches, result,
	NULL);
	return result;
	}

	/*!
	* \internal
	* \brief Parse a comparison type from a string
	*
	* \param[in] op String with comparison type (valid values are
	* \c PCMK_VALUE_DEFINED, \c PCMK_VALUE_NOT_DEFINED,
	* \c PCMK_VALUE_EQ, \c PCMK_VALUE_NE,
	* \c PCMK_VALUE_LT, \c PCMK_VALUE_LTE,
	* \c PCMK_VALUE_GT, or \c PCMK_VALUE_GTE)
	*
	* \return Comparison type corresponding to \p op
	*/
	enum pcmk__comparison
	pcmk__parse_comparison(const char *op)
	{
	if (pcmk__str_eq(op, PCMK_VALUE_DEFINED, pcmk__str_casei)) {
	return pcmk__comparison_defined;

	} else if (pcmk__str_eq(op, PCMK_VALUE_NOT_DEFINED, pcmk__str_casei)) {
	return pcmk__comparison_undefined;

	} else if (pcmk__str_eq(op, PCMK_VALUE_EQ, pcmk__str_casei)) {
	return pcmk__comparison_eq;

	} else if (pcmk__str_eq(op, PCMK_VALUE_NE, pcmk__str_casei)) {
	return pcmk__comparison_ne;

	} else if (pcmk__str_eq(op, PCMK_VALUE_LT, pcmk__str_casei)) {
	return pcmk__comparison_lt;

	} else if (pcmk__str_eq(op, PCMK_VALUE_LTE, pcmk__str_casei)) {
	return pcmk__comparison_lte;

	} else if (pcmk__str_eq(op, PCMK_VALUE_GT, pcmk__str_casei)) {
	return pcmk__comparison_gt;

	} else if (pcmk__str_eq(op, PCMK_VALUE_GTE, pcmk__str_casei)) {
	return pcmk__comparison_gte;
	}

	return pcmk__comparison_unknown;
	}

	/*!
	* \internal
	* \brief Parse a value type from a string
	*
	* \param[in] type String with value type (valid values are NULL,
	* \c PCMK_VALUE_STRING, \c PCMK_VALUE_INTEGER,
	* \c PCMK_VALUE_NUMBER, and \c PCMK_VALUE_VERSION)
	* \param[in] op Operation type (used only to select default)
	* \param[in] value1 First value being compared (used only to select default)
	* \param[in] value2 Second value being compared (used only to select default)
	*/
	enum pcmk__type
	pcmk__parse_type(const char *type, enum pcmk__comparison op,
	const char value1, const char value2)
	{
	if (type == NULL) {
	switch (op) {
	case pcmk__comparison_lt:
	case pcmk__comparison_lte:
	case pcmk__comparison_gt:
	case pcmk__comparison_gte:
	if (((value1 != NULL) && (strchr(value1, '.') != NULL))
	\|\| ((value2 != NULL) && (strchr(value2, '.') != NULL))) {
	return pcmk__type_number;
	}
	return pcmk__type_integer;

	default:
	return pcmk__type_string;
	}
	}

	if (pcmk__str_eq(type, PCMK_VALUE_STRING, pcmk__str_casei)) {
	return pcmk__type_string;

	} else if (pcmk__str_eq(type, PCMK_VALUE_INTEGER, pcmk__str_casei)) {
	return pcmk__type_integer;

	} else if (pcmk__str_eq(type, PCMK_VALUE_NUMBER, pcmk__str_casei)) {
	return pcmk__type_number;

	} else if (pcmk__str_eq(type, PCMK_VALUE_VERSION, pcmk__str_casei)) {
	return pcmk__type_version;
	}

	return pcmk__type_unknown;
	}

	/*!
	* \internal
	* \brief Compare two strings according to a given type
	*
	* \param[in] value1 String with first value to compare
	* \param[in] value2 String with second value to compare
	* \param[in] type How to interpret the values
	*
	* \return Standard comparison result (a negative integer if \p value1 is
	* lesser, 0 if the values are equal, and a positive integer if
	* \p value1 is greater)
	*/
	int
	pcmk__cmp_by_type(const char value1, const char value2, enum pcmk__type type)
	{
	// NULL compares as less than non-NULL
	if (value2 == NULL) {
	return (value1 == NULL)? 0 : 1;
	}
	if (value1 == NULL) {
	return -1;
	}

	switch (type) {
	case pcmk__type_string:
	return strcasecmp(value1, value2);

	case pcmk__type_integer:
	{
	long long integer1;
	long long integer2;

	if ((pcmk__scan_ll(value1, &integer1, 0LL) != pcmk_rc_ok)
	\|\| (pcmk__scan_ll(value2, &integer2, 0LL) != pcmk_rc_ok)) {
	crm_warn("Comparing '%s' and '%s' as strings because "
	"invalid as integers", value1, value2);
	return strcasecmp(value1, value2);
	}
	return (integer1 < integer2)? -1 : (integer1 > integer2)? 1 : 0;
	}
	break;

	case pcmk__type_number:
	{
	double num1;
	double num2;

	if ((pcmk__scan_double(value1, &num1, NULL, NULL) != pcmk_rc_ok)
	\|\| (pcmk__scan_double(value2, &num2, NULL,
	NULL) != pcmk_rc_ok)) {
	crm_warn("Comparing '%s' and '%s' as strings because invalid as "
	"numbers", value1, value2);
	return strcasecmp(value1, value2);
	}
	return (num1 < num2)? -1 : (num1 > num2)? 1 : 0;
	}
	break;

	case pcmk__type_version:
	return compare_version(value1, value2);

	default: // Invalid type
	return 0;
	}
	}

	/*!
	* \internal
	* \brief Parse a reference value source from a string
	*
	* \param[in] source String indicating reference value source
	*
	* \return Reference value source corresponding to \p source
	*/
	enum pcmk__reference_source
	pcmk__parse_source(const char *source)
	{
	if (pcmk__str_eq(source, PCMK_VALUE_LITERAL,
	pcmk__str_casei\|pcmk__str_null_matches)) {
	return pcmk__source_literal;

	} else if (pcmk__str_eq(source, PCMK_VALUE_PARAM, pcmk__str_casei)) {
	return pcmk__source_instance_attrs;

	} else if (pcmk__str_eq(source, PCMK_VALUE_META, pcmk__str_casei)) {
	return pcmk__source_meta_attrs;

	} else {
	return pcmk__source_unknown;
	}
	}

	/*!
	* \internal
	* \brief Parse a boolean operator from a string
	*
	* \param[in] combine String indicating boolean operator
	*
	* \return Enumeration value corresponding to \p combine
	*/
	enum pcmk__combine
	pcmk__parse_combine(const char *combine)
	{
	if (pcmk__str_eq(combine, PCMK_VALUE_AND,
	pcmk__str_null_matches\|pcmk__str_casei)) {
	return pcmk__combine_and;

	} else if (pcmk__str_eq(combine, PCMK_VALUE_OR, pcmk__str_casei)) {
	return pcmk__combine_or;

	} else {
	return pcmk__combine_unknown;
	}
	}

	/*!
	* \internal
	* \brief Get the result of a node attribute comparison for rule evaluation
	*
	* \param[in] actual Actual node attribute value
	* \param[in] reference Node attribute value from rule (ignored for
	* \p comparison of \c pcmk__comparison_defined or
	* \c pcmk__comparison_undefined)
	* \param[in] type How to interpret the values
	* \param[in] comparison How to compare the values
	*
	* \return Standard Pacemaker return code (specifically, \c pcmk_rc_ok if the
	* comparison passes, and some other value if it does not)
	*/
	static int
	evaluate_attr_comparison(const char actual, const char reference,
	enum pcmk__type type, enum pcmk__comparison comparison)
	{
	int cmp = 0;

	switch (comparison) {
	case pcmk__comparison_defined:
	return (actual != NULL)? pcmk_rc_ok : pcmk_rc_op_unsatisfied;

	case pcmk__comparison_undefined:
	return (actual == NULL)? pcmk_rc_ok : pcmk_rc_op_unsatisfied;

	default:
	break;
	}

	cmp = pcmk__cmp_by_type(actual, reference, type);

	switch (comparison) {
	case pcmk__comparison_eq:
	return (cmp == 0)? pcmk_rc_ok : pcmk_rc_op_unsatisfied;

	case pcmk__comparison_ne:
	return (cmp != 0)? pcmk_rc_ok : pcmk_rc_op_unsatisfied;

	default:
	break;
	}

	if ((actual == NULL) \|\| (reference == NULL)) {
	return pcmk_rc_op_unsatisfied; // Comparison would be meaningless
	}

	switch (comparison) {
	case pcmk__comparison_lt:
	return (cmp < 0)? pcmk_rc_ok : pcmk_rc_after_range;

	case pcmk__comparison_lte:
	return (cmp <= 0)? pcmk_rc_ok : pcmk_rc_after_range;

	case pcmk__comparison_gt:
	return (cmp > 0)? pcmk_rc_ok : pcmk_rc_before_range;

	case pcmk__comparison_gte:
	return (cmp >= 0)? pcmk_rc_ok : pcmk_rc_before_range;

	default: // Not possible with schema validation enabled
	return pcmk_rc_op_unsatisfied;
	}
	}

	/*!
	* \internal
	* \brief Get a reference value from a configured source
	*
	* \param[in] value Value given in rule expression
	* \param[in] source Reference value source
	* \param[in] rule_input Values used to evaluate rule criteria
	*/
	static const char *
	value_from_source(const char *value, enum pcmk__reference_source source,
	const pcmk_rule_input_t *rule_input)
	{
	GHashTable *table = NULL;

	switch (source) {
	case pcmk__source_literal:
	return value;

	case pcmk__source_instance_attrs:
	table = rule_input->rsc_params;
	break;

	case pcmk__source_meta_attrs:
	table = rule_input->rsc_meta;
	break;

	default:
	return NULL; // Not possible
	}

	if (table == NULL) {
	return NULL;
	}
	return (const char *) g_hash_table_lookup(table, value);
	}

	/*!
	* \internal
	* \brief Evaluate a node attribute rule expression
	*
	* \param[in] expression XML of a rule's PCMK_XE_EXPRESSION subelement
	* \param[in] rule_input Values used to evaluate rule criteria
	*
	* \return Standard Pacemaker return code (\c pcmk_rc_ok if the expression
	* passes, some other value if it does not)
	*/
	int
	pcmk__evaluate_attr_expression(const xmlNode *expression,
	const pcmk_rule_input_t *rule_input)
	{
	const char *id = NULL;
	const char *op = NULL;
	const char *attr = NULL;
	const char *type_s = NULL;
	const char *value = NULL;
	const char *actual = NULL;
	const char *source_s = NULL;
	const char *reference = NULL;
	char *expanded_attr = NULL;
	int rc = pcmk_rc_ok;

	enum pcmk__type type = pcmk__type_unknown;
	enum pcmk__reference_source source = pcmk__source_unknown;
	enum pcmk__comparison comparison = pcmk__comparison_unknown;

	if ((expression == NULL) \|\| (rule_input == NULL)) {
	return EINVAL;
	}

	// Get expression ID (for logging)
	id = pcmk__xe_id(expression);
	if (pcmk__str_empty(id)) {
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " without " PCMK_XA_ID
	" as not passing");
	return pcmk_rc_unpack_error;
	}

	/* Get name of node attribute to compare (expanding any %0-%9 to
	* regular expression submatches)
	*/
	attr = crm_element_value(expression, PCMK_XA_ATTRIBUTE);
	if (attr == NULL) {
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " %s as not passing "
	"because " PCMK_XA_ATTRIBUTE " was not specified", id);
	return pcmk_rc_unpack_error;
	}
	expanded_attr = pcmk__replace_submatches(attr, rule_input->rsc_id,
	rule_input->rsc_id_submatches,
	rule_input->rsc_id_nmatches);
	if (expanded_attr != NULL) {
	attr = expanded_attr;
	}

	// Get and validate operation
	op = crm_element_value(expression, PCMK_XA_OPERATION);
	comparison = pcmk__parse_comparison(op);
	if (comparison == pcmk__comparison_unknown) {
	// Not possible with schema validation enabled
	if (op == NULL) {
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " %s as not "
	"passing because it has no " PCMK_XA_OPERATION,
	id);
	} else {
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " %s as not "
	"passing because '%s' is not a valid "
	PCMK_XA_OPERATION, id, op);
	}
	rc = pcmk_rc_unpack_error;
	goto done;
	}

	// How reference value is obtained (literal, resource meta-attribute, etc.)
	source_s = crm_element_value(expression, PCMK_XA_VALUE_SOURCE);
	source = pcmk__parse_source(source_s);
	if (source == pcmk__source_unknown) {
	// Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " %s as not passing "
	"because '%s' is not a valid " PCMK_XA_VALUE_SOURCE,
	id, source_s);
	rc = pcmk_rc_unpack_error;
	goto done;
	}

	// Get and validate reference value
	value = crm_element_value(expression, PCMK_XA_VALUE);
	switch (comparison) {
	case pcmk__comparison_defined:
	case pcmk__comparison_undefined:
	if (value != NULL) {
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " %s as not "
	"passing because " PCMK_XA_VALUE " is not "
	"allowed when " PCMK_XA_OPERATION " is %s",
	id, op);
	rc = pcmk_rc_unpack_error;
	goto done;
	}
	break;

	default:
	if (value == NULL) {
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " %s as not "
	"passing because " PCMK_XA_VALUE " is "
	"required when " PCMK_XA_OPERATION " is %s",
	id, op);
	rc = pcmk_rc_unpack_error;
	goto done;
	}
	reference = value_from_source(value, source, rule_input);
	break;
	}

	// Get actual value of node attribute
	if (rule_input->node_attrs != NULL) {
	actual = g_hash_table_lookup(rule_input->node_attrs, attr);
	}

	// Get and validate value type (after expanding reference value)
	type_s = crm_element_value(expression, PCMK_XA_TYPE);
	type = pcmk__parse_type(type_s, comparison, actual, reference);
	if (type == pcmk__type_unknown) {
	// Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_EXPRESSION " %s as not passing "
	"because '%s' is not a valid type", id, type_s);
	rc = pcmk_rc_unpack_error;
	goto done;
	}

	rc = evaluate_attr_comparison(actual, reference, type, comparison);
	switch (comparison) {
	case pcmk__comparison_defined:
	case pcmk__comparison_undefined:
	crm_trace(PCMK_XE_EXPRESSION " %s result: %s (for attribute %s %s)",
	id, pcmk_rc_str(rc), attr, op);
	break;

	default:
	crm_trace(PCMK_XE_EXPRESSION " %s result: "
	"%s (attribute %s %s '%s' via %s source as %s type)",
	id, pcmk_rc_str(rc), attr, op, pcmk__s(reference, ""),
	pcmk__s(source_s, "default"), pcmk__s(type_s, "default"));
	break;
	}

	done:
	free(expanded_attr);
	return rc;
	}

	/*!
	* \internal
	* \brief Evaluate a resource rule expression
	*
	* \param[in] rsc_expression XML of rule's \c PCMK_XE_RSC_EXPRESSION subelement
	* \param[in] rule_input Values used to evaluate rule criteria
	*
	* \return Standard Pacemaker return code (\c pcmk_rc_ok if the expression
	* passes, some other value if it does not)
	*/
	int
	pcmk__evaluate_rsc_expression(const xmlNode *rsc_expression,
	const pcmk_rule_input_t *rule_input)
	{
	const char *id = NULL;
	const char *standard = NULL;
	const char *provider = NULL;
	const char *type = NULL;

	if ((rsc_expression == NULL) \|\| (rule_input == NULL)) {
	return EINVAL;
	}

	// Validate XML ID
	id = pcmk__xe_id(rsc_expression);
	if (pcmk__str_empty(id)) {
	// Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_RSC_EXPRESSION " without "
	PCMK_XA_ID " as not passing");
	return pcmk_rc_unpack_error;
	}

	// Compare resource standard
	standard = crm_element_value(rsc_expression, PCMK_XA_CLASS);
	if ((standard != NULL)
	&& !pcmk__str_eq(standard, rule_input->rsc_standard, pcmk__str_none)) {
	crm_trace(PCMK_XE_RSC_EXPRESSION " %s is unsatisfied because "
	"actual standard '%s' doesn't match '%s'",
	id, pcmk__s(rule_input->rsc_standard, ""), standard);
	return pcmk_rc_op_unsatisfied;
	}

	// Compare resource provider
	provider = crm_element_value(rsc_expression, PCMK_XA_PROVIDER);
	if ((provider != NULL)
	&& !pcmk__str_eq(provider, rule_input->rsc_provider, pcmk__str_none)) {
	crm_trace(PCMK_XE_RSC_EXPRESSION " %s is unsatisfied because "
	"actual provider '%s' doesn't match '%s'",
	id, pcmk__s(rule_input->rsc_provider, ""), provider);
	return pcmk_rc_op_unsatisfied;
	}

	// Compare resource agent type
	type = crm_element_value(rsc_expression, PCMK_XA_TYPE);
	if ((type != NULL)
	&& !pcmk__str_eq(type, rule_input->rsc_agent, pcmk__str_none)) {
	crm_trace(PCMK_XE_RSC_EXPRESSION " %s is unsatisfied because "
	"actual agent '%s' doesn't match '%s'",
	id, pcmk__s(rule_input->rsc_agent, ""), type);
	return pcmk_rc_op_unsatisfied;
	}

	crm_trace(PCMK_XE_RSC_EXPRESSION " %s is satisfied by %s%s%s:%s",
	id, pcmk__s(standard, ""),
	((provider == NULL)? "" : ":"), pcmk__s(provider, ""),
	pcmk__s(type, ""));
	return pcmk_rc_ok;
	}

	/*!
	* \internal
	* \brief Evaluate an operation rule expression
	*
	* \param[in] op_expression XML of a rule's \c PCMK_XE_OP_EXPRESSION subelement
	* \param[in] rule_input Values used to evaluate rule criteria
	*
	* \return Standard Pacemaker return code (\c pcmk_rc_ok if the expression
	* is satisfied, some other value if it is not)
	*/
	int
	pcmk__evaluate_op_expression(const xmlNode *op_expression,
	const pcmk_rule_input_t *rule_input)
	{
	const char *id = NULL;
	const char *name = NULL;
	const char *interval_s = NULL;
	guint interval_ms = 0U;

	if ((op_expression == NULL) \|\| (rule_input == NULL)) {
	return EINVAL;
	}

	// Get operation expression ID (for logging)
	id = pcmk__xe_id(op_expression);
	if (pcmk__str_empty(id)) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_OP_EXPRESSION " without "
	PCMK_XA_ID " as not passing");
	return pcmk_rc_unpack_error;
	}

	// Validate operation name
	name = crm_element_value(op_expression, PCMK_XA_NAME);
	if (name == NULL) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_OP_EXPRESSION " %s as not "
	"passing because it has no " PCMK_XA_NAME, id);
	return pcmk_rc_unpack_error;
	}

	// Validate operation interval
	interval_s = crm_element_value(op_expression, PCMK_META_INTERVAL);
	if (pcmk_parse_interval_spec(interval_s, &interval_ms) != pcmk_rc_ok) {
	pcmk__config_err("Treating " PCMK_XE_OP_EXPRESSION " %s as not "
	"passing because '%s' is not a valid "
	PCMK_META_INTERVAL,
	id, interval_s);
	return pcmk_rc_unpack_error;
	}

	// Compare operation name
	if (!pcmk__str_eq(name, rule_input->op_name, pcmk__str_none)) {
	crm_trace(PCMK_XE_OP_EXPRESSION " %s is unsatisfied because "
	"actual name '%s' doesn't match '%s'",
	id, pcmk__s(rule_input->op_name, ""), name);
	return pcmk_rc_op_unsatisfied;
	}

	// Compare operation interval (unspecified interval matches all)
	if ((interval_s != NULL) && (interval_ms != rule_input->op_interval_ms)) {
	crm_trace(PCMK_XE_OP_EXPRESSION " %s is unsatisfied because "
	"actual interval %s doesn't match %s",
	id, pcmk__readable_interval(rule_input->op_interval_ms),
	pcmk__readable_interval(interval_ms));
	return pcmk_rc_op_unsatisfied;
	}

	crm_trace(PCMK_XE_OP_EXPRESSION " %s is satisfied (name %s, interval %s)",
	id, name, pcmk__readable_interval(rule_input->op_interval_ms));
	return pcmk_rc_ok;
	}

	/*!
	* \internal
	* \brief Evaluate a rule condition
	*
	* \param[in,out] condition XML containing a rule condition (a subrule, or an
	* expression of any type)
	* \param[in] rule_input Values used to evaluate rule criteria
	* \param[out] next_change If not NULL, set to when evaluation will change
	*
	* \return Standard Pacemaker return code (\c pcmk_rc_ok if the condition
	* passes, some other value if it does not)
	*/
	int
	pcmk__evaluate_condition(xmlNode *condition,
	const pcmk_rule_input_t *rule_input,
	crm_time_t *next_change)
	{

	if ((condition == NULL) \|\| (rule_input == NULL)) {
	return EINVAL;
	}

	switch (pcmk__condition_type(condition)) {
	case pcmk__condition_rule:
	return pcmk_evaluate_rule(condition, rule_input, next_change);

	case pcmk__condition_attribute:
	case pcmk__condition_location:
	return pcmk__evaluate_attr_expression(condition, rule_input);

	case pcmk__condition_datetime:
	{
	int rc = pcmk__evaluate_date_expression(condition,
	rule_input->now,
	next_change);

	return (rc == pcmk_rc_within_range)? pcmk_rc_ok : rc;
	}

	case pcmk__condition_resource:
	return pcmk__evaluate_rsc_expression(condition, rule_input);

	case pcmk__condition_operation:
	return pcmk__evaluate_op_expression(condition, rule_input);

	default: // Not possible with schema validation enabled
	pcmk__config_err("Treating rule condition %s as not passing "
	"because %s is not a valid condition type",
	pcmk__s(pcmk__xe_id(condition), "without ID"),
	(const char *) condition->name);
	return pcmk_rc_unpack_error;
	}
	}

	/*!
	* \brief Evaluate a single rule, including all its conditions
	*
	* \param[in,out] rule XML containing a rule definition or its id-ref
	* \param[in] rule_input Values used to evaluate rule criteria
	* \param[out] next_change If not NULL, set to when evaluation will change
	*
	* \return Standard Pacemaker return code (\c pcmk_rc_ok if the rule is
	* satisfied, some other value if it is not)
	*/
	int
	pcmk_evaluate_rule(xmlNode rule, const pcmk_rule_input_t rule_input,
	crm_time_t *next_change)
	{
	bool empty = true;
	int rc = pcmk_rc_ok;
	const char *id = NULL;
	const char *value = NULL;
	enum pcmk__combine combine = pcmk__combine_unknown;

	if ((rule == NULL) \|\| (rule_input == NULL)) {
	return EINVAL;
	}

	rule = pcmk__xe_resolve_idref(rule, NULL);
	if (rule == NULL) {
	// Not possible with schema validation enabled; message already logged
	return pcmk_rc_unpack_error;
	}

	// Validate XML ID
	id = pcmk__xe_id(rule);
	if (pcmk__str_empty(id)) { // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_RULE " without " PCMK_XA_ID
	" as not passing");
	return pcmk_rc_unpack_error;
	}

	value = crm_element_value(rule, PCMK_XA_BOOLEAN_OP);
	combine = pcmk__parse_combine(value);
	switch (combine) {
	case pcmk__combine_and:
	// For "and", rc defaults to success (reset on failure below)
	break;

	case pcmk__combine_or:
	// For "or", rc defaults to failure (reset on success below)
	rc = pcmk_rc_op_unsatisfied;
	break;

	default: // Not possible with schema validation enabled
	pcmk__config_err("Treating " PCMK_XE_RULE " %s as not passing "
	"because '%s' is not a valid " PCMK_XA_BOOLEAN_OP,
	id, value);
	return pcmk_rc_unpack_error;
	}

	// Evaluate each condition
	for (xmlNode *condition = pcmk__xe_first_child(rule, NULL, NULL, NULL);
	condition != NULL; condition = pcmk__xe_next(condition)) {

	empty = false;
	if (pcmk__evaluate_condition(condition, rule_input,
	next_change) == pcmk_rc_ok) {
	if (combine == pcmk__combine_or) {
	rc = pcmk_rc_ok; // Any pass is final for "or"
	break;
	}
	} else if (combine == pcmk__combine_and) {
	rc = pcmk_rc_op_unsatisfied; // Any failure is final for "and"
	break;
	}
	}

	if (empty) { // Not possible with schema validation enabled
	pcmk__config_warn("Ignoring rule %s because it contains no conditions",
	id);
	rc = pcmk_rc_ok;
	}

	crm_trace("Rule %s is %ssatisfied", id, ((rc == pcmk_rc_ok)? "" : "not "));
	return rc;
	}
	diff --git a/xml/rule-4.0.rng b/xml/rule-4.0.rng
	index 9c5f8c534f..cd25c22850 100644
	--- a/xml/rule-4.0.rng
	+++ b/xml/rule-4.0.rng
	@@ -1,433 +1,430 @@
	<?xml version="1.0" encoding="UTF-8"?>
	<grammar xmlns="http://relaxng.org/ns/structure/1.0"
	xmlns:ann="http://relaxng.org/ns/compatibility/annotations/1.0"
	datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
	<start>
	<ref name="element-rule"/>
	</start>

	<!--
	Rule elements allow different syntax depending on their context, each of
	which gets their own rule definition below:

	1. rsc_location
	2. meta_attributes within rsc_defaults
	3. meta_attributes within op_defaults
	4. all other contexts that allow node attribute expressions
	(instance_attributes elements within bundle, clone, group, op, primitive,
	and template elements; and meta_attributes elements within op elements)
	5. all other contexts (cluster_property_set elements; instance_attributes
	within alert, node, and recipient elements; meta_attributes within alert,
	bundle, clone, group, primitive, recipient, and template elements; and
	utilization elements within node, primitive, and template elements)

	The COMPAT comments below mark items that are invalid in their given context
	and should be removed at a compatibility break.
	-->

	<!-- 1. rule element within rsc_location -->
	<define name="element-rule-location">
	<element name="rule">
	<choice>
	<attribute name="id-ref"><data type="IDREF"/></attribute>
	<group>
	<ref name="rule-common"/>
	<oneOrMore>
	<choice>
	<ref name="expression-location"/>
	<ref name="date_expression"/>
	<ref name="element-rule-location"/>

	<!-- @COMPAT: The below expression types are invalid here -->
	<ref name="rsc_expression"/>
	<ref name="op_expression"/>
	</choice>
	</oneOrMore>
	<optional>
	<choice>
	<externalRef href="score.rng"/>
	<attribute name="score-attribute"><text/></attribute>
	</choice>
	</optional>
	</group>
	</choice>
	</element>
	</define>

	<!-- 2. rule element within rsc_defaults -->
	<define name="element-rule-rsc_defaults">
	<element name="rule">
	<choice>
	<attribute name="id-ref"><data type="IDREF"/></attribute>
	<group>
	<ref name="rule-common"/>
	<oneOrMore>
	<choice>
	<ref name="date_expression"/>
	<ref name="rsc_expression"/>
	<ref name="element-rule-rsc_defaults"/>

	<!-- @COMPAT: The below expression type is deprecated here -->
	<ref name="expression"/>

	<!-- @COMPAT: The below expression type is invalid here -->
	<ref name="op_expression"/>
	</choice>
	</oneOrMore>

	<!-- @COMPAT: The below score attributes are invalid here -->
	<optional>
	<choice>
	<externalRef href="score.rng"/>
	<attribute name="score-attribute"><text/></attribute>
	</choice>
	</optional>
	</group>
	</choice>
	</element>
	</define>

	<!-- 3. rule element within op_defaults -->
	<define name="element-rule-op_defaults">
	<element name="rule">
	<choice>
	<attribute name="id-ref"><data type="IDREF"/></attribute>
	<group>
	<ref name="rule-common"/>
	<oneOrMore>
	<choice>
	<ref name="date_expression"/>
	<ref name="rsc_expression"/>
	<ref name="op_expression"/>
	<ref name="element-rule-op_defaults"/>

	<!-- @COMPAT: The below expression type is deprecated here -->
	<ref name="expression"/>
	</choice>
	</oneOrMore>

	<!-- @COMPAT: The below score attributes are invalid here -->
	<optional>
	<choice>
	<externalRef href="score.rng"/>
	<attribute name="score-attribute"><text/></attribute>
	</choice>
	</optional>
	</group>
	</choice>
	</element>
	</define>


	<!-- 4. rule element in other contexts allowing node attribute expressions -->
	<define name="element-rule-node-allowed">
	<element name="rule">
	<choice>
	<attribute name="id-ref"><data type="IDREF"/></attribute>
	<group>
	<ref name="rule-common"/>
	<oneOrMore>
	<choice>
	<ref name="expression"/>
	<ref name="date_expression"/>
	<ref name="element-rule-node-allowed"/>

	<!-- @COMPAT: The below expression types are invalid here -->
	<ref name="rsc_expression"/>
	<ref name="op_expression"/>
	</choice>
	</oneOrMore>

	<!-- @COMPAT: The below score attributes are invalid here -->
	<optional>
	<choice>
	<externalRef href="score.rng"/>
	<attribute name="score-attribute"><text/></attribute>
	</choice>
	</optional>
	</group>
	</choice>
	</element>
	</define>

	<!-- 5. rule element within all other contexts -->
	<define name="element-rule">
	<element name="rule">
	<choice>
	<attribute name="id-ref"><data type="IDREF"/></attribute>
	<group>
	<ref name="rule-common"/>
	<oneOrMore>
	<choice>
	<ref name="date_expression"/>
	<ref name="element-rule"/>

	<!-- @COMPAT: The below expression types are invalid here -->
	<ref name="expression"/>
	<ref name="rsc_expression"/>
	<ref name="op_expression"/>
	</choice>
	</oneOrMore>

	<!-- @COMPAT: The below score attributes are invalid here -->
	<optional>
	<choice>
	<externalRef href="score.rng"/>
	<attribute name="score-attribute"><text/></attribute>
	</choice>
	</optional>
	</group>
	</choice>
	</element>
	</define>

	<!-- Attributes that are common to all rule elements -->
	<define name="rule-common">
	<attribute name="id"><data type="ID"/></attribute>
	<optional>
	<attribute name="boolean-op">
	<choice>
	<value>or</value>
	<value>and</value>
	</choice>
	</attribute>
	</optional>

	<!--
	@COMPAT Role applies only to rules within location constraints. When we can
	break behavioral backward compatibility, move this to
	rule-element-location.
	-->
	<optional>
	<attribute name="role"><text/></attribute>
	</optional>
	</define>

	<!-- A node attribute expression -->
	<define name="expression">
	<element name="expression">
	<ref name="expression-common"/>

	<optional>
	<attribute name="value-source" ann:defaultValue="literal">
	<choice>
	<value>literal</value>
	<!-- @COMPAT: These value-source choices are invalid here -->
	<value>param</value>
	<value>meta</value>
	</choice>
	</attribute>
	</optional>
	</element>
	</define>

	<!-- A node attribute expression in a location constraint -->
	<define name="expression-location">
	<element name="expression">
	<ref name="expression-common"/>
	<optional>
	<attribute name="value-source" ann:defaultValue="literal">
	<choice>
	<value>literal</value>
	<value>param</value>
	<value>meta</value>
	</choice>
	</attribute>
	</optional>
	</element>
	</define>

	<!-- Attributes that are common to all <expression> elements -->
	<define name="expression-common">
	<attribute name="id"><data type="ID"/></attribute>
	<attribute name="attribute"><text/></attribute>
	<choice>
	<group>
	<attribute name="operation">
	<choice>
	<value>defined</value>
	<value>not_defined</value>
	</choice>
	</attribute>
	<!-- @COMPAT value attribute should be prohibited here -->
	<optional>
	<attribute name="value"><text/></attribute>
	</optional>
	</group>
	<group>
	<attribute name="operation">
	<choice>
	<value>lt</value>
	<value>gt</value>
	<value>lte</value>
	<value>gte</value>
	<value>eq</value>
	<value>ne</value>
	</choice>
	</attribute>
	<!-- @COMPAT value attribute should be required here -->
	<optional>
	<attribute name="value"><text/></attribute>
	</optional>
	</group>
	</choice>
	<optional>
	<attribute name="type" ann:defaultValue="string">
	<choice>
	<value>string</value>
	<value>integer</value>
	<value>number</value>
	<value>version</value>
	</choice>
	</attribute>
	</optional>
	</define>

	<define name="date_expression">
	<element name="date_expression">
	<attribute name="id"><data type="ID"/></attribute>
	<choice>
	<group>
	<attribute name="operation"><value>in_range</value></attribute>
	<choice>
	<attribute name="start"><text/></attribute>
	<attribute name="end"><text/></attribute>
	<group>
	<attribute name="start"><text/></attribute>
	<attribute name="end"><text/></attribute>
	</group>
	</choice>
	<optional>
	<ref name="duration"/>
	</optional>
	</group>
	<group>
	<attribute name="operation"><value>gt</value></attribute>
	<attribute name="start"><text/></attribute>
	</group>
	<group>
	<attribute name="operation"><value>lt</value></attribute>
	<attribute name="end"><text/></attribute>
	</group>
	<group>
	<attribute name="operation"><value>date_spec</value></attribute>
	<ref name="date_spec"/>
	</group>
	</choice>
	</element>
	</define>

	<define name="rsc_expression">
	<element name="rsc_expression">
	<attribute name="id"><data type="ID"/></attribute>
	<optional>
	<attribute name="class"><text/></attribute>
	</optional>
	<optional>
	<attribute name="provider"><text/></attribute>
	</optional>
	<optional>
	<attribute name="type"><text/></attribute>
	</optional>
	</element>
	</define>

	<define name="op_expression">
	<element name="op_expression">
	<attribute name="id"><data type="ID"/></attribute>
	<attribute name="name"><text/></attribute>
	<optional>
	<attribute name="interval"><text/></attribute>
	</optional>
	</element>
	</define>

	<define name="duration">
	<element name="duration">
	<attribute name="id"><data type="ID"/></attribute>
	<optional>
	<attribute name="years"><text/></attribute>
	</optional>
	<optional>
	<attribute name="months"><text/></attribute>
	</optional>
	<optional>
	<attribute name="weeks"><text/></attribute>
	</optional>
	<optional>
	<attribute name="days"><text/></attribute>
	</optional>
	<optional>
	<attribute name="hours"><text/></attribute>
	</optional>
	<optional>
	<attribute name="minutes"><text/></attribute>
	</optional>
	<optional>
	<attribute name="seconds"><text/></attribute>
	</optional>

	<!-- @COMPAT: The below attributes are invalid here -->
	<optional>
	<attribute name="monthdays"><text/></attribute>
	</optional>
	<optional>
	<attribute name="weekdays"><text/></attribute>
	</optional>
	<optional>
	<attribute name="yearsdays"><text/></attribute>
	</optional>
	<optional>
	<attribute name="weekyears"><text/></attribute>
	</optional>
	<optional>
	<attribute name="moon"><text/></attribute>
	</optional>
	</element>
	</define>

	<define name="date_spec">
	<element name="date_spec">
	<attribute name="id"><data type="ID"/></attribute>
	<optional>
	<attribute name="years"><text/></attribute>
	</optional>
	<optional>
	<attribute name="months"><text/></attribute>
	</optional>
	<optional>
	<attribute name="monthdays"><text/></attribute>
	</optional>
	<optional>
	<attribute name="hours"><text/></attribute>
	</optional>
	<optional>
	<attribute name="minutes"><text/></attribute>
	</optional>
	<optional>
	<attribute name="seconds"><text/></attribute>
	</optional>
	<optional>
	<attribute name="yeardays"><text/></attribute>
	</optional>
	<optional>
	<attribute name="weekyears"><text/></attribute>
	</optional>
	<optional>
	<attribute name="weeks"><text/></attribute>
	</optional>
	<optional>
	<attribute name="weekdays"><text/></attribute>
	</optional>
	- <optional>
	- <attribute name="moon"><text/></attribute>
	- </optional>

	<!-- @COMPAT: The below attributes are invalid here -->
	<optional>
	<attribute name="yearsdays"><text/></attribute>
	</optional>
	</element>
	</define>

	</grammar>
	diff --git a/xml/upgrade-3.10-1.xsl b/xml/upgrade-3.10-1.xsl
	index 10aab967c8..5b5565e6c1 100644
	--- a/xml/upgrade-3.10-1.xsl
	+++ b/xml/upgrade-3.10-1.xsl
	@@ -1,156 +1,165 @@
	<?xml version="1.0" encoding="UTF-8"?>

	<!--
	Use comments liberally as future maintainers may be unfamiliar with XSLT.
	-->

	<!--
	upgrade-3.10-1.xsl

	Guarantees after this transformation:
	* The validate-with attribute of the cib element is set to "pacemaker-4.0".
	* All nvset elements are sorted by score within their respective parent
	elements (remaining in document order in the case of a tie) and placed below
	all non-nvset siblings. Exception: a cluster_property_set with id
	"cib-bootstrap-options" always sorts first relative to its siblings.
	* Each nvpair has a value attribute. If an nvpair did not have a value
	attribute prior to this transformation, it is dropped.
	+ * There are no "moon" attributes in date_spec elements of rules. If there were
	+ any prior to this transformation, the attributes are now removed and the rest
	+ of the date_spec is unchanged.
	* The crmd-finalization-timeout cluster property has been renamed to
	"join-finalization-timeout".
	* The crmd-integration-timeout cluster property has been renamed to
	"join-integration-timeout".
	* The crmd-transition-delay cluster property has been renamed to
	"transition-delay".
	* The remove-after-stop cluster property is not present.
	* The stonith-action cluster property is set to "off" if it was previously set
	to "poweroff".

	nvset elements include the following:
	* cluster_property_set
	* instance_attributes
	* meta_attributes
	* utilization

	Any template that matches an element (for example, "primitive") that may
	contain an nvset should be placed in a later stylesheet. If such a template is
	placed in this stylesheet, its nvsets will not be sorted. We could avoid this
	with some refactoring, but it's cleaner this way.
	-->

	<xsl:stylesheet version="1.0"
	xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

	<xsl:import href="upgrade-3.10-common.xsl"/>

	<!--
	Copy everything unaltered by default, except sort nvset elements by score.

	This doesn't affect behavior. nvset elements of a given type within a given
	parent element are processed in order of their score attributes, with a
	nonexistent score treated as 0. In the event of a tie, elements are processed
	in document order. The sort here preserves document order in the event of a
	tie.

	The order of nvset elements relative to non-nvset elements does not matter. So
	this template puts existing nvset elements after existing non-nvset elements.

	This facilitates later transformations, allowing us to more easily drop nvpairs
	with unsupported values without changing behavior.
	-->
	<xsl:template match="/\|@*\|node()">
	<xsl:copy>
	<xsl:variable name="nvsets"
	select="cluster_property_set
	\|instance_attributes
	\|meta_attributes
	\|utilization"/>

	<!-- XPath 1.0 set difference idiom -->
	<xsl:variable name="non_nvsets"
	select="@*\|node()[count(.\|$nvsets) != count($nvsets)]"/>

	<xsl:apply-templates select="$non_nvsets"/>
	<xsl:apply-templates select="$nvsets">
	<!--
	Order cluster_property_set with id "cib-bootstrap-options" before
	siblings
	-->
	<xsl:sort select="self::cluster_property_set
	and (@id = 'cib-bootstrap-options')"
	order="descending"/>

	<!--
	Sort remaining elements by score.

	First, score="INFINITY" (including "+INFINITY").
	-->
	<xsl:sort select="@score[. = 'INFINITY'] or @score[. = '+INFINITY']"
	order="descending"/>

	<!-- Then finite positive scores -->
	<xsl:sort select="@score[. > 0]" data-type="number"
	order="descending"/>

	<!-- Then score 0 (including implicit) -->
	<xsl:sort select="number(not(@score) or @score[. = 0])"
	data-type="number" order="descending"/>

	<!-- Then finite negative scores -->
	<xsl:sort select="@score[. < 0]" data-type="number"
	order="descending"/>

	<!-- Then score="-INFINITY" -->
	<xsl:sort select="@score[. = '-INFINITY']" order="descending"/>
	</xsl:apply-templates>
	</xsl:copy>
	</xsl:template>

	<!--
	Bump cib/@validate-with, or set it if not already set. Pacemaker does this, but
	doing it in the transformation is helpful for testing.
	-->
	<xsl:template match="cib">
	<xsl:copy>
	<xsl:apply-templates select="@*"/>
	<xsl:attribute name="validate-with">pacemaker-4.0</xsl:attribute>
	<xsl:apply-templates select="node()"/>
	</xsl:copy>
	</xsl:template>


	<!-- Name/value pairs -->

	<!-- Drop any nvpair that does not have a value attribute -->
	<xsl:template match="nvpair[not(@value)]"/>


	+<!-- Rules -->
	+
	+<!-- Drop the moon attribute from date_spec elements -->
	+<xsl:template match="date_spec/@moon"/>
	+
	+
	<!-- Cluster properties -->

	<!-- Rename crmd-finalization-timeout property to join-finalization-timeout -->
	<xsl:template match="cluster_property_set
	/nvpair[@name = 'crmd-finalization-timeout']/@name">
	<xsl:attribute name="name">join-finalization-timeout</xsl:attribute>
	</xsl:template>

	<!-- Rename crmd-integration-timeout property to join-integration-timeout -->
	<xsl:template match="cluster_property_set
	/nvpair[@name = 'crmd-integration-timeout']/@name">
	<xsl:attribute name="name">join-integration-timeout</xsl:attribute>
	</xsl:template>

	<!-- Rename crmd-transition-delay property to transition-delay -->
	<xsl:template match="cluster_property_set
	/nvpair[@name = 'crmd-transition-delay']/@name">
	<xsl:attribute name="name">transition-delay</xsl:attribute>
	</xsl:template>

	<!-- Drop remove-after-stop property -->
	<xsl:template match="cluster_property_set/nvpair[@name = 'remove-after-stop']"/>

	<!-- Replace stonith-action="poweroff" with stonith-action="off" -->
	<xsl:template match="cluster_property_set/nvpair[@name = 'stonith-action']
	/@value[. = 'poweroff']">
	<xsl:attribute name="value">off</xsl:attribute>
	</xsl:template>

	</xsl:stylesheet>

File Metadata

Mime Type: text/x-diff
Expires: Mon, Apr 21, 6:04 PM (15 h, 7 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1665038
Default Alt Text: (260 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions