No OneTemporary
Actions

Size

201 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/common/acl.c b/lib/common/acl.c
	index 39f5cc730a..39091a7409 100644
	--- a/lib/common/acl.c
	+++ b/lib/common/acl.c
	@@ -1,862 +1,863 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h>
	#include <sys/types.h>
	#include <pwd.h>
	#include <string.h>
	#include <stdlib.h>
	#include <stdarg.h>

	#include <libxml/tree.h>

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h>
	#include "crmcommon_private.h"

	typedef struct xml_acl_s {
	enum xml_private_flags mode;
	char *xpath;
	} xml_acl_t;

	static void
	free_acl(void *data)
	{
	if (data) {
	xml_acl_t *acl = data;

	free(acl->xpath);
	free(acl);
	}
	}

	void
	pcmk__free_acls(GList *acls)
	{
	g_list_free_full(acls, free_acl);
	}

	static GList *
	create_acl(xmlNode xml, GList acls, enum xml_private_flags mode)
	{
	xml_acl_t *acl = NULL;

	const char *tag = crm_element_value(xml, XML_ACL_ATTR_TAG);
	const char *ref = crm_element_value(xml, XML_ACL_ATTR_REF);
	const char *xpath = crm_element_value(xml, XML_ACL_ATTR_XPATH);
	const char *attr = crm_element_value(xml, XML_ACL_ATTR_ATTRIBUTE);

	if (tag == NULL) {
	// @COMPAT rolling upgrades <=1.1.11
	tag = crm_element_value(xml, XML_ACL_ATTR_TAGv1);
	}
	if (ref == NULL) {
	// @COMPAT rolling upgrades <=1.1.11
	ref = crm_element_value(xml, XML_ACL_ATTR_REFv1);
	}

	if ((tag == NULL) && (ref == NULL) && (xpath == NULL)) {
	// Schema should prevent this, but to be safe ...
	crm_trace("Ignoring ACL <%s> element without selection criteria",
	crm_element_name(xml));
	return NULL;
	}

	acl = calloc(1, sizeof (xml_acl_t));
	CRM_ASSERT(acl != NULL);

	acl->mode = mode;
	if (xpath) {
	acl->xpath = strdup(xpath);
	CRM_ASSERT(acl->xpath != NULL);
	crm_trace("Unpacked ACL <%s> element using xpath: %s",
	crm_element_name(xml), acl->xpath);

	} else {
	GString *buf = g_string_sized_new(128);

	if ((ref != NULL) && (attr != NULL)) {
	// NOTE: schema currently does not allow this
	pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), "[@" XML_ATTR_ID "='",
	ref, "' and @", attr, "]", NULL);

	} else if (ref != NULL) {
	pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), "[@" XML_ATTR_ID "='",
	ref, "']", NULL);

	} else if (attr != NULL) {
	pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), "[@", attr, "]", NULL);

	} else {
	pcmk__g_strcat(buf, "//", pcmk__s(tag, "*"), NULL);
	}

	acl->xpath = strdup((const char *) buf->str);
	CRM_ASSERT(acl->xpath != NULL);

	g_string_free(buf, TRUE);
	crm_trace("Unpacked ACL <%s> element as xpath: %s",
	crm_element_name(xml), acl->xpath);
	}

	return g_list_append(acls, acl);
	}

	/*!
	* \internal
	* \brief Unpack a user, group, or role subtree of the ACLs section
	*
	* \param[in] acl_top XML of entire ACLs section
	* \param[in] acl_entry XML of ACL element being unpacked
	* \param[in,out] acls List of ACLs unpacked so far
	*
	* \return New head of (possibly modified) acls
	*
	* \note This function is recursive
	*/
	static GList *
	parse_acl_entry(xmlNode acl_top, xmlNode acl_entry, GList *acls)
	{
	xmlNode *child = NULL;

	for (child = pcmk__xe_first_child(acl_entry); child;
	child = pcmk__xe_next(child)) {
	const char *tag = crm_element_name(child);
	const char *kind = crm_element_value(child, XML_ACL_ATTR_KIND);

	if (strcmp(XML_ACL_TAG_PERMISSION, tag) == 0){
	CRM_ASSERT(kind != NULL);
	crm_trace("Unpacking ACL <%s> element of kind '%s'", tag, kind);
	tag = kind;
	} else {
	crm_trace("Unpacking ACL <%s> element", tag);
	}

	if (strcmp(XML_ACL_TAG_ROLE_REF, tag) == 0
	\|\| strcmp(XML_ACL_TAG_ROLE_REFv1, tag) == 0) {
	const char *ref_role = crm_element_value(child, XML_ATTR_ID);

	if (ref_role) {
	xmlNode *role = NULL;

	for (role = pcmk__xe_first_child(acl_top); role;
	role = pcmk__xe_next(role)) {
	if (!strcmp(XML_ACL_TAG_ROLE, (const char *) role->name)) {
	const char *role_id = crm_element_value(role,
	XML_ATTR_ID);

	if (role_id && strcmp(ref_role, role_id) == 0) {
	crm_trace("Unpacking referenced role '%s' in ACL <%s> element",
	role_id, crm_element_name(acl_entry));
	acls = parse_acl_entry(acl_top, role, acls);
	break;
	}
	}
	}
	}

	} else if (strcmp(XML_ACL_TAG_READ, tag) == 0) {
	acls = create_acl(child, acls, pcmk__xf_acl_read);

	} else if (strcmp(XML_ACL_TAG_WRITE, tag) == 0) {
	acls = create_acl(child, acls, pcmk__xf_acl_write);

	} else if (strcmp(XML_ACL_TAG_DENY, tag) == 0) {
	acls = create_acl(child, acls, pcmk__xf_acl_deny);

	} else {
	crm_warn("Ignoring unknown ACL %s '%s'",
	(kind? "kind" : "element"), tag);
	}
	}

	return acls;
	}

	/*
	<acls>
	<acl_target id="l33t-haxor"><role id="auto-l33t-haxor"/></acl_target>
	<acl_role id="auto-l33t-haxor">
	<acl_permission id="crook-nothing" kind="deny" xpath="/cib"/>
	</acl_role>
	<acl_target id="niceguy">
	<role id="observer"/>
	</acl_target>
	<acl_role id="observer">
	<acl_permission id="observer-read-1" kind="read" xpath="/cib"/>
	<acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>
	<acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>
	</acl_role>
	<acl_target id="badidea"><role id="auto-badidea"/></acl_target>
	<acl_role id="auto-badidea">
	<acl_permission id="badidea-resources" kind="read" xpath="//meta_attributes"/>
	<acl_permission id="badidea-resources-2" kind="deny" reference="dummy-meta_attributes"/>
	</acl_role>
	</acls>
	*/

	static const char *
	acl_to_text(enum xml_private_flags flags)
	{
	if (pcmk_is_set(flags, pcmk__xf_acl_deny)) {
	return "deny";

	} else if (pcmk_any_flags_set(flags, pcmk__xf_acl_write\|pcmk__xf_acl_create)) {
	return "read/write";

	} else if (pcmk_is_set(flags, pcmk__xf_acl_read)) {
	return "read";
	}
	return "none";
	}

	void
	pcmk__apply_acl(xmlNode *xml)
	{
	GList *aIter = NULL;
	- xml_private_t *p = xml->doc->_private;
	+ xml_doc_private_t *docpriv = xml->doc->_private;
	+ xml_node_private_t *nodepriv;
	xmlXPathObjectPtr xpathObj = NULL;

	if (!xml_acl_enabled(xml)) {
	crm_trace("Skipping ACLs for user '%s' because not enabled for this XML",
	- p->user);
	+ docpriv->user);
	return;
	}

	- for (aIter = p->acls; aIter != NULL; aIter = aIter->next) {
	+ for (aIter = docpriv->acls; aIter != NULL; aIter = aIter->next) {
	int max = 0, lpc = 0;
	xml_acl_t *acl = aIter->data;

	xpathObj = xpath_search(xml, acl->xpath);
	max = numXpathResults(xpathObj);

	for (lpc = 0; lpc < max; lpc++) {
	static struct qb_log_callsite *trace_cs = NULL;
	xmlNode *match = getXpathResult(xpathObj, lpc);

	- p = match->_private;
	- pcmk__set_xml_flags(p, acl->mode);
	+ nodepriv = match->_private;
	+ pcmk__set_xml_flags(nodepriv, acl->mode);

	/* Build a GString only if tracing is enabled.
	* Can't use pcmk__log_else() because the else_action would be
	* continue.
	*/
	if (trace_cs == NULL) {
	trace_cs = qb_log_callsite_get(__func__, __FILE__, "apply_acl",
	LOG_TRACE, __LINE__, 0);
	}
	if (crm_is_callsite_active(trace_cs, LOG_TRACE, 0)) {
	GString *path = pcmk__element_xpath(match);
	crm_trace("Applying %s ACL to %s matched by %s",
	acl_to_text(acl->mode), (const char *) path->str,
	acl->xpath);
	g_string_free(path, TRUE);
	}
	}
	crm_trace("Applied %s ACL %s (%d match%s)",
	acl_to_text(acl->mode), acl->xpath, max,
	((max == 1)? "" : "es"));
	freeXpathObject(xpathObj);
	}
	}

	/*!
	* \internal
	* \brief Unpack ACLs for a given user into the
	* metadata of the target XML tree
	*
	* Taking the description of ACLs from the source XML tree and
	* marking up the target XML tree with access information for the
	* given user by tacking it onto the relevant nodes
	*
	* \param[in] source XML with ACL definitions
	* \param[in,out] target XML that ACLs will be applied to
	* \param[in] user Username whose ACLs need to be unpacked
	*/
	void
	pcmk__unpack_acl(xmlNode source, xmlNode target, const char *user)
	{
	- xml_private_t *p = NULL;
	+ xml_doc_private_t *docpriv = NULL;

	if ((target == NULL) \|\| (target->doc == NULL)
	\|\| (target->doc->_private == NULL)) {
	return;
	}

	- p = target->doc->_private;
	+ docpriv = target->doc->_private;
	if (!pcmk_acl_required(user)) {
	crm_trace("Not unpacking ACLs because not required for user '%s'",
	user);

	- } else if (p->acls == NULL) {
	+ } else if (docpriv->acls == NULL) {
	xmlNode *acls = get_xpath_object("//" XML_CIB_TAG_ACLS,
	source, LOG_NEVER);

	- pcmk__str_update(&p->user, user);
	+ pcmk__str_update(&docpriv->user, user);

	if (acls) {
	xmlNode *child = NULL;

	for (child = pcmk__xe_first_child(acls); child;
	child = pcmk__xe_next(child)) {
	const char *tag = crm_element_name(child);

	if (!strcmp(tag, XML_ACL_TAG_USER)
	\|\| !strcmp(tag, XML_ACL_TAG_USERv1)) {
	const char *id = crm_element_value(child, XML_ATTR_NAME);

	if (id == NULL) {
	id = crm_element_value(child, XML_ATTR_ID);
	}

	if (id && strcmp(id, user) == 0) {
	crm_debug("Unpacking ACLs for user '%s'", id);
	- p->acls = parse_acl_entry(acls, child, p->acls);
	+ docpriv->acls = parse_acl_entry(acls, child, docpriv->acls);
	}
	} else if (!strcmp(tag, XML_ACL_TAG_GROUP)) {
	const char *id = crm_element_value(child, XML_ATTR_NAME);

	if (id == NULL) {
	id = crm_element_value(child, XML_ATTR_ID);
	}

	if (id && pcmk__is_user_in_group(user,id)) {
	crm_debug("Unpacking ACLs for group '%s'", id);
	- p->acls = parse_acl_entry(acls, child, p->acls);
	+ docpriv->acls = parse_acl_entry(acls, child, docpriv->acls);
	}
	}
	}
	}
	}
	}

	/*!
	* \internal
	* \brief Copy source to target and set xf_acl_enabled flag in target
	*
	* \param[in] acl_source XML with ACL definitions
	* \param[in,out] target XML that ACLs will be applied to
	* \param[in] user Username whose ACLs need to be set
	*/
	void
	pcmk__enable_acl(xmlNode acl_source, xmlNode target, const char *user)
	{
	pcmk__unpack_acl(acl_source, target, user);
	pcmk__set_xml_doc_flag(target, pcmk__xf_acl_enabled);
	pcmk__apply_acl(target);
	}

	static inline bool
	test_acl_mode(enum xml_private_flags allowed, enum xml_private_flags requested)
	{
	if (pcmk_is_set(allowed, pcmk__xf_acl_deny)) {
	return false;

	} else if (pcmk_all_flags_set(allowed, requested)) {
	return true;

	} else if (pcmk_is_set(requested, pcmk__xf_acl_read)
	&& pcmk_is_set(allowed, pcmk__xf_acl_write)) {
	return true;

	} else if (pcmk_is_set(requested, pcmk__xf_acl_create)
	&& pcmk_any_flags_set(allowed, pcmk__xf_acl_write\|pcmk__xf_created)) {
	return true;
	}
	return false;
	}

	/*!
	* \internal
	* \brief Rid XML tree of all unreadable nodes and node properties
	*
	* \param[in] xml root node to be purged of attributes
	*
	* \return true if this node or any of its children are readable
	* if false is returned, xml will be freed
	*
	* \note This function is recursive
	*/
	static bool
	purge_xml_attributes(xmlNode *xml)
	{
	xmlNode *child = NULL;
	xmlAttr *xIter = NULL;
	bool readable_children = false;
	- xml_private_t *p = xml->_private;
	+ xml_node_private_t *nodepriv = xml->_private;

	- if (test_acl_mode(p->flags, pcmk__xf_acl_read)) {
	+ if (test_acl_mode(nodepriv->flags, pcmk__xf_acl_read)) {
	crm_trace("%s[@id=%s] is readable", crm_element_name(xml), ID(xml));
	return true;
	}

	xIter = xml->properties;
	while (xIter != NULL) {
	xmlAttr *tmp = xIter;
	const char prop_name = (const char )xIter->name;

	xIter = xIter->next;
	if (strcmp(prop_name, XML_ATTR_ID) == 0) {
	continue;
	}

	xmlUnsetProp(xml, tmp->name);
	}

	child = pcmk__xml_first_child(xml);
	while ( child != NULL ) {
	xmlNode *tmp = child;

	child = pcmk__xml_next(child);
	readable_children \|= purge_xml_attributes(tmp);
	}

	if (!readable_children) {
	free_xml(xml); /* Nothing readable under here, purge completely */
	}
	return readable_children;
	}

	/*!
	* \brief Copy ACL-allowed portions of specified XML
	*
	* \param[in] user Username whose ACLs should be used
	* \param[in] acl_source XML containing ACLs
	* \param[in] xml XML to be copied
	* \param[out] result Copy of XML portions readable via ACLs
	*
	* \return true if xml exists and ACLs are required for user, false otherwise
	* \note If this returns true, caller should use \p result rather than \p xml
	*/
	bool
	xml_acl_filtered_copy(const char user, xmlNode acl_source, xmlNode *xml,
	xmlNode **result)
	{
	GList *aIter = NULL;
	xmlNode *target = NULL;
	- xml_private_t *doc = NULL;
	+ xml_doc_private_t *docpriv = NULL;

	*result = NULL;
	if ((xml == NULL) \|\| !pcmk_acl_required(user)) {
	crm_trace("Not filtering XML because ACLs not required for user '%s'",
	user);
	return false;
	}

	crm_trace("Filtering XML copy using user '%s' ACLs", user);
	target = copy_xml(xml);
	if (target == NULL) {
	return true;
	}

	pcmk__enable_acl(acl_source, target, user);

	- doc = target->doc->_private;
	- for(aIter = doc->acls; aIter != NULL && target; aIter = aIter->next) {
	+ docpriv = target->doc->_private;
	+ for(aIter = docpriv->acls; aIter != NULL && target; aIter = aIter->next) {
	int max = 0;
	xml_acl_t *acl = aIter->data;

	if (acl->mode != pcmk__xf_acl_deny) {
	/* Nothing to do */

	} else if (acl->xpath) {
	int lpc = 0;
	xmlXPathObjectPtr xpathObj = xpath_search(target, acl->xpath);

	max = numXpathResults(xpathObj);
	for(lpc = 0; lpc < max; lpc++) {
	xmlNode *match = getXpathResult(xpathObj, lpc);

	if (!purge_xml_attributes(match) && (match == target)) {
	crm_trace("ACLs deny user '%s' access to entire XML document",
	user);
	freeXpathObject(xpathObj);
	return true;
	}
	}
	crm_trace("ACLs deny user '%s' access to %s (%d %s)",
	user, acl->xpath, max,
	pcmk__plural_alt(max, "match", "matches"));
	freeXpathObject(xpathObj);
	}
	}

	if (!purge_xml_attributes(target)) {
	crm_trace("ACLs deny user '%s' access to entire XML document", user);
	return true;
	}

	- if (doc->acls) {
	- g_list_free_full(doc->acls, free_acl);
	- doc->acls = NULL;
	+ if (docpriv->acls) {
	+ g_list_free_full(docpriv->acls, free_acl);
	+ docpriv->acls = NULL;

	} else {
	crm_trace("User '%s' without ACLs denied access to entire XML document",
	user);
	free_xml(target);
	target = NULL;
	}

	if (target) {
	*result = target;
	}

	return true;
	}

	/*!
	* \internal
	* \brief Check whether creation of an XML element is implicitly allowed
	*
	* Check whether XML is a "scaffolding" element whose creation is implicitly
	* allowed regardless of ACLs (that is, it is not in the ACL section and has
	* no attributes other than "id").
	*
	* \param[in] xml XML element to check
	*
	* \return true if XML element is implicitly allowed, false otherwise
	*/
	static bool
	implicitly_allowed(xmlNode *xml)
	{
	GString *path = NULL;

	for (xmlAttr *prop = xml->properties; prop != NULL; prop = prop->next) {
	if (strcmp((const char *) prop->name, XML_ATTR_ID) != 0) {
	return false;
	}
	}

	path = pcmk__element_xpath(xml);
	CRM_ASSERT(path != NULL);

	if (strstr((const char *) path->str, "/" XML_CIB_TAG_ACLS "/") != NULL) {
	g_string_free(path, TRUE);
	return false;
	}

	g_string_free(path, TRUE);
	return true;
	}

	#define display_id(xml) (ID(xml)? ID(xml) : "<unset>")

	/*!
	* \internal
	* \brief Drop XML nodes created in violation of ACLs
	*
	* Given an XML element, free all of its descendent nodes created in violation
	* of ACLs, with the exception of allowing "scaffolding" elements (i.e. those
	* that aren't in the ACL section and don't have any attributes other than
	* "id").
	*
	* \param[in,out] xml XML to check
	* \param[in] check_top Whether to apply checks to argument itself
	* (if true, xml might get freed)
	*
	* \note This function is recursive
	*/
	void
	pcmk__apply_creation_acl(xmlNode *xml, bool check_top)
	{
	- xml_private_t *p = xml->_private;
	+ xml_node_private_t *nodepriv = xml->_private;

	- if (pcmk_is_set(p->flags, pcmk__xf_created)) {
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_created)) {
	if (implicitly_allowed(xml)) {
	crm_trace("Creation of <%s> scaffolding with id=\"%s\""
	" is implicitly allowed",
	crm_element_name(xml), display_id(xml));

	} else if (pcmk__check_acl(xml, NULL, pcmk__xf_acl_write)) {
	crm_trace("ACLs allow creation of <%s> with id=\"%s\"",
	crm_element_name(xml), display_id(xml));

	} else if (check_top) {
	crm_trace("ACLs disallow creation of <%s> with id=\"%s\"",
	crm_element_name(xml), display_id(xml));
	pcmk_free_xml_subtree(xml);
	return;

	} else {
	crm_notice("ACLs would disallow creation of %s<%s> with id=\"%s\" ",
	((xml == xmlDocGetRootElement(xml->doc))? "root element " : ""),
	crm_element_name(xml), display_id(xml));
	}
	}

	for (xmlNode *cIter = pcmk__xml_first_child(xml); cIter != NULL; ) {
	xmlNode *child = cIter;
	cIter = pcmk__xml_next(cIter); /* In case it is free'd */
	pcmk__apply_creation_acl(child, true);
	}
	}

	/*!
	* \brief Check whether or not an XML node is ACL-denied
	*
	* \param[in] xml node to check
	*
	* \return true if XML node exists and is ACL-denied, false otherwise
	*/
	bool
	xml_acl_denied(xmlNode *xml)
	{
	if (xml && xml->doc && xml->doc->_private){
	- xml_private_t *p = xml->doc->_private;
	+ xml_doc_private_t *docpriv = xml->doc->_private;

	- return pcmk_is_set(p->flags, pcmk__xf_acl_denied);
	+ return pcmk_is_set(docpriv->flags, pcmk__xf_acl_denied);
	}
	return false;
	}

	void
	xml_acl_disable(xmlNode *xml)
	{
	if (xml_acl_enabled(xml)) {
	- xml_private_t *p = xml->doc->_private;
	+ xml_doc_private_t *docpriv = xml->doc->_private;

	/* Catch anything that was created but shouldn't have been */
	pcmk__apply_acl(xml);
	pcmk__apply_creation_acl(xml, false);
	- pcmk__clear_xml_flags(p, pcmk__xf_acl_enabled);
	+ pcmk__clear_xml_flags(docpriv, pcmk__xf_acl_enabled);
	}
	}

	/*!
	* \brief Check whether or not an XML node is ACL-enabled
	*
	* \param[in] xml node to check
	*
	* \return true if XML node exists and is ACL-enabled, false otherwise
	*/
	bool
	xml_acl_enabled(xmlNode *xml)
	{
	if (xml && xml->doc && xml->doc->_private){
	- xml_private_t *p = xml->doc->_private;
	+ xml_doc_private_t *docpriv = xml->doc->_private;

	- return pcmk_is_set(p->flags, pcmk__xf_acl_enabled);
	+ return pcmk_is_set(docpriv->flags, pcmk__xf_acl_enabled);
	}
	return false;
	}

	bool
	pcmk__check_acl(xmlNode xml, const char name, enum xml_private_flags mode)
	{
	CRM_ASSERT(xml);
	CRM_ASSERT(xml->doc);
	CRM_ASSERT(xml->doc->_private);

	if (pcmk__tracking_xml_changes(xml, false) && xml_acl_enabled(xml)) {
	xmlNode *parent = xml;
	- xml_private_t *docp = xml->doc->_private;
	+ xml_doc_private_t *docpriv = xml->doc->_private;
	GString *xpath = NULL;

	- if (docp->acls == NULL) {
	+ if (docpriv->acls == NULL) {
	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_denied);

	pcmk__log_else(LOG_TRACE, return false);
	xpath = pcmk__element_xpath(xml);
	if (name != NULL) {
	pcmk__g_strcat(xpath, "[@", name, "]", NULL);
	}

	qb_log_from_external_source(__func__, __FILE__,
	"User '%s' without ACLs denied %s "
	"access to %s", LOG_TRACE, __LINE__, 0,
	- docp->user, acl_to_text(mode),
	+ docpriv->user, acl_to_text(mode),
	(const char *) xpath->str);
	g_string_free(xpath, TRUE);
	return false;
	}

	/* Walk the tree upwards looking for xml_acl_* flags
	* - Creating an attribute requires write permissions for the node
	* - Creating a child requires write permissions for the parent
	*/

	if (name) {
	xmlAttr *attr = xmlHasProp(xml, (pcmkXmlStr) name);

	if (attr && mode == pcmk__xf_acl_create) {
	mode = pcmk__xf_acl_write;
	}
	}

	while (parent && parent->_private) {
	- xml_private_t *p = parent->_private;
	- if (test_acl_mode(p->flags, mode)) {
	+ xml_node_private_t *nodepriv = parent->_private;
	+ if (test_acl_mode(nodepriv->flags, mode)) {
	return true;

	- } else if (pcmk_is_set(p->flags, pcmk__xf_acl_deny)) {
	+ } else if (pcmk_is_set(nodepriv->flags, pcmk__xf_acl_deny)) {
	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_denied);

	pcmk__log_else(LOG_TRACE, return false);
	xpath = pcmk__element_xpath(xml);
	if (name != NULL) {
	pcmk__g_strcat(xpath, "[@", name, "]", NULL);
	}

	qb_log_from_external_source(__func__, __FILE__,
	"%sACL denies user '%s' %s access "
	"to %s", LOG_TRACE, __LINE__, 0,
	(parent != xml)? "Parent ": "",
	- docp->user, acl_to_text(mode),
	+ docpriv->user, acl_to_text(mode),
	(const char *) xpath->str);
	g_string_free(xpath, TRUE);
	return false;
	}
	parent = parent->parent;
	}

	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_denied);

	pcmk__log_else(LOG_TRACE, return false);
	xpath = pcmk__element_xpath(xml);
	if (name != NULL) {
	pcmk__g_strcat(xpath, "[@", name, "]", NULL);
	}

	qb_log_from_external_source(__func__, __FILE__,
	"Default ACL denies user '%s' %s access to "
	"%s", LOG_TRACE, __LINE__, 0,
	- docp->user, acl_to_text(mode),
	+ docpriv->user, acl_to_text(mode),
	(const char *) xpath->str);
	g_string_free(xpath, TRUE);
	return false;
	}

	return true;
	}

	/*!
	* \brief Check whether ACLs are required for a given user
	*
	* \param[in] User name to check
	*
	* \return true if the user requires ACLs, false otherwise
	*/
	bool
	pcmk_acl_required(const char *user)
	{
	if (pcmk__str_empty(user)) {
	crm_trace("ACLs not required because no user set");
	return false;

	} else if (!strcmp(user, CRM_DAEMON_USER) \|\| !strcmp(user, "root")) {
	crm_trace("ACLs not required for privileged user %s", user);
	return false;
	}
	crm_trace("ACLs required for %s", user);
	return true;
	}

	char *
	pcmk__uid2username(uid_t uid)
	{
	struct passwd *pwent = getpwuid(uid);

	if (pwent == NULL) {
	crm_perror(LOG_INFO, "Cannot get user details for user ID %d", uid);
	return NULL;
	}
	return strdup(pwent->pw_name);
	}

	/*!
	* \internal
	* \brief Set the ACL user field properly on an XML request
	*
	* Multiple user names are potentially involved in an XML request: the effective
	* user of the current process; the user name known from an IPC client
	* connection; and the user name obtained from the request itself, whether by
	* the current standard XML attribute name or an older legacy attribute name.
	* This function chooses the appropriate one that should be used for ACLs, sets
	* it in the request (using the standard attribute name, and the legacy name if
	* given), and returns it.
	*
	* \param[in,out] request XML request to update
	* \param[in] field Alternate name for ACL user name XML attribute
	* \param[in] peer_user User name as known from IPC connection
	*
	* \return ACL user name actually used
	*/
	const char *
	pcmk__update_acl_user(xmlNode request, const char field,
	const char *peer_user)
	{
	static const char *effective_user = NULL;
	const char *requested_user = NULL;
	const char *user = NULL;

	if (effective_user == NULL) {
	effective_user = pcmk__uid2username(geteuid());
	if (effective_user == NULL) {
	effective_user = strdup("#unprivileged");
	CRM_CHECK(effective_user != NULL, return NULL);
	crm_err("Unable to determine effective user, assuming unprivileged for ACLs");
	}
	}

	requested_user = crm_element_value(request, XML_ACL_TAG_USER);
	if (requested_user == NULL) {
	/* @COMPAT rolling upgrades <=1.1.11
	*
	* field is checked for backward compatibility with older versions that
	* did not use XML_ACL_TAG_USER.
	*/
	requested_user = crm_element_value(request, field);
	}

	if (!pcmk__is_privileged(effective_user)) {
	/* We're not running as a privileged user, set or overwrite any existing
	* value for $XML_ACL_TAG_USER
	*/
	user = effective_user;

	} else if (peer_user == NULL && requested_user == NULL) {
	/* No user known or requested, use 'effective_user' and make sure one is
	* set for the request
	*/
	user = effective_user;

	} else if (peer_user == NULL) {
	/* No user known, trusting 'requested_user' */
	user = requested_user;

	} else if (!pcmk__is_privileged(peer_user)) {
	/* The peer is not a privileged user, set or overwrite any existing
	* value for $XML_ACL_TAG_USER
	*/
	user = peer_user;

	} else if (requested_user == NULL) {
	/* Even if we're privileged, make sure there is always a value set */
	user = peer_user;

	} else {
	/* Legal delegation to 'requested_user' */
	user = requested_user;
	}

	// This requires pointer comparison, not string comparison
	if (user != crm_element_value(request, XML_ACL_TAG_USER)) {
	crm_xml_add(request, XML_ACL_TAG_USER, user);
	}

	if (field != NULL && user != crm_element_value(request, field)) {
	crm_xml_add(request, field, user);
	}

	return requested_user;
	}
	diff --git a/lib/common/crmcommon_private.h b/lib/common/crmcommon_private.h
	index 2dcedf32e8..3ddf6f47e8 100644
	--- a/lib/common/crmcommon_private.h
	+++ b/lib/common/crmcommon_private.h
	@@ -1,294 +1,299 @@
	/*
	* Copyright 2018-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#ifndef CRMCOMMON_PRIVATE__H
	# define CRMCOMMON_PRIVATE__H

	/* This header is for the sole use of libcrmcommon, so that functions can be
	* declared with G_GNUC_INTERNAL for efficiency.
	*/

	#include <stdint.h> // uint8_t, uint32_t
	#include <stdbool.h> // bool
	#include <sys/types.h> // size_t
	#include <glib.h> // GList
	#include <libxml/tree.h> // xmlNode, xmlAttr
	#include <qb/qbipcc.h> // struct qb_ipc_response_header

	// Decent chunk size for processing large amounts of data
	#define PCMK__BUFFER_SIZE 4096

	#if defined(PCMK__UNIT_TESTING)
	#undef G_GNUC_INTERNAL
	#define G_GNUC_INTERNAL
	#endif

	/* When deleting portions of an XML tree, we keep a record so we can know later
	* (e.g. when checking differences) that something was deleted.
	*/
	typedef struct pcmk__deleted_xml_s {
	char *path;
	int position;
	} pcmk__deleted_xml_t;

	-typedef struct xml_private_s {
	+typedef struct xml_node_private_s {
	+ long check;
	+ uint32_t flags;
	+} xml_node_private_t;
	+
	+typedef struct xml_doc_private_s {
	long check;
	uint32_t flags;
	char *user;
	GList *acls;
	GList *deleted_objs; // List of pcmk__deleted_xml_t
	-} xml_private_t;
	+} xml_doc_private_t;

	#define pcmk__set_xml_flags(xml_priv, flags_to_set) do { \
	(xml_priv)->flags = pcmk__set_flags_as(__func__, __LINE__, \
	LOG_NEVER, "XML", "XML node", (xml_priv)->flags, \
	(flags_to_set), #flags_to_set); \
	} while (0)

	#define pcmk__clear_xml_flags(xml_priv, flags_to_clear) do { \
	(xml_priv)->flags = pcmk__clear_flags_as(__func__, __LINE__, \
	LOG_NEVER, "XML", "XML node", (xml_priv)->flags, \
	(flags_to_clear), #flags_to_clear); \
	} while (0)

	G_GNUC_INTERNAL
	void pcmk__xml2text(xmlNodePtr data, int options, GString *buffer, int depth);

	G_GNUC_INTERNAL
	bool pcmk__tracking_xml_changes(xmlNode *xml, bool lazy);

	G_GNUC_INTERNAL
	void pcmk__mark_xml_created(xmlNode *xml);

	G_GNUC_INTERNAL
	int pcmk__xml_position(xmlNode *xml, enum xml_private_flags ignore_if_set);

	G_GNUC_INTERNAL
	xmlNode pcmk__xml_match(xmlNode haystack, xmlNode *needle, bool exact);

	G_GNUC_INTERNAL
	void pcmk__xml_log(int log_level, const char file, const char function,
	int line, const char prefix, const xmlNode data, int depth,
	int options);

	G_GNUC_INTERNAL
	void pcmk__xml_update(xmlNode parent, xmlNode target, xmlNode *update,
	bool as_diff);

	G_GNUC_INTERNAL
	xmlNode pcmk__xc_match(xmlNode root, xmlNode *search_comment, bool exact);

	G_GNUC_INTERNAL
	void pcmk__xc_update(xmlNode parent, xmlNode target, xmlNode *update);

	G_GNUC_INTERNAL
	void pcmk__free_acls(GList *acls);

	G_GNUC_INTERNAL
	void pcmk__unpack_acl(xmlNode source, xmlNode target, const char *user);

	G_GNUC_INTERNAL
	bool pcmk__is_user_in_group(const char user, const char group);

	G_GNUC_INTERNAL
	void pcmk__apply_acl(xmlNode *xml);

	G_GNUC_INTERNAL
	void pcmk__apply_creation_acl(xmlNode *xml, bool check_top);

	G_GNUC_INTERNAL
	void pcmk__mark_xml_attr_dirty(xmlAttr *a);

	G_GNUC_INTERNAL
	bool pcmk__xa_filterable(const char *name);

	static inline const char *
	pcmk__xml_attr_value(const xmlAttr *attr)
	{
	return ((attr == NULL) \|\| (attr->children == NULL))? NULL
	: (const char *) attr->children->content;
	}

	/*
	* IPC
	*/

	#define PCMK__IPC_VERSION 1

	#define PCMK__CONTROLD_API_MAJOR "1"
	#define PCMK__CONTROLD_API_MINOR "0"

	// IPC behavior that varies by daemon
	typedef struct pcmk__ipc_methods_s {
	/*!
	* \internal
	* \brief Allocate any private data needed by daemon IPC
	*
	* \param[in,out] api IPC API connection
	*
	* \return Standard Pacemaker return code
	*/
	int (new_data)(pcmk_ipc_api_t api);

	/*!
	* \internal
	* \brief Free any private data used by daemon IPC
	*
	* \param[in,out] api_data Data allocated by new_data() method
	*/
	void (free_data)(void api_data);

	/*!
	* \internal
	* \brief Perform daemon-specific handling after successful connection
	*
	* Some daemons require clients to register before sending any other
	* commands. The controller requires a CRM_OP_HELLO (with no reply), and
	* the CIB manager, executor, and fencer require a CRM_OP_REGISTER (with a
	* reply). Ideally this would be consistent across all daemons, but for now
	* this allows each to do its own authorization.
	*
	* \param[in,out] api IPC API connection
	*
	* \return Standard Pacemaker return code
	*/
	int (post_connect)(pcmk_ipc_api_t api);

	/*!
	* \internal
	* \brief Check whether an IPC request results in a reply
	*
	* \param[in,out] api IPC API connection
	* \param[in,out] request IPC request XML
	*
	* \return true if request would result in an IPC reply, false otherwise
	*/
	bool (reply_expected)(pcmk_ipc_api_t api, xmlNode *request);

	/*!
	* \internal
	* \brief Perform daemon-specific handling of an IPC message
	*
	* \param[in,out] api IPC API connection
	* \param[in,out] msg Message read from IPC connection
	*
	* \return true if more IPC reply messages should be expected
	*/
	bool (dispatch)(pcmk_ipc_api_t api, xmlNode *msg);

	/*!
	* \internal
	* \brief Perform daemon-specific handling of an IPC disconnect
	*
	* \param[in,out] api IPC API connection
	*/
	void (post_disconnect)(pcmk_ipc_api_t api);
	} pcmk__ipc_methods_t;

	// Implementation of pcmk_ipc_api_t
	struct pcmk_ipc_api_s {
	enum pcmk_ipc_server server; // Daemon this IPC API instance is for
	enum pcmk_ipc_dispatch dispatch_type; // How replies should be dispatched
	size_t ipc_size_max; // maximum IPC buffer size
	crm_ipc_t *ipc; // IPC connection
	mainloop_io_t *mainloop_io; // If using mainloop, I/O source for IPC
	bool free_on_disconnect; // Whether disconnect should free object
	pcmk_ipc_callback_t cb; // Caller-registered callback (if any)
	void *user_data; // Caller-registered data (if any)
	void *api_data; // For daemon-specific use
	pcmk__ipc_methods_t *cmds; // Behavior that varies by daemon
	};

	typedef struct pcmk__ipc_header_s {
	struct qb_ipc_response_header qb;
	uint32_t size_uncompressed;
	uint32_t size_compressed;
	uint32_t flags;
	uint8_t version;
	} pcmk__ipc_header_t;

	G_GNUC_INTERNAL
	int pcmk__send_ipc_request(pcmk_ipc_api_t api, xmlNode request);

	G_GNUC_INTERNAL
	void pcmk__call_ipc_callback(pcmk_ipc_api_t *api,
	enum pcmk_ipc_event event_type,
	crm_exit_t status, void *event_data);

	G_GNUC_INTERNAL
	unsigned int pcmk__ipc_buffer_size(unsigned int max);

	G_GNUC_INTERNAL
	bool pcmk__valid_ipc_header(const pcmk__ipc_header_t *header);

	G_GNUC_INTERNAL
	pcmk__ipc_methods_t *pcmk__attrd_api_methods(void);

	G_GNUC_INTERNAL
	pcmk__ipc_methods_t *pcmk__controld_api_methods(void);

	G_GNUC_INTERNAL
	pcmk__ipc_methods_t *pcmk__pacemakerd_api_methods(void);

	G_GNUC_INTERNAL
	pcmk__ipc_methods_t *pcmk__schedulerd_api_methods(void);


	/*
	* Logging
	*/

	/*!
	* \brief Check the authenticity of the IPC socket peer process
	*
	* If everything goes well, peer's authenticity is verified by the means
	* of comparing against provided referential UID and GID (either satisfies),
	* and the result of this check can be deduced from the return value.
	* As an exception, detected UID of 0 ("root") satisfies arbitrary
	* provided referential daemon's credentials.
	*
	* \param[in] qb_ipc libqb client connection if available
	* \param[in] sock IPC related, connected Unix socket to check peer of
	* \param[in] refuid referential UID to check against
	* \param[in] refgid referential GID to check against
	* \param[out] gotpid to optionally store obtained PID of the peer
	* (not available on FreeBSD, special value of 1
	* used instead, and the caller is required to
	* special case this value respectively)
	* \param[out] gotuid to optionally store obtained UID of the peer
	* \param[out] gotgid to optionally store obtained GID of the peer
	*
	* \return Standard Pacemaker return code
	* ie: 0 if it the connection is authentic
	* pcmk_rc_ipc_unauthorized if the connection is not authentic,
	* standard errors.
	*
	* \note While this function is tolerant on what constitutes authorized
	* IPC daemon process (its effective user matches UID=0 or \p refuid,
	* or at least its group matches \p refgid), either or both (in case
	* of UID=0) mismatches on the expected credentials of such peer
	* process \e shall be investigated at the caller when value of 1
	* gets returned there, since higher-than-expected privileges in
	* respect to the expected/intended credentials possibly violate
	* the least privilege principle and may pose an additional risk
	* (i.e. such accidental inconsistency shall be eventually fixed).
	*/
	int pcmk__crm_ipc_is_authentic_process(qb_ipcc_connection_t *qb_ipc, int sock,
	uid_t refuid, gid_t refgid,
	pid_t gotpid, uid_t gotuid,
	gid_t *gotgid);


	/*
	* Utils
	*/
	#define PCMK__PW_BUFFER_LEN 500


	#endif // CRMCOMMON_PRIVATE__H
	diff --git a/lib/common/patchset.c b/lib/common/patchset.c
	index b0e245e4c7..e43a1494e9 100644
	--- a/lib/common/patchset.c
	+++ b/lib/common/patchset.c
	@@ -1,1732 +1,1733 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h>
	#include <sys/types.h>
	#include <unistd.h>
	#include <time.h>
	#include <string.h>
	#include <stdlib.h>
	#include <stdarg.h>
	#include <bzlib.h>

	#include <libxml/parser.h>
	#include <libxml/tree.h>
	#include <libxml/xmlIO.h> /* xmlAllocOutputBuffer */

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h> // CRM_XML_LOG_BASE, etc.
	#include "crmcommon_private.h"

	static xmlNode subtract_xml_comment(xmlNode parent, xmlNode *left,
	xmlNode right, gboolean changed);

	/*
	<diff format="2.0">
	<version>
	<source admin_epoch="1" epoch="2" num_updates="3"/>
	<target admin_epoch="1" epoch="3" num_updates="0"/>
	</version>
	<change operation="add" xpath="/cib/configuration/nodes">
	<node id="node2" uname="node2" description="foo"/>
	</change>
	<change operation="add" xpath="/cib/configuration/nodes/node[node2]">
	<instance_attributes id="nodes-node"><!-- NOTE: can be a full tree -->
	<nvpair id="nodes-node2-ram" name="ram" value="1024M"/>
	</instance_attributes>
	</change>
	<change operation="update" xpath="/cib/configuration/nodes[@id='node2']">
	<change-list>
	<change-attr operation="set" name="type" value="member"/>
	<change-attr operation="unset" name="description"/>
	</change-list>
	<change-result>
	<node id="node2" uname="node2" type="member"/><!-- NOTE: not recursive -->
	</change-result>
	</change>
	<change operation="delete" xpath="/cib/configuration/nodes/node[@id='node3'] /">
	<change operation="update" xpath="/cib/configuration/resources/group[@id='g1']">
	<change-list>
	<change-attr operation="set" name="description" value="some garbage here"/>
	</change-list>
	<change-result>
	<group id="g1" description="some garbage here"/><!-- NOTE: not recursive -->
	</change-result>
	</change>
	<change operation="update" xpath="/cib/status/node_state[@id='node2]/lrm[@id='node2']/lrm_resources/lrm_resource[@id='Fence']">
	<change-list>
	<change-attr operation="set" name="oper" value="member"/>
	<change-attr operation="set" name="operation_key" value="Fence_start_0"/>
	<change-attr operation="set" name="operation" value="start"/>
	<change-attr operation="set" name="transition-key" value="2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"/>
	<change-attr operation="set" name="transition-magic" value="0:0;2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"/>
	<change-attr operation="set" name="call-id" value="2"/>
	<change-attr operation="set" name="rc-code" value="0"/>
	</change-list>
	<change-result>
	<lrm_rsc_op id="Fence_last_0" operation_key="Fence_start_0" operation="start" crm-debug-origin="crm_simulate" transition-key="2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" transition-magic="0:0;2:-1:0:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" call-id="2" rc-code="0" op-status="0" interval="0" exec-time="0" queue-time="0" op-digest="f2317cad3d54cec5d7d7aa7d0bf35cf8"/>
	</change-result>
	</change>
	</diff>
	*/

	// Add changes for specified XML to patchset
	static void
	add_xml_changes_to_patchset(xmlNode xml, xmlNode patchset)
	{
	xmlNode *cIter = NULL;
	xmlAttr *pIter = NULL;
	xmlNode *change = NULL;
	- xml_private_t *p = xml->_private;
	+ xml_node_private_t *nodepriv = xml->_private;
	const char *value = NULL;

	// If this XML node is new, just report that
	- if (patchset && pcmk_is_set(p->flags, pcmk__xf_created)) {
	+ if (patchset && pcmk_is_set(nodepriv->flags, pcmk__xf_created)) {
	GString *xpath = pcmk__element_xpath(xml->parent);

	if (xpath != NULL) {
	int position = pcmk__xml_position(xml, pcmk__xf_deleted);

	change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "create");
	crm_xml_add(change, XML_DIFF_PATH, (const char *) xpath->str);
	crm_xml_add_int(change, XML_DIFF_POSITION, position);
	add_node_copy(change, xml);
	g_string_free(xpath, TRUE);
	}

	return;
	}

	// Check each of the XML node's attributes for changes
	for (pIter = pcmk__xe_first_attr(xml); pIter != NULL;
	pIter = pIter->next) {
	xmlNode *attr = NULL;

	- p = pIter->_private;
	- if (!pcmk_any_flags_set(p->flags, pcmk__xf_deleted\|pcmk__xf_dirty)) {
	+ nodepriv = pIter->_private;
	+ if (!pcmk_any_flags_set(nodepriv->flags, pcmk__xf_deleted\|pcmk__xf_dirty)) {
	continue;
	}

	if (change == NULL) {
	GString *xpath = pcmk__element_xpath(xml);

	if (xpath != NULL) {
	change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "modify");
	crm_xml_add(change, XML_DIFF_PATH, (const char *) xpath->str);

	change = create_xml_node(change, XML_DIFF_LIST);
	g_string_free(xpath, TRUE);
	}
	}

	attr = create_xml_node(change, XML_DIFF_ATTR);

	crm_xml_add(attr, XML_NVPAIR_ATTR_NAME, (const char *)pIter->name);
	- if (p->flags & pcmk__xf_deleted) {
	+ if (nodepriv->flags & pcmk__xf_deleted) {
	crm_xml_add(attr, XML_DIFF_OP, "unset");

	} else {
	crm_xml_add(attr, XML_DIFF_OP, "set");

	value = crm_element_value(xml, (const char *) pIter->name);
	crm_xml_add(attr, XML_NVPAIR_ATTR_VALUE, value);
	}
	}

	if (change) {
	xmlNode *result = NULL;

	change = create_xml_node(change->parent, XML_DIFF_RESULT);
	result = create_xml_node(change, (const char *)xml->name);

	for (pIter = pcmk__xe_first_attr(xml); pIter != NULL;
	pIter = pIter->next) {
	- p = pIter->_private;
	- if (!pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	+ nodepriv = pIter->_private;
	+ if (!pcmk_is_set(nodepriv->flags, pcmk__xf_deleted)) {
	value = crm_element_value(xml, (const char *) pIter->name);
	crm_xml_add(result, (const char *)pIter->name, value);
	}
	}
	}

	// Now recursively do the same for each child node of this node
	for (cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	add_xml_changes_to_patchset(cIter, patchset);
	}

	- p = xml->_private;
	- if (patchset && pcmk_is_set(p->flags, pcmk__xf_moved)) {
	+ nodepriv = xml->_private;
	+ if (patchset && pcmk_is_set(nodepriv->flags, pcmk__xf_moved)) {
	GString *xpath = pcmk__element_xpath(xml);

	crm_trace("%s.%s moved to position %d",
	xml->name, ID(xml), pcmk__xml_position(xml, pcmk__xf_skip));

	if (xpath != NULL) {
	change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "move");
	crm_xml_add(change, XML_DIFF_PATH, (const char *) xpath->str);
	crm_xml_add_int(change, XML_DIFF_POSITION,
	pcmk__xml_position(xml, pcmk__xf_deleted));
	g_string_free(xpath, TRUE);
	}
	}
	}

	static bool
	is_config_change(xmlNode *xml)
	{
	GList *gIter = NULL;
	- xml_private_t *p = NULL;
	+ xml_node_private_t *nodepriv = NULL;
	+ xml_doc_private_t *docpriv;
	xmlNode *config = first_named_child(xml, XML_CIB_TAG_CONFIGURATION);

	if (config) {
	- p = config->_private;
	+ nodepriv = config->_private;
	}
	- if ((p != NULL) && pcmk_is_set(p->flags, pcmk__xf_dirty)) {
	+ if ((nodepriv != NULL) && pcmk_is_set(nodepriv->flags, pcmk__xf_dirty)) {
	return TRUE;
	}

	if ((xml->doc != NULL) && (xml->doc->_private != NULL)) {
	- p = xml->doc->_private;
	- for (gIter = p->deleted_objs; gIter; gIter = gIter->next) {
	+ docpriv = xml->doc->_private;
	+ for (gIter = docpriv->deleted_objs; gIter; gIter = gIter->next) {
	pcmk__deleted_xml_t *deleted_obj = gIter->data;

	if (strstr(deleted_obj->path,
	"/" XML_TAG_CIB "/" XML_CIB_TAG_CONFIGURATION) != NULL) {
	return TRUE;
	}
	}
	}
	return FALSE;
	}

	static void
	xml_repair_v1_diff(xmlNode last, xmlNode next, xmlNode *local_diff,
	gboolean changed)
	{
	int lpc = 0;
	xmlNode *cib = NULL;
	xmlNode *diff_child = NULL;

	const char *tag = NULL;

	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};

	if (local_diff == NULL) {
	crm_trace("Nothing to do");
	return;
	}

	tag = "diff-removed";
	diff_child = find_xml_node(local_diff, tag, FALSE);
	if (diff_child == NULL) {
	diff_child = create_xml_node(local_diff, tag);
	}

	tag = XML_TAG_CIB;
	cib = find_xml_node(diff_child, tag, FALSE);
	if (cib == NULL) {
	cib = create_xml_node(diff_child, tag);
	}

	for (lpc = 0; (last != NULL) && (lpc < PCMK__NELEM(vfields)); lpc++) {
	const char *value = crm_element_value(last, vfields[lpc]);

	crm_xml_add(diff_child, vfields[lpc], value);
	if (changed \|\| lpc == 2) {
	crm_xml_add(cib, vfields[lpc], value);
	}
	}

	tag = "diff-added";
	diff_child = find_xml_node(local_diff, tag, FALSE);
	if (diff_child == NULL) {
	diff_child = create_xml_node(local_diff, tag);
	}

	tag = XML_TAG_CIB;
	cib = find_xml_node(diff_child, tag, FALSE);
	if (cib == NULL) {
	cib = create_xml_node(diff_child, tag);
	}

	for (lpc = 0; next && lpc < PCMK__NELEM(vfields); lpc++) {
	const char *value = crm_element_value(next, vfields[lpc]);

	crm_xml_add(diff_child, vfields[lpc], value);
	}

	for (xmlAttrPtr a = pcmk__xe_first_attr(next); a != NULL; a = a->next) {
	const char p_value = crm_element_value(next, (const char ) a->name);

	xmlSetProp(cib, a->name, (pcmkXmlStr) p_value);
	}

	crm_log_xml_explicit(local_diff, "Repaired-diff");
	}

	static xmlNode *
	xml_create_patchset_v1(xmlNode source, xmlNode target, bool config,
	bool suppress)
	{
	xmlNode *patchset = diff_xml_object(source, target, suppress);

	if (patchset) {
	CRM_LOG_ASSERT(xml_document_dirty(target));
	xml_repair_v1_diff(source, target, patchset, config);
	crm_xml_add(patchset, "format", "1");
	}
	return patchset;
	}

	static xmlNode *
	xml_create_patchset_v2(xmlNode source, xmlNode target)
	{
	int lpc = 0;
	GList *gIter = NULL;
	- xml_private_t *doc = NULL;
	+ xml_doc_private_t *docpriv;

	xmlNode *v = NULL;
	xmlNode *version = NULL;
	xmlNode *patchset = NULL;
	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};

	CRM_ASSERT(target);
	if (!xml_document_dirty(target)) {
	return NULL;
	}

	CRM_ASSERT(target->doc);
	- doc = target->doc->_private;
	+ docpriv = target->doc->_private;

	patchset = create_xml_node(NULL, XML_TAG_DIFF);
	crm_xml_add_int(patchset, "format", 2);

	version = create_xml_node(patchset, XML_DIFF_VERSION);

	v = create_xml_node(version, XML_DIFF_VSOURCE);
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	const char *value = crm_element_value(source, vfields[lpc]);

	if (value == NULL) {
	value = "1";
	}
	crm_xml_add(v, vfields[lpc], value);
	}

	v = create_xml_node(version, XML_DIFF_VTARGET);
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	const char *value = crm_element_value(target, vfields[lpc]);

	if (value == NULL) {
	value = "1";
	}
	crm_xml_add(v, vfields[lpc], value);
	}

	- for (gIter = doc->deleted_objs; gIter; gIter = gIter->next) {
	+ for (gIter = docpriv->deleted_objs; gIter; gIter = gIter->next) {
	pcmk__deleted_xml_t *deleted_obj = gIter->data;
	xmlNode *change = create_xml_node(patchset, XML_DIFF_CHANGE);

	crm_xml_add(change, XML_DIFF_OP, "delete");
	crm_xml_add(change, XML_DIFF_PATH, deleted_obj->path);
	if (deleted_obj->position >= 0) {
	crm_xml_add_int(change, XML_DIFF_POSITION, deleted_obj->position);
	}
	}

	add_xml_changes_to_patchset(target, patchset);
	return patchset;
	}

	xmlNode *
	xml_create_patchset(int format, xmlNode source, xmlNode target,
	bool *config_changed, bool manage_version)
	{
	int counter = 0;
	bool config = FALSE;
	xmlNode *patch = NULL;
	const char *version = crm_element_value(source, XML_ATTR_CRM_VERSION);

	xml_acl_disable(target);
	if (!xml_document_dirty(target)) {
	crm_trace("No change %d", format);
	return NULL; /* No change */
	}

	config = is_config_change(target);
	if (config_changed) {
	*config_changed = config;
	}

	if (manage_version && config) {
	crm_trace("Config changed %d", format);
	crm_xml_add(target, XML_ATTR_NUMUPDATES, "0");

	crm_element_value_int(target, XML_ATTR_GENERATION, &counter);
	crm_xml_add_int(target, XML_ATTR_GENERATION, counter+1);

	} else if (manage_version) {
	crm_element_value_int(target, XML_ATTR_NUMUPDATES, &counter);
	crm_trace("Status changed %d - %d %s", format, counter,
	crm_element_value(source, XML_ATTR_NUMUPDATES));
	crm_xml_add_int(target, XML_ATTR_NUMUPDATES, (counter + 1));
	}

	if (format == 0) {
	if (compare_version("3.0.8", version) < 0) {
	format = 2;
	} else {
	format = 1;
	}
	crm_trace("Using patch format %d for version: %s", format, version);
	}

	switch (format) {
	case 1:
	patch = xml_create_patchset_v1(source, target, config, FALSE);
	break;
	case 2:
	patch = xml_create_patchset_v2(source, target);
	break;
	default:
	crm_err("Unknown patch format: %d", format);
	return NULL;
	}
	return patch;
	}

	void
	patchset_process_digest(xmlNode patch, xmlNode source, xmlNode *target,
	bool with_digest)
	{
	int format = 1;
	const char *version = NULL;
	char *digest = NULL;

	if ((patch == NULL) \|\| (source == NULL) \|\| (target == NULL)) {
	return;
	}

	/* We should always call xml_accept_changes() before calculating a digest.
	* Otherwise, with an on-tracking dirty target, we could get a wrong digest.
	*/
	CRM_LOG_ASSERT(!xml_document_dirty(target));

	crm_element_value_int(patch, "format", &format);
	if ((format > 1) && !with_digest) {
	return;
	}

	version = crm_element_value(source, XML_ATTR_CRM_VERSION);
	digest = calculate_xml_versioned_digest(target, FALSE, TRUE, version);

	crm_xml_add(patch, XML_ATTR_DIGEST, digest);
	free(digest);

	return;
	}

	void
	xml_log_patchset(uint8_t log_level, const char function, xmlNode patchset)
	{
	int format = 1;
	xmlNode *child = NULL;
	xmlNode *added = NULL;
	xmlNode *removed = NULL;
	gboolean is_first = TRUE;

	int add[] = { 0, 0, 0 };
	int del[] = { 0, 0, 0 };

	const char *fmt = NULL;
	const char *digest = NULL;
	int options = xml_log_option_formatted;

	static struct qb_log_callsite *patchset_cs = NULL;

	if (log_level == LOG_NEVER) {
	return;
	}
	if (patchset_cs == NULL) {
	patchset_cs = qb_log_callsite_get(function, __FILE__, "xml-patchset",
	log_level, __LINE__, 0);
	}

	if (patchset == NULL) {
	crm_trace("Empty patch");
	return;

	} else if ((log_level != LOG_STDOUT)
	&& !crm_is_callsite_active(patchset_cs, log_level, 0)) {
	return;
	}

	xml_patch_versions(patchset, add, del);
	fmt = crm_element_value(patchset, "format");
	digest = crm_element_value(patchset, XML_ATTR_DIGEST);

	if ((add[2] != del[2]) \|\| (add[1] != del[1]) \|\| (add[0] != del[0])) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"Diff: --- %d.%d.%d %s", del[0], del[1], del[2], fmt);
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"Diff: +++ %d.%d.%d %s",
	add[0], add[1], add[2], digest);

	} else if ((patchset != NULL) && (add[0] \|\| add[1] \|\| add[2])) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"%s: Local-only Change: %d.%d.%d",
	(function? function : ""), add[0], add[1], add[2]);
	}

	crm_element_value_int(patchset, "format", &format);
	if (format == 2) {
	xmlNode *change = NULL;

	for (change = pcmk__xml_first_child(patchset); change != NULL;
	change = pcmk__xml_next(change)) {
	const char *op = crm_element_value(change, XML_DIFF_OP);
	const char *xpath = crm_element_value(change, XML_DIFF_PATH);

	if (op == NULL) {
	} else if (strcmp(op, "create") == 0) {
	int lpc = 0, max = 0;
	char *prefix = crm_strdup_printf("++ %s: ", xpath);

	max = strlen(prefix);
	pcmk__xml_log(log_level, __FILE__, function, __LINE__, prefix,
	change->children, 0,
	xml_log_option_formatted\|xml_log_option_open);

	for (lpc = 2; lpc < max; lpc++) {
	prefix[lpc] = ' ';
	}

	pcmk__xml_log(log_level, __FILE__, function, __LINE__, prefix,
	change->children, 0,
	xml_log_option_formatted\|xml_log_option_close
	\|xml_log_option_children);
	free(prefix);

	} else if (strcmp(op, "move") == 0) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"+~ %s moved to offset %s", xpath,
	crm_element_value(change, XML_DIFF_POSITION));

	} else if (strcmp(op, "modify") == 0) {
	xmlNode *clist = first_named_child(change, XML_DIFF_LIST);
	GString *buffer_set = NULL;
	GString *buffer_unset = NULL;

	for (child = pcmk__xml_first_child(clist); child != NULL;
	child = pcmk__xml_next(child)) {
	const char *name = crm_element_value(child, "name");

	op = crm_element_value(child, XML_DIFF_OP);
	if (op == NULL) {
	continue;
	}

	if (strcmp(op, "set") == 0) {
	const char *value = crm_element_value(child, "value");

	pcmk__add_separated_word(&buffer_set, 256, "@", ", ");
	pcmk__g_strcat(buffer_set, name, "=", value, NULL);

	} else if (strcmp(op, "unset") == 0) {
	pcmk__add_separated_word(&buffer_unset, 256, "@", ", ");
	g_string_append(buffer_unset, name);
	}
	}

	if (buffer_set != NULL) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"+ %s: %s", xpath,
	(const char *) buffer_set->str);
	g_string_free(buffer_set, TRUE);
	}
	if (buffer_unset != NULL) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"-- %s: %s", xpath,
	(const char *) buffer_unset->str);
	g_string_free(buffer_unset, TRUE);
	}

	} else if (strcmp(op, "delete") == 0) {
	int position = -1;

	crm_element_value_int(change, XML_DIFF_POSITION, &position);
	if (position >= 0) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"-- %s (%d)", xpath, position);

	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__,
	"-- %s", xpath);
	}
	}
	}
	return;
	}

	if ((log_level < LOG_DEBUG) \|\| (function == NULL)) {
	options \|= xml_log_option_diff_short;
	}

	removed = find_xml_node(patchset, "diff-removed", FALSE);
	for (child = pcmk__xml_first_child(removed); child != NULL;
	child = pcmk__xml_next(child)) {
	log_data_element(log_level, __FILE__, function, __LINE__, "- ", child,
	0, options\|xml_log_option_diff_minus);
	if (is_first) {
	is_first = FALSE;
	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, " --- ");
	}
	}

	is_first = TRUE;
	added = find_xml_node(patchset, "diff-added", FALSE);
	for (child = pcmk__xml_first_child(added); child != NULL;
	child = pcmk__xml_next(child)) {
	log_data_element(log_level, __FILE__, function, __LINE__, "+ ", child,
	0, options\|xml_log_option_diff_plus);
	if (is_first) {
	is_first = FALSE;
	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, " +++ ");
	}
	}
	}

	// Return true if attribute name is not "id"
	static bool
	not_id(xmlAttrPtr attr, void *user_data)
	{
	return strcmp((const char *) attr->name, XML_ATTR_ID) != 0;
	}

	// Apply the removals section of an v1 patchset to an XML node
	static void
	process_v1_removals(xmlNode target, xmlNode patch)
	{
	xmlNode *patch_child = NULL;
	xmlNode *cIter = NULL;

	char *id = NULL;
	const char *name = NULL;
	const char *value = NULL;

	if ((target == NULL) \|\| (patch == NULL)) {
	return;
	}

	if (target->type == XML_COMMENT_NODE) {
	gboolean dummy;

	subtract_xml_comment(target->parent, target, patch, &dummy);
	}

	name = crm_element_name(target);
	CRM_CHECK(name != NULL, return);
	CRM_CHECK(pcmk__str_eq(crm_element_name(target), crm_element_name(patch),
	pcmk__str_casei),
	return);
	CRM_CHECK(pcmk__str_eq(ID(target), ID(patch), pcmk__str_casei), return);

	// Check for XML_DIFF_MARKER in a child
	id = crm_element_value_copy(target, XML_ATTR_ID);
	value = crm_element_value(patch, XML_DIFF_MARKER);
	if ((value != NULL) && (strcmp(value, "removed:top") == 0)) {
	crm_trace("We are the root of the deletion: %s.id=%s", name, id);
	free_xml(target);
	free(id);
	return;
	}

	// Removing then restoring id would change ordering of properties
	pcmk__xe_remove_matching_attrs(patch, not_id, NULL);

	// Changes to child objects
	cIter = pcmk__xml_first_child(target);
	while (cIter) {
	xmlNode *target_child = cIter;

	cIter = pcmk__xml_next(cIter);
	patch_child = pcmk__xml_match(patch, target_child, false);
	process_v1_removals(target_child, patch_child);
	}
	free(id);
	}

	// Apply the additions section of an v1 patchset to an XML node
	static void
	process_v1_additions(xmlNode parent, xmlNode target, xmlNode *patch)
	{
	xmlNode *patch_child = NULL;
	xmlNode *target_child = NULL;
	xmlAttrPtr xIter = NULL;

	const char *id = NULL;
	const char *name = NULL;
	const char *value = NULL;

	if (patch == NULL) {
	return;
	} else if ((parent == NULL) && (target == NULL)) {
	return;
	}

	// Check for XML_DIFF_MARKER in a child
	value = crm_element_value(patch, XML_DIFF_MARKER);
	if ((target == NULL) && (value != NULL)
	&& (strcmp(value, "added:top") == 0)) {
	id = ID(patch);
	name = crm_element_name(patch);
	crm_trace("We are the root of the addition: %s.id=%s", name, id);
	add_node_copy(parent, patch);
	return;

	} else if (target == NULL) {
	id = ID(patch);
	name = crm_element_name(patch);
	crm_err("Could not locate: %s.id=%s", name, id);
	return;
	}

	if (target->type == XML_COMMENT_NODE) {
	pcmk__xc_update(parent, target, patch);
	}

	name = crm_element_name(target);
	CRM_CHECK(name != NULL, return);
	CRM_CHECK(pcmk__str_eq(crm_element_name(target), crm_element_name(patch),
	pcmk__str_casei),
	return);
	CRM_CHECK(pcmk__str_eq(ID(target), ID(patch), pcmk__str_casei), return);

	for (xIter = pcmk__xe_first_attr(patch); xIter != NULL;
	xIter = xIter->next) {
	const char p_name = (const char ) xIter->name;
	const char *p_value = crm_element_value(patch, p_name);

	xml_remove_prop(target, p_name); // Preserve patch order
	crm_xml_add(target, p_name, p_value);
	}

	// Changes to child objects
	for (patch_child = pcmk__xml_first_child(patch); patch_child != NULL;
	patch_child = pcmk__xml_next(patch_child)) {

	target_child = pcmk__xml_match(target, patch_child, false);
	process_v1_additions(target, target_child, patch_child);
	}
	}

	/*!
	* \internal
	* \brief Find additions or removals in a patch set
	*
	* \param[in] patchset XML of patch
	* \param[in] format Patch version
	* \param[in] added TRUE if looking for additions, FALSE if removals
	* \param[in,out] patch_node Will be set to node if found
	*
	* \return TRUE if format is valid, FALSE if invalid
	*/
	static bool
	find_patch_xml_node(const xmlNode *patchset, int format, bool added,
	xmlNode **patch_node)
	{
	xmlNode *cib_node;
	const char *label;

	switch (format) {
	case 1:
	label = added? "diff-added" : "diff-removed";
	*patch_node = find_xml_node(patchset, label, FALSE);
	cib_node = find_xml_node(*patch_node, "cib", FALSE);
	if (cib_node != NULL) {
	*patch_node = cib_node;
	}
	break;
	case 2:
	label = added? "target" : "source";
	*patch_node = find_xml_node(patchset, "version", FALSE);
	patch_node = find_xml_node(patch_node, label, FALSE);
	break;
	default:
	crm_warn("Unknown patch format: %d", format);
	*patch_node = NULL;
	return FALSE;
	}
	return TRUE;
	}

	// Get CIB versions used for additions and deletions in a patchset
	bool
	xml_patch_versions(const xmlNode *patchset, int add[3], int del[3])
	{
	int lpc = 0;
	int format = 1;
	xmlNode *tmp = NULL;

	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};


	crm_element_value_int(patchset, "format", &format);

	/* Process removals */
	if (!find_patch_xml_node(patchset, format, FALSE, &tmp)) {
	return -EINVAL;
	}
	if (tmp != NULL) {
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	crm_element_value_int(tmp, vfields[lpc], &(del[lpc]));
	crm_trace("Got %d for del[%s]", del[lpc], vfields[lpc]);
	}
	}

	/* Process additions */
	if (!find_patch_xml_node(patchset, format, TRUE, &tmp)) {
	return -EINVAL;
	}
	if (tmp != NULL) {
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	crm_element_value_int(tmp, vfields[lpc], &(add[lpc]));
	crm_trace("Got %d for add[%s]", add[lpc], vfields[lpc]);
	}
	}
	return pcmk_ok;
	}

	/*!
	* \internal
	* \brief Check whether patchset can be applied to current CIB
	*
	* \param[in] xml Root of current CIB
	* \param[in] patchset Patchset to check
	* \param[in] format Patchset version
	*
	* \return Standard Pacemaker return code
	*/
	static int
	xml_patch_version_check(const xmlNode xml, const xmlNode patchset, int format)
	{
	int lpc = 0;
	bool changed = FALSE;

	int this[] = { 0, 0, 0 };
	int add[] = { 0, 0, 0 };
	int del[] = { 0, 0, 0 };

	const char *vfields[] = {
	XML_ATTR_GENERATION_ADMIN,
	XML_ATTR_GENERATION,
	XML_ATTR_NUMUPDATES,
	};

	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	crm_element_value_int(xml, vfields[lpc], &(this[lpc]));
	crm_trace("Got %d for this[%s]", this[lpc], vfields[lpc]);
	if (this[lpc] < 0) {
	this[lpc] = 0;
	}
	}

	/* Set some defaults in case nothing is present */
	add[0] = this[0];
	add[1] = this[1];
	add[2] = this[2] + 1;
	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	del[lpc] = this[lpc];
	}

	xml_patch_versions(patchset, add, del);

	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	if (this[lpc] < del[lpc]) {
	crm_debug("Current %s is too low (%d.%d.%d < %d.%d.%d --> %d.%d.%d)",
	vfields[lpc], this[0], this[1], this[2],
	del[0], del[1], del[2], add[0], add[1], add[2]);
	return pcmk_rc_diff_resync;

	} else if (this[lpc] > del[lpc]) {
	crm_info("Current %s is too high (%d.%d.%d > %d.%d.%d --> %d.%d.%d) %p",
	vfields[lpc], this[0], this[1], this[2],
	del[0], del[1], del[2], add[0], add[1], add[2], patchset);
	crm_log_xml_info(patchset, "OldPatch");
	return pcmk_rc_old_data;
	}
	}

	for (lpc = 0; lpc < PCMK__NELEM(vfields); lpc++) {
	if (add[lpc] > del[lpc]) {
	changed = TRUE;
	}
	}

	if (!changed) {
	crm_notice("Versions did not change in patch %d.%d.%d",
	add[0], add[1], add[2]);
	return pcmk_rc_old_data;
	}

	crm_debug("Can apply patch %d.%d.%d to %d.%d.%d",
	add[0], add[1], add[2], this[0], this[1], this[2]);
	return pcmk_rc_ok;
	}

	/*!
	* \internal
	* \brief Apply a version 1 patchset to an XML node
	*
	* \param[in,out] xml XML to apply patchset to
	* \param[in] patchset Patchset to apply
	*
	* \return Standard Pacemaker return code
	*/
	static int
	apply_v1_patchset(xmlNode xml, const xmlNode patchset)
	{
	int rc = pcmk_rc_ok;
	int root_nodes_seen = 0;

	xmlNode *child_diff = NULL;
	xmlNode *added = find_xml_node(patchset, "diff-added", FALSE);
	xmlNode *removed = find_xml_node(patchset, "diff-removed", FALSE);
	xmlNode *old = copy_xml(xml);

	crm_trace("Subtraction Phase");
	for (child_diff = pcmk__xml_first_child(removed); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, rc = FALSE);
	if (root_nodes_seen == 0) {
	process_v1_removals(xml, child_diff);
	}
	root_nodes_seen++;
	}

	if (root_nodes_seen > 1) {
	crm_err("(-) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	rc = ENOTUNIQ;
	}

	root_nodes_seen = 0;
	crm_trace("Addition Phase");
	if (rc == pcmk_rc_ok) {
	xmlNode *child_diff = NULL;

	for (child_diff = pcmk__xml_first_child(added); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, rc = FALSE);
	if (root_nodes_seen == 0) {
	process_v1_additions(NULL, xml, child_diff);
	}
	root_nodes_seen++;
	}
	}

	if (root_nodes_seen > 1) {
	crm_err("(+) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	rc = ENOTUNIQ;
	}

	purge_diff_markers(xml); // Purge prior to checking digest

	free_xml(old);
	return rc;
	}

	// Return first child matching element name and optionally id or position
	static xmlNode *
	first_matching_xml_child(const xmlNode parent, const char name,
	const char *id, int position)
	{
	xmlNode *cIter = NULL;

	for (cIter = pcmk__xml_first_child(parent); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	if (strcmp((const char *) cIter->name, name) != 0) {
	continue;
	} else if (id) {
	const char *cid = ID(cIter);

	if ((cid == NULL) \|\| (strcmp(cid, id) != 0)) {
	continue;
	}
	}

	// "position" makes sense only for XML comments for now
	if ((cIter->type == XML_COMMENT_NODE)
	&& (position >= 0)
	&& (pcmk__xml_position(cIter, pcmk__xf_skip) != position)) {
	continue;
	}

	return cIter;
	}
	return NULL;
	}

	/*!
	* \internal
	* \brief Simplified, more efficient alternative to get_xpath_object()
	*
	* \param[in] top Root of XML to search
	* \param[in] key Search xpath
	* \param[in] target_position If deleting, where to delete
	*
	* \return XML child matching xpath if found, NULL otherwise
	*
	* \note This only works on simplified xpaths found in v2 patchset diffs,
	* i.e. the only allowed search predicate is [@id='XXX'].
	*/
	static xmlNode *
	search_v2_xpath(const xmlNode top, const char key, int target_position)
	{
	xmlNode target = (xmlNode ) top->doc;
	const char *current = key;
	char *section;
	char *remainder;
	char *id;
	char *tag;
	char *path = NULL;
	int rc;
	size_t key_len;

	CRM_CHECK(key != NULL, return NULL);
	key_len = strlen(key);

	/* These are scanned from key after a slash, so they can't be bigger
	* than key_len - 1 characters plus a null terminator.
	*/

	remainder = calloc(key_len, sizeof(char));
	CRM_ASSERT(remainder != NULL);

	section = calloc(key_len, sizeof(char));
	CRM_ASSERT(section != NULL);

	id = calloc(key_len, sizeof(char));
	CRM_ASSERT(id != NULL);

	tag = calloc(key_len, sizeof(char));
	CRM_ASSERT(tag != NULL);

	do {
	// Look for /NEXT_COMPONENT/REMAINING_COMPONENTS
	rc = sscanf(current, "/%[^/]%s", section, remainder);
	if (rc > 0) {
	// Separate FIRST_COMPONENT into TAG[@id='ID']
	int f = sscanf(section, "%[^[][@id='%[^']", tag, id);
	int current_position = -1;

	/* The target position is for the final component tag, so only use
	* it if there is nothing left to search after this component.
	*/
	if ((rc == 1) && (target_position >= 0)) {
	current_position = target_position;
	}

	switch (f) {
	case 1:
	target = first_matching_xml_child(target, tag, NULL,
	current_position);
	break;
	case 2:
	target = first_matching_xml_child(target, tag, id,
	current_position);
	break;
	default:
	// This should not be possible
	target = NULL;
	break;
	}
	current = remainder;
	}

	// Continue if something remains to search, and we've matched so far
	} while ((rc == 2) && target);

	if (target) {
	crm_trace("Found %s for %s",
	(path = (char *) xmlGetNodePath(target)), key);
	free(path);
	} else {
	crm_debug("No match for %s", key);
	}

	free(remainder);
	free(section);
	free(tag);
	free(id);
	return target;
	}

	typedef struct xml_change_obj_s {
	const xmlNode *change;
	xmlNode *match;
	} xml_change_obj_t;

	static gint
	sort_change_obj_by_position(gconstpointer a, gconstpointer b)
	{
	const xml_change_obj_t *change_obj_a = a;
	const xml_change_obj_t *change_obj_b = b;
	int position_a = -1;
	int position_b = -1;

	crm_element_value_int(change_obj_a->change, XML_DIFF_POSITION, &position_a);
	crm_element_value_int(change_obj_b->change, XML_DIFF_POSITION, &position_b);

	if (position_a < position_b) {
	return -1;

	} else if (position_a > position_b) {
	return 1;
	}

	return 0;
	}

	/*!
	* \internal
	* \brief Apply a version 2 patchset to an XML node
	*
	* \param[in,out] xml XML to apply patchset to
	* \param[in] patchset Patchset to apply
	*
	* \return Standard Pacemaker return code
	*/
	static int
	apply_v2_patchset(xmlNode xml, const xmlNode patchset)
	{
	int rc = pcmk_rc_ok;
	const xmlNode *change = NULL;
	GList *change_objs = NULL;
	GList *gIter = NULL;

	for (change = pcmk__xml_first_child(patchset); change != NULL;
	change = pcmk__xml_next(change)) {
	xmlNode *match = NULL;
	const char *op = crm_element_value(change, XML_DIFF_OP);
	const char *xpath = crm_element_value(change, XML_DIFF_PATH);
	int position = -1;

	if (op == NULL) {
	continue;
	}

	crm_trace("Processing %s %s", change->name, op);

	// "delete" changes for XML comments are generated with "position"
	if (strcmp(op, "delete") == 0) {
	crm_element_value_int(change, XML_DIFF_POSITION, &position);
	}
	match = search_v2_xpath(xml, xpath, position);
	crm_trace("Performing %s on %s with %p", op, xpath, match);

	if ((match == NULL) && (strcmp(op, "delete") == 0)) {
	crm_debug("No %s match for %s in %p", op, xpath, xml->doc);
	continue;

	} else if (match == NULL) {
	crm_err("No %s match for %s in %p", op, xpath, xml->doc);
	rc = pcmk_rc_diff_failed;
	continue;

	} else if ((strcmp(op, "create") == 0) \|\| (strcmp(op, "move") == 0)) {
	// Delay the adding of a "create" object
	xml_change_obj_t *change_obj = calloc(1, sizeof(xml_change_obj_t));

	CRM_ASSERT(change_obj != NULL);

	change_obj->change = change;
	change_obj->match = match;

	change_objs = g_list_append(change_objs, change_obj);

	if (strcmp(op, "move") == 0) {
	// Temporarily put the "move" object after the last sibling
	if ((match->parent != NULL) && (match->parent->last != NULL)) {
	xmlAddNextSibling(match->parent->last, match);
	}
	}

	} else if (strcmp(op, "delete") == 0) {
	free_xml(match);

	} else if (strcmp(op, "modify") == 0) {
	xmlNode *attrs = NULL;

	attrs = pcmk__xml_first_child(first_named_child(change,
	XML_DIFF_RESULT));
	if (attrs == NULL) {
	rc = ENOMSG;
	continue;
	}
	pcmk__xe_remove_matching_attrs(match, NULL, NULL); // Remove all

	for (xmlAttrPtr pIter = pcmk__xe_first_attr(attrs); pIter != NULL;
	pIter = pIter->next) {
	const char name = (const char ) pIter->name;
	const char *value = crm_element_value(attrs, name);

	crm_xml_add(match, name, value);
	}

	} else {
	crm_err("Unknown operation: %s", op);
	rc = pcmk_rc_diff_failed;
	}
	}

	// Changes should be generated in the right order. Double checking.
	change_objs = g_list_sort(change_objs, sort_change_obj_by_position);

	for (gIter = change_objs; gIter; gIter = gIter->next) {
	xml_change_obj_t *change_obj = gIter->data;
	xmlNode *match = change_obj->match;
	const char *op = NULL;
	const char *xpath = NULL;

	change = change_obj->change;

	op = crm_element_value(change, XML_DIFF_OP);
	xpath = crm_element_value(change, XML_DIFF_PATH);

	crm_trace("Continue performing %s on %s with %p", op, xpath, match);

	if (strcmp(op, "create") == 0) {
	int position = 0;
	xmlNode *child = NULL;
	xmlNode *match_child = NULL;

	match_child = match->children;
	crm_element_value_int(change, XML_DIFF_POSITION, &position);

	while ((match_child != NULL)
	&& (position != pcmk__xml_position(match_child, pcmk__xf_skip))) {
	match_child = match_child->next;
	}

	child = xmlDocCopyNode(change->children, match->doc, 1);
	if (match_child) {
	crm_trace("Adding %s at position %d", child->name, position);
	xmlAddPrevSibling(match_child, child);

	} else if (match->last) {
	crm_trace("Adding %s at position %d (end)",
	child->name, position);
	xmlAddNextSibling(match->last, child);

	} else {
	crm_trace("Adding %s at position %d (first)",
	child->name, position);
	CRM_LOG_ASSERT(position == 0);
	xmlAddChild(match, child);
	}
	pcmk__mark_xml_created(child);

	} else if (strcmp(op, "move") == 0) {
	int position = 0;

	crm_element_value_int(change, XML_DIFF_POSITION, &position);
	if (position != pcmk__xml_position(match, pcmk__xf_skip)) {
	xmlNode *match_child = NULL;
	int p = position;

	if (p > pcmk__xml_position(match, pcmk__xf_skip)) {
	p++; // Skip ourselves
	}

	CRM_ASSERT(match->parent != NULL);
	match_child = match->parent->children;

	while ((match_child != NULL)
	&& (p != pcmk__xml_position(match_child, pcmk__xf_skip))) {
	match_child = match_child->next;
	}

	crm_trace("Moving %s to position %d (was %d, prev %p, %s %p)",
	match->name, position,
	pcmk__xml_position(match, pcmk__xf_skip),
	match->prev, (match_child? "next":"last"),
	(match_child? match_child : match->parent->last));

	if (match_child) {
	xmlAddPrevSibling(match_child, match);

	} else {
	CRM_ASSERT(match->parent->last != NULL);
	xmlAddNextSibling(match->parent->last, match);
	}

	} else {
	crm_trace("%s is already in position %d",
	match->name, position);
	}

	if (position != pcmk__xml_position(match, pcmk__xf_skip)) {
	crm_err("Moved %s.%s to position %d instead of %d (%p)",
	match->name, ID(match),
	pcmk__xml_position(match, pcmk__xf_skip),
	position, match->prev);
	rc = pcmk_rc_diff_failed;
	}
	}
	}

	g_list_free_full(change_objs, free);
	return rc;
	}

	int
	xml_apply_patchset(xmlNode xml, xmlNode patchset, bool check_version)
	{
	int format = 1;
	int rc = pcmk_ok;
	xmlNode *old = NULL;
	const char *digest = crm_element_value(patchset, XML_ATTR_DIGEST);

	if (patchset == NULL) {
	return rc;
	}

	xml_log_patchset(LOG_TRACE, __func__, patchset);

	crm_element_value_int(patchset, "format", &format);
	if (check_version) {
	rc = pcmk_rc2legacy(xml_patch_version_check(xml, patchset, format));
	if (rc != pcmk_ok) {
	return rc;
	}
	}

	if (digest) {
	// Make it available for logging if result doesn't have expected digest
	old = copy_xml(xml);
	}

	if (rc == pcmk_ok) {
	switch (format) {
	case 1:
	rc = pcmk_rc2legacy(apply_v1_patchset(xml, patchset));
	break;
	case 2:
	rc = pcmk_rc2legacy(apply_v2_patchset(xml, patchset));
	break;
	default:
	crm_err("Unknown patch format: %d", format);
	rc = -EINVAL;
	}
	}

	if ((rc == pcmk_ok) && (digest != NULL)) {
	static struct qb_log_callsite *digest_cs = NULL;

	char *new_digest = NULL;
	char *version = crm_element_value_copy(xml, XML_ATTR_CRM_VERSION);

	if (digest_cs == NULL) {
	digest_cs = qb_log_callsite_get(__func__, __FILE__, "diff-digest",
	LOG_TRACE, __LINE__,
	crm_trace_nonlog);
	}

	new_digest = calculate_xml_versioned_digest(xml, FALSE, TRUE, version);
	if (!pcmk__str_eq(new_digest, digest, pcmk__str_casei)) {
	crm_info("v%d digest mis-match: expected %s, calculated %s",
	format, digest, new_digest);
	rc = -pcmk_err_diff_failed;

	if ((digest_cs != NULL) && digest_cs->targets) {
	save_xml_to_file(old, "PatchDigest:input", NULL);
	save_xml_to_file(xml, "PatchDigest:result", NULL);
	save_xml_to_file(patchset, "PatchDigest:diff", NULL);

	} else {
	crm_trace("%p %.6x", digest_cs,
	((digest_cs != NULL)? digest_cs->targets : 0));
	}

	} else {
	crm_trace("v%d digest matched: expected %s, calculated %s",
	format, digest, new_digest);
	}
	free(new_digest);
	free(version);
	}
	free_xml(old);
	return rc;
	}

	void
	purge_diff_markers(xmlNode *a_node)
	{
	xmlNode *child = NULL;

	CRM_CHECK(a_node != NULL, return);

	xml_remove_prop(a_node, XML_DIFF_MARKER);
	for (child = pcmk__xml_first_child(a_node); child != NULL;
	child = pcmk__xml_next(child)) {
	purge_diff_markers(child);
	}
	}

	xmlNode *
	diff_xml_object(xmlNode old, xmlNode new, gboolean suppress)
	{
	xmlNode *tmp1 = NULL;
	xmlNode *diff = create_xml_node(NULL, "diff");
	xmlNode *removed = create_xml_node(diff, "diff-removed");
	xmlNode *added = create_xml_node(diff, "diff-added");

	crm_xml_add(diff, XML_ATTR_CRM_VERSION, CRM_FEATURE_SET);

	tmp1 = subtract_xml_object(removed, old, new, FALSE, NULL, "removed:top");
	if (suppress && (tmp1 != NULL) && can_prune_leaf(tmp1)) {
	free_xml(tmp1);
	}

	tmp1 = subtract_xml_object(added, new, old, TRUE, NULL, "added:top");
	if (suppress && (tmp1 != NULL) && can_prune_leaf(tmp1)) {
	free_xml(tmp1);
	}

	if ((added->children == NULL) && (removed->children == NULL)) {
	free_xml(diff);
	diff = NULL;
	}

	return diff;
	}

	static xmlNode *
	subtract_xml_comment(xmlNode parent, xmlNode left, xmlNode *right,
	gboolean *changed)
	{
	CRM_CHECK(left != NULL, return NULL);
	CRM_CHECK(left->type == XML_COMMENT_NODE, return NULL);

	if ((right == NULL) \|\| !pcmk__str_eq((const char *)left->content,
	(const char *)right->content,
	pcmk__str_casei)) {
	xmlNode *deleted = NULL;

	deleted = add_node_copy(parent, left);
	*changed = TRUE;

	return deleted;
	}

	return NULL;
	}

	xmlNode *
	subtract_xml_object(xmlNode parent, xmlNode left, xmlNode *right,
	gboolean full, gboolean changed, const char marker)
	{
	gboolean dummy = FALSE;
	xmlNode *diff = NULL;
	xmlNode *right_child = NULL;
	xmlNode *left_child = NULL;
	xmlAttrPtr xIter = NULL;

	const char *id = NULL;
	const char *name = NULL;
	const char *value = NULL;
	const char *right_val = NULL;

	if (changed == NULL) {
	changed = &dummy;
	}

	if (left == NULL) {
	return NULL;
	}

	if (left->type == XML_COMMENT_NODE) {
	return subtract_xml_comment(parent, left, right, changed);
	}

	id = ID(left);
	if (right == NULL) {
	xmlNode *deleted = NULL;

	crm_trace("Processing <%s id=%s> (complete copy)",
	crm_element_name(left), id);
	deleted = add_node_copy(parent, left);
	crm_xml_add(deleted, XML_DIFF_MARKER, marker);

	*changed = TRUE;
	return deleted;
	}

	name = crm_element_name(left);
	CRM_CHECK(name != NULL, return NULL);
	CRM_CHECK(pcmk__str_eq(crm_element_name(left), crm_element_name(right),
	pcmk__str_casei),
	return NULL);

	// Check for XML_DIFF_MARKER in a child
	value = crm_element_value(right, XML_DIFF_MARKER);
	if ((value != NULL) && (strcmp(value, "removed:top") == 0)) {
	crm_trace("We are the root of the deletion: %s.id=%s", name, id);
	*changed = TRUE;
	return NULL;
	}

	// @TODO Avoiding creating the full hierarchy would save work here
	diff = create_xml_node(parent, name);

	// Changes to child objects
	for (left_child = pcmk__xml_first_child(left); left_child != NULL;
	left_child = pcmk__xml_next(left_child)) {
	gboolean child_changed = FALSE;

	right_child = pcmk__xml_match(right, left_child, false);
	subtract_xml_object(diff, left_child, right_child, full, &child_changed,
	marker);
	if (child_changed) {
	*changed = TRUE;
	}
	}

	if (!*changed) {
	/* Nothing to do */

	} else if (full) {
	xmlAttrPtr pIter = NULL;

	for (pIter = pcmk__xe_first_attr(left); pIter != NULL;
	pIter = pIter->next) {
	const char p_name = (const char )pIter->name;
	const char *p_value = pcmk__xml_attr_value(pIter);

	xmlSetProp(diff, (pcmkXmlStr) p_name, (pcmkXmlStr) p_value);
	}

	// We have everything we need
	goto done;
	}

	// Changes to name/value pairs
	for (xIter = pcmk__xe_first_attr(left); xIter != NULL;
	xIter = xIter->next) {
	const char prop_name = (const char ) xIter->name;
	xmlAttrPtr right_attr = NULL;
	- xml_private_t *p = NULL;
	+ xml_node_private_t *nodepriv = NULL;

	if (strcmp(prop_name, XML_ATTR_ID) == 0) {
	// id already obtained when present ~ this case, so just reuse
	xmlSetProp(diff, (pcmkXmlStr) XML_ATTR_ID, (pcmkXmlStr) id);
	continue;
	}

	if (pcmk__xa_filterable(prop_name)) {
	continue;
	}

	right_attr = xmlHasProp(right, (pcmkXmlStr) prop_name);
	if (right_attr) {
	- p = right_attr->_private;
	+ nodepriv = right_attr->_private;
	}

	right_val = crm_element_value(right, prop_name);
	- if ((right_val == NULL) \|\| (p && pcmk_is_set(p->flags, pcmk__xf_deleted))) {
	+ if ((right_val == NULL) \|\| (nodepriv && pcmk_is_set(nodepriv->flags, pcmk__xf_deleted))) {
	/* new */
	*changed = TRUE;
	if (full) {
	xmlAttrPtr pIter = NULL;

	for (pIter = pcmk__xe_first_attr(left); pIter != NULL;
	pIter = pIter->next) {
	const char p_name = (const char ) pIter->name;
	const char *p_value = pcmk__xml_attr_value(pIter);

	xmlSetProp(diff, (pcmkXmlStr) p_name, (pcmkXmlStr) p_value);
	}
	break;

	} else {
	const char *left_value = crm_element_value(left, prop_name);

	xmlSetProp(diff, (pcmkXmlStr) prop_name, (pcmkXmlStr) value);
	crm_xml_add(diff, prop_name, left_value);
	}

	} else {
	/* Only now do we need the left value */
	const char *left_value = crm_element_value(left, prop_name);

	if (strcmp(left_value, right_val) == 0) {
	/* unchanged */

	} else {
	*changed = TRUE;
	if (full) {
	xmlAttrPtr pIter = NULL;

	crm_trace("Changes detected to %s in <%s id=%s>", prop_name,
	crm_element_name(left), id);
	for (pIter = pcmk__xe_first_attr(left); pIter != NULL;
	pIter = pIter->next) {
	const char p_name = (const char ) pIter->name;
	const char *p_value = pcmk__xml_attr_value(pIter);

	xmlSetProp(diff, (pcmkXmlStr) p_name,
	(pcmkXmlStr) p_value);
	}
	break;

	} else {
	crm_trace("Changes detected to %s (%s -> %s) in <%s id=%s>",
	prop_name, left_value, right_val,
	crm_element_name(left), id);
	crm_xml_add(diff, prop_name, left_value);
	}
	}
	}
	}

	if (!*changed) {
	free_xml(diff);
	return NULL;

	} else if (!full && (id != NULL)) {
	crm_xml_add(diff, XML_ATTR_ID, id);
	}
	done:
	return diff;
	}

	// Deprecated functions kept only for backward API compatibility
	// LCOV_EXCL_START

	#include <crm/common/xml_compat.h>

	gboolean
	apply_xml_diff(xmlNode old_xml, xmlNode diff, xmlNode **new_xml)
	{
	gboolean result = TRUE;
	int root_nodes_seen = 0;
	static struct qb_log_callsite *digest_cs = NULL;
	const char *digest = crm_element_value(diff, XML_ATTR_DIGEST);
	const char *version = crm_element_value(diff, XML_ATTR_CRM_VERSION);

	xmlNode *child_diff = NULL;
	xmlNode *added = find_xml_node(diff, "diff-added", FALSE);
	xmlNode *removed = find_xml_node(diff, "diff-removed", FALSE);

	CRM_CHECK(new_xml != NULL, return FALSE);
	if (digest_cs == NULL) {
	digest_cs = qb_log_callsite_get(__func__, __FILE__, "diff-digest",
	LOG_TRACE, __LINE__, crm_trace_nonlog);
	}

	crm_trace("Subtraction Phase");
	for (child_diff = pcmk__xml_first_child(removed); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, result = FALSE);
	if (root_nodes_seen == 0) {
	*new_xml = subtract_xml_object(NULL, old_xml, child_diff, FALSE,
	NULL, NULL);
	}
	root_nodes_seen++;
	}

	if (root_nodes_seen == 0) {
	*new_xml = copy_xml(old_xml);

	} else if (root_nodes_seen > 1) {
	crm_err("(-) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	result = FALSE;
	}

	root_nodes_seen = 0;
	crm_trace("Addition Phase");
	if (result) {
	xmlNode *child_diff = NULL;

	for (child_diff = pcmk__xml_first_child(added); child_diff != NULL;
	child_diff = pcmk__xml_next(child_diff)) {
	CRM_CHECK(root_nodes_seen == 0, result = FALSE);
	if (root_nodes_seen == 0) {
	pcmk__xml_update(NULL, *new_xml, child_diff, true);
	}
	root_nodes_seen++;
	}
	}

	if (root_nodes_seen > 1) {
	crm_err("(+) Diffs cannot contain more than one change set... saw %d",
	root_nodes_seen);
	result = FALSE;

	} else if (result && (digest != NULL)) {
	char *new_digest = NULL;

	purge_diff_markers(*new_xml); // Purge now so diff is ok
	new_digest = calculate_xml_versioned_digest(*new_xml, FALSE, TRUE,
	version);
	if (!pcmk__str_eq(new_digest, digest, pcmk__str_casei)) {
	crm_info("Digest mis-match: expected %s, calculated %s",
	digest, new_digest);
	result = FALSE;

	crm_trace("%p %.6x", digest_cs, digest_cs ? digest_cs->targets : 0);
	if ((digest_cs != NULL) && digest_cs->targets) {
	save_xml_to_file(old_xml, "diff:original", NULL);
	save_xml_to_file(diff, "diff:input", NULL);
	save_xml_to_file(*new_xml, "diff:new", NULL);
	}

	} else {
	crm_trace("Digest matched: expected %s, calculated %s",
	digest, new_digest);
	}
	free(new_digest);

	} else if (result) {
	purge_diff_markers(*new_xml); // Purge now so diff is ok
	}

	return result;
	}

	// LCOV_EXCL_STOP
	// End deprecated API
	diff --git a/lib/common/tests/acl/xml_acl_denied_test.c b/lib/common/tests/acl/xml_acl_denied_test.c
	index dad5e685d9..117c5bd4c2 100644
	--- a/lib/common/tests/acl/xml_acl_denied_test.c
	+++ b/lib/common/tests/acl/xml_acl_denied_test.c
	@@ -1,61 +1,61 @@
	/*
	* Copyright 2020-2021 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <crm/common/unittest_internal.h>
	#include <crm/common/acl.h>

	#include "../../crmcommon_private.h"

	static void
	is_xml_acl_denied_without_node(void **state)
	{
	xmlNode *test_xml = create_xml_node(NULL, "test_xml");
	assert_false(xml_acl_denied(test_xml));

	test_xml->doc->_private = NULL;
	assert_false(xml_acl_denied(test_xml));

	test_xml->doc = NULL;
	assert_false(xml_acl_denied(test_xml));

	test_xml = NULL;
	assert_false(xml_acl_denied(test_xml));
	}

	static void
	is_xml_acl_denied_with_node(void **state)
	{
	- xml_private_t *p;
	+ xml_doc_private_t *docpriv;

	xmlNode *test_xml = create_xml_node(NULL, "test_xml");

	// allocate memory for _private, which is NULL by default
	- test_xml->doc->_private = calloc(1, sizeof(xml_private_t));
	+ test_xml->doc->_private = calloc(1, sizeof(xml_doc_private_t));

	assert_false(xml_acl_denied(test_xml));

	- // cast _private from void* to xml_private_t*
	- p = test_xml->doc->_private;
	+ // cast _private from void* to xml_doc_private_t*
	+ docpriv = test_xml->doc->_private;

	// enable an irrelevant flag
	- p->flags \|= pcmk__xf_acl_enabled;
	+ docpriv->flags \|= pcmk__xf_acl_enabled;

	assert_false(xml_acl_denied(test_xml));

	// enable pcmk__xf_acl_denied
	- p->flags \|= pcmk__xf_acl_denied;
	+ docpriv->flags \|= pcmk__xf_acl_denied;

	assert_true(xml_acl_denied(test_xml));
	}

	PCMK__UNIT_TEST(NULL, NULL,
	cmocka_unit_test(is_xml_acl_denied_without_node),
	cmocka_unit_test(is_xml_acl_denied_with_node))
	diff --git a/lib/common/tests/acl/xml_acl_enabled_test.c b/lib/common/tests/acl/xml_acl_enabled_test.c
	index db9768d133..8530fce1ce 100644
	--- a/lib/common/tests/acl/xml_acl_enabled_test.c
	+++ b/lib/common/tests/acl/xml_acl_enabled_test.c
	@@ -1,61 +1,61 @@
	/*
	* Copyright 2020-2021 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <crm/common/unittest_internal.h>
	#include <crm/common/acl.h>

	#include "../../crmcommon_private.h"

	static void
	is_xml_acl_enabled_without_node(void **state)
	{
	xmlNode *test_xml = create_xml_node(NULL, "test_xml");
	assert_false(xml_acl_enabled(test_xml));

	test_xml->doc->_private = NULL;
	assert_false(xml_acl_enabled(test_xml));

	test_xml->doc = NULL;
	assert_false(xml_acl_enabled(test_xml));

	test_xml = NULL;
	assert_false(xml_acl_enabled(test_xml));
	}

	static void
	is_xml_acl_enabled_with_node(void **state)
	{
	- xml_private_t *p;
	+ xml_doc_private_t *docpriv;

	xmlNode *test_xml = create_xml_node(NULL, "test_xml");

	// allocate memory for _private, which is NULL by default
	- test_xml->doc->_private = calloc(1, sizeof(xml_private_t));
	+ test_xml->doc->_private = calloc(1, sizeof(xml_doc_private_t));

	assert_false(xml_acl_enabled(test_xml));

	- // cast _private from void* to xml_private_t*
	- p = test_xml->doc->_private;
	+ // cast _private from void* to xml_doc_private_t*
	+ docpriv = test_xml->doc->_private;

	// enable an irrelevant flag
	- p->flags \|= pcmk__xf_acl_denied;
	+ docpriv->flags \|= pcmk__xf_acl_denied;

	assert_false(xml_acl_enabled(test_xml));

	// enable pcmk__xf_acl_enabled
	- p->flags \|= pcmk__xf_acl_enabled;
	+ docpriv->flags \|= pcmk__xf_acl_enabled;

	assert_true(xml_acl_enabled(test_xml));
	}

	PCMK__UNIT_TEST(NULL, NULL,
	cmocka_unit_test(is_xml_acl_enabled_without_node),
	cmocka_unit_test(is_xml_acl_enabled_with_node))
	diff --git a/lib/common/xml.c b/lib/common/xml.c
	index 984948d2db..69d783bbfc 100644
	--- a/lib/common/xml.c
	+++ b/lib/common/xml.c
	@@ -1,3091 +1,3128 @@
	/*
	* Copyright 2004-2022 the Pacemaker project contributors
	*
	* The version control history for this file may have further details.
	*
	* This source code is licensed under the GNU Lesser General Public License
	* version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
	*/

	#include <crm_internal.h>

	#include <stdio.h>
	#include <sys/types.h>
	#include <unistd.h>
	#include <time.h>
	#include <string.h>
	#include <stdlib.h>
	#include <stdarg.h>
	#include <bzlib.h>

	#include <libxml/parser.h>
	#include <libxml/tree.h>
	#include <libxml/xmlIO.h> /* xmlAllocOutputBuffer */

	#include <crm/crm.h>
	#include <crm/msg_xml.h>
	#include <crm/common/xml.h>
	#include <crm/common/xml_internal.h> // PCMK__XML_LOG_BASE, etc.
	#include "crmcommon_private.h"

	// Define this as 1 in development to get insanely verbose trace messages
	#ifndef XML_PARSER_DEBUG
	#define XML_PARSER_DEBUG 0
	#endif


	/* @TODO XML_PARSE_RECOVER allows some XML errors to be silently worked around
	* by libxml2, which is potentially ambiguous and dangerous. We should drop it
	* when we can break backward compatibility with configurations that might be
	* relying on it (i.e. pacemaker 3.0.0).
	*
	* It might be a good idea to have a transitional period where we first try
	* parsing without XML_PARSE_RECOVER, and if that fails, try parsing again with
	* it, logging a warning if it succeeds.
	*/
	#define PCMK__XML_PARSE_OPTS (XML_PARSE_NOBLANKS \| XML_PARSE_RECOVER)

	bool
	pcmk__tracking_xml_changes(xmlNode *xml, bool lazy)
	{
	if(xml == NULL \|\| xml->doc == NULL \|\| xml->doc->_private == NULL) {
	return FALSE;
	- } else if (!pcmk_is_set(((xml_private_t *)xml->doc->_private)->flags,
	+ } else if (!pcmk_is_set(((xml_doc_private_t *)xml->doc->_private)->flags,
	pcmk__xf_tracking)) {
	return FALSE;
	- } else if (lazy && !pcmk_is_set(((xml_private_t *)xml->doc->_private)->flags,
	+ } else if (lazy && !pcmk_is_set(((xml_doc_private_t *)xml->doc->_private)->flags,
	pcmk__xf_lazy)) {
	return FALSE;
	}
	return TRUE;
	}

	/*!
	* \internal
	* \brief Append spaces to a buffer
	*
	* Spaces are appended only if the \p xml_log_option_formatted flag is set.
	*
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the spaces (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static inline void
	insert_prefix(int options, GString *buffer, int depth)
	{
	int spaces = 0;

	if (!pcmk_is_set(options, xml_log_option_formatted)) {
	return;
	}
	CRM_ASSERT(buffer != NULL);
	CRM_CHECK(depth >= 0, depth = 0);

	/* With -O2, this loop is faster than one g_string_append_printf() call with
	* width == 2 * depth
	*/
	spaces = 2 * depth;
	for (int lpc = 0; lpc < spaces; lpc++) {
	g_string_append_c(buffer, ' ');
	}
	}

	static inline void
	set_parent_flag(xmlNode *xml, long flag)
	{
	for(; xml; xml = xml->parent) {
	- xml_private_t *p = xml->_private;
	+ xml_node_private_t *nodepriv = xml->_private;

	- if(p == NULL) {
	+ if (nodepriv == NULL) {
	/* During calls to xmlDocCopyNode(), _private will be unset for parent nodes */
	} else {
	- pcmk__set_xml_flags(p, flag);
	+ pcmk__set_xml_flags(nodepriv, flag);
	}
	}
	}

	void
	pcmk__set_xml_doc_flag(xmlNode *xml, enum xml_private_flags flag)
	{
	if(xml && xml->doc && xml->doc->_private){
	/* During calls to xmlDocCopyNode(), xml->doc may be unset */
	- xml_private_t *p = xml->doc->_private;
	+ xml_doc_private_t *docpriv = xml->doc->_private;

	- pcmk__set_xml_flags(p, flag);
	+ pcmk__set_xml_flags(docpriv, flag);
	}
	}

	// Mark document, element, and all element's parents as changed
	static inline void
	mark_xml_node_dirty(xmlNode *xml)
	{
	pcmk__set_xml_doc_flag(xml, pcmk__xf_dirty);
	set_parent_flag(xml, pcmk__xf_dirty);
	}

	// Clear flags on XML node and its children
	static void
	reset_xml_node_flags(xmlNode *xml)
	{
	xmlNode *cIter = NULL;
	- xml_private_t *p = xml->_private;
	+ xml_node_private_t *nodepriv = xml->_private;

	- if (p) {
	- p->flags = 0;
	+ if (nodepriv) {
	+ nodepriv->flags = 0;
	}

	for (cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	reset_xml_node_flags(cIter);
	}
	}

	// Set xpf_created flag on XML node and any children
	void
	pcmk__mark_xml_created(xmlNode *xml)
	{
	xmlNode *cIter = NULL;
	- xml_private_t *p = xml->_private;
	+ xml_node_private_t *nodepriv = xml->_private;

	- if (p && pcmk__tracking_xml_changes(xml, FALSE)) {
	- if (!pcmk_is_set(p->flags, pcmk__xf_created)) {
	- pcmk__set_xml_flags(p, pcmk__xf_created);
	+ if (nodepriv && pcmk__tracking_xml_changes(xml, FALSE)) {
	+ if (!pcmk_is_set(nodepriv->flags, pcmk__xf_created)) {
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_created);
	mark_xml_node_dirty(xml);
	}
	for (cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	pcmk__mark_xml_created(cIter);
	}
	}
	}

	void
	pcmk__mark_xml_attr_dirty(xmlAttr *a)
	{
	xmlNode *parent = a->parent;
	- xml_private_t *p = NULL;
	+ xml_node_private_t *nodepriv = a->_private;

	- p = a->_private;
	- pcmk__set_xml_flags(p, pcmk__xf_dirty\|pcmk__xf_modified);
	- pcmk__clear_xml_flags(p, pcmk__xf_deleted);
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_dirty\|pcmk__xf_modified);
	+ pcmk__clear_xml_flags(nodepriv, pcmk__xf_deleted);
	mark_xml_node_dirty(parent);
	}

	-#define XML_PRIVATE_MAGIC (long) 0x81726354
	+#define XML_DOC_PRIVATE_MAGIC 0x81726354UL
	+#define XML_NODE_PRIVATE_MAGIC 0x54637281UL

	// Free an XML object previously marked as deleted
	static void
	free_deleted_object(void *data)
	{
	if(data) {
	pcmk__deleted_xml_t *deleted_obj = data;

	free(deleted_obj->path);
	free(deleted_obj);
	}
	}

	// Free and NULL user, ACLs, and deleted objects in an XML node's private data
	static void
	-reset_xml_private_data(xml_private_t *p)
	+reset_xml_private_data(xml_doc_private_t *docpriv)
	{
	- if(p) {
	- CRM_ASSERT(p->check == XML_PRIVATE_MAGIC);
	+ if (docpriv != NULL) {
	+ CRM_ASSERT(docpriv->check == XML_DOC_PRIVATE_MAGIC);

	- free(p->user);
	- p->user = NULL;
	+ free(docpriv->user);
	+ docpriv->user = NULL;

	- if(p->acls) {
	- pcmk__free_acls(p->acls);
	- p->acls = NULL;
	+ if (docpriv->acls != NULL) {
	+ pcmk__free_acls(docpriv->acls);
	+ docpriv->acls = NULL;
	}

	- if(p->deleted_objs) {
	- g_list_free_full(p->deleted_objs, free_deleted_object);
	- p->deleted_objs = NULL;
	+ if(docpriv->deleted_objs) {
	+ g_list_free_full(docpriv->deleted_objs, free_deleted_object);
	+ docpriv->deleted_objs = NULL;
	}
	}
	}

	// Free all private data associated with an XML node
	static void
	free_private_data(xmlNode *node)
	{
	- /* need to explicitly avoid our custom _private field cleanup when
	- called from internal XSLT cleanup (xsltApplyStylesheetInternal
	- -> xsltFreeTransformContext -> xsltFreeRVTs -> xmlFreeDoc)
	- onto result tree fragments, represented as standalone documents
	- with otherwise infeasible space-prefixed name (xsltInternals.h:
	- XSLT_MARK_RES_TREE_FRAG) and carrying it's own load at _private
	- field -- later assert on the XML_PRIVATE_MAGIC would explode */
	- if (node->type != XML_DOCUMENT_NODE \|\| node->name == NULL
	- \|\| node->name[0] != ' ') {
	- reset_xml_private_data(node->_private);
	- free(node->_private);
	+ /* Note:
	+
	+ This function frees private data assosciated with an XML node,
	+ unless the function is being called as a result of internal
	+ XSLT cleanup.
	+
	+ That could happen through, for example, the following chain of
	+ function calls:
	+
	+ xsltApplyStylesheetInternal
	+ -> xsltFreeTransformContext
	+ -> xsltFreeRVTs
	+ -> xmlFreeDoc
	+
	+ And in that case, the node would fulfill three conditions:
	+
	+ 1. It would be a standalone document (i.e. it wouldn't be
	+ part of a document)
	+ 2. It would have a space-prefixed name (for reference, please
	+ see xsltInternals.h: XSLT_MARK_RES_TREE_FRAG)
	+ 3. It would carry its own payload in the _private field.
	+
	+ We do not free data in this circumstance to avoid a failed
	+ assertion on the XML_*_PRIVATE_MAGIC later.
	+
	+ */
	+ if (node->name == NULL \|\| node->name[0] != ' ') {
	+ if (node->_private) {
	+ if (node->type == XML_DOCUMENT_NODE) {
	+ reset_xml_private_data(node->_private);
	+ } else {
	+ CRM_ASSERT(((xml_node_private_t *) node->_private)->check
	+ == XML_NODE_PRIVATE_MAGIC);
	+ /* nothing dynamically allocated nested */
	+ }
	+ free(node->_private);
	+ node->_private = NULL;
	+ }
	}
	}

	// Allocate and initialize private data for an XML node
	static void
	new_private_data(xmlNode *node)
	{
	- xml_private_t *p = NULL;
	-
	- switch(node->type) {
	+ switch (node->type) {
	+ case XML_DOCUMENT_NODE: {
	+ xml_doc_private_t *docpriv = NULL;
	+ docpriv = calloc(1, sizeof(xml_doc_private_t));
	+ CRM_ASSERT(docpriv != NULL);
	+ docpriv->check = XML_DOC_PRIVATE_MAGIC;
	+ /* Flags will be reset if necessary when tracking is enabled */
	+ pcmk__set_xml_flags(docpriv, pcmk__xf_dirty\|pcmk__xf_created);
	+ node->_private = docpriv;
	+ break;
	+ }
	case XML_ELEMENT_NODE:
	- case XML_DOCUMENT_NODE:
	case XML_ATTRIBUTE_NODE:
	- case XML_COMMENT_NODE:
	- p = calloc(1, sizeof(xml_private_t));
	- p->check = XML_PRIVATE_MAGIC;
	+ case XML_COMMENT_NODE: {
	+ xml_node_private_t *nodepriv = NULL;
	+ nodepriv = calloc(1, sizeof(xml_node_private_t));
	+ CRM_ASSERT(nodepriv != NULL);
	+ nodepriv->check = XML_NODE_PRIVATE_MAGIC;
	/* Flags will be reset if necessary when tracking is enabled */
	- pcmk__set_xml_flags(p, pcmk__xf_dirty\|pcmk__xf_created);
	- node->_private = p;
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_dirty\|pcmk__xf_created);
	+ node->_private = nodepriv;
	+ if (pcmk__tracking_xml_changes(node, FALSE)) {
	+ /* XML_ELEMENT_NODE doesn't get picked up here, node->doc is
	+ * not hooked up at the point we are called
	+ */
	+ mark_xml_node_dirty(node);
	+ }
	break;
	+ }
	case XML_TEXT_NODE:
	case XML_DTD_NODE:
	case XML_CDATA_SECTION_NODE:
	break;
	default:
	/* Ignore */
	crm_trace("Ignoring %p %d", node, node->type);
	CRM_LOG_ASSERT(node->type == XML_ELEMENT_NODE);
	break;
	}
	-
	- if(p && pcmk__tracking_xml_changes(node, FALSE)) {
	- /* XML_ELEMENT_NODE doesn't get picked up here, node->doc is
	- * not hooked up at the point we are called
	- */
	- mark_xml_node_dirty(node);
	- }
	}

	void
	xml_track_changes(xmlNode * xml, const char user, xmlNode acl_source, bool enforce_acls)
	{
	xml_accept_changes(xml);
	crm_trace("Tracking changes%s to %p", enforce_acls?" with ACLs":"", xml);
	pcmk__set_xml_doc_flag(xml, pcmk__xf_tracking);
	if(enforce_acls) {
	if(acl_source == NULL) {
	acl_source = xml;
	}
	pcmk__set_xml_doc_flag(xml, pcmk__xf_acl_enabled);
	pcmk__unpack_acl(acl_source, xml, user);
	pcmk__apply_acl(xml);
	}
	}

	bool xml_tracking_changes(xmlNode * xml)
	{
	return (xml != NULL) && (xml->doc != NULL) && (xml->doc->_private != NULL)
	- && pcmk_is_set(((xml_private_t *)(xml->doc->_private))->flags,
	+ && pcmk_is_set(((xml_doc_private_t *)(xml->doc->_private))->flags,
	pcmk__xf_tracking);
	}

	bool xml_document_dirty(xmlNode *xml)
	{
	return (xml != NULL) && (xml->doc != NULL) && (xml->doc->_private != NULL)
	- && pcmk_is_set(((xml_private_t *)(xml->doc->_private))->flags,
	+ && pcmk_is_set(((xml_doc_private_t *)(xml->doc->_private))->flags,
	pcmk__xf_dirty);
	}

	/*!
	* \internal
	* \brief Return ordinal position of an XML node among its siblings
	*
	* \param[in] xml XML node to check
	* \param[in] ignore_if_set Don't count siblings with this flag set
	*
	* \return Ordinal position of \p xml (starting with 0)
	*/
	int
	pcmk__xml_position(xmlNode *xml, enum xml_private_flags ignore_if_set)
	{
	int position = 0;
	xmlNode *cIter = NULL;

	- for(cIter = xml; cIter->prev; cIter = cIter->prev) {
	- xml_private_t p = ((xmlNode)cIter->prev)->_private;
	+ for (cIter = xml; cIter->prev; cIter = cIter->prev) {
	+ xml_node_private_t nodepriv = ((xmlNode)cIter->prev)->_private;

	- if (!pcmk_is_set(p->flags, ignore_if_set)) {
	+ if (!pcmk_is_set(nodepriv->flags, ignore_if_set)) {
	position++;
	}
	}

	return position;
	}

	// This also clears attribute's flags if not marked as deleted
	static bool
	marked_as_deleted(xmlAttrPtr a, void *user_data)
	{
	- xml_private_t *p = a->_private;
	+ xml_node_private_t *nodepriv = a->_private;

	- if (pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_deleted)) {
	return true;
	}
	- p->flags = pcmk__xf_none;
	+ nodepriv->flags = pcmk__xf_none;
	return false;
	}

	// Remove all attributes marked as deleted from an XML node
	static void
	accept_attr_deletions(xmlNode *xml)
	{
	// Clear XML node's flags
	- ((xml_private_t *) xml->_private)->flags = pcmk__xf_none;
	+ ((xml_node_private_t *) xml->_private)->flags = pcmk__xf_none;

	// Remove this XML node's attributes that were marked as deleted
	pcmk__xe_remove_matching_attrs(xml, marked_as_deleted, NULL);

	// Recursively do the same for this XML node's children
	for (xmlNodePtr cIter = pcmk__xml_first_child(xml); cIter != NULL;
	cIter = pcmk__xml_next(cIter)) {
	accept_attr_deletions(cIter);
	}
	}

	/*!
	* \internal
	* \brief Find first child XML node matching another given XML node
	*
	* \param[in] haystack XML whose children should be checked
	* \param[in] needle XML to match (comment content or element name and ID)
	* \param[in] exact If true and needle is a comment, position must match
	*/
	xmlNode *
	pcmk__xml_match(xmlNode haystack, xmlNode needle, bool exact)
	{
	CRM_CHECK(needle != NULL, return NULL);

	if (needle->type == XML_COMMENT_NODE) {
	return pcmk__xc_match(haystack, needle, exact);

	} else {
	const char *id = ID(needle);
	const char *attr = (id == NULL)? NULL : XML_ATTR_ID;

	return pcmk__xe_match(haystack, crm_element_name(needle), attr, id);
	}
	}

	void
	xml_log_changes(uint8_t log_level, const char function, xmlNode xml)
	{
	GList *gIter = NULL;
	- xml_private_t *doc = NULL;
	+ xml_doc_private_t *docpriv = NULL;

	if (log_level == LOG_NEVER) {
	return;
	}

	CRM_ASSERT(xml);
	CRM_ASSERT(xml->doc);

	- doc = xml->doc->_private;
	- if (!pcmk_is_set(doc->flags, pcmk__xf_dirty)) {
	+ docpriv = xml->doc->_private;
	+ if (!pcmk_is_set(docpriv->flags, pcmk__xf_dirty)) {
	return;
	}

	- for(gIter = doc->deleted_objs; gIter; gIter = gIter->next) {
	+ for(gIter = docpriv->deleted_objs; gIter; gIter = gIter->next) {
	pcmk__deleted_xml_t *deleted_obj = gIter->data;

	if (deleted_obj->position >= 0) {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, "-- %s (%d)",
	deleted_obj->path, deleted_obj->position);

	} else {
	do_crm_log_alias(log_level, __FILE__, function, __LINE__, "-- %s",
	deleted_obj->path);
	}
	}

	log_data_element(log_level, __FILE__, function, __LINE__, "+ ", xml, 0,
	xml_log_option_formatted\|xml_log_option_dirty_add);
	}

	void
	xml_accept_changes(xmlNode * xml)
	{
	xmlNode *top = NULL;
	- xml_private_t *doc = NULL;
	+ xml_doc_private_t *docpriv = NULL;

	if(xml == NULL) {
	return;
	}

	crm_trace("Accepting changes to %p", xml);
	- doc = xml->doc->_private;
	+ docpriv = xml->doc->_private;
	top = xmlDocGetRootElement(xml->doc);

	reset_xml_private_data(xml->doc->_private);

	- if (!pcmk_is_set(doc->flags, pcmk__xf_dirty)) {
	- doc->flags = pcmk__xf_none;
	+ if (!pcmk_is_set(docpriv->flags, pcmk__xf_dirty)) {
	+ docpriv->flags = pcmk__xf_none;
	return;
	}

	- doc->flags = pcmk__xf_none;
	+ docpriv->flags = pcmk__xf_none;
	accept_attr_deletions(top);
	}

	xmlNode *
	find_xml_node(const xmlNode root, const char search_path, gboolean must_find)
	{
	xmlNode *a_child = NULL;
	const char *name = "NULL";

	if (root != NULL) {
	name = crm_element_name(root);
	}

	if (search_path == NULL) {
	crm_warn("Will never find <NULL>");
	return NULL;
	}

	for (a_child = pcmk__xml_first_child(root); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	if (strcmp((const char *)a_child->name, search_path) == 0) {
	/* crm_trace("returning node (%s).", crm_element_name(a_child)); */
	return a_child;
	}
	}

	if (must_find) {
	crm_warn("Could not find %s in %s.", search_path, name);
	} else if (root != NULL) {
	crm_trace("Could not find %s in %s.", search_path, name);
	} else {
	crm_trace("Could not find %s in <NULL>.", search_path);
	}

	return NULL;
	}

	#define attr_matches(c, n, v) pcmk__str_eq(crm_element_value((c), (n)), \
	(v), pcmk__str_none)

	/*!
	* \internal
	* \brief Find first XML child element matching given criteria
	*
	* \param[in] parent XML element to search
	* \param[in] node_name If not NULL, only match children of this type
	* \param[in] attr_n If not NULL, only match children with an attribute
	* of this name and a value of \p attr_v
	* \param[in] attr_v If \p attr_n and this are not NULL, only match children
	* with an attribute named \p attr_n and this value
	*
	* \return Matching XML child element, or NULL if none found
	*/
	xmlNode *
	pcmk__xe_match(xmlNode parent, const char node_name,
	const char attr_n, const char attr_v)
	{
	/* ensure attr_v specified when attr_n is */
	CRM_CHECK(attr_n == NULL \|\| attr_v != NULL, return NULL);

	for (xmlNode *child = pcmk__xml_first_child(parent); child != NULL;
	child = pcmk__xml_next(child)) {
	if (pcmk__str_eq(node_name, (const char *) (child->name),
	pcmk__str_null_matches)
	&& ((attr_n == NULL) \|\| attr_matches(child, attr_n, attr_v))) {
	return child;
	}
	}
	crm_trace("XML child node <%s%s%s%s%s> not found in %s",
	(node_name? node_name : "(any)"),
	(attr_n? " " : ""),
	(attr_n? attr_n : ""),
	(attr_n? "=" : ""),
	(attr_n? attr_v : ""),
	crm_element_name(parent));
	return NULL;
	}

	void
	copy_in_properties(xmlNode * target, xmlNode * src)
	{
	if (src == NULL) {
	crm_warn("No node to copy properties from");

	} else if (target == NULL) {
	crm_err("No node to copy properties into");

	} else {
	for (xmlAttrPtr a = pcmk__xe_first_attr(src); a != NULL; a = a->next) {
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);

	expand_plus_plus(target, p_name, p_value);
	if (xml_acl_denied(target)) {
	crm_trace("Cannot copy %s=%s to %s", p_name, p_value, target->name);
	return;
	}
	}
	}

	return;
	}

	/*!
	* \brief Parse integer assignment statements on this node and all its child
	* nodes
	*
	* \param[in] target root XML node to be processed
	*
	* \note This function is recursive
	*/
	void
	fix_plus_plus_recursive(xmlNode * target)
	{
	/* TODO: Remove recursion and use xpath searches for value++ */
	xmlNode *child = NULL;

	for (xmlAttrPtr a = pcmk__xe_first_attr(target); a != NULL; a = a->next) {
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);

	expand_plus_plus(target, p_name, p_value);
	}
	for (child = pcmk__xml_first_child(target); child != NULL;
	child = pcmk__xml_next(child)) {
	fix_plus_plus_recursive(child);
	}
	}

	/*!
	* \brief Update current XML attribute value per parsed integer assignment
	statement
	*
	* \param[in,out] target an XML node, containing a XML attribute that is
	* initialized to some numeric value, to be processed
	* \param[in] name name of the XML attribute, e.g. X, whose value
	* should be updated
	* \param[in] value assignment statement, e.g. "X++" or
	* "X+=5", to be applied to the initialized value.
	*
	* \note The original XML attribute value is treated as 0 if non-numeric and
	* truncated to be an integer if decimal-point-containing.
	* \note The final XML attribute value is truncated to not exceed 1000000.
	* \note Undefined behavior if unexpected input.
	*/
	void
	expand_plus_plus(xmlNode * target, const char name, const char value)
	{
	int offset = 1;
	int name_len = 0;
	int int_value = 0;
	int value_len = 0;

	const char *old_value = NULL;

	if (target == NULL \|\| value == NULL \|\| name == NULL) {
	return;
	}

	old_value = crm_element_value(target, name);

	if (old_value == NULL) {
	/* if no previous value, set unexpanded */
	goto set_unexpanded;

	} else if (strstr(value, name) != value) {
	goto set_unexpanded;
	}

	name_len = strlen(name);
	value_len = strlen(value);
	if (value_len < (name_len + 2)
	\|\| value[name_len] != '+' \|\| (value[name_len + 1] != '+' && value[name_len + 1] != '=')) {
	goto set_unexpanded;
	}

	/* if we are expanding ourselves,
	* then no previous value was set and leave int_value as 0
	*/
	if (old_value != value) {
	int_value = char2score(old_value);
	}

	if (value[name_len + 1] != '+') {
	const char *offset_s = value + (name_len + 2);

	offset = char2score(offset_s);
	}
	int_value += offset;

	if (int_value > INFINITY) {
	int_value = (int)INFINITY;
	}

	crm_xml_add_int(target, name, int_value);
	return;

	set_unexpanded:
	if (old_value == value) {
	/* the old value is already set, nothing to do */
	return;
	}
	crm_xml_add(target, name, value);
	return;
	}

	/*!
	* \internal
	* \brief Remove an XML element's attributes that match some criteria
	*
	* \param[in,out] element XML element to modify
	* \param[in] match If not NULL, only remove attributes for which
	* this function returns true
	* \param[in] user_data Data to pass to \p match
	*/
	void
	pcmk__xe_remove_matching_attrs(xmlNode *element,
	bool (match)(xmlAttrPtr, void ),
	void *user_data)
	{
	xmlAttrPtr next = NULL;

	for (xmlAttrPtr a = pcmk__xe_first_attr(element); a != NULL; a = next) {
	next = a->next; // Grab now because attribute might get removed
	if ((match == NULL) \|\| match(a, user_data)) {
	if (!pcmk__check_acl(element, NULL, pcmk__xf_acl_write)) {
	crm_trace("ACLs prevent removal of attributes (%s and "
	"possibly others) from %s element",
	(const char ) a->name, (const char ) element->name);
	return; // ACLs apply to element, not particular attributes
	}

	if (pcmk__tracking_xml_changes(element, false)) {
	// Leave (marked for removal) until after diff is calculated
	set_parent_flag(element, pcmk__xf_dirty);
	- pcmk__set_xml_flags((xml_private_t *) a->_private,
	+ pcmk__set_xml_flags((xml_node_private_t *) a->_private,
	pcmk__xf_deleted);
	} else {
	xmlRemoveProp(a);
	}
	}
	}
	}

	xmlDoc *
	getDocPtr(xmlNode * node)
	{
	xmlDoc *doc = NULL;

	CRM_CHECK(node != NULL, return NULL);

	doc = node->doc;
	if (doc == NULL) {
	doc = xmlNewDoc((pcmkXmlStr) "1.0");
	xmlDocSetRootElement(doc, node);
	xmlSetTreeDoc(node, doc);
	}
	return doc;
	}

	xmlNode *
	add_node_copy(xmlNode * parent, xmlNode * src_node)
	{
	xmlNode *child = NULL;
	xmlDoc *doc = getDocPtr(parent);

	CRM_CHECK(src_node != NULL, return NULL);

	child = xmlDocCopyNode(src_node, doc, 1);
	xmlAddChild(parent, child);
	pcmk__mark_xml_created(child);
	return child;
	}

	int
	add_node_nocopy(xmlNode * parent, const char name, xmlNode child)
	{
	add_node_copy(parent, child);
	free_xml(child);
	return 1;
	}

	xmlNode *
	create_xml_node(xmlNode * parent, const char *name)
	{
	xmlDoc *doc = NULL;
	xmlNode *node = NULL;

	if (pcmk__str_empty(name)) {
	CRM_CHECK(name != NULL && name[0] == 0, return NULL);
	return NULL;
	}

	if (parent == NULL) {
	doc = xmlNewDoc((pcmkXmlStr) "1.0");
	node = xmlNewDocRawNode(doc, NULL, (pcmkXmlStr) name, NULL);
	xmlDocSetRootElement(doc, node);

	} else {
	doc = getDocPtr(parent);
	node = xmlNewDocRawNode(doc, NULL, (pcmkXmlStr) name, NULL);
	xmlAddChild(parent, node);
	}
	pcmk__mark_xml_created(node);
	return node;
	}

	xmlNode *
	pcmk_create_xml_text_node(xmlNode * parent, const char name, const char content)
	{
	xmlNode *node = create_xml_node(parent, name);

	if (node != NULL) {
	xmlNodeSetContent(node, (pcmkXmlStr) content);
	}

	return node;
	}

	xmlNode *
	pcmk_create_html_node(xmlNode * parent, const char element_name, const char id,
	const char class_name, const char text)
	{
	xmlNode *node = pcmk_create_xml_text_node(parent, element_name, text);

	if (class_name != NULL) {
	crm_xml_add(node, "class", class_name);
	}

	if (id != NULL) {
	crm_xml_add(node, "id", id);
	}

	return node;
	}

	/*!
	* Free an XML element and all of its children, removing it from its parent
	*
	* \param[in] xml XML element to free
	*/
	void
	pcmk_free_xml_subtree(xmlNode *xml)
	{
	xmlUnlinkNode(xml); // Detaches from parent and siblings
	xmlFreeNode(xml); // Frees
	}

	static void
	free_xml_with_position(xmlNode * child, int position)
	{
	if (child != NULL) {
	xmlNode *top = NULL;
	xmlDoc *doc = child->doc;
	- xml_private_t *p = child->_private;
	+ xml_node_private_t *nodepriv = child->_private;
	+ xml_doc_private_t *docpriv = NULL;

	if (doc != NULL) {
	top = xmlDocGetRootElement(doc);
	}

	if (doc != NULL && top == child) {
	/* Free everything */
	xmlFreeDoc(doc);

	} else if (pcmk__check_acl(child, NULL, pcmk__xf_acl_write) == FALSE) {
	GString *xpath = NULL;

	pcmk__log_else(LOG_TRACE, return);
	xpath = pcmk__element_xpath(child);
	qb_log_from_external_source(__func__, __FILE__,
	"Cannot remove %s %x", LOG_TRACE,
	__LINE__, 0, (const char *) xpath->str,
	- p->flags);
	+ nodepriv->flags);
	g_string_free(xpath, TRUE);
	return;

	} else {
	if (doc && pcmk__tracking_xml_changes(child, FALSE)
	- && !pcmk_is_set(p->flags, pcmk__xf_created)) {
	+ && !pcmk_is_set(nodepriv->flags, pcmk__xf_created)) {

	GString *xpath = pcmk__element_xpath(child);

	if (xpath != NULL) {
	pcmk__deleted_xml_t *deleted_obj = NULL;

	crm_trace("Deleting %s %p from %p",
	(const char *) xpath->str, child, doc);

	deleted_obj = calloc(1, sizeof(pcmk__deleted_xml_t));
	deleted_obj->path = strdup((const char *) xpath->str);

	CRM_ASSERT(deleted_obj->path != NULL);
	g_string_free(xpath, TRUE);

	deleted_obj->position = -1;
	/* Record the "position" only for XML comments for now */
	if (child->type == XML_COMMENT_NODE) {
	if (position >= 0) {
	deleted_obj->position = position;

	} else {
	deleted_obj->position = pcmk__xml_position(child,
	pcmk__xf_skip);
	}
	}

	- p = doc->_private;
	- p->deleted_objs = g_list_append(p->deleted_objs, deleted_obj);
	+ docpriv = doc->_private;
	+ docpriv->deleted_objs = g_list_append(docpriv->deleted_objs, deleted_obj);
	pcmk__set_xml_doc_flag(child, pcmk__xf_dirty);
	}
	}
	pcmk_free_xml_subtree(child);
	}
	}
	}


	void
	free_xml(xmlNode * child)
	{
	free_xml_with_position(child, -1);
	}

	xmlNode *
	copy_xml(xmlNode * src)
	{
	xmlDoc *doc = xmlNewDoc((pcmkXmlStr) "1.0");
	xmlNode *copy = xmlDocCopyNode(src, doc, 1);

	xmlDocSetRootElement(doc, copy);
	xmlSetTreeDoc(copy, doc);
	return copy;
	}

	static void
	log_xmllib_err(void ctx, const char fmt, ...)
	G_GNUC_PRINTF(2, 3);

	// Log an XML library error
	static void
	log_xmllib_err(void ctx, const char fmt, ...)
	{
	va_list ap;
	static struct qb_log_callsite *xml_error_cs = NULL;

	if (xml_error_cs == NULL) {
	xml_error_cs = qb_log_callsite_get(
	__func__, __FILE__, "xml library error", LOG_TRACE, __LINE__, crm_trace_nonlog);
	}

	va_start(ap, fmt);
	if (xml_error_cs && xml_error_cs->targets) {
	PCMK__XML_LOG_BASE(LOG_ERR, TRUE,
	crm_abort(__FILE__, __PRETTY_FUNCTION__, __LINE__, "xml library error",
	TRUE, TRUE),
	"XML Error: ", fmt, ap);
	} else {
	PCMK__XML_LOG_BASE(LOG_ERR, TRUE, 0, "XML Error: ", fmt, ap);
	}
	va_end(ap);
	}

	xmlNode *
	string2xml(const char *input)
	{
	xmlNode *xml = NULL;
	xmlDocPtr output = NULL;
	xmlParserCtxtPtr ctxt = NULL;
	xmlErrorPtr last_error = NULL;

	if (input == NULL) {
	crm_err("Can't parse NULL input");
	return NULL;
	}

	/* create a parser context */
	ctxt = xmlNewParserCtxt();
	CRM_CHECK(ctxt != NULL, return NULL);

	xmlCtxtResetLastError(ctxt);
	xmlSetGenericErrorFunc(ctxt, log_xmllib_err);
	output = xmlCtxtReadDoc(ctxt, (pcmkXmlStr) input, NULL, NULL,
	PCMK__XML_PARSE_OPTS);
	if (output) {
	xml = xmlDocGetRootElement(output);
	}
	last_error = xmlCtxtGetLastError(ctxt);
	if (last_error && last_error->code != XML_ERR_OK) {
	/* crm_abort(__FILE__,__func__,__LINE__, "last_error->code != XML_ERR_OK", TRUE, TRUE); */
	/*
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlErrorLevel
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlParserErrors
	*/
	crm_warn("Parsing failed (domain=%d, level=%d, code=%d): %s",
	last_error->domain, last_error->level, last_error->code, last_error->message);

	if (last_error->code == XML_ERR_DOCUMENT_EMPTY) {
	CRM_LOG_ASSERT("Cannot parse an empty string");

	} else if (last_error->code != XML_ERR_DOCUMENT_END) {
	crm_err("Couldn't%s parse %d chars: %s", xml ? " fully" : "", (int)strlen(input),
	input);
	if (xml != NULL) {
	crm_log_xml_err(xml, "Partial");
	}

	} else {
	int len = strlen(input);
	int lpc = 0;

	while(lpc < len) {
	crm_warn("Parse error[+%.3d]: %.80s", lpc, input+lpc);
	lpc += 80;
	}

	CRM_LOG_ASSERT("String parsing error");
	}
	}

	xmlFreeParserCtxt(ctxt);
	return xml;
	}

	xmlNode *
	stdin2xml(void)
	{
	size_t data_length = 0;
	size_t read_chars = 0;

	char *xml_buffer = NULL;
	xmlNode *xml_obj = NULL;

	do {
	xml_buffer = pcmk__realloc(xml_buffer, data_length + PCMK__BUFFER_SIZE);
	read_chars = fread(xml_buffer + data_length, 1, PCMK__BUFFER_SIZE,
	stdin);
	data_length += read_chars;
	} while (read_chars == PCMK__BUFFER_SIZE);

	if (data_length == 0) {
	crm_warn("No XML supplied on stdin");
	free(xml_buffer);
	return NULL;
	}

	xml_buffer[data_length] = '\0';
	xml_obj = string2xml(xml_buffer);
	free(xml_buffer);

	crm_log_xml_trace(xml_obj, "Created fragment");
	return xml_obj;
	}

	static char *
	decompress_file(const char *filename)
	{
	char *buffer = NULL;
	int rc = 0;
	size_t length = 0, read_len = 0;
	BZFILE *bz_file = NULL;
	FILE *input = fopen(filename, "r");

	if (input == NULL) {
	crm_perror(LOG_ERR, "Could not open %s for reading", filename);
	return NULL;
	}

	bz_file = BZ2_bzReadOpen(&rc, input, 0, 0, NULL, 0);
	if (rc != BZ_OK) {
	crm_err("Could not prepare to read compressed %s: %s "
	CRM_XS " bzerror=%d", filename, bz2_strerror(rc), rc);
	BZ2_bzReadClose(&rc, bz_file);
	fclose(input);
	return NULL;
	}

	rc = BZ_OK;
	// cppcheck seems not to understand the abort-logic in pcmk__realloc
	// cppcheck-suppress memleak
	while (rc == BZ_OK) {
	buffer = pcmk__realloc(buffer, PCMK__BUFFER_SIZE + length + 1);
	read_len = BZ2_bzRead(&rc, bz_file, buffer + length, PCMK__BUFFER_SIZE);

	crm_trace("Read %ld bytes from file: %d", (long)read_len, rc);

	if (rc == BZ_OK \|\| rc == BZ_STREAM_END) {
	length += read_len;
	}
	}

	buffer[length] = '\0';

	if (rc != BZ_STREAM_END) {
	crm_err("Could not read compressed %s: %s "
	CRM_XS " bzerror=%d", filename, bz2_strerror(rc), rc);
	free(buffer);
	buffer = NULL;
	}

	BZ2_bzReadClose(&rc, bz_file);
	fclose(input);
	return buffer;
	}

	/*!
	* \internal
	* \brief Remove XML text nodes from specified XML and all its children
	*
	* \param[in,out] xml XML to strip text from
	*/
	void
	pcmk__strip_xml_text(xmlNode *xml)
	{
	xmlNode *iter = xml->children;

	while (iter) {
	xmlNode *next = iter->next;

	switch (iter->type) {
	case XML_TEXT_NODE:
	/* Remove it */
	pcmk_free_xml_subtree(iter);
	break;

	case XML_ELEMENT_NODE:
	/* Search it */
	pcmk__strip_xml_text(iter);
	break;

	default:
	/* Leave it */
	break;
	}

	iter = next;
	}
	}

	xmlNode *
	filename2xml(const char *filename)
	{
	xmlNode *xml = NULL;
	xmlDocPtr output = NULL;
	bool uncompressed = true;
	xmlParserCtxtPtr ctxt = NULL;
	xmlErrorPtr last_error = NULL;

	/* create a parser context */
	ctxt = xmlNewParserCtxt();
	CRM_CHECK(ctxt != NULL, return NULL);

	xmlCtxtResetLastError(ctxt);
	xmlSetGenericErrorFunc(ctxt, log_xmllib_err);

	if (filename) {
	uncompressed = !pcmk__ends_with_ext(filename, ".bz2");
	}

	if (pcmk__str_eq(filename, "-", pcmk__str_null_matches)) {
	/* STDIN_FILENO == fileno(stdin) */
	output = xmlCtxtReadFd(ctxt, STDIN_FILENO, "unknown.xml", NULL,
	PCMK__XML_PARSE_OPTS);

	} else if (uncompressed) {
	output = xmlCtxtReadFile(ctxt, filename, NULL, PCMK__XML_PARSE_OPTS);

	} else {
	char *input = decompress_file(filename);

	output = xmlCtxtReadDoc(ctxt, (pcmkXmlStr) input, NULL, NULL,
	PCMK__XML_PARSE_OPTS);
	free(input);
	}

	if (output && (xml = xmlDocGetRootElement(output))) {
	pcmk__strip_xml_text(xml);
	}

	last_error = xmlCtxtGetLastError(ctxt);
	if (last_error && last_error->code != XML_ERR_OK) {
	/* crm_abort(__FILE__,__func__,__LINE__, "last_error->code != XML_ERR_OK", TRUE, TRUE); */
	/*
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlErrorLevel
	* http://xmlsoft.org/html/libxml-xmlerror.html#xmlParserErrors
	*/
	crm_err("Parsing failed (domain=%d, level=%d, code=%d): %s",
	last_error->domain, last_error->level, last_error->code, last_error->message);

	if (last_error && last_error->code != XML_ERR_OK) {
	crm_err("Couldn't%s parse %s", xml ? " fully" : "", filename);
	if (xml != NULL) {
	crm_log_xml_err(xml, "Partial");
	}
	}
	}

	xmlFreeParserCtxt(ctxt);
	return xml;
	}

	/*!
	* \internal
	* \brief Add a "last written" attribute to an XML element, set to current time
	*
	* \param[in] xe XML element to add attribute to
	*
	* \return Value that was set, or NULL on error
	*/
	const char *
	pcmk__xe_add_last_written(xmlNode *xe)
	{
	const char *now_str = pcmk__epoch2str(NULL);

	return crm_xml_add(xe, XML_CIB_ATTR_WRITTEN,
	now_str ? now_str : "Could not determine current time");
	}

	/*!
	* \brief Sanitize a string so it is usable as an XML ID
	*
	* \param[in,out] id String to sanitize
	*/
	void
	crm_xml_sanitize_id(char *id)
	{
	char *c;

	for (c = id; *c; ++c) {
	/* @TODO Sanitize more comprehensively */
	switch (*c) {
	case ':':
	case '#':
	*c = '.';
	}
	}
	}

	/*!
	* \brief Set the ID of an XML element using a format
	*
	* \param[in,out] xml XML element
	* \param[in] fmt printf-style format
	* \param[in] ... any arguments required by format
	*/
	void
	crm_xml_set_id(xmlNode xml, const char format, ...)
	{
	va_list ap;
	int len = 0;
	char *id = NULL;

	/* equivalent to crm_strdup_printf() */
	va_start(ap, format);
	len = vasprintf(&id, format, ap);
	va_end(ap);
	CRM_ASSERT(len > 0);

	crm_xml_sanitize_id(id);
	crm_xml_add(xml, XML_ATTR_ID, id);
	free(id);
	}

	/*!
	* \internal
	* \brief Write XML to a file stream
	*
	* \param[in] xml_node XML to write
	* \param[in] filename Name of file being written (for logging only)
	* \param[in] stream Open file stream corresponding to filename
	* \param[in] compress Whether to compress XML before writing
	* \param[out] nbytes Number of bytes written
	*
	* \return Standard Pacemaker return code
	*/
	static int
	write_xml_stream(xmlNode xml_node, const char filename, FILE *stream,
	bool compress, unsigned int *nbytes)
	{
	int rc = pcmk_rc_ok;
	char *buffer = NULL;

	*nbytes = 0;
	crm_log_xml_trace(xml_node, "writing");

	buffer = dump_xml_formatted(xml_node);
	CRM_CHECK(buffer && strlen(buffer),
	crm_log_xml_warn(xml_node, "formatting failed");
	rc = pcmk_rc_error;
	goto bail);

	if (compress) {
	unsigned int in = 0;
	BZFILE *bz_file = NULL;

	rc = BZ_OK;
	bz_file = BZ2_bzWriteOpen(&rc, stream, 5, 0, 30);
	if (rc != BZ_OK) {
	crm_warn("Not compressing %s: could not prepare file stream: %s "
	CRM_XS " bzerror=%d", filename, bz2_strerror(rc), rc);
	} else {
	BZ2_bzWrite(&rc, bz_file, buffer, strlen(buffer));
	if (rc != BZ_OK) {
	crm_warn("Not compressing %s: could not compress data: %s "
	CRM_XS " bzerror=%d errno=%d",
	filename, bz2_strerror(rc), rc, errno);
	}
	}

	if (rc == BZ_OK) {
	BZ2_bzWriteClose(&rc, bz_file, 0, &in, nbytes);
	if (rc != BZ_OK) {
	crm_warn("Not compressing %s: could not write compressed data: %s "
	CRM_XS " bzerror=%d errno=%d",
	filename, bz2_strerror(rc), rc, errno);
	*nbytes = 0; // retry without compression
	} else {
	crm_trace("Compressed XML for %s from %u bytes to %u",
	filename, in, *nbytes);
	}
	}
	rc = pcmk_rc_ok; // Either true, or we'll retry without compression
	}

	if (*nbytes == 0) {
	rc = fprintf(stream, "%s", buffer);
	if (rc < 0) {
	rc = errno;
	crm_perror(LOG_ERR, "writing %s", filename);
	} else {
	*nbytes = (unsigned int) rc;
	rc = pcmk_rc_ok;
	}
	}

	bail:

	if (fflush(stream) != 0) {
	rc = errno;
	crm_perror(LOG_ERR, "flushing %s", filename);
	}

	/* Don't report error if the file does not support synchronization */
	if (fsync(fileno(stream)) < 0 && errno != EROFS && errno != EINVAL) {
	rc = errno;
	crm_perror(LOG_ERR, "synchronizing %s", filename);
	}

	fclose(stream);

	crm_trace("Saved %d bytes to %s as XML", *nbytes, filename);
	free(buffer);

	return rc;
	}

	/*!
	* \brief Write XML to a file descriptor
	*
	* \param[in] xml_node XML to write
	* \param[in] filename Name of file being written (for logging only)
	* \param[in] fd Open file descriptor corresponding to filename
	* \param[in] compress Whether to compress XML before writing
	*
	* \return Number of bytes written on success, -errno otherwise
	*/
	int
	write_xml_fd(xmlNode * xml_node, const char *filename, int fd, gboolean compress)
	{
	FILE *stream = NULL;
	unsigned int nbytes = 0;
	int rc = pcmk_rc_ok;

	CRM_CHECK(xml_node && (fd > 0), return -EINVAL);
	stream = fdopen(fd, "w");
	if (stream == NULL) {
	return -errno;
	}
	rc = write_xml_stream(xml_node, filename, stream, compress, &nbytes);
	if (rc != pcmk_rc_ok) {
	return pcmk_rc2legacy(rc);
	}
	return (int) nbytes;
	}

	/*!
	* \brief Write XML to a file
	*
	* \param[in] xml_node XML to write
	* \param[in] filename Name of file to write
	* \param[in] compress Whether to compress XML before writing
	*
	* \return Number of bytes written on success, -errno otherwise
	*/
	int
	write_xml_file(xmlNode * xml_node, const char *filename, gboolean compress)
	{
	FILE *stream = NULL;
	unsigned int nbytes = 0;
	int rc = pcmk_rc_ok;

	CRM_CHECK(xml_node && filename, return -EINVAL);
	stream = fopen(filename, "w");
	if (stream == NULL) {
	return -errno;
	}
	rc = write_xml_stream(xml_node, filename, stream, compress, &nbytes);
	if (rc != pcmk_rc_ok) {
	return pcmk_rc2legacy(rc);
	}
	return (int) nbytes;
	}

	// Replace a portion of a dynamically allocated string (reallocating memory)
	static char *
	replace_text(char text, int start, size_t length, const char *replace)
	{
	size_t offset = strlen(replace) - 1; // We have space for 1 char already

	*length += offset;
	text = pcmk__realloc(text, *length);

	for (size_t lpc = (*length) - 1; lpc > (start + offset); lpc--) {
	text[lpc] = text[lpc - offset];
	}

	memcpy(text + start, replace, offset + 1);
	return text;
	}

	/*!
	* \brief Replace special characters with their XML escape sequences
	*
	* \param[in] text Text to escape
	*
	* \return Newly allocated string equivalent to \p text but with special
	* characters replaced with XML escape sequences (or NULL if \p text
	* is NULL)
	*/
	char *
	crm_xml_escape(const char *text)
	{
	size_t length;
	char *copy;

	/*
	* When xmlCtxtReadDoc() parses < and friends in a
	* value, it converts them to their human readable
	* form.
	*
	* If one uses xmlNodeDump() to convert it back to a
	* string, all is well, because special characters are
	* converted back to their escape sequences.
	*
	* However xmlNodeDump() is randomly dog slow, even with the same
	* input. So we need to replicate the escaping in our custom
	* version so that the result can be re-parsed by xmlCtxtReadDoc()
	* when necessary.
	*/

	if (text == NULL) {
	return NULL;
	}

	length = 1 + strlen(text);
	copy = strdup(text);
	CRM_ASSERT(copy != NULL);
	for (size_t index = 0; index < length; index++) {
	if(copy[index] & 0x80 && copy[index+1] & 0x80){
	index++;
	break;
	}
	switch (copy[index]) {
	case 0:
	break;
	case '<':
	copy = replace_text(copy, index, &length, "<");
	break;
	case '>':
	copy = replace_text(copy, index, &length, ">");
	break;
	case '"':
	copy = replace_text(copy, index, &length, """);
	break;
	case '\'':
	copy = replace_text(copy, index, &length, "'");
	break;
	case '&':
	copy = replace_text(copy, index, &length, "&");
	break;
	case '\t':
	/* Might as well just expand to a few spaces... */
	copy = replace_text(copy, index, &length, " ");
	break;
	case '\n':
	copy = replace_text(copy, index, &length, "\\n");
	break;
	case '\r':
	copy = replace_text(copy, index, &length, "\\r");
	break;
	default:
	/* Check for and replace non-printing characters with their octal equivalent */
	if(copy[index] < ' ' \|\| copy[index] > '~') {
	char *replace = crm_strdup_printf("\\%.3o", copy[index]);

	copy = replace_text(copy, index, &length, replace);
	free(replace);
	}
	}
	}
	return copy;
	}

	/* Keep this inline. De-inlining resulted in a 0.6% average slowdown in
	* crm_simulate on cts/scheduler/xml during testing.
	*/

	/*!
	* \internal
	* \brief Append an XML attribute to a buffer
	*
	* \param[in] attr Attribute to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	*/
	static inline void
	dump_xml_attr(const xmlAttr attr, int options, GString buffer)
	{
	char *p_value = NULL;
	const char *p_name = NULL;
	- xml_private_t *p = NULL;
	+ xml_node_private_t *nodepriv = NULL;

	CRM_ASSERT(buffer != NULL);
	if (attr == NULL \|\| attr->children == NULL) {
	return;
	}

	- p = attr->_private;
	- if (p && pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	+ nodepriv = attr->_private;
	+ if (nodepriv && pcmk_is_set(nodepriv->flags, pcmk__xf_deleted)) {
	return;
	}

	p_name = (const char *) attr->name;
	p_value = crm_xml_escape((const char *)attr->children->content);
	pcmk__g_strcat(buffer, " ", p_name, "=\"", pcmk__s(p_value, "<null>"), "\"",
	NULL);

	free(p_value);
	}

	// Log an XML element or comment (and any children) in a formatted way
	static void
	log_xml_node_and_children(GString buffer, int log_level, const char file,
	const char function, int line, const char prefix,
	const xmlNode *data, int depth, int options)
	{
	const char *name = NULL;
	const char *hidden = NULL;

	xmlNode *child = NULL;

	CRM_ASSERT(buffer != NULL);

	if ((data == NULL) \|\| (log_level == LOG_NEVER)
	\|\| ((data->type != XML_COMMENT_NODE)
	&& (data->type != XML_ELEMENT_NODE))) {
	return;
	}

	name = crm_element_name(data);

	g_string_truncate(buffer, 0);

	if (pcmk_is_set(options, xml_log_option_open)) {
	insert_prefix(options, buffer, depth);

	if (data->type == XML_COMMENT_NODE) {
	pcmk__g_strcat(buffer, "<!--", (const char *) data->content, "-->",
	NULL);

	} else {
	pcmk__g_strcat(buffer, "<", name, NULL);

	hidden = crm_element_value(data, "hidden");
	for (xmlAttrPtr a = pcmk__xe_first_attr(data); a != NULL;
	a = a->next) {

	- xml_private_t *p = a->_private;
	+ xml_node_private_t *nodepriv = a->_private;
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);
	char *p_copy = NULL;

	- if (pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_deleted)) {
	continue;
	} else if (pcmk_any_flags_set(options,
	xml_log_option_diff_plus
	\|xml_log_option_diff_minus)
	&& (strcmp(XML_DIFF_MARKER, p_name) == 0)) {
	continue;

	} else if (hidden != NULL && p_name[0] != 0 && strstr(hidden, p_name) != NULL) {
	p_copy = strdup("*****");

	} else {
	p_copy = crm_xml_escape(p_value);
	}

	pcmk__g_strcat(buffer, " ", p_name, "=\"",
	pcmk__s(p_copy, "<null>"), "\"", NULL);
	free(p_copy);
	}

	if(xml_has_children(data) == FALSE) {
	g_string_append(buffer, "/>");

	} else if (pcmk_is_set(options, xml_log_option_children)) {
	g_string_append_c(buffer, '>');

	} else {
	g_string_append(buffer, "/>");
	}
	}

	do_crm_log_alias(log_level, file, function, line, "%s %s", prefix,
	(const char *) buffer->str);
	}

	if(data->type == XML_COMMENT_NODE) {
	return;

	} else if(xml_has_children(data) == FALSE) {
	return;

	} else if (pcmk_is_set(options, xml_log_option_children)) {
	for (child = pcmk__xml_first_child(data); child != NULL;
	child = pcmk__xml_next(child)) {

	log_xml_node_and_children(buffer, log_level, file, function, line,
	prefix, child, depth + 1,
	options\|xml_log_option_open
	\|xml_log_option_close);
	}
	}

	if (pcmk_is_set(options, xml_log_option_close)) {
	g_string_truncate(buffer, 0);

	insert_prefix(options, buffer, depth);
	pcmk__g_strcat(buffer, "</", name, ">", NULL);

	do_crm_log_alias(log_level, file, function, line, "%s %s", prefix,
	(const char *) buffer->str);
	}
	}

	// Log an XML element or comment (and any children) in a formatted way
	void
	pcmk__xml_log(int log_level, const char file, const char function, int line,
	const char prefix, const xmlNode data, int depth, int options)
	{
	/* Allocate a buffer once, for log_xml_node_and_children() to truncate and
	* reuse in recursive calls
	*/
	GString *buffer = g_string_sized_new(1024);

	log_xml_node_and_children(buffer, log_level, file, function, line, prefix,
	data, depth, options);

	g_string_free(buffer, TRUE);
	}

	// Log XML portions that have been marked as changed
	static void
	log_xml_changes(int log_level, const char file, const char function, int line,
	const char prefix, const xmlNode data, int depth, int options)
	{
	- xml_private_t *p;
	+ xml_node_private_t *nodepriv;
	char *prefix_m = NULL;
	xmlNode *child = NULL;

	if ((data == NULL) \|\| (log_level == LOG_NEVER)) {
	return;
	}

	- p = data->_private;
	+ nodepriv = data->_private;

	prefix_m = strdup(prefix);
	prefix_m[1] = '+';

	- if (pcmk_all_flags_set(p->flags, pcmk__xf_dirty\|pcmk__xf_created)) {
	+ if (pcmk_all_flags_set(nodepriv->flags, pcmk__xf_dirty\|pcmk__xf_created)) {
	/* Continue and log full subtree */
	pcmk__xml_log(log_level, file, function, line, prefix_m, data, depth,
	options\|xml_log_option_open\|xml_log_option_close
	\|xml_log_option_children);

	- } else if (pcmk_is_set(p->flags, pcmk__xf_dirty)) {
	+ } else if (pcmk_is_set(nodepriv->flags, pcmk__xf_dirty)) {
	int spaces = 0;
	char *prefix_del = NULL;
	char *prefix_moved = NULL;
	const char *flags = prefix;

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	CRM_CHECK(depth >= 0, depth = 0);
	spaces = 2 * depth;
	}

	prefix_del = strdup(prefix);
	prefix_del[0] = '-';
	prefix_del[1] = '-';
	prefix_moved = strdup(prefix);
	prefix_moved[1] = '~';

	- if (pcmk_is_set(p->flags, pcmk__xf_moved)) {
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_moved)) {
	flags = prefix_moved;
	} else {
	flags = prefix;
	}

	pcmk__xml_log(log_level, file, function, line, flags, data, depth,
	options\|xml_log_option_open);

	for (xmlAttrPtr a = pcmk__xe_first_attr(data); a != NULL; a = a->next) {
	const char aname = (const char) a->name;

	- p = a->_private;
	- if (pcmk_is_set(p->flags, pcmk__xf_deleted)) {
	+ nodepriv = a->_private;
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_deleted)) {
	const char *value = crm_element_value(data, aname);
	flags = prefix_del;
	do_crm_log_alias(log_level, file, function, line,
	"%s %*s @%s=%s", flags, spaces, "", aname,
	value);

	- } else if (pcmk_is_set(p->flags, pcmk__xf_dirty)) {
	+ } else if (pcmk_is_set(nodepriv->flags, pcmk__xf_dirty)) {
	const char *value = crm_element_value(data, aname);

	- if (pcmk_is_set(p->flags, pcmk__xf_created)) {
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_created)) {
	flags = prefix_m;

	- } else if (pcmk_is_set(p->flags, pcmk__xf_modified)) {
	+ } else if (pcmk_is_set(nodepriv->flags, pcmk__xf_modified)) {
	flags = prefix;

	- } else if (pcmk_is_set(p->flags, pcmk__xf_moved)) {
	+ } else if (pcmk_is_set(nodepriv->flags, pcmk__xf_moved)) {
	flags = prefix_moved;

	} else {
	flags = prefix;
	}
	do_crm_log_alias(log_level, file, function, line,
	"%s %*s @%s=%s", flags, spaces, "", aname,
	value);
	}
	}
	free(prefix_moved);
	free(prefix_del);

	for (child = pcmk__xml_first_child(data); child != NULL;
	child = pcmk__xml_next(child)) {
	log_xml_changes(log_level, file, function, line, prefix, child,
	depth + 1, options);
	}

	pcmk__xml_log(log_level, file, function, line, prefix, data, depth,
	options\|xml_log_option_close);

	} else {
	for (child = pcmk__xml_first_child(data); child != NULL;
	child = pcmk__xml_next(child)) {
	log_xml_changes(log_level, file, function, line, prefix, child,
	depth + 1, options);
	}
	}

	free(prefix_m);

	}

	void
	log_data_element(int log_level, const char file, const char function,
	int line, const char prefix, const xmlNode data, int depth,
	int options)
	{
	xmlNode *a_child = NULL;

	char *prefix_m = NULL;

	if (log_level == LOG_NEVER) {
	return;
	}

	if (prefix == NULL) {
	prefix = "";
	}

	/* Since we use the same file and line, to avoid confusing libqb, we need to use the same format strings */
	if (data == NULL) {
	do_crm_log_alias(log_level, file, function, line, "%s: %s", prefix,
	"No data to dump as XML");
	return;
	}

	if (pcmk_is_set(options, xml_log_option_dirty_add)) {
	log_xml_changes(log_level, file, function, line, prefix, data, depth,
	options);
	return;
	}

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	if (pcmk_is_set(options, xml_log_option_diff_plus)
	&& (data->children == NULL \|\| crm_element_value(data, XML_DIFF_MARKER))) {
	options \|= xml_log_option_diff_all;
	prefix_m = strdup(prefix);
	prefix_m[1] = '+';
	prefix = prefix_m;

	} else if (pcmk_is_set(options, xml_log_option_diff_minus)
	&& (data->children == NULL \|\| crm_element_value(data, XML_DIFF_MARKER))) {
	options \|= xml_log_option_diff_all;
	prefix_m = strdup(prefix);
	prefix_m[1] = '-';
	prefix = prefix_m;
	}
	}

	if (pcmk_is_set(options, xml_log_option_diff_short)
	&& !pcmk_is_set(options, xml_log_option_diff_all)) {
	/* Still searching for the actual change */
	for (a_child = pcmk__xml_first_child(data); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	log_data_element(log_level, file, function, line, prefix, a_child, depth + 1, options);
	}
	} else {
	pcmk__xml_log(log_level, file, function, line, prefix, data, depth,
	options\|xml_log_option_open\|xml_log_option_close
	\|xml_log_option_children);
	}
	free(prefix_m);
	}

	/*!
	* \internal
	* \brief Append filtered XML attributes to a buffer
	*
	* \param[in] data XML element whose attributes to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	*/
	static void
	dump_filtered_xml(const xmlNode data, int options, GString buffer)
	{
	CRM_ASSERT(buffer != NULL);

	for (const xmlAttr *a = pcmk__xe_first_attr(data); a != NULL; a = a->next) {
	if (!pcmk__xa_filterable((const char *) (a->name))) {
	dump_xml_attr(a, options, buffer);
	}
	}
	}

	/*!
	* \internal
	* \brief Append a string representation of an XML element to a buffer
	*
	* \param[in] data XML whose representation to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_element(const xmlNode data, int options, GString buffer, int depth)
	{
	const char *name = NULL;

	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	name = crm_element_name(data);
	CRM_ASSERT(name != NULL);

	insert_prefix(options, buffer, depth);
	pcmk__g_strcat(buffer, "<", name, NULL);

	if (options & xml_log_option_filtered) {
	dump_filtered_xml(data, options, buffer);

	} else {
	for (const xmlAttr *a = pcmk__xe_first_attr(data); a != NULL;
	a = a->next) {

	dump_xml_attr(a, options, buffer);
	}
	}

	if (data->children == NULL) {
	g_string_append(buffer, "/>");

	} else {
	g_string_append_c(buffer, '>');
	}

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}

	if (data->children) {
	xmlNode *xChild = NULL;
	for(xChild = data->children; xChild != NULL; xChild = xChild->next) {
	pcmk__xml2text(xChild, options, buffer, depth + 1);
	}

	insert_prefix(options, buffer, depth);
	pcmk__g_strcat(buffer, "</", name, ">", NULL);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}
	}

	/*!
	* \internal
	* \brief Append XML text content to a buffer
	*
	* \param[in] data XML whose content to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_text(const xmlNode data, int options, GString buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	insert_prefix(options, buffer, depth);
	g_string_append(buffer, (const gchar *) data->content);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}

	/*!
	* \internal
	* \brief Append XML CDATA content to a buffer
	*
	* \param[in] data XML whose content to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_cdata(const xmlNode data, int options, GString buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	insert_prefix(options, buffer, depth);
	pcmk__g_strcat(buffer, "<![CDATA[", (const char *) data->content, "]]>",
	NULL);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}

	/*!
	* \internal
	* \brief Append an XML comment to a buffer
	*
	* \param[in] data XML whose content to append
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to append the content (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	static void
	dump_xml_comment(const xmlNode data, int options, GString buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	crm_trace("Nothing to dump");
	return;
	}

	insert_prefix(options, buffer, depth);
	pcmk__g_strcat(buffer, "<!--", (const char *) data->content, "-->", NULL);

	if (pcmk_is_set(options, xml_log_option_formatted)) {
	g_string_append_c(buffer, '\n');
	}
	}

	#define PCMK__XMLDUMP_STATS 0

	/*!
	* \internal
	* \brief Create a text representation of an XML object
	*
	* \param[in] data XML to convert
	* \param[in] options Group of \p xml_log_options flags
	* \param[in,out] buffer Where to store the text (must not be \p NULL)
	* \param[in] depth Current indentation level
	*/
	void
	pcmk__xml2text(xmlNodePtr data, int options, GString *buffer, int depth)
	{
	CRM_ASSERT(buffer != NULL);

	if (data == NULL) {
	return;
	}

	if (!pcmk_is_set(options, xml_log_option_filtered)
	&& pcmk_is_set(options, xml_log_option_full_fledged)) {
	/* libxml's serialization reuse is a good idea, sadly we cannot
	apply it for the filtered cases (preceding filtering pass
	would preclude further reuse of such in-situ modified XML
	in generic context and is likely not a win performance-wise),
	and there's also a historically unstable throughput argument
	(likely stemming from memory allocation overhead, eventhough
	that shall be minimized with defaults preset in crm_xml_init) */
	#if (PCMK__XMLDUMP_STATS - 0)
	time_t next, new = time(NULL);
	#endif
	xmlDoc *doc;
	xmlOutputBuffer *xml_buffer;

	doc = getDocPtr(data);
	/* doc will only be NULL if data is */
	CRM_CHECK(doc != NULL, return);

	xml_buffer = xmlAllocOutputBuffer(NULL);
	CRM_ASSERT(xml_buffer != NULL);

	/* XXX we could setup custom allocation scheme for the particular
	buffer, but it's subsumed with crm_xml_init that needs to
	be invoked prior to entering this function as such, since
	its other branch vitally depends on it -- what can be done
	about this all is to have a facade parsing functions that
	would 100% mark entering libxml code for us, since we don't
	do anything as crazy as swapping out the binary form of the
	parsed tree (but those would need to be strictly used as
	opposed to libxml's raw functions) */

	xmlNodeDumpOutput(xml_buffer, doc, data, 0,
	(options & xml_log_option_formatted), NULL);
	/* attempt adding final NL - failing shouldn't be fatal here */
	(void) xmlOutputBufferWrite(xml_buffer, sizeof("\n") - 1, "\n");
	if (xml_buffer->buffer != NULL) {
	g_string_append(buffer,
	(const gchar *) xmlBufContent(xml_buffer->buffer));
	}

	#if (PCMK__XMLDUMP_STATS - 0)
	next = time(NULL);
	if ((now + 1) < next) {
	crm_log_xml_trace(data, "Long time");
	crm_err("xmlNodeDumpOutput() -> %lld bytes took %ds",
	(long long) buffer->len, next - now);
	}
	#endif

	/* asserted allocation before so there should be something to remove */
	(void) xmlOutputBufferClose(xml_buffer);
	return;
	}

	switch(data->type) {
	case XML_ELEMENT_NODE:
	/* Handle below */
	dump_xml_element(data, options, buffer, depth);
	break;
	case XML_TEXT_NODE:
	/* if option xml_log_option_text is enabled, then dump XML_TEXT_NODE */
	if (options & xml_log_option_text) {
	dump_xml_text(data, options, buffer, depth);
	}
	break;
	case XML_COMMENT_NODE:
	dump_xml_comment(data, options, buffer, depth);
	break;
	case XML_CDATA_SECTION_NODE:
	dump_xml_cdata(data, options, buffer, depth);
	break;
	default:
	crm_warn("Unhandled type: %d", data->type);
	break;

	/*
	XML_ATTRIBUTE_NODE = 2
	XML_ENTITY_REF_NODE = 5
	XML_ENTITY_NODE = 6
	XML_PI_NODE = 7
	XML_DOCUMENT_NODE = 9
	XML_DOCUMENT_TYPE_NODE = 10
	XML_DOCUMENT_FRAG_NODE = 11
	XML_NOTATION_NODE = 12
	XML_HTML_DOCUMENT_NODE = 13
	XML_DTD_NODE = 14
	XML_ELEMENT_DECL = 15
	XML_ATTRIBUTE_DECL = 16
	XML_ENTITY_DECL = 17
	XML_NAMESPACE_DECL = 18
	XML_XINCLUDE_START = 19
	XML_XINCLUDE_END = 20
	XML_DOCB_DOCUMENT_NODE = 21
	*/
	}
	}

	char *
	dump_xml_formatted_with_text(xmlNode * an_xml_node)
	{
	char *buffer = NULL;
	GString *g_buffer = g_string_sized_new(1024);

	pcmk__xml2text(an_xml_node,
	xml_log_option_formatted\|xml_log_option_full_fledged,
	g_buffer, 0);

	if (g_buffer != NULL) {
	buffer = strdup((const char *) g_buffer->str);
	g_string_free(g_buffer, TRUE);
	}
	return buffer;
	}

	char *
	dump_xml_formatted(xmlNode * an_xml_node)
	{
	char *buffer = NULL;
	GString *g_buffer = g_string_sized_new(1024);

	pcmk__xml2text(an_xml_node, xml_log_option_formatted, g_buffer, 0);

	if (g_buffer != NULL) {
	buffer = strdup((const char *) g_buffer->str);
	g_string_free(g_buffer, TRUE);
	}
	return buffer;
	}

	char *
	dump_xml_unformatted(xmlNode * an_xml_node)
	{
	char *buffer = NULL;
	GString *g_buffer = g_string_sized_new(1024);

	pcmk__xml2text(an_xml_node, 0, g_buffer, 0);

	if (g_buffer != NULL) {
	buffer = strdup((const char *) g_buffer->str);
	g_string_free(g_buffer, TRUE);
	}
	return buffer;
	}

	gboolean
	xml_has_children(const xmlNode * xml_root)
	{
	if (xml_root != NULL && xml_root->children != NULL) {
	return TRUE;
	}
	return FALSE;
	}

	void
	xml_remove_prop(xmlNode * obj, const char *name)
	{
	if (pcmk__check_acl(obj, NULL, pcmk__xf_acl_write) == FALSE) {
	crm_trace("Cannot remove %s from %s", name, obj->name);

	} else if (pcmk__tracking_xml_changes(obj, FALSE)) {
	/* Leave in place (marked for removal) until after the diff is calculated */
	- xml_private_t *p = NULL;
	xmlAttr *attr = xmlHasProp(obj, (pcmkXmlStr) name);
	+ xml_node_private_t *nodepriv = attr->_private;

	- p = attr->_private;
	set_parent_flag(obj, pcmk__xf_dirty);
	- pcmk__set_xml_flags(p, pcmk__xf_deleted);
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_deleted);
	} else {
	xmlUnsetProp(obj, (pcmkXmlStr) name);
	}
	}

	void
	save_xml_to_file(xmlNode * xml, const char desc, const char filename)
	{
	char *f = NULL;

	if (filename == NULL) {
	char *uuid = crm_generate_uuid();

	f = crm_strdup_printf("%s/%s", pcmk__get_tmpdir(), uuid);
	filename = f;
	free(uuid);
	}

	crm_info("Saving %s to %s", desc, filename);
	write_xml_file(xml, filename, FALSE);
	free(f);
	}

	/*!
	* \internal
	* \brief Set a flag on all attributes of an XML element
	*
	* \param[in,out] xml XML node to set flags on
	* \param[in] flag XML private flag to set
	*/
	static void
	set_attrs_flag(xmlNode *xml, enum xml_private_flags flag)
	{
	for (xmlAttr *attr = pcmk__xe_first_attr(xml); attr; attr = attr->next) {
	- pcmk__set_xml_flags((xml_private_t *) (attr->_private), flag);
	+ pcmk__set_xml_flags((xml_node_private_t *) (attr->_private), flag);
	}
	}

	/*!
	* \internal
	* \brief Add an XML attribute to a node, marked as deleted
	*
	* When calculating XML changes, we need to know when an attribute has been
	* deleted. Add the attribute back to the new XML, so that we can check the
	* removal against ACLs, and mark it as deleted for later removal after
	* differences have been calculated.
	*/
	static void
	mark_attr_deleted(xmlNode new_xml, const char element, const char *attr_name,
	const char *old_value)
	{
	- xml_private_t *p = new_xml->doc->_private;
	+ xml_doc_private_t *docpriv = new_xml->doc->_private;
	xmlAttr *attr = NULL;
	+ xml_node_private_t *nodepriv;

	// Prevent the dirty flag being set recursively upwards
	- pcmk__clear_xml_flags(p, pcmk__xf_tracking);
	+ pcmk__clear_xml_flags(docpriv, pcmk__xf_tracking);

	// Restore the old value (and the tracking flag)
	attr = xmlSetProp(new_xml, (pcmkXmlStr) attr_name, (pcmkXmlStr) old_value);
	- pcmk__set_xml_flags(p, pcmk__xf_tracking);
	+ pcmk__set_xml_flags(docpriv, pcmk__xf_tracking);

	// Reset flags (so the attribute doesn't appear as newly created)
	- p = attr->_private;
	- p->flags = 0;
	+ nodepriv = attr->_private;
	+ nodepriv->flags = 0;

	// Check ACLs and mark restored value for later removal
	xml_remove_prop(new_xml, attr_name);

	crm_trace("XML attribute %s=%s was removed from %s",
	attr_name, old_value, element);
	}

	/*
	* \internal
	* \brief Check ACLs for a changed XML attribute
	*/
	static void
	mark_attr_changed(xmlNode new_xml, const char element, const char *attr_name,
	const char *old_value)
	{
	char *vcopy = crm_element_value_copy(new_xml, attr_name);

	crm_trace("XML attribute %s was changed from '%s' to '%s' in %s",
	attr_name, old_value, vcopy, element);

	// Restore the original value
	xmlSetProp(new_xml, (pcmkXmlStr) attr_name, (pcmkXmlStr) old_value);

	// Change it back to the new value, to check ACLs
	crm_xml_add(new_xml, attr_name, vcopy);
	free(vcopy);
	}

	/*!
	* \internal
	* \brief Mark an XML attribute as having changed position
	*/
	static void
	mark_attr_moved(xmlNode new_xml, const char element, xmlAttr *old_attr,
	xmlAttr *new_attr, int p_old, int p_new)
	{
	- xml_private_t *p = new_attr->_private;
	+ xml_node_private_t *nodepriv = new_attr->_private;

	crm_trace("XML attribute %s moved from position %d to %d in %s",
	old_attr->name, p_old, p_new, element);

	// Mark document, element, and all element's parents as changed
	mark_xml_node_dirty(new_xml);

	// Mark attribute as changed
	- pcmk__set_xml_flags(p, pcmk__xf_dirty\|pcmk__xf_moved);
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_dirty\|pcmk__xf_moved);

	- p = (p_old > p_new)? old_attr->_private : new_attr->_private;
	- pcmk__set_xml_flags(p, pcmk__xf_skip);
	+ nodepriv = (p_old > p_new)? old_attr->_private : new_attr->_private;
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_skip);
	}

	/*!
	* \internal
	* \brief Calculate differences in all previously existing XML attributes
	*/
	static void
	xml_diff_old_attrs(xmlNode old_xml, xmlNode new_xml)
	{
	xmlAttr *attr_iter = pcmk__xe_first_attr(old_xml);

	while (attr_iter != NULL) {
	xmlAttr *old_attr = attr_iter;
	xmlAttr *new_attr = xmlHasProp(new_xml, attr_iter->name);
	const char name = (const char ) attr_iter->name;
	const char *old_value = crm_element_value(old_xml, name);

	attr_iter = attr_iter->next;
	if (new_attr == NULL) {
	mark_attr_deleted(new_xml, (const char *) old_xml->name, name,
	old_value);

	} else {
	- xml_private_t *p = new_attr->_private;
	+ xml_node_private_t *nodepriv = new_attr->_private;
	int new_pos = pcmk__xml_position((xmlNode*) new_attr,
	pcmk__xf_skip);
	int old_pos = pcmk__xml_position((xmlNode*) old_attr,
	pcmk__xf_skip);
	const char *new_value = crm_element_value(new_xml, name);

	// This attribute isn't new
	- pcmk__clear_xml_flags(p, pcmk__xf_created);
	+ pcmk__clear_xml_flags(nodepriv, pcmk__xf_created);

	if (strcmp(new_value, old_value) != 0) {
	mark_attr_changed(new_xml, (const char *) old_xml->name, name,
	old_value);

	} else if ((old_pos != new_pos)
	&& !pcmk__tracking_xml_changes(new_xml, TRUE)) {
	mark_attr_moved(new_xml, (const char *) old_xml->name,
	old_attr, new_attr, old_pos, new_pos);
	}
	}
	}
	}

	/*!
	* \internal
	* \brief Check all attributes in new XML for creation
	*/
	static void
	mark_created_attrs(xmlNode *new_xml)
	{
	xmlAttr *attr_iter = pcmk__xe_first_attr(new_xml);

	while (attr_iter != NULL) {
	xmlAttr *new_attr = attr_iter;
	- xml_private_t *p = attr_iter->_private;
	+ xml_node_private_t *nodepriv = attr_iter->_private;

	attr_iter = attr_iter->next;
	- if (pcmk_is_set(p->flags, pcmk__xf_created)) {
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_created)) {
	const char attr_name = (const char ) new_attr->name;

	crm_trace("Created new attribute %s=%s in %s",
	attr_name, crm_element_value(new_xml, attr_name),
	new_xml->name);

	/* Check ACLs (we can't use the remove-then-create trick because it
	* would modify the attribute position).
	*/
	if (pcmk__check_acl(new_xml, attr_name, pcmk__xf_acl_write)) {
	pcmk__mark_xml_attr_dirty(new_attr);
	} else {
	// Creation was not allowed, so remove the attribute
	xmlUnsetProp(new_xml, new_attr->name);
	}
	}
	}
	}

	/*!
	* \internal
	* \brief Calculate differences in attributes between two XML nodes
	*/
	static void
	xml_diff_attrs(xmlNode old_xml, xmlNode new_xml)
	{
	set_attrs_flag(new_xml, pcmk__xf_created); // cleared later if not really new
	xml_diff_old_attrs(old_xml, new_xml);
	mark_created_attrs(new_xml);
	}

	/*!
	* \internal
	* \brief Add an XML child element to a node, marked as deleted
	*
	* When calculating XML changes, we need to know when a child element has been
	* deleted. Add the child back to the new XML, so that we can check the removal
	* against ACLs, and mark it as deleted for later removal after differences have
	* been calculated.
	*/
	static void
	mark_child_deleted(xmlNode old_child, xmlNode new_parent)
	{
	// Re-create the child element so we can check ACLs
	xmlNode *candidate = add_node_copy(new_parent, old_child);

	// Clear flags on new child and its children
	reset_xml_node_flags(candidate);

	// Check whether ACLs allow the deletion
	pcmk__apply_acl(xmlDocGetRootElement(candidate->doc));

	// Remove the child again (which will track it in document's deleted_objs)
	free_xml_with_position(candidate,
	pcmk__xml_position(old_child, pcmk__xf_skip));

	if (pcmk__xml_match(new_parent, old_child, true) == NULL) {
	- pcmk__set_xml_flags((xml_private_t *) (old_child->_private),
	+ pcmk__set_xml_flags((xml_node_private_t *) (old_child->_private),
	pcmk__xf_skip);
	}
	}

	static void
	mark_child_moved(xmlNode old_child, xmlNode new_parent, xmlNode *new_child,
	int p_old, int p_new)
	{
	- xml_private_t *p = new_child->_private;
	+ xml_node_private_t *nodepriv = new_child->_private;

	crm_trace("Child element %s with id='%s' moved from position %d to %d under %s",
	new_child->name, (ID(new_child)? ID(new_child) : "<no id>"),
	p_old, p_new, new_parent->name);
	mark_xml_node_dirty(new_parent);
	- pcmk__set_xml_flags(p, pcmk__xf_moved);
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_moved);

	if (p_old > p_new) {
	- p = old_child->_private;
	+ nodepriv = old_child->_private;
	} else {
	- p = new_child->_private;
	+ nodepriv = new_child->_private;
	}
	- pcmk__set_xml_flags(p, pcmk__xf_skip);
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_skip);
	}

	// Given original and new XML, mark new XML portions that have changed
	static void
	mark_xml_changes(xmlNode old_xml, xmlNode new_xml, bool check_top)
	{
	xmlNode *cIter = NULL;
	- xml_private_t *p = NULL;
	+ xml_node_private_t *nodepriv = NULL;

	CRM_CHECK(new_xml != NULL, return);
	if (old_xml == NULL) {
	pcmk__mark_xml_created(new_xml);
	pcmk__apply_creation_acl(new_xml, check_top);
	return;
	}

	- p = new_xml->_private;
	- CRM_CHECK(p != NULL, return);
	+ nodepriv = new_xml->_private;
	+ CRM_CHECK(nodepriv != NULL, return);

	- if(p->flags & pcmk__xf_processed) {
	+ if(nodepriv->flags & pcmk__xf_processed) {
	/* Avoid re-comparing nodes */
	return;
	}
	- pcmk__set_xml_flags(p, pcmk__xf_processed);
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_processed);

	xml_diff_attrs(old_xml, new_xml);

	// Check for differences in the original children
	for (cIter = pcmk__xml_first_child(old_xml); cIter != NULL; ) {
	xmlNode *old_child = cIter;
	xmlNode *new_child = pcmk__xml_match(new_xml, cIter, true);

	cIter = pcmk__xml_next(cIter);
	if(new_child) {
	mark_xml_changes(old_child, new_child, TRUE);

	} else {
	mark_child_deleted(old_child, new_xml);
	}
	}

	// Check for moved or created children
	for (cIter = pcmk__xml_first_child(new_xml); cIter != NULL; ) {
	xmlNode *new_child = cIter;
	xmlNode *old_child = pcmk__xml_match(old_xml, cIter, true);

	cIter = pcmk__xml_next(cIter);
	if(old_child == NULL) {
	// This is a newly created child
	- p = new_child->_private;
	- pcmk__set_xml_flags(p, pcmk__xf_skip);
	+ nodepriv = new_child->_private;
	+ pcmk__set_xml_flags(nodepriv, pcmk__xf_skip);
	mark_xml_changes(old_child, new_child, TRUE);

	} else {
	/* Check for movement, we already checked for differences */
	int p_new = pcmk__xml_position(new_child, pcmk__xf_skip);
	int p_old = pcmk__xml_position(old_child, pcmk__xf_skip);

	if(p_old != p_new) {
	mark_child_moved(old_child, new_xml, new_child, p_old, p_new);
	}
	}
	}
	}

	void
	xml_calculate_significant_changes(xmlNode old_xml, xmlNode new_xml)
	{
	pcmk__set_xml_doc_flag(new_xml, pcmk__xf_lazy);
	xml_calculate_changes(old_xml, new_xml);
	}

	void
	xml_calculate_changes(xmlNode old_xml, xmlNode new_xml)
	{
	CRM_CHECK(pcmk__str_eq(crm_element_name(old_xml), crm_element_name(new_xml), pcmk__str_casei),
	return);
	CRM_CHECK(pcmk__str_eq(ID(old_xml), ID(new_xml), pcmk__str_casei), return);

	if(xml_tracking_changes(new_xml) == FALSE) {
	xml_track_changes(new_xml, NULL, NULL, FALSE);
	}

	mark_xml_changes(old_xml, new_xml, FALSE);
	}

	gboolean
	can_prune_leaf(xmlNode * xml_node)
	{
	xmlNode *cIter = NULL;
	gboolean can_prune = TRUE;
	const char *name = crm_element_name(xml_node);

	if (pcmk__strcase_any_of(name, XML_TAG_RESOURCE_REF, XML_CIB_TAG_OBJ_REF,
	XML_ACL_TAG_ROLE_REF, XML_ACL_TAG_ROLE_REFv1, NULL)) {
	return FALSE;
	}

	for (xmlAttrPtr a = pcmk__xe_first_attr(xml_node); a != NULL; a = a->next) {
	const char p_name = (const char ) a->name;

	if (strcmp(p_name, XML_ATTR_ID) == 0) {
	continue;
	}
	can_prune = FALSE;
	}

	cIter = pcmk__xml_first_child(xml_node);
	while (cIter) {
	xmlNode *child = cIter;

	cIter = pcmk__xml_next(cIter);
	if (can_prune_leaf(child)) {
	free_xml(child);
	} else {
	can_prune = FALSE;
	}
	}
	return can_prune;
	}

	/*!
	* \internal
	* \brief Find a comment with matching content in specified XML
	*
	* \param[in] root XML to search
	* \param[in] search_comment Comment whose content should be searched for
	* \param[in] exact If true, comment must also be at same position
	*/
	xmlNode *
	pcmk__xc_match(xmlNode root, xmlNode search_comment, bool exact)
	{
	xmlNode *a_child = NULL;
	int search_offset = pcmk__xml_position(search_comment, pcmk__xf_skip);

	CRM_CHECK(search_comment->type == XML_COMMENT_NODE, return NULL);

	for (a_child = pcmk__xml_first_child(root); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	if (exact) {
	int offset = pcmk__xml_position(a_child, pcmk__xf_skip);
	- xml_private_t *p = a_child->_private;
	+ xml_node_private_t *nodepriv = a_child->_private;

	if (offset < search_offset) {
	continue;

	} else if (offset > search_offset) {
	return NULL;
	}

	- if (pcmk_is_set(p->flags, pcmk__xf_skip)) {
	+ if (pcmk_is_set(nodepriv->flags, pcmk__xf_skip)) {
	continue;
	}
	}

	if (a_child->type == XML_COMMENT_NODE
	&& pcmk__str_eq((const char )a_child->content, (const char )search_comment->content, pcmk__str_casei)) {
	return a_child;

	} else if (exact) {
	return NULL;
	}
	}

	return NULL;
	}

	/*!
	* \internal
	* \brief Make one XML comment match another (in content)
	*
	* \param[in,out] parent If \p target is NULL and this is not, add or update
	* comment child of this XML node that matches \p update
	* \param[in,out] target If not NULL, update this XML comment node
	* \param[in] update Make comment content match this (must not be NULL)
	*
	* \note At least one of \parent and \target must be non-NULL
	*/
	void
	pcmk__xc_update(xmlNode parent, xmlNode target, xmlNode *update)
	{
	CRM_CHECK(update != NULL, return);
	CRM_CHECK(update->type == XML_COMMENT_NODE, return);

	if (target == NULL) {
	target = pcmk__xc_match(parent, update, false);
	}

	if (target == NULL) {
	add_node_copy(parent, update);

	} else if (!pcmk__str_eq((const char )target->content, (const char )update->content, pcmk__str_casei)) {
	xmlFree(target->content);
	target->content = xmlStrdup(update->content);
	}
	}

	/*!
	* \internal
	* \brief Make one XML tree match another (in children and attributes)
	*
	* \param[in,out] parent If \p target is NULL and this is not, add or update
	* child of this XML node that matches \p update
	* \param[in,out] target If not NULL, update this XML
	* \param[in] update Make the desired XML match this (must not be NULL)
	* \param[in] as_diff If false, expand "++" when making attributes match
	*
	* \note At least one of \parent and \target must be non-NULL
	*/
	void
	pcmk__xml_update(xmlNode parent, xmlNode target, xmlNode *update,
	bool as_diff)
	{
	xmlNode *a_child = NULL;
	const char *object_name = NULL,
	*object_href = NULL,
	*object_href_val = NULL;

	#if XML_PARSER_DEBUG
	crm_log_xml_trace(update, "update:");
	crm_log_xml_trace(target, "target:");
	#endif

	CRM_CHECK(update != NULL, return);

	if (update->type == XML_COMMENT_NODE) {
	pcmk__xc_update(parent, target, update);
	return;
	}

	object_name = crm_element_name(update);
	object_href_val = ID(update);
	if (object_href_val != NULL) {
	object_href = XML_ATTR_ID;
	} else {
	object_href_val = crm_element_value(update, XML_ATTR_IDREF);
	object_href = (object_href_val == NULL) ? NULL : XML_ATTR_IDREF;
	}

	CRM_CHECK(object_name != NULL, return);
	CRM_CHECK(target != NULL \|\| parent != NULL, return);

	if (target == NULL) {
	target = pcmk__xe_match(parent, object_name,
	object_href, object_href_val);
	}

	if (target == NULL) {
	target = create_xml_node(parent, object_name);
	CRM_CHECK(target != NULL, return);
	#if XML_PARSER_DEBUG
	crm_trace("Added <%s%s%s%s%s/>", pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");

	} else {
	crm_trace("Found node <%s%s%s%s%s/> to update",
	pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");
	#endif
	}

	CRM_CHECK(pcmk__str_eq(crm_element_name(target), crm_element_name(update),
	pcmk__str_casei),
	return);

	if (as_diff == FALSE) {
	/* So that expand_plus_plus() gets called */
	copy_in_properties(target, update);

	} else {
	/* No need for expand_plus_plus(), just raw speed */
	for (xmlAttrPtr a = pcmk__xe_first_attr(update); a != NULL;
	a = a->next) {
	const char *p_value = pcmk__xml_attr_value(a);

	/* Remove it first so the ordering of the update is preserved */
	xmlUnsetProp(target, a->name);
	xmlSetProp(target, a->name, (pcmkXmlStr) p_value);
	}
	}

	for (a_child = pcmk__xml_first_child(update); a_child != NULL;
	a_child = pcmk__xml_next(a_child)) {
	#if XML_PARSER_DEBUG
	crm_trace("Updating child <%s%s%s%s%s/>",
	pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");
	#endif
	pcmk__xml_update(target, NULL, a_child, as_diff);
	}

	#if XML_PARSER_DEBUG
	crm_trace("Finished with <%s%s%s%s%s/>", pcmk__s(object_name, "<null>"),
	object_href ? " " : "",
	object_href ? object_href : "",
	object_href ? "=" : "",
	object_href ? object_href_val : "");
	#endif
	}

	gboolean
	update_xml_child(xmlNode * child, xmlNode * to_update)
	{
	gboolean can_update = TRUE;
	xmlNode *child_of_child = NULL;

	CRM_CHECK(child != NULL, return FALSE);
	CRM_CHECK(to_update != NULL, return FALSE);

	if (!pcmk__str_eq(crm_element_name(to_update), crm_element_name(child), pcmk__str_none)) {
	can_update = FALSE;

	} else if (!pcmk__str_eq(ID(to_update), ID(child), pcmk__str_none)) {
	can_update = FALSE;

	} else if (can_update) {
	#if XML_PARSER_DEBUG
	crm_log_xml_trace(child, "Update match found...");
	#endif
	pcmk__xml_update(NULL, child, to_update, false);
	}

	for (child_of_child = pcmk__xml_first_child(child); child_of_child != NULL;
	child_of_child = pcmk__xml_next(child_of_child)) {
	/* only update the first one */
	if (can_update) {
	break;
	}
	can_update = update_xml_child(child_of_child, to_update);
	}

	return can_update;
	}

	int
	find_xml_children(xmlNode ** children, xmlNode * root,
	const char tag, const char field, const char *value, gboolean search_matches)
	{
	int match_found = 0;

	CRM_CHECK(root != NULL, return FALSE);
	CRM_CHECK(children != NULL, return FALSE);

	if (tag != NULL && !pcmk__str_eq(tag, crm_element_name(root), pcmk__str_casei)) {

	} else if (value != NULL && !pcmk__str_eq(value, crm_element_value(root, field), pcmk__str_casei)) {

	} else {
	if (*children == NULL) {
	*children = create_xml_node(NULL, __func__);
	}
	add_node_copy(*children, root);
	match_found = 1;
	}

	if (search_matches \|\| match_found == 0) {
	xmlNode *child = NULL;

	for (child = pcmk__xml_first_child(root); child != NULL;
	child = pcmk__xml_next(child)) {
	match_found += find_xml_children(children, child, tag, field, value, search_matches);
	}
	}

	return match_found;
	}

	gboolean
	replace_xml_child(xmlNode * parent, xmlNode * child, xmlNode * update, gboolean delete_only)
	{
	gboolean can_delete = FALSE;
	xmlNode *child_of_child = NULL;

	const char *up_id = NULL;
	const char *child_id = NULL;
	const char *right_val = NULL;

	CRM_CHECK(child != NULL, return FALSE);
	CRM_CHECK(update != NULL, return FALSE);

	up_id = ID(update);
	child_id = ID(child);

	if (up_id == NULL \|\| (child_id && strcmp(child_id, up_id) == 0)) {
	can_delete = TRUE;
	}
	if (!pcmk__str_eq(crm_element_name(update), crm_element_name(child), pcmk__str_casei)) {
	can_delete = FALSE;
	}
	if (can_delete && delete_only) {
	for (xmlAttrPtr a = pcmk__xe_first_attr(update); a != NULL;
	a = a->next) {
	const char p_name = (const char ) a->name;
	const char *p_value = pcmk__xml_attr_value(a);

	right_val = crm_element_value(child, p_name);
	if (!pcmk__str_eq(p_value, right_val, pcmk__str_casei)) {
	can_delete = FALSE;
	}
	}
	}

	if (can_delete && parent != NULL) {
	crm_log_xml_trace(child, "Delete match found...");
	if (delete_only \|\| update == NULL) {
	free_xml(child);

	} else {
	xmlNode *tmp = copy_xml(update);
	xmlDoc *doc = tmp->doc;
	xmlNode *old = NULL;

	xml_accept_changes(tmp);
	old = xmlReplaceNode(child, tmp);

	if(xml_tracking_changes(tmp)) {
	/* Replaced sections may have included relevant ACLs */
	pcmk__apply_acl(tmp);
	}

	xml_calculate_changes(old, tmp);
	xmlDocSetRootElement(doc, old);
	free_xml(old);
	}
	child = NULL;
	return TRUE;

	} else if (can_delete) {
	crm_log_xml_debug(child, "Cannot delete the search root");
	can_delete = FALSE;
	}

	child_of_child = pcmk__xml_first_child(child);
	while (child_of_child) {
	xmlNode *next = pcmk__xml_next(child_of_child);

	can_delete = replace_xml_child(child, child_of_child, update, delete_only);

	/* only delete the first one */
	if (can_delete) {
	child_of_child = NULL;
	} else {
	child_of_child = next;
	}
	}

	return can_delete;
	}

	xmlNode *
	sorted_xml(xmlNode input, xmlNode parent, gboolean recursive)
	{
	xmlNode *child = NULL;
	GSList *nvpairs = NULL;
	xmlNode *result = NULL;
	const char *name = NULL;

	CRM_CHECK(input != NULL, return NULL);

	name = crm_element_name(input);
	CRM_CHECK(name != NULL, return NULL);

	result = create_xml_node(parent, name);
	nvpairs = pcmk_xml_attrs2nvpairs(input);
	nvpairs = pcmk_sort_nvpairs(nvpairs);
	pcmk_nvpairs2xml_attrs(nvpairs, result);
	pcmk_free_nvpairs(nvpairs);

	for (child = pcmk__xml_first_child(input); child != NULL;
	child = pcmk__xml_next(child)) {

	if (recursive) {
	sorted_xml(child, result, recursive);
	} else {
	add_node_copy(result, child);
	}
	}

	return result;
	}

	xmlNode *
	first_named_child(const xmlNode parent, const char name)
	{
	xmlNode *match = NULL;

	for (match = pcmk__xe_first_child(parent); match != NULL;
	match = pcmk__xe_next(match)) {
	/*
	* name == NULL gives first child regardless of name; this is
	* semantically incorrect in this function, but may be necessary
	* due to prior use of xml_child_iter_filter
	*/
	if (pcmk__str_eq(name, (const char *)match->name, pcmk__str_null_matches)) {
	return match;
	}
	}
	return NULL;
	}

	/*!
	* \brief Get next instance of same XML tag
	*
	* \param[in] sibling XML tag to start from
	*
	* \return Next sibling XML tag with same name
	*/
	xmlNode *
	crm_next_same_xml(const xmlNode *sibling)
	{
	xmlNode *match = pcmk__xe_next(sibling);
	const char *name = crm_element_name(sibling);

	while (match != NULL) {
	if (!strcmp(crm_element_name(match), name)) {
	return match;
	}
	match = pcmk__xe_next(match);
	}
	return NULL;
	}

	void
	crm_xml_init(void)
	{
	static bool init = true;

	if(init) {
	init = false;
	/* The default allocator XML_BUFFER_ALLOC_EXACT does far too many
	* pcmk__realloc()s and it can take upwards of 18 seconds (yes, seconds)
	* to dump a 28kb tree which XML_BUFFER_ALLOC_DOUBLEIT can do in
	* less than 1 second.
	*/
	xmlSetBufferAllocationScheme(XML_BUFFER_ALLOC_DOUBLEIT);

	/* Populate and free the _private field when nodes are created and destroyed */
	xmlDeregisterNodeDefault(free_private_data);
	xmlRegisterNodeDefault(new_private_data);

	crm_schema_init();
	}
	}

	void
	crm_xml_cleanup(void)
	{
	crm_schema_cleanup();
	xmlCleanupParser();
	}

	#define XPATH_MAX 512

	xmlNode *
	expand_idref(xmlNode * input, xmlNode * top)
	{
	const char *tag = NULL;
	const char *ref = NULL;
	xmlNode *result = input;

	if (result == NULL) {
	return NULL;

	} else if (top == NULL) {
	top = input;
	}

	tag = crm_element_name(result);
	ref = crm_element_value(result, XML_ATTR_IDREF);

	if (ref != NULL) {
	char *xpath_string = crm_strdup_printf("//%s[@id='%s']", tag, ref);

	result = get_xpath_object(xpath_string, top, LOG_ERR);
	if (result == NULL) {
	char nodePath = (char )xmlGetNodePath(top);

	crm_err("No match for %s found in %s: Invalid configuration",
	xpath_string, pcmk__s(nodePath, "unrecognizable path"));
	free(nodePath);
	}
	free(xpath_string);
	}
	return result;
	}

	char *
	pcmk__xml_artefact_root(enum pcmk__xml_artefact_ns ns)
	{
	static const char *base = NULL;
	char *ret = NULL;

	if (base == NULL) {
	base = getenv("PCMK_schema_directory");
	}
	if (pcmk__str_empty(base)) {
	base = CRM_SCHEMA_DIRECTORY;
	}

	switch (ns) {
	case pcmk__xml_artefact_ns_legacy_rng:
	case pcmk__xml_artefact_ns_legacy_xslt:
	ret = strdup(base);
	break;
	case pcmk__xml_artefact_ns_base_rng:
	case pcmk__xml_artefact_ns_base_xslt:
	ret = crm_strdup_printf("%s/base", base);
	break;
	default:
	crm_err("XML artefact family specified as %u not recognized", ns);
	}
	return ret;
	}

	char *
	pcmk__xml_artefact_path(enum pcmk__xml_artefact_ns ns, const char *filespec)
	{
	char base = pcmk__xml_artefact_root(ns), ret = NULL;

	switch (ns) {
	case pcmk__xml_artefact_ns_legacy_rng:
	case pcmk__xml_artefact_ns_base_rng:
	ret = crm_strdup_printf("%s/%s.rng", base, filespec);
	break;
	case pcmk__xml_artefact_ns_legacy_xslt:
	case pcmk__xml_artefact_ns_base_xslt:
	ret = crm_strdup_printf("%s/%s.xsl", base, filespec);
	break;
	default:
	crm_err("XML artefact family specified as %u not recognized", ns);
	}
	free(base);

	return ret;
	}

	void
	pcmk__xe_set_propv(xmlNodePtr node, va_list pairs)
	{
	while (true) {
	const char name, value;

	name = va_arg(pairs, const char *);
	if (name == NULL) {
	return;
	}

	value = va_arg(pairs, const char *);
	if (value != NULL) {
	crm_xml_add(node, name, value);
	}
	}
	}

	void
	pcmk__xe_set_props(xmlNodePtr node, ...)
	{
	va_list pairs;
	va_start(pairs, node);
	pcmk__xe_set_propv(node, pairs);
	va_end(pairs);
	}

	int
	pcmk__xe_foreach_child(xmlNode xml, const char child_element_name,
	int (handler)(xmlNode xml, void *userdata),
	void *userdata)
	{
	xmlNode *children = (xml? xml->children : NULL);

	CRM_ASSERT(handler != NULL);

	for (xmlNode *node = children; node != NULL; node = node->next) {
	if (node->type == XML_ELEMENT_NODE &&
	pcmk__str_eq(child_element_name, (const char *) node->name, pcmk__str_null_matches)) {
	int rc = handler(node, userdata);

	if (rc != pcmk_rc_ok) {
	return rc;
	}
	}
	}

	return pcmk_rc_ok;
	}

	// Deprecated functions kept only for backward API compatibility
	// LCOV_EXCL_START

	#include <crm/common/xml_compat.h>

	xmlNode *
	find_entity(xmlNode parent, const char node_name, const char *id)
	{
	return pcmk__xe_match(parent, node_name,
	((id == NULL)? id : XML_ATTR_ID), id);
	}

	void
	crm_destroy_xml(gpointer data)
	{
	free_xml(data);
	}

	// LCOV_EXCL_STOP
	// End deprecated API

File Metadata

Mime Type: text/x-diff
Expires: Sat, Nov 23, 12:16 PM (1 d, 4 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1011306
Default Alt Text: (201 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions