diff --git a/tools/hb2openais.sh.in b/tools/hb2openais.sh.in
index e9da0531d6..8231b38f57 100755
--- a/tools/hb2openais.sh.in
+++ b/tools/hb2openais.sh.in
@@ -1,590 +1,592 @@
 #!/bin/sh
 
  # Copyright (C) 2008 Dejan Muhamedagic <dmuhamedagic@suse.de>
  # 
  # This program is free software; you can redistribute it and/or
  # modify it under the terms of the GNU General Public
  # License as published by the Free Software Foundation; either
  # version 2.1 of the License, or (at your option) any later version.
  # 
  # This software is distributed in the hope that it will be useful,
  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  # General Public License for more details.
  # 
  # You should have received a copy of the GNU General Public
  # License along with this library; if not, write to the Free Software
  # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  #
 
 . @sysconfdir@/ha.d/shellfuncs
 . $HA_NOARCHBIN/utillib.sh
 
 PROG=`basename $0`
 # FIXME: once this is part of the package!
 PROGDIR=`dirname $0`
 echo "$PROGDIR" | grep -qs '^/' || {
 	test -f @sbindir@/$PROG &&
 		PROGDIR=@sbindir@
 	test -f $HA_NOARCHBIN/$PROG &&
 		PROGDIR=$HA_NOARCHBIN
 }
 
 # the default syslog facility is not (yet) exported by heartbeat
 # to shell scripts
 #
 DEFAULT_HA_LOGFACILITY="daemon"
 export DEFAULT_HA_LOGFACILITY
 AIS_CONF=/etc/ais/openais.conf
 AIS_KEYF=/etc/ais/authkey
 
 PY_HELPER=$HA_BIN/hb2openais-helper.py
 CIB=@HA_VARLIBDIR@/heartbeat/crm/cib.xml
 CIBSIG=@HA_VARLIBDIR@/heartbeat/crm/cib.xml.sig
+CIBLAST=@HA_VARLIBDIR@/heartbeat/crm/cib.xml.last
+CIBLAST_SIG=@HA_VARLIBDIR@/heartbeat/crm/cib.xml.sig.last
 HOSTCACHE=@HA_VARLIBDIR@/heartbeat/hostcache
 HB_UUID=@HA_VARLIBDIR@/heartbeat/hb_uuid
 DONE_F=$HA_VARRUN/heartbeat/.$PROG.conv_done
 BACKUPDIR=/var/tmp/`basename $PROG .sh`.backup
 BACKUP_FILES=" $CIB $CIBSIG $HOSTCACHE $HB_UUID $AIS_CONF "
-RM_FILES=" $CIBSIG $HOSTCACHE $HB_UUID "
-REMOTE_RM_FILES=" $CIB $CIBSIG $HOSTCACHE $HB_UUID "
+RM_FILES=" $CIBSIG $HOSTCACHE $HB_UUID $CIBLAST $CIBLAST_SIG"
+REMOTE_RM_FILES=" $CIB $CIBSIG $HOSTCACHE $HB_UUID $CIBLAST $CIBLAST_SIG"
 DIST_FILES=" $AIS_CONF $AIS_KEYF $DONE_F "
 MAN_TARF=/var/tmp/`basename $PROG .sh`.tar.gz
 
 : ${SSH_OPTS="-T"}
 
 usage() {
 	cat<<EOF
 
 usage: $PROG [-u user] [-T directory] [revert]
 
 	-u user: a user to sudo with (otherwise, you'd
 	         have to run this as root)
 	-T directory: a directory containing ha.cf/logd.cf/cib.xml/hostcache
 	         (use for testing); with this option files are not
 	         copied to other nodes and there are no destructive
 	         commands executed; you may run as unprivileged uid
 
 EOF
 	exit
 }
 
 SUDO_USER=""
 MYSUDO=""
 TEST_DIR=""
 while getopts u:T:h o; do
 	case "$o" in
 		h) usage;;
 		u) SUDO_USER="$OPTARG";;
 		T) TEST_DIR="$OPTARG";;
 		[?]) usage;;
 	esac
 done
 shift $(($OPTIND-1))
 [ $# -gt 1 ] && usage
 [ "$TEST_DIR" ] && [ $# -ne 0 ] && usage
 
 if [ "$TEST_DIR" ]; then
 	CIB=$TEST_DIR/cib.xml
 	HOSTCACHE=$TEST_DIR/hostcache
 	HA_CF=$TEST_DIR/ha.cf
 	AIS_CONF=$TEST_DIR/openais.conf
 else
 	ps -ef | grep -wqs crmd &&
 		fatal "you must first stop heartbeat on _all_ nodes"
 fi
 if [ "$SUDO_USER" ]; then
 	MYSUDO="sudo -u $SUDO_USER"
 fi
 
 LOGD_CF=`findlogdcf $TEST_DIR /etc $HA_DIR`
 export LOGD_CF
 
 prerequisites() {
 	test -f $HA_CF ||
 		fatal "$HA_CF does not exist: cannot proceed"
 	iscfvartrue crm || grep -w "^crm" $HA_CF | grep -wqs respawn ||
 		fatal "crm is not enabled: we cannot convert v1 configurations"
 	$DRY test -f $CIB ||
 		fatal "CIB $CIB does not exist: cannot proceed"
 	if [ -f "$DONE_F" ]; then
 		info "Conversion to OpenAIS already done, exiting"
 		exit 0
 	fi
 }
 # some notes about unsupported stuff
 unsupported() {
 	respawned_progs=`awk '/^respawn/{print $3}' $HA_CF |while read p; do basename $p; done`
 	grep -qs "^serial" $HA_CF &&
 		warning "serial media is not supported by OpenAIS"
 	for prog in $respawned_progs; do
 		case $prog in
 		pingd|evmsd) : these two are fine
 			;;
 		*)
 			warning "program $prog is being controlled by heartbeat (thru respawn)"
 			warning "you have to find another way of running it"
 			;;
 		esac
 	done
 }
 #
 # find nodes for this cluster
 #
 getnodes() {
 	# 1. hostcache
 	if [ -f $HOSTCACHE ]; then
 		awk '{print $1}' $HOSTCACHE
 		return
 	fi
 	# 2. ha.cf
 	getcfvar node
 }
 #
 # does ssh work?
 #
 testsshuser() {
 	if [ "$2" ]; then
 		ssh -T -o Batchmode=yes $2@$1 true 2>/dev/null
 	else
 		ssh -T -o Batchmode=yes $1 true 2>/dev/null
 	fi
 }
 findsshuser() {
 	for u in "" $TRY_SSH; do
 		rc=0
 		for n in `getnodes`; do
 			[ "$node" = "$WE" ] && continue
 			testsshuser $n $u || {
 				rc=1
 				break
 			}
 		done
 		if [ $rc -eq 0 ]; then
 			echo $u
 			return 0
 		fi
 	done
 	return 1
 }
 newportinfo() {
 	info "the port number for the multicast is set to 5405"
 	info "please update your firewall rules (if any)"
 }
 changemediainfo() {
 	info "openais uses multicast for communication"
 	info "please make sure that your network infrastructure supports it"
 }
 multicastinfo() {
 	info "multicast for openais ring $1 set to $2:$3"
 }
 netaddrinfo() {
 	info "network address for openais ring $1 set to $2"
 }
 backup_files() {
 	[ "$TEST_DIR" ] && return
 	info "backing up $BACKUP_FILES to $BACKUPDIR"
 	$DRY mkdir $BACKUPDIR || {
 		echo sorry, could not create $BACKUPDIR directory
 		echo please cleanup
 		exit 1
 	}
 	for f in $BACKUP_FILES; do
 		$DRY cp -p $f $BACKUPDIR || {
 			echo sorry, could not copy $f to $BACKUPDIR
 			exit 1
 		}
 	done
 }
 revert() {
 	[ "$TEST_DIR" ] && return
 	test -d $BACKUPDIR || {
 		echo sorry, there is no $BACKUPDIR directory
 		echo cannot revert
 		exit 1
 	}
 	for f in $BACKUP_FILES; do
 		cp -p $BACKUPDIR/`basename $f` $f || {
 			echo sorry, could not copy $BACKUPDIR/`basename $f` to $f
 		}
 	done
 }
 pls_press_enter() {
 	[ "$TEST_DIR" ] && return
 	cat<<EOF
 
 Please press enter to continue or ^C to exit ...
 EOF
 	read junk
 	echo ""
 }
 introduction() {
 	cat<<EOF
 
 This is a Heartbeat to OpenAIS conversion tool.
 
 * IMPORTANT * IMPORTANT * IMPORTANT * IMPORTANT * IMPORTANT *
 
 Please read this and don't proceed before understanding what
 we try to do and what is required.
 
 1. You need to know your cluster in detail. This program will
 inform you on changes it makes. It is up to you to verify
 that the changes are meaningful. We will also probably ask
 some questions now and again.
 
 2. This procedure is supposed to be run on one node only.
 Although the main cluster configuration (the CIB) is
 automatically replicated, there are some things which have to
 be copied by other means. For that to work, we need sshd
 running on all nodes and root access working.
 
 3. Do not run this procedure on more than one node!
 EOF
 	pls_press_enter
 	cat<<EOF
 The procedure consists of two parts: the OpenAIS
 configuration and the Pacemaker/CRM CIB configuration.
 
 The first part is obligatory. The second part may be skipped
 unless your cluster configuration requires changes due to the
 change from Heartbeat to OpenAIS.
 
 We will try to analyze your configuration and let you know
 whether the CIB configuration should be changed as well.
 However, you will still have a choice to skip the CIB
 mangling part in case you want to do that yourself.
 
 The next step is to create the OpenAIS configuration. If you
 want to leave, now is the time to interrupt the program.
 EOF
 	pls_press_enter
 }
 want_to_proceed() {
 	[ "$TEST_DIR" ] && return 0
 	while :; do
 		printf "Do you want to proceed? (y/n) "
 		read ans
 		if echo $ans | grep -iqs '^[yn]'; then
 			echo $ans | grep -iqs '^y'
 			return $?
 		else
 			echo Please answer with y or n
 		fi
 	done
 }
 intro_part2() {
 	cat<<EOF
 
 The second part of the configuration deals with the CIB.
 According to our analysis (you should have seen some
 messages), this step is necessary.
 EOF
 	want_to_proceed || return
 }
 
 gethbmedia() {
 	grep "^[bum]cast" $HA_CF
 }
 pl_ipcalc() {
 perl -e '
 # stolen from internet!
 my $ipaddr=$ARGV[0];
 my $nmask=$ARGV[1];
 my @addrarr=split(/\./,$ipaddr);
 my ( $ipaddress ) = unpack( "N", pack( "C4",@addrarr ) );
 my @maskarr=split(/\./,$nmask);
 my ( $netmask ) = unpack( "N", pack( "C4",@maskarr ) );
 # Calculate network address by logical AND operation of addr &
 # netmask
 # and convert network address to IP address format
 my $netadd = ( $ipaddress & $netmask );
 my @netarr=unpack( "C4", pack( "N",$netadd ) );
 my $netaddress=join(".",@netarr);
 print "$netaddress\n";
 ' $1 $2
 }
 get_if_val() {
 	test "$1" || return
 	awk -v key=$1 '
 	{ for( i=1; i<=NF; i++ )
 		if( match($i,key) ) {
 			sub(key,"",$i);
 			print $i
 			exit
 		}
 	}'
 }
 netaddress() {
 	ip=`ifconfig $1 | grep 'inet addr:' | get_if_val addr:`
 	mask=`ifconfig $1 | grep 'Mask:' | get_if_val Mask:`
 	test "$mask" ||
 		fatal "could not get the network mask for interface $1"
 	pl_ipcalc $ip $mask
 }
 
 sw=0
 do_tabs() {
 	for i in `seq $sw`; do printf "\t"; done
 }
 newstanza() {
 	do_tabs
 	printf "%s {\n" $1
 	let sw=sw+1
 }
 endstanza() {
 	let sw=sw-1
 	do_tabs
 	printf "}\n"
 }
 setvalue() {
 	name=$1
 	val=$2
 	test "$val" || {
 		fatal "sorry, no value set for $name"
 	}
 	do_tabs
 	echo "$name: $val"
 }
 setdebug() {
 	cfdebug=`getcfvar debug` # prefer debuglog if set
 	isnumber $cfdebug || cfdebug=""
 	[ "$cfdebug" ] && [ $cfdebug -gt 0 ] &&
 		echo "on" || echo "off"
 }
 
 prerequisites
 
 if [ "$1" = revert ]; then
 	revert
 	exit
 fi
 
 introduction
 
 backup_files
 
 WE=`uname -n`  # who am i?
 unsupported
 
 # 1. Generate the openais.conf
 
 openaisconf() {
 
 info "Generating $AIS_CONF from $HA_CF ..."
 
 # the totem stanza
 
 cpunum=`grep -c ^processor /proc/cpuinfo`
 newstanza totem
 setvalue threads $cpunum
 setvalue secauth on
 setvalue version 2
 ring=0
 gethbmedia |
 while read media_type iface address rest; do
 	info "Processing interface $iface of type $media_type ..."
 	case "$media_type" in
 		ucast|bcast) mcastaddr=226.94.1.1 ;;
 		mcast) mcastaddr=$address ;;
 	esac
 	mcastport=5405
 	echo `netaddress $iface` $mcastaddr $mcastport
 done | sort -u |
 while read network addr port; do
 	newstanza interface
 	setvalue ringnumber $ring
 	setvalue bindnetaddr $network
 	netaddrinfo $ring $network
 	multicastinfo $ring $addr $port
 	setvalue mcastport $port
 	setvalue mcastaddr $addr
 	let ring=$ring+1
 	endstanza
 done
 changemediainfo
 endstanza
 
 # the logging stanza
 
 getlogvars
 # enforce some syslog facility
 : ${HA_LOGFACILITY=$DEFAULT_HA_LOGFACILITY}
 debugsetting=`setdebug`
 newstanza logging
 setvalue debug $debugsetting
 setvalue fileline off
 setvalue to_stderr no
 setvalue to_file no
 setvalue to_syslog yes
 setvalue syslog_facility $HA_LOGFACILITY
 endstanza
 
 newstanza amf
 setvalue mode disabled
 endstanza
 
 newstanza aisexec
 setvalue user	root
 setvalue group	root
 endstanza
 
 newstanza pacemaker
 setvalue logfacility $HA_LOGFACILITY
 setvalue debug $debugsetting
 endstanza
 }
 
 if [ -z "$DRY" ]; then
 	openaisconf > $AIS_CONF ||
 		fatal "cannot create $AIS_CONF"
 	grep -wqs interface $AIS_CONF ||
 		fatal "no media found in $HA_CF"
 else
 	openaisconf
 fi
 
 if [ "$TEST_DIR" ]; then
 	info "Skipping OpenAIS authentication key generation ..."
 else
 	info "Generating a key for OpenAIS authentication ..."
 	$DRY ais-keygen ||
 		fatal "cannot generate the key using ais-keygen"
 fi
 
 # remove various files which could get in a way
 
 if [ -z "$TEST_DIR" ]; then
 	$DRY rm -f $RM_FILES
 fi
 
 # remove the nodes section from the CIB
 
 tmpfile=`maketempfile`
 $MYSUDO sh -c "python $PY_HELPER zap_nodes <$CIB >$tmpfile" ||
 	fatal "cannot clear the nodes section from the CIB"
 if [ "$TEST_DIR" ]; then
 	mv $tmpfile $TEST_DIR/cib-out.xml
 else
 	$DRY $MYSUDO mv $tmpfile $CIB
 fi
 info "Cleared the nodes section in the CIB"
 
 info "Done converting ha.cf to openais.conf"
 #
 # first part done (openais), on to the CIB
 
 analyze_cib() {
 	info "Analyzing the CIB..."
 	$MYSUDO sh -c "python $PY_HELPER analyze_cib <$CIB"
 }
 
 part2() {
 	intro_part2 || return 0
 	tmpfile=`maketempfile`
 	opts="-c $HA_CF"
 	[ "$TEST_DIR" ] && opts="-T $opts"
 	$MYSUDO sh -c "python $PY_HELPER $opts convert_cib <$CIB >$tmpfile" ||
 		fatal "failed to process the CIB"
 	if [ "$TEST_DIR" ]; then
 		mv $tmpfile $TEST_DIR/cib-out.xml
 	else
 		$DRY $MYSUDO mv $tmpfile $CIB
 	fi
 	info "Processed the CIB successfully"
 }
 dcidle() {
 	try_crmadmin=10
 	dc=""
 	while [ -z "$dc" -a $try_crmadmin -gt 0 ]; do
 		dc=`$MYSUDO crmadmin -D | awk '{print $NF}'`
 		try_crmadmin=$((try_crmadmin-1))
 	done
 
 	if [ x = x"$dc" ]; then
 		echo "sorry, no dc found/elected"
 		exit 1
 	fi
 	maxcnt=60 cnt=0
 	while [ $cnt -lt $maxcnt ]; do
 		stat=`$MYSUDO crmadmin -S $dc`
 		ec=$?
 		echo $stat | grep -qs S_IDLE && break
 		[ "$1" = "-v" ] && echo $stat
 		sleep 1
 		printf "."
 		cnt=$((cnt+1))
 	done
 	echo status: $stat
 	echo waited: $cnt
 	echo $stat | grep -qs S_IDLE
 }
 start_cluster() {
 	$DRY /etc/init.d/openais start
 }
 wait_cluster() {
 	printf "waiting for crm to start."
 	for i in 1 2 3 4 5; do
 		for j in 1 2; do
 			sleep 1; printf "."
 		done
 	done
 	dcidle
 }
 tune_ocfs2() {
 	[ "$TEST_DIR" ] && return
 	cat<<EOF
 The ocfs2 metadata has to change to reflect the cluster stack
 change. To do that, we have to start the cluster stack on
 this node.
 EOF
 	pls_press_enter
 	$DRY start_cluster
 	if $DRY wait_cluster; then
 		info "starting the tunefs.ocfs2"
 		$DRY tunefs.ocfs2 --update-cluster-stack
 	else
 		fatal "could not start pacemaker; please check the logs"
 	fi
 }
 
 analyze_cib
 rc=$?
 [ $rc -gt 1 ] && fatal "error while analyzing CIB"
 if [ $rc -eq 1 ] ||
 	grep -qs "^respawn.*pingd" $HA_CF &&
 		info "a pingd resource has to be created"; then
 	part2
 	if grep -qs '<primitive.*type="ocfs2"' $CIB; then
 		tune_ocfs2
 	fi
 else
 	info "No need to process CIB further"
 fi
 
 [ "$TEST_DIR" ] && exit
 
 $DRY touch $DONE_F
 
 # finally, copy files to all nodes
 info "Copying files to other nodes ..."
 info "(please provide root password if prompted)"
 ssh_opts="-l root $SSH_OPTS"
 rc=0
 for node in `getnodes`; do
 	[ "$node" = "$WE" ] &&
 		continue
 	echo "Copying to node $node ..."
 	(cd / && tar czf - $DIST_FILES) |
 		ssh $ssh_opts $node "$DRY rm -f $REMOTE_RM_FILES &&
 			cd / && $DRY tar xzf -"
 	let rc=$rc+$?
 done
 info "Done transfering files"
 if [ $rc -ne 0 ]; then
 	warning "we could not update some ssh nodes"
 	info "before starting the cluster stack on those nodes:"
 	info "copy and unpack $MAN_TARF (from the / directory)"
 	info "and execute: rm -f $REMOTE_RM_FILES"
 	(cd / && tar czf $MAN_TARF $DIST_FILES)
 fi