Merge lp:~james-page/ubuntu/oneiric/eucalyptus/fix-sslv3-compat into lp:ubuntu/oneiric/eucalyptus

[James Page]

=== added directory '.pc/29-euca_conf-sslv3.patch'
=== added directory '.pc/29-euca_conf-sslv3.patch/tools'
=== added file '.pc/29-euca_conf-sslv3.patch/tools/euca_conf.in'
--- .pc/29-euca_conf-sslv3.patch/tools/euca_conf.in	1970-01-01 00:00:00 +0000
+++ .pc/29-euca_conf-sslv3.patch/tools/euca_conf.in	2011-09-21 09:10:44 +0000
@@ -0,0 +1,1555 @@
+#!/bin/bash
+#Copyright (c) 2009  Eucalyptus Systems, Inc.	
+#
+#This program is free software: you can redistribute it and/or modify
+#it under the terms of the GNU General Public License as published by 
+#the Free Software Foundation, only version 3 of the License.  
+# 
+#This file is distributed in the hope that it will be useful, but WITHOUT
+#ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+#FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+#for more details.  
+#
+#You should have received a copy of the GNU General Public License along
+#with this program.  If not, see <http://www.gnu.org/licenses/>.
+# 
+#Please contact Eucalyptus Systems, Inc., 130 Castilian
+#Dr., Goleta, CA 93101 USA or visit <http://www.eucalyptus.com/licenses/> 
+#if you need additional information or have any questions.
+#
+#This file may incorporate work covered under the following copyright and
+#permission notice:
+#
+#  Software License Agreement (BSD License)
+#
+#  Copyright (c) 2008, Regents of the University of California
+#  
+#
+#  Redistribution and use of this software in source and binary forms, with
+#  or without modification, are permitted provided that the following
+#  conditions are met:
+#
+#    Redistributions of source code must retain the above copyright notice,
+#    this list of conditions and the following disclaimer.
+#
+#    Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+#  IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+#  TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+#  PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
+#  OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+#  EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+#  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+#  PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+#  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+#  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+#  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. USERS OF
+#  THIS SOFTWARE ACKNOWLEDGE THE POSSIBLE PRESENCE OF OTHER OPEN SOURCE
+#  LICENSED MATERIAL, COPYRIGHTED MATERIAL OR PATENTED MATERIAL IN THIS
+#  SOFTWARE, AND IF ANY SUCH MATERIAL IS DISCOVERED THE PARTY DISCOVERING
+#  IT MAY INFORM DR. RICH WOLSKI AT THE UNIVERSITY OF CALIFORNIA, SANTA
+#  BARBARA WHO WILL THEN ASCERTAIN THE MOST APPROPRIATE REMEDY, WHICH IN
+#  THE REGENTS’ DISCRETION MAY INCLUDE, WITHOUT LIMITATION, REPLACEMENT
+#  OF THE CODE SO IDENTIFIED, LICENSING OF THE CODE SO IDENTIFIED, OR
+#  WITHDRAWAL OF THE CODE CAPABILITY TO THE EXTENT NEEDED TO COMPLY WITH
+#  ANY SUCH LICENSES OR RIGHTS.
+#
+#
+#FAKEREG="yes"
+
+FILE="@prefix@/etc/eucalyptus/eucalyptus.local.conf"
+DEFAULTS_FILE="@prefix@/etc/eucalyptus/eucalyptus.conf"
+IMPORTFILE=""
+EUCALYPTUS=""
+CC_PORT=""
+NC_PORT=""
+CLOUD_PORT=""
+CLOUD_SSL_PORT=""
+NAME=""
+INSTANCE=""
+EUCA_USER=""
+HYPERVISOR=""
+DHCPD=""
+DHCP_USER=""
+BRIDGE=""
+NEWNODES=""
+NODEMODE=""
+WALRUS_MODE=""
+SYNC=""
+WALRUS=""
+WALRUS_MODE=""
+CLUSNAME=""
+NEWCLUS=""
+CLUSMODE=""
+UPGRADE_CONF=""
+SETUP=""
+VERSION=""
+CHECK=""
+TOSYNC=""
+TO_BACKUP="Y"
+CREDENTIALZIPFILE=""
+SCP="`which scp 2> /dev/null`"
+SCP_OPT=""
+RSYNC="`which rsync 2> /dev/null`"
+LOCALSYNC="N"
+WGET="`which wget 2> /dev/null`"
+VERBOSE="N"
+LIST=""
+ENABLED=""
+DISABLED=""
+TO_START=""
+
+
+usage () {
+	echo "$0 [options] [<file>]"
+	echo
+	echo "where <file> is the configuration file ($FILE by default)"
+	echo "   --help                           this message"
+	echo "   -d <dir>                         point EUCALYPTUS to <dir>"
+	echo "   --no-rsync                       don't use rsync"
+	echo "   --no-scp                         don't use scp"
+	echo "   --skip-scp-hostcheck             skip scp interactive host keycheck"
+	echo "   --local-sync                     force local key sync"
+	echo "   --get-credentials <zipfile>      download credentials to <zipfile>"
+	echo "   --register-nodes \"host host ...\" add new nodes to EUCALYPTUS"
+	echo "   --discover-nodes                 find and add nodes on local network"
+	echo "   --deregister-nodes \"host host ...\"   remove nodes from EUCALYPTUS"
+	echo "   --register-cluster <clustername> <host> add new cluster to EUCALYPTUS"
+	echo "   --deregister-cluster <clustername>      remove cluster from EUCALYPTUS"
+	echo "   --register-walrus <host>         add walrus to EUCALYPTUS"
+	echo "   --deregister-walrus <host>       remove walrus from EUCALYPTUS"
+	echo "   --register-sc <clustername> <host>      add storage controller"
+	echo "   --deregister-sc <clustername>           remove storage controller from EUCALYPTUS"
+	echo "   --list-walruses                  list registered walrus(es)"
+	echo "   --list-clusters                  list registered CCs"
+	echo "   --list-nodes                     list registered NCs"
+	echo "   --list-scs                       list registered SCs"
+	echo "   --no-sync                        used only with --register-* to skip syncing keys"
+	echo "   --cc-port <port>                 set CC port"
+	echo "   --nc-port <port>                 set NC port"
+	echo "   --instances <path>               set the INSTANCE path"
+#	echo "   --cloud-port <port1> <port2>     set the 2 cloud ports"
+	echo "   --hypervisor <kvm|xen>           set hypervisor to use"
+	echo "   --user <euca_user>               set the user to use"
+	echo "   --dhcpd <dhcpd>                  set the dhcpd binary to <name>"
+	echo "   --dhcp_user <user>               set the username to run dhcpd as"
+	echo "   --name <var>                     returns the value or <name>"
+	echo "   --import-conf <file>             import variables from <file> into $FILE"
+	echo "   --setup                          perform initial setup"
+	echo "   --enable {cloud|walrus|sc}       enable service at next start"
+	echo "   --disable {cloud|walrus|sc}      disable service at next start"
+	echo "   --check {nc|cc|cloud|sc|walrus}  pre-flight checks"
+#	echo "   --sync {nc|cc|cloud|sc|walrus}   pre-flight checks"
+	echo "   --version                        eucalyptus version"
+	echo
+}
+
+# utility function to make a copy of the conf file
+check_and_backup () {
+	# can we write to the configuration file?
+	if [ ! -w $1 ]; then
+		echo "Cannot write to $1!"
+		exit 1
+	fi
+
+	# let's see if we need a copy
+	if [ "$TO_BACKUP" = "Y" ]; then
+		cp $1 $1.bak
+		TO_BACKUP="N"
+	fi
+}
+
+# 3 paramenter: the file, the variable name, the new value
+change_var_value () {
+	check_and_backup $1
+	sed -i "s<^[[:blank:]#]*\(${2}\).*<\1=\"${3}\"<" $1
+}
+# comment lines matching $2 ($1 is the file)
+comment () {
+	check_and_backup $1
+	sed -i "s<^[[:blank:]]*\(${2}.*\)<#\1<" $1
+}
+# comment lines matching $2 ($1 is the file)
+uncomment () {
+	check_and_backup $1
+	sed -i "s<^[#[:blank:]]*\(${2}.*\)<\1<" $1
+}
+
+check_heartbeat() {
+	local __host="$1"
+	local __service="$2"
+	local ret=""
+
+	# checks
+	if [ -z "$__host" -o -z "$__service" ]; then
+		echo "check_heartbeat: need a host and a service!"
+		return 1
+	fi
+	if [ -z "$WGET" -o ! -x "$WGET" ]; then
+		echo "ERROR: wget is missing, cannot continue."
+		return 1
+	fi
+
+	# let's talk to the host and check if something is running
+	ret="`$WGET -q -T 10 -t 1 -O - http://${__host}:8773/services/Heartbeat`"
+	if [ "$?" != "0" -o -z "$ret" ]; then
+		return 1
+	fi
+
+	# we need both ehabled and local to be true
+	if ! echo $ret |grep "enabled=true" > /dev/null  ; then
+		return 1
+	elif ! echo $ret |grep "local=true"  > /dev/null ; then
+		return 1
+	fi
+
+	return 0
+}
+
+check_ws() {
+	local URL="$1"
+	local ret=""
+	local soap_error=""
+
+	if [ -z "$URL" ]; then
+		echo "check_ws: need a URL!"
+		return 1
+	fi
+	
+	if [ -n "${FAKEREG}" ]; then
+		ret=""
+	elif [ "$2" != "" ]; then
+		if [ "$VERBOSE" = "Y" ]; then
+			echo   "$WGET -q -T 10 -t 1 -O - \"$URL\"" "|sed 's/<euca:registered>\\(.*\\)<\\/euca:registered>/\\n\\1\\n/g;s/<euca:name>/\\n>/g;s/<\\/*euca:item>//g;s/<\\/*euca:[^>]*>/ /g'|awk -F\">\" '/>/{print \"   \"$2}')"
+		fi
+		E=$($WGET -q -T 10 -t 1 -O - "$URL"|\
+			sed 's/<euca:registered>\(.*\)<\/euca:registered>/\n\1\n/g;s/<euca:name>/\n>/g;s/<\/*euca:item>//g;s/<\/*euca:[^>]*>/ /g'|\
+			awk -F">" '/>/{print "   "$2}')
+		eval "$2=\"${E}\""
+	else
+		if [ "$VERBOSE" = "Y" ]; then
+			echo "$WGET -q -T 10 -t 1 -O - \"$URL\" |grep faultstring | sed 's:.*<faultstring>\(.*\)</faultstring>.*:\1:'"
+		fi
+		soap_error="`$WGET -q -T 10 -t 1 -O - \"$URL\"`"
+		ret="$?"
+		soap_error="`echo $soap_error |grep faultstring | sed 's:.*<faultstring>\(.*\)</faultstring>.*:\1:'`"
+		if test -n "$soap_error" ; then
+			echo $soap_error
+			ret="1"
+		fi
+	fi
+	return $ret
+}
+
+component_sync_keys() {
+    local COMPONENT=""
+    local NAME=""
+    
+    if [ "$SYNC" = "N" ]; then
+	return 0
+    fi
+    
+    if [ $# -lt 1 ]; then
+	return 1
+    fi
+    
+    COMPONENT="$1"
+    shift
+    NAME="$2"
+    shift
+
+    if [ "$COMPONENT" = "walrus" ]; then
+	echo "syncing walrus"
+    elif [ "$COMPONENT" = "cc" ]; then
+	echo "syncing cc($NAME)"
+    elif [ "$COMPONENT" = "sc" ]; then
+	echo "syncing sc($NAME)"
+    elif [ "$COMPONENT" = "nc" ]; then
+	echo "syncing nc"
+    fi
+
+
+}
+
+# copy files over.
+sync_keys() {
+	local DESTDIR=""
+	local REMOTE=""
+	local FILES=""
+	local FILE=""
+
+	if [ "$SYNC" = "N" ]; then
+	    return 0
+	fi
+
+	if [ $# -lt 4 ]; then
+		return 1
+	fi
+
+	SOURCEDIRS="$1"
+	shift
+	DESTDIR="$1"
+	shift
+	REMOTE="$1"
+	shift
+	while [ $# -ge 1 ]; do 
+	    FILE=""
+	    for sd in `echo $SOURCEDIRS | sed "s/,/ /g"`
+	    do
+		if [ -e "${sd}/${1}" ]; then
+		    FILE="${sd}/${1}"
+		fi
+	    done
+	    if [ "$FILE" = "" ]; then
+		echo "Warning: cannot file file ${1} in ${SOURCEDIRS}"
+	    else
+		FILES="$FILES $FILE"
+	    fi
+
+	    shift
+	done
+
+	# is REMOTE actually localhost?
+	if [ ${LOCALSYNC} = "Y" -o ${REMOTE} = "127.0.0.1" -o ${REMOTE} = localhost -o ${REMOTE} = "`hostname -s`" -o ${REMOTE} = "`hostname -f`" ]; then
+	    # machine is localhost, not need for remote syncing
+	    for i in $FILES
+	    do
+		if [ ! -e $i ]; then
+		    echo "ERROR: cannot find cluster credentials."
+		    exit 1
+		else
+		    if ! $RSYNC -a $i $DESTDIR ; then
+			echo "ERROR: cannot copy file (${i}) to destination (${DESTDIR})"
+			return 1
+		    fi
+		fi
+	    done
+	    return 0
+	fi
+
+	# try rsync first 
+	if [ -n "$RSYNC" ]; then
+	    echo
+	    echo  -n "Trying rsync to sync keys with \"${REMOTE}\"..."
+	    [ -z "${RSYNC_RSH}" ] && RSYNC_RSH="ssh"
+	    if sudo -u ${EUCA_USER} ${RSYNC} --rsh "${RSYNC_RSH}" -az ${FILES} ${EUCA_USER}@${REMOTE}:${DESTDIR}/ > /dev/null ; then
+		echo "done."
+		return 0
+	    else
+		echo "failed."
+	    fi
+	fi
+
+	# scp next
+	if [ -n "$SCP" ]; then
+	    echo
+	    if [ "$EUCA_USER" = "" ]; then
+		if getent passwd eucalyptus > /dev/null ; then
+		    echo "Using 'eucalyptus' as EUCA_USER"
+		    EUCA_USER="eucalyptus"
+		else
+		    echo "EUCA_USER is not defined!"
+		    return 1
+		fi
+	    fi
+	    echo
+	    echo "Trying scp to sync keys to: ${EUCA_USER}@${REMOTE}:${DESTDIR}..."
+	    if [ "$EUID" = `getent passwd $EUCA_USER | cut -f3 -d:` ]; then
+                $SCP $SCP_OPT ${FILES} ${EUCA_USER}@${REMOTE}:${DESTDIR} > /dev/null
+            else
+	        sudo -u ${EUCA_USER} $SCP $SCP_OPT ${FILES} ${EUCA_USER}@${REMOTE}:${DESTDIR} > /dev/null
+            fi
+            if [ "$?" = "0" ]; then
+		echo "done."
+		return 0
+	    else
+		echo "failed."
+	    fi
+	fi
+	
+	return 1
+}
+
+xsearch() {
+	local needle="$1" i="" haystack=" "
+	shift
+	for i in "$@"; do
+		haystack="${haystack}$(printf "%s" "$i" | tr '\n' ' ') "
+	done
+	[ "${haystack#* ${needle} }" != "${haystack}" ]
+}
+
+if [ $# -eq 0 ]; then
+	usage
+	exit 1
+fi
+
+# let's parse the command line
+while [ $# -gt 0 ]; do
+	if [ "$1" = "-h" -o "$1" = "-help" -o "$1" = "?" -o "$1" = "--help" ]; then
+		usage
+		exit 1
+	fi
+
+	if [ "$1" = "-synckeys" -o "$1" = "-synckey" ]; then 
+	    NODEMODE="SYNC"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "-norsync" -o "$1" = "--no-rsync" ]; then 
+	    RSYNC=""
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--local-sync" ]; then
+	    LOCALSYNC="Y"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--list-scs" ]; then 
+	    LIST="$LIST storages"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--list-walruses" ]; then 
+	    LIST="$LIST walruses"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--list-clusters" ]; then 
+	    LIST="$LIST clusters"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--list-nodes" ]; then 
+	    LIST="$LIST nodes"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--verbose" ]; then 
+	    VERBOSE="Y"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "-noscp" -o "$1" = "--no-scp" ]; then 
+	    SCP=""
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--skip-scp-hostcheck" ]; then 
+	    SCP_OPT="-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "-version" -o "$1" = "--version" ]; then 
+	    VERSION="Y"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "-setup" -o "$1" = "--setup" ]; then 
+	    SETUP="Y"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--no-sync" ]; then 
+	    SYNC="N"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--deregister-walrus" ]; then
+	    WALRUS_MODE="DEL"
+	    shift
+	    continue
+	fi
+	if [ "$1" = "--discover-nodes" ]; then
+	    NODEMODE="DISCOVER"
+	    RSYNC_RSH="ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null"
+	    shift
+	    continue
+	fi
+	if [ $# -eq 1 ]; then
+		# we dont have options with no argument, so it has to be
+		# the file
+		FILE="$1"
+		if [ "${FILE:0:1}" = '-' ]; then
+			usage
+			exit 1
+		fi
+		break
+	fi
+
+	# all other parameters requires at least 1 argument
+	if [ $# -lt 2 ]; then
+		usage
+		exit 1
+	fi
+
+	# old command line options not used anylonger
+	if [ "$1" = "-cc" -o "$1" = "-nc" -o "$1" = "-cloud" ]; then
+		echo "-cc, -nc and -cloud are not used anymore"
+		shift; shift;
+		continue
+	fi
+
+	if [ "$1" = "-d" ]; then
+		if [ ! -d "${2}" ]; then
+			echo "Is $2 where Eucalyptus is installed?"
+			exit 1
+		fi
+		EUCALYPTUS="${2}"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-name" -o "$1" = "--name" ]; then
+		NAME="$NAME $2"
+		shift; shift
+		continue
+	fi		
+	if [ "$1" = "-bridge" ]; then
+		BRIDGE="$2"
+		shift; shift
+		continue
+	fi		
+	if [ "$1" = "-upgrade-conf" -o "$1" = "--upgrade-conf" ]; then
+		# hidden options to upgrade from an older version
+		UPGRADE_CONF="$2"
+		if [ ! -e "$UPGRADE_CONF" ]; then
+			echo "Cannot read $UPGRADE_CONF"
+			exit 1
+		fi
+		shift; shift
+		continue
+	fi		
+	if [ "$1" = "-import-conf" -o "$1" = "--import-conf" ]; then
+	        IMPORTFILE="$2"
+		if [ ! -e "$IMPORTFILE" ]; then
+			echo "Cannot read $IMPORTFILE"
+			exit 1
+		fi
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-dhcpd" -o "$1" = "--dhcpd" ]; then
+		DHCPD="$2"
+		shift; shift
+		continue
+	fi		
+	if [ "$1" = "-dhcp_user" -o "$1" = "--dhcp_user" ]; then
+		DHCPC_USER="$2"
+		shift; shift
+		continue
+	fi		
+	if [ "$1" = "-nodes" ]; then
+		NODES="${2}"
+		shift; shift
+		continue
+	fi		
+	if [ "$1" = "-ccp" -o "$1" = "--cc-port" ]; then
+		CC_PORT="$2"
+		shift; shift
+		continue
+	fi		
+	if [ "$1" = "-ncp" -o "$1" = "--nc-port" ]; then
+		NC_PORT="$2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-instances" -o "$1" = "--instances" ]; then
+		INSTANCE="$2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-user" -o "$1" = "--user" ]; then
+		EUCA_USER="$2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-hypervisor" -o "$1" = "--hypervisor" ]; then
+		if [ "$2" != "xen" -a "$2" != "kvm" ]; then
+			echo "Only kvm or xen are supported at the moment"
+			exit 1
+		fi
+		HYPERVISOR="$2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-cloudp" ]; then
+		if [ $# -lt 3 ]; then
+			echo "We need 2 ports for cloud controller"
+			exit 1
+		fi
+# doesn't work right now
+#		CLOUD_PORT="$2"
+#		CLOUD_SSL_PORT="$3"
+		shift; shift; shift
+		continue
+	fi
+	if [ "$1" = "--get-credentials" ]; then
+	        CREDENTIALZIPFILE="${2}"
+		shift; shift;
+		continue
+	fi
+	if [ "$1" = "-addnode" -o "$1" = "--register-nodes" ]; then 
+		NEWNODES="${2}"
+		NODEMODE="ADD"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-delnode" -o "$1" = "--deregister-nodes" ]; then 
+		NEWNODES="${2}"
+		NODEMODE="REM"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "--register-walrus" ]; then
+		WALRUS_MODE="ADD"
+		WALRUS="$2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "--deregister-sc" ]; then
+		SC_MODE="DEL"
+		SCNAME="$2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "--register-sc" ]; then
+		if [ $# -lt 3 ]; then
+			echo "--register-sc requires a CC and a hostname"
+			exit 1
+		fi
+		SC_MODE="ADD"
+		SCNAME="$2"
+		SCHOST="$3"
+		shift; shift; shift
+		continue
+	fi
+	if [ "$1" = "-addcluster" -o "$1" = "--register-cluster" ]; then
+		if [ $# -lt 3 ]; then
+			echo "--register-cluster requires a user assigned name and CC hostname"
+			exit 1
+		fi
+		CLUSNAME="$2"
+		NEWCLUS="$3"
+		CLUSMODE="ADD"
+		shift; shift; shift
+		continue
+	fi
+	if [ "$1" = "--deregister-cluster" ]; then
+		CLUSNAME="$2"
+		CLUSMODE="DEL"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-check" -o "$1" = "--check" ]; then 
+		if [ "$2" != "cc" -a "$2" != "cloud" -a "$2" != "nc" -a "$2" != "sc" -a "$2" != "walrus" ]; then
+			echo "-check requires cc, nc, sc, walrus or cloud"
+			exit 1
+		fi
+		CHECK="$2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "--enable" ]; then 
+		if [ "$2" != "cloud" -a "$2" != "sc" -a "$2" != "walrus" ]; then
+			echo "--enable requires cloud, sc or walrus"
+			exit 1
+		fi
+		ENABLED="$ENABLED $2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "--disable" ]; then 
+		if [ "$2" != "cloud" -a "$2" != "sc" -a "$2" != "walrus" ]; then
+			echo "--disable requires cloud, sc or walrus"
+			exit 1
+		fi
+		DISABLED="$DISABLED $2"
+		shift; shift
+		continue
+	fi
+	if [ "$1" = "-sync" -o "$1" = "--sync" ]; then 
+		if [ "$2" != "cc" -a "$2" != "cloud" -a "$2" != "nc" -a "$2" != "sc" -a "$2" != "walrus" ]; then
+			echo "-sync requires cc, nc, sc, walrus or cloud"
+			exit 1
+		fi
+		TOSYNC="$2"
+		shift; shift
+		continue
+	fi
+	usage 
+	exit 1
+done
+
+if [ -z "${FILE}" -o ! -f "${FILE}" ]; then
+	echo "$FILE is not a valid eucalyptus configuration file"
+	exit  1
+fi
+
+# if asked to print the version that's all we do
+if [ "$VERSION" = "Y" ]; then
+	. $DEFAULTS_FILE
+	. $FILE
+
+	if [ -e $EUCALYPTUS/etc/eucalyptus/eucalyptus-version ]; then
+		VERSION="$EUCALYPTUS/etc/eucalyptus/eucalyptus-version"
+	elif [ -e @prefix@/etc/eucalyptus/eucalyptus-version ]; then
+		VERSION="@prefix@/etc/eucalyptus/eucalyptus-version"
+	fi
+	if [ -n "$VERSION" ]; then
+		echo -n "Eucalyptus version: "
+		cat $VERSION 
+	else
+		echo "Cannot find eucalyptus installation!"
+		exit 1
+	fi
+	exit 0
+fi
+
+# let's change the value
+if [ -n "$EUCALYPTUS" ]; then
+	change_var_value $FILE EUCALYPTUS "${EUCALYPTUS}"
+fi
+if [ -n "$CC_PORT" ]; then
+	change_var_value $FILE CC_PORT "${CC_PORT}"
+fi
+if [ -n "$NC_PORT" ]; then
+	change_var_value $FILE NC_PORT "${NC_PORT}"
+fi
+if [ -n "$CLOUD_PORT" ]; then
+	change_var_value $FILE CLOUD_PORT "${CLOUD_PORT}"
+fi
+if [ -n "$CLOUD_SSL_PORT" ]; then
+	change_var_value $FILE CLOUD_SSL_PORT "${CLOUD_SSL_PORT}"
+fi
+if [ -n "$INSTANCE" ]; then
+	change_var_value $FILE INSTANCE_PATH "${INSTANCE}"
+fi
+if [ -n "$DHCPD" ]; then
+	change_var_value $FILE VNET_DHCPDAEMON "${DHCPD}"
+fi
+if [ -n "$DHCPC_USER" ]; then
+	change_var_value $FILE VNET_DHCPUSER "${DHCPC_USER}"
+	uncomment $FILE VNET_DHCPUSER
+fi
+if [ -n "$NODES" ]; then
+	change_var_value $FILE NODES "${NODES}"
+fi
+if [ -n "$HYPERVISOR" ]; then
+	change_var_value $FILE HYPERVISOR "${HYPERVISOR}"
+	uncomment $FILE HYPERVISOR
+fi
+if [ -n "$BRIDGE" ]; then
+	change_var_value $FILE VNET_BRIDGE "${BRIDGE}"
+	uncomment $FILE VNET_BRIDGE
+fi
+if [ -n "$EUCA_USER" ]; then
+	ID="`which id 2> /dev/null`"
+	if [ -n "$ID" ]; then
+		if ! $ID $EUCA_USER > /dev/null 2> /dev/null ; then
+			echo "WARNING: $EUCA_USER doesn't exists!"
+		fi
+	fi
+	change_var_value $FILE EUCA_USER "${EUCA_USER}"
+fi
+for x in $NAME ; do
+	VALUE=`cat $FILE |grep $x|cut -f 2 -d =|tr  '"' ' '`
+	echo "$x=$VALUE"
+done
+
+# modify the current conf file based on an older configuration, or from import file
+if [ -n "$UPGRADE_CONF" -o -n "$IMPORTFILE" ]; then
+	VARS="EUCA_USER ENABLE_WS_SECURITY DISABLE_EBS HYPERVISOR LOGLEVEL SWAP_SIZE CC_PORT MANUAL_INSTANCES_CLEANUP NC_CACHE_SIZE SCHEDPOLICY NODES NC_SERVICE NC_PORT MAX_MEM MAX_CORES INSTANCE_PATH VNET_BRIDGE VNET_DHCPDAEMON VNET_DHCPUSER VNET_PRIVINTERFACE VNET_PUBINTERFACE VNET_INTERFACE DISABLE_TUNNELING DISABLE_DNS POWER_IDLETHRESH POWER_WAKETHRESH CONCURRENT_DISK_OPS"
+	VNET_VARS="VNET_MODE VNET_SUBNET VNET_NETMASK VNET_DNS VNET_ADDRSPERNET VNET_PUBLICIPS VNET_BROADCAST VNET_ROUTER VNET_MACMAP VNET_CLOUDIP VNET_LOCALIP"
+	
+	if [ -n "$UPGRADE_CONF" ]; then
+	# source the old config
+	    VARS_TO_DO=$VARS
+	    VNET_VARS_TO_DO=$VNET_VARS
+	    . $UPGRADE_CONF
+	elif [ -n "$IMPORTFILE" ]; then
+	    VARS_TO_DO=""
+	    VNET_VARS_TO_DO=""
+	    . $IMPORTFILE
+	    for i in $VNET_VARS
+	    do
+		VAL="$(echo \$${i})"
+		eval VAL=$VAL
+		if [ -n "$VAL" ]; then
+		    VNET_VARS_TO_DO="$VNET_VARS_TO_DO $i"
+		fi
+	    done
+	fi
+
+	# let's start from no network
+	for x in $VNET_VARS_TO_DO ; do
+	    comment $FILE $x
+	done
+	
+	# modified the defined variables
+	for x in $VARS_TO_DO ; do
+	    y="$(echo \$${x})"
+	    eval y="$y"
+	    if [ -z "$y" ]; then
+			# we just leave NODES uncommented even if it's empty
+		    if [ "$x" != "NODES" ]; then
+			comment $FILE $x
+		    fi
+	    else
+		uncomment $FILE $x
+		change_var_value $FILE $x "${y}"
+	    fi
+	done
+	# and add the network variables
+	echo >> $FILE
+	echo "# network configuration from the input configuration file" >> $FILE
+	for x in $VNET_VARS_TO_DO ; do
+	    y="$(echo \$${x})"
+	    eval y="$y"
+	    if [ -n "$y" ]; then
+		if [ "$x" = "VNET_INTERFACE" ]; then
+			change_var_value $FILE VNET_PRIVINTERFACE "${y}"
+			change_var_value $FILE VNET_PUBINTERFACE "${y}"
+		else
+			echo "$x=\"${y}\"" >> $FILE
+		fi
+	    fi
+	done
+fi
+
+# we may need the location of the ssh key for eucalyptus
+EUCA_HOME="`getent passwd eucalyptus|cut -f 6 -d ':'`"
+if [ -f "${EUCA_HOME}/.ssh/id_rsa.pub" ]; then
+	SSHKEY=`cat ${EUCA_HOME}/.ssh/id_rsa.pub`
+else
+	SSHKEY=""
+fi
+
+# we need defaults in eucalyptus.conf
+. $DEFAULTS_FILE
+. $FILE
+# get node from nodes.list if it exists
+if [ -e "$EUCALYPTUS/var/lib/eucalyptus/nodes.list" ]; then
+    NODES=`cat $EUCALYPTUS/var/lib/eucalyptus/nodes.list`
+fi
+
+# first time setup
+if [ -n "$SETUP" ]; then
+	ROOTWRAP="$EUCALYPTUS/usr/lib/eucalyptus/euca_rootwrap"
+	
+	# first of all setup euca_rootwrap
+	if [ ! -x "$ROOTWRAP" ]; then
+		echo "Cannot find $ROOTWRAP (or not readable)!"
+		exit 1
+	fi
+	# get EUCA group
+	if [ -z "$EUCA_USER" ]; then
+		echo "Is EUCA_USER defined?"
+		exit 1
+	fi
+	# if running as root no need to do anything
+	if [ "$EUCA_USER" != "root" ]; then
+		ID="`which id 2> /dev/null`"
+		if [ -z "$ID" ]; then
+			echo "Cannot find command $ID"
+			exit 1
+		fi
+		if ! $ID $EUCA_USER > /dev/null 2> /dev/null ; then
+			echo "User $EUCA_USER doesn't exists!"
+			exit 1
+		fi
+		EUCA_GROUP="`$ID -ng $EUCA_USER 2>/dev/null`"
+		if [ -z "$EUCA_GROUP" ]; then
+			echo "Cannot detect $EUCA_USER group"
+			exit 1
+		fi
+		if ! chown root:$EUCA_GROUP $ROOTWRAP ; then
+			exit 1
+		fi
+		if ! chmod 4750 $ROOTWRAP ; then
+			exit 1
+		fi
+	fi
+	
+	# let's create the instance path
+	if [ -n "$INSTANCE_PATH" -a "$INSTANCE_PATH" != "not_configured" -a ! -d "$INSTANCE_PATH" ]; then
+		if ! mkdir -p $INSTANCE_PATH ; then
+			echo "Failed to create instance path!"
+			exit 1
+		fi
+		if ! chown $EUCA_USER:$EUCA_GROUP $INSTANCE_PATH ; then
+			exit 1
+		fi
+	fi
+
+	chown -R $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/lib/eucalyptus
+	ret=$?
+	chown -R $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/log/eucalyptus
+	let $((ret += $?))
+	chown -R $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/run/eucalyptus
+	let $((ret += $?))
+	chown $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/etc/eucalyptus/eucalyptus.conf
+	let $((ret += $?))
+
+	# let's create more needed directory with the right permissions
+	mkdir -p $EUCALYPTUS/var/lib/eucalyptus/db
+	let $((ret += $?))
+	chown $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/lib/eucalyptus/db
+	let $((ret += $?))
+	chmod 700 $EUCALYPTUS/var/lib/eucalyptus/db
+	let $((ret += $?))
+	mkdir -p $EUCALYPTUS/var/lib/eucalyptus/keys
+	let $((ret += $?))
+	chown $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/lib/eucalyptus/keys
+	let $((ret += $?))
+	chmod 700 $EUCALYPTUS/var/lib/eucalyptus/keys
+	let $((ret += $?))
+	mkdir -p $EUCALYPTUS/var/lib/eucalyptus/CC
+	let $((ret += $?))
+	chown $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/lib/eucalyptus/CC
+	let $((ret += $?))
+	chmod 700 $EUCALYPTUS/var/lib/eucalyptus/CC
+	let $((ret += $?))
+
+	exit $ret
+fi
+
+if [ -n "$TOSYNC" ]; then
+    echo "not implemented"
+fi
+
+# pre-flight checks
+if [ -n "$CHECK" ]; then
+	ROOTWRAP="$EUCALYPTUS/usr/lib/eucalyptus/euca_rootwrap"
+
+	# vblade and aoe may be needed
+	if [ "$DISABLE_EBS" != "Y" -a "$DISABLE_EBS" != "y" ]; then
+		if [ "$CHECK" = "sc" ]; then
+			VBLADE="`which vblade 2> /dev/null`"
+			if [ -z "$VBLADE" ]; then
+				echo
+				echo "ERROR: EBS is enabled and vblade was not found"
+				exit 1
+			fi
+		fi
+	fi
+	
+	# first of all check euca_rootwrap
+	if [ ! -x $ROOTWRAP ]; then
+		echo "Cannot find euca_rootwrap!"
+		exit 1
+	fi
+	# get EUCA group
+	if [ -z "$EUCA_USER" ]; then
+		echo "Running eucalyptus as root"
+		EUCA_USER="root"
+		EUCA_GROUP="root"
+	fi
+	# if running as root no need to do anything
+	if [ "$EUCA_USER" != "root" ]; then
+		ID="`which id 2> /dev/null`"
+		if [ -z "$ID" ]; then
+			echo "Cannot find command id"
+			exit 1
+		fi
+		if ! $ID $EUCA_USER > /dev/null 2> /dev/null ; then
+			echo "User $EUCA_USER doesn't exists!"
+			exit 1
+		fi
+		EUCA_GROUP="`$ID -ng $EUCA_USER 2>/dev/null`"
+		if [ -z "$EUCA_GROUP" ]; then
+			echo "Cannot detect $EUCA_USER group: using $EUCA_USER"
+			exit 1
+		fi
+		# need to check if euca_rootwrap can run as EUCA_USER
+                TEST_EUID="`sudo -u $EUCA_USER $ROOTWRAP $ID -u`"
+		if [ "$?" != "0" -o "$TEST_EUID" != "0" ]; then
+			echo "Problem running $ROOTWRAP! Did you run euca_conf -setup?"
+			exit 1
+		fi
+	fi
+
+	# let's be sure we have the INSTANCE_PATH
+	if [ "$CHECK" = "nc" ]; then
+		if [ -z "$INSTANCE_PATH" ]; then
+			echo "INSTANCE_PATH is not defined"
+			exit 1
+		fi
+		if [ ! -d "$INSTANCE_PATH" ]; then
+			echo "$INSTANCE_PATH doesn't exist: did you run euca_conf -setup?"
+			exit 1
+		fi
+	fi
+
+	# let's set up directories which could disappears if /var/run is
+	# in memory
+	if [ ! -d $EUCALYPTUS/var/run/eucalyptus ]; then
+		if ! mkdir -p $EUCALYPTUS/var/run/eucalyptus ; then
+			# error should come from mkdir
+			exit 1
+		fi
+	fi
+	if ! chown $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/run/eucalyptus ; then
+	    # error should come from chown
+	    exit 1
+	fi
+
+
+	if [ "$CHECK" = "cc" ]; then
+	    if [ ! -d $EUCALYPTUS/var/run/eucalyptus/net ]; then
+		if ! mkdir -p $EUCALYPTUS/var/run/eucalyptus/net ; then
+			# error should come from mkdir
+		    exit 1
+		fi
+	    fi
+	    if ! chown $EUCA_USER:$EUCA_GROUP $EUCALYPTUS/var/run/eucalyptus/net ; then
+			# error should come from chown
+		exit 1
+	    fi
+	fi
+	# good to go
+	exit 0
+fi
+
+createCloudURL () {
+    if ! getSecretKey; then
+	echo "ERROR: cannot get credentials"
+	return 1
+    fi
+    ARGS="AWSAccessKeyId=$AKEY"
+    KEY=$1
+    shift
+    VAL=$1
+    shift
+    while ( test -n "$KEY" -a -n "$VAL")
+    do
+	ARGS="${ARGS}&${KEY}=${VAL}"
+	KEY=$1
+	shift
+	VAL=$1
+	shift
+    done
+    if [ -z "$SKEY" ]; then
+	echo "ERROR: SKEY parameter is not set."
+	export URL=""
+	return 1
+    fi
+    ARGS="${ARGS}&SignatureMethod=HmacSHA256&SignatureVersion=2&Timestamp=$(date -u '+%Y-%m-%dT%H%%3A%M%%3A%S.000Z')&Version=eucalyptus"
+    SIGNATURE=$(echo -en "GET\n127.0.0.1\n/services/Configuration\n${ARGS}" | openssl dgst -sha256 -hmac ${SKEY} -binary | openssl base64)
+    export URL="http://127.0.0.1:8773/services/Configuration?${ARGS}&Signature=${SIGNATURE}"
+	if [ "$VERBOSE" = "Y" ]; then
+		echo $URL
+	fi
+    return 0
+}
+
+getSecretKey() {
+    if [ -d "$EUCALYPTUS/var/lib/eucalyptus/db/" ]; then
+	DBDIR="$EUCALYPTUS/var/lib/eucalyptus/db/"
+    else
+	echo "ERROR: cannot locate eucalyptus database, try logging in through the admin web interface."
+	exit 1
+    fi
+
+    FIELD=`grep -i "CREATE .*TABLE AUTH_USERS" ${DBDIR}/*auth* | sed 's/,/\n/g' | awk '/[Aa][Uu][Tt][Hh]_[Uu][Ss][Ee][Rr]_[Ss][Ee][Cc][Rr][Ee][Tt][Kk][Ee][Yy]/ {print NR}'`
+    if [ "$FIELD" = "" ]; then
+	echo "ERROR: cannot locate entry in eucalyptus database, try logging in through the admin web interface"
+	export SKEY=""
+	return 1
+    fi
+    SKEY=$(eval echo $(awk -v field=${FIELD} -F, '/INSERT INTO AUTH_USERS.*admin/ {print $field}' ${DBDIR}/*auth* | head -n 1 | sed 's/[()]//g'))
+
+   FIELD=`grep -i "CREATE .*TABLE AUTH_USERS" ${DBDIR}/*auth* | sed 's/,/\n/g' | awk '/[Aa][Uu][Tt][Hh]_[Uu][Ss][Ee][Rr]_[Qq][Uu][Ee][Rr][Yy]_[Ii][Dd]/ {print NR}'`
+   if [ "$FIELD" = "" ]; then
+     echo "ERROR: cannot locate entry in eucalyptus database, try logging in through the admin web interface"
+     export AKEY=""
+     return 1
+   fi
+   AKEY=$(eval echo $(awk -v field=${FIELD} -F, '/INSERT INTO AUTH_USERS.*admin/ {print $field}' ${DBDIR}/*auth* | head -n 1 | sed 's/[()]//g'))
+
+    return 0
+}
+
+checkLocalService() {
+    local SERVICE=""
+    
+    if [ -z "$WGET" -o ! -x "$WGET" ]; then
+	echo "ERROR: wget is missing, cannot continue."
+	return 1
+    fi
+
+    SERVICE="$1"
+    if [ -z "$SERVICE" ]; then
+	echo "ERROR: must pass in service name (CLC, CC)"
+	return 1
+    elif [ "$SERVICE" = "CLC" ]; then
+	if [ -n "$FAKEREG" ]; then
+	    local SOURCEDIR="$EUCALYPTUS/var/lib/eucalyptus/keys/"
+	    for i in cloud
+	    do 
+		if [ ! -e "$SOURCEDIR/${i}-cert.pem" -o ! -e "$SOURCEDIR/${i}-pk.pem" ]; then
+		    openssl req -new -nodes -x509 -out $SOURCEDIR/${i}-cert.pem -keyout $SOURCEDIR/${i}-pk.pem -days 365 -subj "/C=US/ST=CA/L=City/CN=localhost/emailAddress=root@localhost"
+		fi
+	    done
+	fi
+	
+	CMD="$WGET -T 10 -t 1 -O - -q --no-check-certificate https://127.0.0.1:8443/register | grep CloudVersion >/dev/null"
+    elif [ "$SERVICE" = "CC" ]; then
+	CMD="$WGET -T 10 -t 1 -O - -q http://127.0.0.1:8774/axis2/services/ | grep EucalyptusCC >/dev/null"
+    fi
+    
+    if [ -n "${FAKEREG}" ]; then
+	CMD="echo"
+    fi
+    if ! eval $CMD ; then
+	echo "ERROR: you need to be on the $SERVICE host and the $SERVICE needs to be running."
+	return 1
+    fi  
+    return 0
+}
+
+if [ -n "$CREDENTIALZIPFILE" ]; then
+    if [ -f "$CREDENTIALZIPFILE" ]; then
+	echo "file '$CREDENTIALZIPFILE' already exists, please remove and try again"
+	exit 1
+    fi
+    if ! checkLocalService "CLC" ; then
+	exit 1
+    fi
+
+    if [ -d "$EUCALYPTUS/var/lib/eucalyptus/db/" ]; then
+	DBDIR="$EUCALYPTUS/var/lib/eucalyptus/db/"
+    else
+	echo "ERROR: cannot locate eucalyptus database, try logging in through the admin web interface."
+        exit 1
+    fi
+    FIELD=`grep -i "CREATE .*TABLE AUTH_USERS" ${DBDIR}/* | sed 's/,/\n/g' | awk '/[Aa][Uu][Tt][Hh]_[Uu][Ss][Ee][Rr]_[Tt][Oo][Kk][Ee][Nn]/ {print NR}'`
+    if [ -z "$FIELD" ]; then
+	echo "cannot find code field in database, please go to the Eucalyptus web UI to obtain credentials."
+	exit 1
+    fi
+    VERCOL=`grep -i "CREATE .*TABLE AUTH_USERS" ${DBDIR}/* | sed 's/,/\n/g' | awk '/[Vv][Ee][Rr][Ss][Ii][Oo][Nn]/ {print NR}'`
+    if [ -z "$VERCOL" ]; then
+	echo "cannot find version field in database, please go to the Eucalyptus web UI to obtain credentials."
+	exit 1
+    fi
+    KEY=$(eval echo $(awk -v field=${FIELD} -v vercol=${VERCOL} -F, 'BEGIN { token=""; max=-1; } /INSERT INTO AUTH_USERS.*admin/ { if ($vercol>max) { max=$vercol; token=$field; } } END { print token; }' ${DBDIR}/* | head -n 1 | sed 's/[()]//g'))
+    if [ -z "$KEY" ]; then
+	echo "cannot find code in database, please go to the Eucalyptus web UI to obtain credentials."
+	exit 1
+    fi
+    CMD="$WGET --no-check-certificate \"https://localhost:8443/getX509?user=admin&code=$KEY\" -O $CREDENTIALZIPFILE"
+    if ! eval $CMD ; then
+	echo "failed to obtain credentals, please try again or go to the Eucalyptus web UI."
+	exit 1
+    fi
+fi
+
+# adding a new cluster
+if [ -n "$CLUSNAME" ]; then
+    if ! checkLocalService "CLC" ; then
+	exit 1
+    fi
+
+    if [ "$CLUSMODE" = "ADD" ]; then
+	if [ -d "${EUCALYPTUS}/var/lib/eucalyptus/keys/" ]; then
+	    SOURCEDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/${CLUSNAME}/
+	    DESTDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/
+	else
+	    echo "ERROR: cannot find key directory ($EUCALYPTUS/var/lib/eucalyptus/keys), check that your installation was successful!"
+	    exit 1
+	fi
+	
+	URL=""
+	if ! createCloudURL "Action" "RegisterCluster" "Host" "${NEWCLUS}" "Name" "${CLUSNAME}" "Port" "${CC_PORT}"; then
+	    exit 1
+	fi
+	
+	if ! check_ws "$URL" ; then
+		echo "ERROR: failed to register new cluster, please log in to the admin interface and check cloud status."
+		exit 1
+	fi
+	
+	if [ -n "${FAKEREG}" ]; then
+	    mkdir -p $SOURCEDIR
+	    if [ -n "${FAKEREG}" ]; then
+		mkdir -p $SOURCEDIR
+		for i in cluster node
+		do 
+		    if [ ! -e "$SOURCEDIR/${i}-cert.pem" -o ! -e "$SOURCEDIR/${i}-pk.pem" ]; then
+			openssl req -new -nodes -x509 -out $SOURCEDIR/${i}-cert.pem -keyout $SOURCEDIR/${i}-pk.pem -days 365 -subj "/C=US/ST=CA/L=City/CN=localhost/emailAddress=root@localhost"
+		    fi
+		done
+	    fi
+	fi
+	
+        # sync the keys
+	if ! sync_keys "${DESTDIR},${SOURCEDIR}" ${DESTDIR} ${NEWCLUS} node-cert.pem cluster-cert.pem cluster-pk.pem node-pk.pem vtunpass cloud-cert.pem; then
+	    echo "ERROR: failed to sync keys with ${NEWCLUS}; registration will not be complete until keys can be synced, please try again."
+	    exit 1
+	fi
+	echo
+	echo "SUCCESS: new cluster '${CLUSNAME}' on host '${NEWCLUS}' successfully registered."
+    elif [ "$CLUSMODE" = "DEL" ]; then
+	URL=""
+	# let's see if we have such a cluster
+	LIST_RES=""
+	if ! createCloudURL "Action" "DescribeClusters" ; then
+		exit 1
+	fi
+	if ! check_ws "$URL" LIST_RES ; then
+		echo "ERROR: cannot talk with CLC"
+		exit 1
+	fi
+	FOUND="N"
+	for x in $LIST_RES ; do
+		if [ "$x" = "${CLUSNAME}" ]; then
+			FOUND="Y"
+			break
+		fi
+	done
+	if [ "$FOUND" = "N" ]; then
+		echo "No registered cluster $CLUSNAME was found"
+		exit 1
+	fi
+
+	# now let's deregister
+	URL=""
+	if ! createCloudURL "Action" "DeregisterCluster" "Name" "${CLUSNAME}"; then
+	    exit 1
+	fi
+	
+	if ! check_ws "$URL" ; then
+		echo "ERROR: failed to deregister new cluster, please log in to the admin interface and check cloud status."
+		exit 1
+	fi	
+	echo
+	echo "SUCCESS: cluster '${CLUSNAME}' successfully deregistered."
+    fi
+fi
+
+# walrus
+if [ -n "$WALRUS" -o -n "$WALRUS_MODE" ]; then
+    if ! checkLocalService "CLC" ; then
+	exit 1
+    fi
+    
+    if [ "$WALRUS_MODE" = "ADD" ]; then
+	echo "Adding WALRUS host $WALRUS"
+	if [ -d "${EUCALYPTUS}/var/lib/eucalyptus/keys/" ]; then
+	    SOURCEDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/
+	    DESTDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/
+	else
+	    echo "ERROR: cannot find key directory ($EUCALYPTUS/var/lib/eucalyptus/keys), check that your installation was successful!"
+	    exit 1
+	fi
+	
+	URL=""
+	if ! createCloudURL "Action" "RegisterWalrus" "Host" "${WALRUS}" "Name" "walrus" "Port" "8773"; then
+	    exit 1
+	fi
+
+	if ! check_ws "$URL" ; then
+	    echo "ERROR: failed to register Walrus, please log in to the admin interface and check cloud status."
+	    exit 1
+	fi
+	
+	# check that walrus is at least running on the remote host
+	sleep 3
+	if ! check_heartbeat ${WALRUS} walrus ; then
+		echo "WARNING: Walrus is not up on host ${WALRUS};  registration will not be complete until walrus is running."
+	fi
+	
+	# sync the keys
+	if ! sync_keys ${SOURCEDIR} ${DESTDIR} ${WALRUS} euca.p12 ; then
+	    echo "ERROR: failed to sync keys with ${WALRUS}; registration will not be complete until keys can be synced, please try again."
+            exit 1
+	fi
+	echo
+	echo "SUCCESS: new walrus on host '${WALRUS}' successfully registered."
+	
+    elif [ "$WALRUS_MODE" = "DEL" ]; then
+	URL=""
+	if ! createCloudURL "Action" "DeregisterWalrus" "Name" "walrus"; then
+	    exit 1
+	fi
+	if ! check_ws "$URL" ; then
+	    echo "ERROR: failed to deregister Walrus, please log in to the admin interface and check cloud status."
+	    exit 1
+	fi
+        echo
+        echo "SUCCESS: Walrus successfully deregistered."
+    fi
+fi
+
+# sc
+if [ -n "$SCNAME" ]; then
+    if ! checkLocalService "CLC" ; then
+	exit 1
+    fi
+    
+    if [ "$SC_MODE" = "ADD" ]; then
+	echo "Adding SC $SCHOST to cluster $SCNAME"
+	if [ -d "${EUCALYPTUS}/var/lib/eucalyptus/keys/" ]; then
+	    SOURCEDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/
+	    DESTDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/
+	else
+	    echo "ERROR: cannot find key directory ($EUCALYPTUS/var/lib/eucalyptus/keys), check that your installation was successful!"
+	    exit 1
+	fi
+	
+	URL=""
+	if ! createCloudURL "Action" "RegisterStorageController" "Host" "${SCHOST}" "Name" "${SCNAME}" "Port" "8773"; then
+	    exit 1
+	fi
+	if ! check_ws "$URL"; then
+	    echo "ERROR: failed to register storage controller, please log in to the admin interface and check cloud status."
+	    exit 1
+	fi
+	if [ -n "${FAKEREG}" ]; then
+	    mkdir -p $SOURCEDIR
+	    for i in sc
+	    do 
+		if [ ! -e "$SOURCEDIR/${i}-cert.pem" -o ! -e "$SOURCEDIR/${i}-pk.pem" ]; then
+		    openssl req -new -nodes -x509 -out $SOURCEDIR/${i}-cert.pem -keyout $SOURCEDIR/${i}-pk.pem -days 365 -subj "/C=US/ST=CA/L=City/CN=localhost/emailAddress=root@localhost"
+		fi
+	    done
+	fi
+    
+    # sync the keys
+	if ! sync_keys ${SOURCEDIR} ${DESTDIR} ${SCHOST} euca.p12; then
+	    echo "ERROR: failed to sync keys with ${SCHOST}; registration will not be complete until keys can be synced, please try again."
+	    exit 1
+	fi
+	echo
+	echo "SUCCESS: new SC for cluster '${SCNAME}' on host '${SCHOST}' successfully registered."
+
+    elif [ "$SC_MODE" = "DEL" ]; then
+	# let's see if we have such a storage controller
+	LIST_RES=""
+	if ! createCloudURL "Action" "DescribeStorageControllers" ; then
+		exit 1
+	fi
+	if ! check_ws "$URL" LIST_RES ; then
+		echo "ERROR: cannot talk with CLC"
+		exit 1
+	fi
+	FOUND="N"
+	for x in $LIST_RES ; do
+		if [ "$x" = "${SCNAME}" ]; then
+			FOUND="Y"
+			break
+		fi
+	done
+	if [ "$FOUND" = "N" ]; then
+		echo "No registered storage controller $SCNAME was found"
+		exit 1
+	fi
+
+	# now let's deregister
+	URL=""
+	if ! createCloudURL "Action" "DeregisterStorageController" "Name" "${SCNAME}"; then
+	    exit 1
+	fi
+	if ! check_ws "$URL" ; then
+	    echo "ERROR: failed to deregister StorageController, please log in to the admin interface and check cloud status."
+	    exit 1
+	fi
+	echo
+	echo "SUCCESS: Storage controller for cluster '${SCNAME}' successfully deregistered."
+    fi
+fi
+
+# operations on the nodes
+if [ -n "$NODEMODE" ]; then
+	# for synckey we fake addnodes
+	if [ "$NODEMODE" = "SYNC" ]; then
+		if [ -z "$NODES" ]; then
+			echo "Warning: there are no NODES configured"
+		else
+			NEWNODES="${NODES}"
+			NODEMODE="ADD"
+		fi
+	fi
+	if [ "$NODEMODE" = "DISCOVER" ]; then
+		if ! which avahi-browse >/dev/null 2>&1; then
+			echo "ERROR: avahi-browse not installed, so cannot discover nodes"
+			exit 1
+		fi
+		NEWNODES=
+		for DISCOVERED in $(avahi-browse -prt _eucalyptus._tcp | grep '^=.*"type=node"' | cut -d\; -f8 | sort -u); do
+			if ! xsearch "$DISCOVERED" "$NODES"; then
+				read -p "New node found on $DISCOVERED; add it? [Yn] " CONFIRM
+				CONFIRM="$(printf %s "$CONFIRM" | tr A-Z a-z | cut -c1)"
+				if [ "x$CONFIRM" = x ] || [ "x$CONFIRM" = xy ]; then
+					NEWNODES="${NEWNODES:+$NEWNODES }$DISCOVERED"
+				fi
+			fi
+		done
+		NODEMODE="ADD"
+	fi
+
+	# check we have a valid command
+	if [ "$NODEMODE" != "ADD" -a "$NODEMODE" != "REM" ]; then
+		echo "ERROR: unknown mode '$NODEMODE', don't know what to do"
+		exit 1
+	fi
+
+	if [ -d "${EUCALYPTUS}/var/lib/eucalyptus/keys/" ]; then
+	    SOURCEDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/
+	    DESTDIR=${EUCALYPTUS}/var/lib/eucalyptus/keys/
+	else
+	    echo "ERROR: cannot find key directory ($EUCALYPTUS/var/lib/eucalyptus/keys), check that your installation was successful and that this cluster is already registered!"
+	    exit 1
+	fi
+	
+	# CC needs to be running 
+	if ! checkLocalService "CC" ; then
+	    exit 1
+	fi
+
+	# warn the user on where we expect the keys to be
+	if [ "$NODEMODE" = "ADD" ]; then 
+		echo
+		echo "INFO: We expect all nodes to have eucalyptus installed in $EUCALYPTUS/var/lib/eucalyptus/keys for key synchronization."
+	fi
+
+	# adding (or removing) nodes
+	for NEWNODE in ${NEWNODES} ; do
+	    # let's see if the node is already in the node list
+            its_here="0"
+            for x in $NODES ; do
+                if [ "$x" = "${NEWNODE}" ]; then
+                    its_here="1"
+                    break
+                fi
+	    done
+	    
+            # remove is simpler: just remove the node name
+            if [ "$NODEMODE" = "REM" ]; then
+                if [ "$its_here" = "0" ]; then
+                    echo "Node ${NEWNODE} is not known"
+                    continue
+                fi
+                NEW_NODES=""
+                for x in $NODES;  do
+                    if [ "$x" = "${NEWNODE}" ]; then
+                        continue
+                    fi
+                    NEW_NODES="$x $NEW_NODES"
+                done
+                echo "$NEW_NODES" | tr ' ' '\n' | uniq > $EUCALYPTUS/var/lib/eucalyptus/nodes.list
+                echo "SUCCESS: removed node '${NEWNODE}' from '$FILE'"
+                continue
+            fi
+	    
+	    # let's sync keys with the nodes
+	    if ! sync_keys ${SOURCEDIR} ${DESTDIR} ${NEWNODE} node-cert.pem cluster-cert.pem node-pk.pem cloud-cert.pem; then
+		errors=1
+		echo
+		echo "ERROR: could not synchronize keys with $NEWNODE!"
+		echo "The configuration will not have this node."
+		if [ "$SSHKEY" = "" ]; then
+		    echo "User $EUCA_USER may have to run ssh-keygen!"
+		else
+		    echo "Hint: to setup passwordless login to the nodes as user $EUCA_USER, you can"
+		    echo "run the following commands on node $NEWNODE:"
+		    echo "sudo -u $EUCA_USER mkdir -p ~${EUCA_USER}/.ssh"
+		    echo "sudo -u $EUCA_USER tee ~${EUCA_USER}/.ssh/authorized_keys > /dev/null <<EOT"
+		    echo "$SSHKEY"
+		    echo "EOT"
+		    echo ""
+		    echo "Be sure that authorized_keys is not group/world readable or writable"
+		fi
+		continue
+	    fi
+
+            # if the node is already listed, we are done
+            if [ "$its_here" = "1" ]; then
+                continue
+            fi
+
+            # add the node
+            NODES="${NODES} $NEWNODE"
+            echo "$NODES" | tr ' ' '\n' | uniq > $EUCALYPTUS/var/lib/eucalyptus/nodes.list
+
+	done
+fi
+
+
+for x in $LIST ; do
+	LIST_RES=""
+
+	if [ "$x" = "walruses" ]; then
+		if ! createCloudURL "Action" "DescribeWalruses" ; then
+			exit 1
+		fi
+		if ! check_ws "$URL" LIST_RES ; then
+			exit 1
+		fi
+		if [ -n "$LIST_RES" ]; then
+			echo "registered walruses:"
+		fi
+		echo "$LIST_RES"
+	fi
+	if [ "$x" = "storages" ]; then
+		if ! createCloudURL "Action" "DescribeStorageControllers" ; then
+			exit 1
+		fi
+		if ! check_ws "$URL" LIST_RES ; then
+			exit 1
+		fi
+		if [ -n "$LIST_RES" ]; then
+			echo "registered storage controllers:"
+		fi
+		echo "$LIST_RES"
+	fi
+	if [ "$x" = "clusters" ]; then
+		if ! createCloudURL "Action" "DescribeClusters" ; then
+			exit 1
+		fi
+		if ! check_ws "$URL" LIST_RES ; then
+			exit 1
+		fi
+		if [ -n "$LIST_RES" ]; then
+			echo "registered clusters:"
+		fi
+		echo "$LIST_RES"
+	fi
+	if [ "$x" = "nodes" ]; then
+		if ! createCloudURL "Action" "DescribeNodes" ; then
+			exit 1
+		fi
+		if ! check_ws "$URL" LIST_RES ; then
+			exit 1
+		fi
+		if [ -n "$LIST_RES" ]; then
+			echo "registered nodes:"
+		fi
+		echo "$LIST_RES"
+	fi
+done
+
+
+# enable/disable services
+if [ -r $EUCALYPTUS/var/lib/eucalyptus/services ]; then
+	for x in `cat $EUCALYPTUS/var/lib/eucalyptus/services` ; do
+		TO_START="$TO_START $x"
+	done
+fi
+if [ -n "$DISABLED" -o -n "$ENABLED" ]; then
+	for x in $TO_START $ENABLED ; do
+		to_start="Y"
+		for y in $DISABLED ; do
+			if [ "$x" = "$y" ]; then
+				to_start="N"
+			fi
+		done
+		[ $to_start = "Y" ] && echo $x
+	done | sort | uniq > $EUCALYPTUS/var/lib/eucalyptus/services
+fi
+
+[ "$errors" = "1" ] && exit 1 || exit 0

=== added directory '.pc/30-clock_drift.patch'
=== added directory '.pc/30-clock_drift.patch/tools'
=== added file '.pc/30-clock_drift.patch/tools/client-policy-template.xml'
--- .pc/30-clock_drift.patch/tools/client-policy-template.xml	1970-01-01 00:00:00 +0000
+++ .pc/30-clock_drift.patch/tools/client-policy-template.xml	2011-09-21 09:10:44 +0000
@@ -0,0 +1,73 @@
+<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
+  <wsp:ExactlyOne>
+    <wsp:All>
+      <sp:AsymmetricBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
+	<wsp:Policy>
+          <sp:InitiatorToken>
+            <wsp:Policy>
+              <sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always">
+                <wsp:Policy>
+                  <sp:RequireEmbeddedTokenReference/>
+                  <sp:WssX509V3Token10/>
+                </wsp:Policy>
+              </sp:X509Token>
+            </wsp:Policy>
+          </sp:InitiatorToken>
+          <sp:RecipientToken>
+            <wsp:Policy>
+              <sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always">
+                <wsp:Policy>
+                  <sp:RequireEmbeddedTokenReference/>
+                  <sp:WssX509V3Token10/>
+                </wsp:Policy>
+              </sp:X509Token>
+            </wsp:Policy>
+          </sp:RecipientToken>
+
+          <sp:AlgorithmSuite>
+            <wsp:Policy>
+              <sp:Basic256Rsa15/>
+            </wsp:Policy>
+          </sp:AlgorithmSuite>
+
+          <sp:Layout>
+            <wsp:Policy>
+              <sp:Strict/>
+            </wsp:Policy>
+          </sp:Layout>
+
+	  <sp:IncludeTimestamp/> 
+          <sp:OnlySignEntireHeadersAndBody/>
+        </wsp:Policy>
+      </sp:AsymmetricBinding>
+
+      <sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
+        <wsp:Policy>
+          <sp:MustSupportRefKeyIdentifier/>
+          <sp:MustSupportRefEmbeddedToken/>
+        </wsp:Policy>
+      </sp:Wss10>
+
+      <sp:SignedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
+	<sp:Body/>
+        <sp:Header Namespace="http://www.w3.org/2005/08/addressing"/>
+      </sp:SignedParts>
+
+      <rampc:RampartConfig xmlns:rampc="http://ws.apache.org/rampart/c/policy">
+	<rampc:ReceiverCertificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-CERT</rampc:ReceiverCertificate>
+	<rampc:Certificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-CERT</rampc:Certificate>
+	<rampc:PrivateKey>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-KEY</rampc:PrivateKey>
+	<!-- <rampc:TimeToLive>14400</rampc:TimeToLive> -->
+	<!--
+	    <rampc:User>CLIENT-USERNAME</rampc:User>
+	    <rampc:PasswordType>Digest</rampc:PasswordType>
+	    <rampc:PasswordCallbackClass>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/libpwcb.so</rampc:PasswordCallbackClass>
+	    <rampc:ReceiverCertificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-CERT</rampc:ReceiverCertificate>
+	    <rampc:Certificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-CERT</rampc:Certificate>
+	    <rampc:PrivateKey>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-KEY</rampc:PrivateKey>
+	-->
+      </rampc:RampartConfig>
+    </wsp:All>
+  </wsp:ExactlyOne>
+</wsp:Policy>
+

=== added file '.pc/30-clock_drift.patch/tools/service-policy-template.xml'
--- .pc/30-clock_drift.patch/tools/service-policy-template.xml	1970-01-01 00:00:00 +0000
+++ .pc/30-clock_drift.patch/tools/service-policy-template.xml	2011-09-21 09:10:44 +0000
@@ -0,0 +1,67 @@
+<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
+  <wsp:ExactlyOne>
+    <wsp:All>
+      <sp:AsymmetricBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
+	<wsp:Policy>
+          <sp:InitiatorToken>
+            <wsp:Policy>
+              <sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always">a
+                <wsp:Policy>
+                  <sp:RequireEmbeddedTokenReference/>
+                  <sp:WssX509V3Token10/>
+                </wsp:Policy>
+              </sp:X509Token>
+            </wsp:Policy>
+          </sp:InitiatorToken>
+          <sp:RecipientToken>
+            <wsp:Policy>
+              <sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Always">
+                <wsp:Policy>
+                  <sp:RequireEmbeddedTokenReference/>
+                  <sp:WssX509V3Token10/>
+                </wsp:Policy>
+              </sp:X509Token>
+            </wsp:Policy>
+          </sp:RecipientToken>
+
+          <sp:AlgorithmSuite>
+            <wsp:Policy>
+              <sp:Basic256Rsa15/>
+            </wsp:Policy>
+          </sp:AlgorithmSuite>
+
+          <sp:Layout>
+            <wsp:Policy>
+              <sp:Strict/>
+            </wsp:Policy>
+          </sp:Layout>
+
+	  <sp:IncludeTimestamp/>
+          <sp:OnlySignEntireHeadersAndBody/>
+	  <!-- <sp:EncryptSignature/> -->
+        </wsp:Policy>
+      </sp:AsymmetricBinding>
+
+      <sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
+        <wsp:Policy>
+          <sp:MustSupportRefKeyIdentifier/>
+          <sp:MustSupportRefEmbeddedToken/>
+	  <sp:MustSupportRefIssuerSerial/>
+        </wsp:Policy>
+      </sp:Wss10>
+
+      <sp:SignedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
+	<sp:Body/>
+        <sp:Header Namespace="http://www.w3.org/2005/08/addressing"/>
+      </sp:SignedParts>
+
+      <rampc:RampartConfig xmlns:rampc="http://ws.apache.org/rampart/c/policy">
+	<rampc:ReceiverCertificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-CERT</rampc:ReceiverCertificate>
+	<rampc:Certificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-CERT</rampc:Certificate>
+	<rampc:PrivateKey>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-KEY</rampc:PrivateKey>
+	<!-- <rampc:TimeToLive>14400</rampc:TimeToLive> -->
+      </rampc:RampartConfig>
+    </wsp:All>
+  </wsp:ExactlyOne>
+</wsp:Policy>
+

=== added directory '.pc/30-clock_drift.patch/util'
=== added file '.pc/30-clock_drift.patch/util/euca_axis.c'
--- .pc/30-clock_drift.patch/util/euca_axis.c	1970-01-01 00:00:00 +0000
+++ .pc/30-clock_drift.patch/util/euca_axis.c	2011-09-21 09:10:44 +0000
@@ -0,0 +1,459 @@
+/*
+Copyright (c) 2009  Eucalyptus Systems, Inc.	
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by 
+the Free Software Foundation, only version 3 of the License.  
+ 
+This file is distributed in the hope that it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+for more details.  
+
+You should have received a copy of the GNU General Public License along
+with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+Please contact Eucalyptus Systems, Inc., 130 Castilian
+Dr., Goleta, CA 93101 USA or visit <http://www.eucalyptus.com/licenses/> 
+if you need additional information or have any questions.
+
+This file may incorporate work covered under the following copyright and
+permission notice:
+
+  Software License Agreement (BSD License)
+
+  Copyright (c) 2008, Regents of the University of California
+  
+
+  Redistribution and use of this software in source and binary forms, with
+  or without modification, are permitted provided that the following
+  conditions are met:
+
+    Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+    Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+  IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+  TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+  PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
+  OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+  EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+  PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. USERS OF
+  THIS SOFTWARE ACKNOWLEDGE THE POSSIBLE PRESENCE OF OTHER OPEN SOURCE
+  LICENSED MATERIAL, COPYRIGHTED MATERIAL OR PATENTED MATERIAL IN THIS
+  SOFTWARE, AND IF ANY SUCH MATERIAL IS DISCOVERED THE PARTY DISCOVERING
+  IT MAY INFORM DR. RICH WOLSKI AT THE UNIVERSITY OF CALIFORNIA, SANTA
+  BARBARA WHO WILL THEN ASCERTAIN THE MOST APPROPRIATE REMEDY, WHICH IN
+  THE REGENTS’ DISCRETION MAY INCLUDE, WITHOUT LIMITATION, REPLACEMENT
+  OF THE CODE SO IDENTIFIED, LICENSING OF THE CODE SO IDENTIFIED, OR
+  WITHDRAWAL OF THE CODE CAPABILITY TO THE EXTENT NEEDED TO COMPLY WITH
+  ANY SUCH LICENSES OR RIGHTS.
+*/
+/* BRIEF EXAMPLE MSG:
+<soapenv:Envelope>.
+  <soapenv:Header>
+    [..snip..]
+    <wsse:Security>
+      [..snip..]
+      <wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+                              EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
+                              ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
+                              wsu:Id="CertId-469">[..snip..]</wsse:BinarySecurityToken>
+      [..snip..]
+      <ds:Signature>
+        <ds:SignedInfo>
+	  <!-- <ref-id> points to a signed element. Body, Timestamp, To, Action, and MessageId element are expected to be signed-->
+	  <ds:Reference URI="#<ref-id>>
+	  [..snip..]
+	  </ds:Reference>
+	</ds:SignedInfo>
+        <ds:KeyInfo Id="KeyId-374652">
+          <wsse:SecurityTokenReference xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-22112351">
+            <!-- this thing points to the wsse:BinarySecurityToken above -->
+            <wsse:Reference URI="#CertId-469" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
+          </wsse:SecurityTokenReference>
+        </ds:KeyInfo>
+      </ds:Signature>
+    </wsse:Security>
+  </soapenv:Header>
+  <soapenv:Body>...</soapenv:Body>
+</soapenv:Envelope>.
+*/
+
+#include "oxs_axiom.h"
+#include "oxs_x509_cert.h"
+#include "oxs_key_mgr.h"
+#include "rampart_handler_util.h"
+#include "rampart_sec_processed_result.h"
+#include "rampart_error.h"
+#include "axis2_op_ctx.h"
+#include "rampart_context.h"
+#include "rampart_constants.h"
+#include "axis2_addr.h"
+#include "axiom_util.h"
+#include "rampart_timestamp_token.h"
+
+#include <neethi_policy.h>
+#include <neethi_util.h>
+#include <axutil_utils.h>
+#include <axis2_client.h>
+#include <axis2_stub.h>
+
+#include "misc.h" /* check_file, logprintf */
+#include "euca_axis.h"
+
+#define NO_U_FAIL(x) do{ \
+AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][eucalyptus-verify] " #x );\
+AXIS2_ERROR_SET(env->error, RAMPART_ERROR_FAILED_AUTHENTICATION, AXIS2_FAILURE);\
+return AXIS2_FAILURE; \
+}while(0)
+
+axis2_status_t __euca_authenticate(const axutil_env_t *env,axis2_msg_ctx_t *out_msg_ctx, axis2_op_ctx_t *op_ctx)
+{
+  //***** First get the message context before doing anything dumb w/ a NULL pointer *****/
+  axis2_msg_ctx_t *msg_ctx = NULL; //<--- incoming msg context, it is NULL, see?
+  msg_ctx = axis2_op_ctx_get_msg_ctx(op_ctx, env, AXIS2_WSDL_MESSAGE_LABEL_IN);  
+
+  //***** Print everything from the security results, just for testing now *****//
+  rampart_context_t *rampart_context = NULL;
+  axutil_property_t *property = NULL;
+
+  property = axis2_msg_ctx_get_property(msg_ctx, env, RAMPART_CONTEXT);
+  if(property)
+  {
+     rampart_context = (rampart_context_t *)axutil_property_get_value(property, env);
+     //     AXIS2_LOG_CRITICAL(env->log,AXIS2_LOG_SI," ======== PRINTING PROCESSED WSSEC TOKENS ======== ");
+     rampart_print_security_processed_results_set(env,msg_ctx);
+  }
+
+  //***** Extract Security Node from header from enveloper from msg_ctx *****//
+  axiom_soap_envelope_t *soap_envelope = NULL;
+  axiom_soap_header_t *soap_header = NULL;
+  axiom_node_t *sec_node = NULL;
+
+
+  soap_envelope = axis2_msg_ctx_get_soap_envelope(msg_ctx, env);
+  if(!soap_envelope) NO_U_FAIL("SOAP envelope cannot be found."); 
+  soap_header = axiom_soap_envelope_get_header(soap_envelope, env);
+  if (!soap_header) NO_U_FAIL("SOAP header cannot be found.");
+  sec_node = rampart_get_security_header(env, msg_ctx, soap_header); // <---- here it is!
+  if(!sec_node)NO_U_FAIL("No node wsse:Security -- required: ws-security");
+
+  //***** Find the wsse:Reference to the BinarySecurityToken *****//
+  //** Path is: Security/
+  //** *sec_node must be non-NULL, kkthx **//
+  axiom_node_t *sig_node = NULL;
+  axiom_node_t *key_info_node = NULL;
+  axiom_node_t *sec_token_ref_node = NULL;
+  /** the ds:Signature node **/
+  sig_node = oxs_axiom_get_first_child_node_by_name(env,sec_node, OXS_NODE_SIGNATURE, OXS_DSIG_NS, OXS_DS );
+  if(!sig_node)NO_U_FAIL("No node ds:Signature -- required: signature");
+  /** the ds:KeyInfo **/
+  key_info_node = oxs_axiom_get_first_child_node_by_name(env, sig_node, OXS_NODE_KEY_INFO, OXS_DSIG_NS, NULL );
+  if(!key_info_node)NO_U_FAIL("No node ds:KeyInfo -- required: signature key");
+  /** the wsse:SecurityTokenReference **/ 
+  sec_token_ref_node = oxs_axiom_get_first_child_node_by_name(env, key_info_node,OXS_NODE_SECURITY_TOKEN_REFRENCE, OXS_WSSE_XMLNS, NULL);
+  if(!sec_token_ref_node)NO_U_FAIL("No node wsse:SecurityTokenReference -- required: signing token");
+  //** in theory this is the branching point for supporting all kinds of tokens -- we only do BST Direct Reference **/
+
+  //***** Find the wsse:Reference to the BinarySecurityToken *****//
+  //** *sec_token_ref_node must be non-NULL **/
+  axis2_char_t *ref = NULL;
+  axis2_char_t *ref_id = NULL;
+  axiom_node_t *token_ref_node = NULL;
+  axiom_node_t *bst_node = NULL;
+  /** the wsse:Reference node **/
+  token_ref_node = oxs_axiom_get_first_child_node_by_name(env, sec_token_ref_node,OXS_NODE_REFERENCE, OXS_WSSE_XMLNS, NULL);
+  /** pull out the name of the BST node **/
+  ref = oxs_token_get_reference(env, token_ref_node);
+  ref_id = axutil_string_substring_starting_at(axutil_strdup(env, ref), 1);
+  /** get the wsse:BinarySecurityToken used to sign the message **/
+  bst_node = oxs_axiom_get_node_by_id(env, sec_node, "Id", ref_id, OXS_WSU_XMLNS);
+  if(!bst_node){oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Error retrieving elementwith ID=%s", ref_id);NO_U_FAIL("Cant find the required node");}
+
+
+  //***** Find the wsse:Reference to the BinarySecurityToken *****//
+  //** *bst_node must be non-NULL **/
+  axis2_char_t *data = NULL;
+  oxs_x509_cert_t *_cert = NULL;
+  oxs_x509_cert_t *recv_cert = NULL;
+  axis2_char_t *file_name = NULL;
+  axis2_char_t *recv_x509_buf = NULL;
+  axis2_char_t *msg_x509_buf = NULL;
+
+  /** pull out the data from the BST **/
+  data = oxs_axiom_get_node_content(env, bst_node);
+  /** create an oxs_X509_cert **/
+  _cert = oxs_key_mgr_load_x509_cert_from_string(env, data);
+  if(_cert)
+  {
+    //***** FINALLY -- we have the certificate used to sign the message.  authenticate it HERE *****//
+    msg_x509_buf = oxs_x509_cert_get_data(_cert,env);
+    if(!msg_x509_buf)NO_U_FAIL("OMG WHAT NOW?!");
+    /*
+    recv_x509_buf = (axis2_char_t *)rampart_context_get_receiver_certificate(rampart_context, env);
+    if(recv_x509_buf)
+        recv_cert = oxs_key_mgr_load_x509_cert_from_string(env, recv_x509_buf);
+    else
+    {
+        file_name = rampart_context_get_receiver_certificate_file(rampart_context, env);
+        if(!file_name) NO_U_FAIL("Policy for the service is incorrect -- ReceiverCertificate is not set!!");
+	if (check_file(file_name)) NO_U_FAIL("No cert file ($EUCALYPTUS/var/lib/eucalyptus/keys/cloud-cert.pem) found, failing");
+        recv_cert = oxs_key_mgr_load_x509_cert_from_pem_file(env, file_name);
+    }
+    */
+
+    file_name = rampart_context_get_receiver_certificate_file(rampart_context, env);
+    if(!file_name) NO_U_FAIL("Policy for the service is incorrect -- ReceiverCertificate is not set!!");
+    if (check_file(file_name)) NO_U_FAIL("No cert file ($EUCALYPTUS/var/lib/eucalyptus/keys/cloud-cert.pem) found, failing");
+    recv_cert = oxs_key_mgr_load_x509_cert_from_pem_file(env, file_name);
+
+    if (recv_cert) {
+      recv_x509_buf = oxs_x509_cert_get_data(recv_cert,env);
+    } else {
+      NO_U_FAIL("could not populate receiver cert");
+    }
+
+    if( axutil_strcmp(recv_x509_buf,msg_x509_buf)!=0){
+      AXIS2_LOG_CRITICAL(env->log,AXIS2_LOG_SI," --------- Received x509 certificate value ---------" );
+      AXIS2_LOG_CRITICAL(env->log,AXIS2_LOG_SI, msg_x509_buf );
+      AXIS2_LOG_CRITICAL(env->log,AXIS2_LOG_SI," --------- Local x509 certificate value! ---------" );
+      AXIS2_LOG_CRITICAL(env->log,AXIS2_LOG_SI, recv_x509_buf );
+      AXIS2_LOG_CRITICAL(env->log,AXIS2_LOG_SI," ---------------------------------------------------" );
+      NO_U_FAIL("The certificate specified is invalid!");
+    }
+    if(verify_references(sig_node, env, out_msg_ctx, soap_envelope) == AXIS2_FAILURE) {
+      return AXIS2_FAILURE;
+  }
+
+  }
+  else 
+  {
+    oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_DEFAULT, "Cannot load certificate from string =%s", data); 
+    NO_U_FAIL("Failed to build certificate from BinarySecurityToken");
+  }
+  oxs_x509_cert_free(_cert, env);
+  oxs_x509_cert_free(recv_cert, env);
+
+  return AXIS2_SUCCESS;
+
+}
+
+/**
+ * Verifes that Body, Timestamp, To, Action, and MessageId elements are signed and located
+ * where expected by the application logic. Timestamp is checked for expiration regardless
+ * of its actual location.
+ */
+axis2_status_t verify_references(axiom_node_t *sig_node, const axutil_env_t *env, axis2_msg_ctx_t *msg_ctx, axiom_soap_envelope_t *envelope) {
+  axiom_node_t *si_node = NULL;
+  axiom_node_t *ref_node = NULL;
+  axis2_status_t status = AXIS2_SUCCESS;
+
+  si_node = oxs_axiom_get_first_child_node_by_name(env,sig_node, OXS_NODE_SIGNEDINFO, OXS_DSIG_NS, OXS_DS);
+
+  if(!si_node) {
+    axis2_char_t *tmp = axiom_node_to_string(sig_node, env);
+    AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart]sig = %s", tmp);
+    NO_U_FAIL("Couldn't find SignedInfo!");
+  }
+
+  axutil_qname_t *qname = NULL;
+  axiom_element_t *parent_elem = NULL; 
+  axiom_children_qname_iterator_t *qname_iter = NULL; 
+
+  parent_elem = axiom_node_get_data_element(si_node, env);  
+  if(!parent_elem)                                                                                                                          
+    {                                                                                                                                        
+       NO_U_FAIL("Could not get Reference elem");                                                                                                                           
+    }     
+
+  axis2_char_t *ref = NULL;
+  axis2_char_t *ref_id = NULL;
+  axiom_node_t *signed_node = NULL;
+  axiom_node_t *envelope_node = NULL;
+
+  short signed_elems[5] = {0,0,0,0,0};
+
+  envelope_node = axiom_soap_envelope_get_base_node(envelope, env);
+
+  qname = axutil_qname_create(env, OXS_NODE_REFERENCE, OXS_DSIG_NS, NULL);                                                                            
+  qname_iter = axiom_element_get_children_with_qname(parent_elem, env, qname, si_node); 
+  while (axiom_children_qname_iterator_has_next(qname_iter , env)) {
+      ref_node = axiom_children_qname_iterator_next(qname_iter, env);     
+      axis2_char_t *txt = axiom_node_to_string(ref_node, env); 
+
+      /* get reference to a signed element */
+      ref = oxs_token_get_reference(env, ref_node);
+      if(ref == NULL || strlen(ref) == 0 || ref[0] != '#') {
+	oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Unsupported reference ID in %s", txt);
+	status = AXIS2_FAILURE;
+	break;
+      }
+
+      AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] %s, ref = %s", txt, ref); 
+  
+      /* get rid of '#' */
+      ref_id = axutil_string_substring_starting_at(axutil_strdup(env, ref), 1);
+      signed_node = oxs_axiom_get_node_by_id(env, envelope_node, OXS_ATTR_ID, ref_id, OXS_WSU_XMLNS);
+      if(!signed_node) {
+	  oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Error retrieving elementwith ID=%s", ref_id);
+	  status = AXIS2_FAILURE;
+	  break;
+      }
+      if(verify_node(signed_node, env, msg_ctx, ref, signed_elems)) {
+	status = AXIS2_FAILURE;
+	break;
+      }
+    }         
+
+  
+  axutil_qname_free(qname, env);                                                                                                           
+  qname = NULL;                   
+  
+  if(status == AXIS2_FAILURE) {
+    NO_U_FAIL("Failed to verify location of signed elements!");
+  }
+
+  /* This is needed to make sure that all security-critical elements are signed */
+  for(int i = 0; i < 5; i++) {
+    if(signed_elems[i] == 0) {
+      NO_U_FAIL("Not all required elements are signed");
+    }
+  }
+
+  return status;
+
+}
+
+/**
+ * Verifies XPath location of signed elements.
+ */ 
+int verify_node(axiom_node_t *signed_node, const axutil_env_t *env, axis2_msg_ctx_t *msg_ctx, axis2_char_t *ref, short *signed_elems) {
+
+  if(!axutil_strcmp(OXS_NODE_BODY, axiom_util_get_localname(signed_node, env))) {
+    AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] node %s is Body", ref); 
+    signed_elems[0] = 1;
+
+    axiom_node_t *parent = axiom_node_get_parent(signed_node,env);
+    if(axutil_strcmp(OXS_NODE_ENVELOPE, axiom_util_get_localname(parent, env))) {
+       oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Unexpected parent element for Body with ID = %s", ref);
+       return 1;
+    }
+
+     parent = axiom_node_get_parent(parent,env);
+     if(parent) {
+       AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] parent of Envelope = %s", axiom_node_to_string(parent, env));
+       oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Unexpected location of signed Body with ID = %s", ref);
+       return 1;
+     }
+
+  } else if(!axutil_strcmp(RAMPART_SECURITY_TIMESTAMP, axiom_util_get_localname(signed_node, env))) {
+    AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] node %s is Timestamp", ref); 
+    signed_elems[1] = 1;
+
+    /* Regardless of the location of the Timestamp, verify the one that is signed */
+    if(AXIS2_FAILURE == rampart_timestamp_token_validate(env, msg_ctx, signed_node, 0)) {
+       oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Validation failed for Timestamp with ID = %s", ref);
+      return 1;
+    }
+
+  } else if(!axutil_strcmp(AXIS2_WSA_ACTION, axiom_util_get_localname(signed_node, env))) {
+    AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] node %s is Action", ref); 
+    signed_elems[2] = 1;
+
+    if(verify_addr_hdr_elem_loc(signed_node, env, ref)) {
+	oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Validation failed for Action with ID = %s", ref);
+	return 1;
+      }
+
+  } else if(!axutil_strcmp(AXIS2_WSA_TO, axiom_util_get_localname(signed_node, env))) {
+    AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] node %s is To", ref); 
+    signed_elems[3] = 1;
+ 
+    if(verify_addr_hdr_elem_loc(signed_node, env, ref)) {
+	oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Validation failed for To with ID = %s", ref);
+	return 1;
+      }
+
+
+  } else if(!axutil_strcmp(AXIS2_WSA_MESSAGE_ID, axiom_util_get_localname(signed_node, env))) {
+    AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] node %s is MessageId", ref); 
+    signed_elems[4] = 1;
+
+    if(verify_addr_hdr_elem_loc(signed_node, env, ref)) {
+	oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Validation failed for MessageId with ID = %s", ref);
+	return 1;
+      }
+
+  } else {
+    AXIS2_LOG_WARNING(env->log, AXIS2_LOG_SI, "[euca-rampart] node %s is UNKNOWN", ref); 
+  }
+
+    return 0;
+}
+
+/**
+ * Verify that an addressing element is located in <Envelope>/<Header>
+ */
+int verify_addr_hdr_elem_loc(axiom_node_t *signed_node, const axutil_env_t *env, axis2_char_t *ref) {
+
+    axiom_node_t *parent = axiom_node_get_parent(signed_node,env);
+
+    if(axutil_strcmp(OXS_NODE_HEADER, axiom_util_get_localname(parent, env))) {
+       AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] parent of addressing elem is %s", axiom_node_to_string(parent, env));
+       oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Unexpected location of signed addressing elem with ID = %s", ref);
+       return 1;
+
+    }
+     parent = axiom_node_get_parent(parent,env);
+
+    if(axutil_strcmp(OXS_NODE_ENVELOPE, axiom_util_get_localname(parent, env))) {
+       AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] second parent of addressing elem is %s", axiom_node_to_string(parent, env));
+       oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Unexpected location of signed addressing elem with ID = %s", ref);
+       return 1;
+
+    }
+
+     parent = axiom_node_get_parent(parent,env);
+     if(parent) {
+       AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[euca-rampart] parent of Envelope = %s", axiom_node_to_string(parent, env));
+       oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Unexpected location of signed Body with ID = %s", ref);
+       return 1;
+     }
+
+     return 0;
+}
+
+
+int InitWSSEC(axutil_env_t *env, axis2_stub_t *stub, char *policyFile) {
+  axis2_svc_client_t *svc_client = NULL;
+  neethi_policy_t *policy = NULL;
+  axis2_status_t status = AXIS2_FAILURE;
+
+  //return(0);
+
+  svc_client =  axis2_stub_get_svc_client(stub, env);
+  if (!svc_client) {
+    logprintfl (EUCAERROR, "InitWSSEC(): ERROR could not get svc_client from stub\n");
+    return(1);
+  }
+  axis2_svc_client_engage_module(svc_client, env, "rampart");
+
+  policy = neethi_util_create_policy_from_file(env, policyFile);
+  if (!policy) {
+    logprintfl (EUCAERROR, "InitWSSEC(): ERROR could not initialize policy file %s\n", policyFile);
+    return(1);
+  }
+  status = axis2_svc_client_set_policy(svc_client, env, policy);
+    
+  return(0);
+}
+

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2011-09-15 13:35:03 +0000
+++ .pc/applied-patches	2011-09-21 09:10:44 +0000
@@ -16,3 +16,5 @@
 26-google-collections-1.0-ftbfs.patch
 27-soap-security.patch
 28-fix-startup-crash.patch
+29-euca_conf-sslv3.patch
+30-clock_drift.patch

=== modified file 'debian/changelog'
--- debian/changelog	2011-09-15 13:35:03 +0000
+++ debian/changelog	2011-09-21 09:10:44 +0000
@@ -1,3 +1,16 @@
+eucalyptus (2.0.1+bzr1256-0ubuntu8) oneiric; urgency=low
+
+  * Fix compatibility issues with SSLv3 (LP: #851611):
+    - d/patches/29-euca_conf-sslv3.patch: Use --secure-protocol=SSLv3
+      with wget when communicating with CLC.
+    - d/eucalyptus-cloud.upstart: Use --secure-protocol=SSLv3 with wget
+      when checking for CLC startup complete.
+  * d/patches/30-clock_drift.patch: Resolve issue with rampart blocking 
+    communication between CC and NC when time is fractionally in the
+    future (LP: #854946):
+
+ -- James Page <[e-mail]>  Wed, 21 Sep 2011 09:57:58 +0100
+
 eucalyptus (2.0.1+bzr1256-0ubuntu7) oneiric; urgency=low
 
   * d/patches/28-fix-startup-crash.patch: Fix from Graziano Obertelli

=== modified file 'debian/eucalyptus-cloud.upstart'
--- debian/eucalyptus-cloud.upstart	2010-02-03 19:01:47 +0000
+++ debian/eucalyptus-cloud.upstart	2011-09-21 09:10:44 +0000
@@ -12,6 +12,7 @@
 		. /etc/eucalyptus/eucalyptus-ipaddr.conf
 		# Should this check something on :8773 instead? -mdz
 		if wget -q -T10 -t1 -O- --no-check-certificate \
+            --secure-protocol=SSLv3 \
 			https://$CLOUD_IP_ADDR:8443/register | \
 			grep CloudVersion; then
 

=== added file 'debian/patches/29-euca_conf-sslv3.patch'
--- debian/patches/29-euca_conf-sslv3.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/29-euca_conf-sslv3.patch	2011-09-21 09:10:44 +0000
@@ -0,0 +1,18 @@
+Description: Force wget to use SSLv3 protocol when talking to CLC
+ otherwise SSL comms failures happen.
+Origin: https://build.opensuse.org/package/view_file?file=eucalyptus-force-sslv3.patch&package=eucalyptus&project=Virtualization%3ACloud%3AEucalyptus&srcmd5=603fc985140105bd4ed7a079a4dc7258
+Forwarded: not-needed
+
+Index: eucalyptus/tools/euca_conf.in
+===================================================================
+--- eucalyptus.orig/tools/euca_conf.in	2011-09-20 17:03:52.995305737 +0100
++++ eucalyptus/tools/euca_conf.in	2011-09-20 17:05:46.935553670 +0100
+@@ -1096,7 +1096,7 @@
+ 	    done
+ 	fi
+ 	
+-	CMD="$WGET -T 10 -t 1 -O - -q --no-check-certificate https://127.0.0.1:8443/register | grep CloudVersion >/dev/null"
++	CMD="$WGET -T 10 -t 1 -O - -q --no-check-certificate --secure-protocol=SSLv3 https://127.0.0.1:8443/register | grep CloudVersion >/dev/null"
+     elif [ "$SERVICE" = "CC" ]; then
+ 	CMD="$WGET -T 10 -t 1 -O - -q http://127.0.0.1:8774/axis2/services/ | grep EucalyptusCC >/dev/null"
+     fi

=== added file 'debian/patches/30-clock_drift.patch'
--- debian/patches/30-clock_drift.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/30-clock_drift.patch	2011-09-21 09:10:44 +0000
@@ -0,0 +1,38 @@
+Author: Graziano Obertelli <[e-mail]>
+Description: Permit fractional time difference between NC and CC
+Bug-Ubuntu: http://pad.lv/854946
+
+--- a/tools/client-policy-template.xml	2011-03-30 16:44:16 +0000
++++ b/tools/client-policy-template.xml	2011-04-07 22:26:08 +0000
+@@ -57,6 +57,7 @@
+ 	<rampc:ReceiverCertificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-CERT</rampc:ReceiverCertificate>
+ 	<rampc:Certificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-CERT</rampc:Certificate>
+ 	<rampc:PrivateKey>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-KEY</rampc:PrivateKey>
++	<rampc:ClockSkewBuffer>20</rampc:ClockSkewBuffer>
+ 	<!-- <rampc:TimeToLive>14400</rampc:TimeToLive> -->
+ 	<!--
+ 	    <rampc:User>CLIENT-USERNAME</rampc:User>
+
+--- a/tools/service-policy-template.xml	2011-03-30 16:44:16 +0000
++++ b/tools/service-policy-template.xml	2011-04-07 22:26:08 +0000
+@@ -60,6 +60,7 @@
+ 	<rampc:Certificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-CERT</rampc:Certificate>
+ 	<rampc:PrivateKey>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-KEY</rampc:PrivateKey>
+ 	<!-- <rampc:TimeToLive>14400</rampc:TimeToLive> -->
++	<rampc:ClockSkewBuffer>20</rampc:ClockSkewBuffer>
+       </rampc:RampartConfig>
+     </wsp:All>
+   </wsp:ExactlyOne>
+
+--- a/util/euca_axis.c	2011-03-30 16:44:16 +0000
++++ b/util/euca_axis.c	2011-04-07 22:26:08 +0000
+@@ -360,7 +360,7 @@
+     signed_elems[1] = 1;
+ 
+     /* Regardless of the location of the Timestamp, verify the one that is signed */
+-    if(AXIS2_FAILURE == rampart_timestamp_token_validate(env, msg_ctx, signed_node, 0)) {
++    if(AXIS2_FAILURE == rampart_timestamp_token_validate(env, msg_ctx, signed_node, 20)) {
+        oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Validation failed for Timestamp with ID = %s", ref);
+       return 1;
+     }
+

=== modified file 'debian/patches/series'
--- debian/patches/series	2011-09-15 13:35:03 +0000
+++ debian/patches/series	2011-09-21 09:10:44 +0000
@@ -16,3 +16,5 @@
 26-google-collections-1.0-ftbfs.patch
 27-soap-security.patch
 28-fix-startup-crash.patch
+29-euca_conf-sslv3.patch
+30-clock_drift.patch 

=== modified file 'tools/client-policy-template.xml'
--- tools/client-policy-template.xml	2011-05-26 10:21:56 +0000
+++ tools/client-policy-template.xml	2011-09-21 09:10:44 +0000
@@ -57,6 +57,7 @@
 	<rampc:ReceiverCertificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-CERT</rampc:ReceiverCertificate>
 	<rampc:Certificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-CERT</rampc:Certificate>
 	<rampc:PrivateKey>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/CLIENT-KEY</rampc:PrivateKey>
+	<rampc:ClockSkewBuffer>20</rampc:ClockSkewBuffer>
 	<!-- <rampc:TimeToLive>14400</rampc:TimeToLive> -->
 	<!--
 	    <rampc:User>CLIENT-USERNAME</rampc:User>

=== modified file 'tools/euca_conf.in'
--- tools/euca_conf.in	2010-09-27 23:41:14 +0000
+++ tools/euca_conf.in	2011-09-21 09:10:44 +0000
@@ -1096,7 +1096,7 @@
 	    done
 	fi
 	
-	CMD="$WGET -T 10 -t 1 -O - -q --no-check-certificate https://127.0.0.1:8443/register | grep CloudVersion >/dev/null"
+	CMD="$WGET -T 10 -t 1 -O - -q --no-check-certificate --secure-protocol=SSLv3 https://127.0.0.1:8443/register | grep CloudVersion >/dev/null"
     elif [ "$SERVICE" = "CC" ]; then
 	CMD="$WGET -T 10 -t 1 -O - -q http://127.0.0.1:8774/axis2/services/ | grep EucalyptusCC >/dev/null"
     fi

=== modified file 'tools/service-policy-template.xml'
--- tools/service-policy-template.xml	2011-05-26 10:21:56 +0000
+++ tools/service-policy-template.xml	2011-09-21 09:10:44 +0000
@@ -60,6 +60,7 @@
 	<rampc:Certificate>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-CERT</rampc:Certificate>
 	<rampc:PrivateKey>EUCALYPTUS_HOME/var/lib/eucalyptus/keys/SERVER-KEY</rampc:PrivateKey>
 	<!-- <rampc:TimeToLive>14400</rampc:TimeToLive> -->
+	<rampc:ClockSkewBuffer>20</rampc:ClockSkewBuffer>
       </rampc:RampartConfig>
     </wsp:All>
   </wsp:ExactlyOne>

=== modified file 'util/euca_axis.c'
--- util/euca_axis.c	2011-05-26 10:21:56 +0000
+++ util/euca_axis.c	2011-09-21 09:10:44 +0000
@@ -360,7 +360,7 @@
     signed_elems[1] = 1;
 
     /* Regardless of the location of the Timestamp, verify the one that is signed */
-    if(AXIS2_FAILURE == rampart_timestamp_token_validate(env, msg_ctx, signed_node, 0)) {
+    if(AXIS2_FAILURE == rampart_timestamp_token_validate(env, msg_ctx, signed_node, 20)) {
        oxs_error(env, OXS_ERROR_LOCATION, OXS_ERROR_ELEMENT_FAILED, "Validation failed for Timestamp with ID = %s", ref);
       return 1;
     }