func newDoBaseStack() (*provider.BaseStack, error) {
	log := logging.NewCustom("test", true)

	testTemplate := `{
    "variable": {
        "username": {
            "default": "testuser"
        }
    },
    "provider": {
        "digitalocean": {
            "token": "${var.digitalocean_access_token}"
        }
    },
    "resource": {
        "digitalocean_droplet": {
            "example": {
                "name": "web-1",
                "image": "ubuntu-14-04-x64",
                "region": "nyc2",
                "size": "512mb",
                "user_data": "sudo apt-get install sl -y\ntouch /tmp/${var.username}.txt"
            }
        }
    }
}`

	template, err := provider.ParseTemplate(testTemplate, log)
	if err != nil {
		return nil, err
	}

	return &provider.BaseStack{
		Provider: doProvider,
		Req: &kite.Request{
			Username: "testuser",
		},
		Arg: &stack.BootstrapRequest{
			Provider:  "digitalocean",
			GroupName: "testgroup",
		},
		Keys: &publickeys.Keys{
			PublicKey: "random-publickey",
		},
		Builder: &provider.Builder{
			Template: template,
		},
		Session: &session.Session{
			Userdata: &userdata.Userdata{
				KlientURL: "https://example-klient.com",
				Keycreator: &keycreator.Key{
					KontrolURL:        "https://example-kontrol.com",
					KontrolPrivateKey: testkeys.Private,
					KontrolPublicKey:  testkeys.Public,
				},
			},
		},
		KlientIDs: stack.KiteMap(map[string]string{}),
	}, nil
}

// NewClient returns client with required properties for accessing remote
// klient.
func NewClient() (*Client, error) {
	// Parse kite.key only once.
	if err := once.Do(newConfig); err != nil {
		return nil, err
	}

	k := kite.New(Name, Version)
	k.Config = config.Copy()

	if debug {
		k.SetLogLevel(kite.DEBUG)
	}

	c := &Client{
		Kite: k,
		Log:  logging.NewCustom(Name, debug),
	}

	c.Log.Debug("starting provider-vagrant in debug mode")

	c.Vagrant = &vagrantapi.Klient{
		Kite:  k,
		Log:   c.Log.New("vagrantapi"),
		Debug: debug,
	}

	return c, nil
}

func main() {
	if accessKey == "" {
		die("AWS_ACCESS_KEY is not set")
	}
	if secretKey == "" {
		die("AWS_SECRET_KEY is not set")
	}
	if hostedZone == "" {
		die("ROUTE53_HOSTED_ZONE is not set")
	}

	opts := &dnsclient.Options{
		Creds:       credentials.NewStaticCredentials(accessKey, secretKey, ""),
		HostedZone:  hostedZone,
		Log:         logging.NewCustom("dnsclient", os.Getenv("ROUTE53_DEBUG") == "1"),
		SyncTimeout: 5 * time.Minute,
	}

	if d, err := time.ParseDuration(os.Getenv("ROUTE53_TIMEOUT")); err == nil {
		opts.SyncTimeout = d
	}

	opts.Log.Debug("Options: %# v", opts)

	var err error
	client, err = dnsclient.NewRoute53Client(opts)
	if err != nil {
		die(err)
	}

	if err := Resources.Main(os.Args[1:]); err != nil {
		die(err)
	}
}

// BaseStack builds new base stack for the given context value.
func (s *Stacker) BaseStack(ctx context.Context) (*BaseStack, error) {
	bs := &BaseStack{
		Planner: &Planner{
			Provider:     s.Provider.Name,
			ResourceType: s.Provider.resourceName(),
			Log:          s.Log,
		},
		Provider:  s.Provider,
		KlientIDs: make(stack.KiteMap),
		Klients:   make(map[string]*DialState),
		TunnelURL: s.TunnelURL,
		Keys:      s.SSHKey,
	}

	var ok bool
	if bs.Req, ok = request.FromContext(ctx); !ok {
		return nil, errors.New("request not available in context")
	}

	req, ok := stack.TeamRequestFromContext(ctx)
	if !ok {
		return nil, errors.New("team request not available in context")
	}

	if bs.Session, ok = session.FromContext(ctx); !ok {
		return nil, errors.New("session not available in context")
	}

	bs.Log = s.Log.New(req.GroupName)

	if traceID, ok := stack.TraceFromContext(ctx); ok {
		bs.Log = logging.NewCustom("kloud-"+req.Provider, true).New(traceID)
		bs.TraceID = traceID
	}

	if keys, ok := publickeys.FromContext(ctx); ok {
		bs.Keys = keys
	}

	if ev, ok := eventer.FromContext(ctx); ok {
		bs.Eventer = ev
	}

	builderOpts := &BuilderOptions{
		Log:       s.Log.New("stackplan"),
		CredStore: s.CredStore,
	}

	bs.Builder = NewBuilder(builderOpts)

	if err := bs.Builder.BuildTeam(req.GroupName); err != nil {
		return nil, err
	}

	if !bs.Builder.Team.IsSubActive() {
		return nil, stack.NewError(stack.ErrTeamSubIsNotActive)
	}

	return bs, nil
}

func (s *Stacker) BuildBaseMachine(ctx context.Context, m *models.Machine) (*BaseMachine, error) {
	req, ok := request.FromContext(ctx)
	if !ok {
		return nil, errors.New("request context is not available")
	}

	bm := &BaseMachine{
		Machine: m,
		Session: &session.Session{
			DB:       s.DB,
			Kite:     s.Kite,
			Userdata: s.Userdata,
			Log:      s.Log.New(m.ObjectId.Hex()),
		},
		Credential: s.Provider.newCredential(),
		Bootstrap:  s.Provider.newBootstrap(),
		Metadata:   s.Provider.newMetadata(nil),
		Req:        req,
		Provider:   s.Provider.Name,
		Debug:      s.Debug,
	}

	// NOTE(rjeczalik): "internal" method is used by (*Queue).CheckAWS
	if req.Method != "internal" {
		// get user model which contains user ssh keys or the list of users that
		// are allowed to use this machine
		if len(m.Users) == 0 {
			return nil, errors.New("permitted users list is empty")
		}

		// get the user from the permitted list. If the list contains more than one
		// allowed person, fetch the one that is the same as requesterName, if
		// not pick up the first one.
		var err error
		bm.User, err = modelhelper.GetPermittedUser(req.Username, bm.Users)
		if err != nil {
			return nil, err
		}

		if err := s.ValidateUser(bm.User, bm.Users, req); err != nil {
			return nil, err
		}
	}

	if traceID, ok := stack.TraceFromContext(ctx); ok {
		bm.Log = logging.NewCustom("kloud-"+s.Provider.Name, true).New(m.ObjectId.Hex()).New(traceID)
		bm.Debug = true
		bm.TraceID = traceID
	}

	ev, ok := eventer.FromContext(ctx)
	if ok {
		bm.Eventer = ev
	}

	s.Log.Debug("BaseMachine: %+v", bm)

	return bm, nil
}

// NewIterOptions Sets the default values for iterOptions
func NewIterOptions() *iterOptions {
	return &iterOptions{
		Skip:       0,
		Limit:      1000,
		Filter:     modelhelper.Selector{},
		RetryCount: 50,
		Log:        logging.NewCustom("Iter", false),
	}
}

// NewClient gives new, unstarted tunnel client for the given options.
func NewClient(opts *ClientOptions) (*Client, error) {
	optsCopy := *opts

	if optsCopy.Log == nil {
		optsCopy.Log = logging.NewCustom("tunnelclient", optsCopy.Debug)
	}

	// TODO(rjeczalik): fix production to use WebSocket by default
	//
	// BUG(rjeczalik): starting a kite that is not registered to
	// kontrol will prevent the kite from updating it's keypair,
	// when it changes in kontrol - the only fix is to restart
	// kite process.
	k := kite.New("tunnelclient", "0.0.1")
	k.Config = optsCopy.Kite.Config.Copy()
	k.Config.Transport = config.WebSocket

	c := &Client{
		kite:          k,
		opts:          &optsCopy,
		tunnelKiteURL: optsCopy.tunnelKiteURL(),
		stateChanges:  make(chan *tunnel.ClientStateChange, 128),
		regserv:       make(chan map[string]*Tunnel, 1),
		services:      make(Services),
		routes:        make(map[int]string),
	}

	// If VirtualHost was configured, try to connect to it first.
	if c.opts.LastVirtualHost != "" {
		c.tunnelKiteURL = fmt.Sprintf("http://%s/kite", c.opts.LastVirtualHost)
		c.connected = &RegisterResult{
			VirtualHost: c.opts.LastVirtualHost,
			ServerAddr:  c.opts.LastVirtualHost,
		}
	}

	c.kite.ClientFunc = httputil.ClientFunc(opts.Debug)

	cfg := &tunnel.ClientConfig{
		FetchIdentifier: c.fetchIdent,
		FetchServerAddr: c.fetchServerAddr,
		FetchLocalAddr:  c.fetchLocalAddr,
		LocalAddr:       c.opts.LocalAddr,
		Debug:           c.opts.Debug,
		Log:             c.opts.Log.New("transport"),
		StateChanges:    c.stateChanges,
	}

	client, err := tunnel.NewClient(cfg)
	if err != nil {
		return nil, err
	}

	c.client = client

	return c, nil
}

// Config creates new gateway.Config value from the given flags.
func (f *Flags) Config() *keygen.Config {
	return &keygen.Config{
		AccessKey:  f.AccessKey,
		SecretKey:  f.SecretKey,
		Bucket:     f.Bucket,
		AuthExpire: f.Expire,
		Region:     f.Region,
		Log:        logging.NewCustom("gateway-test", testing.Verbose()),
	}
}

// Action is an entry point for "vagrant" subcommand.
func (v *Vagrant) Action(args []string) error {
	k, err := kloudClient()
	if err != nil {
		return err
	}
	vapi := &vagrantapi.Klient{
		Kite:  k.LocalKite,
		Log:   logging.NewCustom("vagrant", flagDebug),
		Debug: true,
	}

	ctx := context.Background()
	ctx = context.WithValue(ctx, vapiKey, vapi)
	v.Resource.ContextFunc = func([]string) context.Context { return ctx }
	return v.Resource.Main(args)
}

func main() {
	conf := &terraformer.Config{}

	mc := multiconfig.New()
	mc.Loader = multiconfig.MultiLoader(
		&multiconfig.TagLoader{},
		&multiconfig.EnvironmentLoader{},
		&multiconfig.EnvironmentLoader{Prefix: "KONFIG_TERRAFORMER"},
		&multiconfig.FlagLoader{},
	)

	mc.MustLoad(conf)

	if !conf.TerraformDebug {
		// hashicorp.terraform outputs many logs, discard them
		log.SetOutput(ioutil.Discard)
	}

	log := logging.NewCustom(terraformer.Name, conf.Debug)

	// init terraformer
	t, err := terraformer.New(conf, log)
	if err != nil {
		log.Fatal(err.Error())
	}

	k, err := terraformer.NewKite(t, conf)
	if err != nil {
		log.Fatal(err.Error())
	}

	if err := k.RegisterForever(k.RegisterURL(true)); err != nil {
		log.Fatal(err.Error())
	}

	go k.Run()
	<-k.ServerReadyNotify()
	log.Debug("Kite Started Listening")

	// terraformer can only be closed with signals, wait for any signal
	if err := t.Wait(); err != nil {
		log.Error("Err after waiting terraformer %s", err)
	}

	k.Close()
}

func (cmd *GroupFixDomain) Valid() error {
	if err := cmd.groupValues.Valid(); err != nil {
		return err
	}

	if len(cmd.values) == 0 {
		return errors.New("no usernames provided for -users flag")
	}

	if cmd.machine == "" {
		return errors.New("no value provided for -machine flag")
	}

	if cmd.env == "" {
		return errors.New("no value provided for -env flag")
	}

	zone := dnsZones[cmd.env]
	if zone == "" {
		return errors.New("invalid value provided for -env flag")
	}

	if cmd.access == "" {
		return errors.New("no value provided for -access flag")
	}

	if cmd.secret == "" {
		return errors.New("no value provided for -secret flag")
	}

	dnsOpts := &dnsclient.Options{
		Creds:      credentials.NewStaticCredentials(cmd.access, cmd.secret, ""),
		HostedZone: zone,
		Log:        logging.NewCustom("dns", flagDebug),
	}

	dns, err := dnsclient.NewRoute53Client(dnsOpts)
	if err != nil {
		return err
	}

	cmd.dns = dns

	return nil
}

func TestMain(m *testing.M) {
	rand.Seed(time.Now().UnixNano() + int64(os.Getpid()))
	argsTesting, argsConfig := splitArgs()
	flag.CommandLine.Parse(argsTesting)

	l := multiconfig.MultiLoader(
		&multiconfig.EnvironmentLoader{
			Prefix: "e2etest",
		},
		&multiconfig.FlagLoader{
			EnvPrefix: "e2etest",
			Args:      argsConfig,
		},
	)

	if err := l.Load(&Test); err != nil {
		die("unable to load configuration", err)
	}

	Test.Log = logging.NewCustom("test", Test.Debug)
	Test.setDefaults()

	if Test.Debug {
		fmt.Printf("e2etest.Test = %s\n", &Test)
	}

	ktrl := NewKontrol()
	ktrl.Start()

	exit := m.Run()

	if !Test.NoClean {
		Test.cleanupRoute53()
	}

	ktrl.Close()

	os.Exit(exit)
}

func newSession(conf *Config, k *kite.Kite) (*session.Session, error) {
	c := credentials.NewStaticCredentials(conf.AWSAccessKeyId, conf.AWSSecretAccessKey, "")

	kontrolPrivateKey, kontrolPublicKey := kontrolKeys(conf)

	klientFolder := "development/latest"
	if conf.ProdMode {
		k.Log.Info("Prod mode enabled")
		klientFolder = "production/latest"
	}

	k.Log.Info("Klient distribution channel is: %s", klientFolder)

	// Credential belongs to the `koding-kloud` user in AWS IAM's
	sess := &session.Session{
		DB:   modelhelper.Mongo,
		Kite: k,
		Userdata: &userdata.Userdata{
			Keycreator: &keycreator.Key{
				KontrolURL:        getKontrolURL(conf.KontrolURL),
				KontrolPrivateKey: kontrolPrivateKey,
				KontrolPublicKey:  kontrolPublicKey,
			},
			KlientURL: conf.KlientURL,
			TunnelURL: conf.TunnelURL,
			Bucket:    userdata.NewBucket("koding-klient", klientFolder, c),
		},
		Terraformer: &terraformer.Options{
			Endpoint:  "http://127.0.0.1:2300/kite",
			SecretKey: conf.TerraformerSecretKey,
			Kite:      k,
		},
		Log: logging.NewCustom("kloud", conf.DebugMode),
	}

	sess.DNSStorage = dnsstorage.NewMongodbStorage(sess.DB)

	return sess, nil
}

func withKite(t *testing.T, f func(k *kite.Kite) error) {
	conf := &Config{}
	// Load the config, reads environment variables or from flags
	multiconfig.New().MustLoad(conf)

	// enable test mode
	conf.Test = true

	if !conf.Debug {
		// hashicorp.terraform outputs many logs, discard them
		log.SetOutput(ioutil.Discard)
	}

	log := logging.NewCustom(Name, conf.Debug)

	// init terraformer
	tr, err := New(conf, log)
	if err != nil {
		t.Errorf("err while creating terraformer %s", err.Error())
	}

	// init terraformer's kite
	k, err := NewKite(tr, conf)
	if err != nil {
		t.Errorf(err.Error())
	}
	k.Config.DisableAuthentication = true
	go k.Run()
	<-k.ServerReadyNotify()

	err = f(k)
	tr.Close()
	tr.Wait()
	k.Close()
	if err != nil {
		t.Errorf("failed with %s", err.Error())
	}
}

func kloudWithProviders(a *awsprovider.Provider, s *softlayer.Provider) *kloud.Kloud {
	kloudLogger := logging.NewCustom("kloud", true)
	sess := &session.Session{
		DB:         a.DB,
		Kite:       a.Kite,
		DNSClient:  a.DNSClient,
		DNSStorage: a.DNSStorage,
		AWSClients: a.EC2Clients,
		Userdata:   a.Userdata,
		Log:        kloudLogger,
	}

	kld := kloud.New()
	kld.ContextCreator = func(ctx context.Context) context.Context {
		return session.NewContext(ctx, sess)
	}

	userPrivateKey, userPublicKey := userMachinesKeys(
		os.Getenv("KLOUD_USER_PUBLICKEY"),
		os.Getenv("KLOUD_USER_PRIVATEKEY"),
	)

	kld.PublicKeys = &publickeys.Keys{
		KeyName:    publickeys.DeployKeyName,
		PrivateKey: userPrivateKey,
		PublicKey:  userPublicKey,
	}
	kld.Log = kloudLogger
	kld.DomainStorage = p.DNSStorage
	kld.Domainer = p.DNSClient
	kld.Locker = p
	kld.AddProvider("koding", p)
	kld.AddProvider("aws", a)
	kld.AddProvider("softlayer", s)
	return kld
}

	"time"

	"koding/kites/kloud/api/amazon"

	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/credentials"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/s3"
	"github.com/aws/aws-sdk-go/service/sts"
	"github.com/koding/kite"
	"github.com/koding/logging"
)

// TODO(rjeczalik): refactor Server/Provider to support multiple auth types (AuthRequest.Type)

var defaultLog = logging.NewCustom("keygen", false)

// DefaultBefore is a default behavior for Config.BeforeFunc field.
var DefaultBefore = func(expire time.Time) bool {
	return expire.Before(time.Now())
}

// Config defines configuration for Server, Provider and UserBucket types.
//
// TODO(rjeczalik): Split into ServerConfig / ClientConfig.
type Config struct {
	RootUser string // kite user allowed to impersonate other users; "koding" by default

	// S3 auth configuration
	AccessKey string // AWS access key; required
	SecretKey string // AWS secret key; required

package credential

import (
	"fmt"
	"net/http"
	"net/url"
	"sync"

	"koding/db/mongodb"
	"koding/kites/kloud/utils/object"

	"github.com/hashicorp/go-multierror"
	"github.com/koding/logging"
)

var defaultLog = logging.NewCustom("credential", false)

type validator interface {
	Valid() error
}

// NotFoundError represents an error fetching credentials.
//
// Identfiers of credentials that are missing in the underlying
// storage are listed in the Identifiers field.
type NotFoundError struct {
	Identifiers []string
	Err         error
}

// Error implements the built-in error interface.

package httputil

import (
	"fmt"
	"net"
	"net/http"
	"runtime/debug"
	"sync"
	"time"

	"github.com/koding/logging"
)

var defaultLog = logging.NewCustom("dialer", false)

type Dialer struct {
	*net.Dialer

	mu    sync.Mutex // protects conns
	once  sync.Once
	conns map[*Conn]struct{}
	tick  *time.Ticker
	opts  *ClientConfig
}

func NewDialer(cfg *ClientConfig) *Dialer {
	return &Dialer{
		Dialer: &net.Dialer{
			Timeout:   cfg.DialTimeout,
			KeepAlive: cfg.KeepAlive,
		},

	"net"
	"net/http"
	"net/http/httptest"
	"os"
	"runtime"
	"strings"
	"sync/atomic"
	"time"

	"github.com/koding/logging"

	"koding/klient/tunnel/tlsproxy/pem"
	"koding/tools/util"
)

var defaultLog = logging.NewCustom("tlsproxy", false)

// Init adds local route for pem.Hostname to 127.0.0.1 address.
func Init() error {
	if runtime.GOOS == "windows" {
		return errors.New("not implemented")
	}

	f, err := os.OpenFile("/etc/hosts", os.O_RDWR|os.O_APPEND, 0644)
	if err != nil {
		return err
	}

	scanner := bufio.NewScanner(f)
	for scanner.Scan() {
		fields := strings.Fields(scanner.Text())

func TestUpdater(t *testing.T) {
	const timeout = 250 * time.Millisecond

	events := make(chan *mount.Event)
	defer close(events)

	s := StartUpdateServer()

	u := &app.Updater{
		Endpoint:    s.URL().String(),
		Interval:    50 * time.Millisecond,
		Log:         logging.NewCustom("updater", true),
		MountEvents: events,
	}

	go u.Run()

	if err := s.WaitForLatestReq(timeout); err != nil {
		t.Fatal(err)
	}

	// Send a mouting event and ensure no
	// update attempt was made afterwards.
	events <- &mount.Event{
		Path: "/path1",
		Type: mount.EventMounting,
	}

	// From this point update server will mark every latest request as illegal.
	s.Enable(false)

	if err := s.WaitForLatestReq(timeout); err == nil {
		t.Fatal("expected to timeout waiting for latest with disabled autoupdates")
	}

	// Send event that mouting succeeded, still no update requests expected.
	events <- &mount.Event{
		Path: "/path1",
		Type: mount.EventMounted,
	}

	if err := s.WaitForLatestReq(timeout); err == nil {
		t.Fatal("expected to timeout waiting for latest with disabled autoupdates")
	}

	// Send unmount event, but for different path that was previously reported
	// as mounted - this event should be ignored, autoupdates still disabled.
	events <- &mount.Event{
		Path: "/pathX",
		Type: mount.EventUnmounted,
	}

	// Only confirmed umount enables autoupdate, since unmounting
	// can traisition to failed - this event also does not enable autoupdates.
	events <- &mount.Event{
		Path: "/path1",
		Type: mount.EventUnmounting,
	}

	if err := s.WaitForLatestReq(timeout); err == nil {
		t.Fatal("expected to timeout waiting for latest with disabled autoupdates")
	}

	// Send unmount event for previous mount and expect autoupdates to turn on.
	events <- &mount.Event{
		Path: "/path1",
		Type: mount.EventUnmounted,
	}

	s.Enable(true)

	if err := s.WaitForLatestReq(timeout); err != nil {
		t.Fatal(err)
	}

	// Send mounting event, expect autoupdates to turn off, send the mount
	// was failed and expect the autoupdates to turn on again.
	events <- &mount.Event{
		Path: "/path1",
		Type: mount.EventMounting,
	}

	s.Enable(false)

	if err := s.WaitForLatestReq(timeout); err == nil {
		t.Fatal("expected to timeout waiting for latest with disabled autoupdates")
	}

	events <- &mount.Event{
		Path: "/path1",
		Type: mount.EventMounting,
		Err:  errors.New("mount failed"),
	}

	s.Enable(true)

	if err := s.WaitForLatestReq(timeout); err != nil {
		t.Fatal(err)
	}

//.........这里部分代码省略.........