def _proxy2server(self):
        hdrs = rhnFlags.get('outputTransportOptions')
        log_debug(3, hdrs)
        size = -1

        # Put the headers into the output connection object
        http_connection = self.responseContext.getConnection()
        for (k, vals) in hdrs.items():
            if k.lower() in ['content_length', 'content-length']:
                try:
                    size = int(vals)
                except ValueError:
                    pass
            if k.lower() in ['content_length', 'content_type']:
                # mod_wsgi modifies incoming headers so we have to transform them back
                k = k.replace('_', '-')
            if not (k.lower()[:2] == 'x-' or
                    k.lower() in [  # all but 'host', and 'via'
                        'accept', 'accept-charset', 'accept-encoding', 'accept-language',
                        'accept-ranges', 'age', 'allow', 'authorization', 'cache-control',
                        'connection', 'content-encoding', 'content-language', 'content-length',
                        'content-location', 'content-md5', 'content-range', 'content-type',
                        'date', 'etag', 'expect', 'expires', 'from', 'if-match',
                        'if-modified-since', 'if-none-match', 'if-range', 'if-unmodified-since',
                        'last-modified', 'location', 'max-forwards', 'pragma', 'proxy-authenticate',
                        'proxy-authorization', 'range', 'referer', 'retry-after', 'server',
                        'te', 'trailer', 'transfer-encoding', 'upgrade', 'user-agent', 'vary',
                        'warning', 'www-authenticate']):
                # filter out header we don't want to send
                continue
            if not isinstance(vals, (ListType, TupleType)):
                vals = [vals]
            for v in vals:
                log_debug(5, "Outgoing header", k, v)
                http_connection.putheader(k, v)
        http_connection.endheaders()

        # Send the body too if there is a body
        if size > 0:
            # reset file to beginning so it can be read again
            self.req.headers_in['wsgi.input'].seek(0, 0)
            if sys.version_info < (2, 6):
                data = self.req.headers_in['wsgi.input'].read(size)
            else:
                data = self.req.headers_in['wsgi.input']
            http_connection.send(data)

        # At this point everything is sent to the server
        # We now wait for the response
        try:
            response = http_connection.getresponse()
        except TimeoutException:
            log_error("Connection timed out")
            return apache.HTTP_GATEWAY_TIME_OUT, None, None
        headers = response.msg
        status = response.status
        # Get the body of the request too - well, just a fd actually
        # in this case, the response object itself.
        bodyFd = response
        return status, headers, bodyFd

def _delete_rpm_group(packageIds):

    references = [
        'rhnChannelPackage',
        'rhnErrataPackage',
        'rhnErrataPackageTMP',
        'rhnPackageChangelogRec',
        'rhnPackageConflicts',
        'rhnPackageFile',
        'rhnPackageObsoletes',
        'rhnPackageProvides',
        'rhnPackageRequires',
        'rhnPackageRecommends',
        'rhnPackageSuggests',
        'rhnPackageSupplements',
        'rhnPackageEnhances',
        'rhnPackageBreaks',
        'rhnPackagePredepends',
        'rhnServerNeededCache',
    ]
    deleteStatement = "delete from %s where package_id = :package_id"
    for table in references:
        h = rhnSQL.prepare(deleteStatement % table)
        count = h.executemany(package_id=packageIds)
        log_debug(3, "Deleted from %s: %d rows" % (table, count))
    deleteStatement = "delete from rhnPackage where id = :package_id"
    h = rhnSQL.prepare(deleteStatement)
    count = h.executemany(package_id=packageIds)
    if count:
        log_debug(2, "DELETED package id %s" % str(packageIds))
    else:
        log_error("No such package id %s" % str(packageIds))
    rhnSQL.commit()

    def entitle(self, server_id, history, virt_type=None):
        """
        Entitle a server according to the entitlements we have configured.
        """
        log_debug(3, self.entitlements)

        entitle_server = rhnSQL.Procedure("rhn_entitlements.entitle_server")
        # TODO: entitle_server calls can_entitle_server, so we're doing this
        # twice for each successful call. Is it necessary for external error
        # handling or can we ditch it?
        can_entitle_server = rhnSQL.Function(
            "rhn_entitlements.can_entitle_server", rhnSQL.types.NUMBER())

        can_ent = None

        history["entitlement"] = ""

        # Do a quick check to see if both virt entitlements are present. (i.e.
        # activation keys stacked together) If so, give preference to the more
        # powerful virtualization platform and remove the regular virt
        # entitlement from the list.
        found_virt = False
        found_virt_platform = False
        for entitlement in self.entitlements:
            if entitlement[0] == VIRT_ENT_LABEL:
                found_virt = True
            elif entitlement[0] == VIRT_PLATFORM_ENT_LABEL:
                found_virt_platform = True

        for entitlement in self.entitlements:
            if virt_type is not None and entitlement[0] in \
                    (VIRT_ENT_LABEL, VIRT_PLATFORM_ENT_LABEL):
                continue

            # If both virt entitlements are present, skip the least powerful:
            if found_virt and found_virt_platform and entitlement[0] == VIRT_ENT_LABEL:
                log_debug(1, "Virtualization and Virtualization Platform " +
                          "entitlements both present.")
                log_debug(1, "Skipping Virtualization.")
                continue

            try:
                can_ent = can_entitle_server(server_id, entitlement[0])
            except rhnSQL.SQLSchemaError, e:
                can_ent = 0

            try:
                # bugzilla #160077, skip attempting to entitle if we cant
                if can_ent:
                    entitle_server(server_id, entitlement[0])
            except rhnSQL.SQLSchemaError, e:
                log_error("Token failed to entitle server", server_id,
                          self.get_names(), entitlement[0], e.errmsg)
                if e.errno == 20220:
                    # ORA-20220: (servergroup_max_members) - Server group membership
                    # cannot exceed maximum membership
                    raise rhnFault(91,
                                   _("Registration failed: RHN Software service entitlements exhausted: %s") % entitlement[0]), None, sys.exc_info()[2]
                # No idea what error may be here...
                raise rhnFault(90, e.errmsg), None, sys.exc_info()[2]

def exitWithTraceback(e, msg, exitnum, mail=0):
    tbOut = StringIO()
    Traceback(mail, ostream=tbOut, with_locals=1)
    log_error(-1, _('ERROR: %s %s: %s') %
              (e.__class__.__name__, msg, e))
    log_error(-1, _('TRACEBACK: %s') % tbOut.getvalue())
    sys.exit(exitnum)

    def autoentitle(self):
        entitlement_hierarchy = ['enterprise_entitled']

        any_base_entitlements = 0

        for entitlement in entitlement_hierarchy:
            try:
                self._entitle(entitlement)
                any_base_entitlements = 1
            except rhnSQL.SQLSchemaError:
                e = sys.exc_info()[1]
                if e.errno == 20287:
                    # ORA-20287: (invalid_entitlement) - The server can not be
                    # entitled to the specified level
                    #
                    # ignore for now, since any_base_entitlements will throw
                    # an error at the end if not set
                    continue

                # Should not normally happen
                log_error("Failed to entitle", self.server["id"], entitlement,
                          e.errmsg)
                raise_with_tb(server_lib.rhnSystemEntitlementException("Unable to entitle"), sys.exc_info()[2])
            except rhnSQL.SQLError:
                e = sys.exc_info()[1]
                log_error("Failed to entitle", self.server["id"], entitlement,
                          str(e))
                raise_with_tb(server_lib.rhnSystemEntitlementException("Unable to entitle"), sys.exc_info()[2])
            else:
                if any_base_entitlements:
                    # All is fine
                    return
                else:
                    raise_with_tb(server_lib.rhnNoSystemEntitlementsException, sys.exc_info()[2])

def check_password(username, password, service):
    global __username, __password
    auth = PAM.pam()
    auth.start(service, username, __pam_conv)

    # Save the username and passwords in the globals, the conversation
    # function needs access to them
    __username = username
    __password = password

    try:
        try:
            auth.authenticate()
            auth.acct_mgmt()
        finally:
            # Something to be always executed - cleanup
            __username = __password = None
    except PAM.error:
        e = sys.exc_info()[1]
        resp, code = e.args[:2]
        log_error("Password check failed (%s): %s" % (code, resp))
        return 0
    except:
        raise_with_tb(rhnException('Internal PAM error'), sys.exc_info()[2])
    else:
        # Good password
        return 1

 def connect(self, reconnect=1):
     log_debug(1, "Connecting to database", self.dbtxt)
     self._fix_environment_vars()
     try:
         self.dbh = self._connect()
     except self.OracleError, e:
         ret = self._get_oracle_error_info(e)
         if isinstance(ret, types.StringType):
             raise sql_base.SQLConnectError(self.dbtxt, -1,
                                            "Unable to connect to database", ret), None, sys.exc_info()[2]
         (errno, errmsg) = ret[:2]
         log_error("Connection attempt failed", errno, errmsg)
         if reconnect:
             # we don't try to reconnect blindly.  We have a list of
             # known "good" failure codes that warrant a reconnect
             # attempt
             if errno in [12547]:  # lost contact
                 return self.connect(reconnect=0)
             err_args = [self.dbtxt, errno, errmsg]
             err_args.extend(list(ret[2:]))
             raise sql_base.SQLConnectError(*err_args), None, sys.exc_info()[2]
         # else, this is a reconnect attempt
         raise sql_base.SQLConnectError(*(
             [self.dbtxt, errno, errmsg,
              "Attempting Re-Connect to the database failed", ] + ret[2:])), None, sys.exc_info()[2]

 def repl_func(self, match_object):
     try:
         return self._repl_func(match_object)
     except ValueError:
         e = sys.exc_info()[1]
         log_error("cfg variable interpolation error", e)
         return match_object.group()

 def connect(self, reconnect=1):
     log_debug(1, "Connecting to database", self.dbtxt)
     self._fix_environment_vars()
     try:
         self.dbh = self._connect()
     except self.OracleError:
         e = sys.exc_info()[1]
         ret = self._get_oracle_error_info(e)
         if isinstance(ret, usix.StringType):
             raise_with_tb(sql_base.SQLConnectError(self.dbtxt, -1,
                                            "Unable to connect to database", ret), sys.exc_info()[2])
         (errno, errmsg) = ret[:2]
         log_error("Connection attempt failed", errno, errmsg)
         if reconnect:
             # we don't try to reconnect blindly.  We have a list of
             # known "good" failure codes that warrant a reconnect
             # attempt
             if errno in [12547]:  # lost contact
                 return self.connect(reconnect=0)
             err_args = [self.dbtxt, errno, errmsg]
             err_args.extend(list(ret[2:]))
             raise_with_tb(sql_base.SQLConnectError(*err_args), sys.exc_info()[2])
         # else, this is a reconnect attempt
         raise sql_base.SQLConnectError(*(
             [self.dbtxt, errno, errmsg,
              "Attempting Re-Connect to the database failed", ] + ret[2:])).with_traceback(sys.exc_info()[2])
     dbh_id = id(self.dbh)
     # Reset the statement cache for this database connection
     self._cursor_class._cursor_cache[dbh_id] = {}

 def _wrapper(self, req, function_name):
     #log_debug(1, "_wrapper", req, function_name)
     if not hasattr(self.server, function_name):
         log_error("%s doesn't have a %s function" %
                   (self.server, function_name))
         return apache.HTTP_NOT_FOUND
     function = getattr(self.server, function_name)
     try:
         log_debug(5, "Calling", function)
         ret = function(req)
     except rhnFault:
         e = sys.exc_info()[1]
         log_debug(4, "rhnFault caught: %s" % (e, ))
         error_string = self._exception_to_text(e)
         error_code = e.code
         self._error_to_headers(req.err_headers_out, error_code, error_string)
         ret = rhnFlags.get("apache-return-code")
         if not ret:
             ret = apache.HTTP_INTERNAL_SERVER_ERROR
         req.status = ret
         log_debug(4, "_wrapper %s exited with apache code %s" %
                   (function_name, ret))
     except rhnSession.ExpiredSessionError:
         e = sys.exc_info()[1]
         # if session expires we catch here and return a forbidden
         # abd make it re-authenticate
         log_debug(4, "Expire Session Error Caught: %s" % (e, ))
         return 403
     except:
         Traceback("server.apacheUploadServer._wrapper", req=req)
         log_error("Unhandled exception")
         return apache.HTTP_INTERNAL_SERVER_ERROR
     return ret

 def auth_system(self, system_id):
     """ System authentication. We override the standard function because
         we need to check additionally if this system_id is entitled for
         proxy functionality.
     """
     log_debug(3)
     server = rhnHandler.auth_system(self, system_id)
     # if it did not blow up, we have a valid server. Check proxy
     # entitlement.
     # XXX: this needs to be moved out of the rhnServer module,
     # possibly in here
     h = rhnSQL.prepare("""
     select 1
     from rhnProxyInfo pi
     where pi.server_id = :server_id
     """)
     h.execute(server_id = self.server_id)
     row = h.fetchone_dict()
     if not row:
         # we require entitlement for this functionality
         log_error("Server not entitled for Proxy", self.server_id)
         raise rhnFault(1002, _(
             'Spacewalk Proxy service not enabled for server profile: "%s"')
                        % server.server["name"])
     # we're fine...
     return server

    def entitle(self, server_id, history, virt_type=None):
        """
        Entitle a server according to the entitlements we have configured.
        """
        log_debug(3, self.entitlements)

        entitle_server = rhnSQL.Procedure("rhn_entitlements.entitle_server")
        # TODO: entitle_server calls can_entitle_server, so we're doing this
        # twice for each successful call. Is it necessary for external error
        # handling or can we ditch it?
        can_entitle_server = rhnSQL.Function(
            "rhn_entitlements.can_entitle_server", rhnSQL.types.NUMBER())

        can_ent = None

        history["entitlement"] = ""

        for entitlement in self.entitlements:
            if virt_type is not None and entitlement[0] == VIRT_ENT_LABEL:
                continue

            try:
                can_ent = can_entitle_server(server_id, entitlement[0])
            except rhnSQL.SQLSchemaError, e:
                can_ent = 0

            try:
                # bugzilla #160077, skip attempting to entitle if we cant
                if can_ent:
                    entitle_server(server_id, entitlement[0])
            except rhnSQL.SQLSchemaError, e:
                log_error("Token failed to entitle server", server_id,
                          self.get_names(), entitlement[0], e.errmsg)
                #No idea what error may be here...
                raise rhnFault(90, e.errmsg), None, sys.exc_info()[2]

    def getPackageErratum(self, system_id, pkg):
        """ Clients v2+ - Get errata for a package given [n,v,r,e,a,...] format

            Sing-along: You say erratum(sing), I say errata(pl)! :)
            IN:  pkg:   [n,v,r,e,s,a,ch,...]
            RET: a hash by errata that applies to this package
        """
        log_debug(5, system_id, pkg)
        if type(pkg) != type([]) or len(pkg) < 7:
            log_error("Got invalid package specification: %s" % str(pkg))
            raise rhnFault(30, _("Expected a package, not: %s") % pkg)
        # Authenticate and decode server id.
        self.auth_system(system_id)
        # log the entry
        log_debug(1, self.server_id, pkg)
        # Stuff the action in the headers:
        transport = rhnFlags.get("outputTransportOptions")
        transport["X-RHN-Action"] = "getPackageErratum"

        name, ver, rel, epoch, arch, size, channel = pkg[:7]
        if epoch in ["", "none", "None"]:
            epoch = None

        # XXX: also, should arch/size/channel ever be used?
        # bug#186996:adding synopsis field to errata info
        # client side changes are needed to access this data.
        h = rhnSQL.prepare(
            """
        select distinct
            e.id            errata_id,
            e.advisory_type errata_type,
            e.advisory      advisory,
            e.topic         topic,
            e.description   description,
            e.synopsis      synopsis
        from
            rhnServerChannel sc,
            rhnChannelPackage cp,
            rhnChannelErrata ce,
            rhnErrata e,
            rhnErrataPackage ep,
            rhnPackage p
        where
            p.name_id = LOOKUP_PACKAGE_NAME(:name)
        and p.evr_id = LOOKUP_EVR(:epoch, :ver, :rel)
        -- map to a channel
        and p.id = cp.package_id
        -- map to an errata as well
        and p.id = ep.package_id
        and ep.errata_id = e.id
        -- the errata and the channel have to be linked
        and e.id = ce.errata_id
        and ce.channel_id = cp.channel_id
        -- and the server has to be subscribed to the channel
        and cp.channel_id = sc.channel_id
        and sc.server_id = :server_id
        """
        )  # " emacs sucks
        h.execute(name=name, ver=ver, rel=rel, epoch=epoch, server_id=str(self.server_id))
        return self._sanitize_result(h)

    def getPackagePath(self, pkgFilename, redirect=0):
        """ OVERLOADS getPackagePath in common/rhnRepository.
            Returns complete path to an RPM file.
        """

        log_debug(3, pkgFilename)
        mappingName = "package_mapping:%s:" % self.channelName
        pickledMapping = self._cacheObj(mappingName, self.channelVersion,
                                        self.__channelPackageMapping, ())

        mapping = cPickle.loads(pickledMapping)

        # If the file name has parameters, it's a different kind of package.
        # Determine the architecture requested so we can construct an
        # appropriate filename.
        if type(pkgFilename) == types.ListType:
            arch = pkgFilename[3]
            if isSolarisArch(arch):
                pkgFilename = "%s-%s-%s.%s.pkg" % \
                    (pkgFilename[0],
                     pkgFilename[1],
                     pkgFilename[2],
                     pkgFilename[3])

        if not mapping.has_key(pkgFilename):
            log_error("Package not in mapping: %s" % pkgFilename)
            raise rhnFault(17, _("Invalid RPM package requested: %s")
                                 % pkgFilename)
        filePath = "%s/%s" % (CFG.PKG_DIR, mapping[pkgFilename])
        log_debug(4, "File path", filePath)
        if not os.access(filePath, os.R_OK):
            log_debug(4, "Package not found locally: %s" % pkgFilename)
            raise NotLocalError(filePath, pkgFilename)
        return filePath

def isAllowedSlave(hostname):
    rhnSQL.initDB()
    if not rhnSQL.fetchone_dict("select 1 from rhnISSSlave where slave = :hostname and enabled = 'Y'",
                                hostname=idn_puny_to_unicode(hostname)):
        log_error('Server "%s" is not enabled for ISS.' % hostname)
        return False
    return True

 def guest_migrated(self, old_host_sid, new_host_sid, guest_sid, guest_uuid):
     try:
         procedure.rhn_entitlements.repoll_virt_guest_entitlements(new_host_sid)
     except rhnSQL.SQLError, e:
         log_error("Error adding entitlement: %s" % str(e))
         # rhnSQL.rollback()
         return

    def _execute_wrapper(self, function, *p, **kw):
        params = ",".join(["%s: %s" % (repr(key), repr(value)) for key, value in kw.items()])
        log_debug(5, 'Executing SQL: "%s" with bind params: {%s}' % (self.sql, params))
        if self.sql is None:
            raise rhnException("Cannot execute empty cursor")
        if self.blob_map:
            blob_content = {}
            for orig_blob_var in self.blob_map.keys():
                new_blob_var = orig_blob_var + "_blob"
                blob_content[new_blob_var] = kw[orig_blob_var]
                kw[new_blob_var] = self.var(cx_Oracle.BLOB)
                del kw[orig_blob_var]
        modified_params = self._munge_args(kw)

        try:
            retval = apply(function, p, kw)
        except self.OracleError, e:
            ret = self._get_oracle_error_info(e)
            if isinstance(ret, types.StringType):
                raise sql_base.SQLError(self.sql, p, kw, ret), None, sys.exc_info()[2]
            (errno, errmsg) = ret[:2]
            if 900 <= errno <= 999:
                # Per Oracle's documentation, SQL parsing error
                raise sql_base.SQLStatementPrepareError(errno, errmsg, self.sql), None, sys.exc_info()[2]
            if errno == 1475:  # statement needs to be reparsed; force a prepare again
                if self.reparsed:  # useless, tried that already. give up
                    log_error("Reparsing cursor did not fix it", self.sql)
                    args = ("Reparsing tried and still got this",) + tuple(ret)
                    raise sql_base.SQLError(*args), None, sys.exc_info()[2]
                self._real_cursor = self.dbh.prepare(self.sql)
                self.reparsed = 1
                apply(self._execute_wrapper, (function,) + p, kw)
            elif 20000 <= errno <= 20999:  # error codes we know we raise as schema errors
                raise sql_base.SQLSchemaError(*ret), None, sys.exc_info()[2]
            raise apply(sql_base.SQLError, ret), None, sys.exc_info()[2]

    def setup_config(self, config, force=0):
        # Figure out the log level
        debug_level = self.options.verbose
        if debug_level is None:
            debug_level = CFG.debug
        self.debug_level = debug_level
        logfile = self.options.logfile
        if logfile is None or logfile == '':
            logfile = CFG.log_file
        initLOG(level=debug_level, log_file=logfile)

        # Get the ssl cert
        ssl_cert = CFG.osa_ssl_cert
        try:
            self.check_cert(ssl_cert)
        except jabber_lib.InvalidCertError:
            e = sys.exc_info()[1]
            log_error("Invalid SSL certificate:", e)
            return 1

        self.ssl_cert = ssl_cert

        rhnSQL.initDB()

        self._username = 'rhn-dispatcher-sat'
        self._password = self.get_dispatcher_password(self._username)
        if not self._password:
            self._password = self.create_dispatcher_password(32)
        self._resource = 'superclient'
        js = config.get('jabber_server')
        self._jabber_servers = [ idn_ascii_to_puny(js) ]

    def _transformKsRequestForBroker(self, req):

        # Get the checksum for the requested resource from the satellite.

        (status, checksum) = self._querySatelliteForChecksum(req)
        if status != apache.OK or not checksum:
            return status

        # If we got this far, we have the checksum.  Create a new URI based on
        # the checksum.

        newURI = self._generateCacheableKickstartURI(req.uri, checksum)
        if not newURI:
            # Couldn't create a cacheable URI, log an error and revert to
            # BZ 158236 behavior.

            log_error('Could not create cacheable ks URI from "%s"' % req.uri)
            return apache.OK

        # Now we must embed the old URI into a header in the original request
        # so that the SSL Redirect has it available if the resource has not
        # been cached yet.  We will also embed a header that holds the new URI,
        # so that the content handler can use it later.

        log_debug(3, "Generated new kickstart URI: %s" % newURI)
        req.headers_in[HEADER_ACTUAL_URI] = req.uri
        req.headers_in[HEADER_EFFECTIVE_URI] = newURI

        return apache.OK

def delete_guests(server_id):
    """
    Callback used after a successful kickstart to remove any guest virtual
    instances, as well as their associated servers.
    """
    # First delete all the guest server objects:
    h = rhnSQL.prepare(_query_lookup_guests_for_host)
    h.execute(server_id=server_id)
    delete_server = rhnSQL.Procedure("delete_server")
    log_debug(4, "Deleting guests")
    while 1:
        row = h.fetchone_dict()
        if not row:
            break
        guest_id = row['virtual_system_id']
        log_debug(4, 'Deleting guest server: %s' % guest_id)
        try:
            if guest_id is not None:
                delete_server(guest_id)
        except rhnSQL.SQLError:
            log_error("Error deleting server: %s" % guest_id)

    # Finally delete all the virtual instances:
    log_debug(4, "Deleting all virtual instances for host")
    h = rhnSQL.prepare(_query_delete_virtual_instances)
    h.execute(server_id=server_id)

    # Commit all changes:
    try:
        rhnSQL.commit()
    except rhnSQL.SQLError:
        e = sys.exc_info()[1]
        log_error("Error committing transaction: %s" % e)
        rhnSQL.rollback()