def delete_router(self, tenant_id):
        is_router = False
        ports = self.driver.shell.network_manager.list_ports()
        ports = ports['ports']
        networks = self.driver.shell.network_manager.list_networks()
        networks = networks['networks']

        # find the subnetwork ID for removing the interface related with private network
        # TOPOLOGY: Public Network -- Router -- Private Network -- VM Instance(s)
        for port in ports:
            if (port.get('tenant_id') == tenant_id) and \
               (port.get('device_owner') == 'network:router_interface'):
                router_id = port.get('device_id')
                port_net_id = port.get('network_id')
        for network in networks:
            if network.get('tenant_id') == tenant_id:
                net_id = network.get('id')
                if port_net_id == net_id:
                    sbnet_ids = network.get('subnets')
                    is_router = True

        if is_router:
            # remove the router's interface which is related with private network
            if sbnet_ids:
                body = {'subnet_id': sbnet_ids[0]}
                self.driver.shell.network_manager.remove_interface_router(
                                                  router=router_id, body=body)
            # remove the router's interface which is related with public network
            self.driver.shell.network_manager.remove_gateway_router(router=router_id)
            # delete the router
            self.driver.shell.network_manager.delete_router(router=router_id)
            logger.info("Deleted the router: Router ID [%s]" % router_id)
        return 1

    def actual_caller_hrn (self):
        """a helper method used by some API calls like e.g. Allocate
        to try and find out who really is the original caller
        
        This admittedly is a bit of a hack, please USE IN LAST RESORT
        
        This code uses a heuristic to identify a delegated credential

        A first known restriction if for traffic that gets through a slice manager
        in this case the hrn reported is the one from the last SM in the call graph
        which is not at all what is meant here"""

        caller_hrn = self.get_gid_caller().get_hrn()
        issuer_hrn = self.get_signature().get_issuer_gid().get_hrn()
        subject_hrn = self.get_gid_object().get_hrn()
        # if we find that the caller_hrn is an immediate descendant of the issuer, then
        # this seems to be a 'regular' credential
        if caller_hrn.startswith(issuer_hrn): 
            actual_caller_hrn=caller_hrn
        # else this looks like a delegated credential, and the real caller is the issuer
        else:
            actual_caller_hrn=issuer_hrn
        logger.info("actual_caller_hrn: caller_hrn=%s, issuer_hrn=%s, returning %s"
                    %(caller_hrn,issuer_hrn,actual_caller_hrn))
        return actual_caller_hrn

def init_server():
    logger = logging.getLogger('EucaAggregate')
    fileHandler = logging.FileHandler('/var/log/euca.log')
    fileHandler.setFormatter(logging.Formatter('%(asctime)s - %(levelname)s - %(message)s'))
    logger.addHandler(fileHandler)
    fileHandler.setLevel(logging.DEBUG)
    logger.setLevel(logging.DEBUG)

    configParser = ConfigParser()
    configParser.read(['/etc/sfa/eucalyptus_aggregate.conf', 'eucalyptus_aggregate.conf'])
    if len(configParser.sections()) < 1:
        logger.error('No cloud defined in the config file')
        raise Exception('Cannot find cloud definition in configuration file.')

    # Only read the first section.
    cloudSec = configParser.sections()[0]
    cloud['name'] = cloudSec
    cloud['access_key'] = configParser.get(cloudSec, 'access_key')
    cloud['secret_key'] = configParser.get(cloudSec, 'secret_key')
    cloud['cloud_url']  = configParser.get(cloudSec, 'cloud_url')
    cloudURL = cloud['cloud_url']
    if cloudURL.find('https://') >= 0:
        cloudURL = cloudURL.replace('https://', '')
    elif cloudURL.find('http://') >= 0:
        cloudURL = cloudURL.replace('http://', '')
    (cloud['ip'], parts) = cloudURL.split(':')

    # Create image bundles
    images = getEucaConnection().get_all_images()
    cloud['images'] = images
    cloud['imageBundles'] = {}
    for i in images:
        if i.type != 'machine' or i.kernel_id is None: continue
        name = os.path.dirname(i.location)
        detail = {'imageID' : i.id, 'kernelID' : i.kernel_id, 'ramdiskID' : i.ramdisk_id}
        cloud['imageBundles'][name] = detail

    # Initialize sqlite3 database and tables.
    dbPath = '/etc/sfa/db'
    dbName = 'euca_aggregate.db'

    if not os.path.isdir(dbPath):
        logger.info('%s not found. Creating directory ...' % dbPath)
        os.mkdir(dbPath)

    conn = connectionForURI('sqlite://%s/%s' % (dbPath, dbName))
    sqlhub.processConnection = conn
    Slice.createTable(ifNotExists=True)
    EucaInstance.createTable(ifNotExists=True)
    Meta.createTable(ifNotExists=True)

    # Start the update process to keep track of the meta data
    # about Eucalyptus instance.
    Process(target=updateMeta).start()

    # Make sure the schema exists.
    if not os.path.exists(EUCALYPTUS_RSPEC_SCHEMA):
        err = 'Cannot location schema at %s' % EUCALYPTUS_RSPEC_SCHEMA
        logger.error(err)
        raise Exception(err)

    def node_to_rspec_node(self, node, options={}):
        rspec_node = NodeElement()
        site=self.driver.testbedInfo
        rspec_node['component_id'] = hostname_to_urn(self.driver.hrn, site['name'], node['hostname'])
        rspec_node['component_name'] = node['hostname']
        rspec_node['ip'] = node['ip']
        rspec_node['protocol'] = node['protocol']     
        rspec_node['port'] = node['port']                
        rspec_node['component_manager_id'] = Xrn(self.driver.hrn, 'authority+cm').get_urn()
        rspec_node['authority_id'] = hrn_to_urn(unigetestbedXrn.site_hrn(self.driver.hrn, site['name']), 'authority+sa')
        #distinguish between Shared and Reservable nodes
        rspec_node['exclusive'] = 'false'

        rspec_node['hardware_types'] = [HardwareType({'name': 'endpoint'}),
                                        HardwareType({'name': 'sensor'})]
        
        resources = []
        for resource in node['resources']:
            resources.append(Resource({'name':resource.get('name'),'path':resource.get('path'),
                                       'type':resource.get('type'),
                                       'unit':resource.get('unit'),
                                       'data_type':resource.get('datatype')}))
        
        rspec_node['resources'] = resources
        logger.info(rspec_node)
        
        
        if site['longitude'] and site['latitude']:
            location = Location({'longitude': site['longitude'], 'latitude': site['latitude'], 'country': 'unknown'})
            rspec_node['location'] = location
        
        logger.info(rspec_node);        
        return rspec_node

    def get_euca_connection(self, project_name=None):
        if not has_boto:
            logger.info('Unable to access EC2 API - boto library not found.')
            return None

        if not self.access_key or not self.secret_key:
            self.init_context(project_name)
        
        url = self.config.SFA_NOVA_API_URL
        host = None
        port = None    
        path = "/"
        use_ssl = False
        # Split the url into parts 
        if url.find('https://') >= 0:
            use_ssl  = True
            url = url.replace('https://', '')
        elif url.find('http://') >= 0:
            use_ssl  = False
            url = url.replace('http://', '')
        parts = url.split(':')
        host = parts[0]
        if len(parts) > 1:
            parts = parts[1].split('/')
            port = int(parts[0])
            parts = parts[1:]
            path = '/'+'/'.join(parts)
        return boto.connect_ec2(aws_access_key_id=self.access_key,
                                aws_secret_access_key=self.secret_key,
                                is_secure=use_ssl,
                                region=RegionInfo(None, 'eucalyptus', host),
                                host=host,
                                port=port,
                                path=path) 

    def reserveInstance(self, botoConn, pubKeys):
        logger = logging.getLogger('EucaAggregate')
        logger.info('Reserving an instance: image: %s, kernel: ' \
                    '%s, ramdisk: %s, type: %s, key: %s' % \
                    (self.image_id, self.kernel_id, self.ramdisk_id,
                    self.inst_type, self.key_pair))

        # XXX The return statement is for testing. REMOVE in production
        #return

        try:
            reservation = botoConn.run_instances(self.image_id,
                                                 kernel_id = self.kernel_id,
                                                 ramdisk_id = self.ramdisk_id,
                                                 instance_type = self.inst_type,
                                                 key_name  = self.key_pair,
                                                 user_data = pubKeys)
            for instance in reservation.instances:
                self.instance_id = instance.id

        # If there is an error, destroy itself.
        except EC2ResponseError, ec2RespErr:
            errTree = ET.fromstring(ec2RespErr.body)
            msg = errTree.find('.//Message')
            logger.error(msg.text)
            self.destroySelf()

 def update_pis (self, pi_hrns, dbsession):
     # strip that in case we have <researcher> words </researcher>
     pi_hrns = [ x.strip() for x in pi_hrns ]
     request = dbsession.query (RegUser).filter(RegUser.hrn.in_(pi_hrns))
     logger.info ("RegAuthority.update_pis: %d incoming pis, %d matches found"%(len(pi_hrns),request.count()))
     pis = dbsession.query (RegUser).filter(RegUser.hrn.in_(pi_hrns)).all()
     self.reg_pis = pis

 def update_researchers (self, researcher_hrns, dbsession):
     # strip that in case we have <researcher> words </researcher>
     researcher_hrns = [ x.strip() for x in researcher_hrns ]
     request = dbsession.query (RegUser).filter(RegUser.hrn.in_(researcher_hrns))
     logger.info ("RegSlice.update_researchers: %d incoming researchers, %d matches found"%(len(researcher_hrns),request.count()))
     researchers = dbsession.query (RegUser).filter(RegUser.hrn.in_(researcher_hrns)).all()
     self.reg_researchers = researchers

def install_peer_certs(server_key_file, server_cert_file):
    """
    Attempt to install missing trusted gids and db records for 
    our federated interfaces
    """
    # Attempt to get any missing peer gids
    # There should be a gid file in /etc/sfa/trusted_roots for every
    # peer registry found in in the registries.xml config file. If there
    # are any missing gids, request a new one from the peer registry.
    api = SfaAPI(key_file=server_key_file, cert_file=server_cert_file)
    registries = Registries()
    aggregates = Aggregates()
    interfaces = dict(registries.items() + aggregates.items())
    gids_current = api.auth.trusted_cert_list
    hrns_current = [gid.get_hrn() for gid in gids_current]
    hrns_expected = set([hrn for hrn in interfaces])
    new_hrns = set(hrns_expected).difference(hrns_current)
    # gids = self.get_peer_gids(new_hrns) + gids_current
    peer_gids = []
    if not new_hrns:
        return

    trusted_certs_dir = api.config.get_trustedroots_dir()
    for new_hrn in new_hrns:
        if not new_hrn:
            continue
        # the gid for this interface should already be installed
        if new_hrn == api.config.SFA_INTERFACE_HRN:
            continue
        try:
            # get gid from the registry
            url = interfaces[new_hrn].get_url()
            interface = interfaces[new_hrn].get_server(server_key_file, server_cert_file, timeout=30)
            # skip non sfa aggregates
            server_version = api.get_cached_server_version(interface)
            if "sfa" not in server_version:
                logger.info("get_trusted_certs: skipping non sfa aggregate: %s" % new_hrn)
                continue

            trusted_gids = interface.get_trusted_certs()
            if trusted_gids:
                # the gid we want should be the first one in the list,
                # but lets make sure
                for trusted_gid in trusted_gids:
                    # default message
                    message = "interface: %s\t" % (api.interface)
                    message += "unable to install trusted gid for %s" % (new_hrn)
                    gid = GID(string=trusted_gids[0])
                    peer_gids.append(gid)
                    if gid.get_hrn() == new_hrn:
                        gid_filename = os.path.join(trusted_certs_dir, "%s.gid" % new_hrn)
                        gid.save_to_file(gid_filename, save_parents=True)
                        message = "installed trusted cert for %s" % new_hrn
                    # log the message
                    api.logger.info(message)
        except:
            message = "interface: %s\tunable to install trusted gid for %s" % (api.interface, new_hrn)
            api.logger.log_exc(message)
    # doesnt matter witch one
    update_cert_records(peer_gids)

    def get_rspec(self, slice_xrn=None, version = None, options={}):

        version_manager = VersionManager()
        version = version_manager.get_version(version)
        if not slice_xrn:
            rspec_version = version_manager._get_version(version.type, version.version, 'ad')
        else:
            rspec_version = version_manager._get_version(version.type, version.version, 'manifest')

        slice, slivers = self.get_slice_and_slivers(slice_xrn)
        rspec = RSpec(version=rspec_version, user_options=options)
        if slice and 'expires' in slice:
            rspec.xml.set('expires',  datetime_to_string(utcparse(slice['expires'])))

        nodes = self.get_nodes(slice_xrn, slice, slivers, options)
        rspec.version.add_nodes(nodes)
        # add sliver defaults
        default_sliver = slivers.get(None, [])
        if default_sliver:
            default_sliver_attribs = default_sliver.get('tags', [])
            for attrib in default_sliver_attribs:
                 logger.info(attrib)
                 rspec.version.add_default_sliver_attribute(attrib['tagname'], attrib['value'])
        
        return rspec.toxml()

 def init_compute_manager_conn(self):
     from sfa.util.config import Config 
     import sfa.openstack.client as os_client
     opts = os_client.parse_accrc(Config().SFA_NOVA_NOVARC)
     self.shell.compute_manager.connect( username=opts.get('OS_USERNAME'),  \
                                         tenant=opts.get('OS_TENANT_NAME'), \
                                         password=opts.get('OS_PASSWORD')   )
     logger.info( "Initialize Openstack connection from novarc file." )

 def createCred(credString=None, credFile=None):
     if not credString and not credFile:
         raise Exception("CredentialFactory.createCred called with no argument")
     if credFile:
         try:
             credString = open(credFile).read()
         except Exception, e:
             logger.info("Error opening credential file %s: %s" % credFile, e)
             return None

        def func(*args, **kwds):
            if name not in FdShell.direct_calls:
                raise Exception, "Illegal method call %s for FEDERICA driver"%(name)
            logger.info("Issuing %s args=%s kwds=%s to federica"%\
                            (name,args,kwds))
#            result=getattr(self.proxy, "AggregateManager.%s"%name)(credential, *args, **kwds)
            result=getattr(self.proxy, "AggregateManager.%s"%name)(*args, **kwds)
            logger.debug('FdShell %s (%s) returned ... '%(name,name))
            return result

 def update_pis (self, pi_hrns):
     # don't ruin the import of that file in a client world
     from sfa.storage.alchemy import dbsession
     # strip that in case we have <researcher> words </researcher>
     pi_hrns = [ x.strip() for x in pi_hrns ]
     request = dbsession.query (RegUser).filter(RegUser.hrn.in_(pi_hrns))
     logger.info ("RegAuthority.update_pis: %d incoming pis, %d matches found"%(len(pi_hrns),request.count()))
     pis = dbsession.query (RegUser).filter(RegUser.hrn.in_(pi_hrns)).all()
     self.reg_pis = pis

 def update_researchers (self, researcher_hrns):
     # don't ruin the import of that file in a client world
     from sfa.storage.alchemy import dbsession
     # strip that in case we have <researcher> words </researcher>
     researcher_hrns = [ x.strip() for x in researcher_hrns ]
     request = dbsession.query (RegUser).filter(RegUser.hrn.in_(researcher_hrns))
     logger.info ("RegSlice.update_researchers: %d incoming researchers, %d matches found"%(len(researcher_hrns),request.count()))
     researchers = dbsession.query (RegUser).filter(RegUser.hrn.in_(researcher_hrns)).all()
     self.reg_researchers = researchers

    def scan(self,interfaces,graph):
        if not isinstance(interfaces,list):
            interfaces=[interfaces]

        # remember node to interface mapping
        node2interface={}
        # add entry points right away using the interface uid's as a key
        to_scan=interfaces
        for i in interfaces: 
            graph.add_node(i.uid())
            node2interface[graph.get_node(i.uid())]=i
        scanned=[]
        # keep on looping until we reach a fixed point
        # don't worry about abels and shapes that will get fixed later on
        while to_scan:
            for interface in to_scan:
                # performing xmlrpc call
                version=interface.get_version()
                if self.verbose:
                    logger.info("GetVersion at interface %s"%interface.url())
                    if not version:
                        logger.info("<EMPTY GetVersion(); offline or cannot authenticate>")
                    else: 
                        for (k,v) in version.iteritems(): 
                            if not isinstance(v,dict):
                                logger.info("\r\t%s:%s"%(k,v))
                            else:
                                logger.info(k)
                                for (k1,v1) in v.iteritems():
                                    logger.info("\r\t\t%s:%s"%(k1,v1))
                # 'geni_api' is expected if the call succeeded at all
                # 'peers' is needed as well as AMs typically don't have peers
                if 'geni_api' in version and 'peers' in version: 
                    # proceed with neighbours
                    for (next_name,next_url) in version['peers'].iteritems():
                        next_interface=Interface(next_url)
                        # locate or create node in graph
                        try:
                            # if found, we're good with this one
                            next_node=graph.get_node(next_interface.uid())
                        except:
                            # otherwise, let's move on with it
                            graph.add_node(next_interface.uid())
                            next_node=graph.get_node(next_interface.uid())
                            node2interface[next_node]=next_interface
                            to_scan.append(next_interface)
                        graph.add_edge(interface.uid(),next_interface.uid())
                scanned.append(interface)
                to_scan.remove(interface)
            # we've scanned the whole graph, let's get the labels and shapes right
            for node in graph.nodes():
                interface=node2interface.get(node,None)
                if interface:
                    for (k,v) in interface.get_layout().iteritems():
                        node.attr[k]=v
                else:
                    logger.error("MISSED interface with node %s"%node)

 def __init__(self, ip, port, key_file, cert_file,interface):
     threading.Thread.__init__(self)
     self.key = Keypair(filename = key_file)
     self.cert = Certificate(filename = cert_file)
     #self.server = SecureXMLRPCServer((ip, port), SecureXMLRpcRequestHandler, key_file, cert_file)
     self.server = ThreadedServer((ip, port), SecureXMLRpcRequestHandler, key_file, cert_file)
     self.server.interface=interface
     self.trusted_cert_list = None
     self.register_functions()
     logger.info("Starting SfaServer, interface=%s"%interface)

 def log_invalid_cred(cred):
     if not isinstance (cred, StringTypes):
         logger.info("cannot validate credential %s - expecting a string"%cred)
         error="checkCredentials: expected a string, received %s"%(type(cred))
     else:
         cred_obj=Credential(string=cred)
         logger.info("failed to validate credential - dump=%s"%\
                     cred_obj.dump_string(dump_parents=True))
         error = sys.exc_info()[:2]
     return error

        def GetSlices(self,filter={}):
		logger.info("GETSlices")
		logger.info(filter)
		result = []
		result.extend(self.slices)
		if 'slice_name' in filter:
			for slice in self.slices:
				if slice['slice_name'] not in filter['slice_name']:
					result.remove(slice)
		
                return self.slices

    def fill_record_sfa_info(self, records):
        
        def startswith(prefix, values):
            return [value for value in values if value.startswith(prefix)]

        # get user ids
        user_ids = []
        for record in records:
            user_ids.extend(record.get("user_ids", []))
        
        # get the registry records
        user_list, users = [], {}
        user_list = dbsession.query(RegRecord).filter(RegRecord.pointer.in_(user_ids)).all()
        # create a hrns keyed on the sfa record's pointer.
        # Its possible for multiple records to have the same pointer so
        # the dict's value will be a list of hrns.
        users = defaultdict(list)
        for user in user_list:
            users[user.pointer].append(user)

        # get the nitos records
        nitos_user_list, nitos_users = [], {}
        nitos_all_users = self.convert_id(self.shell.getUsers())
        nitos_user_list = [user for user in nitos_all_users if user['user_id'] in user_ids]
        nitos_users = list_to_dict(nitos_user_list, 'user_id')


        # fill sfa info
        for record in records:
            if record['pointer'] == -1:
                continue 

            sfa_info = {}
            type = record['type']
            logger.info("fill_record_sfa_info - incoming record typed %s"%type)
            if (type == "slice"):
                # all slice users are researchers
                record['geni_urn'] = hrn_to_urn(record['hrn'], 'slice')
                record['researcher'] = []
                for user_id in record.get('user_ids', []):
                    hrns = [user.hrn for user in users[user_id]]
                    record['researcher'].extend(hrns)                
                
            elif (type == "node"):
                sfa_info['dns'] = record.get("hostname", "")
                # xxx TODO: URI, LatLong, IP, DNS
    
            elif (type == "user"):
                logger.info('setting user.email')
                sfa_info['email'] = record.get("email", "")
                sfa_info['geni_urn'] = hrn_to_urn(record['hrn'], 'user')
                sfa_info['geni_certificate'] = record['gid'] 
                # xxx TODO: PostalAddress, Phone
            record.update(sfa_info)