I used the following commands:
autopep8 test_ors.py --select=E101 --ignore=E121 --indent-size=2 --in-place
autopep8 test.py --select=E101 --ignore=E121 --indent-size=2 --in-place

This parameter no longer exists, this was not removed correctly

"repozo --verify" is not working as this code expects it to: it simply
prints errors in stdout, and doesn't return an error code in case of
error. Thus, running it had absolutely no effect, except wasting IO
and CPU time.

This commit introduces the use of "repozo --recover --with-verify",
which runs the verify and the recover in a same step, and has the
advantage to raise (it doesn't exit with 0) in case of error. Also, as
it does the verification and the recovery at the same time, it uses
half the IO for the read. On a production server using SSDs, with a
ZODB of 1Tb, runner-import-restore now takes 14h instead of 26h, iow a
performance increase of 46%.

See merge request nexedi/slapos!1534

This is needed since version up of pim-dm in cfb05d82

Hello up there. This merge-request brings in major update to ors-amarisoft
software release: first eNB is significantly restructured to prepare base for
further changes, and then we add support for working with multiple radio units
and multiple cells with all LTE/NR and FDD/TDD simultaneously. All kinds of
Carrier Aggregation - LTE+LTE, NR+NR and LTE+NR are now supported. All kinds of
Handover - Intra-ENB, Inter-ENB with LTE→NR and NR→LTE are now supported as
well. UE simulator is also updated to support multiple radio units, cells and
UEs. In the new system configuration of RU, CELL, PEERCELL, PEER and UE objects
are done via shared instances attached to the main eNB or UEsim instance.

Most of the parameters become runtime settings instead of being static choice
of particular software template. There is no longer multiple rendered
softwares - all that remain is

1. `software.cfg` for generic software, and
2. `software-ors.cfg` for ORS.

Switching to configuring things at runtime became possible because SlapOS Master
recently switched to new JSON-editor with support for `oneOf`, arrays and
conditionals - bits that make it possible to configure settings in the WEB UI
with multiple choices for e.g. RF mode, cell or radio unit type.

For ORS full backward compatibility is preserved via special proxy which
translates ORS input schema to configuration objects of the new generic eNB.
Since most our current ORS deployments are TDD, `software-tdd-ors.cfg` link to
`software-ors.cfg` is also provided to preserve backward compatibility at
software-release URL level for those instances.

eNB and gNB are merged along the way. Unittests are improved. JSON schemas
become primary source for defaults(*). Unnecessary parameters are removed and
are now computed automatically. For example it is no longer needed to
explicitly specify SSB NR-ARFCN for peer NR cell, or `txa0cc00_center_frequency`
for Lopcomm RU. `tx_gain` and `rx_gain` become generic parameters that
semantically apply uniformly to all Radio Units.

A protection against buildout code injection via specially-crafted references
of shared instances is installed. The problem was noticed because instantiation
was failing with spaces in the references - a condition that is present by
default on the testnodes. Solving the problem generally via custom "buildout
encoding" was not hard and probably the solution might be useful not only for
ors-amarisoft software release. Please see the patch `"Protect from buildout
code injection"` for details.

There are more minor enhancements and bug fixes in there.

Please see individual patches for details.

Kirill

/cc @jhuge, @lu.xu, @xavier_thompson, @Daetalus
/approved-by @tomo
/reviewed-on !1533

(*) this goes in line with similar design choice to make JSON schemas primary
    source of defaults in Rapid-CDN: !1380 .

To run tapsplit we use plone.recipe.command with both command and
update-command set to `tapsplit ...`. But tapsplit, when run, currently fully
recreates and reinitializes subtap interfaces, which leads to interfering with
running enb because subtap interfaces, that enb started to use, are removed.
This is not desirable behaviour.

What we need:

1) create subtap interfaces only once and keep them stable
2) until configuration changes which should lead to
   * subtaps recreated, and
   * enb restarted
3) if subtap interfaces disappear for any reason, recreate it

-> Rework tapsplit to keep its promise, that it "brings tap interface into state
   with several children interfaces each covering part of original interface
   address space", without recreating those children on every run and instead
   doing any action only if their state is not what is desired.

In other words those interfaces now are only created when they do not exist
before. Addresses and routes are added only if they are not there before
tapsplit is run, etc.

After the patch the first run of tapsplit to split by 2 looks like

    # ./pythonwitheggs ru/tapsplit slaptap16 2
    slaptap16: split 2401:5180:0:66:a200::/71 by 2
    preserve         2401:5180:0:66:a200::/73
    -> slaptap16-1   2401:5180:0:66:a280::/73
     # ip tuntap add dev slaptap16-1 mode tap user slapuser16
     # ip link set slaptap16-1 up
     # ip addr add 2401:5180:0:66:a280::/73 dev slaptap16-1 noprefixroute
     # ip route add 2401:5180:0:66:a280::1 dev slaptap16-1
     # ip route add 2401:5180:0:66:a280::/73 dev slaptap16-1 via 2401:5180:0:66:a280::1
    -> slaptap16-2   2401:5180:0:66:a300::/73
     # ip tuntap add dev slaptap16-2 mode tap user slapuser16
     # ip link set slaptap16-2 up
     # ip addr add 2401:5180:0:66:a300::/73 dev slaptap16-2 noprefixroute
     # ip route add 2401:5180:0:66:a300::1 dev slaptap16-2
     # ip route add 2401:5180:0:66:a300::/73 dev slaptap16-2 via 2401:5180:0:66:a300::1

The second run with the same arguments looks as

    # ./pythonwitheggs ru/tapsplit slaptap16 2
    slaptap16: split 2401:5180:0:66:a200::/71 by 2
    preserve         2401:5180:0:66:a200::/73
    -> slaptap16-1   2401:5180:0:66:a280::/73
     # slaptap16-1: already exists
     # slaptap16-1: already up
     # slaptap16-1: already has 2401:5180:0:66:a280::/73 addr
     # slaptap16-1: already has 2401:5180:0:66:a280::1 route
     # slaptap16-1: already has 2401:5180:0:66:a280::/73 route
    -> slaptap16-2   2401:5180:0:66:a300::/73
     # slaptap16-2: already exists
     # slaptap16-2: already up
     # slaptap16-2: already has 2401:5180:0:66:a300::/73 addr
     # slaptap16-2: already has 2401:5180:0:66:a300::1 route
     # slaptap16-2: already has 2401:5180:0:66:a300::/73 route

where it could be seen that no actions had been taken.

And if, for example, the user manipulates slaptap16-2 and manually sets it
down, the third run restores it to desired 'UP' state and readds the address
and routes because the kernel removed them when link went down:

    # ip -6 addr show dev slaptap16-2
    157: slaptap16-2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
        inet6 2401:5180:0:66:a300::/73 scope global tentative noprefixroute
           valid_lft forever preferred_lft forever
    # ip -6 route show dev slaptap16-2
    2401:5180:0:66:a300::1 metric 1024 linkdown pref medium
    2401:5180:0:66:a300::/73 via 2401:5180:0:66:a300::1 metric 1024 linkdown pref medium
    # ip link set slaptap16-2 down
    # ip -6 addr show dev slaptap16-2
    # ip -6 route show dev slaptap16-2
    # ./pythonwitheggs ru/tapsplit slaptap16 2
    slaptap16: split 2401:5180:0:66:a200::/71 by 2
    preserve         2401:5180:0:66:a200::/73
    -> slaptap16-1   2401:5180:0:66:a280::/73
     # slaptap16-1: already exists
     # slaptap16-1: already up
     # slaptap16-1: already has 2401:5180:0:66:a280::/73 addr
     # slaptap16-1: already has 2401:5180:0:66:a280::1 route
     # slaptap16-1: already has 2401:5180:0:66:a280::/73 route
    -> slaptap16-2   2401:5180:0:66:a300::/73
     # slaptap16-2: already exists
     # ip link set slaptap16-2 up
     # ip addr add 2401:5180:0:66:a300::/73 dev slaptap16-2 noprefixroute
     # ip route add 2401:5180:0:66:a300::1 dev slaptap16-2
     # ip route add 2401:5180:0:66:a300::/73 dev slaptap16-2 via 2401:5180:0:66:a300::1

The first version of this patch tried to solve the problem by setting
update-command to be noop instead of reworking tapsplit itself. But as Thomas
noted this does not satisfy requirement "3".

Amends 49ce8ef5 (software/ors-amarisoft: Provide dedicated TAP interface for each Radio Unit)

/helped-by @tomo
/cc @jhuge, @lu.xu, @xavier_thompson, @Daetalus
/reviewed-on !1508

 - use caucase for balancer certificate
 - move virtual host logic on the backend
 - change "frontend" parameter to request "" type (and no longer "zope")

See merge request nexedi/slapos!1504

The strategy for compatibility is that:
 - haproxy still listen on the same port as before, without rewrite rule.
   This is called "legacy" port.
 - for each frontend from request parameters, we introduce an haproxy
   frontend with a rewrite for the corresponding `internal-path`
   parameter.
 - the shared frontend instance is updated to use this new frontend
   entry from haproxy. This will cause a small downtime until the shared
   frontend is updated to the new URL on ERP5, but since this feature
   was not used, it's OK.

Technical details are that we:
 - split haproxy config to have frontends and backends.
 - introduce one frontend in haproxy for each frontend from request
   parameters.
 - routing-rule-list argument is still honored the same way, globally
   and after path from frontend.
 - change the shared frontend requests to use "" type, no longer "zope"
   type.
 - we don't do automatic detection of /VirtualHostRoot in URL but always
   add it, because it could be used to trick zope into thinking it
   serves requests for an arbitrary host and do open redirects
 - before using the request's host header in virtualhost path, we check
   that it does not contain /, to prevent injection of virutalhost path
   elements through the host header.
 - we don't use the "path" parameter from shared frontend, because we
   want the frontend to be simple, so we don't want it to rewrite the
   request path (which is also the reason why we deprecated "zope" type)
 - the tests have changed a lot, because they were using what's now the
   "legacy" URL types, so we updated it to use the new URL types with
   all the /VirtualHostRoot/../ in path and also because they use IPv6
   URL, no longer IPv4

and save the already allocated ports in a state file, so that requesting
new families does not change already allocated ports.

This reverts commit 620c9332 (stack/erp5: stop using caucase managed
certificate for balancer, 2020-11-10) with an updated design. We add a
caucase service for balancer in the balancer partition. The caucase
service from the root partition (that was not used) is removed.

The underlying idea is that the default configuration should use multiple
caucases with limited scope, here we have one caucase to manage the
certificate used by haproxy server in the balancer partition, so we put
one caucase to manage this certificate and the caucase is configured to
auto-accept one certificate only. The plan is that when we will add a
certificate for mariadb server, we'll add another caucase inside this
mariadb server.

For more advanced usage and also to support the cases where a new
certificate needs to be re-emitted for some reason, users can request
with an existing caucase URL. In that case, they will have to accept
the certificate requests.

Notable changes:

balancer/ssl/caucase-url is no longer documented in parameters, this is
an internal parameter, users can pass one global caucase service to
manage all partition

CAUCASE environment variable is no longer set when running zope. There
was no identified use case and with this new approach of multiple
caucases, the term "caucase" alone became ambiguous.

This is not documented in schema and has no effect in erp5 (but this is
still used for slapos-master)

This change the format or the (mostly) unused frontend parameter to
support requesting more than one frontend and also enable the request of
a frontend by default, so that requesting a frontend separately is no
longer needed.

The `frontend` parameter now also supports requesting frontends for
specific paths on the ERP5 backend, the example below requests a
frontend serving directly a web site, with the necessary rewrite rules:

```js
{
  "frontend": {
    "default": {
      "internal-path": "/erp5/web_site_module/renderjs_runner/"
    }
  }
}
```

The example below requests a default frontend to the erp5 root, to
access the ZMI or erp5_xhtml_style interface and two web sites:

```js
{
  "frontend": {
    "default": {},
    "erp5js": {
      "internal-path": "/erp5/web_site_module/renderjs_runner/"
    },
    "crm": {
      "internal-path": "/erp5/web_site_module/erp5_officejs_support_request_ui/"
    }
  }
}
```

The example below has an explicit definition of the zope families using
`zope-partition-dict` parameter, because there is more than one zope
family, no frontend is requested by default:

```js
{
  "zope-partition-dict": {
    "backoffice": {
      "family": "backoffice"
    },
    "web": {
      "family": "web"
    },
    "activities": {
      "family": "activities"
    }
  }
}
```

Continuing this example, to have frontends for backoffice and web
families, the frontend request can specify the families, like it is
demonstrated in the example below. In this example, we don't specify an
entry for "activities" family, so no frontend will be requested for
this family.

```js
{
  "frontend": {
    "backoffice": {
      "zope-family": "backoffice"
    },
    "web": {
      "zope-family": "web",
      "internal-path": "/erp5/web_site_module/web_site/"
    }
  }
  "zope-partition-dict": {
    "backoffice": {
      "family": "backoffice"
    },
    "web": {
      "family": "web"
    },
    "activities": {
      "family": "activities"
    }
  }
}
```

Going 0.140 -> 0.142 introduces the following changes:

    nexedi/slapos.toolbox@0.140...0.142

Test results: https://erp5js.nexedi.net/#/test_result_module/20240215-D4F3CE96 (all ok)

Typos, whitespace changes, etc...

Noticed accidentaly: ssb_pos_bitmap is string, not integer - the default should be of the same type.

Rework UEsim to be able to work with multiple cells, multiple radio units(*),
multiple UE all at the same time. RU, CELLs and UEs are now configured,
simiularly to eNB, via shared instances. Add tests.

Contrary to ORS don't care about backward compatibility here because currently
we have just a few UEsim deployments and migrating them should be easy.

Please see added schemas, tests and updates slapos-render-config on how to use
the new system.

(*) contrary to eNB UEsim does not allow to use one RU for two cells,

It should be already generally supported, but many parameters needs in NR case
are currently hardcoded to their TDD values. I've adjusted only a few of them
and stopped, becuase there is currently no practical case at hand for me to
test it. Still I think it makes sense to save this first step.

For ORS, who uses TDD, rendered config stays practically the same:

```
$ ./pythonwitheggs slapos-render-config.py && xdiff -C -C config/{old,out}/ors/
```

```diff
diff --git a/config/old/ors/gnb/enb.cfg b/config/out/ors/gnb/enb.cfg
index ead7f0160..9a260d73f 100644
--- a/config/old/ors/gnb/enb.cfg
+++ b/config/out/ors/gnb/enb.cfg
@@ -97,6 +97,7 @@

         prach: {
+          ra_response_window: 20,
         },

         pdcch: {
@@ -180,7 +181,6 @@
       preamble_received_target_power: -110,
       preamble_trans_max: 7,
       power_ramping_step: 4,
-      ra_response_window: 20,
       restricted_set_config: "unrestricted_set",
       ra_contention_resolution_timer: 64,
       ssb_per_prach_occasion: 1,
```

If a base station has multiple cells, it should be possible for UE to be handed
over from one cell into another, for example when UE crosses border of sectors.

So far we had only Inter-ENB HO and now we are also adding configuration for
HO in between all own cells.

Add tests for everything.

NOTE: we use allowed_meas_bandwidth, antenna_port_1 in dst=LTE case because
otherwise, e.g. for NR->LTE HO if they are not present, lteenb complains:

    enb.cfg:260: expecting 'allowed_meas_bandwidth' field
    enb.cfg:260: expecting 'antenna_port_1' field

for both Intra-ENB and Inter-ENB handovers.

For Intra-ENB case we can compute those numbers from cell definition. For
Inter-ENB case, when we don't know target context, we use conservative values.

We already had CA for LTE+LTE case. Let's also setup it for NR+NR and LTE+NR
cases as well. Add tests for everything.

Currently when setting up cells we allow users to input

- dl_earfcn for LTE, and
- dl_nr_arfcn and nr_band for NR

and from that lteenb automatically computes

- ul_earfcn for LTE, and
- ul_nr_arfcn and ssb_nr_arfcn for NR

everything kind of works out of the box for eNB case when there is simple SDR Radio Unit.

Then there are also the following cases:

1. we also need to set UL frequency when configuring Lopcomm RU, or any other ORAN-based Radio Unit.
2. we also need to specify DL/UL frequencies in MHz when configuring Lopcomm RU.
3. when configuring NR peercell it is required to set ssb_nr_arfcn. It is also
   required to set both dl_nr_arfcn and ul_nr_arfcn, and so far we were setting
   only DL one and using it for both assuming TDD band.
4. when configuring UEsim we need to specify both dl_nr_arfcn and ssb_nr_arfcn for NR cells.

So the problem is that even though lteenb automatically computes UL and SSB
frequencies, there is no way for us to reuse results of that computation for
scenarios outside of "simple enb" case.

As the result we kind of workaround that currently with exposing additional
parameters and asking users to look into enb, probably its `cell phy` output,
with the following:

     ---- 8< ---- (from UEsim)
     "ssb_nr_arfcn": {
       "title": "SSB NR ARFCN",
       "description": "SSB NR ARFCN, you can retrieve from ENB/GNB side",

or use additional parameters just for ul_earfcn and frequency-in-MHz:

     ---- 8< ---- (from ru/lopcomm)
     "txa0cc00_center_frequency": {
       "title": "Lopcomm ORAN DL Center Frequency in MHz (TXA0CC00)",
       "description": "Lopcomm ORAN Center Frequency in MHz (TXA0CC00)",
       "type": "number",
       "default": 2140
     },
     "rxa0cc00_center_frequency_earfcn": {
       "title": "Lopcomm ORAN UL Center Frequency EARFCN (RXA0CC00)",
       "description": "Lopcomm ORAN Center Frequency EARFCN (RXA0CC00)",
       "type": "number",
       "default": 18300
     },
     "rxa0cc00_center_frequency": {
       "title": "Lopcomm ORAN UL Center Frequency in MHz (RXA0CC00)",
       "description": "Lopcomm ORAN Center Frequency in MHz (RXA0CC00)",
       "type": "number",
       "default": 1950
     },

which prevents automation, opens the door for inconsistencies and puts the load
to resolve all that on users.

The root cause of the problem is that there is no way to access at
instantiation time what lteenb would compute internally. But DL<->UL conversion
and DL->SSB conversion is not a difficult task and we can do that on our own.

-> Do that here and solve all the problems listed above in one go.

For frequency computations we use my xlte.earfcn and xlte.nrarfcn modules and
upstream nrarfcn egg. For this xlte is updated(*) to primarily pick up

kirr/xlte@6cb9d37f
kirr/xlte@b8065120

and the rest of the conversion is in slaplte to use corresponding dl2ul and
dl2ssb routines.

For consistency ul_earfcn and ul_nr_arfcn now become input parameters for LTE
and NR cells, but optional. If they are absent - they are computed with
defaults, but a user can now control them explicitly. The same applies for
ssb_nr_arfcn.

This patch does not convert UEsim yet, because UEsim does not use rulib yet and
will be handled all in one go in a follow-up step.

The computation routines are thoroughly tested. First they have unit tests
inside XLTE itself, then we also update our tests in generic test/test.py here
with explicitly checking that correct numbers are emitted for UL and SSB
frequencies, and third I've also verified SSB computation results with respect
to https://tech-academy.amarisoft.com/OutOfBox_UEsim_SA.html#Tips_SSB_Frequency .

All this creates a base to be sure that the computations are correct and we are
indeed safe to switch our frequencies computation modules.

(*) full upgrade brings kirr/xlte@e716ab51...8e606c64 ;
    nrarfcn egg: https://pypi.org/project/nrarfcn/

So far in the unit tests we were only generating enb.cfg without semantically
processing as running lteenb is not possible on testnodes due to licensing
restrictions. That allowed to use arbitrary numbers, even invalid, for
frequencies without hitting an error.

However in the next patch we are going to start handling frequencies ourselves,
and invalid frequencies will lead to instantiation failures like

    ... in dl2ul(dl_earfcn)
    KeyError: 'no band that corresponds to DL EARFCN=325320'

Avoid that by switching to valid LTE and NR frequency numbers in the test.

Radio Units like Lopcomm ORAN require explicit activation for the radio.
Generalize this and introduce a generic parameter for explicit activation of
the radio on any RU. Default it to _INACTIVE_ so that radio happens only when
it is explicitly asked to be on for real. But preserve backward compatibility
for ORS which used to do "radio on" by default. disable_sdr becomes
ORS-specific parameter.

Lopcomm-specific txa0cc00_active and rxa0cc00_active go away and are replaced
by txrx_active usage.

I.e. apply not only to SDR but to all Radio Units and expecting that they apply
to them with the same uniform semantic of controlling Tx/Rx amplifiers on on
the RU.

- For SDR nothing is changed.
- For Lopcomm txa0cc00_gain goes away and is replaced by tx_gain. For rx_gain
  there is a question as I could not find offhand how to control aplifier on RX
  circuit there.
- For Sunwave tx_gain/rx_gain, as with lots of more(*) is TODO.

For example by publishing on RU the list of CELLs that are using it.

While at it and as we are introducing per-RU publication, fix a long-standing
TODO in ru/lopcomm to publish RU-specific information in per-RU way instead of
global.

Instead of publishing it on enb with prefixing by cell reference. It is more
logical to have cell input parameters on the cell instance and also have output
parameters about that cell published on that same instance.

For now it is all only what was input. But in the next patches we'll extend set
of published information with also computed things, so it won't remain trivial.

For example if we need to do 4T4R but have SDR boards with only 2T2R ports, we
need to combine two such boards into single RF port. Allow to do that via
changing SDR schema from taking sdr_dev into accepting sdr_dev_list and
adjusting the code everywhere correspondingly.

For ORS full backward compatibility is preserved via adjusting "ORS mode" proxy
correspondingly.

One example in slapos-render-config.py is changed from 2T2R to be 4T2R on such
RF port combined from two SDR boards. For that example the diff for rendered
enb.cfg is as follows:

    --- a/config/old/enb/iRU1_SDR_tLTE2_tNR/enb.cfg
    +++ b/config/out/enb/iRU1_SDR_tLTE2_tNR/enb.cfg
    @@ -8,7 +8,7 @@
       rf_driver: {
           // __CELL__a__ru 4T2R  (sdr)
           name: "sdr",
    -      args: "dev0=/dev/sdr0",
    +      args: "dev0=/dev/sdr0,dev1=/dev/sdr1",
       },
       tx_gain: [51, 51, 51, 51],
       rx_gain: [52, 52],

All other cases, including ORS, remain without any change.

We currently have at least the following problem:

1. a malfored shared instance reference leads to instantiation failure and
   potential buildout code injection. For example if reference of shared
   instance contains space then buildout fails with something like

       zc.buildout.configparser.ParsingError: File contains parsing errors: .../instance-enb.cfg
           [line 45]: '[promise-testing partition 0.RU-sdr-busy]\n'

   since, when requesting, it is possible to use arbitrary characters for
   references, including newline, it also opens the door for code injection attacks.

2. we currently use `json` directive of slapos.recipe.template e.g. as

     extra-context =
         json iru_dict   {{ rulib.iru_dict   | tojson }}

   this also potentially leads to instantiation failure if JSON(rulib.iru_dict)
   contains buildout control characters.

Solve this problems.

For 1 we develop "buildout encoding" that encodes arbitrary string into form
that is safe to be used as a name of buildout section. This encoding never fails
and does not loose information, which means it is safe to be applied
unconditionanly and there is no chance for two string inputs to result in the
same encoded form. The encoding also has practical property that it leaves most
of the strings, that we use in our buildot profiles, intact. Which means that
the result of the encoding is readable and the encoding can be applied almost
unconditionally to all strings without hurting instantiation. Then this
encoding is applied wherever reference of a shared instance is used to form
e.g. name of buildout section or inside other codes. We apply this encoding
universally - in config files too to avoid breakage there - e.g. in enb.cfg to
protect from e.g. \n being inserted in the middle of comment resulting in YAML
breakage. See documentation of added xbuildout.py for details.

For 2 we switch from `json` to using `dumps` on an object and referring that
dumps result via `key` directive.

See the following links for preliminary discussions with Jérome and Vincent on
this topic:

kirr/slapos@d5d4f7c8
nexedi/slapos@bf6b2ef3

As promised add tests for generic enb that exercise enb instantiation with
multiple Radio Units and cells in all kind of combinations:

   FDD|TDD x LTE|NR x SDR|Lopcomm|Sunwave

and not only one particular case, but verifying instantiation with many
combinations at the same time - verifying how cells of different kinds are
handled and how radio units of different kinds are handled too. Using multiple
cells on top of several radio units of the same type is verified too.

For Lopcomm we also exercise generated cu_config.xml a bit.

See added tests for details.

Enb/generic tests are bootstrapped now.

From now one every fix to enb/generic and every semantic change will go on only
if it is accompanied test change or enhancement.