base line version tested with kube 1.5.6, 1.6

LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

Makefile

@@ -0,0 +1,9 @@
+#all: push
+all:  
+	go build  -o kube-router kube-router.go
+
+clean:
+	rm -f kube-router
+
+run:
+	./kube-router --kubeconfig=~/kubeconfig

README.md

@@ -0,0 +1,180 @@
+kube-router
+==========
+Kube-router is a distributed load balancer, firewall and router for Kubernetes. 
+
+Kube-router can be configured to provide on each node:
+
+- a ingress firewall for the pods running on the node as per the defined network policies
+- a service proxy on each node for 'ClusterIP' and 'NodePort' service types, providing service discovery and load
+  balancing
+- a router to advertise the routes to the pod IP's to the peer nodes in the cluster
+
+Kube-router is motivated to provide:
+
+- all in one cohesive solution that is simple to deploy and operate
+- optimized for performance and scale
+- easy to verify configuration and troubleshoot with standard linux networking tools
+
+## Theory of Operation
+
+Kube-router runs as agent on each node and leverages standard Linux technologies **iptables, ipvs/lvs, ipset, iproute2** 
+
+### service proxy and load balancing 
+
+Kube-router uses IPVS/LVS technology built in Linux to provide L4 load balancing. Each of the kubernetes service of **ClusterIP** and **NodePort**
+type is configured as IPVS virtual service. Each service endpoint is configured as real server to the virtual service.
+Standard **ipvsadm** tool can be used to verify the configuration and monitor the status. 
+
+Below is example set of services on kubernetes
+
+![Kube services](./Documentation/img/svc.jpg)
+
+and the endpoints for the services
+
+![Kube services](./Documentation/img/ep.jpg)
+
+and how they got mapped to the ipvs by kube-router
+
+![IPVS configuration](./Documentation/img/ipvs1.jpg)
+
+Kube-router watches kubernetes API server to get updates on the services, endpoints and automatically syncs the ipvs
+configuration to reflect desired state of services. Kube-router uses IPVS masquerading mode and uses round robin scheduling
+currently. Source pod IP is preserved so thap appropriate network policies can be applied.
+
+### pod ingress firewall 
+
+Kube-router provides implementation of network policies semantics through the use of iptables, ipset and conntrack.
+All the pods in a namespace with 'DefaultDeny' ingress isolation policy has ingress blocked. Only traffic that matches
+whitelist rules specified in the network policies are permitted to reach pod. Following set of iptables rules and 
+chians in the 'filter' table are used to achive the network policies semantics.
+
+Each pod running on the node, which needs ingress blocked by default is mathced in FORWARD and OUTPUT chains of fliter table 
+and send to pod specific firewall chain. Below rules are added to match various cases
+
+- traffic getting switched between the pods on the same node through bridge
+- traffic getting routed between the pods on different nodes
+- traffic originating from a pod and going through the service proxy and getting routed to pod on same node
+
+![FORWARD/OUTPUT chain](./Documentation/img/forward.png)
+
+Each pod specific firewall chain has default rule to block the traffic. Rules are added to jump traffic to the network policy 
+specific policy chains. Rules cover only policies that apply to the destination pod ip. A rule is added to accept the
+the established traffic to permit the return traffic.
+
+![Pod firewall chain](./Documentation/img/podfw.png)
+
+Each policy chain has rules expressed through source and destination ipsets. Set of pods matching ingress rule in network policy spec
+forms a source pod ip ipset. set of pods matching pod selector (for destination pods) in the network policy forms
+destination pod ip ipset.  
+
+![Policy chain](./Documentation/img/policyfw.png)
+
+Finally ipsets are created that are used in forming the rules in the network policy specific chain
+
+![ipset](./Documentation/img/ipset.jpg)
+
+Kube-router at runtime watches Kubernetes API server for changes in the namespace, network policy and pods and
+dynamically updates iptables and ipset configuration to reflect desired state of ingress firewall for the the pods.
+
+### Pod networking
+
+Kube-router is expected to run on each node. It is expected that a subnet lease out a preconfigured address space is
+allocated to the node. Subnet of the node is learnt by kube-router from the CNI configuration file on the node. Each kube-router
+instance on the node acts a BGP router and advertise the subnet assigned to the node. Each node peers with rest of the 
+nodes in the cluster forming full mesh. Learned routes about the subnet from the other nodes (BGP peers) are injected into
+local node routing table.
+
+On the data path, inter node pod-to-pod communication is done by routing stack on the node. 
+
+## Documenation
+
+### Building
+
+**Go version 1.7 or above is required to build kube-router**
+
+All the dependencies are vendored already, so just run  *make* or *go build -o kube-router kube-router.go* to build
+   
+### Configuration
+```
+  --cleanup-config                  If true cleanup iptables rules, ipvs, ipset configuration and exit.
+  --cni-conf-file string            Full path to CNI configuration file.
+  --config-sync-period duration     How often configuration from the apiserver is refreshed. Must be greater than 0. (default 1m0s)
+  --iptables-sync-period duration   The maximum interval of how often iptables rules are refreshed (e.g. '5s', '1m'). Must be greater than 0. (default 1m0s)
+  --ipvs-sync-period duration       The maximum interval of how often ipvs config is refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0. (default 1m0s)
+  --kubeconfig string               Path to kubeconfig file with authorization information (the master location is set by the master flag).
+  --master string                   The address of the Kubernetes API server (overrides any value in kubeconfig)
+  --routes-sync-period duration     The maximum interval of how often routes are adrvertised and learned (e.g. '5s', '1m', '2h22m'). Must be greater than 0. (default 1m0s)
+  --run-firewall                    If false, kube-router wont setup iptables to provide ingress firewall for pods. true by default. 
+  --run-router                      If true each node advertise routes the rest of the nodes and learn the routes for the pods. false by default
+  --run-service-proxy               If false, kube-router wont setup IPVS for services proxy. true by default.
+```
+
+### Running
+
+Kube-router need to access kubernetes API server to get information on pods, services, endpoitns, network policies etc.
+The very minimum infomation it requires is the details on where to access the kuberntes API server. This information can
+be passed as
+
+```
+kube-router --master=http://192.168.1.99:8080/
+```
+or 
+``` 
+kube-router --kubeconfig=<path to kubeconfig file>
+```
+
+In this minimal configuration mode, kube-router provides service proxy and ingress firewall on the node on which it is running. You
+can use the flags *--run-firewall*, *--run-router*, *--run-service-proxy* to selectivley run the required services.
+
+For e.g if you just want kube-router to provide ingress firewall for the pods then you can start kube-router as 
+```
+kube-router --master=http://192.168.1.99:8080/ --run-service-proxy=false --run-router=false
+```
+
+You can clean up all the configurations done (to ipvs, iptables, ip routes) by kube-router on the node by running
+```
+ kube-router --cleanup-config
+```
+
+#### trying kube-router as alternative to kube-proxy
+
+If you have a kube-proxy in use, and want to try kube-router just for service proxy you can do
+```
+kube-proxy --cleanup-iptables
+```
+followed by
+```
+kube-router --master=http://192.168.1.99:8080/ --run-firewall=false --run-router=false
+```
+and if you want to move back to kube-proxy then 
+```
+ kube-router --cleanup-config
+```
+and run kube-proxy with what ever configuration you have
+
+##### pod networking
+kube-router does not (at this point) do subnet managment for the node. It assumes the information is provided in the CNI conf file.
+
+Any CNI plug-in which just does IPAM and hooking up the pods to the bridge can be used. For e.g. CNI plugin *bridge*
+with below conf can be used to work with kube-router
+
+```
+{
+  "name": "mynet",
+  "type": "bridge",
+  "bridge": "kube-bridge",
+  "isDefaultGateway": true,
+  "ipam": {
+    "type": "host-local",
+    "subnet": "10.1.3.0/24"
+  }
+}
+```
+In this case kube-router will advertise the availailibity of subnet "10.1.3.0/24" through the node ip to the peers.
+
+Assuming CNI conf file is located at */etc/cni/net.d/mynet.conf* kube-router can be started as
+
+```
+kube-router --master=http://192.168.1.99:8080/ --run-router=true --cni-conf-file=/etc/cni/net.d/mynet.conf
+```
+

app/controllers/network_policy_controller.go

@@ -0,0 +1,779 @@
+package controllers
+
+import (
+	"crypto/sha256"
+	"encoding/base32"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/app/options"
+	"github.com/cloudnativelabs/kube-router/app/watchers"
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/golang/glog"
+	"github.com/janeczku/go-ipset/ipset"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	apiv1 "k8s.io/client-go/pkg/api/v1"
+)
+
+// Network policy controller provides an ingress firewall for the pods as per the defined network policies.
+// Two different types of iptables chains are used. Each pod running on the node which has default ingress
+// policy is to deny the traffic gets a pod specific chian. Each network policy has a iptable chain, which
+// has rules expreessed through ipsets matching source and destination pod ip's. In the FORWARD chain of the
+// filter table a rule is added jump the traffic destined to the pod to the pod specific iptable chain. Each
+// pod specifc iptable chain has rules to jump to the network polices chains, that pod matches. So packet
+// destined for pod goes throuh fitler table's, FORWARD chain, followed by pod specific chain, followed
+// by one or more network policy chains, till there is a match which will accept the packet, or gets
+// dropped by the rule in the pod chain, if there is no match.
+
+type NetworkPolicyController struct {
+	nodeIP       net.IP
+	nodeHostName string
+	mu           sync.Mutex
+	syncPeriod   time.Duration
+
+	// list of all active network policies expressed as networkPolicyInfo
+	networkPoliciesInfo *[]networkPolicyInfo
+}
+
+// internal structure to represent a network policy
+type networkPolicyInfo struct {
+	name      string
+	namespace string
+	labels    map[string]string
+
+	// set of pods matching network policy spec podselector label selector
+	destPods map[string]podInfo
+
+	// whitelist ingress rules from the netwrok policy spec
+	ingressRules []ingressRule
+}
+
+// internal structure to represent Pod
+type podInfo struct {
+	ip        string
+	name      string
+	namespace string
+	labels    map[string]string
+}
+
+type ingressRule struct {
+	ports   []protocolAndPort
+	srcPods []podInfo
+}
+
+type protocolAndPort struct {
+	protocol string
+	port     string
+}
+
+func (npc *NetworkPolicyController) Run(stopCh <-chan struct{}, wg *sync.WaitGroup) {
+	t := time.NewTicker(npc.syncPeriod)
+	defer t.Stop()
+	defer wg.Done()
+
+	glog.Infof("Starting network policy controller")
+
+	// loop forever till notified to stop on stopCh
+	for {
+		select {
+		case <-stopCh:
+			glog.Infof("Shutting down network policies controller")
+			return
+		default:
+		}
+
+		if watchers.PodWatcher.HasSynced() && watchers.NetworkPolicyWatcher.HasSynced() {
+			glog.Infof("Performing periodic syn of the iptables to reflect network policies")
+			npc.Sync()
+		} else {
+			continue
+		}
+
+		select {
+		case <-stopCh:
+			glog.Infof("Shutting down network policies controller")
+			return
+		case <-t.C:
+		}
+	}
+}
+
+func (npc *NetworkPolicyController) OnPodUpdate(podUpdate *watchers.PodUpdate) {
+	glog.Infof("Received pod update namspace:%s pod name:%s", podUpdate.Pod.Namespace, podUpdate.Pod.Name)
+	if watchers.PodWatcher.HasSynced() && watchers.NetworkPolicyWatcher.HasSynced() {
+		npc.Sync()
+	} else {
+		glog.Infof("Received pod update, but controller not in sync")
+	}
+}
+
+func (npc *NetworkPolicyController) OnNetworkPolicyUpdate(networkPolicyUpdate *watchers.NetworkPolicyUpdate) {
+	glog.Infof("Received network policy update namspace:%s policy name:%s", networkPolicyUpdate.NetworkPolicy.Namespace, networkPolicyUpdate.NetworkPolicy.Name)
+	if watchers.PodWatcher.HasSynced() && watchers.NetworkPolicyWatcher.HasSynced() {
+		npc.Sync()
+	} else {
+		glog.Infof("Received network policy update, but controller not in sync")
+	}
+}
+
+func (npc *NetworkPolicyController) OnNamespaceUpdate(namespaceUpdate *watchers.NamespaceUpdate) {
+	glog.Infof("Received namesapce update namspace:%s", namespaceUpdate.Namespace.Name)
+	if watchers.PodWatcher.HasSynced() && watchers.NetworkPolicyWatcher.HasSynced() {
+		npc.Sync()
+	} else {
+		glog.Infof("Received namspace update, but controller not in sync")
+	}
+}
+
+// Sync synchronizes iptables to desired state of network policies
+func (npc *NetworkPolicyController) Sync() {
+
+	var err error
+	npc.mu.Lock()
+	defer npc.mu.Unlock()
+
+	start := time.Now()
+	defer func() {
+		glog.Infof("sync iptables took %v", time.Since(start))
+	}()
+
+	npc.networkPoliciesInfo, err = buildNetworkPoliciesInfo()
+	if err != nil {
+		glog.Errorf("Aborting sync. Failed to build network policies: %s", err.Error())
+		return
+	}
+
+	activePolicyChains, err := npc.syncNetworkPolicyChains()
+	if err != nil {
+		glog.Errorf("Aborting sync. Failed to sync network policy chains: %s", err.Error())
+		return
+	}
+
+	activePodFwChains, err := npc.syncPodFirewallChains()
+	if err != nil {
+		glog.Errorf("Aborting sync. Failed to sync pod firewalls: %s", err.Error())
+		return
+	}
+
+	err = cleanupStaleRules(activePolicyChains, activePodFwChains)
+	if err != nil {
+		glog.Errorf("Aborting sync. Failed to cleanup stale iptable rules: %s", err.Error())
+		return
+	}
+}
+
+// Configure iptable rules representing each network policy. All pod's matched by
+// network policy spec podselector labels are grouped together in one ipset which
+// is used for matching destination ip address. Each ingress rule in the network
+// policyspec is evaluated to set of matching pods, which are grouped in to a
+// ipset used for source ip addr matching.
+func (npc *NetworkPolicyController) syncNetworkPolicyChains() (map[string]bool, error) {
+
+	activePolicyChains := make(map[string]bool)
+
+	iptablesCmdHandler, err := iptables.New()
+	if err != nil {
+		glog.Fatalf("Failed to initialize iptables executor due to: %s", err.Error())
+	}
+
+	// run through all network policies
+	for _, policy := range *npc.networkPoliciesInfo {
+
+		// ensure there is a unique chain per network policy in filter table
+		policyChainName := networkPolicyChainName(policy.namespace, policy.name)
+		err := iptablesCmdHandler.NewChain("filter", policyChainName)
+		if err != nil && err.(*iptables.Error).ExitStatus() != 1 {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+
+		activePolicyChains[policyChainName] = true
+
+		// create a ipset for all destination pod ip's matched by the policy spec PodSelector
+		destPodIpSetName := policyDestinationPodIpSetName(policy.namespace, policy.name)
+		destPodIpSet, err := ipset.New(destPodIpSetName, "hash:ip", &ipset.Params{})
+		if err != nil {
+			return nil, fmt.Errorf("failed to create ipset: %s", err.Error())
+		}
+
+		// flush all entries in the set
+		if destPodIpSet.Flush() != nil {
+			return nil, fmt.Errorf("failed to flush ipset while syncing iptables: %s", err.Error())
+		}
+		for k, _ := range policy.destPods {
+			// TODO restrict ipset to ip's of pods running on the node
+			destPodIpSet.Add(k, 0)
+		}
+
+		// TODO use iptables-restore to better implement the logic, than flush and add rules
+		err = iptablesCmdHandler.ClearChain("filter", policyChainName)
+		if err != nil && err.(*iptables.Error).ExitStatus() != 1 {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+
+		// run through all the ingress rules in the spec and create iptable rules
+		// in the chain for the network policy
+		for i, ingressRule := range policy.ingressRules {
+
+			if len(ingressRule.srcPods) != 0 {
+				srcPodIpSetName := policySourcePodIpSetName(policy.namespace, policy.name, i)
+				srcPodIpSet, err := ipset.New(srcPodIpSetName, "hash:ip", &ipset.Params{})
+				if err != nil {
+					return nil, fmt.Errorf("failed to create ipset: %s", err.Error())
+				}
+				// flush all entries in the set
+				if srcPodIpSet.Flush() != nil {
+					return nil, fmt.Errorf("failed to flush ipset while syncing iptables: %s", err.Error())
+				}
+
+				for _, pod := range ingressRule.srcPods {
+					srcPodIpSet.Add(pod.ip, 0)
+				}
+
+				if len(ingressRule.ports) != 0 {
+					// case where 'ports' details and 'from' details specified in the ingress rule
+					// so match on specified source and destination ip's and specified port and protocol
+					for _, portProtocol := range ingressRule.ports {
+						comment := "rule to ACCEPT traffic from source pods to dest pods selected by policy name " +
+							policy.name + " namespace " + policy.namespace
+						args := []string{"-m", "comment", "--comment", comment,
+							"-m", "set", "--set", srcPodIpSetName, "src",
+							"-m", "set", "--set", destPodIpSetName, "dst",
+							"-p", portProtocol.protocol,
+							"--dport", portProtocol.port,
+							"-j", "ACCEPT"}
+						err := iptablesCmdHandler.AppendUnique("filter", policyChainName, args...)
+						if err != nil {
+							return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+						}
+					}
+				} else {
+					// case where no 'ports' details specified in the ingress rule but 'from' details specified
+					// so match on specified source and destination ip with all port and protocol
+					comment := "rule to ACCEPT traffic from source pods to dest pods selected by policy name " +
+						policy.name + " namespace " + policy.namespace
+					args := []string{"-m", "comment", "--comment", comment,
+						"-m", "set", "--set", srcPodIpSetName, "src",
+						"-m", "set", "--set", destPodIpSetName, "dst",
+						"-j", "ACCEPT"}
+					err := iptablesCmdHandler.AppendUnique("filter", policyChainName, args...)
+					if err != nil {
+						return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+					}
+				}
+			}
+
+			// case where only 'ports' details specified but no 'from' details in the ingress rule
+			// so match on all sources, with specified port and protocol
+			if len(ingressRule.srcPods) == 0 && len(ingressRule.ports) != 0 {
+				for _, portProtocol := range ingressRule.ports {
+					comment := "rule to ACCEPT traffic from source pods to dest pods selected by policy name: " +
+						policy.name + " namespace " + policy.namespace
+					args := []string{"-m", "comment", "--comment", comment,
+						"-m", "set", "--set", destPodIpSetName, "dst",
+						"-p", portProtocol.protocol,
+						"--dport", portProtocol.port,
+						"-j", "ACCEPT"}
+					err := iptablesCmdHandler.AppendUnique("filter", policyChainName, args...)
+					if err != nil {
+						return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+					}
+				}
+			}
+
+			// case where nether ports nor from details are speified in the ingress rule
+			// so match on all ports, protocol, source IP's
+			if len(ingressRule.srcPods) == 0 && len(ingressRule.ports) == 0 {
+				comment := "rule to ACCEPT traffic from source pods to dest pods selected by policy name: " +
+					policy.name + " namespace " + policy.namespace
+				args := []string{"-m", "comment", "--comment", comment,
+					"-m", "set", "--set", destPodIpSetName, "dst",
+					"-j", "ACCEPT"}
+				err := iptablesCmdHandler.AppendUnique("filter", policyChainName, args...)
+				if err != nil {
+					return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+				}
+			}
+		}
+	}
+
+	glog.Infof("Iptables chains in the filter table are synchronized with the network policies.")
+
+	return activePolicyChains, nil
+}
+
+func (npc *NetworkPolicyController) syncPodFirewallChains() (map[string]bool, error) {
+
+	activePodFwChains := make(map[string]bool)
+
+	iptablesCmdHandler, err := iptables.New()
+	if err != nil {
+		glog.Fatalf("Failed to initialize iptables executor: %s", err.Error())
+	}
+
+	// loop through the pods running on the node which has default ingress to be denied
+	podsOnNodeInfo, err := getPodsRunningOnNode(npc.nodeIP.String())
+	for _, pod := range *podsOnNodeInfo {
+
+		// below condition occurs when we get trasient update while removing or adding pod
+		// subseqent update will do the correct action
+		if len(pod.ip) == 0 || pod.ip == "" {
+			continue
+		}
+
+		// ensure pod specfic firewall chain exist for all the pods running on this node
+		podFwChainName := podFirewallChainName(pod.namespace, pod.name)
+		err = iptablesCmdHandler.NewChain("filter", podFwChainName)
+		if err != nil && err.(*iptables.Error).ExitStatus() != 1 {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+		activePodFwChains[podFwChainName] = true
+
+		// ensure there is rule in filter table and FORWARD chain to jump to pod specific firewall chain
+		// this rule applies to the traffic getting routed (coming for other node pods)
+		comment := "rule to jump traffic destined to POD name:" + pod.name + " namespace: " + pod.namespace +
+			" to chain " + podFwChainName
+		args := []string{"-m", "comment", "--comment", comment, "-d", pod.ip, "-j", podFwChainName}
+		exists, err := iptablesCmdHandler.Exists("filter", "FORWARD", args...)
+		if err != nil {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+		if !exists {
+			err := iptablesCmdHandler.Insert("filter", "FORWARD", 1, args...)
+			if err != nil {
+				return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+			}
+		}
+
+		// ensure there is rule in filter table and OUTPUT chain to jump to pod specific firewall chain
+		// this rule applies to the traffic from a pod getting routed back to another pod on same node by service proxy
+		exists, err = iptablesCmdHandler.Exists("filter", "OUTPUT", args...)
+		if err != nil {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+		if !exists {
+			err := iptablesCmdHandler.Insert("filter", "OUTPUT", 1, args...)
+			if err != nil {
+				return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+			}
+		}
+
+		// ensure there is rule in filter table and forward chain to jump to pod specific firewall chain
+		// this rule applies to the traffic getting switched (coming for same node pods)
+		comment = "rule to jump traffic destined to POD name:" + pod.name + " namespace: " + pod.namespace +
+			" to chain " + podFwChainName
+		args = []string{"-m", "physdev", "--physdev-is-bridged",
+			"-m", "comment", "--comment", comment,
+			"-d", pod.ip,
+			"-j", podFwChainName}
+		exists, err = iptablesCmdHandler.Exists("filter", "FORWARD", args...)
+		if err != nil {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+		if !exists {
+			err = iptablesCmdHandler.Insert("filter", "FORWARD", 1, args...)
+			if err != nil {
+				return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+			}
+		}
+
+		// add default DROP rule at the end of chain
+		comment = "default rule to REJECT traffic destined for POD name:" + pod.name + " namespace: " + pod.namespace
+		args = []string{"-m", "comment", "--comment", comment, "-j", "REJECT"}
+		err = iptablesCmdHandler.AppendUnique("filter", podFwChainName, args...)
+		if err != nil {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+
+		// add entries in pod firewall to run through required network policies
+		for _, policy := range *npc.networkPoliciesInfo {
+			if _, ok := policy.destPods[pod.ip]; ok {
+				comment := "run through nw policy " + policy.name
+				policyChainName := networkPolicyChainName(policy.namespace, policy.name)
+				args := []string{"-m", "comment", "--comment", comment, "-j", policyChainName}
+				exists, err := iptablesCmdHandler.Exists("filter", podFwChainName, args...)
+				if err != nil {
+					return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+				}
+				if !exists {
+					err := iptablesCmdHandler.Insert("filter", podFwChainName, 1, args...)
+					if err != nil && err.(*iptables.Error).ExitStatus() != 1 {
+						return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+					}
+				}
+			}
+		}
+
+		// ensure statefull firewall, that permits return traffic for the traffic originated by the pod
+		comment = "rule for stateful firewall for pod"
+		args = []string{"-m", "comment", "--comment", comment, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"}
+		exists, err = iptablesCmdHandler.Exists("filter", podFwChainName, args...)
+		if err != nil {
+			return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+		}
+		if !exists {
+			err := iptablesCmdHandler.Insert("filter", podFwChainName, 1, args...)
+			if err != nil {
+				return nil, fmt.Errorf("Failed to run iptables command: %s", err.Error())
+			}
+		}
+	}
+
+	return activePodFwChains, nil
+}
+
+func cleanupStaleRules(activePolicyChains, activePodFwChains map[string]bool) error {
+
+	cleanupPodFwChains := make([]string, 0)
+	cleanupPolicyChains := make([]string, 0)
+
+	iptablesCmdHandler, err := iptables.New()
+	if err != nil {
+		glog.Fatalf("failed to initialize iptables command executor due to %s", err.Error())
+	}
+
+	// get the list of chains created for pod firewall and network policies
+	chains, err := iptablesCmdHandler.ListChains("filter")
+	for _, chain := range chains {
+		if strings.HasPrefix(chain, "KUBE-NWPLCY-") {
+			if _, ok := activePolicyChains[chain]; !ok {
+				cleanupPolicyChains = append(cleanupPolicyChains, chain)
+			}
+		}
+		if strings.HasPrefix(chain, "KUBE-POD-FW-") {
+			if _, ok := activePodFwChains[chain]; !ok {
+				cleanupPodFwChains = append(cleanupPodFwChains, chain)
+			}
+		}
+	}
+
+	// cleanup FORWARD chain rules to jump to pod firewall
+	for _, chain := range cleanupPodFwChains {
+
+		forwardChainRules, err := iptablesCmdHandler.List("filter", "FORWARD")
+		if err != nil {
+			return fmt.Errorf("failed to list rules in filter table, FORWARD chain due to %s", err.Error())
+		}
+		outputChainRules, err := iptablesCmdHandler.List("filter", "OUTPUT")
+		if err != nil {
+			return fmt.Errorf("failed to list rules in filter table, OUTPUT chain due to %s", err.Error())
+		}
+
+		// TODO delete rule by spec, than rule number to avoid extra loop
+		var realRuleNo int = 0
+		for i, rule := range forwardChainRules {
+			if strings.Contains(rule, chain) {
+				err = iptablesCmdHandler.Delete("filter", "FORWARD", strconv.Itoa(i-realRuleNo))
+				if err != nil {
+					return fmt.Errorf("failed to delete rule: %s from the FORWARD chain of filter table due to %s", rule, err.Error())
+				}
+				realRuleNo++
+			}
+		}
+		realRuleNo = 0
+		for i, rule := range outputChainRules {
+			if strings.Contains(rule, chain) {
+				err = iptablesCmdHandler.Delete("filter", "OUTPUT", strconv.Itoa(i-realRuleNo))
+				if err != nil {
+					return fmt.Errorf("failed to delete rule: %s from the OUTPUT chain of filter table due to %s", rule, err.Error())
+				}
+				realRuleNo++
+			}
+		}
+	}
+
+	// cleanup pod firewall chain
+	for _, chain := range cleanupPodFwChains {
+		glog.Errorf("Found pod fw chain to cleanup: %s", chain)
+		err = iptablesCmdHandler.ClearChain("filter", chain)
+		if err != nil {
+			return fmt.Errorf("Failed to flush the rules in chain %s due to %s", chain, err.Error())
+		}
+		err = iptablesCmdHandler.DeleteChain("filter", chain)
+		if err != nil {
+			return fmt.Errorf("Failed to delete the chain %s due to %s", chain, err.Error())
+		}
+		glog.Infof("Deleted pod specific firewall chain: %s from the filter table", chain)
+	}
+
+	// cleanup network policy chains
+	for _, policyChain := range cleanupPolicyChains {
+		glog.Infof("Found policy chain to cleanup %s", policyChain)
+
+		// first clean up any references from pod firewall chain
+		for podFwChain := range activePodFwChains {
+			podFwChainRules, err := iptablesCmdHandler.List("filter", podFwChain)
+			if err != nil {
+
+			}
+			for i, rule := range podFwChainRules {
+				if strings.Contains(rule, policyChain) {
+					err = iptablesCmdHandler.Delete("filter", podFwChain, strconv.Itoa(i))
+					if err != nil {
+						return fmt.Errorf("Failed to delete rule %s from the chain %s", rule, podFwChain)
+					}
+					break
+				}
+			}
+		}
+
+		err = iptablesCmdHandler.ClearChain("filter", policyChain)
+		if err != nil {
+			return fmt.Errorf("Failed to flush the rules in chain %s due to  %s", policyChain, err)
+		}
+		err = iptablesCmdHandler.DeleteChain("filter", policyChain)
+		if err != nil {
+			return fmt.Errorf("Failed to flush the rules in chain %s due to %s", policyChain, err)
+		}
+		glog.Infof("Deleted network policy chain: %s from the filter table", policyChain)
+	}
+
+	// TODO delete unused ipsets
+	return nil
+}
+
+func getPodsRunningOnNode(nodeIp string) (*map[string]podInfo, error) {
+
+	nodePods := make(map[string]podInfo)
+
+	for _, pod := range watchers.PodWatcher.List() {
+		if strings.Compare(pod.Status.HostIP, nodeIp) != 0 {
+			continue
+		}
+		default_policy, err := getNameSpaceDefaultPolicy(pod.ObjectMeta.Namespace)
+		if err != nil {
+			return nil, fmt.Errorf("Failed to get the namespace default ingress policy %s", err.Error())
+		}
+		if strings.Compare(default_policy, "DefaultDeny") != 0 {
+			continue
+		}
+		nodePods[pod.Status.PodIP] = podInfo{ip: pod.Status.PodIP,
+			name:      pod.ObjectMeta.Name,
+			namespace: pod.ObjectMeta.Namespace,
+			labels:    pod.ObjectMeta.Labels}
+	}
+	return &nodePods, nil
+}
+
+func buildNetworkPoliciesInfo() (*[]networkPolicyInfo, error) {
+
+	NetworkPolicies := make([]networkPolicyInfo, 0)
+
+	for _, policy := range watchers.NetworkPolicyWatcher.List() {
+		newPolicy := networkPolicyInfo{
+			name:      policy.Name,
+			namespace: policy.Namespace,
+			labels:    policy.Spec.PodSelector.MatchLabels,
+		}
+		matchingPods, err := watchers.PodWatcher.ListByNamespaceAndLabels(policy.Namespace, policy.Spec.PodSelector.MatchLabels)
+		newPolicy.destPods = make(map[string]podInfo)
+		newPolicy.ingressRules = make([]ingressRule, 0)
+		if err == nil {
+			for _, matchingPod := range matchingPods {
+				newPolicy.destPods[matchingPod.Status.PodIP] = podInfo{ip: matchingPod.Status.PodIP,
+					name:      matchingPod.ObjectMeta.Name,
+					namespace: matchingPod.ObjectMeta.Namespace,
+					labels:    matchingPod.ObjectMeta.Labels}
+			}
+		}
+
+		for _, specIngressRule := range policy.Spec.Ingress {
+			ingressRule := ingressRule{}
+
+			ingressRule.ports = make([]protocolAndPort, 0)
+			for _, port := range specIngressRule.Ports {
+				protocolAndPort := protocolAndPort{protocol: string(*port.Protocol), port: port.Port.String()}
+				ingressRule.ports = append(ingressRule.ports, protocolAndPort)
+			}
+
+			ingressRule.srcPods = make([]podInfo, 0)
+			for _, peer := range specIngressRule.From {
+				matchingPods, err := watchers.PodWatcher.ListByNamespaceAndLabels(policy.Namespace, peer.PodSelector.MatchLabels)
+				if err == nil {
+					for _, matchingPod := range matchingPods {
+						ingressRule.srcPods = append(ingressRule.srcPods,
+							podInfo{ip: matchingPod.Status.PodIP,
+								name:      matchingPod.ObjectMeta.Name,
+								namespace: matchingPod.ObjectMeta.Namespace,
+								labels:    matchingPod.ObjectMeta.Labels})
+					}
+				}
+			}
+			newPolicy.ingressRules = append(newPolicy.ingressRules, ingressRule)
+		}
+		NetworkPolicies = append(NetworkPolicies, newPolicy)
+	}
+
+	return &NetworkPolicies, nil
+}
+
+func getNameSpaceDefaultPolicy(namespace string) (string, error) {
+	for _, nspw := range watchers.NamespaceWatcher.List() {
+		if strings.Compare(namespace, nspw.Name) == 0 {
+			networkPolicyAnnotation, ok := nspw.ObjectMeta.Annotations["net.beta.kubernetes.io/network-policy"]
+			var annot map[string]map[string]string
+			if ok {
+				err := json.Unmarshal([]byte(networkPolicyAnnotation), &annot)
+				if err == nil {
+					return annot["ingress"]["isolation"], nil
+				}
+			} else {
+				return "DefaultAllow", nil
+			}
+		}
+	}
+	return "", errors.New("Failed to get the default ingress policy for the namespace: " + namespace)
+}
+
+func podFirewallChainName(namespace, podName string) string {
+	hash := sha256.Sum256([]byte(namespace + podName))
+	encoded := base32.StdEncoding.EncodeToString(hash[:])
+	return "KUBE-POD-FW-" + encoded[:16]
+}
+
+func networkPolicyChainName(namespace, policyName string) string {
+	hash := sha256.Sum256([]byte(namespace + policyName))
+	encoded := base32.StdEncoding.EncodeToString(hash[:])
+	return "KUBE-NWPLCY-" + encoded[:16]
+}
+
+func policyDestinationPodIpSetName(namespace, policyName string) string {
+	hash := sha256.Sum256([]byte(namespace + policyName))
+	encoded := base32.StdEncoding.EncodeToString(hash[:])
+	return "KUBE-DST-" + encoded[:16]
+}
+
+func policySourcePodIpSetName(namespace, policyName string, ingressRuleNo int) string {
+	hash := sha256.Sum256([]byte(namespace + policyName + "ingressrule" + strconv.Itoa(ingressRuleNo)))
+	encoded := base32.StdEncoding.EncodeToString(hash[:])
+	return "KUBE-SRC-" + encoded[:16]
+}
+
+func getNodeIP(node *apiv1.Node) (net.IP, error) {
+	addresses := node.Status.Addresses
+	addressMap := make(map[apiv1.NodeAddressType][]apiv1.NodeAddress)
+	for i := range addresses {
+		addressMap[addresses[i].Type] = append(addressMap[addresses[i].Type], addresses[i])
+	}
+	if addresses, ok := addressMap[apiv1.NodeInternalIP]; ok {
+		return net.ParseIP(addresses[0].Address), nil
+	}
+	if addresses, ok := addressMap[apiv1.NodeExternalIP]; ok {
+		return net.ParseIP(addresses[0].Address), nil
+	}
+	if addresses, ok := addressMap[apiv1.NodeLegacyHostIP]; ok {
+		return net.ParseIP(addresses[0].Address), nil
+	}
+	return nil, errors.New("host IP unknown")
+}
+
+func (npc *NetworkPolicyController) Cleanup() {
+
+	glog.Infof("Cleaning up iptables configuration permanently done by kube-router")
+
+	iptablesCmdHandler, err := iptables.New()
+	if err != nil {
+		glog.Errorf("Failed to initialize iptables executor: %s", err.Error())
+	}
+
+	// delete jump rules in FORWARD chain to pod specific firewall chain
+	forwardChainRules, err := iptablesCmdHandler.List("filter", "FORWARD")
+	if err != nil {
+		glog.Errorf("Failed to delete iptable rules as part of cleanup")
+		return
+	}
+
+	// TODO: need a better way to delte rule with out using number
+	var realRuleNo int = 0
+	for i, rule := range forwardChainRules {
+		if strings.Contains(rule, "KUBE-POD-FW-") {
+			err = iptablesCmdHandler.Delete("filter", "FORWARD", strconv.Itoa(i-realRuleNo))
+			realRuleNo++
+		}
+	}
+
+	// flush and delete pod specific firewall chain
+	chains, err := iptablesCmdHandler.ListChains("filter")
+	for _, chain := range chains {
+		if strings.HasPrefix(chain, "KUBE-POD-FW-") {
+			err = iptablesCmdHandler.ClearChain("filter", chain)
+			if err != nil {
+				glog.Errorf("Failed to cleanup iptable rules: " + err.Error())
+				return
+			}
+			err = iptablesCmdHandler.DeleteChain("filter", chain)
+			if err != nil {
+				glog.Errorf("Failed to cleanup iptable rules: " + err.Error())
+				return
+			}
+		}
+	}
+
+	// flush and delete per network policy specific chain
+	chains, err = iptablesCmdHandler.ListChains("filter")
+	for _, chain := range chains {
+		if strings.HasPrefix(chain, "KUBE-NWPLCY-") {
+			err = iptablesCmdHandler.ClearChain("filter", chain)
+			if err != nil {
+				glog.Errorf("Failed to cleanup iptable rules: " + err.Error())
+				return
+			}
+			err = iptablesCmdHandler.DeleteChain("filter", chain)
+			if err != nil {
+				glog.Errorf("Failed to cleanup iptable rules: " + err.Error())
+				return
+			}
+		}
+	}
+
+	// delete all ipsets
+	err = ipset.DestroyAll()
+	if err != nil {
+		glog.Errorf("Failed to clean up ipsets: " + err.Error())
+	}
+	glog.Infof("Successfully cleaned the iptables configuration done by kube-router")
+}
+
+func init() {
+	_, err := exec.LookPath("ipset")
+	if err != nil {
+		panic("ipset command not found ensure ipset package is installed")
+	}
+}
+
+func NewNetworkPolicyController(clientset *kubernetes.Clientset, config *options.KubeRouterConfig) (*NetworkPolicyController, error) {
+
+	npc := NetworkPolicyController{}
+
+	npc.syncPeriod = config.IPTablesSyncPeriod
+
+	nodeHostName, err := os.Hostname()
+	if err != nil {
+		panic(err.Error())
+	}
+	npc.nodeHostName = nodeHostName
+
+	node, err := clientset.Core().Nodes().Get(nodeHostName, metav1.GetOptions{})
+	if err != nil {
+		panic(err.Error())
+	}
+	nodeIP, err := getNodeIP(node)
+	if err != nil {
+		panic(err.Error())
+	}
+	npc.nodeIP = nodeIP
+
+	watchers.PodWatcher.RegisterHandler(&npc)
+	watchers.NetworkPolicyWatcher.RegisterHandler(&npc)
+	watchers.NamespaceWatcher.RegisterHandler(&npc)
+
+	return &npc, nil
+}

app/controllers/network_routes_controller.go

@@ -0,0 +1,214 @@
+package controllers
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/app/options"
+	"github.com/containernetworking/cni/libcni"
+	"github.com/containernetworking/cni/plugins/ipam/host-local/backend/allocator"
+	"github.com/golang/glog"
+	bgpapi "github.com/osrg/gobgp/api"
+	"github.com/osrg/gobgp/config"
+	"github.com/osrg/gobgp/packet/bgp"
+	gobgp "github.com/osrg/gobgp/server"
+	"github.com/osrg/gobgp/table"
+	"github.com/vishvananda/netlink"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+type NetworkRoutingController struct {
+	nodeIP       net.IP
+	nodeHostName string
+	mu           sync.Mutex
+	clientset    *kubernetes.Clientset
+	bgpServer    *gobgp.BgpServer
+	cniConfFile  string
+	syncPeriod   time.Duration
+}
+
+func (nrc *NetworkRoutingController) Run(stopCh <-chan struct{}, wg *sync.WaitGroup) {
+
+	t := time.NewTicker(nrc.syncPeriod)
+	defer t.Stop()
+	defer wg.Done()
+
+	nodes, err := nrc.clientset.Core().Nodes().List(metav1.ListOptions{})
+	if err != nil {
+		glog.Errorf("Failed to list nodes: %s", err.Error())
+		return
+	}
+
+	glog.Infof("Starting network route controller")
+
+	// add the current set of nodes (excluding self) as BGP peers. Nodes form full mesh
+	for _, node := range nodes.Items {
+		nodeIP, _ := getNodeIP(&node)
+		if nodeIP.String() == nrc.nodeIP.String() {
+			continue
+		}
+		n := &config.Neighbor{
+			Config: config.NeighborConfig{
+				NeighborAddress: nodeIP.String(),
+				PeerAs:          65000,
+			},
+		}
+		if err := nrc.bgpServer.AddNeighbor(n); err != nil {
+			panic(err)
+		}
+	}
+
+	// loop forever till notified to stop on stopCh
+	for {
+		select {
+		case <-stopCh:
+			glog.Infof("Shutting down network routes controller")
+			return
+		default:
+		}
+
+		glog.Infof("Performing periodic syn of the routes")
+		err := nrc.advertiseRoute()
+		if err != nil {
+			glog.Errorf("Failed to advertise route: %s", err.Error())
+		}
+
+		select {
+		case <-stopCh:
+			glog.Infof("Shutting down network routes controller")
+			return
+		case <-t.C:
+		}
+	}
+}
+
+func (nrc *NetworkRoutingController) watchBgpUpdates() {
+	watcher := nrc.bgpServer.Watch(gobgp.WatchBestPath(false))
+	for {
+		select {
+		case ev := <-watcher.Event():
+			switch msg := ev.(type) {
+			case *gobgp.WatchEventBestPath:
+				glog.Infof("Processing bgp route advertisement from peer")
+				for _, path := range msg.PathList {
+					if path.IsLocal() {
+						continue
+					}
+					if err := nrc.injectRoute(path); err != nil {
+						glog.Errorf("Failed to inject routes due to: " + err.Error())
+						continue
+					}
+				}
+			}
+		}
+	}
+}
+
+func (nrc *NetworkRoutingController) getIpamConfig() (*allocator.IPAMConfig, error) {
+	netconfig, err := libcni.ConfFromFile(nrc.cniConfFile)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to load CNI conf: %s", err.Error())
+	}
+	var ipamConfig *allocator.IPAMConfig
+	ipamConfig, _, err = allocator.LoadIPAMConfig(netconfig.Bytes, "")
+	if err != nil {
+		return nil, fmt.Errorf("Failed to get IPAM details from the CNI conf file: %s", err.Error())
+	}
+	return ipamConfig, nil
+}
+
+func (nrc *NetworkRoutingController) advertiseRoute() error {
+
+	ipamConfig, err := nrc.getIpamConfig()
+	if err != nil {
+		return err
+	}
+	cidrlen, _ := ipamConfig.Subnet.Mask.Size()
+	attrs := []bgp.PathAttributeInterface{
+		bgp.NewPathAttributeOrigin(0),
+		bgp.NewPathAttributeNextHop(nrc.nodeIP.String()),
+		bgp.NewPathAttributeAsPath([]bgp.AsPathParamInterface{bgp.NewAs4PathParam(bgp.BGP_ASPATH_ATTR_TYPE_SEQ, []uint32{4000, 400000, 300000, 40001})}),
+	}
+	glog.Infof("Advertising route: '%s/%s via %s' to peers", ipamConfig.Subnet.IP.String(), strconv.Itoa(cidrlen), nrc.nodeIP.String())
+	if _, err := nrc.bgpServer.AddPath("", []*table.Path{table.NewPath(nil, bgp.NewIPAddrPrefix(uint8(cidrlen),
+		ipamConfig.Subnet.IP.String()), false, attrs, time.Now(), false)}); err != nil {
+		return fmt.Errorf(err.Error())
+	}
+	return nil
+}
+
+func (nrc *NetworkRoutingController) injectRoute(path *table.Path) error {
+	nexthop := path.GetNexthop()
+	nlri := path.GetNlri()
+	dst, _ := netlink.ParseIPNet(nlri.String())
+	route := &netlink.Route{
+		Dst:      dst,
+		Gw:       nexthop,
+		Protocol: 0x11,
+	}
+
+	glog.Infof("Inject route: '%s via %s' from peer to routing table", dst, nexthop)
+	return netlink.RouteReplace(route)
+}
+
+func (nrc *NetworkRoutingController) Cleanup() {
+
+}
+
+func NewNetworkRoutingController(clientset *kubernetes.Clientset, kubeRouterConfig *options.KubeRouterConfig) (*NetworkRoutingController, error) {
+
+	nrc := NetworkRoutingController{}
+
+	nrc.syncPeriod = kubeRouterConfig.RoutesSyncPeriod
+	nrc.clientset = clientset
+	nrc.cniConfFile = kubeRouterConfig.CniConfFile
+	if _, err := os.Stat(nrc.cniConfFile); os.IsNotExist(err) {
+		panic("Specified CNI conf file does not exist")
+	}
+	_, err := nrc.getIpamConfig()
+	if err != nil {
+		panic("Failed to read IPAM conf from the CNI conf file: " + err.Error())
+	}
+
+	nodeHostName, err := os.Hostname()
+	if err != nil {
+		panic(err.Error())
+	}
+	nrc.nodeHostName = nodeHostName
+
+	node, err := clientset.Core().Nodes().Get(nodeHostName, metav1.GetOptions{})
+	if err != nil {
+		panic(err.Error())
+	}
+	nodeIP, err := getNodeIP(node)
+	if err != nil {
+		panic(err.Error())
+	}
+	nrc.nodeIP = nodeIP
+
+	nrc.bgpServer = gobgp.NewBgpServer()
+	go nrc.bgpServer.Serve()
+
+	g := bgpapi.NewGrpcServer(nrc.bgpServer, ":50051")
+	go g.Serve()
+
+	global := &config.Global{
+		Config: config.GlobalConfig{
+			As:       65000,
+			RouterId: nrc.nodeIP.String(),
+		},
+	}
+
+	if err := nrc.bgpServer.Start(global); err != nil {
+		panic(err)
+	}
+
+	go nrc.watchBgpUpdates()
+
+	return &nrc, nil
+}

app/controllers/network_services_controller.go

@@ -0,0 +1,509 @@
+package controllers
+
+import (
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"os"
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/app/options"
+	"github.com/cloudnativelabs/kube-router/app/watchers"
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/golang/glog"
+	"github.com/mqliang/libipvs"
+	"github.com/vishvananda/netlink"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+const (
+	KUBE_DUMMY_IF      = "kube-dummy-if"
+	IFACE_NOT_FOUND    = "Link not found"
+	IFACE_HAS_ADDR     = "file exists"
+	IPVS_SERVER_EXISTS = "file exists"
+)
+
+// Network services controller enables local node as network service proxy through IPVS/LVS.
+// Support only Kuberntes network services of type NodePort, ClusterIP. For each service a
+// IPVS service is created and for each service endpoint a server is added to the IPVS service.
+// As services and endpoints are updated, network service controller gets the updates from
+// the kubernetes api server and syncs the ipvs configuration to reflect state of services
+// and endpoints
+
+type NetworkServicesController struct {
+	nodeIP       net.IP
+	nodeHostName string
+	syncPeriod   time.Duration
+	mu           sync.Mutex
+	serviceMap   serviceInfoMap
+	endpointsMap endpointsInfoMap
+}
+
+// internal representation of kubernetes service
+type serviceInfo struct {
+	clusterIP net.IP
+	port      int
+	protocol  string
+	nodePort  int
+}
+
+// map of all services, with unique service id(namespace name, service name, port) as key
+type serviceInfoMap map[string]*serviceInfo
+
+// internal representation of endpoints
+type endpointsInfo struct {
+	ip   string
+	port int
+}
+
+// map of all endpoints, with unique service id(namespace name, service name, port) as key
+type endpointsInfoMap map[string][]endpointsInfo
+
+// periodically sync ipvs configuration to reflect desired state of services and endpoints
+func (nsc *NetworkServicesController) Run(stopCh <-chan struct{}, wg *sync.WaitGroup) {
+
+	t := time.NewTicker(nsc.syncPeriod)
+	defer t.Stop()
+	defer wg.Done()
+
+	glog.Infof("Starting network services controller")
+
+	// enable ipvs connection tracking
+	err := ensureIpvsConntrack()
+	if err != nil {
+		panic("Failed to do sysctl net.ipv4.vs.conntrack=1 due to: %s" + err.Error())
+	}
+
+	// loop forever unitl notified to stop on stopCh
+	for {
+		select {
+		case <-stopCh:
+			glog.Infof("Shutting down network services controller")
+			return
+		default:
+		}
+
+		if watchers.PodWatcher.HasSynced() && watchers.NetworkPolicyWatcher.HasSynced() {
+			glog.Infof("Performing periodic syn of the ipvs services and server to reflect desired state of kubernetes services and endpoints")
+			nsc.sync()
+		} else {
+			continue
+		}
+
+		select {
+		case <-stopCh:
+			glog.Infof("Shutting down network services controller")
+			return
+		case <-t.C:
+		}
+	}
+}
+
+func (nsc *NetworkServicesController) sync() {
+	nsc.mu.Lock()
+	defer nsc.mu.Unlock()
+
+	nsc.serviceMap = buildServicesInfo()
+	nsc.endpointsMap = buildEndpointsInfo()
+	nsc.syncIpvsServices(nsc.serviceMap, nsc.endpointsMap)
+}
+
+// handle change in endpoints update from the API server
+func (nsc *NetworkServicesController) OnEndpointsUpdate(endpointsUpdate *watchers.EndpointsUpdate) {
+
+	nsc.mu.Lock()
+	defer nsc.mu.Unlock()
+
+	glog.Infof("Received endpoints update from watch API")
+	if !(watchers.ServiceWatcher.HasSynced() && watchers.EndpointsWatcher.HasSynced()) {
+		glog.Infof("Skipping ipvs server sync as local cache is not synced yet")
+	}
+
+	// build new endpoints map to reflect the change
+	newEndpointsMap := buildEndpointsInfo()
+
+	if len(newEndpointsMap) != len(nsc.endpointsMap) || !reflect.DeepEqual(newEndpointsMap, nsc.endpointsMap) {
+		nsc.endpointsMap = newEndpointsMap
+		nsc.syncIpvsServices(nsc.serviceMap, nsc.endpointsMap)
+	} else {
+		glog.Infof("Skipping ipvs server sync on endpoints update because nothing changed")
+	}
+}
+
+// handle change in service update from the API server
+func (nsc *NetworkServicesController) OnServiceUpdate(serviceUpdate *watchers.ServiceUpdate) {
+
+	nsc.mu.Lock()
+	defer nsc.mu.Unlock()
+
+	glog.Infof("Received service update from watch API")
+	if !(watchers.ServiceWatcher.HasSynced() && watchers.EndpointsWatcher.HasSynced()) {
+		glog.Infof("Skipping ipvs server sync as local cache is not synced yet")
+	}
+
+	// build new services map to reflect the change
+	newServiceMap := buildServicesInfo()
+
+	if len(newServiceMap) != len(nsc.serviceMap) || !reflect.DeepEqual(newServiceMap, nsc.serviceMap) {
+		nsc.serviceMap = newServiceMap
+		nsc.syncIpvsServices(nsc.serviceMap, nsc.endpointsMap)
+	} else {
+		glog.Infof("Skipping ipvs server sync on service update because nothing changed")
+	}
+}
+
+// sync the ipvs service and server details configured to reflect the desired state of services and endpoint
+// as learned from services and endpoints information from the api server
+func (nsc *NetworkServicesController) syncIpvsServices(serviceInfoMap serviceInfoMap, endpointsInfoMap endpointsInfoMap) {
+
+	start := time.Now()
+	defer func() {
+		glog.Infof("sync ipvs servers took %v", time.Since(start))
+	}()
+
+	dummyVipInterface := getKubeDummyInterface()
+
+	// map of active services and service endpoints
+	activeServiceEndpointMap := make(map[string][]string)
+
+	for k, svc := range serviceInfoMap {
+
+		var protocol uint16
+		if svc.protocol == "tcp" {
+			protocol = syscall.IPPROTO_TCP
+		} else {
+			protocol = syscall.IPPROTO_UDP
+		}
+
+		// assign cluster IP of the service to the dummy interface so that its routable from the pod's on the node
+		vip := &netlink.Addr{IPNet: &net.IPNet{svc.clusterIP, net.IPv4Mask(255, 255, 255, 255)}, Scope: syscall.RT_SCOPE_LINK}
+		err := netlink.AddrAdd(dummyVipInterface, vip)
+		if err != nil && err.Error() != IFACE_HAS_ADDR {
+			glog.Errorf("Failed to assign cluster ip to dummy interface %s", err)
+			continue
+		}
+
+		// create IPVS service for the service to be exposed through the cluster ip
+		ipvs_cluster_vip_svc, err := ipvsAddService(svc.clusterIP, protocol, uint16(svc.port))
+		if err != nil {
+			glog.Errorf("Failed to create ipvs service for cluster ip: ", err.Error())
+			continue
+		}
+		var clusterServiceId = generateIpPortId(svc.clusterIP.String(), svc.protocol, strconv.Itoa(svc.port))
+		activeServiceEndpointMap[clusterServiceId] = make([]string, 0)
+
+		// create IPVS service for the service to be exposed through the nodeport
+		var ipvs_nodeport_svc *libipvs.Service
+		var nodeServiceId string
+		if svc.nodePort != 0 {
+			ipvs_nodeport_svc, err = ipvsAddService(nsc.nodeIP, protocol, uint16(svc.nodePort))
+			if err != nil {
+				glog.Errorf("Failed to create ipvs service for node port")
+				continue
+			}
+			nodeServiceId = generateIpPortId(nsc.nodeIP.String(), svc.protocol, strconv.Itoa(svc.nodePort))
+			activeServiceEndpointMap[nodeServiceId] = make([]string, 0)
+		}
+
+		// add IPVS remote server to the IPVS service
+		endpoints := endpointsInfoMap[k]
+		for _, endpoint := range endpoints {
+			dst := libipvs.Destination{
+				Address:       net.ParseIP(endpoint.ip),
+				AddressFamily: syscall.AF_INET,
+				Port:          uint16(endpoint.port),
+				Weight:        1,
+			}
+			err := ipvsAddServer(ipvs_cluster_vip_svc, &dst)
+			if err != nil {
+				glog.Errorf(err.Error())
+			}
+			activeServiceEndpointMap[clusterServiceId] = append(activeServiceEndpointMap[clusterServiceId], endpoint.ip)
+			if svc.nodePort != 0 {
+				err := ipvsAddServer(ipvs_nodeport_svc, &dst)
+				activeServiceEndpointMap[nodeServiceId] = append(activeServiceEndpointMap[clusterServiceId], endpoint.ip)
+				if err != nil {
+					glog.Errorf(err.Error())
+				}
+			}
+		}
+	}
+
+	// cleanup stale ipvs service and servers
+	glog.Infof("Cleaning up if any, old ipvs service and servers which are no longer needed")
+	h, err := libipvs.New()
+	if err != nil {
+		panic(err)
+	}
+	ipvsSvcs, err := h.ListServices()
+	if err != nil {
+		panic(err)
+	}
+	for _, ipvsSvc := range ipvsSvcs {
+		key := generateIpPortId(ipvsSvc.Address.String(), ipvsSvc.Protocol.String(), strconv.Itoa(int(ipvsSvc.Port)))
+		endpoints, ok := activeServiceEndpointMap[key]
+		if !ok {
+			glog.Infof("Found a IPVS service %s:%s:%s which is no longer needed so cleaning up", ipvsSvc.Address.String(), ipvsSvc.Protocol.String(), strconv.Itoa(int(ipvsSvc.Port)))
+			err := h.DelService(ipvsSvc)
+			if err != nil {
+				glog.Errorf("Failed to delete stale IPVS service: ", err.Error())
+				continue
+			}
+		} else {
+			dsts, err := h.ListDestinations(ipvsSvc)
+			if err != nil {
+				glog.Errorf("Failed to get list of servers from ipvs service")
+			}
+			for _, dst := range dsts {
+				validEp := false
+				for _, ep := range endpoints {
+					if ep == dst.Address.String() {
+						validEp = true
+						break
+					}
+				}
+				if !validEp {
+					glog.Infof("Found a IPVS service %s:%s:%s, destination %s which is no longer needed so cleaning up",
+						ipvsSvc.Address.String(), ipvsSvc.Protocol.String(), strconv.Itoa(int(ipvsSvc.Port)), dst.Address.String())
+					err := h.DelDestination(ipvsSvc, dst)
+					if err != nil {
+						glog.Errorf("Failed to delete server from ipvs service")
+					}
+				}
+			}
+		}
+	}
+	glog.Infof("IPVS servers and services are synced to desired state!!")
+}
+
+func buildServicesInfo() serviceInfoMap {
+	serviceMap := make(serviceInfoMap)
+	for _, svc := range watchers.ServiceWatcher.List() {
+
+		if svc.Spec.ClusterIP == "None" || svc.Spec.ClusterIP == "" {
+			glog.Infof("Skipping service name:%s namespace:%s as there is no cluster IP", svc.Name, svc.Namespace)
+			continue
+		}
+
+		if svc.Spec.Type == "LoadBalancer" || svc.Spec.Type == "ExternalName" {
+			glog.Infof("Skipping service name:%s namespace:%s due to service Type=%s", svc.Name, svc.Namespace, svc.Spec.Type)
+			continue
+		}
+
+		for _, port := range svc.Spec.Ports {
+			svcInfo := serviceInfo{
+				clusterIP: net.ParseIP(svc.Spec.ClusterIP),
+				port:      int(port.Port),
+				protocol:  strings.ToLower(string(port.Protocol)),
+				nodePort:  int(port.NodePort),
+			}
+			svcId := generateServiceId(svc.Namespace, svc.Name, strconv.Itoa(int(port.Port)))
+			serviceMap[svcId] = &svcInfo
+		}
+	}
+	return serviceMap
+}
+
+func buildEndpointsInfo() endpointsInfoMap {
+	endpointsMap := make(endpointsInfoMap)
+	for _, ep := range watchers.EndpointsWatcher.List() {
+		for _, ep_subset := range ep.Subsets {
+			for _, port := range ep_subset.Ports {
+				svcId := generateServiceId(ep.Namespace, ep.Name, strconv.Itoa(int(port.Port)))
+				endpoints := make([]endpointsInfo, 0)
+				for _, addr := range ep_subset.Addresses {
+					endpoints = append(endpoints, endpointsInfo{ip: addr.IP, port: int(port.Port)})
+				}
+				endpointsMap[svcId] = endpoints
+			}
+		}
+	}
+	return endpointsMap
+}
+
+// Add an iptable rule to masqurade outbound IPVS traffic. IPVS nat requires that reverse path traffic
+// to go through the director for its functioning. So the masqurae rule ensures source IP is modifed
+// to node ip, so return traffic from real server (endpoint pods) hits the node/lvs director
+func ensureMasqueradeIptablesRule() error {
+	iptablesCmdHandler, err := iptables.New()
+	if err != nil {
+		return errors.New("Failed to initialize iptables executor" + err.Error())
+	}
+	args := []string{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "-j", "MASQUERADE"}
+	err = iptablesCmdHandler.AppendUnique("nat", "POSTROUTING", args...)
+	if err != nil {
+		return errors.New("Failed to run iptables command" + err.Error())
+	}
+	glog.Infof("Successfully added iptables masqurade rule")
+	return nil
+}
+
+func ensureIpvsConntrack() error {
+	return ioutil.WriteFile("/proc/sys/net/ipv4/vs/conntrack", []byte(strconv.Itoa(1)), 0640)
+}
+
+func deleteMasqueradeIptablesRule() error {
+	iptablesCmdHandler, err := iptables.New()
+	if err != nil {
+		return errors.New("Failed to initialize iptables executor" + err.Error())
+	}
+	args := []string{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "-j", "MASQUERADE"}
+	err = iptablesCmdHandler.Delete("nat", "POSTROUTING", args...)
+	if err != nil {
+		return errors.New("Failed to run iptables command" + err.Error())
+	}
+	return nil
+}
+
+func ipvsAddService(vip net.IP, protocol, port uint16) (*libipvs.Service, error) {
+	h, err := libipvs.New()
+	if err != nil {
+		panic(err)
+	}
+	svcs, err := h.ListServices()
+	if err != nil {
+		panic(err)
+	}
+	for _, svc := range svcs {
+		if strings.Compare(vip.String(), svc.Address.String()) == 0 &&
+			libipvs.Protocol(protocol) == svc.Protocol && port == svc.Port {
+			glog.Infof("ipvs service %s:%s:%s already exists so returning", vip.String(),
+				libipvs.Protocol(protocol), strconv.Itoa(int(port)))
+			return svc, nil
+		}
+	}
+	svc := libipvs.Service{
+		Address:       vip,
+		AddressFamily: syscall.AF_INET,
+		Protocol:      libipvs.Protocol(protocol),
+		Port:          port,
+		SchedName:     libipvs.RoundRobin,
+	}
+	if err := h.NewService(&svc); err != nil {
+		return nil, fmt.Errorf("Failed to create service: %s:%s:%s", vip.String(), libipvs.Protocol(protocol), strconv.Itoa(int(port)))
+	}
+	glog.Infof("Successfully added service: %s:%s:%s", vip.String(), libipvs.Protocol(protocol), strconv.Itoa(int(port)))
+	return &svc, nil
+}
+
+func ipvsAddServer(service *libipvs.Service, dest *libipvs.Destination) error {
+	h, err := libipvs.New()
+	if err != nil {
+		panic(err)
+	}
+
+	err = h.NewDestination(service, dest)
+	if err == nil {
+		glog.Infof("Successfully added destination %s:%s to the service %s:%s:%s", dest.Address,
+			strconv.Itoa(int(dest.Port)), service.Address, service.Protocol, strconv.Itoa(int(service.Port)))
+		return nil
+	}
+
+	if strings.Contains(err.Error(), IPVS_SERVER_EXISTS) {
+		glog.Infof("ipvs destination %s:%s already exists in the ipvs service %s:%s:%s so not adding destination", dest.Address,
+			strconv.Itoa(int(dest.Port)), service.Address, service.Protocol, strconv.Itoa(int(service.Port)))
+	} else {
+		return fmt.Errorf("Failed to add ipvs destination %s:%s to the ipvs service %s:%s:%s due to : %s", dest.Address,
+			strconv.Itoa(int(dest.Port)), service.Address, service.Protocol, strconv.Itoa(int(service.Port)), err.Error())
+	}
+	return nil
+}
+
+// unique identfier for a load-balanced service (namespace + name + portname)
+func generateServiceId(namespace, svcName, port string) string {
+	return namespace + "-" + svcName + "-" + port
+}
+
+// unique identfier for a load-balanced service (namespace + name + portname)
+func generateIpPortId(ip, protocol, port string) string {
+	return ip + "-" + protocol + "-" + port
+}
+
+func getKubeDummyInterface() netlink.Link {
+	var dummyVipInterface netlink.Link
+	dummyVipInterface, err := netlink.LinkByName(KUBE_DUMMY_IF)
+	if err != nil && err.Error() == IFACE_NOT_FOUND {
+		glog.Infof("Could not find dummy interface: " + KUBE_DUMMY_IF + " to assign cluster ip's, so creating one")
+		err = netlink.LinkAdd(&netlink.Dummy{netlink.LinkAttrs{Name: KUBE_DUMMY_IF}})
+		if err != nil {
+			panic("Failed to add dummy interface:  " + err.Error())
+		}
+		dummyVipInterface, err = netlink.LinkByName(KUBE_DUMMY_IF)
+		err = netlink.LinkSetUp(dummyVipInterface)
+		if err != nil {
+			panic("Failed to bring dummy interface up: " + err.Error())
+		}
+	}
+	return dummyVipInterface
+}
+
+// clean up all the configurations (IPVS, iptables, links)
+func (nsc *NetworkServicesController) Cleanup() {
+
+	// cleanup ipvs rules by flush
+	h, err := libipvs.New()
+	if err != nil {
+		panic(err)
+	}
+	glog.Infof("Cleaning up IPVS configuration permanently")
+	err = h.Flush()
+	if err != nil {
+		glog.Errorf("Failed to cleanup ipvs rules: ", err.Error())
+		return
+	}
+
+	// cleanup iptable masqurade rule
+	deleteMasqueradeIptablesRule()
+
+	// delete dummy interface used to assign cluster IP's
+	dummyVipInterface, err := netlink.LinkByName(KUBE_DUMMY_IF)
+	if err != nil {
+		if err.Error() != IFACE_NOT_FOUND {
+			glog.Infof("Dummy interface: " + KUBE_DUMMY_IF + " does not exist")
+		}
+	} else {
+		err = netlink.LinkDel(dummyVipInterface)
+		if err != nil {
+			glog.Errorf("Could not delete dummy interface: "+KUBE_DUMMY_IF, err.Error())
+			return
+		}
+	}
+	glog.Infof("Successfully cleaned the ipvs configuration done by kube-router")
+}
+
+func NewNetworkServicesController(clientset *kubernetes.Clientset, config *options.KubeRouterConfig) (*NetworkServicesController, error) {
+
+	nsc := NetworkServicesController{}
+	nsc.syncPeriod = config.IpvsSyncPeriod
+
+	nsc.serviceMap = make(serviceInfoMap)
+	nsc.endpointsMap = make(endpointsInfoMap)
+
+	nodeHostName, err := os.Hostname()
+	if err != nil {
+		panic(err.Error())
+	}
+	nsc.nodeHostName = nodeHostName
+
+	node, err := clientset.Core().Nodes().Get(nodeHostName, v1.GetOptions{})
+	if err != nil {
+		panic(err.Error())
+	}
+	nodeIP, err := getNodeIP(node)
+	if err != nil {
+		panic(err.Error())
+	}
+	nsc.nodeIP = nodeIP
+
+	watchers.EndpointsWatcher.RegisterHandler(&nsc)
+	watchers.ServiceWatcher.RegisterHandler(&nsc)
+
+	return &nsc, nil
+}

app/options/options.go

@@ -0,0 +1,45 @@
+package options
+
+import (
+	"time"
+
+	"github.com/spf13/pflag"
+)
+
+type KubeRouterConfig struct {
+	Kubeconfig         string
+	Master             string
+	ConfigSyncPeriod   time.Duration
+	CleanupConfig      bool
+	IPTablesSyncPeriod time.Duration
+	IpvsSyncPeriod     time.Duration
+	RoutesSyncPeriod   time.Duration
+	RunServiceProxy    bool
+	RunFirewall        bool
+	RunRouter          bool
+	CniConfFile        string
+}
+
+func NewKubeRouterConfig() *KubeRouterConfig {
+	return &KubeRouterConfig{ConfigSyncPeriod: 1 * time.Minute,
+		IpvsSyncPeriod:     1 * time.Minute,
+		IPTablesSyncPeriod: 1 * time.Minute,
+		RoutesSyncPeriod:   1 * time.Minute,
+		RunServiceProxy:    true,
+		RunFirewall:        true,
+		RunRouter:          false}
+}
+
+func (s *KubeRouterConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&s.Master, "master", s.Master, "The address of the Kubernetes API server (overrides any value in kubeconfig)")
+	fs.StringVar(&s.Kubeconfig, "kubeconfig", s.Kubeconfig, "Path to kubeconfig file with authorization information (the master location is set by the master flag).")
+	fs.BoolVar(&s.CleanupConfig, "cleanup-config", s.CleanupConfig, "If true cleanup iptables rules, ipvs, ipset configuration and exit.")
+	fs.DurationVar(&s.ConfigSyncPeriod, "config-sync-period", s.ConfigSyncPeriod, "How often configuration from the apiserver is refreshed.  Must be greater than 0.")
+	fs.DurationVar(&s.IPTablesSyncPeriod, "iptables-sync-period", s.IPTablesSyncPeriod, "The maximum interval of how often iptables rules are refreshed (e.g. '5s', '1m'). Must be greater than 0.")
+	fs.DurationVar(&s.IpvsSyncPeriod, "ipvs-sync-period", s.IpvsSyncPeriod, "The maximum interval of how often ipvs config is refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.")
+	fs.DurationVar(&s.RoutesSyncPeriod, "routes-sync-period", s.RoutesSyncPeriod, "The maximum interval of how often routes are adrvertised and learned (e.g. '5s', '1m', '2h22m'). Must be greater than 0.")
+	fs.BoolVar(&s.RunServiceProxy, "run-service-proxy", s.RunServiceProxy, "If false, kube-router wont setup IPVS for services proxy. True by default.")
+	fs.BoolVar(&s.RunFirewall, "run-firewall", s.RunFirewall, "If false, kube-router wont setup iptables to provide ingress firewall for pods. True by default.")
+	fs.BoolVar(&s.RunRouter, "run-router", s.RunRouter, "If true each node advertise routes the rest of the nodes and learn the routes for the pods. False by default.")
+	fs.StringVar(&s.CniConfFile, "cni-conf-file", s.CniConfFile, "Full path to CNI configuration file.")
+}

app/server.go

@@ -0,0 +1,156 @@
+package app
+
+import (
+	"errors"
+	"os"
+	"os/signal"
+	"sync"
+	"syscall"
+
+	"github.com/cloudnativelabs/kube-router/app/controllers"
+	"github.com/cloudnativelabs/kube-router/app/options"
+	"github.com/cloudnativelabs/kube-router/app/watchers"
+	"github.com/golang/glog"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+type KubeRouter struct {
+	Client *kubernetes.Clientset
+	Config *options.KubeRouterConfig
+}
+
+func NewKubeRouterDefault(config *options.KubeRouterConfig) (*KubeRouter, error) {
+
+	clientconfig, err := clientcmd.BuildConfigFromFlags(config.Master, config.Kubeconfig)
+	if err != nil {
+		panic(err.Error())
+	}
+
+	clientset, err := kubernetes.NewForConfig(clientconfig)
+	if err != nil {
+		panic(err.Error())
+	}
+
+	return &KubeRouter{Client: clientset, Config: config}, nil
+}
+
+func CleanupConfigAndExit() {
+	npc := controllers.NetworkPolicyController{}
+	npc.Cleanup()
+
+	nsc := controllers.NetworkServicesController{}
+	nsc.Cleanup()
+
+	nrc := controllers.NetworkRoutingController{}
+	nrc.Cleanup()
+}
+
+// start API watchers to get notification on changes
+func (kr *KubeRouter) startApiWatchers() error {
+
+	var err error
+
+	_, err = watchers.StartPodWatcher(kr.Client, kr.Config.ConfigSyncPeriod)
+	if err != nil {
+		return errors.New("Failed to launch pod api watcher: " + err.Error())
+	}
+
+	_, err = watchers.StartEndpointsWatcher(kr.Client, kr.Config.ConfigSyncPeriod)
+	if err != nil {
+		return errors.New("Failed to launch endpoint api watcher: " + err.Error())
+	}
+
+	_, err = watchers.StartNetworkPolicyWatcher(kr.Client, kr.Config.ConfigSyncPeriod)
+	if err != nil {
+		return errors.New("Failed to launch network policy api watcher: " + err.Error())
+	}
+
+	_, err = watchers.StartNamespaceWatcher(kr.Client, kr.Config.ConfigSyncPeriod)
+	if err != nil {
+		return errors.New("Failed to launch namespace api watcher: " + err.Error())
+	}
+
+	_, err = watchers.StartServiceWatcher(kr.Client, kr.Config.ConfigSyncPeriod)
+	if err != nil {
+		return errors.New("Failed to launch service api watcher: " + err.Error())
+	}
+
+	return nil
+}
+
+func (kr *KubeRouter) stopApiWatchers() {
+	watchers.StopPodWatcher()
+	watchers.StopEndpointsWatcher()
+	watchers.StopNetworkPolicyWatcher()
+	watchers.StopNamespaceWatcher()
+	watchers.StopServiceWatcher()
+}
+
+func (kr *KubeRouter) Run() error {
+
+	var err error
+	var nscStopCh, npcStopCh, nrcStopCh chan struct{}
+	var wg sync.WaitGroup
+
+	err = kr.startApiWatchers()
+	if err != nil {
+		panic("Failed to start API watchers: " + err.Error())
+	}
+
+	if !(kr.Config.RunFirewall || kr.Config.RunServiceProxy || kr.Config.RunRouter) {
+		glog.Infof("None of router, firewall, service proxy functionality was specified to be run. So exiting")
+		os.Exit(0)
+	}
+
+	if kr.Config.RunFirewall {
+		npc, err := controllers.NewNetworkPolicyController(kr.Client, kr.Config)
+		if err != nil {
+			panic("Failed to create network policy controller")
+		}
+		npcStopCh = make(chan struct{})
+		wg.Add(1)
+		go npc.Run(npcStopCh, &wg)
+	}
+
+	if kr.Config.RunServiceProxy {
+		nsc, err := controllers.NewNetworkServicesController(kr.Client, kr.Config)
+		if err != nil {
+			panic("Failed to create network services controller")
+		}
+		nscStopCh = make(chan struct{})
+		wg.Add(1)
+		go nsc.Run(nscStopCh, &wg)
+	}
+
+	if kr.Config.RunRouter {
+		nrc, err := controllers.NewNetworkRoutingController(kr.Client, kr.Config)
+		if err != nil {
+			panic("Failed to create network routing controller")
+		}
+		nrcStopCh = make(chan struct{})
+		wg.Add(1)
+		go nrc.Run(nrcStopCh, &wg)
+	}
+
+	// Handle SIGINT and SIGTERM
+	ch := make(chan os.Signal)
+	signal.Notify(ch, syscall.SIGINT, syscall.SIGTERM)
+	<-ch
+
+	glog.Infof("Shutting down the controllers")
+	if kr.Config.RunServiceProxy {
+		nscStopCh <- struct{}{}
+	}
+	if kr.Config.RunFirewall {
+		npcStopCh <- struct{}{}
+	}
+	if kr.Config.RunRouter {
+		nrcStopCh <- struct{}{}
+	}
+
+	kr.stopApiWatchers()
+
+	wg.Wait()
+	return nil
+}

app/watchers/endpoints_watcher.go

@@ -0,0 +1,119 @@
+package watchers
+
+import (
+	"reflect"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/utils"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/client-go/kubernetes"
+	api "k8s.io/client-go/pkg/api/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+type Operation int
+
+const (
+	ADD Operation = iota
+	UPDATE
+	REMOVE
+	SYNCED
+)
+
+type EndpointsUpdate struct {
+	Endpoints *api.Endpoints
+	Op        Operation
+}
+
+var (
+	EndpointsWatcher *endpointsWatcher
+)
+
+type endpointsWatcher struct {
+	clientset           *kubernetes.Clientset
+	endpointsController cache.Controller
+	endpointsLister     cache.Indexer
+	broadcaster         *utils.Broadcaster
+}
+
+type EndpointsUpdatesHandler interface {
+	OnEndpointsUpdate(endpointsUpdate *EndpointsUpdate)
+}
+
+func (ew *endpointsWatcher) endpointsAddEventHandler(obj interface{}) {
+	endpoints, ok := obj.(*api.Endpoints)
+	if !ok {
+		return
+	}
+	ew.broadcaster.Notify(&EndpointsUpdate{Op: ADD, Endpoints: endpoints})
+}
+
+func (ew *endpointsWatcher) endpointsDeleteEventHandler(obj interface{}) {
+	endpoints, ok := obj.(*api.Endpoints)
+	if !ok {
+		return
+	}
+	ew.broadcaster.Notify(&EndpointsUpdate{Op: REMOVE, Endpoints: endpoints})
+}
+
+func (ew *endpointsWatcher) endpointsUpdateEventHandler(oldObj, newObj interface{}) {
+	endpoints, ok := newObj.(*api.Endpoints)
+	if !ok {
+		return
+	}
+	if !reflect.DeepEqual(newObj, oldObj) {
+		if endpoints.Name != "kube-scheduler" && endpoints.Name != "kube-controller-manager" {
+			ew.broadcaster.Notify(&EndpointsUpdate{Op: UPDATE, Endpoints: endpoints})
+		}
+	}
+}
+
+func (ew *endpointsWatcher) RegisterHandler(handler EndpointsUpdatesHandler) {
+	ew.broadcaster.Add(utils.ListenerFunc(func(instance interface{}) {
+		handler.OnEndpointsUpdate(instance.(*EndpointsUpdate))
+	}))
+}
+
+func (ew *endpointsWatcher) List() []*api.Endpoints {
+	obj_list := ew.endpointsLister.List()
+	ep_instances := make([]*api.Endpoints, len(obj_list))
+	for i, ins := range obj_list {
+		ep_instances[i] = ins.(*api.Endpoints)
+	}
+	return ep_instances
+}
+
+func (ew *endpointsWatcher) HasSynced() bool {
+	return ew.endpointsController.HasSynced()
+}
+
+var endpointsStopCh chan struct{}
+
+func StartEndpointsWatcher(clientset *kubernetes.Clientset, resyncPeriod time.Duration) (*endpointsWatcher, error) {
+
+	ew := endpointsWatcher{}
+	EndpointsWatcher = &ew
+
+	eventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc:    ew.endpointsAddEventHandler,
+		DeleteFunc: ew.endpointsDeleteEventHandler,
+		UpdateFunc: ew.endpointsUpdateEventHandler,
+	}
+
+	ew.clientset = clientset
+	ew.broadcaster = utils.NewBroadcaster()
+	lw := cache.NewListWatchFromClient(clientset.Core().RESTClient(), "endpoints", metav1.NamespaceAll, fields.Everything())
+	ew.endpointsLister, ew.endpointsController = cache.NewIndexerInformer(
+		lw,
+		&api.Endpoints{}, resyncPeriod, eventHandler,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	endpointsStopCh = make(chan struct{})
+	go ew.endpointsController.Run(endpointsStopCh)
+	return &ew, nil
+}
+
+func StopEndpointsWatcher() {
+	endpointsStopCh <- struct{}{}
+}

app/watchers/namespace_watcher.go

@@ -0,0 +1,102 @@
+package watchers
+
+import (
+	"reflect"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/utils"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/client-go/kubernetes"
+	api "k8s.io/client-go/pkg/api/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+type NamespaceUpdate struct {
+	Namespace *api.Namespace
+	Op        Operation
+}
+
+var (
+	NamespaceWatcher *namespaceWatcher
+	namespaceStopCh  chan struct{}
+)
+
+type namespaceWatcher struct {
+	clientset           *kubernetes.Clientset
+	namespaceController cache.Controller
+	namespaceLister     cache.Indexer
+	broadcaster         *utils.Broadcaster
+}
+
+type NamespaceUpdatesHandler interface {
+	OnNamespaceUpdate(namespaceUpdate *NamespaceUpdate)
+}
+
+func (nsw *namespaceWatcher) namespaceAddEventHandler(obj interface{}) {
+	namespace, ok := obj.(*api.Namespace)
+	if !ok {
+		return
+	}
+	nsw.broadcaster.Notify(&NamespaceUpdate{Op: ADD, Namespace: namespace})
+}
+
+func (nsw *namespaceWatcher) namespaceDeleteEventHandler(obj interface{}) {
+	namespace, ok := obj.(*api.Namespace)
+	if !ok {
+		return
+	}
+	nsw.broadcaster.Notify(&NamespaceUpdate{Op: REMOVE, Namespace: namespace})
+}
+
+func (nsw *namespaceWatcher) namespaceAUpdateEventHandler(oldObj, newObj interface{}) {
+	namespace, ok := newObj.(*api.Namespace)
+	if !ok {
+		return
+	}
+	if !reflect.DeepEqual(newObj, oldObj) {
+		nsw.broadcaster.Notify(&NamespaceUpdate{Op: UPDATE, Namespace: namespace})
+	}
+}
+
+func (nsw *namespaceWatcher) List() []*api.Namespace {
+	obj_list := nsw.namespaceLister.List()
+	namespace_instances := make([]*api.Namespace, len(obj_list))
+	for i, ins := range obj_list {
+		namespace_instances[i] = ins.(*api.Namespace)
+	}
+	return namespace_instances
+}
+
+func (nsw *namespaceWatcher) RegisterHandler(handler NamespaceUpdatesHandler) {
+	nsw.broadcaster.Add(utils.ListenerFunc(func(instance interface{}) {
+		handler.OnNamespaceUpdate(instance.(*NamespaceUpdate))
+	}))
+}
+
+func StartNamespaceWatcher(clientset *kubernetes.Clientset, resyncPeriod time.Duration) (*namespaceWatcher, error) {
+
+	nsw := namespaceWatcher{}
+	NamespaceWatcher = &nsw
+	eventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc:    nsw.namespaceAddEventHandler,
+		DeleteFunc: nsw.namespaceDeleteEventHandler,
+		UpdateFunc: nsw.namespaceAUpdateEventHandler,
+	}
+
+	nsw.clientset = clientset
+	nsw.broadcaster = utils.NewBroadcaster()
+	lw := cache.NewListWatchFromClient(clientset.Core().RESTClient(), "namespaces", metav1.NamespaceAll, fields.Everything())
+	nsw.namespaceLister, nsw.namespaceController = cache.NewIndexerInformer(
+		lw,
+		&api.Namespace{}, resyncPeriod, eventHandler,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	namespaceStopCh = make(chan struct{})
+	go nsw.namespaceController.Run(namespaceStopCh)
+	return &nsw, nil
+}
+
+func StopNamespaceWatcher() {
+	namespaceStopCh <- struct{}{}
+}

app/watchers/network_policy_watcher.go

@@ -0,0 +1,108 @@
+package watchers
+
+import (
+	"reflect"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/utils"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/client-go/kubernetes"
+	apiextensions "k8s.io/client-go/pkg/apis/extensions/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+type NetworkPolicyUpdate struct {
+	NetworkPolicy *apiextensions.NetworkPolicy
+	Op            Operation
+}
+
+var (
+	NetworkPolicyWatcher *networkPolicyWatcher
+)
+
+type networkPolicyWatcher struct {
+	clientset               *kubernetes.Clientset
+	networkPolicyController cache.Controller
+	networkPolicyLister     cache.Indexer
+	broadcaster             *utils.Broadcaster
+}
+
+type NetworkPolicyUpdatesHandler interface {
+	OnNetworkPolicyUpdate(networkPolicyUpdate *NetworkPolicyUpdate)
+}
+
+func (npw *networkPolicyWatcher) networkPolicyAddEventHandler(obj interface{}) {
+	policy, ok := obj.(*apiextensions.NetworkPolicy)
+	if !ok {
+		return
+	}
+	npw.broadcaster.Notify(&NetworkPolicyUpdate{Op: ADD, NetworkPolicy: policy})
+}
+
+func (npw *networkPolicyWatcher) networkPolicyDeleteEventHandler(obj interface{}) {
+	policy, ok := obj.(*apiextensions.NetworkPolicy)
+	if !ok {
+		return
+	}
+	npw.broadcaster.Notify(&NetworkPolicyUpdate{Op: REMOVE, NetworkPolicy: policy})
+}
+
+func (npw *networkPolicyWatcher) networkPolicyUpdateEventHandler(oldObj, newObj interface{}) {
+	policy, ok := newObj.(*apiextensions.NetworkPolicy)
+	if !ok {
+		return
+	}
+	if !reflect.DeepEqual(newObj, oldObj) {
+		npw.broadcaster.Notify(&NetworkPolicyUpdate{Op: UPDATE, NetworkPolicy: policy})
+	}
+}
+
+func (npw *networkPolicyWatcher) RegisterHandler(handler NetworkPolicyUpdatesHandler) {
+	npw.broadcaster.Add(utils.ListenerFunc(func(instance interface{}) {
+		handler.OnNetworkPolicyUpdate(instance.(*NetworkPolicyUpdate))
+	}))
+}
+
+func (npw *networkPolicyWatcher) List() []*apiextensions.NetworkPolicy {
+	obj_list := npw.networkPolicyLister.List()
+	np_instances := make([]*apiextensions.NetworkPolicy, len(obj_list))
+	for i, ins := range obj_list {
+		np_instances[i] = ins.(*apiextensions.NetworkPolicy)
+	}
+	return np_instances
+}
+
+func (npw *networkPolicyWatcher) HasSynced() bool {
+	return npw.networkPolicyController.HasSynced()
+}
+
+var networkPolicyStopCh chan struct{}
+
+func StartNetworkPolicyWatcher(clientset *kubernetes.Clientset, resyncPeriod time.Duration) (*networkPolicyWatcher, error) {
+
+	npw := networkPolicyWatcher{}
+	NetworkPolicyWatcher = &npw
+
+	eventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc:    npw.networkPolicyAddEventHandler,
+		DeleteFunc: npw.networkPolicyDeleteEventHandler,
+		UpdateFunc: npw.networkPolicyUpdateEventHandler,
+	}
+
+	npw.clientset = clientset
+	npw.broadcaster = utils.NewBroadcaster()
+	lw := cache.NewListWatchFromClient(clientset.Extensions().RESTClient(), "networkpolicies", metav1.NamespaceAll, fields.Everything())
+	npw.networkPolicyLister, npw.networkPolicyController = cache.NewIndexerInformer(
+		lw,
+		&apiextensions.NetworkPolicy{}, resyncPeriod, eventHandler,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	networkPolicyStopCh = make(chan struct{})
+	go npw.networkPolicyController.Run(networkPolicyStopCh)
+	return &npw, nil
+}
+
+func StopNetworkPolicyWatcher() {
+	networkPolicyStopCh <- struct{}{}
+}

app/watchers/pods_watcher.go

@@ -0,0 +1,118 @@
+package watchers
+
+import (
+	"reflect"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/utils"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/kubernetes"
+	listers "k8s.io/client-go/listers/core/v1"
+	api "k8s.io/client-go/pkg/api/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+type PodUpdate struct {
+	Pod *api.Pod
+	Op  Operation
+}
+
+var (
+	PodWatcher *podWatcher
+)
+
+type podWatcher struct {
+	clientset     *kubernetes.Clientset
+	podController cache.Controller
+	podLister     cache.Indexer
+	broadcaster   *utils.Broadcaster
+}
+
+type PodUpdatesHandler interface {
+	OnPodUpdate(podUpdate *PodUpdate)
+}
+
+func (pw *podWatcher) podAddEventHandler(obj interface{}) {
+	pod, ok := obj.(*api.Pod)
+	if !ok {
+		return
+	}
+	pw.broadcaster.Notify(&PodUpdate{Op: ADD, Pod: pod})
+}
+
+func (pw *podWatcher) podDeleteEventHandler(obj interface{}) {
+	pod, ok := obj.(*api.Pod)
+	if !ok {
+		return
+	}
+	pw.broadcaster.Notify(&PodUpdate{Op: REMOVE, Pod: pod})
+}
+
+func (pw *podWatcher) podAUpdateEventHandler(oldObj, newObj interface{}) {
+	pod, ok := newObj.(*api.Pod)
+	if !ok {
+		return
+	}
+	if !reflect.DeepEqual(newObj, oldObj) {
+		pw.broadcaster.Notify(&PodUpdate{Op: UPDATE, Pod: pod})
+	}
+}
+
+func (pw *podWatcher) RegisterHandler(handler PodUpdatesHandler) {
+	pw.broadcaster.Add(utils.ListenerFunc(func(instance interface{}) {
+		handler.OnPodUpdate(instance.(*PodUpdate))
+	}))
+}
+
+func (pw *podWatcher) List() []*api.Pod {
+	obj_list := pw.podLister.List()
+	pod_instances := make([]*api.Pod, len(obj_list))
+	for i, ins := range obj_list {
+		pod_instances[i] = ins.(*api.Pod)
+	}
+	return pod_instances
+}
+
+func (pw *podWatcher) ListByNamespaceAndLabels(namespace string, labelsToMatch labels.Set) (ret []*api.Pod, err error) {
+	podLister := listers.NewPodLister(pw.podLister)
+	allMatchedNameSpacePods, err := podLister.Pods(namespace).List(labelsToMatch.AsSelector())
+	if err != nil {
+		return nil, err
+	}
+	return allMatchedNameSpacePods, nil
+}
+
+func (pw *podWatcher) HasSynced() bool {
+	return pw.podController.HasSynced()
+}
+
+var podwatchStopCh chan struct{}
+
+func StartPodWatcher(clientset *kubernetes.Clientset, resyncPeriod time.Duration) (*podWatcher, error) {
+
+	pw := podWatcher{}
+	PodWatcher = &pw
+	eventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc:    pw.podAddEventHandler,
+		DeleteFunc: pw.podDeleteEventHandler,
+		UpdateFunc: pw.podAUpdateEventHandler,
+	}
+
+	pw.clientset = clientset
+	pw.broadcaster = utils.NewBroadcaster()
+	lw := cache.NewListWatchFromClient(clientset.Core().RESTClient(), "pods", metav1.NamespaceAll, fields.Everything())
+	pw.podLister, pw.podController = cache.NewIndexerInformer(
+		lw,
+		&api.Pod{}, resyncPeriod, eventHandler,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	podwatchStopCh = make(chan struct{})
+	go pw.podController.Run(podwatchStopCh)
+	return &pw, nil
+}
+
+func StopPodWatcher() {
+	podwatchStopCh <- struct{}{}
+}

app/watchers/services_watcher.go

@@ -0,0 +1,107 @@
+package watchers
+
+import (
+	"reflect"
+	"time"
+
+	"github.com/cloudnativelabs/kube-router/utils"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/client-go/kubernetes"
+	api "k8s.io/client-go/pkg/api/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+type ServiceUpdate struct {
+	Service *api.Service
+	Op      Operation
+}
+
+var (
+	ServiceWatcher *serviceWatcher
+)
+
+type serviceWatcher struct {
+	clientset         *kubernetes.Clientset
+	serviceController cache.Controller
+	serviceLister     cache.Indexer
+	broadcaster       *utils.Broadcaster
+}
+
+type ServiceUpdatesHandler interface {
+	OnServiceUpdate(serviceUpdate *ServiceUpdate)
+}
+
+func (svcw *serviceWatcher) serviceAddEventHandler(obj interface{}) {
+	service, ok := obj.(*api.Service)
+	if !ok {
+		return
+	}
+	svcw.broadcaster.Notify(&ServiceUpdate{Op: ADD, Service: service})
+}
+
+func (svcw *serviceWatcher) serviceDeleteEventHandler(obj interface{}) {
+	service, ok := obj.(*api.Service)
+	if !ok {
+		return
+	}
+	svcw.broadcaster.Notify(&ServiceUpdate{Op: REMOVE, Service: service})
+}
+
+func (svcw *serviceWatcher) serviceAUpdateEventHandler(oldObj, newObj interface{}) {
+	service, ok := newObj.(*api.Service)
+	if !ok {
+		return
+	}
+	if !reflect.DeepEqual(newObj, oldObj) {
+		svcw.broadcaster.Notify(&ServiceUpdate{Op: UPDATE, Service: service})
+	}
+}
+
+func (svcw *serviceWatcher) RegisterHandler(handler ServiceUpdatesHandler) {
+	svcw.broadcaster.Add(utils.ListenerFunc(func(instance interface{}) {
+		handler.OnServiceUpdate(instance.(*ServiceUpdate))
+	}))
+}
+
+func (svcw *serviceWatcher) List() []*api.Service {
+	obj_list := svcw.serviceLister.List()
+	svc_instances := make([]*api.Service, len(obj_list))
+	for i, ins := range obj_list {
+		svc_instances[i] = ins.(*api.Service)
+	}
+	return svc_instances
+}
+
+func (svcw *serviceWatcher) HasSynced() bool {
+	return svcw.serviceController.HasSynced()
+}
+
+var servicesStopCh chan struct{}
+
+func StartServiceWatcher(clientset *kubernetes.Clientset, resyncPeriod time.Duration) (*serviceWatcher, error) {
+
+	svcw := serviceWatcher{}
+	ServiceWatcher = &svcw
+
+	eventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc:    svcw.serviceAddEventHandler,
+		DeleteFunc: svcw.serviceDeleteEventHandler,
+		UpdateFunc: svcw.serviceAUpdateEventHandler,
+	}
+
+	svcw.clientset = clientset
+	svcw.broadcaster = utils.NewBroadcaster()
+	lw := cache.NewListWatchFromClient(clientset.Core().RESTClient(), "services", metav1.NamespaceAll, fields.Everything())
+	svcw.serviceLister, svcw.serviceController = cache.NewIndexerInformer(
+		lw,
+		&api.Service{}, resyncPeriod, eventHandler,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	servicesStopCh = make(chan struct{})
+	go svcw.serviceController.Run(servicesStopCh)
+	return &svcw, nil
+}
+func StopServiceWatcher() {
+	servicesStopCh <- struct{}{}
+}

glide.lock

@@ -0,0 +1,327 @@
+hash: fcedcbbb84730488c5b7e5d7860f0ae886f8d253968feba297ca6d88deee9033
+updated: 2017-04-11T15:18:28.828122197+05:30
+imports:
+- name: github.com/armon/go-radix
+  version: 4239b77079c7b5d1243b7b4736304ce8ddb6f0f2
+- name: github.com/containernetworking/cni
+  version: 137b4975ecab6e1f0c24c1e3c228a50a3cfba75e
+- name: github.com/coreos/go-iptables
+  version: 5463fbac3bcc6b990663941c2e12660d19f6b36d
+  subpackages:
+  - iptables
+- name: github.com/coreos/go-semver
+  version: 5e3acbb5668c4c3deb4842615c4098eb61fb6b1e
+  subpackages:
+  - semver
+- name: github.com/davecgh/go-spew
+  version: 5215b55f46b2b919f50a1df0eaa5886afe4e3b3d
+  subpackages:
+  - spew
+- name: github.com/docker/distribution
+  version: cd27f179f2c10c5d300e6d09025b538c475b0d51
+  subpackages:
+  - digest
+  - reference
+- name: github.com/eapache/channels
+  version: 47238d5aae8c0fefd518ef2bee46290909cf8263
+- name: github.com/eapache/queue
+  version: 44cc805cf13205b55f69e14bcb69867d1ae92f98
+- name: github.com/emicklei/go-restful
+  version: 09691a3b6378b740595c1002f40c34dd5f218a22
+  subpackages:
+  - log
+  - swagger
+- name: github.com/fsnotify/fsnotify
+  version: 4da3e2cfbabc9f751898f250b49f2439785783a1
+- name: github.com/ghodss/yaml
+  version: 73d445a93680fa1a78ae23a5839bad48f32ba1ee
+- name: github.com/go-openapi/jsonpointer
+  version: 46af16f9f7b149af66e5d1bd010e3574dc06de98
+- name: github.com/go-openapi/jsonreference
+  version: 13c6e3589ad90f49bd3e3bbe2c2cb3d7a4142272
+- name: github.com/go-openapi/spec
+  version: 6aced65f8501fe1217321abf0749d354824ba2ff
+- name: github.com/go-openapi/swag
+  version: 1d0bd113de87027671077d3c71eb3ac5d7dbba72
+- name: github.com/gogo/protobuf
+  version: e18d7aa8f8c624c915db340349aad4c49b10d173
+  subpackages:
+  - proto
+  - sortkeys
+- name: github.com/golang/glog
+  version: 44145f04b68cf362d9c4df2182967c2275eaefed
+- name: github.com/golang/protobuf
+  version: 8616e8ee5e20a1704615e6c8d7afcdac06087a67
+  subpackages:
+  - proto
+- name: github.com/google/gofuzz
+  version: 44d81051d367757e1c7c6a5a86423ece9afcf63c
+- name: github.com/hashicorp/hcl
+  version: 630949a3c5fa3c613328e1b8256052cbc2327c9b
+  subpackages:
+  - hcl/ast
+  - hcl/parser
+  - hcl/scanner
+  - hcl/strconv
+  - hcl/token
+  - json/parser
+  - json/scanner
+  - json/token
+- name: github.com/hkwi/nlgo
+  version: a84bdcfa49f5f8947a64e62adf6a41181de2e11a
+- name: github.com/howeyc/gopass
+  version: 3ca23474a7c7203e0a0a070fd33508f6efdb9b3d
+- name: github.com/imdario/mergo
+  version: 6633656539c1639d9d78127b7d47c622b5d7b6dc
+- name: github.com/influxdata/influxdb
+  version: 7c5ce27bb05ad7a917d1c1fc687b7dcaa375e8c7
+  subpackages:
+  - client/v2
+  - models
+  - pkg/escape
+- name: github.com/janeczku/go-ipset
+  version: 499ed3217c4b5a39b31c483b0151aea724adb933
+  subpackages:
+  - ipset
+- name: github.com/juju/ratelimit
+  version: 77ed1c8a01217656d2080ad51981f6e99adaa177
+- name: github.com/magiconair/properties
+  version: 51463bfca2576e06c62a8504b5c0f06d61312647
+- name: github.com/mailru/easyjson
+  version: d5b7844b561a7bc640052f1b935f7b800330d7e0
+  subpackages:
+  - buffer
+  - jlexer
+  - jwriter
+- name: github.com/mitchellh/mapstructure
+  version: 53818660ed4955e899c0bcafa97299a388bd7c8e
+- name: github.com/mqliang/libipvs
+  version: 52d236e889f736fc36e587a344782b5f261f127c
+- name: github.com/osrg/gobgp
+  version: a45237c202aedb1a0cbe16d162024fb855e8eb1a
+  subpackages:
+  - api
+  - config
+  - packet/bgp
+  - packet/bmp
+  - packet/mrt
+  - packet/rtr
+  - server
+  - table
+  - zebra
+- name: github.com/pelletier/go-buffruneio
+  version: c37440a7cf42ac63b919c752ca73a85067e05992
+- name: github.com/pelletier/go-toml
+  version: fe206efb84b2bc8e8cfafe6b4c1826622be969e3
+- name: github.com/pkg/errors
+  version: ff09b135c25aae272398c51a07235b90a75aa4f0
+- name: github.com/PuerkitoBio/purell
+  version: 8a290539e2e8629dbc4e6bad948158f790ec31f4
+- name: github.com/PuerkitoBio/urlesc
+  version: 5bd2802263f21d8788851d5305584c82a5c75d7e
+- name: github.com/satori/go.uuid
+  version: 5bf94b69c6b68ee1b541973bb8e1144db23a194b
+- name: github.com/Sirupsen/logrus
+  version: 10f801ebc38b33738c9d17d50860f484a0988ff5
+- name: github.com/spf13/afero
+  version: 9be650865eab0c12963d8753212f4f9c66cdcf12
+  subpackages:
+  - mem
+- name: github.com/spf13/cast
+  version: ce135a4ebeee6cfe9a26c93ee0d37825f26113c7
+- name: github.com/spf13/jwalterweatherman
+  version: fa7ca7e836cf3a8bb4ebf799f472c12d7e903d66
+- name: github.com/spf13/pflag
+  version: 9ff6c6923cfffbcd502984b8e0c80539a94968b7
+- name: github.com/spf13/viper
+  version: 5d46e70da8c0b6f812e0b170b7a985753b5c63cb
+- name: github.com/ugorji/go
+  version: ded73eae5db7e7a0ef6f55aace87a2873c5d2b74
+  subpackages:
+  - codec
+- name: github.com/vishvananda/netlink
+  version: fe3b5664d23a11b52ba59bece4ff29c52772a56b
+  subpackages:
+  - nl
+- name: github.com/vishvananda/netns
+  version: 8ba1072b58e0c2a240eb5f6120165c7776c3e7b8
+- name: golang.org/x/crypto
+  version: d172538b2cfce0c13cee31e647d0367aa8cd2486
+  subpackages:
+  - ssh/terminal
+- name: golang.org/x/net
+  version: e90d6d0afc4c315a0d87a568ae68577cc15149a0
+  subpackages:
+  - context
+  - context/ctxhttp
+  - http2
+  - http2/hpack
+  - idna
+  - internal/timeseries
+  - lex/httplex
+  - trace
+- name: golang.org/x/sys
+  version: 8f0908ab3b2457e2e15403d3697c9ef5cb4b57a9
+  subpackages:
+  - unix
+- name: golang.org/x/text
+  version: 2910a502d2bf9e43193af9d68ca516529614eed3
+  subpackages:
+  - cases
+  - internal/tag
+  - language
+  - runes
+  - secure/bidirule
+  - secure/precis
+  - transform
+  - unicode/bidi
+  - unicode/norm
+  - width
+- name: google.golang.org/grpc
+  version: 8050b9cbc271307e5a716a9d782803d09b0d6f2d
+  subpackages:
+  - codes
+  - credentials
+  - grpclog
+  - internal
+  - keepalive
+  - metadata
+  - naming
+  - peer
+  - stats
+  - tap
+  - transport
+- name: gopkg.in/inf.v0
+  version: 3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4
+- name: gopkg.in/tomb.v2
+  version: d5d1b5820637886def9eef33e03a27a9f166942c
+- name: gopkg.in/yaml.v2
+  version: 53feefa2559fb8dfa8d81baad31be332c97d6c77
+- name: k8s.io/apimachinery
+  version: 75b8dd260ef0469d96d578705a87cffd0e09dab8
+  subpackages:
+  - pkg/api/errors
+  - pkg/api/meta
+  - pkg/api/resource
+  - pkg/apimachinery
+  - pkg/apimachinery/announced
+  - pkg/apimachinery/registered
+  - pkg/apis/meta/v1
+  - pkg/apis/meta/v1/unstructured
+  - pkg/conversion
+  - pkg/conversion/queryparams
+  - pkg/fields
+  - pkg/labels
+  - pkg/openapi
+  - pkg/runtime
+  - pkg/runtime/schema
+  - pkg/runtime/serializer
+  - pkg/runtime/serializer/json
+  - pkg/runtime/serializer/protobuf
+  - pkg/runtime/serializer/recognizer
+  - pkg/runtime/serializer/streaming
+  - pkg/runtime/serializer/versioning
+  - pkg/selection
+  - pkg/types
+  - pkg/util/diff
+  - pkg/util/errors
+  - pkg/util/framer
+  - pkg/util/intstr
+  - pkg/util/json
+  - pkg/util/net
+  - pkg/util/rand
+  - pkg/util/runtime
+  - pkg/util/sets
+  - pkg/util/validation
+  - pkg/util/validation/field
+  - pkg/util/wait
+  - pkg/util/yaml
+  - pkg/version
+  - pkg/watch
+  - third_party/forked/golang/reflect
+- name: k8s.io/client-go
+  version: 3627aeb7d4f6ade38f995d2c923e459146493c7e
+  subpackages:
+  - discovery
+  - kubernetes
+  - kubernetes/scheme
+  - kubernetes/typed/apps/v1beta1
+  - kubernetes/typed/authentication/v1
+  - kubernetes/typed/authentication/v1beta1
+  - kubernetes/typed/authorization/v1
+  - kubernetes/typed/authorization/v1beta1
+  - kubernetes/typed/autoscaling/v1
+  - kubernetes/typed/autoscaling/v2alpha1
+  - kubernetes/typed/batch/v1
+  - kubernetes/typed/batch/v2alpha1
+  - kubernetes/typed/certificates/v1beta1
+  - kubernetes/typed/core/v1
+  - kubernetes/typed/extensions/v1beta1
+  - kubernetes/typed/policy/v1beta1
+  - kubernetes/typed/rbac/v1alpha1
+  - kubernetes/typed/rbac/v1beta1
+  - kubernetes/typed/settings/v1alpha1
+  - kubernetes/typed/storage/v1
+  - kubernetes/typed/storage/v1beta1
+  - listers/core/v1
+  - pkg/api
+  - pkg/api/install
+  - pkg/api/v1
+  - pkg/apis/apps
+  - pkg/apis/apps/install
+  - pkg/apis/apps/v1beta1
+  - pkg/apis/authentication
+  - pkg/apis/authentication/install
+  - pkg/apis/authentication/v1
+  - pkg/apis/authentication/v1beta1
+  - pkg/apis/authorization
+  - pkg/apis/authorization/install
+  - pkg/apis/authorization/v1
+  - pkg/apis/authorization/v1beta1
+  - pkg/apis/autoscaling
+  - pkg/apis/autoscaling/install
+  - pkg/apis/autoscaling/v1
+  - pkg/apis/autoscaling/v2alpha1
+  - pkg/apis/batch
+  - pkg/apis/batch/install
+  - pkg/apis/batch/v1
+  - pkg/apis/batch/v2alpha1
+  - pkg/apis/certificates
+  - pkg/apis/certificates/install
+  - pkg/apis/certificates/v1beta1
+  - pkg/apis/extensions
+  - pkg/apis/extensions/install
+  - pkg/apis/extensions/v1beta1
+  - pkg/apis/policy
+  - pkg/apis/policy/install
+  - pkg/apis/policy/v1beta1
+  - pkg/apis/rbac
+  - pkg/apis/rbac/install
+  - pkg/apis/rbac/v1alpha1
+  - pkg/apis/rbac/v1beta1
+  - pkg/apis/settings
+  - pkg/apis/settings/install
+  - pkg/apis/settings/v1alpha1
+  - pkg/apis/storage
+  - pkg/apis/storage/install
+  - pkg/apis/storage/v1
+  - pkg/apis/storage/v1beta1
+  - pkg/util
+  - pkg/util/parsers
+  - pkg/version
+  - rest
+  - rest/watch
+  - tools/auth
+  - tools/cache
+  - tools/clientcmd
+  - tools/clientcmd/api
+  - tools/clientcmd/api/latest
+  - tools/clientcmd/api/v1
+  - tools/metrics
+  - transport
+  - util/cert
+  - util/clock
+  - util/flowcontrol
+  - util/homedir
+  - util/integer
+testImports: []

glide.yaml

@@ -0,0 +1,41 @@
+package: github.com/cloudnativelabs/kube-router
+import:
+- package: github.com/coreos/go-iptables
+  version: master
+  subpackages:
+  - iptables
+- package: github.com/golang/glog
+- package: github.com/janeczku/go-ipset
+  version: master
+  subpackages:
+  - ipset
+- package: github.com/mqliang/libipvs
+- package: github.com/osrg/gobgp
+  version: ^1.17.0
+  subpackages:
+  - api
+  - config
+  - packet/bgp
+  - server
+  - table
+- package: github.com/spf13/pflag
+- package: github.com/vishvananda/netlink
+- package: k8s.io/apimachinery
+  subpackages:
+  - pkg/apis/meta/v1
+  - pkg/fields
+  - pkg/labels
+- package: k8s.io/client-go
+  version: ^3.0.0-beta.0
+  subpackages:
+  - kubernetes
+  - listers/core/v1
+  - pkg/api/v1
+  - pkg/apis/extensions/v1beta1
+  - tools/cache
+  - tools/clientcmd
+- package: github.com/armon/go-radix
+- package: google.golang.org/grpc
+  version: ~1.2.1
+- package: github.com/containernetworking/cni
+  version: ^0.5.2

kube-router.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"github.com/cloudnativelabs/kube-router/app"
+	"github.com/cloudnativelabs/kube-router/app/options"
+	"github.com/spf13/pflag"
+)
+
+func main() {
+
+	config := options.NewKubeRouterConfig()
+	config.AddFlags(pflag.CommandLine)
+	pflag.Parse()
+
+	flag.Set("logtostderr", "true")
+
+	if os.Geteuid() != 0 {
+		fmt.Fprintf(os.Stderr, "kube-router need to be run by user with previlages to execute iptables, ipset and configure ipvs\n")
+		os.Exit(1)
+	}
+
+	if config.CleanupConfig {
+		app.CleanupConfigAndExit()
+		os.Exit(0)
+	}
+
+	kubeRouter, err := app.NewKubeRouterDefault(config)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to parse kube-router config: %v\n", err)
+		os.Exit(1)
+	}
+
+	if err = kubeRouter.Run(); err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to run kube-router: %v\n", err)
+		os.Exit(1)
+	}
+}

utils/utils.go

@@ -0,0 +1,39 @@
+package utils
+
+import (
+	"sync"
+)
+
+type Listener interface {
+	OnUpdate(instance interface{})
+}
+
+type ListenerFunc func(instance interface{})
+
+func (f ListenerFunc) OnUpdate(instance interface{}) {
+	f(instance)
+}
+
+type Broadcaster struct {
+	listenerLock sync.RWMutex
+	listeners    []Listener
+}
+
+func NewBroadcaster() *Broadcaster {
+	return &Broadcaster{}
+}
+
+func (b *Broadcaster) Add(listener Listener) {
+	b.listenerLock.Lock()
+	defer b.listenerLock.Unlock()
+	b.listeners = append(b.listeners, listener)
+}
+
+func (b *Broadcaster) Notify(instance interface{}) {
+	b.listenerLock.RLock()
+	listeners := b.listeners
+	b.listenerLock.RUnlock()
+	for _, listener := range listeners {
+		go listener.OnUpdate(instance)
+	}
+}

vendor/github.com/PuerkitoBio/purell/.gitignore

@@ -0,0 +1,5 @@
+*.sublime-*
+.DS_Store
+*.swp
+*.swo
+tags

vendor/github.com/PuerkitoBio/purell/.travis.yml

@@ -0,0 +1,7 @@
+language: go
+
+go:
+    - 1.4
+    - 1.5
+    - 1.6
+    - tip

vendor/github.com/PuerkitoBio/purell/LICENSE

@@ -0,0 +1,12 @@
+Copyright (c) 2012, Martin Angers
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+* Neither the name of the author nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/PuerkitoBio/purell/README.md

@@ -0,0 +1,185 @@
+# Purell
+
+Purell is a tiny Go library to normalize URLs. It returns a pure URL. Pure-ell. Sanitizer and all. Yeah, I know...
+
+Based on the [wikipedia paper][wiki] and the [RFC 3986 document][rfc].
+
+[![build status](https://secure.travis-ci.org/PuerkitoBio/purell.png)](http://travis-ci.org/PuerkitoBio/purell)
+
+## Install
+
+`go get github.com/PuerkitoBio/purell`
+
+## Changelog
+
+*    **2016-07-27 (v1.0.0)** : Normalize IDN to ASCII (thanks to @zenovich).
+*    **2015-02-08** : Add fix for relative paths issue ([PR #5][pr5]) and add fix for unnecessary encoding of reserved characters ([see issue #7][iss7]).
+*    **v0.2.0** : Add benchmarks, Attempt IDN support.
+*    **v0.1.0** : Initial release.
+
+## Examples
+
+From `example_test.go` (note that in your code, you would import "github.com/PuerkitoBio/purell", and would prefix references to its methods and constants with "purell."):
+
+```go
+package purell
+
+import (
+  "fmt"
+  "net/url"
+)
+
+func ExampleNormalizeURLString() {
+  if normalized, err := NormalizeURLString("hTTp://someWEBsite.com:80/Amazing%3f/url/",
+    FlagLowercaseScheme|FlagLowercaseHost|FlagUppercaseEscapes); err != nil {
+    panic(err)
+  } else {
+    fmt.Print(normalized)
+  }
+  // Output: http://somewebsite.com:80/Amazing%3F/url/
+}
+
+func ExampleMustNormalizeURLString() {
+  normalized := MustNormalizeURLString("hTTpS://someWEBsite.com:443/Amazing%fa/url/",
+    FlagsUnsafeGreedy)
+  fmt.Print(normalized)
+
+  // Output: http://somewebsite.com/Amazing%FA/url
+}
+
+func ExampleNormalizeURL() {
+  if u, err := url.Parse("Http://SomeUrl.com:8080/a/b/.././c///g?c=3&a=1&b=9&c=0#target"); err != nil {
+    panic(err)
+  } else {
+    normalized := NormalizeURL(u, FlagsUsuallySafeGreedy|FlagRemoveDuplicateSlashes|FlagRemoveFragment)
+    fmt.Print(normalized)
+  }
+
+  // Output: http://someurl.com:8080/a/c/g?c=3&a=1&b=9&c=0
+}
+```
+
+## API
+
+As seen in the examples above, purell offers three methods, `NormalizeURLString(string, NormalizationFlags) (string, error)`, `MustNormalizeURLString(string, NormalizationFlags) (string)` and `NormalizeURL(*url.URL, NormalizationFlags) (string)`. They all normalize the provided URL based on the specified flags. Here are the available flags:
+
+```go
+const (
+	// Safe normalizations
+	FlagLowercaseScheme           NormalizationFlags = 1 << iota // HTTP://host -> http://host, applied by default in Go1.1
+	FlagLowercaseHost                                            // http://HOST -> http://host
+	FlagUppercaseEscapes                                         // http://host/t%ef -> http://host/t%EF
+	FlagDecodeUnnecessaryEscapes                                 // http://host/t%41 -> http://host/tA
+	FlagEncodeNecessaryEscapes                                   // http://host/!"#$ -> http://host/%21%22#$
+	FlagRemoveDefaultPort                                        // http://host:80 -> http://host
+	FlagRemoveEmptyQuerySeparator                                // http://host/path? -> http://host/path
+
+	// Usually safe normalizations
+	FlagRemoveTrailingSlash // http://host/path/ -> http://host/path
+	FlagAddTrailingSlash    // http://host/path -> http://host/path/ (should choose only one of these add/remove trailing slash flags)
+	FlagRemoveDotSegments   // http://host/path/./a/b/../c -> http://host/path/a/c
+
+	// Unsafe normalizations
+	FlagRemoveDirectoryIndex   // http://host/path/index.html -> http://host/path/
+	FlagRemoveFragment         // http://host/path#fragment -> http://host/path
+	FlagForceHTTP              // https://host -> http://host
+	FlagRemoveDuplicateSlashes // http://host/path//a///b -> http://host/path/a/b
+	FlagRemoveWWW              // http://www.host/ -> http://host/
+	FlagAddWWW                 // http://host/ -> http://www.host/ (should choose only one of these add/remove WWW flags)
+	FlagSortQuery              // http://host/path?c=3&b=2&a=1&b=1 -> http://host/path?a=1&b=1&b=2&c=3
+
+	// Normalizations not in the wikipedia article, required to cover tests cases
+	// submitted by jehiah
+	FlagDecodeDWORDHost           // http://1113982867 -> http://66.102.7.147
+	FlagDecodeOctalHost           // http://0102.0146.07.0223 -> http://66.102.7.147
+	FlagDecodeHexHost             // http://0x42660793 -> http://66.102.7.147
+	FlagRemoveUnnecessaryHostDots // http://.host../path -> http://host/path
+	FlagRemoveEmptyPortSeparator  // http://host:/path -> http://host/path
+
+	// Convenience set of safe normalizations
+	FlagsSafe NormalizationFlags = FlagLowercaseHost | FlagLowercaseScheme | FlagUppercaseEscapes | FlagDecodeUnnecessaryEscapes | FlagEncodeNecessaryEscapes | FlagRemoveDefaultPort | FlagRemoveEmptyQuerySeparator
+
+	// For convenience sets, "greedy" uses the "remove trailing slash" and "remove www. prefix" flags,
+	// while "non-greedy" uses the "add (or keep) the trailing slash" and "add www. prefix".
+
+	// Convenience set of usually safe normalizations (includes FlagsSafe)
+	FlagsUsuallySafeGreedy    NormalizationFlags = FlagsSafe | FlagRemoveTrailingSlash | FlagRemoveDotSegments
+	FlagsUsuallySafeNonGreedy NormalizationFlags = FlagsSafe | FlagAddTrailingSlash | FlagRemoveDotSegments
+
+	// Convenience set of unsafe normalizations (includes FlagsUsuallySafe)
+	FlagsUnsafeGreedy    NormalizationFlags = FlagsUsuallySafeGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagRemoveWWW | FlagSortQuery
+	FlagsUnsafeNonGreedy NormalizationFlags = FlagsUsuallySafeNonGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagAddWWW | FlagSortQuery
+
+	// Convenience set of all available flags
+	FlagsAllGreedy    = FlagsUnsafeGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
+	FlagsAllNonGreedy = FlagsUnsafeNonGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
+)
+```
+
+For convenience, the set of flags `FlagsSafe`, `FlagsUsuallySafe[Greedy|NonGreedy]`, `FlagsUnsafe[Greedy|NonGreedy]` and `FlagsAll[Greedy|NonGreedy]` are provided for the similarly grouped normalizations on [wikipedia's URL normalization page][wiki]. You can add (using the bitwise OR `|` operator) or remove (using the bitwise AND NOT `&^` operator) individual flags from the sets if required, to build your own custom set.
+
+The [full godoc reference is available on gopkgdoc][godoc].
+
+Some things to note:
+
+*    `FlagDecodeUnnecessaryEscapes`, `FlagEncodeNecessaryEscapes`, `FlagUppercaseEscapes` and `FlagRemoveEmptyQuerySeparator` are always implicitly set, because internally, the URL string is parsed as an URL object, which automatically decodes unnecessary escapes, uppercases and encodes necessary ones, and removes empty query separators (an unnecessary `?` at the end of the url). So this operation cannot **not** be done. For this reason, `FlagRemoveEmptyQuerySeparator` (as well as the other three) has been included in the `FlagsSafe` convenience set, instead of `FlagsUnsafe`, where Wikipedia puts it.
+
+*    The `FlagDecodeUnnecessaryEscapes` decodes the following escapes (*from -> to*):
+    -    %24 -> $
+    -    %26 -> &
+    -    %2B-%3B -> +,-./0123456789:;
+    -    %3D -> =
+    -    %40-%5A -> @ABCDEFGHIJKLMNOPQRSTUVWXYZ
+    -    %5F -> _
+    -    %61-%7A -> abcdefghijklmnopqrstuvwxyz
+    -    %7E -> ~
+
+
+*    When the `NormalizeURL` function is used (passing an URL object), this source URL object is modified (that is, after the call, the URL object will be modified to reflect the normalization).
+
+*    The *replace IP with domain name* normalization (`http://208.77.188.166/ → http://www.example.com/`) is obviously not possible for a library without making some network requests. This is not implemented in purell.
+
+*    The *remove unused query string parameters* and *remove default query parameters* are also not implemented, since this is a very case-specific normalization, and it is quite trivial to do with an URL object.
+
+### Safe vs Usually Safe vs Unsafe
+
+Purell allows you to control the level of risk you take while normalizing an URL. You can aggressively normalize, play it totally safe, or anything in between.
+
+Consider the following URL:
+
+`HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid`
+
+Normalizing with the `FlagsSafe` gives:
+
+`https://www.root.com/toto/tE%1F///a/./b/../c/?z=3&w=2&a=4&w=1#invalid`
+
+With the `FlagsUsuallySafeGreedy`:
+
+`https://www.root.com/toto/tE%1F///a/c?z=3&w=2&a=4&w=1#invalid`
+
+And with `FlagsUnsafeGreedy`:
+
+`http://root.com/toto/tE%1F/a/c?a=4&w=1&w=2&z=3`
+
+## TODOs
+
+*    Add a class/default instance to allow specifying custom directory index names? At the moment, removing directory index removes `(^|/)((?:default|index)\.\w{1,4})$`.
+
+## Thanks / Contributions
+
+@rogpeppe
+@jehiah
+@opennota
+@pchristopher1275
+@zenovich
+
+## License
+
+The [BSD 3-Clause license][bsd].
+
+[bsd]: http://opensource.org/licenses/BSD-3-Clause
+[wiki]: http://en.wikipedia.org/wiki/URL_normalization
+[rfc]: http://tools.ietf.org/html/rfc3986#section-6
+[godoc]: http://go.pkgdoc.org/github.com/PuerkitoBio/purell
+[pr5]: https://github.com/PuerkitoBio/purell/pull/5
+[iss7]: https://github.com/PuerkitoBio/purell/issues/7

vendor/github.com/PuerkitoBio/purell/bench_test.go

@@ -0,0 +1,57 @@
+package purell
+
+import (
+	"testing"
+)
+
+var (
+	safeUrl        = "HttPS://..iaMHost..Test:443/paTh^A%ef//./%41PaTH/..//?"
+	usuallySafeUrl = "HttPS://..iaMHost..Test:443/paTh^A%ef//./%41PaTH/../final/"
+	unsafeUrl      = "HttPS://..www.iaMHost..Test:443/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
+	allDWORDUrl    = "HttPS://1113982867:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
+	allOctalUrl    = "HttPS://0102.0146.07.0223:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
+	allHexUrl      = "HttPS://0x42660793:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
+	allCombinedUrl = "HttPS://..0x42660793.:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
+)
+
+func BenchmarkSafe(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		NormalizeURLString(safeUrl, FlagsSafe)
+	}
+}
+
+func BenchmarkUsuallySafe(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		NormalizeURLString(usuallySafeUrl, FlagsUsuallySafeGreedy)
+	}
+}
+
+func BenchmarkUnsafe(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		NormalizeURLString(unsafeUrl, FlagsUnsafeGreedy)
+	}
+}
+
+func BenchmarkAllDWORD(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		NormalizeURLString(allDWORDUrl, FlagsAllGreedy)
+	}
+}
+
+func BenchmarkAllOctal(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		NormalizeURLString(allOctalUrl, FlagsAllGreedy)
+	}
+}
+
+func BenchmarkAllHex(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		NormalizeURLString(allHexUrl, FlagsAllGreedy)
+	}
+}
+
+func BenchmarkAllCombined(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		NormalizeURLString(allCombinedUrl, FlagsAllGreedy)
+	}
+}

vendor/github.com/PuerkitoBio/purell/benchmarks/v0.1.0

@@ -0,0 +1,9 @@
+PASS
+BenchmarkSafe	  500000	      6131 ns/op
+BenchmarkUsuallySafe	  200000	      7864 ns/op
+BenchmarkUnsafe	  100000	     28560 ns/op
+BenchmarkAllDWORD	   50000	     38722 ns/op
+BenchmarkAllOctal	   50000	     40941 ns/op
+BenchmarkAllHex	   50000	     44063 ns/op
+BenchmarkAllCombined	   50000	     33613 ns/op
+ok  	github.com/PuerkitoBio/purell	17.404s

vendor/github.com/PuerkitoBio/purell/example_test.go

@@ -0,0 +1,35 @@
+package purell
+
+import (
+	"fmt"
+	"net/url"
+)
+
+func ExampleNormalizeURLString() {
+	if normalized, err := NormalizeURLString("hTTp://someWEBsite.com:80/Amazing%3f/url/",
+		FlagLowercaseScheme|FlagLowercaseHost|FlagUppercaseEscapes); err != nil {
+		panic(err)
+	} else {
+		fmt.Print(normalized)
+	}
+	// Output: http://somewebsite.com:80/Amazing%3F/url/
+}
+
+func ExampleMustNormalizeURLString() {
+	normalized := MustNormalizeURLString("hTTpS://someWEBsite.com:443/Amazing%fa/url/",
+		FlagsUnsafeGreedy)
+	fmt.Print(normalized)
+
+	// Output: http://somewebsite.com/Amazing%FA/url
+}
+
+func ExampleNormalizeURL() {
+	if u, err := url.Parse("Http://SomeUrl.com:8080/a/b/.././c///g?c=3&a=1&b=9&c=0#target"); err != nil {
+		panic(err)
+	} else {
+		normalized := NormalizeURL(u, FlagsUsuallySafeGreedy|FlagRemoveDuplicateSlashes|FlagRemoveFragment)
+		fmt.Print(normalized)
+	}
+
+	// Output: http://someurl.com:8080/a/c/g?c=3&a=1&b=9&c=0
+}

vendor/github.com/PuerkitoBio/purell/purell.go

@@ -0,0 +1,375 @@
+/*
+Package purell offers URL normalization as described on the wikipedia page:
+http://en.wikipedia.org/wiki/URL_normalization
+*/
+package purell
+
+import (
+	"bytes"
+	"fmt"
+	"net/url"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/PuerkitoBio/urlesc"
+	"golang.org/x/net/idna"
+	"golang.org/x/text/secure/precis"
+	"golang.org/x/text/unicode/norm"
+)
+
+// A set of normalization flags determines how a URL will
+// be normalized.
+type NormalizationFlags uint
+
+const (
+	// Safe normalizations
+	FlagLowercaseScheme           NormalizationFlags = 1 << iota // HTTP://host -> http://host, applied by default in Go1.1
+	FlagLowercaseHost                                            // http://HOST -> http://host
+	FlagUppercaseEscapes                                         // http://host/t%ef -> http://host/t%EF
+	FlagDecodeUnnecessaryEscapes                                 // http://host/t%41 -> http://host/tA
+	FlagEncodeNecessaryEscapes                                   // http://host/!"#$ -> http://host/%21%22#$
+	FlagRemoveDefaultPort                                        // http://host:80 -> http://host
+	FlagRemoveEmptyQuerySeparator                                // http://host/path? -> http://host/path
+
+	// Usually safe normalizations
+	FlagRemoveTrailingSlash // http://host/path/ -> http://host/path
+	FlagAddTrailingSlash    // http://host/path -> http://host/path/ (should choose only one of these add/remove trailing slash flags)
+	FlagRemoveDotSegments   // http://host/path/./a/b/../c -> http://host/path/a/c
+
+	// Unsafe normalizations
+	FlagRemoveDirectoryIndex   // http://host/path/index.html -> http://host/path/
+	FlagRemoveFragment         // http://host/path#fragment -> http://host/path
+	FlagForceHTTP              // https://host -> http://host
+	FlagRemoveDuplicateSlashes // http://host/path//a///b -> http://host/path/a/b
+	FlagRemoveWWW              // http://www.host/ -> http://host/
+	FlagAddWWW                 // http://host/ -> http://www.host/ (should choose only one of these add/remove WWW flags)
+	FlagSortQuery              // http://host/path?c=3&b=2&a=1&b=1 -> http://host/path?a=1&b=1&b=2&c=3
+
+	// Normalizations not in the wikipedia article, required to cover tests cases
+	// submitted by jehiah
+	FlagDecodeDWORDHost           // http://1113982867 -> http://66.102.7.147
+	FlagDecodeOctalHost           // http://0102.0146.07.0223 -> http://66.102.7.147
+	FlagDecodeHexHost             // http://0x42660793 -> http://66.102.7.147
+	FlagRemoveUnnecessaryHostDots // http://.host../path -> http://host/path
+	FlagRemoveEmptyPortSeparator  // http://host:/path -> http://host/path
+
+	// Convenience set of safe normalizations
+	FlagsSafe NormalizationFlags = FlagLowercaseHost | FlagLowercaseScheme | FlagUppercaseEscapes | FlagDecodeUnnecessaryEscapes | FlagEncodeNecessaryEscapes | FlagRemoveDefaultPort | FlagRemoveEmptyQuerySeparator
+
+	// For convenience sets, "greedy" uses the "remove trailing slash" and "remove www. prefix" flags,
+	// while "non-greedy" uses the "add (or keep) the trailing slash" and "add www. prefix".
+
+	// Convenience set of usually safe normalizations (includes FlagsSafe)
+	FlagsUsuallySafeGreedy    NormalizationFlags = FlagsSafe | FlagRemoveTrailingSlash | FlagRemoveDotSegments
+	FlagsUsuallySafeNonGreedy NormalizationFlags = FlagsSafe | FlagAddTrailingSlash | FlagRemoveDotSegments
+
+	// Convenience set of unsafe normalizations (includes FlagsUsuallySafe)
+	FlagsUnsafeGreedy    NormalizationFlags = FlagsUsuallySafeGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagRemoveWWW | FlagSortQuery
+	FlagsUnsafeNonGreedy NormalizationFlags = FlagsUsuallySafeNonGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagAddWWW | FlagSortQuery
+
+	// Convenience set of all available flags
+	FlagsAllGreedy    = FlagsUnsafeGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
+	FlagsAllNonGreedy = FlagsUnsafeNonGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
+)
+
+const (
+	defaultHttpPort  = ":80"
+	defaultHttpsPort = ":443"
+)
+
+// Regular expressions used by the normalizations
+var rxPort = regexp.MustCompile(`(:\d+)/?$`)
+var rxDirIndex = regexp.MustCompile(`(^|/)((?:default|index)\.\w{1,4})$`)
+var rxDupSlashes = regexp.MustCompile(`/{2,}`)
+var rxDWORDHost = regexp.MustCompile(`^(\d+)((?:\.+)?(?:\:\d*)?)$`)
+var rxOctalHost = regexp.MustCompile(`^(0\d*)\.(0\d*)\.(0\d*)\.(0\d*)((?:\.+)?(?:\:\d*)?)$`)
+var rxHexHost = regexp.MustCompile(`^0x([0-9A-Fa-f]+)((?:\.+)?(?:\:\d*)?)$`)
+var rxHostDots = regexp.MustCompile(`^(.+?)(:\d+)?$`)
+var rxEmptyPort = regexp.MustCompile(`:+$`)
+
+// Map of flags to implementation function.
+// FlagDecodeUnnecessaryEscapes has no action, since it is done automatically
+// by parsing the string as an URL. Same for FlagUppercaseEscapes and FlagRemoveEmptyQuerySeparator.
+
+// Since maps have undefined traversing order, make a slice of ordered keys
+var flagsOrder = []NormalizationFlags{
+	FlagLowercaseScheme,
+	FlagLowercaseHost,
+	FlagRemoveDefaultPort,
+	FlagRemoveDirectoryIndex,
+	FlagRemoveDotSegments,
+	FlagRemoveFragment,
+	FlagForceHTTP, // Must be after remove default port (because https=443/http=80)
+	FlagRemoveDuplicateSlashes,
+	FlagRemoveWWW,
+	FlagAddWWW,
+	FlagSortQuery,
+	FlagDecodeDWORDHost,
+	FlagDecodeOctalHost,
+	FlagDecodeHexHost,
+	FlagRemoveUnnecessaryHostDots,
+	FlagRemoveEmptyPortSeparator,
+	FlagRemoveTrailingSlash, // These two (add/remove trailing slash) must be last
+	FlagAddTrailingSlash,
+}
+
+// ... and then the map, where order is unimportant
+var flags = map[NormalizationFlags]func(*url.URL){
+	FlagLowercaseScheme:           lowercaseScheme,
+	FlagLowercaseHost:             lowercaseHost,
+	FlagRemoveDefaultPort:         removeDefaultPort,
+	FlagRemoveDirectoryIndex:      removeDirectoryIndex,
+	FlagRemoveDotSegments:         removeDotSegments,
+	FlagRemoveFragment:            removeFragment,
+	FlagForceHTTP:                 forceHTTP,
+	FlagRemoveDuplicateSlashes:    removeDuplicateSlashes,
+	FlagRemoveWWW:                 removeWWW,
+	FlagAddWWW:                    addWWW,
+	FlagSortQuery:                 sortQuery,
+	FlagDecodeDWORDHost:           decodeDWORDHost,
+	FlagDecodeOctalHost:           decodeOctalHost,
+	FlagDecodeHexHost:             decodeHexHost,
+	FlagRemoveUnnecessaryHostDots: removeUnncessaryHostDots,
+	FlagRemoveEmptyPortSeparator:  removeEmptyPortSeparator,
+	FlagRemoveTrailingSlash:       removeTrailingSlash,
+	FlagAddTrailingSlash:          addTrailingSlash,
+}
+
+// MustNormalizeURLString returns the normalized string, and panics if an error occurs.
+// It takes an URL string as input, as well as the normalization flags.
+func MustNormalizeURLString(u string, f NormalizationFlags) string {
+	result, e := NormalizeURLString(u, f)
+	if e != nil {
+		panic(e)
+	}
+	return result
+}
+
+// NormalizeURLString returns the normalized string, or an error if it can't be parsed into an URL object.
+// It takes an URL string as input, as well as the normalization flags.
+func NormalizeURLString(u string, f NormalizationFlags) (string, error) {
+	if parsed, e := url.Parse(u); e != nil {
+		return "", e
+	} else {
+		options := make([]precis.Option, 1, 3)
+		options[0] = precis.IgnoreCase
+		if f&FlagLowercaseHost == FlagLowercaseHost {
+			options = append(options, precis.FoldCase())
+		}
+		options = append(options, precis.Norm(norm.NFC))
+		profile := precis.NewFreeform(options...)
+		if parsed.Host, e = idna.ToASCII(profile.NewTransformer().String(parsed.Host)); e != nil {
+			return "", e
+		}
+		return NormalizeURL(parsed, f), nil
+	}
+	panic("Unreachable code.")
+}
+
+// NormalizeURL returns the normalized string.
+// It takes a parsed URL object as input, as well as the normalization flags.
+func NormalizeURL(u *url.URL, f NormalizationFlags) string {
+	for _, k := range flagsOrder {
+		if f&k == k {
+			flags[k](u)
+		}
+	}
+	return urlesc.Escape(u)
+}
+
+func lowercaseScheme(u *url.URL) {
+	if len(u.Scheme) > 0 {
+		u.Scheme = strings.ToLower(u.Scheme)
+	}
+}
+
+func lowercaseHost(u *url.URL) {
+	if len(u.Host) > 0 {
+		u.Host = strings.ToLower(u.Host)
+	}
+}
+
+func removeDefaultPort(u *url.URL) {
+	if len(u.Host) > 0 {
+		scheme := strings.ToLower(u.Scheme)
+		u.Host = rxPort.ReplaceAllStringFunc(u.Host, func(val string) string {
+			if (scheme == "http" && val == defaultHttpPort) || (scheme == "https" && val == defaultHttpsPort) {
+				return ""
+			}
+			return val
+		})
+	}
+}
+
+func removeTrailingSlash(u *url.URL) {
+	if l := len(u.Path); l > 0 {
+		if strings.HasSuffix(u.Path, "/") {
+			u.Path = u.Path[:l-1]
+		}
+	} else if l = len(u.Host); l > 0 {
+		if strings.HasSuffix(u.Host, "/") {
+			u.Host = u.Host[:l-1]
+		}
+	}
+}
+
+func addTrailingSlash(u *url.URL) {
+	if l := len(u.Path); l > 0 {
+		if !strings.HasSuffix(u.Path, "/") {
+			u.Path += "/"
+		}
+	} else if l = len(u.Host); l > 0 {
+		if !strings.HasSuffix(u.Host, "/") {
+			u.Host += "/"
+		}
+	}
+}
+
+func removeDotSegments(u *url.URL) {
+	if len(u.Path) > 0 {
+		var dotFree []string
+		var lastIsDot bool
+
+		sections := strings.Split(u.Path, "/")
+		for _, s := range sections {
+			if s == ".." {
+				if len(dotFree) > 0 {
+					dotFree = dotFree[:len(dotFree)-1]
+				}
+			} else if s != "." {
+				dotFree = append(dotFree, s)
+			}
+			lastIsDot = (s == "." || s == "..")
+		}
+		// Special case if host does not end with / and new path does not begin with /
+		u.Path = strings.Join(dotFree, "/")
+		if u.Host != "" && !strings.HasSuffix(u.Host, "/") && !strings.HasPrefix(u.Path, "/") {
+			u.Path = "/" + u.Path
+		}
+		// Special case if the last segment was a dot, make sure the path ends with a slash
+		if lastIsDot && !strings.HasSuffix(u.Path, "/") {
+			u.Path += "/"
+		}
+	}
+}
+
+func removeDirectoryIndex(u *url.URL) {
+	if len(u.Path) > 0 {
+		u.Path = rxDirIndex.ReplaceAllString(u.Path, "$1")
+	}
+}
+
+func removeFragment(u *url.URL) {
+	u.Fragment = ""
+}
+
+func forceHTTP(u *url.URL) {
+	if strings.ToLower(u.Scheme) == "https" {
+		u.Scheme = "http"
+	}
+}
+
+func removeDuplicateSlashes(u *url.URL) {
+	if len(u.Path) > 0 {
+		u.Path = rxDupSlashes.ReplaceAllString(u.Path, "/")
+	}
+}
+
+func removeWWW(u *url.URL) {
+	if len(u.Host) > 0 && strings.HasPrefix(strings.ToLower(u.Host), "www.") {
+		u.Host = u.Host[4:]
+	}
+}
+
+func addWWW(u *url.URL) {
+	if len(u.Host) > 0 && !strings.HasPrefix(strings.ToLower(u.Host), "www.") {
+		u.Host = "www." + u.Host
+	}
+}
+
+func sortQuery(u *url.URL) {
+	q := u.Query()
+
+	if len(q) > 0 {
+		arKeys := make([]string, len(q))
+		i := 0
+		for k, _ := range q {
+			arKeys[i] = k
+			i++
+		}
+		sort.Strings(arKeys)
+		buf := new(bytes.Buffer)
+		for _, k := range arKeys {
+			sort.Strings(q[k])
+			for _, v := range q[k] {
+				if buf.Len() > 0 {
+					buf.WriteRune('&')
+				}
+				buf.WriteString(fmt.Sprintf("%s=%s", k, urlesc.QueryEscape(v)))
+			}
+		}
+
+		// Rebuild the raw query string
+		u.RawQuery = buf.String()
+	}
+}
+
+func decodeDWORDHost(u *url.URL) {
+	if len(u.Host) > 0 {
+		if matches := rxDWORDHost.FindStringSubmatch(u.Host); len(matches) > 2 {
+			var parts [4]int64
+
+			dword, _ := strconv.ParseInt(matches[1], 10, 0)
+			for i, shift := range []uint{24, 16, 8, 0} {
+				parts[i] = dword >> shift & 0xFF
+			}
+			u.Host = fmt.Sprintf("%d.%d.%d.%d%s", parts[0], parts[1], parts[2], parts[3], matches[2])
+		}
+	}
+}
+
+func decodeOctalHost(u *url.URL) {
+	if len(u.Host) > 0 {
+		if matches := rxOctalHost.FindStringSubmatch(u.Host); len(matches) > 5 {
+			var parts [4]int64
+
+			for i := 1; i <= 4; i++ {
+				parts[i-1], _ = strconv.ParseInt(matches[i], 8, 0)
+			}
+			u.Host = fmt.Sprintf("%d.%d.%d.%d%s", parts[0], parts[1], parts[2], parts[3], matches[5])
+		}
+	}
+}
+
+func decodeHexHost(u *url.URL) {
+	if len(u.Host) > 0 {
+		if matches := rxHexHost.FindStringSubmatch(u.Host); len(matches) > 2 {
+			// Conversion is safe because of regex validation
+			parsed, _ := strconv.ParseInt(matches[1], 16, 0)
+			// Set host as DWORD (base 10) encoded host
+			u.Host = fmt.Sprintf("%d%s", parsed, matches[2])
+			// The rest is the same as decoding a DWORD host
+			decodeDWORDHost(u)
+		}
+	}
+}
+
+func removeUnncessaryHostDots(u *url.URL) {
+	if len(u.Host) > 0 {
+		if matches := rxHostDots.FindStringSubmatch(u.Host); len(matches) > 1 {
+			// Trim the leading and trailing dots
+			u.Host = strings.Trim(matches[1], ".")
+			if len(matches) > 2 {
+				u.Host += matches[2]
+			}
+		}
+	}
+}
+
+func removeEmptyPortSeparator(u *url.URL) {
+	if len(u.Host) > 0 {
+		u.Host = rxEmptyPort.ReplaceAllString(u.Host, "")
+	}
+}

vendor/github.com/PuerkitoBio/purell/purell_test.go

@@ -0,0 +1,768 @@
+package purell
+
+import (
+	"fmt"
+	"net/url"
+	"testing"
+)
+
+type testCase struct {
+	nm     string
+	src    string
+	flgs   NormalizationFlags
+	res    string
+	parsed bool
+}
+
+var (
+	cases = [...]*testCase{
+		&testCase{
+			"LowerScheme",
+			"HTTP://www.SRC.ca",
+			FlagLowercaseScheme,
+			"http://www.SRC.ca",
+			false,
+		},
+		&testCase{
+			"LowerScheme2",
+			"http://www.SRC.ca",
+			FlagLowercaseScheme,
+			"http://www.SRC.ca",
+			false,
+		},
+		&testCase{
+			"LowerHost",
+			"HTTP://www.SRC.ca/",
+			FlagLowercaseHost,
+			"http://www.src.ca/", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"UpperEscapes",
+			`http://www.whatever.com/Some%aa%20Special%8Ecases/`,
+			FlagUppercaseEscapes,
+			"http://www.whatever.com/Some%AA%20Special%8Ecases/",
+			false,
+		},
+		&testCase{
+			"UnnecessaryEscapes",
+			`http://www.toto.com/%41%42%2E%44/%32%33%52%2D/%5f%7E`,
+			FlagDecodeUnnecessaryEscapes,
+			"http://www.toto.com/AB.D/23R-/_~",
+			false,
+		},
+		&testCase{
+			"RemoveDefaultPort",
+			"HTTP://www.SRC.ca:80/",
+			FlagRemoveDefaultPort,
+			"http://www.SRC.ca/", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveDefaultPort2",
+			"HTTP://www.SRC.ca:80",
+			FlagRemoveDefaultPort,
+			"http://www.SRC.ca", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveDefaultPort3",
+			"HTTP://www.SRC.ca:8080",
+			FlagRemoveDefaultPort,
+			"http://www.SRC.ca:8080", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"Safe",
+			"HTTP://www.SRC.ca:80/to%1ato%8b%ee/OKnow%41%42%43%7e",
+			FlagsSafe,
+			"http://www.src.ca/to%1Ato%8B%EE/OKnowABC~",
+			false,
+		},
+		&testCase{
+			"BothLower",
+			"HTTP://www.SRC.ca:80/to%1ato%8b%ee/OKnow%41%42%43%7e",
+			FlagLowercaseHost | FlagLowercaseScheme,
+			"http://www.src.ca:80/to%1Ato%8B%EE/OKnowABC~",
+			false,
+		},
+		&testCase{
+			"RemoveTrailingSlash",
+			"HTTP://www.SRC.ca:80/",
+			FlagRemoveTrailingSlash,
+			"http://www.SRC.ca:80", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveTrailingSlash2",
+			"HTTP://www.SRC.ca:80/toto/titi/",
+			FlagRemoveTrailingSlash,
+			"http://www.SRC.ca:80/toto/titi", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveTrailingSlash3",
+			"HTTP://www.SRC.ca:80/toto/titi/fin/?a=1",
+			FlagRemoveTrailingSlash,
+			"http://www.SRC.ca:80/toto/titi/fin?a=1", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"AddTrailingSlash",
+			"HTTP://www.SRC.ca:80",
+			FlagAddTrailingSlash,
+			"http://www.SRC.ca:80/", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"AddTrailingSlash2",
+			"HTTP://www.SRC.ca:80/toto/titi.html",
+			FlagAddTrailingSlash,
+			"http://www.SRC.ca:80/toto/titi.html/", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"AddTrailingSlash3",
+			"HTTP://www.SRC.ca:80/toto/titi/fin?a=1",
+			FlagAddTrailingSlash,
+			"http://www.SRC.ca:80/toto/titi/fin/?a=1", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveDotSegments",
+			"HTTP://root/a/b/./../../c/",
+			FlagRemoveDotSegments,
+			"http://root/c/", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveDotSegments2",
+			"HTTP://root/../a/b/./../c/../d",
+			FlagRemoveDotSegments,
+			"http://root/a/d", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"UsuallySafe",
+			"HTTP://www.SRC.ca:80/to%1ato%8b%ee/./c/d/../OKnow%41%42%43%7e/?a=b#test",
+			FlagsUsuallySafeGreedy,
+			"http://www.src.ca/to%1Ato%8B%EE/c/OKnowABC~?a=b#test",
+			false,
+		},
+		&testCase{
+			"RemoveDirectoryIndex",
+			"HTTP://root/a/b/c/default.aspx",
+			FlagRemoveDirectoryIndex,
+			"http://root/a/b/c/", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveDirectoryIndex2",
+			"HTTP://root/a/b/c/default#a=b",
+			FlagRemoveDirectoryIndex,
+			"http://root/a/b/c/default#a=b", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"RemoveFragment",
+			"HTTP://root/a/b/c/default#toto=tata",
+			FlagRemoveFragment,
+			"http://root/a/b/c/default", // Since Go1.1, scheme is automatically lowercased
+			false,
+		},
+		&testCase{
+			"ForceHTTP",
+			"https://root/a/b/c/default#toto=tata",
+			FlagForceHTTP,
+			"http://root/a/b/c/default#toto=tata",
+			false,
+		},
+		&testCase{
+			"RemoveDuplicateSlashes",
+			"https://root/a//b///c////default#toto=tata",
+			FlagRemoveDuplicateSlashes,
+			"https://root/a/b/c/default#toto=tata",
+			false,
+		},
+		&testCase{
+			"RemoveDuplicateSlashes2",
+			"https://root//a//b///c////default#toto=tata",
+			FlagRemoveDuplicateSlashes,
+			"https://root/a/b/c/default#toto=tata",
+			false,
+		},
+		&testCase{
+			"RemoveWWW",
+			"https://www.root/a/b/c/",
+			FlagRemoveWWW,
+			"https://root/a/b/c/",
+			false,
+		},
+		&testCase{
+			"RemoveWWW2",
+			"https://WwW.Root/a/b/c/",
+			FlagRemoveWWW,
+			"https://Root/a/b/c/",
+			false,
+		},
+		&testCase{
+			"AddWWW",
+			"https://Root/a/b/c/",
+			FlagAddWWW,
+			"https://www.Root/a/b/c/",
+			false,
+		},
+		&testCase{
+			"SortQuery",
+			"http://root/toto/?b=4&a=1&c=3&b=2&a=5",
+			FlagSortQuery,
+			"http://root/toto/?a=1&a=5&b=2&b=4&c=3",
+			false,
+		},
+		&testCase{
+			"RemoveEmptyQuerySeparator",
+			"http://root/toto/?",
+			FlagRemoveEmptyQuerySeparator,
+			"http://root/toto/",
+			false,
+		},
+		&testCase{
+			"Unsafe",
+			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
+			FlagsUnsafeGreedy,
+			"http://root.com/toto/tE%1F/a/c?a=4&w=1&w=2&z=3",
+			false,
+		},
+		&testCase{
+			"Safe2",
+			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
+			FlagsSafe,
+			"https://www.root.com/toto/tE%1F///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
+			false,
+		},
+		&testCase{
+			"UsuallySafe2",
+			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
+			FlagsUsuallySafeGreedy,
+			"https://www.root.com/toto/tE%1F///a/c?z=3&w=2&a=4&w=1#invalid",
+			false,
+		},
+		&testCase{
+			"AddTrailingSlashBug",
+			"http://src.ca/",
+			FlagsAllNonGreedy,
+			"http://www.src.ca/",
+			false,
+		},
+		&testCase{
+			"SourceModified",
+			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
+			FlagsUnsafeGreedy,
+			"http://root.com/toto/tE%1F/a/c?a=4&w=1&w=2&z=3",
+			true,
+		},
+		&testCase{
+			"IPv6-1",
+			"http://[2001:db8:1f70::999:de8:7648:6e8]/test",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://[2001:db8:1f70::999:de8:7648:6e8]/test",
+			false,
+		},
+		&testCase{
+			"IPv6-2",
+			"http://[::ffff:192.168.1.1]/test",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://[::ffff:192.168.1.1]/test",
+			false,
+		},
+		&testCase{
+			"IPv6-3",
+			"http://[::ffff:192.168.1.1]:80/test",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://[::ffff:192.168.1.1]/test",
+			false,
+		},
+		&testCase{
+			"IPv6-4",
+			"htTps://[::fFff:192.168.1.1]:443/test",
+			FlagsSafe | FlagRemoveDotSegments,
+			"https://[::ffff:192.168.1.1]/test",
+			false,
+		},
+		&testCase{
+			"FTP",
+			"ftp://user:pass@ftp.foo.net/foo/bar",
+			FlagsSafe | FlagRemoveDotSegments,
+			"ftp://user:pass@ftp.foo.net/foo/bar",
+			false,
+		},
+		&testCase{
+			"Standard-1",
+			"http://www.foo.com:80/foo",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://www.foo.com/foo",
+			false,
+		},
+		&testCase{
+			"Standard-2",
+			"http://www.foo.com:8000/foo",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://www.foo.com:8000/foo",
+			false,
+		},
+		&testCase{
+			"Standard-3",
+			"http://www.foo.com/%7ebar",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://www.foo.com/~bar",
+			false,
+		},
+		&testCase{
+			"Standard-4",
+			"http://www.foo.com/%7Ebar",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://www.foo.com/~bar",
+			false,
+		},
+		&testCase{
+			"Standard-5",
+			"http://USER:pass@www.Example.COM/foo/bar",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://USER:pass@www.example.com/foo/bar",
+			false,
+		},
+		&testCase{
+			"Standard-6",
+			"http://test.example/?a=%26&b=1",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://test.example/?a=%26&b=1",
+			false,
+		},
+		&testCase{
+			"Standard-7",
+			"http://test.example/%25/?p=%20val%20%25",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://test.example/%25/?p=%20val%20%25",
+			false,
+		},
+		&testCase{
+			"Standard-8",
+			"http://test.example/path/with a%20space+/",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://test.example/path/with%20a%20space+/",
+			false,
+		},
+		&testCase{
+			"Standard-9",
+			"http://test.example/?",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://test.example/",
+			false,
+		},
+		&testCase{
+			"Standard-10",
+			"http://a.COM/path/?b&a",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://a.com/path/?b&a",
+			false,
+		},
+		&testCase{
+			"StandardCasesAddTrailingSlash",
+			"http://test.example?",
+			FlagsSafe | FlagAddTrailingSlash,
+			"http://test.example/",
+			false,
+		},
+		&testCase{
+			"OctalIP-1",
+			"http://0123.011.0.4/",
+			FlagsSafe | FlagDecodeOctalHost,
+			"http://0123.011.0.4/",
+			false,
+		},
+		&testCase{
+			"OctalIP-2",
+			"http://0102.0146.07.0223/",
+			FlagsSafe | FlagDecodeOctalHost,
+			"http://66.102.7.147/",
+			false,
+		},
+		&testCase{
+			"OctalIP-3",
+			"http://0102.0146.07.0223.:23/",
+			FlagsSafe | FlagDecodeOctalHost,
+			"http://66.102.7.147.:23/",
+			false,
+		},
+		&testCase{
+			"OctalIP-4",
+			"http://USER:pass@0102.0146.07.0223../",
+			FlagsSafe | FlagDecodeOctalHost,
+			"http://USER:pass@66.102.7.147../",
+			false,
+		},
+		&testCase{
+			"DWORDIP-1",
+			"http://123.1113982867/",
+			FlagsSafe | FlagDecodeDWORDHost,
+			"http://123.1113982867/",
+			false,
+		},
+		&testCase{
+			"DWORDIP-2",
+			"http://1113982867/",
+			FlagsSafe | FlagDecodeDWORDHost,
+			"http://66.102.7.147/",
+			false,
+		},
+		&testCase{
+			"DWORDIP-3",
+			"http://1113982867.:23/",
+			FlagsSafe | FlagDecodeDWORDHost,
+			"http://66.102.7.147.:23/",
+			false,
+		},
+		&testCase{
+			"DWORDIP-4",
+			"http://USER:pass@1113982867../",
+			FlagsSafe | FlagDecodeDWORDHost,
+			"http://USER:pass@66.102.7.147../",
+			false,
+		},
+		&testCase{
+			"HexIP-1",
+			"http://0x123.1113982867/",
+			FlagsSafe | FlagDecodeHexHost,
+			"http://0x123.1113982867/",
+			false,
+		},
+		&testCase{
+			"HexIP-2",
+			"http://0x42660793/",
+			FlagsSafe | FlagDecodeHexHost,
+			"http://66.102.7.147/",
+			false,
+		},
+		&testCase{
+			"HexIP-3",
+			"http://0x42660793.:23/",
+			FlagsSafe | FlagDecodeHexHost,
+			"http://66.102.7.147.:23/",
+			false,
+		},
+		&testCase{
+			"HexIP-4",
+			"http://USER:pass@0x42660793../",
+			FlagsSafe | FlagDecodeHexHost,
+			"http://USER:pass@66.102.7.147../",
+			false,
+		},
+		&testCase{
+			"UnnecessaryHostDots-1",
+			"http://.www.foo.com../foo/bar.html",
+			FlagsSafe | FlagRemoveUnnecessaryHostDots,
+			"http://www.foo.com/foo/bar.html",
+			false,
+		},
+		&testCase{
+			"UnnecessaryHostDots-2",
+			"http://www.foo.com./foo/bar.html",
+			FlagsSafe | FlagRemoveUnnecessaryHostDots,
+			"http://www.foo.com/foo/bar.html",
+			false,
+		},
+		&testCase{
+			"UnnecessaryHostDots-3",
+			"http://www.foo.com.:81/foo",
+			FlagsSafe | FlagRemoveUnnecessaryHostDots,
+			"http://www.foo.com:81/foo",
+			false,
+		},
+		&testCase{
+			"UnnecessaryHostDots-4",
+			"http://www.example.com./",
+			FlagsSafe | FlagRemoveUnnecessaryHostDots,
+			"http://www.example.com/",
+			false,
+		},
+		&testCase{
+			"EmptyPort-1",
+			"http://www.thedraymin.co.uk:/main/?p=308",
+			FlagsSafe | FlagRemoveEmptyPortSeparator,
+			"http://www.thedraymin.co.uk/main/?p=308",
+			false,
+		},
+		&testCase{
+			"EmptyPort-2",
+			"http://www.src.ca:",
+			FlagsSafe | FlagRemoveEmptyPortSeparator,
+			"http://www.src.ca",
+			false,
+		},
+		&testCase{
+			"Slashes-1",
+			"http://test.example/foo/bar/.",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/bar/",
+			false,
+		},
+		&testCase{
+			"Slashes-2",
+			"http://test.example/foo/bar/./",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/bar/",
+			false,
+		},
+		&testCase{
+			"Slashes-3",
+			"http://test.example/foo/bar/..",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/",
+			false,
+		},
+		&testCase{
+			"Slashes-4",
+			"http://test.example/foo/bar/../",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/",
+			false,
+		},
+		&testCase{
+			"Slashes-5",
+			"http://test.example/foo/bar/../baz",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/baz",
+			false,
+		},
+		&testCase{
+			"Slashes-6",
+			"http://test.example/foo/bar/../..",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/",
+			false,
+		},
+		&testCase{
+			"Slashes-7",
+			"http://test.example/foo/bar/../../",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/",
+			false,
+		},
+		&testCase{
+			"Slashes-8",
+			"http://test.example/foo/bar/../../baz",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/baz",
+			false,
+		},
+		&testCase{
+			"Slashes-9",
+			"http://test.example/foo/bar/../../../baz",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/baz",
+			false,
+		},
+		&testCase{
+			"Slashes-10",
+			"http://test.example/foo/bar/../../../../baz",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/baz",
+			false,
+		},
+		&testCase{
+			"Slashes-11",
+			"http://test.example/./foo",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo",
+			false,
+		},
+		&testCase{
+			"Slashes-12",
+			"http://test.example/../foo",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo",
+			false,
+		},
+		&testCase{
+			"Slashes-13",
+			"http://test.example/foo.",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo.",
+			false,
+		},
+		&testCase{
+			"Slashes-14",
+			"http://test.example/.foo",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/.foo",
+			false,
+		},
+		&testCase{
+			"Slashes-15",
+			"http://test.example/foo..",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo..",
+			false,
+		},
+		&testCase{
+			"Slashes-16",
+			"http://test.example/..foo",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/..foo",
+			false,
+		},
+		&testCase{
+			"Slashes-17",
+			"http://test.example/./../foo",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo",
+			false,
+		},
+		&testCase{
+			"Slashes-18",
+			"http://test.example/./foo/.",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/",
+			false,
+		},
+		&testCase{
+			"Slashes-19",
+			"http://test.example/foo/./bar",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/bar",
+			false,
+		},
+		&testCase{
+			"Slashes-20",
+			"http://test.example/foo/../bar",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/bar",
+			false,
+		},
+		&testCase{
+			"Slashes-21",
+			"http://test.example/foo//",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/",
+			false,
+		},
+		&testCase{
+			"Slashes-22",
+			"http://test.example/foo///bar//",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"http://test.example/foo/bar/",
+			false,
+		},
+		&testCase{
+			"Relative",
+			"foo/bar",
+			FlagsAllGreedy,
+			"foo/bar",
+			false,
+		},
+		&testCase{
+			"Relative-1",
+			"./../foo",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"foo",
+			false,
+		},
+		&testCase{
+			"Relative-2",
+			"./foo/bar/../baz/../bang/..",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"foo/",
+			false,
+		},
+		&testCase{
+			"Relative-3",
+			"foo///bar//",
+			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
+			"foo/bar/",
+			false,
+		},
+		&testCase{
+			"Relative-4",
+			"www.youtube.com",
+			FlagsUsuallySafeGreedy,
+			"www.youtube.com",
+			false,
+		},
+		/*&testCase{
+			"UrlNorm-5",
+			"http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3",
+			FlagsSafe | FlagRemoveDotSegments,
+			"http://ja.wikipedia.org/wiki/\xe3\x82\xad\xe3\x83\xa3\xe3\x82\xbf\xe3\x83\x94\xe3\x83\xa9\xe3\x83\xbc\xe3\x82\xb8\xe3\x83\xa3\xe3\x83\x91\xe3\x83\xb3",
+			false,
+		},
+		&testCase{
+			"UrlNorm-1",
+			"http://test.example/?a=%e3%82%82%26",
+			FlagsAllGreedy,
+			"http://test.example/?a=\xe3\x82\x82%26",
+			false,
+		},*/
+	}
+)
+
+func TestRunner(t *testing.T) {
+	for _, tc := range cases {
+		runCase(tc, t)
+	}
+}
+
+func runCase(tc *testCase, t *testing.T) {
+	t.Logf("running %s...", tc.nm)
+	if tc.parsed {
+		u, e := url.Parse(tc.src)
+		if e != nil {
+			t.Errorf("%s - FAIL : %s", tc.nm, e)
+			return
+		} else {
+			NormalizeURL(u, tc.flgs)
+			if s := u.String(); s != tc.res {
+				t.Errorf("%s - FAIL expected '%s', got '%s'", tc.nm, tc.res, s)
+			}
+		}
+	} else {
+		if s, e := NormalizeURLString(tc.src, tc.flgs); e != nil {
+			t.Errorf("%s - FAIL : %s", tc.nm, e)
+		} else if s != tc.res {
+			t.Errorf("%s - FAIL expected '%s', got '%s'", tc.nm, tc.res, s)
+		}
+	}
+}
+
+func TestDecodeUnnecessaryEscapesAll(t *testing.T) {
+	var url = "http://host/"
+
+	for i := 0; i < 256; i++ {
+		url += fmt.Sprintf("%%%02x", i)
+	}
+	if s, e := NormalizeURLString(url, FlagDecodeUnnecessaryEscapes); e != nil {
+		t.Fatalf("Got error %s", e.Error())
+	} else {
+		const want = "http://host/%00%01%02%03%04%05%06%07%08%09%0A%0B%0C%0D%0E%0F%10%11%12%13%14%15%16%17%18%19%1A%1B%1C%1D%1E%1F%20!%22%23$%25&'()*+,-./0123456789:;%3C=%3E%3F@ABCDEFGHIJKLMNOPQRSTUVWXYZ[%5C]%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~%7F%80%81%82%83%84%85%86%87%88%89%8A%8B%8C%8D%8E%8F%90%91%92%93%94%95%96%97%98%99%9A%9B%9C%9D%9E%9F%A0%A1%A2%A3%A4%A5%A6%A7%A8%A9%AA%AB%AC%AD%AE%AF%B0%B1%B2%B3%B4%B5%B6%B7%B8%B9%BA%BB%BC%BD%BE%BF%C0%C1%C2%C3%C4%C5%C6%C7%C8%C9%CA%CB%CC%CD%CE%CF%D0%D1%D2%D3%D4%D5%D6%D7%D8%D9%DA%DB%DC%DD%DE%DF%E0%E1%E2%E3%E4%E5%E6%E7%E8%E9%EA%EB%EC%ED%EE%EF%F0%F1%F2%F3%F4%F5%F6%F7%F8%F9%FA%FB%FC%FD%FE%FF"
+		if s != want {
+			t.Errorf("DecodeUnnecessaryEscapesAll:\nwant\n%s\ngot\n%s", want, s)
+		}
+	}
+}
+
+func TestEncodeNecessaryEscapesAll(t *testing.T) {
+	var url = "http://host/"
+
+	for i := 0; i < 256; i++ {
+		if i != 0x25 {
+			url += string(i)
+		}
+	}
+	if s, e := NormalizeURLString(url, FlagEncodeNecessaryEscapes); e != nil {
+		t.Fatalf("Got error %s", e.Error())
+	} else {
+		const want = "http://host/%00%01%02%03%04%05%06%07%08%09%0A%0B%0C%0D%0E%0F%10%11%12%13%14%15%16%17%18%19%1A%1B%1C%1D%1E%1F%20!%22#$&'()*+,-./0123456789:;%3C=%3E?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[%5C]%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~%7F%C2%80%C2%81%C2%82%C2%83%C2%84%C2%85%C2%86%C2%87%C2%88%C2%89%C2%8A%C2%8B%C2%8C%C2%8D%C2%8E%C2%8F%C2%90%C2%91%C2%92%C2%93%C2%94%C2%95%C2%96%C2%97%C2%98%C2%99%C2%9A%C2%9B%C2%9C%C2%9D%C2%9E%C2%9F%C2%A0%C2%A1%C2%A2%C2%A3%C2%A4%C2%A5%C2%A6%C2%A7%C2%A8%C2%A9%C2%AA%C2%AB%C2%AC%C2%AD%C2%AE%C2%AF%C2%B0%C2%B1%C2%B2%C2%B3%C2%B4%C2%B5%C2%B6%C2%B7%C2%B8%C2%B9%C2%BA%C2%BB%C2%BC%C2%BD%C2%BE%C2%BF%C3%80%C3%81%C3%82%C3%83%C3%84%C3%85%C3%86%C3%87%C3%88%C3%89%C3%8A%C3%8B%C3%8C%C3%8D%C3%8E%C3%8F%C3%90%C3%91%C3%92%C3%93%C3%94%C3%95%C3%96%C3%97%C3%98%C3%99%C3%9A%C3%9B%C3%9C%C3%9D%C3%9E%C3%9F%C3%A0%C3%A1%C3%A2%C3%A3%C3%A4%C3%A5%C3%A6%C3%A7%C3%A8%C3%A9%C3%AA%C3%AB%C3%AC%C3%AD%C3%AE%C3%AF%C3%B0%C3%B1%C3%B2%C3%B3%C3%B4%C3%B5%C3%B6%C3%B7%C3%B8%C3%B9%C3%BA%C3%BB%C3%BC%C3%BD%C3%BE%C3%BF"
+		if s != want {
+			t.Errorf("EncodeNecessaryEscapesAll:\nwant\n%s\ngot\n%s", want, s)
+		}
+	}
+}

vendor/github.com/PuerkitoBio/purell/urlnorm_test.go

@@ -0,0 +1,52 @@
+package purell
+
+import (
+	"testing"
+)
+
+// Test cases merged from PR #1
+// Originally from https://github.com/jehiah/urlnorm/blob/master/test_urlnorm.py
+
+func assertMap(t *testing.T, cases map[string]string, f NormalizationFlags) {
+	for bad, good := range cases {
+		s, e := NormalizeURLString(bad, f)
+		if e != nil {
+			t.Errorf("%s normalizing %v to %v", e.Error(), bad, good)
+		} else {
+			if s != good {
+				t.Errorf("source: %v expected: %v got: %v", bad, good, s)
+			}
+		}
+	}
+}
+
+// This tests normalization to a unicode representation
+// precent escapes for unreserved values are unescaped to their unicode value
+// tests normalization to idna domains
+// test ip word handling, ipv6 address handling, and trailing domain periods
+// in general, this matches google chromes unescaping for things in the address bar.
+// spaces are converted to '+' (perhaphs controversial)
+// http://code.google.com/p/google-url/ probably is another good reference for this approach
+func TestUrlnorm(t *testing.T) {
+	testcases := map[string]string{
+		"http://test.example/?a=%e3%82%82%26": "http://test.example/?a=%e3%82%82%26",
+		//"http://test.example/?a=%e3%82%82%26": "http://test.example/?a=\xe3\x82\x82%26", //should return a unicode character
+		"http://s.xn--q-bga.DE/":    "http://s.xn--q-bga.de/",       //should be in idna format
+		"http://XBLA\u306eXbox.com": "http://xn--xblaxbox-jf4g.com", //test utf8 and unicode
+		"http://президент.рф":       "http://xn--d1abbgf6aiiy.xn--p1ai",
+		"http://ПРЕЗИДЕНТ.РФ":       "http://xn--d1abbgf6aiiy.xn--p1ai",
+		"http://\u00e9.com":         "http://xn--9ca.com",
+		"http://e\u0301.com":        "http://xn--9ca.com",
+		"http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3": "http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3",
+		//"http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3": "http://ja.wikipedia.org/wiki/\xe3\x82\xad\xe3\x83\xa3\xe3\x82\xbf\xe3\x83\x94\xe3\x83\xa9\xe3\x83\xbc\xe3\x82\xb8\xe3\x83\xa3\xe3\x83\x91\xe3\x83\xb3",
+
+		"http://test.example/\xe3\x82\xad": "http://test.example/%E3%82%AD",
+		//"http://test.example/\xe3\x82\xad":              "http://test.example/\xe3\x82\xad",
+		"http://test.example/?p=%23val#test-%23-val%25": "http://test.example/?p=%23val#test-%23-val%25", //check that %23 (#) is not escaped where it shouldn't be
+
+		"http://test.domain/I%C3%B1t%C3%ABrn%C3%A2ti%C3%B4n%EF%BF%BDliz%C3%A6ti%C3%B8n": "http://test.domain/I%C3%B1t%C3%ABrn%C3%A2ti%C3%B4n%EF%BF%BDliz%C3%A6ti%C3%B8n",
+		//"http://test.domain/I%C3%B1t%C3%ABrn%C3%A2ti%C3%B4n%EF%BF%BDliz%C3%A6ti%C3%B8n": "http://test.domain/I\xc3\xb1t\xc3\xabrn\xc3\xa2ti\xc3\xb4n\xef\xbf\xbdliz\xc3\xa6ti\xc3\xb8n",
+	}
+
+	assertMap(t, testcases, FlagsSafe|FlagRemoveDotSegments)
+}

vendor/github.com/PuerkitoBio/urlesc/.travis.yml

@@ -0,0 +1,11 @@
+language: go
+
+go:
+  - 1.4
+  - tip
+
+install:
+  - go build .
+
+script:
+  - go test -v

vendor/github.com/PuerkitoBio/urlesc/LICENSE

@@ -0,0 +1,27 @@
+Copyright (c) 2012 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/PuerkitoBio/urlesc/README.md

@@ -0,0 +1,16 @@
+urlesc [![Build Status](https://travis-ci.org/PuerkitoBio/urlesc.png?branch=master)](https://travis-ci.org/PuerkitoBio/urlesc) [![GoDoc](http://godoc.org/github.com/PuerkitoBio/urlesc?status.svg)](http://godoc.org/github.com/PuerkitoBio/urlesc)
+======
+
+Package urlesc implements query escaping as per RFC 3986.
+
+It contains some parts of the net/url package, modified so as to allow
+some reserved characters incorrectly escaped by net/url (see [issue 5684](https://github.com/golang/go/issues/5684)).
+
+## Install
+
+    go get github.com/PuerkitoBio/urlesc
+
+## License
+
+Go license (BSD-3-Clause)
+

vendor/github.com/PuerkitoBio/urlesc/urlesc.go

@@ -0,0 +1,180 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package urlesc implements query escaping as per RFC 3986.
+// It contains some parts of the net/url package, modified so as to allow
+// some reserved characters incorrectly escaped by net/url.
+// See https://github.com/golang/go/issues/5684
+package urlesc
+
+import (
+	"bytes"
+	"net/url"
+	"strings"
+)
+
+type encoding int
+
+const (
+	encodePath encoding = 1 + iota
+	encodeUserPassword
+	encodeQueryComponent
+	encodeFragment
+)
+
+// Return true if the specified character should be escaped when
+// appearing in a URL string, according to RFC 3986.
+func shouldEscape(c byte, mode encoding) bool {
+	// §2.3 Unreserved characters (alphanum)
+	if 'A' <= c && c <= 'Z' || 'a' <= c && c <= 'z' || '0' <= c && c <= '9' {
+		return false
+	}
+
+	switch c {
+	case '-', '.', '_', '~': // §2.3 Unreserved characters (mark)
+		return false
+
+	// §2.2 Reserved characters (reserved)
+	case ':', '/', '?', '#', '[', ']', '@', // gen-delims
+		'!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=': // sub-delims
+		// Different sections of the URL allow a few of
+		// the reserved characters to appear unescaped.
+		switch mode {
+		case encodePath: // §3.3
+			// The RFC allows sub-delims and : @.
+			// '/', '[' and ']' can be used to assign meaning to individual path
+			// segments.  This package only manipulates the path as a whole,
+			// so we allow those as well.  That leaves only ? and # to escape.
+			return c == '?' || c == '#'
+
+		case encodeUserPassword: // §3.2.1
+			// The RFC allows : and sub-delims in
+			// userinfo.  The parsing of userinfo treats ':' as special so we must escape
+			// all the gen-delims.
+			return c == ':' || c == '/' || c == '?' || c == '#' || c == '[' || c == ']' || c == '@'
+
+		case encodeQueryComponent: // §3.4
+			// The RFC allows / and ?.
+			return c != '/' && c != '?'
+
+		case encodeFragment: // §4.1
+			// The RFC text is silent but the grammar allows
+			// everything, so escape nothing but #
+			return c == '#'
+		}
+	}
+
+	// Everything else must be escaped.
+	return true
+}
+
+// QueryEscape escapes the string so it can be safely placed
+// inside a URL query.
+func QueryEscape(s string) string {
+	return escape(s, encodeQueryComponent)
+}
+
+func escape(s string, mode encoding) string {
+	spaceCount, hexCount := 0, 0
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if shouldEscape(c, mode) {
+			if c == ' ' && mode == encodeQueryComponent {
+				spaceCount++
+			} else {
+				hexCount++
+			}
+		}
+	}
+
+	if spaceCount == 0 && hexCount == 0 {
+		return s
+	}
+
+	t := make([]byte, len(s)+2*hexCount)
+	j := 0
+	for i := 0; i < len(s); i++ {
+		switch c := s[i]; {
+		case c == ' ' && mode == encodeQueryComponent:
+			t[j] = '+'
+			j++
+		case shouldEscape(c, mode):
+			t[j] = '%'
+			t[j+1] = "0123456789ABCDEF"[c>>4]
+			t[j+2] = "0123456789ABCDEF"[c&15]
+			j += 3
+		default:
+			t[j] = s[i]
+			j++
+		}
+	}
+	return string(t)
+}
+
+var uiReplacer = strings.NewReplacer(
+	"%21", "!",
+	"%27", "'",
+	"%28", "(",
+	"%29", ")",
+	"%2A", "*",
+)
+
+// unescapeUserinfo unescapes some characters that need not to be escaped as per RFC3986.
+func unescapeUserinfo(s string) string {
+	return uiReplacer.Replace(s)
+}
+
+// Escape reassembles the URL into a valid URL string.
+// The general form of the result is one of:
+//
+//	scheme:opaque
+//	scheme://userinfo@host/path?query#fragment
+//
+// If u.Opaque is non-empty, String uses the first form;
+// otherwise it uses the second form.
+//
+// In the second form, the following rules apply:
+//	- if u.Scheme is empty, scheme: is omitted.
+//	- if u.User is nil, userinfo@ is omitted.
+//	- if u.Host is empty, host/ is omitted.
+//	- if u.Scheme and u.Host are empty and u.User is nil,
+//	   the entire scheme://userinfo@host/ is omitted.
+//	- if u.Host is non-empty and u.Path begins with a /,
+//	   the form host/path does not add its own /.
+//	- if u.RawQuery is empty, ?query is omitted.
+//	- if u.Fragment is empty, #fragment is omitted.
+func Escape(u *url.URL) string {
+	var buf bytes.Buffer
+	if u.Scheme != "" {
+		buf.WriteString(u.Scheme)
+		buf.WriteByte(':')
+	}
+	if u.Opaque != "" {
+		buf.WriteString(u.Opaque)
+	} else {
+		if u.Scheme != "" || u.Host != "" || u.User != nil {
+			buf.WriteString("//")
+			if ui := u.User; ui != nil {
+				buf.WriteString(unescapeUserinfo(ui.String()))
+				buf.WriteByte('@')
+			}
+			if h := u.Host; h != "" {
+				buf.WriteString(h)
+			}
+		}
+		if u.Path != "" && u.Path[0] != '/' && u.Host != "" {
+			buf.WriteByte('/')
+		}
+		buf.WriteString(escape(u.Path, encodePath))
+	}
+	if u.RawQuery != "" {
+		buf.WriteByte('?')
+		buf.WriteString(u.RawQuery)
+	}
+	if u.Fragment != "" {
+		buf.WriteByte('#')
+		buf.WriteString(escape(u.Fragment, encodeFragment))
+	}
+	return buf.String()
+}

vendor/github.com/PuerkitoBio/urlesc/urlesc_test.go

@@ -0,0 +1,641 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package urlesc
+
+import (
+	"net/url"
+	"testing"
+)
+
+type URLTest struct {
+	in        string
+	out       *url.URL
+	roundtrip string // expected result of reserializing the URL; empty means same as "in".
+}
+
+var urltests = []URLTest{
+	// no path
+	{
+		"http://www.google.com",
+		&url.URL{
+			Scheme: "http",
+			Host:   "www.google.com",
+		},
+		"",
+	},
+	// path
+	{
+		"http://www.google.com/",
+		&url.URL{
+			Scheme: "http",
+			Host:   "www.google.com",
+			Path:   "/",
+		},
+		"",
+	},
+	// path with hex escaping
+	{
+		"http://www.google.com/file%20one%26two",
+		&url.URL{
+			Scheme: "http",
+			Host:   "www.google.com",
+			Path:   "/file one&two",
+		},
+		"http://www.google.com/file%20one&two",
+	},
+	// user
+	{
+		"ftp://webmaster@www.google.com/",
+		&url.URL{
+			Scheme: "ftp",
+			User:   url.User("webmaster"),
+			Host:   "www.google.com",
+			Path:   "/",
+		},
+		"",
+	},
+	// escape sequence in username
+	{
+		"ftp://john%20doe@www.google.com/",
+		&url.URL{
+			Scheme: "ftp",
+			User:   url.User("john doe"),
+			Host:   "www.google.com",
+			Path:   "/",
+		},
+		"ftp://john%20doe@www.google.com/",
+	},
+	// query
+	{
+		"http://www.google.com/?q=go+language",
+		&url.URL{
+			Scheme:   "http",
+			Host:     "www.google.com",
+			Path:     "/",
+			RawQuery: "q=go+language",
+		},
+		"",
+	},
+	// query with hex escaping: NOT parsed
+	{
+		"http://www.google.com/?q=go%20language",
+		&url.URL{
+			Scheme:   "http",
+			Host:     "www.google.com",
+			Path:     "/",
+			RawQuery: "q=go%20language",
+		},
+		"",
+	},
+	// %20 outside query
+	{
+		"http://www.google.com/a%20b?q=c+d",
+		&url.URL{
+			Scheme:   "http",
+			Host:     "www.google.com",
+			Path:     "/a b",
+			RawQuery: "q=c+d",
+		},
+		"",
+	},
+	// path without leading /, so no parsing
+	{
+		"http:www.google.com/?q=go+language",
+		&url.URL{
+			Scheme:   "http",
+			Opaque:   "www.google.com/",
+			RawQuery: "q=go+language",
+		},
+		"http:www.google.com/?q=go+language",
+	},
+	// path without leading /, so no parsing
+	{
+		"http:%2f%2fwww.google.com/?q=go+language",
+		&url.URL{
+			Scheme:   "http",
+			Opaque:   "%2f%2fwww.google.com/",
+			RawQuery: "q=go+language",
+		},
+		"http:%2f%2fwww.google.com/?q=go+language",
+	},
+	// non-authority with path
+	{
+		"mailto:/webmaster@golang.org",
+		&url.URL{
+			Scheme: "mailto",
+			Path:   "/webmaster@golang.org",
+		},
+		"mailto:///webmaster@golang.org", // unfortunate compromise
+	},
+	// non-authority
+	{
+		"mailto:webmaster@golang.org",
+		&url.URL{
+			Scheme: "mailto",
+			Opaque: "webmaster@golang.org",
+		},
+		"",
+	},
+	// unescaped :// in query should not create a scheme
+	{
+		"/foo?query=http://bad",
+		&url.URL{
+			Path:     "/foo",
+			RawQuery: "query=http://bad",
+		},
+		"",
+	},
+	// leading // without scheme should create an authority
+	{
+		"//foo",
+		&url.URL{
+			Host: "foo",
+		},
+		"",
+	},
+	// leading // without scheme, with userinfo, path, and query
+	{
+		"//user@foo/path?a=b",
+		&url.URL{
+			User:     url.User("user"),
+			Host:     "foo",
+			Path:     "/path",
+			RawQuery: "a=b",
+		},
+		"",
+	},
+	// Three leading slashes isn't an authority, but doesn't return an error.
+	// (We can't return an error, as this code is also used via
+	// ServeHTTP -> ReadRequest -> Parse, which is arguably a
+	// different URL parsing context, but currently shares the
+	// same codepath)
+	{
+		"///threeslashes",
+		&url.URL{
+			Path: "///threeslashes",
+		},
+		"",
+	},
+	{
+		"http://user:password@google.com",
+		&url.URL{
+			Scheme: "http",
+			User:   url.UserPassword("user", "password"),
+			Host:   "google.com",
+		},
+		"http://user:password@google.com",
+	},
+	// unescaped @ in username should not confuse host
+	{
+		"http://j@ne:password@google.com",
+		&url.URL{
+			Scheme: "http",
+			User:   url.UserPassword("j@ne", "password"),
+			Host:   "google.com",
+		},
+		"http://j%40ne:password@google.com",
+	},
+	// unescaped @ in password should not confuse host
+	{
+		"http://jane:p@ssword@google.com",
+		&url.URL{
+			Scheme: "http",
+			User:   url.UserPassword("jane", "p@ssword"),
+			Host:   "google.com",
+		},
+		"http://jane:p%40ssword@google.com",
+	},
+	{
+		"http://j@ne:password@google.com/p@th?q=@go",
+		&url.URL{
+			Scheme:   "http",
+			User:     url.UserPassword("j@ne", "password"),
+			Host:     "google.com",
+			Path:     "/p@th",
+			RawQuery: "q=@go",
+		},
+		"http://j%40ne:password@google.com/p@th?q=@go",
+	},
+	{
+		"http://www.google.com/?q=go+language#foo",
+		&url.URL{
+			Scheme:   "http",
+			Host:     "www.google.com",
+			Path:     "/",
+			RawQuery: "q=go+language",
+			Fragment: "foo",
+		},
+		"",
+	},
+	{
+		"http://www.google.com/?q=go+language#foo%26bar",
+		&url.URL{
+			Scheme:   "http",
+			Host:     "www.google.com",
+			Path:     "/",
+			RawQuery: "q=go+language",
+			Fragment: "foo&bar",
+		},
+		"http://www.google.com/?q=go+language#foo&bar",
+	},
+	{
+		"file:///home/adg/rabbits",
+		&url.URL{
+			Scheme: "file",
+			Host:   "",
+			Path:   "/home/adg/rabbits",
+		},
+		"file:///home/adg/rabbits",
+	},
+	// "Windows" paths are no exception to the rule.
+	// See golang.org/issue/6027, especially comment #9.
+	{
+		"file:///C:/FooBar/Baz.txt",
+		&url.URL{
+			Scheme: "file",
+			Host:   "",
+			Path:   "/C:/FooBar/Baz.txt",
+		},
+		"file:///C:/FooBar/Baz.txt",
+	},
+	// case-insensitive scheme
+	{
+		"MaIlTo:webmaster@golang.org",
+		&url.URL{
+			Scheme: "mailto",
+			Opaque: "webmaster@golang.org",
+		},
+		"mailto:webmaster@golang.org",
+	},
+	// Relative path
+	{
+		"a/b/c",
+		&url.URL{
+			Path: "a/b/c",
+		},
+		"a/b/c",
+	},
+	// escaped '?' in username and password
+	{
+		"http://%3Fam:pa%3Fsword@google.com",
+		&url.URL{
+			Scheme: "http",
+			User:   url.UserPassword("?am", "pa?sword"),
+			Host:   "google.com",
+		},
+		"",
+	},
+	// escaped '?' and '#' in path
+	{
+		"http://example.com/%3F%23",
+		&url.URL{
+			Scheme: "http",
+			Host:   "example.com",
+			Path:   "?#",
+		},
+		"",
+	},
+	// unescaped [ ] ! ' ( ) * in path
+	{
+		"http://example.com/[]!'()*",
+		&url.URL{
+			Scheme: "http",
+			Host:   "example.com",
+			Path:   "[]!'()*",
+		},
+		"http://example.com/[]!'()*",
+	},
+	// escaped : / ? # [ ] @ in username and password
+	{
+		"http://%3A%2F%3F:%23%5B%5D%40@example.com",
+		&url.URL{
+			Scheme: "http",
+			User:   url.UserPassword(":/?", "#[]@"),
+			Host:   "example.com",
+		},
+		"",
+	},
+	// unescaped ! $ & ' ( ) * + , ; = in username and password
+	{
+		"http://!$&'():*+,;=@example.com",
+		&url.URL{
+			Scheme: "http",
+			User:   url.UserPassword("!$&'()", "*+,;="),
+			Host:   "example.com",
+		},
+		"",
+	},
+	// unescaped = : / . ? = in query component
+	{
+		"http://example.com/?q=http://google.com/?q=",
+		&url.URL{
+			Scheme:   "http",
+			Host:     "example.com",
+			Path:     "/",
+			RawQuery: "q=http://google.com/?q=",
+		},
+		"",
+	},
+	// unescaped : / ? [ ] @ ! $ & ' ( ) * + , ; = in fragment
+	{
+		"http://example.com/#:/?%23[]@!$&'()*+,;=",
+		&url.URL{
+			Scheme:   "http",
+			Host:     "example.com",
+			Path:     "/",
+			Fragment: ":/?#[]@!$&'()*+,;=",
+		},
+		"",
+	},
+}
+
+func DoTestString(t *testing.T, parse func(string) (*url.URL, error), name string, tests []URLTest) {
+	for _, tt := range tests {
+		u, err := parse(tt.in)
+		if err != nil {
+			t.Errorf("%s(%q) returned error %s", name, tt.in, err)
+			continue
+		}
+		expected := tt.in
+		if len(tt.roundtrip) > 0 {
+			expected = tt.roundtrip
+		}
+		s := Escape(u)
+		if s != expected {
+			t.Errorf("Escape(%s(%q)) == %q (expected %q)", name, tt.in, s, expected)
+		}
+	}
+}
+
+func TestURLString(t *testing.T) {
+	DoTestString(t, url.Parse, "Parse", urltests)
+
+	// no leading slash on path should prepend
+	// slash on String() call
+	noslash := URLTest{
+		"http://www.google.com/search",
+		&url.URL{
+			Scheme: "http",
+			Host:   "www.google.com",
+			Path:   "search",
+		},
+		"",
+	}
+	s := Escape(noslash.out)
+	if s != noslash.in {
+		t.Errorf("Expected %s; go %s", noslash.in, s)
+	}
+}
+
+type EscapeTest struct {
+	in  string
+	out string
+	err error
+}
+
+var escapeTests = []EscapeTest{
+	{
+		"",
+		"",
+		nil,
+	},
+	{
+		"abc",
+		"abc",
+		nil,
+	},
+	{
+		"one two",
+		"one+two",
+		nil,
+	},
+	{
+		"10%",
+		"10%25",
+		nil,
+	},
+	{
+		" ?&=#+%!<>#\"{}|\\^[]`☺\t:/@$'()*,;",
+		"+?%26%3D%23%2B%25%21%3C%3E%23%22%7B%7D%7C%5C%5E%5B%5D%60%E2%98%BA%09%3A/%40%24%27%28%29%2A%2C%3B",
+		nil,
+	},
+}
+
+func TestEscape(t *testing.T) {
+	for _, tt := range escapeTests {
+		actual := QueryEscape(tt.in)
+		if tt.out != actual {
+			t.Errorf("QueryEscape(%q) = %q, want %q", tt.in, actual, tt.out)
+		}
+
+		// for bonus points, verify that escape:unescape is an identity.
+		roundtrip, err := url.QueryUnescape(actual)
+		if roundtrip != tt.in || err != nil {
+			t.Errorf("QueryUnescape(%q) = %q, %s; want %q, %s", actual, roundtrip, err, tt.in, "[no error]")
+		}
+	}
+}
+
+var resolveReferenceTests = []struct {
+	base, rel, expected string
+}{
+	// Absolute URL references
+	{"http://foo.com?a=b", "https://bar.com/", "https://bar.com/"},
+	{"http://foo.com/", "https://bar.com/?a=b", "https://bar.com/?a=b"},
+	{"http://foo.com/bar", "mailto:foo@example.com", "mailto:foo@example.com"},
+
+	// Path-absolute references
+	{"http://foo.com/bar", "/baz", "http://foo.com/baz"},
+	{"http://foo.com/bar?a=b#f", "/baz", "http://foo.com/baz"},
+	{"http://foo.com/bar?a=b", "/baz?c=d", "http://foo.com/baz?c=d"},
+
+	// Scheme-relative
+	{"https://foo.com/bar?a=b", "//bar.com/quux", "https://bar.com/quux"},
+
+	// Path-relative references:
+
+	// ... current directory
+	{"http://foo.com", ".", "http://foo.com/"},
+	{"http://foo.com/bar", ".", "http://foo.com/"},
+	{"http://foo.com/bar/", ".", "http://foo.com/bar/"},
+
+	// ... going down
+	{"http://foo.com", "bar", "http://foo.com/bar"},
+	{"http://foo.com/", "bar", "http://foo.com/bar"},
+	{"http://foo.com/bar/baz", "quux", "http://foo.com/bar/quux"},
+
+	// ... going up
+	{"http://foo.com/bar/baz", "../quux", "http://foo.com/quux"},
+	{"http://foo.com/bar/baz", "../../../../../quux", "http://foo.com/quux"},
+	{"http://foo.com/bar", "..", "http://foo.com/"},
+	{"http://foo.com/bar/baz", "./..", "http://foo.com/"},
+	// ".." in the middle (issue 3560)
+	{"http://foo.com/bar/baz", "quux/dotdot/../tail", "http://foo.com/bar/quux/tail"},
+	{"http://foo.com/bar/baz", "quux/./dotdot/../tail", "http://foo.com/bar/quux/tail"},
+	{"http://foo.com/bar/baz", "quux/./dotdot/.././tail", "http://foo.com/bar/quux/tail"},
+	{"http://foo.com/bar/baz", "quux/./dotdot/./../tail", "http://foo.com/bar/quux/tail"},
+	{"http://foo.com/bar/baz", "quux/./dotdot/dotdot/././../../tail", "http://foo.com/bar/quux/tail"},
+	{"http://foo.com/bar/baz", "quux/./dotdot/dotdot/./.././../tail", "http://foo.com/bar/quux/tail"},
+	{"http://foo.com/bar/baz", "quux/./dotdot/dotdot/dotdot/./../../.././././tail", "http://foo.com/bar/quux/tail"},
+	{"http://foo.com/bar/baz", "quux/./dotdot/../dotdot/../dot/./tail/..", "http://foo.com/bar/quux/dot/"},
+
+	// Remove any dot-segments prior to forming the target URI.
+	// http://tools.ietf.org/html/rfc3986#section-5.2.4
+	{"http://foo.com/dot/./dotdot/../foo/bar", "../baz", "http://foo.com/dot/baz"},
+
+	// Triple dot isn't special
+	{"http://foo.com/bar", "...", "http://foo.com/..."},
+
+	// Fragment
+	{"http://foo.com/bar", ".#frag", "http://foo.com/#frag"},
+
+	// RFC 3986: Normal Examples
+	// http://tools.ietf.org/html/rfc3986#section-5.4.1
+	{"http://a/b/c/d;p?q", "g:h", "g:h"},
+	{"http://a/b/c/d;p?q", "g", "http://a/b/c/g"},
+	{"http://a/b/c/d;p?q", "./g", "http://a/b/c/g"},
+	{"http://a/b/c/d;p?q", "g/", "http://a/b/c/g/"},
+	{"http://a/b/c/d;p?q", "/g", "http://a/g"},
+	{"http://a/b/c/d;p?q", "//g", "http://g"},
+	{"http://a/b/c/d;p?q", "?y", "http://a/b/c/d;p?y"},
+	{"http://a/b/c/d;p?q", "g?y", "http://a/b/c/g?y"},
+	{"http://a/b/c/d;p?q", "#s", "http://a/b/c/d;p?q#s"},
+	{"http://a/b/c/d;p?q", "g#s", "http://a/b/c/g#s"},
+	{"http://a/b/c/d;p?q", "g?y#s", "http://a/b/c/g?y#s"},
+	{"http://a/b/c/d;p?q", ";x", "http://a/b/c/;x"},
+	{"http://a/b/c/d;p?q", "g;x", "http://a/b/c/g;x"},
+	{"http://a/b/c/d;p?q", "g;x?y#s", "http://a/b/c/g;x?y#s"},
+	{"http://a/b/c/d;p?q", "", "http://a/b/c/d;p?q"},
+	{"http://a/b/c/d;p?q", ".", "http://a/b/c/"},
+	{"http://a/b/c/d;p?q", "./", "http://a/b/c/"},
+	{"http://a/b/c/d;p?q", "..", "http://a/b/"},
+	{"http://a/b/c/d;p?q", "../", "http://a/b/"},
+	{"http://a/b/c/d;p?q", "../g", "http://a/b/g"},
+	{"http://a/b/c/d;p?q", "../..", "http://a/"},
+	{"http://a/b/c/d;p?q", "../../", "http://a/"},
+	{"http://a/b/c/d;p?q", "../../g", "http://a/g"},
+
+	// RFC 3986: Abnormal Examples
+	// http://tools.ietf.org/html/rfc3986#section-5.4.2
+	{"http://a/b/c/d;p?q", "../../../g", "http://a/g"},
+	{"http://a/b/c/d;p?q", "../../../../g", "http://a/g"},
+	{"http://a/b/c/d;p?q", "/./g", "http://a/g"},
+	{"http://a/b/c/d;p?q", "/../g", "http://a/g"},
+	{"http://a/b/c/d;p?q", "g.", "http://a/b/c/g."},
+	{"http://a/b/c/d;p?q", ".g", "http://a/b/c/.g"},
+	{"http://a/b/c/d;p?q", "g..", "http://a/b/c/g.."},
+	{"http://a/b/c/d;p?q", "..g", "http://a/b/c/..g"},
+	{"http://a/b/c/d;p?q", "./../g", "http://a/b/g"},
+	{"http://a/b/c/d;p?q", "./g/.", "http://a/b/c/g/"},
+	{"http://a/b/c/d;p?q", "g/./h", "http://a/b/c/g/h"},
+	{"http://a/b/c/d;p?q", "g/../h", "http://a/b/c/h"},
+	{"http://a/b/c/d;p?q", "g;x=1/./y", "http://a/b/c/g;x=1/y"},
+	{"http://a/b/c/d;p?q", "g;x=1/../y", "http://a/b/c/y"},
+	{"http://a/b/c/d;p?q", "g?y/./x", "http://a/b/c/g?y/./x"},
+	{"http://a/b/c/d;p?q", "g?y/../x", "http://a/b/c/g?y/../x"},
+	{"http://a/b/c/d;p?q", "g#s/./x", "http://a/b/c/g#s/./x"},
+	{"http://a/b/c/d;p?q", "g#s/../x", "http://a/b/c/g#s/../x"},
+
+	// Extras.
+	{"https://a/b/c/d;p?q", "//g?q", "https://g?q"},
+	{"https://a/b/c/d;p?q", "//g#s", "https://g#s"},
+	{"https://a/b/c/d;p?q", "//g/d/e/f?y#s", "https://g/d/e/f?y#s"},
+	{"https://a/b/c/d;p#s", "?y", "https://a/b/c/d;p?y"},
+	{"https://a/b/c/d;p?q#s", "?y", "https://a/b/c/d;p?y"},
+}
+
+func TestResolveReference(t *testing.T) {
+	mustParse := func(url_ string) *url.URL {
+		u, err := url.Parse(url_)
+		if err != nil {
+			t.Fatalf("Expected URL to parse: %q, got error: %v", url_, err)
+		}
+		return u
+	}
+	opaque := &url.URL{Scheme: "scheme", Opaque: "opaque"}
+	for _, test := range resolveReferenceTests {
+		base := mustParse(test.base)
+		rel := mustParse(test.rel)
+		url := base.ResolveReference(rel)
+		if Escape(url) != test.expected {
+			t.Errorf("URL(%q).ResolveReference(%q) == %q, got %q", test.base, test.rel, test.expected, Escape(url))
+		}
+		// Ensure that new instances are returned.
+		if base == url {
+			t.Errorf("Expected URL.ResolveReference to return new URL instance.")
+		}
+		// Test the convenience wrapper too.
+		url, err := base.Parse(test.rel)
+		if err != nil {
+			t.Errorf("URL(%q).Parse(%q) failed: %v", test.base, test.rel, err)
+		} else if Escape(url) != test.expected {
+			t.Errorf("URL(%q).Parse(%q) == %q, got %q", test.base, test.rel, test.expected, Escape(url))
+		} else if base == url {
+			// Ensure that new instances are returned for the wrapper too.
+			t.Errorf("Expected URL.Parse to return new URL instance.")
+		}
+		// Ensure Opaque resets the URL.
+		url = base.ResolveReference(opaque)
+		if *url != *opaque {
+			t.Errorf("ResolveReference failed to resolve opaque URL: want %#v, got %#v", url, opaque)
+		}
+		// Test the convenience wrapper with an opaque URL too.
+		url, err = base.Parse("scheme:opaque")
+		if err != nil {
+			t.Errorf(`URL(%q).Parse("scheme:opaque") failed: %v`, test.base, err)
+		} else if *url != *opaque {
+			t.Errorf("Parse failed to resolve opaque URL: want %#v, got %#v", url, opaque)
+		} else if base == url {
+			// Ensure that new instances are returned, again.
+			t.Errorf("Expected URL.Parse to return new URL instance.")
+		}
+	}
+}
+
+type shouldEscapeTest struct {
+	in     byte
+	mode   encoding
+	escape bool
+}
+
+var shouldEscapeTests = []shouldEscapeTest{
+	// Unreserved characters (§2.3)
+	{'a', encodePath, false},
+	{'a', encodeUserPassword, false},
+	{'a', encodeQueryComponent, false},
+	{'a', encodeFragment, false},
+	{'z', encodePath, false},
+	{'A', encodePath, false},
+	{'Z', encodePath, false},
+	{'0', encodePath, false},
+	{'9', encodePath, false},
+	{'-', encodePath, false},
+	{'-', encodeUserPassword, false},
+	{'-', encodeQueryComponent, false},
+	{'-', encodeFragment, false},
+	{'.', encodePath, false},
+	{'_', encodePath, false},
+	{'~', encodePath, false},
+
+	// User information (§3.2.1)
+	{':', encodeUserPassword, true},
+	{'/', encodeUserPassword, true},
+	{'?', encodeUserPassword, true},
+	{'@', encodeUserPassword, true},
+	{'$', encodeUserPassword, false},
+	{'&', encodeUserPassword, false},
+	{'+', encodeUserPassword, false},
+	{',', encodeUserPassword, false},
+	{';', encodeUserPassword, false},
+	{'=', encodeUserPassword, false},
+}
+
+func TestShouldEscape(t *testing.T) {
+	for _, tt := range shouldEscapeTests {
+		if shouldEscape(tt.in, tt.mode) != tt.escape {
+			t.Errorf("shouldEscape(%q, %v) returned %v; expected %v", tt.in, tt.mode, !tt.escape, tt.escape)
+		}
+	}
+}

vendor/github.com/Sirupsen/logrus/.gitignore

@@ -0,0 +1 @@
+logrus

vendor/github.com/Sirupsen/logrus/.travis.yml

@@ -0,0 +1,8 @@
+language: go
+go:
+  - 1.6
+  - 1.7
+  - tip
+install:
+  - go get -t ./...
+script: GOMAXPROCS=4 GORACE="halt_on_error=1" go test -race -v ./...

vendor/github.com/Sirupsen/logrus/CHANGELOG.md

@@ -0,0 +1,94 @@
+# 0.11.5
+
+* feature: add writer and writerlevel to entry (#372)
+
+# 0.11.4
+
+* bug: fix undefined variable on solaris (#493)
+
+# 0.11.3
+
+* formatter: configure quoting of empty values (#484)
+* formatter: configure quoting character (default is `"`) (#484)
+* bug: fix not importing io correctly in non-linux environments (#481)
+
+# 0.11.2
+
+* bug: fix windows terminal detection (#476)
+
+# 0.11.1
+
+* bug: fix tty detection with custom out (#471)
+
+# 0.11.0
+
+* performance: Use bufferpool to allocate (#370)
+* terminal: terminal detection for app-engine (#343)
+* feature: exit handler (#375)
+
+# 0.10.0
+
+* feature: Add a test hook (#180)
+* feature: `ParseLevel` is now case-insensitive (#326)
+* feature: `FieldLogger` interface that generalizes `Logger` and `Entry` (#308)
+* performance: avoid re-allocations on `WithFields` (#335)
+
+# 0.9.0
+
+* logrus/text_formatter: don't emit empty msg
+* logrus/hooks/airbrake: move out of main repository
+* logrus/hooks/sentry: move out of main repository
+* logrus/hooks/papertrail: move out of main repository
+* logrus/hooks/bugsnag: move out of main repository
+* logrus/core: run tests with `-race`
+* logrus/core: detect TTY based on `stderr`
+* logrus/core: support `WithError` on logger
+* logrus/core: Solaris support
+
+# 0.8.7
+
+* logrus/core: fix possible race (#216)
+* logrus/doc: small typo fixes and doc improvements
+
+
+# 0.8.6
+
+* hooks/raven: allow passing an initialized client
+
+# 0.8.5
+
+* logrus/core: revert #208
+
+# 0.8.4
+
+* formatter/text: fix data race (#218)
+
+# 0.8.3
+
+* logrus/core: fix entry log level (#208)
+* logrus/core: improve performance of text formatter by 40%
+* logrus/core: expose `LevelHooks` type
+* logrus/core: add support for DragonflyBSD and NetBSD
+* formatter/text: print structs more verbosely
+
+# 0.8.2
+
+* logrus: fix more Fatal family functions
+
+# 0.8.1
+
+* logrus: fix not exiting on `Fatalf` and `Fatalln`
+
+# 0.8.0
+
+* logrus: defaults to stderr instead of stdout
+* hooks/sentry: add special field for `*http.Request`
+* formatter/text: ignore Windows for colors
+
+# 0.7.3
+
+* formatter/\*: allow configuration of timestamp layout
+
+# 0.7.2
+
+* formatter/text: Add configuration option for time format (#158)

vendor/github.com/Sirupsen/logrus/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Simon Eskildsen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

vendor/github.com/Sirupsen/logrus/README.md

@@ -0,0 +1,479 @@
+# Logrus <img src="http://i.imgur.com/hTeVwmJ.png" width="40" height="40" alt=":walrus:" class="emoji" title=":walrus:"/>&nbsp;[![Build Status](https://travis-ci.org/Sirupsen/logrus.svg?branch=master)](https://travis-ci.org/Sirupsen/logrus)&nbsp;[![GoDoc](https://godoc.org/github.com/Sirupsen/logrus?status.svg)](https://godoc.org/github.com/Sirupsen/logrus)
+
+**Seeing weird case-sensitive problems?** See [this
+issue](https://github.com/sirupsen/logrus/issues/451#issuecomment-264332021).
+This change has been reverted. I apologize for causing this. I greatly
+underestimated the impact this would have. Logrus strives for stability and
+backwards compatibility and failed to provide that.
+
+Logrus is a structured logger for Go (golang), completely API compatible with
+the standard library logger. [Godoc][godoc]. **Please note the Logrus API is not
+yet stable (pre 1.0). Logrus itself is completely stable and has been used in
+many large deployments. The core API is unlikely to change much but please
+version control your Logrus to make sure you aren't fetching latest `master` on
+every build.**
+
+Nicely color-coded in development (when a TTY is attached, otherwise just
+plain text):
+
+![Colored](http://i.imgur.com/PY7qMwd.png)
+
+With `log.SetFormatter(&log.JSONFormatter{})`, for easy parsing by logstash
+or Splunk:
+
+```json
+{"animal":"walrus","level":"info","msg":"A group of walrus emerges from the
+ocean","size":10,"time":"2014-03-10 19:57:38.562264131 -0400 EDT"}
+
+{"level":"warning","msg":"The group's number increased tremendously!",
+"number":122,"omg":true,"time":"2014-03-10 19:57:38.562471297 -0400 EDT"}
+
+{"animal":"walrus","level":"info","msg":"A giant walrus appears!",
+"size":10,"time":"2014-03-10 19:57:38.562500591 -0400 EDT"}
+
+{"animal":"walrus","level":"info","msg":"Tremendously sized cow enters the ocean.",
+"size":9,"time":"2014-03-10 19:57:38.562527896 -0400 EDT"}
+
+{"level":"fatal","msg":"The ice breaks!","number":100,"omg":true,
+"time":"2014-03-10 19:57:38.562543128 -0400 EDT"}
+```
+
+With the default `log.SetFormatter(&log.TextFormatter{})` when a TTY is not
+attached, the output is compatible with the
+[logfmt](http://godoc.org/github.com/kr/logfmt) format:
+
+```text
+time="2015-03-26T01:27:38-04:00" level=debug msg="Started observing beach" animal=walrus number=8
+time="2015-03-26T01:27:38-04:00" level=info msg="A group of walrus emerges from the ocean" animal=walrus size=10
+time="2015-03-26T01:27:38-04:00" level=warning msg="The group's number increased tremendously!" number=122 omg=true
+time="2015-03-26T01:27:38-04:00" level=debug msg="Temperature changes" temperature=-4
+time="2015-03-26T01:27:38-04:00" level=panic msg="It's over 9000!" animal=orca size=9009
+time="2015-03-26T01:27:38-04:00" level=fatal msg="The ice breaks!" err=&{0x2082280c0 map[animal:orca size:9009] 2015-03-26 01:27:38.441574009 -0400 EDT panic It's over 9000!} number=100 omg=true
+exit status 1
+```
+
+#### Example
+
+The simplest way to use Logrus is simply the package-level exported logger:
+
+```go
+package main
+
+import (
+  log "github.com/Sirupsen/logrus"
+)
+
+func main() {
+  log.WithFields(log.Fields{
+    "animal": "walrus",
+  }).Info("A walrus appears")
+}
+```
+
+Note that it's completely api-compatible with the stdlib logger, so you can
+replace your `log` imports everywhere with `log "github.com/Sirupsen/logrus"`
+and you'll now have the flexibility of Logrus. You can customize it all you
+want:
+
+```go
+package main
+
+import (
+  "os"
+  log "github.com/Sirupsen/logrus"
+)
+
+func init() {
+  // Log as JSON instead of the default ASCII formatter.
+  log.SetFormatter(&log.JSONFormatter{})
+
+  // Output to stdout instead of the default stderr
+  // Can be any io.Writer, see below for File example
+  log.SetOutput(os.Stdout)
+
+  // Only log the warning severity or above.
+  log.SetLevel(log.WarnLevel)
+}
+
+func main() {
+  log.WithFields(log.Fields{
+    "animal": "walrus",
+    "size":   10,
+  }).Info("A group of walrus emerges from the ocean")
+
+  log.WithFields(log.Fields{
+    "omg":    true,
+    "number": 122,
+  }).Warn("The group's number increased tremendously!")
+
+  log.WithFields(log.Fields{
+    "omg":    true,
+    "number": 100,
+  }).Fatal("The ice breaks!")
+
+  // A common pattern is to re-use fields between logging statements by re-using
+  // the logrus.Entry returned from WithFields()
+  contextLogger := log.WithFields(log.Fields{
+    "common": "this is a common field",
+    "other": "I also should be logged always",
+  })
+
+  contextLogger.Info("I'll be logged with common and other field")
+  contextLogger.Info("Me too")
+}
+```
+
+For more advanced usage such as logging to multiple locations from the same
+application, you can also create an instance of the `logrus` Logger:
+
+```go
+package main
+
+import (
+  "os"
+  "github.com/Sirupsen/logrus"
+)
+
+// Create a new instance of the logger. You can have any number of instances.
+var log = logrus.New()
+
+func main() {
+  // The API for setting attributes is a little different than the package level
+  // exported logger. See Godoc.
+  log.Out = os.Stdout
+
+  // You could set this to any `io.Writer` such as a file
+  // file, err := os.OpenFile("logrus.log", os.O_CREATE|os.O_WRONLY, 0666)
+  // if err == nil {
+  //  log.Out = file
+  // } else {
+  //  log.Info("Failed to log to file, using default stderr")
+  // }
+
+  log.WithFields(logrus.Fields{
+    "animal": "walrus",
+    "size":   10,
+  }).Info("A group of walrus emerges from the ocean")
+}
+```
+
+#### Fields
+
+Logrus encourages careful, structured logging though logging fields instead of
+long, unparseable error messages. For example, instead of: `log.Fatalf("Failed
+to send event %s to topic %s with key %d")`, you should log the much more
+discoverable:
+
+```go
+log.WithFields(log.Fields{
+  "event": event,
+  "topic": topic,
+  "key": key,
+}).Fatal("Failed to send event")
+```
+
+We've found this API forces you to think about logging in a way that produces
+much more useful logging messages. We've been in countless situations where just
+a single added field to a log statement that was already there would've saved us
+hours. The `WithFields` call is optional.
+
+In general, with Logrus using any of the `printf`-family functions should be
+seen as a hint you should add a field, however, you can still use the
+`printf`-family functions with Logrus.
+
+#### Default Fields
+
+Often it's helpful to have fields _always_ attached to log statements in an
+application or parts of one. For example, you may want to always log the
+`request_id` and `user_ip` in the context of a request. Instead of writing
+`log.WithFields(log.Fields{"request_id": request_id, "user_ip": user_ip})` on
+every line, you can create a `logrus.Entry` to pass around instead:
+
+```go
+requestLogger := log.WithFields(log.Fields{"request_id": request_id, "user_ip": user_ip})
+requestLogger.Info("something happened on that request") # will log request_id and user_ip
+requestLogger.Warn("something not great happened")
+```
+
+#### Hooks
+
+You can add hooks for logging levels. For example to send errors to an exception
+tracking service on `Error`, `Fatal` and `Panic`, info to StatsD or log to
+multiple places simultaneously, e.g. syslog.
+
+Logrus comes with [built-in hooks](hooks/). Add those, or your custom hook, in
+`init`:
+
+```go
+import (
+  log "github.com/Sirupsen/logrus"
+  "gopkg.in/gemnasium/logrus-airbrake-hook.v2" // the package is named "aibrake"
+  logrus_syslog "github.com/Sirupsen/logrus/hooks/syslog"
+  "log/syslog"
+)
+
+func init() {
+
+  // Use the Airbrake hook to report errors that have Error severity or above to
+  // an exception tracker. You can create custom hooks, see the Hooks section.
+  log.AddHook(airbrake.NewHook(123, "xyz", "production"))
+
+  hook, err := logrus_syslog.NewSyslogHook("udp", "localhost:514", syslog.LOG_INFO, "")
+  if err != nil {
+    log.Error("Unable to connect to local syslog daemon")
+  } else {
+    log.AddHook(hook)
+  }
+}
+```
+Note: Syslog hook also support connecting to local syslog (Ex. "/dev/log" or "/var/run/syslog" or "/var/run/log"). For the detail, please check the [syslog hook README](hooks/syslog/README.md).
+
+| Hook  | Description |
+| ----- | ----------- |
+| [Airbrake "legacy"](https://github.com/gemnasium/logrus-airbrake-legacy-hook) | Send errors to an exception tracking service compatible with the Airbrake API V2. Uses [`airbrake-go`](https://github.com/tobi/airbrake-go) behind the scenes. |
+| [Airbrake](https://github.com/gemnasium/logrus-airbrake-hook) | Send errors to the Airbrake API V3. Uses the official [`gobrake`](https://github.com/airbrake/gobrake) behind the scenes. |
+| [Amazon Kinesis](https://github.com/evalphobia/logrus_kinesis) | Hook for logging to [Amazon Kinesis](https://aws.amazon.com/kinesis/) |
+| [Amqp-Hook](https://github.com/vladoatanasov/logrus_amqp) | Hook for logging to Amqp broker (Like RabbitMQ) |
+| [Bugsnag](https://github.com/Shopify/logrus-bugsnag/blob/master/bugsnag.go) | Send errors to the Bugsnag exception tracking service. |
+| [DeferPanic](https://github.com/deferpanic/dp-logrus) | Hook for logging to DeferPanic |
+| [Discordrus](https://github.com/kz/discordrus) | Hook for logging to [Discord](https://discordapp.com/) |
+| [ElasticSearch](https://github.com/sohlich/elogrus) | Hook for logging to ElasticSearch|
+| [Firehose](https://github.com/beaubrewer/firehose) | Hook for logging to [Amazon Firehose](https://aws.amazon.com/kinesis/firehose/)
+| [Fluentd](https://github.com/evalphobia/logrus_fluent) | Hook for logging to fluentd |
+| [Go-Slack](https://github.com/multiplay/go-slack) | Hook for logging to [Slack](https://slack.com) |
+| [Graylog](https://github.com/gemnasium/logrus-graylog-hook) | Hook for logging to [Graylog](http://graylog2.org/) |
+| [Hiprus](https://github.com/nubo/hiprus) | Send errors to a channel in hipchat. |
+| [Honeybadger](https://github.com/agonzalezro/logrus_honeybadger) | Hook for sending exceptions to Honeybadger |
+| [InfluxDB](https://github.com/Abramovic/logrus_influxdb) | Hook for logging to influxdb |
+| [Influxus] (http://github.com/vlad-doru/influxus) | Hook for concurrently logging to [InfluxDB] (http://influxdata.com/) |
+| [Journalhook](https://github.com/wercker/journalhook) | Hook for logging to `systemd-journald` |
+| [KafkaLogrus](https://github.com/goibibo/KafkaLogrus) | Hook for logging to kafka |
+| [LFShook](https://github.com/rifflock/lfshook) | Hook for logging to the local filesystem |
+| [Logentries](https://github.com/jcftang/logentriesrus) | Hook for logging to [Logentries](https://logentries.com/) |
+| [Logentrus](https://github.com/puddingfactory/logentrus) | Hook for logging to [Logentries](https://logentries.com/) |
+| [Logmatic.io](https://github.com/logmatic/logmatic-go) | Hook for logging to [Logmatic.io](http://logmatic.io/) |
+| [Logrusly](https://github.com/sebest/logrusly) | Send logs to [Loggly](https://www.loggly.com/) |
+| [Logstash](https://github.com/bshuster-repo/logrus-logstash-hook) | Hook for logging to [Logstash](https://www.elastic.co/products/logstash) |
+| [Mail](https://github.com/zbindenren/logrus_mail) | Hook for sending exceptions via mail |
+| [Mongodb](https://github.com/weekface/mgorus) | Hook for logging to mongodb |
+| [NATS-Hook](https://github.com/rybit/nats_logrus_hook) | Hook for logging to [NATS](https://nats.io) |
+| [Octokit](https://github.com/dorajistyle/logrus-octokit-hook) | Hook for logging to github via octokit |
+| [Papertrail](https://github.com/polds/logrus-papertrail-hook) | Send errors to the [Papertrail](https://papertrailapp.com) hosted logging service via UDP. |
+| [PostgreSQL](https://github.com/gemnasium/logrus-postgresql-hook) | Send logs to [PostgreSQL](http://postgresql.org) |
+| [Pushover](https://github.com/toorop/logrus_pushover) | Send error via [Pushover](https://pushover.net) |
+| [Raygun](https://github.com/squirkle/logrus-raygun-hook) | Hook for logging to [Raygun.io](http://raygun.io/) |
+| [Redis-Hook](https://github.com/rogierlommers/logrus-redis-hook) | Hook for logging to a ELK stack (through Redis) |
+| [Rollrus](https://github.com/heroku/rollrus) | Hook for sending errors to rollbar |
+| [Scribe](https://github.com/sagar8192/logrus-scribe-hook) | Hook for logging to [Scribe](https://github.com/facebookarchive/scribe)|
+| [Sentry](https://github.com/evalphobia/logrus_sentry) | Send errors to the Sentry error logging and aggregation service. |
+| [Slackrus](https://github.com/johntdyer/slackrus) | Hook for Slack chat. |
+| [Stackdriver](https://github.com/knq/sdhook) | Hook for logging to [Google Stackdriver](https://cloud.google.com/logging/) |
+| [Sumorus](https://github.com/doublefree/sumorus) | Hook for logging to [SumoLogic](https://www.sumologic.com/)|
+| [Syslog](https://github.com/Sirupsen/logrus/blob/master/hooks/syslog/syslog.go) | Send errors to remote syslog server. Uses standard library `log/syslog` behind the scenes. |
+| [TraceView](https://github.com/evalphobia/logrus_appneta) | Hook for logging to [AppNeta TraceView](https://www.appneta.com/products/traceview/) |
+| [Typetalk](https://github.com/dragon3/logrus-typetalk-hook) | Hook for logging to [Typetalk](https://www.typetalk.in/) |
+| [logz.io](https://github.com/ripcurld00d/logrus-logzio-hook) | Hook for logging to [logz.io](https://logz.io), a Log as a Service using Logstash |
+
+#### Level logging
+
+Logrus has six logging levels: Debug, Info, Warning, Error, Fatal and Panic.
+
+```go
+log.Debug("Useful debugging information.")
+log.Info("Something noteworthy happened!")
+log.Warn("You should probably take a look at this.")
+log.Error("Something failed but I'm not quitting.")
+// Calls os.Exit(1) after logging
+log.Fatal("Bye.")
+// Calls panic() after logging
+log.Panic("I'm bailing.")
+```
+
+You can set the logging level on a `Logger`, then it will only log entries with
+that severity or anything above it:
+
+```go
+// Will log anything that is info or above (warn, error, fatal, panic). Default.
+log.SetLevel(log.InfoLevel)
+```
+
+It may be useful to set `log.Level = logrus.DebugLevel` in a debug or verbose
+environment if your application has that.
+
+#### Entries
+
+Besides the fields added with `WithField` or `WithFields` some fields are
+automatically added to all logging events:
+
+1. `time`. The timestamp when the entry was created.
+2. `msg`. The logging message passed to `{Info,Warn,Error,Fatal,Panic}` after
+   the `AddFields` call. E.g. `Failed to send event.`
+3. `level`. The logging level. E.g. `info`.
+
+#### Environments
+
+Logrus has no notion of environment.
+
+If you wish for hooks and formatters to only be used in specific environments,
+you should handle that yourself. For example, if your application has a global
+variable `Environment`, which is a string representation of the environment you
+could do:
+
+```go
+import (
+  log "github.com/Sirupsen/logrus"
+)
+
+init() {
+  // do something here to set environment depending on an environment variable
+  // or command-line flag
+  if Environment == "production" {
+    log.SetFormatter(&log.JSONFormatter{})
+  } else {
+    // The TextFormatter is default, you don't actually have to do this.
+    log.SetFormatter(&log.TextFormatter{})
+  }
+}
+```
+
+This configuration is how `logrus` was intended to be used, but JSON in
+production is mostly only useful if you do log aggregation with tools like
+Splunk or Logstash.
+
+#### Formatters
+
+The built-in logging formatters are:
+
+* `logrus.TextFormatter`. Logs the event in colors if stdout is a tty, otherwise
+  without colors.
+  * *Note:* to force colored output when there is no TTY, set the `ForceColors`
+    field to `true`.  To force no colored output even if there is a TTY  set the
+    `DisableColors` field to `true`. For Windows, see
+    [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable).
+  * All options are listed in the [generated docs](https://godoc.org/github.com/sirupsen/logrus#TextFormatter).
+* `logrus.JSONFormatter`. Logs fields as JSON.
+  * All options are listed in the [generated docs](https://godoc.org/github.com/sirupsen/logrus#JSONFormatter).
+
+Third party logging formatters:
+
+* [`logstash`](https://github.com/bshuster-repo/logrus-logstash-hook). Logs fields as [Logstash](http://logstash.net) Events.
+* [`prefixed`](https://github.com/x-cray/logrus-prefixed-formatter). Displays log entry source along with alternative layout.
+* [`zalgo`](https://github.com/aybabtme/logzalgo). Invoking the P͉̫o̳̼̊w̖͈̰͎e̬͔̭͂r͚̼̹̲ ̫͓͉̳͈ō̠͕͖̚f̝͍̠ ͕̲̞͖͑Z̖̫̤̫ͪa͉̬͈̗l͖͎g̳̥o̰̥̅!̣͔̲̻͊̄ ̙̘̦̹̦.
+
+You can define your formatter by implementing the `Formatter` interface,
+requiring a `Format` method. `Format` takes an `*Entry`. `entry.Data` is a
+`Fields` type (`map[string]interface{}`) with all your fields as well as the
+default ones (see Entries section above):
+
+```go
+type MyJSONFormatter struct {
+}
+
+log.SetFormatter(new(MyJSONFormatter))
+
+func (f *MyJSONFormatter) Format(entry *Entry) ([]byte, error) {
+  // Note this doesn't include Time, Level and Message which are available on
+  // the Entry. Consult `godoc` on information about those fields or read the
+  // source of the official loggers.
+  serialized, err := json.Marshal(entry.Data)
+    if err != nil {
+      return nil, fmt.Errorf("Failed to marshal fields to JSON, %v", err)
+    }
+  return append(serialized, '\n'), nil
+}
+```
+
+#### Logger as an `io.Writer`
+
+Logrus can be transformed into an `io.Writer`. That writer is the end of an `io.Pipe` and it is your responsibility to close it.
+
+```go
+w := logger.Writer()
+defer w.Close()
+
+srv := http.Server{
+    // create a stdlib log.Logger that writes to
+    // logrus.Logger.
+    ErrorLog: log.New(w, "", 0),
+}
+```
+
+Each line written to that writer will be printed the usual way, using formatters
+and hooks. The level for those entries is `info`.
+
+This means that we can override the standard library logger easily:
+
+```go
+logger := logrus.New()
+logger.Formatter = &logrus.JSONFormatter{}
+
+// Use logrus for standard log output
+// Note that `log` here references stdlib's log
+// Not logrus imported under the name `log`.
+log.SetOutput(logger.Writer())
+```
+
+#### Rotation
+
+Log rotation is not provided with Logrus. Log rotation should be done by an
+external program (like `logrotate(8)`) that can compress and delete old log
+entries. It should not be a feature of the application-level logger.
+
+#### Tools
+
+| Tool | Description |
+| ---- | ----------- |
+|[Logrus Mate](https://github.com/gogap/logrus_mate)|Logrus mate is a tool for Logrus to manage loggers, you can initial logger's level, hook and formatter by config file, the logger will generated with different config at different environment.|
+|[Logrus Viper Helper](https://github.com/heirko/go-contrib/tree/master/logrusHelper)|An Helper around Logrus to wrap with spf13/Viper to load configuration with fangs! And to simplify Logrus configuration use some behavior of [Logrus Mate](https://github.com/gogap/logrus_mate). [sample](https://github.com/heirko/iris-contrib/blob/master/middleware/logrus-logger/example) |
+
+#### Testing
+
+Logrus has a built in facility for asserting the presence of log messages. This is implemented through the `test` hook and provides:
+
+* decorators for existing logger (`test.NewLocal` and `test.NewGlobal`) which basically just add the `test` hook
+* a test logger (`test.NewNullLogger`) that just records log messages (and does not output any):
+
+```go
+logger, hook := NewNullLogger()
+logger.Error("Hello error")
+
+assert.Equal(1, len(hook.Entries))
+assert.Equal(logrus.ErrorLevel, hook.LastEntry().Level)
+assert.Equal("Hello error", hook.LastEntry().Message)
+
+hook.Reset()
+assert.Nil(hook.LastEntry())
+```
+
+#### Fatal handlers
+
+Logrus can register one or more functions that will be called when any `fatal`
+level message is logged. The registered handlers will be executed before
+logrus performs a `os.Exit(1)`. This behavior may be helpful if callers need
+to gracefully shutdown. Unlike a `panic("Something went wrong...")` call which can be intercepted with a deferred `recover` a call to `os.Exit(1)` can not be intercepted.
+
+```
+...
+handler := func() {
+  // gracefully shutdown something...
+}
+logrus.RegisterExitHandler(handler)
+...
+```
+
+#### Thread safety
+
+By default Logger is protected by mutex for concurrent writes, this mutex is invoked when calling hooks and writing logs.
+If you are sure such locking is not needed, you can call logger.SetNoLock() to disable the locking.
+
+Situation when locking is not needed includes:
+
+* You have no hooks registered, or hooks calling is already thread-safe.
+
+* Writing to logger.Out is already thread-safe, for example:
+
+  1) logger.Out is protected by locks.
+
+  2) logger.Out is a os.File handler opened with `O_APPEND` flag, and every write is smaller than 4k. (This allow multi-thread/multi-process writing)
+
+     (Refer to http://www.notthewizard.com/2014/06/17/are-files-appends-really-atomic/)

vendor/github.com/Sirupsen/logrus/alt_exit.go

@@ -0,0 +1,64 @@
+package logrus
+
+// The following code was sourced and modified from the
+// https://github.com/tebeka/atexit package governed by the following license:
+//
+// Copyright (c) 2012 Miki Tebeka <miki.tebeka@gmail.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+// the Software, and to permit persons to whom the Software is furnished to do so,
+// subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+import (
+	"fmt"
+	"os"
+)
+
+var handlers = []func(){}
+
+func runHandler(handler func()) {
+	defer func() {
+		if err := recover(); err != nil {
+			fmt.Fprintln(os.Stderr, "Error: Logrus exit handler error:", err)
+		}
+	}()
+
+	handler()
+}
+
+func runHandlers() {
+	for _, handler := range handlers {
+		runHandler(handler)
+	}
+}
+
+// Exit runs all the Logrus atexit handlers and then terminates the program using os.Exit(code)
+func Exit(code int) {
+	runHandlers()
+	os.Exit(code)
+}
+
+// RegisterExitHandler adds a Logrus Exit handler, call logrus.Exit to invoke
+// all handlers. The handlers will also be invoked when any Fatal log entry is
+// made.
+//
+// This method is useful when a caller wishes to use logrus to log a fatal
+// message but also needs to gracefully shutdown. An example usecase could be
+// closing database connections, or sending a alert that the application is
+// closing.
+func RegisterExitHandler(handler func()) {
+	handlers = append(handlers, handler)
+}

vendor/github.com/Sirupsen/logrus/alt_exit_test.go

@@ -0,0 +1,74 @@
+package logrus
+
+import (
+	"io/ioutil"
+	"os/exec"
+	"testing"
+	"time"
+)
+
+func TestRegister(t *testing.T) {
+	current := len(handlers)
+	RegisterExitHandler(func() {})
+	if len(handlers) != current+1 {
+		t.Fatalf("can't add handler")
+	}
+}
+
+func TestHandler(t *testing.T) {
+	gofile := "/tmp/testprog.go"
+	if err := ioutil.WriteFile(gofile, testprog, 0666); err != nil {
+		t.Fatalf("can't create go file")
+	}
+
+	outfile := "/tmp/testprog.out"
+	arg := time.Now().UTC().String()
+	err := exec.Command("go", "run", gofile, outfile, arg).Run()
+	if err == nil {
+		t.Fatalf("completed normally, should have failed")
+	}
+
+	data, err := ioutil.ReadFile(outfile)
+	if err != nil {
+		t.Fatalf("can't read output file %s", outfile)
+	}
+
+	if string(data) != arg {
+		t.Fatalf("bad data")
+	}
+}
+
+var testprog = []byte(`
+// Test program for atexit, gets output file and data as arguments and writes
+// data to output file in atexit handler.
+package main
+
+import (
+	"github.com/Sirupsen/logrus"
+	"flag"
+	"fmt"
+	"io/ioutil"
+)
+
+var outfile = ""
+var data = ""
+
+func handler() {
+	ioutil.WriteFile(outfile, []byte(data), 0666)
+}
+
+func badHandler() {
+	n := 0
+	fmt.Println(1/n)
+}
+
+func main() {
+	flag.Parse()
+	outfile = flag.Arg(0)
+	data = flag.Arg(1)
+
+	logrus.RegisterExitHandler(handler)
+	logrus.RegisterExitHandler(badHandler)
+	logrus.Fatal("Bye bye")
+}
+`)

vendor/github.com/Sirupsen/logrus/doc.go

@@ -0,0 +1,26 @@
+/*
+Package logrus is a structured logger for Go, completely API compatible with the standard library logger.
+
+
+The simplest way to use Logrus is simply the package-level exported logger:
+
+  package main
+
+  import (
+    log "github.com/Sirupsen/logrus"
+  )
+
+  func main() {
+    log.WithFields(log.Fields{
+      "animal": "walrus",
+      "number": 1,
+      "size":   10,
+    }).Info("A walrus appears")
+  }
+
+Output:
+  time="2015-09-07T08:48:33Z" level=info msg="A walrus appears" animal=walrus number=1 size=10
+
+For a full guide visit https://github.com/Sirupsen/logrus
+*/
+package logrus

vendor/github.com/Sirupsen/logrus/entry.go

@@ -0,0 +1,275 @@
+package logrus
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"sync"
+	"time"
+)
+
+var bufferPool *sync.Pool
+
+func init() {
+	bufferPool = &sync.Pool{
+		New: func() interface{} {
+			return new(bytes.Buffer)
+		},
+	}
+}
+
+// Defines the key when adding errors using WithError.
+var ErrorKey = "error"
+
+// An entry is the final or intermediate Logrus logging entry. It contains all
+// the fields passed with WithField{,s}. It's finally logged when Debug, Info,
+// Warn, Error, Fatal or Panic is called on it. These objects can be reused and
+// passed around as much as you wish to avoid field duplication.
+type Entry struct {
+	Logger *Logger
+
+	// Contains all the fields set by the user.
+	Data Fields
+
+	// Time at which the log entry was created
+	Time time.Time
+
+	// Level the log entry was logged at: Debug, Info, Warn, Error, Fatal or Panic
+	Level Level
+
+	// Message passed to Debug, Info, Warn, Error, Fatal or Panic
+	Message string
+
+	// When formatter is called in entry.log(), an Buffer may be set to entry
+	Buffer *bytes.Buffer
+}
+
+func NewEntry(logger *Logger) *Entry {
+	return &Entry{
+		Logger: logger,
+		// Default is three fields, give a little extra room
+		Data: make(Fields, 5),
+	}
+}
+
+// Returns the string representation from the reader and ultimately the
+// formatter.
+func (entry *Entry) String() (string, error) {
+	serialized, err := entry.Logger.Formatter.Format(entry)
+	if err != nil {
+		return "", err
+	}
+	str := string(serialized)
+	return str, nil
+}
+
+// Add an error as single field (using the key defined in ErrorKey) to the Entry.
+func (entry *Entry) WithError(err error) *Entry {
+	return entry.WithField(ErrorKey, err)
+}
+
+// Add a single field to the Entry.
+func (entry *Entry) WithField(key string, value interface{}) *Entry {
+	return entry.WithFields(Fields{key: value})
+}
+
+// Add a map of fields to the Entry.
+func (entry *Entry) WithFields(fields Fields) *Entry {
+	data := make(Fields, len(entry.Data)+len(fields))
+	for k, v := range entry.Data {
+		data[k] = v
+	}
+	for k, v := range fields {
+		data[k] = v
+	}
+	return &Entry{Logger: entry.Logger, Data: data}
+}
+
+// This function is not declared with a pointer value because otherwise
+// race conditions will occur when using multiple goroutines
+func (entry Entry) log(level Level, msg string) {
+	var buffer *bytes.Buffer
+	entry.Time = time.Now()
+	entry.Level = level
+	entry.Message = msg
+
+	if err := entry.Logger.Hooks.Fire(level, &entry); err != nil {
+		entry.Logger.mu.Lock()
+		fmt.Fprintf(os.Stderr, "Failed to fire hook: %v\n", err)
+		entry.Logger.mu.Unlock()
+	}
+	buffer = bufferPool.Get().(*bytes.Buffer)
+	buffer.Reset()
+	defer bufferPool.Put(buffer)
+	entry.Buffer = buffer
+	serialized, err := entry.Logger.Formatter.Format(&entry)
+	entry.Buffer = nil
+	if err != nil {
+		entry.Logger.mu.Lock()
+		fmt.Fprintf(os.Stderr, "Failed to obtain reader, %v\n", err)
+		entry.Logger.mu.Unlock()
+	} else {
+		entry.Logger.mu.Lock()
+		_, err = entry.Logger.Out.Write(serialized)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Failed to write to log, %v\n", err)
+		}
+		entry.Logger.mu.Unlock()
+	}
+
+	// To avoid Entry#log() returning a value that only would make sense for
+	// panic() to use in Entry#Panic(), we avoid the allocation by checking
+	// directly here.
+	if level <= PanicLevel {
+		panic(&entry)
+	}
+}
+
+func (entry *Entry) Debug(args ...interface{}) {
+	if entry.Logger.Level >= DebugLevel {
+		entry.log(DebugLevel, fmt.Sprint(args...))
+	}
+}
+
+func (entry *Entry) Print(args ...interface{}) {
+	entry.Info(args...)
+}
+
+func (entry *Entry) Info(args ...interface{}) {
+	if entry.Logger.Level >= InfoLevel {
+		entry.log(InfoLevel, fmt.Sprint(args...))
+	}
+}
+
+func (entry *Entry) Warn(args ...interface{}) {
+	if entry.Logger.Level >= WarnLevel {
+		entry.log(WarnLevel, fmt.Sprint(args...))
+	}
+}
+
+func (entry *Entry) Warning(args ...interface{}) {
+	entry.Warn(args...)
+}
+
+func (entry *Entry) Error(args ...interface{}) {
+	if entry.Logger.Level >= ErrorLevel {
+		entry.log(ErrorLevel, fmt.Sprint(args...))
+	}
+}
+
+func (entry *Entry) Fatal(args ...interface{}) {
+	if entry.Logger.Level >= FatalLevel {
+		entry.log(FatalLevel, fmt.Sprint(args...))
+	}
+	Exit(1)
+}
+
+func (entry *Entry) Panic(args ...interface{}) {
+	if entry.Logger.Level >= PanicLevel {
+		entry.log(PanicLevel, fmt.Sprint(args...))
+	}
+	panic(fmt.Sprint(args...))
+}
+
+// Entry Printf family functions
+
+func (entry *Entry) Debugf(format string, args ...interface{}) {
+	if entry.Logger.Level >= DebugLevel {
+		entry.Debug(fmt.Sprintf(format, args...))
+	}
+}
+
+func (entry *Entry) Infof(format string, args ...interface{}) {
+	if entry.Logger.Level >= InfoLevel {
+		entry.Info(fmt.Sprintf(format, args...))
+	}
+}
+
+func (entry *Entry) Printf(format string, args ...interface{}) {
+	entry.Infof(format, args...)
+}
+
+func (entry *Entry) Warnf(format string, args ...interface{}) {
+	if entry.Logger.Level >= WarnLevel {
+		entry.Warn(fmt.Sprintf(format, args...))
+	}
+}
+
+func (entry *Entry) Warningf(format string, args ...interface{}) {
+	entry.Warnf(format, args...)
+}
+
+func (entry *Entry) Errorf(format string, args ...interface{}) {
+	if entry.Logger.Level >= ErrorLevel {
+		entry.Error(fmt.Sprintf(format, args...))
+	}
+}
+
+func (entry *Entry) Fatalf(format string, args ...interface{}) {
+	if entry.Logger.Level >= FatalLevel {
+		entry.Fatal(fmt.Sprintf(format, args...))
+	}
+	Exit(1)
+}
+
+func (entry *Entry) Panicf(format string, args ...interface{}) {
+	if entry.Logger.Level >= PanicLevel {
+		entry.Panic(fmt.Sprintf(format, args...))
+	}
+}
+
+// Entry Println family functions
+
+func (entry *Entry) Debugln(args ...interface{}) {
+	if entry.Logger.Level >= DebugLevel {
+		entry.Debug(entry.sprintlnn(args...))
+	}
+}
+
+func (entry *Entry) Infoln(args ...interface{}) {
+	if entry.Logger.Level >= InfoLevel {
+		entry.Info(entry.sprintlnn(args...))
+	}
+}
+
+func (entry *Entry) Println(args ...interface{}) {
+	entry.Infoln(args...)
+}
+
+func (entry *Entry) Warnln(args ...interface{}) {
+	if entry.Logger.Level >= WarnLevel {
+		entry.Warn(entry.sprintlnn(args...))
+	}
+}
+
+func (entry *Entry) Warningln(args ...interface{}) {
+	entry.Warnln(args...)
+}
+
+func (entry *Entry) Errorln(args ...interface{}) {
+	if entry.Logger.Level >= ErrorLevel {
+		entry.Error(entry.sprintlnn(args...))
+	}
+}
+
+func (entry *Entry) Fatalln(args ...interface{}) {
+	if entry.Logger.Level >= FatalLevel {
+		entry.Fatal(entry.sprintlnn(args...))
+	}
+	Exit(1)
+}
+
+func (entry *Entry) Panicln(args ...interface{}) {
+	if entry.Logger.Level >= PanicLevel {
+		entry.Panic(entry.sprintlnn(args...))
+	}
+}
+
+// Sprintlnn => Sprint no newline. This is to get the behavior of how
+// fmt.Sprintln where spaces are always added between operands, regardless of
+// their type. Instead of vendoring the Sprintln implementation to spare a
+// string allocation, we do the simplest thing.
+func (entry *Entry) sprintlnn(args ...interface{}) string {
+	msg := fmt.Sprintln(args...)
+	return msg[:len(msg)-1]
+}

vendor/github.com/Sirupsen/logrus/entry_test.go

@@ -0,0 +1,77 @@
+package logrus
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEntryWithError(t *testing.T) {
+
+	assert := assert.New(t)
+
+	defer func() {
+		ErrorKey = "error"
+	}()
+
+	err := fmt.Errorf("kaboom at layer %d", 4711)
+
+	assert.Equal(err, WithError(err).Data["error"])
+
+	logger := New()
+	logger.Out = &bytes.Buffer{}
+	entry := NewEntry(logger)
+
+	assert.Equal(err, entry.WithError(err).Data["error"])
+
+	ErrorKey = "err"
+
+	assert.Equal(err, entry.WithError(err).Data["err"])
+
+}
+
+func TestEntryPanicln(t *testing.T) {
+	errBoom := fmt.Errorf("boom time")
+
+	defer func() {
+		p := recover()
+		assert.NotNil(t, p)
+
+		switch pVal := p.(type) {
+		case *Entry:
+			assert.Equal(t, "kaboom", pVal.Message)
+			assert.Equal(t, errBoom, pVal.Data["err"])
+		default:
+			t.Fatalf("want type *Entry, got %T: %#v", pVal, pVal)
+		}
+	}()
+
+	logger := New()
+	logger.Out = &bytes.Buffer{}
+	entry := NewEntry(logger)
+	entry.WithField("err", errBoom).Panicln("kaboom")
+}
+
+func TestEntryPanicf(t *testing.T) {
+	errBoom := fmt.Errorf("boom again")
+
+	defer func() {
+		p := recover()
+		assert.NotNil(t, p)
+
+		switch pVal := p.(type) {
+		case *Entry:
+			assert.Equal(t, "kaboom true", pVal.Message)
+			assert.Equal(t, errBoom, pVal.Data["err"])
+		default:
+			t.Fatalf("want type *Entry, got %T: %#v", pVal, pVal)
+		}
+	}()
+
+	logger := New()
+	logger.Out = &bytes.Buffer{}
+	entry := NewEntry(logger)
+	entry.WithField("err", errBoom).Panicf("kaboom %v", true)
+}

vendor/github.com/Sirupsen/logrus/examples/basic/basic.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"github.com/Sirupsen/logrus"
+	// "os"
+)
+
+var log = logrus.New()
+
+func init() {
+	log.Formatter = new(logrus.JSONFormatter)
+	log.Formatter = new(logrus.TextFormatter) // default
+
+	// file, err := os.OpenFile("logrus.log", os.O_CREATE|os.O_WRONLY, 0666)
+	// if err == nil {
+	// 	log.Out = file
+	// } else {
+	// 	log.Info("Failed to log to file, using default stderr")
+	// }
+
+	log.Level = logrus.DebugLevel
+}
+
+func main() {
+	defer func() {
+		err := recover()
+		if err != nil {
+			log.WithFields(logrus.Fields{
+				"omg":    true,
+				"err":    err,
+				"number": 100,
+			}).Fatal("The ice breaks!")
+		}
+	}()
+
+	log.WithFields(logrus.Fields{
+		"animal": "walrus",
+		"number": 8,
+	}).Debug("Started observing beach")
+
+	log.WithFields(logrus.Fields{
+		"animal": "walrus",
+		"size":   10,
+	}).Info("A group of walrus emerges from the ocean")
+
+	log.WithFields(logrus.Fields{
+		"omg":    true,
+		"number": 122,
+	}).Warn("The group's number increased tremendously!")
+
+	log.WithFields(logrus.Fields{
+		"temperature": -4,
+	}).Debug("Temperature changes")
+
+	log.WithFields(logrus.Fields{
+		"animal": "orca",
+		"size":   9009,
+	}).Panic("It's over 9000!")
+}

vendor/github.com/Sirupsen/logrus/examples/hook/hook.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"github.com/Sirupsen/logrus"
+	"gopkg.in/gemnasium/logrus-airbrake-hook.v2"
+)
+
+var log = logrus.New()
+
+func init() {
+	log.Formatter = new(logrus.TextFormatter) // default
+	log.Hooks.Add(airbrake.NewHook(123, "xyz", "development"))
+}
+
+func main() {
+	log.WithFields(logrus.Fields{
+		"animal": "walrus",
+		"size":   10,
+	}).Info("A group of walrus emerges from the ocean")
+
+	log.WithFields(logrus.Fields{
+		"omg":    true,
+		"number": 122,
+	}).Warn("The group's number increased tremendously!")
+
+	log.WithFields(logrus.Fields{
+		"omg":    true,
+		"number": 100,
+	}).Fatal("The ice breaks!")
+}

vendor/github.com/Sirupsen/logrus/exported.go

@@ -0,0 +1,193 @@
+package logrus
+
+import (
+	"io"
+)
+
+var (
+	// std is the name of the standard logger in stdlib `log`
+	std = New()
+)
+
+func StandardLogger() *Logger {
+	return std
+}
+
+// SetOutput sets the standard logger output.
+func SetOutput(out io.Writer) {
+	std.mu.Lock()
+	defer std.mu.Unlock()
+	std.Out = out
+}
+
+// SetFormatter sets the standard logger formatter.
+func SetFormatter(formatter Formatter) {
+	std.mu.Lock()
+	defer std.mu.Unlock()
+	std.Formatter = formatter
+}
+
+// SetLevel sets the standard logger level.
+func SetLevel(level Level) {
+	std.mu.Lock()
+	defer std.mu.Unlock()
+	std.Level = level
+}
+
+// GetLevel returns the standard logger level.
+func GetLevel() Level {
+	std.mu.Lock()
+	defer std.mu.Unlock()
+	return std.Level
+}
+
+// AddHook adds a hook to the standard logger hooks.
+func AddHook(hook Hook) {
+	std.mu.Lock()
+	defer std.mu.Unlock()
+	std.Hooks.Add(hook)
+}
+
+// WithError creates an entry from the standard logger and adds an error to it, using the value defined in ErrorKey as key.
+func WithError(err error) *Entry {
+	return std.WithField(ErrorKey, err)
+}
+
+// WithField creates an entry from the standard logger and adds a field to
+// it. If you want multiple fields, use `WithFields`.
+//
+// Note that it doesn't log until you call Debug, Print, Info, Warn, Fatal
+// or Panic on the Entry it returns.
+func WithField(key string, value interface{}) *Entry {
+	return std.WithField(key, value)
+}
+
+// WithFields creates an entry from the standard logger and adds multiple
+// fields to it. This is simply a helper for `WithField`, invoking it
+// once for each field.
+//
+// Note that it doesn't log until you call Debug, Print, Info, Warn, Fatal
+// or Panic on the Entry it returns.
+func WithFields(fields Fields) *Entry {
+	return std.WithFields(fields)
+}
+
+// Debug logs a message at level Debug on the standard logger.
+func Debug(args ...interface{}) {
+	std.Debug(args...)
+}
+
+// Print logs a message at level Info on the standard logger.
+func Print(args ...interface{}) {
+	std.Print(args...)
+}
+
+// Info logs a message at level Info on the standard logger.
+func Info(args ...interface{}) {
+	std.Info(args...)
+}
+
+// Warn logs a message at level Warn on the standard logger.
+func Warn(args ...interface{}) {
+	std.Warn(args...)
+}
+
+// Warning logs a message at level Warn on the standard logger.
+func Warning(args ...interface{}) {
+	std.Warning(args...)
+}
+
+// Error logs a message at level Error on the standard logger.
+func Error(args ...interface{}) {
+	std.Error(args...)
+}
+
+// Panic logs a message at level Panic on the standard logger.
+func Panic(args ...interface{}) {
+	std.Panic(args...)
+}
+
+// Fatal logs a message at level Fatal on the standard logger.
+func Fatal(args ...interface{}) {
+	std.Fatal(args...)
+}
+
+// Debugf logs a message at level Debug on the standard logger.
+func Debugf(format string, args ...interface{}) {
+	std.Debugf(format, args...)
+}
+
+// Printf logs a message at level Info on the standard logger.
+func Printf(format string, args ...interface{}) {
+	std.Printf(format, args...)
+}
+
+// Infof logs a message at level Info on the standard logger.
+func Infof(format string, args ...interface{}) {
+	std.Infof(format, args...)
+}
+
+// Warnf logs a message at level Warn on the standard logger.
+func Warnf(format string, args ...interface{}) {
+	std.Warnf(format, args...)
+}
+
+// Warningf logs a message at level Warn on the standard logger.
+func Warningf(format string, args ...interface{}) {
+	std.Warningf(format, args...)
+}
+
+// Errorf logs a message at level Error on the standard logger.
+func Errorf(format string, args ...interface{}) {
+	std.Errorf(format, args...)
+}
+
+// Panicf logs a message at level Panic on the standard logger.
+func Panicf(format string, args ...interface{}) {
+	std.Panicf(format, args...)
+}
+
+// Fatalf logs a message at level Fatal on the standard logger.
+func Fatalf(format string, args ...interface{}) {
+	std.Fatalf(format, args...)
+}
+
+// Debugln logs a message at level Debug on the standard logger.
+func Debugln(args ...interface{}) {
+	std.Debugln(args...)
+}
+
+// Println logs a message at level Info on the standard logger.
+func Println(args ...interface{}) {
+	std.Println(args...)
+}
+
+// Infoln logs a message at level Info on the standard logger.
+func Infoln(args ...interface{}) {
+	std.Infoln(args...)
+}
+
+// Warnln logs a message at level Warn on the standard logger.
+func Warnln(args ...interface{}) {
+	std.Warnln(args...)
+}
+
+// Warningln logs a message at level Warn on the standard logger.
+func Warningln(args ...interface{}) {
+	std.Warningln(args...)
+}
+
+// Errorln logs a message at level Error on the standard logger.
+func Errorln(args ...interface{}) {
+	std.Errorln(args...)
+}
+
+// Panicln logs a message at level Panic on the standard logger.
+func Panicln(args ...interface{}) {
+	std.Panicln(args...)
+}
+
+// Fatalln logs a message at level Fatal on the standard logger.
+func Fatalln(args ...interface{}) {
+	std.Fatalln(args...)
+}

vendor/github.com/Sirupsen/logrus/formatter.go

@@ -0,0 +1,45 @@
+package logrus
+
+import "time"
+
+const DefaultTimestampFormat = time.RFC3339
+
+// The Formatter interface is used to implement a custom Formatter. It takes an
+// `Entry`. It exposes all the fields, including the default ones:
+//
+// * `entry.Data["msg"]`. The message passed from Info, Warn, Error ..
+// * `entry.Data["time"]`. The timestamp.
+// * `entry.Data["level"]. The level the entry was logged at.
+//
+// Any additional fields added with `WithField` or `WithFields` are also in
+// `entry.Data`. Format is expected to return an array of bytes which are then
+// logged to `logger.Out`.
+type Formatter interface {
+	Format(*Entry) ([]byte, error)
+}
+
+// This is to not silently overwrite `time`, `msg` and `level` fields when
+// dumping it. If this code wasn't there doing:
+//
+//  logrus.WithField("level", 1).Info("hello")
+//
+// Would just silently drop the user provided level. Instead with this code
+// it'll logged as:
+//
+//  {"level": "info", "fields.level": 1, "msg": "hello", "time": "..."}
+//
+// It's not exported because it's still using Data in an opinionated way. It's to
+// avoid code duplication between the two default formatters.
+func prefixFieldClashes(data Fields) {
+	if t, ok := data["time"]; ok {
+		data["fields.time"] = t
+	}
+
+	if m, ok := data["msg"]; ok {
+		data["fields.msg"] = m
+	}
+
+	if l, ok := data["level"]; ok {
+		data["fields.level"] = l
+	}
+}

vendor/github.com/Sirupsen/logrus/formatter_bench_test.go

@@ -0,0 +1,101 @@
+package logrus
+
+import (
+	"fmt"
+	"testing"
+	"time"
+)
+
+// smallFields is a small size data set for benchmarking
+var smallFields = Fields{
+	"foo":   "bar",
+	"baz":   "qux",
+	"one":   "two",
+	"three": "four",
+}
+
+// largeFields is a large size data set for benchmarking
+var largeFields = Fields{
+	"foo":       "bar",
+	"baz":       "qux",
+	"one":       "two",
+	"three":     "four",
+	"five":      "six",
+	"seven":     "eight",
+	"nine":      "ten",
+	"eleven":    "twelve",
+	"thirteen":  "fourteen",
+	"fifteen":   "sixteen",
+	"seventeen": "eighteen",
+	"nineteen":  "twenty",
+	"a":         "b",
+	"c":         "d",
+	"e":         "f",
+	"g":         "h",
+	"i":         "j",
+	"k":         "l",
+	"m":         "n",
+	"o":         "p",
+	"q":         "r",
+	"s":         "t",
+	"u":         "v",
+	"w":         "x",
+	"y":         "z",
+	"this":      "will",
+	"make":      "thirty",
+	"entries":   "yeah",
+}
+
+var errorFields = Fields{
+	"foo": fmt.Errorf("bar"),
+	"baz": fmt.Errorf("qux"),
+}
+
+func BenchmarkErrorTextFormatter(b *testing.B) {
+	doBenchmark(b, &TextFormatter{DisableColors: true}, errorFields)
+}
+
+func BenchmarkSmallTextFormatter(b *testing.B) {
+	doBenchmark(b, &TextFormatter{DisableColors: true}, smallFields)
+}
+
+func BenchmarkLargeTextFormatter(b *testing.B) {
+	doBenchmark(b, &TextFormatter{DisableColors: true}, largeFields)
+}
+
+func BenchmarkSmallColoredTextFormatter(b *testing.B) {
+	doBenchmark(b, &TextFormatter{ForceColors: true}, smallFields)
+}
+
+func BenchmarkLargeColoredTextFormatter(b *testing.B) {
+	doBenchmark(b, &TextFormatter{ForceColors: true}, largeFields)
+}
+
+func BenchmarkSmallJSONFormatter(b *testing.B) {
+	doBenchmark(b, &JSONFormatter{}, smallFields)
+}
+
+func BenchmarkLargeJSONFormatter(b *testing.B) {
+	doBenchmark(b, &JSONFormatter{}, largeFields)
+}
+
+func doBenchmark(b *testing.B, formatter Formatter, fields Fields) {
+	logger := New()
+
+	entry := &Entry{
+		Time:    time.Time{},
+		Level:   InfoLevel,
+		Message: "message",
+		Data:    fields,
+		Logger:  logger,
+	}
+	var d []byte
+	var err error
+	for i := 0; i < b.N; i++ {
+		d, err = formatter.Format(entry)
+		if err != nil {
+			b.Fatal(err)
+		}
+		b.SetBytes(int64(len(d)))
+	}
+}

vendor/github.com/Sirupsen/logrus/hook_test.go

@@ -0,0 +1,122 @@
+package logrus
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type TestHook struct {
+	Fired bool
+}
+
+func (hook *TestHook) Fire(entry *Entry) error {
+	hook.Fired = true
+	return nil
+}
+
+func (hook *TestHook) Levels() []Level {
+	return []Level{
+		DebugLevel,
+		InfoLevel,
+		WarnLevel,
+		ErrorLevel,
+		FatalLevel,
+		PanicLevel,
+	}
+}
+
+func TestHookFires(t *testing.T) {
+	hook := new(TestHook)
+
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Hooks.Add(hook)
+		assert.Equal(t, hook.Fired, false)
+
+		log.Print("test")
+	}, func(fields Fields) {
+		assert.Equal(t, hook.Fired, true)
+	})
+}
+
+type ModifyHook struct {
+}
+
+func (hook *ModifyHook) Fire(entry *Entry) error {
+	entry.Data["wow"] = "whale"
+	return nil
+}
+
+func (hook *ModifyHook) Levels() []Level {
+	return []Level{
+		DebugLevel,
+		InfoLevel,
+		WarnLevel,
+		ErrorLevel,
+		FatalLevel,
+		PanicLevel,
+	}
+}
+
+func TestHookCanModifyEntry(t *testing.T) {
+	hook := new(ModifyHook)
+
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Hooks.Add(hook)
+		log.WithField("wow", "elephant").Print("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["wow"], "whale")
+	})
+}
+
+func TestCanFireMultipleHooks(t *testing.T) {
+	hook1 := new(ModifyHook)
+	hook2 := new(TestHook)
+
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Hooks.Add(hook1)
+		log.Hooks.Add(hook2)
+
+		log.WithField("wow", "elephant").Print("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["wow"], "whale")
+		assert.Equal(t, hook2.Fired, true)
+	})
+}
+
+type ErrorHook struct {
+	Fired bool
+}
+
+func (hook *ErrorHook) Fire(entry *Entry) error {
+	hook.Fired = true
+	return nil
+}
+
+func (hook *ErrorHook) Levels() []Level {
+	return []Level{
+		ErrorLevel,
+	}
+}
+
+func TestErrorHookShouldntFireOnInfo(t *testing.T) {
+	hook := new(ErrorHook)
+
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Hooks.Add(hook)
+		log.Info("test")
+	}, func(fields Fields) {
+		assert.Equal(t, hook.Fired, false)
+	})
+}
+
+func TestErrorHookShouldFireOnError(t *testing.T) {
+	hook := new(ErrorHook)
+
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Hooks.Add(hook)
+		log.Error("test")
+	}, func(fields Fields) {
+		assert.Equal(t, hook.Fired, true)
+	})
+}

vendor/github.com/Sirupsen/logrus/hooks.go

@@ -0,0 +1,34 @@
+package logrus
+
+// A hook to be fired when logging on the logging levels returned from
+// `Levels()` on your implementation of the interface. Note that this is not
+// fired in a goroutine or a channel with workers, you should handle such
+// functionality yourself if your call is non-blocking and you don't wish for
+// the logging calls for levels returned from `Levels()` to block.
+type Hook interface {
+	Levels() []Level
+	Fire(*Entry) error
+}
+
+// Internal type for storing the hooks on a logger instance.
+type LevelHooks map[Level][]Hook
+
+// Add a hook to an instance of logger. This is called with
+// `log.Hooks.Add(new(MyHook))` where `MyHook` implements the `Hook` interface.
+func (hooks LevelHooks) Add(hook Hook) {
+	for _, level := range hook.Levels() {
+		hooks[level] = append(hooks[level], hook)
+	}
+}
+
+// Fire all the hooks for the passed level. Used by `entry.log` to fire
+// appropriate hooks for a log entry.
+func (hooks LevelHooks) Fire(level Level, entry *Entry) error {
+	for _, hook := range hooks[level] {
+		if err := hook.Fire(entry); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

vendor/github.com/Sirupsen/logrus/hooks/syslog/README.md

@@ -0,0 +1,39 @@
+# Syslog Hooks for Logrus <img src="http://i.imgur.com/hTeVwmJ.png" width="40" height="40" alt=":walrus:" class="emoji" title=":walrus:"/>
+
+## Usage
+
+```go
+import (
+  "log/syslog"
+  "github.com/Sirupsen/logrus"
+  logrus_syslog "github.com/Sirupsen/logrus/hooks/syslog"
+)
+
+func main() {
+  log       := logrus.New()
+  hook, err := logrus_syslog.NewSyslogHook("udp", "localhost:514", syslog.LOG_INFO, "")
+
+  if err == nil {
+    log.Hooks.Add(hook)
+  }
+}
+```
+
+If you want to connect to local syslog (Ex. "/dev/log" or "/var/run/syslog" or "/var/run/log"). Just assign empty string to the first two parameters of `NewSyslogHook`. It should look like the following.
+
+```go
+import (
+  "log/syslog"
+  "github.com/Sirupsen/logrus"
+  logrus_syslog "github.com/Sirupsen/logrus/hooks/syslog"
+)
+
+func main() {
+  log       := logrus.New()
+  hook, err := logrus_syslog.NewSyslogHook("", "", syslog.LOG_INFO, "")
+
+  if err == nil {
+    log.Hooks.Add(hook)
+  }
+}
+```

vendor/github.com/Sirupsen/logrus/hooks/syslog/syslog.go

@@ -0,0 +1,54 @@
+// +build !windows,!nacl,!plan9
+
+package logrus_syslog
+
+import (
+	"fmt"
+	"github.com/Sirupsen/logrus"
+	"log/syslog"
+	"os"
+)
+
+// SyslogHook to send logs via syslog.
+type SyslogHook struct {
+	Writer        *syslog.Writer
+	SyslogNetwork string
+	SyslogRaddr   string
+}
+
+// Creates a hook to be added to an instance of logger. This is called with
+// `hook, err := NewSyslogHook("udp", "localhost:514", syslog.LOG_DEBUG, "")`
+// `if err == nil { log.Hooks.Add(hook) }`
+func NewSyslogHook(network, raddr string, priority syslog.Priority, tag string) (*SyslogHook, error) {
+	w, err := syslog.Dial(network, raddr, priority, tag)
+	return &SyslogHook{w, network, raddr}, err
+}
+
+func (hook *SyslogHook) Fire(entry *logrus.Entry) error {
+	line, err := entry.String()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Unable to read entry, %v", err)
+		return err
+	}
+
+	switch entry.Level {
+	case logrus.PanicLevel:
+		return hook.Writer.Crit(line)
+	case logrus.FatalLevel:
+		return hook.Writer.Crit(line)
+	case logrus.ErrorLevel:
+		return hook.Writer.Err(line)
+	case logrus.WarnLevel:
+		return hook.Writer.Warning(line)
+	case logrus.InfoLevel:
+		return hook.Writer.Info(line)
+	case logrus.DebugLevel:
+		return hook.Writer.Debug(line)
+	default:
+		return nil
+	}
+}
+
+func (hook *SyslogHook) Levels() []logrus.Level {
+	return logrus.AllLevels
+}

vendor/github.com/Sirupsen/logrus/hooks/syslog/syslog_test.go

@@ -0,0 +1,26 @@
+package logrus_syslog
+
+import (
+	"github.com/Sirupsen/logrus"
+	"log/syslog"
+	"testing"
+)
+
+func TestLocalhostAddAndPrint(t *testing.T) {
+	log := logrus.New()
+	hook, err := NewSyslogHook("udp", "localhost:514", syslog.LOG_INFO, "")
+
+	if err != nil {
+		t.Errorf("Unable to connect to local syslog.")
+	}
+
+	log.Hooks.Add(hook)
+
+	for _, level := range hook.Levels() {
+		if len(log.Hooks[level]) != 1 {
+			t.Errorf("SyslogHook was not added. The length of log.Hooks[%v]: %v", level, len(log.Hooks[level]))
+		}
+	}
+
+	log.Info("Congratulations!")
+}

vendor/github.com/Sirupsen/logrus/hooks/test/test.go

@@ -0,0 +1,67 @@
+package test
+
+import (
+	"io/ioutil"
+
+	"github.com/Sirupsen/logrus"
+)
+
+// test.Hook is a hook designed for dealing with logs in test scenarios.
+type Hook struct {
+	Entries []*logrus.Entry
+}
+
+// Installs a test hook for the global logger.
+func NewGlobal() *Hook {
+
+	hook := new(Hook)
+	logrus.AddHook(hook)
+
+	return hook
+
+}
+
+// Installs a test hook for a given local logger.
+func NewLocal(logger *logrus.Logger) *Hook {
+
+	hook := new(Hook)
+	logger.Hooks.Add(hook)
+
+	return hook
+
+}
+
+// Creates a discarding logger and installs the test hook.
+func NewNullLogger() (*logrus.Logger, *Hook) {
+
+	logger := logrus.New()
+	logger.Out = ioutil.Discard
+
+	return logger, NewLocal(logger)
+
+}
+
+func (t *Hook) Fire(e *logrus.Entry) error {
+	t.Entries = append(t.Entries, e)
+	return nil
+}
+
+func (t *Hook) Levels() []logrus.Level {
+	return logrus.AllLevels
+}
+
+// LastEntry returns the last entry that was logged or nil.
+func (t *Hook) LastEntry() (l *logrus.Entry) {
+
+	if i := len(t.Entries) - 1; i < 0 {
+		return nil
+	} else {
+		return t.Entries[i]
+	}
+
+}
+
+// Reset removes all Entries from this test hook.
+func (t *Hook) Reset() {
+	t.Entries = make([]*logrus.Entry, 0)
+}

vendor/github.com/Sirupsen/logrus/hooks/test/test_test.go

@@ -0,0 +1,39 @@
+package test
+
+import (
+	"testing"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAllHooks(t *testing.T) {
+
+	assert := assert.New(t)
+
+	logger, hook := NewNullLogger()
+	assert.Nil(hook.LastEntry())
+	assert.Equal(0, len(hook.Entries))
+
+	logger.Error("Hello error")
+	assert.Equal(logrus.ErrorLevel, hook.LastEntry().Level)
+	assert.Equal("Hello error", hook.LastEntry().Message)
+	assert.Equal(1, len(hook.Entries))
+
+	logger.Warn("Hello warning")
+	assert.Equal(logrus.WarnLevel, hook.LastEntry().Level)
+	assert.Equal("Hello warning", hook.LastEntry().Message)
+	assert.Equal(2, len(hook.Entries))
+
+	hook.Reset()
+	assert.Nil(hook.LastEntry())
+	assert.Equal(0, len(hook.Entries))
+
+	hook = NewGlobal()
+
+	logrus.Error("Hello error")
+	assert.Equal(logrus.ErrorLevel, hook.LastEntry().Level)
+	assert.Equal("Hello error", hook.LastEntry().Message)
+	assert.Equal(1, len(hook.Entries))
+
+}

vendor/github.com/Sirupsen/logrus/json_formatter.go

@@ -0,0 +1,74 @@
+package logrus
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+type fieldKey string
+type FieldMap map[fieldKey]string
+
+const (
+	FieldKeyMsg   = "msg"
+	FieldKeyLevel = "level"
+	FieldKeyTime  = "time"
+)
+
+func (f FieldMap) resolve(key fieldKey) string {
+	if k, ok := f[key]; ok {
+		return k
+	}
+
+	return string(key)
+}
+
+type JSONFormatter struct {
+	// TimestampFormat sets the format used for marshaling timestamps.
+	TimestampFormat string
+
+	// DisableTimestamp allows disabling automatic timestamps in output
+	DisableTimestamp bool
+
+	// FieldMap allows users to customize the names of keys for various fields.
+	// As an example:
+	// formatter := &JSONFormatter{
+	//   	FieldMap: FieldMap{
+	// 		 FieldKeyTime: "@timestamp",
+	// 		 FieldKeyLevel: "@level",
+	// 		 FieldKeyLevel: "@message",
+	//    },
+	// }
+	FieldMap FieldMap
+}
+
+func (f *JSONFormatter) Format(entry *Entry) ([]byte, error) {
+	data := make(Fields, len(entry.Data)+3)
+	for k, v := range entry.Data {
+		switch v := v.(type) {
+		case error:
+			// Otherwise errors are ignored by `encoding/json`
+			// https://github.com/Sirupsen/logrus/issues/137
+			data[k] = v.Error()
+		default:
+			data[k] = v
+		}
+	}
+	prefixFieldClashes(data)
+
+	timestampFormat := f.TimestampFormat
+	if timestampFormat == "" {
+		timestampFormat = DefaultTimestampFormat
+	}
+
+	if !f.DisableTimestamp {
+		data[f.FieldMap.resolve(FieldKeyTime)] = entry.Time.Format(timestampFormat)
+	}
+	data[f.FieldMap.resolve(FieldKeyMsg)] = entry.Message
+	data[f.FieldMap.resolve(FieldKeyLevel)] = entry.Level.String()
+
+	serialized, err := json.Marshal(data)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to marshal fields to JSON, %v", err)
+	}
+	return append(serialized, '\n'), nil
+}

vendor/github.com/Sirupsen/logrus/json_formatter_test.go

@@ -0,0 +1,199 @@
+package logrus
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestErrorNotLost(t *testing.T) {
+	formatter := &JSONFormatter{}
+
+	b, err := formatter.Format(WithField("error", errors.New("wild walrus")))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+
+	entry := make(map[string]interface{})
+	err = json.Unmarshal(b, &entry)
+	if err != nil {
+		t.Fatal("Unable to unmarshal formatted entry: ", err)
+	}
+
+	if entry["error"] != "wild walrus" {
+		t.Fatal("Error field not set")
+	}
+}
+
+func TestErrorNotLostOnFieldNotNamedError(t *testing.T) {
+	formatter := &JSONFormatter{}
+
+	b, err := formatter.Format(WithField("omg", errors.New("wild walrus")))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+
+	entry := make(map[string]interface{})
+	err = json.Unmarshal(b, &entry)
+	if err != nil {
+		t.Fatal("Unable to unmarshal formatted entry: ", err)
+	}
+
+	if entry["omg"] != "wild walrus" {
+		t.Fatal("Error field not set")
+	}
+}
+
+func TestFieldClashWithTime(t *testing.T) {
+	formatter := &JSONFormatter{}
+
+	b, err := formatter.Format(WithField("time", "right now!"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+
+	entry := make(map[string]interface{})
+	err = json.Unmarshal(b, &entry)
+	if err != nil {
+		t.Fatal("Unable to unmarshal formatted entry: ", err)
+	}
+
+	if entry["fields.time"] != "right now!" {
+		t.Fatal("fields.time not set to original time field")
+	}
+
+	if entry["time"] != "0001-01-01T00:00:00Z" {
+		t.Fatal("time field not set to current time, was: ", entry["time"])
+	}
+}
+
+func TestFieldClashWithMsg(t *testing.T) {
+	formatter := &JSONFormatter{}
+
+	b, err := formatter.Format(WithField("msg", "something"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+
+	entry := make(map[string]interface{})
+	err = json.Unmarshal(b, &entry)
+	if err != nil {
+		t.Fatal("Unable to unmarshal formatted entry: ", err)
+	}
+
+	if entry["fields.msg"] != "something" {
+		t.Fatal("fields.msg not set to original msg field")
+	}
+}
+
+func TestFieldClashWithLevel(t *testing.T) {
+	formatter := &JSONFormatter{}
+
+	b, err := formatter.Format(WithField("level", "something"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+
+	entry := make(map[string]interface{})
+	err = json.Unmarshal(b, &entry)
+	if err != nil {
+		t.Fatal("Unable to unmarshal formatted entry: ", err)
+	}
+
+	if entry["fields.level"] != "something" {
+		t.Fatal("fields.level not set to original level field")
+	}
+}
+
+func TestJSONEntryEndsWithNewline(t *testing.T) {
+	formatter := &JSONFormatter{}
+
+	b, err := formatter.Format(WithField("level", "something"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+
+	if b[len(b)-1] != '\n' {
+		t.Fatal("Expected JSON log entry to end with a newline")
+	}
+}
+
+func TestJSONMessageKey(t *testing.T) {
+	formatter := &JSONFormatter{
+		FieldMap: FieldMap{
+			FieldKeyMsg: "message",
+		},
+	}
+
+	b, err := formatter.Format(&Entry{Message: "oh hai"})
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+	s := string(b)
+	if !(strings.Contains(s, "message") && strings.Contains(s, "oh hai")) {
+		t.Fatal("Expected JSON to format message key")
+	}
+}
+
+func TestJSONLevelKey(t *testing.T) {
+	formatter := &JSONFormatter{
+		FieldMap: FieldMap{
+			FieldKeyLevel: "somelevel",
+		},
+	}
+
+	b, err := formatter.Format(WithField("level", "something"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+	s := string(b)
+	if !strings.Contains(s, "somelevel") {
+		t.Fatal("Expected JSON to format level key")
+	}
+}
+
+func TestJSONTimeKey(t *testing.T) {
+	formatter := &JSONFormatter{
+		FieldMap: FieldMap{
+			FieldKeyTime: "timeywimey",
+		},
+	}
+
+	b, err := formatter.Format(WithField("level", "something"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+	s := string(b)
+	if !strings.Contains(s, "timeywimey") {
+		t.Fatal("Expected JSON to format time key")
+	}
+}
+
+func TestJSONDisableTimestamp(t *testing.T) {
+	formatter := &JSONFormatter{
+		DisableTimestamp: true,
+	}
+
+	b, err := formatter.Format(WithField("level", "something"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+	s := string(b)
+	if strings.Contains(s, FieldKeyTime) {
+		t.Error("Did not prevent timestamp", s)
+	}
+}
+
+func TestJSONEnableTimestamp(t *testing.T) {
+	formatter := &JSONFormatter{}
+
+	b, err := formatter.Format(WithField("level", "something"))
+	if err != nil {
+		t.Fatal("Unable to format entry: ", err)
+	}
+	s := string(b)
+	if !strings.Contains(s, FieldKeyTime) {
+		t.Error("Timestamp not present", s)
+	}
+}

vendor/github.com/Sirupsen/logrus/logger.go

@@ -0,0 +1,308 @@
+package logrus
+
+import (
+	"io"
+	"os"
+	"sync"
+)
+
+type Logger struct {
+	// The logs are `io.Copy`'d to this in a mutex. It's common to set this to a
+	// file, or leave it default which is `os.Stderr`. You can also set this to
+	// something more adventorous, such as logging to Kafka.
+	Out io.Writer
+	// Hooks for the logger instance. These allow firing events based on logging
+	// levels and log entries. For example, to send errors to an error tracking
+	// service, log to StatsD or dump the core on fatal errors.
+	Hooks LevelHooks
+	// All log entries pass through the formatter before logged to Out. The
+	// included formatters are `TextFormatter` and `JSONFormatter` for which
+	// TextFormatter is the default. In development (when a TTY is attached) it
+	// logs with colors, but to a file it wouldn't. You can easily implement your
+	// own that implements the `Formatter` interface, see the `README` or included
+	// formatters for examples.
+	Formatter Formatter
+	// The logging level the logger should log at. This is typically (and defaults
+	// to) `logrus.Info`, which allows Info(), Warn(), Error() and Fatal() to be
+	// logged. `logrus.Debug` is useful in
+	Level Level
+	// Used to sync writing to the log. Locking is enabled by Default
+	mu MutexWrap
+	// Reusable empty entry
+	entryPool sync.Pool
+}
+
+type MutexWrap struct {
+	lock     sync.Mutex
+	disabled bool
+}
+
+func (mw *MutexWrap) Lock() {
+	if !mw.disabled {
+		mw.lock.Lock()
+	}
+}
+
+func (mw *MutexWrap) Unlock() {
+	if !mw.disabled {
+		mw.lock.Unlock()
+	}
+}
+
+func (mw *MutexWrap) Disable() {
+	mw.disabled = true
+}
+
+// Creates a new logger. Configuration should be set by changing `Formatter`,
+// `Out` and `Hooks` directly on the default logger instance. You can also just
+// instantiate your own:
+//
+//    var log = &Logger{
+//      Out: os.Stderr,
+//      Formatter: new(JSONFormatter),
+//      Hooks: make(LevelHooks),
+//      Level: logrus.DebugLevel,
+//    }
+//
+// It's recommended to make this a global instance called `log`.
+func New() *Logger {
+	return &Logger{
+		Out:       os.Stderr,
+		Formatter: new(TextFormatter),
+		Hooks:     make(LevelHooks),
+		Level:     InfoLevel,
+	}
+}
+
+func (logger *Logger) newEntry() *Entry {
+	entry, ok := logger.entryPool.Get().(*Entry)
+	if ok {
+		return entry
+	}
+	return NewEntry(logger)
+}
+
+func (logger *Logger) releaseEntry(entry *Entry) {
+	logger.entryPool.Put(entry)
+}
+
+// Adds a field to the log entry, note that it doesn't log until you call
+// Debug, Print, Info, Warn, Fatal or Panic. It only creates a log entry.
+// If you want multiple fields, use `WithFields`.
+func (logger *Logger) WithField(key string, value interface{}) *Entry {
+	entry := logger.newEntry()
+	defer logger.releaseEntry(entry)
+	return entry.WithField(key, value)
+}
+
+// Adds a struct of fields to the log entry. All it does is call `WithField` for
+// each `Field`.
+func (logger *Logger) WithFields(fields Fields) *Entry {
+	entry := logger.newEntry()
+	defer logger.releaseEntry(entry)
+	return entry.WithFields(fields)
+}
+
+// Add an error as single field to the log entry.  All it does is call
+// `WithError` for the given `error`.
+func (logger *Logger) WithError(err error) *Entry {
+	entry := logger.newEntry()
+	defer logger.releaseEntry(entry)
+	return entry.WithError(err)
+}
+
+func (logger *Logger) Debugf(format string, args ...interface{}) {
+	if logger.Level >= DebugLevel {
+		entry := logger.newEntry()
+		entry.Debugf(format, args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Infof(format string, args ...interface{}) {
+	if logger.Level >= InfoLevel {
+		entry := logger.newEntry()
+		entry.Infof(format, args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Printf(format string, args ...interface{}) {
+	entry := logger.newEntry()
+	entry.Printf(format, args...)
+	logger.releaseEntry(entry)
+}
+
+func (logger *Logger) Warnf(format string, args ...interface{}) {
+	if logger.Level >= WarnLevel {
+		entry := logger.newEntry()
+		entry.Warnf(format, args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Warningf(format string, args ...interface{}) {
+	if logger.Level >= WarnLevel {
+		entry := logger.newEntry()
+		entry.Warnf(format, args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Errorf(format string, args ...interface{}) {
+	if logger.Level >= ErrorLevel {
+		entry := logger.newEntry()
+		entry.Errorf(format, args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Fatalf(format string, args ...interface{}) {
+	if logger.Level >= FatalLevel {
+		entry := logger.newEntry()
+		entry.Fatalf(format, args...)
+		logger.releaseEntry(entry)
+	}
+	Exit(1)
+}
+
+func (logger *Logger) Panicf(format string, args ...interface{}) {
+	if logger.Level >= PanicLevel {
+		entry := logger.newEntry()
+		entry.Panicf(format, args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Debug(args ...interface{}) {
+	if logger.Level >= DebugLevel {
+		entry := logger.newEntry()
+		entry.Debug(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Info(args ...interface{}) {
+	if logger.Level >= InfoLevel {
+		entry := logger.newEntry()
+		entry.Info(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Print(args ...interface{}) {
+	entry := logger.newEntry()
+	entry.Info(args...)
+	logger.releaseEntry(entry)
+}
+
+func (logger *Logger) Warn(args ...interface{}) {
+	if logger.Level >= WarnLevel {
+		entry := logger.newEntry()
+		entry.Warn(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Warning(args ...interface{}) {
+	if logger.Level >= WarnLevel {
+		entry := logger.newEntry()
+		entry.Warn(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Error(args ...interface{}) {
+	if logger.Level >= ErrorLevel {
+		entry := logger.newEntry()
+		entry.Error(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Fatal(args ...interface{}) {
+	if logger.Level >= FatalLevel {
+		entry := logger.newEntry()
+		entry.Fatal(args...)
+		logger.releaseEntry(entry)
+	}
+	Exit(1)
+}
+
+func (logger *Logger) Panic(args ...interface{}) {
+	if logger.Level >= PanicLevel {
+		entry := logger.newEntry()
+		entry.Panic(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Debugln(args ...interface{}) {
+	if logger.Level >= DebugLevel {
+		entry := logger.newEntry()
+		entry.Debugln(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Infoln(args ...interface{}) {
+	if logger.Level >= InfoLevel {
+		entry := logger.newEntry()
+		entry.Infoln(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Println(args ...interface{}) {
+	entry := logger.newEntry()
+	entry.Println(args...)
+	logger.releaseEntry(entry)
+}
+
+func (logger *Logger) Warnln(args ...interface{}) {
+	if logger.Level >= WarnLevel {
+		entry := logger.newEntry()
+		entry.Warnln(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Warningln(args ...interface{}) {
+	if logger.Level >= WarnLevel {
+		entry := logger.newEntry()
+		entry.Warnln(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Errorln(args ...interface{}) {
+	if logger.Level >= ErrorLevel {
+		entry := logger.newEntry()
+		entry.Errorln(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+func (logger *Logger) Fatalln(args ...interface{}) {
+	if logger.Level >= FatalLevel {
+		entry := logger.newEntry()
+		entry.Fatalln(args...)
+		logger.releaseEntry(entry)
+	}
+	Exit(1)
+}
+
+func (logger *Logger) Panicln(args ...interface{}) {
+	if logger.Level >= PanicLevel {
+		entry := logger.newEntry()
+		entry.Panicln(args...)
+		logger.releaseEntry(entry)
+	}
+}
+
+//When file is opened with appending mode, it's safe to
+//write concurrently to a file (within 4k message on Linux).
+//In these cases user can choose to disable the lock.
+func (logger *Logger) SetNoLock() {
+	logger.mu.Disable()
+}

vendor/github.com/Sirupsen/logrus/logger_bench_test.go

@@ -0,0 +1,61 @@
+package logrus
+
+import (
+	"os"
+	"testing"
+)
+
+// smallFields is a small size data set for benchmarking
+var loggerFields = Fields{
+	"foo":   "bar",
+	"baz":   "qux",
+	"one":   "two",
+	"three": "four",
+}
+
+func BenchmarkDummyLogger(b *testing.B) {
+	nullf, err := os.OpenFile("/dev/null", os.O_WRONLY, 0666)
+	if err != nil {
+		b.Fatalf("%v", err)
+	}
+	defer nullf.Close()
+	doLoggerBenchmark(b, nullf, &TextFormatter{DisableColors: true}, smallFields)
+}
+
+func BenchmarkDummyLoggerNoLock(b *testing.B) {
+	nullf, err := os.OpenFile("/dev/null", os.O_WRONLY|os.O_APPEND, 0666)
+	if err != nil {
+		b.Fatalf("%v", err)
+	}
+	defer nullf.Close()
+	doLoggerBenchmarkNoLock(b, nullf, &TextFormatter{DisableColors: true}, smallFields)
+}
+
+func doLoggerBenchmark(b *testing.B, out *os.File, formatter Formatter, fields Fields) {
+	logger := Logger{
+		Out:       out,
+		Level:     InfoLevel,
+		Formatter: formatter,
+	}
+	entry := logger.WithFields(fields)
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			entry.Info("aaa")
+		}
+	})
+}
+
+func doLoggerBenchmarkNoLock(b *testing.B, out *os.File, formatter Formatter, fields Fields) {
+	logger := Logger{
+		Out:       out,
+		Level:     InfoLevel,
+		Formatter: formatter,
+	}
+	logger.SetNoLock()
+	entry := logger.WithFields(fields)
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			entry.Info("aaa")
+		}
+	})
+}

vendor/github.com/Sirupsen/logrus/logrus.go

@@ -0,0 +1,143 @@
+package logrus
+
+import (
+	"fmt"
+	"log"
+	"strings"
+)
+
+// Fields type, used to pass to `WithFields`.
+type Fields map[string]interface{}
+
+// Level type
+type Level uint8
+
+// Convert the Level to a string. E.g. PanicLevel becomes "panic".
+func (level Level) String() string {
+	switch level {
+	case DebugLevel:
+		return "debug"
+	case InfoLevel:
+		return "info"
+	case WarnLevel:
+		return "warning"
+	case ErrorLevel:
+		return "error"
+	case FatalLevel:
+		return "fatal"
+	case PanicLevel:
+		return "panic"
+	}
+
+	return "unknown"
+}
+
+// ParseLevel takes a string level and returns the Logrus log level constant.
+func ParseLevel(lvl string) (Level, error) {
+	switch strings.ToLower(lvl) {
+	case "panic":
+		return PanicLevel, nil
+	case "fatal":
+		return FatalLevel, nil
+	case "error":
+		return ErrorLevel, nil
+	case "warn", "warning":
+		return WarnLevel, nil
+	case "info":
+		return InfoLevel, nil
+	case "debug":
+		return DebugLevel, nil
+	}
+
+	var l Level
+	return l, fmt.Errorf("not a valid logrus Level: %q", lvl)
+}
+
+// A constant exposing all logging levels
+var AllLevels = []Level{
+	PanicLevel,
+	FatalLevel,
+	ErrorLevel,
+	WarnLevel,
+	InfoLevel,
+	DebugLevel,
+}
+
+// These are the different logging levels. You can set the logging level to log
+// on your instance of logger, obtained with `logrus.New()`.
+const (
+	// PanicLevel level, highest level of severity. Logs and then calls panic with the
+	// message passed to Debug, Info, ...
+	PanicLevel Level = iota
+	// FatalLevel level. Logs and then calls `os.Exit(1)`. It will exit even if the
+	// logging level is set to Panic.
+	FatalLevel
+	// ErrorLevel level. Logs. Used for errors that should definitely be noted.
+	// Commonly used for hooks to send errors to an error tracking service.
+	ErrorLevel
+	// WarnLevel level. Non-critical entries that deserve eyes.
+	WarnLevel
+	// InfoLevel level. General operational entries about what's going on inside the
+	// application.
+	InfoLevel
+	// DebugLevel level. Usually only enabled when debugging. Very verbose logging.
+	DebugLevel
+)
+
+// Won't compile if StdLogger can't be realized by a log.Logger
+var (
+	_ StdLogger = &log.Logger{}
+	_ StdLogger = &Entry{}
+	_ StdLogger = &Logger{}
+)
+
+// StdLogger is what your logrus-enabled library should take, that way
+// it'll accept a stdlib logger and a logrus logger. There's no standard
+// interface, this is the closest we get, unfortunately.
+type StdLogger interface {
+	Print(...interface{})
+	Printf(string, ...interface{})
+	Println(...interface{})
+
+	Fatal(...interface{})
+	Fatalf(string, ...interface{})
+	Fatalln(...interface{})
+
+	Panic(...interface{})
+	Panicf(string, ...interface{})
+	Panicln(...interface{})
+}
+
+// The FieldLogger interface generalizes the Entry and Logger types
+type FieldLogger interface {
+	WithField(key string, value interface{}) *Entry
+	WithFields(fields Fields) *Entry
+	WithError(err error) *Entry
+
+	Debugf(format string, args ...interface{})
+	Infof(format string, args ...interface{})
+	Printf(format string, args ...interface{})
+	Warnf(format string, args ...interface{})
+	Warningf(format string, args ...interface{})
+	Errorf(format string, args ...interface{})
+	Fatalf(format string, args ...interface{})
+	Panicf(format string, args ...interface{})
+
+	Debug(args ...interface{})
+	Info(args ...interface{})
+	Print(args ...interface{})
+	Warn(args ...interface{})
+	Warning(args ...interface{})
+	Error(args ...interface{})
+	Fatal(args ...interface{})
+	Panic(args ...interface{})
+
+	Debugln(args ...interface{})
+	Infoln(args ...interface{})
+	Println(args ...interface{})
+	Warnln(args ...interface{})
+	Warningln(args ...interface{})
+	Errorln(args ...interface{})
+	Fatalln(args ...interface{})
+	Panicln(args ...interface{})
+}

vendor/github.com/Sirupsen/logrus/logrus_test.go

@@ -0,0 +1,386 @@
+package logrus
+
+import (
+	"bytes"
+	"encoding/json"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func LogAndAssertJSON(t *testing.T, log func(*Logger), assertions func(fields Fields)) {
+	var buffer bytes.Buffer
+	var fields Fields
+
+	logger := New()
+	logger.Out = &buffer
+	logger.Formatter = new(JSONFormatter)
+
+	log(logger)
+
+	err := json.Unmarshal(buffer.Bytes(), &fields)
+	assert.Nil(t, err)
+
+	assertions(fields)
+}
+
+func LogAndAssertText(t *testing.T, log func(*Logger), assertions func(fields map[string]string)) {
+	var buffer bytes.Buffer
+
+	logger := New()
+	logger.Out = &buffer
+	logger.Formatter = &TextFormatter{
+		DisableColors: true,
+	}
+
+	log(logger)
+
+	fields := make(map[string]string)
+	for _, kv := range strings.Split(buffer.String(), " ") {
+		if !strings.Contains(kv, "=") {
+			continue
+		}
+		kvArr := strings.Split(kv, "=")
+		key := strings.TrimSpace(kvArr[0])
+		val := kvArr[1]
+		if kvArr[1][0] == '"' {
+			var err error
+			val, err = strconv.Unquote(val)
+			assert.NoError(t, err)
+		}
+		fields[key] = val
+	}
+	assertions(fields)
+}
+
+func TestPrint(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Print("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test")
+		assert.Equal(t, fields["level"], "info")
+	})
+}
+
+func TestInfo(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Info("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test")
+		assert.Equal(t, fields["level"], "info")
+	})
+}
+
+func TestWarn(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Warn("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test")
+		assert.Equal(t, fields["level"], "warning")
+	})
+}
+
+func TestInfolnShouldAddSpacesBetweenStrings(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Infoln("test", "test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test test")
+	})
+}
+
+func TestInfolnShouldAddSpacesBetweenStringAndNonstring(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Infoln("test", 10)
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test 10")
+	})
+}
+
+func TestInfolnShouldAddSpacesBetweenTwoNonStrings(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Infoln(10, 10)
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "10 10")
+	})
+}
+
+func TestInfoShouldAddSpacesBetweenTwoNonStrings(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Infoln(10, 10)
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "10 10")
+	})
+}
+
+func TestInfoShouldNotAddSpacesBetweenStringAndNonstring(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Info("test", 10)
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test10")
+	})
+}
+
+func TestInfoShouldNotAddSpacesBetweenStrings(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.Info("test", "test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "testtest")
+	})
+}
+
+func TestWithFieldsShouldAllowAssignments(t *testing.T) {
+	var buffer bytes.Buffer
+	var fields Fields
+
+	logger := New()
+	logger.Out = &buffer
+	logger.Formatter = new(JSONFormatter)
+
+	localLog := logger.WithFields(Fields{
+		"key1": "value1",
+	})
+
+	localLog.WithField("key2", "value2").Info("test")
+	err := json.Unmarshal(buffer.Bytes(), &fields)
+	assert.Nil(t, err)
+
+	assert.Equal(t, "value2", fields["key2"])
+	assert.Equal(t, "value1", fields["key1"])
+
+	buffer = bytes.Buffer{}
+	fields = Fields{}
+	localLog.Info("test")
+	err = json.Unmarshal(buffer.Bytes(), &fields)
+	assert.Nil(t, err)
+
+	_, ok := fields["key2"]
+	assert.Equal(t, false, ok)
+	assert.Equal(t, "value1", fields["key1"])
+}
+
+func TestUserSuppliedFieldDoesNotOverwriteDefaults(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.WithField("msg", "hello").Info("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test")
+	})
+}
+
+func TestUserSuppliedMsgFieldHasPrefix(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.WithField("msg", "hello").Info("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["msg"], "test")
+		assert.Equal(t, fields["fields.msg"], "hello")
+	})
+}
+
+func TestUserSuppliedTimeFieldHasPrefix(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.WithField("time", "hello").Info("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["fields.time"], "hello")
+	})
+}
+
+func TestUserSuppliedLevelFieldHasPrefix(t *testing.T) {
+	LogAndAssertJSON(t, func(log *Logger) {
+		log.WithField("level", 1).Info("test")
+	}, func(fields Fields) {
+		assert.Equal(t, fields["level"], "info")
+		assert.Equal(t, fields["fields.level"], 1.0) // JSON has floats only
+	})
+}
+
+func TestDefaultFieldsAreNotPrefixed(t *testing.T) {
+	LogAndAssertText(t, func(log *Logger) {
+		ll := log.WithField("herp", "derp")
+		ll.Info("hello")
+		ll.Info("bye")
+	}, func(fields map[string]string) {
+		for _, fieldName := range []string{"fields.level", "fields.time", "fields.msg"} {
+			if _, ok := fields[fieldName]; ok {
+				t.Fatalf("should not have prefixed %q: %v", fieldName, fields)
+			}
+		}
+	})
+}
+
+func TestDoubleLoggingDoesntPrefixPreviousFields(t *testing.T) {
+
+	var buffer bytes.Buffer
+	var fields Fields
+
+	logger := New()
+	logger.Out = &buffer
+	logger.Formatter = new(JSONFormatter)
+
+	llog := logger.WithField("context", "eating raw fish")
+
+	llog.Info("looks delicious")
+
+	err := json.Unmarshal(buffer.Bytes(), &fields)
+	assert.NoError(t, err, "should have decoded first message")
+	assert.Equal(t, len(fields), 4, "should only have msg/time/level/context fields")
+	assert.Equal(t, fields["msg"], "looks delicious")
+	assert.Equal(t, fields["context"], "eating raw fish")
+
+	buffer.Reset()
+
+	llog.Warn("omg it is!")
+
+	err = json.Unmarshal(buffer.Bytes(), &fields)
+	assert.NoError(t, err, "should have decoded second message")
+	assert.Equal(t, len(fields), 4, "should only have msg/time/level/context fields")
+	assert.Equal(t, fields["msg"], "omg it is!")
+	assert.Equal(t, fields["context"], "eating raw fish")
+	assert.Nil(t, fields["fields.msg"], "should not have prefixed previous `msg` entry")
+
+}
+
+func TestConvertLevelToString(t *testing.T) {
+	assert.Equal(t, "debug", DebugLevel.String())
+	assert.Equal(t, "info", InfoLevel.String())
+	assert.Equal(t, "warning", WarnLevel.String())
+	assert.Equal(t, "error", ErrorLevel.String())
+	assert.Equal(t, "fatal", FatalLevel.String())
+	assert.Equal(t, "panic", PanicLevel.String())
+}
+
+func TestParseLevel(t *testing.T) {
+	l, err := ParseLevel("panic")
+	assert.Nil(t, err)
+	assert.Equal(t, PanicLevel, l)
+
+	l, err = ParseLevel("PANIC")
+	assert.Nil(t, err)
+	assert.Equal(t, PanicLevel, l)
+
+	l, err = ParseLevel("fatal")
+	assert.Nil(t, err)
+	assert.Equal(t, FatalLevel, l)
+
+	l, err = ParseLevel("FATAL")
+	assert.Nil(t, err)
+	assert.Equal(t, FatalLevel, l)
+
+	l, err = ParseLevel("error")
+	assert.Nil(t, err)
+	assert.Equal(t, ErrorLevel, l)
+
+	l, err = ParseLevel("ERROR")
+	assert.Nil(t, err)
+	assert.Equal(t, ErrorLevel, l)
+
+	l, err = ParseLevel("warn")
+	assert.Nil(t, err)
+	assert.Equal(t, WarnLevel, l)
+
+	l, err = ParseLevel("WARN")
+	assert.Nil(t, err)
+	assert.Equal(t, WarnLevel, l)
+
+	l, err = ParseLevel("warning")
+	assert.Nil(t, err)
+	assert.Equal(t, WarnLevel, l)
+
+	l, err = ParseLevel("WARNING")
+	assert.Nil(t, err)
+	assert.Equal(t, WarnLevel, l)
+
+	l, err = ParseLevel("info")
+	assert.Nil(t, err)
+	assert.Equal(t, InfoLevel, l)
+
+	l, err = ParseLevel("INFO")
+	assert.Nil(t, err)
+	assert.Equal(t, InfoLevel, l)
+
+	l, err = ParseLevel("debug")
+	assert.Nil(t, err)
+	assert.Equal(t, DebugLevel, l)
+
+	l, err = ParseLevel("DEBUG")
+	assert.Nil(t, err)
+	assert.Equal(t, DebugLevel, l)
+
+	l, err = ParseLevel("invalid")
+	assert.Equal(t, "not a valid logrus Level: \"invalid\"", err.Error())
+}
+
+func TestGetSetLevelRace(t *testing.T) {
+	wg := sync.WaitGroup{}
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			if i%2 == 0 {
+				SetLevel(InfoLevel)
+			} else {
+				GetLevel()
+			}
+		}(i)
+
+	}
+	wg.Wait()
+}
+
+func TestLoggingRace(t *testing.T) {
+	logger := New()
+
+	var wg sync.WaitGroup
+	wg.Add(100)
+
+	for i := 0; i < 100; i++ {
+		go func() {
+			logger.Info("info")
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+}
+
+// Compile test
+func TestLogrusInterface(t *testing.T) {
+	var buffer bytes.Buffer
+	fn := func(l FieldLogger) {
+		b := l.WithField("key", "value")
+		b.Debug("Test")
+	}
+	// test logger
+	logger := New()
+	logger.Out = &buffer
+	fn(logger)
+
+	// test Entry
+	e := logger.WithField("another", "value")
+	fn(e)
+}
+
+// Implements io.Writer using channels for synchronization, so we can wait on
+// the Entry.Writer goroutine to write in a non-racey way. This does assume that
+// there is a single call to Logger.Out for each message.
+type channelWriter chan []byte
+
+func (cw channelWriter) Write(p []byte) (int, error) {
+	cw <- p
+	return len(p), nil
+}
+
+func TestEntryWriter(t *testing.T) {
+	cw := channelWriter(make(chan []byte, 1))
+	log := New()
+	log.Out = cw
+	log.Formatter = new(JSONFormatter)
+	log.WithField("foo", "bar").WriterLevel(WarnLevel).Write([]byte("hello\n"))
+
+	bs := <-cw
+	var fields Fields
+	err := json.Unmarshal(bs, &fields)
+	assert.Nil(t, err)
+	assert.Equal(t, fields["foo"], "bar")
+	assert.Equal(t, fields["level"], "warning")
+}

vendor/github.com/Sirupsen/logrus/terminal_appengine.go

@@ -0,0 +1,10 @@
+// +build appengine
+
+package logrus
+
+import "io"
+
+// IsTerminal returns true if stderr's file descriptor is a terminal.
+func IsTerminal(f io.Writer) bool {
+	return true
+}

vendor/github.com/Sirupsen/logrus/terminal_bsd.go

@@ -0,0 +1,10 @@
+// +build darwin freebsd openbsd netbsd dragonfly
+// +build !appengine
+
+package logrus
+
+import "syscall"
+
+const ioctlReadTermios = syscall.TIOCGETA
+
+type Termios syscall.Termios

vendor/github.com/Sirupsen/logrus/terminal_linux.go

@@ -0,0 +1,14 @@
+// Based on ssh/terminal:
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !appengine
+
+package logrus
+
+import "syscall"
+
+const ioctlReadTermios = syscall.TCGETS
+
+type Termios syscall.Termios

vendor/github.com/Sirupsen/logrus/terminal_notwindows.go

@@ -0,0 +1,28 @@
+// Based on ssh/terminal:
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build linux darwin freebsd openbsd netbsd dragonfly
+// +build !appengine
+
+package logrus
+
+import (
+	"io"
+	"os"
+	"syscall"
+	"unsafe"
+)
+
+// IsTerminal returns true if stderr's file descriptor is a terminal.
+func IsTerminal(f io.Writer) bool {
+	var termios Termios
+	switch v := f.(type) {
+	case *os.File:
+		_, _, err := syscall.Syscall6(syscall.SYS_IOCTL, uintptr(v.Fd()), ioctlReadTermios, uintptr(unsafe.Pointer(&termios)), 0, 0, 0)
+		return err == 0
+	default:
+		return false
+	}
+}

vendor/github.com/Sirupsen/logrus/terminal_solaris.go

@@ -0,0 +1,21 @@
+// +build solaris,!appengine
+
+package logrus
+
+import (
+	"io"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// IsTerminal returns true if the given file descriptor is a terminal.
+func IsTerminal(f io.Writer) bool {
+	switch v := f.(type) {
+	case *os.File:
+		_, err := unix.IoctlGetTermios(int(v.Fd()), unix.TCGETA)
+		return err == nil
+	default:
+		return false
+	}
+}

vendor/github.com/Sirupsen/logrus/terminal_windows.go

@@ -0,0 +1,33 @@
+// Based on ssh/terminal:
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build windows,!appengine
+
+package logrus
+
+import (
+	"io"
+	"os"
+	"syscall"
+	"unsafe"
+)
+
+var kernel32 = syscall.NewLazyDLL("kernel32.dll")
+
+var (
+	procGetConsoleMode = kernel32.NewProc("GetConsoleMode")
+)
+
+// IsTerminal returns true if stderr's file descriptor is a terminal.
+func IsTerminal(f io.Writer) bool {
+	switch v := f.(type) {
+	case *os.File:
+		var st uint32
+		r, _, e := syscall.Syscall(procGetConsoleMode.Addr(), 2, uintptr(v.Fd()), uintptr(unsafe.Pointer(&st)), 0)
+		return r != 0 && e == 0
+	default:
+		return false
+	}
+}

vendor/github.com/Sirupsen/logrus/text_formatter.go

@@ -0,0 +1,189 @@
+package logrus
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	nocolor = 0
+	red     = 31
+	green   = 32
+	yellow  = 33
+	blue    = 34
+	gray    = 37
+)
+
+var (
+	baseTimestamp time.Time
+)
+
+func init() {
+	baseTimestamp = time.Now()
+}
+
+type TextFormatter struct {
+	// Set to true to bypass checking for a TTY before outputting colors.
+	ForceColors bool
+
+	// Force disabling colors.
+	DisableColors bool
+
+	// Disable timestamp logging. useful when output is redirected to logging
+	// system that already adds timestamps.
+	DisableTimestamp bool
+
+	// Enable logging the full timestamp when a TTY is attached instead of just
+	// the time passed since beginning of execution.
+	FullTimestamp bool
+
+	// TimestampFormat to use for display when a full timestamp is printed
+	TimestampFormat string
+
+	// The fields are sorted by default for a consistent output. For applications
+	// that log extremely frequently and don't use the JSON formatter this may not
+	// be desired.
+	DisableSorting bool
+
+	// QuoteEmptyFields will wrap empty fields in quotes if true
+	QuoteEmptyFields bool
+
+	// QuoteCharacter can be set to the override the default quoting character "
+	// with something else. For example: ', or `.
+	QuoteCharacter string
+
+	// Whether the logger's out is to a terminal
+	isTerminal bool
+
+	sync.Once
+}
+
+func (f *TextFormatter) init(entry *Entry) {
+	if len(f.QuoteCharacter) == 0 {
+		f.QuoteCharacter = "\""
+	}
+	if entry.Logger != nil {
+		f.isTerminal = IsTerminal(entry.Logger.Out)
+	}
+}
+
+func (f *TextFormatter) Format(entry *Entry) ([]byte, error) {
+	var b *bytes.Buffer
+	keys := make([]string, 0, len(entry.Data))
+	for k := range entry.Data {
+		keys = append(keys, k)
+	}
+
+	if !f.DisableSorting {
+		sort.Strings(keys)
+	}
+	if entry.Buffer != nil {
+		b = entry.Buffer
+	} else {
+		b = &bytes.Buffer{}
+	}
+
+	prefixFieldClashes(entry.Data)
+
+	f.Do(func() { f.init(entry) })
+
+	isColored := (f.ForceColors || f.isTerminal) && !f.DisableColors
+
+	timestampFormat := f.TimestampFormat
+	if timestampFormat == "" {
+		timestampFormat = DefaultTimestampFormat
+	}
+	if isColored {
+		f.printColored(b, entry, keys, timestampFormat)
+	} else {
+		if !f.DisableTimestamp {
+			f.appendKeyValue(b, "time", entry.Time.Format(timestampFormat))
+		}
+		f.appendKeyValue(b, "level", entry.Level.String())
+		if entry.Message != "" {
+			f.appendKeyValue(b, "msg", entry.Message)
+		}
+		for _, key := range keys {
+			f.appendKeyValue(b, key, entry.Data[key])
+		}
+	}
+
+	b.WriteByte('\n')
+	return b.Bytes(), nil
+}
+
+func (f *TextFormatter) printColored(b *bytes.Buffer, entry *Entry, keys []string, timestampFormat string) {
+	var levelColor int
+	switch entry.Level {
+	case DebugLevel:
+		levelColor = gray
+	case WarnLevel:
+		levelColor = yellow
+	case ErrorLevel, FatalLevel, PanicLevel:
+		levelColor = red
+	default:
+		levelColor = blue
+	}
+
+	levelText := strings.ToUpper(entry.Level.String())[0:4]
+
+	if f.DisableTimestamp {
+		fmt.Fprintf(b, "\x1b[%dm%s\x1b[0m %-44s ", levelColor, levelText, entry.Message)
+	} else if !f.FullTimestamp {
+		fmt.Fprintf(b, "\x1b[%dm%s\x1b[0m[%04d] %-44s ", levelColor, levelText, int(entry.Time.Sub(baseTimestamp)/time.Second), entry.Message)
+	} else {
+		fmt.Fprintf(b, "\x1b[%dm%s\x1b[0m[%s] %-44s ", levelColor, levelText, entry.Time.Format(timestampFormat), entry.Message)
+	}
+	for _, k := range keys {
+		v := entry.Data[k]
+		fmt.Fprintf(b, " \x1b[%dm%s\x1b[0m=", levelColor, k)
+		f.appendValue(b, v)
+	}
+}
+
+func (f *TextFormatter) needsQuoting(text string) bool {
+	if f.QuoteEmptyFields && len(text) == 0 {
+		return true
+	}
+	for _, ch := range text {
+		if !((ch >= 'a' && ch <= 'z') ||
+			(ch >= 'A' && ch <= 'Z') ||
+			(ch >= '0' && ch <= '9') ||
+			ch == '-' || ch == '.') {
+			return true
+		}
+	}
+	return false
+}
+
+func (f *TextFormatter) appendKeyValue(b *bytes.Buffer, key string, value interface{}) {
+
+	b.WriteString(key)
+	b.WriteByte('=')
+	f.appendValue(b, value)
+	b.WriteByte(' ')
+}
+
+func (f *TextFormatter) appendValue(b *bytes.Buffer, value interface{}) {
+	switch value := value.(type) {
+	case string:
+		if !f.needsQuoting(value) {
+			b.WriteString(value)
+		} else {
+			fmt.Fprintf(b, "%s%v%s", f.QuoteCharacter, value, f.QuoteCharacter)
+		}
+	case error:
+		errmsg := value.Error()
+		if !f.needsQuoting(errmsg) {
+			b.WriteString(errmsg)
+		} else {
+			fmt.Fprintf(b, "%s%v%s", f.QuoteCharacter, errmsg, f.QuoteCharacter)
+		}
+	default:
+		fmt.Fprint(b, value)
+	}
+}

vendor/github.com/Sirupsen/logrus/text_formatter_test.go

@@ -0,0 +1,87 @@
+package logrus
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestQuoting(t *testing.T) {
+	tf := &TextFormatter{DisableColors: true}
+
+	checkQuoting := func(q bool, value interface{}) {
+		b, _ := tf.Format(WithField("test", value))
+		idx := bytes.Index(b, ([]byte)("test="))
+		cont := bytes.Contains(b[idx+5:], []byte(tf.QuoteCharacter))
+		if cont != q {
+			if q {
+				t.Errorf("quoting expected for: %#v", value)
+			} else {
+				t.Errorf("quoting not expected for: %#v", value)
+			}
+		}
+	}
+
+	checkQuoting(false, "")
+	checkQuoting(false, "abcd")
+	checkQuoting(false, "v1.0")
+	checkQuoting(false, "1234567890")
+	checkQuoting(true, "/foobar")
+	checkQuoting(true, "x y")
+	checkQuoting(true, "x,y")
+	checkQuoting(false, errors.New("invalid"))
+	checkQuoting(true, errors.New("invalid argument"))
+
+	// Test for custom quote character.
+	tf.QuoteCharacter = "`"
+	checkQuoting(false, "")
+	checkQuoting(false, "abcd")
+	checkQuoting(true, "/foobar")
+	checkQuoting(true, errors.New("invalid argument"))
+
+	// Test for multi-character quotes.
+	tf.QuoteCharacter = "§~±"
+	checkQuoting(false, "abcd")
+	checkQuoting(true, errors.New("invalid argument"))
+
+	// Test for quoting empty fields.
+	tf.QuoteEmptyFields = true
+	checkQuoting(true, "")
+	checkQuoting(false, "abcd")
+	checkQuoting(true, errors.New("invalid argument"))
+}
+
+func TestTimestampFormat(t *testing.T) {
+	checkTimeStr := func(format string) {
+		customFormatter := &TextFormatter{DisableColors: true, TimestampFormat: format}
+		customStr, _ := customFormatter.Format(WithField("test", "test"))
+		timeStart := bytes.Index(customStr, ([]byte)("time="))
+		timeEnd := bytes.Index(customStr, ([]byte)("level="))
+		timeStr := customStr[timeStart+5+len(customFormatter.QuoteCharacter) : timeEnd-1-len(customFormatter.QuoteCharacter)]
+		if format == "" {
+			format = time.RFC3339
+		}
+		_, e := time.Parse(format, (string)(timeStr))
+		if e != nil {
+			t.Errorf("time string \"%s\" did not match provided time format \"%s\": %s", timeStr, format, e)
+		}
+	}
+
+	checkTimeStr("2006-01-02T15:04:05.000000000Z07:00")
+	checkTimeStr("Mon Jan _2 15:04:05 2006")
+	checkTimeStr("")
+}
+
+func TestDisableTimestampWithColoredOutput(t *testing.T) {
+	tf := &TextFormatter{DisableTimestamp: true, ForceColors: true}
+
+	b, _ := tf.Format(WithField("test", "test"))
+	if strings.Contains(string(b), "[0000]") {
+		t.Error("timestamp not expected when DisableTimestamp is true")
+	}
+}
+
+// TODO add tests for sorting etc., this requires a parser for the text
+// formatter output.

vendor/github.com/Sirupsen/logrus/writer.go

@@ -0,0 +1,62 @@
+package logrus
+
+import (
+	"bufio"
+	"io"
+	"runtime"
+)
+
+func (logger *Logger) Writer() *io.PipeWriter {
+	return logger.WriterLevel(InfoLevel)
+}
+
+func (logger *Logger) WriterLevel(level Level) *io.PipeWriter {
+	return NewEntry(logger).WriterLevel(level)
+}
+
+func (entry *Entry) Writer() *io.PipeWriter {
+	return entry.WriterLevel(InfoLevel)
+}
+
+func (entry *Entry) WriterLevel(level Level) *io.PipeWriter {
+	reader, writer := io.Pipe()
+
+	var printFunc func(args ...interface{})
+
+	switch level {
+	case DebugLevel:
+		printFunc = entry.Debug
+	case InfoLevel:
+		printFunc = entry.Info
+	case WarnLevel:
+		printFunc = entry.Warn
+	case ErrorLevel:
+		printFunc = entry.Error
+	case FatalLevel:
+		printFunc = entry.Fatal
+	case PanicLevel:
+		printFunc = entry.Panic
+	default:
+		printFunc = entry.Print
+	}
+
+	go entry.writerScanner(reader, printFunc)
+	runtime.SetFinalizer(writer, writerFinalizer)
+
+	return writer
+}
+
+func (entry *Entry) writerScanner(reader *io.PipeReader, printFunc func(args ...interface{})) {
+	scanner := bufio.NewScanner(reader)
+	for scanner.Scan() {
+		printFunc(scanner.Text())
+	}
+	if err := scanner.Err(); err != nil {
+		entry.Errorf("Error while reading from Writer: %s", err)
+	}
+	reader.Close()
+}
+
+func writerFinalizer(writer *io.PipeWriter) {
+	writer.Close()
+}

vendor/github.com/armon/go-radix/.gitignore

@@ -0,0 +1,22 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe

vendor/github.com/armon/go-radix/.travis.yml

@@ -0,0 +1,3 @@
+language: go
+go:
+  - tip

vendor/github.com/armon/go-radix/LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Armon Dadgar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

vendor/github.com/armon/go-radix/README.md

@@ -0,0 +1,38 @@
+go-radix [![Build Status](https://travis-ci.org/armon/go-radix.png)](https://travis-ci.org/armon/go-radix)
+=========
+
+Provides the `radix` package that implements a [radix tree](http://en.wikipedia.org/wiki/Radix_tree).
+The package only provides a single `Tree` implementation, optimized for sparse nodes.
+
+As a radix tree, it provides the following:
+ * O(k) operations. In many cases, this can be faster than a hash table since
+   the hash function is an O(k) operation, and hash tables have very poor cache locality.
+ * Minimum / Maximum value lookups
+ * Ordered iteration
+
+For an immutable variant, see [go-immutable-radix](https://github.com/hashicorp/go-immutable-radix).
+
+Documentation
+=============
+
+The full documentation is available on [Godoc](http://godoc.org/github.com/armon/go-radix).
+
+Example
+=======
+
+Below is a simple example of usage
+
+```go
+// Create a tree
+r := radix.New()
+r.Insert("foo", 1)
+r.Insert("bar", 2)
+r.Insert("foobar", 2)
+
+// Find the longest prefix match
+m, _, _ := r.LongestPrefix("foozip")
+if m != "foo" {
+    panic("should be foo")
+}
+```
+

vendor/github.com/armon/go-radix/radix.go

@@ -0,0 +1,496 @@
+package radix
+
+import (
+	"sort"
+	"strings"
+)
+
+// WalkFn is used when walking the tree. Takes a
+// key and value, returning if iteration should
+// be terminated.
+type WalkFn func(s string, v interface{}) bool
+
+// leafNode is used to represent a value
+type leafNode struct {
+	key string
+	val interface{}
+}
+
+// edge is used to represent an edge node
+type edge struct {
+	label byte
+	node  *node
+}
+
+type node struct {
+	// leaf is used to store possible leaf
+	leaf *leafNode
+
+	// prefix is the common prefix we ignore
+	prefix string
+
+	// Edges should be stored in-order for iteration.
+	// We avoid a fully materialized slice to save memory,
+	// since in most cases we expect to be sparse
+	edges edges
+}
+
+func (n *node) isLeaf() bool {
+	return n.leaf != nil
+}
+
+func (n *node) addEdge(e edge) {
+	n.edges = append(n.edges, e)
+	n.edges.Sort()
+}
+
+func (n *node) replaceEdge(e edge) {
+	num := len(n.edges)
+	idx := sort.Search(num, func(i int) bool {
+		return n.edges[i].label >= e.label
+	})
+	if idx < num && n.edges[idx].label == e.label {
+		n.edges[idx].node = e.node
+		return
+	}
+	panic("replacing missing edge")
+}
+
+func (n *node) getEdge(label byte) *node {
+	num := len(n.edges)
+	idx := sort.Search(num, func(i int) bool {
+		return n.edges[i].label >= label
+	})
+	if idx < num && n.edges[idx].label == label {
+		return n.edges[idx].node
+	}
+	return nil
+}
+
+func (n *node) delEdge(label byte) {
+	num := len(n.edges)
+	idx := sort.Search(num, func(i int) bool {
+		return n.edges[i].label >= label
+	})
+	if idx < num && n.edges[idx].label == label {
+		copy(n.edges[idx:], n.edges[idx+1:])
+		n.edges[len(n.edges)-1] = edge{}
+		n.edges = n.edges[:len(n.edges)-1]
+	}
+}
+
+type edges []edge
+
+func (e edges) Len() int {
+	return len(e)
+}
+
+func (e edges) Less(i, j int) bool {
+	return e[i].label < e[j].label
+}
+
+func (e edges) Swap(i, j int) {
+	e[i], e[j] = e[j], e[i]
+}
+
+func (e edges) Sort() {
+	sort.Sort(e)
+}
+
+// Tree implements a radix tree. This can be treated as a
+// Dictionary abstract data type. The main advantage over
+// a standard hash map is prefix-based lookups and
+// ordered iteration,
+type Tree struct {
+	root *node
+	size int
+}
+
+// New returns an empty Tree
+func New() *Tree {
+	return NewFromMap(nil)
+}
+
+// NewFromMap returns a new tree containing the keys
+// from an existing map
+func NewFromMap(m map[string]interface{}) *Tree {
+	t := &Tree{root: &node{}}
+	for k, v := range m {
+		t.Insert(k, v)
+	}
+	return t
+}
+
+// Len is used to return the number of elements in the tree
+func (t *Tree) Len() int {
+	return t.size
+}
+
+// longestPrefix finds the length of the shared prefix
+// of two strings
+func longestPrefix(k1, k2 string) int {
+	max := len(k1)
+	if l := len(k2); l < max {
+		max = l
+	}
+	var i int
+	for i = 0; i < max; i++ {
+		if k1[i] != k2[i] {
+			break
+		}
+	}
+	return i
+}
+
+// Insert is used to add a newentry or update
+// an existing entry. Returns if updated.
+func (t *Tree) Insert(s string, v interface{}) (interface{}, bool) {
+	var parent *node
+	n := t.root
+	search := s
+	for {
+		// Handle key exhaution
+		if len(search) == 0 {
+			if n.isLeaf() {
+				old := n.leaf.val
+				n.leaf.val = v
+				return old, true
+			}
+
+			n.leaf = &leafNode{
+				key: s,
+				val: v,
+			}
+			t.size++
+			return nil, false
+		}
+
+		// Look for the edge
+		parent = n
+		n = n.getEdge(search[0])
+
+		// No edge, create one
+		if n == nil {
+			e := edge{
+				label: search[0],
+				node: &node{
+					leaf: &leafNode{
+						key: s,
+						val: v,
+					},
+					prefix: search,
+				},
+			}
+			parent.addEdge(e)
+			t.size++
+			return nil, false
+		}
+
+		// Determine longest prefix of the search key on match
+		commonPrefix := longestPrefix(search, n.prefix)
+		if commonPrefix == len(n.prefix) {
+			search = search[commonPrefix:]
+			continue
+		}
+
+		// Split the node
+		t.size++
+		child := &node{
+			prefix: search[:commonPrefix],
+		}
+		parent.replaceEdge(edge{
+			label: search[0],
+			node:  child,
+		})
+
+		// Restore the existing node
+		child.addEdge(edge{
+			label: n.prefix[commonPrefix],
+			node:  n,
+		})
+		n.prefix = n.prefix[commonPrefix:]
+
+		// Create a new leaf node
+		leaf := &leafNode{
+			key: s,
+			val: v,
+		}
+
+		// If the new key is a subset, add to to this node
+		search = search[commonPrefix:]
+		if len(search) == 0 {
+			child.leaf = leaf
+			return nil, false
+		}
+
+		// Create a new edge for the node
+		child.addEdge(edge{
+			label: search[0],
+			node: &node{
+				leaf:   leaf,
+				prefix: search,
+			},
+		})
+		return nil, false
+	}
+}
+
+// Delete is used to delete a key, returning the previous
+// value and if it was deleted
+func (t *Tree) Delete(s string) (interface{}, bool) {
+	var parent *node
+	var label byte
+	n := t.root
+	search := s
+	for {
+		// Check for key exhaution
+		if len(search) == 0 {
+			if !n.isLeaf() {
+				break
+			}
+			goto DELETE
+		}
+
+		// Look for an edge
+		parent = n
+		label = search[0]
+		n = n.getEdge(label)
+		if n == nil {
+			break
+		}
+
+		// Consume the search prefix
+		if strings.HasPrefix(search, n.prefix) {
+			search = search[len(n.prefix):]
+		} else {
+			break
+		}
+	}
+	return nil, false
+
+DELETE:
+	// Delete the leaf
+	leaf := n.leaf
+	n.leaf = nil
+	t.size--
+
+	// Check if we should delete this node from the parent
+	if parent != nil && len(n.edges) == 0 {
+		parent.delEdge(label)
+	}
+
+	// Check if we should merge this node
+	if n != t.root && len(n.edges) == 1 {
+		n.mergeChild()
+	}
+
+	// Check if we should merge the parent's other child
+	if parent != nil && parent != t.root && len(parent.edges) == 1 && !parent.isLeaf() {
+		parent.mergeChild()
+	}
+
+	return leaf.val, true
+}
+
+func (n *node) mergeChild() {
+	e := n.edges[0]
+	child := e.node
+	n.prefix = n.prefix + child.prefix
+	n.leaf = child.leaf
+	n.edges = child.edges
+}
+
+// Get is used to lookup a specific key, returning
+// the value and if it was found
+func (t *Tree) Get(s string) (interface{}, bool) {
+	n := t.root
+	search := s
+	for {
+		// Check for key exhaution
+		if len(search) == 0 {
+			if n.isLeaf() {
+				return n.leaf.val, true
+			}
+			break
+		}
+
+		// Look for an edge
+		n = n.getEdge(search[0])
+		if n == nil {
+			break
+		}
+
+		// Consume the search prefix
+		if strings.HasPrefix(search, n.prefix) {
+			search = search[len(n.prefix):]
+		} else {
+			break
+		}
+	}
+	return nil, false
+}
+
+// LongestPrefix is like Get, but instead of an
+// exact match, it will return the longest prefix match.
+func (t *Tree) LongestPrefix(s string) (string, interface{}, bool) {
+	var last *leafNode
+	n := t.root
+	search := s
+	for {
+		// Look for a leaf node
+		if n.isLeaf() {
+			last = n.leaf
+		}
+
+		// Check for key exhaution
+		if len(search) == 0 {
+			break
+		}
+
+		// Look for an edge
+		n = n.getEdge(search[0])
+		if n == nil {
+			break
+		}
+
+		// Consume the search prefix
+		if strings.HasPrefix(search, n.prefix) {
+			search = search[len(n.prefix):]
+		} else {
+			break
+		}
+	}
+	if last != nil {
+		return last.key, last.val, true
+	}
+	return "", nil, false
+}
+
+// Minimum is used to return the minimum value in the tree
+func (t *Tree) Minimum() (string, interface{}, bool) {
+	n := t.root
+	for {
+		if n.isLeaf() {
+			return n.leaf.key, n.leaf.val, true
+		}
+		if len(n.edges) > 0 {
+			n = n.edges[0].node
+		} else {
+			break
+		}
+	}
+	return "", nil, false
+}
+
+// Maximum is used to return the maximum value in the tree
+func (t *Tree) Maximum() (string, interface{}, bool) {
+	n := t.root
+	for {
+		if num := len(n.edges); num > 0 {
+			n = n.edges[num-1].node
+			continue
+		}
+		if n.isLeaf() {
+			return n.leaf.key, n.leaf.val, true
+		}
+		break
+	}
+	return "", nil, false
+}
+
+// Walk is used to walk the tree
+func (t *Tree) Walk(fn WalkFn) {
+	recursiveWalk(t.root, fn)
+}
+
+// WalkPrefix is used to walk the tree under a prefix
+func (t *Tree) WalkPrefix(prefix string, fn WalkFn) {
+	n := t.root
+	search := prefix
+	for {
+		// Check for key exhaution
+		if len(search) == 0 {
+			recursiveWalk(n, fn)
+			return
+		}
+
+		// Look for an edge
+		n = n.getEdge(search[0])
+		if n == nil {
+			break
+		}
+
+		// Consume the search prefix
+		if strings.HasPrefix(search, n.prefix) {
+			search = search[len(n.prefix):]
+
+		} else if strings.HasPrefix(n.prefix, search) {
+			// Child may be under our search prefix
+			recursiveWalk(n, fn)
+			return
+		} else {
+			break
+		}
+	}
+
+}
+
+// WalkPath is used to walk the tree, but only visiting nodes
+// from the root down to a given leaf. Where WalkPrefix walks
+// all the entries *under* the given prefix, this walks the
+// entries *above* the given prefix.
+func (t *Tree) WalkPath(path string, fn WalkFn) {
+	n := t.root
+	search := path
+	for {
+		// Visit the leaf values if any
+		if n.leaf != nil && fn(n.leaf.key, n.leaf.val) {
+			return
+		}
+
+		// Check for key exhaution
+		if len(search) == 0 {
+			return
+		}
+
+		// Look for an edge
+		n = n.getEdge(search[0])
+		if n == nil {
+			return
+		}
+
+		// Consume the search prefix
+		if strings.HasPrefix(search, n.prefix) {
+			search = search[len(n.prefix):]
+		} else {
+			break
+		}
+	}
+}
+
+// recursiveWalk is used to do a pre-order walk of a node
+// recursively. Returns true if the walk should be aborted
+func recursiveWalk(n *node, fn WalkFn) bool {
+	// Visit the leaf values if any
+	if n.leaf != nil && fn(n.leaf.key, n.leaf.val) {
+		return true
+	}
+
+	// Recurse on the children
+	for _, e := range n.edges {
+		if recursiveWalk(e.node, fn) {
+			return true
+		}
+	}
+	return false
+}
+
+// ToMap is used to walk the tree and convert it into a map
+func (t *Tree) ToMap() map[string]interface{} {
+	out := make(map[string]interface{}, t.size)
+	t.Walk(func(k string, v interface{}) bool {
+		out[k] = v
+		return false
+	})
+	return out
+}

vendor/github.com/armon/go-radix/radix_test.go

@@ -0,0 +1,319 @@
+package radix
+
+import (
+	crand "crypto/rand"
+	"fmt"
+	"reflect"
+	"sort"
+	"testing"
+)
+
+func TestRadix(t *testing.T) {
+	var min, max string
+	inp := make(map[string]interface{})
+	for i := 0; i < 1000; i++ {
+		gen := generateUUID()
+		inp[gen] = i
+		if gen < min || i == 0 {
+			min = gen
+		}
+		if gen > max || i == 0 {
+			max = gen
+		}
+	}
+
+	r := NewFromMap(inp)
+	if r.Len() != len(inp) {
+		t.Fatalf("bad length: %v %v", r.Len(), len(inp))
+	}
+
+	r.Walk(func(k string, v interface{}) bool {
+		println(k)
+		return false
+	})
+
+	for k, v := range inp {
+		out, ok := r.Get(k)
+		if !ok {
+			t.Fatalf("missing key: %v", k)
+		}
+		if out != v {
+			t.Fatalf("value mis-match: %v %v", out, v)
+		}
+	}
+
+	// Check min and max
+	outMin, _, _ := r.Minimum()
+	if outMin != min {
+		t.Fatalf("bad minimum: %v %v", outMin, min)
+	}
+	outMax, _, _ := r.Maximum()
+	if outMax != max {
+		t.Fatalf("bad maximum: %v %v", outMax, max)
+	}
+
+	for k, v := range inp {
+		out, ok := r.Delete(k)
+		if !ok {
+			t.Fatalf("missing key: %v", k)
+		}
+		if out != v {
+			t.Fatalf("value mis-match: %v %v", out, v)
+		}
+	}
+	if r.Len() != 0 {
+		t.Fatalf("bad length: %v", r.Len())
+	}
+}
+
+func TestRoot(t *testing.T) {
+	r := New()
+	_, ok := r.Delete("")
+	if ok {
+		t.Fatalf("bad")
+	}
+	_, ok = r.Insert("", true)
+	if ok {
+		t.Fatalf("bad")
+	}
+	val, ok := r.Get("")
+	if !ok || val != true {
+		t.Fatalf("bad: %v", val)
+	}
+	val, ok = r.Delete("")
+	if !ok || val != true {
+		t.Fatalf("bad: %v", val)
+	}
+}
+
+func TestDelete(t *testing.T) {
+
+	r := New()
+
+	s := []string{"", "A", "AB"}
+
+	for _, ss := range s {
+		r.Insert(ss, true)
+	}
+
+	for _, ss := range s {
+		_, ok := r.Delete(ss)
+		if !ok {
+			t.Fatalf("bad %q", ss)
+		}
+	}
+}
+
+func TestLongestPrefix(t *testing.T) {
+	r := New()
+
+	keys := []string{
+		"",
+		"foo",
+		"foobar",
+		"foobarbaz",
+		"foobarbazzip",
+		"foozip",
+	}
+	for _, k := range keys {
+		r.Insert(k, nil)
+	}
+	if r.Len() != len(keys) {
+		t.Fatalf("bad len: %v %v", r.Len(), len(keys))
+	}
+
+	type exp struct {
+		inp string
+		out string
+	}
+	cases := []exp{
+		{"a", ""},
+		{"abc", ""},
+		{"fo", ""},
+		{"foo", "foo"},
+		{"foob", "foo"},
+		{"foobar", "foobar"},
+		{"foobarba", "foobar"},
+		{"foobarbaz", "foobarbaz"},
+		{"foobarbazzi", "foobarbaz"},
+		{"foobarbazzip", "foobarbazzip"},
+		{"foozi", "foo"},
+		{"foozip", "foozip"},
+		{"foozipzap", "foozip"},
+	}
+	for _, test := range cases {
+		m, _, ok := r.LongestPrefix(test.inp)
+		if !ok {
+			t.Fatalf("no match: %v", test)
+		}
+		if m != test.out {
+			t.Fatalf("mis-match: %v %v", m, test)
+		}
+	}
+}
+
+func TestWalkPrefix(t *testing.T) {
+	r := New()
+
+	keys := []string{
+		"foobar",
+		"foo/bar/baz",
+		"foo/baz/bar",
+		"foo/zip/zap",
+		"zipzap",
+	}
+	for _, k := range keys {
+		r.Insert(k, nil)
+	}
+	if r.Len() != len(keys) {
+		t.Fatalf("bad len: %v %v", r.Len(), len(keys))
+	}
+
+	type exp struct {
+		inp string
+		out []string
+	}
+	cases := []exp{
+		{
+			"f",
+			[]string{"foobar", "foo/bar/baz", "foo/baz/bar", "foo/zip/zap"},
+		},
+		{
+			"foo",
+			[]string{"foobar", "foo/bar/baz", "foo/baz/bar", "foo/zip/zap"},
+		},
+		{
+			"foob",
+			[]string{"foobar"},
+		},
+		{
+			"foo/",
+			[]string{"foo/bar/baz", "foo/baz/bar", "foo/zip/zap"},
+		},
+		{
+			"foo/b",
+			[]string{"foo/bar/baz", "foo/baz/bar"},
+		},
+		{
+			"foo/ba",
+			[]string{"foo/bar/baz", "foo/baz/bar"},
+		},
+		{
+			"foo/bar",
+			[]string{"foo/bar/baz"},
+		},
+		{
+			"foo/bar/baz",
+			[]string{"foo/bar/baz"},
+		},
+		{
+			"foo/bar/bazoo",
+			[]string{},
+		},
+		{
+			"z",
+			[]string{"zipzap"},
+		},
+	}
+
+	for _, test := range cases {
+		out := []string{}
+		fn := func(s string, v interface{}) bool {
+			out = append(out, s)
+			return false
+		}
+		r.WalkPrefix(test.inp, fn)
+		sort.Strings(out)
+		sort.Strings(test.out)
+		if !reflect.DeepEqual(out, test.out) {
+			t.Fatalf("mis-match: %v %v", out, test.out)
+		}
+	}
+}
+
+func TestWalkPath(t *testing.T) {
+	r := New()
+
+	keys := []string{
+		"foo",
+		"foo/bar",
+		"foo/bar/baz",
+		"foo/baz/bar",
+		"foo/zip/zap",
+		"zipzap",
+	}
+	for _, k := range keys {
+		r.Insert(k, nil)
+	}
+	if r.Len() != len(keys) {
+		t.Fatalf("bad len: %v %v", r.Len(), len(keys))
+	}
+
+	type exp struct {
+		inp string
+		out []string
+	}
+	cases := []exp{
+		{
+			"f",
+			[]string{},
+		},
+		{
+			"foo",
+			[]string{"foo"},
+		},
+		{
+			"foo/",
+			[]string{"foo"},
+		},
+		{
+			"foo/ba",
+			[]string{"foo"},
+		},
+		{
+			"foo/bar",
+			[]string{"foo", "foo/bar"},
+		},
+		{
+			"foo/bar/baz",
+			[]string{"foo", "foo/bar", "foo/bar/baz"},
+		},
+		{
+			"foo/bar/bazoo",
+			[]string{"foo", "foo/bar", "foo/bar/baz"},
+		},
+		{
+			"z",
+			[]string{},
+		},
+	}
+
+	for _, test := range cases {
+		out := []string{}
+		fn := func(s string, v interface{}) bool {
+			out = append(out, s)
+			return false
+		}
+		r.WalkPath(test.inp, fn)
+		sort.Strings(out)
+		sort.Strings(test.out)
+		if !reflect.DeepEqual(out, test.out) {
+			t.Fatalf("mis-match: %v %v", out, test.out)
+		}
+	}
+}
+
+// generateUUID is used to generate a random UUID
+func generateUUID() string {
+	buf := make([]byte, 16)
+	if _, err := crand.Read(buf); err != nil {
+		panic(fmt.Errorf("failed to read random bytes: %v", err))
+	}
+
+	return fmt.Sprintf("%08x-%04x-%04x-%04x-%12x",
+		buf[0:4],
+		buf[4:6],
+		buf[6:8],
+		buf[8:10],
+		buf[10:16])
+}

vendor/github.com/containernetworking/cni/.gitignore

@@ -0,0 +1,4 @@
+bin/
+gopath/
+*.sw[ponm]
+.vagrant

vendor/github.com/containernetworking/cni/.travis.yml

@@ -0,0 +1,41 @@
+language: go
+sudo: required
+dist: trusty
+
+go:
+  - 1.7.x
+  - 1.8.x
+
+env:
+  global:
+  - TOOLS_CMD=golang.org/x/tools/cmd
+  - PATH=$GOROOT/bin:$PATH
+  - GO15VENDOREXPERIMENT=1
+  matrix:
+  - TARGET=amd64
+  - TARGET=arm
+  - TARGET=arm64
+  - TARGET=ppc64le
+  - TARGET=s390x
+
+matrix:
+  fast_finish: true
+
+install:
+ - go get ${TOOLS_CMD}/cover
+ - go get github.com/modocache/gover
+ - go get github.com/mattn/goveralls
+
+script:
+ - >
+    if [ "${TARGET}" == "amd64" ]; then
+      GOARCH="${TARGET}" ./test.sh;
+    else
+      GOARCH="${TARGET}" ./build.sh;
+    fi
+
+notifications:
+  email: false
+
+git:
+  depth: 9999999

vendor/github.com/containernetworking/cni/CONTRIBUTING.md

@@ -0,0 +1,125 @@
+# How to Contribute
+
+CNI is [Apache 2.0 licensed](LICENSE) and accepts contributions via GitHub
+pull requests. This document outlines some of the conventions on development
+workflow, commit message formatting, contact points and other resources to make
+it easier to get your contribution accepted.
+
+We gratefully welcome improvements to documentation as well as to code.
+
+# Certificate of Origin
+
+By contributing to this project you agree to the Developer Certificate of
+Origin (DCO). This document was created by the Linux Kernel community and is a
+simple statement that you, as a contributor, have the legal right to make the
+contribution. See the [DCO](DCO) file for details.
+
+# Email and Chat
+
+The project uses the the cni-dev email list and IRC chat:
+- Email: [cni-dev](https://groups.google.com/forum/#!forum/cni-dev)
+- IRC: #[containernetworking](irc://irc.freenode.org:6667/#containernetworking) channel on freenode.org
+
+Please avoid emailing maintainers found in the MAINTAINERS file directly. They
+are very busy and read the mailing lists.
+
+## Getting Started
+
+- Fork the repository on GitHub
+- Read the [README](README.md) for build and test instructions
+- Play with the project, submit bugs, submit pull requests!
+
+## Contribution workflow
+
+This is a rough outline of how to prepare a contribution:
+
+- Create a topic branch from where you want to base your work (usually branched from master).
+- Make commits of logical units.
+- Make sure your commit messages are in the proper format (see below).
+- Push your changes to a topic branch in your fork of the repository.
+- If you changed code:
+   - add automated tests to cover your changes, using the [Ginkgo](http://onsi.github.io/ginkgo/) & [Gomega](http://onsi.github.io/gomega/) style
+   - if the package did not previously have any test coverage, add it to the list
+   of `TESTABLE` packages in the `test.sh` script.
+   - run the full test script and ensure it passes
+- Make sure any new code files have a license header (this is now enforced by automated tests)
+- Submit a pull request to the original repository.
+
+## How to run the test suite
+We generally require test coverage of any new features or bug fixes.
+
+Here's how you can run the test suite on any system (even Mac or Windows) using
+ [Vagrant](https://www.vagrantup.com/) and a hypervisor of your choice:
+
+```bash
+vagrant up
+vagrant ssh
+# you're now in a shell in a virtual machine
+sudo su
+cd /go/src/github.com/containernetworking/cni
+
+# to run the full test suite
+./test.sh
+
+# to focus on a particular test suite
+cd plugins/main/loopback
+go test
+```
+
+# Acceptance policy
+
+These things will make a PR more likely to be accepted:
+
+ * a well-described requirement
+ * tests for new code
+ * tests for old code!
+ * new code and tests follow the conventions in old code and tests
+ * a good commit message (see below)
+
+In general, we will merge a PR once two maintainers have endorsed it.
+Trivial changes (e.g., corrections to spelling) may get waved through.
+For substantial changes, more people may become involved, and you might get asked to resubmit the PR or divide the changes into more than one PR.
+
+### Format of the Commit Message
+
+We follow a rough convention for commit messages that is designed to answer two
+questions: what changed and why. The subject line should feature the what and
+the body of the commit should describe the why.
+
+```
+scripts: add the test-cluster command
+
+this uses tmux to setup a test cluster that you can easily kill and
+start for debugging.
+
+Fixes #38
+```
+
+The format can be described more formally as follows:
+
+```
+<subsystem>: <what changed>
+<BLANK LINE>
+<why this change was made>
+<BLANK LINE>
+<footer>
+```
+
+The first line is the subject and should be no longer than 70 characters, the
+second line is always blank, and other lines should be wrapped at 80 characters.
+This allows the message to be easier to read on GitHub as well as in various
+git tools.
+
+## 3rd party plugins
+So you've built a CNI plugin.  Where should it live?
+
+Short answer: We'd be happy to link to it from our [list of 3rd party plugins](README.md#3rd-party-plugins).
+But we'd rather you kept the code in your own repo.
+
+Long answer: An advantage of the CNI model is that independent plugins can be
+built, distributed and used without any code changes to this repository.  While
+some widely used plugins (and a few less-popular legacy ones) live in this repo,
+we're reluctant to add more.
+
+If you have a good reason why the CNI maintainers should take custody of your
+plugin, please open an issue or PR.

vendor/github.com/containernetworking/cni/CONVENTIONS.md

@@ -0,0 +1,102 @@
+# Extension conventions                                                        
+                                                                                 
+There are three ways of passing information to plugins using the Container Network Interface (CNI), none of which require the [spec](SPEC.md) to be updated. These are 
+- plugin specific fields in the JSON config
+- `args` field in the JSON config
+- `CNI_ARGS` environment variable 
+
+This document aims to provide guidance on which method should be used and to provide a convention for how common information should be passed.
+Establishing these conventions allows plugins to work across multiple runtimes. This helps both plugins and the runtimes.
+
+## Plugins
+* Plugin authors should aim to support these conventions where it makes sense for their plugin. This means they are more likely to "just work" with a wider range of runtimes.
+* Plugins should accept arguments according to these conventions if they implement the same basic functionality as other plugins. If plugins have shared functionality that isn't coverered by these conventions then a PR should be opened against this document.
+
+## Runtimes
+* Runtime authors should follow these conventions if they want to pass additional information to plugins. This will allow the extra information to be consumed by the widest range of plugins.
+* These conventions serve as an abstraction for the runtime. For example, port forwarding is highly implementation specific, but users should be able to select the plugin of their choice without changing the runtime.
+
+# Current conventions
+Additional conventions can be created by creating PRs which modify this document.
+
+## Plugin specific fields
+[Plugin specific fields](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration) formed part of the original CNI spec and have been present since the initial release.
+> Plugins may define additional fields that they accept and may generate an error if called with unknown fields. The exception to this is the args field may be used to pass arbitrary data which may be ignored by plugins.
+
+A plugin can define any additional fields it needs to work properly. It is expected that it will return an error if it can't act on fields that were expected or where the field values were malformed.
+
+This method of passing information to a plugin is recommended when the following conditions hold
+* The configuration has specific meaning to the plugin (i.e. it's not just general meta data)
+* the plugin is expected to act on the configuration or return an error if it can't
+
+Dynamic information (i.e. data that a runtime fills out) should be placed in a `runtimeConfig` section.
+
+| Area  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
+| ------ | ------ | ------             | ------  | ------                  | ------                 |  
+| port mappings | Pass mapping from ports on the host to ports in the container network namespace. | Operators can ask runtimes to pass port mapping information to plugins, by setting the following in the CNI config <pre>"capabilities": {"portMappings": true} </pre> Runtimes should fill in the actual port mappings when the config is passed to plugins. It should be placed in a new section of the config "runtimeConfig" e.g. <pre>"runtimeConfig": {<br />  "portMappings" : [<br />    { "hostPort": 8080, "containerPort": 80, "protocol": "tcp" },<br />    { "hostPort": 8000, "containerPort": 8001, "protocol": "udp" }<br />  ]<br />}</pre> | none | none |
+
+For example, the configuration for a port mapping plugin might look like this to an operator (it should be included as part of a [network configuration list](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration-lists).
+```json
+{
+  "name" : "ExamplePlugin",
+  "type" : "port-mapper",
+  "capabilities": {"portMappings": true}
+}
+```
+
+But the runtime would fill in the mappings so the plugin itself would receive something like this.
+```json
+{
+  "name" : "ExamplePlugin",
+  "type" : "port-mapper",
+  "runtimeConfig": {
+    "portMappings": [
+      {"hostPort": 8080, "containerPort": 80, "protocol": "tcp"}
+    ]
+  }
+}
+```
+
+## "args" in network config
+`args` in [network config](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration) were introduced as an optional field into the `0.1.0` CNI spec. The first CNI code release that it appeared in was `v0.4.0`. 
+> args (dictionary): Optional additional arguments provided by the container runtime. For example a dictionary of labels could be passed to CNI plugins by adding them to a labels field under args.
+
+`args` provide a way of providing more structured data than the flat strings that CNI_ARGS can support.
+
+`args` should be used for _optional_ meta-data. Runtimes can place additional data in `args` and plugins that don't understand that data should just ignore it. Runtimes should not require that a plugin understands or consumes that data provided, and so a runtime should not expect to receive an error if the data could not be acted on.
+
+This method of passing information to a plugin is recommended when the information is optional and the plugin can choose to ignore it. It's often that case that such information is passed to all plugins by the runtime whithout regard for whether the plugin can understand it. 
+
+The conventions documented here are all namepaced under `cni` so they don't conflict with any existing `args`.
+
+For example:
+```json
+{  
+   "cniVersion":"0.2.0",
+   "name":"net",
+   "args":{  
+      "cni":{  
+         "labels": [{"key": "app", "value": "myapp"}]
+      }
+   },
+   <REST OF CNI CONFIG HERE>
+   "ipam":{  
+     <IPAM CONFIG HERE>
+   }
+}
+```
+
+| Area  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
+| ------ | ------ | ------             | ------  | ------                  | ------                 |  
+| labels | Pass`key=value` labels to plugins | <pre>"labels" : [<br />  { "key" : "app", "value" : "myapp" },<br />  { "key" : "env", "value" : "prod" }<br />] </pre> | none | none |
+
+## CNI_ARGS
+CNI_ARGS formed part of the original CNI spec and have been present since the initial release.
+> `CNI_ARGS`: Extra arguments passed in by the user at invocation time. Alphanumeric key-value pairs separated by semicolons; for example, "FOO=BAR;ABC=123"
+
+The use of `CNI_ARGS` is deprecated and "args" should be used instead.
+
+| Field  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
+| ------ | ------ | ------             | ------  | ------                  | ------                 |  
+| IP     | Request a specific IP from IPAM plugins | IP=192.168.10.4 | *rkt* supports passing additional arguments to plugins and the [documentation](https://coreos.com/rkt/docs/latest/networking/overriding-defaults.html) suggests IP can be used. | host-local (since version v0.2.0) supports the field for IPv4 only - [documentation](https://github.com/containernetworking/cni/blob/master/Documentation/host-local.md#supported-arguments).|
+                                                                                                                  

vendor/github.com/containernetworking/cni/DCO

@@ -0,0 +1,36 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.

vendor/github.com/containernetworking/cni/Documentation/bridge.md

@@ -0,0 +1,42 @@
+# bridge plugin
+
+## Overview
+
+With bridge plugin, all containers (on the same host) are plugged into a bridge (virtual switch) that resides in the host network namespace.
+The containers receive one end of the veth pair with the other end connected to the bridge.
+An IP address is only assigned to one end of the veth pair -- one residing in the container.
+The bridge itself can also be assigned an IP address, turning it into a gateway for the containers.
+Alternatively, the bridge can function purely in L2 mode and would need to be bridged to the host network interface (if other than container-to-container communication on the same host is desired).
+
+The network configuration specifies the name of the bridge to be used.
+If the bridge is missing, the plugin will create one on first use and, if gateway mode is used, assign it an IP that was returned by IPAM plugin via the gateway field.
+
+## Example configuration
+```
+{
+	"name": "mynet",
+	"type": "bridge",
+	"bridge": "mynet0",
+	"isDefaultGateway": true,
+	"forceAddress": false,
+	"ipMasq": true,
+	"hairpinMode": true,
+	"ipam": {
+		"type": "host-local",
+		"subnet": "10.10.0.0/16"
+	}
+}
+```
+
+## Network configuration reference
+
+* `name` (string, required): the name of the network.
+* `type` (string, required): "bridge".
+* `bridge` (string, optional): name of the bridge to use/create. Defaults to "cni0".
+* `isGateway` (boolean, optional): assign an IP address to the bridge. Defaults to false.
+* `isDefaultGateway` (boolean, optional): Sets isGateway to true and makes the assigned IP the default route. Defaults to false.
+* `forceAddress` (boolean, optional): Indicates if a new IP address should be set if the previous value has been changed. Defaults to false.
+* `ipMasq` (boolean, optional): set up IP Masquerade on the host for traffic originating from this network and destined outside of it. Defaults to false.
+* `mtu` (integer, optional): explicitly set MTU to the specified value. Defaults to the value chosen by the kernel.
+* `hairpinMode` (boolean, optional): set hairpin mode for interfaces on the bridge. Defaults to false.
+* `ipam` (dictionary, required): IPAM configuration to be used for this network.

vendor/github.com/containernetworking/cni/Documentation/cnitool.md

@@ -0,0 +1,16 @@
+# Overview
+The `cnitool` is a utility that can be used to test a CNI plugin
+without the need for a container runtime. The `cnitool` takes a
+`network name` and a `network namespace` and a command to `ADD` or
+`DEL`,.i.e, attach or detach containers from a network. The `cnitool`
+relies on the following environment variables to operate properly:
+* `NETCONFPATH`: This environment variable needs to be set to a
+  directory. It defaults to `/etc/cni/net.d`. The `cnitool` searches
+  for CNI configuration files in this directory with the extension
+  `*.conf` or `*.json`. It loads all the CNI configuration files in
+  this directory and if it finds a CNI configuration with the `network
+  name` given to the cnitool it returns the corresponding CNI
+  configuration, else it returns `nil`.
+
+* `CNI_PATH`: For a given CNI configuration `cnitool` will search for
+  the corresponding CNI plugin in this path.

vendor/github.com/containernetworking/cni/Documentation/dhcp.md

@@ -0,0 +1,35 @@
+# dhcp plugin
+
+## Overview
+
+With dhcp plugin the containers can get an IP allocated by a DHCP server already running on your network.
+This can be especially useful with plugin types such as [macvlan](https://github.com/containernetworking/cni/blob/master/Documentation/macvlan.md).
+Because a DHCP lease must be periodically renewed for the duration of container lifetime, a separate daemon is required to be running.
+The same plugin binary can also be run in the daemon mode.
+
+## Operation
+To use the dhcp IPAM plugin, first launch the dhcp daemon:
+
+```
+# Make sure the unix socket has been removed
+$ rm -f /run/cni/dhcp.sock
+$ ./dhcp daemon
+```
+
+Alternatively, you can use systemd socket activation protocol.
+Be sure that the .socket file uses /run/cni/dhcp.sock as the socket path.
+
+With the daemon running, containers using the dhcp plugin can be launched.
+
+## Example configuration
+
+```
+{
+	"ipam": {
+		"type": "dhcp",
+	}
+}
+
+## Network configuration reference
+
+* `type` (string, required): "dhcp"

vendor/github.com/containernetworking/cni/Documentation/flannel.md

@@ -0,0 +1,88 @@
+# flannel plugin
+
+## Overview
+This plugin is designed to work in conjunction with [flannel](https://github.com/coreos/flannel), a network fabric for containers.
+When flannel daemon is started, it outputs a `/run/flannel/subnet.env` file that looks like this:
+```
+FLANNEL_NETWORK=10.1.0.0/16
+FLANNEL_SUBNET=10.1.17.1/24
+FLANNEL_MTU=1472
+FLANNEL_IPMASQ=true
+```
+
+This information reflects the attributes of flannel network on the host.
+The flannel CNI plugin uses this information to configure another CNI plugin, such as bridge plugin.
+
+## Operation
+Given the following network configuration file and the contents of `/run/flannel/subnet.env` above,
+```
+{
+	"name": "mynet",
+	"type": "flannel"
+}
+```
+the flannel plugin will generate another network configuration file:
+```
+{
+	"name": "mynet",
+	"type": "bridge",
+	"mtu": 1472,
+	"ipMasq": false,
+	"isGateway": true,
+	"ipam": {
+		"type": "host-local",
+		"subnet": "10.1.17.0/24"
+	}
+}
+```
+
+It will then invoke the bridge plugin, passing it the generated configuration.
+
+As can be seen from above, the flannel plugin, by default, will delegate to the bridge plugin.
+If additional configuration values need to be passed to the bridge plugin, it can be done so via the `delegate` field:
+```
+{
+	"name": "mynet",
+	"type": "flannel",
+	"delegate": {
+		"bridge": "mynet0",
+		"mtu": 1400
+	}
+}
+```
+
+This supplies a configuration parameter to the bridge plugin -- the created bridge will now be named `mynet0`.
+Notice that `mtu` has also been specified and this value will not be overwritten by flannel plugin.
+
+Additionally, the `delegate` field can be used to select a different kind of plugin altogether.
+To use `ipvlan` instead of `bridge`, the following configuration can be specified:
+
+```
+{
+	"name": "mynet",
+	"type": "flannel",
+	"delegate": {
+		"type": "ipvlan",
+		"master": "eth0"
+	}
+}
+```
+
+## Network configuration reference
+
+* `name` (string, required): the name of the network
+* `type` (string, required): "flannel"
+* `subnetFile` (string, optional): full path to the subnet file written out by flanneld. Defaults to /run/flannel/subnet.env
+* `dataDir` (string, optional): path to directory where plugin will store generated network configuration files. Defaults to `/var/lib/cni/flannel`
+* `delegate` (dictionary, optional): specifies configuration options for the delegated plugin.
+
+flannel plugin will always set the following fields in the delegated plugin configuration:
+
+* `name`: value of its "name" field.
+* `ipam`: "host-local" type will be used with "subnet" set to `$FLANNEL_SUBNET`.
+
+flannel plugin will set the following fields in the delegated plugin configuration if they are not present:
+* `ipMasq`: the inverse of `$FLANNEL_IPMASQ`
+* `mtu`: `$FLANNEL_MTU`
+
+Additionally, for the bridge plugin, `isGateway` will be set to `true`, if not present.

vendor/github.com/containernetworking/cni/Documentation/host-local.md

@@ -0,0 +1,82 @@
+# host-local IP address management plugin
+
+host-local IPAM allocates IPv4 and IPv6 addresses out of a specified address range. Optionally,
+it can include a DNS configuration from a `resolv.conf` file on the host.
+
+## Overview
+
+host-local IPAM plugin allocates IPv4 addresses out of a specified address range.
+It stores the state locally on the host filesystem, therefore ensuring uniqueness of IP addresses on a single host.
+
+## Example configurations
+
+IPv4:
+```json
+{
+	"ipam": {
+		"type": "host-local",
+		"subnet": "10.10.0.0/16",
+		"rangeStart": "10.10.1.20",
+		"rangeEnd": "10.10.3.50",
+		"gateway": "10.10.0.254",
+		"routes": [
+			{ "dst": "0.0.0.0/0" },
+			{ "dst": "192.168.0.0/16", "gw": "10.10.5.1" }
+		],
+		"dataDir": "/var/my-orchestrator/container-ipam-state"
+	}
+}
+```
+
+IPv6:
+```json
+{
+  "ipam": {
+		"type": "host-local",
+		"subnet": "3ffe:ffff:0:01ff::/64",
+		"rangeStart": "3ffe:ffff:0:01ff::0010",
+		"rangeEnd": "3ffe:ffff:0:01ff::0020",
+		"routes": [
+			{ "dst": "3ffe:ffff:0:01ff::1/64" }
+		],
+		"resolvConf": "/etc/resolv.conf"
+	}
+}
+```
+
+We can test it out on the command-line:
+
+```bash
+$ export CNI_COMMAND=ADD
+$ export CNI_CONTAINERID=f81d4fae-7dec-11d0-a765-00a0c91e6bf6
+$ echo '{ "name": "default", "ipam": { "type": "host-local", "subnet": "203.0.113.0/24" } }' | ./host-local
+```
+
+```json
+{
+    "ip4": {
+        "ip": "203.0.113.1/24"
+    }
+}
+```
+
+## Network configuration reference
+
+* `type` (string, required): "host-local".
+* `subnet` (string, required): CIDR block to allocate out of.
+* `rangeStart` (string, optional): IP inside of "subnet" from which to start allocating addresses. Defaults to ".2" IP inside of the "subnet" block.
+* `rangeEnd` (string, optional): IP inside of "subnet" with which to end allocating addresses. Defaults to ".254" IP inside of the "subnet" block.
+* `gateway` (string, optional): IP inside of "subnet" to designate as the gateway. Defaults to ".1" IP inside of the "subnet" block.
+* `routes` (string, optional): list of routes to add to the container namespace. Each route is a dictionary with "dst" and optional "gw" fields. If "gw" is omitted, value of "gateway" will be used.
+* `resolvConf` (string, optional): Path to a `resolv.conf` on the host to parse and return as the DNS configuration
+* `dataDir` (string, optional): Path to a directory to use for maintaining state, e.g. which IPs have been allocated to which containers
+
+
+## Supported arguments
+The following [CNI_ARGS](https://github.com/containernetworking/cni/blob/master/SPEC.md#parameters) are supported:
+
+* `ip`: request a specific IP address from the subnet. If it's not available, the plugin will exit with an error
+
+## Files
+
+Allocated IP addresses are stored as files in `/var/lib/cni/networks/$NETWORK_NAME`.  The prefix can be customized with the `dataDir` option listed above.

vendor/github.com/containernetworking/cni/Documentation/ipvlan.md

@@ -0,0 +1,40 @@
+# ipvlan plugin
+
+## Overview
+
+ipvlan is a new [addition](https://lwn.net/Articles/620087/) to the Linux kernel.
+Like its cousin macvlan, it virtualizes the host interface.
+However unlike macvlan which generates a new MAC address for each interface, ipvlan devices all share the same MAC.
+The kernel driver inspects the IP address of each packet when making a decision about which virtual interface should process the packet.
+
+Because all ipvlan interfaces share the MAC address with the host interface, DHCP can only be used in conjunction with ClientID (currently not supported by DHCP plugin).
+
+## Example configuration
+
+```
+{
+	"name": "mynet",
+	"type": "ipvlan",
+	"master": "eth0",
+	"ipam": {
+		"type": "host-local",
+		"subnet": "10.1.2.0/24"
+	}
+}
+```
+
+## Network configuration reference
+
+* `name` (string, required): the name of the network.
+* `type` (string, required): "ipvlan".
+* `master` (string, required): name of the host interface to enslave.
+* `mode` (string, optional): one of "l2", "l3". Defaults to "l2".
+* `mtu` (integer, optional): explicitly set MTU to the specified value. Defaults to the value chosen by the kernel.
+* `ipam` (dictionary, required): IPAM configuration to be used for this network.
+
+## Notes
+
+* `ipvlan` does not allow virtual interfaces to communicate with the master interface.
+Therefore the container will not be able to reach the host via `ipvlan` interface.
+Be sure to also have container join a network that provides connectivity to the host (e.g. `ptp`).
+* A single master interface can not be enslaved by both `macvlan` and `ipvlan`.

vendor/github.com/containernetworking/cni/Documentation/macvlan.md

@@ -0,0 +1,34 @@
+# macvlan plugin
+
+## Overview
+
+[macvlan](http://backreference.org/2014/03/20/some-notes-on-macvlanmacvtap/) functions like a switch that is already connected to the host interface.
+A host interface gets "enslaved" with the virtual interfaces sharing the physical device but having distinct MAC addresses.
+Since each macvlan interface has its own MAC address, it makes it easy to use with existing DHCP servers already present on the network.
+
+## Example configuration
+
+```
+{
+	"name": "mynet",
+	"type": "macvlan",
+	"master": "eth0",
+	"ipam": {
+		"type": "dhcp"
+	}
+}
+```
+
+## Network configuration reference
+
+* `name` (string, required): the name of the network
+* `type` (string, required): "macvlan"
+* `master` (string, required): name of the host interface to enslave
+* `mode` (string, optional): one of "bridge", "private", "vepa", "passthrough". Defaults to "bridge".
+* `mtu` (integer, optional): explicitly set MTU to the specified value. Defaults to the value chosen by the kernel.
+* `ipam` (dictionary, required): IPAM configuration to be used for this network.
+
+## Notes
+
+* If are testing on a laptop, please remember that most wireless cards do not support being enslaved by macvlan.
+* A single master interface can not be enslaved by both `macvlan` and `ipvlan`.

vendor/github.com/containernetworking/cni/Documentation/ptp.md

@@ -0,0 +1,32 @@
+# ptp plugin
+
+## Overview
+The ptp plugin creates a point-to-point link between a container and the host by using a veth device.
+One end of the veth pair is placed inside a container and the other end resides on the host.
+The host-local IPAM plugin can be used to allocate an IP address to the container.
+The traffic of the container interface will be routed through the interface of the host.
+
+## Example network configuration
+
+```
+{
+	"name": "mynet",
+	"type": "ptp",
+	"ipam": {
+		"type": "host-local",
+		"subnet": "10.1.1.0/24"
+	},
+	"dns": {
+		"nameservers": [ "10.1.1.1", "8.8.8.8" ]
+	}
+}
+```
+
+## Network configuration reference
+
+* `name` (string, required): the name of the network
+* `type` (string, required): "ptp"
+* `ipMasq` (boolean, optional): set up IP Masquerade on the host for traffic originating from this network and destined outside of it. Defaults to false.
+* `mtu` (integer, optional): explicitly set MTU to the specified value. Defaults to value chosen by the kernel.
+* `ipam` (dictionary, required): IPAM configuration to be used for this network.
+* `dns` (dictionary, optional): DNS information to return as described in the [Result](/SPEC.md#result).

vendor/github.com/containernetworking/cni/Documentation/spec-upgrades.md

@@ -0,0 +1,259 @@
+# How to upgrade to CNI Specification v0.3.1
+
+The 0.3.0 specification contained a small error. The Result structure's `ip` field should have been renamed to `ips` to be consistent with the IPAM result structure definition; this rename was missed when updating the Result to accommodate multiple IP addresses and interfaces. All first-party CNI plugins (bridge, host-local, etc) were updated to use `ips` (and thus be inconsistent with the 0.3.0 specification) and most other plugins have not been updated to the 0.3.0 specification yet, so few (if any) users should be impacted by this change.
+
+The 0.3.1 specification corrects the Result structure to use the `ips` field name as originally intended.  This is the only change between 0.3.0 and 0.3.1.
+
+# How to upgrade to CNI Specification v0.3.0
+
+Version 0.3.0 of the [CNI Specification](../SPEC.md) provides rich information
+about container network configuration, including details of network interfaces
+and support for multiple IP addresses.
+
+To support this new data, the specification changed in a couple significant
+ways that will impact CNI users, plugin authors, and runtime authors.
+
+This document provides guidance for how to upgrade:
+
+- [For CNI Users](#for-cni-users)
+- [For Plugin Authors](#for-plugin-authors)
+- [For Runtime Authors](#for-runtime-authors)
+
+**Note**: the CNI Spec is versioned independently from the GitHub releases
+for this repo.  For example, Release v0.4.0 supports Spec version v0.2.0,
+and Release v0.5.0 supports Spec v0.3.0.
+
+----
+
+## For CNI Users
+If you maintain CNI configuration files for a container runtime that uses CNI,
+ensure that the configuration files specify a `cniVersion` field and that the
+version there is supported by your container runtime and CNI plugins.
+Configuration files without a version field should be given version 0.2.0. 
+The CNI spec includes example configuration files for 
+[single plugins](https://github.com/containernetworking/cni/blob/master/SPEC.md#example-configurations)
+and for [lists of chained plugins](https://github.com/containernetworking/cni/blob/master/SPEC.md#example-configurations).
+
+Consult the documentation for your runtime and plugins to determine what
+CNI spec versions they support. Test any plugin upgrades before deploying to 
+production. You may find [cnitool](https://github.com/containernetworking/cni/tree/master/cnitool)
+useful. Specifically, your configuration version should be the lowest common
+version supported by your plugins.
+
+## For Plugin Authors
+This section provides guidance for upgrading plugins to CNI Spec Version 0.3.0.
+
+### General guidance for all plugins (language agnostic)
+To provide the smoothest upgrade path, **existing plugins should support
+multiple versions of the CNI spec**.  In particular, plugins with existing
+installed bases should add support for CNI spec version 0.3.0 while maintaining
+compatibility with older versions.
+
+To do this, two changes are required.  First, a plugin should advertise which
+CNI spec versions it supports.  It does this by responding to the `VERSION`
+command with the following JSON data:
+
+```json
+{
+  "cniVersion": "0.3.0",
+  "supportedVersions": [ "0.1.0", "0.2.0", "0.3.0" ]
+}
+```
+
+Second, for the `ADD` command, a plugin must respect the `cniVersion` field
+provided in the [network configuration JSON](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration). 
+That field is a request for the plugin to return results of a particular format:
+
+- If the `cniVersion` field is not present, then spec v0.2.0 should be assumed
+	and v0.2.0 format result JSON returned.
+
+- If the plugin doesn't support the version, the plugin must error.
+
+- Otherwise, the plugin must return a [CNI Result](https://github.com/containernetworking/cni/blob/master/SPEC.md#result)
+	in the format requested.
+
+Result formats for older CNI spec versions are available in the
+[git history for SPEC.md](https://github.com/containernetworking/cni/commits/master/SPEC.md).
+
+For example, suppose a plugin, via its `VERSION` response, advertises CNI specification
+support for v0.2.0 and v0.3.0.  When it receives `cniVersion` key of `0.2.0`,
+the plugin must return result JSON conforming to CNI spec version 0.2.0.
+
+### Specific guidance for plugins written in Go
+Plugins written in Go may leverage the Go language packages in this repository
+to ease the process of upgrading and supporting multiple versions.  CNI 
+[Library and Plugins Release v0.5.0](https://github.com/containernetworking/cni/releases)
+includes important changes to the Golang APIs.  Plugins using these APIs will
+require some changes now, but should more-easily handle spec changes and
+new features going forward.
+
+For plugin authors, the biggest change is that `types.Result` is now an
+interface implemented by concrete struct types in the `types/current` and
+`types/020` subpackages.
+
+Internally, plugins should use the `types/current` structs, and convert
+to or from specific versions when required.  A typical plugin will only need
+to do a single conversion.  That is when it is about to complete and needs to
+print the result JSON in the correct format to stdout.  The library
+function `types.PrintResult()` simplifies this by converting and printing in
+a single call.
+
+Additionally, the plugin should advertise which CNI Spec versions it supports
+via the 3rd argument to `skel.PluginMain()`.
+
+Here is some example code
+
+```go
+import (
+	 "github.com/containernetworking/cni/pkg/skel"
+	 "github.com/containernetworking/cni/pkg/types"
+	 "github.com/containernetworking/cni/pkg/types/current"
+	 "github.com/containernetworking/cni/pkg/version"
+)
+
+func cmdAdd(args *skel.CmdArgs) error {
+	// determine spec version to use
+	var netConf struct {
+		types.NetConf
+		// other plugin-specific configuration goes here
+	}
+	err := json.Unmarshal(args.StdinData, &netConf)
+	cniVersion := netConf.CNIVersion
+
+	// plugin does its work...
+	//   set up interfaces
+	//   assign addresses, etc
+	
+	// construct the result
+	result := &current.Result{
+		Interfaces: []*current.Interface{ ... },
+		IPs: []*current.IPs{ ... },
+		...
+	}
+	
+	// print result to stdout, in the format defined by the requested cniVersion
+	return types.PrintResult(result, cniVersion)
+}
+
+func main() {
+	skel.PluginMain(cmdAdd, cmdDel, version.PluginSupports("0.1.0", "0.2.0", "0.3.0"))
+}
+```
+
+Alternately, to use the result from a delegated IPAM plugin, the `result`
+value might be formed like this:
+
+```go
+ipamResult, err := ipam.ExecAdd(netConf.IPAM.Type, args.StdinData)
+result, err := current.NewResultFromResult(ipamResult)
+```
+
+Other examples of spec v0.3.0-compatible plugins are the
+[main plugins in this repo](https://github.com/containernetworking/cni/tree/master/plugins/main)
+
+
+## For Runtime Authors
+
+This section provides guidance for upgrading container runtimes to support
+CNI Spec Version 0.3.0.
+
+### General guidance for all runtimes (language agnostic)
+
+#### Support multiple CNI spec versions
+To provide the smoothest upgrade path and support the broadest range of CNI
+plugins, **container runtimes should support multiple versions of the CNI spec**.
+In particular, runtimes with existing installed bases should add support for CNI
+spec version 0.3.0 while maintaining compatibility with older versions.
+
+To support multiple versions of the CNI spec, runtimes should be able to
+call both new and legacy plugins, and handle the results from either.
+
+When calling a plugin, the runtime must request that the plugin respond in a
+particular format by specifying the `cniVersion` field in the
+[Network Configuration](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration)
+JSON block.  The plugin will then respond with
+a [Result](https://github.com/containernetworking/cni/blob/master/SPEC.md#result)
+in the format defined by that CNI spec version, and the runtime must parse
+and handle this result.
+
+#### Handle errors due to version incompatibility
+Plugins may respond with error indicating that they don't support the requested
+CNI version (see [Well-known Error Codes](https://github.com/containernetworking/cni/blob/master/SPEC.md#well-known-error-codes)),
+e.g.
+```json
+{
+  "cniVersion": "0.2.0",
+  "code": 1,
+  "msg": "CNI version not supported"
+}
+```
+In that case, the runtime may retry with a lower CNI spec version, or take
+some other action.
+
+#### (optional) Discover plugin version support
+Runtimes may discover which CNI spec versions are supported by a plugin, by
+calling the plugin with the `VERSION` command.  The `VERSION` command was
+added in CNI spec v0.2.0, so older plugins may not respect it.  In the absence
+of a successful response to `VERSION`, assume that the plugin only supports
+CNI spec v0.1.0.
+
+#### Handle missing data in v0.3.0 results
+The Result for the `ADD` command in CNI spec version 0.3.0 includes a new field
+`interfaces`.  An IP address in the `ip` field may describe which interface
+it is assigned to, by placing a numeric index in the `interface` subfield.
+
+However, some plugins which are v0.3.0 compatible may nonetheless omit the
+`interfaces` field and/or set the `interface` index value to `-1`.  Runtimes
+should gracefully handle this situation, unless they have good reason to rely
+on the existence of the interface data.  In that case, provide the user an
+error message that helps diagnose the issue.
+
+### Specific guidance for container runtimes written in Go
+Container runtimes written in Go may leverage the Go language packages in this
+repository to ease the process of upgrading and supporting multiple versions.
+CNI [Library and Plugins Release v0.5.0](https://github.com/containernetworking/cni/releases)
+includes important changes to the Golang APIs.  Runtimes using these APIs will
+require some changes now, but should more-easily handle spec changes and
+new features going forward.
+
+For runtimes, the biggest changes to the Go libraries are in the `types` package.
+It has been refactored to make working with versioned results simpler. The top-level 
+`types.Result` is now an opaque interface instead of a struct, and APIs exposed by
+other packages, such as the high-level `libcni` package, have been updated to use 
+this interface.  Concrete types are now per-version subpackages. The `types/current`
+subpackage contains the latest (spec v0.3.0) types.
+
+When up-converting older result types to spec v0.3.0, fields new in
+spec v0.3.0 (like `interfaces`) may be empty.  Conversely, when
+down-converting v0.3.0 results to an older version, any data in those fields
+will be lost.
+
+| From   | 0.1 | 0.2 | 0.3 |
+|--------|-----|-----|-----|
+| To 0.1 |  ✔  |  ✔  |  x  |
+| To 0.2 |  ✔  |  ✔  |  x  |
+| To 0.3 |  ✴  |  ✴  |  ✔  |
+
+
+Key:
+> ✔ : lossless conversion <br>
+> ✴ : higher-version output may have empty fields <br>
+> x : lower-version output is missing some data <br>
+
+
+
+A container runtime should use `current.NewResultFromResult()` to convert the
+opaque  `types.Result` to a concrete `current.Result` struct.  It may then
+work with the fields exposed by that struct:
+
+```go
+// runtime invokes the plugin to get the opaque types.Result
+// this may conform to any CNI spec version
+resultInterface, err := libcni.AddNetwork(netConf, runtimeConf)
+
+// upconvert result to the current 0.3.0 spec
+result, err := current.NewResultFromResult(resultInterface)
+
+// use the result fields ....
+for _, ip := range result.IPs { ... }
+```

vendor/github.com/containernetworking/cni/Documentation/tuning.md

@@ -0,0 +1,34 @@
+# tuning plugin
+
+## Overview
+
+This plugin can change some system controls (sysctls) in the network namespace.
+It does not create any network interfaces and therefore does not bring connectivity by itself.
+It is only useful when used in addition to other plugins.
+
+## Operation
+The following network configuration file
+```
+{
+  "name": "mytuning",
+  "type": "tuning",
+  "sysctl": {
+          "net.core.somaxconn": "500"
+  }
+}
+```
+will set /proc/sys/net/core/somaxconn to 500.
+Other sysctls can be modified as long as they belong to the network namespace (`/proc/sys/net/*`).
+
+A successful result would simply be:
+```
+{ }
+```
+
+## Network sysctls documentation
+
+Some network sysctls are documented in the Linux sources:
+
+- [Documentation/sysctl/net.txt](https://www.kernel.org/doc/Documentation/sysctl/net.txt)
+- [Documentation/networking/ip-sysctl.txt](https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt)
+- [Documentation/networking/](https://www.kernel.org/doc/Documentation/networking/)

vendor/github.com/containernetworking/cni/Godeps/Godeps.json

@@ -0,0 +1,194 @@
+{
+	"ImportPath": "github.com/containernetworking/cni",
+	"GoVersion": "go1.6",
+	"GodepVersion": "v79",
+	"Packages": [
+		"./..."
+	],
+	"Deps": [
+		{
+			"ImportPath": "github.com/coreos/go-iptables/iptables",
+			"Comment": "v0.1.0",
+			"Rev": "fbb73372b87f6e89951c2b6b31470c2c9d5cfae3"
+		},
+		{
+			"ImportPath": "github.com/coreos/go-systemd/activation",
+			"Comment": "v2-53-g2688e91",
+			"Rev": "2688e91251d9d8e404e86dd8f096e23b2f086958"
+		},
+		{
+			"ImportPath": "github.com/d2g/dhcp4",
+			"Rev": "f0e4d29ff0231dce36e250b2ed9ff08412584bca"
+		},
+		{
+			"ImportPath": "github.com/d2g/dhcp4client",
+			"Rev": "bed07e1bc5b85f69c6f0fd73393aa35ec68ed892"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/config",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/extensions/table",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/codelocation",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/containernode",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/failer",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/leafnodes",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/remote",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/spec",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/specrunner",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/suite",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/testingtproxy",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/internal/writer",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/reporters",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/reporters/stenographer",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/ginkgo/types",
+			"Comment": "v1.2.0-29-g7f8ab55",
+			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/format",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/gbytes",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/gexec",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/internal/assertion",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/internal/asyncassertion",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/internal/oraclematcher",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/internal/testingtsupport",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/matchers",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/bipartitegraph",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/edge",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/node",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/util",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/onsi/gomega/types",
+			"Comment": "v1.0-71-g2152b45",
+			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
+		},
+		{
+			"ImportPath": "github.com/vishvananda/netlink",
+			"Rev": "fe3b5664d23a11b52ba59bece4ff29c52772a56b"
+		},
+		{
+			"ImportPath": "github.com/vishvananda/netlink/nl",
+			"Rev": "fe3b5664d23a11b52ba59bece4ff29c52772a56b"
+		},
+		{
+			"ImportPath": "github.com/vishvananda/netns",
+			"Rev": "8ba1072b58e0c2a240eb5f6120165c7776c3e7b8"
+		},
+		{
+			"ImportPath": "golang.org/x/sys/unix",
+			"Rev": "076b546753157f758b316e59bcb51e6807c04057"
+		}
+	]
+}

vendor/github.com/containernetworking/cni/Godeps/Readme

@@ -0,0 +1,5 @@
+This directory tree is generated automatically by godep.
+
+Please do not edit.
+
+See https://github.com/tools/godep for more information.

vendor/github.com/containernetworking/cni/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+