# vim: tabstop=4 shiftwidth=4 softtabstop=4

# Copyright 2012 VMware, Inc.  All rights reserved.

#

# Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.

#

#    Licensed under the Apache License, Version 2.0 (the "License"); you may

#    not use this file except in compliance with the License. You may obtain

#    a copy of the License at

#

#         http://www.apache.org/licenses/LICENSE-2.0

#

#    Unless required by applicable law or agreed to in writing, software

#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT

#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the

#    License for the specific language governing permissions and limitations

#    under the License.

#

"""

"""

import errno

import netaddr

from oslo_log import log as logging

from neutron.agent.common import ovs_lib

from neutron.agent.l3 import agent as l3_agent

from neutron.agent.l3 import router_info as router

from neutron.agent.linux import utils

from neutron.agent.solaris import interface

from neutron.agent.solaris import net_lib

from neutron.agent.solaris import packetfilter

from neutron.agent.solaris import ra

from neutron.callbacks import events

from neutron.callbacks import registry

from neutron.callbacks import resources

from neutron.common import constants as l3_constants

from neutron.common import exceptions as n_exc

from neutron.common import utils as common_utils

from neutron_vpnaas.services.vpn import vpn_service

import neutron_vpnaas.services.vpn.agent as neutron_vpnaas

LOG = logging.getLogger(__name__)

INTERNAL_DEV_PREFIX = 'l3i'

EXTERNAL_DEV_PREFIX = 'l3e'

FLOATING_IP_CIDR_SUFFIX = '/32'

class SolarisRouterInfo(router.RouterInfo):

    def __init__(self, router_id, router, agent_conf, interface_driver,

                 use_ipv6=False):

        super(SolarisRouterInfo, self).__init__(router_id, router, agent_conf,

                                                interface_driver, use_ipv6)

        self.pf = packetfilter.PacketFilter("_auto/neutron:l3:agent")

        self.iptables_manager = None

        self.remove_route = False

        self.ipnet_gwportname = dict()

        self.tenant_subnets = dict()

        self.tenant_subnets['all_tenants'] = set()

    def initialize(self, process_monitor):

        """Initialize the router on the system.

        This differs from __init__ in that this method actually affects the

        system creating namespaces, starting processes, etc.  The other merely

        initializes the python object.  This separates in-memory object

        initialization from methods that actually go do stuff to the system.

        :param process_monitor: The agent's process monitor instance.

        """

        self.process_monitor = process_monitor

        self.radvd = ra.NDPD(self.router_id, self.get_internal_device_name)

    def get_internal_device_name(self, port_id):

        # Because of the way how dnsmasq works on Solaris, the length

        # of datalink name cannot exceed 16 (includes terminating nul

        # character). So, the linkname can only have 15 characters and

        # the last two characters are set aside for '_0'. So, we only

        # have 13 characters left.

        dname = (INTERNAL_DEV_PREFIX + port_id)[:13]

        dname += '_0'

        return dname.replace('-', '_')

    def get_external_device_name(self, port_id):

        # please see the comment above

        dname = (EXTERNAL_DEV_PREFIX + port_id)[:13]

        dname += '_0'

        return dname.replace('-', '_')

    def internal_network_added(self, port):

        internal_dlname = self.get_internal_device_name(port['id'])

        # driver just returns if datalink and IP interface already exists

        self.driver.plug(port['tenant_id'], port['network_id'], port['id'],

                         internal_dlname, port['mac_address'],

                         vif_type=port.get('binding:vif_type'))

        fixed_ips = port['fixed_ips']

        ip_cidrs = common_utils.fixed_ip_cidrs(fixed_ips)

        self.driver.init_l3(internal_dlname, ip_cidrs)

        for fixed_ip in fixed_ips:

            net_lib.send_ip_addr_adv_notif(internal_dlname,

                                           fixed_ip['ip_address'],

                                           self.agent_conf)

        port_subnet = port['subnets'][0]['cidr']

        ipversion = netaddr.IPNetwork(port_subnet).version

        rules = []

        # if metadata is enabled, then we need to redirect all the packets

        # arriving at 169.254.169.254:80 to neutron-metadata-proxy server

        # listening at self.agent_conf.metadata_port

        if self.agent_conf.enable_metadata_proxy and ipversion == 4:

            rules.append('pass in quick proto tcp to 169.254.169.254/32 '

        # Since we support shared router model, we need to block the new

        # internal port from reaching other tenant's ports. However, if

        # allow_forwarding_between_networks is set, then we need to

        # allow forwarding of packets between same tenant's ports.

        block_tblname = 'block_%s' % internal_dlname

        rules.append('block in quick to <%s> label %s' %

                     (block_tblname, block_tblname))

        if self.agent_conf.allow_forwarding_between_networks:

            allow_tblname = 'allow_%s' % internal_dlname

            rules.append('pass in quick to <%s> reply-to %s label %s' %

                         (allow_tblname, internal_dlname, allow_tblname))

        # finally add all the rules in one shot

        self.pf.add_rules(rules, [internal_dlname, 'normal'])

        ex_gw_port = self.ex_gw_port

        if not ex_gw_port:

            return

        ex_gw_ip = ex_gw_port['subnets'][0]['gateway_ip']

        if not ex_gw_ip:

            return

        if netaddr.IPAddress(ex_gw_ip).version != 4 or ipversion != 4:

            return

        # if the external gateway is already setup for the shared router,

        # then we need to add Policy Based Routing (PBR) for both inbound

        # and outbound for this internal network

        external_dlname = self.get_external_device_name(ex_gw_port['id'])

        label = 'pbr_%s' % internal_dlname

        pbr_rules = ['pass in quick to !%s route-to {(%s %s)} label %s_in' %

                     (port_subnet, external_dlname, ex_gw_ip, label)]

        pbr_rules.append('pass out quick received-on %s reply-to %s@%s '

                         'label %s_out' % (external_dlname, ex_gw_ip,

                                           external_dlname, label))

        self.pf.add_rules(pbr_rules, [internal_dlname, 'pbr'])

        if self._snat_enabled:

            ex_gw_port_ip = ex_gw_port['fixed_ips'][0]['ip_address']

            label = 'snat_%s' % internal_dlname

            snat_rule = ('pass out quick from %s to any nat-to %s label %s '

                         'reply-to %s' % (port_subnet, ex_gw_port_ip, label,

                                          internal_dlname))

            self.pf.add_rules([snat_rule], [external_dlname, internal_dlname])

    def internal_network_removed(self, port):

        internal_dlname = self.get_internal_device_name(port['id'])

        # remove the anchor and tables associated with this internal port

        self.pf.remove_anchor_recursively([internal_dlname])

        if self.ex_gw_port and self._snat_enabled:

            external_dlname = self.\

                get_external_device_name(self.ex_gw_port['id'])

            self.pf.remove_anchor_recursively([external_dlname,

                                               internal_dlname])

        if net_lib.Datalink.datalink_exists(internal_dlname):

            self.driver.unplug(internal_dlname)

    def _apply_common_rules(self, all_subnets, internal_ports):

        v4_subnets = [subnet for subnet in all_subnets

                      if netaddr.IPNetwork(subnet).version == 4]

        if not v4_subnets:

            return

        # add rule for metadata and broadcast

        allsubnets_tblname = "all_v4_subnets"

        common_aname = "common"

        self.pf.replace_table_entry(allsubnets_tblname, v4_subnets,

                                    [common_aname])

        rules = []

        # don't forward broadcast packets out of the internal subnet

        rules.append('pass in quick from <%s> to 255.255.255.255 label '

                     '%s_bcast' % (allsubnets_tblname, common_aname))

        self.pf.add_rules(rules, [common_aname])

    def _pre_setup_pf_rules(self, new_ports, old_ports, internal_ports):

        """We are going to do some amount of book keeping (for later use) and

        also pre-setup PF skeleton rules ahead of time to improve PF setup

        time.

        """

        # Process PF anchor rules for internal ports in bulk as this

        # significantly improves the PF setup time. Capture the anchor

        # rules that will be placed under _auto/neutron:l3:agent.

        new_anchor_rules = set()

        for p in new_ports:

            port_id = p['id']

            tenant_id = p['tenant_id']

            subnet = p['subnets'][0]['cidr']

            internal_dlname = self.get_internal_device_name(port_id)

            anchor_rule = 'anchor "%s/*" on %s all' % (internal_dlname,

                                                       internal_dlname)

            new_anchor_rules.add(anchor_rule)

            ipnet = netaddr.IPNetwork(subnet)

            if ipnet.version == 4:

                self.ipnet_gwportname[ipnet] = internal_dlname

            # Capture all the subnets across all tenants and subnets

            # per-tenant. We will setup PF tables for each internal network

            # ahead of time

            self.tenant_subnets['all_tenants'].add(subnet)

            if tenant_id not in self.tenant_subnets:

                self.tenant_subnets[tenant_id] = set()

            self.tenant_subnets[tenant_id].add(subnet)

        old_anchor_rules = set()

        for p in old_ports:

            port_id = p['id']

            tenant_id = p['tenant_id']

            subnet = p['subnets'][0]['cidr']

            internal_dlname = self.get_internal_device_name(port_id)

            anchor_rule = 'anchor "%s/*" on %s all' % (internal_dlname,

                                                       internal_dlname)

            old_anchor_rules.add(anchor_rule)

            ipnet = netaddr.IPNetwork(subnet)

            if ipnet.version == 4:

                self.ipnet_gwportname.pop(ipnet, None)

            self.tenant_subnets['all_tenants'].discard(subnet)

            if tenant_id in self.tenant_subnets:

                self.tenant_subnets[tenant_id].discard(subnet)

        existing_anchor_rules = set(self.pf.list_anchor_rules())

        final_anchor_rules = ((existing_anchor_rules | new_anchor_rules) -

                              old_anchor_rules)

        # add an anchor rule to capture rules common amongst all the

        # internal ports under 'common' anchor

        if internal_ports:

            final_anchor_rules.add('anchor "common" all')

            # add rule for metadata and broadcast for all tenant's networks

            self._apply_common_rules(self.tenant_subnets['all_tenants'],

                                     internal_ports)

        else:

            final_anchor_rules.discard('anchor "common" all')

            # Now that there are no internal ports, remove the common anchor

            # that captures rules common amongst all the internal ports

            self.pf.remove_anchor_recursively(['common'])

        self.pf.add_rules(list(sorted(final_anchor_rules)))

        # Since we support shared router model, we need to block the new

        # internal port from reaching other tenant's ports. However, if

        # allow_forwarding_between_networks is set, then we need to

        # allow forwarding of packets between same tenant's ports

        block_subnets = set()

        allow_subnets = set()

        for p in internal_ports:

            subnet = p['subnets'][0]['cidr']

            tenant_id = p['tenant_id']

            if self.agent_conf.allow_forwarding_between_networks:

                allow_subnets = self.tenant_subnets[tenant_id] - set([subnet])

                block_subnets = (self.tenant_subnets['all_tenants'] -

                                 self.tenant_subnets[tenant_id])

            else:

                block_subnets = (self.tenant_subnets['all_tenants'] -

                                 set([subnet]))

            # add table entry in the global scope

            internal_dlname = self.get_internal_device_name(p['id'])

            block_tblname = "block_%s" % internal_dlname

            self.pf.replace_table_entry(block_tblname, list(block_subnets),

                                        [internal_dlname, 'normal'])

            if allow_subnets:

                allow_tblname = "allow_%s" % internal_dlname

                self.pf.replace_table_entry(allow_tblname, list(allow_subnets),

                                            [internal_dlname, 'normal'])

        existing_port_ids = set([p['id'] for p in self.internal_ports])

        internal_ports = self.router.get(l3_constants.INTERFACE_KEY, [])

        current_port_ids = set([p['id'] for p in internal_ports

                                if p['admin_state_up']])

        new_port_ids = current_port_ids - existing_port_ids

        new_ports = [p for p in internal_ports if p['id'] in new_port_ids]

        old_ports = [p for p in self.internal_ports if

                     p['id'] not in current_port_ids]

#         updated_ports = self._get_updated_ports(self.internal_ports,

#                                                 internal_ports)

        if old_ports or new_ports:

            self._pre_setup_pf_rules(new_ports, old_ports, internal_ports)

        enable_ra = False

        for p in new_ports:

            self.internal_network_added(p)

            self.internal_ports.append(p)

            enable_ra = enable_ra or self._port_has_ipv6_subnet(p)

        for p in old_ports:

            self.internal_network_removed(p)

            self.internal_ports.remove(p)

            enable_ra = enable_ra or self._port_has_ipv6_subnet(p)

#         if updated_ports:

#             for index, p in enumerate(internal_ports):

#                 if not updated_ports.get(p['id']):

#                     continue

#                 self.internal_ports[index] = updated_ports[p['id']]

#                 interface_name = self.get_internal_device_name(p['id'])

#                 ip_cidrs = common_utils.fixed_ip_cidrs(p['fixed_ips'])

#                 self.driver.init_l3(interface_name, ip_cidrs=ip_cidrs,

#                         namespace=self.ns_name)

#                 enable_ra = enable_ra or self._port_has_ipv6_subnet(p)