// or more contributor license agreements.  See the NOTICE file

// distributed with this work for additional information

// regarding copyright ownership.  The ASF licenses this file

// to you under the Apache License, Version 2.0 (the

// "License"); you may not use this file except in compliance

// with the License.  You may obtain a copy of the License at

//

//   http://www.apache.org/licenses/LICENSE-2.0

//

// Unless required by applicable law or agreed to in writing,

// software distributed under the License is distributed on an

// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

// KIND, either express or implied.  See the License for the

// specific language governing permissions and limitations

// under the License.

* NetworkServiceImpl implements NetworkService.

*/

@Local(value = { NetworkService.class })

    private static final Logger s_logger = Logger.getLogger(NetworkServiceImpl.class);

    @Inject

    DataCenterDao _dcDao = null;

    @Inject

    VlanDao _vlanDao = null;

    @Inject

    IPAddressDao _ipAddressDao = null;

    @Inject

    AccountDao _accountDao = null;

    @Inject

    DomainDao _domainDao = null;

    @Inject

    UserDao _userDao = null;

    @Inject

    EventDao _eventDao = null;

    @Inject

    ConfigurationDao _configDao;

    @Inject

    UserVmDao _userVmDao = null;

    @Inject

    AccountManager _accountMgr;

    @Inject

    ConfigurationManager _configMgr;

    @Inject

    AccountVlanMapDao _accountVlanMapDao;

    @Inject

    NetworkOfferingDao _networkOfferingDao = null;

    @Inject

    NetworkDao _networksDao = null;

    @Inject

    NicDao _nicDao = null;

    @Inject

    RulesManager _rulesMgr;

    @Inject

    UsageEventDao _usageEventDao;

   

    @Inject List<NetworkGuru> _networkGurus;

 

    @Inject

    NetworkDomainDao _networkDomainDao;

    @Inject

    VMInstanceDao _vmDao;

    @Inject

    FirewallRulesDao _firewallDao;

 

    @Inject

    ResourceLimitService _resourceLimitMgr;

  

    @Inject

    DomainManager _domainMgr;

    @Inject

    ProjectManager _projectMgr;

    @Inject

    NetworkOfferingServiceMapDao _ntwkOfferingSrvcDao;

    @Inject

    PhysicalNetworkDao _physicalNetworkDao;

    @Inject

    PhysicalNetworkServiceProviderDao _pNSPDao;

   

    @Inject

    PhysicalNetworkTrafficTypeDao _pNTrafficTypeDao;

    @Inject

    NetworkServiceMapDao _ntwkSrvcDao;

    @Inject

    StorageNetworkManager _stnwMgr;

    @Inject

    VpcManager _vpcMgr;

    @Inject

    PrivateIpDao _privateIpDao;

    @Inject

    ResourceTagDao _resourceTagDao;

    @Inject

    NetworkManager _networkMgr;

    @Inject

    NetworkModel _networkModel;

    int _cidrLimit;

    boolean _allowSubdomainNetworkAccess;

    private Map<String, String> _configs;

    /* Get a list of IPs, classify them by service */

    protected Map<PublicIp, Set<Service>> getIpToServices(List<PublicIp> publicIps, boolean rulesRevoked, boolean includingFirewall) {

        Map<PublicIp, Set<Service>> ipToServices = new HashMap<PublicIp, Set<Service>>();

        if (publicIps != null && !publicIps.isEmpty()) {

            Set<Long> networkSNAT = new HashSet<Long>();

            for (PublicIp ip : publicIps) {

                Set<Service> services = ipToServices.get(ip);

                if (services == null) {

                    services = new HashSet<Service>();

                }

                if (ip.isSourceNat()) {

                    if (!networkSNAT.contains(ip.getAssociatedWithNetworkId())) {

                        services.add(Service.SourceNat);

                        networkSNAT.add(ip.getAssociatedWithNetworkId());

                    } else {

                        CloudRuntimeException ex = new CloudRuntimeException("Multiple generic soure NAT IPs provided for network");

                        // see the IPAddressVO.java class.

                        ex.addProxyObject("user_ip_address", ip.getAssociatedWithNetworkId(), "networkId");

                        throw ex;

                    }

                }

                ipToServices.put(ip, services);

                // if IP in allocating state then it will not have any rules attached so skip IPAssoc to network service

                // provider

                if (ip.getState() == State.Allocating) {

                    continue;

                }

                // check if any active rules are applied on the public IP

                Set<Purpose> purposes = getPublicIpPurposeInRules(ip, false, includingFirewall);

                // Firewall rules didn't cover static NAT

                if (ip.isOneToOneNat() && ip.getAssociatedWithVmId() != null) {

                    if (purposes == null) {

                        purposes = new HashSet<Purpose>();

                    }

                    purposes.add(Purpose.StaticNat);

                }

                if (purposes == null || purposes.isEmpty()) {

                    // since no active rules are there check if any rules are applied on the public IP but are in

// revoking state

                   

                    purposes = getPublicIpPurposeInRules(ip, true, includingFirewall);

                    if (ip.isOneToOneNat()) {

                        if (purposes == null) {

                            purposes = new HashSet<Purpose>();

                        }

                        purposes.add(Purpose.StaticNat);

                    }

                    if (purposes == null || purposes.isEmpty()) {

                        // IP is not being used for any purpose so skip IPAssoc to network service provider

                        continue;

                    } else {

                        if (rulesRevoked) {

                            // no active rules/revoked rules are associated with this public IP, so remove the

// association with the provider

                            ip.setState(State.Releasing);

                        } else {

                            if (ip.getState() == State.Releasing) {

                                // rules are not revoked yet, so don't let the network service provider revoke the IP

// association

                                // mark IP is allocated so that IP association will not be removed from the provider

                                ip.setState(State.Allocated);

                            }

                        }

                    }

                }

                if (purposes.contains(Purpose.StaticNat)) {

                    services.add(Service.StaticNat);

                }

                if (purposes.contains(Purpose.LoadBalancing)) {

                    services.add(Service.Lb);

                }

                if (purposes.contains(Purpose.PortForwarding)) {

                    services.add(Service.PortForwarding);

                }

                if (purposes.contains(Purpose.Vpn)) {

                    services.add(Service.Vpn);

                }

                if (purposes.contains(Purpose.Firewall)) {

                    services.add(Service.Firewall);

                }

                if (services.isEmpty()) {

                    continue;

                }

                ipToServices.put(ip, services);

            }

        }

        return ipToServices;

    }

    protected boolean canIpUsedForNonConserveService(PublicIp ip, Service service) {

        // If it's non-conserve mode, then the new ip should not be used by any other services

        List<PublicIp> ipList = new ArrayList<PublicIp>();

        ipList.add(ip);

        Map<PublicIp, Set<Service>> ipToServices = getIpToServices(ipList, false, false);

        Set<Service> services = ipToServices.get(ip);

        // Not used currently, safe

        if (services == null || services.isEmpty()) {

            return true;

        }

        // Since it's non-conserve mode, only one service should used for IP

        if (services.size() != 1) {

            throw new InvalidParameterException("There are multiple services used ip " + ip.getAddress() + ".");

        }

        if (service != null && !((Service) services.toArray()[0] == service || service.equals(Service.Firewall))) {

            throw new InvalidParameterException("The IP " + ip.getAddress() + " is already used as " + ((Service) services.toArray()[0]).getName() + " rather than " + service.getName());

        }

        return true;

    }

    protected boolean canIpsUsedForNonConserve(List<PublicIp> publicIps) {

        boolean result = true;

        for (PublicIp ip : publicIps) {

            result = canIpUsedForNonConserveService(ip, null);

            if (!result) {

                break;

            }

        }

        return result;

    }

    private boolean canIpsUseOffering(List<PublicIp> publicIps, long offeringId) {

        Map<PublicIp, Set<Service>> ipToServices = getIpToServices(publicIps, false, true);

        Map<Service, Set<Provider>> serviceToProviders = _networkModel.getNetworkOfferingServiceProvidersMap(offeringId);

        NetworkOfferingVO offering = _networkOfferingDao.findById(offeringId);

        //For inline mode checking, using firewall provider for LB instead, because public ip would apply on firewall provider

        if (offering.isInline()) {

            Provider firewallProvider = null;

            if (serviceToProviders.containsKey(Service.Firewall)) {

                firewallProvider = (Provider)serviceToProviders.get(Service.Firewall).toArray()[0];

            }

            Set<Provider> p = new HashSet<Provider>();

            p.add(firewallProvider);

            serviceToProviders.remove(Service.Lb);

            serviceToProviders.put(Service.Lb, p);

        }

        for (PublicIp ip : ipToServices.keySet()) {

            Set<Service> services = ipToServices.get(ip);

            Provider provider = null;

            for (Service service : services) {

                Set<Provider> curProviders = serviceToProviders.get(service);

                if (curProviders == null || curProviders.isEmpty()) {

                    continue;

                }

                Provider curProvider = (Provider) curProviders.toArray()[0];

                if (provider == null) {

                    provider = curProvider;

                    continue;

                }

                // We don't support multiple providers for one service now

                if (!provider.equals(curProvider)) {

                    throw new InvalidParameterException("There would be multiple providers for IP " + ip.getAddress() + " with the new network offering!");

                }

            }

        }

        return true;

    }

   

   

    private Set<Purpose> getPublicIpPurposeInRules(PublicIp ip, boolean includeRevoked, boolean includingFirewall) {

        Set<Purpose> result = new HashSet<Purpose>();

        List<FirewallRuleVO> rules = null;

        if (includeRevoked) {

            rules = _firewallDao.listByIp(ip.getId());

        } else {

            rules = _firewallDao.listByIpAndNotRevoked(ip.getId());

        }

        if (rules == null || rules.isEmpty()) {

            return null;

        }

        for (FirewallRuleVO rule : rules) {

            if (rule.getPurpose() != Purpose.Firewall || includingFirewall) {

                result.add(rule.getPurpose());

            }

        }

        return result;

    }

    @Override

    public List<? extends Network> getIsolatedNetworksOwnedByAccountInZone(long zoneId, Account owner) {

        return _networksDao.listByZoneAndGuestType(owner.getId(), zoneId, Network.GuestType.Isolated, false);

    }

   

    @Override

    public List<? extends Network> getIsolatedNetworksWithSourceNATOwnedByAccountInZone(long zoneId, Account owner) {

        return _networksDao.listSourceNATEnabledNetworks(owner.getId(), zoneId, Network.GuestType.Isolated);

    }

   

   

    @Override

    @ActionEvent(eventType = EventTypes.EVENT_NET_IP_ASSIGN, eventDescription = "allocating Ip", create = true)

    public IpAddress allocateIP(Account ipOwner, boolean isSystem, long zoneId)

            throws ResourceAllocationException, InsufficientAddressCapacityException, ConcurrentOperationException {

        Account caller = UserContext.current().getCaller();

        // check permissions

        _accountMgr.checkAccess(caller, null, false, ipOwner);

        long callerUserId = UserContext.current().getCallerUserId();

        DataCenter zone = _configMgr.getZone(zoneId);

       

        return _networkMgr.allocateIp(ipOwner, isSystem, caller, callerUserId, zone);

    }

    @Override

    @DB

    public boolean configure(final String name, final Map<String, Object> params) throws ConfigurationException {

        _configs = _configDao.getConfiguration("Network", params);

        _cidrLimit = NumbersUtil.parseInt(_configs.get(Config.NetworkGuestCidrLimit.key()), 22);

        _allowSubdomainNetworkAccess = Boolean.valueOf(_configs.get(Config.SubDomainNetworkAccess.key()));

        s_logger.info("Network Service is configured.");

        return true;

    }

    @Override

    public boolean start() {

        return true;

    }

    @Override

    public boolean stop() {

        return true;

    }

    protected NetworkServiceImpl() {

    }

    @Override

    @DB

    @ActionEvent(eventType = EventTypes.EVENT_NET_IP_RELEASE, eventDescription = "disassociating Ip", async = true)

    public boolean releaseIpAddress(long ipAddressId) throws InsufficientAddressCapacityException {

        Long userId = UserContext.current().getCallerUserId();

        Account caller = UserContext.current().getCaller();

        // Verify input parameters

        IPAddressVO ipVO = _ipAddressDao.findById(ipAddressId);

        if (ipVO == null) {

            throw new InvalidParameterValueException("Unable to find ip address by id");

        }

        if (ipVO.getAllocatedTime() == null) {

            s_logger.debug("Ip Address id= " + ipAddressId + " is not allocated, so do nothing.");

            return true;

        }

        // verify permissions

        if (ipVO.getAllocatedToAccountId() != null) {

            _accountMgr.checkAccess(caller, null, true, ipVO);

        }

        if (ipVO.isSourceNat()) {

            throw new IllegalArgumentException("ip address is used for source nat purposes and can not be disassociated.");

        }

        VlanVO vlan = _vlanDao.findById(ipVO.getVlanId());

        if (!vlan.getVlanType().equals(VlanType.VirtualNetwork)) {

            throw new IllegalArgumentException("only ip addresses that belong to a virtual network may be disassociated.");

        }

        // Check for account wide pool. It will have an entry for account_vlan_map.

        if (_accountVlanMapDao.findAccountVlanMap(ipVO.getAllocatedToAccountId(), ipVO.getVlanId()) != null) {           

            //see IPaddressVO.java

            InvalidParameterValueException ex = new InvalidParameterValueException("Sepcified IP address uuid belongs to" +

                    " Account wide IP pool and cannot be disassociated");

            ex.addProxyObject("user_ip_address", ipAddressId, "ipAddressId");

            throw ex;

        }

        // don't allow releasing system ip address

        if (ipVO.getSystem()) {

            InvalidParameterValueException ex = new InvalidParameterValueException("Can't release system IP address with specified id");

            ex.addProxyObject(ipVO, ipVO.getId(), "systemIpAddrId");

            throw ex;

        }

        boolean success = _networkMgr.disassociatePublicIpAddress(ipAddressId, userId, caller);

        if (success) {

            Long networkId = ipVO.getAssociatedWithNetworkId();

            if (networkId != null) {

                Network guestNetwork = getNetwork(networkId);

                NetworkOffering offering = _configMgr.getNetworkOffering(guestNetwork.getNetworkOfferingId());

                Long vmId = ipVO.getAssociatedWithVmId();

                if (offering.getElasticIp() && vmId != null) {

                    _rulesMgr.getSystemIpAndEnableStaticNatForVm(_userVmDao.findById(vmId), true);

                    return true;

                }

            }

        } else {

            s_logger.warn("Failed to release public ip address id=" + ipAddressId);

        }

        return success;

    }

    @Override

    @DB

    public Network getNetwork(long id) {

        return _networksDao.findById(id);

    }

  

    private void checkSharedNetworkCidrOverlap(Long zoneId, long physicalNetworkId, String cidr) {

        if (zoneId == null || cidr == null) {

            return;

        }

        DataCenter zone = _dcDao.findById(zoneId);

        List<NetworkVO> networks = _networksDao.listByZone(zoneId);

        Map<Long, String> networkToCidr = new HashMap<Long, String>();

        // check for CIDR overlap with all possible CIDR for isolated guest networks

        // in the zone when using external networking

        PhysicalNetworkVO pNetwork = _physicalNetworkDao.findById(physicalNetworkId);

        if (pNetwork.getVnet() != null) {

            String vlanRange[] = pNetwork.getVnet().split("-");

            int lowestVlanTag = Integer.valueOf(vlanRange[0]);

            int highestVlanTag = Integer.valueOf(vlanRange[1]);

            for (int vlan=lowestVlanTag; vlan <= highestVlanTag; ++vlan) {

                int offset = vlan - lowestVlanTag;

                String globalVlanBits = _configDao.getValue(Config.GuestVlanBits.key());

                int cidrSize = 8 + Integer.parseInt(globalVlanBits);

                String guestNetworkCidr = zone.getGuestNetworkCidr();

                String[] cidrTuple = guestNetworkCidr.split("\\/");

                long newCidrAddress = (NetUtils.ip2Long(cidrTuple[0]) & 0xff000000) | (offset << (32 - cidrSize));

                if (NetUtils.isNetworksOverlap(NetUtils.long2Ip(newCidrAddress), cidr)) {

                    throw new InvalidParameterValueException("Specified CIDR for shared network conflict with CIDR that is reserved for zone vlan " + vlan);

                }

            }

        }

        // check for CIDR overlap with all CIDR's of the shared networks in the zone

        for (NetworkVO network : networks) {

            if (network.getGuestType() == GuestType.Isolated) {

                continue;