# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

"""
Tests protocol number support for security groups
"""

# Import Local Modules
from nose.plugins.attrib import attr
from marvin.cloudstackTestCase import cloudstackTestCase, unittest
from marvin.cloudstackAPI import authorizeSecurityGroupIngress, revokeSecurityGroupIngress, authorizeSecurityGroupEgress, revokeSecurityGroupEgress
from marvin.sshClient import SshClient
from marvin.lib.utils import (validateList,
                              cleanup_resources,
                              get_host_credentials)
from marvin.lib.base import (Account,
                             Host,
                             Domain,
                             VirtualMachine,
                             ServiceOffering,
                             Zone,
                             SecurityGroup)
from marvin.lib.common import (get_domain,
                               get_zone,
                               get_template,
                               list_hosts)
import logging

class TestProtocolNumberSecurityGroup(cloudstackTestCase):
    @classmethod
    def setUpClass(cls):
        cls.testClient = super(
            TestProtocolNumberSecurityGroup,
            cls).getClsTestClient()
        cls.apiclient = cls.testClient.getApiClient()
        cls.testdata = cls.testClient.getParsedTestDataConfig()
        cls.services = cls.testClient.getParsedTestDataConfig()

        zone = get_zone(cls.apiclient, cls.testClient.getZoneForTests())
        cls.zone = Zone(zone.__dict__)
        cls.template = get_template(cls.apiclient, cls.zone.id)
        cls._cleanup = []

        if str(cls.zone.securitygroupsenabled) != "True":
            sys.exit(1)

        cls.logger = logging.getLogger("TestProtocolNumberSecurityGroup")
        cls.stream_handler = logging.StreamHandler()
        cls.logger.setLevel(logging.DEBUG)
        cls.logger.addHandler(cls.stream_handler)

        # Get Zone, Domain and templates
        cls.domain = get_domain(cls.apiclient)
        testClient = super(TestProtocolNumberSecurityGroup, cls).getClsTestClient()
        cls.zone = get_zone(cls.apiclient, testClient.getZoneForTests())
        cls.services['mode'] = cls.zone.networktype

        # Create new domain, account, network and VM
        cls.user_domain = Domain.create(
            cls.apiclient,
            services=cls.testdata["acl"]["domain2"],
            parentdomainid=cls.domain.id)

        # Create account
        cls.account = Account.create(
            cls.apiclient,
            cls.testdata["acl"]["accountD2"],
            admin=True,
            domainid=cls.user_domain.id
        )

        cls.service_offering = ServiceOffering.create(
            cls.apiclient,
            cls.testdata["service_offering"]
        )

        cls.testdata["domainid"] = cls.domain.id
        cls.testdata["virtual_machine_userdata"]["zoneid"] = cls.zone.id
        cls.testdata["virtual_machine_userdata"]["template"] = cls.template.id

        cls._cleanup.append(cls.service_offering)
        cls._cleanup.append(cls.account)
        cls._cleanup.append(cls.user_domain)

    @classmethod
    def tearDownClass(self):
        try:
            cleanup_resources(self.apiclient, self._cleanup)
        except Exception as e:
            raise Exception("Warning: Exception during cleanup : %s" % e)
        return

    def setUp(self):
        self.apiclient = self.testClient.getApiClient()
        self.cleanup = []
        return

    def tearDown(self):
        try:
            cleanup_resources(self.apiclient, self.cleanup)
        except Exception as e:
            raise Exception("Warning: Exception during cleanup : %s" % e)
        return

    @attr(tags=["advancedsg"], required_hardware="false")
    def test_01_add_valid_protocol_number(self):
        # Validate the following
        #
        # 1. Create a security group
        # 2. Try to add a new ingress rule by specifying a protocol number
        # 3. New rule should be added successfully
        # 4. Try to add a new egress rule by specifying a protocol number
        # 5. New rule should be added successfully

        self.security_group = SecurityGroup.create(
            self.apiclient,
            self.testdata["security_group"],
            account=self.account.name,
            domainid=self.account.domainid
        )
        self.debug("Created security group with ID: %s" % self.security_group.id)

        # Add ingress rule
        self.createIngressRule("111")

        # Add egress rule
        self.createEgressRule("111")

        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 1, 1)

    @attr(tags=["advancedsg"], required_hardware="false")
    def test_02_add_invalid_protocol_number(self):
        # Validate the following
        #
        # 1. Create a security group
        # 2. Try to add a new ingress rule by specifying an invalid (> 255) protocol number
        # 3. Exception should be thrown successfully
        # 4. Try to add a new egreess rule by specifying an invalid (> 255) protocol number
        # 5. Exception should be thrown successfully

        self.security_group = SecurityGroup.create(
            self.apiclient,
            self.testdata["security_group"],
            account=self.account.name,
            domainid=self.account.domainid
        )
        self.debug("Created security group with ID: %s" % self.security_group.id)

        # Create ingress rule with invalid protocol number. Exception should be thrown
        with self.assertRaises(Exception):
            self.createIngressRule("555")

        # Create egress rule with invalid protocol number. Exception should be thrown
        with self.assertRaises(Exception):
            self.createEgressRule("555")

    @attr(tags=["advancedsg"], required_hardware="false")
    def test_03_add_duplicate_protocol_number(self):
        # Validate the following
        #
        # 1. Create a security group
        # 2. Try to add a new ingress rule by specifying a protocol number
        # 3. Try to add one more ingress rule by specifying the same protocol number
        # 4. Exception should be thrown successfully
        # 5. Try to add a new egress rule by specifying a protocol number
        # 6. Try to add one more egress rule by specifying the same protocol number
        # 7. Exception should be thrown successfully

        self.security_group = SecurityGroup.create(
            self.apiclient,
            self.testdata["security_group"],
            account=self.account.name,
            domainid=self.account.domainid
        )
        self.debug("Created security group with ID: %s" % self.security_group.id)

        # Add ingress rule
        self.createIngressRule("111")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 1, 0)

        # Try to add another ingress with same protocol number. Exception is thrown
        with self.assertRaises(Exception):
            self.createIngressRule("111")

        # Add egress rule
        self.createEgressRule("111")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 1, 1)

        # Try to add another ingress with same protocol number. Exception is thrown
        with self.assertRaises(Exception):
            self.createEgressRule("111")

    @attr(tags=["advancedsg"], required_hardware="false")
    def test_04_add_duplicate_protocol_number(self):
        # Validate the following
        #
        # 1. Create a security group
        # 2. Try to add a new ingress rule by using "all" as the protocol string
        # 3. Try to add one more ingress rule by specifying the same protocol
        # 4. Exception should be thrown successfully
        # 5. Try to add a new egress rule by using "all" as the protocol string
        # 6. Try to add one more egress rule by specifying the same protocol
        # 7. Exception should be thrown successfully

        self.security_group = SecurityGroup.create(
            self.apiclient,
            self.testdata["security_group"],
            account=self.account.name,
            domainid=self.account.domainid
        )
        self.debug("Created security group with ID: %s" % self.security_group.id)

        # Add ingress rule
        self.createIngressRule("111")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 1, 0)

        # Try to add another ingress with same protocol number. Exception is thrown
        with self.assertRaises(Exception):
            self.createIngressRule("111")

        # Add egress rule
        self.createEgressRule("111")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 1, 1)

        # Try to add another ingress with same protocol number. Exception is thrown
        with self.assertRaises(Exception):
            self.createEgressRule("111")

    @attr(tags=["advancedsg"], required_hardware="false")
    def test_05_invalid_protocol_string(self):
        # Validate the following
        #
        # 1. Create a security group
        # 2. Try to add ingress rule with invalid protocol name
        # 3. Exception should be thrown
        # 4. Try to add egressrule with invalid protocol name
        # 5. Exception should be thrown

        security_group = SecurityGroup.create(
            self.apiclient,
            self.testdata["security_group"],
            account=self.account.name,
            domainid=self.account.domainid
        )
        self.debug("Created security group with ID: %s" % security_group.id)

        with self.assertRaises(Exception):
            self.createIngressRule("randomprotocol")

        with self.assertRaises(Exception):
            self.createEgressRule("randomprotocol")

    @attr(tags=["advancedsg"])
    def test_06_create_virtual_machine(self):
        # Validate the following
        #
        # 1. Create a security group
        # 2. Create a virtual machine
        # 3. Try to add a new ingress rule
        # 4. Check if ingress rule is applied successfully on host
        # 5. Throw exception if it's not applied
        # 6. Try to add a new egress rule
        # 7. Check if egress rule is applied successfully on host
        # 8. Throw exception if it's not applied

        self.security_group = SecurityGroup.create(
            self.apiclient,
            self.testdata["security_group"],
            account=self.account.name,
            domainid=self.account.domainid
        )

        self.virtual_machine = VirtualMachine.create(
            self.apiclient,
            self.testdata["virtual_machine_userdata"],
            accountid=self.account.name,
            domainid=self.account.domainid,
            serviceofferingid=self.service_offering.id,
            securitygroupids=[self.security_group.id]
        )

        # Get the virtual machine
        virtial_machine = VirtualMachine.list(
            self.apiclient,
            id=self.virtual_machine.id
        )

        vm = virtial_machine[0]

        # get the host on which the vm is running
        hosts = list_hosts(
            self.apiclient,
            id=vm.hostid
        )

        host = hosts[0]
        if host.hypervisor.lower() not in "kvm":
            return

        host.user, host.passwd = get_host_credentials(self.config, host.ipaddress)

        # Add ingress rule
        self.createIngressRule("tcp", "1.1.1.1/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 1, 0)
        # Check if the ingress rule if applied successfully on host
        rule = "-A %s -s 1.1.1.1/32 -p tcp -m tcp --dport 1:65535 -m state --state NEW -j ACCEPT" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add ingress rule
        self.createIngressRule("udp", "2.2.2.2/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 2, 0)
        # Check if the ingress rule if applied successfully on host
        rule = "-A %s -s 2.2.2.2/32 -p udp -m udp --dport 1:65535 -m state --state NEW -j ACCEPT" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add ingress rule
        self.createIngressRule("icmp", "3.3.3.3/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 3, 0)
        # Check if the ingress rule if applied successfully on host
        rule = "-A %s -s 3.3.3.3/32 -p icmp -m icmp --icmp-type any -j ACCEPT" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add ingress rule
        self.createIngressRule("all", "4.4.4.4/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 4, 0)
        # Check if the ingress rule if applied successfully on host
        rule = "-A %s -s 4.4.4.4/32 -m state --state NEW -j ACCEPT" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add ingress rule
        self.createIngressRule("47", "5.5.5.5/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 5, 0)
        # Check if the ingress rule if applied successfully on host
        rule = "-A %s -s 5.5.5.5/32 -p gre -j ACCEPT" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add egress rule
        self.createEgressRule("tcp", "11.11.11.11/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 5, 1)
        # Check if the egress rule if applied successfully on host
        rule = "-A %s-eg -d 11.11.11.11/32 -p tcp -m tcp --dport 1:65535 -m state --state NEW -j RETURN" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add egress rule
        self.createEgressRule("udp", "12.12.12.12/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 5, 2)
        # Check if the egress rule if applied successfully on host
        rule = "-A %s-eg -d 12.12.12.12/32 -p udp -m udp --dport 1:65535 -m state --state NEW -j RETURN" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add egress rule
        self.createEgressRule("icmp", "13.13.13.13/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 5, 3)
        # Check if the egress rule if applied successfully on host
        rule = "-A %s-eg -d 13.13.13.13/32 -p icmp -m icmp --icmp-type any -j RETURN" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add egress rule
        self.createEgressRule("all", "14.14.14.14/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 5, 4)
        # Check if the egress rule if applied successfully on host
        rule = "-A %s-eg -d 14.14.14.14/32 -m state --state NEW -j RETURN" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

        # Add egress rule
        self.createEgressRule("47", "15.15.15.15/32")
        # verify number of ingress rules and egress rules
        self.verify_security_group_rules(self.security_group.id, 5, 5)
        # Check if the egress rule if applied successfully on host
        rule = "-A %s-eg -d 15.15.15.15/32 -p gre -j RETURN" % vm.instancename
        self.verify_rule_on_host(host.ipaddress, host.user, host.passwd, rule)

    def createIngressRule(self, protocol, cidrlist=None):
        cmd = authorizeSecurityGroupIngress.authorizeSecurityGroupIngressCmd()
        cmd.account=self.account.name
        cmd.domainid=self.account.domainid
        cmd.securitygroupid=self.security_group.id
        cmd.cidrlist="99.99.99.99/32"
        if cidrlist:
            cmd.cidrlist=cidrlist
        cmd.protocol=protocol
        if protocol == "tcp" or protocol == "udp":
            cmd.startport = 1
            cmd.endport = 65535
        elif protocol == "icmp":
            cmd.icmptype = -1
            cmd.icmpcode = -1
        self.apiclient.authorizeSecurityGroupIngress(cmd)
        cmd = None

    def createEgressRule(self, protocol, cidrlist=None):
        cmd = authorizeSecurityGroupEgress.authorizeSecurityGroupEgressCmd()
        cmd.account=self.account.name
        cmd.domainid=self.account.domainid
        cmd.securitygroupid=self.security_group.id
        cmd.cidrlist="88.88.88.88/32"
        if cidrlist:
            cmd.cidrlist=cidrlist
        cmd.protocol=protocol
        if protocol == "tcp" or protocol == "udp":
            cmd.startport = 1
            cmd.endport = 65535
        elif protocol == "icmp":
            cmd.icmptype = -1
            cmd.icmpcode = -1
        self.apiclient.authorizeSecurityGroupEgress(cmd)
        cmd = None

    def verify_security_group_rules(self, securitygroupid, numIngress, numEgress):
        security_groups = SecurityGroup.list(
            self.apiclient,
            account=self.account.name,
            domainid=self.account.domainid,
            id=securitygroupid
        )
        ingressrule = security_groups[0].ingressrule
        if len(ingressrule) != numIngress:
            raise Exception("Failed to verify ingress rule for security group %s" % security_groups[0].name)
        egressrule = security_groups[0].egressrule
        if len(egressrule) != numEgress:
            raise Exception("Failed to verify egress rule for security group %s" % security_groups[0].name)

    def verify_rule_on_host(self, ipaddress, user, password, rule):
        self.logger.debug("Verifying rule '%s' in host %s" % (rule, ipaddress))
        try:
            ssh = SshClient(ipaddress, 22, user, password)
            result = ssh.execute("iptables-save |grep \"\\%s\"" % rule)
            if len(result) == 0 or result[0] != rule:
                raise Exception("Unable to apply security group rule")
        except KeyError:
            self.skipTest(
                "Provide a marvin config file with host credentials to run %s" % self._testMethodName)