// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
package org.apache.cloudstack.storage.template;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.stream.Collectors;

import javax.inject.Inject;

import com.cloud.dc.DataCenter;
import com.cloud.exception.InsufficientAddressCapacityException;
import com.cloud.exception.InvalidParameterValueException;
import com.cloud.exception.NetworkRuleConflictException;
import com.cloud.exception.ResourceAllocationException;
import com.cloud.exception.ResourceUnavailableException;
import com.cloud.network.IpAddress;
import com.cloud.network.IpAddressManager;
import com.cloud.network.Network;
import com.cloud.network.NetworkModel;
import com.cloud.network.NetworkService;
import com.cloud.network.VNF;
import com.cloud.network.dao.FirewallRulesDao;
import com.cloud.network.dao.NetworkDao;
import com.cloud.network.firewall.FirewallService;
import com.cloud.network.rules.FirewallRule;
import com.cloud.network.rules.FirewallRuleVO;
import com.cloud.network.rules.RulesService;
import com.cloud.network.security.SecurityGroup;
import com.cloud.network.security.SecurityGroupManager;
import com.cloud.network.security.SecurityGroupService;
import com.cloud.network.security.SecurityGroupVO;
import com.cloud.network.security.SecurityRule;
import com.cloud.storage.VnfTemplateDetailVO;
import com.cloud.storage.VnfTemplateNicVO;
import com.cloud.storage.dao.VnfTemplateDetailsDao;
import com.cloud.storage.dao.VnfTemplateNicDao;
import com.cloud.template.VirtualMachineTemplate;
import com.cloud.user.Account;
import com.cloud.uservm.UserVm;
import com.cloud.utils.NumbersUtil;
import com.cloud.utils.component.ManagerBase;
import com.cloud.utils.component.PluggableService;
import com.cloud.utils.db.Transaction;
import com.cloud.utils.db.TransactionCallbackWithExceptionNoReturn;
import com.cloud.utils.db.TransactionStatus;
import com.cloud.utils.exception.CloudRuntimeException;
import com.cloud.utils.net.NetUtils;
import com.cloud.vm.NicVO;
import com.cloud.vm.dao.NicDao;
import org.apache.cloudstack.api.command.admin.template.ListVnfTemplatesCmdByAdmin;
import org.apache.cloudstack.api.command.admin.template.RegisterVnfTemplateCmdByAdmin;
import org.apache.cloudstack.api.command.admin.template.UpdateVnfTemplateCmdByAdmin;
import org.apache.cloudstack.api.command.admin.vm.DeployVnfApplianceCmdByAdmin;
import org.apache.cloudstack.api.command.user.template.DeleteVnfTemplateCmd;
import org.apache.cloudstack.api.command.user.template.ListVnfTemplatesCmd;
import org.apache.cloudstack.api.command.user.template.RegisterVnfTemplateCmd;
import org.apache.cloudstack.api.command.user.template.UpdateVnfTemplateCmd;
import org.apache.cloudstack.api.command.user.vm.DeployVnfApplianceCmd;
import org.apache.cloudstack.framework.config.ConfigKey;
import org.apache.cloudstack.framework.config.Configurable;
import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.collections.MapUtils;
import org.apache.log4j.Logger;


public class VnfTemplateManagerImpl extends ManagerBase implements VnfTemplateManager, PluggableService, Configurable {

    static final Logger LOGGER = Logger.getLogger(VnfTemplateManagerImpl.class);

    public static final String VNF_SECURITY_GROUP_NAME = "VNF_SecurityGroup_";
    public static final String ACCESS_METHOD_SEPARATOR = ",";
    public static final Integer ACCESS_DEFAULT_SSH_PORT = 22;
    public static final Integer ACCESS_DEFAULT_HTTP_PORT = 80;
    public static final Integer ACCESS_DEFAULT_HTTPS_PORT = 443;

    @Inject
    VnfTemplateDetailsDao vnfTemplateDetailsDao;
    @Inject
    VnfTemplateNicDao vnfTemplateNicDao;
    @Inject
    SecurityGroupManager securityGroupManager;
    @Inject
    SecurityGroupService securityGroupService;
    @Inject
    NetworkModel networkModel;
    @Inject
    IpAddressManager ipAddressManager;
    @Inject
    NicDao nicDao;
    @Inject
    NetworkDao networkDao;
    @Inject
    NetworkService networkService;
    @Inject
    RulesService rulesService;
    @Inject
    FirewallRulesDao firewallRulesDao;
    @Inject
    FirewallService firewallService;

    @Override
    public List<Class<?>> getCommands() {
        final List<Class<?>> cmdList = new ArrayList<>();
        if (!VnfTemplateAndApplianceEnabled.value()) {
            return cmdList;
        }
        cmdList.add(RegisterVnfTemplateCmd.class);
        cmdList.add(RegisterVnfTemplateCmdByAdmin.class);
        cmdList.add(ListVnfTemplatesCmd.class);
        cmdList.add(ListVnfTemplatesCmdByAdmin.class);
        cmdList.add(UpdateVnfTemplateCmd.class);
        cmdList.add(UpdateVnfTemplateCmdByAdmin.class);
        cmdList.add(DeleteVnfTemplateCmd.class);
        cmdList.add(DeployVnfApplianceCmd.class);
        cmdList.add(DeployVnfApplianceCmdByAdmin.class);
        return cmdList;
    }

    @Override
    public void persistVnfTemplate(long templateId, RegisterVnfTemplateCmd cmd) {
        persistVnfTemplateNics(templateId, cmd.getVnfNics());
        persistVnfTemplateDetails(templateId, cmd);
    }

    private void persistVnfTemplateNics(long templateId, List<VNF.VnfNic> nics) {
        for (VNF.VnfNic nic : nics) {
            VnfTemplateNicVO vnfTemplateNicVO = new VnfTemplateNicVO(templateId, nic.getDeviceId(), nic.getName(), nic.isRequired(), nic.isManagement(), nic.getDescription());
            vnfTemplateNicDao.persist(vnfTemplateNicVO);
        }
    }

    private void persistVnfTemplateDetails(long templateId, RegisterVnfTemplateCmd cmd) {
        persistVnfTemplateDetails(templateId, cmd.getVnfDetails());
    }

    private void persistVnfTemplateDetails(long templateId, Map<String, String> vnfDetails) {
        for (Map.Entry<String, String> entry:  vnfDetails.entrySet()) {
            String value = entry.getValue();
            if (VNF.AccessDetail.ACCESS_METHODS.name().equalsIgnoreCase(entry.getKey())) {
                value = Arrays.stream(value.split(ACCESS_METHOD_SEPARATOR)).sorted().collect(Collectors.joining(ACCESS_METHOD_SEPARATOR));
            }
            vnfTemplateDetailsDao.addDetail(templateId, entry.getKey().toLowerCase(), value, true);
        }
    }

    @Override
    public void updateVnfTemplate(long templateId, UpdateVnfTemplateCmd cmd) {
        updateVnfTemplateDetails(templateId, cmd);
        updateVnfTemplateNics(templateId, cmd);
    }

    private void updateVnfTemplateDetails(long templateId, UpdateVnfTemplateCmd cmd) {
        boolean cleanupVnfDetails = cmd.isCleanupVnfDetails();
        if (cleanupVnfDetails) {
            vnfTemplateDetailsDao.removeDetails(templateId);
        } else if (MapUtils.isNotEmpty(cmd.getVnfDetails())) {
            vnfTemplateDetailsDao.removeDetails(templateId);
            persistVnfTemplateDetails(templateId, cmd.getVnfDetails());
        }
    }

    private void updateVnfTemplateNics(long templateId, UpdateVnfTemplateCmd cmd) {
        boolean cleanupVnfNics = cmd.isCleanupVnfNics();
        if (cleanupVnfNics) {
            vnfTemplateNicDao.deleteByTemplateId(templateId);
        } else if (CollectionUtils.isNotEmpty(cmd.getVnfNics())) {
            vnfTemplateNicDao.deleteByTemplateId(templateId);
            persistVnfTemplateNics(templateId, cmd.getVnfNics());
        }
    }

    @Override
    public String getConfigComponentName() {
        return VnfTemplateManager.class.getSimpleName();
    }

    @Override
    public ConfigKey<?>[] getConfigKeys() {
        return new ConfigKey[] { VnfTemplateAndApplianceEnabled };
    }

    @Override
    public void validateVnfApplianceNics(VirtualMachineTemplate template, List<Long> networkIds) {
        if (CollectionUtils.isEmpty(networkIds)) {
            throw new InvalidParameterValueException("VNF nics list is empty");
        }
        List<VnfTemplateNicVO> vnfNics = vnfTemplateNicDao.listByTemplateId(template.getId());
        for (VnfTemplateNicVO vnfNic : vnfNics) {
            if (vnfNic.isRequired() && networkIds.size() <= vnfNic.getDeviceId()) {
                throw new InvalidParameterValueException("VNF nic is required but not found: " + vnfNic);
            }
        }
    }

    protected Set<Integer> getOpenPortsForVnfAppliance(VirtualMachineTemplate template) {
        Set<Integer> ports = new HashSet<>();
        VnfTemplateDetailVO accessMethodsDetail = vnfTemplateDetailsDao.findDetail(template.getId(), VNF.AccessDetail.ACCESS_METHODS.name().toLowerCase());
        if (accessMethodsDetail == null || accessMethodsDetail.getValue() == null) {
            return ports;
        }
        String[] accessMethods = accessMethodsDetail.getValue().split(ACCESS_METHOD_SEPARATOR);
        for (String accessMethod : accessMethods) {
            if (VNF.AccessMethod.SSH_WITH_KEY.toString().equalsIgnoreCase(accessMethod)
                    || VNF.AccessMethod.SSH_WITH_PASSWORD.toString().equalsIgnoreCase(accessMethod)) {
                VnfTemplateDetailVO accessDetail = vnfTemplateDetailsDao.findDetail(template.getId(), VNF.AccessDetail.SSH_PORT.name().toLowerCase());
                if (accessDetail == null) {
                    ports.add(ACCESS_DEFAULT_SSH_PORT);
                } else {
                    ports.add(NumbersUtil.parseInt(accessDetail.getValue(), ACCESS_DEFAULT_SSH_PORT));
                }
            } else if (VNF.AccessMethod.HTTP.toString().equalsIgnoreCase(accessMethod)) {
                VnfTemplateDetailVO accessDetail = vnfTemplateDetailsDao.findDetail(template.getId(), VNF.AccessDetail.HTTP_PORT.name().toLowerCase());
                if (accessDetail == null) {
                    ports.add(ACCESS_DEFAULT_HTTP_PORT);
                } else {
                    ports.add(NumbersUtil.parseInt(accessDetail.getValue(), ACCESS_DEFAULT_HTTP_PORT));
                }
            } else if (VNF.AccessMethod.HTTPS.toString().equalsIgnoreCase(accessMethod)) {
                VnfTemplateDetailVO accessDetail = vnfTemplateDetailsDao.findDetail(template.getId(), VNF.AccessDetail.HTTPS_PORT.name().toLowerCase());
                if (accessDetail == null) {
                    ports.add(ACCESS_DEFAULT_HTTPS_PORT);
                } else {
                    ports.add(NumbersUtil.parseInt(accessDetail.getValue(), ACCESS_DEFAULT_HTTPS_PORT));
                }
            }
        }
        return ports;
    }

    private Set<Long> getDeviceIdsOfVnfManagementNics(VirtualMachineTemplate template) {
        Set<Long> deviceIds = new HashSet<>();
        for (VnfTemplateNicVO nic : vnfTemplateNicDao.listByTemplateId(template.getId())) {
            if (nic.isManagement()) {
                deviceIds.add(nic.getDeviceId());
            }
        }
        return deviceIds;
    }

    protected Map<Network, String> getManagementNetworkAndIp(VirtualMachineTemplate template, UserVm vm) {
        Map<Network, String> networkAndIpMap = new HashMap<>();
        Set<Long> managementDeviceIds = getDeviceIdsOfVnfManagementNics(template);
        for (NicVO nic : nicDao.listByVmId(vm.getId())) {
            if (managementDeviceIds.contains((long) nic.getDeviceId()) && nic.getIPv4Address() != null) {
                Network network = networkDao.findById(nic.getNetworkId());
                if (network == null || !Network.GuestType.Isolated.equals(network.getGuestType())) {
                    continue;
                }
                if (!networkModel.areServicesSupportedInNetwork(network.getId(), Network.Service.StaticNat)) {
                    LOGGER.info(String.format("Network ID: %s does not support static nat, " +
                            "skipping this network configuration for VNF appliance", network.getUuid()));
                    continue;
                }
                if (network.getVpcId() != null) {
                    LOGGER.info(String.format("Network ID: %s is a VPC tier, " +
                            "skipping this network configuration for VNF appliance", network.getUuid()));
                    continue;
                }
                if (!networkModel.areServicesSupportedInNetwork(network.getId(), Network.Service.Firewall)) {
                    LOGGER.info(String.format("Network ID: %s does not support firewall, " +
                            "skipping this network configuration for VNF appliance", network.getUuid()));
                    continue;
                }
                networkAndIpMap.put(network, nic.getIPv4Address());
            }
        }
        return networkAndIpMap;
    }

    @Override
    public SecurityGroup createSecurityGroupForVnfAppliance(DataCenter zone, VirtualMachineTemplate template, Account owner,
                                                            DeployVnfApplianceCmd cmd) {
        if (zone == null || !zone.isSecurityGroupEnabled()) {
            return null;
        }
        if (!cmd.getVnfConfigureManagement()) {
            return null;
        }
        LOGGER.debug("Creating security group and rules for VNF appliance");
        Set<Integer> ports = getOpenPortsForVnfAppliance(template);
        if (ports.size() == 0) {
            LOGGER.debug("No need to create security group and rules for VNF appliance as there is no ports to be open");
            return null;
        }
        String securityGroupName = VNF_SECURITY_GROUP_NAME.concat(Long.toHexString(System.currentTimeMillis()));
        SecurityGroupVO securityGroupVO = securityGroupManager.createSecurityGroup(securityGroupName,
                "Security group for VNF appliance", owner.getDomainId(), owner.getId(), owner.getAccountName());
        if (securityGroupVO == null) {
            throw new CloudRuntimeException(String.format("Failed to create security group: %s", securityGroupName));
        }
        List<String> cidrList = cmd.getVnfCidrlist();
        for (Integer port : ports) {
            securityGroupService.authorizeSecurityGroupRule(securityGroupVO.getId(), NetUtils.TCP_PROTO, port, port,
                    null, null, cidrList, null, SecurityRule.SecurityRuleType.IngressRule);
        }
        return securityGroupVO;
    }

    @Override
    public void createIsolatedNetworkRulesForVnfAppliance(DataCenter zone, VirtualMachineTemplate template, Account owner,
                                                          UserVm vm, DeployVnfApplianceCmd cmd)
            throws InsufficientAddressCapacityException, ResourceAllocationException, ResourceUnavailableException {

        Map<Network, String> networkAndIpMap = getManagementNetworkAndIp(template, vm);
        Set<Integer> ports = getOpenPortsForVnfAppliance(template);
        for (Map.Entry<Network, String> entry : networkAndIpMap.entrySet()) {
            Network network = entry.getKey();
            LOGGER.debug("Creating network rules for VNF appliance on isolated network " + network.getUuid());
            String ip = entry.getValue();
            IpAddress publicIp = networkService.allocateIP(owner, zone.getId(), network.getId(), null, null);
            if (publicIp == null) {
                continue;
            }
            publicIp = ipAddressManager.associateIPToGuestNetwork(publicIp.getId(), network.getId(), false);
            if (publicIp.isSourceNat()) {
                // If isolated network is not implemented, the first acquired Public IP will be Source NAT IP
                publicIp = networkService.allocateIP(owner, zone.getId(), network.getId(), null, null);
                if (publicIp == null) {
                    continue;
                }
                publicIp = ipAddressManager.associateIPToGuestNetwork(publicIp.getId(), network.getId(), false);
            }
            final IpAddress publicIpFinal = publicIp;
            final List<String> cidrList = cmd.getVnfCidrlist();
            try {
                boolean result = rulesService.enableStaticNat(publicIp.getId(), vm.getId(), network.getId(), ip);
                if (!result) {
                    throw new CloudRuntimeException(String.format("Failed to create static nat for vm: %s", vm.getUuid()));
                }
            } catch (NetworkRuleConflictException e) {
                throw new CloudRuntimeException(String.format("Failed to create static nat for vm %s due to %s", vm.getUuid(), e.getMessage()));
            }
            if (network.getVpcId() == null) {
                Transaction.execute(new TransactionCallbackWithExceptionNoReturn<>() {
                    @Override
                    public void doInTransactionWithoutResult(final TransactionStatus status) throws CloudRuntimeException {
                        for (Integer port : ports) {
                            FirewallRuleVO newFirewallRule = new FirewallRuleVO(null, publicIpFinal.getId(), port, port, NetUtils.TCP_PROTO,
                                    network.getId(), owner.getAccountId(), owner.getDomainId(), FirewallRule.Purpose.Firewall,
                                    cidrList, null, null, null, FirewallRule.TrafficType.Ingress);
                            newFirewallRule.setDisplay(true);
                            newFirewallRule.setState(FirewallRule.State.Add);
                            firewallRulesDao.persist(newFirewallRule);
                        }
                    }
                });
                firewallService.applyIngressFwRules(publicIp.getId(), owner);
            }
            LOGGER.debug("Created network rules for VNF appliance on isolated network " + network.getUuid());
        }
    }
}