/*
	Build a set of openstack objects for each project (tenant) that we have access to.
	Retuns the list of creds and both ID->project and project->ID maps

	We build a new map each time, copying existing references, so that if a parallel thread
	has a copy and is working from it a change to the map isn't disruptive.

	This function also sets a reference ("_ref_") entry in the map which can be used to pull
	an entry out when any of them will do.

	NOTE: All errors will be logged, but only the first error will be returned to the caller.
*/
func refresh_creds(admin *ostack.Ostack, old_list map[string]*ostack.Ostack, id2pname map[string]*string) (creds map[string]*ostack.Ostack, gerr error) {
	var (
		err error
	)

	creds = make(map[string]*ostack.Ostack) // new map to fill in
	if old_list == nil {
		old_list = creds
	}

	for k, v := range id2pname { // run the list of projects and add creds to the map if we don't have them
		if old_list[*v] == nil {
			osif_sheep.Baa(1, "adding creds for: %s/%s", k, *v)
			creds[*v], err = admin.Dup(v) // duplicate creds for this project and then authorise to get a token

			if err != nil {
				osif_sheep.Baa(1, "WRN: unable to authorise credentials for project: %s   [TGUOSI008]", *v)
				delete(creds, *v)
			}
			if gerr == nil { // ensure error captured for return if last in list is good
				gerr = err
			}
		} else {
			creds[*v] = old_list[*v] // reuse the data
			osif_sheep.Baa(2, "reusing credentials for: %s", *v)
		}

		if creds["_ref"] == nil && creds[*v] != nil { // set the quick reference key
			creds["_ref_"] = creds[*v]
		}
	}

	return
}

/*
	Fetch new maps and update the project list.
	Returns:
		osack reference map
		project name to id map
		id to project name map

	On error err is set, and nil values returned for conversion maps and the old os_list is returned
*/
func update_project(os_admin *ostack.Ostack, old_os_refs map[string]*ostack.Ostack, os_projects map[string]*osif_project, old_pname2id map[string]*string, old_id2pname map[string]*string, update_list bool) (
	os_refs map[string]*ostack.Ostack,
	id2pname map[string]*string,
	pname2id map[string]*string) {

	new_name2id, new_id2pname, err := os_admin.Map_tenants() // fetch new maps, overwrite only if no errors
	if err == nil {
		pname2id = new_name2id
		id2pname = new_id2pname
	} else {
		osif_sheep.Baa(1, "WRN: unable to get tenant name/ID translation data: %s  [TGUOSI010]", err)
		return old_os_refs, old_pname2id, old_id2pname
	}

	if update_list { // asked to update the os_refs too
		os_refs, _ = refresh_creds(os_admin, old_os_refs, id2pname) // periodic update of project cred list
		add2projects(os_projects, os_refs, pname2id, 2)             // add refernces to the projects list
		if osif_sheep.Would_baa(2) {
			for _, v := range os_projects {
				osif_sheep.Baa(2, "update project sees: %s", *v.name)
			}
		}
	} else {
		os_refs = old_os_refs
	}

	osif_sheep.Baa(1, "credentials were updated from openstack")

	return os_refs, pname2id, id2pname
}

/*
	Given a token, return true if the token is valid for one of the roles listed in role.
	Role is a list of space separated role names.  Token is expected to be token/projectr;
	we will test only with the indicated project.

	2015.12.09 - We will only accept token/project strings as trying a token against
	every proejct that Tegu knows about doesn't scale in the openstack world, and openstack
	doesn't make a 'generic' crack function available.  If a string is passed as token
	and _NOT_ token/project it will be rejected with an appropriate error.

	WARNING:
	If the token passed to us to crack is not a valid token the error message that openstack
	returns might be very misleading, suggesting that Tegu is not authorised to crack the
	token:
		Unauthorized (401): The request you have made requires authentication.

	This is not cool openstack.  The token is invalid, full stop and you should say so.
*/
func has_any_role(os_refs map[string]*ostack.Ostack, admin *ostack.Ostack, token *string, roles *string) (userproj string, err error) {
	rtoks := strings.Split(*roles, ",") // simple tokenising of role list

	userproj = ""
	if strings.Contains(*token, "/") { // assume it's token/project (could also be tok/proj/junk)
		const p int = 1 // order in split tokens (project)
		const t int = 0 // order in split tokens (actual token)

		toks := strings.Split(*token, "/")
		if toks[p] == "" {
			osif_sheep.Baa(2, "has_any_role: project/token had empty project")
			return "", fmt.Errorf("project portion of token/project was empty")
		}

		stuff, err := admin.Crack_ptoken(&toks[t], &toks[p], false) // crack user info based on project and token
		if err == nil {
			state := gizmos.Map_has_any(stuff.Roles, rtoks) // true if any from rtoks list matches any in Roles
			if state {
				osif_sheep.Baa(2, "has_any_role: token/project validated for roles: %s", *roles)
				return (stuff.User + "," + stuff.TenantId), nil
			} else {
				err = fmt.Errorf("none matched")
			}
		}

		osif_sheep.Baa(2, "has_any_role: token/project %s/%s not valid for roles: %s: %s (caution, 401 error from openstack is misleading if it suggests the request requires auth)", toks[0], toks[1], *roles, err)
		return "", fmt.Errorf("has_any_role: token/project not valid for roles: %s: %s", *roles, err)
	}

	return "", fmt.Errorf("has_any_role: rejected: data was NOT of the form token/project")

}

/*
	Given a token, return true if the token is valid for one of the roles listed in role.
	Role is a list of space separated role names.  If token is actually tokken/project, then
	we will test only with the indicated project. Otherwise we will test the token against
	every project we know about and return true if any of the roles in the list is defined
	for the user in any project.  This _is_ needed to authenticate Tegu requests which are not
	directly project oriented (e.g. set capacities, graph, etc.), so it is legitimate for
	a token to be submitted without a leading project/ string.
*/
func has_any_role(os_refs map[string]*ostack.Ostack, admin *ostack.Ostack, token *string, roles *string) (has_role bool, err error) {
	rtoks := strings.Split(*roles, ",") // simple tokenising of role list

	has_role = false
	if strings.Contains(*token, "/") { // assume it's token/project
		const p int = 1 // order in split tokens (project)
		const t int = 0 // order in split tokens (actual token)

		toks := strings.Split(*token, "/")
		if toks[p] == "" {
			osif_sheep.Baa(2, "has_any_role: project/token had empty project")
			return false, fmt.Errorf("project portion of token/project was empty")
		}

		stuff, err := admin.Crack_ptoken(&toks[t], &toks[p], false) // crack user info based on project and token
		if err == nil {
			state := gizmos.Map_has_any(stuff.Roles, rtoks) // true if any from rtoks list matches any in Roles
			if state {
				osif_sheep.Baa(2, "has_any_role: token/project validated for roles: %s", *roles)
				return true, nil
			} else {
				err = fmt.Errorf("none matched")
			}
		}

		osif_sheep.Baa(2, "has_any_role: token/project not valid for roles: %s: %s", *roles, err)
		return false, fmt.Errorf("has_any_role: token/project not valid for roles: %s: %s", roles, err)
	}

	for _, v := range os_refs {
		pname, _ := v.Get_project()
		osif_sheep.Baa(2, "has_any_role: checking %s", *pname)

		stuff, err := admin.Crack_ptoken(token, pname, false) // return a stuff struct with details about the token

		if err == nil {
			err = fmt.Errorf("role not defined; %s", *roles) // asume error
			state := gizmos.Map_has_any(stuff.Roles, rtoks)  // true if any role token matches anything from ostack
			if state {
				osif_sheep.Baa(2, "has_any_role: verified in %s", *pname)
				return true, nil
			}
		} else {
			osif_sheep.Baa(2, "has_any_role: crack failed for project=%s: %s", *pname, err)
		}
	}

	if err == nil {
		err = fmt.Errorf("undetermined reason")
	}

	osif_sheep.Baa(1, "unable to verify role: %s: %s", *roles, err)
	return false, err
}

/*
	Verifies that the token passed in is a valid token for the default user (a.k.a. the tegu admin) given in the
	config file.
	Returns "ok" (err is nil) if it is good, and an error otherwise.
*/
func validate_admin_token(admin *ostack.Ostack, token *string, user *string) error {

	osif_sheep.Baa(2, "validating admin token")
	exp, err := admin.Token_validation(token, user) // ensure token is good and was issued for user
	if err == nil {
		osif_sheep.Baa(2, "admin token validated successfully: %s expires: ", *token, exp)
	} else {
		osif_sheep.Baa(1, "admin token invalid: %s", err)
	}

	return err
}

func identity_auth(o *ostack.Ostack, identity_ver *int) (err error) {
	switch *identity_ver {
	case 2:
		err = o.Authorise()
	case 3:
		err = o.Authorise_v3()
	default:
		fmt.Println("The identity version should be either 2 or 3")
		os.Exit(1)
	}
	return
}

/*
	Crates an array of VM info that can be inserted into the network graph for an entire
	project.
*/
func (p *osif_project) Get_all_info(creds *ostack.Ostack, inc_project bool) (ilist []*Net_vm, err error) {

	err = nil
	ilist = nil

	if p == nil || creds == nil {
		err = fmt.Errorf("creds were nil")
		osif_sheep.Baa(2, "lazy update: unable to get_all: nil creds")
		return
	}

	if time.Now().Unix()-p.lastfetch > 90 { // if not fresh force a reload first
		err = p.refresh_maps(creds)
		osif_sheep.Baa(2, "lazy update: data reload for: get_all")
		if err != nil {
			return
		}
	}

	found := 0
	ilist = make([]*Net_vm, len(p.ip2vmid))

	for k, _ := range p.ip2vmid {
		name := p.ip2vm[k]
		_, id, ip4, fip4, mac, gw, phost, gwmap, _, lerr := p.Get_info(&k, creds, true)
		if lerr == nil {
			if name == nil {
				n := "unknown"
				name = &n
			}
			ilist[found] = Mk_netreq_vm(name, id, ip4, nil, phost, mac, gw, fip4, gwmap)
			found++
		}
	}

	pname, _ := creds.Get_project()
	osif_sheep.Baa(1, "get all osvm info found %d VMs in %s", found, *pname)

	return
}

/*
	Build all translation maps for the given project.
	Does NOT replace a map with a nil map; we assume this is an openstack glitch.

	CAUTION:  ip2 maps are complete, where vm2 or vmid2 maps are not because
			they only reference one of the VMs IP addresses where there might
			be many.
*/
func (p *osif_project) refresh_maps(creds *ostack.Ostack) (rerr error) {

	if p == nil {
		return
	}
	if creds == nil {
		osif_sheep.Baa(1, "IER: refresh_maps given nil creds")
		rerr = fmt.Errorf("creds were nil")
		return
	}

	if *p.name != "_ref_" { // we don't fetch maps from the ref since it's not real
		olastfetch := p.lastfetch // last fetch -- ensure it wasn't fetched while we waited
		p.rwlock.Lock()           // wait for a write lock
		defer p.rwlock.Unlock()   // ensure unlocked on return

		if olastfetch != p.lastfetch { // assume read done while we waited
			return
		}

		osif_sheep.Baa(2, "refresh: creating VM maps from: %s", creds.To_str())
		vmid2ip, ip2vmid, vm2ip, vmid2host, vmip2vm, err := creds.Mk_vm_maps(nil, nil, nil, nil, nil, true)
		if err != nil {
			osif_sheep.Baa(2, "WRN: unable to map VM info (vm): %s; %s   [TGUOSI003]", creds.To_str(), err)
			rerr = err
			creds.Expire() // force re-auth next go round
		} else {

			osif_sheep.Baa(2, "%s map sizes: vmid2ip=%d ip2vmid=%d vm2ip=%d vmid2host=%d vmip2vm=%d",
				*p.name, len(vmid2ip), len(ip2vmid), len(vm2ip), len(vmid2host), len(vmip2vm))
			if len(vmip2vm) > 0 && len(vmid2ip) > 0 && len(ip2vmid) > 0 && len(vm2ip) > 0 && len(vmid2host) > 0 { // don't refresh unless all are good
				p.vmid2ip = vmid2ip // id and vm name map to just ONE ip address
				p.vm2ip = vm2ip
				p.ip2vmid = ip2vmid     // the only complete list of ips
				p.vmid2host = vmid2host // id to physical host
				p.ip2vm = vmip2vm
			}
		}

		fip2ip, ip2fip, err := creds.Mk_fip_maps(nil, nil, true)
		if err != nil {
			osif_sheep.Baa(2, "WRN: unable to map VM info (fip): %s; %s   [TGUOSI004]", creds.To_str(), err)
			rerr = err
			creds.Expire() // force re-auth next go round
		} else {
			osif_sheep.Baa(2, "%s map sizes: ip2fip=%d fip2ip=%d", *p.name, len(ip2fip), len(fip2ip))
			if len(ip2fip) > 0 && len(fip2ip) > 0 {
				p.ip2fip = ip2fip
				p.ip2fip = fip2ip
			}
		}

		ip2mac, _, err := creds.Mk_mac_maps(nil, nil, true)
		if err != nil {
			osif_sheep.Baa(2, "WRN: unable to map MAC info: %s; %s   [TGUOSI005]", creds.To_str(), err)
			rerr = err
			creds.Expire() // force re-auth next go round
		} else {
			osif_sheep.Baa(2, "%s map sizes: ip2mac=%d", *p.name, len(ip2mac))
			if len(ip2mac) > 0 {
				p.ip2mac = ip2mac
			}
		}

		gwmap, _, gwmac2id, _, _, gwip2phost, err := creds.Mk_gwmaps(nil, nil, nil, nil, nil, nil, true, false) // gwmap is mac2ip
		if err != nil {
			osif_sheep.Baa(2, "WRN: unable to map gateway info: %s; %s   [TGUOSI006]", creds.To_str(), err)
			creds.Expire() // force re-auth next go round
		} else {
			osif_sheep.Baa(2, "%s map sizes: gwmap=%d", *p.name, len(gwmap))
			if len(gwmap) > 0 {
				p.gwmap = gwmap
			}

			for mac, id := range gwmac2id { // run the gateway info and insert as though they were first class VMs
				ip := gwmap[mac]
				p.vmid2ip[*id] = ip
				p.ip2vmid[*ip] = id
				p.vmid2host[*id] = gwip2phost[*ip]
				p.vm2ip[*ip] = ip // gw is nameless, so use the ip address
			}
		}

		_, gw2cidr, err := creds.Mk_snlists() // get list of gateways and their subnet cidr
		if err == nil && gw2cidr != nil {
			p.gw2cidr = gw2cidr
		} else {
			if err != nil {
				osif_sheep.Baa(1, "WRN: unable to create gateway to cidr map: %s; %s   [TGUOSI007]", creds.To_str(), err)
			} else {
				osif_sheep.Baa(1, "WRN: unable to create gateway to cidr map: %s  no reason given   [TGUOSI007]", creds.To_str())
			}
//.........这里部分代码省略.........

/*
	executed as a goroutine this loops waiting for messages from the tickler and takes
	action based on what is needed.
*/
func Osif_mgr(my_chan chan *ipc.Chmsg) {

	var (
		msg           *ipc.Chmsg
		os_list       string                    = ""
		os_sects      []string                       // sections in the config file
		os_refs       map[string]*ostack.Ostack      // creds for each project we need to request info from
		os_projects   map[string]*osif_project       // list of project info (maps)
		os_admin      *ostack.Ostack                 // admin creds
		refresh_delay int                       = 15 // config file can override
		id2pname      map[string]*string             // project id/name translation maps
		pname2id      map[string]*string
		req_token     bool    = false // if set to true in config file the token _must_ be present when called to validate
		def_passwd    *string         // defaults and what we assume are the admin creds
		def_usr       *string
		def_url       *string
		def_project   *string
		def_region    *string
	)

	osif_sheep = bleater.Mk_bleater(0, os.Stderr) // allocate our bleater and attach it to the master
	osif_sheep.Set_prefix("osif_mgr")
	tegu_sheep.Add_child(osif_sheep) // we become a child so that if the master vol is adjusted we'll react too

	//ostack.Set_debugging( 0 );

	// ---- pick up configuration file things of interest --------------------------

	if cfg_data["osif"] != nil { // cannot imagine that this section is missing, but don't fail if it is
		def_passwd = cfg_data["osif"]["passwd"] // defaults applied if non-section given in list, or info omitted from the section
		def_usr = cfg_data["osif"]["usr"]
		def_url = cfg_data["osif"]["url"]
		def_project = cfg_data["osif"]["project"]

		p := cfg_data["osif"]["refresh"]
		if p != nil {
			refresh_delay = clike.Atoi(*p)
			if refresh_delay < 15 {
				osif_sheep.Baa(1, "resresh was too small (%ds), setting to 15", refresh_delay)
				refresh_delay = 15
			}
		}

		p = cfg_data["osif"]["debug"]
		if p != nil {
			v := clike.Atoi(*p)
			if v > -5 {
				ostack.Set_debugging(v)
			}
		}

		p = cfg_data["osif"]["region"]
		if p != nil {
			def_region = p
		}

		p = cfg_data["osif"]["ostack_list"] // preferred placement in osif section
		if p == nil {
			p = cfg_data["default"]["ostack_list"] // originally in default, so backwards compatable
		}
		if p != nil {
			os_list = *p
		}

		p = cfg_data["osif"]["require_token"]
		if p != nil && *p == "true" {
			req_token = true
		}

		p = cfg_data["osif"]["verbose"]
		if p != nil {
			osif_sheep.Set_level(uint(clike.Atoi(*p)))
		}
	}

	if os_list == " " || os_list == "" || os_list == "off" {
		osif_sheep.Baa(0, "osif disabled: no openstack list (ostack_list) defined in configuration file or setting is 'off'")
	} else {
		// TODO -- investigate getting id2pname maps from each specific set of creds defined if an overarching admin name is not given

		os_admin = get_admin_creds(def_url, def_usr, def_passwd, def_project, def_region) // this will block until we authenticate
		if os_admin != nil {
			osif_sheep.Baa(1, "admin creds generated, mapping tenants")
			pname2id, id2pname, _ = os_admin.Map_tenants() // list only projects we belong to
			for k, v := range pname2id {
				osif_sheep.Baa(1, "project known: %s %s", k, *v) // useful to see in log what projects we can see
			}
		} else {
			id2pname = make(map[string]*string) // empty maps and we'll never generate a translation from project name to tenant ID since there are no default admin creds
			pname2id = make(map[string]*string)
			if def_project != nil {
				osif_sheep.Baa(0, "WRN: unable to use admin information (%s, proj=%s, reg=%s) to authorise with openstack  [TGUOSI009]", def_usr, def_project, def_region)
			} else {
				osif_sheep.Baa(0, "WRN: unable to use admin information (%s, proj=no-project, reg=%s) to authorise with openstack  [TGUOSI009]", def_usr, def_region) // YES msg ids are duplicated here
			}
		}
//.........这里部分代码省略.........

func main() {
	var (
		o2           *ostack.Ostack     = nil
		all_projects map[string]*string // list of all projects from keystone needed by several tests
		project_map  map[string]*string // list of projects we belong to

		pwd *string
		usr *string
		url *string
	)

	fmt.Fprintf(os.Stderr, "api debugger: v1.11/19235\n")
	err_count := 0

	{
		p := os.Getenv("OS_USERNAME")
		usr = &p
	} // defaults from environment (NOT project!)
	{
		p := os.Getenv("OS_AUTH_URL")
		url = &p
	}
	{
		p := os.Getenv("OS_PASSWORD")
		pwd = &p
	}

	// tests are -<capital> except -P
	chost_only := flag.Bool("c", false, "list only compute hosts")
	dump_stuff := flag.Bool("d", false, "dump stuff")
	host2find := flag.String("h", "", "host search (if -L)")
	inc_project := flag.Bool("i", false, "include project in names")
	show_latency := flag.Bool("l", false, "show latency on openstack calls")
	pwd = flag.String("p", *pwd, "password")
	project := flag.String("P", "", "project for subsequent tests")
	region := flag.String("r", "", "region")
	token := flag.String("t", "", "token")
	usr = flag.String("u", *usr, "user-name")
	url = flag.String("U", *url, "auth-url")
	verbose := flag.Bool("v", false, "verbose")
	target_vm := flag.String("vm", "", "target VM ID")

	run_all := flag.Bool("A", false, "run all tests") // the various tests
	run_crack := flag.Bool("C", false, "crack a token")
	run_endpt := flag.Bool("E", false, "test endpoint list gen")
	run_fip := flag.Bool("F", false, "run fixed-ip test")
	run_gw_map := flag.Bool("G", false, "run gw list test")
	run_mac := flag.Bool("H", false, "run mac-ip map test")
	run_info := flag.Bool("I", false, "run vm info map test")
	run_if := flag.Bool("IF", false, "run get interfaces test")
	run_hlist := flag.Bool("L", false, "run list-host test")
	run_maps := flag.Bool("M", false, "run maps test")
	run_netinfo := flag.Bool("N", false, "run netinfo maps")
	run_user := flag.Bool("R", false, "run user/role test")
	run_subnet := flag.Bool("S", false, "run subnet map test")
	run_vfp := flag.Bool("V", false, "run token valid for project test")
	run_projects := flag.Bool("T", false, "run projects test")
	flag.Parse() // actually parse the commandline

	if *token == "" {
		token = nil
	}

	if *dump_stuff {
		ostack.Set_debugging(-100) // resets debugging counts to 0
	}
	if *show_latency {
		ostack.Set_latency_debugging(true)
	}

	if url == nil || usr == nil || pwd == nil {
		fmt.Fprintf(os.Stderr, "usage: debug_ostack_api -U URL -u user -p password [-d] [-i] [-v] [-A] [-F] [-L] [-M] [-T] [-V]\n")
		fmt.Fprintf(os.Stderr, "usage: debug_ostack_api --help\n")
		os.Exit(1)
	}

	o := ostack.Mk_ostack_region(url, usr, pwd, nil, region)
	if o == nil {
		fmt.Fprintf(os.Stderr, "[FAIL] aborting: unable to make ostack structure\n")
		os.Exit(1)
	}

	fmt.Fprintf(os.Stderr, "[OK]   created openstack interface structure for: %s %s\n", *usr, *url)

	region_str := "default"
	if *region == "" {
		region = nil
	} else {
		region_str = *region
	}

	err := o.Authorise() // generic auth without region since we don't give a project on the default creds
	if err != nil {
		fmt.Fprintf(os.Stderr, "[FAIL] aborting: authorisation failed: region=%s:  %s\n", region_str, err)
		os.Exit(1)
	}

	fmt.Fprintf(os.Stderr, "\n[OK]   authorisation for %s (default creds) successful admin flag: %v\n", *usr, o.Isadmin())

	if *project == "" || *run_all || *run_projects { // map projects that the user belongs to
//.........这里部分代码省略.........