def test_filtering_by_dl():
    """
    Title: Tests dl-based packet filtering.

    Scenario:
    When: A VM sends UDP packets to another host on the same bridge.
    Then: The UDP packets reach the receiver without filtering rule chains.
    Then: A filtering rule chain based on mac address is set on the bridge.
    And: UDP packets from the same host do NOT reach the same destination host.
    """
    outside = BM.get_iface_for_port("bridge-000-001", 2)
    inside = BM.get_iface_for_port("bridge-000-001", 3)

    # Reset an in-bound filter.
    unset_bridge_port_filters("bridge-000-001", 3)

    port_num = get_random_port_num()
    f1 = async_assert_that(
        inside,
        receives("dst host 172.16.1.2 and udp", within_sec(5)),
        "No filtering: inside receives UDP packets from outside.",
    )
    f2 = outside.send_udp("aa:bb:cc:00:01:02", "172.16.1.2", 41, src_port=port_num, dst_port=port_num)
    wait_on_futures([f1, f2])

    # Set a filtering rule based on mac addresses
    set_bridge_port_filters("bridge-000-001", 3, "connection_tracking_dl_in", "connection_tracking_dl_out")

    f1 = async_assert_that(
        inside,
        should_NOT_receive("dst host 172.16.1.2 and udp", within_sec(5)),
        "Packets are filtered based on mac address.",
    )
    f2 = outside.send_udp("aa:bb:cc:00:01:02", "172.16.1.2", 41, src_port=port_num, dst_port=port_num)
    wait_on_futures([f1, f2])

def test_floating_ip():
    """
    Title: Tests a floating IP.

    Scenario 1:
    When: a VM sends an ICMP echo request to a floating IP address
          (100.100.100.100).
    Then: the router performs DNAT on the message according to the rule chain
          set to the router,
    And: the receiver VM should receive the ICMP echo packet,
    And: the receiver sends back an ICMP reply with its original IP address
         as a source address.
    And: the router applies SNAT to the reply packet.
    And: the sender receives the reply with src address NATed to the floating IP
         address.
    """
    sender = BM.get_iface_for_port("bridge-000-001", 2)
    receiver = BM.get_iface_for_port("bridge-000-002", 2)
    # Reset in-/out-bound filters.
    unset_filters("router-000-001")
    feed_receiver_mac(receiver)

    f1 = async_assert_that(receiver, should_NOT_receive("dst host 172.16.2.1 and icmp", within_sec(10)))
    sender.ping_ipv4_addr("100.100.100.100")
    wait_on_futures([f1])

    # Configure floating IP address with the router
    set_filters("router-000-001", "pre_filter_floating_ip", "post_filter_floating_ip")

    f1 = async_assert_that(receiver, receives("dst host 172.16.2.1 and icmp", within_sec(10)))
    f2 = async_assert_that(sender, receives("src host 100.100.100.100 and icmp", within_sec(10)))
    sender.ping_ipv4_addr("100.100.100.100")
    wait_on_futures([f1, f2])

def test_connection_tracking_with_drop_by_dl():
    """
    Title: Tests dl-based connection tracking.

    Scenario:
    When: A VM inside a FW sends UDP packets to a VM outside.
    And: The outside receives the UDP packets.
    Then: A connection-tracking-based peep hole is established.
    And: The outside now can send UDP packets to the inside. 
    """
    outside = BM.get_iface_for_port("bridge-000-001", 2)
    inside = BM.get_iface_for_port("bridge-000-001", 3)

    # Set a filtering rule based on mac addresses
    set_bridge_port_filters("bridge-000-001", 3, "connection_tracking_dl_in", "connection_tracking_dl_out")

    # Send forward packets to set up a connection-tracking based peep hole in
    # the filter.
    port_num = get_random_port_num()
    f1 = async_assert_that(
        outside,
        receives("dst host 172.16.1.1 and udp", within_sec(5)),
        "The outside host receives forward packets " "from the inside.",
    )
    f2 = inside.send_udp("aa:bb:cc:00:01:01", "172.16.1.1", 41, src_port=port_num, dst_port=port_num)
    wait_on_futures([f1, f2])

    # Verify the peep hole.
    f1 = async_assert_that(
        inside,
        receives("dst host 172.16.1.2 and udp", within_sec(5)),
        "The outside host can now send packets to the inside" "via a peep hole.",
    )
    f2 = outside.send_udp("aa:bb:cc:00:01:02", "172.16.1.2", 41, src_port=port_num, dst_port=port_num)
    wait_on_futures([f1, f2])

def test_tracing_with_limit():
    """
    Title: Tracing with a limit

    Scenario 1:
    When: a VM sends 20 ICMP echo requests over a trace request with limit 10
    Then: Trace data appears for the ingress and the egress host,
          but only for the first 10.
    Then: when disabled and reenabled, new trace data shows up
    """
    tracerequest = VTM.get_tracerequest('ping-trace-request-limited')
    try:
        set_filters('router-000-001', 'pre_filter_001', 'post_filter_001')

        tracerequest.set_enabled(True)
        time.sleep(5)

        flowtraces = get_flow_traces(tracerequest.get_id())
        assert (len(flowtraces) == 0)

        sender = BM.get_iface_for_port('bridge-000-001', 2)
        receiver = BM.get_iface_for_port('bridge-000-002', 2)

        feed_receiver_mac(receiver)
        for i in range(0, 20):
            f2 = async_assert_that(receiver, receives('dst host 172.16.2.1 and icmp',
                                                      within_sec(10)))
            f3 = async_assert_that(sender, receives('src host 172.16.2.1 and icmp',
                                                    within_sec(10)))
            f1 = sender.ping_ipv4_addr('172.16.2.1')
            wait_on_futures([f1, f2, f3])

        time.sleep(5)

        flowtraces = get_flow_traces(tracerequest.get_id())
        assert (len(flowtraces) == 10)

        # ensure both packets were traced on both hosts
        for i in range(0, 10):
            assert(len(get_hosts(tracerequest.get_id(), flowtraces[i])) == 2)

        tracerequest.set_enabled(False)
        tracerequest.set_enabled(True)

        time.sleep(5)

        f2 = async_assert_that(receiver, receives('dst host 172.16.2.1 and icmp',
                                                  within_sec(10)))
        f3 = async_assert_that(sender, receives('src host 172.16.2.1 and icmp',
                                                within_sec(10)))
        f1 = sender.ping_ipv4_addr('172.16.2.1')
        wait_on_futures([f1, f2, f3])

        time.sleep(5)

        flowtraces = get_flow_traces(tracerequest.get_id())
        assert (len(flowtraces) == 11)
    finally:
        unset_filters('router-000-001')
        tracerequest.set_enabled(False)

def ping_to_vtep(bridge_name, port_index, dest_ip,
                 interval=0.5, count=4, retries=1):
    try:
        time.sleep(2)
        sender = BM.get_iface_for_port(bridge_name, port_index)
        f1 = sender.ping_ipv4_addr(dest_ip, interval=interval, count=count)
        wait_on_futures([f1])
        output_stream, exec_id = f1.result()
        exit_status = sender.compute_host.check_exit_status(exec_id,
                                                            output_stream,
                                                            timeout=60)

        assert_that(exit_status, equal_to(0),
                    "Ping to from {0}.{1} to {2} failed.".format(bridge_name,
                                                                 port_index,
                                                                 dest_ip))
    except Exception:
        if retries == 0:
            assert_that(-1, equal_to(0),
                        "Ping to from {0}.{1} to {2} failed.".format(bridge_name,
                                                                     port_index,
                                                                     dest_ip))

        ping_to_vtep(bridge_name, port_index, dest_ip, count, interval,
                     retries - 1)

def ping(src, dst, expected_failure=False, retries=3):
    try:
        # src and dst could be the vm object
        # or the port name where the vm is bound
        LOG.info("VPNaaS: pinging from %s to %s" % (src, dst))
        src_vm = src if not isinstance(src, str) \
            else BM.get_interface_on_vport(src)
        dst_vm = dst if not isinstance(dst, str) \
            else BM.get_interface_on_vport(dst)
        f1 = src_vm.ping_ipv4_addr(dst_vm.get_ip(update=True),
                                      interval=1,
                                      count=5)
        wait_on_futures([f1])
        output_stream, exec_id = f1.result()
        exit_status = src_vm.compute_host.check_exit_status(exec_id,
                                                            output_stream,
                                                            timeout=10)

        assert_that(exit_status, equal_to(0), "Ping did not return any data")
    except AssertionError:
        if retries == 0:
            if expected_failure:
                return
            raise AssertionError("Ping failed after max retries. Giving up.")
        LOG.debug("VPNaaS: failed ping from %s to %s... (%d retries left)" %
                  (src, dst, retries))
        ping(src, dst, expected_failure, retries=retries-1)

def _ping_from_mn(midoVmIface, exHostIface, count=3, do_arp=False):

    f1 = async_assert_that(exHostIface,
                           receives('dst host 172.16.0.224 and icmp',
                                    within_sec(20)))
    f2 = midoVmIface.ping4(exHostIface, count=count, do_arp=do_arp)
    wait_on_futures([f1, f2])

def test_fragmented_packets():
    """
    Title: L3 connectivity over bridge and router
           (MN-L3-ICMP-2) with large packets that will be fragmented

    Scenario 1:
    When: a VM sends a ICMP echo request with size >MTU uwing ping command
          to a different subnet
    Then: the receiver VM should receive the ICMP echo packet.
    And: the ping command succeeds
    """

    sender = BM.get_iface_for_port('bridge-000-001', 2)
    receiver = BM.get_iface_for_port('bridge-000-002', 2)

    # The receiver VM needs to send some frames so the MN Router learns
    # the VM's mac address. Otherwise this test would fail with binding2
    # because the MidoNet Router forwards the ICMP with the previous mac
    # found in bindings1 in ethernet headers.
    # Issue: https://midobugs.atlassian.net/browse/MN-79
    receiver.ping4(sender, 0.5, 3, True, 2000, do_arp=True)

    f1 = async_assert_that(receiver,
                           receives('dst host 172.16.2.1 and icmp', within_sec(5)))

    f2 = sender.ping4(receiver, 0.5, 3, False, 2000)

    wait_on_futures([f1, f2])

def test_dnat():
    """
    Title: Tests DNAT on ping messages.

    Scenario 1:
    When: a VM sends ICMP echo request with ping command to an unassigned IP
          address.
    Then: the router performs DNAT on the message according to the rule chain
          set to the router,
    And: the receiver VM should receive the ICMP echo packet,
    And: the ping command succeeds
    """
    sender = BM.get_iface_for_port('bridge-000-001', 2)
    receiver = BM.get_iface_for_port('bridge-000-002', 2)

    # Reset in-/out-bound filters.
    unset_filters('router-000-001')
    feed_receiver_mac(receiver)

    f2 = async_assert_that(receiver, should_NOT_receive('dst host 172.16.2.1 and icmp',
                                             within_sec(5)))
    f1 = sender.ping_ipv4_addr('100.100.100.100')
    wait_on_futures([f1, f2])

    # Set DNAT rule chains to the router
    set_filters('router-000-001', 'pre_filter_001', 'post_filter_001')

    f2 = async_assert_that(receiver, receives('dst host 172.16.2.1 and icmp',
                                   within_sec(5)))
    f3 = async_assert_that(sender, receives('src host 100.100.100.100 and icmp',
                                 within_sec(5)))
    f1 = sender.ping_ipv4_addr('100.100.100.100')
    wait_on_futures([f1, f2, f3])

def test_snat():
    """
    Title: Tests SNAT on ping messages.

    Scenario:
    When: a VM sends ICMP echo request with ping command to a different subnet,
    Then: the router performs SNAT on the message according to the rule chain
          set to the router,
    And: the receiver VM should receive the ICMP echo packet, with src address
         NATted,
    And: the ping command succeeds.
    """
    sender = BM.get_iface_for_port('bridge-000-001', 2)
    receiver = BM.get_iface_for_port('bridge-000-002', 2)

    # Reset in-/out-bound filters.
    unset_filters('router-000-001')
    feed_receiver_mac(receiver)

    # No SNAT configured. Should not receive SNATed messages.
    f2 = async_assert_that(receiver, should_NOT_receive('src host 172.16.1.100 and icmp',
                                             within_sec(5)))
    f1 = sender.ping4(receiver)
    wait_on_futures([f1, f2])

    # Set SNAT rule chains to the router
    set_filters('router-000-001', 'pre_filter_002', 'post_filter_002')

    # The receiver should receive SNATed messages.
    f2 = async_assert_that(receiver, receives('src host 172.16.1.100 and icmp',
                                   within_sec(5)))
    f3 = async_assert_that(sender, receives('dst host 172.16.1.1 and icmp',
                                 within_sec(5)))
    f1 = sender.ping4(receiver)
    wait_on_futures([f1, f2, f3])

def test_icmp_autobind_vm_in_binding():
    vm1 = BM2.get_interface_on_vport("port1")
    vm2 = BM2.get_interface_on_vport("port2")
    # Test ping works
    f1 = async_assert_that(vm2, receives("dst host %s and icmp" % vm2.get_ip(), within_sec(10)))
    f2 = vm1.ping4(vm2)

    wait_on_futures([f1, f2])

def _ping_to_mn(midoVmIface, exHostIface, count=3, do_arp=False):

    exHostIface.clear_arp()
    f1 = async_assert_that(midoVmIface,
                           receives('dst host 172.16.0.1 and icmp',
                                    within_sec(5)))
    f2 = exHostIface.ping4(midoVmIface, count=count, do_arp=do_arp)
    wait_on_futures([f1, f2])

def check_return_flow(src_vm, dst_vm, snat_ip, snat_port, dst_port, src_port):
    # And expect: Internal VM receives return traffic
    recv_filter = 'udp and port %d and ip dst %s' % (dst_port, dst_vm.get_ip())
    f = async_assert_that(dst_vm, receives(recv_filter, within_sec(10)))
    # When: sending return flows
    src_vm.execute('hping3 -c 1 -q -2 -s %s -p %s %s' %
                   (src_port, snat_port, snat_ip))
    wait_on_futures([f])

def check_forward_flow(src_port_no):
    dst_mac = mac_for(downlink_port())
    fs = expect_forward()
    f = downlink_iface().send_udp(dst_mac,
                                  '21.42.84.168',
                                  41,
                                  src_port=src_port_no,
                                  dst_port=1080)
    wait_on_futures([f, fs])

def test_icmp_autobind():
    vm1 = BM.get_interface_on_vport('port1')
    vm2 = BM.get_interface_on_vport('port2')
    # Test ping works
    f1 = async_assert_that(vm2,
                           receives('dst host %s and icmp' % vm2.get_ip(),
                                    within_sec(10)))
    f2 = vm1.ping4(vm2)

    wait_on_futures([f1, f2])

def test_ping_host_on_vtep_from_one_mm():
    '''Tests if a VM can ping an IP address behind a VTEP from one host.'''
    sender = BM.get_iface_for_port('bridge-000-001', 1)

    pcap_filter = 'src host %s and icmp' % vm_on_vtep

    # Ping an IP address on the physical VTEP from a VM on a virtual bridge.
    f1 = sender.ping_ipv4_addr(vm_on_vtep)
    f2 = async_assert_that(sender, receives(pcap_filter, within_sec(5)))
    wait_on_futures([f1, f2])

def feed_receiver_mac(receiver):
    """Feeds the receiver's mac address to the MidoNet router."""
    try:
        router_port = VTM.get_router("router-000-001").get_port(2)
        router_ip = router_port.get_mn_resource().get_port_address()
        receiver_ip = receiver.get_ip()
        f1 = async_assert_that(receiver, receives("dst host %s" % receiver_ip, within_sec(10)))
        receiver.send_arp_request(router_ip)
        wait_on_futures([f1])
    except:
        LOG.warn("Oops, sending ARP from the receiver VM failed.")

def send_udp(sender, receiver, hw_dst, dst_p, src_p, mirror = None):
    hw_src = sender.get_mac_addr()
    ip_src = sender.get_ip()
    ip_dst = receiver.get_ip()

    udp_filter = "dst host %s and dst port %d" % (ip_dst, dst_p)
    futures = []
    futures.append(async_assert_that(receiver, receives(udp_filter, within_sec(15))))
    if mirror is not None:
        futures.append(async_assert_that(mirror, receives(udp_filter, within_sec(15))))

    sender.send_udp(hw_dst, ip_dst, src_port = src_p, dst_port = dst_p)
    wait_on_futures(futures)

def _send_icmp(sender, receiver, payload, target_ipv4,
               expect, expect_icmp_frag_needed = False):
    f1 = async_assert_that(receiver,
                           expect('dst host %s and icmp' % target_ipv4,
                                  within_sec(5)))

    f2 = _async_assert_receives_icmp_frag_needed(sender,
                                                 expect_icmp_frag_needed)

    time.sleep(1)

    f3 = sender.ping4(receiver, 0.5, 3, False, payload)

    wait_on_futures([f1, f2, f3])

def test_mac_learning():
    """
    Title: Bridge mac learning

    Scenario 1:
    When: the destination ethernet address has never been seen before.
    Then: the bridge should flood the ethernet unicast

    Scenario 2:
    When: the destination ethernet address has been seen before.
    Then: the bridge should not flood the ethernet frame, instaed it should
          forward to only the port that is connected to the interface with
          the mac address.
    """
    sender = BM.get_iface_for_port('bridge-000-001', 1)
    iface_with_the_hw_addr = BM.get_iface_for_port('bridge-000-001', 2)
    iface_x = BM.get_iface_for_port('bridge-000-001', 3)

    hw_addr = iface_with_the_hw_addr.get_mac_addr()
    match_on_the_hw_addr = 'ether dst ' + hw_addr

    ethernet_unicast_to_the_hw_addr = '%s-7e:1f:ff:ff:ff:ff-aa:bb' % (hw_addr)

    # Scenario 1:
    # Both interfaces should get the frname as the bridge should flood it.

    f1 = async_assert_that(iface_with_the_hw_addr,
                           receives(match_on_the_hw_addr, within_sec(5)))
    f2 = async_assert_that(iface_x,
                           receives(match_on_the_hw_addr, within_sec(5)))
    time.sleep(1)

    sender.send_ether(ethernet_unicast_to_the_hw_addr, count=3)
    wait_on_futures([f1, f2])

    # Scenario 2:

    # Get the bridge to learn the mac address
    iface_with_the_hw_addr.ping4(sender, sync=True)

    time.sleep(1)

    # only iface_with_the_hw_addr should receives the ehternet unicast
    f1 = async_assert_that(iface_with_the_hw_addr,
                           receives(match_on_the_hw_addr, within_sec(5)))
    f2 = async_assert_that(iface_x,
                           should_NOT_receive(match_on_the_hw_addr,
                                              within_sec(5)))
    sender.send_ether(ethernet_unicast_to_the_hw_addr, count=1)
    wait_on_futures([f1, f2])