// ensureInterHostRoutes ensures we have routes to every other host.
func (h Helper) ensureInterHostRoutes() error {
	log.Trace(trace.Inside, "Acquiring mutex ensureInterhostRoutes")
	h.ensureInterHostRoutesMutex.Lock()
	defer func() {
		log.Trace(trace.Inside, "Releasing mutex ensureInterhostRoutes")
		h.ensureInterHostRoutesMutex.Unlock()
	}()
	log.Trace(trace.Inside, "Acquired mutex ensureInterhostRoutes")

	via := "via"
	log.Tracef(trace.Inside, "In ensureInterHostRoutes over %v\n", h.Agent.networkConfig.otherHosts)
	for _, host := range h.Agent.networkConfig.otherHosts {
		log.Tracef(trace.Inside, "In ensureInterHostRoutes ensuring route for %v\n", host)
		_, romanaCidr, err := net.ParseCIDR(host.RomanaIp)
		if err != nil {
			return failedToParseOtherHosts(host.RomanaIp)
		}
		romanaMaskInt, _ := romanaCidr.Mask.Size()
		romanaMask := fmt.Sprintf("%d", romanaMaskInt)
		dest := host.Ip

		// wait until no one messing with routes
		// If route doesn't exist yet
		if err := h.isRouteExist(romanaCidr.IP, romanaMask); err != nil {

			// Create it
			err2 := h.createRoute(romanaCidr.IP, romanaMask, via, dest)
			if err2 != nil {
				return routeCreateError(err, romanaCidr.IP.String(), romanaMask, dest)
			}
		}
	}
	return nil
}

// rootState is a state at the beginning of the input and outside of any other state.
func rootState(l *Lexer) stateFn {
	log.Trace(trace.Private, "In root state")
	for {
		b := l.nextByte()

		// There are 5 states we can go from root.
		switch string(b) {
		case string(endOfText):
			return l.errorEof("EOF reached in root section")
		case "#":
			log.Trace(trace.Inside, "In root state, switching into the comment state")
			return stateInComment
		case "*":
			log.Trace(trace.Inside, "In root state, switching into the table state")
			return stateInTable
		case ":":
			log.Trace(trace.Inside, "In root state, switching into the chain state")
			return stateInChain
		case "-":
			// Checking one byte ahead of reader to detect "-A"
			if l.accept("A ") {
				log.Trace(trace.Inside, "In root state, switching into the rule state")
				return stateInRule
			}
		case "C":
			// Whenever we arrive at "C" we need to check if it is a "COMMIT" token.
			if l.accept("OMMIT\n") {
				l.items <- Item{Type: itemCommit, Body: "COMMIT"}
				return rootState
			}
		}
	}
}

// lastTable returns pointer to the last IPtable in IPtables.
func (i *IPtables) lastTable() *IPtable {
	log.Trace(trace.Private, "In lastTable()")
	if len(i.Tables) == 0 {
		return nil
	}

	t := i.Tables[len(i.Tables)-1]
	log.Trace(trace.Inside, "In lastTable returning with ", t.Name)
	return t
}

// SetConfig implements SetConfig function of the Service interface.
func (a *Agent) SetConfig(config common.ServiceConfig) error {
	log.Trace(trace.Public, config)
	a.config = config
	leaseFileName := config.ServiceSpecific["lease_file"].(string)
	lf := NewLeaseFile(leaseFileName, a)
	a.leaseFile = &lf

	a.waitForIfaceTry = int(config.ServiceSpecific["wait_for_iface_try"].(float64))
	a.networkConfig = &NetworkConfig{}

	a.store = *NewStore(config)

	log.Trace(trace.Inside, "Agent.SetConfig() finished.")
	return nil
}

// podDownHandler cleans up after pod deleted.
func (a *Agent) podDownHandler(input interface{}, ctx common.RestContext) (interface{}, error) {
	log.Trace(trace.Private, "Agent: Entering podDownHandler()")
	netReq := input.(*NetworkRequest)
	netif := netReq.NetIf

	// We need new firewall instance here to use its Cleanup()
	// to uninstall firewall rules related to the endpoint.
	fw, err := firewall.NewFirewall(a.getFirewallType())
	if err != nil {
		return nil, err
	}

	err = fw.Init(a.Helper.Executor, a.store, a.networkConfig)
	if err != nil {
		return nil, err
	}

	err = fw.Cleanup(netif)
	if err != nil {
		return nil, err
	}

	// Spawn new thread to process the request
	log.Infof("Agent: Got request for pod teardown %v\n", netReq)

	return "OK", nil
}

// NextItem returns next item from input stream.
func (l *Lexer) NextItem() Item {
	log.Trace(trace.Public, "In NextItem()")
	for {
		select {
		case item := <-l.items:
			log.Trace(trace.Inside, "In NextItem() returning item ", item)
			return item
		default:
			if l.state == nil {
				panic("Lexer failed to process input stream")
			}

			log.Trace(trace.Inside, "In NextItem(), next state")
			l.state = l.state(l)
		}
	}
}

func (agentStore *agentStore) listRoutes() ([]Route, error) {
	log.Trace(trace.Inside, "Acquiring store mutex for listRoutes")
	agentStore.mu.Lock()
	defer func() {
		log.Trace(trace.Inside, "Releasing store mutex for listRoutes")
		agentStore.mu.Unlock()
	}()
	log.Trace(trace.Inside, "Acquired store mutex for listRoutes")

	var routes []Route
	agentStore.DbStore.Db.Find(&routes)
	err := common.MakeMultiError(agentStore.DbStore.Db.GetErrors())
	if err != nil {
		return nil, err
	}
	return routes, nil
}

// SetConfig implements SetConfig function of the Service interface.
func (l *KubeListener) SetConfig(config common.ServiceConfig) error {
	confString := "/etc/romana/romana.conf.yml:kubernetesListener:config:"
	log.Trace(trace.Inside, confString, config)

	m := config.ServiceSpecific
	if kl, ok := m["kubernetes_url"]; !ok || kl == "" {
		return fmt.Errorf("%s%s", confString, "kubernetes_url required in config.")
	}
	l.kubeURL = m["kubernetes_url"].(string)

	if nnp, ok := m["namespace_notification_path"]; !ok || nnp == "" {
		return fmt.Errorf("%s%s", confString, "namespace_notification_path required in config.")
	}
	l.namespaceNotificationPath = m["namespace_notification_path"].(string)

	if pnppre, ok := m["policy_notification_path_prefix"]; !ok || pnppre == "" {
		return fmt.Errorf("%s%s", confString, "policy_notification_path_prefix required in config.")
	}
	l.policyNotificationPathPrefix = m["policy_notification_path_prefix"].(string)

	if pnppost, ok := m["policy_notification_path_prefix"]; !ok || pnppost == "" {
		return fmt.Errorf("%s%s", confString, "policy_notification_path_postfix required in config.")
	}
	l.policyNotificationPathPostfix = m["policy_notification_path_postfix"].(string)

	if sln, ok := m["segment_label_name"]; !ok || sln == "" {
		return fmt.Errorf("%s%s", confString, "segment_label_name required in config.")
	}
	l.segmentLabelName = m["segment_label_name"].(string)

	if tln, ok := m["tenant_label_name"]; !ok || tln == "" {
		return fmt.Errorf("%s%s", confString, "tenant_label_name required in config.")
	}
	l.tenantLabelName = m["tenant_label_name"].(string)

	l.namespaceBufferSize = 1000

	if kc, ok := m["kubernetes_config"]; !ok || kc == "" {
		// Default kubernetes config location on ubuntu
		// TODO: this should not be hard coded, other
		//       distributions may have other user names.
		m["kubernetes_config"] = "/home/ubuntu/.kube/config"
	}

	// TODO, this loads kubernetes config from flags provided in main
	// should be loading from path provided by romana-root. Stas.
	kubeClientConfig, err := clientcmd.BuildConfigFromFlags("", m["kubernetes_config"].(string))
	if err != nil {
		return errors.New(fmt.Sprintf("Failed to load kubernetes kubeClientConfig %s", err))
	}
	clientset, err := kubernetes.NewForConfig(kubeClientConfig)
	if err != nil {
		return fmt.Errorf("Failed to make kubernetes client %s", err)
	}
	l.kubeClient = clientset

	return nil
}

// lastChain returns pointer to the last IPchain in IPtable.
func (i *IPtable) lastChain() *IPchain {
	log.Trace(trace.Private, "In lastChain()")
	if len(i.Chains) == 0 {
		return nil
	}

	c := i.Chains[len(i.Chains)-1]
	return c
}

// stateInComment consumes entire line.
func stateInComment(l *Lexer) stateFn {
	log.Trace(trace.Private, "In comment state")

	item := Item{Type: itemComment}
	for {
		b := l.nextByte()
		c := string(b)

		switch c {
		case string(endOfText):
			return l.errorf("Error: unexpected EOF in comment section")
		case "\n":
			l.items <- item
			log.Trace(trace.Inside, "In comment state, switching into the root state")
			return rootState
		default:
			item.Body += c
		}
	}
}

// createRoute creates IP route, returns nil if success and error otherwise.
func (h Helper) createRoute(ip net.IP, netmask string, via string, dest string, extraArgs ...string) error {
	log.Trace(trace.Private, "Helper: creating route")
	cmd := "/sbin/ip"
	targetIP := fmt.Sprintf("%s/%v", ip, netmask)
	args := []string{"ro", "add", targetIP, via, dest}
	args = append(args, extraArgs...)
	if _, err := h.Executor.Exec(cmd, args); err != nil {
		return shelloutError(err, cmd, args)
	}
	return nil // success
}

// getFirewallType converts configuration option firewall_provider into
// firewall.Provider type.
func (a Agent) getFirewallType() firewall.Provider {
	provider, ok := a.config.ServiceSpecific["firewall_provider"].(string)
	if !ok {
		panic("Unable to read firewall_provider from config")
	}

	// Value of "shellex" stands for firewall provider that executes iptables
	// commands line by line and value of "save-restore" stands for
	// firewall provider that uses iptables-save/iptables-restore.
	switch provider {
	case "shellex":
		log.Trace(trace.Inside, "Agent: using ShellexProvider firewall provider")
		return firewall.ShellexProvider
	case "save-restore":
		log.Trace(trace.Inside, "Agent: using IPTsaveProvider firewall provider")
		return firewall.IPTsaveProvider
	default:
		panic(fmt.Sprintf("Unsupported firewall type value %s, supported values are 'shellex' and 'save-restore'", provider))
	}

}

func (agentStore *agentStore) deleteRoute(route *Route) error {
	log.Trace(trace.Inside, "Acquiring store mutex for deleteRoute")
	agentStore.mu.Lock()
	defer func() {
		log.Trace(trace.Inside, "Releasing store mutex for deleteRoute")
		agentStore.mu.Unlock()
	}()
	log.Trace(trace.Inside, "Acquired store mutex for deleteRoute")

	db := agentStore.DbStore.Db
	agentStore.DbStore.Db.Delete(route)
	err := common.MakeMultiError(db.GetErrors())
	if err != nil {
		return err
	}
	if db.Error != nil {
		return db.Error
	}

	return nil
}

// ChainByName looks for IPchain with corresponding name and returns a pointer to it.
func (i *IPtable) ChainByName(name string) *IPchain {
	log.Trace(trace.Private, "In ChainByName()")

	for n, c := range i.Chains {
		if c.Name == name {
			ret := i.Chains[n]
			return ret
		}
	}

	return nil
}

func (agentStore *agentStore) findRouteByIface(routeIface string) (*Route, error) {
	log.Trace(trace.Inside, "Acquiring store mutex for findRoute")
	agentStore.mu.Lock()
	defer func() {
		log.Trace(trace.Inside, "Releasing store mutex for findRoute")
		agentStore.mu.Unlock()
	}()
	log.Trace(trace.Inside, "Acquired store mutex for findRoute")

	var route Route
	db := agentStore.DbStore.Db
	agentStore.DbStore.Db.Where("ip = ?", routeIface).First(&route)
	err := common.MakeMultiError(db.GetErrors())
	if err != nil {
		return nil, err
	}
	if db.Error != nil {
		return nil, db.Error
	}
	return &route, nil
}

// ensureLine ensures that line is present in a file.
func (h Helper) ensureLine(path string, token string, op leaseOp) error {
	// if file exist
	if err := h.OS.CreateIfMissing(path); err != nil {
		return ensureLineError(err)
	}

	// wait until no one using the file
	log.Trace(trace.Inside, "Acquiring mutex ensureLine")
	h.ensureLineMutex.Lock()
	defer func() {
		log.Trace(trace.Inside, "Releasing mutex ensureLine")
		h.ensureLineMutex.Unlock()
	}()
	log.Trace(trace.Inside, "Acquired mutex ensureLine")
	lineInFile, err := h.isLineInFile(path, token)
	if err != nil {
		return ensureLineError(err)
	}

	switch op {
	case leaseAdd:
		if !lineInFile {
			if err := h.appendLineToFile(path, token); err != nil {
				return ensureLineError(err)
			}
		} else {
			// nothing to do
		}
	case leaseRemove:
		if lineInFile {
			if err := h.removeLineFromFile(path, token); err != nil {
				return ensureLineError(err)
			}
		} else {
			// nothing to do
		}
	}
	return nil
}

// ensureRouteToEndpoint verifies that ip route to endpoint interface exists, creates it otherwise.
// Error if failed, nil if success.
func (h Helper) ensureRouteToEndpoint(netif *NetIf) error {
	mask := fmt.Sprintf("%d", h.Agent.networkConfig.EndpointNetmaskSize())
	log.Trace(trace.Private, "Ensuring routes for ", netif.IP, " ", netif.Name)
	log.Trace(trace.Inside, "Acquiring mutex ensureRouteToEndpoint")
	h.ensureRouteToEndpointMutex.Lock()
	defer func() {
		log.Trace(trace.Inside, "Releasing mutex ensureRouteToEndpoint")
		h.ensureRouteToEndpointMutex.Unlock()
	}()
	log.Trace(trace.Inside, "Acquired mutex ensureRouteToEndpoint")
	// If route not exist
	if err := h.isRouteExist(netif.IP.IP, mask); err != nil {

		// Create route
		via := "dev"
		dest := netif.Name

		err := h.createRoute(netif.IP.IP, mask, via, dest, "src", h.Agent.networkConfig.romanaGW.String())
		if err != nil {
			return netIfRouteCreateError(err, *netif)
		}
	}
	return nil
}

// podUpHandler handles HTTP requests for endpoints provisioning.
func (a *Agent) podUpHandler(input interface{}, ctx common.RestContext) (interface{}, error) {
	log.Trace(trace.Private, "Agent: Entering podUpHandler()")
	netReq := input.(*NetworkRequest)

	log.Infof("Agent: Got request for network configuration: %v\n", netReq)
	// Spawn new thread to process the request

	// TODO don't know if fork-bombs are possible in go but if they are this
	// need to be refactored as buffered channel with fixed pool of workers
	go a.podUpHandlerAsync(*netReq)

	// TODO I wonder if this should actually return something like a
	// link to a status of this request which will later get updated
	// with success or failure -- Greg.
	return "OK", nil
}

// stateInChainPolicy consumes chain deafult policy if any.
func stateInChainPolicy(l *Lexer) stateFn {
	log.Trace(trace.Private, "In chain policy state")

	item := Item{Type: itemChainPolicy}

	b := l.nextByte()
	c := string(b)

	switch c {
	case string(endOfText):
		return l.errorf("Error: unexpected EOF in chain section")
	case "-":
		item.Body = "-"
		l.items <- item
		_ = l.nextByte() // Discard next space to prevent it from getting captured as counter
		return stateInChainCounter
	case "A":
		if l.accept("CCEPT ") {
			item.Body = "ACCEPT"
			l.items <- item
			return stateInChainCounter
		} else {
			l.items <- Item{Type: ItemError, Body: "Unexpected deafult policy for a chain"}
			return nil
		}
	case "R":
		if l.accept("ETURN ") {
			item.Body = "RETURN"
			l.items <- item
			return stateInChainCounter
		} else {
			l.items <- Item{Type: ItemError, Body: "Unexpected deafult policy for a chain"}
			return nil
		}
	case "D":
		if l.accept("ROP ") {
			item.Body = "DROP"
			l.items <- item
			return stateInChainCounter
		} else {
			l.items <- Item{Type: ItemError, Body: "Unexpected deafult policy for a chain"}
			return nil
		}
	default:
		return l.errorf("Unexpectend end of line in chain state")
	}
}

// waitForIface waits for network interface to become available in the system.
func (h Helper) waitForIface(expectedIface string) bool {
	for i := 0; i <= h.Agent.waitForIfaceTry; i++ {
		log.Tracef(trace.Inside, "Helper: Waiting for interface %s, %d attempt", expectedIface, i)
		ifaceList, err := net.Interfaces()
		log.Trace(trace.Inside, "Agent: Entering podUpHandlerAsync()")
		if err != nil {
			log.Warn("Warning: Helper: failed to read net.Interfaces()")
		}
		for iface := range ifaceList {
			if ifaceList[iface].Name == expectedIface {
				return true
			}
		}
		time.Sleep(10 * time.Second)
	}
	return false
}