content: // Licensed to the Apache Software Foundation (ASF) under one
  // or more contributor license agreements.  See the NOTICE file
  // distributed with this work for additional information
  // regarding copyright ownership.  The ASF licenses this file
  // to you under the Apache License, Version 2.0 (the
  // "License"); you may not use this file except in compliance
  // with the License.  You may obtain a copy of the License at
  //
  //   http://www.apache.org/licenses/LICENSE-2.0
  //
  // Unless required by applicable law or agreed to in writing,
  // software distributed under the License is distributed on an
  // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  // KIND, either express or implied.  See the License for the
  // specific language governing permissions and limitations
  // under the License.
  package com.cloud.network.security;
  
  import java.util.ArrayList;
  import java.util.List;
  import java.util.Map;
  import java.util.Random;
  import java.util.concurrent.ConcurrentHashMap;
  
  import org.apache.logging.log4j.LogManager;
  import org.apache.logging.log4j.Logger;
  
  import com.cloud.agent.AgentManager;
  import com.cloud.agent.Listener;
  import com.cloud.agent.api.AgentControlAnswer;
  import com.cloud.agent.api.AgentControlCommand;
  import com.cloud.agent.api.Answer;
  import com.cloud.agent.api.CleanupNetworkRulesCmd;
  import com.cloud.agent.api.Command;
  import com.cloud.agent.api.PingRoutingWithNwGroupsCommand;
  import com.cloud.agent.api.SecurityGroupRuleAnswer;
  import com.cloud.agent.api.SecurityGroupRuleAnswer.FailureReason;
  import com.cloud.agent.api.StartupCommand;
  import com.cloud.agent.api.StartupRoutingCommand;
  import com.cloud.agent.manager.Commands;
  import com.cloud.exception.AgentUnavailableException;
  import com.cloud.host.Host;
  import com.cloud.host.Status;
  import com.cloud.network.security.SecurityGroupWork.Step;
  import com.cloud.network.security.dao.SecurityGroupWorkDao;
  
  /**
   * Listens for answers to ingress rules modification commands
   *
   */
  public class SecurityGroupListener implements Listener {
      protected Logger logger = LogManager.getLogger(getClass());
  
      private static final int MAX_RETRIES_ON_FAILURE = 3;
      private static final int MIN_TIME_BETWEEN_CLEANUPS = 30 * 60;//30 minutes
      private final Random _cleanupRandom = new Random();
  
      SecurityGroupManagerImpl _securityGroupManager;
      AgentManager _agentMgr;
      SecurityGroupWorkDao _workDao;
      Map<Long, Integer> _vmFailureCounts = new ConcurrentHashMap<Long, Integer>();
  
      private SecurityGroupWorkTracker _workTracker;
  
      public SecurityGroupListener(SecurityGroupManagerImpl securityGroupManager, AgentManager agentMgr, SecurityGroupWorkDao workDao) {
          super();
          _securityGroupManager = securityGroupManager;
          _agentMgr = agentMgr;
          _workDao = workDao;
      }
  
      @Override
      public int getTimeout() {
          return -1;
      }
  
      @Override
      public boolean isRecurring() {
          return true;
      }
  
      @Override
      public boolean processAnswers(long agentId, long seq, Answer[] answers) {
          return processAnswers(agentId, null, null, seq, answers);
      }
  
      @Override
      public boolean processAnswers(long agentId, String uuid, String name, long seq, Answer[] answers) {
          List<Long> affectedVms = new ArrayList<Long>();
  
          for (Answer ans : answers) {
              if (ans instanceof SecurityGroupRuleAnswer) {
                  SecurityGroupRuleAnswer ruleAnswer = (SecurityGroupRuleAnswer)ans;
                  if (ans.getResult()) {
                      logger.debug("Successfully programmed rule {} into host [id: {}, uuid: {}, name: {}]", ruleAnswer.toString(), agentId, uuid, name);
                      _workDao.updateStep(ruleAnswer.getVmId(), ruleAnswer.getLogSequenceNumber(), Step.Done);
                      recordSuccess(ruleAnswer.getVmId());
                  } else {
                      _workDao.updateStep(ruleAnswer.getVmId(), ruleAnswer.getLogSequenceNumber(), Step.Error);
                      ;
                      logger.debug("Failed to program rule {} into host [id: {}, uuid: {}, name: {}] due to {} and updated  jobs", ruleAnswer.toString(), agentId, uuid, name, ruleAnswer.getDetails());
                      if (ruleAnswer.getReason() == FailureReason.CANNOT_BRIDGE_FIREWALL) {
                          logger.debug("Not retrying security group rules for vm {} on failure since host [id: {}, uuid: {}, name: {}] cannot do bridge firewalling", ruleAnswer.getVmId(), agentId, uuid, name);
                      } else if (ruleAnswer.getReason() == FailureReason.PROGRAMMING_FAILED) {
                          if (checkShouldRetryOnFailure(ruleAnswer.getVmId())) {
                              logger.debug("Retrying security group rules on failure for vm " + ruleAnswer.getVmId());
                              affectedVms.add(ruleAnswer.getVmId());
                          } else {
                              logger.debug("Not retrying security group rules for vm " + ruleAnswer.getVmId() + " on failure: too many retries");
                          }
                      }
                  }
  
                  if (_workTracker != null)
                      _workTracker.processAnswers(agentId, seq, answers);
              }
          }
  
          if (affectedVms.size() > 0) {
              _securityGroupManager.scheduleRulesetUpdateToHosts(affectedVms, false, new Long(10 * 1000l));
          }
  
          return true;
      }
  
      protected boolean checkShouldRetryOnFailure(long vmId) {
          Integer currCount = _vmFailureCounts.get(vmId);
          if (currCount == null)
              currCount = 0;
  
          if (currCount.intValue() < MAX_RETRIES_ON_FAILURE) {
              _vmFailureCounts.put(vmId, ++currCount);
              return true;
          }
  
          return false;
      }
  
      protected void recordSuccess(long vmId) {
          _vmFailureCounts.remove(vmId);
      }
  
      @Override
      public boolean processCommands(long agentId, long seq, Command[] commands) {
          boolean processed = false;
          for (Command cmd : commands) {
              if (cmd instanceof PingRoutingWithNwGroupsCommand) {
                  PingRoutingWithNwGroupsCommand ping = (PingRoutingWithNwGroupsCommand)cmd;
                  if (ping.getNewGroupStates().size() > 0) {
                      _securityGroupManager.fullSync(agentId, ping.getNewGroupStates());
                  }
                  processed = true;
              }
          }
          return processed;
      }
  
      @Override
      public void processHostAdded(long hostId) {
      }
  
      @Override
      public void processConnect(Host host, StartupCommand cmd, boolean forRebalance) {
          if (logger.isInfoEnabled())
              logger.info("Received a host startup notification");
  
          if (!(cmd instanceof StartupRoutingCommand) || cmd.isConnectionTransferred()) {
              return;
          }
  
          try {
              int interval = MIN_TIME_BETWEEN_CLEANUPS + _cleanupRandom.nextInt(MIN_TIME_BETWEEN_CLEANUPS / 2);
              CleanupNetworkRulesCmd cleanupCmd = new CleanupNetworkRulesCmd(interval);
              Commands c = new Commands(cleanupCmd);
              _agentMgr.send(host.getId(), c, this);
              if (logger.isInfoEnabled())
                  logger.info("Scheduled network rules cleanup, interval=" + cleanupCmd.getInterval());
          } catch (AgentUnavailableException e) {
              //usually hypervisors that do not understand sec group rules.
              logger.debug("Unable to schedule network rules cleanup for host {}", host, e);
          }
          if (_workTracker != null) {
              _workTracker.processConnect(host.getId());
          }
      }
  
      @Override
      public AgentControlAnswer processControlCommand(long agentId, AgentControlCommand cmd) {
          return null;
      }
  
      @Override
      public boolean processDisconnect(long agentId, Status state) {
          if (_workTracker != null) {
              _workTracker.processDisconnect(agentId);
          }
          return true;
      }
  
      @Override
      public void processHostAboutToBeRemoved(long hostId) {
      }
  
      @Override
      public void processHostRemoved(long hostId, long clusterId) {
      }
  
      @Override
      public boolean processTimeout(long agentId, long seq) {
          if (_workTracker != null) {
              _workTracker.processTimeout(agentId, seq);
          }
          return true;
      }
  
      public void setWorkDispatcher(SecurityGroupWorkTracker workDispatcher) {
          this._workTracker = workDispatcher;
      }
  }
  