policy.go

package nethooks

import (
	"strconv"
	s "strings"
	log "github.com/Sirupsen/logrus"
	contivmodel "github.com/contiv/contivmodel"
	"github.com/docker/libcompose/project"
)

const (
	baseURL = "http://netmaster:9999/api/"
)

type policyCreateRec struct {
	nextRuleId    int
	policyApplied bool
}

func getRulePath(tenantName, policyName, ruleID string) string {
	return baseURL + "rules/" + tenantName + ":" + policyName + ":" + ruleID + "/"
}

func getRulePathFromName(ruleName string) string {
	return baseURL + "rules/" + ruleName
}

func getPolicyRulesPath(tenantName, policyName string) string {
	return baseURL + "rules/" + tenantName + ":" + policyName + "/"
}

func getPolicyPath(tenantName, policyName string) string {
	return baseURL + "policys/" + tenantName + ":" + policyName + "/"
}

func getAppProfilePath(tenantName, networkName, appProfileName string) string {
	keyStr := tenantName + ":" + networkName + ":" + appProfileName
        url := baseURL + "appProfiles/" + keyStr + "/"
	return url
}

func getEpgPath(tenantName, networkName, groupName string) string {
	return baseURL + "endpointGroups/" + tenantName + ":" + networkName + ":" + groupName + "/"
}

func getRuleStr(ruleID int) string {
	return string(ruleID + '0')
}

func getInPolicyStr(projectName, svcName string) string {
	return projectName + "_" + svcName + "-in"
}

func getOutPolicyStr(projectName, svcName string) string {
	return projectName + "_" + svcName + "-out"
}

func getTenantName(labels map[string]string) string {
	tenantName := TENANT_DEFAULT
	if labels != nil {
		if value, ok := labels[TENANT_LABEL]; ok {
			tenantName = value
		}
	}
	return tenantName
}

func getNetworkName(labels map[string]string) string {
	networkName := NETWORK_DEFAULT
	if labels != nil {
		if value, ok := labels[NET_LABEL]; ok {
			networkName = value
		}
	}
	return networkName
}

func getFullSvcName(p *project.Project, svcName string) string {
	if p == nil {
		return svcName
	}

	return p.Name + "_" + svcName + "." + NETWORK_DEFAULT
}

func getSvcName(p *project.Project, svcName string) string {
	if p == nil {
		return svcName
	}

	return p.Name + "_" + svcName
}

func getFromEpgName(p *project.Project, fromSvcName string) string {
	if applyContractPolicyFlag {
		return getSvcName(p, fromSvcName)
	}

	return ""
}

func getSvcLinks(p *project.Project) (map[string][]string, error) {
	links := make(map[string][]string)

	for svcName, svc := range p.Configs {
		log.Debugf("svc %s === %+v ", svcName, svc)
		svcLinks := svc.Links.Slice()
		log.Debugf("found links for svc '%s' %#v ", svcName, svcLinks)
		links[svcName] = svcLinks
	}

	return links, nil
}

func clearSvcLinks(p *project.Project) error {
	for svcName, svc := range p.Configs {
		// if len(svc.Links.Slice()) > 0 {
		svc.Links = project.NewMaporColonSlice([]string{})
		log.Debugf("clearing links for svc '%s' %#v ", svcName, svc.Links)
		// }
	}
	return nil
}

func extractPort(ps string) string {
	lastCol := s.LastIndex(ps, ":")
	if lastCol == -1 {
		return ps
	}

	return ps[lastCol+1:]
}

func getSvcPorts(p *project.Project) (map[string][]string, error) {
	sPorts := make(map[string][]string)
	res := []string{}
	for svcName, svc := range p.Configs {
		if len(svc.Ports) > 0 {
			pList := svc.Ports
			for _, ps := range pList {
				res = append(res, extractPort(ps))
			}
			sPorts[svcName] = res
			log.Debugf("Service %v port %v", svcName, sPorts[svcName])
		}
	}

	return sPorts, nil
}

func clearExposedPorts(p *project.Project) error {
	for svcName, svc := range p.Configs {
		if len(svc.Expose) > 0 {
			log.Debugf("svc.Expose: %v svc.Ports %v", svc.Expose, svc.Ports)
			svc.Expose = []string{}
			log.Debugf("clearing exposed ports for svc '%s' %#v ", svcName, svc.Links)
		}
		svc.Ports = []string{}
	}
	return nil
}

func addDenyAllRule(tenantName, networkName, fromEpgName, policyName string, ruleID int) error {
	rule := &contivmodel.Rule{
		Action:        "deny",
		Direction:     "in",
		FromEndpointGroup: fromEpgName,
		FromNetwork:       networkName,
		PolicyName:    policyName,
		Priority:      ruleID,
		Protocol:      "tcp",
		RuleID:        getRuleStr(ruleID),
		TenantName:    tenantName,
	}
	if err := httpPost(getRulePath(rule.TenantName, rule.PolicyName, rule.RuleID), rule); err != nil {
		log.Errorf("Unable to create deny all rule %#v. Error: %v", rule, err)
		return err
	}

	return nil
}

func addInAcceptRule(tenantName, networkName, fromEpgName, policyName, protoName string, portID, ruleID int) error {
	rule := &contivmodel.Rule{
		Action:        "allow",
		Direction:     "in",
		FromEndpointGroup: fromEpgName,
		FromNetwork:       networkName,
		PolicyName:    policyName,
		Port:          portID,
		Priority:      ruleID,
		Protocol:      protoName,
		RuleID:        getRuleStr(ruleID),
		TenantName:    tenantName,
	}
	if err := httpPost(getRulePath(rule.TenantName, rule.PolicyName, rule.RuleID), rule); err != nil {
		log.Errorf("Unable to create allow rule %#v. Error: %v", rule, err)
		return err
	}

	return nil
}

func addOutAcceptAllRule(tenantName, networkName, fromEpgName, policyName string, ruleID int) error {
	rule := &contivmodel.Rule{
		Action:        "allow",
		Direction:     "out",
		FromEndpointGroup: fromEpgName,
		FromNetwork:       networkName,
		PolicyName:    policyName,
		Priority:      ruleID,
		Protocol:      "tcp",
		RuleID:        getRuleStr(ruleID),
		TenantName:    tenantName,
	}
	if err := httpPost(getRulePath(rule.TenantName, rule.PolicyName, rule.RuleID), rule); err != nil {
		log.Errorf("Unable to create allow rule %#v. Error: %v", rule, err)
		return err
	}

	return nil
}

func addPolicy(tenantName, policyName string) error {
	policy := &contivmodel.Policy{
		PolicyName: policyName,
		TenantName: tenantName,
	}
	if err := httpPost(getPolicyPath(policy.TenantName, policy.PolicyName), policy); err != nil {
		log.Debugf("Unable to create policy rule. Error: %v", err)
		return err
	}

	return nil
}

func addApp(tenantName string, p *project.Project) error {

	log.Debugf("Entered addApp '%s':'%s' ", tenantName, p.Name)
	epgList := make([]string, 0, 3)
	app := &contivmodel.AppProfile{
		AppProfileName: p.Name,
		TenantName: tenantName,
		NetworkName: NETWORK_DEFAULT,
	}

	// Add services
	for svcName := range p.Configs {
		epgName := getSvcName(p, svcName)
		epgList = append(epgList, epgName)
		log.Debugf("addApp add epg :'%s' ", epgName)
	}

	app.EndpointGroups = epgList

	if err := httpPost(getAppProfilePath(tenantName, NETWORK_DEFAULT, p.Name), app); err != nil {
		log.Errorf("Unable to post app to netmaster. Error: %v", err)
		return err
	}

	return nil
}

func deleteApp(tenantName string, p *project.Project) error {

	log.Debugf("Entered deleteApp '%s':'%s' ", tenantName, p.Name)

	if err := httpDelete(getAppProfilePath(tenantName, NETWORK_DEFAULT, p.Name)); err != nil {
		log.Errorf("Unable to post app delete to netmaster. Error: %v", err)
		return err
	}

	return nil
}

func addEpg(tenantName, networkName, epgName string, policies []string) error {
	epg := &contivmodel.EndpointGroup{
		EndpointGroupID: 1,
		GroupName:       epgName,
		NetworkName:     networkName,
		Policies:        policies,
		TenantName:      tenantName,
	}
	if err := httpPost(getEpgPath(epg.TenantName, epg.NetworkName, epg.GroupName), epg); err != nil {
		log.Errorf("Unable to create endpoint group. Tenant '%s' Network '%s' Epg '%s'. Error %v",
			tenantName, networkName, epgName, err)
		return err
	}

	return nil
}

func addEpgs(p *project.Project) error {
	for svcName, svc := range p.Configs {
		tenantName := getTenantName(svc.Labels.MapParts())
		networkName := getNetworkName(svc.Labels.MapParts())
		epgName := getSvcName(p, svcName)

		if err := addEpg(tenantName, networkName, epgName, []string{}); err != nil {
			log.Errorf("Unable to add epg for service '%s'. Error %v", svcName, err)
			return err
		}
	}
	return nil
}

func applyDefaultPolicy(p *project.Project, polRecs map[string]policyCreateRec) error {
	for svcName, svc := range p.Configs {
		tenantName := getTenantName(svc.Labels.MapParts())
		networkName := getNetworkName(svc.Labels.MapParts())
		toEpgName := getSvcName(p, svcName)

		if pR, ok := polRecs[svcName]; ok {
			if pR.policyApplied {
				continue
			}
		}

		// add 'in' policy for the service tier
		ruleID := 1
		policyName := getInPolicyStr(p.Name, svcName)
		policies := []string{}

		log.Debugf("Applying deny all in policy for service '%s' ", svcName)
		if err := addPolicy(tenantName, policyName); err != nil {
			log.Errorf("Unable to add policy. Error %v ", err)
			return err
		}
		policies = append(policies, policyName)

		if err := addDenyAllRule(tenantName, networkName, "", policyName, ruleID); err != nil {
			log.Errorf("Unable to add deny rule. Error %v ", err)
			return err
		}

		// add 'out' policy for the service tier
		ruleID = 1
		policyName = getOutPolicyStr(p.Name, svcName)
		if err := addPolicy(tenantName, policyName); err != nil {
			log.Errorf("Unable to add policy. Error %v", err)
		}
		policies = append(policies, policyName)
		if err := addOutAcceptAllRule(tenantName, networkName, "", policyName, ruleID); err != nil {
			log.Errorf("Unable to add deny rule. Error %v ", err)
			return err
		}

		// add epg with in and out policies
		if err := addEpg(tenantName, networkName, toEpgName, policies); err != nil {
			log.Errorf("Unable to add epg. Error %v", err)
			return err
		}
	}

	return nil
}

func getPolicyRec(name string, polRecs map[string]policyCreateRec) policyCreateRec {
	rec, ok := polRecs[name]

	if ok {
		return rec
	}

	rec = policyCreateRec{nextRuleId: 1, policyApplied: false}
	polRecs[name] = rec
	return rec
}

func applyExposePolicy(p *project.Project, expMap map[string][]string, polRecs map[string]policyCreateRec) error {
	tenantName := "default"
	for toSvcName, spList := range expMap {
		svc := p.Configs[toSvcName]
		networkName := getNetworkName(svc.Labels.MapParts())
		policyRec := getPolicyRec(toSvcName, polRecs)
		ruleID := policyRec.nextRuleId
		policyName := getInPolicyStr(p.Name, toSvcName)
		// create the policy, if necessary
		if !policyRec.policyApplied && (len(spList) > 0) {
			policies := []string{}
			if err := addPolicy(tenantName, policyName); err != nil {
				log.Errorf("Unable to add policy. Error %v ", err)
				return err
			}
			toEpgName := getSvcName(p, toSvcName)
			policies = append(policies, policyName)
			if err := addEpg(tenantName, networkName, toEpgName, policies); err != nil {
				log.Errorf("Unable to add epg. Error %v", err)
				return err
			}
		}

		for _, portID := range spList {
			pNum, err := strconv.Atoi(portID)
			if err != nil {
				log.Errorf("Unable to get port number. Error %v ", err)
			}

			if err = addInAcceptRule(tenantName, networkName, "", policyName, "tcp", pNum, ruleID); err != nil {
				log.Errorf("Unable to add allow rule. Error %v ", err)
				return err
			} else {
				log.Debugf("Exposed %v : port %v", policyName, portID)
			}
			ruleID++
		}
		policyRec.nextRuleId = ruleID
		polRecs[toSvcName] = policyRec
	}

	return nil
}

func applyInPolicy(p *project.Project, fromSvcName, toSvcName string, polRecs map[string]policyCreateRec) error {
	svc := p.Configs[toSvcName]

	policyRec := getPolicyRec(toSvcName, polRecs)
	tenantName := getTenantName(svc.Labels.MapParts())
	networkName := getNetworkName(svc.Labels.MapParts())
	toEpgName := getSvcName(p, toSvcName)

	policyName := getInPolicyStr(p.Name, toSvcName)
	fromEpgName := getFromEpgName(p, fromSvcName)

	ruleID := policyRec.nextRuleId
	policies := []string{}

	imageInfoList, err := getImageInfo(toSvcName)
	if err != nil {
		log.Infof("Unable to auto fetch port/protocol information. Error %v", err)
	}

	log.Debugf("Creating network objects to service '%s': Tenant: %s Network %s", toSvcName, tenantName, networkName)

	if err := addPolicy(tenantName, policyName); err != nil {
		log.Errorf("Unable to add policy. Error %v ", err)
		return err
	}
	policies = append(policies, policyName)

	if err := addDenyAllRule(tenantName, networkName, "", policyName, ruleID); err != nil {
		return err
	}
	ruleID++

	for _, imageInfo := range imageInfoList {
		if err := addInAcceptRule(tenantName, networkName, fromEpgName, policyName, imageInfo.protoName, imageInfo.portID, ruleID); err != nil {
			log.Errorf("Unable to add allow rule. Error %v ", err)
			return err
		}
		ruleID++
	}

	if err := addEpg(tenantName, networkName, toEpgName, policies); err != nil {
		log.Errorf("Unable to add epg. Error %v", err)
		return err
	}

	policyRec.nextRuleId = ruleID
	policyRec.policyApplied = true
	polRecs[toSvcName] = policyRec
	return nil
}

func removePolicy(p *project.Project, svcName, dir string) error {
	svc := p.Configs[svcName]

	log.Debugf("Deleting policies for service '%s' ", svcName)
	tenantName := getTenantName(svc.Labels.MapParts())
	networkName := getNetworkName(svc.Labels.MapParts())
	policyName := getInPolicyStr(p.Name, svcName)
	if dir == "out" {
		policyName = getOutPolicyStr(p.Name, svcName)
	}

	log.Debugf("Deleting network objects to service '%s': Tenant: %s Network %s", svcName, tenantName, networkName)

	policyPath := getPolicyPath(tenantName, policyName)

	policy := contivmodel.Policy{}
	if err := httpGet(policyPath, &policy); err != nil {
		log.Debugf("Unable to delete policy for service '%s' policy %s", svcName, policyName)
		return nil
	}

	for ruleName, _ := range policy.LinkSets.Rules {
		rulePath := getRulePathFromName(ruleName)
		if err := httpDelete(rulePath); err != nil {
			log.Errorf("Unable to delete '%s' rule. Error: %v", rulePath, err)
		}
	}

	if err := httpDelete(policyPath); err != nil {
		log.Errorf("Unable to delete '%s' policy. Error: %v", policyPath, err)
	}

	return nil
}

func removeEpg(p *project.Project, svcName string) error {
	svc := p.Configs[svcName]

	log.Debugf("Deleting Epg for service '%s' ", svcName)
	tenantName := getTenantName(svc.Labels.MapParts())
	networkName := getNetworkName(svc.Labels.MapParts())
	epgName := getSvcName(p, svcName)

	epgPath := getEpgPath(tenantName, networkName, epgName)
	if err := httpDelete(epgPath); err != nil {
		log.Errorf("Unable to delete '%s' epg. Error: %v", epgPath, err)
	}

	return nil
}