package docker
 
 import (

 	"encoding/binary"

 	"errors"

 	"fmt"

 	"io"

 	"log"

 	"net"

 	"os/exec"
 	"strconv"
 	"strings"

 	"sync"

 )
 

 var NetworkBridgeIface string
 

 const (

 	DefaultNetworkBridge = "docker0"

 	portRangeStart       = 49153
 	portRangeEnd         = 65535

 )
 

 // Calculates the first and last IP addresses in an IPNet

 func networkRange(network *net.IPNet) (net.IP, net.IP) {
 	netIP := network.IP.To4()
 	firstIP := netIP.Mask(network.Mask)
 	lastIP := net.IPv4(0, 0, 0, 0).To4()
 	for i := 0; i < len(lastIP); i++ {
 		lastIP[i] = netIP[i] | ^network.Mask[i]
 	}
 	return firstIP, lastIP
 }
 

 // Detects overlap between one IPNet and another
 func networkOverlaps(netX *net.IPNet, netY *net.IPNet) bool {
 	firstIP, _ := networkRange(netX)
 	if netY.Contains(firstIP) {
 		return true
 	}
 	firstIP, _ = networkRange(netY)
 	if netX.Contains(firstIP) {
 		return true
 	}
 	return false
 }
 

 // Converts a 4 bytes IP into a 32 bit integer

 func ipToInt(ip net.IP) int32 {
 	return int32(binary.BigEndian.Uint32(ip.To4()))

 }
 

 // Converts 32 bit integer into a 4 bytes IP address

 func intToIp(n int32) net.IP {
 	b := make([]byte, 4)
 	binary.BigEndian.PutUint32(b, uint32(n))
 	return net.IP(b)

 }
 

 // Given a netmask, calculates the number of available hosts

 func networkSize(mask net.IPMask) int32 {

 	m := net.IPv4Mask(0, 0, 0, 0)

 	for i := 0; i < net.IPv4len; i++ {

 		m[i] = ^mask[i]

 	}

 
 	return int32(binary.BigEndian.Uint32(m)) + 1

 }
 

 //Wrapper around the ip command
 func ip(args ...string) (string, error) {
 	path, err := exec.LookPath("ip")
 	if err != nil {
 		return "", fmt.Errorf("command not found: ip")
 	}
 	output, err := exec.Command(path, args...).CombinedOutput()
 	if err != nil {
 		return "", fmt.Errorf("ip failed: ip %v", strings.Join(args, " "))
 	}
 	return string(output), nil
 }
 

 // Wrapper around the iptables command
 func iptables(args ...string) error {

 	path, err := exec.LookPath("iptables")
 	if err != nil {

 		return fmt.Errorf("command not found: iptables")

 	}
 	if err := exec.Command(path, args...).Run(); err != nil {

 		return fmt.Errorf("iptables failed: iptables %v", strings.Join(args, " "))
 	}
 	return nil
 }
 

 func checkRouteOverlaps(dockerNetwork *net.IPNet) error {
 	output, err := ip("route")
 	if err != nil {
 		return err
 	}
 	Debugf("Routes:\n\n%s", output)
 	for _, line := range strings.Split(output, "\n") {
 		if strings.Trim(line, "\r\n\t ") == "" || strings.Contains(line, "default") {
 			continue
 		}
 		if _, network, err := net.ParseCIDR(strings.Split(line, " ")[0]); err != nil {
 			return fmt.Errorf("Unexpected ip route output: %s (%s)", err, line)
 		} else if networkOverlaps(dockerNetwork, network) {
 			return fmt.Errorf("Network %s is already routed: '%s'", dockerNetwork.String(), line)
 		}
 	}
 	return nil
 }
 
 func CreateBridgeIface(ifaceName string) error {

 	// FIXME: try more IP ranges
 	// FIXME: try bigger ranges! /24 is too small.

 	addrs := []string{"172.16.42.1/24", "10.0.42.1/24", "192.168.42.1/24"}
 
 	var ifaceAddr string
 	for _, addr := range addrs {
 		_, dockerNetwork, err := net.ParseCIDR(addr)
 		if err != nil {
 			return err
 		}
 		if err := checkRouteOverlaps(dockerNetwork); err == nil {
 			ifaceAddr = addr
 			break
 		} else {
 			Debugf("%s: %s", addr, err)
 		}
 	}
 	if ifaceAddr == "" {

 		return fmt.Errorf("Could not find a free IP address range for interface '%s'. Please configure its address manually and run 'docker -b %s'", ifaceName, ifaceName)

 	} else {
 		Debugf("Creating bridge %s with network %s", ifaceName, ifaceAddr)
 	}
 
 	if output, err := ip("link", "add", ifaceName, "type", "bridge"); err != nil {
 		return fmt.Errorf("Error creating bridge: %s (output: %s)", err, output)
 	}
 
 	if output, err := ip("addr", "add", ifaceAddr, "dev", ifaceName); err != nil {
 		return fmt.Errorf("Unable to add private network: %s (%s)", err, output)
 	}
 	if output, err := ip("link", "set", ifaceName, "up"); err != nil {
 		return fmt.Errorf("Unable to start network bridge: %s (%s)", err, output)
 	}
 	if err := iptables("-t", "nat", "-A", "POSTROUTING", "-s", ifaceAddr,
 		"!", "-d", ifaceAddr, "-j", "MASQUERADE"); err != nil {
 		return fmt.Errorf("Unable to enable network bridge NAT: %s", err)
 	}
 	return nil
 }
 

 // Return the IPv4 address of a network interface

 func getIfaceAddr(name string) (net.Addr, error) {

 	iface, err := net.InterfaceByName(name)
 	if err != nil {
 		return nil, err
 	}
 	addrs, err := iface.Addrs()
 	if err != nil {
 		return nil, err
 	}
 	var addrs4 []net.Addr
 	for _, addr := range addrs {
 		ip := (addr.(*net.IPNet)).IP
 		if ip4 := ip.To4(); len(ip4) == net.IPv4len {
 			addrs4 = append(addrs4, addr)
 		}
 	}
 	switch {
 	case len(addrs4) == 0:

 		return nil, fmt.Errorf("Interface %v has no IP addresses", name)

 	case len(addrs4) > 1:

 		fmt.Printf("Interface %v has more than 1 IPv4 address. Defaulting to using %v\n",
 			name, (addrs4[0].(*net.IPNet)).IP)

 	}
 	return addrs4[0], nil
 }
 

 // Port mapper takes care of mapping external ports to containers by setting
 // up iptables rules.
 // It keeps track of all mappings and is able to unmap at will
 type PortMapper struct {
 	mapping map[int]net.TCPAddr

 	proxies map[int]net.Listener

 }
 
 func (mapper *PortMapper) cleanup() error {
 	// Ignore errors - This could mean the chains were never set up

 	iptables("-t", "nat", "-D", "PREROUTING", "-m", "addrtype", "--dst-type", "LOCAL", "-j", "DOCKER")

 	iptables("-t", "nat", "-D", "OUTPUT", "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", "127.0.0.0/8", "-j", "DOCKER")
 	iptables("-t", "nat", "-D", "OUTPUT", "-m", "addrtype", "--dst-type", "LOCAL", "-j", "DOCKER") // Created in versions <= 0.1.6

 	// Also cleanup rules created by older versions, or -X might fail.
 	iptables("-t", "nat", "-D", "PREROUTING", "-j", "DOCKER")
 	iptables("-t", "nat", "-D", "OUTPUT", "-j", "DOCKER")

 	iptables("-t", "nat", "-F", "DOCKER")
 	iptables("-t", "nat", "-X", "DOCKER")
 	mapper.mapping = make(map[int]net.TCPAddr)

 	mapper.proxies = make(map[int]net.Listener)

 	return nil
 }
 
 func (mapper *PortMapper) setup() error {
 	if err := iptables("-t", "nat", "-N", "DOCKER"); err != nil {

 		return fmt.Errorf("Failed to create DOCKER chain: %s", err)

 	}

 	if err := iptables("-t", "nat", "-A", "PREROUTING", "-m", "addrtype", "--dst-type", "LOCAL", "-j", "DOCKER"); err != nil {

 		return fmt.Errorf("Failed to inject docker in PREROUTING chain: %s", err)

 	}

 	if err := iptables("-t", "nat", "-A", "OUTPUT", "-m", "addrtype", "--dst-type", "LOCAL", "!", "--dst", "127.0.0.0/8", "-j", "DOCKER"); err != nil {

 		return fmt.Errorf("Failed to inject docker in OUTPUT chain: %s", err)

 	}

 	return nil
 }
 
 func (mapper *PortMapper) iptablesForward(rule string, port int, dest net.TCPAddr) error {
 	return iptables("-t", "nat", rule, "DOCKER", "-p", "tcp", "--dport", strconv.Itoa(port),
 		"-j", "DNAT", "--to-destination", net.JoinHostPort(dest.IP.String(), strconv.Itoa(dest.Port)))
 }
 
 func (mapper *PortMapper) Map(port int, dest net.TCPAddr) error {
 	if err := mapper.iptablesForward("-A", port, dest); err != nil {
 		return err
 	}

 	mapper.mapping[port] = dest

 	listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port))
 	if err != nil {
 		mapper.Unmap(port)
 		return err
 	}

 	mapper.proxies[port] = listener

 	go proxy(listener, "tcp", dest.String())

 	return nil
 }

 // proxy listens for socket connections on `listener`, and forwards them unmodified
 // to `proto:address`
 func proxy(listener net.Listener, proto, address string) error {
 	Debugf("proxying to %s:%s", proto, address)
 	defer Debugf("Done proxying to %s:%s", proto, address)
 	for {
 		Debugf("Listening on %s", listener)
 		src, err := listener.Accept()
 		if err != nil {
 			return err
 		}
 		Debugf("Connecting to %s:%s", proto, address)
 		dst, err := net.Dial(proto, address)
 		if err != nil {
 			log.Printf("Error connecting to %s:%s: %s", proto, address, err)
 			src.Close()
 			continue
 		}
 		Debugf("Connected to backend, splicing")
 		splice(src, dst)
 	}
 	return nil
 }
 
 func halfSplice(dst, src net.Conn) error {
 	_, err := io.Copy(dst, src)
 	// FIXME: on EOF from a tcp connection, pass WriteClose()
 	dst.Close()
 	src.Close()
 	return err
 }
 
 func splice(a, b net.Conn) {
 	go halfSplice(a, b)
 	go halfSplice(b, a)
 }
 

 func (mapper *PortMapper) Unmap(port int) error {
 	dest, ok := mapper.mapping[port]
 	if !ok {
 		return errors.New("Port is not mapped")
 	}

 	if proxy, exists := mapper.proxies[port]; exists {
 		proxy.Close()
 		delete(mapper.proxies, port)
 	}

 	if err := mapper.iptablesForward("-D", port, dest); err != nil {
 		return err

 	}

 	delete(mapper.mapping, port)
 	return nil
 }
 
 func newPortMapper() (*PortMapper, error) {
 	mapper := &PortMapper{}
 	if err := mapper.cleanup(); err != nil {

 		return nil, err

 	}

 	if err := mapper.setup(); err != nil {
 		return nil, err
 	}
 	return mapper, nil

 }

 // Port allocator: Atomatically allocate and release networking ports
 type PortAllocator struct {

 	inUse    map[int]struct{}

 	fountain chan (int)

 	lock     sync.Mutex

 }
 

 func (alloc *PortAllocator) runFountain() {
 	for {
 		for port := portRangeStart; port < portRangeEnd; port++ {
 			alloc.fountain <- port
 		}

 	}
 }
 

 // FIXME: Release can no longer fail, change its prototype to reflect that.

 func (alloc *PortAllocator) Release(port int) error {

 	Debugf("Releasing %d", port)

 	alloc.lock.Lock()
 	delete(alloc.inUse, port)
 	alloc.lock.Unlock()
 	return nil
 }
 
 func (alloc *PortAllocator) Acquire(port int) (int, error) {

 	Debugf("Acquiring %d", port)

 	if port == 0 {
 		// Allocate a port from the fountain
 		for port := range alloc.fountain {
 			if _, err := alloc.Acquire(port); err == nil {
 				return port, nil
 			}
 		}
 		return -1, fmt.Errorf("Port generator ended unexpectedly")

 	}

 	alloc.lock.Lock()
 	defer alloc.lock.Unlock()
 	if _, inUse := alloc.inUse[port]; inUse {
 		return -1, fmt.Errorf("Port already in use: %d", port)
 	}
 	alloc.inUse[port] = struct{}{}
 	return port, nil

 }
 

 func newPortAllocator() (*PortAllocator, error) {
 	allocator := &PortAllocator{

 		inUse:    make(map[int]struct{}),

 		fountain: make(chan int),

 	}
 	go allocator.runFountain()

 	return allocator, nil
 }
 
 // IP allocator: Atomatically allocate and release networking ports
 type IPAllocator struct {

 	network       *net.IPNet
 	queueAlloc    chan allocatedIP
 	queueReleased chan net.IP
 	inUse         map[int32]struct{}
 }
 
 type allocatedIP struct {
 	ip  net.IP
 	err error

 }
 

 func (alloc *IPAllocator) run() {

 	firstIP, _ := networkRange(alloc.network)

 	ipNum := ipToInt(firstIP)
 	ownIP := ipToInt(alloc.network.IP)
 	size := networkSize(alloc.network.Mask)
 
 	pos := int32(1)
 	max := size - 2 // -1 for the broadcast address, -1 for the gateway address
 	for {
 		var (
 			newNum int32
 			inUse  bool
 		)
 
 		// Find first unused IP, give up after one whole round
 		for attempt := int32(0); attempt < max; attempt++ {
 			newNum = ipNum + pos
 
 			pos = pos%max + 1
 
 			// The network's IP is never okay to use
 			if newNum == ownIP {
 				continue
 			}
 
 			if _, inUse = alloc.inUse[newNum]; !inUse {
 				// We found an unused IP
 				break
 			}

 		}

 
 		ip := allocatedIP{ip: intToIp(newNum)}
 		if inUse {
 			ip.err = errors.New("No unallocated IP available")

 		}

 
 		select {
 		case alloc.queueAlloc <- ip:
 			alloc.inUse[newNum] = struct{}{}
 		case released := <-alloc.queueReleased:
 			r := ipToInt(released)
 			delete(alloc.inUse, r)
 
 			if inUse {
 				// If we couldn't allocate a new IP, the released one
 				// will be the only free one now, so instantly use it
 				// next time
 				pos = r - ipNum
 			} else {
 				// Use same IP as last time
 				if pos == 1 {
 					pos = max
 				} else {
 					pos--
 				}
 			}

 		}

 	}
 }
 
 func (alloc *IPAllocator) Acquire() (net.IP, error) {

 	ip := <-alloc.queueAlloc
 	return ip.ip, ip.err

 }
 

 func (alloc *IPAllocator) Release(ip net.IP) {
 	alloc.queueReleased <- ip

 }
 

 func newIPAllocator(network *net.IPNet) *IPAllocator {

 	alloc := &IPAllocator{

 		network:       network,
 		queueAlloc:    make(chan allocatedIP),
 		queueReleased: make(chan net.IP),
 		inUse:         make(map[int32]struct{}),

 	}

 
 	go alloc.run()
 
 	return alloc

 }
 
 // Network interface represents the networking stack of a container
 type NetworkInterface struct {
 	IPNet   net.IPNet
 	Gateway net.IP
 
 	manager  *NetworkManager
 	extPorts []int
 }
 
 // Allocate an external TCP port and map it to the interface

 func (iface *NetworkInterface) AllocatePort(spec string) (*Nat, error) {
 	nat, err := parseNat(spec)

 	if err != nil {

 		return nil, err
 	}
 	// Allocate a random port if Frontend==0
 	if extPort, err := iface.manager.portAllocator.Acquire(nat.Frontend); err != nil {
 		return nil, err
 	} else {
 		nat.Frontend = extPort
 	}
 	if err := iface.manager.portMapper.Map(nat.Frontend, net.TCPAddr{IP: iface.IPNet.IP, Port: nat.Backend}); err != nil {
 		iface.manager.portAllocator.Release(nat.Frontend)
 		return nil, err
 	}
 	iface.extPorts = append(iface.extPorts, nat.Frontend)
 	return nat, nil
 }
 
 type Nat struct {
 	Proto    string
 	Frontend int
 	Backend  int
 }
 
 func parseNat(spec string) (*Nat, error) {
 	var nat Nat
 	// If spec starts with ':', external and internal ports must be the same.
 	// This might fail if the requested external port is not available.
 	var sameFrontend bool
 	if spec[0] == ':' {
 		sameFrontend = true
 		spec = spec[1:]
 	}
 	port, err := strconv.ParseUint(spec, 10, 16)
 	if err != nil {
 		return nil, err

 	}

 	nat.Backend = int(port)
 	if sameFrontend {
 		nat.Frontend = nat.Backend

 	}

 	nat.Proto = "tcp"
 	return &nat, nil

 }
 
 // Release: Network cleanup - release all resources

 func (iface *NetworkInterface) Release() {

 	for _, port := range iface.extPorts {
 		if err := iface.manager.portMapper.Unmap(port); err != nil {
 			log.Printf("Unable to unmap port %v: %v", port, err)
 		}
 		if err := iface.manager.portAllocator.Release(port); err != nil {
 			log.Printf("Unable to release port %v: %v", port, err)
 		}
 
 	}

 
 	iface.manager.ipAllocator.Release(iface.IPNet.IP)

 }
 
 // Network Manager manages a set of network interfaces
 // Only *one* manager per host machine should be used
 type NetworkManager struct {
 	bridgeIface   string
 	bridgeNetwork *net.IPNet
 
 	ipAllocator   *IPAllocator
 	portAllocator *PortAllocator
 	portMapper    *PortMapper
 }
 
 // Allocate a network interface
 func (manager *NetworkManager) Allocate() (*NetworkInterface, error) {
 	ip, err := manager.ipAllocator.Acquire()

 	if err != nil {

 		return nil, err

 	}

 	iface := &NetworkInterface{

 		IPNet:   net.IPNet{IP: ip, Mask: manager.bridgeNetwork.Mask},

 		Gateway: manager.bridgeNetwork.IP,
 		manager: manager,

 	}
 	return iface, nil
 }
 

 func newNetworkManager(bridgeIface string) (*NetworkManager, error) {
 	addr, err := getIfaceAddr(bridgeIface)
 	if err != nil {

 		// If the iface is not found, try to create it
 		if err := CreateBridgeIface(bridgeIface); err != nil {
 			return nil, err
 		}
 		addr, err = getIfaceAddr(bridgeIface)
 		if err != nil {
 			return nil, err
 		}

 	}
 	network := addr.(*net.IPNet)
 

 	ipAllocator := newIPAllocator(network)

 	portAllocator, err := newPortAllocator()

 	if err != nil {
 		return nil, err
 	}
 
 	portMapper, err := newPortMapper()

 	if err != nil {
 		return nil, err
 	}

 
 	manager := &NetworkManager{
 		bridgeIface:   bridgeIface,
 		bridgeNetwork: network,
 		ipAllocator:   ipAllocator,
 		portAllocator: portAllocator,
 		portMapper:    portMapper,
 	}
 	return manager, nil

 }