#pragma once

#include <chrono>

#include <cstddef>

#include <memory>

#include <string>

#include <utility>

#include <vector>

#include "envoy/api/io_error.h"

#include "envoy/common/random_generator.h"

#include "envoy/network/address.h"

#include "envoy/network/filter.h"

#include "envoy/network/listener_filter_buffer.h"

#include "envoy/server/factory_context.h"

#include "source/common/common/logger.h"

#include "absl/strings/string_view.h"

#include "absl/types/optional.h"

#include "cilium/api/bpf_metadata.pb.h"

#include "cilium/conntrack.h"

#include "cilium/filter_state_cilium_destination.h"

#include "cilium/filter_state_cilium_policy.h"

#include "cilium/host_map.h"

#include "cilium/ipcache.h"

#include "cilium/network_policy.h"

#include "cilium/socket_option_cilium_mark.h"

#include "cilium/socket_option_source_address.h"

namespace Envoy {

namespace Cilium {

namespace BpfMetadata {

#define DEFAULT_CACHE_ENTRY_TTL_MS 3

struct SocketMetadata : public Logger::Loggable<Logger::Id::filter> {

  SocketMetadata(uint32_t mark, uint32_t ingress_source_identity, uint32_t source_identity,

                 bool ingress, bool l7lb, uint16_t port, std::string&& pod_ip,

                 std::string&& ingress_policy_name,

                 Network::Address::InstanceConstSharedPtr original_source_address,

                 Network::Address::InstanceConstSharedPtr source_address_ipv4,

                 Network::Address::InstanceConstSharedPtr source_address_ipv6,

                 Network::Address::InstanceConstSharedPtr original_dest_address,

                 const PolicyResolverSharedPtr& policy_resolver, uint32_t proxy_id,

                 std::string&& proxylib_l7_proto, absl::string_view sni)

  std::shared_ptr<Envoy::Cilium::SourceAddressSocketOption> buildSourceAddressSocketOption(

      int linger_time, const std::shared_ptr<CiliumDestinationFilterState>& dest_fs = nullptr,

  // Add ProxyLib L7 protocol as requested application protocol on the socket.

      // Only set the local address if it really changed, and mark it as address being restored.

    // Restoration of the original destination address lets the OriginalDstCluster know the

    // destination address that can be used.

  uint32_t ingress_source_identity_;

  uint32_t source_identity_;

  bool ingress_;

  bool is_l7lb_;

  uint16_t port_;

  std::string pod_ip_; // pod policy to enforce, if any; empty only when there is no local pod (i.e.

                       // north/south l7lb)

  std::string ingress_policy_name_; // Ingress policy to enforce, if any

  uint32_t proxy_id_;

  std::string proxylib_l7_proto_;

  std::string sni_;

  const PolicyResolverSharedPtr policy_resolver_;

  uint32_t mark_;

  Network::Address::InstanceConstSharedPtr original_source_address_;

  Network::Address::InstanceConstSharedPtr source_address_ipv4_;

  Network::Address::InstanceConstSharedPtr source_address_ipv6_;

  Network::Address::InstanceConstSharedPtr original_dest_address_;

};

/**

 * Global configuration for Bpf Metadata listener filter. This

 * represents all global state shared among the working thread

 * instances of the filter.

 */

class Config : public Cilium::PolicyResolver,

               public std::enable_shared_from_this<Config>,

               Logger::Loggable<Logger::Id::config> {

public:

  Config(const ::cilium::BpfMetadata& config,

         Server::Configuration::ListenerFactoryContext& context);

  // PolicyResolver

  uint32_t resolvePolicyId(const Network::Address::Ip*) const override;

  const PolicyInstance& getPolicy(const std::string&) const override;

  bool exists(const std::string&) const override;

  virtual absl::optional<SocketMetadata> extractSocketMetadata(Network::ConnectionSocket& socket);

  // Possibility to prevent socket options that require

  // NET_ADMIN privileges from being applied. Used by tests.

  int so_linger_; // negative if disabled

  uint32_t proxy_id_;

  bool is_ingress_;

  bool use_original_source_address_;

  bool is_l7lb_;

  Network::Address::InstanceConstSharedPtr ipv4_source_address_;

  Network::Address::InstanceConstSharedPtr ipv6_source_address_;

  bool enforce_policy_on_l7lb_;

  std::string l7lb_policy_name_;

  std::chrono::milliseconds ipcache_entry_ttl_;

  Random::RandomGenerator& random_;

  std::shared_ptr<const Cilium::NetworkPolicyMap> npmap_{};

  Cilium::CtMapSharedPtr ct_maps_{};

  Cilium::IpCacheSharedPtr ipcache_{};

  std::shared_ptr<const Cilium::PolicyHostMap> hosts_{};

private:

  uint32_t resolveSourceIdentity(const PolicyInstance& policy, const Network::Address::Ip* sip,

                                 const Network::Address::Ip* dip, bool ingress, bool is_l7_lb);

  IpAddressPair getIpAddressPairWithPort(uint16_t port, const IpAddressPair& addresses);

  const Network::Address::Ip* selectIpVersion(const Network::Address::IpVersion version,

                                              const IpAddressPair& source_addresses);

};

using ConfigSharedPtr = std::shared_ptr<Config>;

/**

 * Implementation of a bpf metadata listener filter.

 */

class Instance : public Network::ListenerFilter, Logger::Loggable<Logger::Id::filter> {

public:

  // Network::ListenerFilter

  Network::FilterStatus onAccept(Network::ListenerFilterCallbacks& cb) override;

  // Network::ListenerFilter

  Network::FilterStatus onData(Network::ListenerFilterBuffer& buffer) override;

  // Network::ListenerFilter

  size_t maxReadBytes() const override;

private:

  const ConfigSharedPtr config_;

};

/**

 * Implementation of a UDP bpf metadata listener filter.

 */

class UdpInstance : public Network::UdpListenerReadFilter, Logger::Loggable<Logger::Id::filter> {

public:

  UdpInstance(const ConfigSharedPtr& config, Network::UdpReadFilterCallbacks& callbacks)

  // Network::UdpListenerReadFilter

  Network::FilterStatus onData(Network::UdpRecvData& data) override;

  // Network::UdpListenerReadFilter

  Network::FilterStatus onReceiveError(Api::IoError::IoErrorCode error_code) override;

private:

  const ConfigSharedPtr config_;

};

} // namespace BpfMetadata

} // namespace Cilium

} // namespace Envoy