// limitations under the License.

package nodeagent

import (
	"fmt"
	"runtime"
	"sync"

	netns "github.com/containernetworking/plugins/pkg/ns"
	"golang.org/x/sys/unix"
)

type NetnsWrapper struct {
	innerNetns netns.NetNS
	inode      uint64
}

func (n *NetnsWrapper) Inode() uint64 {
	return n.inode
}

func (n *NetnsWrapper) Close() error {

            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false
          runAsUser: 0

	MOVD $·Sethostname(SB), R8
	MOVD R8, ret+0(FP)
	RET

// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

TEXT ·get_SetnsAddr(SB), NOSPLIT|NOFRAME, $0-8
	MOVD $·Setns(SB), R8
	MOVD R8, ret+0(FP)
	RET

// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

TEXT ·get_SymlinkatAddr(SB), NOSPLIT|NOFRAME, $0-8
	MOVD $·Symlinkat(SB), R8
	MOVD R8, ret+0(FP)
	RET

import "io"

type NetnsFd interface {
	Fd() uintptr
}

type Netns interface {
	NetnsFd
	Inode() uint64
}
type NetnsCloser interface {
	io.Closer
	Netns
}

type NetnsWithFd struct {
	netns io.Closer
	fd    uintptr
	inode uint64
}

func (n *NetnsWithFd) Close() error {
	if n.netns == nil {
		return nil
	}

	ret := n.netns.Close()

	for _, p := range procs {
		match := false
		ns := getPidNamespace(p.PID)

		err := netns.WithNetNSPath(ns, func(_ netns.NetNS) error {
			var err error
			match, err = checkInterfacesForMatchingAddr(parsedPodAddr)
			return err
		})
		if err != nil {
			log.Warnf("failed to check proc %d netns interfaces: %v", p.PID, err)
			continue
		}

		if !match {
			// Not the network we want, skip

	cfg.DualStack = rdrct.dualStack
	if err := cfg.FillConfigFromEnvironment(); err != nil {
		return err
	}

	netNs, err := getNs(netns)
	if err != nil {
		err = fmt.Errorf("failed to open netns %q: %s", netns, err)
		return err
	}
	defer netNs.Close()

	return netNs.Do(func(_ ns.NetNS) error {
		log.Infof("============= Start iptables configuration for %v =============", podName)

	if e1 != 0 {
		err = errnoErr(e1)
	}
	return
}

// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

func Setns(fd int, nstype int) (err error) {
	_, _, e1 := Syscall(SYS_SETNS, uintptr(fd), uintptr(nstype), 0)
	if e1 != 0 {
		err = errnoErr(e1)
	}
	return
}

//sys	Setdomainname(p []byte) (err error)
//sys	Sethostname(p []byte) (err error)
//sysnb	Setpgid(pid int, pgid int) (err error)
//sysnb	Setsid() (pid int, err error)
//sysnb	Settimeofday(tv *Timeval) (err error)
//sys	Setns(fd int, nstype int) (err error)

//go:linkname syscall_prlimit syscall.prlimit
func syscall_prlimit(pid, resource int, newlimit, old *syscall.Rlimit) error

	runtime.ExitSyscall()
	if int64(r0) == -1 {
		err = errnoErr2(e1, e2)
	}
	return
}

//go:nosplit
func get_SetnsAddr() *(func(fd int, nstype int) (err error))

var Setns = enter_Setns

func enter_Setns(fd int, nstype int) (err error) {
	funcref := get_SetnsAddr()
	if funcptrtest(GetZosLibVec()+SYS_SETNS<<4, "") == 0 {
		*funcref = impl_Setns
	} else {

	path string
}

func (ns *mockNetNs) Do(toRun func(ns.NetNS) error) error {
	return toRun(ns)
}

func (*mockNetNs) Set() error {
	return nil
}

func (ns *mockNetNs) Path() string {
	return ns.path
}

func (*mockNetNs) Fd() uintptr {
	return 0
}

func (*mockNetNs) Close() error {
	return nil
}

type netNsFunc func(nspath string) (ns.NetNS, error)