vnc_cfg_types.py

#
# Copyright (c) 2013 Juniper Networks, Inc. All rights reserved.
#
#
# This file is built up from an autogenerated template resource_server.py and
# contains code/hooks at different point during processing a request, specific
# to type of resource. For eg. allocation of mac/ip-addr for a port during its
# creation.

import json
import re

import cfgm_common
import netaddr
import uuid
import ConfigParser
from vnc_quota import QuotaHelper

from gen.resource_xsd import *
from gen.resource_common import *
from gen.resource_server import *
from netaddr import IPNetwork
from pprint import pformat
from pysandesh.gen_py.sandesh.ttypes import SandeshLevel


class GlobalSystemConfigServer(GlobalSystemConfigServerGen):
    @classmethod
    def _check_asn(cls, obj_dict, db_conn):
        global_asn = obj_dict.get('autonomous_system')
        if not global_asn:
            return (True, '')
        (ok, result) = db_conn.dbe_list('virtual-network')
        if not ok:
            return (ok, result)
        for vn_name, vn_uuid in result:
            ok, result = db_conn.dbe_read('virtual-network', {'uuid': vn_uuid}, 
                                           obj_fields=['route_target_list'])
            if not ok:
                return ok, result
            rt_dict = result.get('route_target_list', {})
            for rt in rt_dict.get('route_target', []):
                (_, asn, target) = rt.split(':')
                if (int(asn) == global_asn and
                    int(target) >= cfgm_common.BGP_RTGT_MIN_ID):
                    return (False, (400, "Virtual network %s is configured "
                            "with a route target with this ASN and route "
                            "target value in the same range as used by "
                            "automatically allocated route targets" % vn_name))
        return (True, '')
    # end _check_asn

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        ok, result = cls._check_asn(obj_dict, db_conn)
        if not ok:
            return ok, result
        return True, ''
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        ok, result = cls._check_asn(obj_dict, db_conn)
        if not ok:
            return ok, result
        return True, ''
    # end http_put

# end class GlobalSystemConfigServer


class FloatingIpServer(FloatingIpServerGen):
    generate_default_instance = False

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        proj_dict = obj_dict['project_refs'][0]
        if 'uuid' in proj_dict:
            proj_uuid = proj_dict['uuid']
        else:
            proj_uuid = db_conn.fq_name_to_uuid('project', proj_dict['to'])

        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'floating_ip_back_refs',
                               'obj_type': 'floating-ip',
                               'user_visibility': user_visibility,
                               'proj_uuid': proj_uuid}
        (ok, response) = QuotaHelper.verify_quota_for_resource(
            **verify_quota_kwargs)

        if not ok:
            return (ok, response)

        vn_fq_name = obj_dict['fq_name'][:-2]
        req_ip = obj_dict.get("floating_ip_address")
        if req_ip and cls.addr_mgmt.is_ip_allocated(req_ip, vn_fq_name):
            return (False, (403, 'Ip address already in use'))
        try:
            fip_addr = cls.addr_mgmt.ip_alloc_req(vn_fq_name,
                                                  asked_ip_addr=req_ip)
        except Exception as e:
            return (False, (500, str(e)))
        obj_dict['floating_ip_address'] = fip_addr
        db_conn.config_log('AddrMgmt: alloc %s FIP for vn=%s, tenant=%s, askip=%s' \
            % (obj_dict['floating_ip_address'], vn_fq_name, tenant_name,
               req_ip), level=SandeshLevel.SYS_DEBUG)
        return True, ""
    # end http_post_collection

    @classmethod
    def http_post_collection_fail(cls, tenant_name, obj_dict, db_conn):
        vn_fq_name = obj_dict['fq_name'][:-2]
        fip_addr = obj_dict['floating_ip_address']
        db_conn.config_log('AddrMgmt: free FIP %s for vn=%s tenant=%s, on post fail'
                           % (fip_addr, vn_fq_name, tenant_name),
                           level=SandeshLevel.SYS_DEBUG)
        cls.addr_mgmt.ip_free_req(fip_addr, vn_fq_name)
        return True, ""
    # end http_post_collection_fail

    @classmethod
    def http_delete(cls, id, obj_dict, db_conn):
        vn_fq_name = obj_dict['fq_name'][:-2]
        fip_addr = obj_dict['floating_ip_address']
        db_conn.config_log('AddrMgmt: free FIP %s for vn=%s'
                           % (fip_addr, vn_fq_name),
                           level=SandeshLevel.SYS_DEBUG)
        cls.addr_mgmt.ip_free_req(fip_addr, vn_fq_name)
        return True, ""
    # end http_delete

    @classmethod
    def http_delete_fail(cls, id, obj_dict, db_conn):
        vn_fq_name = obj_dict['fq_name'][:-2]
        req_ip = obj_dict.get("floating_ip_address", None)
        if req_ip is None:
            return True, ""
        try:
            cls.addr_mgmt.ip_alloc_req(vn_fq_name, asked_ip_addr=req_ip)
        except Exception as e:
            return (False, (500, str(e)))
        db_conn.config_log('AddrMgmt: alloc %s FIP for vn=%s to recover DELETE failure'
                           % (obj_dict['floating_ip_address'], vn_fq_name),
                           level=SandeshLevel.SYS_DEBUG)
        return True, ""
    # end http_delete_fail

    @classmethod
    def dbe_create_notification(cls, obj_ids, obj_dict):
        fip_addr = obj_dict['floating_ip_address']
        vn_fq_name = obj_dict['fq_name'][:-2]
        cls.addr_mgmt.ip_alloc_notify(fip_addr, vn_fq_name)
    # end dbe_create_notification

    @classmethod
    def dbe_delete_notification(cls, obj_ids, obj_dict):
        fip_addr = obj_dict['floating_ip_address']
        vn_fq_name = obj_dict['fq_name'][:-2]
        cls.addr_mgmt.ip_free_notify(fip_addr, vn_fq_name)
    # end dbe_delete_notification

# end class FloatingIpServer


class InstanceIpServer(InstanceIpServerGen):
    generate_default_instance = False

    @classmethod
    def _get_subnet_name(cls, vn_dict, subnet_uuid):
        ipam_refs = vn_dict.get('network_ipam_refs', [])
        subnet_name = None
        for ipam in ipam_refs:
            ipam_subnets = ipam['attr'].get('ipam_subnets', [])
            for subnet in ipam_subnets:
                if subnet['subnet_uuid'] == subnet_uuid:
                    subnet_dict = subnet['subnet']
                    subnet_name = subnet_dict['ip_prefix'] + '/' + str(
                                  subnet_dict['ip_prefix_len'])
                    return subnet_name

    @classmethod
    def _is_gateway_ip(cls, vn_dict, ip_addr):
        ipam_refs = vn_dict.get('network_ipam_refs', [])
        for ipam in ipam_refs:
            ipam_subnets = ipam['attr'].get('ipam_subnets', [])
            for subnet in ipam_subnets:
                if subnet['default_gateway'] == ip_addr:
                    return True

        return False

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        vn_fq_name = obj_dict['virtual_network_refs'][0]['to']
        if ((vn_fq_name == cfgm_common.IP_FABRIC_VN_FQ_NAME) or
                (vn_fq_name == cfgm_common.LINK_LOCAL_VN_FQ_NAME)):
            # Ignore ip-fabric and link-local address allocations
            return True,  ""

        req_ip = obj_dict.get("instance_ip_address", None)

        vn_id = {'uuid': db_conn.fq_name_to_uuid('virtual-network', vn_fq_name)}
        (read_ok, vn_dict) = db_conn.dbe_read('virtual-network', vn_id, 
                            obj_fields=['router_external', 'network_ipam_refs'])
        if not read_ok:
            return (False, (500, 'Internal error : ' + pformat(vn_dict)))

        subnet_uuid = obj_dict.get('subnet_uuid', None)
        sub = cls._get_subnet_name(vn_dict, subnet_uuid) if subnet_uuid else None
        if subnet_uuid and not sub:
            return (False, (404, "Subnet id " + subnet_uuid + " not found"))

        req_ip_family = obj_dict.get("instance_ip_family", None)
        if req_ip is None and subnet_uuid:
            # pickup the version from subnet
            req_ip_version = IPNetwork(sub).version
        else:
            req_ip_version = 4 # default ip v4

        if req_ip_family == "v6": req_ip_version = 6
        # If its an external network, check whether floating IP equivalent to
        # requested fixed-IP is already reserved.
        router_external = vn_dict.get('router_external', None)
        if req_ip and router_external and \
           not cls._is_gateway_ip(vn_dict, req_ip) and \
           cls.addr_mgmt.is_ip_allocated(req_ip, vn_fq_name):
            return (False, (403, 'Ip address already in use'))

        try:
            ip_addr = cls.addr_mgmt.ip_alloc_req(
                vn_fq_name, vn_dict=vn_dict, sub=sub, asked_ip_addr=req_ip,
                asked_ip_version=req_ip_version)
        except Exception as e:
            return (False, (500, str(e)))
        obj_dict['instance_ip_address'] = ip_addr
        db_conn.config_log('AddrMgmt: alloc %s for vn=%s, tenant=%s, askip=%s'
            % (obj_dict['instance_ip_address'],
               vn_fq_name, tenant_name, req_ip),
            level=SandeshLevel.SYS_DEBUG)
        return True, ""
    # end http_post_collection

    @classmethod
    def http_post_collection_fail(cls, tenant_name, obj_dict, db_conn):
        vn_fq_name = obj_dict['virtual_network_refs'][0]['to']
        if ((vn_fq_name == cfgm_common.IP_FABRIC_VN_FQ_NAME) or
                (vn_fq_name == cfgm_common.LINK_LOCAL_VN_FQ_NAME)):
            # Ignore ip-fabric and link-local address allocations
            return True,  ""

        ip_addr = obj_dict['instance_ip_address']
        db_conn.config_log('AddrMgmt: free IP %s, vn=%s tenant=%s on post fail'
                           % (ip_addr, vn_fq_name, tenant_name),
                           level=SandeshLevel.SYS_DEBUG)
        cls.addr_mgmt.ip_free_req(ip_addr, vn_fq_name)
        return True, ""
    # end http_post_collection_fail

    @classmethod
    def http_delete(cls, id, obj_dict, db_conn):
        vn_fq_name = obj_dict['virtual_network_refs'][0]['to']
        if ((vn_fq_name == cfgm_common.IP_FABRIC_VN_FQ_NAME) or
                (vn_fq_name == cfgm_common.LINK_LOCAL_VN_FQ_NAME)):
            # Ignore ip-fabric and link-local address allocations
            return True,  ""

        try:
            ip_addr = obj_dict['instance_ip_address']
        except KeyError:
            db_conn.config_log('AddrMgmt: IP Not allocated to iip = %s, vn=%s'
                           % (id, vn_fq_name),
                           level=SandeshLevel.SYS_DEBUG)
            return True, ""
        db_conn.config_log('AddrMgmt: free IP %s, vn=%s'
                           % (ip_addr, vn_fq_name),
                           level=SandeshLevel.SYS_DEBUG)
        cls.addr_mgmt.ip_free_req(ip_addr, vn_fq_name)
        return True, ""
    # end http_delete

    @classmethod
    def http_delete_fail(cls, id, obj_dict, db_conn):
        vn_fq_name = obj_dict['virtual_network_refs'][0]['to']
        if ((vn_fq_name == cfgm_common.IP_FABRIC_VN_FQ_NAME) or
                (vn_fq_name == cfgm_common.LINK_LOCAL_VN_FQ_NAME)):
            # Ignore ip-fabric and link-local address allocations
            return True,  ""

        req_ip = obj_dict.get("instance_ip_address", None)
        if req_ip is None:
            return True, ""
        try:
            cls.addr_mgmt.ip_alloc_req(vn_fq_name, asked_ip_addr=req_ip)
        except Exception as e:
            return (False, (500, str(e)))
        db_conn.config_log('AddrMgmt: alloc %s for vn=%s to recover DELETE failure'
                           % (obj_dict['instance_ip_address'], vn_fq_name),
                           level=SandeshLevel.SYS_DEBUG)

        return True, ""
    # end http_delete_fail

    @classmethod
    def dbe_create_notification(cls, obj_ids, obj_dict):
        ip_addr = obj_dict['instance_ip_address']
        vn_fq_name = obj_dict['virtual_network_refs'][0]['to']
        cls.addr_mgmt.ip_alloc_notify(ip_addr, vn_fq_name)
    # end dbe_create_notification

    @classmethod
    def dbe_delete_notification(cls, obj_ids, obj_dict):
        try:
            ip_addr = obj_dict['instance_ip_address']
        except KeyError:
            return
        vn_fq_name = obj_dict['virtual_network_refs'][0]['to']
        cls.addr_mgmt.ip_free_notify(ip_addr, vn_fq_name)
    # end dbe_delete_notification

# end class InstanceIpServer


class LogicalRouterServer(LogicalRouterServerGen):
    generate_default_instance = False

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'logical_routers',
                               'obj_type': 'logical-router',
                               'user_visibility': user_visibility}

        return QuotaHelper.verify_quota_for_resource(**verify_quota_kwargs)
    # end http_post_collection

# end class LogicalRouterServer


class VirtualMachineInterfaceServer(VirtualMachineInterfaceServerGen):
    generate_default_instance = False

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        vn_dict = obj_dict['virtual_network_refs'][0]
        vn_uuid = vn_dict.get('uuid')
        if not vn_uuid:
            vn_fq_name = vn_dict.get('to')
            if not vn_fq_name:
                return (False, (500, 'Internal error : ' + pformat(vn_dict)))
            vn_uuid = db_conn.fq_name_to_uuid('virtual-network', vn_fq_name)
        (ok, vn_dict) = db_conn.dbe_read('virtual-network', {'uuid':vn_uuid}, 
                                         obj_fields=['parent_uuid'])
        if not ok:
            return (False, (500, 'Internal error : ' + pformat(vn_dict)))

        proj_uuid = vn_dict['parent_uuid']
        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'virtual_machine_interfaces',
                               'obj_type': 'virtual-machine-interface',
                               'user_visibility': user_visibility,
                               'proj_uuid': proj_uuid}

        (ok, response) = QuotaHelper.verify_quota_for_resource(
            **verify_quota_kwargs)

        if not ok:
            return (ok, response)

        inmac = None
        if 'virtual_machine_interface_mac_addresses' in obj_dict:
            mc = obj_dict['virtual_machine_interface_mac_addresses']
            if 'mac_address' in mc:
                if len(mc['mac_address'])==1:
                    inmac = [m.replace("-",":") for m in mc['mac_address']]
        if inmac!=None:
            mac_addrs_obj = MacAddressesType(inmac)
        else:
            mac_addr = cls.addr_mgmt.mac_alloc(obj_dict)
            mac_addrs_obj = MacAddressesType([mac_addr])
        mac_addrs_json = json.dumps(
            mac_addrs_obj,
            default=lambda o: dict((k, v)
                                   for k, v in o.__dict__.iteritems()))
        mac_addrs_dict = json.loads(mac_addrs_json)
        obj_dict['virtual_machine_interface_mac_addresses'] = mac_addrs_dict

        if 'virtual_machine_interface_allowed_address_pairs' in obj_dict:
            aap_config = obj_dict['virtual_machine_interface_allowed_address_pairs']
            if 'allowed_address_pair' in aap_config:
                aaps = aap_config['allowed_address_pair']
                for aap in aaps or []:
                    if aap['mac'] == "":
                        aap['mac'] = obj_dict['virtual_machine_interface_mac_addresses']['mac_address'][0]
        return True, ""
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        if 'virtual_machine_interface_allowed_address_pairs' in obj_dict:
            vmi_id = {'uuid': id}
            (read_ok, read_result) = db_conn.dbe_read('virtual-machine-interface', vmi_id)
            if not read_ok:
                return (False, (500, read_result))

            aap_config = obj_dict['virtual_machine_interface_allowed_address_pairs']
            if 'allowed_address_pair' in aap_config:
                aaps = aap_config['allowed_address_pair']
                for aap in aaps or []:
                    if aap['mac'] == "":
                        aap['mac'] = read_result['virtual_machine_interface_mac_addresses']['mac_address'][0]
        return True, ""
    # end http_put
# end class VirtualMachineInterfaceServer


class VirtualNetworkServer(VirtualNetworkServerGen):

    @classmethod
    def _check_route_targets(cls, obj_dict, db_conn):
        if 'route_target_list' not in obj_dict:
            return (True, '')
        config_uuid = db_conn.fq_name_to_uuid('global_system_config', ['default-global-system-config'])
        config = db_conn.uuid_to_obj_dict(config_uuid)
        global_asn = config.get('prop:autonomous_system')
        if not global_asn:
            return (True, '')
        global_asn = json.loads(global_asn)
        rt_dict = obj_dict.get('route_target_list')
        if not rt_dict:
            return (True, '')
        for rt in rt_dict.get('route_target', []):
            try:
                (prefix, asn, target) = rt.split(':')
                if prefix != 'target':
                    raise ValueError()
                target = int(target)
                if not asn.isdigit():
                    netaddr.IPAddress(asn)
            except (ValueError, netaddr.core.AddrFormatError) as e:
                 return (False, "Route target must be of the format "
                         "'target:<asn>:<number>' or 'target:<ip>:number'")
            if asn == global_asn and target >= cfgm_common.BGP_RTGT_MIN_ID:
                 return (False, "Configured route target must use ASN that is "
                         "different from global ASN or route target value must"
                         " be less than %d" % cfgm_common.BGP_RTGT_MIN_ID)

        return (True, '')
    # end _check_route_targets

    @classmethod
    def _check_vxlan_id(cls, obj_dict, db_conn):
        # if vxlan id check is disabled, return
        try:
            conf_sections = db_conn._api_svr_mgr._args.config_sections
            check_enabled = \
                conf_sections.getboolean('DEFAULTS', 'check_vxlan_id_uniqueness')
        except ConfigParser.NoOptionError:
            check_enabled = True
        if not check_enabled:
            return (True, '')

        vxlan_id = None
        vn_uuid = obj_dict.get('uuid', None)
        vn_properties = obj_dict.get('virtual_network_properties', None)
        if vn_properties:
            vxlan_id = vn_properties.get('vxlan_network_identifier', None)
        if not vxlan_id:
            return (True, '')

        # read all VNs, across projects
        (ok, vn_objects) = db_conn.dbe_list('virtual-network')
        if not ok:
            return (ok, 'Internal error : Virtual Networks read failed')

        # get VN properties of all VNs using a dbe_read_multi
        obj_ids_list = [{'uuid': obj_uuid} for _, obj_uuid in vn_objects]
        obj_fields = [u'virtual_network_properties']
        (ok, result) = db_conn.dbe_read_multi('virtual-network',
                               obj_ids_list, obj_fields)
        if not ok:
            return (False, (500, 'Internal error : Virtual Network read failed'))

        # ensure uniqueness of vxlan_network_identifier
        for vn_object in result:
            if vn_object['uuid'] == vn_uuid:
                continue
            vn_object_properties = vn_object.get('virtual_network_properties', None)
            if vn_object_properties:
                vn_object_vxlan_id = vn_object_properties.get('vxlan_network_identifier', None)
                if vn_object_vxlan_id and vn_object_vxlan_id == vxlan_id:
                    return (False, (403, 'Vxlan Id already used in : ' + vn_object['uuid']))

        return (True, '')
    # end _check_vxlan_id

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'virtual_networks',
                               'obj_type': 'virtual-network',
                               'user_visibility': user_visibility}

        (ok, response) = QuotaHelper.verify_quota_for_resource(
            **verify_quota_kwargs)
        if not ok:
            return (ok, response)

        (ok, response) =  cls._check_vxlan_id(obj_dict, db_conn)
        if not ok:
            return (ok, response)

        db_conn.update_subnet_uuid(obj_dict)

        (ok, error) =  cls._check_route_targets(obj_dict, db_conn)
        if not ok:
            return (False, (400, error))
        try:
            cls.addr_mgmt.net_create_req(obj_dict)
        except Exception as e:
            return (False, (500, str(e)))

        return True, ""
    # end http_post_collection

    @classmethod
    def http_post_collection_fail(cls, tenant_name, obj_dict, db_conn):
        cls.addr_mgmt.net_delete_req(obj_dict)
        return True, ""
    # end post_collection_fail

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        if ((fq_name == cfgm_common.IP_FABRIC_VN_FQ_NAME) or
                (fq_name == cfgm_common.LINK_LOCAL_VN_FQ_NAME)):
            # Ignore ip-fabric subnet updates
            return True,  ""

        (ok, result) =  cls._check_vxlan_id(obj_dict, db_conn)
        if not ok:
            return (ok, result)

        if 'network_ipam_refs' not in obj_dict:
            # NOP for addr-mgmt module
            return True,  ""

        vn_id = {'uuid': id}
        (read_ok, read_result) = db_conn.dbe_read('virtual-network', vn_id, 
                                               obj_fields=['network_ipam_refs'])
        if not read_ok:
            return (False, (500, read_result))

        (ok, result) = cls.addr_mgmt.net_check_subnet(read_result, obj_dict)
        if not ok:
            return (ok, (409, result))

        (ok, result) = cls.addr_mgmt.net_check_subnet_quota(read_result,
                                                            obj_dict, db_conn)
        if not ok:
            return (ok, (403, result))
        (ok, result) = cls.addr_mgmt.net_check_subnet_overlap(read_result,
                                                              obj_dict)
        if not ok:
            return (ok, (409, result))
        (ok, result) = cls.addr_mgmt.net_check_subnet_delete(read_result,
                                                             obj_dict)
        if not ok:
            return (ok, (409, result))

        try:
            cls.addr_mgmt.net_update_req(fq_name, read_result, obj_dict, id)
        except Exception as e:
            return (False, (500, str(e)))

        db_conn.update_subnet_uuid(obj_dict)

        (ok, error) =  cls._check_route_targets(obj_dict, db_conn)
        if not ok:
            return (False, (400, error))
        return True, ""
    # end http_put

    @classmethod
    def http_put_fail(cls, id, fq_name, obj_dict, db_conn):
        if ((fq_name == cfgm_common.IP_FABRIC_VN_FQ_NAME) or
                (fq_name == cfgm_common.LINK_LOCAL_VN_FQ_NAME)):
            # Ignore ip-fabric subnet updates
            return True,  ""

        ipam_refs = obj_dict.get('network_ipam_refs', None)
        if not ipam_refs:
            # NOP for addr-mgmt module
            return True,  ""

        vn_id = {'uuid': id}
        (read_ok, read_result) = db_conn.dbe_read('virtual-network', vn_id, 
                                               obj_fields=['network_ipam_refs'])
        if not read_ok:
            return (False, (500, read_result))
        cls.addr_mgmt.net_update_req(fq_name, obj_dict, read_result, id)
    # end http_put_fail

    @classmethod
    def http_delete(cls, id, obj_dict, db_conn):
        cls.addr_mgmt.net_delete_req(obj_dict)
        return True, ""
    # end http_delete

    @classmethod
    def http_delete_fail(cls, id, obj_dict, db_conn):
        cls.addr_mgmt.net_create_req(obj_dict)
        return True, ""
    # end http_delete_fail

    @classmethod
    def ip_alloc(cls, vn_fq_name, subnet_name, count):
        ip_list = [cls.addr_mgmt.ip_alloc_req(vn_fq_name, sub=subnet_name)
                   for i in range(count)]
        msg = 'AddrMgmt: reserve %d IP for vn=%s, subnet=%s - %s' \
            % (count, vn_fq_name, subnet_name if subnet_name else '', ip_list)
        cls.addr_mgmt.config_log(msg, level=SandeshLevel.SYS_DEBUG)
        return {'ip_addr': ip_list}
    # end ip_alloc

    @classmethod
    def ip_free(cls, vn_fq_name, subnet_name, ip_list):
        msg = 'AddrMgmt: release IP %s for vn=%s, subnet=%s' \
            % (ip_list, vn_fq_name, subnet_name if subnet_name else '')
        cls.addr_mgmt.config_log(msg, level=SandeshLevel.SYS_DEBUG)
        for ip_addr in ip_list:
            cls.addr_mgmt.ip_free_req(ip_addr, vn_fq_name, sub=subnet_name)
    # end ip_free

    @classmethod
    def subnet_ip_count(cls, obj_dict, subnet_list):
        ip_count_list = []
        for item in subnet_list:
            ip_count_list.append(cls.addr_mgmt.ip_count(obj_dict, item))
        return {'ip_count_list': ip_count_list}
    # end subnet_ip_count

    @classmethod
    def dbe_create_notification(cls, obj_ids, obj_dict):
        cls.addr_mgmt.net_create_notify(obj_ids, obj_dict)
    # end dbe_create_notification

    @classmethod
    def dbe_update_notification(cls, obj_ids):
        cls.addr_mgmt.net_update_notify(obj_ids)
    # end dbe_update_notification

    @classmethod
    def dbe_delete_notification(cls, obj_ids, obj_dict):
        cls.addr_mgmt.net_delete_notify(obj_ids, obj_dict)
    # end dbe_update_notification

# end class VirtualNetworkServer


class NetworkIpamServer(NetworkIpamServerGen):

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        ipam_uuid = obj_dict['uuid']
        ipam_id = {'uuid': ipam_uuid}
        (read_ok, read_result) = db_conn.dbe_read('network-ipam', ipam_id)
        if not read_ok:
            return (False, (500, "Internal error : IPAM is not valid"))
        old_ipam_mgmt = read_result.get('network_ipam_mgmt')
        new_ipam_mgmt = obj_dict.get('network_ipam_mgmt')
        if not old_ipam_mgmt or not new_ipam_mgmt:
            return True, ""
        old_dns_method = old_ipam_mgmt.get('ipam_dns_method')
        new_dns_method = new_ipam_mgmt.get('ipam_dns_method')
        if not cls.is_change_allowed(old_dns_method, new_dns_method, obj_dict,
                                     db_conn):
            return (False, (409, "Cannot change DNS Method from " +
                    old_dns_method + " to " + new_dns_method +
                    " with active VMs referring to the IPAM"))
        return True, ""
    # end http_put

    @classmethod
    def http_put_fail(cls, id, fq_name, obj_dict, db_conn):
        # undo any state change done by http_put function
        return True, ""
    # end http_put_fail

    @classmethod
    def is_change_allowed(cls, old, new, obj_dict, db_conn):
        if (old == "default-dns-server" or old == "virtual-dns-server"):
            if ((new == "tenant-dns-server" or new == "none") and
                    cls.is_active_vm_present(obj_dict, db_conn)):
                return False
        if (old == "tenant-dns-server" and new != old and
                cls.is_active_vm_present(obj_dict, db_conn)):
            return False
        if (old == "none" and new != old and
                cls.is_active_vm_present(obj_dict, db_conn)):
            return False
        return True
    # end is_change_allowed

    @classmethod
    def is_active_vm_present(cls, obj_dict, db_conn):
        if 'virtual_network_back_refs' in obj_dict:
            vn_backrefs = obj_dict['virtual_network_back_refs']
            for vn in vn_backrefs:
                vn_uuid = vn['uuid']
                vn_id = {'uuid': vn_uuid}
                (read_ok, read_result) = db_conn.dbe_read('virtual-network',
                                                          vn_id)
                if not read_ok:
                    continue
                if 'virtual_machine_interface_back_refs' in read_result:
                    return True
        return False
    # end is_active_vm_present

# end class NetworkIpamServer


class VirtualDnsServer(VirtualDnsServerGen):
    generate_default_instance = False

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        return cls.validate_dns_server(obj_dict, db_conn)
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        return cls.validate_dns_server(obj_dict, db_conn)
    # end http_put

    @classmethod
    def http_put_fail(cls, id, fq_name, obj_dict, db_conn):
        # undo any state change done by http_put function
        return True, ""
    # end http_put_fail

    @classmethod
    def http_delete(cls, id, obj_dict, db_conn):
        vdns_name = ":".join(obj_dict['fq_name'])
        if 'parent_uuid' in obj_dict:
            domain_uuid = obj_dict['parent_uuid']
            domain_id = {'uuid': domain_uuid}
            (read_ok, read_result) = db_conn.dbe_read('domain', domain_id)
            if not read_ok:
                return (
                    False,
                    (500, "Internal error : Virtual DNS is not in a domain"))
            virtual_DNSs = read_result.get('virtual_DNSs', [])
            for vdns in virtual_DNSs:
                vdns_uuid = vdns['uuid']
                vdns_id = {'uuid': vdns_uuid}
                (read_ok, read_result) = db_conn.dbe_read('virtual-DNS',
                                                          vdns_id)
                if not read_ok:
                    return (
                        False,
                        (500,
                         "Internal error : Unable to read Virtual DNS data"))
                vdns_data = read_result['virtual_DNS_data']
                if 'next_virtual_DNS' in vdns_data:
                    if vdns_data['next_virtual_DNS'] == vdns_name:
                        return (
                            False,
                            (403,
                             "Virtual DNS server is referred"
                             " by other virtual DNS servers"))
        return True, ""
    # end http_delete

    @classmethod
    def http_delete_fail(cls, id, obj_dict, db_conn):
        # undo any state change done by http_delete function
        return True, ""
    # end http_delete_fail

    @classmethod
    def is_valid_dns_name(cls, name):
        if len(name) > 255:
            return False
        if name.endswith("."):  # A single trailing dot is legal
            # strip exactly one dot from the right, if present
            name = name[:-1]
        disallowed = re.compile("[^A-Z\d-]", re.IGNORECASE)
        return all(  # Split by labels and verify individually
            (label and len(label) <= 63  # length is within proper range
             # no bordering hyphens
             and not label.startswith("-") and not label.endswith("-")
             and not disallowed.search(label))  # contains only legal char
            for label in name.split("."))
    # end is_valid_dns_name

    @classmethod
    def is_valid_ipv4_address(cls, address):
        parts = address.split(".")
        if len(parts) != 4:
            return False
        for item in parts:
            try:
                if not 0 <= int(item) <= 255:
                    return False
            except ValueError:
                return False
        return True
    # end is_valid_ipv4_address

    @classmethod
    def validate_dns_server(cls, obj_dict, db_conn):
        if 'fq_name' in obj_dict:
            virtual_dns = obj_dict['fq_name'][1]
            disallowed = re.compile("[^A-Z\d-]", re.IGNORECASE)
            if disallowed.search(virtual_dns) or virtual_dns.startswith("-"):
                return (False, (403,
                        "Special characters are not allowed in " +
                        "Virtual DNS server name"))

        vdns_data = obj_dict['virtual_DNS_data']
        if not cls.is_valid_dns_name(vdns_data['domain_name']):
            return (
                False,
                (403, "Domain name does not adhere to DNS name requirements"))

        record_order = ["fixed", "random", "round-robin"]
        if not str(vdns_data['record_order']).lower() in record_order:
            return (False, (403, "Invalid value for record order"))

        ttl = vdns_data['default_ttl_seconds']
        if ttl < 0 or ttl > 2147483647:
            return (False, (403, "Invalid value for TTL"))

        if 'next_virtual_DNS' in vdns_data:
            vdns_next = vdns_data['next_virtual_DNS']
            if not vdns_next or vdns_next is None:
                return True, ""
            next_vdns = vdns_data['next_virtual_DNS'].split(":")
            # check that next vdns exists
            try:
                next_vdns_uuid = db_conn.fq_name_to_uuid(
                    'virtual_DNS', next_vdns)
            except Exception as e:
                if not cls.is_valid_ipv4_address(
                        vdns_data['next_virtual_DNS']):
                    return (
                        False,
                        (403,
                         "Invalid Virtual Forwarder(next virtual dns server)"))
                else:
                    return True, ""
            # check that next virtual dns servers arent referring to each other
            # above check doesnt allow during create, but entry could be
            # modified later
            next_vdns_id = {'uuid': next_vdns_uuid}
            (read_ok, read_result) = db_conn.dbe_read(
                'virtual-DNS', next_vdns_id)
            if read_ok:
                next_vdns_data = read_result['virtual_DNS_data']
                if 'next_virtual_DNS' in next_vdns_data:
                    vdns_name = ":".join(obj_dict['fq_name'])
                    if next_vdns_data['next_virtual_DNS'] == vdns_name:
                        return (
                            False,
                            (403,
                             "Cannot have Virtual DNS Servers "
                             "referring to each other"))
        return True, ""
    # end validate_dns_server
# end class VirtualDnsServer


class VirtualDnsRecordServer(VirtualDnsRecordServerGen):
    generate_default_instance = False

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        return cls.validate_dns_record(obj_dict, db_conn)
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        return cls.validate_dns_record(obj_dict, db_conn)
    # end http_put

    @classmethod
    def http_put_fail(cls, id, fq_name, obj_dict, db_conn):
        # undo any state change done by http_put function
        return True, ""
    # end http_put_fail

    @classmethod
    def http_delete(cls, id, obj_dict, db_conn):
        return True, ""
    # end http_delete

    @classmethod
    def http_delete_fail(cls, id, obj_dict, db_conn):
        # undo any state change done by http_delete function
        return True, ""
    # end http_delete_fail

    @classmethod
    def validate_dns_record(cls, obj_dict, db_conn):
        rec_data = obj_dict['virtual_DNS_record_data']
        rec_types = ["a", "cname", "ptr", "ns"]
        rec_type = str(rec_data['record_type']).lower()
        if not rec_type in rec_types:
            return (False, (403, "Invalid record type"))
        if str(rec_data['record_class']).lower() != "in":
            return (False, (403, "Invalid record class"))

        rec_name = rec_data['record_name']
        rec_value = rec_data['record_data']

        # check rec_name validity
        if rec_type == "ptr":
            if (not VirtualDnsServer.is_valid_ipv4_address(rec_name) and
                    not "in-addr.arpa" in rec_name.lower()):
                return (
                    False,
                    (403,
                     "PTR Record name has to be IP address"
                     " or reverse.ip.in-addr.arpa"))
        elif not VirtualDnsServer.is_valid_dns_name(rec_name):
            return (
                False,
                (403, "Record name does not adhere to DNS name requirements"))

        # check rec_data validity
        if rec_type == "a":
            if not VirtualDnsServer.is_valid_ipv4_address(rec_value):
                return (False, (403, "Invalid IP address"))
        elif rec_type == "cname" or rec_type == "ptr" or rec_type == "mx":
            if not VirtualDnsServer.is_valid_dns_name(rec_value):
                return (
                    False,
                    (403,
                     "Record data does not adhere to DNS name requirements"))
        elif rec_type == "ns":
            try:
                vdns_name = rec_value.split(":")
                vdns_uuid = db_conn.fq_name_to_uuid('virtual_DNS', vdns_name)
            except Exception as e:
                if (not VirtualDnsServer.is_valid_ipv4_address(rec_value) and
                        not VirtualDnsServer.is_valid_dns_name(rec_value)):
                    return (
                        False,
                        (403, "Invalid virtual dns server in record data"))

        ttl = rec_data['record_ttl_seconds']
        if ttl < 0 or ttl > 2147483647:
            return (False, (403, "Invalid value for TTL"))

        if rec_type == "mx":
            preference = rec_data['record_mx_preference']
            if preference < 0 or preference > 65535:
                return (False, (403, "Invalid value for MX record preference"))

        return True, ""
    # end validate_dns_record
# end class VirtualDnsRecordServer

def _check_policy_rules(entries):
    if not entries:
        return True, ""
    for rule in entries.get('policy_rule') or []:
        if not rule.get('rule_uuid'):
            rule['rule_uuid'] = str(uuid.uuid4())
        protocol = rule['protocol']
        if protocol.isdigit():
            if int(protocol) < 0 or int(protocol) > 255:
                return (False, (400, 'Rule with invalid protocol : %s' % \
                    rule['protocol']))
        else:
            valids = ['any', 'icmp', 'tcp', 'udp']
            if protocol not in valids:
                return (False, (400, 'Rule with invalid protocol : %s' % \
                    rule['protocol']))
    return True, ""
# end _check_policy_rules

class SecurityGroupServer(SecurityGroupServerGen):
    generate_default_instance = False

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'security_groups',
                               'obj_type': 'security-group',
                               'user_visibility': user_visibility}

        (ok, response) = QuotaHelper.verify_quota_for_resource(
            **verify_quota_kwargs)
        if not ok:
            return (ok, response)

        return _check_policy_rules(obj_dict.get('security_group_entries'))
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        (ok, sec_dict) = db_conn.dbe_read('security-group', {'uuid': id})
        if not ok:
            return (False, (500, 'Bad Security Group error : ' + pformat(sec_dict)))
        (ok, proj_dict) = QuotaHelper.get_project_dict_for_quota(
            sec_dict['parent_uuid'], db_conn)
        if not ok:
            return (False, (500, 'Bad Project error : ' + pformat(proj_dict)))

        obj_type = 'security-group-rule'
        if ('security_group_entries' in obj_dict and
            QuotaHelper.get_quota_limit(proj_dict, obj_type) >= 0):
            rule_count = len(obj_dict['security_group_entries']['policy_rule'])
            for sg in proj_dict.get('security_groups', []):
                if sg['uuid'] == sec_dict['uuid']:
                    continue
                ok, sg_dict = db_conn.dbe_read('security-group', sg)
                if not ok:
                    continue
                sge = sg_dict.get('security_group_entries', {})
                rule_count += len(sge.get('policy_rule', []))

            if sec_dict['id_perms'].get('user_visible', True) is not False:
                (ok, quota_limit) = QuotaHelper.check_quota_limit(
                                        proj_dict, obj_type, rule_count-1)
                if not ok:
                    return (False, (403, pformat(fq_name) + ' : ' + quota_limit))

        return _check_policy_rules(obj_dict.get('security_group_entries'))
    # end http_put

# end class SecurityGroupServer


class NetworkPolicyServer(NetworkPolicyServerGen):

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'network_policys',
                               'obj_type': 'network-policy',
                               'user_visibility': user_visibility}

        (ok, response) = QuotaHelper.verify_quota_for_resource(
            **verify_quota_kwargs)
        if not ok:
            return (ok, response)

        try:
            cls._check_policy(obj_dict)
        except Exception as e:
            return (False, (500, str(e)))

        return _check_policy_rules(obj_dict.get('network_policy_entries'))
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        p_id = {'uuid': id}
        (read_ok, read_result) = db_conn.dbe_read('network-policy', p_id)
        if not read_ok:
            return (False, (500, read_result))

        return _check_policy_rules(obj_dict.get('network_policy_entries'))
    # end http_put

    @classmethod
    def _check_policy(cls, obj_dict):
        entries = obj_dict.get('network_policy_entries')
        if not entries:
            return
    # end _check_policy

# end class NetworkPolicyServer

class LogicalInterfaceServer(LogicalInterfaceServerGen):

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        (ok, msg) = cls._check_vlan(obj_dict, db_conn)
        if ok == False:
            return (False, msg)

        vlan = 0
        if 'logical_interface_vlan_tag' in obj_dict:
            vlan = obj_dict['logical_interface_vlan_tag']
        return PhysicalInterfaceServer._check_interface_name(obj_dict, db_conn, vlan)
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        interface = {'uuid': id}
        (read_ok, read_result) = db_conn.dbe_read('logical-interface', interface)
        if not read_ok:
            return (False, (500, read_result))

        # do not allow change in display name
        if 'display_name' in obj_dict:
            if obj_dict['display_name'] != read_result.get('display_name'):
                return (False, (403, "Cannot change display name !"))

        vlan = None
        if 'logical_interface_vlan_tag' in obj_dict:
            vlan = obj_dict['logical_interface_vlan_tag']
            if 'logical_interface_vlan_tag' in read_result:
                if int(vlan) != int(read_result.get('logical_interface_vlan_tag')):
                    return (False, (403, "Cannot change Vlan id"))

        return True, ""
    # end http_put

    @classmethod
    def _check_vlan(cls, obj_dict, db_conn):
        if 'logical_interface_vlan_tag' in obj_dict:
            vlan = obj_dict['logical_interface_vlan_tag']
            if vlan < 0 or vlan > 4094:
                return (False, (403, "Invalid Vlan id"))
        return True, ""
    # end _check_vlan

# end class LogicalInterfaceServer

class PhysicalInterfaceServer(PhysicalInterfaceServerGen):

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        return cls._check_interface_name(obj_dict, db_conn, None)
    # end http_post_collection

    @classmethod
    def http_put(cls, id, fq_name, obj_dict, db_conn):
        # do not allow change in display name
        if 'display_name' in obj_dict:
            (read_ok, read_result) = db_conn.dbe_read(
                                            obj_type='physical-interface',
                                            obj_ids={'uuid': id},
                                            obj_fields=['display_name'])
            if not read_ok:
                return (False, (500, read_result))

            if obj_dict['display_name'] != read_result.get('display_name'):
                return (False, (403, "Cannot change display name !"))

        return True, ""
    # end http_put

    @classmethod
    def _check_interface_name(cls, obj_dict, db_conn, vlan_tag):
        interface_name = obj_dict['display_name']
        router = obj_dict['fq_name'][:2]
        try:
            router_uuid = db_conn.fq_name_to_uuid('physical-router', router)
        except cfgm_common.exceptions.NoIdError:
            return (False, (500, 'Internal error : Physical router ' +
                                 ":".join(router) + ' not found'))
        physical_interface_uuid = ""
        if obj_dict['parent_type'] == 'physical-interface':
            try:
                physical_interface_name = obj_dict['fq_name'][:3]
                physical_interface_uuid = db_conn.fq_name_to_uuid('physical-interface', physical_interface_name)
            except cfgm_common.exceptions.NoIdError:
                return (False, (500, 'Internal error : Physical interface ' +
                                     ":".join(physical_interface_name) + ' not found'))
        (ok, physical_router) = db_conn.dbe_read(
                                            obj_type='physical-router',
                                            obj_ids={'uuid': router_uuid},
                                            obj_fields=['physical_interfaces',
                                                        'physical_router_product_name'])
        if not ok:
            return (False, (500, 'Internal error : Physical router ' +
                                 ":".join(router) + ' not found'))

        # In case of QFX, check that VLANs 1, 2 and 4094 are not used
        product_name = physical_router.get('physical_router_product_name', "")
        if product_name.lower().startswith("qfx") and vlan_tag != None:
            if vlan_tag == 1 or vlan_tag == 2 or vlan_tag == 4094:
                return (False, (403, "Vlan id " + str(vlan_tag) + " is not allowed on QFX"))

        for physical_interface in physical_router.get('physical_interfaces', []):
            # Read only the display name of the physical interface
            (ok, interface_object) = db_conn.dbe_read(
                                            obj_type='physical-interface',
                                            obj_ids={'uuid': physical_interface['uuid']},
                                            obj_fields=['display_name'])
            if not ok:
                return (False, (500, 'Internal error : physical interface ' +
                                     physical_interface['uuid'] + ' not found'))

            if 'display_name' in interface_object:
                if interface_name == interface_object['display_name']:
                    return (False, (403, "Display name already used in another interface :" +
                                         physical_interface['uuid']))

            # Need to check vlan only when request is for logical interfaces and
            # When the current physical_interface is the parent
            if vlan_tag == None or \
               physical_interface['uuid'] != physical_interface_uuid:
                continue

            # Read the logical interfaces in the physical interface.
            # This isnt read in the earlier DB read to avoid reading them for
            # all interfaces.
            (ok, interface_object) = db_conn.dbe_list('logical-interface',
                    [physical_interface['uuid']])
            if not ok:
                return (False, (500, 'Internal error : Read logical interface list for ' +
                                     physical_interface['uuid'] + ' failed'))
            obj_ids_list = [{'uuid': obj_uuid} for _, obj_uuid in interface_object]
            obj_fields = [u'logical_interface_vlan_tag']
            (ok, result) = db_conn.dbe_read_multi('logical-interface',
                    obj_ids_list, obj_fields)
            if not ok:
                return (False, (500, 'Internal error : Logical interface read failed'))
            for li_object in result:
                # check vlan tags on the same physical interface
                if 'logical_interface_vlan_tag' in li_object:
                    if vlan_tag == int(li_object['logical_interface_vlan_tag']):
                        return (False, (403, "Vlan tag already used in " +
                                   "another interface : " + li_object['uuid']))

        return True, ""
    # end _check_interface_name

# end class PhysicalInterfaceServer


class LoadbalancerMemberServer(LoadbalancerMemberServerGen):

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        user_visibility = obj_dict['id_perms'].get('user_visible', True)

        try:
            fq_name = obj_dict['fq_name']
            proj_uuid = db_conn.fq_name_to_uuid('project', fq_name[0:2])
        except cfgm_common.exceptions.NoIdError:
            return (False, (500, 'No Project ID error : ' + proj_uuid))

        ok, proj_dict = db_conn.dbe_read('project', {'uuid': proj_uuid})
        if not ok:
            return (False, (500, 'Internal error : ' + pformat(proj_dict)))

        if not user_visibility:
            return True, ""
        if QuotaHelper.get_quota_limit(proj_dict, 'loadbalancer-member') < 0:
            return True, ""
        lb_pools = proj_dict.get('loadbalancer_pools', [])
        quota_count = 0

        for pool in lb_pools:
            ok, lb_pool_dict = db_conn.dbe_read('loadbalancer-pool',
                                                {'uuid': pool['uuid']})
            if not ok:
                return (False, (500, 'Internal error : ' +
                                pformat(lb_pool_dict)))

            quota_count += len(lb_pool_dict.get('loadbalancer_members', []))

        (ok, quota_limit) = QuotaHelper.check_quota_limit(
            proj_dict, 'loadbalancer-member', quota_count)
        if not ok:
            return (False, (403, pformat(fq_name) + ' : ' + quota_limit))

        return True, ""

#end class LoadbalancerMemberServer


class LoadbalancerPoolServer(LoadbalancerPoolServerGen):

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'loadbalancer_pools',
                               'obj_type': 'loadbalancer-pool',
                               'user_visibility': user_visibility}
        return QuotaHelper.verify_quota_for_resource(**verify_quota_kwargs)

# end class LoadbalancerPoolServer


class LoadbalancerHealthmonitorServer(LoadbalancerHealthmonitorServerGen):

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):
        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'loadbalancer_healthmonitors',
                               'obj_type': 'loadbalancer-healthmonitor',
                               'user_visibility': user_visibility}
        return QuotaHelper.verify_quota_for_resource(**verify_quota_kwargs)

# end class LoadbalancerHealthmonitorServer


class VirtualIpServer(VirtualIpServerGen):

    @classmethod
    def http_post_collection(cls, tenant_name, obj_dict, db_conn):

        user_visibility = obj_dict['id_perms'].get('user_visible', True)
        verify_quota_kwargs = {'db_conn': db_conn,
                               'fq_name': obj_dict['fq_name'],
                               'resource': 'virtual_ips',
                               'obj_type': 'virtual-ip',
                               'user_visibility': user_visibility}
        return QuotaHelper.verify_quota_for_resource(**verify_quota_kwargs)

# end class VirtualIpServer