// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
package com.cloud.network.resource;

import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import javax.naming.ConfigurationException;
import javax.xml.transform.OutputKeys;
import javax.xml.transform.Source;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathExpression;
import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;

import org.apache.cloudstack.utils.security.ParserUtils;
import org.apache.http.NameValuePair;
import org.apache.http.client.HttpClient;
import org.apache.http.client.ResponseHandler;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.BasicResponseHandler;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.protocol.HTTP;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
import org.xml.sax.InputSource;

import com.cloud.agent.IAgentControl;
import com.cloud.agent.api.Answer;
import com.cloud.agent.api.Command;
import com.cloud.agent.api.ExternalNetworkResourceUsageAnswer;
import com.cloud.agent.api.ExternalNetworkResourceUsageCommand;
import com.cloud.agent.api.MaintainAnswer;
import com.cloud.agent.api.MaintainCommand;
import com.cloud.agent.api.PingCommand;
import com.cloud.agent.api.ReadyAnswer;
import com.cloud.agent.api.ReadyCommand;
import com.cloud.agent.api.StartupCommand;
import com.cloud.agent.api.StartupExternalFirewallCommand;
import com.cloud.agent.api.routing.IpAssocAnswer;
import com.cloud.agent.api.routing.IpAssocCommand;
import com.cloud.agent.api.routing.NetworkElementCommand;
import com.cloud.agent.api.routing.SetFirewallRulesCommand;
import com.cloud.agent.api.routing.SetPortForwardingRulesCommand;
import com.cloud.agent.api.routing.SetStaticNatRulesCommand;
import com.cloud.agent.api.to.FirewallRuleTO;
import com.cloud.agent.api.to.IpAddressTO;
import com.cloud.agent.api.to.PortForwardingRuleTO;
import com.cloud.agent.api.to.StaticNatRuleTO;
import com.cloud.host.Host;
import com.cloud.network.rules.FirewallRule;
import com.cloud.network.utils.HttpClientWrapper;
import com.cloud.resource.ServerResource;
import com.cloud.utils.NumbersUtil;
import com.cloud.utils.exception.ExecutionException;
import com.cloud.utils.net.NetUtils;

public class PaloAltoResource implements ServerResource {

    private String _name;
    private String _zoneId;
    private String _ip;
    private String _username;
    private String _password;
    private String _guid;
    private String _key;
    private Integer _numRetries;
    private Integer _timeoutInSeconds;
    private String _publicZone;
    private String _privateZone;
    private String _publicInterface;
    private String _privateInterface;
    private String _publicInterfaceType;
    private String _privateInterfaceType;
    private String _virtualRouter;
    private String _threatProfile;
    private String _logProfile;
    private String _pingManagementProfile;
    protected Logger logger = LogManager.getLogger(getClass());

    private static String s_apiUri = "/api";
    private static HttpClient s_httpclient;

    protected enum PaloAltoMethod {
        GET, POST;
    }

    private enum PaloAltoPrimative {
        CHECK_IF_EXISTS, ADD, DELETE;
    }

    private enum InterfaceType {
        AGGREGATE("aggregate-ethernet"), ETHERNET("ethernet");

        private final String type;

        private InterfaceType(String type) {
            this.type = type;
        }

        @Override
        public String toString() {
            return type;
        }
    }

    private enum Protocol {
        TCP("tcp"), UDP("udp"), ICMP("icmp"), ALL("all");

        private final String protocol;

        private Protocol(String protocol) {
            this.protocol = protocol;
        }

        @Override
        public String toString() {
            return protocol;
        }
    }

    private enum GuestNetworkType {
        SOURCE_NAT, INTERFACE_NAT;
    }

    @Override
    public Answer executeRequest(Command cmd) {
        if (cmd instanceof ReadyCommand) {
            return execute((ReadyCommand)cmd);
        } else if (cmd instanceof MaintainCommand) {
            return execute((MaintainCommand)cmd);
        } else if (cmd instanceof IpAssocCommand) {
            return execute((IpAssocCommand)cmd);
        } else if (cmd instanceof SetStaticNatRulesCommand) {
            return execute((SetStaticNatRulesCommand)cmd);
        } else if (cmd instanceof SetPortForwardingRulesCommand) {
            return execute((SetPortForwardingRulesCommand)cmd);
        } else if (cmd instanceof SetFirewallRulesCommand) {
            return execute((SetFirewallRulesCommand)cmd);
        } else if (cmd instanceof ExternalNetworkResourceUsageCommand) {
            return execute((ExternalNetworkResourceUsageCommand)cmd);
        } else {
            return Answer.createUnsupportedCommandAnswer(cmd);
        }
    }

    @Override
    public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
        try {
            _name = (String)params.get("name");
            if (_name == null) {
                throw new ConfigurationException("Unable to find name");
            }

            _zoneId = (String)params.get("zoneId");
            if (_zoneId == null) {
                throw new ConfigurationException("Unable to find zone");
            }

            _ip = (String)params.get("ip");
            if (_ip == null) {
                throw new ConfigurationException("Unable to find IP");
            }

            _username = (String)params.get("username");
            if (_username == null) {
                throw new ConfigurationException("Unable to find username");
            }

            _password = (String)params.get("password");
            if (_password == null) {
                throw new ConfigurationException("Unable to find password");
            }

            _publicInterface = (String)params.get("publicinterface");
            if (_publicInterface == null) {
                throw new ConfigurationException("Unable to find public interface.");
            }

            _privateInterface = (String)params.get("privateinterface");
            if (_privateInterface == null) {
                throw new ConfigurationException("Unable to find private interface.");
            }

            _publicZone = (String)params.get("publicnetwork");
            if (_publicZone == null) {
                throw new ConfigurationException("Unable to find public zone");
            }

            _privateZone = (String)params.get("privatenetwork");
            if (_privateZone == null) {
                throw new ConfigurationException("Unable to find private zone");
            }

            _virtualRouter = (String)params.get("pavr");
            if (_virtualRouter == null) {
                throw new ConfigurationException("Unable to find virtual router");
            }

            _threatProfile = (String)params.get("patp");
            _logProfile = (String)params.get("palp");

            _guid = (String)params.get("guid");
            if (_guid == null) {
                throw new ConfigurationException("Unable to find the guid");
            }

            _numRetries = NumbersUtil.parseInt((String)params.get("numretries"), 1);
            _timeoutInSeconds = NumbersUtil.parseInt((String)params.get("timeout"), 300);

            // Open a socket and login
            if (!refreshPaloAltoConnection()) {
                throw new ConfigurationException("Unable to open a connection to the Palo Alto.");
            }

            // check that the threat profile exists if one was specified
            if (_threatProfile != null) {
                try {
                    boolean has_profile = getThreatProfile(_threatProfile);
                    if (!has_profile) {
                        throw new ConfigurationException("The specified threat profile group does not exist.");
                    }
                } catch (ExecutionException e) {
                    throw new ConfigurationException(e.getMessage());
                }
            }

            // check that the log profile exists if one was specified
            if (_logProfile != null) {
                try {
                    boolean has_profile = getLogProfile(_logProfile);
                    if (!has_profile) {
                        throw new ConfigurationException("The specified log profile does not exist.");
                    }
                } catch (ExecutionException e) {
                    throw new ConfigurationException(e.getMessage());
                }
            }

            // get public interface type
            try {
                _publicInterfaceType = getInterfaceType(_publicInterface);
                if (_publicInterfaceType.equals("")) {
                    throw new ConfigurationException("The specified public interface is not configured on the Palo Alto.");
                }
            } catch (ExecutionException e) {
                throw new ConfigurationException(e.getMessage());
            }

            // get private interface type
            try {
                _privateInterfaceType = getInterfaceType(_privateInterface);
                if (_privateInterfaceType.equals("")) {
                    throw new ConfigurationException("The specified private interface is not configured on the Palo Alto.");
                }
            } catch (ExecutionException e) {
                throw new ConfigurationException(e.getMessage());
            }

            _pingManagementProfile = "Ping";
            try {
                ArrayList<IPaloAltoCommand> cmdList = new ArrayList<IPaloAltoCommand>();
                managePingProfile(cmdList, PaloAltoPrimative.ADD);
                boolean status = requestWithCommit(cmdList);
            } catch (ExecutionException e) {
                throw new ConfigurationException(e.getMessage());
            }

            return true;
        } catch (Exception e) {
            throw new ConfigurationException(e.getMessage());
        }

    }

    @Override
    public StartupCommand[] initialize() {
        StartupExternalFirewallCommand cmd = new StartupExternalFirewallCommand();
        cmd.setName(_name);
        cmd.setDataCenter(_zoneId);
        cmd.setPod("");
        cmd.setPrivateIpAddress(_ip);
        cmd.setStorageIpAddress("");
        cmd.setVersion(PaloAltoResource.class.getPackage().getImplementationVersion());
        cmd.setGuid(_guid);
        return new StartupCommand[] {cmd};
    }

    @Override
    public Host.Type getType() {
        return Host.Type.ExternalFirewall;
    }

    @Override
    public String getName() {
        return _name;
    }

    @Override
    public boolean start() {
        return true;
    }

    @Override
    public boolean stop() {
        return true;
    }

    @Override
    public PingCommand getCurrentStatus(final long id) {
        return new PingCommand(Host.Type.ExternalFirewall, id);
    }

    @Override
    public void disconnected() {
        // nothing for now...
    }

    @Override
    public IAgentControl getAgentControl() {
        return null;
    }

    @Override
    public void setAgentControl(IAgentControl agentControl) {
        return;
    }

    /*
     * Login
     */
    private void openHttpConnection() {
        s_httpclient = new DefaultHttpClient();

        // Allows you to connect via SSL using unverified certs
        s_httpclient = HttpClientWrapper.wrapClient(s_httpclient);
    }

    private boolean refreshPaloAltoConnection() {
        if (s_httpclient == null) {
            openHttpConnection();
        }

        try {
            return login(_username, _password);
        } catch (ExecutionException e) {
            logger.error("Failed to login due to " + e.getMessage());
            return false;
        }
    }

    private boolean login(String username, String password) throws ExecutionException {
        Map<String, String> params = new HashMap<String, String>();
        params.put("type", "keygen");
        params.put("user", username);
        params.put("password", password);

        String keygenBody;
        try {
            keygenBody = request(PaloAltoMethod.GET, params);
        } catch (ExecutionException e) {
            return false;
        }
        Document keygen_doc = getDocument(keygenBody);
        XPath xpath = XPathFactory.newInstance().newXPath();
        try {
            XPathExpression expr = xpath.compile("/response[@status='success']/result/key/text()");
            _key = (String)expr.evaluate(keygen_doc, XPathConstants.STRING);
        } catch (XPathExpressionException e) {
            throw new ExecutionException(e.getCause().getMessage());
        }
        if (_key != null) {
            return true;
        }
        return false;
    }

    // ENTRY POINTS...

    private Answer execute(ReadyCommand cmd) {
        return new ReadyAnswer(cmd);
    }

    private Answer execute(MaintainCommand cmd) {
        return new MaintainAnswer(cmd);
    }

    private ExternalNetworkResourceUsageAnswer execute(ExternalNetworkResourceUsageCommand cmd) {
        return new ExternalNetworkResourceUsageAnswer(cmd);
    }

    /*
     * Guest networks
     */

    private synchronized Answer execute(IpAssocCommand cmd) {
        refreshPaloAltoConnection();
        return execute(cmd, _numRetries);
    }

    private Answer execute(IpAssocCommand cmd, int numRetries) {
        String[] results = new String[cmd.getIpAddresses().length];
        int i = 0;
        try {
            IpAddressTO ip;
            if (cmd.getIpAddresses().length != 1) {
                throw new ExecutionException("Received an invalid number of guest IPs to associate.");
            } else {
                ip = cmd.getIpAddresses()[0];
            }

            String sourceNatIpAddress = null;
            GuestNetworkType type = GuestNetworkType.INTERFACE_NAT;

            if (ip.isSourceNat()) {
                type = GuestNetworkType.SOURCE_NAT;

                if (ip.getPublicIp() == null) {
                    throw new ExecutionException("Source NAT IP address must not be null.");
                } else {
                    sourceNatIpAddress = ip.getPublicIp();
                }
            }

            long guestVlanTag = Long.parseLong(cmd.getAccessDetail(NetworkElementCommand.GUEST_VLAN_TAG));
            String guestVlanGateway = cmd.getAccessDetail(NetworkElementCommand.GUEST_NETWORK_GATEWAY);
            String cidr = cmd.getAccessDetail(NetworkElementCommand.GUEST_NETWORK_CIDR);
            long cidrSize = NetUtils.cidrToLong(cidr)[1];
            String guestVlanSubnet = NetUtils.getCidrSubNet(guestVlanGateway, cidrSize);

            Long publicVlanTag = null;
            if (ip.getBroadcastUri() != null) {
                String parsedVlanTag = parsePublicVlanTag(ip.getBroadcastUri());
                if (!parsedVlanTag.equals("untagged")) {
                    try {
                        publicVlanTag = Long.parseLong(parsedVlanTag);
                    } catch (Exception e) {
                        throw new ExecutionException("Could not parse public VLAN tag: " + parsedVlanTag);
                    }
                }
            }

            ArrayList<IPaloAltoCommand> commandList = new ArrayList<IPaloAltoCommand>();

            if (ip.isAdd()) {
                // Implement the guest network for this VLAN
                implementGuestNetwork(commandList, type, publicVlanTag, sourceNatIpAddress, guestVlanTag, guestVlanGateway, guestVlanSubnet, cidrSize);
            } else {
                // Remove the guest network:
                shutdownGuestNetwork(commandList, type, publicVlanTag, sourceNatIpAddress, guestVlanTag, guestVlanGateway, guestVlanSubnet, cidrSize);
            }

            boolean status = requestWithCommit(commandList);

            results[i++] = ip.getPublicIp() + " - success";
        } catch (ExecutionException e) {
            logger.error(e);

            if (numRetries > 0 && refreshPaloAltoConnection()) {
                int numRetriesRemaining = numRetries - 1;
                logger.debug("Retrying IPAssocCommand. Number of retries remaining: " + numRetriesRemaining);
                return execute(cmd, numRetriesRemaining);
            } else {
                results[i++] = IpAssocAnswer.errorResult;
            }
        }

        return new IpAssocAnswer(cmd, results);
    }

    private void implementGuestNetwork(ArrayList<IPaloAltoCommand> cmdList, GuestNetworkType type, Long publicVlanTag, String publicIp, long privateVlanTag,
        String privateGateway, String privateSubnet, long privateCidrNumber) throws ExecutionException {
        privateSubnet = privateSubnet + "/" + privateCidrNumber;

        managePrivateInterface(cmdList, PaloAltoPrimative.ADD, privateVlanTag, privateGateway + "/" + privateCidrNumber);

        if (type.equals(GuestNetworkType.SOURCE_NAT)) {
            managePublicInterface(cmdList, PaloAltoPrimative.ADD, publicVlanTag, publicIp + "/32", privateVlanTag);
            manageSrcNatRule(cmdList, PaloAltoPrimative.ADD, type, publicVlanTag, publicIp + "/32", privateVlanTag, privateGateway + "/" + privateCidrNumber);
            manageNetworkIsolation(cmdList, PaloAltoPrimative.ADD, privateVlanTag, privateSubnet, privateGateway);
        }

        String msg =
            "Implemented guest network with type " + type + ". Guest VLAN tag: " + privateVlanTag + ", guest gateway: " + privateGateway + "/" + privateCidrNumber;
        msg += type.equals(GuestNetworkType.SOURCE_NAT) ? ", source NAT IP: " + publicIp : "";
        logger.debug(msg);
    }

    private void shutdownGuestNetwork(ArrayList<IPaloAltoCommand> cmdList, GuestNetworkType type, Long publicVlanTag, String sourceNatIpAddress, long privateVlanTag,
        String privateGateway, String privateSubnet, long privateCidrSize) throws ExecutionException {
        privateSubnet = privateSubnet + "/" + privateCidrSize;

        // remove any orphaned egress rules if they exist...
        removeOrphanedFirewallRules(cmdList, privateVlanTag);

        if (type.equals(GuestNetworkType.SOURCE_NAT)) {
            manageNetworkIsolation(cmdList, PaloAltoPrimative.DELETE, privateVlanTag, privateSubnet, privateGateway);
            manageSrcNatRule(cmdList, PaloAltoPrimative.DELETE, type, publicVlanTag, sourceNatIpAddress + "/32", privateVlanTag, privateGateway + "/" + privateCidrSize);
            managePublicInterface(cmdList, PaloAltoPrimative.DELETE, publicVlanTag, sourceNatIpAddress + "/32", privateVlanTag);
        }

        managePrivateInterface(cmdList, PaloAltoPrimative.DELETE, privateVlanTag, privateGateway + "/" + privateCidrSize);

        String msg = "Shut down guest network with type " + type + ". Guest VLAN tag: " + privateVlanTag + ", guest gateway: " + privateGateway + "/" + privateCidrSize;
        msg += type.equals(GuestNetworkType.SOURCE_NAT) ? ", source NAT IP: " + sourceNatIpAddress : "";
        logger.debug(msg);
    }

    /*
     * Firewall rule entry point
     */
    private synchronized Answer execute(SetFirewallRulesCommand cmd) {
        refreshPaloAltoConnection();
        return execute(cmd, _numRetries);
    }

    private Answer execute(SetFirewallRulesCommand cmd, int numRetries) {
        FirewallRuleTO[] rules = cmd.getRules();
        try {
            ArrayList<IPaloAltoCommand> commandList = new ArrayList<IPaloAltoCommand>();

            for (FirewallRuleTO rule : rules) {
                if (!rule.revoked()) {
                    manageFirewallRule(commandList, PaloAltoPrimative.ADD, rule);
                } else {
                    manageFirewallRule(commandList, PaloAltoPrimative.DELETE, rule);
                }
            }

            boolean status = requestWithCommit(commandList);

            return new Answer(cmd);
        } catch (ExecutionException e) {
            logger.error(e);

            if (numRetries > 0 && refreshPaloAltoConnection()) {
                int numRetriesRemaining = numRetries - 1;
                logger.debug("Retrying SetFirewallRulesCommand. Number of retries remaining: " + numRetriesRemaining);
                return execute(cmd, numRetriesRemaining);
            } else {
                return new Answer(cmd, e);
            }
        }
    }

    /*
     * Static NAT rule entry point
     */

    private synchronized Answer execute(SetStaticNatRulesCommand cmd) {
        refreshPaloAltoConnection();
        return execute(cmd, _numRetries);
    }

    private Answer execute(SetStaticNatRulesCommand cmd, int numRetries) {
        StaticNatRuleTO[] rules = cmd.getRules();

        try {
            ArrayList<IPaloAltoCommand> commandList = new ArrayList<IPaloAltoCommand>();

            for (StaticNatRuleTO rule : rules) {
                if (!rule.revoked()) {
                    manageStcNatRule(commandList, PaloAltoPrimative.ADD, rule);
                } else {
                    manageStcNatRule(commandList, PaloAltoPrimative.DELETE, rule);
                }
            }

            boolean status = requestWithCommit(commandList);

            return new Answer(cmd);
        } catch (ExecutionException e) {
            logger.error(e);

            if (numRetries > 0 && refreshPaloAltoConnection()) {
                int numRetriesRemaining = numRetries - 1;
                logger.debug("Retrying SetStaticNatRulesCommand. Number of retries remaining: " + numRetriesRemaining);
                return execute(cmd, numRetriesRemaining);
            } else {
                return new Answer(cmd, e);
            }
        }
    }

    /*
     * Destination NAT (Port Forwarding) entry point
     */
    private synchronized Answer execute(SetPortForwardingRulesCommand cmd) {
        refreshPaloAltoConnection();
        return execute(cmd, _numRetries);
    }

    private Answer execute(SetPortForwardingRulesCommand cmd, int numRetries) {
        PortForwardingRuleTO[] rules = cmd.getRules();

        try {
            ArrayList<IPaloAltoCommand> commandList = new ArrayList<IPaloAltoCommand>();

            for (PortForwardingRuleTO rule : rules) {
                if (!rule.revoked()) {
                    manageDstNatRule(commandList, PaloAltoPrimative.ADD, rule);
                } else {
                    manageDstNatRule(commandList, PaloAltoPrimative.DELETE, rule);
                }
            }

            boolean status = requestWithCommit(commandList);

            return new Answer(cmd);
        } catch (ExecutionException e) {
            logger.error(e);

            if (numRetries > 0 && refreshPaloAltoConnection()) {
                int numRetriesRemaining = numRetries - 1;
                logger.debug("Retrying SetPortForwardingRulesCommand. Number of retries remaining: " + numRetriesRemaining);
                return execute(cmd, numRetriesRemaining);
            } else {
                return new Answer(cmd, e);
            }
        }
    }

    // IMPLEMENTATIONS...

    /*
     * Private interface implementation
     */

    private String genPrivateInterfaceName(long vlanTag) {
        return _privateInterface + "." + Long.toString(vlanTag);
    }

    public boolean managePrivateInterface(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, long privateVlanTag, String privateGateway)
        throws ExecutionException {
        String interfaceName = genPrivateInterfaceName(privateVlanTag);

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/network/interface/" + _privateInterfaceType + "/entry[@name='" + _privateInterface +
                    "']/layer3/units/entry[@name='" + interfaceName + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Private sub-interface exists: " + interfaceName + ", " + result);
                return result;

            case ADD:
                if (managePrivateInterface(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, privateVlanTag, privateGateway)) {
                    return true;
                }

                // add cmds
                // add sub-interface
                Map<String, String> a_sub_params = new HashMap<String, String>();
                a_sub_params.put("type", "config");
                a_sub_params.put("action", "set");
                a_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _privateInterfaceType + "/entry[@name='" + _privateInterface +
                    "']/layer3/units/entry[@name='" + interfaceName + "']");
                a_sub_params.put("element", "<tag>" + privateVlanTag + "</tag><ip><entry name='" + privateGateway + "'/></ip><interface-management-profile>" +
                    _pingManagementProfile + "</interface-management-profile>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_sub_params));

                // add sub-interface to VR...
                Map<String, String> a_vr_params = new HashMap<String, String>();
                a_vr_params.put("type", "config");
                a_vr_params.put("action", "set");
                a_vr_params.put("xpath", "/config/devices/entry/network/virtual-router/entry[@name='" + _virtualRouter + "']/interface");
                a_vr_params.put("element", "<member>" + interfaceName + "</member>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_vr_params));

                // add sub-interface to vsys...
                Map<String, String> a_vsys_params = new HashMap<String, String>();
                a_vsys_params.put("type", "config");
                a_vsys_params.put("action", "set");
                a_vsys_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/import/network/interface");
                a_vsys_params.put("element", "<member>" + interfaceName + "</member>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_vsys_params));

                // add sub-interface to zone...
                Map<String, String> a_zone_params = new HashMap<String, String>();
                a_zone_params.put("type", "config");
                a_zone_params.put("action", "set");
                a_zone_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/zone/entry[@name='" + _privateZone + "']/network/layer3");
                a_zone_params.put("element", "<member>" + interfaceName + "</member>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_zone_params));

                return true;

            case DELETE:
                if (!managePrivateInterface(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, privateVlanTag, privateGateway)) {
                    return true;
                }

                // add cmds to the list
                // delete sub-interface from zone...
                Map<String, String> d_zone_params = new HashMap<String, String>();
                d_zone_params.put("type", "config");
                d_zone_params.put("action", "delete");
                d_zone_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/zone/entry[@name='" + _privateZone + "']/network/layer3/member[text()='" +
                    interfaceName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_zone_params));

                // delete sub-interface from vsys...
                Map<String, String> d_vsys_params = new HashMap<String, String>();
                d_vsys_params.put("type", "config");
                d_vsys_params.put("action", "delete");
                d_vsys_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/import/network/interface/member[text()='" + interfaceName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_vsys_params));

                // delete sub-interface from VR...
                Map<String, String> d_vr_params = new HashMap<String, String>();
                d_vr_params.put("type", "config");
                d_vr_params.put("action", "delete");
                d_vr_params.put("xpath", "/config/devices/entry/network/virtual-router/entry[@name='" + _virtualRouter + "']/interface/member[text()='" + interfaceName +
                    "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_vr_params));

                // delete sub-interface...
                Map<String, String> d_sub_params = new HashMap<String, String>();
                d_sub_params.put("type", "config");
                d_sub_params.put("action", "delete");
                d_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _privateInterfaceType + "/entry[@name='" + _privateInterface +
                    "']/layer3/units/entry[@name='" + interfaceName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_sub_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    /*
     * Public Interface implementation
     */

    private String genPublicInterfaceName(Long id) {
        return _publicInterface + "." + Long.toString(id);
    }

    public boolean managePublicInterface(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, Long publicVlanTag, String publicIp, long privateVlanTag)
        throws ExecutionException {
        String interfaceName;
        if (publicVlanTag == null) {
            interfaceName = genPublicInterfaceName(new Long("9999"));
        } else {
            interfaceName = genPublicInterfaceName(publicVlanTag);
        }

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/network/interface/" + _publicInterfaceType + "/entry[@name='" + _publicInterface +
                    "']/layer3/units/entry[@name='" + interfaceName + "']/ip/entry[@name='" + publicIp + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Public sub-interface & IP exists: " + interfaceName + " : " + publicIp + ", " + result);
                return result;

            case ADD:
                if (managePublicInterface(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, publicVlanTag, publicIp, privateVlanTag)) {
                    return true;
                }

                // add IP to the sub-interface
                Map<String, String> a_sub_params = new HashMap<String, String>();
                a_sub_params.put("type", "config");
                a_sub_params.put("action", "set");
                a_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _publicInterfaceType + "/entry[@name='" + _publicInterface +
                    "']/layer3/units/entry[@name='" + interfaceName + "']/ip");
                a_sub_params.put("element", "<entry name='" + publicIp + "'/>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_sub_params));

                // add sub-interface to VR (does nothing if already done)...
                Map<String, String> a_vr_params = new HashMap<String, String>();
                a_vr_params.put("type", "config");
                a_vr_params.put("action", "set");
                a_vr_params.put("xpath", "/config/devices/entry/network/virtual-router/entry[@name='" + _virtualRouter + "']/interface");
                a_vr_params.put("element", "<member>" + interfaceName + "</member>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_vr_params));

                // add sub-interface to vsys (does nothing if already done)...
                Map<String, String> a_vsys_params = new HashMap<String, String>();
                a_vsys_params.put("type", "config");
                a_vsys_params.put("action", "set");
                a_vsys_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/import/network/interface");
                a_vsys_params.put("element", "<member>" + interfaceName + "</member>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_vsys_params));

                // add sub-interface to zone (does nothing if already done)...
                Map<String, String> a_zone_params = new HashMap<String, String>();
                a_zone_params.put("type", "config");
                a_zone_params.put("action", "set");
                a_zone_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/zone/entry[@name='" + _publicZone + "']/network/layer3");
                a_zone_params.put("element", "<member>" + interfaceName + "</member>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_zone_params));

                return true;

            case DELETE:
                if (!managePublicInterface(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, publicVlanTag, publicIp, privateVlanTag)) {
                    return true;
                }

                // delete IP from sub-interface...
                Map<String, String> d_sub_params = new HashMap<String, String>();
                d_sub_params.put("type", "config");
                d_sub_params.put("action", "delete");
                d_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _publicInterfaceType + "/entry[@name='" + _publicInterface +
                    "']/layer3/units/entry[@name='" + interfaceName + "']/ip/entry[@name='" + publicIp + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_sub_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    /*
     * Source NAT rule implementation
     */

    private String genSrcNatRuleName(Long privateVlanTag) {
        return "src_nat." + Long.toString(privateVlanTag);
    }

    public boolean manageSrcNatRule(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, GuestNetworkType type, Long publicVlanTag, String publicIp,
        long privateVlanTag, String privateGateway) throws ExecutionException {
        String publicInterfaceName;
        if (publicVlanTag == null) {
            publicInterfaceName = genPublicInterfaceName(new Long("9999"));
        } else {
            publicInterfaceName = genPublicInterfaceName(publicVlanTag);
        }
        String srcNatName = genSrcNatRuleName(privateVlanTag);

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + srcNatName + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Source NAT exists: " + srcNatName + ", " + result);
                return result;

            case ADD:
                if (manageSrcNatRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, type, publicVlanTag, publicIp, privateVlanTag, privateGateway)) {
                    return true;
                }

                String xml = "";
                xml += "<from><member>" + _privateZone + "</member></from>";
                xml += "<to><member>" + _publicZone + "</member></to>";
                xml += "<source><member>" + privateGateway + "</member></source>";
                xml += "<destination><member>any</member></destination>";
                xml += "<service>any</service>";
                xml += "<nat-type>ipv4</nat-type>";
                xml += "<to-interface>" + publicInterfaceName + "</to-interface>";
                xml += "<source-translation><dynamic-ip-and-port><interface-address>";
                xml += "<ip>" + publicIp + "</ip>";
                xml += "<interface>" + publicInterfaceName + "</interface>";
                xml += "</interface-address></dynamic-ip-and-port></source-translation>";

                Map<String, String> a_params = new HashMap<String, String>();
                a_params.put("type", "config");
                a_params.put("action", "set");
                a_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + srcNatName + "']");
                a_params.put("element", xml);
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, a_params));

                return true;

            case DELETE:
                if (!manageSrcNatRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, type, publicVlanTag, publicIp, privateVlanTag, privateGateway)) {
                    return true;
                }

                Map<String, String> d_params = new HashMap<String, String>();
                d_params.put("type", "config");
                d_params.put("action", "delete");
                d_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + srcNatName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, d_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    /*
     * Destination NAT rules (Port Forwarding) implementation
     */
    private String genDstNatRuleName(String publicIp, long id) {
        return "dst_nat." + genIpIdentifier(publicIp) + "_" + Long.toString(id);
    }

    public boolean manageDstNatRule(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, PortForwardingRuleTO rule) throws ExecutionException {
        String publicIp = rule.getSrcIp();
        String dstNatName = genDstNatRuleName(publicIp, rule.getId());

        String publicInterfaceName;
        String publicVlanTag;
        if (rule.getSrcVlanTag() == null) {
            publicInterfaceName = genPublicInterfaceName(new Long("9999"));
        } else {
            publicVlanTag = parsePublicVlanTag(rule.getSrcVlanTag());
            if (publicVlanTag.equals("untagged")) {
                publicInterfaceName = genPublicInterfaceName(new Long("9999"));
            } else {
                publicInterfaceName = genPublicInterfaceName(new Long(publicVlanTag));
            }
        }

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + dstNatName + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Destination NAT exists: " + dstNatName + ", " + result);
                return result;

            case ADD:
                if (manageDstNatRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, rule)) {
                    return true;
                }

                // build source service xml
                String srcService;
                String protocol = rule.getProtocol();
                int[] srcPortRange = rule.getSrcPortRange();
                if (srcPortRange != null) {
                    String portRange;
                    if (srcPortRange.length == 1 || srcPortRange[0] == srcPortRange[1]) {
                        portRange = String.valueOf(srcPortRange[0]);
                    } else {
                        portRange = String.valueOf(srcPortRange[0]) + "-" + String.valueOf(srcPortRange[1]);
                    }
                    manageService(cmdList, PaloAltoPrimative.ADD, protocol, portRange, null);
                    srcService = genServiceName(protocol, portRange, null);
                } else {
                    // no equivalent config in PA, so allow all traffic...
                    srcService = "any";
                }

                // build destination port xml (single port limit in PA)
                String dstPortXML = "";
                int[] dstPortRange = rule.getDstPortRange();
                if (dstPortRange != null) {
                    dstPortXML = "<translated-port>" + dstPortRange[0] + "</translated-port>";
                }

                // add public IP to the sub-interface
                Map<String, String> a_sub_params = new HashMap<String, String>();
                a_sub_params.put("type", "config");
                a_sub_params.put("action", "set");
                a_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _publicInterfaceType + "/entry[@name='" + _publicInterface +
                    "']/layer3/units/entry[@name='" + publicInterfaceName + "']/ip");
                a_sub_params.put("element", "<entry name='" + publicIp + "/32'/>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_sub_params));

                // add the destination nat rule for the public IP
                String xml = "";
                xml += "<from><member>" + _publicZone + "</member></from>";
                xml += "<to><member>" + _publicZone + "</member></to>";
                xml += "<source><member>any</member></source>";
                xml += "<destination><member>" + publicIp + "</member></destination>";
                xml += "<service>" + srcService + "</service>";
                xml += "<nat-type>ipv4</nat-type>";
                xml += "<to-interface>" + publicInterfaceName + "</to-interface>";
                xml += "<destination-translation><translated-address>" + rule.getDstIp() + "</translated-address>" + dstPortXML + "</destination-translation>";

                Map<String, String> a_params = new HashMap<String, String>();
                a_params.put("type", "config");
                a_params.put("action", "set");
                a_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + dstNatName + "']");
                a_params.put("element", xml);
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, a_params));

                return true;

            case DELETE:
                if (!manageDstNatRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, rule)) {
                    return true;
                }

                // determine if we need to delete the ip from the interface as well...
                Map<String, String> c_params = new HashMap<String, String>();
                c_params.put("type", "config");
                c_params.put("action", "get");
                c_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[destination/member[text()='" + publicIp + "']]");
                String c_response = request(PaloAltoMethod.GET, c_params);

                String count = "";
                NodeList response_body;
                Document doc = getDocument(c_response);
                XPath xpath = XPathFactory.newInstance().newXPath();
                try {
                    XPathExpression expr = xpath.compile("/response[@status='success']/result");
                    response_body = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
                } catch (XPathExpressionException e) {
                    throw new ExecutionException(e.getCause().getMessage());
                }
                if (response_body.getLength() > 0 && response_body.item(0).getAttributes().getLength() > 0) {
                    count = response_body.item(0).getAttributes().getNamedItem("count").getTextContent();
                }

                // delete the dst nat rule
                Map<String, String> d_params = new HashMap<String, String>();
                d_params.put("type", "config");
                d_params.put("action", "delete");
                d_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + dstNatName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, d_params));

                if (!count.equals("") && Integer.parseInt(count) == 1) { // this dst nat rule is the last, so remove the ip...
                    // delete IP from sub-interface...
                    Map<String, String> d_sub_params = new HashMap<String, String>();
                    d_sub_params.put("type", "config");
                    d_sub_params.put("action", "delete");
                    d_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _publicInterfaceType + "/entry[@name='" + _publicInterface +
                        "']/layer3/units/entry[@name='" + publicInterfaceName + "']/ip/entry[@name='" + publicIp + "/32']");
                    cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_sub_params));
                }

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    /*
     * Static NAT rule implementation
     */
    private String genStcNatRuleName(String publicIp, long id) {
        return "stc_nat." + genIpIdentifier(publicIp) + "_" + Long.toString(id);
    }

    public boolean manageStcNatRule(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, StaticNatRuleTO rule) throws ExecutionException {
        String publicIp = rule.getSrcIp();
        String stcNatName = genStcNatRuleName(publicIp, rule.getId());

        String publicInterfaceName;
        String publicVlanTag;
        if (rule.getSrcVlanTag() == null) {
            publicInterfaceName = genPublicInterfaceName(new Long("9999"));
        } else {
            publicVlanTag = parsePublicVlanTag(rule.getSrcVlanTag());
            if (publicVlanTag.equals("untagged")) {
                publicInterfaceName = genPublicInterfaceName(new Long("9999"));
            } else {
                publicInterfaceName = genPublicInterfaceName(new Long(publicVlanTag));
            }
        }

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + stcNatName + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Static NAT exists: " + stcNatName + ", " + result);
                return result;

            case ADD:
                if (manageStcNatRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, rule)) {
                    return true;
                }

                // add public IP to the sub-interface
                Map<String, String> a_sub_params = new HashMap<String, String>();
                a_sub_params.put("type", "config");
                a_sub_params.put("action", "set");
                a_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _publicInterfaceType + "/entry[@name='" + _publicInterface +
                    "']/layer3/units/entry[@name='" + publicInterfaceName + "']/ip");
                a_sub_params.put("element", "<entry name='" + publicIp + "/32'/>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_sub_params));

                // add the static nat rule for the public IP
                String xml = "";
                xml += "<from><member>" + _publicZone + "</member></from>";
                xml += "<to><member>" + _publicZone + "</member></to>";
                xml += "<source><member>any</member></source>";
                xml += "<destination><member>" + publicIp + "</member></destination>";
                xml += "<service>any</service>";
                xml += "<nat-type>ipv4</nat-type>";
                xml += "<to-interface>" + publicInterfaceName + "</to-interface>";
                xml += "<destination-translation><translated-address>" + rule.getDstIp() + "</translated-address></destination-translation>";

                Map<String, String> a_params = new HashMap<String, String>();
                a_params.put("type", "config");
                a_params.put("action", "set");
                a_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + stcNatName + "']");
                a_params.put("element", xml);
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, a_params));

                return true;

            case DELETE:
                if (!manageStcNatRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, rule)) {
                    return true;
                }

                // delete the static nat rule
                Map<String, String> d_params = new HashMap<String, String>();
                d_params.put("type", "config");
                d_params.put("action", "delete");
                d_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='" + stcNatName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, d_params));

                // delete IP from sub-interface...
                Map<String, String> d_sub_params = new HashMap<String, String>();
                d_sub_params.put("type", "config");
                d_sub_params.put("action", "delete");
                d_sub_params.put("xpath", "/config/devices/entry/network/interface/" + _publicInterfaceType + "/entry[@name='" + _publicInterface +
                    "']/layer3/units/entry[@name='" + publicInterfaceName + "']/ip/entry[@name='" + publicIp + "/32']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_sub_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    /*
     * Firewall rule implementation
     */
    private String genFirewallRuleName(long id) { // ingress
        return "policy_" + Long.toString(id);
    }

    private String genFirewallRuleName(long id, String vlan) { // egress
        return "policy_" + Long.toString(id) + "_" + vlan;
    }

    public boolean manageFirewallRule(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, FirewallRuleTO rule) throws ExecutionException {
        String ruleName;
        if (rule.getTrafficType() == FirewallRule.TrafficType.Egress) {
            ruleName = genFirewallRuleName(rule.getId(), rule.getSrcVlanTag());
        } else {
            ruleName = genFirewallRuleName(rule.getId());
        }

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='" + ruleName + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Firewall policy exists: " + ruleName + ", " + result);
                return result;

            case ADD:
                if (manageFirewallRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, rule)) {
                    return true;
                }

                String srcZone;
                String dstZone;
                String dstAddressXML;
                String appXML;
                String serviceXML;

                String protocol = rule.getProtocol();
                String action = "allow";

                // Only ICMP will use an Application, so others will be any.
                if (protocol.equals(Protocol.ICMP.toString())) {
                    appXML = "<member>icmp</member><member>ping</member><member>traceroute</member>"; // use the default icmp applications...
                } else {
                    appXML = "<member>any</member>";
                }

                // Only TCP and UDP will use a Service, others will use any.
                if (protocol.equals(Protocol.TCP.toString()) || protocol.equals(Protocol.UDP.toString())) {
                    String portRange;
                    if (rule.getSrcPortRange() != null) {
                        int startPort = rule.getSrcPortRange()[0];
                        int endPort = rule.getSrcPortRange()[1];
                        if (startPort == endPort) {
                            portRange = String.valueOf(startPort);
                        } else {
                            portRange = String.valueOf(startPort) + "-" + String.valueOf(endPort);
                        }
                        manageService(cmdList, PaloAltoPrimative.ADD, protocol, portRange, null);
                        serviceXML = "<member>" + genServiceName(protocol, portRange, null) + "</member>";
                    } else {
                        // no equivalent config in PA, so allow all traffic...
                        serviceXML = "<member>any</member>";
                    }
                } else {
                    serviceXML = "<member>any</member>";
                }

                // handle different types of fire wall rules (egress | ingress)
                if (rule.getTrafficType() == FirewallRule.TrafficType.Egress) { // Egress Rule
                    srcZone = _privateZone;
                    dstZone = _publicZone;
                    dstAddressXML = "<member>any</member>";

                    // defaults to 'allow', the deny rules are as follows
                    if (rule.getType() == FirewallRule.FirewallRuleType.System) {
                        if (!rule.isDefaultEgressPolicy()) { // default of deny && system rule, so deny
                            action = "deny";
                        }
                    } else {
                        if (rule.isDefaultEgressPolicy()) { // default is allow && user rule, so deny
                            action = "deny";
                        }
                    }
                } else { // Ingress Rule
                    srcZone = _publicZone;
                    dstZone = _privateZone;
                    dstAddressXML = "<member>" + rule.getSrcIp() + "</member>";
                }

                // build the source cidr xml
                String srcCidrXML = "";
                List<String> ruleSrcCidrList = rule.getSourceCidrList();
                if (ruleSrcCidrList.size() > 0) { // a cidr was entered, modify as needed...
                    for (int i = 0; i < ruleSrcCidrList.size(); i++) {
                        if (ruleSrcCidrList.get(i).trim().equals("0.0.0.0/0")) { // allow any
                            if (rule.getTrafficType() == FirewallRule.TrafficType.Egress) {
                                srcCidrXML += "<member>" + getPrivateSubnet(rule.getSrcVlanTag()) + "</member>";
                            } else {
                                srcCidrXML += "<member>any</member>";
                            }
                        } else {
                            srcCidrXML += "<member>" + ruleSrcCidrList.get(i).trim() + "</member>";
                        }
                    }
                } else { // no cidr was entered, so allow ALL according to firewall rule type
                    if (rule.getTrafficType() == FirewallRule.TrafficType.Egress) {
                        srcCidrXML = "<member>" + getPrivateSubnet(rule.getSrcVlanTag()) + "</member>";
                    } else {
                        srcCidrXML = "<member>any</member>";
                    }
                }

                // build new rule xml
                String xml = "";
                xml += "<from><member>" + srcZone + "</member></from>";
                xml += "<to><member>" + dstZone + "</member></to>";
                xml += "<source>" + srcCidrXML + "</source>";
                xml += "<destination>" + dstAddressXML + "</destination>";
                xml += "<application>" + appXML + "</application>";
                xml += "<service>" + serviceXML + "</service>";
                xml += "<action>" + action + "</action>";
                xml += "<negate-source>no</negate-source>";
                xml += "<negate-destination>no</negate-destination>";
                if (_threatProfile != null && action.equals("allow")) { // add the threat profile if it exists
                    xml += "<profile-setting><group><member>" + _threatProfile + "</member></group></profile-setting>";
                }
                if (_logProfile != null && action.equals("allow")) { // add the log profile if it exists
                    xml += "<log-setting>" + _logProfile + "</log-setting>";
                }

                boolean has_default = false;
                String defaultEgressRule = "";
                if (rule.getTrafficType() == FirewallRule.TrafficType.Egress) {
                    // check if a default egress rule exists because it always has to be after the other rules.
                    Map<String, String> e_params = new HashMap<String, String>();
                    e_params.put("type", "config");
                    e_params.put("action", "get");
                    e_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='policy_0_" + rule.getSrcVlanTag() + "']");
                    String e_response = request(PaloAltoMethod.GET, e_params);
                    has_default = (validResponse(e_response) && responseNotEmpty(e_response));

                    // there is an existing default rule, so we need to remove it and add it back after the new rule is added.
                    if (has_default) {
                        logger.debug("Moving the default egress rule after the new rule: " + ruleName);
                        NodeList response_body;
                        Document doc = getDocument(e_response);
                        XPath xpath = XPathFactory.newInstance().newXPath();
                        try {
                            XPathExpression expr = xpath.compile("/response[@status='success']/result/entry/node()");
                            response_body = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
                        } catch (XPathExpressionException e) {
                            throw new ExecutionException(e.getCause().getMessage());
                        }
                        for (int i = 0; i < response_body.getLength(); i++) {
                            Node n = response_body.item(i);
                            defaultEgressRule += nodeToString(n);
                        }
                        Map<String, String> dd_params = new HashMap<String, String>();
                        dd_params.put("type", "config");
                        dd_params.put("action", "delete");
                        dd_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='policy_0_" + rule.getSrcVlanTag() +
                            "']");
                        cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, dd_params));
                    }
                }

                // add the new rule...
                Map<String, String> a_params = new HashMap<String, String>();
                a_params.put("type", "config");
                a_params.put("action", "set");
                a_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='" + ruleName + "']");
                a_params.put("element", xml);
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, a_params));

                // add back the default rule
                if (rule.getTrafficType() == FirewallRule.TrafficType.Egress && has_default) {
                    Map<String, String> da_params = new HashMap<String, String>();
                    da_params.put("type", "config");
                    da_params.put("action", "set");
                    da_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='policy_0_" + rule.getSrcVlanTag() + "']");
                    da_params.put("element", defaultEgressRule);
                    cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, da_params));
                    logger.debug("Completed move of the default egress rule after rule: " + ruleName);
                }

                return true;

            case DELETE:
                if (!manageFirewallRule(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, rule)) {
                    return true;
                }

                Map<String, String> d_params = new HashMap<String, String>();
                d_params.put("type", "config");
                d_params.put("action", "delete");
                d_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='" + ruleName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, d_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    // remove orphaned rules if they exist...
    public void removeOrphanedFirewallRules(ArrayList<IPaloAltoCommand> cmdList, long vlan) throws ExecutionException {
        Map<String, String> params = new HashMap<String, String>();
        params.put("type", "config");
        params.put("action", "get");
        params.put("xpath",
            "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[contains(@name, 'policy') and contains(@name, '" + Long.toString(vlan) + "')]");
        String response = request(PaloAltoMethod.GET, params);
        boolean has_orphans = (validResponse(response) && responseNotEmpty(response));

        if (has_orphans) {
            Map<String, String> d_params = new HashMap<String, String>();
            d_params.put("type", "config");
            d_params.put("action", "delete");
            d_params.put("xpath",
                "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[contains(@name, 'policy') and contains(@name, '" + Long.toString(vlan) +
                    "')]");
            cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, d_params));
        }
    }

    /*
     * Usage
     */

    /*
     * Helper config functions
     */

    // ensure guest network isolation
    private String genNetworkIsolationName(long privateVlanTag) {
        return "isolate_" + Long.toString(privateVlanTag);
    }

    public boolean manageNetworkIsolation(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, long privateVlanTag, String privateSubnet, String privateGateway)
        throws ExecutionException {
        String ruleName = genNetworkIsolationName(privateVlanTag);

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='" + ruleName + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Firewall policy exists: " + ruleName + ", " + result);
                return result;

            case ADD:
                if (manageNetworkIsolation(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, privateVlanTag, privateSubnet, privateGateway)) {
                    return true;
                }

                String xml = "";
                xml += "<from><member>" + _privateZone + "</member></from>";
                xml += "<to><member>" + _privateZone + "</member></to>";
                xml += "<source><member>" + privateSubnet + "</member></source>";
                xml += "<destination><member>" + privateGateway + "</member></destination>";
                xml += "<application><member>any</member></application>";
                xml += "<service><member>any</member></service>";
                xml += "<action>deny</action>";
                xml += "<negate-source>no</negate-source>";
                xml += "<negate-destination>yes</negate-destination>";

                Map<String, String> a_params = new HashMap<String, String>();
                a_params.put("type", "config");
                a_params.put("action", "set");
                a_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='" + ruleName + "']");
                a_params.put("element", xml);
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, a_params));

                return true;

            case DELETE:
                if (!manageNetworkIsolation(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, privateVlanTag, privateSubnet, privateGateway)) {
                    return true;
                }

                Map<String, String> d_params = new HashMap<String, String>();
                d_params.put("type", "config");
                d_params.put("action", "delete");
                d_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='" + ruleName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.POST, d_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    // make the interfaces pingable for basic network troubleshooting
    public boolean managePingProfile(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim) throws ExecutionException {
        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/network/profiles/interface-management-profile/entry[@name='" + _pingManagementProfile + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Management profile exists: " + _pingManagementProfile + ", " + result);
                return result;

            case ADD:
                if (managePingProfile(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS)) {
                    return true;
                }

                // add ping profile...
                Map<String, String> a_params = new HashMap<String, String>();
                a_params.put("type", "config");
                a_params.put("action", "set");
                a_params.put("xpath", "/config/devices/entry/network/profiles/interface-management-profile/entry[@name='" + _pingManagementProfile + "']");
                a_params.put("element", "<ping>yes</ping>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_params));

                return true;

            case DELETE:
                if (!managePingProfile(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS)) {
                    return true;
                }

                // delete ping profile...
                Map<String, String> d_params = new HashMap<String, String>();
                d_params.put("type", "config");
                d_params.put("action", "delete");
                d_params.put("xpath", "/config/devices/entry/network/profiles/interface-management-profile/entry[@name='" + _pingManagementProfile + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    private String genServiceName(String protocol, String dstPorts, String srcPorts) {
        String name;
        if (srcPorts == null) {
            name = "cs_" + protocol.toLowerCase() + "_" + dstPorts.replace(',', '.');
        } else {
            name = "cs_" + protocol.toLowerCase() + "_" + dstPorts.replace(',', '.') + "_" + srcPorts.replace(',', '.');
        }
        return name;
    }

    public boolean manageService(ArrayList<IPaloAltoCommand> cmdList, PaloAltoPrimative prim, String protocol, String dstPorts, String srcPorts)
        throws ExecutionException {
        String serviceName = genServiceName(protocol, dstPorts, srcPorts);

        switch (prim) {

            case CHECK_IF_EXISTS:
                // check if one exists already
                Map<String, String> params = new HashMap<String, String>();
                params.put("type", "config");
                params.put("action", "get");
                params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/service/entry[@name='" + serviceName + "']");
                String response = request(PaloAltoMethod.GET, params);
                boolean result = (validResponse(response) && responseNotEmpty(response));
                logger.debug("Service exists: " + serviceName + ", " + result);
                return result;

            case ADD:
                if (manageService(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, protocol, dstPorts, srcPorts)) {
                    return true;
                }

                String dstPortXML = "<port>" + dstPorts + "</port>";
                String srcPortXML = "";
                if (srcPorts != null) {
                    srcPortXML = "<source-port>" + srcPorts + "</source-port>";
                }

                // add ping profile...
                Map<String, String> a_params = new HashMap<String, String>();
                a_params.put("type", "config");
                a_params.put("action", "set");
                a_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/service/entry[@name='" + serviceName + "']");
                a_params.put("element", "<protocol><" + protocol.toLowerCase() + ">" + dstPortXML + srcPortXML + "</" + protocol.toLowerCase() + "></protocol>");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, a_params));

                return true;

            case DELETE:
                if (!manageService(cmdList, PaloAltoPrimative.CHECK_IF_EXISTS, protocol, dstPorts, srcPorts)) {
                    return true;
                }

                // delete ping profile...
                Map<String, String> d_params = new HashMap<String, String>();
                d_params.put("type", "config");
                d_params.put("action", "delete");
                d_params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/service/entry[@name='" + serviceName + "']");
                cmdList.add(new DefaultPaloAltoCommand(PaloAltoMethod.GET, d_params));

                return true;

            default:
                logger.debug("Unrecognized command.");
                return false;
        }
    }

    private String getPrivateSubnet(String vlan) throws ExecutionException {
        String _interfaceName = genPrivateInterfaceName(Long.parseLong(vlan));
        Map<String, String> params = new HashMap<String, String>();
        params.put("type", "config");
        params.put("action", "get");
        params.put("xpath", "/config/devices/entry/network/interface/" + _privateInterfaceType + "/entry[@name='" + _privateInterface + "']/layer3/units/entry[@name='" +
            _interfaceName + "']/ip/entry");
        String response = request(PaloAltoMethod.GET, params);
        if (validResponse(response) && responseNotEmpty(response)) {
            NodeList response_body;
            Document doc = getDocument(response);
            XPath xpath = XPathFactory.newInstance().newXPath();
            try {
                XPathExpression expr = xpath.compile("/response[@status='success']/result/entry");
                response_body = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
            } catch (XPathExpressionException e) {
                throw new ExecutionException(e.getCause().getMessage());
            }
            if (response_body.getLength() > 0) {
                return response_body.item(0).getAttributes().getNamedItem("name").getTextContent();
            }
        }
        return null;
    }

    /*
     * XML API commands
     */

    /* Function to make calls to the Palo Alto API. */
    /* All API calls will end up going through this function. */
    protected String request(PaloAltoMethod method, Map<String, String> params) throws ExecutionException {
        if (method != PaloAltoMethod.GET && method != PaloAltoMethod.POST) {
            throw new ExecutionException("Invalid http method used to access the Palo Alto API.");
        }

        String responseBody = "";
        String debug_msg = "Palo Alto Request\n";

        // a GET method...
        if (method == PaloAltoMethod.GET) {
            String queryString = "?";
            for (String key : params.keySet()) {
                if (!queryString.equals("?")) {
                    queryString = queryString + "&";
                }
                try {
                    queryString = queryString + key + "=" + URLEncoder.encode(params.get(key), "UTF-8");
                } catch (UnsupportedEncodingException e) {
                    throw new ExecutionException(e.getMessage());
                }
            }
            if (_key != null) {
                queryString = queryString + "&key=" + _key;
            }

            try {
                debug_msg = debug_msg + "GET request: https://" + _ip + s_apiUri + URLDecoder.decode(queryString, "UTF-8") + "\n";
            } catch (UnsupportedEncodingException e) {
                debug_msg = debug_msg + "GET request: https://" + _ip + s_apiUri + queryString + "\n";
            }

            HttpGet get_request = new HttpGet("https://" + _ip + s_apiUri + queryString);
            ResponseHandler<String> responseHandler = new BasicResponseHandler();
            try {
                responseBody = s_httpclient.execute(get_request, responseHandler);
            } catch (IOException e) {
                throw new ExecutionException(e.getMessage());
            }
        }

        // a POST method...
        if (method == PaloAltoMethod.POST) {
            List<NameValuePair> nvps = new ArrayList<NameValuePair>();
            for (String key : params.keySet()) {
                nvps.add(new BasicNameValuePair(key, params.get(key)));
            }
            if (_key != null) {
                nvps.add(new BasicNameValuePair("key", _key));
            }

            debug_msg = debug_msg + "POST request: https://" + _ip + s_apiUri + "\n";
            for (NameValuePair nvp : nvps) {
                debug_msg = debug_msg + "param: " + nvp.getName() + ", " + nvp.getValue() + "\n";
            }

            HttpPost post_request = new HttpPost("https://" + _ip + s_apiUri);
            try {
                post_request.setEntity(new UrlEncodedFormEntity(nvps, HTTP.UTF_8));
            } catch (UnsupportedEncodingException e) {
                throw new ExecutionException(e.getMessage());
            }
            ResponseHandler<String> responseHandler = new BasicResponseHandler();
            try {
                responseBody = s_httpclient.execute(post_request, responseHandler);
            } catch (IOException e) {
                throw new ExecutionException(e.getMessage());
            }
        }

        debug_msg = debug_msg + prettyFormat(responseBody);
        debug_msg = debug_msg + "\n" + responseBody.replace("\"", "\\\"") + "\n\n"; // test cases
        //logger.debug(debug_msg); // this can be commented if we don't want to show each request in the log.

        return responseBody;
    }

    /* Used for requests that require polling to get a result (eg: commit) */
    private String requestWithPolling(PaloAltoMethod method, Map<String, String> params) throws ExecutionException {
        String job_id;
        String job_response = request(method, params);
        Document doc = getDocument(job_response);
        XPath xpath = XPathFactory.newInstance().newXPath();
        try {
            XPathExpression expr = xpath.compile("/response[@status='success']/result/job/text()");
            job_id = (String)expr.evaluate(doc, XPathConstants.STRING);
        } catch (XPathExpressionException e) {
            throw new ExecutionException(e.getCause().getMessage());
        }
        if (job_id.length() > 0) {
            boolean finished = false;
            Map<String, String> job_params = new HashMap<String, String>();
            job_params.put("type", "op");
            job_params.put("cmd", "<show><jobs><id>" + job_id + "</id></jobs></show>");

            while (!finished) {
                String job_status;
                String response = request(PaloAltoMethod.GET, job_params);
                Document job_doc = getDocument(response);
                XPath job_xpath = XPathFactory.newInstance().newXPath();
                try {
                    XPathExpression expr = job_xpath.compile("/response[@status='success']/result/job/status/text()");
                    job_status = (String)expr.evaluate(job_doc, XPathConstants.STRING);
                } catch (XPathExpressionException e) {
                    throw new ExecutionException(e.getCause().getMessage());
                }
                if (job_status.equals("FIN")) {
                    finished = true;
                    String job_result;
                    try {
                        XPathExpression expr = job_xpath.compile("/response[@status='success']/result/job/result/text()");
                        job_result = (String)expr.evaluate(job_doc, XPathConstants.STRING);
                    } catch (XPathExpressionException e) {
                        throw new ExecutionException(e.getCause().getMessage());
                    }
                    if (!job_result.equals("OK")) {
                        NodeList job_details;
                        try {
                            XPathExpression expr = job_xpath.compile("/response[@status='success']/result/job/details/line");
                            job_details = (NodeList)expr.evaluate(job_doc, XPathConstants.NODESET);
                        } catch (XPathExpressionException e) {
                            throw new ExecutionException(e.getCause().getMessage());
                        }
                        String error = "";
                        for (int i = 0; i < job_details.getLength(); i++) {
                            error = error + job_details.item(i).getTextContent() + "\n";
                        }
                        throw new ExecutionException(error);
                    }
                    return response;
                } else {
                    try {
                        Thread.sleep(2000); // poll periodically for the status of the async job...
                    } catch (InterruptedException e) { /* do nothing */
                    }
                }
            }
        } else {
            return job_response;
        }
        return null;
    }

    /* Runs a sequence of commands and attempts to commit at the end. */
    /* Uses the Command pattern to enable overriding of the response handling if needed. */
    private synchronized boolean requestWithCommit(ArrayList<IPaloAltoCommand> commandList) throws ExecutionException {
        boolean result = true;

        if (commandList.size() > 0) {
            // CHECK IF THERE IS PENDING CHANGES THAT HAVE NOT BEEN COMMITTED...
            String pending_changes;
            Map<String, String> check_params = new HashMap<String, String>();
            check_params.put("type", "op");
            check_params.put("cmd", "<check><pending-changes></pending-changes></check>");
            String check_response = request(PaloAltoMethod.GET, check_params);
            Document check_doc = getDocument(check_response);
            XPath check_xpath = XPathFactory.newInstance().newXPath();
            try {
                XPathExpression expr = check_xpath.compile("/response[@status='success']/result/text()");
                pending_changes = (String)expr.evaluate(check_doc, XPathConstants.STRING);
            } catch (XPathExpressionException e) {
                throw new ExecutionException(e.getCause().getMessage());
            }
            if (pending_changes.equals("yes")) {
                throw new ExecutionException("The Palo Alto has uncommited changes, so no changes can be made.  Try again later or contact your administrator.");
            } else {
                // ADD A CONFIG LOCK TO CAPTURE THE PALO ALTO RESOURCE
                String add_lock_status;
                Map<String, String> add_lock_params = new HashMap<String, String>();
                add_lock_params.put("type", "op");
                add_lock_params.put("cmd", "<request><config-lock><add></add></config-lock></request>");
                String add_lock_response = request(PaloAltoMethod.GET, add_lock_params);
                Document add_lock_doc = getDocument(add_lock_response);
                XPath add_lock_xpath = XPathFactory.newInstance().newXPath();
                try {
                    XPathExpression expr = add_lock_xpath.compile("/response[@status='success']/result/text()");
                    add_lock_status = (String)expr.evaluate(add_lock_doc, XPathConstants.STRING);
                } catch (XPathExpressionException e) {
                    throw new ExecutionException(e.getCause().getMessage());
                }
                if (add_lock_status.length() == 0) {
                    throw new ExecutionException("The Palo Alto is locked, no changes can be made at this time.");
                }

                try {
                    // RUN THE SEQUENCE OF COMMANDS
                    for (IPaloAltoCommand command : commandList) {
                        result = (result && command.execute()); // run commands and modify result boolean
                    }

                    // COMMIT THE CHANGES (ALSO REMOVES CONFIG LOCK)
                    String commit_job_id;
                    Map<String, String> commit_params = new HashMap<String, String>();
                    commit_params.put("type", "commit");
                    commit_params.put("cmd", "<commit></commit>");
                    String commit_response = requestWithPolling(PaloAltoMethod.GET, commit_params);
                    Document commit_doc = getDocument(commit_response);
                    XPath commit_xpath = XPathFactory.newInstance().newXPath();
                    try {
                        XPathExpression expr = commit_xpath.compile("/response[@status='success']/result/job/id/text()");
                        commit_job_id = (String)expr.evaluate(commit_doc, XPathConstants.STRING);
                    } catch (XPathExpressionException e) {
                        throw new ExecutionException(e.getCause().getMessage());
                    }
                    if (commit_job_id.length() == 0) { // no commit was done, so release the lock...
                        // REMOVE THE CONFIG LOCK TO RELEASE THE PALO ALTO RESOURCE
                        String remove_lock_status;
                        Map<String, String> remove_lock_params = new HashMap<String, String>();
                        remove_lock_params.put("type", "op");
                        remove_lock_params.put("cmd", "<request><config-lock><remove></remove></config-lock></request>");
                        String remove_lock_response = request(PaloAltoMethod.GET, remove_lock_params);
                        Document remove_lock_doc = getDocument(remove_lock_response);
                        XPath remove_lock_xpath = XPathFactory.newInstance().newXPath();
                        try {
                            XPathExpression expr = remove_lock_xpath.compile("/response[@status='success']/result/text()");
                            remove_lock_status = (String)expr.evaluate(remove_lock_doc, XPathConstants.STRING);
                        } catch (XPathExpressionException e) {
                            throw new ExecutionException(e.getCause().getMessage());
                        }
                        if (remove_lock_status.length() == 0) {
                            throw new ExecutionException("Could not release the Palo Alto device.  Please notify an administrator!");
                        }
                    }

                } catch (ExecutionException ex) {
                    // REVERT TO RUNNING
                    String revert_job_id;
                    Map<String, String> revert_params = new HashMap<String, String>();
                    revert_params.put("type", "op");
                    revert_params.put("cmd", "<load><config><from>running-config.xml</from></config></load>");
                    requestWithPolling(PaloAltoMethod.GET, revert_params);

                    // REMOVE THE CONFIG LOCK TO RELEASE THE PALO ALTO RESOURCE
                    String remove_lock_status;
                    Map<String, String> remove_lock_params = new HashMap<String, String>();
                    remove_lock_params.put("type", "op");
                    remove_lock_params.put("cmd", "<request><config-lock><remove></remove></config-lock></request>");
                    String remove_lock_response = request(PaloAltoMethod.GET, remove_lock_params);
                    Document remove_lock_doc = getDocument(remove_lock_response);
                    XPath remove_lock_xpath = XPathFactory.newInstance().newXPath();
                    try {
                        XPathExpression expr = remove_lock_xpath.compile("/response[@status='success']/result/text()");
                        remove_lock_status = (String)expr.evaluate(remove_lock_doc, XPathConstants.STRING);
                    } catch (XPathExpressionException e) {
                        throw new ExecutionException(e.getCause().getMessage());
                    }
                    if (remove_lock_status.length() == 0) {
                        throw new ExecutionException("Could not release the Palo Alto device.  Please notify an administrator!");
                    }

                    throw ex; // Bubble up the reason we reverted...
                }

                return result;
            }
        } else {
            return true; // nothing to do
        }
    }

    /* A default response handler to validate that the request was successful. */
    public boolean validResponse(String response) throws ExecutionException {
        NodeList response_body;
        Document doc = getDocument(response);
        XPath xpath = XPathFactory.newInstance().newXPath();
        try {
            XPathExpression expr = xpath.compile("/response[@status='success']");
            response_body = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
        } catch (XPathExpressionException e) {
            throw new ExecutionException(e.getCause().getMessage());
        }

        if (response_body.getLength() > 0) {
            return true;
        } else {
            NodeList error_details;
            try {
                XPathExpression expr = xpath.compile("/response/msg/line/line");
                error_details = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
            } catch (XPathExpressionException e) {
                throw new ExecutionException(e.getCause().getMessage());
            }
            if (error_details.getLength() == 0) {
                try {
                    XPathExpression expr = xpath.compile("/response/msg/line");
                    error_details = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
                } catch (XPathExpressionException e) {
                    throw new ExecutionException(e.getCause().getMessage());
                }

                if (error_details.getLength() == 0) {
                    try {
                        XPathExpression expr = xpath.compile("/response/result/msg");
                        error_details = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
                    } catch (XPathExpressionException e) {
                        throw new ExecutionException(e.getCause().getMessage());
                    }
                }
            }
            String error = "";
            for (int i = 0; i < error_details.getLength(); i++) {
                error = error + error_details.item(i).getTextContent() + "\n";
            }
            throw new ExecutionException(error);
        }
    }

    /* Validate that the response is not empty. */
    public boolean responseNotEmpty(String response) throws ExecutionException {
        NodeList response_body;
        Document doc = getDocument(response);
        XPath xpath = XPathFactory.newInstance().newXPath();
        try {
            XPathExpression expr = xpath.compile("/response[@status='success']");
            response_body = (NodeList)expr.evaluate(doc, XPathConstants.NODESET);
        } catch (XPathExpressionException e) {
            throw new ExecutionException(e.getCause().getMessage());
        }

        if (response_body.getLength() > 0 &&
            (!response_body.item(0).getTextContent().equals("") || (response_body.item(0).hasChildNodes() && response_body.item(0).getFirstChild().hasChildNodes()))) {
            return true;
        } else {
            return false;
        }
    }

    /* Get the type of interface from the PA device. */
    private String getInterfaceType(String interfaceName) throws ExecutionException {
        String[] types = {InterfaceType.ETHERNET.toString(), InterfaceType.AGGREGATE.toString()};
        for (String type : types) {
            Map<String, String> params = new HashMap<String, String>();
            params.put("type", "config");
            params.put("action", "get");
            params.put("xpath", "/config/devices/entry/network/interface/" + type + "/entry[@name='" + interfaceName + "']");
            String ethernet_response = request(PaloAltoMethod.GET, params);
            if (validResponse(ethernet_response) && responseNotEmpty(ethernet_response)) {
                return type;
            }
        }
        return "";
    }

    /* Get the threat profile from the server if it exists. */
    private boolean getThreatProfile(String profile) throws ExecutionException {
        Map<String, String> params = new HashMap<String, String>();
        params.put("type", "config");
        params.put("action", "get");
        params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/profile-group/entry[@name='" + profile + "']");
        String response = request(PaloAltoMethod.GET, params);
        return (validResponse(response) && responseNotEmpty(response));
    }

    /* Get the log profile from the server if it exists. */
    private boolean getLogProfile(String profile) throws ExecutionException {
        Map<String, String> params = new HashMap<String, String>();
        params.put("type", "config");
        params.put("action", "get");
        params.put("xpath", "/config/devices/entry/vsys/entry[@name='vsys1']/log-settings/profiles/entry[@name='" + profile + "']");
        String response = request(PaloAltoMethod.GET, params);
        return (validResponse(response) && responseNotEmpty(response));
    }

    /* Command Interface */
    public interface IPaloAltoCommand {
        public boolean execute() throws ExecutionException;
    }

    /* Command Abstract */
    private abstract class AbstractPaloAltoCommand implements IPaloAltoCommand {
        PaloAltoMethod method;
        Map<String, String> params;

        public AbstractPaloAltoCommand() {
        }

        public AbstractPaloAltoCommand(PaloAltoMethod method, Map<String, String> params) {
            this.method = method;
            this.params = params;
        }

        @Override
        public boolean execute() throws ExecutionException {
            String response = request(method, params);
            return validResponse(response);
        }
    }

    /* Implement the default functionality */
    private class DefaultPaloAltoCommand extends AbstractPaloAltoCommand {
        public DefaultPaloAltoCommand(PaloAltoMethod method, Map<String, String> params) {
            super(method, params);
        }
    }

    /*
     * Misc
     */

    private String genIpIdentifier(String ip) {
        return ip.replace('.', '-').replace('/', '-');
    }

    private String parsePublicVlanTag(String uri) {
        return uri.replace("vlan://", "");
    }

    private Protocol getProtocol(String protocolName) throws ExecutionException {
        protocolName = protocolName.toLowerCase();

        try {
            return Protocol.valueOf(protocolName);
        } catch (Exception e) {
            throw new ExecutionException("Invalid protocol: " + protocolName);
        }
    }

    private Document getDocument(String xml) throws ExecutionException {
        StringReader xmlReader = new StringReader(xml);
        InputSource xmlSource = new InputSource(xmlReader);
        Document doc = null;

        try {
            doc = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder().parse(xmlSource);
        } catch (Exception e) {
            logger.error(e);
            throw new ExecutionException(e.getMessage());
        }

        if (doc == null) {
            throw new ExecutionException("Failed to parse xml " + xml);
        } else {
            return doc;
        }
    }

    // return an xml node as a string
    private String nodeToString(Node node) throws ExecutionException {
        StringWriter sw = new StringWriter();
        try {
            Transformer t = ParserUtils.getSaferTransformerFactory().newTransformer();
            t.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
            t.transform(new DOMSource(node), new StreamResult(sw));
        } catch (Throwable t) {
            throw new ExecutionException("XML convert error when modifying PA config: " + t.getMessage());
        }
        return sw.toString();
    }

    // pretty printing of xml strings
    private String prettyFormat(String input) {
        int indent = 4;
        try {
            Source xmlInput = new StreamSource(new StringReader(input));
            StringWriter stringWriter = new StringWriter();
            StreamResult xmlOutput = new StreamResult(stringWriter);
            TransformerFactory transformerFactory = ParserUtils.getSaferTransformerFactory();
            transformerFactory.setAttribute("indent-number", indent);
            Transformer transformer = transformerFactory.newTransformer();
            transformer.setOutputProperty(OutputKeys.INDENT, "yes");
            transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
            transformer.transform(xmlInput, xmlOutput);
            return xmlOutput.getWriter().toString();
        } catch (Throwable e) {
            try {
                Source xmlInput = new StreamSource(new StringReader(input));
                StringWriter stringWriter = new StringWriter();
                StreamResult xmlOutput = new StreamResult(stringWriter);
                TransformerFactory transformerFactory = ParserUtils.getSaferTransformerFactory();
                Transformer transformer = transformerFactory.newTransformer();
                transformer.setOutputProperty(OutputKeys.INDENT, "yes");
                transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount", String.valueOf(indent));
                transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
                transformer.transform(xmlInput, xmlOutput);
                return xmlOutput.getWriter().toString();
            } catch (Throwable t) {
                return input;
            }
        }
    }

    //@Override
    @Override
    public void setName(String name) {
        // TODO Auto-generated method stub
    }

    //@Override
    @Override
    public void setConfigParams(Map<String, Object> params) {
        // TODO Auto-generated method stub
    }

    //@Override
    @Override
    public Map<String, Object> getConfigParams() {
        // TODO Auto-generated method stub
        return null;
    }

    //@Override
    @Override
    public int getRunLevel() {
        // TODO Auto-generated method stub
        return 0;
    }

    //@Override
    @Override
    public void setRunLevel(int level) {
        // TODO Auto-generated method stub
    }
}
