package wireguard

import (
    "crypto/rand"
    "net"
    "sync"
    "time"
    "golang.zx2c4.com/wireguard/device"
    "golang.zx2c4.com/wireguard/tun"
)

type WireGuardServer struct {
    Device          *device.Device
    TunInterface    tun.Device
    Configuration   *ServerConfig
    PeerManager     *PeerManager
    KeyManager      *KeyManager
    TrafficAnalyzer *TrafficAnalyzer
    SecurityEngine  *SecurityEngine
    PerformanceMonitor *PerformanceMonitor
    mutex           sync.RWMutex
}

type ServerConfig struct {
    InterfaceName   string
    ListenPort      int
    PrivateKey      [32]byte
    PublicKey       [32]byte
    NetworkCIDR     *net.IPNet
    DNS             []net.IP
    MTU             int
    FwMark          uint32
    PersistentKeepalive int
}

type Peer struct {
    PublicKey       [32]byte
    PreSharedKey    [32]byte
    AllowedIPs      []*net.IPNet
    Endpoint        *net.UDPAddr
    PersistentKeepalive time.Duration
    LastHandshake   time.Time
    RxBytes         uint64
    TxBytes         uint64
    ConnectionState PeerState
    QoSClass        QoSClass
    BandwidthLimit  uint64
}

func NewWireGuardServer(config *ServerConfig) (*WireGuardServer, error) {
    // Create TUN interface
    tunInterface, err := tun.CreateTUN(config.InterfaceName, config.MTU)
    if err != nil {
        return nil, err
    }
    
    // Create WireGuard device
    device := device.NewDevice(tunInterface, conn.NewDefaultBind(), device.NewLogger(device.LogLevelVerbose, ""))
    
    server := &WireGuardServer{
        Device:          device,
        TunInterface:    tunInterface,
        Configuration:   config,
        PeerManager:     NewPeerManager(),
        KeyManager:      NewKeyManager(),
        TrafficAnalyzer: NewTrafficAnalyzer(),
        SecurityEngine:  NewSecurityEngine(),
        PerformanceMonitor: NewPerformanceMonitor(),
    }
    
    return server, nil
}

func (wgs *WireGuardServer) Start() error {
    // Configure device
    if err := wgs.configureDevice(); err != nil {
        return err
    }
    
    // Start performance monitoring
    go wgs.PerformanceMonitor.Start()
    
    // Start traffic analysis
    go wgs.TrafficAnalyzer.Start()
    
    // Start security monitoring
    go wgs.SecurityEngine.Start()
    
    // Start peer management
    go wgs.PeerManager.ManagePeers()
    
    // Bring up the device
    wgs.Device.Up()
    
    return nil
}

func (wgs *WireGuardServer) AddPeer(peerConfig *PeerConfig) error {
    wgs.mutex.Lock()
    defer wgs.mutex.Unlock()
    
    // Validate peer configuration
    if err := wgs.validatePeerConfig(peerConfig); err != nil {
        return err
    }
    
    // Generate pre-shared key if not provided
    var preSharedKey [32]byte
    if peerConfig.PreSharedKey == nil {
        if _, err := rand.Read(preSharedKey[:]); err != nil {
            return err
        }
    } else {
        copy(preSharedKey[:], peerConfig.PreSharedKey[:])
    }
    
    peer := &Peer{
        PublicKey:       peerConfig.PublicKey,
        PreSharedKey:    preSharedKey,
        AllowedIPs:      peerConfig.AllowedIPs,
        Endpoint:        peerConfig.Endpoint,
        PersistentKeepalive: time.Duration(peerConfig.PersistentKeepalive) * time.Second,
        ConnectionState: PeerStateDisconnected,
        QoSClass:        peerConfig.QoSClass,
        BandwidthLimit:  peerConfig.BandwidthLimit,
    }
    
    // Add peer to device
    if err := wgs.Device.SetPeer(peer.PublicKey, peer); err != nil {
        return err
    }
    
    // Register peer with manager
    wgs.PeerManager.AddPeer(peer)
    
    return nil
}

type PeerManager struct {
    Peers           map[[32]byte]*Peer
    HealthChecker   *HealthChecker
    LoadBalancer    *PeerLoadBalancer
    FailoverManager *FailoverManager
    TrafficShaper   *TrafficShaper
    mutex           sync.RWMutex
}

func (pm *PeerManager) ManagePeers() {
    ticker := time.NewTicker(30 * time.Second)
    defer ticker.Stop()
    
    for range ticker.C {
        pm.performPeerMaintenance()
    }
}

func (pm *PeerManager) performPeerMaintenance() {
    pm.mutex.RLock()
    peers := make([]*Peer, 0, len(pm.Peers))
    for _, peer := range pm.Peers {
        peers = append(peers, peer)
    }
    pm.mutex.RUnlock()
    
    for _, peer := range peers {
        // Check peer health
        pm.HealthChecker.CheckPeer(peer)
        
        // Update traffic shaping
        pm.TrafficShaper.UpdatePeerShaping(peer)
        
        // Handle failover if needed
        if peer.ConnectionState == PeerStateUnhealthy {
            pm.FailoverManager.HandlePeerFailure(peer)
        }
    }
}

// Advanced Traffic Shaping and QoS
type TrafficShaper struct {
    QoSPolicies     map[QoSClass]*QoSPolicy
    BandwidthLimiter *BandwidthLimiter
    PriorityScheduler *PriorityScheduler
    TokenBucket     map[[32]byte]*TokenBucket
}

func (ts *TrafficShaper) ShapeTraffic(peer *Peer, packet []byte) bool {
    // Apply bandwidth limiting
    if !ts.BandwidthLimiter.AllowPacket(peer, len(packet)) {
        return false // Drop packet
    }
    
    // Apply QoS policies
    qosPolicy := ts.QoSPolicies[peer.QoSClass]
    if qosPolicy != nil {
        priority := qosPolicy.CalculatePriority(packet)
        return ts.PriorityScheduler.SchedulePacket(peer, packet, priority)
    }
    
    return true
}

type PerformanceMonitor struct {
    Metrics         *WireGuardMetrics
    ThroughputMonitor *ThroughputMonitor
    LatencyMonitor  *LatencyMonitor
    ConnectionMonitor *ConnectionMonitor
}

func (pm *PerformanceMonitor) Start() {
    go pm.monitorThroughput()
    go pm.monitorLatency()
    go pm.monitorConnections()
}

func (pm *PerformanceMonitor) monitorThroughput() {
    ticker := time.NewTicker(1 * time.Second)
    defer ticker.Stop()
    
    for range ticker.C {
        throughputStats := pm.ThroughputMonitor.GetCurrentStats()
        pm.Metrics.UpdateThroughput(throughputStats)
    }
}

type WireGuardMetrics struct {
    TotalPeers          int64
    ActiveConnections   int64
    ThroughputBps       float64
    LatencyMs           float64
    PacketLoss          float64
    HandshakeSuccessRate float64
    CryptoOperationsPerSec float64
    MemoryUsage         uint64
    CPUUsage            float64
}

class IPSecTunnel:
    def __init__(self, config):
        self.config = config
        self.ike_sa = None
        self.ipsec_sa = None
        self.esp_engine = ESPEngine()
        self.ah_engine = AHEngine()
        self.key_manager = KeyManager()
        self.dpd_manager = DeadPeerDetectionManager()
        self.nat_traversal = NATTraversalManager()
        
    def establish_tunnel(self):
        """Establish IPSec tunnel with IKEv2"""
        # Phase 1: IKE SA establishment
        self.ike_sa = self.establish_ike_sa()
        
        # Phase 2: IPSec SA establishment
        self.ipsec_sa = self.establish_ipsec_sa()
        
        # Start tunnel maintenance
        self.start_tunnel_maintenance()
        
        return self.ipsec_sa is not None
    
    def establish_ike_sa(self):
        """Establish IKE Security Association"""
        # IKE_SA_INIT exchange
        ike_init_request = self.create_ike_init_request()
        ike_init_response = self.send_ike_message(ike_init_request)
        
        if not self.validate_ike_init_response(ike_init_response):
            raise IPSecError("IKE_SA_INIT failed")
        
        # Generate shared secret
        shared_secret = self.calculate_shared_secret(
            ike_init_response.key_exchange_data
        )
        
        # Derive encryption and authentication keys
        keys = self.derive_ike_keys(shared_secret)
        
        # IKE_AUTH exchange
        ike_auth_request = self.create_ike_auth_request(keys)
        ike_auth_response = self.send_ike_message(ike_auth_request)
        
        if not self.validate_ike_auth_response(ike_auth_response):
            raise IPSecError("IKE_AUTH failed")
        
        # Create IKE SA
        ike_sa = IKESA(
            spi_initiator=ike_init_request.spi,
            spi_responder=ike_init_response.spi,
            encryption_key=keys.encryption_key,
            integrity_key=keys.integrity_key,
            encryption_algorithm=self.config.ike_encryption,
            integrity_algorithm=self.config.ike_integrity,
            dh_group=self.config.dh_group,
            lifetime=self.config.ike_lifetime
        )
        
        return ike_sa
    
    def establish_ipsec_sa(self):
        """Establish IPSec Security Association"""
        if not self.ike_sa:
            raise IPSecError("IKE SA must be established first")
        
        # CREATE_CHILD_SA exchange
        create_child_request = self.create_child_sa_request()
        create_child_response = self.send_ike_message(create_child_request)
        
        if not self.validate_create_child_response(create_child_response):
            raise IPSecError("CREATE_CHILD_SA failed")
        
        # Derive IPSec keys
        ipsec_keys = self.derive_ipsec_keys(
            self.ike_sa.shared_secret,
            create_child_response.nonce
        )
        
        # Create IPSec SA
        ipsec_sa = IPSecSA(
            spi_inbound=create_child_response.spi_inbound,
            spi_outbound=create_child_request.spi_outbound,
            encryption_key_inbound=ipsec_keys.encryption_key_inbound,
            encryption_key_outbound=ipsec_keys.encryption_key_outbound,
            integrity_key_inbound=ipsec_keys.integrity_key_inbound,
            integrity_key_outbound=ipsec_keys.integrity_key_outbound,
            encryption_algorithm=self.config.esp_encryption,
            integrity_algorithm=self.config.esp_integrity,
            lifetime=self.config.ipsec_lifetime,
            traffic_selectors=self.config.traffic_selectors
        )
        
        return ipsec_sa
    
    def process_packet(self, packet, direction):
        """Process packet through IPSec tunnel"""
        if direction == PacketDirection.OUTBOUND:
            return self.encrypt_packet(packet)
        else:
            return self.decrypt_packet(packet)
    
    def encrypt_packet(self, packet):
        """Encrypt outbound packet using ESP"""
        if not self.ipsec_sa:
            raise IPSecError("IPSec SA not established")
        
        # Check traffic selectors
        if not self.matches_traffic_selectors(packet):
            return packet  # Pass through without encryption
        
        # Apply ESP encryption
        esp_packet = self.esp_engine.encrypt(
            packet,
            self.ipsec_sa.spi_outbound,
            self.ipsec_sa.encryption_key_outbound,
            self.ipsec_sa.integrity_key_outbound,
            self.ipsec_sa.sequence_number_outbound
        )
        
        # Increment sequence number
        self.ipsec_sa.sequence_number_outbound += 1
        
        return esp_packet
    
    def decrypt_packet(self, esp_packet):
        """Decrypt inbound ESP packet"""
        if not self.ipsec_sa:
            raise IPSecError("IPSec SA not established")
        
        # Validate ESP header
        if not self.esp_engine.validate_esp_header(esp_packet):
            raise IPSecError("Invalid ESP header")
        
        # Check sequence number for replay protection
        if not self.check_sequence_number(esp_packet.sequence_number):
            raise IPSecError("Replay attack detected")
        
        # Decrypt ESP packet
        decrypted_packet = self.esp_engine.decrypt(
            esp_packet,
            self.ipsec_sa.encryption_key_inbound,
            self.ipsec_sa.integrity_key_inbound
        )
        
        # Update replay window
        self.update_replay_window(esp_packet.sequence_number)
        
        return decrypted_packet

class ESPEngine:
    """Encapsulating Security Payload implementation"""
    
    def __init__(self):
        self.cipher_suites = {
            'AES-256-GCM': AES256GCMCipher(),
            'AES-128-GCM': AES128GCMCipher(),
            'AES-256-CBC': AES256CBCCipher(),
            'ChaCha20-Poly1305': ChaCha20Poly1305Cipher()
        }
    
    def encrypt(self, packet, spi, encryption_key, integrity_key, sequence_number):
        """Encrypt packet using ESP"""
        # Create ESP header
        esp_header = ESPHeader(
            spi=spi,
            sequence_number=sequence_number
        )
        
        # Add padding
        padded_payload = self.add_padding(packet.payload)
        
        # Select cipher based on configuration
        cipher = self.cipher_suites[self.encryption_algorithm]
        
        # Encrypt payload
        encrypted_payload, auth_tag = cipher.encrypt(
            padded_payload,
            encryption_key,
            self.generate_iv()
        )
        
        # Create ESP packet
        esp_packet = ESPPacket(
            header=esp_header,
            encrypted_payload=encrypted_payload,
            authentication_tag=auth_tag
        )
        
        return esp_packet
    
    def decrypt(self, esp_packet, encryption_key, integrity_key):
        """Decrypt ESP packet"""
        # Verify authentication tag
        cipher = self.cipher_suites[self.encryption_algorithm]
        
        if not cipher.verify_auth_tag(
            esp_packet.encrypted_payload,
            esp_packet.authentication_tag,
            integrity_key
        ):
            raise IPSecError("Authentication verification failed")
        
        # Decrypt payload
        decrypted_payload = cipher.decrypt(
            esp_packet.encrypted_payload,
            encryption_key,
            esp_packet.iv
        )
        
        # Remove padding
        original_payload = self.remove_padding(decrypted_payload)
        
        return original_payload

class IPSecPerformanceOptimizer:
    def __init__(self):
        self.crypto_accelerator = CryptoAccelerator()
        self.packet_batching = PacketBatching()
        self.memory_pool = MemoryPool()
        self.numa_optimizer = NUMAOptimizer()
        
    def optimize_encryption_performance(self, ipsec_config):
        """Optimize IPSec encryption performance"""
        optimizations = []
        
        # Hardware acceleration
        if self.crypto_accelerator.is_available():
            optimizations.append(self.enable_hardware_acceleration())
        
        # CPU affinity optimization
        optimizations.append(self.optimize_cpu_affinity())
        
        # Memory optimization
        optimizations.append(self.optimize_memory_allocation())
        
        # Packet batching
        optimizations.append(self.enable_packet_batching())
        
        return optimizations
    
    def enable_hardware_acceleration(self):
        """Enable hardware crypto acceleration"""
        # Configure Intel QuickAssist or similar
        accel_config = {
            'engine': 'qat',
            'algorithms': ['AES-256-GCM', 'SHA-256'],
            'worker_threads': 4,
            'queue_depth': 1024
        }
        
        self.crypto_accelerator.configure(accel_config)
        return accel_config
    
    def optimize_cpu_affinity(self):
        """Optimize CPU affinity for IPSec processing"""
        # Bind IPSec threads to specific CPU cores
        cpu_config = {
            'encryption_cores': [2, 3, 4, 5],
            'decryption_cores': [6, 7, 8, 9],
            'control_plane_cores': [0, 1],
            'isolate_cores': True
        }
        
        return cpu_config
    
    def benchmark_cipher_performance(self):
        """Benchmark different cipher algorithms"""
        test_data = os.urandom(1500)  # MTU-sized packet
        results = {}
        
        for cipher_name, cipher in self.cipher_suites.items():
            start_time = time.time()
            iterations = 10000
            
            for _ in range(iterations):
                encrypted_data, tag = cipher.encrypt(test_data, self.test_key)
                decrypted_data = cipher.decrypt(encrypted_data, self.test_key, tag)
            
            end_time = time.time()
            duration = end_time - start_time
            
            results[cipher_name] = {
                'throughput_mbps': (len(test_data) * iterations * 8) / (duration * 1000000),
                'latency_us': (duration / iterations) * 1000000,
                'cpu_cycles_per_byte': self.measure_cpu_cycles(cipher, test_data)
            }
        
        return results

class VPNLoadBalancer:
    def __init__(self):
        self.tunnels = {}
        self.health_checker = TunnelHealthChecker()
        self.traffic_distributor = TrafficDistributor()
        self.failover_manager = TunnelFailoverManager()
        
    def add_tunnel(self, tunnel_id, tunnel_config):
        """Add VPN tunnel to load balancer"""
        tunnel = self.create_tunnel(tunnel_config)
        self.tunnels[tunnel_id] = tunnel
        
        # Start health monitoring
        self.health_checker.monitor_tunnel(tunnel)
        
    def distribute_traffic(self, packet):
        """Distribute traffic across available tunnels"""
        # Get healthy tunnels
        healthy_tunnels = [
            tunnel for tunnel in self.tunnels.values()
            if tunnel.is_healthy()
        ]
        
        if not healthy_tunnels:
            raise VPNError("No healthy tunnels available")
        
        # Select tunnel based on load balancing algorithm
        selected_tunnel = self.traffic_distributor.select_tunnel(
            healthy_tunnels, packet
        )
        
        return selected_tunnel.send_packet(packet)
    
    def handle_tunnel_failure(self, failed_tunnel):
        """Handle tunnel failure with automatic failover"""
        # Mark tunnel as unhealthy
        failed_tunnel.mark_unhealthy()
        
        # Redistribute traffic to remaining tunnels
        self.traffic_distributor.redistribute_traffic(failed_tunnel)
        
        # Attempt tunnel recovery
        self.failover_manager.attempt_recovery(failed_tunnel)

class TrafficDistributor:
    def __init__(self):
        self.algorithm = 'weighted_round_robin'
        self.flow_table = {}
        
    def select_tunnel(self, tunnels, packet):
        """Select tunnel for packet based on algorithm"""
        if self.algorithm == 'round_robin':
            return self.round_robin_selection(tunnels)
        elif self.algorithm == 'weighted_round_robin':
            return self.weighted_round_robin_selection(tunnels)
        elif self.algorithm == 'least_connections':
            return self.least_connections_selection(tunnels)
        elif self.algorithm == 'flow_hash':
            return self.flow_hash_selection(tunnels, packet)
        else:
            return tunnels[0]  # Default to first tunnel
    
    def flow_hash_selection(self, tunnels, packet):
        """Select tunnel based on flow hash for session affinity"""
        flow_key = self.calculate_flow_key(packet)
        
        # Check if flow already exists
        if flow_key in self.flow_table:
            tunnel_id = self.flow_table[flow_key]
            for tunnel in tunnels:
                if tunnel.id == tunnel_id and tunnel.is_healthy():
                    return tunnel
        
        # New flow - select tunnel using consistent hashing
        hash_value = hashlib.md5(flow_key.encode()).hexdigest()
        tunnel_index = int(hash_value, 16) % len(tunnels)
        selected_tunnel = tunnels[tunnel_index]
        
        # Store flow mapping
        self.flow_table[flow_key] = selected_tunnel.id
        
        return selected_tunnel

class VPNPerformanceBenchmark:
    def __init__(self):
        self.test_scenarios = []
        self.metrics_collector = MetricsCollector()
        self.results_analyzer = ResultsAnalyzer()
        
    def run_comprehensive_benchmark(self, vpn_configs):
        """Run comprehensive performance benchmark"""
        results = {}
        
        for config_name, config in vpn_configs.items():
            print(f"Testing {config_name}...")
            
            # Setup VPN
            vpn = self.setup_vpn(config)
            
            # Run test scenarios
            scenario_results = {}
            for scenario in self.test_scenarios:
                scenario_results[scenario.name] = self.run_scenario(vpn, scenario)
            
            results[config_name] = scenario_results
            
            # Cleanup
            self.cleanup_vpn(vpn)
        
        # Analyze and compare results
        analysis = self.results_analyzer.analyze(results)
        return analysis
    
    def create_test_scenarios(self):
        """Create comprehensive test scenarios"""
        self.test_scenarios = [
            # Throughput tests
            ThroughputTestScenario(
                name='max_throughput',
                packet_sizes=[64, 512, 1024, 1500],
                duration=60,
                threads=4
            ),
            
            # Latency tests
            LatencyTestScenario(
                name='latency_test',
                packet_sizes=[64, 1500],
                measurement_duration=30,
                samples=1000
            ),
            
            # CPU utilization tests
            CPUUtilizationScenario(
                name='cpu_utilization',
                traffic_rates=[100, 500, 1000, 2000],  # Mbps
                measurement_duration=30
            ),
            
            # Concurrent connections test
            ConcurrentConnectionsScenario(
                name='concurrent_connections',
                connection_counts=[100, 500, 1000, 5000],
                hold_time=60
            ),
            
            # Cipher performance test
            CipherPerformanceScenario(
                name='cipher_performance',
                ciphers=['AES-256-GCM', 'ChaCha20-Poly1305', 'AES-128-GCM'],
                packet_size=1500,
                duration=30
            )
        ]
    
    def run_scenario(self, vpn, scenario):
        """Run individual test scenario"""
        # Start metrics collection
        self.metrics_collector.start_collection()
        
        # Execute scenario
        scenario_result = scenario.execute(vpn)
        
        # Stop metrics collection
        metrics = self.metrics_collector.stop_collection()
        
        # Combine results
        result = TestResult(
            scenario_name=scenario.name,
            scenario_result=scenario_result,
            system_metrics=metrics,
            timestamp=time.time()
        )
        
        return result

class ThroughputTestScenario:
    def __init__(self, name, packet_sizes, duration, threads):
        self.name = name
        self.packet_sizes = packet_sizes
        self.duration = duration
        self.threads = threads
    
    def execute(self, vpn):
        """Execute throughput test"""
        results = {}
        
        for packet_size in self.packet_sizes:
            print(f"  Testing packet size: {packet_size} bytes")
            
            # Create test traffic
            traffic_generator = TrafficGenerator(
                packet_size=packet_size,
                threads=self.threads,
                duration=self.duration
            )
            
            # Start traffic generation
            start_time = time.time()
            traffic_stats = traffic_generator.generate_traffic(vpn)
            end_time = time.time()
            
            # Calculate throughput
            duration = end_time - start_time
            throughput_mbps = (traffic_stats.bytes_sent * 8) / (duration * 1000000)
            
            results[packet_size] = {
                'throughput_mbps': throughput_mbps,
                'packets_sent': traffic_stats.packets_sent,
                'packets_received': traffic_stats.packets_received,
                'packet_loss': traffic_stats.calculate_packet_loss(),
                'duration': duration
            }
        
        return results

class CipherPerformanceScenario:
    def execute(self, vpn):
        """Test cipher performance"""
        results = {}
        
        for cipher in self.ciphers:
            print(f"  Testing cipher: {cipher}")
            
            # Configure VPN with specific cipher
            vpn.configure_cipher(cipher)
            
            # Generate test traffic
            traffic_generator = TrafficGenerator(
                packet_size=self.packet_size,
                duration=self.duration
            )
            
            # Measure crypto performance
            crypto_start = time.time()
            cpu_start = self.get_cpu_usage()
            
            traffic_stats = traffic_generator.generate_traffic(vpn)
            
            crypto_end = time.time()
            cpu_end = self.get_cpu_usage()
            
            # Calculate metrics
            crypto_duration = crypto_end - crypto_start
            cpu_usage = cpu_end - cpu_start
            throughput = (traffic_stats.bytes_sent * 8) / (crypto_duration * 1000000)
            
            results[cipher] = {
                'throughput_mbps': throughput,
                'cpu_usage_percent': cpu_usage,
                'crypto_operations_per_second': traffic_stats.packets_sent / crypto_duration,
                'bytes_per_cpu_cycle': traffic_stats.bytes_sent / (cpu_usage * self.get_cpu_frequency())
            }
        
        return results

class VPNOptimizationRecommendations:
    def __init__(self):
        self.performance_analyzer = PerformanceAnalyzer()
        self.configuration_optimizer = ConfigurationOptimizer()
        
    def generate_recommendations(self, benchmark_results, use_case):
        """Generate optimization recommendations based on results"""
        recommendations = []
        
        # Analyze performance characteristics
        analysis = self.performance_analyzer.analyze_results(benchmark_results)
        
        # Protocol selection recommendations
        protocol_rec = self.recommend_protocol(analysis, use_case)
        recommendations.append(protocol_rec)
        
        # Cipher selection recommendations
        cipher_rec = self.recommend_cipher(analysis, use_case)
        recommendations.append(cipher_rec)
        
        # Configuration optimizations
        config_recs = self.recommend_configuration_optimizations(analysis, use_case)
        recommendations.extend(config_recs)
        
        # Infrastructure recommendations
        infra_recs = self.recommend_infrastructure_optimizations(analysis, use_case)
        recommendations.extend(infra_recs)
        
        return recommendations
    
    def recommend_protocol(self, analysis, use_case):
        """Recommend VPN protocol based on use case"""
        if use_case.priority == 'performance':
            if analysis.wireguard_throughput > analysis.ipsec_throughput * 1.2:
                return Recommendation(
                    type='protocol',
                    recommendation='WireGuard',
                    reason='Superior performance characteristics',
                    confidence=0.9
                )
        
        elif use_case.priority == 'compatibility':
            return Recommendation(
                type='protocol',
                recommendation='IPSec',
                reason='Better enterprise compatibility and feature set',
                confidence=0.8
            )
        
        elif use_case.priority == 'simplicity':
            return Recommendation(
                type='protocol',
                recommendation='WireGuard',
                reason='Simpler configuration and management',
                confidence=0.9
            )
        
        # Default recommendation based on balanced analysis
        return self.balanced_protocol_recommendation(analysis)
    
    def recommend_cipher(self, analysis, use_case):
        """Recommend cipher algorithm"""
        cipher_performance = analysis.cipher_performance
        
        # Sort ciphers by performance
        sorted_ciphers = sorted(
            cipher_performance.items(),
            key=lambda x: x[1]['throughput_mbps'],
            reverse=True
        )
        
        best_cipher = sorted_ciphers[0][0]
        
        # Consider security requirements
        if use_case.security_level == 'high':
            if best_cipher in ['AES-256-GCM', 'ChaCha20-Poly1305']:
                return Recommendation(
                    type='cipher',
                    recommendation=best_cipher,
                    reason=f'Best performance with high security: {cipher_performance[best_cipher]["throughput_mbps"]:.1f} Mbps',
                    confidence=0.9
                )
        
        return Recommendation(
            type='cipher',
            recommendation=best_cipher,
            reason=f'Highest throughput: {cipher_performance[best_cipher]["throughput_mbps"]:.1f} Mbps',
            confidence=0.8
        )
    
    def recommend_configuration_optimizations(self, analysis, use_case):
        """Recommend configuration optimizations"""
        recommendations = []
        
        # MTU optimization
        if analysis.packet_loss > 0.01:  # 1% packet loss
            recommendations.append(Recommendation(
                type='configuration',
                recommendation='Reduce MTU size',
                reason='High packet loss detected, likely fragmentation issues',
                confidence=0.7
            ))
        
        # CPU affinity optimization
        if analysis.cpu_utilization > 0.8:
            recommendations.append(Recommendation(
                type='configuration',
                recommendation='Enable CPU affinity and NUMA optimization',
                reason='High CPU utilization detected',
                confidence=0.8
            ))
        
        # Hardware acceleration
        if analysis.crypto_cpu_usage > 0.6:
            recommendations.append(Recommendation(
                type='configuration',
                recommendation='Enable hardware crypto acceleration',
                reason='High crypto CPU usage detected',
                confidence=0.9
            ))
        
        return recommendations