core

type ADD_RULE_DIR = uint8

type ChainCreator func(chainType string, chainName string, tableType string, tableName string) (IIPTablesChain, error)

type IIPTablesChain interface {
	SetLogger(logger types.ILogger)

	SetRuleDef(target string) error
	ListRules() ([]Rule, error)
	ListRulesByIface(iface string) ([]Rule, error)
	Clear() error
	ClearRulesByIface(iface string) error

	GetCachedRules() []Rule
	CacheRuleIndex(rule *Rule) int
	CacheRuleExist(rule *Rule) bool
	ClearCacheRule()
	DelCacheRule(rule *Rule) (old *Rule)
	AddCacheRule(rule *Rule) bool          // append
	AddCacheRuleUnique(rule *Rule) bool    // append if not exist
	InsertCacheRule(rule *Rule) bool       // insert
	InsertCacheRuleUnique(rule *Rule) bool // insert if not exist

	// tx mode
	BeginTx() IIPTablesChain // return self for chain access a.b().c() 链式访问
	ApplyTx() error

	RuleExist(opts ...RuleOptionFunc) (bool, *Rule, error) // check sys iptables, not check cache
	InsertRule(opts ...RuleOptionFunc) (*Rule, error)      // both sys iptables and cache
	AddRule(opts ...RuleOptionFunc) (*Rule, error)         // both sys iptables and cache
	DelRule(opts ...RuleOptionFunc) (*Rule, error)         // both sys iptables and cache
	DelRuleByHandle(handle uint64) error                   // both sys iptables and cache

	// ### gw1(agent1所在):
	// ##### 允许从 gw2 的子网（10.65.0.0/16）访问 agent1（10.64.0.2）的 ICMP（ping）
	// iptables -A FORWARD -s 10.65.0.0/16 -d 10.64.0.2 -p icmp --icmp-type echo-request -j ACCEPT
	// ##### 允许 agent1（10.64.0.2）回复 ICMP 到 gw2 的子网（10.65.0.0/16）
	// iptables -A FORWARD -s 10.64.0.2 -d 10.65.0.0/16 -p icmp --icmp-type echo-reply -j ACCEPT
	// gw1 上： AddPing("wg0", "eth", "10.65.0.0/16", "10.64.0.2")
	//
	// src/dst can be ip or network: 10.64.0.0/16
	InsertPing(inIface, outIface, dst, src string, opts ...RuleOptionFunc) ([]Rule, error)
	AddPing(inIface, outIface, dst, src string, opts ...RuleOptionFunc) ([]Rule, error)
	DelPing(inIface, outIface, dst, src string, opts ...RuleOptionFunc) ([]Rule, error)
	InsertPingReq(inIface, outIface, dst, src string, opts ...RuleOptionFunc) (*Rule, error)
	AddPingReq(inIface, outIface, dst, src string, opts ...RuleOptionFunc) (*Rule, error)
	DelPingReq(inIface, outIface, dst, src string, opts ...RuleOptionFunc) (*Rule, error)
	InsertPingReply(inIface, outIface, dst, src string, opts ...RuleOptionFunc) (*Rule, error)
	AddPingReply(inIface, outIface, dst, src string, opts ...RuleOptionFunc) (*Rule, error)
	DelPingReply(inIface, outIface, dst, src string, opts ...RuleOptionFunc) (*Rule, error)

	// iptables -A FORWARD -s 10.65.0.2 -d 10.64.0.2 -p tcp --dport 22 -j ACCEPT
	// iptables -A FORWARD -s 10.64.0.2 -d 10.65.0.2 -p tcp --sport 22 -j ACCEPT
	InsertProtocol(inIface, outIface, protocol string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	AddProtocol(inIface, outIface, protocol string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	DelProtocol(inIface, outIface, protocol string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	InsertTcp(inIface, outIface string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	AddTcp(inIface, outIface string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	DelTcp(inIface, outIface string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	InsertUdp(inIface, outIface string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	AddUdp(inIface, outIface string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)
	DelUdp(inIface, outIface string, dst string, dstPort uint16, src string, dir ADD_RULE_DIR, opts ...RuleOptionFunc) ([]Rule, error)

	// iptables -I FORWARD -s 10.64.0.5 -j DROP  # 禁止访问其他目标
	InsertDropSrc(inIface, outIface string, src string, opts ...RuleOptionFunc) (*Rule, error)
	AddDropSrc(inIface, outIface string, src string, opts ...RuleOptionFunc) (*Rule, error)
	DelDropSrc(inIface, outIface string, src string, opts ...RuleOptionFunc) (*Rule, error)
	// iptables -I FORWARD -d 10.64.0.5 -j DROP  # 禁止访问其他目标
	InsertDropDst(inIface, outIface string, dst string, opts ...RuleOptionFunc) (*Rule, error)
	AddDropDst(inIface, outIface string, dst string, opts ...RuleOptionFunc) (*Rule, error)
	DelDropDst(inIface, outIface string, dst string, opts ...RuleOptionFunc) (*Rule, error)

	// iptables -I FORWARD -s 10.64.0.5 -j ACCEPT  # 允许访问其他目标
	InsertAcceptSrc(inIface, outIface string, src string, opts ...RuleOptionFunc) (*Rule, error)
	AddAcceptSrc(inIface, outIface string, src string, opts ...RuleOptionFunc) (*Rule, error)
	DelAcceptSrc(inIface, outIface string, src string, opts ...RuleOptionFunc) (*Rule, error)
	// iptables -I FORWARD -d 10.64.0.5 -j ACCEPT  # 允许访问其他目标
	InsertAcceptDst(inIface, outIface string, dst string, opts ...RuleOptionFunc) (*Rule, error)
	AddAcceptDst(inIface, outIface string, dst string, opts ...RuleOptionFunc) (*Rule, error)
	DelAcceptDst(inIface, outIface string, dst string, opts ...RuleOptionFunc) (*Rule, error)

	InsertAccept(inIface, outIface string, dst string, src string, opts ...RuleOptionFunc) (*Rule, error)
	AddAccept(inIface, outIface string, dst string, src string, opts ...RuleOptionFunc) (*Rule, error)
	DelAccept(inIface, outIface string, dst string, src string, opts ...RuleOptionFunc) (*Rule, error)

	InsertDrop(inIface, outIface string, dst string, src string, opts ...RuleOptionFunc) (*Rule, error)
	AddDrop(inIface, outIface string, dst string, src string, opts ...RuleOptionFunc) (*Rule, error)
	DelDrop(inIface, outIface string, dst string, src string, opts ...RuleOptionFunc) (*Rule, error)

	SetRuleDefAccept() error
	SetRuleDefDrop() error
}

type IIPTablesTable interface {
	SetLogger(logger types.ILogger)

	ClearRules() error
	GetTableName() string
	GetTableType() string
	// input/output/forward是默认就有的chain，不需要我们去创建
	GetDefInputChain() (IIPTablesChain, error)
	GetDefOutputChain() (IIPTablesChain, error)
	GetDefForwardChain() (IIPTablesChain, error)
	// if chainName is empty, then use chainType
	GetChain(chainType string, chainName string) (IIPTablesChain, error)
	// customized chain, 需要创建, 它有类型吗？没有吧?
	//> sudo iptables -N USER_A
	//> sudo iptables -A USER_A -s 10.1.1.0/24 -j ACCEPT
	//> sudo iptables -A FORWARD -j USER_A
	GetCustomChain(chainName string) (IIPTablesChain, error)
	DelCustomChain(chainName string) error
}

type IIptablesService interface {
	Init() error
	Apply() error

	GetDefTable() (IIPTablesTable, error)
	GetDefNatTable() (IIPTablesTable, error)
	GetTable(tableType string, table string) (IIPTablesTable, error)

	CreateTable(tableType string, table string) (IIPTablesTable, error)

	ClearAll() error
	Close() error
}

type IPOption struct {
	IP    string
	Cidr  *ip_util.CidrIp //
	Range *IPRange        // 复杂的规则一般都是在--match/-m 里面定义的
	List  []string        // TODO: DstCidr dstList and dst 只能取其一,因为单个地址其实是可以放在list里面的，
}

type IPRange struct {
	Min string
	Max string
}

type IPTablesBaseTable struct {
	Logger types.ILogger

	TableType    string // TableType and Table can be the same
	Table        string
	ChainCreator ChainCreator
	Chains       map[string]IIPTablesChain // key is chainName
}

type IPTablesChainBase struct {
	IIPTablesChain
	Logger types.ILogger

	TableType string // TableType and Table can be the same
	ChainType string // ChainType and Chain can be the same

	Table string
	Chain string

	Rules []Rule
	// contains filtered or unexported fields
}

type IPTablesServiceBase struct {
	IIptablesService
	Logger types.ILogger

	Tables map[string]IIPTablesTable
	// contains filtered or unexported fields
}

type MatchModule struct {
	Name   string         `json:"name"`   // 模块名称，如state, multiport, conntrack等
	Params map[string]any `json:"params"` // 模块参数
}

type PortOption struct {
	Port  uint16     // single port mode
	Range *PortRange //
	List  []uint16   //
}

type PortRange struct {
	Min uint16
	Max uint16
}

type RULE_LOGIC = string

type RULE_OP = string

type RULE_OP_OR_LOGIC = string

type Rule struct {
	// Chain is the name of the chain that contains this rule
	Chain string

	// Rule is the rule in standard nftables syntax. (Should be empty on Delete, but
	// is ignored if not.) Note that this does not include any rule comment, which is
	// separate from the rule itself.
	Rule string

	// Comment is an optional comment for the rule.
	Comment *string

	// Index is the number of a rule (counting from 0) to Add this Rule after or
	// Insert it before. Cannot be specified along with Handle. If neither Index
	// nor Handle is specified then Add appends the rule the end of the chain and
	// Insert prepends it to the beginning.
	Index *uint64

	// Handle is a rule handle. In Add or Insert, if set, this is the handle of
	// existing rule to put the new rule after/before. In Delete or Replace, this
	// indicates the existing rule to delete/replace, and is mandatory. In the result
	// of a List, this will indicate the rule's handle that can then be used in a
	// later operation.
	Handle *uint64

	RuleOpts *RuleOption

	// MD5 ?
	RuleChecksum string
}

type RuleComplex[T any] struct {
	Logic RULE_LOGIC // and/or
	Rules []T
}

type RuleDateRange struct {
	Min string //
	Max string //
}

type RuleDay struct {
	Op    RULE_OP
	Value int16 // 0-6
}

type RuleDayComplex RuleComplex[RuleDay]

type RuleHour struct {
	Op     RULE_OP
	Value  string // 17:00:01
	Ts     int64  // total seconds, parse to string
	Hour   int16  // 0-24
	Minute int16  // 0-59
	Second int16  // 0-59
}

type RuleHourComplex RuleComplex[RuleHour]

type RuleHourRange struct {
	Min uint32 // seconds
	Max uint32 // seconds
}

type RuleOption struct {
	IsDef bool // -P

	InIface  string
	OutIface string
	Protocol string
	Dst      *IPOption
	DstPort  *PortOption
	Src      *IPOption // single ip or cidrIp
	SrcPort  *PortOption
	CtState  byte // -m conntrack --ctstate ESTABLISHED,RELATED
	State    byte // -m state --state ESTABLISHED,RELATED
	Target   string

	// -p icmp --icmp-type echo-request
	ProtocolExtraStr  *string
	ProtocolExtraByte *byte

	// demo time/day/hour:
	// add rule ip filter input tcp dport 22 time hour >= 9 and time hour < 17 accept
	// nftables（v1.0.0+）​​ 中 ​不再强制要求 time 关键字，可以直接使用 day、hour、weekday 等字段。但仍然建议加上 time 以提高可读性，并确保兼容性。
	//
	// time < "2019-06-06 17:00" drop;
	// time < "2019-06-06 17:20:20" drop;
	// time < 12341234 drop;
	// day == "Saturday" drop;
	// day == 6 drop;
	// hour >= 17:00 drop;
	// hour >= "17:00:01" drop;
	// hour >= 63000 drop;
	//
	// integer: ns since epoch, or
	// string: date in ISO format.
	// When an integer is specified, it is assumed to be a UNIX timestamp.
	// "2019-06-06" = "2019-06-06 00:00" = "2019-06-06 00:00:00".
	//
	// integer: 0 = Sunday to 6 = Saturday, or
	// case-insensitive string: "Monday", "tuesday", etc. Unique abbreviations also work: "fri", "Sat".
	// 24-hour "HH:MM:SS", with seconds optional. 17:00 = 17:00:0
	//
	// iptables : --timestart 00:01,--timestop 00:01,--weekdays Sun,Mon
	Time *TimeOption

	// match fields(-m, --match)
	M_mac     map[string]any   //
	M_tcp_udp map[string]any   //
	M_limit   map[string]any   //
	M_other   []map[string]any //
	M_iprange map[string]any   // --src-range,--dst-range
}

type RuleOptionFunc func(*RuleOption)

type RuleTime struct {
	Op    RULE_OP
	Value string // 2019-06-06 17:20:20
	Ts    int64  // unix timestamp
}

type RuleTimeComplex RuleComplex[RuleTime]

type ServiceTool struct {
	// contains filtered or unexported fields
}

type TableCreator func(tableType string, tableName string) (IIPTablesTable, error)

type TimeOption struct {
	UTC       *bool
	HourRange *RuleHourRange // seconds, 00:01, TimeStart/TimeStop
	DateRange *RuleDateRange // DateStart/DateStop
	// for nftables: Sunday=0, Saturday=6;
	// for iptables, Mon=1,Sun=7;
	// 字符格式两个都支持,但是iptables支持的字符格式严格
	// 1-6表示的是一样，区别是0/7， 也就是0=7=Sunday
	WeekDays  []uint16
	MonthDays []uint16 // iptables 支持，我们暂时不需要

	// TODO: BELLOWs, nftables may be support, but iptables not support
	Time        *RuleTime // uint64 // timestamp of packet reception,
	TimeComplex *RuleTimeComplex
	Day         *RuleDay         // day of week
	DayComplex  *RuleDayComplex  // TODO:
	Hour        *RuleHour        // uint16 // hour of day
	HourComplex *RuleHourComplex // TODO:
}