package firewall

import "time"

// FilterRule represents a Linux firewall filter rule
type FilterRule struct {
	IPVersion       int      `json:"ip_version,omitempty"`
	ID              string   `json:"id"`
	Order           int      `json:"order"`
	Chain           string   `json:"chain"`                 // input, forward, output, or custom
	Action          string   `json:"action"`                // accept, drop, reject, return, jump, log, passthrough
	RejectWith      string   `json:"reject_with,omitempty"` // icmp-network-unreachable, icmp-host-unreachable, tcp-reset, etc.
	JumpTarget      string   `json:"jump_target,omitempty"`
	SrcAddress      string   `json:"src_address,omitempty"` // e.g. 192.168.1.0/24, !10.0.0.1
	DstAddress      string   `json:"dst_address,omitempty"`
	Protocol        string   `json:"protocol,omitempty"` // all, tcp, udp, icmp, etc.
	SrcPort         string   `json:"src_port,omitempty"` // e.g. 80, 80-443, 80,443
	DstPort         string   `json:"dst_port,omitempty"`
	InInterface     string   `json:"in_interface,omitempty"` // e.g. eth0, !eth0, wg0
	OutInterface    string   `json:"out_interface,omitempty"`
	ConnectionState []string `json:"connection_state,omitempty"` // new, established, related, invalid, untracked
	ConnectionMark  string   `json:"connection_mark,omitempty"`
	RoutingMark     string   `json:"routing_mark,omitempty"`
	SrcAddressList  string   `json:"src_address_list,omitempty"`
	DstAddressList  string   `json:"dst_address_list,omitempty"`
	SrcGeoIP        string   `json:"src_geoip,omitempty"`
	DstGeoIP        string   `json:"dst_geoip,omitempty"`
	Log             bool     `json:"log"`
	LogPrefix       string   `json:"log_prefix,omitempty"`
	Comment         string   `json:"comment,omitempty"`
	Disabled        bool     `json:"disabled"`
	Packets         uint64   `json:"packets"`
	Bytes           uint64   `json:"bytes"`

	// Extended Linux firewall match properties
	AnyPort            string   `json:"any_port,omitempty"`
	InInterfaceList    string   `json:"in_interface_list,omitempty"`
	OutInterfaceList   string   `json:"out_interface_list,omitempty"`
	PacketMark         string   `json:"packet_mark,omitempty"`
	ConnectionType     string   `json:"connection_type,omitempty"`
	ConnectionNATState []string `json:"connection_nat_state,omitempty"`

	// Advanced tab
	Layer7Protocol    string `json:"layer7_protocol,omitempty"`
	Content           string `json:"content,omitempty"`
	ConnectionBytes   string `json:"connection_bytes,omitempty"`
	ConnectionRate    string `json:"connection_rate,omitempty"`
	PCC               string `json:"pcc,omitempty"`
	SrcMACAddress     string `json:"src_mac_address,omitempty"`
	InBridgePort      string `json:"in_bridge_port,omitempty"`
	OutBridgePort     string `json:"out_bridge_port,omitempty"`
	InBridgePortList  string `json:"in_bridge_port_list,omitempty"`
	OutBridgePortList string `json:"out_bridge_port_list,omitempty"`
	IPsecPolicy       string `json:"ipsec_policy,omitempty"`
	TLSHost           string `json:"tls_host,omitempty"`
	IngressPriority   string `json:"ingress_priority,omitempty"`
	Priority          string `json:"priority,omitempty"`
	DSCP              string `json:"dscp,omitempty"`
	TCPMSS            string `json:"tcp_mss,omitempty"`
	TOS               string `json:"tos,omitempty"`
	PacketSize        string `json:"packet_size,omitempty"`
	Random            string `json:"random,omitempty"`
	TCPFlags          string `json:"tcp_flags,omitempty"`
	ICMPOptions       string `json:"icmp_options,omitempty"`
	IPv4Options       string `json:"ipv4_options,omitempty"`
	TTL               string `json:"ttl,omitempty"`

	// Extra tab
	Time     string `json:"time,omitempty"`
	Days     string `json:"days,omitempty"`
	Limit    string `json:"limit,omitempty"`
	DstLimit string `json:"dst_limit,omitempty"`
	PSD      string `json:"psd,omitempty"`

	// Action tab extended
	AddressList        string `json:"address_list,omitempty"`
	AddressListTimeout string `json:"address_list_timeout,omitempty"`
}

// NATRule represents a Linux NAT rule
type NATRule struct {
	IPVersion      int    `json:"ip_version,omitempty"`
	ID             string `json:"id"`
	Order          int    `json:"order"`
	Chain          string `json:"chain"`                  // srcnat, dstnat
	Action         string `json:"action"`                 // masquerade, src-nat, dst-nat, redirect, accept, return
	ToAddresses    string `json:"to_addresses,omitempty"` // for src-nat or dst-nat
	ToPorts        string `json:"to_ports,omitempty"`     // for dst-nat, redirect, src-nat
	SrcAddress     string `json:"src_address,omitempty"`
	DstAddress     string `json:"dst_address,omitempty"`
	Protocol       string `json:"protocol,omitempty"`
	SrcPort        string `json:"src_port,omitempty"`
	DstPort        string `json:"dst_port,omitempty"`
	InInterface    string `json:"in_interface,omitempty"`
	OutInterface   string `json:"out_interface,omitempty"`
	SrcAddressList string `json:"src_address_list,omitempty"`
	DstAddressList string `json:"dst_address_list,omitempty"`
	SrcGeoIP       string `json:"src_geoip,omitempty"`
	DstGeoIP       string `json:"dst_geoip,omitempty"`
	Comment        string `json:"comment,omitempty"`
	Disabled       bool   `json:"disabled"`
	Packets        uint64 `json:"packets"`
	Bytes          uint64 `json:"bytes"`

	// Extended Linux firewall match properties
	AnyPort          string `json:"any_port,omitempty"`
	InInterfaceList  string `json:"in_interface_list,omitempty"`
	OutInterfaceList string `json:"out_interface_list,omitempty"`
	PacketMark       string `json:"packet_mark,omitempty"`
	ConnectionMark   string `json:"connection_mark,omitempty"`
	RoutingMark      string `json:"routing_mark,omitempty"`
	ConnectionType   string `json:"connection_type,omitempty"`

	// Advanced tab
	Layer7Protocol    string `json:"layer7_protocol,omitempty"`
	Content           string `json:"content,omitempty"`
	ConnectionBytes   string `json:"connection_bytes,omitempty"`
	ConnectionRate    string `json:"connection_rate,omitempty"`
	PCC               string `json:"pcc,omitempty"`
	SrcMACAddress     string `json:"src_mac_address,omitempty"`
	OutBridgePort     string `json:"out_bridge_port,omitempty"`
	InBridgePort      string `json:"in_bridge_port,omitempty"`
	InBridgePortList  string `json:"in_bridge_port_list,omitempty"`
	OutBridgePortList string `json:"out_bridge_port_list,omitempty"`
	IPsecPolicy       string `json:"ipsec_policy,omitempty"`
	IngressPriority   string `json:"ingress_priority,omitempty"`
	Priority          string `json:"priority,omitempty"`
	DSCP              string `json:"dscp,omitempty"`
	TCPMSS            string `json:"tcp_mss,omitempty"`
	TOS               string `json:"tos,omitempty"`
	PacketSize        string `json:"packet_size,omitempty"`
	Random            string `json:"random,omitempty"`
	ICMPOptions       string `json:"icmp_options,omitempty"`
	IPv4Options       string `json:"ipv4_options,omitempty"`
	TTL               string `json:"ttl,omitempty"`

	// Extra tab
	Time     string `json:"time,omitempty"`
	Days     string `json:"days,omitempty"`
	Limit    string `json:"limit,omitempty"`
	DstLimit string `json:"dst_limit,omitempty"`
	PSD      string `json:"psd,omitempty"`

	// Action tab extended
	Log                bool   `json:"log"`
	LogPrefix          string `json:"log_prefix,omitempty"`
	JumpTarget         string `json:"jump_target,omitempty"`
	AddressList        string `json:"address_list,omitempty"`
	AddressListTimeout string `json:"address_list_timeout,omitempty"`
}

// MangleRule represents a Linux mangle rule
type MangleRule struct {
	IPVersion         int      `json:"ip_version,omitempty"`
	ID                string   `json:"id"`
	Order             int      `json:"order"`
	Chain             string   `json:"chain"`  // prerouting, postrouting, input, output, forward
	Action            string   `json:"action"` // mark-connection, mark-routing, mark-packet, change-mss, set-dscp, accept, return
	NewConnectionMark string   `json:"new_connection_mark,omitempty"`
	NewRoutingMark    string   `json:"new_routing_mark,omitempty"`
	NewPacketMark     string   `json:"new_packet_mark,omitempty"`
	NewMSS            string   `json:"new_mss,omitempty"` // e.g. "1440" or "clamp-to-pmtu"
	NewDSCP           int      `json:"new_dscp,omitempty"`
	NewTTL            string   `json:"new_ttl,omitempty"`
	NewPriority       string   `json:"new_priority,omitempty"`
	Route             string   `json:"route,omitempty"`
	SniffTarget       string   `json:"sniff_target,omitempty"`
	Passthrough       bool     `json:"passthrough"` // continue evaluating rules after this action
	SrcAddress        string   `json:"src_address,omitempty"`
	DstAddress        string   `json:"dst_address,omitempty"`
	Protocol          string   `json:"protocol,omitempty"`
	SrcPort           string   `json:"src_port,omitempty"`
	DstPort           string   `json:"dst_port,omitempty"`
	InInterface       string   `json:"in_interface,omitempty"`
	OutInterface      string   `json:"out_interface,omitempty"`
	ConnectionState   []string `json:"connection_state,omitempty"`
	ConnectionMark    string   `json:"connection_mark,omitempty"`
	RoutingMark       string   `json:"routing_mark,omitempty"`
	SrcAddressList    string   `json:"src_address_list,omitempty"`
	DstAddressList    string   `json:"dst_address_list,omitempty"`
	SrcGeoIP          string   `json:"src_geoip,omitempty"`
	DstGeoIP          string   `json:"dst_geoip,omitempty"`
	Comment           string   `json:"comment,omitempty"`
	Disabled          bool     `json:"disabled"`
	Packets           uint64   `json:"packets"`
	Bytes             uint64   `json:"bytes"`

	// Extended Linux firewall match properties
	AnyPort            string   `json:"any_port,omitempty"`
	InInterfaceList    string   `json:"in_interface_list,omitempty"`
	OutInterfaceList   string   `json:"out_interface_list,omitempty"`
	PacketMark         string   `json:"packet_mark,omitempty"`
	ConnectionType     string   `json:"connection_type,omitempty"`
	ConnectionNATState []string `json:"connection_nat_state,omitempty"`

	// Advanced tab
	Layer7Protocol    string `json:"layer7_protocol,omitempty"`
	Content           string `json:"content,omitempty"`
	ConnectionBytes   string `json:"connection_bytes,omitempty"`
	ConnectionRate    string `json:"connection_rate,omitempty"`
	PCC               string `json:"pcc,omitempty"`
	SrcMACAddress     string `json:"src_mac_address,omitempty"`
	OutBridgePort     string `json:"out_bridge_port,omitempty"`
	InBridgePort      string `json:"in_bridge_port,omitempty"`
	InBridgePortList  string `json:"in_bridge_port_list,omitempty"`
	OutBridgePortList string `json:"out_bridge_port_list,omitempty"`
	IPsecPolicy       string `json:"ipsec_policy,omitempty"`
	TLSHost           string `json:"tls_host,omitempty"`
	IngressPriority   string `json:"ingress_priority,omitempty"`
	Priority          string `json:"priority,omitempty"`
	DSCP              string `json:"dscp,omitempty"`
	TCPMSS            string `json:"tcp_mss,omitempty"`
	TOS               string `json:"tos,omitempty"`
	PacketSize        string `json:"packet_size,omitempty"`
	Random            string `json:"random,omitempty"`
	TCPFlags          string `json:"tcp_flags,omitempty"`
	ICMPOptions       string `json:"icmp_options,omitempty"`
	IPv4Options       string `json:"ipv4_options,omitempty"`
	TTL               string `json:"ttl,omitempty"`

	// Extra tab
	Nth             string `json:"nth,omitempty"`
	ConnectionLimit string `json:"connection_limit,omitempty"`
	SrcAddressType  string `json:"src_address_type,omitempty"`
	DstAddressType  string `json:"dst_address_type,omitempty"`
	Hotspot         string `json:"hotspot,omitempty"`
	IPFragment      string `json:"ip_fragment,omitempty"`
	Limit           string `json:"limit,omitempty"`
	DstLimit        string `json:"dst_limit,omitempty"`
	Time            string `json:"time,omitempty"`
	Days            string `json:"days,omitempty"`
	PSD             string `json:"psd,omitempty"`

	// Action tab extended
	Log                bool   `json:"log"`
	LogPrefix          string `json:"log_prefix,omitempty"`
	JumpTarget         string `json:"jump_target,omitempty"`
	AddressList        string `json:"address_list,omitempty"`
	AddressListTimeout string `json:"address_list_timeout,omitempty"`
}

// AddressListEntry represents a static firewall address-list entry
type AddressListEntry struct {
	Dynamic  bool   `json:"dynamic,omitempty"`
	Timeout  int    `json:"timeout,omitempty"`
	ID       string `json:"id"`
	Name     string `json:"name"`    // list name, e.g. "LAN_Subnets", "Blocked"
	Address  string `json:"address"` // IP or CIDR, e.g. "192.168.1.0/24"
	Comment  string `json:"comment,omitempty"`
	Disabled bool   `json:"disabled"`
}

// GeoCountryInfo represents a Geo-Location country entry in the firewall
type GeoCountryInfo struct {
	Code        string    `json:"code"`         // e.g. "GR"
	Name        string    `json:"name"`         // e.g. "Greece"
	Continent   string    `json:"continent"`    // e.g. "Europe"
	SubnetCount int       `json:"subnet_count"` // number of CIDR subnets
	Enabled     bool      `json:"enabled"`      // enabled in firewall (mk_geo_XX)
	IPSetName   string    `json:"ipset_name"`   // e.g. "mk_geo_GR"
	LastUpdated time.Time `json:"last_updated,omitempty"`
}

// ActiveConnection represents an active flow from /proc/net/nf_conntrack / conntrack table
type ActiveConnection struct {
	IPVersion       int    `json:"ip_version"`
	Zone            int    `json:"zone"`
	ICMPID          *int   `json:"icmp_id,omitempty"`
	ICMPType        *int   `json:"icmp_type,omitempty"`
	ICMPCode        *int   `json:"icmp_code,omitempty"`
	ID              string `json:"id"`
	Protocol        string `json:"protocol"`
	SrcAddress      string `json:"src_address"`
	SrcPort         int    `json:"src_port"`
	DstAddress      string `json:"dst_address"`
	DstPort         int    `json:"dst_port"`
	ReplySrcAddress string `json:"reply_src_address"`
	ReplySrcPort    int    `json:"reply_src_port"`
	ReplyDstAddress string `json:"reply_dst_address"`
	ReplyDstPort    int    `json:"reply_dst_port"`
	TCPState        string `json:"tcp_state"`
	Timeout         int    `json:"timeout"`
	ConnectionMark  string `json:"connection_mark,omitempty"`
	Assured         bool   `json:"assured"`
	Bytes           uint64 `json:"bytes,omitempty"`
	Packets         uint64 `json:"packets,omitempty"`
}

// FirewallSummary contains total rule and connection counts
type FirewallSummary struct {
	ConnectionsError  string `json:"connections_error,omitempty"`
	Applied           bool   `json:"applied"`
	LastError         string `json:"last_error,omitempty"`
	FilterRulesCount  int    `json:"filter_rules_count"`
	NATRulesCount     int    `json:"nat_rules_count"`
	MangleRulesCount  int    `json:"mangle_rules_count"`
	AddressListsCount int    `json:"address_lists_count"`
	GeoCountriesCount int    `json:"geo_countries_count"`
	GeoSubnetsCount   int    `json:"geo_subnets_count"`
	ActiveConnections int    `json:"active_connections"`
}