DebTik/internal/firewall/types.go

package firewall

import "time"

// FilterRule represents a MikroTik-style /ip firewall filter rule
type FilterRule struct {
	ID              string   `json:"id"`
	Order           int      `json:"order"`
	Chain           string   `json:"chain"` // input, forward, output, or custom
	Action          string   `json:"action"` // accept, drop, reject, return, jump, log, passthrough
	RejectWith      string   `json:"reject_with,omitempty"` // icmp-network-unreachable, icmp-host-unreachable, tcp-reset, etc.
	JumpTarget      string   `json:"jump_target,omitempty"`
	SrcAddress      string   `json:"src_address,omitempty"` // e.g. 192.168.1.0/24, !10.0.0.1
	DstAddress      string   `json:"dst_address,omitempty"`
	Protocol        string   `json:"protocol,omitempty"` // all, tcp, udp, icmp, etc.
	SrcPort         string   `json:"src_port,omitempty"` // e.g. 80, 80-443, 80,443
	DstPort         string   `json:"dst_port,omitempty"`
	InInterface     string   `json:"in_interface,omitempty"` // e.g. eth0, !eth0, wg0
	OutInterface    string   `json:"out_interface,omitempty"`
	ConnectionState []string `json:"connection_state,omitempty"` // new, established, related, invalid, untracked
	ConnectionMark  string   `json:"connection_mark,omitempty"`
	RoutingMark     string   `json:"routing_mark,omitempty"`
	SrcAddressList  string   `json:"src_address_list,omitempty"`
	DstAddressList  string   `json:"dst_address_list,omitempty"`
	SrcGeoIP        string   `json:"src_geoip,omitempty"`
	DstGeoIP        string   `json:"dst_geoip,omitempty"`
	Log             bool     `json:"log"`
	LogPrefix       string   `json:"log_prefix,omitempty"`
	Comment         string   `json:"comment,omitempty"`
	Disabled        bool     `json:"disabled"`
	Packets         uint64   `json:"packets"`
	Bytes           uint64   `json:"bytes"`

	// Extended WebFig / WinBox v4 properties
	AnyPort            string   `json:"any_port,omitempty"`
	InInterfaceList    string   `json:"in_interface_list,omitempty"`
	OutInterfaceList   string   `json:"out_interface_list,omitempty"`
	PacketMark         string   `json:"packet_mark,omitempty"`
	ConnectionType     string   `json:"connection_type,omitempty"`
	ConnectionNATState []string `json:"connection_nat_state,omitempty"`

	// Advanced tab
	Layer7Protocol   string `json:"layer7_protocol,omitempty"`
	Content          string `json:"content,omitempty"`
	ConnectionBytes  string `json:"connection_bytes,omitempty"`
	ConnectionRate   string `json:"connection_rate,omitempty"`
	PCC              string `json:"pcc,omitempty"`
	SrcMACAddress    string `json:"src_mac_address,omitempty"`
	InBridgePort     string `json:"in_bridge_port,omitempty"`
	OutBridgePort    string `json:"out_bridge_port,omitempty"`
	InBridgePortList string `json:"in_bridge_port_list,omitempty"`
	OutBridgePortList string `json:"out_bridge_port_list,omitempty"`
	IPsecPolicy      string `json:"ipsec_policy,omitempty"`
	TLSHost          string `json:"tls_host,omitempty"`
	IngressPriority  string `json:"ingress_priority,omitempty"`
	Priority         string `json:"priority,omitempty"`
	DSCP             string `json:"dscp,omitempty"`
	TCPMSS           string `json:"tcp_mss,omitempty"`
	TOS              string `json:"tos,omitempty"`
	PacketSize       string `json:"packet_size,omitempty"`
	Random           string `json:"random,omitempty"`
	TCPFlags         string `json:"tcp_flags,omitempty"`
	ICMPOptions      string `json:"icmp_options,omitempty"`
	IPv4Options      string `json:"ipv4_options,omitempty"`
	TTL              string `json:"ttl,omitempty"`

	// Extra tab
	Time     string `json:"time,omitempty"`
	Days     string `json:"days,omitempty"`
	Limit    string `json:"limit,omitempty"`
	DstLimit string `json:"dst_limit,omitempty"`
	PSD      string `json:"psd,omitempty"`

	// Action tab extended
	AddressList        string `json:"address_list,omitempty"`
	AddressListTimeout string `json:"address_list_timeout,omitempty"`
}

// NATRule represents a MikroTik-style /ip firewall nat rule
type NATRule struct {
	ID             string `json:"id"`
	Order          int    `json:"order"`
	Chain          string `json:"chain"` // srcnat, dstnat
	Action         string `json:"action"` // masquerade, src-nat, dst-nat, redirect, accept, return
	ToAddresses    string `json:"to_addresses,omitempty"` // for src-nat or dst-nat
	ToPorts        string `json:"to_ports,omitempty"` // for dst-nat, redirect, src-nat
	SrcAddress     string `json:"src_address,omitempty"`
	DstAddress     string `json:"dst_address,omitempty"`
	Protocol       string `json:"protocol,omitempty"`
	SrcPort        string `json:"src_port,omitempty"`
	DstPort        string `json:"dst_port,omitempty"`
	InInterface    string `json:"in_interface,omitempty"`
	OutInterface   string `json:"out_interface,omitempty"`
	SrcAddressList string `json:"src_address_list,omitempty"`
	DstAddressList string `json:"dst_address_list,omitempty"`
	SrcGeoIP       string `json:"src_geoip,omitempty"`
	DstGeoIP       string `json:"dst_geoip,omitempty"`
	Comment        string `json:"comment,omitempty"`
	Disabled       bool   `json:"disabled"`
	Packets        uint64 `json:"packets"`
	Bytes          uint64 `json:"bytes"`

	// Extended WebFig / WinBox v4 properties
	AnyPort          string `json:"any_port,omitempty"`
	InInterfaceList  string `json:"in_interface_list,omitempty"`
	OutInterfaceList string `json:"out_interface_list,omitempty"`
	PacketMark       string `json:"packet_mark,omitempty"`
	ConnectionMark   string `json:"connection_mark,omitempty"`
	RoutingMark      string `json:"routing_mark,omitempty"`
	ConnectionType   string `json:"connection_type,omitempty"`

	// Advanced tab
	Layer7Protocol    string `json:"layer7_protocol,omitempty"`
	Content           string `json:"content,omitempty"`
	ConnectionBytes   string `json:"connection_bytes,omitempty"`
	ConnectionRate    string `json:"connection_rate,omitempty"`
	PCC               string `json:"pcc,omitempty"`
	SrcMACAddress     string `json:"src_mac_address,omitempty"`
	OutBridgePort     string `json:"out_bridge_port,omitempty"`
	InBridgePort      string `json:"in_bridge_port,omitempty"`
	InBridgePortList  string `json:"in_bridge_port_list,omitempty"`
	OutBridgePortList string `json:"out_bridge_port_list,omitempty"`
	IPsecPolicy       string `json:"ipsec_policy,omitempty"`
	IngressPriority   string `json:"ingress_priority,omitempty"`
	Priority          string `json:"priority,omitempty"`
	DSCP              string `json:"dscp,omitempty"`
	TCPMSS            string `json:"tcp_mss,omitempty"`
	TOS               string `json:"tos,omitempty"`
	PacketSize        string `json:"packet_size,omitempty"`
	Random            string `json:"random,omitempty"`
	ICMPOptions       string `json:"icmp_options,omitempty"`
	IPv4Options       string `json:"ipv4_options,omitempty"`
	TTL               string `json:"ttl,omitempty"`

	// Extra tab
	Time     string `json:"time,omitempty"`
	Days     string `json:"days,omitempty"`
	Limit    string `json:"limit,omitempty"`
	DstLimit string `json:"dst_limit,omitempty"`
	PSD      string `json:"psd,omitempty"`

	// Action tab extended
	Log                bool   `json:"log"`
	LogPrefix          string `json:"log_prefix,omitempty"`
	JumpTarget         string `json:"jump_target,omitempty"`
	AddressList        string `json:"address_list,omitempty"`
	AddressListTimeout string `json:"address_list_timeout,omitempty"`
}

// MangleRule represents a MikroTik-style /ip firewall mangle rule
type MangleRule struct {
	ID                 string   `json:"id"`
	Order              int      `json:"order"`
	Chain              string   `json:"chain"` // prerouting, postrouting, input, output, forward
	Action             string   `json:"action"` // mark-connection, mark-routing, mark-packet, change-mss, set-dscp, accept, return
	NewConnectionMark  string   `json:"new_connection_mark,omitempty"`
	NewRoutingMark     string   `json:"new_routing_mark,omitempty"`
	NewPacketMark      string   `json:"new_packet_mark,omitempty"`
	NewMSS             string   `json:"new_mss,omitempty"` // e.g. "1440" or "clamp-to-pmtu"
	NewDSCP            int      `json:"new_dscp,omitempty"`
	NewTTL             string   `json:"new_ttl,omitempty"`
	NewPriority        string   `json:"new_priority,omitempty"`
	Route              string   `json:"route,omitempty"`
	SniffTarget        string   `json:"sniff_target,omitempty"`
	Passthrough        bool     `json:"passthrough"` // default true in MikroTik
	SrcAddress         string   `json:"src_address,omitempty"`
	DstAddress         string   `json:"dst_address,omitempty"`
	Protocol           string   `json:"protocol,omitempty"`
	SrcPort            string   `json:"src_port,omitempty"`
	DstPort            string   `json:"dst_port,omitempty"`
	InInterface        string   `json:"in_interface,omitempty"`
	OutInterface       string   `json:"out_interface,omitempty"`
	ConnectionState    []string `json:"connection_state,omitempty"`
	ConnectionMark     string   `json:"connection_mark,omitempty"`
	RoutingMark        string   `json:"routing_mark,omitempty"`
	SrcAddressList     string   `json:"src_address_list,omitempty"`
	DstAddressList     string   `json:"dst_address_list,omitempty"`
	SrcGeoIP           string   `json:"src_geoip,omitempty"`
	DstGeoIP           string   `json:"dst_geoip,omitempty"`
	Comment            string   `json:"comment,omitempty"`
	Disabled           bool     `json:"disabled"`
	Packets            uint64   `json:"packets"`
	Bytes              uint64   `json:"bytes"`

	// Extended WebFig / WinBox v4 properties
	AnyPort            string   `json:"any_port,omitempty"`
	InInterfaceList    string   `json:"in_interface_list,omitempty"`
	OutInterfaceList   string   `json:"out_interface_list,omitempty"`
	PacketMark         string   `json:"packet_mark,omitempty"`
	ConnectionType     string   `json:"connection_type,omitempty"`
	ConnectionNATState []string `json:"connection_nat_state,omitempty"`

	// Advanced tab
	Layer7Protocol    string `json:"layer7_protocol,omitempty"`
	Content           string `json:"content,omitempty"`
	ConnectionBytes   string `json:"connection_bytes,omitempty"`
	ConnectionRate    string `json:"connection_rate,omitempty"`
	PCC               string `json:"pcc,omitempty"`
	SrcMACAddress     string `json:"src_mac_address,omitempty"`
	OutBridgePort     string `json:"out_bridge_port,omitempty"`
	InBridgePort      string `json:"in_bridge_port,omitempty"`
	InBridgePortList  string `json:"in_bridge_port_list,omitempty"`
	OutBridgePortList string `json:"out_bridge_port_list,omitempty"`
	IPsecPolicy       string `json:"ipsec_policy,omitempty"`
	TLSHost           string `json:"tls_host,omitempty"`
	IngressPriority   string `json:"ingress_priority,omitempty"`
	Priority          string `json:"priority,omitempty"`
	DSCP              string `json:"dscp,omitempty"`
	TCPMSS            string `json:"tcp_mss,omitempty"`
	TOS               string `json:"tos,omitempty"`
	PacketSize        string `json:"packet_size,omitempty"`
	Random            string `json:"random,omitempty"`
	TCPFlags          string `json:"tcp_flags,omitempty"`
	ICMPOptions       string `json:"icmp_options,omitempty"`
	IPv4Options       string `json:"ipv4_options,omitempty"`
	TTL               string `json:"ttl,omitempty"`

	// Extra tab
	Nth             string `json:"nth,omitempty"`
	ConnectionLimit string `json:"connection_limit,omitempty"`
	SrcAddressType  string `json:"src_address_type,omitempty"`
	DstAddressType  string `json:"dst_address_type,omitempty"`
	Hotspot         string `json:"hotspot,omitempty"`
	IPFragment      string `json:"ip_fragment,omitempty"`
	Limit           string `json:"limit,omitempty"`
	DstLimit        string `json:"dst_limit,omitempty"`
	Time            string `json:"time,omitempty"`
	PSD             string `json:"psd,omitempty"`

	// Action tab extended
	Log                bool   `json:"log"`
	LogPrefix          string `json:"log_prefix,omitempty"`
	JumpTarget         string `json:"jump_target,omitempty"`
	AddressList        string `json:"address_list,omitempty"`
	AddressListTimeout string `json:"address_list_timeout,omitempty"`
}

// AddressListEntry represents a MikroTik /ip firewall address-list entry
type AddressListEntry struct {
	ID       string `json:"id"`
	Name     string `json:"name"`    // list name, e.g. "LAN_Subnets", "Blocked"
	Address  string `json:"address"` // IP or CIDR, e.g. "192.168.1.0/24"
	Comment  string `json:"comment,omitempty"`
	Disabled bool   `json:"disabled"`
}

// GeoCountryInfo represents a Geo-Location country entry in the firewall
type GeoCountryInfo struct {
	Code        string `json:"code"`         // e.g. "GR"
	Name        string `json:"name"`         // e.g. "Greece"
	Continent   string `json:"continent"`    // e.g. "Europe"
	SubnetCount int    `json:"subnet_count"` // number of CIDR subnets
	Enabled     bool   `json:"enabled"`      // enabled in firewall (mk_geo_XX)
	IPSetName   string `json:"ipset_name"`   // e.g. "mk_geo_GR"
	LastUpdated time.Time `json:"last_updated,omitempty"`
}

// ActiveConnection represents an active flow from /proc/net/nf_conntrack / conntrack table
type ActiveConnection struct {
	ID               string `json:"id"`
	Protocol         string `json:"protocol"`
	SrcAddress       string `json:"src_address"`
	SrcPort          int    `json:"src_port"`
	DstAddress       string `json:"dst_address"`
	DstPort          int    `json:"dst_port"`
	ReplySrcAddress  string `json:"reply_src_address"`
	ReplySrcPort     int    `json:"reply_src_port"`
	ReplyDstAddress  string `json:"reply_dst_address"`
	ReplyDstPort     int    `json:"reply_dst_port"`
	TCPState         string `json:"tcp_state"`
	Timeout          int    `json:"timeout"`
	ConnectionMark   string `json:"connection_mark,omitempty"`
	Assured          bool   `json:"assured"`
	Bytes            uint64 `json:"bytes,omitempty"`
	Packets          uint64 `json:"packets,omitempty"`
}

// FirewallSummary contains total rule and connection counts
type FirewallSummary struct {
	FilterRulesCount  int `json:"filter_rules_count"`
	NATRulesCount     int `json:"nat_rules_count"`
	MangleRulesCount  int `json:"mangle_rules_count"`
	AddressListsCount int `json:"address_lists_count"`
	GeoCountriesCount int `json:"geo_countries_count"`
	GeoSubnetsCount   int `json:"geo_subnets_count"`
	ActiveConnections int `json:"active_connections"`
}