package config

import "fmt"

type BlruleAction string

const (
	BlruleAccept    BlruleAction = "accept"
	BlruleWhitelist BlruleAction = "whitelist"
	BlruleDrop      BlruleAction = "drop"
	BlruleReject    BlruleAction = "reject"
	BlruleLog       BlruleAction = "log"
	BlruleContinue  BlruleAction = "continue"
	BlruleNFQueue   BlruleAction = "nfqueue"
)

// BlruleRule defines a blacklist/whitelist rule.
// Processed before normal rules; ACCEPT/WHITELIST/CONTINUE exempt matching
// traffic from remaining blacklist rules.
type BlruleRule struct {
	Action BlruleAction `yaml:"action"`

	Source string `yaml:"source"`
	Dest   string `yaml:"dest"`

	Proto string   `yaml:"proto,omitempty"`
	DPort PortSpec `yaml:"dport,omitempty"`
	SPort PortSpec `yaml:"sport,omitempty"`

	Log string `yaml:"log,omitempty"`

	// NFQUEUE number (only for nfqueue action).
	NFQueue int `yaml:"nfqueue,omitempty"`

	Comment string `yaml:"comment,omitempty"`
}

var validBlruleActions = map[BlruleAction]bool{
	BlruleAccept: true, BlruleWhitelist: true,
	BlruleDrop: true, BlruleReject: true,
	BlruleLog: true, BlruleContinue: true,
	BlruleNFQueue: true,
}

func (c *Config) validateBlrules() error {
	for i, r := range c.Blrules {
		if !validBlruleActions[r.Action] {
			return fmt.Errorf("blrules[%d]: unknown action %q", i, r.Action)
		}

		if r.Source == "" {
			return fmt.Errorf("blrules[%d]: source required", i)
		}
		if r.Dest == "" {
			return fmt.Errorf("blrules[%d]: dest required", i)
		}

		if r.Source != "all" && r.Source != "any" && r.Source != "none" &&
			!hasPrefix(r.Source, "all!") && !hasPrefix(r.Source, "any!") {
			srcZone := zoneFromSpec(r.Source)
			if _, ok := c.Zones[srcZone]; !ok {
				return fmt.Errorf("blrules[%d]: source zone %q not defined", i, srcZone)
			}
		}

		if r.Dest != "all" && r.Dest != "any" && r.Dest != "none" &&
			!hasPrefix(r.Dest, "all!") && !hasPrefix(r.Dest, "any!") {
			dstZone := zoneFromSpec(r.Dest)
			if _, ok := c.Zones[dstZone]; !ok {
				return fmt.Errorf("blrules[%d]: dest zone %q not defined", i, dstZone)
			}
		}
	}
	return nil
}