package config

import "fmt"

type StoppedAction string

const (
	StoppedAccept  StoppedAction = "accept"
	StoppedNoTrack StoppedAction = "notrack"
	StoppedDrop    StoppedAction = "drop"
)

// StoppedRule defines traffic that is permitted when the firewall is stopped
// or being stopped. Without these rules, all traffic is blocked in the
// stopped state.
type StoppedRule struct {
	Action StoppedAction `yaml:"action"`

	// Source: $FW (firewall), interface name, or interface:address.
	Source string `yaml:"source,omitempty"`

	// Dest: $FW (firewall), interface name, or interface:address.
	// May not be specified with NOTRACK or DROP actions.
	Dest string `yaml:"dest,omitempty"`

	Proto string   `yaml:"proto,omitempty"`
	DPort PortSpec `yaml:"dport,omitempty"`
	SPort PortSpec `yaml:"sport,omitempty"`

	Comment string `yaml:"comment,omitempty"`
}

var validStoppedActions = map[StoppedAction]bool{
	StoppedAccept: true, StoppedNoTrack: true, StoppedDrop: true,
}

func (c *Config) validateStoppedRules() error {
	for i, r := range c.StoppedRules {
		if !validStoppedActions[r.Action] {
			return fmt.Errorf("stoppedrules[%d]: unknown action %q", i, r.Action)
		}

		if r.Source == "" && r.Dest == "" {
			return fmt.Errorf("stoppedrules[%d]: source or dest required", i)
		}

		if (r.Action == StoppedNoTrack || r.Action == StoppedDrop) && r.Dest != "" && r.Dest != "-" {
			if r.Dest != "" && r.Dest != "-" {
				srcIsIface := r.Source != "" && r.Source != "$FW" && r.Source != "-"
				destIsIface := r.Dest != "$FW"
				if srcIsIface && destIsIface {
					return fmt.Errorf("stoppedrules[%d]: dest not allowed with %s action (except $FW)", i, r.Action)
				}
			}
		}
	}
	return nil
}