RouterOS/RouterOSAssistant/Core/Models/FirewallConfig.swift

import Foundation

struct FirewallRuleCounts: Equatable {
    var filterRuleCount: Int
    var natRuleCount: Int
}

/// A safe-default firewall + NAT preset, standard Mikrotik best practice (matches the ruleset
/// shipped in RouterOS' own factory-default home-router configurations, unchanged across
/// RouterOS versions for well over a decade): NAT/masquerade the WAN interface, allow
/// established/related traffic, drop invalid packets, and drop unsolicited connections
/// arriving from the WAN that aren't destination-NATed (i.e. not an explicit port forward).
///
/// Every rule gets an incrementing `place-before` so it lands ahead of whatever the router
/// already has in that chain (filter and NAT are separate, independently numbered lists) —
/// otherwise, on a device that already has firewall rules, a pre-existing catch-all rule
/// earlier in the chain could make our rules unreachable.
struct FirewallConfig: Equatable {
    /// One configured LAN/VLAN network, for the pairwise isolation rules below.
    struct NetworkSegment: Equatable {
        var interfaceName: String
        var isolated: Bool
        /// CIDR range (e.g. "192.168.88.0/24") — not used for the filter rules themselves
        /// (those match on interface, not address), only for `isolatedNetworkPairs`, which
        /// `SetupViewModel.apply()` uses to flush already-open connections between two networks
        /// that just became isolated (bugs.md #7 / Gitea #19). Empty for a network with no
        /// address filled in yet (e.g. mid-wizard-editing) — such a network is simply skipped by
        /// the connection-flush, same as it already is by the isolation filter rules once
        /// applied (an unreachable address isolates itself).
        var networkAddress: String = ""
    }

    var wanInterface: String
    var networks: [NetworkSegment] = []

    func buildCommands() -> [RouterOSCommand] {
        let natCommand = RouterOSCommand.add(
            menuPath: "/ip firewall nat",
            restPath: "ip/firewall/nat",
            arguments: [
                "chain": "srcnat",
                "out-interface": wanInterface,
                "action": "masquerade",
                "place-before": "0"
            ],
            summary: "Internetfreigabe (NAT/Masquerade) über \(wanInterface) einrichten"
        )

        let filterRules: [(arguments: [String: String], summary: String)] = [
            (
                ["chain": "input", "connection-state": "established,related", "action": "accept"],
                "Bestehende Verbindungen zum Router erlauben"
            ),
            (
                ["chain": "input", "connection-state": "invalid", "action": "drop"],
                "Ungültige Pakete zum Router verwerfen"
            ),
            (
                ["chain": "input", "in-interface": wanInterface, "protocol": "icmp", "action": "accept"],
                "Ping (ICMP) vom Internet zum Router erlauben"
            ),
            (
                ["chain": "input", "in-interface": wanInterface, "action": "drop"],
                "Restlichen Zugriff vom Internet auf den Router blockieren"
            ),
            (
                ["chain": "forward", "connection-state": "established,related", "action": "accept"],
                "Bestehende Verbindungen durch den Router erlauben"
            ),
            (
                ["chain": "forward", "connection-state": "invalid", "action": "drop"],
                "Ungültige Pakete verwerfen"
            ),
            (
                [
                    "chain": "forward",
                    "connection-state": "new",
                    "connection-nat-state": "!dstnat",
                    "in-interface": wanInterface,
                    "action": "drop"
                ],
                "Unaufgeforderte Verbindungen aus dem Internet zu Geräten im Heimnetz blockieren"
            )
        ]

        let filterCommands = filterRules.enumerated().map { index, rule -> RouterOSCommand in
            var arguments = rule.arguments
            arguments["place-before"] = "\(index)"
            return RouterOSCommand.add(
                menuPath: "/ip firewall filter",
                restPath: "ip/firewall/filter",
                arguments: arguments,
                summary: rule.summary
            )
        }

        let isolationCommands = buildIsolationCommands(startingPlaceBefore: filterCommands.count)

        return [natCommand] + filterCommands + isolationCommands
    }

    /// Every pair of networks where at least one side is marked `isolated`, deduplicated so two
    /// mutually isolated networks still only produce one pair, not two. Shared by
    /// `buildIsolationCommands` (drop rules, by interface) and `SetupViewModel.apply()`'s
    /// post-apply connection-flush (by address range, bugs.md #7 / Gitea #19) — kept as one
    /// source of truth so the two can never disagree about which pairs count as isolated.
    var isolatedNetworkPairs: [(NetworkSegment, NetworkSegment)] {
        var seenPairs = Set<Set<String>>()
        var pairs: [(NetworkSegment, NetworkSegment)] = []

        for network in networks where network.isolated {
            for other in networks where other.interfaceName != network.interfaceName {
                let pair = Set([network.interfaceName, other.interfaceName])
                guard !seenPairs.contains(pair) else { continue }
                seenPairs.insert(pair)
                pairs.append((network, other))
            }
        }

        return pairs
    }

    /// Forward-drop rules between every isolated network pair (both directions).
    private func buildIsolationCommands(startingPlaceBefore: Int) -> [RouterOSCommand] {
        var commands: [RouterOSCommand] = []
        var placeBefore = startingPlaceBefore

        for (network, other) in isolatedNetworkPairs {
            for (from, to) in [(network.interfaceName, other.interfaceName), (other.interfaceName, network.interfaceName)] {
                commands.append(
                    RouterOSCommand.add(
                        menuPath: "/ip firewall filter",
                        restPath: "ip/firewall/filter",
                        arguments: [
                            "chain": "forward",
                            "in-interface": from,
                            "out-interface": to,
                            "action": "drop",
                            "place-before": "\(placeBefore)"
                        ],
                        summary: "Netzwerk \"\(from)\" von \"\(to)\" isolieren"
                    )
                )
                placeBefore += 1
            }
        }

        return commands
    }
}