refactor: simplify firewall service structure

agent/app/dto/firewall.go

@@ -1,6 +1,9 @@
 package dto
 
-import "github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+import (
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
+	firewallsync "github.com/1Panel-dev/1Panel/agent/utils/firewall/sync"
+)
 
 type FirewallSubsystemStatus struct {
 	Name            string                      `json:"name"`
@@ -245,7 +248,8 @@ type FirewallRuleSyncItem struct {
 	Rule        *filter.FirewallRule     `json:"rule,omitempty"`
 	ForwardRule *ForwardRule             `json:"forwardRule,omitempty"`
 	DockerRule  *DockerPortGuardEndpoint `json:"dockerRule,omitempty"`
-	Status      string                   `json:"status"`
+	Status      firewallsync.Status      `json:"status"`
+	ReasonCode  firewallsync.ReasonCode  `json:"reasonCode,omitempty"`
 	Reason      string                   `json:"reason,omitempty"`
 }
 

agent/app/model/firewall.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall/filter"
@@ -67,6 +68,19 @@ func FirewallRuleOwner(sourceKind, sourceID string) string {
 	return sourceKind + ":" + sourceID
 }
 
+func FirewallRulesRevision(rules []FirewallRule) (string, error) {
+	ordered := append([]FirewallRule(nil), rules...)
+	sort.Slice(ordered, func(i, j int) bool {
+		return ordered[i].UUID < ordered[j].UUID
+	})
+	payload, err := json.Marshal(ordered)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(payload)
+	return hex.EncodeToString(sum[:]), nil
+}
+
 func FirewallRuleFromDomain(rule filter.FirewallRule) (FirewallRule, error) {
 	normalized, err := filter.NormalizeRule(rule)
 	if err != nil {
@@ -115,3 +129,99 @@ func (rule FirewallRule) PolicyKey() string {
 	sum := sha256.Sum256(payload)
 	return hex.EncodeToString(sum[:])
 }
+
+func (rule FirewallRule) RulesForProvider(provider filter.Provider) ([]filter.FirewallRule, error) {
+	if rule.CompatibilityError != "" {
+		return nil, fmt.Errorf("%w: %s", filter.ErrUnsupportedScope, rule.CompatibilityError)
+	}
+	connectionStates := make([]string, 0)
+	if rule.ConnectionStates != "" {
+		connectionStates = strings.Split(rule.ConnectionStates, ",")
+	}
+	base := filter.FirewallRule{
+		Protocol: rule.Protocol, SourceAddress: rule.SourceAddress, SourcePort: rule.SourcePort,
+		DestinationAddress: rule.DestinationAddress, DestinationPort: rule.DestinationPort,
+		Interface: rule.Interface, ConnectionStates: connectionStates,
+		Action: filter.Action(rule.Action), Description: rule.Description,
+	}
+	if provider == filter.ProviderFirewalld {
+		base.Priority = rule.Priority
+	}
+	families := []filter.Family{filter.Family(rule.Family)}
+	if provider != filter.ProviderFirewalld && families[0] == filter.FamilyInet {
+		hasIPv4, hasIPv6 := ruleAddressFamilies(base)
+		switch {
+		case hasIPv4 && hasIPv6:
+			return nil, fmt.Errorf("%w: inet policy contains both IPv4 and IPv6 addresses", filter.ErrUnsupportedScope)
+		case hasIPv6 || strings.EqualFold(base.Protocol, "icmpv6"):
+			families = []filter.Family{filter.FamilyIPv6}
+		case hasIPv4:
+			families = []filter.Family{filter.FamilyIPv4}
+		default:
+			families = []filter.Family{filter.FamilyIPv4, filter.FamilyIPv6}
+		}
+	}
+	result := make([]filter.FirewallRule, 0, len(families))
+	for _, family := range families {
+		compiled := base
+		compiled.Scope = filter.Scope{Provider: provider, Family: family, Direction: filter.DirectionInput}
+		switch provider {
+		case filter.ProviderIptables, filter.ProviderNftables:
+			compiled.Scope.Table, compiled.Scope.Chain = "filter", filter.IptablesInputChain
+		case filter.ProviderFirewalld:
+			compiled.Scope.Zone = filter.FirewalldInputZone
+		case filter.ProviderUFW:
+			compiled.Scope.Chain = filter.UFWInputChain
+		default:
+			return nil, fmt.Errorf("%w: unsupported firewall provider %q", filter.ErrProviderUnavailable, provider)
+		}
+		expanded, err := filter.ExpandAtomicRules(compiled)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, expanded...)
+	}
+	return result, nil
+}
+
+func SortFirewallRules(rules []FirewallRule, provider filter.Provider) {
+	sort.SliceStable(rules, func(i, j int) bool {
+		left, right := rules[i], rules[j]
+		if provider == filter.ProviderFirewalld {
+			switch {
+			case left.Priority == nil && right.Priority != nil:
+				return false
+			case left.Priority != nil && right.Priority == nil:
+				return true
+			case left.Priority != nil && right.Priority != nil && *left.Priority != *right.Priority:
+				return *left.Priority < *right.Priority
+			}
+		} else {
+			switch {
+			case left.Sequence == nil && right.Sequence != nil:
+				return false
+			case left.Sequence != nil && right.Sequence == nil:
+				return true
+			case left.Sequence != nil && right.Sequence != nil && *left.Sequence != *right.Sequence:
+				return *left.Sequence < *right.Sequence
+			}
+		}
+		return left.UUID < right.UUID
+	})
+}
+
+func ruleAddressFamilies(rule filter.FirewallRule) (bool, bool) {
+	hasIPv4, hasIPv6 := false, false
+	for _, address := range []string{rule.SourceAddress, rule.DestinationAddress} {
+		address = strings.TrimSpace(address)
+		if address == "" {
+			continue
+		}
+		if strings.Contains(address, ":") {
+			hasIPv6 = true
+		} else {
+			hasIPv4 = true
+		}
+	}
+	return hasIPv4, hasIPv6
+}