Firewall refactoring

- Ability to enable and disable rules in various loops
- Simplified code overall
- Port forwarding moved into openvpn loop
- Route addition and removal improved

internal/firewall/firewall.go

@@ -3,42 +3,49 @@ package firewall
 import (
 	"context"
 	"net"
+	"sync"
 
 	"github.com/qdm12/golibs/command"
 	"github.com/qdm12/golibs/files"
 	"github.com/qdm12/golibs/logging"
 	"github.com/qdm12/private-internet-access-docker/internal/models"
+	"github.com/qdm12/private-internet-access-docker/internal/routing"
 )
 
 // Configurator allows to change firewall rules and modify network routes
 type Configurator interface {
 	Version(ctx context.Context) (string, error)
-	AcceptAll(ctx context.Context) error
-	Clear(ctx context.Context) error
-	BlockAll(ctx context.Context) error
-	CreateGeneralRules(ctx context.Context) error
-	CreateVPNRules(ctx context.Context, dev models.VPNDevice, defaultInterface string, connections []models.OpenVPNConnection) error
-	CreateLocalSubnetsRules(ctx context.Context, subnet net.IPNet, extraSubnets []net.IPNet, defaultInterface string) error
-	AllowInputTrafficOnPort(ctx context.Context, device models.VPNDevice, port uint16) error
-	AllowAnyIncomingOnPort(ctx context.Context, port uint16) error
-	RunUserPostRules(ctx context.Context, fileManager files.FileManager, filepath string) error
-	Disable()
+	SetEnabled(ctx context.Context, enabled bool) (err error)
+	SetVPNConnections(ctx context.Context, connections []models.OpenVPNConnection) (err error)
+	SetAllowedSubnets(ctx context.Context, subnets []net.IPNet) (err error)
+	SetAllowedPort(ctx context.Context, port uint16) error
+	RemoveAllowedPort(ctx context.Context, port uint16) (err error)
+	SetPortForward(ctx context.Context, port uint16) (err error)
 }
 
-type configurator struct {
-	commander command.Commander
-	logger    logging.Logger
-	disabled  bool
+type configurator struct { //nolint:maligned
+	commander     command.Commander
+	logger        logging.Logger
+	routing       routing.Routing
+	fileManager   files.FileManager // for custom iptables rules
+	iptablesMutex sync.Mutex
+
+	// State
+	enabled        bool
+	vpnConnections []models.OpenVPNConnection
+	allowedSubnets []net.IPNet
+	allowedPorts   map[uint16]struct{}
+	portForwarded  uint16
+	stateMutex     sync.Mutex
 }
 
 // NewConfigurator creates a new Configurator instance
-func NewConfigurator(logger logging.Logger) Configurator {
+func NewConfigurator(logger logging.Logger, routing routing.Routing, fileManager files.FileManager) Configurator {
 	return &configurator{
-		commander: command.NewCommander(),
-		logger:    logger.WithPrefix("firewall configurator: "),
+		commander:    command.NewCommander(),
+		logger:       logger.WithPrefix("firewall: "),
+		routing:      routing,
+		fileManager:  fileManager,
+		allowedPorts: make(map[uint16]struct{}),
 	}
 }
-
-func (c *configurator) Disable() {
-	c.disabled = true
-}