<?php

class FirewallRule extends PhonalisaRecord
{

    public $chain;
    public $protocol;
    public $source;
    public $destination;
    public $sport;
    public $dport;
    public $action;
    public $sort;
    public $active = 1;
    public $comment;

    const CHAIN_INPUT = 'INPUT';
    const CHAIN_OUTPUT = 'OUTPUT';
    const PROTOCOL_ALL = '*';
    const PROTOCOL_TCP = 'tcp';
    const PROTOCOL_UDP = 'udp';
    const PROTOCOL_ICMP = 'icmp';
    const ACTION_ACCEPT = 'ACCEPT';
    const ACTION_DROP = 'DROP';

    public static function myAttributes()
    {
        return array(
            'chain' => 'chain',
            'protocol' => 'protocol',
            'source' => 'source',
            'destination' => 'destination',
            'sport' => 'sport',
            'dport' => 'dport',
            'action' => 'action',
            'sort' => 'sort',
            'active' => 'active',
            'comment' => 'comment'
        );
    }

    /**
     * Returns the static model of the specified AR class.
     * @param string $className active record class name.
     * @return Job the static model class
     */
    public static function model($className = __CLASS__)
    {
        return parent::model($className);
    }

    /**
     * @return array validation rules for model attributes.
     */
    public function rules()
    {
        // NOTE: you should only define rules for those attributes that
        // will receive user inputs.
        return array(
            // The following rule is used by search().
            // Please remove those attributes that should not be searched.
            array('chain, protocol, sport, dport, action, sort, active, comment, source, destination', 'safe'),
            array('chain, sort, protocol, sport, dport, action, active', 'required'),
            array('dport, sport', 'ext.PhonalisaValidators.portInRange')
        );
    }

    /**
     * @return array customized attribute labels (name=>label)
     */
    public function attributeLabels()
    {
        return array(
            'protocol' => __('NETWORK_FIREWALL_MODEL_PROTOCOL'),
            'source' => __('NETWORK_FIREWALL_MODEL_SOURCE'),
            'destination' => __('NETWORK_FIREWALL_MODEL_DESTINATION'),
            'sport' => __('NETWORK_FIREWALL_MODEL_SPORT'),
            'dport' => __('NETWORK_FIREWALL_MODEL_DPORT'),
            'action' => __('NETWORK_FIREWALL_MODEL_ACTION'),
            'active' => __('NETWORK_FIREWALL_MODEL_ACTIVE'),
            'comment' => __('NETWORK_FIREWALL_MODEL_COMMENT')
        );
    }

    /**
     * Retrieves a list of models based on the current search/filter conditions.
     * @return CPhonalisaDataProvider the data provider that can return the models based on the search/filter conditions.
     */
    public function search($chain = FirewallRule::CHAIN_INPUT)
    {
        // Warning: Please modify the following code to remove attributes that
        // should not be searched.

        $newModel = new FirewallRule();
        $arrayModels = FirewallRule::model()->findAllByAttributes(array('chain' => $chain));

        $newModel->id = "new";
        $newModel->sort = "new";
        $newModel->chain = $chain;
        $arrayModels[] = $newModel;

        $count = count($arrayModels);
        $dataProvider = new CArrayDataProvider($arrayModels, array(
            'id' => 'key',
            'sort' => array('defaultOrder' => 'sort ASC',
            ),
            'pagination' => array('pageSize' => $count
            ),
        ));
        return $dataProvider;
    }

    public function getProtocolDataArray()
    {
        return array(
            '' => '---',
            FirewallRule::PROTOCOL_ALL => FirewallRule::PROTOCOL_ALL,
            FirewallRule::PROTOCOL_TCP => FirewallRule::PROTOCOL_TCP,
            FirewallRule::PROTOCOL_UDP => FirewallRule::PROTOCOL_UDP,
            FirewallRule::PROTOCOL_ICMP => FirewallRule::PROTOCOL_ICMP
        );
    }

    public function getActionDataArray()
    {
        return array(
            '' => '---',
            FirewallRule::ACTION_ACCEPT => FirewallRule::ACTION_ACCEPT,
            FirewallRule::ACTION_DROP => FirewallRule::ACTION_DROP
        );
    }

    public static function getFirewallDefaultRules()
    {
        $firewalldefaults = array();

        self::addRule($firewalldefaults, "SSH", "22", FirewallRule::PROTOCOL_TCP, "513-65535");
        self::addRule($firewalldefaults, "HTTP", "80");
        self::addRule($firewalldefaults, "HTTPS", "443");
        self::addRule($firewalldefaults, "HTTPS - DLS", "18443");
        self::addRule($firewalldefaults, "SIP UDP - internal Profile", "5060", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "SIP TCP - internal Profile", "5060");
        self::addRule($firewalldefaults, "SIP - TLS - internal Profile", "5061");
        self::addRule($firewalldefaults, "SIP UDP - external Profile", "5080", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "SIP TCP - external Profile", "5080");
        self::addRule($firewalldefaults, "SIP - TLS - external Profile", "5081");
        self::addRule($firewalldefaults, "RTP", "16384-32768", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "DNS UDP", "53", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "DNS TCP", "53");
        self::addRule($firewalldefaults, "NTP", "123", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "DHCP", "67", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "DHCP", "1193", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "LDAP UDP", "12389", FirewallRule::PROTOCOL_UDP);
        self::addRule($firewalldefaults, "LDAP TCP", "12389");
        self::addRule($firewalldefaults, "Jabber TCP", "5222");
        self::addRule($firewalldefaults, "Jabber TLS", "5223");
        self::addRule($firewalldefaults, "Jabber Server to Server", "5269");
        self::addRule($firewalldefaults, "CTI Server", "28888");
        self::addRule($firewalldefaults, "Phonalisa Connect", "28889");

        self::addRule($firewalldefaults, "Drop everything else inbound", "*", FirewallRule::PROTOCOL_ALL, "*", FirewallRule::ACTION_DROP);

        return $firewalldefaults;
    }

    private static function addRule(&$array, $comment, $dport, $protocol = FirewallRule::PROTOCOL_TCP, $sport = "*", $action = FirewallRule::ACTION_ACCEPT)
    {
        $sort = count($array);
        $firewalldefaults["comment"] = $comment;
        $firewalldefaults["protocol"] = $protocol;
        $firewalldefaults["dport"] = $dport;
        $firewalldefaults["sport"] = $sport;
        $firewalldefaults["action"] = $action;
        $firewalldefaults["sort"] = $sort;
        $array[] = $firewalldefaults;
    }
}
