;;;
;;; Firewall
;;;

(define-record-type* <firewall-configuration>
  firewall-configuration make-firewall-configuration
  firewall-configuration?
  (tcp firewall-configuration-tcp
       (default '()))
  (udp firewall-configuration-udp
       (default '())))

(define (firewall-configuration->file tcp udp)
  "Return the iptables rules from the ports list"
  (computed-file
   "firewall-generated-rules"
   (with-imported-modules '((guix build utils))
     #~(begin
         (use-modules (guix build utils)
                      (ice-9 match))
         (call-with-output-file #$output
           (lambda (out)
             (display "\
*filter
:INPUT DROP
:FORWARD DROP
:OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n" out)

             ;; tcp rules
             (when (not (null? (list #$@tcp)))
               (format out "\
~{-A INPUT -p tcp --dport ~a -j ACCEPT~%~}"
                       (list #$@tcp)))

             ;; udp rules
             (when (not (null? (list #$@udp)))
               (format out "\
~{-A INPUT -p udp --dport ~a -j ACCEPT~%~}"
                       (list #$@udp)))
             (display "COMMIT\n" out)
             #t))))))

(define firewall-shepherd-service
  (match-lambda
    (($ <firewall-configuration> tcp udp)
     (let* ((iptables-restore (file-append iptables "/sbin/iptables-restore"))
            (ip6tables-restore (file-append iptables "/sbin/ip6tables-restore"))
            (ruleset (firewall-configuration->file tcp udp)))
       (shepherd-service
        (documentation "Easy firewall management")
        (provision '(firewall))
        (start #~(lambda _
                   (invoke #$iptables-restore  #$ruleset)
                   (invoke #$ip6tables-restore #$ruleset)))
        (stop #~(lambda _
                  (invoke #$iptables-restore #$ruleset)
                  (invoke #$ip6tables-restore #$ruleset))))))))

(define firewall-service-type
  (service-type
   (name 'firewall)
   (description
    "Run @command{iptables-restore}, setting up the specified rules.")
   (extensions
    (list (service-extension shepherd-root-service-type
                             (compose list firewall-shepherd-service))))))


;;; networking.scm ends here