/* $XORP: xorp/etc/templates/firewall.tp,v 1.5 2008/04/27 23:08:03 pavlin Exp $ */

firewall {
    targetname:			txt = "fea";

    rule4 @: u32 {
	action:		txt;
	protocol:	u32 = 0;

	source {
	    interface:		txt = "";
	    vif:		txt = "";
	    network:		ipv4net = 0.0.0.0/0;
	    port-begin:		u32 = 0;
	    port-end:		u32 = 65535;
	}

	destination {
	    network:		ipv4net = 0.0.0.0/0;
	    port-begin:		u32 = 0;
	    port-end:		u32 = 65535;
	}
    }

    rule6 @: u32 {
	action:		txt;
	protocol:	u32 = 0;

	source {
	    interface:		txt = "";
	    vif:		txt = "";
	    network:		ipv6net = ::/0;
	    port-begin:		u32 = 0;
	    port-end:		u32 = 65535;
	}

	destination {
	    network:		ipv6net = ::/0;
	    port-begin:		u32 = 0;
	    port-end:		u32 = 65535;
	}
    }
}

firewall {
    %help:	short		"Configure the firewall";
    %modinfo:	provides	firewall;
    %modinfo:	depends		interfaces;
    %modinfo:	path		"fea/xorp_fea";
    %modinfo:	default_targetname "fea";
    %modinfo:	start_commit	xrl "$(interfaces.targetname)/fea_firewall/0.1/start_transaction->tid:u32=$(firewall.TID)";
    %modinfo:	end_commit	xrl "$(interfaces.targetname)/fea_firewall/0.1/commit_transaction?tid:u32=$(firewall.TID)";

    %mandatory:	$(@.targetname);

    targetname {
	%user-hidden: "XRL target name";
	%help:	short "XRL target name";
	%set:;
    }

    TID {
	%user-hidden: "Transaction ID generated by the FEA";
	%create:;
    }

    rule4 @: u32 {
	%help:	short "Firewall IPv4 rule";
	%order: sorted-numeric;
	%mandatory:	$(@.action);

	%create:	xrl "$(interfaces.targetname)/fea_firewall/0.1/add_entry4?tid:u32=$(firewall.TID)&rule_number:u32=$(@)&ifname:txt=$(@.source.interface)&vifname:txt=$(@.source.vif)&src_network:ipv4net=$(@.source.network)&dst_network:ipv4net=$(@.destination.network)&ip_protocol:u32=$(@.protocol)&src_port_begin:u32=$(@.source.port-begin)&src_port_end:u32=$(@.source.port-end)&dst_port_begin:u32=$(@.destination.port-begin)&dst_port_end:u32=$(@.destination.port-end)&action:txt=$(@.action)";
	%update:	xrl "$(interfaces.targetname)/fea_firewall/0.1/replace_entry4?tid:u32=$(firewall.TID)&rule_number:u32=$(@)&ifname:txt=$(@.source.interface)&vifname:txt=$(@.source.vif)&src_network:ipv4net=$(@.source.network)&dst_network:ipv4net=$(@.destination.network)&ip_protocol:u32=$(@.protocol)&src_port_begin:u32=$(@.source.port-begin)&src_port_end:u32=$(@.source.port-end)&dst_port_begin:u32=$(@.destination.port-begin)&dst_port_end:u32=$(@.destination.port-end)&action:txt=$(@.action)";
	%delete:	xrl "$(interfaces.targetname)/fea_firewall/0.1/delete_entry4?tid:u32=$(firewall.TID)&rule_number:u32=$(@)&ifname:txt=$(@.source.interface)&vifname:txt=$(@.source.vif)&src_network:ipv4net=$(@.source.network)&dst_network:ipv4net=$(@.destination.network)&ip_protocol:u32=$(@.protocol)&src_port_begin:u32=$(@.source.port-begin)&src_port_end:u32=$(@.source.port-end)&dst_port_begin:u32=$(@.destination.port-begin)&dst_port_end:u32=$(@.destination.port-end)";

	action {
	    %help:	short "Firewall rule action";
	    %allow: $(@) "none" %help: "No action";
	    %allow: $(@) "pass" %help: "Pass matching packets";
	    %allow: $(@) "drop" %help: "Drop matching packets";
	    %allow: $(@) "reject" %help: "Reject matching packets";
	}

	protocol {
	    %help:	short "The IP protocol number or 0 if wildcard";
	    %allow-range: $(@) "0" "255" %help: "The IP protocol number or 0 if wildcard";
	}

	source {
	    %help:	short "The source information";
	    interface {
		%help:	short "The incoming interface name";
	    }
	    vif {
		%help:	short "The incoming vif name";
	    }
	    network {
		%help:	short "The source network address prefix";
	    }
	    port-begin {
		%help:	short "The source TCP/UDP begin port";
		%allow-range: $(@) "0" "65535" %help: "The source TCP/UDP begin port";
	    }
	    port-end {
		%help:	short "The source TCP/UDP end port";
		%allow-range: $(@) "0" "65535" %help: "The source TCP/UDP end port";
	    }
	}

	destination {
	    %help:	short "The destination information";
	    network {
		%help:	short "The destination network address prefix";
	    }
	    port-begin {
		%help:	short "The destination TCP/UDP begin port";
		%allow-range: $(@) "0" "65535" %help: "The destination TCP/UDP begin port";
	    }
	    port-end {
		%help:	short "The destination TCP/UDP end port";
		%allow-range: $(@) "0" "65535" %help: "The destination TCP/UDP end port";
	    }
	}
    }

    rule6 @: u32 {
	%help:	short "Firewall IPv6 rule";
	%order: sorted-numeric;
	%mandatory:	$(@.action);

	%create:	xrl "$(interfaces.targetname)/fea_firewall/0.1/add_entry6?tid:u32=$(firewall.TID)&rule_number:u32=$(@)&ifname:txt=$(@.source.interface)&vifname:txt=$(@.source.vif)&src_network:ipv6net=$(@.source.network)&dst_network:ipv6net=$(@.destination.network)&ip_protocol:u32=$(@.protocol)&src_port_begin:u32=$(@.source.port-begin)&src_port_end:u32=$(@.source.port-end)&dst_port_begin:u32=$(@.destination.port-begin)&dst_port_end:u32=$(@.destination.port-end)&action:txt=$(@.action)";
	%update:	xrl "$(interfaces.targetname)/fea_firewall/0.1/replace_entry6?tid:u32=$(firewall.TID)&rule_number:u32=$(@)&ifname:txt=$(@.source.interface)&vifname:txt=$(@.source.vif)&src_network:ipv6net=$(@.source.network)&dst_network:ipv6net=$(@.destination.network)&ip_protocol:u32=$(@.protocol)&src_port_begin:u32=$(@.source.port-begin)&src_port_end:u32=$(@.source.port-end)&dst_port_begin:u32=$(@.destination.port-begin)&dst_port_end:u32=$(@.destination.port-end)&action:txt=$(@.action)";
	%delete:	xrl "$(interfaces.targetname)/fea_firewall/0.1/delete_entry6?tid:u32=$(firewall.TID)&rule_number:u32=$(@)&ifname:txt=$(@.source.interface)&vifname:txt=$(@.source.vif)&src_network:ipv6net=$(@.source.network)&dst_network:ipv6net=$(@.destination.network)&ip_protocol:u32=$(@.protocol)&src_port_begin:u32=$(@.source.port-begin)&src_port_end:u32=$(@.source.port-end)&dst_port_begin:u32=$(@.destination.port-begin)&dst_port_end:u32=$(@.destination.port-end)";

	action {
	    %help:	short "Firewall rule action";
	    %allow: $(@) "none" %help: "No action";
	    %allow: $(@) "pass" %help: "Pass matching packets";
	    %allow: $(@) "drop" %help: "Drop matching packets";
	    %allow: $(@) "reject" %help: "Reject matching packets";
	}

	protocol {
	    %help:	short "The IP protocol number or 0 if wildcard";
	    %allow-range: $(@) "0" "255" %help: "The IP protocol number or 0 if wildcard";
	}

	source {
	    %help:	short "The source information";
	    interface {
		%help:	short "The incoming interface name";
	    }
	    vif {
		%help:	short "The incoming vif name";
	    }
	    network {
		%help:	short "The source network address prefix";
	    }
	    port-begin {
		%help:	short "The source TCP/UDP begin port";
		%allow-range: $(@) "0" "65535" %help: "The source TCP/UDP begin port";
	    }
	    port-end {
		%help:	short "The source TCP/UDP end port";
		%allow-range: $(@) "0" "65535" %help: "The source TCP/UDP end port";
	    }
	}

	destination {
	    %help:	short "The destination information";
	    network {
		%help:	short "The destination network address prefix";
	    }
	    port-begin {
		%help:	short "The destination TCP/UDP begin port";
		%allow-range: $(@) "0" "65535" %help: "The destination TCP/UDP begin port";
	    }
	    port-end {
		%help:	short "The destination TCP/UDP end port";
		%allow-range: $(@) "0" "65535" %help: "The destination TCP/UDP end port";
	    }
	}
    }
}
