Merge pull request #4123 from nicolas-fort/fwall_set_commands

T6760: firewall: add packet modifications existing in policy route to regular firewall ruleset.

20 files changed, 245 insertions, 97 deletions

diff --git a/interface-definitions/include/firewall/bridge-hook-forward.xml.i b/interface-definitions/include/firewall/bridge-hook-forward.xml.i
index fcc981925..03ac26cf6 100644
--- a/interface-definitions/include/firewall/bridge-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/bridge-hook-forward.xml.i
@@ -32,6 +32,12 @@
             #include <include/firewall/state.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-ttl.xml.i>
+            #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
           </children>
         </tagNode>
       </children>
diff --git a/interface-definitions/include/firewall/bridge-hook-output.xml.i b/interface-definitions/include/firewall/bridge-hook-output.xml.i
index 38b8b08ca..853315989 100644
--- a/interface-definitions/include/firewall/bridge-hook-output.xml.i
+++ b/interface-definitions/include/firewall/bridge-hook-output.xml.i
@@ -31,6 +31,12 @@
             #include <include/firewall/connection-status.xml.i>
             #include <include/firewall/state.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-ttl.xml.i>
+            #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
           </children>
         </tagNode>
       </children>
diff --git a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i
index ea567644f..7a45f5cd1 100644
--- a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i
+++ b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i
@@ -28,6 +28,11 @@
             #include <include/firewall/common-rule-bridge.xml.i>
             #include <include/firewall/action-and-notrack.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-ttl.xml.i>
+            #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
           </children>
         </tagNode>
       </children>
diff --git a/interface-definitions/include/firewall/ipv4-custom-name.xml.i b/interface-definitions/include/firewall/ipv4-custom-name.xml.i
index 8046b2d6c..b08262e2d 100644
--- a/interface-definitions/include/firewall/ipv4-custom-name.xml.i
+++ b/interface-definitions/include/firewall/ipv4-custom-name.xml.i
@@ -36,6 +36,12 @@
         #include <include/firewall/match-ipsec.xml.i>
         #include <include/firewall/offload-target.xml.i>
         #include <include/firewall/outbound-interface.xml.i>
+        #include <include/firewall/set-packet-modifications-dscp.xml.i>
+        #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+        #include <include/firewall/set-packet-modifications-mark.xml.i>
+        #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+        #include <include/firewall/set-packet-modifications-ttl.xml.i>
+
       </children>
     </tagNode>
   </children>
diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
index b0e240a03..a2da4b701 100644
--- a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
@@ -31,6 +31,11 @@
             #include <include/firewall/match-ipsec.xml.i>
             #include <include/firewall/offload-target.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-ttl.xml.i>
           </children>
         </tagNode>
       </children>
diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i
index ee9157592..f68136557 100644
--- a/interface-definitions/include/firewall/ipv4-hook-output.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i
@@ -28,6 +28,11 @@
             #include <include/firewall/common-rule-ipv4.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-ttl.xml.i>
           </children>
         </tagNode>
       </children>
@@ -56,6 +61,11 @@
             #include <include/firewall/common-rule-ipv4-raw.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-ttl.xml.i>
           </children>
         </tagNode>
       </children>
diff --git a/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i
index b431303ae..6f9fe6842 100644
--- a/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i
@@ -35,6 +35,10 @@
             #include <include/firewall/common-rule-ipv4-raw.xml.i>
             #include <include/firewall/match-ipsec-in.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-ttl.xml.i>
             <leafNode name="jump-target">
               <properties>
                 <help>Set jump target. Action jump must be defined to use this setting</help>
diff --git a/interface-definitions/include/firewall/ipv6-custom-name.xml.i b/interface-definitions/include/firewall/ipv6-custom-name.xml.i
index fb8740c38..d49267b52 100644
--- a/interface-definitions/include/firewall/ipv6-custom-name.xml.i
+++ b/interface-definitions/include/firewall/ipv6-custom-name.xml.i
@@ -36,6 +36,11 @@
         #include <include/firewall/match-ipsec.xml.i>
         #include <include/firewall/offload-target.xml.i>
         #include <include/firewall/outbound-interface.xml.i>
+        #include <include/firewall/set-packet-modifications-dscp.xml.i>
+        #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+        #include <include/firewall/set-packet-modifications-mark.xml.i>
+        #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+        #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
       </children>
     </tagNode>
   </children>
diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
index 7efc2614e..79898d691 100644
--- a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
@@ -31,6 +31,11 @@
             #include <include/firewall/match-ipsec.xml.i>
             #include <include/firewall/offload-target.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
           </children>
         </tagNode>
       </children>
diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i
index d3c4c1ead..9a6d0bb77 100644
--- a/interface-definitions/include/firewall/ipv6-hook-output.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i
@@ -28,6 +28,11 @@
             #include <include/firewall/common-rule-ipv6.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
           </children>
         </tagNode>
       </children>
@@ -56,6 +61,11 @@
             #include <include/firewall/common-rule-ipv6-raw.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
           </children>
         </tagNode>
       </children>
diff --git a/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i
index 21f8de6f9..15454bbbf 100644
--- a/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i
@@ -35,6 +35,10 @@
             #include <include/firewall/common-rule-ipv6-raw.xml.i>
             #include <include/firewall/match-ipsec-in.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/set-packet-modifications-dscp.xml.i>
+            #include <include/firewall/set-packet-modifications-mark.xml.i>
+            #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
+            #include <include/firewall/set-packet-modifications-hop-limit.xml.i>
             <leafNode name="jump-target">
               <properties>
                 <help>Set jump target. Action jump must be defined to use this setting</help>
diff --git a/interface-definitions/include/firewall/set-packet-modifications-conn-mark.xml.i b/interface-definitions/include/firewall/set-packet-modifications-conn-mark.xml.i
new file mode 100644
index 000000000..dff95d324
--- /dev/null
+++ b/interface-definitions/include/firewall/set-packet-modifications-conn-mark.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from firewall/set-packet-modifications-conn-mark.xml.i -->
+<node name="set">
+  <properties>
+    <help>Packet modifications</help>
+  </properties>
+  <children>
+    <leafNode name="connection-mark">
+      <properties>
+        <help>Set connection mark</help>
+        <valueHelp>
+          <format>u32:0-2147483647</format>
+          <description>Connection mark</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-2147483647"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/set-packet-modifications-dscp.xml.i b/interface-definitions/include/firewall/set-packet-modifications-dscp.xml.i
new file mode 100644
index 000000000..5082806fb
--- /dev/null
+++ b/interface-definitions/include/firewall/set-packet-modifications-dscp.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from firewall/set-packet-modifications-dscp.xml.i -->
+<node name="set">
+  <properties>
+    <help>Packet modifications</help>
+  </properties>
+  <children>
+    <leafNode name="dscp">
+      <properties>
+        <help>Set DSCP (Packet Differentiated Services Codepoint) bits</help>
+        <valueHelp>
+          <format>u32:0-63</format>
+          <description>DSCP number</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-63"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/set-packet-modifications-hop-limit.xml.i b/interface-definitions/include/firewall/set-packet-modifications-hop-limit.xml.i
new file mode 100755
index 000000000..8a6e5347a
--- /dev/null
+++ b/interface-definitions/include/firewall/set-packet-modifications-hop-limit.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from firewall/set-packet-modifications-hop-limit.xml.i -->
+<node name="set">
+  <properties>
+    <help>Packet modifications</help>
+  </properties>
+  <children>
+    <leafNode name="hop-limit">
+      <properties>
+        <help>Set hop limit</help>
+        <valueHelp>
+          <format>u32:0-255</format>
+          <description>Hop limit number</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-255"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/set-packet-modifications-mark.xml.i b/interface-definitions/include/firewall/set-packet-modifications-mark.xml.i
new file mode 100644
index 000000000..b229d0579
--- /dev/null
+++ b/interface-definitions/include/firewall/set-packet-modifications-mark.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from firewall/set-packet-modifications-mark.xml.i -->
+<node name="set">
+  <properties>
+    <help>Packet modifications</help>
+  </properties>
+  <children>
+    <leafNode name="mark">
+      <properties>
+        <help>Set packet mark</help>
+        <valueHelp>
+          <format>u32:1-2147483647</format>
+          <description>Packet mark</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 1-2147483647"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/set-packet-modifications-table-and-vrf.xml.i b/interface-definitions/include/firewall/set-packet-modifications-table-and-vrf.xml.i
new file mode 100644
index 000000000..c7875b31d
--- /dev/null
+++ b/interface-definitions/include/firewall/set-packet-modifications-table-and-vrf.xml.i
@@ -0,0 +1,48 @@
+<!-- include start from firewall/set-packet-modifications-table-and-vrf.xml.i -->
+<node name="set">
+  <properties>
+    <help>Packet modifications</help>
+  </properties>
+  <children>
+    <leafNode name="table">
+      <properties>
+        <help>Set the routing table for matched packets</help>
+        <valueHelp>
+          <format>u32:1-200</format>
+          <description>Table number</description>
+        </valueHelp>
+        <valueHelp>
+          <format>main</format>
+          <description>Main table</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 1-200"/>
+          <regex>(main)</regex>
+        </constraint>
+        <completionHelp>
+          <list>main</list>
+          <path>protocols static table</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+    <leafNode name="vrf">
+      <properties>
+        <help>VRF to forward packet with</help>
+        <valueHelp>
+          <format>txt</format>
+          <description>VRF instance name</description>
+        </valueHelp>
+        <valueHelp>
+          <format>default</format>
+          <description>Forward into default global VRF</description>
+        </valueHelp>
+        <completionHelp>
+          <list>default</list>
+          <path>vrf name</path>
+        </completionHelp>
+        #include <include/constraint/vrf.xml.i>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i b/interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i
new file mode 100644
index 000000000..06ffdfede
--- /dev/null
+++ b/interface-definitions/include/firewall/set-packet-modifications-tcp-mss.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from firewall/set-packet-modifications-tcp-mss.xml.i -->
+<node name="set">
+  <properties>
+    <help>Packet modifications</help>
+  </properties>
+  <children>
+    <leafNode name="tcp-mss">
+      <properties>
+        <help>Set TCP Maximum Segment Size</help>
+        <valueHelp>
+          <format>u32:500-1460</format>
+          <description>Explicitly set TCP MSS value</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 500-1460"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/set-packet-modifications-ttl.xml.i b/interface-definitions/include/firewall/set-packet-modifications-ttl.xml.i
new file mode 100755
index 000000000..e2f14050b
--- /dev/null
+++ b/interface-definitions/include/firewall/set-packet-modifications-ttl.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from firewall/set-packet-modifications-ttl.xml.i -->
+<node name="set">
+  <properties>
+    <help>Packet modifications</help>
+  </properties>
+  <children>
+    <leafNode name="ttl">
+      <properties>
+        <help>Set TTL (time to live)</help>
+        <valueHelp>
+          <format>u32:0-255</format>
+          <description>TTL number</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-255"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/set-packet-modifications.xml.i b/interface-definitions/include/firewall/set-packet-modifications.xml.i
deleted file mode 100644
index ee019b64e..000000000
--- a/interface-definitions/include/firewall/set-packet-modifications.xml.i
+++ /dev/null
@@ -1,96 +0,0 @@
-<!-- include start from firewall/set-packet-modifications.xml.i -->
-<node name="set">
-  <properties>
-    <help>Packet modifications</help>
-  </properties>
-  <children>
-    <leafNode name="connection-mark">
-      <properties>
-        <help>Set connection mark</help>
-        <valueHelp>
-          <format>u32:0-2147483647</format>
-          <description>Connection mark</description>
-        </valueHelp>
-        <constraint>
-          <validator name="numeric" argument="--range 0-2147483647"/>
-        </constraint>
-      </properties>
-    </leafNode>
-    <leafNode name="dscp">
-      <properties>
-        <help>Set DSCP (Packet Differentiated Services Codepoint) bits</help>
-        <valueHelp>
-          <format>u32:0-63</format>
-          <description>DSCP number</description>
-        </valueHelp>
-        <constraint>
-          <validator name="numeric" argument="--range 0-63"/>
-        </constraint>
-      </properties>
-    </leafNode>
-    <leafNode name="mark">
-      <properties>
-        <help>Set packet mark</help>
-        <valueHelp>
-          <format>u32:1-2147483647</format>
-          <description>Packet mark</description>
-        </valueHelp>
-        <constraint>
-          <validator name="numeric" argument="--range 1-2147483647"/>
-        </constraint>
-      </properties>
-    </leafNode>
-    <leafNode name="table">
-      <properties>
-        <help>Set the routing table for matched packets</help>
-        <valueHelp>
-          <format>u32:1-200</format>
-          <description>Table number</description>
-        </valueHelp>
-        <valueHelp>
-          <format>main</format>
-          <description>Main table</description>
-        </valueHelp>
-        <constraint>
-          <validator name="numeric" argument="--range 1-200"/>
-          <regex>(main)</regex>
-        </constraint>
-        <completionHelp>
-          <list>main</list>
-          <path>protocols static table</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
-    <leafNode name="vrf">
-      <properties>
-        <help>VRF to forward packet with</help>
-        <valueHelp>
-          <format>txt</format>
-          <description>VRF instance name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>default</format>
-          <description>Forward into default global VRF</description>
-        </valueHelp>
-        <completionHelp>
-          <list>default</list>
-          <path>vrf name</path>
-        </completionHelp>
-        #include <include/constraint/vrf.xml.i>
-      </properties>
-    </leafNode>
-    <leafNode name="tcp-mss">
-      <properties>
-        <help>Set TCP Maximum Segment Size</help>
-        <valueHelp>
-          <format>u32:500-1460</format>
-          <description>Explicitly set TCP MSS value</description>
-        </valueHelp>
-        <constraint>
-          <validator name="numeric" argument="--range 500-1460"/>
-        </constraint>
-      </properties>
-    </leafNode>
-  </children>
-</node>
-<!-- include end -->
\ No newline at end of file
diff --git a/interface-definitions/include/policy/route-common.xml.i b/interface-definitions/include/policy/route-common.xml.i
index 19ffc0506..5c69a5279 100644
--- a/interface-definitions/include/policy/route-common.xml.i
+++ b/interface-definitions/include/policy/route-common.xml.i
@@ -66,7 +66,11 @@
     </leafNode>
   </children>
 </node>
-#include <include/firewall/set-packet-modifications.xml.i>
+#include <include/firewall/set-packet-modifications-conn-mark.xml.i>
+#include <include/firewall/set-packet-modifications-dscp.xml.i>
+#include <include/firewall/set-packet-modifications-mark.xml.i>
+#include <include/firewall/set-packet-modifications-table-and-vrf.xml.i>
+#include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
 #include <include/firewall/state.xml.i>
 #include <include/firewall/tcp-flags.xml.i>
 #include <include/firewall/tcp-mss.xml.i>