12 files changed, 187 insertions, 9 deletions
diff --git a/interface-definitions/include/firewall/name-default-action.xml.i b/interface-definitions/include/firewall/default-action.xml.i
index 512b0296f..92a2fcaaf 100644
--- a/interface-definitions/include/firewall/name-default-action.xml.i
+++ b/interface-definitions/include/firewall/default-action.xml.i
@@ -1,4 +1,4 @@
-<!-- include start from firewall/name-default-action.xml.i -->
+<!-- include start from firewall/default-action.xml.i -->
 <leafNode name="default-action">
   <properties>
     <help>Default-action for rule-set</help>
@@ -21,5 +21,6 @@
       <regex>(drop|reject|accept)</regex>
     </constraint>
   </properties>
+  <defaultValue>drop</defaultValue>
 </leafNode>
 <!-- include end -->
diff --git a/interface-definitions/include/firewall/dscp.xml.i b/interface-definitions/include/firewall/dscp.xml.i
new file mode 100644
index 000000000..642212d7e
--- /dev/null
+++ b/interface-definitions/include/firewall/dscp.xml.i
@@ -0,0 +1,38 @@
+<!-- include start from firewall/dscp.xml.i -->
+<leafNode name="dscp">
+  <properties>
+    <help>DSCP value</help>
+    <valueHelp>
+      <format>u32:0-63</format>
+      <description>DSCP value to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>&lt;start-end&gt;</format>
+      <description>DSCP range to match</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 0-63"/>
+      <validator name="range" argument="--min=0 --max=63"/>
+    </constraint>
+    <multi/>
+  </properties>
+</leafNode>
+<leafNode name="dscp-exclude">
+  <properties>
+    <help>DSCP value not to match</help>
+    <valueHelp>
+      <format>u32:0-63</format>
+      <description>DSCP value not to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>&lt;start-end&gt;</format>
+      <description>DSCP range not to match</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 0-63"/>
+      <validator name="range" argument="--min=0 --max=63"/>
+    </constraint>
+    <multi/>
+  </properties>
+</leafNode>
+<!-- include end -->
+\ No newline at end of file
diff --git a/interface-definitions/include/firewall/enable-default-log.xml.i b/interface-definitions/include/firewall/enable-default-log.xml.i
new file mode 100644
index 000000000..0efd8341b
--- /dev/null
+++ b/interface-definitions/include/firewall/enable-default-log.xml.i
@@ -0,0 +1,8 @@
+<!-- include start from firewall/enable-default-log.xml.i -->
+<leafNode name="enable-default-log">
+  <properties>
+    <help>Log packets hitting default-action</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- include end -->
+\ No newline at end of file
diff --git a/interface-definitions/include/firewall/eq.xml.i b/interface-definitions/include/firewall/eq.xml.i
new file mode 100644
index 000000000..e1b4f37a2
--- /dev/null
+++ b/interface-definitions/include/firewall/eq.xml.i
@@ -0,0 +1,14 @@
+<!-- include start from firewall/eq.xml.i -->
+<leafNode name="eq">
+  <properties>
+    <help>Match on equal value</help>
+    <valueHelp>
+      <format>u32:0-255</format>
+      <description>Equal to value</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 0-255"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
+\ No newline at end of file
diff --git a/interface-definitions/include/firewall/gt.xml.i b/interface-definitions/include/firewall/gt.xml.i
new file mode 100644
index 000000000..c879171ee
--- /dev/null
+++ b/interface-definitions/include/firewall/gt.xml.i
@@ -0,0 +1,14 @@
+<!-- include start from firewall/gt.xml.i -->
+<leafNode name="gt">
+  <properties>
+    <help>Match on greater then value</help>
+    <valueHelp>
+      <format>u32:0-255</format>
+      <description>Greater then value</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 0-255"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/hop-limit.xml.i b/interface-definitions/include/firewall/hop-limit.xml.i
new file mode 100644
index 000000000..d375dc985
--- /dev/null
+++ b/interface-definitions/include/firewall/hop-limit.xml.i
@@ -0,0 +1,12 @@
+<!-- include start from firewall/hop-limit.xml.i -->
+<node name="hop-limit">
+  <properties>
+    <help>Hop limit</help>
+  </properties>
+  <children>
+    #include <include/firewall/eq.xml.i>
+    #include <include/firewall/gt.xml.i>
+    #include <include/firewall/lt.xml.i>
+  </children>
+</node>
+<!-- include end -->
+\ No newline at end of file
diff --git a/interface-definitions/include/firewall/lt.xml.i b/interface-definitions/include/firewall/lt.xml.i
new file mode 100644
index 000000000..77894d3ce
--- /dev/null
+++ b/interface-definitions/include/firewall/lt.xml.i
@@ -0,0 +1,14 @@
+<!-- include start from firewall/lt.xml.i -->
+<leafNode name="lt">
+  <properties>
+    <help>Match on less then value</help>
+    <valueHelp>
+      <format>u32:0-255</format>
+      <description>Less then value</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 0-255"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/name-default-log.xml.i b/interface-definitions/include/firewall/name-default-log.xml.i
deleted file mode 100644
index 1d0ff9497..000000000
--- a/interface-definitions/include/firewall/name-default-log.xml.i
+++ /dev/null
@@ -1,8 +0,0 @@
-<!-- include start from firewall/name-default-log.xml.i -->
-<leafNode name="enable-default-log">
-  <properties>
-    <help>Option to log packets hitting default-action</help>
-    <valueless/>
-  </properties>
-</leafNode>
-<!-- include end -->
-\ No newline at end of file
diff --git a/interface-definitions/include/firewall/name.xml.i b/interface-definitions/include/firewall/name.xml.i
new file mode 100644
index 000000000..231b9b144
--- /dev/null
+++ b/interface-definitions/include/firewall/name.xml.i
@@ -0,0 +1,18 @@
+<!-- include start from firewall/name.xml.i -->
+<leafNode name="name">
+  <properties>
+    <help>Local IPv4 firewall ruleset name for interface</help>
+    <completionHelp>
+      <path>firewall name</path>
+    </completionHelp>
+  </properties>
+</leafNode>
+<leafNode name="ipv6-name">
+  <properties>
+    <help>Local IPv6 firewall ruleset name for interface</help>
+    <completionHelp>
+      <path>firewall ipv6-name</path>
+    </completionHelp>
+  </properties>
+</leafNode>
+<!-- include end from firewall/name.xml.i -->
+\ No newline at end of file
diff --git a/interface-definitions/include/firewall/packet-length.xml.i b/interface-definitions/include/firewall/packet-length.xml.i
new file mode 100644
index 000000000..043f56d16
--- /dev/null
+++ b/interface-definitions/include/firewall/packet-length.xml.i
@@ -0,0 +1,38 @@
+<!-- include start from firewall/packet-length.xml.i -->
+<leafNode name="packet-length">
+  <properties>
+    <help>Payload size in bytes, including header and data to match</help>
+    <valueHelp>
+      <format>u32:1-65535</format>
+      <description>Packet length to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>&lt;start-end&gt;</format>
+      <description>Packet length range to match</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 1-65535"/>
+      <validator name="range" argument="--min=1 --max=65535"/>
+    </constraint>
+    <multi/>
+  </properties>
+</leafNode>
+<leafNode name="packet-length-exclude">
+  <properties>
+    <help>Payload size in bytes, including header and data not to match</help>
+    <valueHelp>
+      <format>u32:1-65535</format>
+      <description>Packet length not to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>&lt;start-end&gt;</format>
+      <description>Packet length range not to match</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 1-65535"/>
+      <validator name="range" argument="--min=1 --max=65535"/>
+    </constraint>
+    <multi/>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/tcp-flags.xml.i b/interface-definitions/include/firewall/tcp-flags.xml.i
index b99896687..5a7b5a8d3 100644
--- a/interface-definitions/include/firewall/tcp-flags.xml.i
+++ b/interface-definitions/include/firewall/tcp-flags.xml.i
@@ -114,6 +114,23 @@
         </node>
       </children>
     </node>
+    <leafNode name="mss">
+      <properties>
+        <help>Maximum segment size (MSS)</help>
+        <valueHelp>
+          <format>u32:1-16384</format>
+          <description>Maximum segment size</description>
+        </valueHelp>
+        <valueHelp>
+          <format>&lt;min&gt;-&lt;max&gt;</format>
+          <description>TCP MSS range (use '-' as delimiter)</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 1-16384"/>
+          <validator name="range" argument="--min=1 --max=16384"/>
+        </constraint>
+      </properties>
+    </leafNode>
   </children>
 </node>
 <!-- include end -->
diff --git a/interface-definitions/include/firewall/ttl.xml.i b/interface-definitions/include/firewall/ttl.xml.i
new file mode 100644
index 000000000..9c782a9a5
--- /dev/null
+++ b/interface-definitions/include/firewall/ttl.xml.i
@@ -0,0 +1,12 @@
+<!-- include start from firewall/ttl.xml.i -->
+<node name="ttl">
+  <properties>
+    <help>Time to live limit</help>
+  </properties>
+  <children>
+    #include <include/firewall/eq.xml.i>
+    #include <include/firewall/gt.xml.i>
+    #include <include/firewall/lt.xml.i>
+  </children>
+</node>
+<!-- include end -->
+\ No newline at end of file