firewall: T3568: add XML definitions for firewall

Add XML for configuration mode firewall. Used for future rewriting it to Python style.

12 files changed, 727 insertions, 0 deletions

diff --git a/interface-definitions/include/firewall/action-accept-drop-reject.xml.i b/interface-definitions/include/firewall/action-accept-drop-reject.xml.i
new file mode 100644
index 000000000..9f8baa884
--- /dev/null
+++ b/interface-definitions/include/firewall/action-accept-drop-reject.xml.i
@@ -0,0 +1,25 @@
+<!-- include start from firewall/action-accept-drop-reject.xml.i -->
+<leafNode name="action">
+  <properties>
+    <help>Action for packets</help>
+    <completionHelp>
+      <list>accept drop reject</list>
+    </completionHelp>
+    <valueHelp>
+      <format>accept</format>
+      <description>Action to accept</description>
+    </valueHelp>
+    <valueHelp>
+      <format>drop</format>
+      <description>Action to drop</description>
+    </valueHelp>
+    <valueHelp>
+      <format>reject</format>
+      <description>Action to reject</description>
+    </valueHelp>
+    <constraint>
+      <regex>^(accept|drop|reject)$</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/action.xml.i b/interface-definitions/include/firewall/action.xml.i
new file mode 100644
index 000000000..230f590cb
--- /dev/null
+++ b/interface-definitions/include/firewall/action.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from firewall/action.xml.i -->
+<leafNode name="action">
+  <properties>
+    <help>Rule action [REQUIRED]</help>
+    <completionHelp>
+      <list>permit deny</list>
+    </completionHelp>
+    <valueHelp>
+      <format>permit</format>
+      <description>Permit matching entries</description>
+    </valueHelp>
+    <valueHelp>
+      <format>deny</format>
+      <description>Deny matching entries</description>
+    </valueHelp>
+    <constraint>
+      <regex>^(permit|deny)$</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/address-ipv6.xml.i b/interface-definitions/include/firewall/address-ipv6.xml.i
new file mode 100644
index 000000000..fa60c0c8a
--- /dev/null
+++ b/interface-definitions/include/firewall/address-ipv6.xml.i
@@ -0,0 +1,37 @@
+<!-- include start from firewall/address-ipv6.xml.i -->
+<leafNode name="address">
+  <properties>
+    <help>IP address, subnet, or range</help>
+    <valueHelp>
+      <format>ipv6</format>
+      <description>IP address to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6net</format>
+      <description>Subnet to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6range</format>
+      <description>IP range to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>!ipv6</format>
+      <description>Match everything except the specified address</description>
+    </valueHelp>
+    <valueHelp>
+      <format>!ipv6net</format>
+      <description>Match everything except the specified prefix</description>
+    </valueHelp>
+    <valueHelp>
+      <format>!ipv6range</format>
+      <description>Match everything except the specified range</description>
+    </valueHelp>
+    <constraint>
+      <validator name="ipv6"/>
+      <validator name="ipv6-exclude"/>
+      <validator name="ipv6-range"/>
+      <validator name="ipv6-range-exclude"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/address.xml.i b/interface-definitions/include/firewall/address.xml.i
new file mode 100644
index 000000000..2e1bde5a5
--- /dev/null
+++ b/interface-definitions/include/firewall/address.xml.i
@@ -0,0 +1,39 @@
+<!-- include start from firewall/address.xml.i -->
+<leafNode name="address">
+  <properties>
+    <help>IP address, subnet, or range</help>
+    <valueHelp>
+      <format>ipv4</format>
+      <description>IPv4 address to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv4net</format>
+      <description>IPv4 prefix to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv4range</format>
+      <description>IPv4 address range to match</description>
+    </valueHelp>
+    <valueHelp>
+      <format>!ipv4</format>
+      <description>Match everything except the specified address</description>
+    </valueHelp>
+    <valueHelp>
+      <format>!ipv4net</format>
+      <description>Match everything except the specified prefix</description>
+    </valueHelp>
+    <valueHelp>
+      <format>!ipv4range</format>
+      <description>Match everything except the specified range</description>
+    </valueHelp>
+    <constraint>
+      <validator name="ipv4-address"/>
+      <validator name="ipv4-prefix"/>
+      <validator name="ipv4-range"/>
+      <validator name="ipv4-address-exclude"/>
+      <validator name="ipv4-prefix-exclude"/>
+      <validator name="ipv4-range-exclude"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/common-rule.xml.i b/interface-definitions/include/firewall/common-rule.xml.i
new file mode 100644
index 000000000..466599e0a
--- /dev/null
+++ b/interface-definitions/include/firewall/common-rule.xml.i
@@ -0,0 +1,326 @@
+<!-- include start from firewall/common-rule.xml.i -->
+#include <include/firewall/action.xml.i>
+#include <include/firewall/description.xml.i>
+<leafNode name="disable">
+  <properties>
+    <help>Option to disable firewall rule</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<node name="fragment">
+  <properties>
+    <help>IP fragment match</help>
+  </properties>
+  <children>
+    <leafNode name="match-frag">
+      <properties>
+        <help>Second and further fragments of fragmented packets</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+    <leafNode name="match-non-frag">
+      <properties>
+        <help>Head fragments or unfragmented packets</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<node name="ipsec">
+  <properties>
+    <help>Inbound IPsec packets</help>
+  </properties>
+  <children>
+    <leafNode name="match-ipsec">
+      <properties>
+        <help>Inbound IPsec packets</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+    <leafNode name="match-none">
+      <properties>
+        <help>Inbound non-IPsec packets</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<node name="limit">
+  <properties>
+    <help>Rate limit using a token bucket filter</help>
+  </properties>
+  <children>
+    <leafNode name="burst">
+      <properties>
+        <help>Maximum number of packets to allow in excess of rate</help>
+        <valueHelp>
+          <format>u32:0-4294967295</format>
+          <description>burst__change_me</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-4294967295"/>
+        </constraint>
+      </properties>
+    </leafNode>
+    <leafNode name="rate">
+      <properties>
+        <help>Maximum average matching rate</help>
+        <valueHelp>
+          <format>u32:0-4294967295</format>
+          <description>rate__change_me</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-4294967295"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<leafNode name="log">
+  <properties>
+    <help>Option to log packets matching rule</help>
+    <completionHelp>
+      <list>enable disable</list>
+    </completionHelp>
+    <valueHelp>
+      <format>enable</format>
+      <description>Enable log</description>
+    </valueHelp>
+    <valueHelp>
+      <format>disable</format>
+      <description>Disable log</description>
+    </valueHelp>
+    <constraint>
+      <regex>^(enable|disable)$</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<leafNode name="protocol">
+  <properties>
+    <help>Protocol to match (protocol name, number, or "all")</help>
+    <completionHelp>
+      <script>cat /etc/protocols | sed -e '/^#.*/d' | awk '{ print $1 }'</script>
+    </completionHelp>
+    <valueHelp>
+      <format>all</format>
+      <description>All IP protocols</description>
+    </valueHelp>
+    <valueHelp>
+      <format>tcp_udp</format>
+      <description>Both TCP and UDP</description>
+    </valueHelp>
+    <valueHelp>
+      <format>0-255</format>
+      <description>IP protocol number</description>
+    </valueHelp>
+    <valueHelp>
+      <format>!&lt;protocol&gt;</format>
+      <description>IP protocol number</description>
+    </valueHelp>
+    <constraint>
+      <validator name="ip-protocol"/>
+    </constraint>
+  </properties>
+  <defaultValue>all</defaultValue>
+</leafNode>
+<node name="recent">
+  <properties>
+    <help>Parameters for matching recently seen sources</help>
+  </properties>
+  <children>
+    <leafNode name="count">
+      <properties>
+        <help>Source addresses seen more than N times</help>
+        <valueHelp>
+          <format>u32:1-255</format>
+          <description>Source addresses seen more than N times</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 1-255"/>
+        </constraint>
+      </properties>
+    </leafNode>
+    <leafNode name="time">
+      <properties>
+        <help>Source addresses seen in the last N seconds</help>
+        <valueHelp>
+          <format>u32:0-4294967295</format>
+          <description>Source addresses seen in the last N seconds</description>
+        </valueHelp>
+        <constraint>
+          <validator name="numeric" argument="--range 0-4294967295"/>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<node name="source">
+  <properties>
+    <help>Source parameters</help>
+  </properties>
+  <children>
+    #include <include/firewall/address.xml.i>
+    #include <include/firewall/source-destination-group.xml.i>
+    <leafNode name="mac-address">
+      <properties>
+        <help>Source MAC address</help>
+        <valueHelp>
+          <format>&lt;MAC address&gt;</format>
+          <description>MAC address to match</description>
+        </valueHelp>
+        <valueHelp>
+          <format>!&lt;MAC address&gt;</format>
+          <description>Match everything except the specified MAC address</description>
+        </valueHelp>
+      </properties>
+    </leafNode>
+    #include <include/firewall/port.xml.i>
+  </children>
+</node>
+<node name="state">
+  <properties>
+    <help>Session state</help>
+  </properties>
+  <children>
+    <leafNode name="established">
+      <properties>
+        <help>Established state</help>
+        <completionHelp>
+          <list>enable disable</list>
+        </completionHelp>
+        <valueHelp>
+          <format>enable</format>
+          <description>Enable</description>
+        </valueHelp>
+        <valueHelp>
+          <format>disable</format>
+          <description>Disable</description>
+        </valueHelp>
+        <constraint>
+          <regex>^(enable|disable)$</regex>
+        </constraint>
+      </properties>
+    </leafNode>
+    <leafNode name="invalid">
+      <properties>
+        <help>Invalid state</help>
+        <completionHelp>
+          <list>enable disable</list>
+        </completionHelp>
+        <valueHelp>
+          <format>enable</format>
+          <description>Enable</description>
+        </valueHelp>
+        <valueHelp>
+          <format>disable</format>
+          <description>Disable</description>
+        </valueHelp>
+        <constraint>
+          <regex>^(enable|disable)$</regex>
+        </constraint>
+      </properties>
+    </leafNode>
+    <leafNode name="new">
+      <properties>
+        <help>New state</help>
+        <completionHelp>
+          <list>enable disable</list>
+        </completionHelp>
+        <valueHelp>
+          <format>enable</format>
+          <description>Enable</description>
+        </valueHelp>
+        <valueHelp>
+          <format>disable</format>
+          <description>Disable</description>
+        </valueHelp>
+        <constraint>
+          <regex>^(enable|disable)$</regex>
+        </constraint>
+      </properties>
+    </leafNode>
+    <leafNode name="related">
+      <properties>
+        <help>Related state</help>
+        <completionHelp>
+          <list>enable disable</list>
+        </completionHelp>
+        <valueHelp>
+          <format>enable</format>
+          <description>Enable</description>
+        </valueHelp>
+        <valueHelp>
+          <format>disable</format>
+          <description>Disable</description>
+        </valueHelp>
+        <constraint>
+          <regex>^(enable|disable)$</regex>
+        </constraint>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<node name="tcp">
+  <properties>
+    <help>TCP flags to match</help>
+  </properties>
+  <children>
+    <leafNode name="flags">
+      <properties>
+        <help>TCP flags to match</help>
+        <valueHelp>
+          <format>txt</format>
+          <description>TCP flags to match</description>
+        </valueHelp>
+        <valueHelp>
+          <format> </format>
+          <description>\n\n  Allowed values for TCP flags : SYN ACK FIN RST URG PSH ALL\n  When specifying more than one flag, flags should be comma-separated.\n For example : value of 'SYN,!ACK,!FIN,!RST' will only match packets with\n  the SYN flag set, and the ACK, FIN and RST flags unset</description>
+        </valueHelp>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<node name="time">
+  <properties>
+    <help>Time to match rule</help>
+  </properties>
+  <children>
+    <leafNode name="monthdays">
+      <properties>
+        <help>Monthdays to match rule on</help>
+      </properties>
+    </leafNode>
+    <leafNode name="startdate">
+      <properties>
+        <help>Date to start matching rule</help>
+      </properties>
+    </leafNode>
+    <leafNode name="starttime">
+      <properties>
+        <help>Time of day to start matching rule</help>
+      </properties>
+    </leafNode>
+    <leafNode name="stopdate">
+      <properties>
+        <help>Date to stop matching rule</help>
+      </properties>
+    </leafNode>
+    <leafNode name="stoptime">
+      <properties>
+        <help>Time of day to stop matching rule</help>
+      </properties>
+    </leafNode>
+    <leafNode name="utc">
+      <properties>
+        <help>Interpret times for startdate, stopdate, starttime and stoptime to be UTC</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+    <leafNode name="weekdays">
+      <properties>
+        <help>Weekdays to match rule on</help>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/description.xml.i b/interface-definitions/include/firewall/description.xml.i
new file mode 100644
index 000000000..b6bae406b
--- /dev/null
+++ b/interface-definitions/include/firewall/description.xml.i
@@ -0,0 +1,11 @@
+<!-- include start from firewall/description.xml.i -->
+<leafNode name="description">
+  <properties>
+    <help>Description</help>
+    <valueHelp>
+      <format>txt</format>
+      <description>Description</description>
+    </valueHelp>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/icmp-type-name.xml.i b/interface-definitions/include/firewall/icmp-type-name.xml.i
new file mode 100644
index 000000000..b45fb619b
--- /dev/null
+++ b/interface-definitions/include/firewall/icmp-type-name.xml.i
@@ -0,0 +1,173 @@
+<!-- include start from firewall/icmp-type-name.xml.i -->
+<leafNode name="type-name">
+  <properties>
+    <help>ICMP type-name</help>
+    <completionHelp>
+      <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply</list>
+    </completionHelp>
+    <valueHelp>
+      <format>any</format>
+      <description>Any ICMP type/code</description>
+    </valueHelp>
+    <valueHelp>
+      <format>echo-reply</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>pong</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>destination-unreachable</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>network-unreachable</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>host-unreachable</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>protocol-unreachable</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>port-unreachable</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>fragmentation-needed</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>source-route-failed</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>network-unknown</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>host-unknown</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>network-prohibited</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>host-prohibited</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>TOS-network-unreachable</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>TOS-host-unreachable</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>communication-prohibited</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>host-precedence-violation</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>precedence-cutoff</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>source-quench</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>redirect</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>network-redirect</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>host-redirect</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>TOS-network-redirect</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>TOS host-redirect</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>echo-request</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ping</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>router-advertisement</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>router-solicitation</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>time-exceeded</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ttl-exceeded</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ttl-zero-during-transit</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ttl-zero-during-reassembly</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>parameter-problem</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ip-header-bad</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>required-option-missing</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>timestamp-request</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>timestamp-reply</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>address-mask-request</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <valueHelp>
+      <format>address-mask-reply</format>
+      <description>ICMP type/code name</description>
+    </valueHelp>
+    <constraint>
+      <regex>^(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply)$</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/log.xml.i b/interface-definitions/include/firewall/log.xml.i
new file mode 100644
index 000000000..46d20c1df
--- /dev/null
+++ b/interface-definitions/include/firewall/log.xml.i
@@ -0,0 +1,15 @@
+<!-- include start from firewall/log.xml.i -->
+<node name="log">
+  <properties>
+    <help>Option to log packets</help>
+  </properties>
+  <children>
+    <leafNode name="enable">
+      <properties>
+        <help>Enable logging</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/name-default-action.xml.i b/interface-definitions/include/firewall/name-default-action.xml.i
new file mode 100644
index 000000000..1b61b076f
--- /dev/null
+++ b/interface-definitions/include/firewall/name-default-action.xml.i
@@ -0,0 +1,25 @@
+<!-- include start from firewall/name-default-action.xml.i -->
+<leafNode name="default-action">
+  <properties>
+    <help>Default-action for rule-set</help>
+    <completionHelp>
+      <list>drop reject accept</list>
+    </completionHelp>
+    <valueHelp>
+      <format>drop</format>
+      <description>Drop if no prior rules are hit (default)</description>
+    </valueHelp>
+    <valueHelp>
+      <format>reject</format>
+      <description>Drop and notify source if no prior rules are hit</description>
+    </valueHelp>
+    <valueHelp>
+      <format>accept</format>
+      <description>Accept if no prior rules are hit</description>
+    </valueHelp>
+    <constraint>
+      <regex>^(drop|reject|accept)$</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/name-default-log.xml.i b/interface-definitions/include/firewall/name-default-log.xml.i
new file mode 100644
index 000000000..979395146
--- /dev/null
+++ b/interface-definitions/include/firewall/name-default-log.xml.i
@@ -0,0 +1,8 @@
+<!-- include start from firewall/name-default-log.xml.i -->
+<leafNode name="enable-default-log">
+  <properties>
+    <help>Option to log packets hitting default-action</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/port.xml.i b/interface-definitions/include/firewall/port.xml.i
new file mode 100644
index 000000000..59d92978b
--- /dev/null
+++ b/interface-definitions/include/firewall/port.xml.i
@@ -0,0 +1,23 @@
+<!-- include start from firewall/port.xml.i -->
+<leafNode name="port">
+  <properties>
+    <help>Port</help>
+    <valueHelp>
+      <format>txt</format>
+      <description>Named port (any name in /etc/services, e.g., http)</description>
+    </valueHelp>
+    <valueHelp>
+      <format>u32:1-65535</format>
+      <description>Numbered port</description>
+    </valueHelp>
+    <valueHelp>
+      <format>&lt;start-end&gt;</format>
+      <description>Numbered port range (e.g. 1001-1005)</description>
+    </valueHelp>
+    <valueHelp>
+      <format> </format>
+      <description>\n\n  Multiple destination ports can be specified as a comma-separated list.\n  The whole list can also be negated using '!'.\n  For example: '!22,telnet,http,123,1001-1005'</description>
+    </valueHelp>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i
new file mode 100644
index 000000000..30226b0d8
--- /dev/null
+++ b/interface-definitions/include/firewall/source-destination-group.xml.i
@@ -0,0 +1,24 @@
+<!-- include start from firewall/source-destination-group.xml.i -->
+<node name="group">
+  <properties>
+    <help>Group</help>
+  </properties>
+  <children>
+    <leafNode name="address-group">
+      <properties>
+        <help>Group of addresses</help>
+      </properties>
+    </leafNode>
+    <leafNode name="network-group">
+      <properties>
+        <help>Group of networks</help>
+      </properties>
+    </leafNode>
+    <leafNode name="port-group">
+      <properties>
+        <help>Group of ports</help>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->