Merge branch 'firewall' of https://github.com/sarthurdev/vyos-1x into current

* 'firewall' of https://github.com/sarthurdev/vyos-1x:
  zone_policy: T3873: Implement intra-zone-filtering
  policy: T2199: Migrate policy route op-mode to XML/Python
  policy: T2199: Migrate policy route to XML/Python
  zone-policy: T2199: Migrate zone-policy op-mode to XML/Python
  zone-policy: T2199: Migrate zone-policy to XML/Python
  firewall: T2199: Migrate firewall op-mode to XML/Python
  firewall: T2199: Migrate firewall to XML/Python

8 files changed, 321 insertions, 0 deletions

diff --git a/interface-definitions/include/interface/interface-firewall-vif-c.xml.i b/interface-definitions/include/interface/interface-firewall-vif-c.xml.i
new file mode 100644
index 000000000..1bc235fcb
--- /dev/null
+++ b/interface-definitions/include/interface/interface-firewall-vif-c.xml.i
@@ -0,0 +1,79 @@
+<!-- include start from interface/interface-firewall-vif-c.xml.i -->
+<node name="firewall" owner="${vyos_conf_scripts_dir}/firewall-interface.py $VAR(../../../@).$VAR(../../@).$VAR(../@)">
+  <properties>
+    <priority>615</priority>
+    <help>Firewall options</help>
+  </properties>
+  <children>
+    <node name="in">
+      <properties>
+        <help>forwarded packets on inbound interface</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Inbound IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Inbound IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+    <node name="out">
+      <properties>
+        <help>forwarded packets on outbound interface</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Outbound IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Outbound IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+    <node name="local">
+      <properties>
+        <help>packets destined for this router</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Local IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Local IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/interface/interface-firewall-vif.xml.i b/interface-definitions/include/interface/interface-firewall-vif.xml.i
new file mode 100644
index 000000000..a37ac5c4a
--- /dev/null
+++ b/interface-definitions/include/interface/interface-firewall-vif.xml.i
@@ -0,0 +1,79 @@
+<!-- include start from interface/interface-firewall-vif.xml.i -->
+<node name="firewall" owner="${vyos_conf_scripts_dir}/firewall-interface.py $VAR(../../@).$VAR(../@)">
+  <properties>
+    <priority>615</priority>
+    <help>Firewall options</help>
+  </properties>
+  <children>
+    <node name="in">
+      <properties>
+        <help>forwarded packets on inbound interface</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Inbound IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Inbound IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+    <node name="out">
+      <properties>
+        <help>forwarded packets on outbound interface</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Outbound IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Outbound IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+    <node name="local">
+      <properties>
+        <help>packets destined for this router</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Local IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Local IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/interface/interface-firewall.xml.i b/interface-definitions/include/interface/interface-firewall.xml.i
new file mode 100644
index 000000000..b3f20c3bf
--- /dev/null
+++ b/interface-definitions/include/interface/interface-firewall.xml.i
@@ -0,0 +1,79 @@
+<!-- include start from interface/interface-firewall.xml.i -->
+<node name="firewall" owner="${vyos_conf_scripts_dir}/firewall-interface.py $VAR(../@)">
+  <properties>
+    <priority>615</priority>
+    <help>Firewall options</help>
+  </properties>
+  <children>
+    <node name="in">
+      <properties>
+        <help>forwarded packets on inbound interface</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Inbound IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Inbound IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+    <node name="out">
+      <properties>
+        <help>forwarded packets on outbound interface</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Outbound IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Outbound IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+    <node name="local">
+      <properties>
+        <help>packets destined for this router</help>
+      </properties>
+      <children>
+        <leafNode name="name">
+          <properties>
+            <help>Local IPv4 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+        <leafNode name="ipv6-name">
+          <properties>
+            <help>Local IPv6 firewall ruleset name for interface</help>
+            <completionHelp>
+              <path>firewall ipv6-name</path>
+            </completionHelp>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/interface/interface-policy-vif-c.xml.i b/interface-definitions/include/interface/interface-policy-vif-c.xml.i
new file mode 100644
index 000000000..5dad6422b
--- /dev/null
+++ b/interface-definitions/include/interface/interface-policy-vif-c.xml.i
@@ -0,0 +1,26 @@
+<!-- include start from interface/interface-policy-vif-c.xml.i -->
+<node name="policy" owner="${vyos_conf_scripts_dir}/policy-route-interface.py $VAR(../../../@).$VAR(../../@).$VAR(../@)">
+  <properties>
+    <priority>620</priority>
+    <help>Policy route options</help>
+  </properties>
+  <children>
+    <leafNode name="route">
+      <properties>
+        <help>IPv4 policy route ruleset for interface</help>
+        <completionHelp>
+          <path>policy route</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+    <leafNode name="ipv6-route">
+      <properties>
+        <help>IPv6 policy route ruleset for interface</help>
+        <completionHelp>
+          <path>policy ipv6-route</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/interface/interface-policy-vif.xml.i b/interface-definitions/include/interface/interface-policy-vif.xml.i
new file mode 100644
index 000000000..5ee80ae13
--- /dev/null
+++ b/interface-definitions/include/interface/interface-policy-vif.xml.i
@@ -0,0 +1,26 @@
+<!-- include start from interface/interface-policy-vif.xml.i -->
+<node name="policy" owner="${vyos_conf_scripts_dir}/policy-route-interface.py $VAR(../../@).$VAR(../@)">
+  <properties>
+    <priority>620</priority>
+    <help>Policy route options</help>
+  </properties>
+  <children>
+    <leafNode name="route">
+      <properties>
+        <help>IPv4 policy route ruleset for interface</help>
+        <completionHelp>
+          <path>policy route</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+    <leafNode name="ipv6-route">
+      <properties>
+        <help>IPv6 policy route ruleset for interface</help>
+        <completionHelp>
+          <path>policy ipv6-route</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/interface/interface-policy.xml.i b/interface-definitions/include/interface/interface-policy.xml.i
new file mode 100644
index 000000000..06f025af1
--- /dev/null
+++ b/interface-definitions/include/interface/interface-policy.xml.i
@@ -0,0 +1,26 @@
+<!-- include start from interface/interface-policy.xml.i -->
+<node name="policy" owner="${vyos_conf_scripts_dir}/policy-route-interface.py $VAR(../@)">
+  <properties>
+    <priority>620</priority>
+    <help>Policy route options</help>
+  </properties>
+  <children>
+    <leafNode name="route">
+      <properties>
+        <help>IPv4 policy route ruleset for interface</help>
+        <completionHelp>
+          <path>policy route</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+    <leafNode name="ipv6-route">
+      <properties>
+        <help>IPv6 policy route ruleset for interface</help>
+        <completionHelp>
+          <path>policy ipv6-route</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/interface/vif-s.xml.i b/interface-definitions/include/interface/vif-s.xml.i
index e7ba6d193..f1a61ff64 100644
--- a/interface-definitions/include/interface/vif-s.xml.i
+++ b/interface-definitions/include/interface/vif-s.xml.i
@@ -18,6 +18,8 @@
     #include <include/interface/dhcpv6-options.xml.i>
     #include <include/interface/disable-link-detect.xml.i>
     #include <include/interface/disable.xml.i>
+    #include <include/interface/interface-firewall-vif.xml.i>
+    #include <include/interface/interface-policy-vif.xml.i>
     <leafNode name="protocol">
       <properties>
         <help>Protocol used for service VLAN (default: 802.1ad)</help>
@@ -63,6 +65,8 @@
         #include <include/interface/mac.xml.i>
         #include <include/interface/mtu-68-16000.xml.i>
         #include <include/interface/vrf.xml.i>
+        #include <include/interface/interface-firewall-vif-c.xml.i>
+        #include <include/interface/interface-policy-vif-c.xml.i>
       </children>
     </tagNode>
     #include <include/interface/vrf.xml.i>
diff --git a/interface-definitions/include/interface/vif.xml.i b/interface-definitions/include/interface/vif.xml.i
index 5644c554f..11ba7e2f8 100644
--- a/interface-definitions/include/interface/vif.xml.i
+++ b/interface-definitions/include/interface/vif.xml.i
@@ -19,6 +19,8 @@
     #include <include/interface/disable-link-detect.xml.i>
     #include <include/interface/disable.xml.i>
     #include <include/interface/vrf.xml.i>
+    #include <include/interface/interface-firewall-vif.xml.i>
+    #include <include/interface/interface-policy-vif.xml.i>
     <leafNode name="egress-qos">
       <properties>
         <help>VLAN egress QoS</help>