Merge pull request #4991 from c-po/policy-xml-cleanup

xml: T8271: cleanup duplicate includes and split duplicate code into new building blocks

13 files changed, 271 insertions, 310 deletions

diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
index e8da1a0e1..85f1071a6 100644
--- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
@@ -27,7 +27,12 @@
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
     #include <include/firewall/port.xml.i>
-    #include <include/firewall/source-destination-group.xml.i>
+    #include <include/firewall/source-destination-group-ipv4.xml.i>
+    <node name="group">
+      <children>
+        #include <include/firewall/mac-group.xml.i>
+      </children>
+    </node>
   </children>
 </node>
 <node name="source">
@@ -41,7 +46,12 @@
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
     #include <include/firewall/port.xml.i>
-    #include <include/firewall/source-destination-group.xml.i>
+    #include <include/firewall/source-destination-group-ipv4.xml.i>
+    <node name="group">
+      <children>
+        #include <include/firewall/mac-group.xml.i>
+      </children>
+    </node>
   </children>
 </node>
-<!-- include end -->
\ No newline at end of file
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i
index b67ef25dc..b6c1b13b3 100644
--- a/interface-definitions/include/firewall/common-rule-ipv4.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i
@@ -14,7 +14,12 @@
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
     #include <include/firewall/port.xml.i>
-    #include <include/firewall/source-destination-group.xml.i>
+    #include <include/firewall/source-destination-group-ipv4.xml.i>
+    <node name="group">
+      <children>
+        #include <include/firewall/mac-group.xml.i>
+      </children>
+    </node>
     #include <include/firewall/source-destination-dynamic-group.xml.i>
     #include <include/firewall/source-destination-remote-group.xml.i>
   </children>
@@ -38,9 +43,14 @@
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
     #include <include/firewall/port.xml.i>
-    #include <include/firewall/source-destination-group.xml.i>
+    #include <include/firewall/source-destination-group-ipv4.xml.i>
+    <node name="group">
+      <children>
+        #include <include/firewall/mac-group.xml.i>
+      </children>
+    </node>
     #include <include/firewall/source-destination-dynamic-group.xml.i>
     #include <include/firewall/source-destination-remote-group.xml.i>
   </children>
 </node>
-<!-- include end -->
\ No newline at end of file
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/domain-group.xml.i b/interface-definitions/include/firewall/domain-group.xml.i
new file mode 100644
index 000000000..46e00ce09
--- /dev/null
+++ b/interface-definitions/include/firewall/domain-group.xml.i
@@ -0,0 +1,10 @@
+<!-- include start from firewall/domain-group.xml.i -->
+<leafNode name="domain-group">
+  <properties>
+    <help>Group of domains</help>
+    <completionHelp>
+      <path>firewall group domain-group</path>
+    </completionHelp>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/icmpv6.xml.i b/interface-definitions/include/firewall/icmpv6.xml.i
index c0118626e..9631f0012 100644
--- a/interface-definitions/include/firewall/icmpv6.xml.i
+++ b/interface-definitions/include/firewall/icmpv6.xml.i
@@ -6,7 +6,7 @@
   <children>
     <leafNode name="code">
       <properties>
-        <help>ICMPv6 code</help>
+        <help>ICMPv6 code field - depends on the message type</help>
         <valueHelp>
           <format>u32:0-255</format>
           <description>ICMPv6 code (0-255)</description>
@@ -18,10 +18,14 @@
     </leafNode>
     <leafNode name="type">
       <properties>
-        <help>ICMPv6 type</help>
+        <help>ICMPv6 message type</help>
         <valueHelp>
-          <format>u32:0-255</format>
-          <description>ICMPv6 type (0-255)</description>
+          <format>u32:0-127</format>
+          <description>ICMPv6 error message</description>
+        </valueHelp>
+        <valueHelp>
+          <format>u32:128-255</format>
+          <description>ICMPv6 information message</description>
         </valueHelp>
         <constraint>
           <validator name="numeric" argument="--range 0-255"/>
diff --git a/interface-definitions/include/firewall/port-group.xml.i b/interface-definitions/include/firewall/port-group.xml.i
new file mode 100644
index 000000000..297f0d781
--- /dev/null
+++ b/interface-definitions/include/firewall/port-group.xml.i
@@ -0,0 +1,10 @@
+    <!-- include start from firewall/port-group.xml.i -->
+    <leafNode name="port-group">
+      <properties>
+        <help>Group of ports</help>
+        <completionHelp>
+          <path>firewall group port-group</path>
+        </completionHelp>
+      </properties>
+    </leafNode>
+    <!-- include end -->
diff --git a/interface-definitions/include/firewall/source-destination-group-inet.xml.i b/interface-definitions/include/firewall/source-destination-group-inet.xml.i
index 174051624..775fda9b3 100644
--- a/interface-definitions/include/firewall/source-destination-group-inet.xml.i
+++ b/interface-definitions/include/firewall/source-destination-group-inet.xml.i
@@ -20,7 +20,6 @@
         </completionHelp>
       </properties>
     </leafNode>
-    #include <include/firewall/mac-group.xml.i>
     <leafNode name="ipv4-network-group">
       <properties>
         <help>Group of IPv4 networks</help>
@@ -37,14 +36,8 @@
         </completionHelp>
       </properties>
     </leafNode>
-    <leafNode name="port-group">
-      <properties>
-        <help>Group of ports</help>
-        <completionHelp>
-          <path>firewall group port-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
+    #include <include/firewall/mac-group.xml.i>
+    #include <include/firewall/port-group.xml.i>
   </children>
 </node>
 <!-- include end -->
diff --git a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i
index 8c34fb933..ccee5b247 100644
--- a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i
+++ b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i
@@ -12,14 +12,6 @@
         </completionHelp>
       </properties>
     </leafNode>
-    <leafNode name="domain-group">
-      <properties>
-        <help>Group of domains</help>
-        <completionHelp>
-          <path>firewall group domain-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
     <leafNode name="network-group">
       <properties>
         <help>Group of networks</help>
@@ -28,14 +20,8 @@
         </completionHelp>
       </properties>
     </leafNode>
-    <leafNode name="port-group">
-      <properties>
-        <help>Group of ports</help>
-        <completionHelp>
-          <path>firewall group port-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
+    #include <include/firewall/domain-group.xml.i>
+    #include <include/firewall/port-group.xml.i>
   </children>
 </node>
 <!-- include end -->
diff --git a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i
index 2a42d236c..43a9e9cf5 100644
--- a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i
+++ b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i
@@ -12,15 +12,6 @@
         </completionHelp>
       </properties>
     </leafNode>
-    <leafNode name="domain-group">
-      <properties>
-        <help>Group of domains</help>
-        <completionHelp>
-          <path>firewall group domain-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
-    #include <include/firewall/mac-group.xml.i>
     <leafNode name="network-group">
       <properties>
         <help>Group of networks</help>
@@ -29,14 +20,9 @@
         </completionHelp>
       </properties>
     </leafNode>
-    <leafNode name="port-group">
-      <properties>
-        <help>Group of ports</help>
-        <completionHelp>
-          <path>firewall group port-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
+    #include <include/firewall/mac-group.xml.i>
+    #include <include/firewall/domain-group.xml.i>
+    #include <include/firewall/port-group.xml.i>
   </children>
 </node>
 <!-- include end -->
diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i
deleted file mode 100644
index 6ebee356c..000000000
--- a/interface-definitions/include/firewall/source-destination-group.xml.i
+++ /dev/null
@@ -1,42 +0,0 @@
-<!-- include start from firewall/source-destination-group.xml.i -->
-<node name="group">
-  <properties>
-    <help>Group</help>
-  </properties>
-  <children>
-    <leafNode name="address-group">
-      <properties>
-        <help>Group of addresses</help>
-        <completionHelp>
-          <path>firewall group address-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
-    <leafNode name="domain-group">
-      <properties>
-        <help>Group of domains</help>
-        <completionHelp>
-          <path>firewall group domain-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
-    #include <include/firewall/mac-group.xml.i>
-    <leafNode name="network-group">
-      <properties>
-        <help>Group of networks</help>
-        <completionHelp>
-          <path>firewall group network-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
-    <leafNode name="port-group">
-      <properties>
-        <help>Group of ports</help>
-        <completionHelp>
-          <path>firewall group port-group</path>
-        </completionHelp>
-      </properties>
-    </leafNode>
-  </children>
-</node>
-<!-- include end -->
diff --git a/interface-definitions/include/nat-rule.xml.i b/interface-definitions/include/nat-rule.xml.i
index 0a7179ff1..3d5a6ede1 100644
--- a/interface-definitions/include/nat-rule.xml.i
+++ b/interface-definitions/include/nat-rule.xml.i
@@ -21,7 +21,12 @@
         #include <include/firewall/fqdn.xml.i>
         #include <include/nat-address.xml.i>
         #include <include/nat-port.xml.i>
-        #include <include/firewall/source-destination-group.xml.i>
+        #include <include/firewall/source-destination-group-ipv4.xml.i>
+        <node name="group">
+          <children>
+            #include <include/firewall/mac-group.xml.i>
+          </children>
+        </node>
       </children>
     </node>
     #include <include/generic-disable-node.xml.i>
@@ -319,7 +324,12 @@
         #include <include/firewall/fqdn.xml.i>
         #include <include/nat-address.xml.i>
         #include <include/nat-port.xml.i>
-        #include <include/firewall/source-destination-group.xml.i>
+        #include <include/firewall/source-destination-group-ipv4.xml.i>
+        <node name="group">
+          <children>
+            #include <include/firewall/mac-group.xml.i>
+          </children>
+        </node>
       </children>
     </node>
   </children>
diff --git a/interface-definitions/include/policy/route-ipv4.xml.i b/interface-definitions/include/policy/route-ipv4.xml.i
deleted file mode 100644
index c12abcae2..000000000
--- a/interface-definitions/include/policy/route-ipv4.xml.i
+++ /dev/null
@@ -1,14 +0,0 @@
-<!-- include start from policy/route-ipv4.xml.i -->
-<node name="source">
-  <properties>
-    <help>Source parameters</help>
-  </properties>
-  <children>
-    #include <include/firewall/address.xml.i>
-    #include <include/firewall/source-destination-group.xml.i>
-    #include <include/firewall/mac-address.xml.i>
-    #include <include/firewall/port.xml.i>
-  </children>
-</node>
-#include <include/firewall/icmp.xml.i>
-<!-- include end -->
diff --git a/interface-definitions/include/policy/route-ipv6.xml.i b/interface-definitions/include/policy/route-ipv6.xml.i
deleted file mode 100644
index d636a654b..000000000
--- a/interface-definitions/include/policy/route-ipv6.xml.i
+++ /dev/null
@@ -1,196 +0,0 @@
-<!-- include start from policy/route-ipv6.xml.i -->
-<node name="source">
-  <properties>
-    <help>Source parameters</help>
-  </properties>
-  <children>
-    #include <include/firewall/address-ipv6.xml.i>
-    #include <include/firewall/source-destination-group.xml.i>
-    #include <include/firewall/mac-address.xml.i>
-    #include <include/firewall/port.xml.i>
-  </children>
-</node>
-<node name="icmpv6">
-  <properties>
-    <help>ICMPv6 type and code information</help>
-  </properties>
-  <children>
-    <leafNode name="type">
-      <properties>
-        <help>ICMP type-name</help>
-        <completionHelp>
-          <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply packet-too-big</list>
-        </completionHelp>
-        <valueHelp>
-          <format>any</format>
-          <description>Any ICMP type/code</description>
-        </valueHelp>
-        <valueHelp>
-          <format>echo-reply</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>pong</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>destination-unreachable</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>network-unreachable</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>host-unreachable</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>protocol-unreachable</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>port-unreachable</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>fragmentation-needed</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>source-route-failed</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>network-unknown</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>host-unknown</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>network-prohibited</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>host-prohibited</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>TOS-network-unreachable</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>TOS-host-unreachable</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>communication-prohibited</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>host-precedence-violation</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>precedence-cutoff</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>source-quench</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>redirect</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>network-redirect</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>host-redirect</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>TOS-network-redirect</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>TOS host-redirect</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>echo-request</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>ping</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>router-advertisement</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>router-solicitation</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>time-exceeded</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>ttl-exceeded</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>ttl-zero-during-transit</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>ttl-zero-during-reassembly</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>parameter-problem</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>ip-header-bad</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>required-option-missing</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>timestamp-request</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>timestamp-reply</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>address-mask-request</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>address-mask-reply</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <valueHelp>
-          <format>packet-too-big</format>
-          <description>ICMP type/code name</description>
-        </valueHelp>
-        <constraint>
-          <regex>(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply|packet-too-big)</regex>
-          <validator name="numeric" argument="--range 0-255"/>
-        </constraint>
-      </properties>
-    </leafNode>
-  </children>
-</node>
-<!-- include end -->
diff --git a/interface-definitions/policy_route.xml.in b/interface-definitions/policy_route.xml.in
index 48f728923..6ec52feeb 100644
--- a/interface-definitions/policy_route.xml.in
+++ b/interface-definitions/policy_route.xml.in
@@ -45,12 +45,195 @@
                 <children>
                   #include <include/firewall/address-ipv6.xml.i>
                   #include <include/firewall/source-destination-group-ipv6.xml.i>
+                  #include <include/firewall/mac-address.xml.i>
                   #include <include/firewall/port.xml.i>
                   #include <include/firewall/geoip.xml.i>
                 </children>
               </node>
+              <node name="icmpv6">
+                <properties>
+                  <help>ICMPv6 type and code information</help>
+                </properties>
+                <children>
+                  <leafNode name="type">
+                    <properties>
+                      <help>ICMP type-name</help>
+                      <completionHelp>
+                        <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply packet-too-big</list>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>any</format>
+                        <description>Any ICMP type/code</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>echo-reply</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>pong</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>destination-unreachable</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>network-unreachable</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>host-unreachable</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>protocol-unreachable</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>port-unreachable</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>fragmentation-needed</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>source-route-failed</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>network-unknown</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>host-unknown</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>network-prohibited</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>host-prohibited</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>TOS-network-unreachable</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>TOS-host-unreachable</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>communication-prohibited</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>host-precedence-violation</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>precedence-cutoff</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>source-quench</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>redirect</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>network-redirect</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>host-redirect</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>TOS-network-redirect</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>TOS host-redirect</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>echo-request</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ping</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>router-advertisement</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>router-solicitation</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>time-exceeded</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ttl-exceeded</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ttl-zero-during-transit</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ttl-zero-during-reassembly</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>parameter-problem</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ip-header-bad</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>required-option-missing</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>timestamp-request</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>timestamp-reply</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>address-mask-request</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>address-mask-reply</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>packet-too-big</format>
+                        <description>ICMP type/code name</description>
+                      </valueHelp>
+                      <constraint>
+                        <regex>(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply|packet-too-big)</regex>
+                        <validator name="numeric" argument="--range 0-255"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
               #include <include/policy/route-common.xml.i>
-              #include <include/policy/route-ipv6.xml.i>
               #include <include/firewall/dscp.xml.i>
               #include <include/firewall/packet-options.xml.i>
               #include <include/firewall/hop-limit.xml.i>
@@ -90,7 +273,12 @@
                 </properties>
                 <children>
                   #include <include/firewall/address.xml.i>
-                  #include <include/firewall/source-destination-group.xml.i>
+                  #include <include/firewall/source-destination-group-ipv4.xml.i>
+                  <node name="group">
+                    <children>
+                      #include <include/firewall/mac-group.xml.i>
+                    </children>
+                  </node>
                   #include <include/firewall/port.xml.i>
                   #include <include/firewall/geoip.xml.i>
                 </children>
@@ -101,13 +289,19 @@
                 </properties>
                 <children>
                   #include <include/firewall/address.xml.i>
-                  #include <include/firewall/source-destination-group.xml.i>
+                  #include <include/firewall/source-destination-group-ipv4.xml.i>
+                  <node name="group">
+                    <children>
+                      #include <include/firewall/mac-group.xml.i>
+                    </children>
+                  </node>
                   #include <include/firewall/port.xml.i>
                   #include <include/firewall/geoip.xml.i>
+                  #include <include/firewall/mac-address.xml.i>
                 </children>
               </node>
               #include <include/policy/route-common.xml.i>
-              #include <include/policy/route-ipv4.xml.i>
+              #include <include/firewall/icmp.xml.i>
               #include <include/firewall/dscp.xml.i>
               #include <include/firewall/packet-options.xml.i>
               #include <include/firewall/ttl.xml.i>