/* $XORP: xorp/xrl/interfaces/fea_firewall.xif,v 1.1 2008/04/26 00:59:49 pavlin Exp $ */

#include <xorp_config.h>

#ifndef XORP_DISABLE_FIREWALL

/*
 * FEA Firewall interface.
 */

interface fea_firewall/0.1 {
	/**
	 * Start firewall configuration transaction.
	 *
	 * @param tid the transaction ID returned by this operation.
	 */
	start_transaction -> tid:u32;

	/**
	 * Commit firewall configuration transaction.
	 *
	 * @param tid the transaction ID for this operation.
	 */
	commit_transaction ? tid:u32;

	/**
	 * Abort firewall configuration transaction.
	 *
	 * @param tid the transaction ID for this operation.
	 */
	abort_transaction ? tid:u32;

	/**
	 * Add an IPv4 firewall entry.
	 *
	 * @param tid the transaction ID for this operation.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter is
	 * to be applied.
	 * @param vifname the name of the vif where this filter is
	 * to be applied.
	 * @param src_network the source IPv4 network address prefix.
	 * @param dst_network the destination IPv4 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 * @param action the action to be taken when this filter is matched.
	 * It is one of the following keywords:
	 * "none", "pass", "drop", "reject".
	 */
	add_entry4	? tid:u32					\
			& rule_number:u32				\
			& ifname:txt					\
			& vifname:txt					\
			& src_network:ipv4net				\
			& dst_network:ipv4net				\
			& ip_protocol:u32				\
			& src_port_begin:u32				\
			& src_port_end:u32				\
			& dst_port_begin:u32				\
			& dst_port_end:u32				\
			& action:txt;

	/**
	 * Replace an IPv4 firewall entry.
	 *
	 * @param tid the transaction ID for this operation.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter is
	 * to be applied.
	 * @param vifname the name of the vif where this filter is
	 * to be applied.
	 * @param src_network the source IPv4 network address prefix.
	 * @param dst_network the destination IPv4 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 * @param action the action to be taken when this filter is matched.
	 * It is one of the following keywords:
	 * "none", "pass", "drop", "reject".
	 */
	replace_entry4	? tid:u32					\
			& rule_number:u32				\
			& ifname:txt					\
			& vifname:txt					\
			& src_network:ipv4net				\
			& dst_network:ipv4net				\
			& ip_protocol:u32				\
			& src_port_begin:u32				\
			& src_port_end:u32				\
			& dst_port_begin:u32				\
			& dst_port_end:u32				\
			& action:txt;

	/**
	 * Delete an IPv4 firewall entry.
	 *
	 * @param tid the transaction ID for this operation.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter is
	 * to be deleted.
	 * @param vifname the name of the vif where this filter is
	 * to be deleted.
	 * @param src_network the source IPv4 network address prefix.
	 * @param dst_network the destination IPv4 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 */
	delete_entry4	? tid:u32					\
			& rule_number:u32				\
			& ifname:txt					\
			& vifname:txt					\
			& src_network:ipv4net				\
			& dst_network:ipv4net				\
			& ip_protocol:u32				\
			& src_port_begin:u32				\
			& src_port_end:u32				\
			& dst_port_begin:u32				\
			& dst_port_end:u32;

	/**
	 * Delete all IPv4 firewall entries.
	 *
	 * @param tid the transaction ID for this operation.
	 */
	delete_all_entries4 ? tid:u32;

	/**
	 * Get a token for a list of IPv4 firewall entries.
	 *
	 * @param token to be provided when calling get_entry_list_next4.
	 * @param more true if the list is not empty.
	 */
	get_entry_list_start4 -> token:u32 & more:bool;

	/**
	 * Get the next item in a list of IPv4 firewall entries.
	 *
	 * @param token returned by a previous call to get_entry_list_start4.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter exists.
	 * @param vifname the name of the vif where this filter exists.
	 * @param src_network the source IPv4 network address prefix.
	 * @param dst_network the destination IPv4 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 * @param action the action taken when this filter is matched.
	 * It is one of the following keywords:
	 * "none", "pass", "drop", "reject".
	 * @param more true if the list has more items remaining.
	 */
	get_entry_list_next4	? token:u32				\
				-> rule_number:u32			\
				& ifname:txt				\
				& vifname:txt				\
				& src_network:ipv4net			\
				& dst_network:ipv4net			\
				& ip_protocol:u32			\
				& src_port_begin:u32			\
				& src_port_end:u32			\
				& dst_port_begin:u32			\
				& dst_port_end:u32			\
				& action:txt				\
				& more:bool;
#ifdef HAVE_IPV6

	/**
	 * Add an IPv6 firewall entry.
	 *
	 * @param tid the transaction ID for this operation.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter is
	 * to be applied.
	 * @param vifname the name of the vif where this filter is
	 * to be applied.
	 * @param src_network the source IPv6 network address prefix.
	 * @param dst_network the destination IPv6 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 * @param action the action to be taken when this filter is matched.
	 * It is one of the following keywords:
	 * "none", "pass", "drop", "reject".
	 */
	add_entry6	? tid:u32					\
			& rule_number:u32				\
			& ifname:txt					\
			& vifname:txt					\
			& src_network:ipv6net				\
			& dst_network:ipv6net				\
			& ip_protocol:u32				\
			& src_port_begin:u32				\
			& src_port_end:u32				\
			& dst_port_begin:u32				\
			& dst_port_end:u32				\
			& action:txt;

	/**
	 * Replace an IPv6 firewall entry.
	 *
	 * @param tid the transaction ID for this operation.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter is
	 * to be applied.
	 * @param vifname the name of the vif where this filter is
	 * to be applied.
	 * @param src_network the source IPv6 network address prefix.
	 * @param dst_network the destination IPv6 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 * @param action the action to be taken when this filter is matched.
	 * It is one of the following keywords:
	 * "none", "pass", "drop", "reject".
	 */
	replace_entry6	? tid:u32					\
			& rule_number:u32				\
			& ifname:txt					\
			& vifname:txt					\
			& src_network:ipv6net				\
			& dst_network:ipv6net				\
			& ip_protocol:u32				\
			& src_port_begin:u32				\
			& src_port_end:u32				\
			& dst_port_begin:u32				\
			& dst_port_end:u32				\
			& action:txt;

	/**
	 * Delete an IPv6 firewall entry.
	 *
	 * @param tid the transaction ID for this operation.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter is
	 * to be deleted.
	 * @param vifname the name of the vif where this filter is
	 * to be deleted.
	 * @param src_network the source IPv6 network address prefix.
	 * @param dst_network the destination IPv6 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 */
	delete_entry6	? tid:u32					\
			& rule_number:u32				\
			& ifname:txt					\
			& vifname:txt					\
			& src_network:ipv6net				\
			& dst_network:ipv6net				\
			& ip_protocol:u32				\
			& src_port_begin:u32				\
			& src_port_end:u32				\
			& dst_port_begin:u32				\
			& dst_port_end:u32;

	/**
	 * Delete all IPv6 firewall entries.
	 *
	 * @param tid the transaction ID for this operation.
	 */
	delete_all_entries6 ? tid:u32;

	/**
	 * Get a token for a list of IPv6 firewall entries.
	 *
	 * @param token to be provided when calling get_entry_list_next6.
	 * @param more true if the list is not empty.
	 */
	get_entry_list_start6 -> token:u32 & more:bool;

	/**
	 * Get the next item in a list of IPv6 firewall entries.
	 *
	 * @param token returned by a previous call to get_entry_list_start6.
	 * @param rule_number the rule number for this entry.
	 * @param ifname the name of the interface where this filter exists.
	 * @param vifname the name of the vif where this filter exists.
	 * @param src_network the source IPv6 network address prefix.
	 * @param dst_network the destination IPv6 network address prefix.
	 * @param ip_protocol the IP protocol number (1-255, or 0 if
	 * wildcard).
	 * @param src_port_begin the source TCP/UDP begin port (0-65535).
	 * @param src_port_end the source TCP/UDP end port (0-65535).
	 * @param dst_port_begin the destination TCP/UDP begin port (0-65535).
	 * @param dst_port_end the destination TCP/UDP end port (0-65535).
	 * @param action the action taken when this filter is matched.
	 * It is one of the following keywords:
	 * "none", "pass", "drop", "reject".
	 * @param more true if the list has more items remaining.
	 */
	get_entry_list_next6	? token:u32				\
				-> rule_number:u32			\
				& ifname:txt				\
				& vifname:txt				\
				& src_network:ipv6net			\
				& dst_network:ipv6net			\
				& ip_protocol:u32			\
				& src_port_begin:u32			\
				& src_port_end:u32			\
				& dst_port_begin:u32			\
				& dst_port_end:u32			\
				& action:txt				\
				& more:bool;
#endif //ipv6

	/* Does nothing, but allows us to 'verify' startup in rtr-mgr*/
	startup_firewall;
}

#endif //firewall
