/
fwbuilder.dtd.in
709 lines (605 loc) · 18.4 KB
/
fwbuilder.dtd.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
<?xml version="1.0" encoding="utf-8"?>
<!--
Firewall Builder Document Type Definition
http://www.fwbuilder.org/
Authors: Friedhelm Duesterhoeft, Vadim Zaliva, Vadim Kurland, Tidei Maurizio, Sirius Bakke
-->
<!ENTITY % BOOLEAN "(False|True)">
<!ENTITY % STRING "CDATA">
<!ENTITY % NUMBER "CDATA">
<!--
* Supported policy rule actions:
*
* Accept - accept the packet, analysis terminates
*
* Reject - reject the packet and send ICMP 'unreachable' or
* TCP RST back to sender, analysis terminates
*
* Deny - drop the packet, nothing is sent back to sender,
* analysis terminates
*
* Scrub - run the packet through normalizer (see 'scrub' in
* PF), continue analysis
*
* Return - action used internally, meaning may depend on
* implementation of the policy compiler but generally
* means return from the block of rules
*
* Skip - skip N rules down and continue analysis. Used
* internally.
*
* Continue - do nothing, continue analysis. Used internally.
*
* Accounting - generate target firewall platform rule to count
* the packet and continue analysis.
*
* Modify - edit the packet (change some header values, like
* TOS bits) or mark it somehow if the kernel supports
* that (e.g. target MARK in iptables)
*
* Tag - put a tag on the packet or mark it somehow
*
* Pipe - send the packet to the userland process for inspection
*
* Classify - classify the packet for QoS or traffic shaping
*
* Custom - platform-depended custom action
*
* Branch - branch to a subset of rules for inspection
*
-->
<!ENTITY % ACTION "(Accept|Reject|Deny|Scrub|Return|Skip|Continue|Accounting|Modify|Pipe|Custom|Branch)">
<!ENTITY % NAT_ACTION "(Translate|NATBranch)">
<!ENTITY % DIRECTION "(Inbound|Outbound|Both)">
<!ENTITY % IPADDRESS "CDATA">
<!ENTITY % NETMASK "CDATA">
<!ENTITY % IP6ADDRESS "CDATA">
<!ENTITY % IP6NETMASK "CDATA">
<!-- Standard attributes presented in all nodes -->
<!ENTITY % STD_ATTRIBUTES '
name %STRING; #REQUIRED
keywords %STRING; #IMPLIED
comment %STRING; #IMPLIED
id ID #REQUIRED
ro %BOOLEAN; #IMPLIED
folder %STRING; #IMPLIED
'>
<!-- Standard attributes for all system nodes -->
<!ENTITY % SYS_ATTRIBUTES '
'>
<!--
**** Document structure, main groups. ****
-->
<!ELEMENT FWObjectDatabase (Library*)>
<!ATTLIST FWObjectDatabase
xmlns CDATA #FIXED "http://www.fwbuilder.org/1.0/"
version %STRING; #FIXED "@FWBUILDER_XML_VERSION@"
lastModified %NUMBER; #IMPLIED
id ID #REQUIRED
>
<!ELEMENT Library
((AnyNetwork|AnyIPService|AnyInterval|ObjectGroup|DynamicGroup|StateSyncClusterGroup|FailoverClusterGroup|Host|Firewall|Cluster|Network|NetworkIPv6|AttachedNetworks|IPv4|IPv6|DNSName|AddressTable|physAddress|AddressRange|ObjectRef|ServiceGroup|IPService|ICMPService|ICMP6Service|TCPService|UDPService|CustomService|ServiceRef|IntervalGroup|Interval|IntervalRef|Interface|Policy|NAT|PolicyRule|NATRule|Library|TagService|UserService|DummyNetwork|DummyIPService|DummyInterface)*)>
<!ATTLIST Library
%STD_ATTRIBUTES;
color %STRING; #IMPLIED
>
<!--
**** Document structure, Services. ****
-->
<!ELEMENT AnyIPService EMPTY>
<!ATTLIST AnyIPService
%SYS_ATTRIBUTES;
%STD_ATTRIBUTES;
protocol_num %NUMBER; #FIXED "0"
>
<!ELEMENT DummyIPService EMPTY>
<!ATTLIST DummyIPService
%SYS_ATTRIBUTES;
%STD_ATTRIBUTES;
protocol_num %NUMBER; #FIXED "0"
>
<!-- Reference to Services child -->
<!ELEMENT ServiceRef EMPTY>
<!ATTLIST ServiceRef
ref IDREF #REQUIRED
>
<!ELEMENT ServiceGroup (( ServiceGroup | IPService | ICMPService | ICMP6Service | TCPService | UDPService | CustomService | ServiceRef | TagService | UserService)*)>
<!ATTLIST ServiceGroup
%STD_ATTRIBUTES;
subfolders %STRING; #IMPLIED
>
<!--
**** Document structure, Objects. ****
-->
<!-- Reference to Objects child -->
<!ELEMENT ObjectRef EMPTY>
<!ATTLIST ObjectRef
ref IDREF #REQUIRED
>
<!ELEMENT ObjectGroup ((ObjectGroup|DynamicGroup|Host|Firewall|Cluster|Network|NetworkIPv6|IPv4|IPv6|DNSName|AddressTable|AddressRange|ObjectRef)*)>
<!ATTLIST ObjectGroup
%STD_ATTRIBUTES;
subfolders %STRING; #IMPLIED
>
<!ELEMENT SelectionCriteria EMPTY>
<!ATTLIST SelectionCriteria
type %STRING; #REQUIRED
keyword %STRING; #REQUIRED
>
<!ELEMENT DynamicGroup (SelectionCriteria*)>
<!ATTLIST DynamicGroup
%STD_ATTRIBUTES;
>
<!--
**** Document structure, Cluster members. ****
-->
<!ELEMENT StateSyncClusterGroup (ObjectRef*, ClusterGroupOptions?)>
<!ATTLIST StateSyncClusterGroup
%STD_ATTRIBUTES;
type %STRING; #REQUIRED
master_iface IDREF #IMPLIED
>
<!ELEMENT FailoverClusterGroup (ObjectRef*, ClusterGroupOptions?)>
<!ATTLIST FailoverClusterGroup
%STD_ATTRIBUTES;
type %STRING; #REQUIRED
master_iface IDREF #IMPLIED
>
<!--
This element will contain elements with platform specific
options.
<Options>
<Option name="option1_name">Value1</Option>
<Option name="option2_name">Value2</Option>
</Options>
Since list of compilers is open (everybody could write his
own compiler) we do not define content model for this element.
-->
<!ELEMENT Option ANY>
<!ATTLIST Option
name %STRING; #REQUIRED
>
<!ELEMENT PolicyRuleOptions (Option*)>
<!ELEMENT NATRuleOptions (Option*)>
<!ELEMENT RoutingRuleOptions (Option*)>
<!ELEMENT FirewallOptions (Option*)>
<!ELEMENT InterfaceOptions (Option*)>
<!ELEMENT HostOptions (Option*)>
<!ELEMENT GatewayOptions (Option*)>
<!ELEMENT ClusterGroupOptions (Option*)>
<!ELEMENT RuleSetOptions (Option*)>
<!--
**** Document structure, rest ****
-->
<!ELEMENT NATRule (OSrc,ODst,OSrv,TSrc,TDst,TSrv,ItfInb,ItfOutb,When?, NATRuleOptions?)>
<!ATTLIST NATRule
id ID #REQUIRED
action %NAT_ACTION; #REQUIRED
disabled %BOOLEAN; "False"
position %NUMBER; #REQUIRED
comment %STRING; #IMPLIED
group %STRING; #IMPLIED
>
<!ELEMENT When (IntervalRef*)>
<!ATTLIST When
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT OSrc (ObjectRef*)>
<!ATTLIST OSrc
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT ODst (ObjectRef*)>
<!ATTLIST ODst
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT OSrv (ServiceRef*)>
<!ATTLIST OSrv
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT TSrc (ObjectRef*)>
<!ATTLIST TSrc
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT TDst (ObjectRef*)>
<!ATTLIST TDst
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT TSrv (ServiceRef*)>
<!ATTLIST TSrv
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT RoutingRule (RDst,RGtw,RItf, RoutingRuleOptions?, Routing?)>
<!ATTLIST RoutingRule
id ID #REQUIRED
disabled %BOOLEAN; "False"
position %NUMBER; #REQUIRED
metric %NUMBER; "0"
comment %STRING; #IMPLIED
group %STRING; #IMPLIED
>
<!ELEMENT RDst (ObjectRef*)>
<!ATTLIST RDst
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT RGtw (ObjectRef*)>
<!ATTLIST RGtw
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT RItf (ObjectRef*)>
<!ATTLIST RItf
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT PolicyRule (Src,Dst,Srv,Itf,When?,PolicyRuleOptions?)>
<!ATTLIST PolicyRule
id ID #REQUIRED
disabled %BOOLEAN; "False"
position %NUMBER; #REQUIRED
direction %DIRECTION; #IMPLIED
action %ACTION; #REQUIRED
log %BOOLEAN; #REQUIRED
comment %STRING; #IMPLIED
group %STRING; #IMPLIED
>
<!ELEMENT Src (ObjectRef*)>
<!ATTLIST Src
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT Dst (ObjectRef*)>
<!ATTLIST Dst
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT Srv (ServiceRef*)>
<!ATTLIST Srv
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT Itf (ObjectRef*)>
<!ATTLIST Itf
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT ItfInb (ObjectRef*)>
<!ATTLIST ItfInb
neg %BOOLEAN; #REQUIRED
>
<!ELEMENT ItfOutb (ObjectRef*)>
<!ATTLIST ItfOutb
neg %BOOLEAN; #REQUIRED
>
<!--
hardware or physical address (MAC, DLCI etc.)
-->
<!ELEMENT physAddress EMPTY>
<!ATTLIST physAddress
%STD_ATTRIBUTES;
address %STRING; #REQUIRED
>
<!ELEMENT IPv4 EMPTY>
<!ATTLIST IPv4
%STD_ATTRIBUTES;
address %IPADDRESS; #REQUIRED
netmask %NETMASK; #REQUIRED
>
<!ELEMENT IPv6 EMPTY>
<!ATTLIST IPv6
%STD_ATTRIBUTES;
address %IP6ADDRESS; #REQUIRED
netmask %IP6NETMASK; #REQUIRED
>
<!ELEMENT DNSName EMPTY>
<!ATTLIST DNSName
%STD_ATTRIBUTES;
dnsrec %STRING; #REQUIRED
dnsrectype %STRING; #IMPLIED
run_time %BOOLEAN; #REQUIRED
>
<!ELEMENT AddressTable ((IPv4|IPv6|ObjectRef)*)>
<!ATTLIST AddressTable
%STD_ATTRIBUTES;
filename %STRING; #REQUIRED
run_time %BOOLEAN; #REQUIRED
>
<!--
Interface can have the following attributes:
- dyn interface has dynamically assigned address
- unnum interface is unnumbered (does not have IP address, but
may still have MAC address)
- bridgeport interface serves as a bridge port on bridging firewall.
The difference between bridge port and unnumbered interface
is that compilers may use special modules or commands for
bridge ports on platforms that support them, such as
module physdev for iptables.
- mgmt this is management interface
- physAddress MAC address of this interface
- security_level
- network_zone ID of the object representing network zone
- unprotected Skip this interface while assigning access lists or policy rules
- dedicated_failover Specialized version of "unprotected"
- label human-readable label of this interface
-->
<!ELEMENT Interface (IPv4*, IPv6*, physAddress?, InterfaceOptions?, Interface*, FailoverClusterGroup?, AttachedNetworks?)>
<!ATTLIST Interface
%STD_ATTRIBUTES;
dyn %BOOLEAN; #REQUIRED
unnum %BOOLEAN; #IMPLIED
mgmt %BOOLEAN; #IMPLIED
bridgeport %BOOLEAN; #IMPLIED
security_level %NUMBER; #REQUIRED
network_zone IDREF #IMPLIED
unprotected %BOOLEAN; #IMPLIED
dedicated_failover %BOOLEAN; #IMPLIED
label %STRING; #IMPLIED
>
<!ELEMENT DummyInterface (InterfaceOptions?)>
<!ATTLIST DummyInterface
%SYS_ATTRIBUTES;
%STD_ATTRIBUTES;
dyn %BOOLEAN; #REQUIRED
unnum %BOOLEAN; #IMPLIED
mgmt %BOOLEAN; #IMPLIED
bridgeport %BOOLEAN; #IMPLIED
security_level %NUMBER; #REQUIRED
network_zone IDREF #IMPLIED
unprotected %BOOLEAN; #IMPLIED
dedicated_failover %BOOLEAN; #IMPLIED
label %STRING; #IMPLIED
>
<!-- Remote management information for Firewall, Host, Gateway -->
<!ELEMENT Management (SNMPManagement? , FWBDManagement?, PolicyInstallScript?)>
<!ATTLIST Management
address %IPADDRESS; #REQUIRED
>
<!-- User-defined custom policy installation script for Firewall -->
<!ELEMENT PolicyInstallScript EMPTY>
<!ATTLIST PolicyInstallScript
enabled %BOOLEAN; "False"
command %STRING; #IMPLIED
arguments %STRING; #IMPLIED
>
<!-- SNMP management information for Firewall, Host, Gateway -->
<!ELEMENT SNMPManagement EMPTY>
<!ATTLIST SNMPManagement
enabled %BOOLEAN; "False"
snmp_read_community %STRING; #IMPLIED
snmp_write_community %STRING; #IMPLIED
>
<!-- FWBD management information for Firewall, Host, Gateway -->
<!ELEMENT FWBDManagement (PublicKey?)>
<!ATTLIST FWBDManagement
enabled %BOOLEAN; "False"
port %NUMBER; #REQUIRED
identity %STRING; #REQUIRED
>
<!-- Remote FWBD public key for Firewall, Host, Gateway -->
<!ELEMENT PublicKey (#PCDATA)>
<!ELEMENT Host (Interface*, Management?, HostOptions?)>
<!ATTLIST Host
%STD_ATTRIBUTES;
host_OS %STRING; #IMPLIED
>
<!ELEMENT AnyNetwork EMPTY>
<!ATTLIST AnyNetwork
%SYS_ATTRIBUTES;
%STD_ATTRIBUTES;
address %IPADDRESS; #FIXED "0.0.0.0"
netmask %NETMASK; #FIXED "0.0.0.0"
>
<!ELEMENT DummyNetwork EMPTY>
<!ATTLIST DummyNetwork
%SYS_ATTRIBUTES;
%STD_ATTRIBUTES;
address %IPADDRESS; #FIXED "255.255.255.255"
netmask %NETMASK; #FIXED "255.255.255.255"
>
<!ELEMENT Network EMPTY>
<!ATTLIST Network
%STD_ATTRIBUTES;
address %IPADDRESS; #REQUIRED
netmask %NETMASK; #REQUIRED
>
<!ELEMENT NetworkIPv6 EMPTY>
<!ATTLIST NetworkIPv6
%STD_ATTRIBUTES;
address %IPADDRESS; #REQUIRED
netmask %NETMASK; #REQUIRED
>
<!ELEMENT AttachedNetworks EMPTY>
<!ATTLIST AttachedNetworks
%STD_ATTRIBUTES;
>
<!ELEMENT AddressRange EMPTY>
<!ATTLIST AddressRange
%STD_ATTRIBUTES;
start_address %IPADDRESS; #REQUIRED
end_address %IPADDRESS; #REQUIRED
>
<!ELEMENT ICMPService EMPTY>
<!ATTLIST ICMPService
%STD_ATTRIBUTES;
code %NUMBER; #REQUIRED
type %NUMBER; #REQUIRED
>
<!ELEMENT ICMP6Service EMPTY>
<!ATTLIST ICMP6Service
%STD_ATTRIBUTES;
code %NUMBER; #REQUIRED
type %NUMBER; #REQUIRED
>
<!ELEMENT TagService EMPTY>
<!ATTLIST TagService
%STD_ATTRIBUTES;
tagcode %STRING; #REQUIRED
>
<!--
See definition of IP options here: http://www.iana.org/assignments/ip-parameters
router-alert option is defined in RFC2113. This option carries 16 bit value
although only value "0" is defined at this time, all other values are
reserved. Used in RSVP and IGMP2 protocols.
attribute "any_opt" is used to create IPService object to match IP packets
with any options present. Some firewall platforms can do this (pf, iptables),
some can't (ipfilter, IOS, PIX)
-->
<!ELEMENT IPService EMPTY>
<!ATTLIST IPService
%STD_ATTRIBUTES;
protocol_num %NUMBER; #REQUIRED
fragm %BOOLEAN; #IMPLIED
any_opt %BOOLEAN; #IMPLIED
lsrr %BOOLEAN; #IMPLIED
rr %BOOLEAN; #IMPLIED
short_fragm %BOOLEAN; #IMPLIED
ssrr %BOOLEAN; #IMPLIED
ts %BOOLEAN; #IMPLIED
tos %STRING; #IMPLIED
dscp %STRING; #IMPLIED
rtralt %BOOLEAN; #IMPLIED
rtralt_value %NUMBER; #IMPLIED
>
<!ELEMENT TCPService EMPTY>
<!ATTLIST TCPService
%STD_ATTRIBUTES;
dst_range_end %NUMBER; #REQUIRED
dst_range_start %NUMBER; #REQUIRED
urg_flag %BOOLEAN; #REQUIRED
ack_flag %BOOLEAN; #REQUIRED
psh_flag %BOOLEAN; #REQUIRED
rst_flag %BOOLEAN; #REQUIRED
syn_flag %BOOLEAN; #REQUIRED
fin_flag %BOOLEAN; #REQUIRED
urg_flag_mask %BOOLEAN; #REQUIRED
ack_flag_mask %BOOLEAN; #REQUIRED
psh_flag_mask %BOOLEAN; #REQUIRED
rst_flag_mask %BOOLEAN; #REQUIRED
syn_flag_mask %BOOLEAN; #REQUIRED
fin_flag_mask %BOOLEAN; #REQUIRED
src_range_end %NUMBER; #REQUIRED
src_range_start %NUMBER; #REQUIRED
established %BOOLEAN; #IMPLIED
>
<!ELEMENT UDPService EMPTY>
<!ATTLIST UDPService
%STD_ATTRIBUTES;
dst_range_end %NUMBER; #REQUIRED
dst_range_start %NUMBER; #REQUIRED
src_range_end %NUMBER; #REQUIRED
src_range_start %NUMBER; #REQUIRED
>
<!ELEMENT CustomServiceCommand (#PCDATA)>
<!ATTLIST CustomServiceCommand
platform %STRING; #REQUIRED
>
<!ELEMENT CustomService (CustomServiceCommand*)>
<!ATTLIST CustomService
%STD_ATTRIBUTES;
protocol %STRING; #IMPLIED
address_family %STRING; #IMPLIED
>
<!ELEMENT UserService EMPTY>
<!ATTLIST UserService
%STD_ATTRIBUTES;
userid %STRING; #REQUIRED
>
<!ELEMENT Gateway (Interface* , Management?, GatewayOptions?)>
<!ATTLIST Gateway
%STD_ATTRIBUTES;
address %IPADDRESS; #REQUIRED
host_OS %STRING; #IMPLIED
>
<!ELEMENT Firewall (NAT* , Policy* , Routing , Interface* , Management?, FirewallOptions?)>
<!ATTLIST Firewall
%STD_ATTRIBUTES;
platform %STRING; #REQUIRED
version %STRING; #IMPLIED
host_OS %STRING; #IMPLIED
lastModified %NUMBER; #IMPLIED
lastInstalled %NUMBER; #IMPLIED
lastCompiled %NUMBER; #IMPLIED
inactive %BOOLEAN; #IMPLIED
>
<!ELEMENT Cluster (NAT*, Policy*, Routing, Interface*, Management?, FirewallOptions?, StateSyncClusterGroup*)>
<!ATTLIST Cluster
%STD_ATTRIBUTES;
platform %STRING; #REQUIRED
host_OS %STRING; #IMPLIED
lastModified %NUMBER; #IMPLIED
lastInstalled %NUMBER; #IMPLIED
lastCompiled %NUMBER; #IMPLIED
inactive %BOOLEAN; #IMPLIED
>
<!ELEMENT NAT (NATRule*, RuleSetOptions)>
<!ATTLIST NAT
%STD_ATTRIBUTES;
ipv4_rule_set %BOOLEAN; #IMPLIED
ipv6_rule_set %BOOLEAN; #IMPLIED
top_rule_set %BOOLEAN; #IMPLIED
>
<!ELEMENT Policy (PolicyRule*, RuleSetOptions)>
<!ATTLIST Policy
%STD_ATTRIBUTES;
ipv4_rule_set %BOOLEAN; #IMPLIED
ipv6_rule_set %BOOLEAN; #IMPLIED
top_rule_set %BOOLEAN; #IMPLIED
>
<!ELEMENT Routing (RoutingRule*, RuleSetOptions)>
<!ATTLIST Routing
%STD_ATTRIBUTES;
ipv4_rule_set %BOOLEAN; #IMPLIED
ipv6_rule_set %BOOLEAN; #IMPLIED
top_rule_set %BOOLEAN; #IMPLIED
>
<!-- Time -->
<!ELEMENT IntervalGroup ((IntervalGroup|Interval|IntervalRef)*)>
<!ATTLIST IntervalGroup
%STD_ATTRIBUTES;
subfolders %STRING; #IMPLIED
>
<!-- Reference to time interval -->
<!ELEMENT IntervalRef EMPTY>
<!ATTLIST IntervalRef
ref IDREF #REQUIRED
>
<!-- up until fwbuilder3 this element used two separate attributes
to deal with days of week, one for the start day of week and another
for the end day of week. Starting with fwbuilder3 we support iptables 1.4.0
module "time" which allows for random day of week spec. Fwbuilder3
provides support for that in object Interval, which uses attrbute
days_of_week in this element. Need to phase out attributes from_weekday
and to_weekday some time in the future.
-->
<!ELEMENT Interval EMPTY>
<!ATTLIST Interval
%STD_ATTRIBUTES;
from_second %NUMBER; "-1"
from_minute %NUMBER; "-1"
from_hour %NUMBER; "-1"
from_day %NUMBER; "-1"
from_month %NUMBER; "-1"
from_year %NUMBER; "-1"
from_weekday %NUMBER; "-1"
to_second %NUMBER; "-1"
to_minute %NUMBER; "-1"
to_hour %NUMBER; "-1"
to_day %NUMBER; "-1"
to_month %NUMBER; "-1"
to_year %NUMBER; "-1"
to_weekday %NUMBER; "-1"
days_of_week %STRING; #IMPLIED
>
<!ELEMENT AnyInterval EMPTY>
<!ATTLIST AnyInterval
%SYS_ATTRIBUTES;
%STD_ATTRIBUTES;
from_second %NUMBER; #FIXED "-1"
from_minute %NUMBER; #FIXED "-1"
from_hour %NUMBER; #FIXED "-1"
from_day %NUMBER; #FIXED "-1"
from_month %NUMBER; #FIXED "-1"
from_year %NUMBER; #FIXED "-1"
from_weekday %NUMBER; #FIXED "-1"
to_second %NUMBER; #FIXED "-1"
to_minute %NUMBER; #FIXED "-1"
to_hour %NUMBER; #FIXED "-1"
to_day %NUMBER; #FIXED "-1"
to_month %NUMBER; #FIXED "-1"
to_year %NUMBER; #FIXED "-1"
to_weekday %NUMBER; #FIXED "-1"
days_of_week %STRING; #IMPLIED
>