<!-- format acls.xml version 2.0 -->

<!ELEMENT policy (descs,periodicities,durations,resources,auths,applications,oss,protocols,l7rules,localsin,localsout,acls,snats,dnats,pnats,groups)>
<!ATTLIST policy version CDATA #FIXED "2.0">

<!ELEMENT descs (desc*)>

<!ELEMENT desc (networks,addresses,interfaces)>
<!ATTLIST desc ID CDATA #REQUIRED>
<!ATTLIST desc interface CDATA #REQUIRED>

<!ELEMENT networks (net+)>

<!ELEMENT net EMPTY>
<!ATTLIST net type CDATA #FIXED "ipv4">
<!ATTLIST net addr CDATA #REQUIRED>
<!ATTLIST net name CDATA #REQUIRED>
<!ATTLIST net dftroute CDATA #IMPLIED>
<!ATTLIST net id CDATA #REQUIRED>

<!ELEMENT addresses (addr+)>

<!ELEMENT addr EMPTY>
<!ATTLIST addr type CDATA #FIXED "ipv4">
<!ATTLIST addr addr CDATA #REQUIRED>
<!ATTLIST addr id CDATA #REQUIRED>

<!ELEMENT interfaces (interface+)>

<!ELEMENT interface (elt+)>
<!ATTLIST interface ID CDATA #REQUIRED>
<!ATTLIST interface name CDATA #REQUIRED>

<!ELEMENT periodicities (periodicity*)>

<!ELEMENT periodicity (elt+)>
<!ATTLIST periodicity name CDATA #REQUIRED>
<!ATTLIST periodicity ID CDATA #REQUIRED>

<!ELEMENT durations (duration*)>

<!--TODO<!ELEMENT duration (elt)>-->

<!ELEMENT resources (ressource*)>

<!ELEMENT resource (elt+)>
<!ATTLIST resource name CDATA #REQUIRED>
<!ATTLIST resource ID CDATA #REQUIRED>

<!ELEMENT auths (auth*)>

<!ELEMENT auth (elt+)>
<!ATTLIST auth name CDATA #REQUIRED>
<!ATTLIST auth id CDATA #REQUIRED>

<!ELEMENT applications (application*)>

<!ELEMENT application (elt+)>
<!ATTLIST application name CDATA #REQUIRED>
<!ATTLIST application ID CDATA #REQUIRED>

<!ELEMENT oss (os*)>

<!ELEMENT os (elt+)>
<!ATTLIST os name CDATA #REQUIRED>
<!ATTLIST os id CDATA #REQUIRED>

<!ELEMENT protocols (protocol*)>

<!ELEMENT protocol (elt+)>
<!ATTLIST protocol name CDATA #REQUIRED>
<!ATTLIST protocol ID CDATA #REQUIRED>

<!ELEMENT l7rules (l7rule*)>
<!ATTLIST l7rules mask CDATA #REQUIRED>

<!ELEMENT l7rule (elt+)>
<!ATTLIST l7rule name CDATA #REQUIRED>
<!ATTLIST l7rule ID CDATA #REQUIRED>
<!ATTLIST l7rule defaultaction (accept|drop|logaccept|logdrop|ulogaccept|ulogdrop) #REQUIRED>

<!ELEMENT acls (acl*)>

<!ELEMENT acl (descsorts)>
<!ATTLIST acl name CDATA #REQUIRED>
<!ATTLIST acl ID CDATA #REQUIRED>
<!ATTLIST acl from CDATA #REQUIRED>
<!ATTLIST acl to CDATA #REQUIRED>
<!ATTLIST acl auth CDATA #REQUIRED>
<!ATTLIST acl with CDATA #IMPLIED>
<!ATTLIST acl proto CDATA #REQUIRED>
<!ATTLIST acl periodicity CDATA #IMPLIED>
<!ATTLIST acl decision (accept|drop|reject|log|ulog) #REQUIRED>
<!ATTLIST acl comment CDATA #REQUIRED>
<!ATTLIST acl modified CDATA #REQUIRED>
<!ATTLIST acl group CDATA #REQUIRED>

<!ELEMENT descsorts (descsort+)>

<!ELEMENT descsort (elt+)>
<!ATTLIST descsort ID CDATA #REQUIRED>

<!ELEMENT localsin (localin*)>

<!ELEMENT localin (descs)>
<!ATTLIST localin name CDATA #REQUIRED>
<!ATTLIST localin ID CDATA #REQUIRED>
<!ATTLIST localin use_interface (0|1) #REQUIRED>
<!ATTLIST localin from CDATA #IMPLIED>
<!ATTLIST localin proto CDATA #REQUIRED>
<!ATTLIST localin decision (accept|drop|reject|log|ulog) #REQUIRED>
<!ATTLIST localin comment CDATA #REQUIRED>
<!ATTLIST localin modified CDATA #REQUIRED>
<!ATTLIST localin group CDATA #REQUIRED>

<!ELEMENT localsout (localsout*)>

<!ELEMENT localout (descs)>
<!ATTLIST localout name CDATA #REQUIRED>
<!ATTLIST localout ID CDATA #REQUIRED>
<!ATTLIST localout use_interface (0|1) #REQUIRED>
<!ATTLIST localout to CDATA #IMPLIED>
<!ATTLIST localout proto CDATA #REQUIRED>
<!ATTLIST localout decision (accept|drop|reject|log|ulog) #REQUIRED>
<!ATTLIST localout comment CDATA #REQUIRED>
<!ATTLIST localout modified CDATA #REQUIRED>
<!ATTLIST localout group CDATA #REQUIRED>

<!ELEMENT snats (snat*)>

<!ELEMENT snat (elt+)>
<!ATTLIST snat name CDATA #REQUIRED>
<!ATTLIST snat ID CDATA #REQUIRED>

<!ELEMENT dnats (dnat*)>

<!ELEMENT dnat (elt+)>
<!ATTLIST dnat name CDATA #REQUIRED>
<!ATTLIST dnat ID CDATA #REQUIRED>

<!ELEMENT pnats (pnat*)>

<!ELEMENT pnat (elt+)>
<!ATTLIST pnat name CDATA #REQUIRED>
<!ATTLIST pnat ID CDATA #REQUIRED>

<!ELEMENT groups (group*)>

<!ELEMENT group EMPTY>
<!ATTLIST group name CDATA #REQUIRED>
<!ATTLIST group ID CDATA #REQUIRED>
<!ATTLIST group comment CDATA #REQUIRED>
<!ATTLIST group enabled (1|0) #REQUIRED>

<!ELEMENT elt EMPTY>
<!ATTLIST elt ID CDATA #REQUIRED>
<!ATTLIST elt name CDATA #IMPLIED>
<!ATTLIST elt type (network|ipv4|periodicity|nufw|app|os|proto|l7rule|link) #IMPLIED>
<!ATTLIST elt linkid CDATA #IMPLIED>
<!ATTLIST elt startday CDATA #IMPLIED>
<!ATTLIST elt stopday CDATA #IMPLIED>
<!ATTLIST elt starthour CDATA #IMPLIED>
<!ATTLIST elt stophour CDATA #IMPLIED>
<!ATTLIST elt modified CDATA #IMPLIED>
<!ATTLIST elt net CDATA #IMPLIED>
<!ATTLIST elt group CDATA #IMPLIED>
<!ATTLIST elt ApplicationPath CDATA #IMPLIED>
<!ATTLIST elt OSName CDATA #IMPLIED>
<!ATTLIST elt OSVersion CDATA #IMPLIED>
<!ATTLIST elt proto CDATA #IMPLIED>
<!ATTLIST elt dport CDATA #IMPLIED>
<!ATTLIST elt sport CDATA #IMPLIED>
<!ATTLIST elt l7rule CDATA #IMPLIED>
<!ATTLIST elt icmptype CDATA #IMPLIED>
<!ATTLIST elt l7proto CDATA #IMPLIED>
<!ATTLIST elt action CDATA #IMPLIED>
<!ATTLIST elt from CDATA #IMPLIED>
<!ATTLIST elt to CDATA #IMPLIED>
<!ATTLIST elt order CDATA #IMPLIED>