junoser 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b370402809bb2214265f0dd6e692c591337882121f7f5c1f8f3653553cd29f83
-  data.tar.gz: 72dd3c61381706e34cba7618e6402f6be59380137c3b7198747d898e17d550c0
+  metadata.gz: f37eb9172418859fd2a4144cdd0d4b47c657162e02117cfb9fe73a33fe9ca0e2
+  data.tar.gz: 4791fbaf136985e1b16a4dba7daaf2fc2dbcee8ed85508d2e3c65b5b3f4575b9
 SHA512:
-  metadata.gz: 606fec606c9882cddbef3f1cc687d00f19cf0f535acdb84da448dfea730e5c7d69f16d4837014c5b7c4b1a68fea00c957f72c867ffcdccae3773b7fbf2c76b5d
-  data.tar.gz: d88215e1ef62177ed15e5c0e76a149ac53a96880fb19c9bfd32c275e750b2aa298bb39a6a01b6a3ee3b650592da1d843b7bb443ac9bbfa75ef620b1e2c061752
+  metadata.gz: 5961c24e760831bf52f6edb82c5972aefb023d99639091fb2c12d95f083ef57e9e2703fd441dbb0c1d5e44b5e386834679e910873e44825c9a7c103243fa2c6c
+  data.tar.gz: 9e41dcfb72bfe2f5b801506c50725a4a0da2f56a09a8ddeedb8cb7d4b8ae82864008c89cdf2da837ced1c83d39d2e7d53640bba5f7dcb459d434e0d173862659

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [0.4.2] - 2021-08-30
+
+### Added
+
+* Newly supported syntax
+  * "virtual-chassis vcp-snmp-statistics"
+  * "application_object"
+
+### Fixed
+
+* Keywords "tls", "group", "dest-nat-rule-match", "src-nat-rule-match", and "static-nat-rule-match" might be marked as invalid in some hierarchies
+* "applications application xxx term xxx"
+* "security"
+
+
 ## [0.4.1] - 2021-06-06
 
 ### Added
@@ -7,7 +22,7 @@
 
 ### Fixed
 
-* "scpf-link", "https", "inet6", "icmp6", "icmpv6", "ospf3", and "snmptrap" keywords might be marked as invalid in some hierarchies
+* Keywords "scpf-link", "https", "inet6", "icmp6", "icmpv6", "ospf3", and "snmptrap" might be marked as invalid in some hierarchies
 * "policy-options community xxx members"
 * "policy-options route-distinguisher xxx members"
 * "routing-options confederation members"

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    junoser (0.4.1)
+    junoser (0.4.2)
       parslet
 
 GEM

data/Rakefile

@@ -19,12 +19,22 @@ def open_files(input, output, &block)
   o.close
 end
 
+def move_wildcards(element)
+  ['ipaddr', 'ipv6addr', 'ipprefix'].each do |pattern|
+    element.xpath(%[.//xsd:element[@type="#{pattern}"]/xsd:annotation/xsd:appinfo/flag[text()="nokeyword"]/../../..]).each do |wildcard|
+      parent = wildcard.parent
+      removed = wildcard.remove
+      parent << removed
+    end
+  end
+end
 
 namespace :build do
   desc 'Build an intermediate config hierarchy'
   task :config do
     open_files(xsd_path, rule_path) do |input, output|
       Nokogiri::XML(input).root.remove_unused.xpath('/xsd:schema/*').each do |e|
+        move_wildcards e # Move wildcard elements to the end of siblings as they capture keywords unexpectedly
         output.puts e.to_config
       end
     end
@@ -56,7 +66,6 @@ task 'find-srx-methods' do
   end
 end
 
-
 Rake::TestTask.new do |t|
   t.libs << 'test'
 

data/example/mx-19.3R3-S1.3.rb

@@ -1996,10 +1996,10 @@ rule(:configuration) do
                                                   ),
                                                   "wildcard-address" (  /* IP wildcard address and mask */
                                                       sc(
-                                                            ipaddr  /* IP wildcard address */,
                                                           "wildcard-mask" (  /* IP wildcard address mask */
                                                             ipaddr  /* IP wildcard address mask */
-                                                          )
+                                                          ),
+                                                            ipaddr  /* IP wildcard address */
                                                       )
                                                   ).as(:oneline),
                                                   "port-range" (  /* IP port ranges */
@@ -2017,10 +2017,10 @@ rule(:configuration) do
                                                   ),
                                                   "wildcard-address" (  /* IP wildcard address and mask */
                                                       sc(
-                                                            ipaddr  /* IP wildcard address */,
                                                           "wildcard-mask" (  /* IP wildcard address mask */
                                                             ipaddr  /* IP wildcard address mask */
-                                                          )
+                                                          ),
+                                                            ipaddr  /* IP wildcard address */
                                                       )
                                                   ).as(:oneline),
                                                   "port-range" (  /* IP port ranges */
@@ -5912,34 +5912,34 @@ rule(:configuration) do
                                               c(
                                                   "source-ip" (  /* Filter based on source-ip (and wildcard) */
                                                       sc(
-                                                            ipaddr  /* Source IP */,
                                                           "wildcard" (  /* Source IP wildcard */
                                                             ipaddr  /* Source IP wildcard */
-                                                          )
+                                                          ),
+                                                            ipaddr  /* Source IP */
                                                       )
                                                   ).as(:oneline),
                                                   "dest-ip" (  /* Filter based on dest-ip (and wildcard) */
                                                       sc(
-                                                            ipaddr  /* Dest IP */,
                                                           "wildcard" (  /* Dest IP wildcard */
                                                             ipaddr  /* Dest IP wildcard */
-                                                          )
+                                                          ),
+                                                            ipaddr  /* Dest IP */
                                                       )
                                                   ).as(:oneline),
                                                   "sw-sip" (  /* Filter based on source softwire ip (and wildcard) */
                                                       sc(
-                                                            ipv6addr  /* Source softwire IP */,
                                                           "wildcard" (  /* Source IP wildcard */
                                                             ipv6addr  /* Source IP wildcard */
-                                                          )
+                                                          ),
+                                                            ipv6addr  /* Source softwire IP */
                                                       )
                                                   ).as(:oneline),
                                                   "sw-dip" (  /* Filter based on destination softwire ip (and wildcard) */
                                                       sc(
-                                                            ipaddr  /* Destination softwire IP */,
                                                           "wildcard" (  /* Destination IP wildcard */
                                                             ipaddr  /* Destination IP wildcard */
-                                                          )
+                                                          ),
+                                                            ipaddr  /* Destination softwire IP */
                                                       )
                                                   ).as(:oneline),
                                                   "sport-range" (  /* Filter based on source port */
@@ -10594,7 +10594,8 @@ rule(:configuration) do
                     "no-auto-conversion"  /* Disable automatic VC port conversion */,
                     "auto-conversion"  /* Enable automatic VC port conversion */
                   ),
-                  "vcp-no-hold-time"  /* Set no hold time for vcp interfaces */
+                  "vcp-no-hold-time"  /* Set no hold time for vcp interfaces */,
+                  "vcp-snmp-statistics"
               )
           ),
           "ethernet-switching-options" (
@@ -17879,53 +17880,6 @@ rule(:any_template) do
   )
 end
 
-rule(:application_object) do
-  arg.as(:arg) (
-    c(
-        "application-protocol" (  /* Application protocol type */
-          ("bootp" | "dce-rpc" | "dce-rpc-portmap" | "dns" | "exec" | "ftp" | "ftp-data" | "gprs-gtp-c" | "gprs-gtp-u" | "gprs-gtp-v0" | "gprs-sctp" | "h323" | "icmp" | "icmpv6" | "ignore" | "iiop" | "ike-esp-nat" | "ip" | "login" | "mgcp-ca" | "mgcp-ua" | "ms-rpc" | "netbios" | "netshow" | "none" | "pptp" | "q931" | "ras" | "realaudio" | "rpc" | "rpc-portmap" | "rsh" | "rtsp" | "sccp" | "sip" | "shell" | "snmp" | "sqlnet" | "sqlnet-v2" | "sun-rpc" | "talk" | "tftp" | "traceroute" | "http" | "winframe" | "https" | "imap" | "smtp" | "ssh" | "telnet" | "twamp")
-        ),
-        "protocol" (  /* Match IP protocol type */
-          ("icmp" | "igmp" | "ipip" | "tcp" | "egp" | "udp" | "rsvp" | "gre" | "esp" | "ah" | "icmp6" | "ospf" | "pim" | "sctp" | arg)
-        ),
-        "source-port" (  /* Match TCP/UDP source port */
-          ("ftp-data" | "ftp" | "ssh" | "telnet" | "smtp" | "tacacs" | "tacacs-ds" | "domain" | "dhcp" | "bootps" | "bootpc" | "tftp" | "finger" | "http" | "kerberos-sec" | "pop3" | "sunrpc" | "ident" | "nntp" | "ntp" | "netbios-ns" | "netbios-dgm" | "netbios-ssn" | "imap" | "snmp" | "snmptrap" | "xdmcp" | "bgp" | "ldap" | "mobileip-agent" | "mobilip-mn" | "msdp" | "https" | "snpp" | "biff" | "exec" | "login" | "who" | "cmd" | "syslog" | "printer" | "talk" | "ntalk" | "rip" | "timed" | "klogin" | "kshell" | "ldp" | "krb-prop" | "krbupdate" | "kpasswd" | "socks" | "afs" | "pptp" | "radius" | "radacct" | "zephyr-srv" | "zephyr-clt" | "zephyr-hm" | "nfsd" | "eklogin" | "ekshell" | "rkinit" | "cvspserver" | arg)
-        ),
-        "destination-port" (  /* Match TCP/UDP destination port */
-          ("ftp-data" | "ftp" | "ssh" | "telnet" | "smtp" | "tacacs" | "tacacs-ds" | "domain" | "dhcp" | "bootps" | "bootpc" | "tftp" | "finger" | "http" | "kerberos-sec" | "pop3" | "sunrpc" | "ident" | "nntp" | "ntp" | "netbios-ns" | "netbios-dgm" | "netbios-ssn" | "imap" | "snmp" | "snmptrap" | "xdmcp" | "bgp" | "ldap" | "mobileip-agent" | "mobilip-mn" | "msdp" | "https" | "snpp" | "biff" | "exec" | "login" | "who" | "cmd" | "syslog" | "printer" | "talk" | "ntalk" | "rip" | "timed" | "klogin" | "kshell" | "ldp" | "krb-prop" | "krbupdate" | "kpasswd" | "socks" | "afs" | "pptp" | "radius" | "radacct" | "zephyr-srv" | "zephyr-clt" | "zephyr-hm" | "nfsd" | "eklogin" | "ekshell" | "rkinit" | "cvspserver" | arg)
-        ),
-        "ether-type" arg  /* Match ether type */,
-        "snmp-command" (  /* Match SNMP command */
-          ("get" | "get-next" | "get-response" | "set" | "trap")
-        ),
-        "icmp-type" (  /* Match ICMP message type */
-          ("echo-request" | "echo-reply" | "unreachable" | "source-quench" | "redirect" | "router-advertisement" | "router-solicit" | "time-exceeded" | "parameter-problem" | "timestamp" | "timestamp-reply" | "info-request" | "info-reply" | "mask-request" | "mask-reply" | arg)
-        ),
-        "icmp6-type" (  /* Match ICMP6 message type */
-          ("echo-request" | "echo-reply" | "destination-unreachable" | "router-advertisement" | "router-solicit" | "time-exceeded" | "parameter-problem" | "packet-too-big" | "membership-query" | "membership-report" | "membership-termination" | "redirect" | "neighbor-solicit" | "neighbor-advertisement" | "router-renumbering" | "node-information-request" | "node-information-reply" | arg)
-        ),
-        "icmp-code" (  /* Match ICMP message code */
-          ("network-unreachable" | "host-unreachable" | "protocol-unreachable" | "port-unreachable" | "fragmentation-needed" | "source-route-failed" | "destination-network-unknown" | "destination-host-unknown" | "source-host-isolated" | "destination-network-prohibited" | "destination-host-prohibited" | "network-unreachable-for-tos" | "host-unreachable-for-tos" | "communication-prohibited-by-filtering" | "host-precedence-violation" | "precedence-cutoff-in-effect" | "redirect-for-network" | "redirect-for-host" | "redirect-for-tos-and-net" | "redirect-for-tos-and-host" | "ttl-eq-zero-during-transit" | "ttl-eq-zero-during-reassembly" | "ip-header-bad" | "required-option-missing" | arg)
-        ),
-        "icmp6-code" (  /* Match ICMP6 message code */
-          ("no-route-to-destination" | "administratively-prohibited" | "address-unreachable" | "port-unreachable" | "ttl-eq-zero-during-transit" | "ttl-eq-zero-during-reassembly" | "ip6-header-bad" | "unrecognized-next-header" | "unrecognized-option" | arg)
-        ),
-        "ttl-threshold" arg  /* Traceroute TTL threshold */,
-        "rpc-program-number" arg  /* Match range of RPC program numbers */,
-        "uuid" arg  /* Match universal unique identifier for DCE RPC objects */,
-        "inactivity-timeout" (  /* Application-specific inactivity timeout */
-          ("never" | arg)
-        ),
-        "gate-timeout" arg  /* Application-specific gate timeout */,
-        "child-inactivity-timeout" arg  /* Application-specific child session inactivity timeout */,
-        c(
-          "do-not-translate-AAAA-query-to-A-query"  /* Knob to control the translation of AAAA query to A query */,
-          "do-not-translate-A-query-to-AAAA-query"  /* Knob to control the translation of A query to AAAA query */
-        )
-    )
-  )
-end
-
 rule(:application_set_object) do
   arg.as(:arg) (
     c(
@@ -28321,34 +28275,34 @@ rule(:interfaces_type) do
                             c(
                                 "source-ip" (  /* Filter based on source-ip (and wildcard) */
                                     sc(
-                                          ipaddr  /* Source IP */,
                                         "wildcard" (  /* Source IP wildcard */
                                           ipaddr  /* Source IP wildcard */
-                                        )
+                                        ),
+                                          ipaddr  /* Source IP */
                                     )
                                 ).as(:oneline),
                                 "dest-ip" (  /* Filter based on dest-ip (and wildcard) */
                                     sc(
-                                          ipaddr  /* Dest IP */,
                                         "wildcard" (  /* Dest IP wildcard */
                                           ipaddr  /* Dest IP wildcard */
-                                        )
+                                        ),
+                                          ipaddr  /* Dest IP */
                                     )
                                 ).as(:oneline),
                                 "sw-sip" (  /* Filter based on source softwire ip (and wildcard) */
                                     sc(
-                                          ipv6addr  /* Source softwire IP */,
                                         "wildcard" (  /* Source IP wildcard */
                                           ipv6addr  /* Source IP wildcard */
-                                        )
+                                        ),
+                                          ipv6addr  /* Source softwire IP */
                                     )
                                 ).as(:oneline),
                                 "sw-dip" (  /* Filter based on destination softwire ip (and wildcard) */
                                     sc(
-                                          ipaddr  /* Destination softwire IP */,
                                         "wildcard" (  /* Destination IP wildcard */
                                           ipaddr  /* Destination IP wildcard */
-                                        )
+                                        ),
+                                          ipaddr  /* Destination softwire IP */
                                     )
                                 ).as(:oneline),
                                 "sport-range" (  /* Filter based on source port */
@@ -43766,34 +43720,34 @@ rule(:juniper_dynamic_profile_object) do
                                             c(
                                                 "source-ip" (  /* Filter based on source-ip (and wildcard) */
                                                     sc(
-                                                          ipaddr  /* Source IP */,
                                                         "wildcard" (  /* Source IP wildcard */
                                                           ipaddr  /* Source IP wildcard */
-                                                        )
+                                                        ),
+                                                          ipaddr  /* Source IP */
                                                     )
                                                 ).as(:oneline),
                                                 "dest-ip" (  /* Filter based on dest-ip (and wildcard) */
                                                     sc(
-                                                          ipaddr  /* Dest IP */,
                                                         "wildcard" (  /* Dest IP wildcard */
                                                           ipaddr  /* Dest IP wildcard */
-                                                        )
+                                                        ),
+                                                          ipaddr  /* Dest IP */
                                                     )
                                                 ).as(:oneline),
                                                 "sw-sip" (  /* Filter based on source softwire ip (and wildcard) */
                                                     sc(
-                                                          ipv6addr  /* Source softwire IP */,
                                                         "wildcard" (  /* Source IP wildcard */
                                                           ipv6addr  /* Source IP wildcard */
-                                                        )
+                                                        ),
+                                                          ipv6addr  /* Source softwire IP */
                                                     )
                                                 ).as(:oneline),
                                                 "sw-dip" (  /* Filter based on destination softwire ip (and wildcard) */
                                                     sc(
-                                                          ipaddr  /* Destination softwire IP */,
                                                         "wildcard" (  /* Destination IP wildcard */
                                                           ipaddr  /* Destination IP wildcard */
-                                                        )
+                                                        ),
+                                                          ipaddr  /* Destination softwire IP */
                                                     )
                                                 ).as(:oneline),
                                                 "sport-range" (  /* Filter based on source port */
@@ -47223,34 +47177,34 @@ rule(:juniper_dynamic_profile_object) do
                                                     c(
                                                         "source-ip" (  /* Filter based on source-ip (and wildcard) */
                                                             sc(
-                                                                  ipaddr  /* Source IP */,
                                                                 "wildcard" (  /* Source IP wildcard */
                                                                   ipaddr  /* Source IP wildcard */
-                                                                )
+                                                                ),
+                                                                  ipaddr  /* Source IP */
                                                             )
                                                         ).as(:oneline),
                                                         "dest-ip" (  /* Filter based on dest-ip (and wildcard) */
                                                             sc(
-                                                                  ipaddr  /* Dest IP */,
                                                                 "wildcard" (  /* Dest IP wildcard */
                                                                   ipaddr  /* Dest IP wildcard */
-                                                                )
+                                                                ),
+                                                                  ipaddr  /* Dest IP */
                                                             )
                                                         ).as(:oneline),
                                                         "sw-sip" (  /* Filter based on source softwire ip (and wildcard) */
                                                             sc(
-                                                                  ipv6addr  /* Source softwire IP */,
                                                                 "wildcard" (  /* Source IP wildcard */
                                                                   ipv6addr  /* Source IP wildcard */
-                                                                )
+                                                                ),
+                                                                  ipv6addr  /* Source softwire IP */
                                                             )
                                                         ).as(:oneline),
                                                         "sw-dip" (  /* Filter based on destination softwire ip (and wildcard) */
                                                             sc(
-                                                                  ipaddr  /* Destination softwire IP */,
                                                                 "wildcard" (  /* Destination IP wildcard */
                                                                   ipaddr  /* Destination IP wildcard */
-                                                                )
+                                                                ),
+                                                                  ipaddr  /* Destination softwire IP */
                                                             )
                                                         ).as(:oneline),
                                                         "sport-range" (  /* Filter based on source port */
@@ -55337,10 +55291,10 @@ rule(:juniper_policy_options) do
                                         c(
                                           "self"  /* Use a local address as the next-hop address */,
                                           "peer-address"  /* Use the remote peer address as the next-hop address */,
-                                            ipaddr  /* Next-hop address */,
                                           "reject"  /* Use a reject next hop */,
                                           "discard"  /* Use a discard next hop */,
-                                          "next-table" arg  /* Perform a forwarding lookup in the specified table */
+                                          "next-table" arg  /* Perform a forwarding lookup in the specified table */,
+                                            ipaddr  /* Next-hop address */
                                         )
                                     )
                                 ).as(:oneline),
@@ -55948,10 +55902,10 @@ rule(:juniper_policy_options) do
                                 c(
                                   "self"  /* Use a local address as the next-hop address */,
                                   "peer-address"  /* Use the remote peer address as the next-hop address */,
-                                    ipaddr  /* Next-hop address */,
                                   "reject"  /* Use a reject next hop */,
                                   "discard"  /* Use a discard next hop */,
-                                  "next-table" arg  /* Perform a forwarding lookup in the specified table */
+                                  "next-table" arg  /* Perform a forwarding lookup in the specified table */,
+                                    ipaddr  /* Next-hop address */
                                 )
                             )
                         ).as(:oneline),
@@ -56163,8 +56117,8 @@ rule(:juniper_policy_options) do
                                   c(
                                     "inet" (  /* Route to match corresponds to an inet/inet6 prefix */
                                         c(
-                                              ipprefix  /* Exact address of the route */,
-                                            "table" arg  /* Routing table in which route should exist */
+                                            "table" arg  /* Routing table in which route should exist */,
+                                              ipprefix  /* Exact address of the route */
                                         )
                                     ),
                                     "ccc" (  /* Route to match corresponds to a ccc prefix */
@@ -56178,8 +56132,8 @@ rule(:juniper_policy_options) do
                                   )
                               )
                           ),
-                            ipprefix  /* Exact address of the route */,
-                          "table" arg  /* Routing table in which route should exist */
+                          "table" arg  /* Routing table in which route should exist */,
+                            ipprefix  /* Exact address of the route */
                       )
                   )
                 )
@@ -56468,10 +56422,10 @@ rule(:control_prefix_list_filter_type) do
                 c(
                   "self"  /* Use a local address as the next-hop address */,
                   "peer-address"  /* Use the remote peer address as the next-hop address */,
-                    ipaddr  /* Next-hop address */,
                   "reject"  /* Use a reject next hop */,
                   "discard"  /* Use a discard next hop */,
-                  "next-table" arg  /* Perform a forwarding lookup in the specified table */
+                  "next-table" arg  /* Perform a forwarding lookup in the specified table */,
+                    ipaddr  /* Next-hop address */
                 )
             )
         ).as(:oneline),
@@ -56863,10 +56817,10 @@ rule(:control_route_filter_type) do
                 c(
                   "self"  /* Use a local address as the next-hop address */,
                   "peer-address"  /* Use the remote peer address as the next-hop address */,
-                    ipaddr  /* Next-hop address */,
                   "reject"  /* Use a reject next hop */,
                   "discard"  /* Use a discard next hop */,
-                  "next-table" arg  /* Perform a forwarding lookup in the specified table */
+                  "next-table" arg  /* Perform a forwarding lookup in the specified table */,
+                    ipaddr  /* Next-hop address */
                 )
             )
         ).as(:oneline),
@@ -57242,10 +57196,10 @@ rule(:control_source_address_filter_type) do
                 c(
                   "self"  /* Use a local address as the next-hop address */,
                   "peer-address"  /* Use the remote peer address as the next-hop address */,
-                    ipaddr  /* Next-hop address */,
                   "reject"  /* Use a reject next hop */,
                   "discard"  /* Use a discard next hop */,
-                  "next-table" arg  /* Perform a forwarding lookup in the specified table */
+                  "next-table" arg  /* Perform a forwarding lookup in the specified table */,
+                    ipaddr  /* Next-hop address */
                 )
             )
         ).as(:oneline),
@@ -77513,9 +77467,9 @@ rule(:juniper_system) do
         ).as(:oneline),
         "inet6-backup-router" (  /* IPv6 router to use while booting */
             sc(
-                  ipv6addr  /* Address of router to use while booting */,
                 "destination" (  /* Destination network reachable through the router */
-                  ipv6prefix  /* Destination network reachable through the router */
+                  ipv6prefix  /* Destination network reachable through the router */,
+                  ipv6addr  /* Address of router to use while booting */
                 )
             )
         ).as(:oneline),
@@ -98364,14 +98318,6 @@ rule(:log_object) do
     )
 end
 
-rule(:logical_system_type) do
-  arg.as(:arg) (
-    c(
-        "max-sessions" arg  /* Max number of IDP sessions */
-    )
-  )
-end
-
 rule(:login_class_object) do
   arg.as(:arg) (
     c(
@@ -101523,31 +101469,6 @@ rule(:nasreq_definition) do
     )
 end
 
-rule(:nat_object) do
-    c(
-        "pool" (  /* Define a NAT pool */
-          nat_pool_object  /* Define a NAT pool */
-        ),
-        "ipv6-multicast-interfaces" ("all" | "interface-name") (  /* Enable IPv6 multicast filter for IPv6 NAT */
-            c(
-                "disable"  /* Disable IPv6 multicast filter for IPv6 NAT */
-            )
-        ),
-        "allow-overlapping-nat-pools"  /* Allow usage of overlapping and same nat pools in multiple service sets */,
-        "rule" (  /* Define a NAT rule */
-          nat_rule_object  /* Define a NAT rule */
-        ),
-        "port-forwarding" (  /* Define a port-forwarding pool */
-          pf_mapping  /* Define a port-forwarding pool */
-        ),
-        "rule-set" arg (  /* Defines a set of NAT rules */
-            c(
-                "rule" arg  /* Rule to be included in this rule set */
-            )
-        )
-    )
-end
-
 rule(:nat_pool_object) do
   arg.as(:arg) (
     c(
@@ -105285,10 +105206,10 @@ rule(:route_filter_list_items) do
                 c(
                   "self"  /* Use a local address as the next-hop address */,
                   "peer-address"  /* Use the remote peer address as the next-hop address */,
-                    ipaddr  /* Next-hop address */,
                   "reject"  /* Use a reject next hop */,
                   "discard"  /* Use a discard next hop */,
-                  "next-table" arg  /* Perform a forwarding lookup in the specified table */
+                  "next-table" arg  /* Perform a forwarding lookup in the specified table */,
+                    ipaddr  /* Next-hop address */
                 )
             )
         ).as(:oneline),
@@ -105552,11 +105473,11 @@ end
 
 rule(:routing_destination_address) do
     c(
-          ipaddr  /* IP address */,
         "port" arg  /* Port number */,
         "transport-protocol" (  /* Transport protocol */
           transport_protocol  /* Transport protocol */
-        )
+        ),
+          ipaddr  /* IP address */
     ).as(:oneline)
 end
 
@@ -107412,12 +107333,6 @@ rule(:ipsec_sa) do
   )
 end
 
-rule(:ipsec_traceoptions) do
-    c(
-        "flag" enum(("packet-processing" | "packet-drops" | "security-associations" | "next-hop-tunnel-binding" | "all"))  /* Events to include in data-plane IPSec trace output */.as(:oneline)
-    )
-end
-
 rule(:ipsec_trusted_channel_sa) do
     c(
         "description" arg  /* Text description of trusted channel security association */,
@@ -107467,114 +107382,6 @@ rule(:ipsec_trusted_channel_sa) do
     )
 end
 
-rule(:ipsec_vpn_monitor) do
-    c(
-        "interval" arg  /* Monitor interval in seconds */,
-        "threshold" arg  /* Number of consecutive failures to determine connectivity */
-    )
-end
-
-rule(:ipsec_vpn_template) do
-  arg.as(:arg) (
-    c(
-        "bind-interface" (  /* Bind to tunnel interface (route-based VPN) */
-          interface_name  /* Bind to tunnel interface (route-based VPN) */
-        ),
-        "df-bit" (  /* Specifies how to handle the Don't Fragment bit */
-          ("clear" | "set" | "copy")
-        ),
-        "vpn-monitor" (  /* Monitor VPN liveliness */
-          ipsec_template_monitor  /* Monitor VPN liveliness */
-        ),
-        c(
-          "manual" (  /* Define a manual security association */
-              c(
-                  "gateway" (  /* Define the IPSec peer */
-                    hostname  /* Define the IPSec peer */
-                  ),
-                  "external-interface" (  /* External interface for the security association */
-                    interface_unit  /* External interface for the security association */
-                  ),
-                  "protocol" (  /* Define an IPSec protocol for the security association */
-                    ("ah" | "esp")
-                  ),
-                  "spi" arg  /* Define security parameter index */,
-                  "authentication" (  /* Define authentication parameters */
-                      c(
-                          "algorithm" (  /* Define authentication algorithm */
-                            ("hmac-md5-96" | "hmac-sha1-96" | "hmac-sha-256-128" | "hmac-sha-256-96")
-                          ),
-                          "key" (  /* Define an authentication key */
-                              sc(
-                                  c(
-                                    "ascii-text" arg  /* Format as text */,
-                                    "hexadecimal" arg  /* Format as hexadecimal */
-                                  )
-                              )
-                          ).as(:oneline)
-                      )
-                  ),
-                  "encryption" (  /* Define encryption parameters */
-                      c(
-                          "algorithm" (  /* Define encryption algorithm */
-                            ("des-cbc" | "3des-cbc" | "aes-128-cbc" | "aes-192-cbc" | "aes-256-cbc")
-                          ),
-                          "key" (  /* Define an encryption key */
-                              sc(
-                                  c(
-                                    "ascii-text" arg  /* Format as text */,
-                                    "hexadecimal" arg  /* Format as hexadecimal */
-                                  )
-                              )
-                          ).as(:oneline)
-                      )
-                  )
-              )
-          ),
-          "ike" (  /* Define an IKE-keyed IPSec vpn */
-              c(
-                  "gateway" arg  /* Name of remote gateway */,
-                  "idle-time" arg  /* Idle time to delete SA */,
-                  "no-anti-replay"  /* Disable the anti-replay check */,
-                  "proxy-identity" (  /* IPSec proxy-id to use in IKE negotiations */
-                    ipsec_template_proxy_id  /* IPSec proxy-id to use in IKE negotiations */
-                  ),
-                  "ipsec-policy" arg  /* Name of the IPSec policy */,
-                  "install-interval" arg  /* Delay installation of rekeyed outbound SAs on initiator */
-              )
-          )
-        ),
-        "establish-tunnels" (  /* Define the criteria to establish tunnels */
-          ("immediately" | "on-traffic")
-        )
-    )
-  )
-end
-
-rule(:ipsec_template_monitor) do
-    c(
-        "optimized"  /* Optimize for scalability */,
-        "source-interface" (  /* Source interface for monitor message */
-          interface_unit  /* Source interface for monitor message */
-        ),
-        "destination-ip" (  /* Destination IP addres for monitor message */
-          ipaddr  /* Destination IP addres for monitor message */
-        )
-    )
-end
-
-rule(:ipsec_template_proxy_id) do
-    c(
-        "local" (  /* Local IP address/prefix length */
-          ipprefix_mandatory  /* Local IP address/prefix length */
-        ),
-        "remote" (  /* Remote IP address/prefix length */
-          ipprefix_mandatory  /* Remote IP address/prefix length */
-        ),
-        "service" arg  /* Name of serivce that passes through, any enables all services */
-    )
-end
-
 rule(:security_macsec) do
     c(
         "traceoptions" (  /* Tracing options for debugging protocol operation */
@@ -108138,14 +107945,14 @@ rule(:service_set_ipsec_vpn_options_object) do
         "trusted-ca" arg  /* List of trusted certificate authority profiles */,
         "local-gateway" (  /* Address and routing instance for local gateway */
             sc(
-                  ipaddr  /* Local gateway address */,
                 "routing-instance" arg  /* Name of routing instance that hosts local gateway */,
                 "interface" (  /* Interface as local gateway */
                   interface_unit  /* Interface as local gateway */
                 ),
                 "gw-interface" (  /* Interface as local gateway */
                   interface_unit  /* Interface as local gateway */
-                )
+                ),
+                  ipaddr  /* Local gateway address */
             )
         ).as(:oneline),
         "ike-access-profile" arg  /* IKE access profile for dynamic peers */,
@@ -109942,10 +109749,10 @@ rule(:source_address_filter_list_items) do
                 c(
                   "self"  /* Use a local address as the next-hop address */,
                   "peer-address"  /* Use the remote peer address as the next-hop address */,
-                    ipaddr  /* Next-hop address */,
                   "reject"  /* Use a reject next hop */,
                   "discard"  /* Use a discard next hop */,
-                  "next-table" arg  /* Perform a forwarding lookup in the specified table */
+                  "next-table" arg  /* Perform a forwarding lookup in the specified table */,
+                    ipaddr  /* Next-hop address */
                 )
             )
         ).as(:oneline),
@@ -115822,8 +115629,8 @@ rule(:default_anti_virus_feature) do
             c(
                 "server" (  /* SAV and Anti-Spam first hop DNS server */
                     c(
-                          ipaddr  /* SAV and Anti-Spam first hop DNS server ip */,
-                        "routing-instance" arg  /* Routing instance name */
+                        "routing-instance" arg  /* Routing instance name */,
+                          ipaddr  /* SAV and Anti-Spam first hop DNS server ip */
                     )
                 ),
                 "sxl-timeout" arg  /* Sxl sophos anti-virus engine timeout */,
@@ -116163,9 +115970,9 @@ end
 
 rule(:host_object) do
     c(
-          ipaddr  /* IP address */,
         "port" arg  /* Host port number */,
-        "routing-instance" arg  /* Routing-instance name */
+        "routing-instance" arg  /* Routing-instance name */,
+          ipaddr  /* IP address */
     )
 end
 
@@ -116563,7 +116370,6 @@ rule(:address_type) do
     c(
         "description" arg  /* Text description of address */,
         c(
-            ipprefix  /* Numeric IPv4 or IPv6 address with prefix */,
           "dns-name" (  /* DNS address name */
             dns_name_type  /* DNS address name */
           ),
@@ -116572,7 +116378,8 @@ rule(:address_type) do
           ),
           "range-address" (  /* Address range */
             range_address_type  /* Address range */
-          )
+          ),
+            ipprefix  /* Numeric IPv4 or IPv6 address with prefix */
         )
     )
   )
@@ -117077,36 +116884,6 @@ rule(:security_ipsec_policy) do
     )
 end
 
-rule(:security_ipsec_vpn) do
-    c(
-        "internal" (  /* Define an IPSec SA for internal RE-RE communication */
-            c(
-                "security-association" (  /* Define an IPsec security association */
-                  ipsec_internal_sa  /* Define an IPsec security association */
-                )
-            )
-        ),
-        "traceoptions" (  /* Trace options for IPSec data-plane debug */
-          ipsec_traceoptions  /* Trace options for IPSec data-plane debug */
-        ),
-        "vpn-monitor-options" (  /* Global options for VPN liveliness monitoring */
-          ipsec_vpn_monitor  /* Global options for VPN liveliness monitoring */
-        ),
-        "proposal" (  /* Define an IPSec proposal */
-          ipsec_proposal  /* Define an IPSec proposal */
-        ),
-        "policy" (  /* Define an IPSec policy */
-          ipsec_policy  /* Define an IPSec policy */
-        ),
-        "vpn" (  /* Define an IPSec VPN */
-          ipsec_vpn_template  /* Define an IPSec VPN */
-        ),
-        "security-association" (  /* Define a manual control plane SA  */
-          ipsec_sa  /* Define a manual control plane SA  */
-        )
-    )
-end
-
 rule(:ipsec_traceoptions) do
     c(
         "flag" enum(("packet-processing" | "packet-drops" | "security-associations" | "next-hop-tunnel-binding" | "all"))  /* Events to include in data-plane IPSec trace output */.as(:oneline)
@@ -117450,7 +117227,6 @@ rule(:ssg_destination_nat_object) do
                 ),
                 "address" (  /* Add address or address range to pool */
                     sc(
-                          ipprefix  /* IPv4 or IPv6 address or address range */,
                         c(
                           "to" (  /* Upper limit of address range */
                               c(
@@ -117458,7 +117234,8 @@ rule(:ssg_destination_nat_object) do
                               )
                           ),
                           "port" arg  /* Specify the port value */
-                        )
+                        ),
+                          ipprefix  /* IPv4 or IPv6 address or address range */
                     )
                 ).as(:oneline)
             )
@@ -118056,13 +117833,13 @@ rule(:static_nat_rule_object) do
                           ),
                           "prefix" (  /* Address prefix */
                               c(
-                                    ipprefix  /* IPv4 or IPv6 address prefix value */,
                                   "mapped-port" (  /* Mapped port */
                                     static_nat_rule_mapped_port_object  /* Mapped port */
                                   ).as(:oneline),
                                   "routing-instance" (  /* Routing instance */
                                     ("default" | arg)
-                                  )
+                                  ),
+                                    ipprefix  /* IPv4 or IPv6 address prefix value */
                               )
                           ),
                           "prefix-name" (  /* Address from address book */
@@ -118078,10 +117855,10 @@ rule(:static_nat_rule_object) do
                           ),
                           "nptv6-prefix" (  /* NPTv6 address prefix, the longest prefix will be supported is /64 */
                               c(
-                                    ipprefix  /* IPv6 address prefix value, the longest prefix will be supported is /64 */,
                                   "routing-instance" (  /* Routing instance */
                                     ("default" | arg)
-                                  )
+                                  ),
+                                    ipprefix  /* IPv6 address prefix value, the longest prefix will be supported is /64 */
                               )
                           ),
                           "nptv6-prefix-name" (  /* NPTv6 address from address book */
@@ -118416,4 +118193,91 @@ rule(:zone_system_services_object_type) do
     )
   )
 end
+
+rule(:application_object) do
+  arg.as(:arg) (
+    c(
+        "description" arg  /* Text description of application */,
+        "term" (  /* Define individual application protocols */
+          term_object  /* Define individual application protocols */
+        ),
+        "application-protocol" (  /* Application protocol type */
+          ("bootp" | "dce-rpc" | "dce-rpc-portmap" | "dns" | "exec" | "ftp" | "ftp-data" | "gprs-gtp-c" | "gprs-gtp-u" | "gprs-gtp-v0" | "gprs-sctp" | "h323" | "icmp" | "icmpv6" | "ignore" | "iiop" | "ike-esp-nat" | "ip" | "login" | "mgcp-ca" | "mgcp-ua" | "ms-rpc" | "netbios" | "netshow" | "none" | "pptp" | "q931" | "ras" | "realaudio" | "rpc" | "rpc-portmap" | "rsh" | "rtsp" | "sccp" | "sip" | "shell" | "snmp" | "sqlnet" | "sqlnet-v2" | "sun-rpc" | "talk" | "tftp" | "traceroute" | "http" | "winframe" | "https" | "imap" | "smtp" | "ssh" | "telnet" | "twamp")
+        ),
+        "protocol" (  /* Match IP protocol type */
+          ("icmp" | "igmp" | "ipip" | "tcp" | "egp" | "udp" | "rsvp" | "gre" | "esp" | "ah" | "icmp6" | "ospf" | "pim" | "sctp" | arg)
+        ),
+        "source-port" (  /* Match TCP/UDP source port */
+          ("ftp-data" | "ftp" | "ssh" | "telnet" | "smtp" | "tacacs" | "tacacs-ds" | "domain" | "dhcp" | "bootps" | "bootpc" | "tftp" | "finger" | "http" | "kerberos-sec" | "pop3" | "sunrpc" | "ident" | "nntp" | "ntp" | "netbios-ns" | "netbios-dgm" | "netbios-ssn" | "imap" | "snmp" | "snmptrap" | "xdmcp" | "bgp" | "ldap" | "mobileip-agent" | "mobilip-mn" | "msdp" | "https" | "snpp" | "biff" | "exec" | "login" | "who" | "cmd" | "syslog" | "printer" | "talk" | "ntalk" | "rip" | "timed" | "klogin" | "kshell" | "ldp" | "krb-prop" | "krbupdate" | "kpasswd" | "socks" | "afs" | "pptp" | "radius" | "radacct" | "zephyr-srv" | "zephyr-clt" | "zephyr-hm" | "nfsd" | "eklogin" | "ekshell" | "rkinit" | "cvspserver" | arg)
+        ),
+        "destination-port" (  /* Match TCP/UDP destination port */
+          ("ftp-data" | "ftp" | "ssh" | "telnet" | "smtp" | "tacacs" | "tacacs-ds" | "domain" | "dhcp" | "bootps" | "bootpc" | "tftp" | "finger" | "http" | "kerberos-sec" | "pop3" | "sunrpc" | "ident" | "nntp" | "ntp" | "netbios-ns" | "netbios-dgm" | "netbios-ssn" | "imap" | "snmp" | "snmptrap" | "xdmcp" | "bgp" | "ldap" | "mobileip-agent" | "mobilip-mn" | "msdp" | "https" | "snpp" | "biff" | "exec" | "login" | "who" | "cmd" | "syslog" | "printer" | "talk" | "ntalk" | "rip" | "timed" | "klogin" | "kshell" | "ldp" | "krb-prop" | "krbupdate" | "kpasswd" | "socks" | "afs" | "pptp" | "radius" | "radacct" | "zephyr-srv" | "zephyr-clt" | "zephyr-hm" | "nfsd" | "eklogin" | "ekshell" | "rkinit" | "cvspserver" | arg)
+        ),
+        "ether-type" arg  /* Match ether type */,
+        "snmp-command" arg  /* Match SNMP command */,
+        "icmp-type" (  /* Match ICMP message type */
+          ("echo-request" | "echo-reply" | "unreachable" | "source-quench" | "redirect" | "router-advertisement" | "router-solicit" | "time-exceeded" | "parameter-problem" | "timestamp" | "timestamp-reply" | "info-request" | "info-reply" | "mask-request" | "mask-reply" | arg)
+        ),
+        "icmp6-type" (  /* Match ICMP6 message type */
+          ("echo-request" | "echo-reply" | "destination-unreachable" | "router-advertisement" | "router-solicit" | "time-exceeded" | "parameter-problem" | "packet-too-big" | "membership-query" | "membership-report" | "membership-termination" | "redirect" | "neighbor-solicit" | "neighbor-advertisement" | "router-renumbering" | "node-information-request" | "node-information-reply" | arg)
+        ),
+        "icmp-code" (  /* Match ICMP message code */
+          ("network-unreachable" | "host-unreachable" | "protocol-unreachable" | "port-unreachable" | "fragmentation-needed" | "source-route-failed" | "destination-network-unknown" | "destination-host-unknown" | "source-host-isolated" | "destination-network-prohibited" | "destination-host-prohibited" | "network-unreachable-for-tos" | "host-unreachable-for-tos" | "communication-prohibited-by-filtering" | "host-precedence-violation" | "precedence-cutoff-in-effect" | "redirect-for-network" | "redirect-for-host" | "redirect-for-tos-and-net" | "redirect-for-tos-and-host" | "ttl-eq-zero-during-transit" | "ttl-eq-zero-during-reassembly" | "ip-header-bad" | "required-option-missing" | arg)
+        ),
+        "icmp6-code" (  /* Match ICMP6 message code */
+          ("no-route-to-destination" | "administratively-prohibited" | "address-unreachable" | "port-unreachable" | "ttl-eq-zero-during-transit" | "ttl-eq-zero-during-reassembly" | "ip6-header-bad" | "unrecognized-next-header" | "unrecognized-option" | arg)
+        ),
+        "ttl-threshold" arg  /* Traceroute TTL threshold */,
+        "rpc-program-number" arg  /* Match range of RPC program numbers */,
+        "uuid" arg  /* Match universal unique identifier for DCE RPC objects */,
+        "inactivity-timeout" (  /* Application-specific inactivity timeout */
+          ("never" | arg)
+        ),
+        "gate-timeout" arg  /* Application-specific gate timeout */,
+        "child-inactivity-timeout" arg  /* Application-specific child session inactivity timeout */,
+        "learn-sip-register"  /* Learn potential incoming SIP calls by inspecting the SIP register method */,
+        "sip-call-hold-timeout" arg  /* SIP flow timeout when call is put on hold */,
+        c(
+          "do-not-translate-AAAA-query-to-A-query"  /* Knob to control the translation of AAAA query to A query */,
+          "do-not-translate-A-query-to-AAAA-query"  /* Knob to control the translation of A query to AAAA query */
+        )
+    )
+  )
+end
+
+rule(:term_object) do
+  arg.as(:arg) (
+    c(
+        "alg" (  /* Application Layer Gateway */
+          ("bootp" | "dce-rpc" | "dce-rpc-portmap" | "dns" | "exec" | "ftp" | "ftp-data" | "gprs-gtp-c" | "gprs-gtp-u" | "gprs-gtp-v0" | "gprs-sctp" | "h323" | "icmp" | "icmpv6" | "ignore" | "iiop" | "ike-esp-nat" | "ip" | "login" | "mgcp-ca" | "mgcp-ua" | "ms-rpc" | "netbios" | "netshow" | "none" | "pptp" | "q931" | "ras" | "realaudio" | "rpc" | "rpc-portmap" | "rsh" | "rtsp" | "sccp" | "sip" | "shell" | "snmp" | "sqlnet" | "sqlnet-v2" | "sun-rpc" | "talk" | "tftp" | "traceroute" | "http" | "winframe" | "https" | "imap" | "smtp" | "ssh" | "telnet" | "twamp")
+        ),
+        "protocol" (  /* Match IP protocol type */
+          ("icmp" | "igmp" | "ipip" | "tcp" | "egp" | "udp" | "rsvp" | "gre" | "esp" | "ah" | "icmp6" | "ospf" | "pim" | "sctp" | arg)
+        ),
+        "source-port" (  /* Match TCP/UDP source port */
+          ("ftp-data" | "ftp" | "ssh" | "telnet" | "smtp" | "tacacs" | "tacacs-ds" | "domain" | "dhcp" | "bootps" | "bootpc" | "tftp" | "finger" | "http" | "kerberos-sec" | "pop3" | "sunrpc" | "ident" | "nntp" | "ntp" | "netbios-ns" | "netbios-dgm" | "netbios-ssn" | "imap" | "snmp" | "snmptrap" | "xdmcp" | "bgp" | "ldap" | "mobileip-agent" | "mobilip-mn" | "msdp" | "https" | "snpp" | "biff" | "exec" | "login" | "who" | "cmd" | "syslog" | "printer" | "talk" | "ntalk" | "rip" | "timed" | "klogin" | "kshell" | "ldp" | "krb-prop" | "krbupdate" | "kpasswd" | "socks" | "afs" | "pptp" | "radius" | "radacct" | "zephyr-srv" | "zephyr-clt" | "zephyr-hm" | "nfsd" | "eklogin" | "ekshell" | "rkinit" | "cvspserver" | arg)
+        ),
+        "destination-port" (  /* Match TCP/UDP destination port */
+          ("ftp-data" | "ftp" | "ssh" | "telnet" | "smtp" | "tacacs" | "tacacs-ds" | "domain" | "dhcp" | "bootps" | "bootpc" | "tftp" | "finger" | "http" | "kerberos-sec" | "pop3" | "sunrpc" | "ident" | "nntp" | "ntp" | "netbios-ns" | "netbios-dgm" | "netbios-ssn" | "imap" | "snmp" | "snmptrap" | "xdmcp" | "bgp" | "ldap" | "mobileip-agent" | "mobilip-mn" | "msdp" | "https" | "snpp" | "biff" | "exec" | "login" | "who" | "cmd" | "syslog" | "printer" | "talk" | "ntalk" | "rip" | "timed" | "klogin" | "kshell" | "ldp" | "krb-prop" | "krbupdate" | "kpasswd" | "socks" | "afs" | "pptp" | "radius" | "radacct" | "zephyr-srv" | "zephyr-clt" | "zephyr-hm" | "nfsd" | "eklogin" | "ekshell" | "rkinit" | "cvspserver" | arg)
+        ),
+        "icmp-type" (  /* Match ICMP message type */
+          ("echo-request" | "echo-reply" | "unreachable" | "source-quench" | "redirect" | "router-advertisement" | "router-solicit" | "time-exceeded" | "parameter-problem" | "timestamp" | "timestamp-reply" | "info-request" | "info-reply" | "mask-request" | "mask-reply" | arg)
+        ),
+        "icmp-code" (  /* Match ICMP message code */
+          ("network-unreachable" | "host-unreachable" | "protocol-unreachable" | "port-unreachable" | "fragmentation-needed" | "source-route-failed" | "destination-network-unknown" | "destination-host-unknown" | "source-host-isolated" | "destination-network-prohibited" | "destination-host-prohibited" | "network-unreachable-for-tos" | "host-unreachable-for-tos" | "communication-prohibited-by-filtering" | "host-precedence-violation" | "precedence-cutoff-in-effect" | "redirect-for-network" | "redirect-for-host" | "redirect-for-tos-and-net" | "redirect-for-tos-and-host" | "ttl-eq-zero-during-transit" | "ttl-eq-zero-during-reassembly" | "ip-header-bad" | "required-option-missing" | arg)
+        ),
+        "icmp6-type" (  /* Match ICMP6 message type */
+          ("echo-request" | "echo-reply" | "destination-unreachable" | "router-advertisement" | "router-solicit" | "time-exceeded" | "parameter-problem" | "packet-too-big" | "membership-query" | "membership-report" | "membership-termination" | "redirect" | "neighbor-solicit" | "neighbor-advertisement" | "router-renumbering" | "node-information-request" | "node-information-reply" | arg)
+        ),
+        "icmp6-code" (  /* Match ICMP6 message code */
+          ("no-route-to-destination" | "administratively-prohibited" | "address-unreachable" | "port-unreachable" | "ttl-eq-zero-during-transit" | "ttl-eq-zero-during-reassembly" | "ip6-header-bad" | "unrecognized-next-header" | "unrecognized-option" | arg)
+        ),
+        "rpc-program-number" arg  /* Match range of RPC program numbers */,
+        "uuid" arg  /* Match universal unique identifier for DCE RPC objects */,
+        "inactivity-timeout" (  /* Application-specific inactivity timeout */
+          ("never" | arg)
+        )
+    )
+  ).as(:oneline)
+end
 # End of vSRX 18.3R1.9