catalystwan 0.41.2.dev9__py3-none-any.whl → 0.41.3__py3-none-any.whl

catalystwan/models/policy/{definition → definitions}/zone_based_firewall.py

@@ -7,35 +7,25 @@ from uuid import UUID
 from pydantic import BaseModel, ConfigDict, Field
 from typing_extensions import Annotated
 
-from catalystwan.models.common import PolicyModeType
 from catalystwan.models.misc.application_protocols import ApplicationProtocol
 from catalystwan.models.policy.policy_definition import (
-    AdvancedInspectionProfileAction,
     AppListEntry,
-    AppListFlatEntry,
-    ConnectionEventsAction,
     DefinitionWithSequencesCommonBase,
     DestinationDataPrefixListEntry,
     DestinationFQDNEntry,
-    DestinationFQDNListEntry,
     DestinationGeoLocationEntry,
     DestinationGeoLocationListEntry,
     DestinationIPEntry,
     DestinationPortEntry,
     DestinationPortListEntry,
-    DestinationScalableGroupTagListEntry,
-    DestinationSecurityGroupEntry,
     LogAction,
     Match,
-    PolicyActionBase,
+    PolicyActionType,
     PolicyDefinitionBase,
-    PolicyDefinitionGetResponse,
-    PolicyDefinitionId,
     PolicyDefinitionSequenceBase,
     ProtocolEntry,
     ProtocolNameEntry,
     ProtocolNameListEntry,
-    ReferenceWithId,
     RuleSetListEntry,
     SourceDataPrefixListEntry,
     SourceFQDNEntry,
@@ -45,24 +35,18 @@ from catalystwan.models.policy.policy_definition import (
     SourceIPEntry,
     SourcePortEntry,
     SourcePortListEntry,
-    SourceScalableGroupTagListEntry,
-    SourceSecurityGroupEntry,
 )
 
 ZoneBasedFWPolicySequenceEntry = Annotated[
     Union[
         AppListEntry,
-        AppListFlatEntry,
         DestinationDataPrefixListEntry,
         DestinationFQDNEntry,
-        DestinationFQDNListEntry,
         DestinationGeoLocationEntry,
         DestinationGeoLocationListEntry,
         DestinationIPEntry,
         DestinationPortEntry,
         DestinationPortListEntry,
-        DestinationScalableGroupTagListEntry,
-        DestinationSecurityGroupEntry,
         ProtocolEntry,
         ProtocolNameEntry,
         ProtocolNameListEntry,
@@ -75,14 +59,10 @@ ZoneBasedFWPolicySequenceEntry = Annotated[
         SourceIPEntry,
         SourcePortEntry,
         SourcePortListEntry,
-        SourceScalableGroupTagListEntry,
-        SourceSecurityGroupEntry,
     ],
     Field(discriminator="field"),
 ]
 
-ZonePair = Literal["self", "default"]
-
 ZoneBasedFWPolicySequenceEntryWithRuleSets = Annotated[
     Union[
         AppListEntry,
@@ -91,22 +71,6 @@ ZoneBasedFWPolicySequenceEntryWithRuleSets = Annotated[
     Field(discriminator="field"),
 ]
 
-ZoneBasedFWPolicyActions = Annotated[
-    Union[
-        AdvancedInspectionProfileAction,
-        ConnectionEventsAction,
-        LogAction,
-    ],
-    Field(discriminator="type"),
-]
-
-ZoneBasedFirewallDefaultActionType = Literal["drop", "pass"]
-ZoneBasedFirewallBaseActionType = Literal["drop", "pass", "inspect"]
-
-
-class ZoneBasedFirewallDefaultAction(PolicyActionBase):
-    type: ZoneBasedFirewallDefaultActionType
-
 
 class ZoneBasedFWPolicyMatches(Match):
     entries: List[ZoneBasedFWPolicySequenceEntry] = []
@@ -118,13 +82,13 @@ class ZoneBasedFWPolicySequenceWithRuleSets(PolicyDefinitionSequenceBase):
     )
     match: ZoneBasedFWPolicyMatches
     ruleset: bool = True
-    actions: List[ZoneBasedFWPolicyActions] = []
+    actions: List[LogAction] = []
     model_config = ConfigDict(populate_by_name=True)
 
     def match_rule_set_lists(self, rule_set_ids: Set[UUID]) -> None:
-        self._insert_match(RuleSetListEntry(ref=list(rule_set_ids)))
+        self._insert_match(RuleSetListEntry.from_rule_set_ids(rule_set_ids))
 
-    def match_app_list(self, app_list_id: List[UUID]) -> None:
+    def match_app_list(self, app_list_id: UUID) -> None:
         if self.base_action != "inspect":
             raise ValueError("Action must be inspect when Application/Application Family List is selected.")
         self._insert_match(AppListEntry(ref=app_list_id))
@@ -135,25 +99,16 @@ class ZoneBasedFWPolicySequence(PolicyDefinitionSequenceBase):
         default="zoneBasedFW", serialization_alias="sequenceType", validation_alias="sequenceType"
     )
     match: ZoneBasedFWPolicyMatches
-    actions: List[Union[LogAction, AdvancedInspectionProfileAction, ConnectionEventsAction]] = []
+    actions: List[LogAction] = []
     model_config = ConfigDict(populate_by_name=True)
 
-    def set_log_action(self):
-        self.actions.append(LogAction())
-
-    def set_advanced_inspection_profile_action(self, profile_id: UUID):
-        self.actions.append(AdvancedInspectionProfileAction(parameter=ReferenceWithId(ref=profile_id)))
-
-    def set_conection_events_action(self):
-        self.actions.append(ConnectionEventsAction())
-
-    def match_app_list(self, app_list_id: List[UUID]) -> None:
+    def match_app_list(self, app_list_id: UUID) -> None:
         if self.base_action != "inspect":
             raise ValueError("Action must be inspect when Application/Application Family List is selected.")
         self._insert_match(AppListEntry(ref=app_list_id))
 
-    def match_destination_data_prefix_list(self, data_prefix_lists: List[UUID]) -> None:
-        self._insert_match(DestinationDataPrefixListEntry(ref=data_prefix_lists))
+    def match_destination_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
+        self._insert_match(DestinationDataPrefixListEntry(ref=data_prefix_list_id))
 
     def match_destination_fqdn(self, fqdn: str) -> None:
         self._insert_match(DestinationFQDNEntry(value=fqdn))
@@ -161,7 +116,7 @@ class ZoneBasedFWPolicySequence(PolicyDefinitionSequenceBase):
     def match_destination_geo_location(self, geo_location: str) -> None:
         self._insert_match(DestinationGeoLocationEntry(value=geo_location))
 
-    def match_destination_geo_location_list(self, geo_location_list_id: List[UUID]) -> None:
+    def match_destination_geo_location_list(self, geo_location_list_id: UUID) -> None:
         self._insert_match(DestinationGeoLocationListEntry(ref=geo_location_list_id))
 
     def match_destination_ip(self, networks: List[IPv4Network]) -> None:
@@ -170,11 +125,8 @@ class ZoneBasedFWPolicySequence(PolicyDefinitionSequenceBase):
     def match_destination_ports(self, ports: Set[int] = set(), port_ranges: List[Tuple[int, int]] = []) -> None:
         self._insert_match(DestinationPortEntry.from_port_set_and_ranges(ports, port_ranges))
 
-    def match_destination_port_list(self, data_prefix_lists: List[UUID]) -> None:
-        self._insert_match(DestinationPortListEntry(ref=data_prefix_lists))
-
-    def match_destination_security_group_list(self, security_group_list: List[UUID]) -> None:
-        self._insert_match(DestinationSecurityGroupEntry(ref=security_group_list))
+    def match_destination_port_list(self, port_list_id: UUID) -> None:
+        self._insert_match(DestinationPortListEntry(ref=port_list_id))
 
     def match_protocols(self, protocols: Set[int]) -> None:
         self._insert_match(ProtocolEntry.from_protocol_set(protocols))
@@ -184,17 +136,17 @@ class ZoneBasedFWPolicySequence(PolicyDefinitionSequenceBase):
         for name in names:
             app_protocol = protocol_map.get(name, None)
             if app_protocol is None:
-                raise ValueError(f"{name} not found in protocol map keys: {protocol_map.keys()}")  # noqa: E713
+                raise ValueError(f"{name} not found in protocol map keys: {protocol_map.keys()}")
             app_protocols.append(app_protocol)
         self._insert_match(ProtocolNameEntry.from_application_protocols(app_protocols))
         self._insert_match(DestinationPortEntry.from_application_protocols(app_protocols), False)
         self._insert_match(ProtocolEntry.from_application_protocols(app_protocols), False)
 
-    def match_protocol_name_list(self, protocol_name_list_id: List[UUID]) -> None:
+    def match_protocol_name_list(self, protocol_name_list_id: UUID) -> None:
         self._insert_match(ProtocolNameListEntry(ref=protocol_name_list_id))
 
-    def match_source_data_prefix_list(self, data_prefix_lists: List[UUID]) -> None:
-        self._insert_match(SourceDataPrefixListEntry(ref=data_prefix_lists))
+    def match_source_data_prefix_list(self, data_prefix_list_id: UUID) -> None:
+        self._insert_match(SourceDataPrefixListEntry(ref=data_prefix_list_id))
 
     def match_source_fqdn(self, fqdn: str) -> None:
         self._insert_match(SourceFQDNEntry(value=fqdn))
@@ -205,7 +157,7 @@ class ZoneBasedFWPolicySequence(PolicyDefinitionSequenceBase):
     def match_source_geo_location(self, geo_location: str) -> None:
         self._insert_match(SourceGeoLocationEntry(value=geo_location))
 
-    def match_source_geo_location_list(self, geo_location_list_id: List[UUID]) -> None:
+    def match_source_geo_location_list(self, geo_location_list_id: UUID) -> None:
         self._insert_match(SourceGeoLocationListEntry(ref=geo_location_list_id))
 
     def match_source_ip(self, networks: List[IPv4Network]) -> None:
@@ -214,41 +166,36 @@ class ZoneBasedFWPolicySequence(PolicyDefinitionSequenceBase):
     def match_source_port(self, ports: Set[int] = set(), port_ranges: List[Tuple[int, int]] = []) -> None:
         self._insert_match(SourcePortEntry.from_port_set_and_ranges(ports, port_ranges))
 
-    def match_source_port_list(self, port_list_id: List[UUID]) -> None:
+    def match_source_port_list(self, port_list_id: UUID) -> None:
         self._insert_match(SourcePortListEntry(ref=port_list_id))
 
-    def match_source_security_group_list(self, security_group_list: List[UUID]) -> None:
-        self._insert_match(SourceSecurityGroupEntry(ref=security_group_list))
-
 
 class ZoneBasedFWPolicyEntry(BaseModel):
-    source_zone_id: Union[UUID, ZonePair] = Field(
+    source_zone_id: Union[UUID, Literal["self"]] = Field(
         default="self", serialization_alias="sourceZone", validation_alias="sourceZone"
     )
-    destination_zone_id: Union[UUID, ZonePair] = Field(
-        serialization_alias="destinationZone", validation_alias="destinationZone"
-    )
+    destination_zone_id: UUID = Field(serialization_alias="destinationZone", validation_alias="destinationZone")
+    model_config = ConfigDict(populate_by_name=True)
+
+
+class ZoneBasedFWPolicyHeader(PolicyDefinitionBase):
+    type: Literal["zoneBasedFW"] = "zoneBasedFW"
+    mode: str = Field(default="security")
     model_config = ConfigDict(populate_by_name=True)
 
 
 class ZoneBasedFWPolicyDefinition(DefinitionWithSequencesCommonBase):
-    default_action: ZoneBasedFirewallDefaultAction = Field(
-        default=ZoneBasedFirewallDefaultAction(type="drop"),
-        serialization_alias="defaultAction",
-        validation_alias="defaultAction",
-    )
     sequences: List[Union[ZoneBasedFWPolicySequence, ZoneBasedFWPolicySequenceWithRuleSets]] = []
     entries: List[ZoneBasedFWPolicyEntry] = []
 
 
-class ZoneBasedFWPolicy(PolicyDefinitionBase):
-    model_config = ConfigDict(populate_by_name=True)
+class ZoneBasedFWPolicy(ZoneBasedFWPolicyHeader):
     type: Literal["zoneBasedFW"] = "zoneBasedFW"
-    mode: PolicyModeType = "security"
+    mode: Literal["security"] = "security"
     definition: ZoneBasedFWPolicyDefinition = ZoneBasedFWPolicyDefinition()
 
     def add_ipv4_rule(
-        self, name: str, base_action: ZoneBasedFirewallBaseActionType = "drop", log: bool = False
+        self, name: str, base_action: PolicyActionType = "drop", log: bool = False
     ) -> ZoneBasedFWPolicySequence:
         """Adds new IPv4 Rule to Zone Based Firewall Policy
 
@@ -272,7 +219,7 @@ class ZoneBasedFWPolicy(PolicyDefinitionBase):
         return sequence
 
     def add_ipv4_rule_sets(
-        self, name: str, base_action: ZoneBasedFirewallBaseActionType = "drop", log: bool = False
+        self, name: str, base_action: PolicyActionType = "drop", log: bool = False
     ) -> ZoneBasedFWPolicySequenceWithRuleSets:
         sequence = ZoneBasedFWPolicySequenceWithRuleSets(
             sequence_name=name,
@@ -285,17 +232,9 @@ class ZoneBasedFWPolicy(PolicyDefinitionBase):
         self.definition.add(sequence)
         return sequence
 
-    def add_zone_pair(self, source_zone: Union[UUID, ZonePair], destination_zone: Union[UUID, ZonePair]) -> None:
+    def add_zone_pair(self, source_zone_id: UUID, destination_zone_id: UUID) -> None:
         entry = ZoneBasedFWPolicyEntry(
-            source_zone_id=source_zone,
-            destination_zone_id=destination_zone,
+            source_zone_id=source_zone_id,
+            destination_zone_id=destination_zone_id,
         )
         self.definition.entries.append(entry)
-
-
-class ZoneBasedFWPolicyEditPayload(ZoneBasedFWPolicy, PolicyDefinitionId):
-    pass
-
-
-class ZoneBasedFWPolicyGetResponse(ZoneBasedFWPolicy, PolicyDefinitionGetResponse):
-    pass

catalystwan/models/policy/lists.py

@@ -0,0 +1,330 @@
+# Copyright 2023 Cisco Systems, Inc. and its affiliates
+
+from ipaddress import IPv4Address, IPv4Network, IPv6Network
+from typing import Any, List, Literal, Optional, Set, Tuple
+from uuid import UUID
+
+from pydantic import BaseModel, Field
+
+from catalystwan.models.common import InterfaceType, TLOCColor, WellKnownBGPCommunities
+from catalystwan.models.policy.lists_entries import (
+    AppListEntry,
+    AppProbeClassListEntry,
+    ASPathListEntry,
+    ClassMapListEntry,
+    ColorGroupPreference,
+    ColorListEntry,
+    CommunityListEntry,
+    DataIPv6PrefixListEntry,
+    DataPrefixListEntry,
+    EncapType,
+    FQDNListEntry,
+    GeoLocationListEntry,
+    IPSSignatureListEntry,
+    IPv6PrefixListEntry,
+    LocalAppListEntry,
+    LocalDomainListEntry,
+    MirrorListEntry,
+    PathPreference,
+    PolicerExceedAction,
+    PolicerListEntry,
+    PortListEntry,
+    PreferredColorGroupListEntry,
+    PrefixListEntry,
+    ProtocolNameListEntry,
+    RegionListEntry,
+    SiteListEntry,
+    SLAClassListEntry,
+    TLOCListEntry,
+    URLListEntry,
+    VPNListEntry,
+    ZoneListEntry,
+)
+
+
+class PolicyListBase(BaseModel):
+    name: str = Field(
+        pattern="^[a-zA-Z0-9_-]{1,32}$",
+        description="Can include only alpha-numeric characters, hyphen '-' or underscore '_'; maximum 32 characters",
+    )
+    description: Optional[str] = "Desc Not Required"
+    entries: List[Any]
+
+    def _add_entry(self, entry: Any, single: bool = False) -> None:
+        if self.entries and single:
+            self.entries[0] = entry
+            del self.entries[1:]
+        else:
+            self.entries.append(entry)
+
+
+class DataPrefixList(PolicyListBase):
+    type: Literal["dataPrefix"] = "dataPrefix"
+    entries: List[DataPrefixListEntry] = []
+
+    def add_prefix(self, ip_prefix: IPv4Network) -> None:
+        self._add_entry(DataPrefixListEntry(ip_prefix=ip_prefix))
+
+
+class SiteList(PolicyListBase):
+    type: Literal["site"] = "site"
+    entries: List[SiteListEntry] = []
+
+    def add_sites(self, sites: Set[int]):
+        for site in sites:
+            self._add_entry(SiteListEntry(site_id=str(site)))
+
+    def add_site_range(self, site_range: Tuple[int, int]):
+        entry = SiteListEntry(site_id=f"{site_range[0]}-{site_range[1]}")
+        self._add_entry(entry)
+
+
+class VPNList(PolicyListBase):
+    type: Literal["vpn"] = "vpn"
+    entries: List[VPNListEntry] = []
+
+    def add_vpns(self, vpns: Set[int]):
+        for vpn in vpns:
+            self._add_entry(VPNListEntry(vpn=str(vpn)))
+
+    def add_vpn_range(self, vpn_range: Tuple[int, int]):
+        entry = VPNListEntry(vpn=f"{vpn_range[0]}-{vpn_range[1]}")
+        self._add_entry(entry)
+
+
+class ZoneList(PolicyListBase):
+    type: Literal["zone"] = "zone"
+    entries: List[ZoneListEntry] = []
+
+    def assign_vpns(self, vpns: Set[int]) -> None:
+        self.entries = [ZoneListEntry(vpn=str(vpn)) for vpn in vpns]
+
+    def assign_interfaces(self, ifs: Set[InterfaceType]) -> None:
+        self.entries = [ZoneListEntry(interface=interface) for interface in ifs]
+
+
+class FQDNList(PolicyListBase):
+    type: Literal["fqdn"] = "fqdn"
+    entries: List[FQDNListEntry] = []
+
+
+class GeoLocationList(PolicyListBase):
+    type: Literal["geoLocation"] = "geoLocation"
+    entries: List[GeoLocationListEntry] = []
+
+
+class PortList(PolicyListBase):
+    type: Literal["port"] = "port"
+    entries: List[PortListEntry] = []
+
+
+class ProtocolNameList(PolicyListBase):
+    type: Literal["protocolName"] = "protocolName"
+    entries: List[ProtocolNameListEntry] = []
+
+
+class LocalAppList(PolicyListBase):
+    type: Literal["localApp"] = "localApp"
+    entries: List[LocalAppListEntry] = []
+
+
+class AppList(PolicyListBase):
+    type: Literal["app"] = "app"
+    entries: List[AppListEntry] = []
+
+    def add_app(self, app: str) -> None:
+        self._add_entry(AppListEntry(app=app))
+
+    def add_app_family(self, app_family: str) -> None:
+        self._add_entry(AppListEntry(app_family=app_family))
+
+
+class ColorList(PolicyListBase):
+    type: Literal["color"] = "color"
+    entries: List[ColorListEntry] = []
+
+    def add_color(self, color: TLOCColor) -> None:
+        self._add_entry(ColorListEntry(color=color))
+
+
+class DataIPv6PrefixList(PolicyListBase):
+    type: Literal["dataIpv6Prefix"] = "dataIpv6Prefix"
+    entries: List[DataIPv6PrefixListEntry] = []
+
+    def add_prefix(self, ipv6_prefix: IPv6Network) -> None:
+        self._add_entry(DataIPv6PrefixListEntry(ipv6_prefix=ipv6_prefix))
+
+
+class LocalDomainList(PolicyListBase):
+    type: Literal["localDomain"] = "localDomain"
+    entries: List[LocalDomainListEntry] = []
+
+
+class IPSSignatureList(PolicyListBase):
+    type: Literal["ipsSignature"] = "ipsSignature"
+    entries: List[IPSSignatureListEntry] = []
+
+
+class URLAllowList(PolicyListBase):
+    type: Literal["urlWhiteList"] = "urlWhiteList"
+    entries: List[URLListEntry] = []
+
+
+class URLBlockList(PolicyListBase):
+    type: Literal["urlBlackList"] = "urlBlackList"
+    entries: List[URLListEntry] = []
+
+
+class _CommunityListBase(PolicyListBase):
+    entries: List[CommunityListEntry] = []
+
+    def add_well_known_community(self, community: WellKnownBGPCommunities) -> None:
+        self._add_entry(CommunityListEntry(community=community))
+
+    def add_community(self, as_number: int, community_number: int) -> None:
+        self._add_entry(CommunityListEntry(community=f"{as_number}:{community_number}"))
+
+
+class CommunityList(_CommunityListBase):
+    type: Literal["community"] = "community"
+
+
+class ExpandedCommunityList(_CommunityListBase):
+    type: Literal["expandedCommunity"] = "expandedCommunity"
+
+
+class PolicerList(PolicyListBase):
+    type: Literal["policer"] = "policer"
+    entries: List[PolicerListEntry] = []
+
+    def police(self, burst: int, rate: int, exceed: PolicerExceedAction = "drop") -> None:
+        # Policer list must have only single entry!
+        entry = PolicerListEntry(burst=str(burst), exceed=exceed, rate=str(rate))
+        self._add_entry(entry, single=True)
+
+
+class ASPathList(PolicyListBase):
+    type: Literal["asPath"] = "asPath"
+    entries: List[ASPathListEntry] = []
+
+
+class ClassMapList(PolicyListBase):
+    type: Literal["class"] = "class"
+    entries: List[ClassMapListEntry] = []
+
+    def assign_queue(self, queue: int) -> None:
+        # Class map list must have only one entry!
+        entry = ClassMapListEntry(queue=str(queue))
+        self._add_entry(entry, single=True)
+
+
+class MirrorList(PolicyListBase):
+    type: Literal["mirror"] = "mirror"
+    entries: List[MirrorListEntry] = []
+
+
+class AppProbeClassList(PolicyListBase):
+    type: Literal["appProbe"] = "appProbe"
+    entries: List[AppProbeClassListEntry] = []
+
+    def assign_forwarding_class(self, name: str) -> AppProbeClassListEntry:
+        # App probe class list must have only one entry!
+        entry = AppProbeClassListEntry(forwarding_class=name)
+        self._add_entry(entry, single=True)
+        return entry
+
+
+class SLAClassList(PolicyListBase):
+    type: Literal["sla"] = "sla"
+    entries: List[SLAClassListEntry] = []
+
+    def assign_app_probe_class(
+        self,
+        app_probe_class_id: UUID,
+        latency: Optional[int] = None,
+        loss: Optional[int] = None,
+        jitter: Optional[int] = None,
+    ) -> SLAClassListEntry:
+        # SLA class list must have only one entry!
+        _latency = str(latency) if latency is not None else None
+        _loss = str(loss) if loss is not None else None
+        _jitter = str(jitter) if jitter is not None else None
+        entry = SLAClassListEntry(latency=_latency, loss=_loss, jitter=_jitter, app_probe_class=app_probe_class_id)
+        self._add_entry(entry, single=True)
+        return entry
+
+    def add_fallback_jitter_criteria(self, jitter_variance: int) -> None:
+        assert self.entries, "Assign app probe class before configuring best fallback tunnel"
+        self.entries[0].add_fallback_jitter_criteria(jitter_variance)
+
+    def add_fallback_latency_criteria(self, latency_variance: int) -> None:
+        assert self.entries, "Assign app probe class before configuring best fallback tunnel"
+        self.entries[0].add_fallback_latency_criteria(latency_variance)
+
+    def add_fallback_loss_criteria(self, loss_variance: int) -> None:
+        assert self.entries, "Assign app probe class before configuring best fallback tunnel"
+        self.entries[0].add_fallback_loss_criteria(loss_variance)
+
+
+class TLOCList(PolicyListBase):
+    type: Literal["tloc"] = "tloc"
+    entries: List[TLOCListEntry] = []
+
+    def add_tloc(self, tloc: IPv4Address, color: TLOCColor, encap: EncapType, preference: Optional[int] = None) -> None:
+        _preference = str(preference) if preference is not None else None
+        self.entries.append(TLOCListEntry(tloc=tloc, color=color, encap=encap, preference=_preference))
+
+
+class PreferredColorGroupList(PolicyListBase):
+    type: Literal["preferredColorGroup"] = "preferredColorGroup"
+    entries: List[PreferredColorGroupListEntry] = []
+
+    def assign_color_groups(
+        self,
+        primary: Tuple[Set[TLOCColor], PathPreference],
+        secondary: Optional[Tuple[Set[TLOCColor], PathPreference]] = None,
+        tertiary: Optional[Tuple[Set[TLOCColor], PathPreference]] = None,
+    ) -> PreferredColorGroupListEntry:
+        primary_preference = ColorGroupPreference.from_color_set_and_path(*primary)
+        secondary_preference = (
+            ColorGroupPreference.from_color_set_and_path(*secondary) if secondary is not None else None
+        )
+        tertiary_preference = ColorGroupPreference.from_color_set_and_path(*tertiary) if tertiary is not None else None
+        entry = PreferredColorGroupListEntry(
+            primary_preference=primary_preference,
+            secondary_preference=secondary_preference,
+            tertiary_preference=tertiary_preference,
+        )
+        if self.entries:
+            self.entries[0] = entry
+        else:
+            self.entries.append(entry)
+        return entry
+
+
+class PrefixList(PolicyListBase):
+    type: Literal["prefix"] = "prefix"
+    entries: List[PrefixListEntry] = []
+
+    def add_prefix(self, prefix: IPv4Network, ge: Optional[int] = None, le: Optional[int] = None) -> None:
+        _ge = str(ge) if ge is not None else None
+        _le = str(le) if le is not None else None
+        self._add_entry(PrefixListEntry(ip_prefix=prefix, ge=_ge, le=_le))
+
+
+class IPv6PrefixList(PolicyListBase):
+    type: Literal["ipv6prefix"] = "ipv6prefix"
+    entries: List[IPv6PrefixListEntry] = []
+
+
+class RegionList(PolicyListBase):
+    type: Literal["region"] = "region"
+    entries: List[RegionListEntry] = []
+
+    def add_regions(self, regions: Set[int]):
+        for region in regions:
+            self._add_entry(RegionListEntry(region_id=str(region)))
+
+    def add_region_range(self, region_range: Tuple[int, int]):
+        entry = RegionListEntry(region_id=f"{region_range[0]}-{region_range[1]}")
+        self._add_entry(entry)