catalystwan 0.41.2__py3-none-any.whl → 0.41.2.dev1__py3-none-any.whl

catalystwan/models/policy/policy_definition.py

@@ -1,18 +1,47 @@
 # Copyright 2023 Cisco Systems, Inc. and its affiliates
 
 import datetime
+from dataclasses import dataclass, field
 from functools import wraps
-from ipaddress import IPv4Address, IPv4Network, IPv6Network
-from typing import Any, Dict, List, MutableSequence, Optional, Protocol, Sequence, Set, Tuple, Union
+from ipaddress import IPv4Address, IPv4Interface, IPv4Network, IPv6Address, IPv6Interface, IPv6Network
+from typing import Any, Dict, List, MutableSequence, Optional, Sequence, Set, Tuple, Union, overload
 from uuid import UUID
 
-from pydantic import BaseModel, ConfigDict, Field, RootModel, model_validator
+from pydantic import BaseModel, ConfigDict, Field, PlainSerializer, RootModel, field_validator, model_validator
 from typing_extensions import Annotated, Literal
 
-from catalystwan.models.common import ServiceChainNumber, TLOCColor, check_fields_exclusive
+from catalystwan.models.common import (
+    AcceptDropActionType,
+    AcceptRejectActionType,
+    CarrierType,
+    ControlPathType,
+    DestinationRegion,
+    DNSEntryType,
+    DNSTypeEntryType,
+    EncapType,
+    IcmpMsgType,
+    IntStr,
+    LossProtectionType,
+    MultiRegionRole,
+    OriginProtocol,
+    SequenceIpType,
+    ServiceChainNumber,
+    ServiceType,
+    SpaceSeparatedInterfaceStr,
+    SpaceSeparatedIPv4,
+    SpaceSeparatedIPv6,
+    SpaceSeparatedNonNegativeIntList,
+    SpaceSeparatedServiceAreaList,
+    SpaceSeparatedTLOCColorStr,
+    SpaceSeparatedUUIDList,
+    TLOCActionType,
+    TLOCColor,
+    TrafficCategory,
+    TrafficTargetType,
+    check_fields_exclusive,
+    str_as_str_list,
+)
 from catalystwan.models.misc.application_protocols import ApplicationProtocol
-from catalystwan.models.policy.lists_entries import EncapType
-from catalystwan.typed_list import DataSequence
 
 
 def port_set_and_ranges_to_str(ports: Set[int] = set(), port_ranges: List[Tuple[int, int]] = []) -> str:
@@ -32,47 +61,6 @@ PLPEntryType = Literal[
     "high",
 ]
 
-DNSEntryType = Literal[
-    "request",
-    "response",
-]
-
-TrafficTargetType = Literal[
-    "access",
-    "core",
-    "service",
-]
-
-DestinationRegion = Literal[
-    "primary-region",
-    "secondary-region",
-    "other-region",
-]
-
-OriginProtocol = Literal[
-    "aggregate",
-    "bgp",
-    "bgp-external",
-    "bgp-internal",
-    "connected",
-    "eigrp",
-    "ospf",
-    "ospf-inter-area",
-    "ospf-intra-area",
-    "ospf-external1",
-    "ospf-external2",
-    "rip",
-    "static",
-    "eigrp-summary",
-    "eigrp-internal",
-    "eigrp-external",
-    "lisp",
-    "nat-dia",
-    "natpool",
-    "isis",
-    "isis-level1",
-    "isis-level2",
-]
 
 PathType = Literal[
     "hierarchical-path",
@@ -80,19 +68,6 @@ PathType = Literal[
     "transport-gateway-path",
 ]
 
-SequenceIpType = Literal[
-    "ipv4",
-    "ipv6",
-    "all",
-]
-
-PolicyActionType = Literal[
-    "drop",
-    "accept",
-    "pass",
-    "inspect",
-    "reject",
-]
 
 SequenceType = Literal[
     "applicationFirewall",
@@ -107,6 +82,10 @@ SequenceType = Literal[
     "aclv6",
     "deviceaccesspolicy",
     "deviceaccesspolicyv6",
+    "sslDecryption",
+    "vedgeRoute",
+    "vedgeroute",
+    "appRoute",
 ]
 
 
@@ -115,65 +94,141 @@ Optimized = Literal[
     "false",
 ]
 
-DNSTypeEntryType = Literal[
-    "host",
-    "umbrella",
-]
-
-LossProtectionType = Literal[
-    "fecAdaptive",
-    "fecAlways",
-    "packetDuplication",
-]
+AdvancedCommunityMatchFlag = Literal["or", "and", "exact"]
 
-MultiRegionRole = Literal[
-    "border-router",
-    "edge-router",
-]
+MetricType = Literal["type1", "type2"]
 
-ServiceType = Literal[
-    "FW",
-    "IDP",
-    "IDS",
-    "netsvc1",
-    "netsvc2",
-    "netsvc3",
-    "netsvc4",
-]
+SlaNotMetAction = Literal["strict", "fallbackToBestPath"]
 
-TLOCActionType = Literal[
-    "strict",
-    "primary",
-    "backup",
-    "ecmp",
+VoicePortType = Literal[
+    "potsDialPeer",
+    "sipDialPeer",
+    "srstPhone",
+    "voicePort",
 ]
 
-Carrier = Literal[
-    "default",
-    "carrier1",
-    "carrier2",
-    "carrier3",
-    "carrier4",
-    "carrier5",
-    "carrier6",
-    "carrier7",
-    "carrier8",
-]
 
-DeviceAccessProtocol = Literal[22, 161]
+class Reference(BaseModel):
+    ref: UUID
 
 
-class Reference(BaseModel):
+class ReferenceWithId(BaseModel):
+    field: Literal["id"] = "id"
     ref: UUID
 
 
+class ReferenceList(BaseModel):
+    ref: SpaceSeparatedUUIDList
+
+
 class VariableName(BaseModel):
     vip_variable_name: str = Field(serialization_alias="vipVariableName", validation_alias="vipVariableName")
 
 
+class CommonStation(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    name: str
+    number: str
+
+
+class MediaProfileRef(BaseModel):
+    name: int
+    ref: UUID
+
+
+class LineParams(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    gain: IntStr
+    attenuation: IntStr
+    echo_cancellor: bool = Field(validation_alias="echoCancellor", serialization_alias="echoCancellor")
+    vad: bool
+    compand_type: str = Field(serialization_alias="compandType", validation_alias="compandType")
+    cptone: str
+    impedance: Optional[str] = Field(default=None)
+
+
+class DidTimers(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    answer_winkwidth: IntStr = Field(
+        ge=110, le=290, serialization_alias="answerWinkwidth", validation_alias="answerWinkwidth"
+    )
+    clear_wait: IntStr = Field(ge=200, le=2000, serialization_alias="clearWait", validation_alias="clearWait")
+    wait_wink: IntStr = Field(ge=100, le=6500, serialization_alias="waitWink", validation_alias="waitWink")
+    wink_duration: IntStr = Field(ge=50, le=3000, serialization_alias="winkDuration", validation_alias="winkDuration")
+    dial_pulse_min_delay: IntStr = Field(
+        ge=0, le=5000, serialization_alias="dialPulseMinDelay", validation_alias="dialPulseMinDelay"
+    )
+
+
+class FxoTuningParams(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    pre_dial_delay: int = Field(ge=0, serialization_alias="preDialDelay", validation_alias="preDialDelay")
+    timing_sup_disc: IntStr = Field(serialization_alias="timingSupDisc", validation_alias="timingSupDisc")
+    supervisory_disconnect: str = Field(
+        serialization_alias="supervisoryDisconnect", validation_alias="supervisoryDisconnect"
+    )
+    dial_type: str = Field(serialization_alias="dialType", validation_alias="dialType")
+    timing_hookflash_out: IntStr = Field(
+        serialization_alias="timingHookflashOut", validation_alias="timingHookflashOut"
+    )
+    timing_guard_out: IntStr = Field(serialization_alias="timingGuardOut", validation_alias="timingGuardOut")
+    battery_reversal_det_delay: Optional[IntStr] = Field(
+        default=None, serialization_alias="batteryReversalDetDelay", validation_alias="batteryReversalDetDelay"
+    )
+
+
+class FxsTuningParams(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    timing_hookflash_in_min: IntStr = Field(
+        ge=0, le=400, serialization_alias="timingHookflashInMin", validation_alias="timingHookflashInMin"
+    )
+    timing_hookflash_in_max: IntStr = Field(
+        ge=50, le=1500, serialization_alias="timingHookflashInMax", validation_alias="timingHookflashInMax"
+    )
+    loop_length: str = Field(serialization_alias="loopLength", validation_alias="loopLength")
+    ring_frequency: IntStr = Field(serialization_alias="ringFrequency", validation_alias="ringFrequency")
+    ring_dc_offset: Optional[str] = Field(
+        default=None, serialization_alias="ringDcOffset", validation_alias="ringDcOffset"
+    )
+    pulse_digit_detection: bool = Field(
+        serialization_alias="pulseDigitDetection", validation_alias="pulseDigitDetection"
+    )
+    ren: IntStr = Field(ge=1, le=5)
+
+
+class TrunkGroupPreference(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    ref: UUID
+    preference: int
+
+
+class TranslationRuleEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    ref: UUID
+    name: str
+
+
+class TranslationProfileEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    ref: UUID
+    name: str
+    calling_translation_rule: Optional[TranslationRuleEntry] = Field(
+        default=None, serialization_alias="callingTranslationRule", validation_alias="callingTranslationRule"
+    )
+    called_translation_rule: Optional[TranslationRuleEntry] = Field(
+        default=None, serialization_alias="calledTranslationRule", validation_alias="calledTranslationRule"
+    )
+
+
+class SupervisoryDisconnectEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    ref: UUID
+    name: str
+
+
 class LocalTLOCListEntryValue(BaseModel):
-    color: TLOCColor
-    encap: EncapType
+    color: SpaceSeparatedTLOCColorStr
+    encap: Optional[EncapType] = None
     restrict: Optional[str] = None
 
 
@@ -226,25 +281,36 @@ class ProtocolEntry(BaseModel):
 
 class DSCPEntry(BaseModel):
     field: Literal["dscp"] = "dscp"
-    value: str = Field(description="0-63 single numbers separate by space")
+    value: SpaceSeparatedNonNegativeIntList = Field(description="0-63 single numbers separate by space")
 
 
 class SourceIPEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
     field: Literal["sourceIp"] = "sourceIp"
-    value: str = Field(description="IP network specifiers separate by space")
+    value: Optional[SpaceSeparatedIPv4] = Field(default=None, description="IP network specifiers separate by space")
+    vip_variable_name: Optional[str] = Field(
+        default=None, serialization_alias="vipVariableName", validation_alias="vipVariableName"
+    )
 
     @staticmethod
     def from_ipv4_networks(networks: List[IPv4Network]) -> "SourceIPEntry":
-        return SourceIPEntry(value=networks_to_str(networks))
+        return SourceIPEntry(value=[IPv4Interface(ip) for ip in networks])
+
+    def as_ipv4_networks(self) -> List[IPv4Network]:
+        return [] if not self.value else [IPv4Network(val) for val in self.value]
 
 
 class SourceIPv6Entry(BaseModel):
     field: Literal["sourceIpv6"] = "sourceIpv6"
-    value: str = Field(description="IPv6 network specifiers separate by space")
+    value: SpaceSeparatedIPv6
 
     @staticmethod
     def from_ipv6_networks(networks: List[IPv6Network]) -> "SourceIPv6Entry":
-        return SourceIPv6Entry(value=networks_to_str(networks))
+        return SourceIPv6Entry(value=[IPv6Interface(ip) for ip in networks])
+
+    def as_ipv6_networks(self) -> List[IPv6Network]:
+        return [] if not self.value else [IPv6Network(val) for val in self.value]
 
 
 class IPAddressEntry(BaseModel):
@@ -262,21 +328,32 @@ class SourcePortEntry(BaseModel):
 
 
 class DestinationIPEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
     field: Literal["destinationIp"] = "destinationIp"
-    value: str
+    value: Optional[SpaceSeparatedIPv4] = Field(default=None)
+    vip_variable_name: Optional[str] = Field(
+        default=None, serialization_alias="vipVariableName", validation_alias="vipVariableName"
+    )
 
     @staticmethod
     def from_ipv4_networks(networks: List[IPv4Network]) -> "DestinationIPEntry":
-        return DestinationIPEntry(value=networks_to_str(networks))
+        return DestinationIPEntry(value=[IPv4Interface(ip) for ip in networks])
+
+    def as_ipv4_networks(self) -> List[IPv4Network]:
+        return [] if not self.value else [IPv4Network(val) for val in self.value]
 
 
 class DestinationIPv6Entry(BaseModel):
     field: Literal["destinationIpv6"] = "destinationIpv6"
-    value: str
+    value: SpaceSeparatedIPv6
 
     @staticmethod
     def from_ipv6_networks(networks: List[IPv6Network]) -> "DestinationIPv6Entry":
-        return DestinationIPv6Entry(value=networks_to_str(networks))
+        return DestinationIPv6Entry(value=[IPv6Interface(ip) for ip in networks])
+
+    def as_ipv6_networks(self) -> List[IPv6Network]:
+        return [] if not self.value else [IPv6Network(val) for val in self.value]
 
 
 class DestinationPortEntry(BaseModel):
@@ -318,6 +395,26 @@ class DestinationRegionEntry(BaseModel):
     value: DestinationRegion
 
 
+class AddressEntry(BaseModel):
+    field: Literal["address"] = "address"
+    ref: UUID
+
+
+class AsPathListMatchEntry(BaseModel):
+    field: Literal["asPath"] = "asPath"
+    ref: UUID
+
+
+class AsPathActionEntryValue(BaseModel):
+    prepend: Optional[SpaceSeparatedNonNegativeIntList] = None
+    exclude: Optional[SpaceSeparatedNonNegativeIntList] = None
+
+
+class AsPathActionEntry(BaseModel):
+    field: Literal["asPath"] = "asPath"
+    value: AsPathActionEntryValue
+
+
 class SourceFQDNEntry(BaseModel):
     field: Literal["sourceFqdn"] = "sourceFqdn"
     value: str = Field(max_length=120)
@@ -364,22 +461,55 @@ class UseVPNEntry(BaseModel):
 
 class FallBackEntry(BaseModel):
     field: Literal["fallback"] = "fallback"
-    value: str = ""
+    value: Literal["", "true"]
+
+    @property
+    def as_bool(self) -> bool:
+        return True if self.value == "true" else False
+
+
+class DiaPoolEntry(BaseModel):
+    field: Literal["diaPool"] = "diaPool"
+    value: SpaceSeparatedNonNegativeIntList
+
+
+class DiaInterfaceEntry(BaseModel):
+    field: Literal["diaInterface"] = "diaInterface"
+    value: SpaceSeparatedInterfaceStr
+
+
+class BypassEntry(BaseModel):
+    field: Literal["bypass"] = "bypass"
+    value: Literal["", "true"]
 
+    @property
+    def as_bool(self) -> bool:
+        return True if self.value == "true" else False
 
-class NextHopEntry(BaseModel):
+
+class NextHopActionEntry(BaseModel):
     field: Literal["nextHop"] = "nextHop"
-    value: IPv4Address
+    value: Union[IPv4Address, IPv6Address]
+
+
+class NextHopIpv6ActionEntry(BaseModel):
+    field: Literal["nextHopIpv6"] = "nextHopIpv6"
+    value: IPv6Address
+
+
+class NextHopMatchEntry(BaseModel):
+    field: Literal["nextHop"] = "nextHop"
+    ref: UUID
 
 
 class NextHopLooseEntry(BaseModel):
     field: Literal["nextHopLoose"] = "nextHopLoose"
-    value: str
+    value: Annotated[bool, PlainSerializer(lambda x: str(x).lower(), return_type=str, when_used="json-unless-none")]
 
 
 class OMPTagEntry(BaseModel):
     field: Literal["ompTag"] = "ompTag"
-    value: str = Field(description="Number in range 0-4294967295")
+    value: IntStr = Field(description="Number in range 0-4294967295", ge=0, le=4294967295)
 
 
 class OriginEntry(BaseModel):
@@ -399,7 +529,7 @@ class PreferenceEntry(BaseModel):
 
 class PathTypeEntry(BaseModel):
     field: Literal["pathType"] = "pathType"
-    value: PathType
+    value: ControlPathType
 
 
 class RegionEntry(BaseModel):
@@ -443,8 +573,17 @@ class TLOCEntry(BaseModel):
 
 
 class CommunityEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
     field: Literal["community"] = "community"
-    value: str = Field(description="Example: 1000:10000 or internet or local-AS or no advertise or no-export")
+    value: Optional[str] = Field(
+        default=None, description="Example: 1000:10000 or internet or local-AS or no advertise or no-export"
+    )
+    vip_variable_name: Optional[str] = Field(
+        default=None,
+        serialization_alias="vipVariableName",
+        validation_alias="vipVariableName",
+        description="Example: 1000:10000 or internet or local-AS or no advertise or no-export",
+    )
 
 
 class CommunityAdditiveEntry(BaseModel):
@@ -454,7 +593,7 @@ class CommunityAdditiveEntry(BaseModel):
 
 class CarrierEntry(BaseModel):
     field: Literal["carrier"] = "carrier"
-    value: Carrier
+    value: CarrierType
 
 
 class DomainIDEntry(BaseModel):
@@ -472,39 +611,175 @@ class NextHeaderEntry(BaseModel):
     value: str = Field(description="0-63 single numbers separate by space")
 
 
+class AggregatorActionEntryValue(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+    aggregator: IntStr = Field(description="Number in range 1-4294967295", ge=0, le=4294967295)
+    ip_address: Union[IPv4Address, IPv6Address] = Field(serialization_alias="ipAddress", validation_alias="ipAddress")
+
+
+class AggregatorActionEntry(BaseModel):
+    field: Literal["aggregator"] = "aggregator"
+    value: AggregatorActionEntryValue
+
+
 class TrafficClassEntry(BaseModel):
     field: Literal["trafficClass"] = "trafficClass"
     value: str = Field(description="Number in range 0-63")
 
 
+class LocalPreferenceEntry(BaseModel):
+    field: Literal["localPreference"] = "localPreference"
+    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
+
+
+class MetricEntry(BaseModel):
+    field: Literal["metric"] = "metric"
+    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
+
+
+class MetricTypeEntry(BaseModel):
+    field: Literal["metricType"] = "metricType"
+    value: MetricType
+
+
+class OspfTagEntry(BaseModel):
+    field: Literal["ospfTag"] = "ospfTag"
+    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
+
+
+class PeerEntry(BaseModel):
+    field: Literal["peer"] = "peer"
+    value: Union[IPv4Address, IPv6Address]
+
+
+class AtomicAggregateActionEntry(BaseModel):
+    field: Literal["atomicAggregate"] = "atomicAggregate"
+    value: Literal["true"] = "true"
+
+
+class WeightEntry(BaseModel):
+    field: Literal["weight"] = "weight"
+    value: IntStr = Field(ge=0, le=4294967295, description="Number in range 0-4294967295")
+
+
+class AdvancedCommunityEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
+    field: Literal["advancedCommunity"] = "advancedCommunity"
+
+    match_flag: AdvancedCommunityMatchFlag = Field(
+        default="or",
+        serialization_alias="matchFlag",
+        validation_alias="matchFlag",
+        description="The 'and' and 'exact' conditions are applicable to only one community list",
+    )
+
+    refs: List[UUID] = []
+
+
+class ExpandedCommunityInLineEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
+    field: Literal["expandedCommunityInline"] = "expandedCommunityInline"
+    vip_variable_name: str = Field(serialization_alias="vipVariableName", validation_alias="vipVariableName")
+
+
+class ExtendedCommunityEntry(BaseModel):
+    field: Literal["extCommunity"] = "extCommunity"
+    ref: UUID
+
+
+NATVPNEntries = Annotated[
+    Union[
+        BypassEntry,
+        DiaPoolEntry,
+        DiaInterfaceEntry,
+        FallBackEntry,
+        UseVPNEntry,
+    ],
+    Field(discriminator="field"),
+]
+
+
+@dataclass
+class NATVPNParams:
+    bypass: bool = False
+    dia_pool: List[int] = field(default_factory=list)
+    dia_interface: List[str] = field(default_factory=list)
+    fallback: bool = False
+    vpn: Optional[int] = None
+
+    def as_entry_list(self) -> List[NATVPNEntries]:
+        entries: List[NATVPNEntries] = []
+        if self.bypass:
+            entries.append(BypassEntry(value="true"))
+        if self.dia_pool:
+            entries.append(DiaPoolEntry(value=self.dia_pool))
+        if self.dia_interface:
+            entries.append(DiaInterfaceEntry(value=self.dia_interface))
+        if self.fallback:
+            entries.append(FallBackEntry(value="true"))
+        if self.vpn is not None:
+            entries.append(UseVPNEntry(value=str(self.vpn)))
+        return entries
+
+
 class NATVPNEntry(RootModel):
-    root: List[Union[UseVPNEntry, FallBackEntry]]
+    root: List[NATVPNEntries]
 
     @staticmethod
-    def from_nat_vpn(fallback: bool, vpn: int = 0) -> "NATVPNEntry":
-        if fallback:
-            return NATVPNEntry(root=[UseVPNEntry(value=str(vpn)), FallBackEntry()])
-        return NATVPNEntry(root=[UseVPNEntry(value=str(vpn))])
+    def from_params(params: NATVPNParams) -> "NATVPNEntry":
+        return NATVPNEntry(root=params.as_entry_list())
+
+    def get_params(self) -> NATVPNParams:
+        params = NATVPNParams()
+        for param in self.root:
+            if param.field == "bypass":
+                params.bypass = param.as_bool
+            elif param.field == "diaInterface":
+                params.dia_interface = param.value
+            elif param.field == "diaPool":
+                params.dia_pool = param.value
+            elif param.field == "fallback":
+                params.fallback = param.as_bool
+            elif param.field == "useVpn":
+                params.vpn = int(param.value)
+        return params
+
+
+class ICMPMessageEntry(BaseModel):
+    field: Literal["icmpMessage"] = "icmpMessage"
+    value: List[IcmpMsgType]
+
+    _value = field_validator("value", mode="before")(str_as_str_list)
 
 
 class SourceDataPrefixListEntry(BaseModel):
     field: Literal["sourceDataPrefixList"] = "sourceDataPrefixList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList = Field(
+        description="usually single id but zone based firewall can use multiple ids separated by space"
+    )
 
 
 class SourceDataIPv6PrefixListEntry(BaseModel):
     field: Literal["sourceDataIpv6PrefixList"] = "sourceDataIpv6PrefixList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList = Field(
+        description="usually single id but zone based firewall can use multiple ids separated by space"
+    )
 
 
 class DestinationDataPrefixListEntry(BaseModel):
     field: Literal["destinationDataPrefixList"] = "destinationDataPrefixList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList = Field(
+        description="usually single id but zone based firewall can use multiple ids separated by space"
+    )
 
 
 class DestinationDataIPv6PrefixListEntry(BaseModel):
     field: Literal["destinationDataIpv6PrefixList"] = "destinationDataIpv6PrefixList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList = Field(
+        description="usually single id but zone based firewall can use multiple ids separated by space"
+    )
 
 
 class DNSAppListEntry(BaseModel):
@@ -514,9 +789,19 @@ class DNSAppListEntry(BaseModel):
 
 class AppListEntry(BaseModel):
     field: Literal["appList"] = "appList"
+    ref: SpaceSeparatedUUIDList
+
+
+class SaaSAppListEntry(BaseModel):
+    field: Literal["saasAppList"] = "saasAppList"
     ref: UUID
 
 
+class AppListFlatEntry(BaseModel):
+    field: Literal["appListFlat"] = "appListFlat"
+    ref: SpaceSeparatedUUIDList
+
+
 class SourceFQDNListEntry(BaseModel):
     field: Literal["sourceFqdnList"] = "sourceFqdnList"
     ref: UUID
@@ -524,41 +809,59 @@ class SourceFQDNListEntry(BaseModel):
 
 class DestinationFQDNListEntry(BaseModel):
     field: Literal["destinationFqdnList"] = "destinationFqdnList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList
 
 
 class SourceGeoLocationListEntry(BaseModel):
     field: Literal["sourceGeoLocationList"] = "sourceGeoLocationList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList
 
 
 class DestinationGeoLocationListEntry(BaseModel):
     field: Literal["destinationGeoLocationList"] = "destinationGeoLocationList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList
 
 
 class ProtocolNameListEntry(BaseModel):
     field: Literal["protocolNameList"] = "protocolNameList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList
 
 
 class SourcePortListEntry(BaseModel):
     field: Literal["sourcePortList"] = "sourcePortList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList
+
+
+class SourceScalableGroupTagListEntry(BaseModel):
+    field: Literal["sourceScalableGroupTagList"] = "sourceScalableGroupTagList"
+    ref: SpaceSeparatedUUIDList
+
+
+class SourceSecurityGroupEntry(BaseModel):
+    field: Literal["sourceSecurityGroup"] = "sourceSecurityGroup"
+    ref: SpaceSeparatedUUIDList
 
 
 class DestinationPortListEntry(BaseModel):
     field: Literal["destinationPortList"] = "destinationPortList"
-    ref: UUID
+    ref: SpaceSeparatedUUIDList = Field(
+        description="usually single id but zone based firewall can use multiple ids separated by space"
+    )
+
+
+class DestinationScalableGroupTagListEntry(BaseModel):
+    field: Literal["destinationScalableGroupTagList"] = "destinationScalableGroupTagList"
+    ref: SpaceSeparatedUUIDList
+
+
+class DestinationSecurityGroupEntry(BaseModel):
+    field: Literal["destinationSecurityGroup"] = "destinationSecurityGroup"
+    ref: SpaceSeparatedUUIDList
 
 
 class RuleSetListEntry(BaseModel):
     field: Literal["ruleSetList"] = "ruleSetList"
-    ref: str
-
-    @staticmethod
-    def from_rule_set_ids(rule_set_ids: Set[UUID]) -> "RuleSetListEntry":
-        return RuleSetListEntry(ref=" ".join(str(rule_set_ids)))
+    ref: SpaceSeparatedUUIDList
 
 
 class PolicerListEntry(BaseModel):
@@ -571,6 +874,16 @@ class TLOCListEntry(BaseModel):
     ref: UUID
 
 
+class SourceVpnEntry(BaseModel):
+    field: Literal["sourceVpn"] = "sourceVpn"
+    value: str = Field(description="VPN ids numbers separated by space")
+
+
+class DestinationVpnEntry(BaseModel):
+    field: Literal["destinationVpn"] = "destinationVpn"
+    value: str = Field(description="VPN ids numbers separated by space")
+
+
 class PrefferedColorGroupListEntry(BaseModel):
     field: Literal["preferredColorGroup"] = "preferredColorGroup"
     ref: UUID
@@ -608,6 +921,11 @@ class PrefixListEntry(BaseModel):
     ref: UUID
 
 
+class Ipv6PrefixListEntry(BaseModel):
+    field: Literal["ipv6prefixList"] = "ipv6prefixList"
+    ref: UUID
+
+
 class RegionListEntry(BaseModel):
     field: Literal["regionList"] = "regionList"
     ref: UUID
@@ -621,15 +939,17 @@ class ClassMapListEntry(BaseModel):
 class ServiceEntryValue(BaseModel):
     model_config = ConfigDict(populate_by_name=True)
     type: ServiceType
-    vpn: str
+    vpn: Optional[IntStr] = None
     tloc: Optional[TLOCEntryValue] = None
     tloc_list: Optional[TLOCListEntry] = Field(
         default=None, validation_alias="tlocList", serialization_alias="tlocList"
     )
+    restrict: Optional[str] = None
+    local: Optional[str] = None
 
     @model_validator(mode="after")
     def tloc_xor_tloc_list(self):
-        check_fields_exclusive(self.__dict__, {"tloc", "tloc_list"}, True)
+        check_fields_exclusive(self.__dict__, {"tloc", "tloc_list"}, False)
         return self
 
 
@@ -651,6 +971,16 @@ class AffinityEntry(BaseModel):
 RedirectDNSActionEntry = Union[IPAddressEntry, DNSTypeEntry]
 
 
+class ServiceAreaEntry(BaseModel):
+    field: Literal["serviceArea"] = "serviceArea"
+    value: SpaceSeparatedServiceAreaList
+
+
+class TrafficCategoryEntry(BaseModel):
+    field: Literal["trafficCategory"] = "trafficCategory"
+    value: TrafficCategory
+
+
 class LogAction(BaseModel):
     type: Literal["log"] = "log"
     parameter: str = ""
@@ -670,8 +1000,34 @@ class NATAction(BaseModel):
         return NATAction(parameter=NATPoolEntry(value=str(nat_pool)))
 
     @staticmethod
-    def from_nat_vpn(fallback: bool, vpn: int = 0) -> "NATAction":
-        return NATAction(parameter=NATVPNEntry.from_nat_vpn(fallback=fallback, vpn=vpn))
+    def from_nat_vpn(
+        use_vpn: int = 0,
+        *,
+        fallback: bool = False,
+        bypass: bool = False,
+        dia_pool: List[int] = [],
+        dia_interface: List[str] = [],
+    ) -> "NATAction":
+        params = NATVPNParams(
+            bypass=bypass,
+            dia_pool=dia_pool,
+            dia_interface=dia_interface,
+            fallback=fallback,
+            vpn=use_vpn,
+        )
+        return NATAction(parameter=NATVPNEntry.from_params(params))
+
+    @property
+    def nat_pool(self) -> Optional[int]:
+        if isinstance(self.parameter, NATPoolEntry):
+            return int(self.parameter.value)
+        return None
+
+    @property
+    def nat_vpn(self) -> Optional[NATVPNParams]:
+        if isinstance(self.parameter, NATVPNEntry):
+            return self.parameter.get_params()
+        return None
 
 
 class CFlowDAction(BaseModel):
@@ -690,6 +1046,16 @@ class RedirectDNSAction(BaseModel):
     def from_dns_type(dns_type: DNSTypeEntryType = "host") -> "RedirectDNSAction":
         return RedirectDNSAction(parameter=DNSTypeEntry(value=dns_type))
 
+    def get_ip(self) -> Optional[IPv4Address]:
+        if self.parameter.field == "ipAddress":
+            return self.parameter.value
+        return None
+
+    def get_dns_type(self) -> Optional[DNSTypeEntryType]:
+        if self.parameter.field == "dnsType":
+            return self.parameter.value
+        return None
+
 
 class TCPOptimizationAction(BaseModel):
     type: Literal["tcpOptimization"] = "tcpOptimization"
@@ -752,17 +1118,121 @@ class PolicerAction(BaseModel):
     parameter: Reference
 
 
+class ConnectionEventsAction(BaseModel):
+    type: Literal["connectionEvents"] = "connectionEvents"
+    parameter: str = ""
+
+
+class AdvancedInspectionProfileAction(BaseModel):
+    type: Literal["advancedInspectionProfile"] = "advancedInspectionProfile"
+    parameter: ReferenceWithId
+
+
+class BackupSlaPrefferedColorAction(BaseModel):
+    type: Literal["backupSlaPreferredColor"] = "backupSlaPreferredColor"
+    parameter: SpaceSeparatedTLOCColorStr
+
+
+class SlaName(BaseModel):
+    field: Literal["name"] = "name"
+    ref: UUID
+
+
+class SlaPreferredColor(BaseModel):
+    field: Literal["preferredColor"] = "preferredColor"
+    value: SpaceSeparatedTLOCColorStr
+
+
+class SlaPreferredRemoteColor(BaseModel):
+    field: Literal["preferredRemoteColor"] = "preferredRemoteColor"
+    value: TLOCColor
+    remote_color_restrict: Optional[bool] = Field(
+        default=None, serialization_alias="remoteColorRestrict", validation_alias="remoteColorRestrict"
+    )
+
+
+class SlaPreferredColorGroup(BaseModel):
+    field: Literal["preferredColorGroup"] = "preferredColorGroup"
+    ref: UUID
+
+
+class SlaNotMet(BaseModel):
+    field: SlaNotMetAction
+
+
+SlaClassActionParam = Annotated[
+    Union[
+        SlaName,
+        SlaPreferredColor,
+        SlaPreferredColorGroup,
+        SlaPreferredRemoteColor,
+        SlaNotMet,
+    ],
+    Field(discriminator="field"),
+]
+
+
+class SlaClassAction(BaseModel):
+    type: Literal["slaClass"] = "slaClass"
+    parameter: List[SlaClassActionParam] = Field(default_factory=list)
+
+    @overload
+    @staticmethod
+    def from_params(
+        sla_class: UUID, not_met_action: Optional[SlaNotMetAction] = None, *, preferred_color: List[TLOCColor]
+    ) -> "SlaClassAction": ...
+
+    @overload
+    @staticmethod
+    def from_params(
+        sla_class: UUID, not_met_action: Optional[SlaNotMetAction] = None, *, preferred_color_group: UUID
+    ) -> "SlaClassAction": ...
+
+    @staticmethod
+    def from_params(
+        sla_class: UUID,
+        not_met_action: Optional[SlaNotMetAction] = None,
+        *,
+        preferred_color: Optional[List[TLOCColor]] = None,
+        preferred_color_group: Optional[UUID] = None,
+    ) -> "SlaClassAction":
+        action = SlaClassAction()
+        action.parameter.append(SlaName(ref=sla_class))
+        if not_met_action:
+            action.parameter.append(SlaNotMet(field=not_met_action))
+        if preferred_color:
+            action.parameter.append(SlaPreferredColor(value=preferred_color))
+        if preferred_color_group:
+            action.parameter.append(SlaPreferredColorGroup(ref=preferred_color_group))
+        return action
+
+
+class CloudSaaSAction(BaseModel):
+    type: Literal["cloudSaas"] = "cloudSaas"
+    parameter: str = Field(default="")
+
+
 ActionSetEntry = Annotated[
     Union[
         AffinityEntry,
+        AggregatorActionEntry,
+        AsPathActionEntry,
+        AtomicAggregateActionEntry,
         CommunityAdditiveEntry,
         CommunityEntry,
         DSCPEntry,
         ForwardingClassEntry,
+        LocalPreferenceEntry,
         LocalTLOCListEntry,
-        NextHopEntry,
+        MetricEntry,
+        MetricTypeEntry,
+        NextHopActionEntry,
+        NextHopIpv6ActionEntry,
         NextHopLooseEntry,
         OMPTagEntry,
+        OriginatorEntry,
+        OriginEntry,
+        OspfTagEntry,
         PolicerListEntry,
         PreferenceEntry,
         PrefferedColorGroupListEntry,
@@ -773,6 +1243,7 @@ ActionSetEntry = Annotated[
         TLOCListEntry,
         TrafficClassEntry,
         VPNEntry,
+        WeightEntry,
     ],
     Field(discriminator="field"),
 ]
@@ -780,16 +1251,21 @@ ActionSetEntry = Annotated[
 
 class ActionSet(BaseModel):
     type: Literal["set"] = "set"
-    parameter: List[ActionSetEntry] = []
+    parameter: List[ActionSetEntry] = Field(default_factory=list)
 
 
 ActionEntry = Annotated[
     Union[
         ActionSet,
+        AdvancedInspectionProfileAction,
+        BackupSlaPrefferedColorAction,
         CFlowDAction,
         ClassMapAction,
+        CloudSaaSAction,
+        ConnectionEventsAction,
         CountAction,
         DREOptimizationAction,
+        ExportToAction,
         FallBackToRoutingAction,
         LogAction,
         LossProtectionAction,
@@ -801,15 +1277,19 @@ ActionEntry = Annotated[
         RedirectDNSAction,
         SecureInternetGatewayAction,
         ServiceNodeGroupAction,
+        SlaClassAction,
         TCPOptimizationAction,
-        ExportToAction,
     ],
     Field(discriminator="type"),
 ]
 
 MatchEntry = Annotated[
     Union[
+        AddressEntry,
+        AdvancedCommunityEntry,
         AppListEntry,
+        AppListFlatEntry,
+        AsPathListMatchEntry,
         CarrierEntry,
         ClassMapListEntry,
         ColorListEntry,
@@ -825,18 +1305,31 @@ MatchEntry = Annotated[
         DestinationPortEntry,
         DestinationPortListEntry,
         DestinationRegionEntry,
+        DestinationScalableGroupTagListEntry,
+        DestinationSecurityGroupEntry,
+        DestinationVpnEntry,
         DNSAppListEntry,
         DNSEntry,
         DomainIDEntry,
         DSCPEntry,
+        ExpandedCommunityInLineEntry,
+        ExpandedCommunityListEntry,
         ExpandedCommunityListEntry,
+        ExtendedCommunityEntry,
         GroupIDEntry,
+        ICMPMessageEntry,
+        Ipv6PrefixListEntry,
+        LocalPreferenceEntry,
+        MetricEntry,
         NextHeaderEntry,
+        NextHopMatchEntry,
         OMPTagEntry,
         OriginatorEntry,
         OriginEntry,
+        OspfTagEntry,
         PacketLengthEntry,
         PathTypeEntry,
+        PeerEntry,
         PLPEntry,
         PreferenceEntry,
         PrefixListEntry,
@@ -847,6 +1340,8 @@ MatchEntry = Annotated[
         RegionListEntry,
         RoleEntry,
         RuleSetListEntry,
+        SaaSAppListEntry,
+        ServiceAreaEntry,
         SiteEntry,
         SiteListEntry,
         SiteListEntry,
@@ -860,11 +1355,16 @@ MatchEntry = Annotated[
         SourceIPv6Entry,
         SourcePortEntry,
         SourcePortListEntry,
+        SourceScalableGroupTagListEntry,
+        SourceSecurityGroupEntry,
+        SourceVpnEntry,
         TCPEntry,
         TLOCEntry,
         TLOCListEntry,
+        TrafficCategoryEntry,
         TrafficClassEntry,
         TrafficToEntry,
+        VPNEntry,
         VPNListEntry,
     ],
     Field(discriminator="field"),
@@ -888,8 +1388,8 @@ MUTUALLY_EXCLUSIVE_FIELDS = [
 def _generate_field_name_check_lookup(spec: Sequence[Set[str]]) -> Dict[str, List[str]]:
     lookup: Dict[str, List[str]] = {}
     for exclusive_set in spec:
-        for field in exclusive_set:
-            lookup[field] = list(exclusive_set - {field})
+        for fieldname in exclusive_set:
+            lookup[fieldname] = list(exclusive_set - {fieldname})
     return lookup
 
 
@@ -906,15 +1406,17 @@ class Action(BaseModel):
 
 class PolicyDefinitionSequenceBase(BaseModel):
     sequence_id: int = Field(default=0, serialization_alias="sequenceId", validation_alias="sequenceId")
-    sequence_name: str = Field(serialization_alias="sequenceName", validation_alias="sequenceName")
-    base_action: PolicyActionType = Field(
-        default="drop", serialization_alias="baseAction", validation_alias="baseAction"
+    sequence_name: Optional[str] = Field(
+        default=None, serialization_alias="sequenceName", validation_alias="sequenceName"
     )
+    base_action: Optional[str] = Field(default=None, serialization_alias="baseAction", validation_alias="baseAction")
     sequence_type: SequenceType = Field(serialization_alias="sequenceType", validation_alias="sequenceType")
-    sequence_ip_type: SequenceIpType = Field(serialization_alias="sequenceIpType", validation_alias="sequenceIpType")
+    sequence_ip_type: Optional[SequenceIpType] = Field(
+        default="ipv4", serialization_alias="sequenceIpType", validation_alias="sequenceIpType"
+    )
     ruleset: Optional[bool] = None
     match: Match
-    actions: Sequence[ActionEntry]
+    actions: Optional[Sequence[ActionEntry]] = None
 
     @staticmethod
     def _check_field_collision(field: str, fields: Sequence[str]) -> None:
@@ -1006,8 +1508,16 @@ def accept_action(method):
     return wrapper
 
 
-class DefaultAction(BaseModel):
-    type: PolicyActionType
+class PolicyActionBase(BaseModel):
+    type: str
+
+
+class PolicyAcceptRejectAction(PolicyActionBase):
+    type: AcceptRejectActionType
+
+
+class PolicyAcceptDropAction(PolicyActionBase):
+    type: AcceptDropActionType
 
 
 class InfoTag(BaseModel):
@@ -1015,6 +1525,7 @@ class InfoTag(BaseModel):
 
 
 class PolicyDefinitionId(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
     definition_id: UUID = Field(serialization_alias="definitionId", validation_alias="definitionId")
 
 
@@ -1024,8 +1535,8 @@ class PolicyReference(BaseModel):
 
 
 class DefinitionWithSequencesCommonBase(BaseModel):
-    default_action: Optional[DefaultAction] = Field(
-        default=DefaultAction(type="drop"),
+    default_action: Optional[PolicyActionBase] = Field(
+        default=None,
         serialization_alias="defaultAction",
         validation_alias="defaultAction",
     )
@@ -1079,8 +1590,9 @@ class DefinitionWithSequencesCommonBase(BaseModel):
 
 class PolicyDefinitionBase(BaseModel):
     name: str = Field(
-        pattern="^[a-zA-Z0-9_-]{1,128}$",
-        description="Can include only alpha-numeric characters, hyphen '-' or underscore '_'; maximum 128 characters",
+        pattern="^[a-zA-Z0-9._-]{1,128}$",
+        description="Can include only alpha-numeric characters, "
+        "dot '.' or hyphen '-' or underscore '_'; maximum 128 characters",
     )
     description: str = "default description"
     type: str
@@ -1103,21 +1615,9 @@ class PolicyDefinitionGetResponse(PolicyDefinitionInfo):
 
 class PolicyDefinitionEditResponse(BaseModel):
     master_templates_affected: List[str] = Field(
-        default=[], serialization_alias="masterTemplatesAffected", validation_alias="masterTemplatesAffected"
+        default_factory=list, serialization_alias="masterTemplatesAffected", validation_alias="masterTemplatesAffected"
     )
 
 
 class PolicyDefinitionPreview(BaseModel):
     preview: str
-
-
-class PolicyDefinitionEndpoints(Protocol):
-    def create_policy_definition(self, payload: BaseModel) -> PolicyDefinitionId: ...
-
-    def delete_policy_definition(self, id: UUID) -> None: ...
-
-    def edit_policy_definition(self, id: UUID, payload: BaseModel) -> PolicyDefinitionEditResponse: ...
-
-    def get_definitions(self) -> DataSequence[PolicyDefinitionInfo]: ...
-
-    def get_policy_definition(self, id: UUID) -> PolicyDefinitionGetResponse: ...