diff options
Diffstat (limited to 'interface-definitions/include/firewall')
5 files changed, 83 insertions, 0 deletions
diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i index 719214d3c..7c7c55f9b 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i @@ -3,6 +3,7 @@ #include <include/firewall/action-and-notrack.xml.i> #include <include/generic-description.xml.i> #include <include/firewall/dscp.xml.i> +#include <include/firewall/fib.xml.i> #include <include/firewall/fragment.xml.i> #include <include/generic-disable-node.xml.i> #include <include/firewall/icmp.xml.i> diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i index 7a6feb9ed..28035e8d5 100644 --- a/interface-definitions/include/firewall/common-rule-ipv4.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i @@ -1,6 +1,7 @@ <!-- include start from firewall/common-rule-ipv4.xml.i --> #include <include/firewall/add-addr-to-group-ipv4.xml.i> #include <include/firewall/common-rule-inet.xml.i> +#include <include/firewall/fib.xml.i> #include <include/firewall/icmp.xml.i> #include <include/firewall/last-used.xml.i> #include <include/firewall/ttl.xml.i> diff --git a/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i index 0db67a12f..0d29369d6 100644 --- a/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i @@ -3,6 +3,7 @@ #include <include/firewall/action-and-notrack.xml.i> #include <include/generic-description.xml.i> #include <include/firewall/dscp.xml.i> +#include <include/firewall/fib.xml.i> #include <include/firewall/fragment.xml.i> #include <include/generic-disable-node.xml.i> #include <include/firewall/icmpv6.xml.i> diff --git a/interface-definitions/include/firewall/common-rule-ipv6.xml.i b/interface-definitions/include/firewall/common-rule-ipv6.xml.i index 917066a16..5613c9403 100644 --- a/interface-definitions/include/firewall/common-rule-ipv6.xml.i +++ b/interface-definitions/include/firewall/common-rule-ipv6.xml.i @@ -1,6 +1,7 @@ <!-- include start from firewall/common-rule-ipv6.xml.i --> #include <include/firewall/add-addr-to-group-ipv6.xml.i> #include <include/firewall/common-rule-inet.xml.i> +#include <include/firewall/fib.xml.i> #include <include/firewall/hop-limit.xml.i> #include <include/firewall/icmpv6.xml.i> #include <include/firewall/last-used.xml.i> diff --git a/interface-definitions/include/firewall/fib.xml.i b/interface-definitions/include/firewall/fib.xml.i new file mode 100644 index 000000000..56826e3f9 --- /dev/null +++ b/interface-definitions/include/firewall/fib.xml.i @@ -0,0 +1,79 @@ +<!-- include start from firewall/fib.xml.i --> +<node name="fib"> + <properties> + <help>Match based on the result of a Forwarding Information Base (FIB) lookup</help> + </properties> + <children> + <leafNode name="lookup"> + <properties> + <help>Key to use for the FIB lookup</help> + <completionHelp> + <list>source-address destination-address</list> + </completionHelp> + <valueHelp> + <format>source-address</format> + <description>Look up a route to the packet's source address (reverse path)</description> + </valueHelp> + <valueHelp> + <format>destination-address</format> + <description>Look up a route to the packet's destination address</description> + </valueHelp> + <constraint> + <regex>(source-address|destination-address)</regex> + </constraint> + <multi/> + </properties> + </leafNode> + <node name="match"> + <properties> + <help>FIB lookup result to match against</help> + </properties> + <children> + <leafNode name="route-type"> + <properties> + <help>Match based on the address type returned by the FIB lookup</help> + <completionHelp> + <list>local unicast broadcast multicast anycast blackhole unreachable prohibit</list> + </completionHelp> + <valueHelp> + <format>local</format> + <description>Address is local to this router</description> + </valueHelp> + <valueHelp> + <format>unicast</format> + <description>Address is a unicast address</description> + </valueHelp> + <valueHelp> + <format>broadcast</format> + <description>Address is a broadcast address</description> + </valueHelp> + <valueHelp> + <format>multicast</format> + <description>Address is a multicast address</description> + </valueHelp> + <valueHelp> + <format>anycast</format> + <description>Address is an anycast address</description> + </valueHelp> + <valueHelp> + <format>blackhole</format> + <description>Address is blackholed</description> + </valueHelp> + <valueHelp> + <format>unreachable</format> + <description>Address is unreachable</description> + </valueHelp> + <valueHelp> + <format>prohibit</format> + <description>Address is administratively prohibited</description> + </valueHelp> + <constraint> + <regex>(!?(local|unicast|broadcast|multicast|anycast|blackhole|unreachable|prohibit))</regex> + </constraint> + </properties> + </leafNode> + </children> + </node> + </children> +</node> +<!-- include end --> |