From 8fec254b2d17d5aec30589f0b3c5444ad1dfd1f5 Mon Sep 17 00:00:00 2001
From: Ruben Herold <ruben@puettmann.net>
Date: Fri, 11 Sep 2026 16:28:09 +0200
Subject: Merge pull request #5372 from ruben-herold/T9157-fib-type-match

firewall: T9157: add fib-type match for destination/source
---
 .../include/firewall/common-rule-ipv4-raw.xml.i    |  1 +
 .../include/firewall/common-rule-ipv4.xml.i        |  1 +
 .../include/firewall/common-rule-ipv6-raw.xml.i    |  1 +
 .../include/firewall/common-rule-ipv6.xml.i        |  1 +
 interface-definitions/include/firewall/fib.xml.i   | 79 ++++++++++++++++++++++
 5 files changed, 83 insertions(+)
 create mode 100644 interface-definitions/include/firewall/fib.xml.i

(limited to 'interface-definitions/include/firewall')

diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
index 719214d3c..7c7c55f9b 100644
--- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
@@ -3,6 +3,7 @@
 #include <include/firewall/action-and-notrack.xml.i>
 #include <include/generic-description.xml.i>
 #include <include/firewall/dscp.xml.i>
+#include <include/firewall/fib.xml.i>
 #include <include/firewall/fragment.xml.i>
 #include <include/generic-disable-node.xml.i>
 #include <include/firewall/icmp.xml.i>
diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i
index 7a6feb9ed..28035e8d5 100644
--- a/interface-definitions/include/firewall/common-rule-ipv4.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i
@@ -1,6 +1,7 @@
 <!-- include start from firewall/common-rule-ipv4.xml.i -->
 #include <include/firewall/add-addr-to-group-ipv4.xml.i>
 #include <include/firewall/common-rule-inet.xml.i>
+#include <include/firewall/fib.xml.i>
 #include <include/firewall/icmp.xml.i>
 #include <include/firewall/last-used.xml.i>
 #include <include/firewall/ttl.xml.i>
diff --git a/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i
index 0db67a12f..0d29369d6 100644
--- a/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i
@@ -3,6 +3,7 @@
 #include <include/firewall/action-and-notrack.xml.i>
 #include <include/generic-description.xml.i>
 #include <include/firewall/dscp.xml.i>
+#include <include/firewall/fib.xml.i>
 #include <include/firewall/fragment.xml.i>
 #include <include/generic-disable-node.xml.i>
 #include <include/firewall/icmpv6.xml.i>
diff --git a/interface-definitions/include/firewall/common-rule-ipv6.xml.i b/interface-definitions/include/firewall/common-rule-ipv6.xml.i
index 917066a16..5613c9403 100644
--- a/interface-definitions/include/firewall/common-rule-ipv6.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv6.xml.i
@@ -1,6 +1,7 @@
 <!-- include start from firewall/common-rule-ipv6.xml.i -->
 #include <include/firewall/add-addr-to-group-ipv6.xml.i>
 #include <include/firewall/common-rule-inet.xml.i>
+#include <include/firewall/fib.xml.i>
 #include <include/firewall/hop-limit.xml.i>
 #include <include/firewall/icmpv6.xml.i>
 #include <include/firewall/last-used.xml.i>
diff --git a/interface-definitions/include/firewall/fib.xml.i b/interface-definitions/include/firewall/fib.xml.i
new file mode 100644
index 000000000..56826e3f9
--- /dev/null
+++ b/interface-definitions/include/firewall/fib.xml.i
@@ -0,0 +1,79 @@
+<!-- include start from firewall/fib.xml.i -->
+<node name="fib">
+  <properties>
+    <help>Match based on the result of a Forwarding Information Base (FIB) lookup</help>
+  </properties>
+  <children>
+    <leafNode name="lookup">
+      <properties>
+        <help>Key to use for the FIB lookup</help>
+        <completionHelp>
+          <list>source-address destination-address</list>
+        </completionHelp>
+        <valueHelp>
+          <format>source-address</format>
+          <description>Look up a route to the packet's source address (reverse path)</description>
+        </valueHelp>
+        <valueHelp>
+          <format>destination-address</format>
+          <description>Look up a route to the packet's destination address</description>
+        </valueHelp>
+        <constraint>
+          <regex>(source-address|destination-address)</regex>
+        </constraint>
+        <multi/>
+      </properties>
+    </leafNode>
+    <node name="match">
+      <properties>
+        <help>FIB lookup result to match against</help>
+      </properties>
+      <children>
+        <leafNode name="route-type">
+          <properties>
+            <help>Match based on the address type returned by the FIB lookup</help>
+            <completionHelp>
+              <list>local unicast broadcast multicast anycast blackhole unreachable prohibit</list>
+            </completionHelp>
+            <valueHelp>
+              <format>local</format>
+              <description>Address is local to this router</description>
+            </valueHelp>
+            <valueHelp>
+              <format>unicast</format>
+              <description>Address is a unicast address</description>
+            </valueHelp>
+            <valueHelp>
+              <format>broadcast</format>
+              <description>Address is a broadcast address</description>
+            </valueHelp>
+            <valueHelp>
+              <format>multicast</format>
+              <description>Address is a multicast address</description>
+            </valueHelp>
+            <valueHelp>
+              <format>anycast</format>
+              <description>Address is an anycast address</description>
+            </valueHelp>
+            <valueHelp>
+              <format>blackhole</format>
+              <description>Address is blackholed</description>
+            </valueHelp>
+            <valueHelp>
+              <format>unreachable</format>
+              <description>Address is unreachable</description>
+            </valueHelp>
+            <valueHelp>
+              <format>prohibit</format>
+              <description>Address is administratively prohibited</description>
+            </valueHelp>
+            <constraint>
+              <regex>(!?(local|unicast|broadcast|multicast|anycast|blackhole|unreachable|prohibit))</regex>
+            </constraint>
+          </properties>
+        </leafNode>
+      </children>
+    </node>
+  </children>
+</node>
+<!-- include end -->
-- 
cgit v1.2.3