From 3641d61b317a6c6ef99bb2fa1a1fa348e48f934e Mon Sep 17 00:00:00 2001
From: l0crian1 <ryan.claridge13@gmail.com>
Date: Sun, 23 Aug 2026 21:03:29 -0400
Subject: firewall: T9242: Add mac-address-mask support

 - Add mac-address-mask support to firewall rules
 - Add smoketest for mac-address-mask
---
 .../include/firewall/common-rule-bridge.xml.i              |  2 ++
 .../include/firewall/common-rule-ipv4-raw.xml.i            |  2 ++
 .../include/firewall/common-rule-ipv4.xml.i                |  2 ++
 .../include/firewall/common-rule-ipv6-raw.xml.i            |  2 ++
 .../include/firewall/common-rule-ipv6.xml.i                |  2 ++
 .../include/firewall/mac-address-mask.xml.i                | 14 ++++++++++++++
 6 files changed, 24 insertions(+)
 create mode 100644 interface-definitions/include/firewall/mac-address-mask.xml.i

(limited to 'interface-definitions/include')

diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i
index f639001a1..8200f3004 100644
--- a/interface-definitions/include/firewall/common-rule-bridge.xml.i
+++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i
@@ -27,6 +27,7 @@
   </properties>
   <children>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/address-inet.xml.i>
     #include <include/firewall/address-mask-inet.xml.i>
     #include <include/firewall/port.xml.i>
@@ -47,6 +48,7 @@
   </properties>
   <children>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/address-inet.xml.i>
     #include <include/firewall/address-mask-inet.xml.i>
     #include <include/firewall/port.xml.i>
diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
index 27057637b..719214d3c 100644
--- a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i
@@ -27,6 +27,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv4.xml.i>
     <node name="group">
@@ -46,6 +47,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv4.xml.i>
     <node name="group">
diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i
index 07d2cfff8..7a6feb9ed 100644
--- a/interface-definitions/include/firewall/common-rule-ipv4.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i
@@ -14,6 +14,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv4.xml.i>
     <node name="group">
@@ -43,6 +44,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv4.xml.i>
     <node name="group">
diff --git a/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i
index 1c1686a00..0db67a12f 100644
--- a/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i
@@ -27,6 +27,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv6.xml.i>
     #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i>
@@ -42,6 +43,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv6.xml.i>
     #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i>
diff --git a/interface-definitions/include/firewall/common-rule-ipv6.xml.i b/interface-definitions/include/firewall/common-rule-ipv6.xml.i
index 657868c7a..917066a16 100644
--- a/interface-definitions/include/firewall/common-rule-ipv6.xml.i
+++ b/interface-definitions/include/firewall/common-rule-ipv6.xml.i
@@ -14,6 +14,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv6.xml.i>
     #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i>
@@ -38,6 +39,7 @@
     #include <include/firewall/fqdn.xml.i>
     #include <include/firewall/geoip.xml.i>
     #include <include/firewall/mac-address.xml.i>
+    #include <include/firewall/mac-address-mask.xml.i>
     #include <include/firewall/port.xml.i>
     #include <include/firewall/source-destination-group-ipv6.xml.i>
     #include <include/firewall/source-destination-dynamic-group-ipv6.xml.i>
diff --git a/interface-definitions/include/firewall/mac-address-mask.xml.i b/interface-definitions/include/firewall/mac-address-mask.xml.i
new file mode 100644
index 000000000..5bdf03ae2
--- /dev/null
+++ b/interface-definitions/include/firewall/mac-address-mask.xml.i
@@ -0,0 +1,14 @@
+<!-- include start from firewall/mac-address-mask.xml.i -->
+<leafNode name="mac-address-mask">
+  <properties>
+    <help>MAC address mask</help>
+    <valueHelp>
+      <format>macaddr</format>
+      <description>MAC mask to apply</description>
+    </valueHelp>
+    <constraint>
+      <validator name="mac-address"/>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
-- 
cgit v1.2.3