From ad7e36be54c00ca1a7adc1b58d72e778931436e7 Mon Sep 17 00:00:00 2001
From: l0crian1 <ryan.claridge13@gmail.com>
Date: Sat, 1 Aug 2026 12:08:15 -0400
Subject: T8221: Add last-used option to firewall rules

 - Add last-used option to firewall rules
 - Updated output of show firewall to include last-used
 - Added smoketest for last-used option
---
 interface-definitions/include/firewall/bridge-custom-name.xml.i   | 1 +
 interface-definitions/include/firewall/bridge-hook-forward.xml.i  | 1 +
 interface-definitions/include/firewall/bridge-hook-input.xml.i    | 1 +
 interface-definitions/include/firewall/bridge-hook-output.xml.i   | 1 +
 .../include/firewall/bridge-hook-prerouting.xml.i                 | 1 +
 interface-definitions/include/firewall/ipv4-custom-name.xml.i     | 1 +
 interface-definitions/include/firewall/ipv4-hook-forward.xml.i    | 1 +
 interface-definitions/include/firewall/ipv4-hook-input.xml.i      | 1 +
 interface-definitions/include/firewall/ipv4-hook-output.xml.i     | 2 ++
 interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i | 3 ++-
 interface-definitions/include/firewall/ipv6-custom-name.xml.i     | 1 +
 interface-definitions/include/firewall/ipv6-hook-forward.xml.i    | 1 +
 interface-definitions/include/firewall/ipv6-hook-input.xml.i      | 1 +
 interface-definitions/include/firewall/ipv6-hook-output.xml.i     | 2 ++
 interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i | 3 ++-
 interface-definitions/include/firewall/last-used.xml.i            | 8 ++++++++
 16 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 interface-definitions/include/firewall/last-used.xml.i

(limited to 'interface-definitions/include')

diff --git a/interface-definitions/include/firewall/bridge-custom-name.xml.i b/interface-definitions/include/firewall/bridge-custom-name.xml.i
index 9a2a829d0..d03266d7e 100644
--- a/interface-definitions/include/firewall/bridge-custom-name.xml.i
+++ b/interface-definitions/include/firewall/bridge-custom-name.xml.i
@@ -35,6 +35,7 @@
         #include <include/firewall/action-l2.xml.i>
         #include <include/firewall/connection-mark.xml.i>
         #include <include/firewall/connection-status.xml.i>
+        #include <include/firewall/last-used.xml.i>
         #include <include/firewall/state.xml.i>
         #include <include/firewall/inbound-interface.xml.i>
         #include <include/firewall/outbound-interface.xml.i>
diff --git a/interface-definitions/include/firewall/bridge-hook-forward.xml.i b/interface-definitions/include/firewall/bridge-hook-forward.xml.i
index 03ac26cf6..80e58ae54 100644
--- a/interface-definitions/include/firewall/bridge-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/bridge-hook-forward.xml.i
@@ -29,6 +29,7 @@
             #include <include/firewall/action-l2.xml.i>
             #include <include/firewall/connection-mark.xml.i>
             #include <include/firewall/connection-status.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/state.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
diff --git a/interface-definitions/include/firewall/bridge-hook-input.xml.i b/interface-definitions/include/firewall/bridge-hook-input.xml.i
index f6a11f8da..a4fe3c418 100644
--- a/interface-definitions/include/firewall/bridge-hook-input.xml.i
+++ b/interface-definitions/include/firewall/bridge-hook-input.xml.i
@@ -29,6 +29,7 @@
             #include <include/firewall/action-l2.xml.i>
             #include <include/firewall/connection-mark.xml.i>
             #include <include/firewall/connection-status.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/state.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
           </children>
diff --git a/interface-definitions/include/firewall/bridge-hook-output.xml.i b/interface-definitions/include/firewall/bridge-hook-output.xml.i
index 853315989..df44a94d8 100644
--- a/interface-definitions/include/firewall/bridge-hook-output.xml.i
+++ b/interface-definitions/include/firewall/bridge-hook-output.xml.i
@@ -29,6 +29,7 @@
             #include <include/firewall/action-l2.xml.i>
             #include <include/firewall/connection-mark.xml.i>
             #include <include/firewall/connection-status.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/state.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
diff --git a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i
index 7a45f5cd1..e2998e359 100644
--- a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i
+++ b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i
@@ -28,6 +28,7 @@
             #include <include/firewall/common-rule-bridge.xml.i>
             #include <include/firewall/action-and-notrack.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
             #include <include/firewall/set-packet-modifications-mark.xml.i>
             #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
diff --git a/interface-definitions/include/firewall/ipv4-custom-name.xml.i b/interface-definitions/include/firewall/ipv4-custom-name.xml.i
index b08262e2d..170dd147c 100644
--- a/interface-definitions/include/firewall/ipv4-custom-name.xml.i
+++ b/interface-definitions/include/firewall/ipv4-custom-name.xml.i
@@ -33,6 +33,7 @@
       <children>
         #include <include/firewall/common-rule-ipv4.xml.i>
         #include <include/firewall/inbound-interface.xml.i>
+        #include <include/firewall/last-used.xml.i>
         #include <include/firewall/match-ipsec.xml.i>
         #include <include/firewall/offload-target.xml.i>
         #include <include/firewall/outbound-interface.xml.i>
diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
index 8f04d6739..8da16a0bd 100644
--- a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i
@@ -29,6 +29,7 @@
             #include <include/firewall/action-forward.xml.i>
             #include <include/firewall/common-rule-ipv4.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec.xml.i>
             #include <include/firewall/offload-target.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
diff --git a/interface-definitions/include/firewall/ipv4-hook-input.xml.i b/interface-definitions/include/firewall/ipv4-hook-input.xml.i
index 64366eac0..1b85d47fa 100644
--- a/interface-definitions/include/firewall/ipv4-hook-input.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-input.xml.i
@@ -28,6 +28,7 @@
           <children>
             #include <include/firewall/common-rule-ipv4.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec-in.xml.i>
           </children>
         </tagNode>
diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i
index 14ea1073b..c79ca0b11 100644
--- a/interface-definitions/include/firewall/ipv4-hook-output.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i
@@ -27,6 +27,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-ipv4.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
@@ -60,6 +61,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-ipv4-raw.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
diff --git a/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i
index 6f9fe6842..2b23d7cfe 100644
--- a/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i
+++ b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i
@@ -35,6 +35,7 @@
             #include <include/firewall/common-rule-ipv4-raw.xml.i>
             #include <include/firewall/match-ipsec-in.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
             #include <include/firewall/set-packet-modifications-mark.xml.i>
             #include <include/firewall/set-packet-modifications-tcp-mss.xml.i>
@@ -53,4 +54,4 @@
     </node>
   </children>
 </node>
-<!-- include end -->
\ No newline at end of file
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/ipv6-custom-name.xml.i b/interface-definitions/include/firewall/ipv6-custom-name.xml.i
index d49267b52..9d11236fc 100644
--- a/interface-definitions/include/firewall/ipv6-custom-name.xml.i
+++ b/interface-definitions/include/firewall/ipv6-custom-name.xml.i
@@ -33,6 +33,7 @@
       <children>
         #include <include/firewall/common-rule-ipv6.xml.i>
         #include <include/firewall/inbound-interface.xml.i>
+        #include <include/firewall/last-used.xml.i>
         #include <include/firewall/match-ipsec.xml.i>
         #include <include/firewall/offload-target.xml.i>
         #include <include/firewall/outbound-interface.xml.i>
diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
index 0319c915a..fecdeee4b 100644
--- a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i
@@ -29,6 +29,7 @@
             #include <include/firewall/action-forward.xml.i>
             #include <include/firewall/common-rule-ipv6.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec.xml.i>
             #include <include/firewall/offload-target.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
diff --git a/interface-definitions/include/firewall/ipv6-hook-input.xml.i b/interface-definitions/include/firewall/ipv6-hook-input.xml.i
index ae78f8910..8edaa577f 100644
--- a/interface-definitions/include/firewall/ipv6-hook-input.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-input.xml.i
@@ -28,6 +28,7 @@
           <children>
             #include <include/firewall/common-rule-ipv6.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec-in.xml.i>
           </children>
         </tagNode>
diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i
index 96976b4a8..c990fc7b3 100644
--- a/interface-definitions/include/firewall/ipv6-hook-output.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i
@@ -27,6 +27,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-ipv6.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
@@ -60,6 +61,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-ipv6-raw.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec-out.xml.i>
             #include <include/firewall/outbound-interface.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
diff --git a/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i
index 15454bbbf..0c316523d 100644
--- a/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i
+++ b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i
@@ -33,6 +33,7 @@
           </properties>
           <children>
             #include <include/firewall/common-rule-ipv6-raw.xml.i>
+            #include <include/firewall/last-used.xml.i>
             #include <include/firewall/match-ipsec-in.xml.i>
             #include <include/firewall/inbound-interface.xml.i>
             #include <include/firewall/set-packet-modifications-dscp.xml.i>
@@ -53,4 +54,4 @@
     </node>
   </children>
 </node>
-<!-- include end -->
\ No newline at end of file
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/last-used.xml.i b/interface-definitions/include/firewall/last-used.xml.i
new file mode 100644
index 000000000..90f8c916f
--- /dev/null
+++ b/interface-definitions/include/firewall/last-used.xml.i
@@ -0,0 +1,8 @@
+<!-- include start from firewall/last-used.xml.i -->
+<leafNode name="last-used">
+  <properties>
+    <help>Track the last time this rule matched traffic</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- include end -->
-- 
cgit v1.2.3