docs: T9157: document firewall fib-type match - #2186
Open
ruben-herold wants to merge 4 commits into
Open
Conversation
Companion doc entry for vyos/vyos-1x#5372, which adds "fib-type" as a source/destination match option (nftables' fib daddr/saddr type expression) for forward/input/output/name rule sets, ipv4 and ipv6.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
🚧 Files skipped from review as they are similar to previous changes (2)
📜 Recent review details⏰ Context from checks skipped due to timeout. (3)
🧰 Additional context used🔍 Remote MCP vyos.devRelevant review context
📝 WalkthroughSummary by CodeRabbit
WalkthroughIPv4 and IPv6 firewall documentation now defines FIB lookup and route-type matching syntax, supported classifications, negated matching, lookup pairing, and ChangesFIB-type firewall matching
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Claude finished @ruben-herold's task in 2m 7s —— View job Claude PR Review
IssuesNone (ERROR / WARNING). The documentation matches the companion vyos-1x PR #5372 accurately:
Needs Verification
Coordination notevyos-1x PR #5372 (the feature PR this documents) is currently OPEN / not merged — the Stats
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
docs/configuration/firewall/ipv4.md (1)
517-526: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse single backticks in both MyST pages.
The added prose uses double backticks for inline code.
docs/configuration/firewall/ipv4.md#L517-L526: Replace double-delimited inline terms with single backticks.docs/configuration/firewall/ipv6.md#L518-L527: Replace double-delimited inline terms with single backticks.As per coding guidelines, MyST pages prefer single backticks for inline code; double backticks are reserved for embedded RST contexts.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/configuration/firewall/ipv4.md` around lines 517 - 526, Replace the double-backtick inline markup with single backticks in the added prose at docs/configuration/firewall/ipv4.md lines 517-526 and docs/configuration/firewall/ipv6.md lines 518-527, covering the FIB, type values, and negation character terms without changing the wording.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/configuration/firewall/ipv4.md`:
- Around line 494-516: Update the command references in
docs/configuration/firewall/ipv4.md lines 494-516 and
docs/configuration/firewall/ipv6.md lines 495-516 to include the supported
prerouting raw source and destination fib-type forms, matching the existing
forward, input, output, and named-rule forms; do not remove the prerouting raw
examples because they are part of the documented use case.
---
Nitpick comments:
In `@docs/configuration/firewall/ipv4.md`:
- Around line 517-526: Replace the double-backtick inline markup with single
backticks in the added prose at docs/configuration/firewall/ipv4.md lines
517-526 and docs/configuration/firewall/ipv6.md lines 518-527, covering the FIB,
type values, and negation character terms without changing the wording.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 1638c304-fa87-4325-bc8e-cd932438deff
📒 Files selected for processing (2)
docs/configuration/firewall/ipv4.mddocs/configuration/firewall/ipv6.md
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
ansible/ansible(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: validate
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🧰 Additional context used
📓 Path-based instructions (2)
docs/**/*.md
📄 CodeRabbit inference engine (AGENTS.md)
docs/**/*.md: Canonical docs pages must be written as MyST Markdown (.md); edit existing pages in.mdonly and never use the oldmd-prefix for new pages.
Use{cfgcmd},{opcmd}, and{cmdincludemd}fenced directives in MyST pages for VyOS command coverage; do not replace them with plaintextorbashfences.
Use MyST ATX headings (#,##,###, etc.) in canonical pages; the RST heading hierarchy does not apply to.mdsources.
In MyST pages, prefer single backticks for inline code; double backticks are reserved for embedded RST contexts.
Use% stop_vyoslinterand% start_vyoslintercomment markers in top-level MyST content to suppress real IPs or other allowed long-line exceptions, and keep them paired.
In MyST pages, write TODO markers as{todo}fenced directives.
Files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
docs/{_include/*.txt,**/*.md}
📄 CodeRabbit inference engine (AGENTS.md)
Keep documentation lines within 80 characters unless the content is inside a code block or fenced/preformatted block.
Files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
🧠 Learnings (13)
📚 Learning: 2026-05-06T20:48:49.689Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:71-71
Timestamp: 2026-05-06T20:48:49.689Z
Learning: In vyos/vyos-documentation, the 80-character line-length rule documented under Source conventions / Formatting applies only to documentation source files located under docs/ (e.g., docs/**/*.rst and docs/**/*.md). The rule is enforced by the vyoslinter (doc-linter.py from vyos/.github) when reviewing changed files via lint-doc.yml, and only for files within docs/**. Do not suggest hard-wrapping CLAUDE.md (repo-root documentation) because GitHub renders and reflows content. For CLAUDE.md, reviews should not enforce the 80-char wrapping; apply the rule only to files matching **/docs/**/*.{rst,md}.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-06T20:48:57.970Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:91-93
Timestamp: 2026-05-06T20:48:57.970Z
Learning: The 80-character line limit applies only to documentation sources under docs/** (RST/MD). Do not enforce this limit on repo-root Markdown files like CLAUDE.md or README.md. The vyoslinter (doc-linter.py, run via lint-doc.yml from vyos/.github) lints only changed files within docs/**; root files are excluded. GitHub renders root Markdown with viewport-width reflow, so hard-wrapping these files reduces readability without tooling benefit.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-06T20:48:50.446Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:64-64
Timestamp: 2026-05-06T20:48:50.446Z
Learning: Enforce the 80-character line-length limit only for documentation source files under docs/ (docs/**/*.md and docs/**/*.rst rendered by Sphinx and linted by vyoslinter via lint-doc.yml). Do not flag line-length issues in repository-root Markdown files such as CLAUDE.md or README.md, which GitHub renders with viewport-width reflow. This applies to all files within docs/ that are part of the documentation source.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-06T20:48:54.578Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:80-84
Timestamp: 2026-05-06T20:48:54.578Z
Learning: Enforce the 80-character line-length limit only for documentation source files under docs/ (docs/**/*.rst and docs/**/*.md). Do not flag repo-root files like CLAUDE.md or README.md, since they are rendered by GitHub and not subject to this rule. The doc-linter (doc-linter.py via lint-doc.yml) only lints docs/**, so CI checks won't flag root files for line length.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-06T20:49:00.044Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:108-108
Timestamp: 2026-05-06T20:49:00.044Z
Learning: Limit the 80-character line length check and vyoslinter (doc-linter.py) enforcement to documentation source files under docs/**/*.{rst,md}. Do not apply or flag line-length issues in repo-root files like CLAUDE.md or README.md, which are rendered directly by GitHub and are not linted by lint-doc.yml. This pattern narrows checks to Sphinx source docs and prevents false positives in non-doc files.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-06T20:48:53.302Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:79-79
Timestamp: 2026-05-06T20:48:53.302Z
Learning: Limit line length to 80 characters only for documentation sources under the docs directory (docs/**/*.rst and docs/**/*.md). This is enforced by the vyoslinter doc-linter.py (from the vyos/.github repo) via lint-doc.yml on changed files under docs/**. Do not flag line-length violations in repository-root Markdown files like CLAUDE.md or README.md, as they are rendered by GitHub and reflow in the UI.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-06T20:49:10.359Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:142-142
Timestamp: 2026-05-06T20:49:10.359Z
Learning: In vyos/vyos-documentation, the 80-character line limit and vyoslinter enforcement apply only to documentation source files under docs/**/*.rst and docs/**/*.md that Sphinx renders. Repo-root files such as CLAUDE.md and README.md are outside the linter's scope (lint-doc.yml runs on docs/**) and are rendered by GitHub with automatic paragraph reflow — do not flag line-length violations in these files.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-06T20:49:15.361Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:163-163
Timestamp: 2026-05-06T20:49:15.361Z
Learning: In vyos/vyos-documentation, enforce the 80-character line-length limit (Source conventions / Formatting) only for Sphinx documentation source files under docs/**/*.rst and docs/**/*.md. The lint-doc.yml workflow runs the doc-linter (doc-linter.py) and checks only docs/** changed files. Files in the repository root (e.g., CLAUDE.md, README.md) are rendered by GitHub and are not subject to this rule; do not flag line-length violations in those files.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-08T07:01:22.978Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1878
File: docs/troubleshooting/connectivity.rst:0-0
Timestamp: 2026-05-08T07:01:22.978Z
Learning: For the VyOS documentation (MyST-based docs), MyST directive opener lines must keep the entire directive arguments on a single line. This includes MyST fenced-directive openers like ```{opcmd} ... ``` and the RST-equivalent form .. opcmd:: ... when ported/used in MyST. Because the MyST parser does not support wrapped/continued directive arguments across multiple lines, do not raise/keep review warnings suggesting line wrapping for these directive opener lines due to line-length (even if they exceed 80 characters).
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-08T07:01:22.978Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1878
File: docs/troubleshooting/connectivity.rst:0-0
Timestamp: 2026-05-08T07:01:22.978Z
Learning: In vyos/vyos-documentation, do not raise line-length (>80 chars) review findings for MyST directive opener lines (the directive “opener” that uses MyST directive syntax such as `{cfgcmd}` / `{opcmd}` fence/openers). CI does not enforce the 80-character limit for these specific opener lines, and existing documentation contains longer opener lines that pass lint.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-13T22:16:06.198Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 2021
File: docs/automation/terraform/terraformvyos.md:14-14
Timestamp: 2026-05-13T22:16:06.198Z
Learning: In the vyos/vyos-documentation repo, when a PR is a byte-for-byte documentation port of an existing file from the rolling branch to a release branch (e.g., circinus, sagitta), keep the port content identical to the production-tested rolling source. For these ports, do not raise new review findings for documentation issues that are already present in the rolling source (for example, markdownlint MD059 like non-descriptive link text such as `[link]`/`[install]`). Instead, defer those existing issues to a rolling-side cleanup PR (e.g., `#2024`) and then backport the cleanup via Mergify.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-05-13T22:43:41.056Z
Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 2024
File: docs/automation/terraform/terraformvyos.md:0-0
Timestamp: 2026-05-13T22:43:41.056Z
Learning: In docs/**/*.md, for Markdown reference definition lines of the form `[label]: <URL>`, if the line cannot be shortened to <= 80 characters (because the URL itself is near/at the limit), suppress the vyoslinter warning by wrapping only that reference definition with a `% stop_vyoslinter` / `% start_vyoslinter` block. If the reference definition can fit within 80 characters, leave it outside any suppression block.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
📚 Learning: 2026-06-05T19:21:44.474Z
Learnt from: LiudmylaNad
Repo: vyos/vyos-documentation PR: 2066
File: docs/configuration/protocols/traffic-engineering.md:0-0
Timestamp: 2026-06-05T19:21:44.474Z
Learning: In the vyos/vyos-documentation MyST documentation pages, when writing CLI example invocations directly under a `{cfgcmd}` directive, use `none` fenced code blocks for those examples. Do not change these example blocks to `{opcmd}` or `{cfgcmd}`—`{opcmd}` is reserved for operational-mode commands, and the surrounding `{cfgcmd}` directive already documents the target command. Plain `none` blocks for these CLI examples are intentional and correct.
Applied to files:
docs/configuration/firewall/ipv6.mddocs/configuration/firewall/ipv4.md
🔍 Remote MCP Context7, vyos.dev
Relevant review context
- T9157 is titled “Support
fib daddr type/fib saddr typematching in firewall rules (especiallyprerouting raw)”; it is Open, Normal priority, and remains in Need Triage. - The task specifically requests matching local destinations without manually enumerating router addresses, with syntax such as
destination fib-type 'local', followed by anacceptrule and a catch-allnotrackrule. - The documented feature corresponds to nftables FIB expressions, which can retrieve address types for packet source or destination addresses.
- The task’s stated use case is
prerouting raw, distinguishing locally destined traffic (retain conntrack) from forwarded traffic (applynotrack); this aligns with the PR’s example.
🔇 Additional comments (1)
docs/configuration/firewall/ipv4.md (1)
517-521: 🎯 Functional CorrectnessVerify the address-type token in both pages.
The docs expose
prohibited, while nftables documents the FIB token asprohibit. Confirm the VyOS parser and translator before release. (netfilter.org)
docs/configuration/firewall/ipv4.md#L517-L521: Verify or correctprohibited.docs/configuration/firewall/ipv6.md#L518-L522: Verify or correctprohibited.Based on the nftables reference, verify the VyOS-to-nftables token mapping before merge.
Companion vyos-1x PR #5372 restructured the "fib-type" leaf into a "fib" node with a "type" child (following feedback from l0crian1 and sarthurdev to reserve the "fib" namespace for a possible future lookup/match concatenation feature, tracked separately under T5119). Update the CLI paths and examples here to match, and fix "prohibited" to "prohibit" to match nftables' actual fib_addrtype token.
Contributor
|
Claude finished @ruben-herold's task in 4m 17s —— View job Claude PR Review
IssuesNone (ERROR / WARNING). The documentation matches the current state of companion vyos-1x PR #5372 accurately after the
Needs Verification
Coordination notevyos-1x PR #5372 (the feature PR this documents) is currently OPEN / not merged — the Stats
|
CodeRabbit feedback on vyos#2186: - the prose showed a "prerouting raw" example but the command reference only listed forward/input/output/name filter forms, even though fib.xml.i is also included from common-rule-ipv{4,6}-raw.xml.i for that hook. Add the missing source/destination cfgcmd entries. - MyST pages use single backticks for inline code, not double (that's for embedded RST); fix the fib type prose accordingly.
Contributor
|
Claude finished @ruben-herold's task in 1m 27s —— View job Claude PR Review
IssuesNone (ERROR / WARNING). Commit
Overall correctness against companion PR
Needs Verification
Coordination noteCompanion vyos-1x PR Stats
|
Companion vyos-1x PR #5372 moved "fib" from a leaf nested under destination/source to a rule-level node with separate "lookup" (source-address/destination-address) and "match route-type" children, per l0crian1's review feedback - reserving room for mark/iif/oif lookup keys and oif/oifname match results later (tracked under T5119) without ever renaming what ships now. Update the CLI paths and examples here to match.
Contributor
|
Claude finished @ruben-herold's task in 1m 56s —— View job Claude PR Review
IssuesNone (ERROR / WARNING). Commit
Needs Verification
Coordination noteCompanion vyos-1x PR Stats
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Summary
Companion documentation for vyos/vyos-1x#5372, which adds
fib-typeas a source/destination match option (nftables'
fib daddr/saddr typeexpression) for the forward/input/output/name rule sets, IPv4 and IPv6.
Adds a
{cfgcmd}block per rule-set/side right afteraddress-mask,matching the existing style for these pages, plus a
prerouting rawusage example in the prose.
Related Task(s)
Related PR(s)
Backport
Checklist: