From 203f81df674e9520d2925bb27c723c3a8fb112f4 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Fri, 2 Jan 2026 19:32:33 +0100
Subject: [PATCH] cli: show firewall, add subcommands for log and matrix

The original 'show firewall log' just did the same as the 'show log firewall'
command.  This new implementation allows showing pretty-printed firewall log
which is admittedly easier on the eyes.

Also, add 'show firewall matrix' to just show the zone matrix overview.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 src/klish-plugin-infix/xml/infix.xml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/klish-plugin-infix/xml/infix.xml b/src/klish-plugin-infix/xml/infix.xml
index 423c31a1..bb3d6a1e 100644
--- a/src/klish-plugin-infix/xml/infix.xml
+++ b/src/klish-plugin-infix/xml/infix.xml
@@ -638,10 +638,18 @@
   <COMMAND name="firewall" help="Show firewall status and configuration">
     <SWITCH name="optional" min="0" max="1">
       <COMMAND name="log" help="Show firewall log (jumps to end), alias to 'show log firewall.log'">
+        <SWITCH name="optional" min="0">
+          <PARAM name="limit" ptype="/UINT" help="Last N lines, default: all"/>
+        </SWITCH>
 	<ACTION sym="script" in="tty" out="tty" interrupt="true">
-	  doas -u $USER cat /log/firewall.log |pager +G
+	  sysrepocfg -X -d operational -x /infix-firewall:firewall -f json -t 60 | /usr/libexec/statd/cli-pretty show-firewall-log $KLISH_PARAM_limit |pager +G
 	</ACTION>
       </COMMAND>
+      <COMMAND name="matrix" help="Show firewall zone matrix">
+        <ACTION sym="script" in="tty" out="tty" interrupt="true">
+          sysrepocfg -X -d operational -x /infix-firewall:firewall -f json -t 60 | /usr/libexec/statd/cli-pretty show-firewall-matrix
+        </ACTION>
+      </COMMAND>
       <COMMAND name="zone" help="Show firewall zones">
         <SWITCH name="optional" min="0">
           <PARAM name="name" ptype="/FIREWALL_ZONES" help="Zone name"/>