firewall4/root/usr/share/ucode, branch master

fw4: fix reading kernel version

2025-03-17T17:36:00Z

Fix reading kernel version for kernels with revision 0 e.g. 6.12 Repair incorrect shift of the revision number causing incorrect value for > 255. Signed-off-by: Mieczyslaw Nalewaj

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T16:08:52Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [fix redirect cases, reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich

Revert "fw4: allow family `any` for ipsets not matching IP addresses"

2025-03-17T15:49:39Z

This reverts commit ad3cba79c19209beaff61279338b1146b343cdc1. The proposed change does not cover all cases. Signed-off-by: Jo-Philipp Wich

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T15:41:09Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich

fw4: skip not existing netdev names in flowtable device list

2024-06-03T14:49:40Z

In case interface configurations are present which refer to not existing network devices, such device names might end up in the flowtable list, leading to `No such file or directory` errors when attempting to load the resulting ruleset. Solve this issue by testing for each netdev name whether it refers to an existing device. Fixes: e009588 ("fw4: do not add physical devices for soft offload") Signed-off-by: Jo-Philipp Wich

fw4: do not add physical devices for soft offload

2024-05-31T22:13:05Z

Let kernel heuristics take care of offloading decapsulation. When software flow offloading is requested, avoid manually resolving and adding lower physical devices to the flow table in order to let kernel heuristics deal with the proper offloading en/decapsulation. Fixes: https://github.com/openwrt/openwrt/issues/13410 Ref: https://github.com/openwrt/openwrt/issues/10224 Submitted-by: Andris PE [refactor code, reword commit message] Signed-off-by: Jo-Philipp Wich

fw4: substitute double quotes in strings

2024-05-21T06:54:02Z

The nftables parser has no concept of escape characters in quoted strings, nor does it support alternative quoting styles so it is currently impossible to emit double quoted strings containing double quotes. This could cause nftables to choke on generated rulesets that contain strings with embedded quotes, e.g. within firewall rule comments. Since firewall3 (iptables based) historically allowed arbitrary characters in comments and since we want to stay backwards compatible with existing uci configurations we can not restrict the allowed input values either. Work around the issue by substituting all double quotes with single quotes when quoting strings for interpolation into the ruleset. Fixes: https://github.com/openwrt/luci/issues/7091 Signed-off-by: Jo-Philipp Wich

fw4: add log_limit to rules and redirects

2023-11-03T12:37:19Z

Just like zone log_limit, now you can specify a different log limit to a single rule or redirect. Signed-off-by: Luiz Angelo Daros de Luca [whitespace cleanup, properly format limit expressions] Signed-off-by: Jo-Philipp Wich

fw4: add support for zone log_limit

2023-11-03T12:34:35Z

It is equivalent to the fw3 feature, affecting not accepted packets and rules explicitily setting the log property. Input rules not associated with a zone will not have log_limit. Forward rules will use src zone log_limit or, if missing, dest zone log_limit. Signed-off-by: Luiz Angelo Daros de Luca [properly handle null zone references, whitespace and indentation cleanup, testcase cleanup, slight code simplification, use dot for named limit, properly format limit expressions] Signed-off-by: Jo-Philipp Wich

fw4: perform strict validation of zone and set names

2023-10-12T07:33:32Z

The nft syntax grammar requires unquoted chain and set names which imposes certain format restrictions. Introduce a new `identifier` datatype and use it for validating set and zone names. Fixes: https://github.com/openwrt/luci/issues/6633 Signed-off-by: Jo-Philipp Wich