firewall4/root/usr/share, branch master

Revert "fw4: list lower devices for software flow offloading"

2026-10-29T08:40:33Z

This reverts commit a3296754c154c9a0203a8ab72820da0b381aaddd. Fixes: #114 Signed-off-by: Robert Marko

fw4: honour negated protocol matches in rules

2026-10-28T13:07:03Z

parse_protocol() records a leading '!' in the invert flag, but the rule template ignores it, so "option proto '!tcp'" silently renders as a match on TCP. Emit "meta l4proto !=" for a negated protocol. A negated list such as '!tcpudp' or '!tcp !udp' matches none of its protocols, so it becomes a single rule against the whole set instead of one rule per protocol. A rule that mixes negated and plain protocols, negates 'all', or combines a negated protocol with port, ICMP type or port set matches is refused with a warning. Signed-off-by: John Crispin

fw4: add the npt target to nat sections

2026-10-28T13:07:03Z

A nat section with target 'npt' maps an internal prefix to an external prefix of the same length, in the manner of RFC 6296: config nat option name 'lan-ula' option src 'wan' option target 'npt' option src_ip 'fd00:21::/64' option snat_ip '2001:db8:200::/64' src or device selects the interface. fw4 emits a prefix SNAT for traffic that leaves on it and the reverse prefix DNAT for traffic that enters on it, so the interface identifier is kept and each host maps 1:1. IPv4 prefixes give a netmap the same way. The nft prefix mapping is stateful and recomputes the transport checksum, where RFC 6296 is stateless and checksum-neutral; the addresses on the wire are the same. The mapping accepts no traffic: the forward rules still decide. Signed-off-by: John Crispin

Do not emit helper jump without helper modules

2026-10-26T08:37:23Z

Do not emit helper jump if no helper modules are present saving per-every-packet bytecode before ct: ``` inet fw4 prerouting [ meta load iifname => reg 1 ] [ cmp eq reg 1 0x6c2d7262 0x00006e61 0x00000000 0x00000000 ] [ immediate reg 0 jump -> helper_lan ] userdata = { \x00-!fw4: Handle lan IPv4/IPv6 helper assignment\x00 } ``` Signed-off-by: Andris PE Link: https://github.com/openwrt/firewall4/pull/27 Signed-off-by: Robert Marko

ruleset: fix for missing counters handling code for ipsets

2026-10-26T08:31:17Z

This commit adds missing code that handles counters for ipsets. Fixes #69 Signed-off-by: XCas13 Link: https://github.com/openwrt/firewall4/pull/70 Signed-off-by: Robert Marko

fw4: list lower devices for software flow offloading

2026-10-25T10:19:25Z

Since Linux commit 871df5007eda ("netfilter: flowtable: bail out if forward path cannot be discovered"), a flow is offloaded only if the ingress device at the bottom of its forward path is a flowtable device. For a bridge that is the bridge port, such as a DSA user port or a wireless interface, not the bridge itself. With software offloading, fw4 lists only the zone devices, so flows through br-lan or a VLAN under the WAN stay on the classic path. Resolve the lower devices for software offloading as for hardware offloading. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris Link: https://github.com/openwrt/firewall4/pull/108 Signed-off-by: Robert Marko

fw4: support forwardings in procd and netifd firewall data

2026-08-27T16:26:56Z

Zones synthesised from published firewall data can now also declare the forwardings between them. All zones are parsed before any forwarding, so resolution is independent of declaration order. Signed-off-by: Daniel Golle

fw4: support zones in procd and netifd firewall data

2026-08-27T16:26:56Z

Zone specs were collected from published firewall data but never parsed. Accept them from the netifd interface data channel and from procd service data, keep their declared names, default their policies to drop to stay fail-closed, and attribute diagnostics for malformed specs to their publisher. Signed-off-by: Daniel Golle

fw4: anchor per-interface ubus firewall specs by kind

2026-08-27T16:26:24Z

Only rule and nat specs pin to the publishing interface device, which protocol handlers such as 464xlat rely on; zone, forwarding, redirect and ipset specs resolve through their own references, and an explicit device on them is kept. An empty device opts a rule or nat out of the pin and then requires a zone reference. Signed-off-by: Daniel Golle

fw4: accept a source rewrite range for ICMP

2026-08-27T16:26:05Z

A snat_port range on proto icmp maps the ICMP identifier rather than a port. map.sh emits one per MAP-E portset (RFC 7597) and firewall3 accepted it, while fw4 rejects the section, breaking ICMP source NAT for MAP. Accept the range for ICMP and infer the IPv6 family for ipv6-icmp; port match options still require UDP or TCP. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle