firewall4/tests, branch master

ruleset: apply egress MSS fixup later to apply final MTU before wire

2023-11-03T13:33:55Z

Reduce scope of MSS fixup to TCP SYN packets only and relocate the fixing of egress MSS to the mangle/postrouting chain in order to properly apply final known MTU size. Fixes: openwrt/openwrt#12112 Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, reword commit message] Signed-off-by: Jo-Philipp Wich

tests: adjust zone log limit testcases

2023-11-03T13:14:15Z

Fix testcase failure introduced by a previous commit. Fixes: a5553da ("ruleset: reduce ksoftirqd load by refering to looopback by numeric id") Signed-off-by: Jo-Philipp Wich

ruleset: reduce ksoftirqd load by refering to looopback by numeric id

2023-11-03T13:11:06Z

Reduce ksoftirq load by half using more efficient reference to loopback which always has index equal to one. Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and similar iperf3 cases clamping against 100% CPU usage. Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, rewrap commit message] Signed-off-by: Jo-Philipp Wich

ruleset: dispatch ct states using verdict map

2023-11-03T13:09:43Z

In case the dropping of invalid conntrack states is enabled, using a verdict map allows us to use only one rule instead of two, lowering the initial rule match overhead. Signed-off-by: Andris PE [whitespace cleanup, rebase, extend commit subject and message] Signed-off-by: Jo-Philipp Wich

Revert "ruleset: dispatch ct states using verdict map"

2023-11-03T13:09:16Z

This reverts commit 785798c8fd72ff3c4c8940922173290bb25bc18e. Revert commit due to bad commit metadata. Signed-off-by: Jo-Philipp Wich

ruleset: dispatch ct states using verdict map

2023-11-03T13:04:39Z

fw4: add log_limit to rules and redirects

2023-11-03T12:37:19Z

Just like zone log_limit, now you can specify a different log limit to a single rule or redirect. Signed-off-by: Luiz Angelo Daros de Luca [whitespace cleanup, properly format limit expressions] Signed-off-by: Jo-Philipp Wich

tests: fix expected test output

2023-05-30T08:19:51Z

A previous commit enabled flowtable counters without properly adjusting the testcase output. Fixes: 04a06bd ("fw4: enable flowtable counters") Signed-off-by: Jo-Philipp Wich

tests: add testcase for automatic includes

2023-02-03T11:04:58Z

Signed-off-by: Jo-Philipp Wich

fw4: fix handling the ipset "comment" option

2023-02-03T11:04:15Z

The comment option for ipset definitions is incorrectly declared as bool and not actually used anywhere in the nftables output rendering. Solve this issue by changing it to the proper "string" type and expose the user configured comment as "comment" property in the generated nftables output. Also add some initial test coverage for ipset declarations to better spot such inconsistencies in the future. Ref: https://github.com/openwrt/luci/pull/6187#issuecomment-1374506633 Reported-by: Paul Dee Signed-off-by: Jo-Philipp Wich