firewall4/tests, branch master

fw4: support forwardings in procd and netifd firewall data

2026-08-27T16:26:56Z

Zones synthesised from published firewall data can now also declare the forwardings between them. All zones are parsed before any forwarding, so resolution is independent of declaration order. Signed-off-by: Daniel Golle

fw4: support zones in procd and netifd firewall data

2026-08-27T16:26:56Z

Zone specs were collected from published firewall data but never parsed. Accept them from the netifd interface data channel and from procd service data, keep their declared names, default their policies to drop to stay fail-closed, and attribute diagnostics for malformed specs to their publisher. Signed-off-by: Daniel Golle

fw4: anchor per-interface ubus firewall specs by kind

2026-08-27T16:26:24Z

Only rule and nat specs pin to the publishing interface device, which protocol handlers such as 464xlat rely on; zone, forwarding, redirect and ipset specs resolve through their own references, and an explicit device on them is kept. An empty device opts a rule or nat out of the pin and then requires a zone reference. Signed-off-by: Daniel Golle

fw4: accept a source rewrite range for ICMP

2026-08-27T16:26:05Z

A snat_port range on proto icmp maps the ICMP identifier rather than a port. map.sh emits one per MAP-E portset (RFC 7597) and firewall3 accepted it, while fw4 rejects the section, breaking ICMP source NAT for MAP. Accept the range for ICMP and infer the IPv6 family for ipv6-icmp; port match options still require UDP or TCP. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: warn about ubus firewall specs of unknown type

2026-08-27T16:26:05Z

A typo in the type field silently disables the spec. Warn instead; entries without a type field remain ignored as before. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: skip zones with duplicate names

2026-08-27T16:12:55Z

Same-named zones emit duplicate defines and nft rejects the whole ruleset. Keep the first zone of a name, skip later ones with a diagnostic; a zone published over ubus never displaces a uci zone. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

ruleset: apply egress MSS fixup later to apply final MTU before wire

2023-11-03T13:33:55Z

Reduce scope of MSS fixup to TCP SYN packets only and relocate the fixing of egress MSS to the mangle/postrouting chain in order to properly apply final known MTU size. Fixes: openwrt/openwrt#12112 Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, reword commit message] Signed-off-by: Jo-Philipp Wich

tests: adjust zone log limit testcases

2023-11-03T13:14:15Z

Fix testcase failure introduced by a previous commit. Fixes: a5553da ("ruleset: reduce ksoftirqd load by refering to looopback by numeric id") Signed-off-by: Jo-Philipp Wich

ruleset: reduce ksoftirqd load by refering to looopback by numeric id

2023-11-03T13:11:06Z

Reduce ksoftirq load by half using more efficient reference to loopback which always has index equal to one. Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and similar iperf3 cases clamping against 100% CPU usage. Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, rewrap commit message] Signed-off-by: Jo-Philipp Wich

ruleset: dispatch ct states using verdict map

2023-11-03T13:09:43Z

In case the dropping of invalid conntrack states is enabled, using a verdict map allows us to use only one rule instead of two, lowering the initial rule match overhead. Signed-off-by: Andris PE [whitespace cleanup, rebase, extend commit subject and message] Signed-off-by: Jo-Philipp Wich