firewall4, branch master

Do not emit helper jump without helper modules

2026-10-26T08:37:23Z

Do not emit helper jump if no helper modules are present saving per-every-packet bytecode before ct: ``` inet fw4 prerouting [ meta load iifname => reg 1 ] [ cmp eq reg 1 0x6c2d7262 0x00006e61 0x00000000 0x00000000 ] [ immediate reg 0 jump -> helper_lan ] userdata = { \x00-!fw4: Handle lan IPv4/IPv6 helper assignment\x00 } ``` Signed-off-by: Andris PE Link: https://github.com/openwrt/firewall4/pull/27 Signed-off-by: Robert Marko

ruleset: fix for missing counters handling code for ipsets

2026-10-26T08:31:17Z

This commit adds missing code that handles counters for ipsets. Fixes #69 Signed-off-by: XCas13 Link: https://github.com/openwrt/firewall4/pull/70 Signed-off-by: Robert Marko

fw4: list lower devices for software flow offloading

2026-10-25T10:19:25Z

Since Linux commit 871df5007eda ("netfilter: flowtable: bail out if forward path cannot be discovered"), a flow is offloaded only if the ingress device at the bottom of its forward path is a flowtable device. For a bridge that is the bridge port, such as a DSA user port or a wireless interface, not the bridge itself. With software offloading, fw4 lists only the zone devices, so flows through br-lan or a VLAN under the WAN stay on the classic path. Resolve the lower devices for software offloading as for hardware offloading. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris Link: https://github.com/openwrt/firewall4/pull/108 Signed-off-by: Robert Marko

fw4: support forwardings in procd and netifd firewall data

2026-08-27T16:26:56Z

Zones synthesised from published firewall data can now also declare the forwardings between them. All zones are parsed before any forwarding, so resolution is independent of declaration order. Signed-off-by: Daniel Golle

fw4: support zones in procd and netifd firewall data

2026-08-27T16:26:56Z

Zone specs were collected from published firewall data but never parsed. Accept them from the netifd interface data channel and from procd service data, keep their declared names, default their policies to drop to stay fail-closed, and attribute diagnostics for malformed specs to their publisher. Signed-off-by: Daniel Golle

fw4: anchor per-interface ubus firewall specs by kind

2026-08-27T16:26:24Z

Only rule and nat specs pin to the publishing interface device, which protocol handlers such as 464xlat rely on; zone, forwarding, redirect and ipset specs resolve through their own references, and an explicit device on them is kept. An empty device opts a rule or nat out of the pin and then requires a zone reference. Signed-off-by: Daniel Golle

fw4: accept a source rewrite range for ICMP

2026-08-27T16:26:05Z

A snat_port range on proto icmp maps the ICMP identifier rather than a port. map.sh emits one per MAP-E portset (RFC 7597) and firewall3 accepted it, while fw4 rejects the section, breaking ICMP source NAT for MAP. Accept the range for ICMP and infer the IPv6 family for ipv6-icmp; port match options still require UDP or TCP. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: warn about ubus firewall specs of unknown type

2026-08-27T16:26:05Z

A typo in the type field silently disables the spec. Warn instead; entries without a type field remain ignored as before. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: skip zones with duplicate names

2026-08-27T16:12:55Z

Same-named zones emit duplicate defines and nft rejects the whole ruleset. Keep the first zone of a name, skip later ones with a diagnostic; a zone published over ubus never displaces a uci zone. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: fix reading kernel version

2025-03-17T17:36:00Z

Fix reading kernel version for kernels with revision 0 e.g. 6.12 Repair incorrect shift of the revision number causing incorrect value for > 255. Signed-off-by: Mieczyslaw Nalewaj