firewall4, branch master

fw4: fix reading kernel version

2025-03-17T17:36:00Z

Fix reading kernel version for kernels with revision 0 e.g. 6.12 Repair incorrect shift of the revision number causing incorrect value for > 255. Signed-off-by: Mieczyslaw Nalewaj

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T16:08:52Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [fix redirect cases, reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich

Revert "fw4: allow family `any` for ipsets not matching IP addresses"

2025-03-17T15:49:39Z

This reverts commit ad3cba79c19209beaff61279338b1146b343cdc1. The proposed change does not cover all cases. Signed-off-by: Jo-Philipp Wich

config: drop to-be-forwarded-nowhere packets on wans

2025-03-17T15:46:41Z

Dropping packets with no clear forward destination is nicer than rejecting them. Especially when some providers punish users for spoofing caused by their noisy infra. Fixes: https://github.com/openwrt/openwrt/issues/13340 Signed-Off-By: Andris PE

init: remove unnecessary stop logic

2025-03-17T15:44:40Z

Always remove table and service state to have consistent cleaned up system state on exit even if user intentionally dropped our table. Removes dependency on grep as a consequence. Ref: https://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables Supersedes: https://github.com/openwrt/firewall4/pull/33 Signed-off-by: Andris PE

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T15:41:09Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich

init: use the reload data trigger to reload firewall on procd data changes

2024-12-18T09:34:15Z

This allows properly handling dynamic changes to firewall rules added via procd data. Signed-off-by: Felix Fietkau

fw4: skip not existing netdev names in flowtable device list

2024-06-03T14:49:40Z

In case interface configurations are present which refer to not existing network devices, such device names might end up in the flowtable list, leading to `No such file or directory` errors when attempting to load the resulting ruleset. Solve this issue by testing for each netdev name whether it refers to an existing device. Fixes: e009588 ("fw4: do not add physical devices for soft offload") Signed-off-by: Jo-Philipp Wich

fw4: do not add physical devices for soft offload

2024-05-31T22:13:05Z

Let kernel heuristics take care of offloading decapsulation. When software flow offloading is requested, avoid manually resolving and adding lower physical devices to the flow table in order to let kernel heuristics deal with the proper offloading en/decapsulation. Fixes: https://github.com/openwrt/openwrt/issues/13410 Ref: https://github.com/openwrt/openwrt/issues/10224 Submitted-by: Andris PE [refactor code, reword commit message] Signed-off-by: Jo-Philipp Wich

fw4: substitute double quotes in strings

2024-05-21T06:54:02Z

The nftables parser has no concept of escape characters in quoted strings, nor does it support alternative quoting styles so it is currently impossible to emit double quoted strings containing double quotes. This could cause nftables to choke on generated rulesets that contain strings with embedded quotes, e.g. within firewall rule comments. Since firewall3 (iptables based) historically allowed arbitrary characters in comments and since we want to stay backwards compatible with existing uci configurations we can not restrict the allowed input values either. Work around the issue by substituting all double quotes with single quotes when quoting strings for interpolation into the ruleset. Fixes: https://github.com/openwrt/luci/issues/7091 Signed-off-by: Jo-Philipp Wich