firewall4/root/usr/share, branch master

fw4: fix reading kernel version

2025-03-17T17:36:00Z

Fix reading kernel version for kernels with revision 0 e.g. 6.12 Repair incorrect shift of the revision number causing incorrect value for > 255. Signed-off-by: Mieczyslaw Nalewaj

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T16:08:52Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [fix redirect cases, reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich

Revert "fw4: allow family `any` for ipsets not matching IP addresses"

2025-03-17T15:49:39Z

This reverts commit ad3cba79c19209beaff61279338b1146b343cdc1. The proposed change does not cover all cases. Signed-off-by: Jo-Philipp Wich

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T15:41:09Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich

fw4: skip not existing netdev names in flowtable device list

2024-06-03T14:49:40Z

In case interface configurations are present which refer to not existing network devices, such device names might end up in the flowtable list, leading to `No such file or directory` errors when attempting to load the resulting ruleset. Solve this issue by testing for each netdev name whether it refers to an existing device. Fixes: e009588 ("fw4: do not add physical devices for soft offload") Signed-off-by: Jo-Philipp Wich

fw4: do not add physical devices for soft offload

2024-05-31T22:13:05Z

Let kernel heuristics take care of offloading decapsulation. When software flow offloading is requested, avoid manually resolving and adding lower physical devices to the flow table in order to let kernel heuristics deal with the proper offloading en/decapsulation. Fixes: https://github.com/openwrt/openwrt/issues/13410 Ref: https://github.com/openwrt/openwrt/issues/10224 Submitted-by: Andris PE [refactor code, reword commit message] Signed-off-by: Jo-Philipp Wich

fw4: substitute double quotes in strings

2024-05-21T06:54:02Z

The nftables parser has no concept of escape characters in quoted strings, nor does it support alternative quoting styles so it is currently impossible to emit double quoted strings containing double quotes. This could cause nftables to choke on generated rulesets that contain strings with embedded quotes, e.g. within firewall rule comments. Since firewall3 (iptables based) historically allowed arbitrary characters in comments and since we want to stay backwards compatible with existing uci configurations we can not restrict the allowed input values either. Work around the issue by substituting all double quotes with single quotes when quoting strings for interpolation into the ruleset. Fixes: https://github.com/openwrt/luci/issues/7091 Signed-off-by: Jo-Philipp Wich

ruleset: apply egress MSS fixup later to apply final MTU before wire

2023-11-03T13:33:55Z

Reduce scope of MSS fixup to TCP SYN packets only and relocate the fixing of egress MSS to the mangle/postrouting chain in order to properly apply final known MTU size. Fixes: openwrt/openwrt#12112 Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, reword commit message] Signed-off-by: Jo-Philipp Wich

ruleset: do not emit redundant drop invalid rules

2023-11-03T13:24:47Z

The wan interface drop rule unnecessarily persists when invalid state is dropped globally and the rule cannot catch anything at all, so remove it as the effect is achieved by default and to global extent. Fixes: 119ee1a ("ruleset: drop ctstate invalid traffic for masq-enabled zones") Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, reword commit subject and message] Signed-off-by: Jo-Philipp Wich

ruleset: reduce ksoftirqd load by refering to looopback by numeric id

2023-11-03T13:11:06Z

Reduce ksoftirq load by half using more efficient reference to loopback which always has index equal to one. Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and similar iperf3 cases clamping against 100% CPU usage. Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, rewrap commit message] Signed-off-by: Jo-Philipp Wich