firewall4/root/usr/share, branch master

fw4: support forwardings in procd and netifd firewall data

2026-08-27T16:26:56Z

Zones synthesised from published firewall data can now also declare the forwardings between them. All zones are parsed before any forwarding, so resolution is independent of declaration order. Signed-off-by: Daniel Golle

fw4: support zones in procd and netifd firewall data

2026-08-27T16:26:56Z

Zone specs were collected from published firewall data but never parsed. Accept them from the netifd interface data channel and from procd service data, keep their declared names, default their policies to drop to stay fail-closed, and attribute diagnostics for malformed specs to their publisher. Signed-off-by: Daniel Golle

fw4: anchor per-interface ubus firewall specs by kind

2026-08-27T16:26:24Z

Only rule and nat specs pin to the publishing interface device, which protocol handlers such as 464xlat rely on; zone, forwarding, redirect and ipset specs resolve through their own references, and an explicit device on them is kept. An empty device opts a rule or nat out of the pin and then requires a zone reference. Signed-off-by: Daniel Golle

fw4: accept a source rewrite range for ICMP

2026-08-27T16:26:05Z

A snat_port range on proto icmp maps the ICMP identifier rather than a port. map.sh emits one per MAP-E portset (RFC 7597) and firewall3 accepted it, while fw4 rejects the section, breaking ICMP source NAT for MAP. Accept the range for ICMP and infer the IPv6 family for ipv6-icmp; port match options still require UDP or TCP. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: warn about ubus firewall specs of unknown type

2026-08-27T16:26:05Z

A typo in the type field silently disables the spec. Warn instead; entries without a type field remain ignored as before. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: skip zones with duplicate names

2026-08-27T16:12:55Z

Same-named zones emit duplicate defines and nft rejects the whole ruleset. Keep the first zone of a name, skip later ones with a diagnostic; a zone published over ubus never displaces a uci zone. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: fix reading kernel version

2025-03-17T17:36:00Z

Fix reading kernel version for kernels with revision 0 e.g. 6.12 Repair incorrect shift of the revision number causing incorrect value for > 255. Signed-off-by: Mieczyslaw Nalewaj

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T16:08:52Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [fix redirect cases, reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich

Revert "fw4: allow family `any` for ipsets not matching IP addresses"

2025-03-17T15:49:39Z

This reverts commit ad3cba79c19209beaff61279338b1146b343cdc1. The proposed change does not cover all cases. Signed-off-by: Jo-Philipp Wich

fw4: allow family `any` for ipsets not matching IP addresses

2025-03-17T15:41:09Z

When filtering by MAC address, it is usually necessary to filter both IPv4 and IPv6. If it is not allowed to set the family of ipset to any, it will be necessary to create a separate, identical ipset for both IPv4 and IPv6. Fixes: https://github.com/openwrt/firewall4/issues/16 Suggested-by: zsien [reword commit subject, rewrap commit message] Signed-off-by: Jo-Philipp Wich