firewall4/tests/02_zones, branch master

fw4: support forwardings in procd and netifd firewall data

2026-08-27T16:26:56Z

Zones synthesised from published firewall data can now also declare the forwardings between them. All zones are parsed before any forwarding, so resolution is independent of declaration order. Signed-off-by: Daniel Golle

fw4: support zones in procd and netifd firewall data

2026-08-27T16:26:56Z

Zone specs were collected from published firewall data but never parsed. Accept them from the netifd interface data channel and from procd service data, keep their declared names, default their policies to drop to stay fail-closed, and attribute diagnostics for malformed specs to their publisher. Signed-off-by: Daniel Golle

fw4: skip zones with duplicate names

2026-08-27T16:12:55Z

Same-named zones emit duplicate defines and nft rejects the whole ruleset. Keep the first zone of a name, skip later ones with a diagnostic; a zone published over ubus never displaces a uci zone. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

tests: adjust zone log limit testcases

2023-11-03T13:14:15Z

Fix testcase failure introduced by a previous commit. Fixes: a5553da ("ruleset: reduce ksoftirqd load by refering to looopback by numeric id") Signed-off-by: Jo-Philipp Wich

ruleset: reduce ksoftirqd load by refering to looopback by numeric id

2023-11-03T13:11:06Z

Reduce ksoftirq load by half using more efficient reference to loopback which always has index equal to one. Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and similar iperf3 cases clamping against 100% CPU usage. Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, rewrap commit message] Signed-off-by: Jo-Philipp Wich

ruleset: dispatch ct states using verdict map

2023-11-03T13:09:43Z

In case the dropping of invalid conntrack states is enabled, using a verdict map allows us to use only one rule instead of two, lowering the initial rule match overhead. Signed-off-by: Andris PE [whitespace cleanup, rebase, extend commit subject and message] Signed-off-by: Jo-Philipp Wich

Revert "ruleset: dispatch ct states using verdict map"

2023-11-03T13:09:16Z

This reverts commit 785798c8fd72ff3c4c8940922173290bb25bc18e. Revert commit due to bad commit metadata. Signed-off-by: Jo-Philipp Wich

ruleset: dispatch ct states using verdict map

2023-11-03T13:04:39Z

fw4: add log_limit to rules and redirects

2023-11-03T12:37:19Z

Just like zone log_limit, now you can specify a different log limit to a single rule or redirect. Signed-off-by: Luiz Angelo Daros de Luca [whitespace cleanup, properly format limit expressions] Signed-off-by: Jo-Philipp Wich

ruleset: drop ctstate invalid traffic for masq-enabled zones

2022-10-26T13:45:16Z

For NAT enabled zones, stage rules to drop forwarded traffic with conntrack state "invalid" and honor `masq_allow_invalid` option to inhibit those rules. This ports the corresponding firewall3 logic to firewall4. Ref: https://forum.openwrt.org/t/x/140790 Signed-off-by: Jo-Philipp Wich