firewall4/tests/03_rules/09_time, branch masterOpenWrt nftables firewallhttps://git.openwrt.org/project/firewall4/atom?h=master2023-11-03T13:11:06Zruleset: reduce ksoftirqd load by refering to looopback by numeric id2023-11-03T13:11:06ZAndris PE2023-09-19T15:23:59Zurn:sha1:a5553dae70439c7e4fa910490fcf12a1ffff5bd2
Reduce ksoftirq load by half using more efficient reference to loopback
which always has index equal to one.
Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and
similar iperf3 cases clamping against 100% CPU usage.
Signed-off-by: Andris PE <neandris@gmail.com>
[fix S-o-b tag, fix commit author, rewrap commit message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: dispatch ct states using verdict map2023-11-03T13:09:43ZAndris PE2023-09-07T19:04:35Zurn:sha1:19a8caf614ec338513e58535ea02c6ee52988170
In case the dropping of invalid conntrack states is enabled, using a verdict
map allows us to use only one rule instead of two, lowering the initial rule
match overhead.
Signed-off-by: Andris PE <neandris@gmail.com>
[whitespace cleanup, rebase, extend commit subject and message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Revert "ruleset: dispatch ct states using verdict map"2023-11-03T13:09:16ZJo-Philipp Wich2023-11-03T13:09:12Zurn:sha1:22c53921c11115e5437385719b6e73800a68cd33
This reverts commit 785798c8fd72ff3c4c8940922173290bb25bc18e.
Revert commit due to bad commit metadata.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: dispatch ct states using verdict map2023-11-03T13:04:39ZUser User-User2023-09-07T19:04:35Zurn:sha1:785798c8fd72ff3c4c8940922173290bb25bc18e
In case the dropping of invalid conntrack states is enabled, using a verdict
map allows us to use only one rule instead of two, lowering the initial rule
match overhead.
Signed-off-by: Andris PE <neandris@gmail.com>
[whitespace cleanup, rebase, extend commit subject and message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: reorder declarations & output tweaks2022-06-14T14:27:26ZJo-Philipp Wich2022-06-14T14:23:50Zurn:sha1:11410b80eb9c442c4850cfc3034267f3f72a196c
- Omit "Set definitions" header if no sets are declared
- Always emit ${zone}_devices and ${zone}_subnets defines, even if empty
- Move CT helper definitions to the top
- Move ${zone}_helper chain definitions after ${zone}_forward chain defs
- Consistently use two line spacing for output sections
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: fix conntrack helpers2022-06-14T14:26:07ZStijn Tintel2022-06-13T15:00:26Zurn:sha1:a063317d96c6c85e4c909eab017ef2813f93ff05
In nftables, helper assignments need to be performed after the conntrack
lookup has completed. Using the raw priority results in the assignment
being done before the conntrack lookup, which breaks conntrack helpers.
Fix this by moving the jumps helper rule chains to a new toplevel
`prerouting` and the existing `output` chain respectively.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
[new toplevel `prerouting` chain + reuse existing `output` chain]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: emit time ranges when both start and stop times are specified2022-05-30T21:46:48ZJo-Philipp Wich2022-05-30T21:46:48Zurn:sha1:221040ee1c197fde7460bf16723058e0d09d707a
Instead of emitting two time matches checking the start and stop time/hour
respectively, emit a range when both are given. This also properly deals
with time of day ranges where start > stop since nft will take care of
implicitly inverting those.
Also add basic test coverage for time related matches.
Fixes: #9923
Signed-off-by: Jo-Philipp Wich <jo@mein.io>