firewall4/tests/03_rules, branch master

fw4: anchor per-interface ubus firewall specs by kind

2026-08-27T16:26:24Z

Only rule and nat specs pin to the publishing interface device, which protocol handlers such as 464xlat rely on; zone, forwarding, redirect and ipset specs resolve through their own references, and an explicit device on them is kept. An empty device opts a rule or nat out of the pin and then requires a zone reference. Signed-off-by: Daniel Golle

fw4: accept a source rewrite range for ICMP

2026-08-27T16:26:05Z

A snat_port range on proto icmp maps the ICMP identifier rather than a port. map.sh emits one per MAP-E portset (RFC 7597) and firewall3 accepted it, while fw4 rejects the section, breaking ICMP source NAT for MAP. Accept the range for ICMP and infer the IPv6 family for ipv6-icmp; port match options still require UDP or TCP. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

fw4: warn about ubus firewall specs of unknown type

2026-08-27T16:26:05Z

A typo in the type field silently disables the spec. Warn instead; entries without a type field remain ignored as before. Fixes: 59dbb982b7fe ("Initial commit") Signed-off-by: Daniel Golle

ruleset: reduce ksoftirqd load by refering to looopback by numeric id

2023-11-03T13:11:06Z

Reduce ksoftirq load by half using more efficient reference to loopback which always has index equal to one. Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and similar iperf3 cases clamping against 100% CPU usage. Signed-off-by: Andris PE [fix S-o-b tag, fix commit author, rewrap commit message] Signed-off-by: Jo-Philipp Wich

ruleset: dispatch ct states using verdict map

2023-11-03T13:09:43Z

In case the dropping of invalid conntrack states is enabled, using a verdict map allows us to use only one rule instead of two, lowering the initial rule match overhead. Signed-off-by: Andris PE [whitespace cleanup, rebase, extend commit subject and message] Signed-off-by: Jo-Philipp Wich

Revert "ruleset: dispatch ct states using verdict map"

2023-11-03T13:09:16Z

This reverts commit 785798c8fd72ff3c4c8940922173290bb25bc18e. Revert commit due to bad commit metadata. Signed-off-by: Jo-Philipp Wich

ruleset: dispatch ct states using verdict map

2023-11-03T13:04:39Z

ruleset: fix emitting set_mark/set_xmark rules with masks

2022-10-14T15:01:44Z

Fix a bad variable access when emitting set_mark/set_xmark rules with masks and add test coverage for the various mark target variants. Fixes: #10965 Signed-off-by: Jo-Philipp Wich

fw4: fix formatting of default log prefix

2022-10-05T21:33:59Z

When using the explicit or implicit rule name as default log prefix, ensure that is followed by a colon and a space to yield properly formatted firewall log messages. Also align the processing logic of `option log` in `config nat` sections with that in `config rule` and `config redirect`. Ref: https://forum.openwrt.org/t/x/137182/8 Signed-off-by: Jo-Philipp Wich

tests: fix testcases

2022-10-03T12:29:41Z

Align expected output with the current implementation. Fixes: a540f6d ("fw4: fix cosmetic issue with per-ruleset and per-table include paths") Fixes: 145e159 ("fw4: recognize `option log` and `option counter` in `config nat` sections") Signed-off-by: Jo-Philipp Wich