firewall4/tests/03_rules, branch masterOpenWrt nftables firewallhttps://git.openwrt.org/project/firewall4/atom?h=master2023-11-03T13:11:06Zruleset: reduce ksoftirqd load by refering to looopback by numeric id2023-11-03T13:11:06ZAndris PE2023-09-19T15:23:59Zurn:sha1:a5553dae70439c7e4fa910490fcf12a1ffff5bd2
Reduce ksoftirq load by half using more efficient reference to loopback
which always has index equal to one.
Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and
similar iperf3 cases clamping against 100% CPU usage.
Signed-off-by: Andris PE <neandris@gmail.com>
[fix S-o-b tag, fix commit author, rewrap commit message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: dispatch ct states using verdict map2023-11-03T13:09:43ZAndris PE2023-09-07T19:04:35Zurn:sha1:19a8caf614ec338513e58535ea02c6ee52988170
In case the dropping of invalid conntrack states is enabled, using a verdict
map allows us to use only one rule instead of two, lowering the initial rule
match overhead.
Signed-off-by: Andris PE <neandris@gmail.com>
[whitespace cleanup, rebase, extend commit subject and message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Revert "ruleset: dispatch ct states using verdict map"2023-11-03T13:09:16ZJo-Philipp Wich2023-11-03T13:09:12Zurn:sha1:22c53921c11115e5437385719b6e73800a68cd33
This reverts commit 785798c8fd72ff3c4c8940922173290bb25bc18e.
Revert commit due to bad commit metadata.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: dispatch ct states using verdict map2023-11-03T13:04:39ZUser User-User2023-09-07T19:04:35Zurn:sha1:785798c8fd72ff3c4c8940922173290bb25bc18e
In case the dropping of invalid conntrack states is enabled, using a verdict
map allows us to use only one rule instead of two, lowering the initial rule
match overhead.
Signed-off-by: Andris PE <neandris@gmail.com>
[whitespace cleanup, rebase, extend commit subject and message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: fix emitting set_mark/set_xmark rules with masks2022-10-14T15:01:44ZJo-Philipp Wich2022-10-14T15:01:44Zurn:sha1:756f1e21ed77f2c0b3fc2c8128c808704f2cf61b
Fix a bad variable access when emitting set_mark/set_xmark rules with
masks and add test coverage for the various mark target variants.
Fixes: #10965
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
fw4: fix formatting of default log prefix2022-10-05T21:33:59ZJo-Philipp Wich2022-10-05T21:33:59Zurn:sha1:43d8ef516747aaede640d292b0326a66186809a8
When using the explicit or implicit rule name as default log prefix, ensure
that is followed by a colon and a space to yield properly formatted firewall
log messages.
Also align the processing logic of `option log` in `config nat` sections with
that in `config rule` and `config redirect`.
Ref: https://forum.openwrt.org/t/x/137182/8
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
tests: fix testcases2022-10-03T12:29:41ZJo-Philipp Wich2022-10-03T12:26:02Zurn:sha1:b0a6bff4ee4410cd554811fa0ca3b28fce908473
Align expected output with the current implementation.
Fixes: a540f6d ("fw4: fix cosmetic issue with per-ruleset and per-table include paths")
Fixes: 145e159 ("fw4: recognize `option log` and `option counter` in `config nat` sections")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: reorder declarations & output tweaks2022-06-14T14:27:26ZJo-Philipp Wich2022-06-14T14:23:50Zurn:sha1:11410b80eb9c442c4850cfc3034267f3f72a196c
- Omit "Set definitions" header if no sets are declared
- Always emit ${zone}_devices and ${zone}_subnets defines, even if empty
- Move CT helper definitions to the top
- Move ${zone}_helper chain definitions after ${zone}_forward chain defs
- Consistently use two line spacing for output sections
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: reuse zone-jump.uc template for notrack and helper chain jumps2022-06-14T14:27:26ZJo-Philipp Wich2022-06-14T12:59:58Zurn:sha1:e1cb763b65262eef5958d19fe922380aa1e96570
Avoid some code-duplication by reusing the zone-jump.uc partial template
to emit the helper_* chain jump rules.
Also add some test coverage for notrack rules.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: fix conntrack helpers2022-06-14T14:26:07ZStijn Tintel2022-06-13T15:00:26Zurn:sha1:a063317d96c6c85e4c909eab017ef2813f93ff05
In nftables, helper assignments need to be performed after the conntrack
lookup has completed. Using the raw priority results in the assignment
being done before the conntrack lookup, which breaks conntrack helpers.
Fix this by moving the jumps helper rule chains to a new toplevel
`prerouting` and the existing `output` chain respectively.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
[new toplevel `prerouting` chain + reuse existing `output` chain]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>