firewall4/tests/06_includes, branch masterOpenWrt nftables firewallhttps://git.openwrt.org/project/firewall4/atom?h=master2026-11-02T22:46:36Zfw4: skip an include section with invalid options2026-11-02T22:46:36ZKoral Ilgun2026-10-15T02:48:02Zurn:sha1:40f032c29a0e46b130f6673fab09a66dbdc409b5
parse_options() returns false for a section that lacks a required
option or holds an invalid value. parse_include() used the result
without a check, so an include section without a path stopped the
render of the whole ruleset:
Reference error: left-hand side expression is not an array or object
fw4 reload deletes the state file before the render, so after such a
failure each later reload stops with "The fw4 firewall does not appear
to be loaded." until a restart of the firewall.
Skip the section with a warning, as the parsers of the rule, forwarding,
redirect and zone sections do, and add a test case for it.
Signed-off-by: Koral Ilgun <koral.ilgun@adtran.com>
ruleset: reduce ksoftirqd load by refering to looopback by numeric id2023-11-03T13:11:06ZAndris PE2023-09-19T15:23:59Zurn:sha1:a5553dae70439c7e4fa910490fcf12a1ffff5bd2
Reduce ksoftirq load by half using more efficient reference to loopback
which always has index equal to one.
Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and
similar iperf3 cases clamping against 100% CPU usage.
Signed-off-by: Andris PE <neandris@gmail.com>
[fix S-o-b tag, fix commit author, rewrap commit message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: dispatch ct states using verdict map2023-11-03T13:09:43ZAndris PE2023-09-07T19:04:35Zurn:sha1:19a8caf614ec338513e58535ea02c6ee52988170
In case the dropping of invalid conntrack states is enabled, using a verdict
map allows us to use only one rule instead of two, lowering the initial rule
match overhead.
Signed-off-by: Andris PE <neandris@gmail.com>
[whitespace cleanup, rebase, extend commit subject and message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Revert "ruleset: dispatch ct states using verdict map"2023-11-03T13:09:16ZJo-Philipp Wich2023-11-03T13:09:12Zurn:sha1:22c53921c11115e5437385719b6e73800a68cd33
This reverts commit 785798c8fd72ff3c4c8940922173290bb25bc18e.
Revert commit due to bad commit metadata.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
ruleset: dispatch ct states using verdict map2023-11-03T13:04:39ZUser User-User2023-09-07T19:04:35Zurn:sha1:785798c8fd72ff3c4c8940922173290bb25bc18e
In case the dropping of invalid conntrack states is enabled, using a verdict
map allows us to use only one rule instead of two, lowering the initial rule
match overhead.
Signed-off-by: Andris PE <neandris@gmail.com>
[whitespace cleanup, rebase, extend commit subject and message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
tests: add testcase for automatic includes2023-02-03T11:04:58ZJo-Philipp Wich2023-02-03T11:04:58Zurn:sha1:ce9a37829a765c62ce8d9da37caa9bbfb5bb58ec
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
fw4: fix handling the ipset "comment" option2023-02-03T11:04:15ZJo-Philipp Wich2023-01-07T16:00:18Zurn:sha1:39e8c70957c795bf0c12f04299170ae86c6efdf8
The comment option for ipset definitions is incorrectly declared as bool
and not actually used anywhere in the nftables output rendering.
Solve this issue by changing it to the proper "string" type and expose
the user configured comment as "comment" property in the generated nftables
output.
Also add some initial test coverage for ipset declarations to better spot
such inconsistencies in the future.
Ref: https://github.com/openwrt/luci/pull/6187#issuecomment-1374506633
Reported-by: Paul Dee <itsascambutmailmeanyway@gmail.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>