fw4: support zones and forwardings in procd and netifd firewall data - #98
Open
dangowrt wants to merge 6 commits into
Open
fw4: support zones and forwardings in procd and netifd firewall data#98dangowrt wants to merge 6 commits into
dangowrt wants to merge 6 commits into
Conversation
dangowrt
force-pushed
the
fw4-ubus-zones
branch
from
August 23, 2026 02:42
237ce49 to
c5741ce
Compare
dangowrt
requested review from
blogic
and
a lite review from Copilot
and removed request for
Copilot
August 23, 2026 20:14
Same-named zones emit duplicate defines and nft rejects the whole ruleset. Keep the first zone of a name, skip later ones with a diagnostic; a zone published over ubus never displaces a uci zone. Fixes: 59dbb98 ("Initial commit") Signed-off-by: Daniel Golle <[email protected]>
dangowrt
force-pushed
the
fw4-ubus-zones
branch
from
August 27, 2026 16:14
c5741ce to
fa2c49b
Compare
dangowrt
changed the title
A typo in the type field silently disables the spec. Warn instead; entries without a type field remain ignored as before. Fixes: 59dbb98 ("Initial commit") Signed-off-by: Daniel Golle <[email protected]>
A snat_port range on proto icmp maps the ICMP identifier rather than a port. map.sh emits one per MAP-E portset (RFC 7597) and firewall3 accepted it, while fw4 rejects the section, breaking ICMP source NAT for MAP. Accept the range for ICMP and infer the IPv6 family for ipv6-icmp; port match options still require UDP or TCP. Fixes: 59dbb98 ("Initial commit") Signed-off-by: Daniel Golle <[email protected]>
Only rule and nat specs pin to the publishing interface device, which protocol handlers such as 464xlat rely on; zone, forwarding, redirect and ipset specs resolve through their own references, and an explicit device on them is kept. An empty device opts a rule or nat out of the pin and then requires a zone reference. Signed-off-by: Daniel Golle <[email protected]>
Zone specs were collected from published firewall data but never parsed. Accept them from the netifd interface data channel and from procd service data, keep their declared names, default their policies to drop to stay fail-closed, and attribute diagnostics for malformed specs to their publisher. Signed-off-by: Daniel Golle <[email protected]>
Zones synthesised from published firewall data can now also declare the forwardings between them. All zones are parsed before any forwarding, so resolution is independent of declaration order. Signed-off-by: Daniel Golle <[email protected]>
dangowrt
force-pushed
the
fw4-ubus-zones
branch
from
August 27, 2026 16:27
fa2c49b to
c2ae8c8
Compare
|
LGTM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fw4 already folds firewall rules published as procd service data and netifd interface data into its ruleset on reload. Let that data also declare zones and the forwardings between them, so a container manager can set up container networking without writing persistent state below /etc/config.
The first three commits fix pre-existing bugs found while validating this: duplicate zone names make nft reject the whole ruleset, unknown spec types vanish silently, and ICMP source NAT ranges (MAP-E portsets) are refused.