ruleset: dispatch ct states using verdict map
authorAndris PE <neandris@gmail.com>
Thu, 7 Sep 2023 19:04:35 +0000 (22:04 +0300)
committerJo-Philipp Wich <jo@mein.io>
Fri, 3 Nov 2023 13:09:43 +0000 (14:09 +0100)
commit19a8caf614ec338513e58535ea02c6ee52988170
treebd4e6144b9d6759d6df147fe32d14fe3437306f0
parent22c53921c11115e5437385719b6e73800a68cd33
ruleset: dispatch ct states using verdict map

In case the dropping of invalid conntrack states is enabled, using a verdict
map allows us to use only one rule instead of two, lowering the initial rule
match overhead.

Signed-off-by: Andris PE <neandris@gmail.com>
[whitespace cleanup, rebase, extend commit subject and message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
31 files changed:
root/usr/share/firewall4/templates/ruleset.uc
tests/01_configuration/01_ruleset
tests/01_configuration/02_rule_order
tests/02_zones/01_policies
tests/02_zones/02_masq
tests/02_zones/03_masq_src_dest_restrictions
tests/02_zones/04_masq_allow_invalid
tests/02_zones/04_wildcard_devices
tests/02_zones/05_subnet_mask_matches
tests/02_zones/06_family_selections
tests/02_zones/07_helpers
tests/02_zones/08_log_limit
tests/03_rules/01_direction
tests/03_rules/02_enabled
tests/03_rules/03_constraints
tests/03_rules/04_icmp
tests/03_rules/05_mangle
tests/03_rules/06_subnet_mask_matches
tests/03_rules/07_redirect
tests/03_rules/08_family_inheritance
tests/03_rules/09_time
tests/03_rules/10_notrack
tests/03_rules/11_log
tests/03_rules/12_mark
tests/04_forwardings/01_family_selections
tests/05_ipsets/01_declaration
tests/05_ipsets/02_usage
tests/06_includes/01_nft_includes
tests/06_includes/02_firewall.user_include
tests/06_includes/04_disabled_include
tests/06_includes/05_automatic_includes