From 6ea76926b0500a34c2c19a1bf86a08650ebf29ff Mon Sep 17 00:00:00 2001 From: Sophronia Koilpillai Date: Mon, 23 Sep 2024 06:06:34 +0000 Subject: [PATCH] firewall4: (APP-2968, PR #306) reduce ksoftirqd load by refering to looopback by numeric id Approved-by: James Haggerty Approved-by: Evan Benn --- ...oftirqd-load-by-refering-to-loopback.patch | 711 ++++++++++++++++++ 1 file changed, 711 insertions(+) create mode 100644 package/network/config/firewall4/patches/002-ruleset-reduce-ksoftirqd-load-by-refering-to-loopback.patch diff --git a/package/network/config/firewall4/patches/002-ruleset-reduce-ksoftirqd-load-by-refering-to-loopback.patch b/package/network/config/firewall4/patches/002-ruleset-reduce-ksoftirqd-load-by-refering-to-loopback.patch new file mode 100644 index 0000000000..db464c99f8 --- /dev/null +++ b/package/network/config/firewall4/patches/002-ruleset-reduce-ksoftirqd-load-by-refering-to-loopback.patch @@ -0,0 +1,711 @@ +From a5553dae70439c7e4fa910490fcf12a1ffff5bd2 Mon Sep 17 00:00:00 2001 +From: Andris PE +Date: Tue, 19 Sep 2023 18:23:59 +0300 +Subject: [PATCH] ruleset: reduce ksoftirqd load by refering to looopback by + numeric id + +Reduce ksoftirq load by half using more efficient reference to loopback +which always has index equal to one. + +Should help a lot with openwrt/openwrt#12914, openwrt/openwrt#12121 and +similar iperf3 cases clamping against 100% CPU usage. + +Signed-off-by: Andris PE +[fix S-o-b tag, fix commit author, rewrap commit message] +Signed-off-by: Jo-Philipp Wich +--- + root/usr/share/firewall4/templates/ruleset.uc | 4 ++-- + tests/01_configuration/01_ruleset | 4 ++-- + tests/01_configuration/02_rule_order | 4 ++-- + tests/02_zones/01_policies | 4 ++-- + tests/02_zones/02_masq | 4 ++-- + tests/02_zones/03_masq_src_dest_restrictions | 4 ++-- + tests/02_zones/04_masq_allow_invalid | 4 ++-- + tests/02_zones/04_wildcard_devices | 4 ++-- + tests/02_zones/05_subnet_mask_matches | 4 ++-- + tests/02_zones/06_family_selections | 4 ++-- + tests/02_zones/07_helpers | 4 ++-- + tests/03_rules/01_direction | 4 ++-- + tests/03_rules/02_enabled | 4 ++-- + tests/03_rules/03_constraints | 4 ++-- + tests/03_rules/04_icmp | 4 ++-- + tests/03_rules/05_mangle | 4 ++-- + tests/03_rules/06_subnet_mask_matches | 4 ++-- + tests/03_rules/07_redirect | 4 ++-- + tests/03_rules/08_family_inheritance | 4 ++-- + tests/03_rules/09_time | 4 ++-- + tests/03_rules/10_notrack | 4 ++-- + tests/03_rules/11_log | 4 ++-- + tests/03_rules/12_mark | 4 ++-- + tests/04_forwardings/01_family_selections | 4 ++-- + tests/05_ipsets/01_declaration | 4 ++-- + tests/05_ipsets/02_usage | 4 ++-- + tests/06_includes/01_nft_includes | 4 ++-- + tests/06_includes/02_firewall.user_include | 4 ++-- + tests/06_includes/04_disabled_include | 4 ++-- + tests/06_includes/05_automatic_includes | 4 ++-- + 30 files changed, 60 insertions(+), 60 deletions(-) + +diff --git a/root/usr/share/firewall4/templates/ruleset.uc b/root/usr/share/firewall4/templates/ruleset.uc +index f7c93fc..4210d64 100644 +--- a/root/usr/share/firewall4/templates/ruleset.uc ++++ b/root/usr/share/firewall4/templates/ruleset.uc +@@ -112,7 +112,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy {{ fw4.input_policy(true) }}; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + {% fw4.includes('chain-prepend', 'input') %} + ct state vmap { established : accept, related : accept{% if (fw4.default_option("drop_invalid")): %}, invalid : drop{% endif %} } comment "!fw4: Handle inbound flows" +@@ -154,7 +154,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy {{ fw4.output_policy(true) }}; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + {% fw4.includes('chain-prepend', 'output') %} + ct state vmap { established : accept, related : accept{% if (fw4.default_option("drop_invalid")): %}, invalid : drop{% endif %} } comment "!fw4: Handle outbound flows" +diff --git a/tests/01_configuration/01_ruleset b/tests/01_configuration/01_ruleset +index 6a30d22..c1a12c7 100644 +--- a/tests/01_configuration/01_ruleset ++++ b/tests/01_configuration/01_ruleset +@@ -110,7 +110,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets" +@@ -132,7 +132,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy accept; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option" +diff --git a/tests/01_configuration/02_rule_order b/tests/01_configuration/02_rule_order +index 7b62d68..c5c52a4 100644 +--- a/tests/01_configuration/02_rule_order ++++ b/tests/01_configuration/02_rule_order +@@ -91,7 +91,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" +@@ -109,7 +109,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" +diff --git a/tests/02_zones/01_policies b/tests/02_zones/01_policies +index 572086e..e956ad4 100644 +--- a/tests/02_zones/01_policies ++++ b/tests/02_zones/01_policies +@@ -93,7 +93,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic" +@@ -113,7 +113,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic" +diff --git a/tests/02_zones/02_masq b/tests/02_zones/02_masq +index 35d3cbc..aedc9bd 100644 +--- a/tests/02_zones/02_masq ++++ b/tests/02_zones/02_masq +@@ -97,7 +97,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic" +@@ -117,7 +117,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic" +diff --git a/tests/02_zones/03_masq_src_dest_restrictions b/tests/02_zones/03_masq_src_dest_restrictions +index 51e05db..e173601 100644 +--- a/tests/02_zones/03_masq_src_dest_restrictions ++++ b/tests/02_zones/03_masq_src_dest_restrictions +@@ -120,7 +120,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic" +@@ -138,7 +138,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic" +diff --git a/tests/02_zones/04_masq_allow_invalid b/tests/02_zones/04_masq_allow_invalid +index bdda791..d5d1ccf 100644 +--- a/tests/02_zones/04_masq_allow_invalid ++++ b/tests/02_zones/04_masq_allow_invalid +@@ -69,7 +69,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic" +@@ -85,7 +85,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic" +diff --git a/tests/02_zones/04_wildcard_devices b/tests/02_zones/04_wildcard_devices +index 22c2183..5e6809a 100644 +--- a/tests/02_zones/04_wildcard_devices ++++ b/tests/02_zones/04_wildcard_devices +@@ -120,7 +120,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic" +@@ -152,7 +152,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic" +diff --git a/tests/02_zones/05_subnet_mask_matches b/tests/02_zones/05_subnet_mask_matches +index a66ad73..55c5635 100644 +--- a/tests/02_zones/05_subnet_mask_matches ++++ b/tests/02_zones/05_subnet_mask_matches +@@ -79,7 +79,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + meta nfproto ipv6 ip6 saddr & ::ffff == ::1 ip6 saddr & ::ffff != ::2 jump input_test1 comment "!fw4: Handle test1 IPv6 input traffic" +@@ -101,7 +101,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + meta nfproto ipv6 ip6 daddr & ::ffff == ::1 ip6 daddr & ::ffff != ::2 jump output_test1 comment "!fw4: Handle test1 IPv6 output traffic" +diff --git a/tests/02_zones/06_family_selections b/tests/02_zones/06_family_selections +index 28a4894..d766be7 100644 +--- a/tests/02_zones/06_family_selections ++++ b/tests/02_zones/06_family_selections +@@ -134,7 +134,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + meta nfproto ipv4 ip saddr 10.0.0.0/8 jump input_test1 comment "!fw4: Handle test1 IPv4 input traffic" +@@ -160,7 +160,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + meta nfproto ipv4 ip daddr 10.0.0.0/8 jump output_test1 comment "!fw4: Handle test1 IPv4 output traffic" +diff --git a/tests/02_zones/07_helpers b/tests/02_zones/07_helpers +index 363aff1..e4955a1 100644 +--- a/tests/02_zones/07_helpers ++++ b/tests/02_zones/07_helpers +@@ -166,7 +166,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic" +@@ -188,7 +188,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic" +diff --git a/tests/03_rules/01_direction b/tests/03_rules/01_direction +index 4a7ba42..535ffcb 100644 +--- a/tests/03_rules/01_direction ++++ b/tests/03_rules/01_direction +@@ -69,7 +69,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + counter comment "!fw4: @rule[1]" +@@ -85,7 +85,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + counter comment "!fw4: @rule[0]" +diff --git a/tests/03_rules/02_enabled b/tests/03_rules/02_enabled +index ae2f424..9c14ed9 100644 +--- a/tests/03_rules/02_enabled ++++ b/tests/03_rules/02_enabled +@@ -66,7 +66,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -80,7 +80,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + counter comment "!fw4: Implicitly enabled" +diff --git a/tests/03_rules/03_constraints b/tests/03_rules/03_constraints +index eb3272f..76f4c0c 100644 +--- a/tests/03_rules/03_constraints ++++ b/tests/03_rules/03_constraints +@@ -105,7 +105,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -119,7 +119,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + meta nfproto ipv4 ip dscp 0x0 counter comment "!fw4: DSCP match rule #1" +diff --git a/tests/03_rules/04_icmp b/tests/03_rules/04_icmp +index b70d102..f9eec47 100644 +--- a/tests/03_rules/04_icmp ++++ b/tests/03_rules/04_icmp +@@ -75,7 +75,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -89,7 +89,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + meta l4proto { "icmp", "ipv6-icmp" } counter comment "!fw4: ICMP rule #1" +diff --git a/tests/03_rules/05_mangle b/tests/03_rules/05_mangle +index e1d27e3..fbb8141 100644 +--- a/tests/03_rules/05_mangle ++++ b/tests/03_rules/05_mangle +@@ -176,7 +176,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname { "eth0", "eth1" } jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" +@@ -194,7 +194,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname { "eth0", "eth1" } jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" +diff --git a/tests/03_rules/06_subnet_mask_matches b/tests/03_rules/06_subnet_mask_matches +index 0bedf50..b397066 100644 +--- a/tests/03_rules/06_subnet_mask_matches ++++ b/tests/03_rules/06_subnet_mask_matches +@@ -131,7 +131,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" +@@ -151,7 +151,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + ip6 saddr & ::ffff == ::1 ip6 daddr & ::ffff != ::2 counter comment "!fw4: Mask rule #1" +diff --git a/tests/03_rules/07_redirect b/tests/03_rules/07_redirect +index 80a9773..80e24bb 100644 +--- a/tests/03_rules/07_redirect ++++ b/tests/03_rules/07_redirect +@@ -163,7 +163,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" +@@ -183,7 +183,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" +diff --git a/tests/03_rules/08_family_inheritance b/tests/03_rules/08_family_inheritance +index b275ca6..679f3b9 100644 +--- a/tests/03_rules/08_family_inheritance ++++ b/tests/03_rules/08_family_inheritance +@@ -200,7 +200,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + meta nfproto ipv4 ip saddr 192.168.1.0/24 jump input_ipv4only comment "!fw4: Handle ipv4only IPv4 input traffic" +@@ -216,7 +216,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + meta nfproto ipv4 ip daddr 192.168.1.0/24 jump output_ipv4only comment "!fw4: Handle ipv4only IPv4 output traffic" +diff --git a/tests/03_rules/09_time b/tests/03_rules/09_time +index cba1914..63c7724 100644 +--- a/tests/03_rules/09_time ++++ b/tests/03_rules/09_time +@@ -137,7 +137,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -151,7 +151,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + meta time >= "2022-05-30 21:51:23" counter accept comment "!fw4: Time rule #1" +diff --git a/tests/03_rules/10_notrack b/tests/03_rules/10_notrack +index d64df11..470f922 100644 +--- a/tests/03_rules/10_notrack ++++ b/tests/03_rules/10_notrack +@@ -101,7 +101,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "eth0" jump input_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 input traffic" +@@ -123,7 +123,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "eth0" jump output_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 output traffic" +diff --git a/tests/03_rules/11_log b/tests/03_rules/11_log +index 6404a58..f777291 100644 +--- a/tests/03_rules/11_log ++++ b/tests/03_rules/11_log +@@ -112,7 +112,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -126,7 +126,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + counter log prefix "@rule[0]: " comment "!fw4: @rule[0]" +diff --git a/tests/03_rules/12_mark b/tests/03_rules/12_mark +index 1d095cf..2744096 100644 +--- a/tests/03_rules/12_mark ++++ b/tests/03_rules/12_mark +@@ -96,7 +96,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -110,7 +110,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + } +diff --git a/tests/04_forwardings/01_family_selections b/tests/04_forwardings/01_family_selections +index 54431ba..029501a 100644 +--- a/tests/04_forwardings/01_family_selections ++++ b/tests/04_forwardings/01_family_selections +@@ -90,7 +90,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "eth0" jump input_wanA comment "!fw4: Handle wanA IPv4/IPv6 input traffic" +@@ -110,7 +110,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "eth0" jump output_wanA comment "!fw4: Handle wanA IPv4/IPv6 output traffic" +diff --git a/tests/05_ipsets/01_declaration b/tests/05_ipsets/01_declaration +index cebb337..60c1514 100644 +--- a/tests/05_ipsets/01_declaration ++++ b/tests/05_ipsets/01_declaration +@@ -86,7 +86,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -100,7 +100,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + } +diff --git a/tests/05_ipsets/02_usage b/tests/05_ipsets/02_usage +index 6bff992..81ed6ed 100644 +--- a/tests/05_ipsets/02_usage ++++ b/tests/05_ipsets/02_usage +@@ -160,7 +160,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + } +@@ -180,7 +180,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + } +diff --git a/tests/06_includes/01_nft_includes b/tests/06_includes/01_nft_includes +index 275f9ee..d267f5c 100644 +--- a/tests/06_includes/01_nft_includes ++++ b/tests/06_includes/01_nft_includes +@@ -154,7 +154,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic" +@@ -172,7 +172,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic" +diff --git a/tests/06_includes/02_firewall.user_include b/tests/06_includes/02_firewall.user_include +index e822fb8..1f83b04 100644 +--- a/tests/06_includes/02_firewall.user_include ++++ b/tests/06_includes/02_firewall.user_include +@@ -91,7 +91,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic" +@@ -107,7 +107,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic" +diff --git a/tests/06_includes/04_disabled_include b/tests/06_includes/04_disabled_include +index b0072d3..5b69540 100644 +--- a/tests/06_includes/04_disabled_include ++++ b/tests/06_includes/04_disabled_include +@@ -97,7 +97,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic" +@@ -113,7 +113,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic" +diff --git a/tests/06_includes/05_automatic_includes b/tests/06_includes/05_automatic_includes +index f2b89c3..83322b9 100644 +--- a/tests/06_includes/05_automatic_includes ++++ b/tests/06_includes/05_automatic_includes +@@ -97,7 +97,7 @@ table inet fw4 { + chain input { + type filter hook input priority filter; policy drop; + +- iifname "lo" accept comment "!fw4: Accept traffic from loopback" ++ iif "lo" accept comment "!fw4: Accept traffic from loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" + iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic" +@@ -113,7 +113,7 @@ table inet fw4 { + chain output { + type filter hook output priority filter; policy drop; + +- oifname "lo" accept comment "!fw4: Accept traffic towards loopback" ++ oif "lo" accept comment "!fw4: Accept traffic towards loopback" + + ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" + oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic" +-- +2.34.1 +