Port forward: ipset not updated when editing source IP list in port forward

[gsanchietti]

Title:
Steps to reproduce

1. Manually enter a list of allowed source IPs in a port forward (without using host set or host domain).
2. Remove an IP from the list or modify an existing one.

Expected behavior

• The IP set should be updated, reflecting the change in the firewall rules.

Actual behavior

• The IP set is not updated: the port forward still works for the removed IP.
• The IP is removed from UCI, but the change does not reflect in nft.

Workaround

Execute:

fw4 restart

Please note that a reload is not enough

Components
NethSecurity version: 8-23.05.5-ns.1.3.0

[Tbaile]

QA:

1. install the image 23.05.5-ns.1.3.0-33-gef914db
2. create a port forward with a list of source ips
3. commit changes
4. open terminal and with nft find the ipset (nft list set inet fw4 <setname>)
5. edit the port forward and commit changes
6. from the terminal, check again with nft that the record is changed.

[francio87]

Confirm fixed ✅

root@NethSec:~# nft list set inet fw4 ns_cd1c7c25_ipset
table inet fw4 {
        set ns_cd1c7c25_ipset {
                type ipv4_addr
                flags interval
                auto-merge
                elements = { 8.8.8.8, 80.17.99.73-80.17.99.75 }
        }
}

removed the ip 80.17.99.74 and save:

root@NethSec:~# uci changes
-firewall.ns_cd1c7c25_ipset
firewall.ns_cd1c7c25_ipset='ipset'
firewall.ns_cd1c7c25_ipset.name='ns_cd1c7c25_ipset'
firewall.ns_cd1c7c25_ipset.match='src_net'
firewall.ns_cd1c7c25_ipset.enabled='1'
firewall.ns_cd1c7c25_ipset.ns_link='firewall/ns_cd1c7c25'
firewall.ns_cd1c7c25_ipset.entry+='80.17.99.73'
firewall.ns_cd1c7c25_ipset.entry+='80.17.99.75'
firewall.ns_cd1c7c25_ipset.entry+='8.8.8.8/32'
-firewall.ns_cd1c7c25.proto
firewall.ns_cd1c7c25.proto+='tcp'
firewall.ns_cd1c7c25.proto+='udp'

the ipset has been updated correctly.

root@NethSec:~# nft list set inet fw4 ns_cd1c7c25_ipset
table inet fw4 {
        set ns_cd1c7c25_ipset {
                type ipv4_addr
                flags interval
                auto-merge
                elements = { 8.8.8.8, 80.17.99.73,
                             80.17.99.75 }
        }
}