nss-switch: add new nss-switch tool by alexandrglm · Pull Request #29517 · openwrt/packages

alexandrglm · 2026-05-22T16:40:38Z

net/`nss-switch` PR

📦 Package Details (New package)

Maintainer: Me (Alexander Gomez alexandrglm@proton.me)

Description:
This PR is intended to introduce nss-switch availability in openWRT sources; the tool allows users to selectively bypass Hardware Acceleration (on Qualcomm qualcommax platforms) or Software Offloading (SFE) on any platform, in a visual&intuitive way right from the shell.

It works via packet marking, in collaboration with conntrack, enabling full, non-shadowed, deep packet inspection for specific-desired traffic without losing global offloading benefits.

Source info & README can be found here.

🧪 Run Testing Details

OpenWrt Version: Main, OpenWrt 25.12.2
OpenWrt Target/Subtarget: qualcommax / ipq807x
OpenWrt Device: Xiaomi AX3600

✅ Formalities

I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

It can be applied using git am
It has been refreshed to avoid offsets, fuzzes, etc., using
```
make package/<your-package>/refresh V=s
```
It is structured in a way that it is potentially upstreamable
_{(e.g., subject line, commit description, etc.)}
_{We must try to upstream patches to reduce maintenance burden.}

Amends

f0c0864: Fixed error in Makefile (prerm PATH), added SPDX header, and applied minor clean-up to the nss-ct-dump C component (tabs, empty lines).
c09c2c0: Fix Makefile (tabs) and removed core dependencies.
148a135: Initial recommendations applied, along with additional cleanups
2e4364a: Fix Makefile
d9ae4be: PR Fix suggestions from 2026-JUL, see CHANGELOG
4818d61: Commits merged/squashed into this one

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

alexandrglm · 2026-05-26T12:49:10Z

Ok, I think the review got cut short, but I can perceive a few things:

Duty to use the typical file hierarchy, bins in /usr/bin, and libs, required files, etcetera, in /usr/lib, or libexec, or share
Camel-Case and capital letters might be an issue
Check dependencies; even if they are core, like fw4
Check the use of fw4 / nftables (restart vs reload)
Maybe more things

I look forward to your recommendations, @BKPepe

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 15 comments.

alexandrglm · 2026-05-26T13:07:33Z

Exhaustive revision. Time to perform some fixes, but still in need of human revision.

alexandrglm · 2026-05-28T00:48:16Z

All proposed fixed resolved, also added new implementations (tool is now compatible with MediaTek PPE offloading, even the main target is Qualcomm NSS), cleanups, and other.
Pending for revision.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 12 comments.

alexandrglm · 2026-07-07T17:25:11Z

A few of proposal corrections were either inaccurate or conflicted with the main purpose of the application.

Anyway, these have all been addressed, alongside other fixes or improvements.

openwrt-ai

Commit checks

This PR contains two commits (2e4364a and d9ae4be), both with the identical subject nss-switch: add new nss-switch tool, and both effectively adding/updating the same new package. Each message accurately describes its own diff, but for a new-package submission OpenWrt expects a single clean commit — please squash these into one before merge.

Inline comments cover one functional issue (incomplete prerm nftables cleanup) plus two minor nits. CI: no checks have run on the head commit yet (combined status is pending, 0 checks), so nothing to flag there.

Generated by Claude Code

openwrt-ai

Fresh review of this new package at 4818d612. Flagged inline: two hex-vs-decimal mark-matching bugs (ecm.sh, conntrack.sh) that silently no-op, two undefined color variables in ui.sh, a ui_hint_bar argument that's discarded, and a validation gap where rules.conf fields are interpolated into an sh-executed script on the regeneration path. Plus two nits (bundled PR changelog, leftover debug comments in the C source). The single commit's message matches its diff.

Generated by Claude Code

openwrt-ai · 2026-07-09T12:43:48Z

+    local src_ip="$1"
+    cat /proc/net/nf_conntrack 2>/dev/null | \
+        grep "src=$src_ip " | \
+        grep -c "mark=$NSS_MARK" 2>/dev/null; true


NSS_MARK defaults to the hex string 0x00010000, but /proc/net/nf_conntrack prints the mark in decimal (mark=65536), so grep -c "mark=$NSS_MARK" never matches and ecm_is_bypassed_by_mark always reports 0. Convert both the per-line mark and NSS_MARK to decimal before comparing, the way the sibling ct_count_bypassed in conntrack.sh already does with printf '%d'.

Generated by Claude Code

openwrt-ai · 2026-07-09T12:43:52Z

+        count=$(conntrack -D -m "$NSS_MARK" 2>/dev/null | wc -l)
+    else
+        # Fallback: buscar y eliminar manualmente
+        conntrack -L 2>/dev/null | grep "mark=$NSS_MARK" | while read -r line; do


conntrack -L prints the mark in decimal too, so grep "mark=$NSS_MARK" (with NSS_MARK=0x00010000) matches nothing and this manual fallback in _ct_clear_all_marks clears zero connections. Same hex-vs-decimal mismatch as the ecm.sh grep. Convert NSS_MARK with printf '%d' before grepping (and match on the decimal value), as ct_count_bypassed does a few lines above.

Generated by Claude Code

openwrt-ai · 2026-07-09T12:44:05Z

+    local proto_c="$C_RESET"
+    case "$service_name" in
+        HTTP|HTTPS)       proto_c="$FG_GREEN" ;;
+        SSH|WG)           proto_c="$FG_CYAN" ;;


$FG_CYAN is never defined. The color block (lines 46-73) defines C_CYAN/C_MAGENTA and the FG_* set (FG_ACCENT/GREEN/RED/YELLOW/ORANGE/BRIGHT/DIM) but no FG_CYAN or FG_MAGENTA, so proto_c is left empty and SSH/WG rows render uncolored.

Suggested change

SSH|WG) proto_c="$FG_CYAN" ;;

SSH|WG) proto_c="$C_CYAN" ;;

Same on line 435: $FG_MAGENTA is also undefined — use $C_MAGENTA there.

Generated by Claude Code

openwrt-ai · 2026-07-09T12:44:10Z

+# DEBUG PR-1
+# ─── Keybind hint bar ──────────────────────────────
+ui_hint_bar() {
+    local hints="Ctrl+C / q exit • refresh every ${interval}s • Sorted by: ${sort_name} • 1-6: Sort column"


ui_hint_bar discards its argument and rebuilds hints from $interval/$sort_name. Those are only visible here via dynamic scoping from the watch caller (nss-switch.sh:196); the picker caller (ui.sh:607) sets neither, so the picker prints a bogus refresh every s • Sorted by: bar instead of its intended q=cancel / type number hint. Both call sites already pass the full string, so just use it:

Suggested change

local hints="Ctrl+C / q exit • refresh every ${interval}s • Sorted by: ${sort_name} • 1-6: Sort column"

local hints="$*"

Generated by Claude Code

openwrt-ai · 2026-07-09T12:44:21Z

+    echo 'nft_add_rules() {' >> "$FW_SCRIPT"
+
+    if [ -f "$RULES_FILE" ]; then
+        while IFS='|' read -r id proto src_ip dst_ip src_port dst_port iface persist comment; do


Fields read from rules.conf here (proto, src_ip, dst_ip, src_port, dst_port, iface) are interpolated unvalidated into the nft commands built by _nft_emit_rule (e.g. meta l4proto ${proto}, ${proto} dport ${dst_port}, ip saddr ${src_ip}), and the generated file is then executed with sh "$FW_SCRIPT" at line 181. rules_validate only runs on the interactive add/pick path, not on this regeneration path, so a hand-edited or malformed rules.conf field (the file is also a conffile) is a command-injection / malformed-command trust boundary — only comment is escaped. Consider validating each field in nft_generate_script/_nft_emit_rule before emitting.

Generated by Claude Code

openwrt-ai · 2026-07-09T12:44:25Z

@@ -0,0 +1,224 @@
+#  Changelog


nit: This is a per-PR review-iteration changelog ("Pull Request Review Fixes, Part 2", etc.) rather than user-facing package history, and it is not installed by the Makefile. openwrt/packages generally doesn't carry this kind of development meta-history in the tree — consider dropping it before merge.

Generated by Claude Code

openwrt-ai · 2026-07-09T12:44:26Z

+
+#define CONNTRACK_FILE "/proc/net/nf_conntrack"
+
+/* DEBUG PR-1 NO hardcoded values, uci get instead */


nit: For a new package, please strip the development leftovers before merge — the /* DEBUG PR-1 ... */ markers (lines 13, 18, 33, 43, 49, 157, 191, 365), the commented-out macro/prototypes (lines 14, 44-47), and the mixed Spanish debug comments throughout. They don't affect behavior but clutter the source.

Generated by Claude Code

A tool designed to manage Hardware Offload for Qualcomm NSS platforms, to permit a real non-shadowed packet inspection. While optimised for NSS-enabled hardware, it remains compatible with any other platform using Software Offloading (SFE). Signed-off-by: Alexander Gomez <alexandrglm@proton.me>

alexandrglm changed the title ~~net/nss-switch: add new nss-switch tool~~ nss-switch: add new nss-switch tool May 22, 2026

github-actions Bot added the Add package label May 22, 2026

alexandrglm force-pushed the nss-switch branch 2 times, most recently from f0c0864 to c09c2c0 Compare May 23, 2026 21:07

BKPepe requested a review from Copilot May 26, 2026 11:56

Copilot started reviewing on behalf of BKPepe May 26, 2026 12:15 View session

Copilot AI reviewed May 26, 2026

BKPepe requested a review from Copilot May 26, 2026 12:52

Copilot started reviewing on behalf of BKPepe May 26, 2026 12:52 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

alexandrglm marked this pull request as draft May 26, 2026 13:08

alexandrglm force-pushed the nss-switch branch from c09c2c0 to 148a135 Compare May 28, 2026 00:42

alexandrglm marked this pull request as ready for review May 28, 2026 00:43

BKPepe requested a review from Copilot May 28, 2026 04:46

Copilot started reviewing on behalf of BKPepe May 28, 2026 04:47 View session

Copilot AI reviewed May 28, 2026

BKPepe requested a review from Copilot June 7, 2026 23:51

Copilot started reviewing on behalf of BKPepe June 7, 2026 23:51 View session

Copilot AI reviewed Jun 8, 2026

BKPepe force-pushed the nss-switch branch from 148a135 to f8c2f7b Compare June 29, 2026 15:56

openwrt Bot added the not following guidelines label Jun 29, 2026

alexandrglm marked this pull request as draft June 30, 2026 08:18

alexandrglm force-pushed the nss-switch branch from f8c2f7b to 8a783f2 Compare July 1, 2026 10:17

BKPepe requested a review from Copilot July 1, 2026 10:18

Copilot started reviewing on behalf of BKPepe July 1, 2026 10:22 View session

alexandrglm force-pushed the nss-switch branch from 8a783f2 to 2e4364a Compare July 1, 2026 10:27

openwrt Bot removed the not following guidelines label Jul 1, 2026

alexandrglm marked this pull request as ready for review July 1, 2026 10:28

Copilot AI reviewed Jul 1, 2026

View reviewed changes

alexandrglm marked this pull request as draft July 1, 2026 10:37

alexandrglm marked this pull request as ready for review July 7, 2026 17:25

openwrt-ai reviewed Jul 9, 2026

View reviewed changes

Comment thread net/nss-switch/Makefile Outdated

Comment thread net/nss-switch/Makefile Outdated

Comment thread net/nss-switch/files/etc/config/nss-switch

alexandrglm force-pushed the nss-switch branch from d9ae4be to 4818d61 Compare July 9, 2026 10:57

alexandrglm requested a review from openwrt-ai July 9, 2026 11:04

openwrt-ai reviewed Jul 9, 2026

View reviewed changes

	local hints="Ctrl+C / q exit • refresh every ${interval}s • Sorted by: ${sort_name} • 1-6: Sort column"
	local hints="$*"


		#define CONNTRACK_FILE "/proc/net/nf_conntrack"

		/* DEBUG PR-1 NO hardcoded values, uci get instead */

Uh oh!

Conversation

alexandrglm commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

net/nss-switch PR

📦 Package Details (New package)

🧪 Run Testing Details

✅ Formalities

If your PR contains a patch:

Amends

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

alexandrglm commented May 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alexandrglm commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexandrglm commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alexandrglm commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openwrt-ai left a comment

Choose a reason for hiding this comment

Commit checks

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openwrt-ai left a comment

Choose a reason for hiding this comment

Uh oh!

openwrt-ai Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

openwrt-ai Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

openwrt-ai Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

openwrt-ai Jul 9, 2026

Choose a reason for hiding this comment

alexandrglm commented May 22, 2026 •

edited

Loading

net/`nss-switch` PR

alexandrglm commented May 26, 2026 •

edited

Loading

alexandrglm commented May 28, 2026 •

edited

Loading

alexandrglm commented Jul 7, 2026 •

edited

Loading