99 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
unkin-agent	15ab32431d	Drop the name from named shorewall LOGLIMIT values	2026-10-04 15:58:12 +11:00
unkin-agent	be391ed385	Keep rule match extras on the limited log rule	2026-10-04 15:56:23 +11:00
unkin-agent	2e8d51759d	Rate-limit log sites with shorewall LOGLIMIT	2026-10-04 15:52:37 +11:00
benvin	b8410488d2	Merge pull request 'Create the nftables table in the configured address family' (#32) from benvin/v4-only-family into main ... Reviewed-on: #32 v0.3.2	2026-10-04 15:43:03 +11:00
benvin	200b4d3bdf	Merge pull request 'Honour shorewall INVALID_DISPOSITION and UNTRACKED_DISPOSITION' (#31) from benvin/invalid-disposition into main ... Reviewed-on: #31	2026-10-04 15:42:40 +11:00
unkin-agent	d6dfeb62b6	Merge remote-tracking branch 'origin/main' into benvin/v4-only-family ... # Conflicts: # internal/nftables/engine.go	2026-10-04 15:40:58 +11:00
benvin	11fafc0e6a	Merge pull request 'Fix large-batch netlink errors and revert failed try applies' (#30) from benvin/try-apply-error into main ... Reviewed-on: #30	2026-10-04 15:40:08 +11:00
unkin-agent	d949fc4772	Create the nftables table in the configured address family	2026-10-04 15:36:03 +11:00
unkin-agent	2ed5b958b4	default dispositions to continue before the nil-conf return; test bad disposition values	2026-10-04 15:35:58 +11:00
unkin-agent	c3049e3ed4	honour shorewall INVALID_DISPOSITION and UNTRACKED_DISPOSITION	2026-10-04 15:34:11 +11:00
unkin-agent	fe689e99ed	Raise netlink buffers for large batches; restore snapshot when try apply fails	2026-10-04 15:34:08 +11:00
benvin	1e32bde555	Merge pull request 'Emit the implied ACCEPT for DNAT and REDIRECT rules' (#29) from benvin/dnat-implied-accept into main ... Reviewed-on: #29 v0.3.1	2026-10-04 15:28:05 +11:00
unkin-agent	87be6bc6af	Merge remote-tracking branch 'origin/main' into benvin/dnat-implied-accept ... # Conflicts: # internal/nftables/compiler.go # internal/nftables/compiler_test.go	2026-10-04 15:22:41 +11:00
benvin	599c483cd8	Merge pull request 'Accept DHCP on dhcp interfaces as shorewall does' (#27) from benvin/dhcp-option into main ... Reviewed-on: #27	2026-10-04 15:21:51 +11:00
benvin	110b109d97	Merge pull request 'Include firewall zone in all/any rule expansion' (#28) from benvin/all-includes-fw into main ... Reviewed-on: #28	2026-10-04 15:21:24 +11:00
unkin-agent	ac63f65f2f	Keep rule extras off the DNAT implied accept, expand all/any DNAT sources and match SPORT	2026-10-04 15:12:29 +11:00
unkin-agent	e3130b6c3b	Expand all/any firewall pairs per zone and dedupe fw	2026-10-04 15:10:49 +11:00
unkin-agent	df9326330a	Count firewall-expanded all/any specs for limiter guard	2026-10-04 15:08:48 +11:00
unkin-agent	b29ed2446e	Emit the implied ACCEPT for DNAT and REDIRECT rules	2026-10-04 15:08:11 +11:00
unkin-agent	0551120eec	Scope DHCP accept rules to IPv4	2026-10-04 15:07:41 +11:00
unkin-agent	ff4c9b63e8	Include firewall zone in all/any rule expansion	2026-10-04 15:06:24 +11:00
unkin-agent	e48e9079bd	Accept DHCP on dhcp interfaces as shorewall does	2026-10-04 15:06:11 +11:00
benvin	2dd408c54e	Merge pull request 'Create a Gitea release on tag' (#26) from benvin/gitea-releases into main ... Reviewed-on: #26 v0.3.0	2026-10-04 15:00:18 +11:00
unkin-agent	6fc8ae9256	Run release step on prebuilt tea image	2026-10-04 14:51:14 +11:00
benvin	b849626a8c	Merge pull request 'Attach conntrack helpers via ct helper objects' (#25) from benvin/ct-helpers into main ... Reviewed-on: #25	2026-10-04 14:17:23 +11:00
unkin-agent	da32729556	Create a Gitea release with binary, RPM and checksums on tag	2026-10-04 13:59:34 +11:00
unkin-agent	b85ba61fe6	Merge remote-tracking branch 'origin/main' into benvin/ct-helpers ... # Conflicts: # internal/nftables/compiler.go # internal/nftables/compiler_test.go # internal/nftables/engine.go	2026-10-04 13:58:25 +11:00
benvin	9abaa85d6a	Merge pull request 'Compile conntrack rules into raw-priority chains' (#22) from benvin/notrack-raw into main ... Reviewed-on: #22	2026-10-04 13:55:36 +11:00
unkin-agent	9078f410ee	Reject conntrack fw DEST without an address in prerouting	2026-10-03 23:56:29 +10:00
unkin-agent	da65c5d0a8	Treat conntrack SOURCE all/any as global like an omitted source	2026-10-03 23:54:37 +10:00
unkin-agent	90d2875301	Reject zone exclusions in conntrack entries	2026-10-03 23:53:09 +10:00
unkin-agent	c557c4b78a	Attach conntrack helpers via ct helper objects	2026-10-03 23:50:31 +10:00
unkin-agent	bf235291d0	Fail closed on unknown/none conntrack DEST and pair all+ symmetrically	2026-10-03 23:50:18 +10:00
unkin-agent	1c379bf5f1	Merge remote-tracking branch 'origin/main' into benvin/notrack-raw	2026-10-03 23:49:40 +10:00
unkin-agent	b6d67897de	Expand all!zone exclusions and fail closed on unknown zones	2026-10-03 23:48:08 +10:00
unkin-agent	9432bb05c9	Reject unknown and excluded zone names in rule, blrule and conntrack specs	2026-10-03 23:48:08 +10:00
benvin	9a7d1ab35b	Merge pull request 'Bump google/nftables to v0.3.0' (#23) from benvin/nftables-v0.3.0 into main ... Reviewed-on: #23	2026-10-03 23:45:34 +10:00
benvin	3c5d23a811	Merge pull request 'Match source/dest zones on conntrack rules' (#24) from benvin/conntrack-zones into benvin/notrack-raw ... Reviewed-on: #24	2026-10-03 23:44:11 +10:00
unkin-agent	337490d995	Reject fw source on prerouting conntrack and pin global omitted-zone entries	2026-10-03 23:01:29 +10:00
unkin-agent	6af17a4c02	Restrict raw_output to fw sources and reject unmatched prerouting dest zones	2026-10-03 22:59:14 +10:00
unkin-agent	3c5f1cacd4	Match source/dest zones and addresses on conntrack rules	2026-10-03 22:56:26 +10:00
unkin-agent	445d14c61e	bump google/nftables to v0.3.0 ... Set NAT.Specified on DNAT with a port so compiled exprs match kernel readback.	2026-10-03 22:56:20 +10:00
unkin-agent	c9adff32f6	Compile conntrack rules into raw-priority chains	2026-10-03 22:54:34 +10:00
benvin	63c46fec81	Merge pull request 'Match dest zone oif on output-chain rules and policies' (#20) from benvin/output-oif into main ... Reviewed-on: #20 v0.2.1	2026-10-03 22:51:28 +10:00
unkin-agent	5238886c6e	Merge remote-tracking branch 'origin/main' into benvin/output-oif ... # Conflicts: # internal/nftables/compiler_test.go	2026-10-03 22:46:09 +10:00
benvin	532bd80a8a	Merge pull request 'Match ORIGDEST in DNAT and filter rules' (#21) from benvin/origdest into main ... Reviewed-on: #21	2026-10-03 22:44:37 +10:00
unkin-agent	036021d726	Treat only non-negated addresses as scoping interfaceless zones	2026-10-03 22:20:41 +10:00
unkin-agent	ff5a52b9e2	Reject ORIGDEST on forwarded rules and mixed-family lists	2026-10-03 22:18:48 +10:00
unkin-agent	44e1ba852e	Skip rules and policies for zones without interfaces	2026-10-03 22:18:10 +10:00
unkin-agent	34cf6dc9ab	Match ORIGDEST in DNAT and filter rules	2026-10-03 22:16:40 +10:00