 unkin-agent
|
460eb20db5
|
Carve sub-zone host interfaces out of wildcard parent matches
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
|
2026-10-09 23:41:34 +11:00 |
|
|
unkin-agent
|
190ff72643
|
Exclude sub-zone hosts from wildcard parent interfaces
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-09 23:35:32 +11:00 |
|
|
unkin-agent
|
3174eabd94
|
Honour hosts routeback for same-interface intra-zone pairs
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
|
2026-10-09 23:15:50 +11:00 |
|
|
unkin-agent
|
0b68110220
|
Merge remote-tracking branch 'origin/main' into benvin/hosts-zones
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
# Conflicts:
# internal/nftables/compiler.go
# internal/nftables/compiler_test.go
|
2026-10-09 23:12:36 +11:00 |
|
|
unkin-agent
|
799c7f3524
|
Guard zone host exclusions with the address family
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-09 22:54:07 +11:00 |
|
|
unkin-agent
|
ecc349cb6f
|
Skip fw->fw policies and treat dest-side + as intra-zone override
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-09 22:48:33 +11:00 |
|
|
unkin-agent
|
695869c80b
|
Match zones defined by hosts entries
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-09 22:48:12 +11:00 |
|
|
unkin-agent
|
96a1ba8351
|
Accept intra-zone traffic between different interfaces
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
|
2026-10-09 22:45:53 +11:00 |
|
|
unkin-agent
|
be391ed385
|
Keep rule match extras on the limited log rule
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
|
2026-10-04 15:56:23 +11:00 |
|
|
unkin-agent
|
2e8d51759d
|
Rate-limit log sites with shorewall LOGLIMIT
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
|
2026-10-04 15:52:37 +11:00 |
|
|
unkin-agent
|
c3049e3ed4
|
honour shorewall INVALID_DISPOSITION and UNTRACKED_DISPOSITION
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:34:11 +11:00 |
|
|
unkin-agent
|
87be6bc6af
|
Merge remote-tracking branch 'origin/main' into benvin/dnat-implied-accept
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
# Conflicts:
# internal/nftables/compiler.go
# internal/nftables/compiler_test.go
|
2026-10-04 15:22:41 +11:00 |
|
 benvin
|
599c483cd8
|
Merge pull request 'Accept DHCP on dhcp interfaces as shorewall does' (#27) from benvin/dhcp-option into main
Reviewed-on: #27
|
2026-10-04 15:21:51 +11:00 |
|
|
unkin-agent
|
ac63f65f2f
|
Keep rule extras off the DNAT implied accept, expand all/any DNAT sources and match SPORT
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:12:29 +11:00 |
|
|
unkin-agent
|
e3130b6c3b
|
Expand all/any firewall pairs per zone and dedupe fw
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:10:49 +11:00 |
|
|
unkin-agent
|
df9326330a
|
Count firewall-expanded all/any specs for limiter guard
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:08:48 +11:00 |
|
|
unkin-agent
|
b29ed2446e
|
Emit the implied ACCEPT for DNAT and REDIRECT rules
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:08:11 +11:00 |
|
|
unkin-agent
|
0551120eec
|
Scope DHCP accept rules to IPv4
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:07:41 +11:00 |
|
|
unkin-agent
|
ff4c9b63e8
|
Include firewall zone in all/any rule expansion
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:06:24 +11:00 |
|
|
unkin-agent
|
e48e9079bd
|
Accept DHCP on dhcp interfaces as shorewall does
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-04 15:06:11 +11:00 |
|
|
unkin-agent
|
b85ba61fe6
|
Merge remote-tracking branch 'origin/main' into benvin/ct-helpers
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
# Conflicts:
# internal/nftables/compiler.go
# internal/nftables/compiler_test.go
# internal/nftables/engine.go
|
2026-10-04 13:58:25 +11:00 |
|
|
unkin-agent
|
9078f410ee
|
Reject conntrack fw DEST without an address in prerouting
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 23:56:29 +10:00 |
|
|
unkin-agent
|
da65c5d0a8
|
Treat conntrack SOURCE all/any as global like an omitted source
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 23:54:37 +10:00 |
|
|
unkin-agent
|
90d2875301
|
Reject zone exclusions in conntrack entries
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 23:53:09 +10:00 |
|
|
unkin-agent
|
c557c4b78a
|
Attach conntrack helpers via ct helper objects
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
|
2026-10-03 23:50:31 +10:00 |
|
|
unkin-agent
|
bf235291d0
|
Fail closed on unknown/none conntrack DEST and pair all+ symmetrically
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 23:50:18 +10:00 |
|
|
unkin-agent
|
1c379bf5f1
|
Merge remote-tracking branch 'origin/main' into benvin/notrack-raw
|
2026-10-03 23:49:40 +10:00 |
|
|
unkin-agent
|
b6d67897de
|
Expand all!zone exclusions and fail closed on unknown zones
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
|
2026-10-03 23:48:08 +10:00 |
|
|
unkin-agent
|
337490d995
|
Reject fw source on prerouting conntrack and pin global omitted-zone entries
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 23:01:29 +10:00 |
|
|
unkin-agent
|
6af17a4c02
|
Restrict raw_output to fw sources and reject unmatched prerouting dest zones
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:59:14 +10:00 |
|
|
unkin-agent
|
3c5f1cacd4
|
Match source/dest zones and addresses on conntrack rules
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:56:26 +10:00 |
|
|
unkin-agent
|
445d14c61e
|
bump google/nftables to v0.3.0
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
Set NAT.Specified on DNAT with a port so compiled exprs match kernel readback.
|
2026-10-03 22:56:20 +10:00 |
|
|
unkin-agent
|
c9adff32f6
|
Compile conntrack rules into raw-priority chains
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:54:34 +10:00 |
|
|
unkin-agent
|
5238886c6e
|
Merge remote-tracking branch 'origin/main' into benvin/output-oif
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
# Conflicts:
# internal/nftables/compiler_test.go
|
2026-10-03 22:46:09 +10:00 |
|
|
unkin-agent
|
036021d726
|
Treat only non-negated addresses as scoping interfaceless zones
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:20:41 +10:00 |
|
|
unkin-agent
|
ff5a52b9e2
|
Reject ORIGDEST on forwarded rules and mixed-family lists
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:18:48 +10:00 |
|
|
unkin-agent
|
44e1ba852e
|
Skip rules and policies for zones without interfaces
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:18:10 +10:00 |
|
|
unkin-agent
|
34cf6dc9ab
|
Match ORIGDEST in DNAT and filter rules
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:16:40 +10:00 |
|
|
unkin-agent
|
b5be665902
|
Match dest zone oif on output-chain rules and policies
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 22:15:24 +10:00 |
|
|
unkin-agent
|
1ad025a4b7
|
Merge remote-tracking branch 'origin/main' into benvin/diff-expr-equality
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
# Conflicts:
# internal/nftables/diff.go
|
2026-10-03 21:16:39 +10:00 |
|
|
unkin-agent
|
aa0d3e10c2
|
Merge remote-tracking branch 'origin/main' into benvin/diff-expr-equality
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
# Conflicts:
# internal/nftables/compiler.go
# internal/nftables/compiler_test.go
|
2026-10-03 21:15:27 +10:00 |
|
|
unkin-agent
|
abbf434af5
|
Merge remote-tracking branch 'origin/main' into benvin/mss-clamp-tcpopt
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
# Conflicts:
# internal/nftables/compiler_test.go
|
2026-10-03 21:14:10 +10:00 |
|
|
benvin
|
e6244d6bf0
|
Merge pull request 'Expand comma zone lists in rule source and dest' (#16) from benvin/comma-zones into benvin/multiport-multiproto
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Reviewed-on: #16
|
2026-10-03 21:12:52 +10:00 |
|
|
unkin-agent
|
df7ebb8efe
|
fix: preserve rule order in diff and insert replacements in place
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 20:52:01 +10:00 |
|
|
unkin-agent
|
457056d58a
|
Pick reject type by resolved protocol number
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 20:51:25 +10:00 |
|
|
unkin-agent
|
8efed72c96
|
Match exact all/any zone tokens, skip only interface-less ip zones, keep DNAT free of rule extras, reject '!' inside address lists
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 20:50:36 +10:00 |
|
|
unkin-agent
|
ed3209681d
|
Load MSS option via tcpopt exthdr op in clamp rule
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 20:50:13 +10:00 |
|
|
unkin-agent
|
852d6bf2ca
|
Resolve common IANA protocol names and reject ports on portless protocols
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
|
2026-10-03 20:49:54 +10:00 |
|
|
unkin-agent
|
f522589a83
|
Merge remote-tracking branch 'origin/benvin/multiport-multiproto' into benvin/comma-zones
|
2026-10-03 20:48:31 +10:00 |
|
|
unkin-agent
|
e16d95fb63
|
fix: compare rule expressions by value in diff
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
|
2026-10-03 20:48:29 +10:00 |
|