60 Commits

Author	SHA1	Message	Date
unkin-agent	d949fc4772	Create the nftables table in the configured address family	2026-10-04 15:36:03 +11:00
unkin-agent	87be6bc6af	Merge remote-tracking branch 'origin/main' into benvin/dnat-implied-accept ... # Conflicts: # internal/nftables/compiler.go # internal/nftables/compiler_test.go	2026-10-04 15:22:41 +11:00
benvin	599c483cd8	Merge pull request 'Accept DHCP on dhcp interfaces as shorewall does' (#27) from benvin/dhcp-option into main ... Reviewed-on: #27	2026-10-04 15:21:51 +11:00
unkin-agent	ac63f65f2f	Keep rule extras off the DNAT implied accept, expand all/any DNAT sources and match SPORT	2026-10-04 15:12:29 +11:00
unkin-agent	e3130b6c3b	Expand all/any firewall pairs per zone and dedupe fw	2026-10-04 15:10:49 +11:00
unkin-agent	df9326330a	Count firewall-expanded all/any specs for limiter guard	2026-10-04 15:08:48 +11:00
unkin-agent	b29ed2446e	Emit the implied ACCEPT for DNAT and REDIRECT rules	2026-10-04 15:08:11 +11:00
unkin-agent	0551120eec	Scope DHCP accept rules to IPv4	2026-10-04 15:07:41 +11:00
unkin-agent	ff4c9b63e8	Include firewall zone in all/any rule expansion	2026-10-04 15:06:24 +11:00
unkin-agent	e48e9079bd	Accept DHCP on dhcp interfaces as shorewall does	2026-10-04 15:06:11 +11:00
unkin-agent	b85ba61fe6	Merge remote-tracking branch 'origin/main' into benvin/ct-helpers ... # Conflicts: # internal/nftables/compiler.go # internal/nftables/compiler_test.go # internal/nftables/engine.go	2026-10-04 13:58:25 +11:00
unkin-agent	9078f410ee	Reject conntrack fw DEST without an address in prerouting	2026-10-03 23:56:29 +10:00
unkin-agent	da65c5d0a8	Treat conntrack SOURCE all/any as global like an omitted source	2026-10-03 23:54:37 +10:00
unkin-agent	90d2875301	Reject zone exclusions in conntrack entries	2026-10-03 23:53:09 +10:00
unkin-agent	c557c4b78a	Attach conntrack helpers via ct helper objects	2026-10-03 23:50:31 +10:00
unkin-agent	bf235291d0	Fail closed on unknown/none conntrack DEST and pair all+ symmetrically	2026-10-03 23:50:18 +10:00
unkin-agent	1c379bf5f1	Merge remote-tracking branch 'origin/main' into benvin/notrack-raw	2026-10-03 23:49:40 +10:00
unkin-agent	b6d67897de	Expand all!zone exclusions and fail closed on unknown zones	2026-10-03 23:48:08 +10:00
unkin-agent	9432bb05c9	Reject unknown and excluded zone names in rule, blrule and conntrack specs	2026-10-03 23:48:08 +10:00
unkin-agent	337490d995	Reject fw source on prerouting conntrack and pin global omitted-zone entries	2026-10-03 23:01:29 +10:00
unkin-agent	6af17a4c02	Restrict raw_output to fw sources and reject unmatched prerouting dest zones	2026-10-03 22:59:14 +10:00
unkin-agent	3c5f1cacd4	Match source/dest zones and addresses on conntrack rules	2026-10-03 22:56:26 +10:00
unkin-agent	445d14c61e	bump google/nftables to v0.3.0 ... Set NAT.Specified on DNAT with a port so compiled exprs match kernel readback.	2026-10-03 22:56:20 +10:00
unkin-agent	c9adff32f6	Compile conntrack rules into raw-priority chains	2026-10-03 22:54:34 +10:00
unkin-agent	5238886c6e	Merge remote-tracking branch 'origin/main' into benvin/output-oif ... # Conflicts: # internal/nftables/compiler_test.go	2026-10-03 22:46:09 +10:00
unkin-agent	036021d726	Treat only non-negated addresses as scoping interfaceless zones	2026-10-03 22:20:41 +10:00
unkin-agent	ff5a52b9e2	Reject ORIGDEST on forwarded rules and mixed-family lists	2026-10-03 22:18:48 +10:00
unkin-agent	44e1ba852e	Skip rules and policies for zones without interfaces	2026-10-03 22:18:10 +10:00
unkin-agent	34cf6dc9ab	Match ORIGDEST in DNAT and filter rules	2026-10-03 22:16:40 +10:00
unkin-agent	b5be665902	Match dest zone oif on output-chain rules and policies	2026-10-03 22:15:24 +10:00
unkin-agent	1ad025a4b7	Merge remote-tracking branch 'origin/main' into benvin/diff-expr-equality ... # Conflicts: # internal/nftables/diff.go	2026-10-03 21:16:39 +10:00
unkin-agent	aa0d3e10c2	Merge remote-tracking branch 'origin/main' into benvin/diff-expr-equality ... # Conflicts: # internal/nftables/compiler.go # internal/nftables/compiler_test.go	2026-10-03 21:15:27 +10:00
unkin-agent	abbf434af5	Merge remote-tracking branch 'origin/main' into benvin/mss-clamp-tcpopt ... # Conflicts: # internal/nftables/compiler_test.go	2026-10-03 21:14:10 +10:00
benvin	937556abeb	Merge pull request 'Add try/confirm safe-apply with out-of-process revert' (#17) from benvin/safe-apply into main ... Reviewed-on: #17	2026-10-03 21:13:57 +10:00
benvin	e6244d6bf0	Merge pull request 'Expand comma zone lists in rule source and dest' (#16) from benvin/comma-zones into benvin/multiport-multiproto ... Reviewed-on: #16	2026-10-03 21:12:52 +10:00
unkin-agent	0b92f1c2f3	Refuse mutating commands during a try and scope reverts to the try ID ... apply, flush and purge take the try lock and fail with ErrPending, which now names 'tomswall revert' as the recovery after a failed automatic revert. Each try gets an ID passed to the timer's 'revert --id', so a stale timer cannot revert a newer try. Adds tests for Revert success/failure/stale ID and for restoring a present table at the engine level.	2026-10-03 20:56:52 +10:00
unkin-agent	6ac03e1012	Persist try snapshot and arm a systemd revert timer	2026-10-03 20:52:42 +10:00
unkin-agent	7f9c010e1a	Drop agent auto-revert; skip agent apply while a try is pending	2026-10-03 20:52:42 +10:00
unkin-agent	df7ebb8efe	fix: preserve rule order in diff and insert replacements in place	2026-10-03 20:52:01 +10:00
unkin-agent	457056d58a	Pick reject type by resolved protocol number	2026-10-03 20:51:25 +10:00
unkin-agent	8efed72c96	Match exact all/any zone tokens, skip only interface-less ip zones, keep DNAT free of rule extras, reject '!' inside address lists	2026-10-03 20:50:36 +10:00
unkin-agent	ed3209681d	Load MSS option via tcpopt exthdr op in clamp rule	2026-10-03 20:50:13 +10:00
unkin-agent	852d6bf2ca	Resolve common IANA protocol names and reject ports on portless protocols	2026-10-03 20:49:54 +10:00
unkin-agent	f522589a83	Merge remote-tracking branch 'origin/benvin/multiport-multiproto' into benvin/comma-zones	2026-10-03 20:48:31 +10:00
unkin-agent	e16d95fb63	fix: compare rule expressions by value in diff	2026-10-03 20:48:29 +10:00
unkin-agent	9c30f1fa54	Reject unknown protocols and dports on mixed ICMP proto lists	2026-10-03 20:47:46 +10:00
unkin-agent	ad2dd9e3e7	Merge benvin/multiport-multiproto; reject limits on zone and address lists	2026-10-03 20:46:37 +10:00
unkin-agent	cc12c4a43a	Add try/confirm safe-apply and agent auto-revert	2026-10-03 20:45:57 +10:00
unkin-agent	211bacd507	Expand comma zone lists in rule source and dest	2026-10-03 20:45:32 +10:00
unkin-agent	30758855ff	Reject empty list elements, unknown ICMP types and limits on list rules	2026-10-03 20:45:16 +10:00