57d209794e
Merge pull request 'Emit nft-decodable family guards' (#40) from benvin/nft-decodable into main
main
benvin2026-10-11 10:19:13 +11:00
78dbb6ad18
Merge remote-tracking branch 'origin/main' into benvin/nft-decodable
unkin-agent2026-10-10 01:10:37 +11:00
9aee3ad7eb
Merge pull request 'Exclude sub-zone hosts from wildcard parent interfaces' (#39) from benvin/wildcard-subzone-exclusion into main
benvin2026-10-10 01:08:33 +11:00
9bfdf292ad
Count limiter expansion after table-family filtering
unkin-agent2026-10-09 23:52:02 +11:00
bc65312647
Cover per-family expansion across rules, NAT, tunnels and blrules
unkin-agent2026-10-09 23:48:53 +11:00
9a65973d7f
Expand address matches per family, fail compile on conflicting guards
unkin-agent2026-10-09 23:48:53 +11:00
460eb20db5
Carve sub-zone host interfaces out of wildcard parent matches
unkin-agent2026-10-09 23:41:34 +11:00
42a4dab6a3
Emit one family guard per rule, none in ip/ip6 tables
unkin-agent2026-10-09 23:39:23 +11:00
0b68110220
Merge remote-tracking branch 'origin/main' into benvin/hosts-zones
unkin-agent2026-10-09 23:12:36 +11:00
70df237121
Merge pull request 'Accept intra-zone traffic between different interfaces' (#37) from benvin/intrazone-multi-iface into main
benvin2026-10-09 23:10:48 +11:00
799c7f3524
Guard zone host exclusions with the address family
unkin-agent2026-10-09 22:54:07 +11:00
ecc349cb6f
Skip fw->fw policies and treat dest-side + as intra-zone override
unkin-agent2026-10-09 22:48:33 +11:00
695869c80b
Match zones defined by hosts entries
unkin-agent2026-10-09 22:48:12 +11:00
96a1ba8351
Accept intra-zone traffic between different interfaces
unkin-agent2026-10-09 22:45:53 +11:00
afa056b454
Merge pull request 'Add boot unit applying a local config' (#34) from benvin/boot-unit into main
v0.4.0
benvin2026-10-05 21:46:58 +11:00
f593f7625d
Merge pull request 'Revert agent generations that cut off the control plane' (#35) from benvin/agent-safe-apply into main
benvin2026-10-05 21:46:08 +11:00
7c8bd87ec0
Merge pull request 'ci: use container-rpmbuilder image' (#36) from benvin/rpmbuilder-image into main
benvin2026-10-05 21:34:18 +11:00
c7e02c089a
Apply the cached config without safe-apply and keep reverted generations in memory
unkin-agent2026-10-05 13:56:11 +11:00
9092b463a0
Apply agent generations as a pending try with a revert timer
unkin-agent2026-10-05 13:52:32 +11:00
502d06bdda
Cap boot unit restarts so it fails open
unkin-agent2026-10-05 13:46:50 +11:00
4ad55fc65e
Revert agent generations that cut off the control plane
unkin-agent2026-10-05 13:46:20 +11:00
7fcbb5fad8
Order boot unit before sysinit and retry on failure
unkin-agent2026-10-05 13:44:58 +11:00
dc406c4f56
Add boot unit applying a local config
unkin-agent2026-10-05 13:41:57 +11:00
2832dd0e7d
Merge pull request 'Rate-limit log sites with LOGLIMIT' (#33) from benvin/loglimit into main
v0.3.3
benvin2026-10-04 18:19:06 +11:00
15ab32431d
Drop the name from named shorewall LOGLIMIT values
unkin-agent2026-10-04 15:58:12 +11:00
be391ed385
Keep rule match extras on the limited log rule
unkin-agent2026-10-04 15:56:23 +11:00
2e8d51759d
Rate-limit log sites with shorewall LOGLIMIT
unkin-agent2026-10-04 15:52:37 +11:00
b8410488d2
Merge pull request 'Create the nftables table in the configured address family' (#32) from benvin/v4-only-family into main
v0.3.2
benvin2026-10-04 15:43:03 +11:00
200b4d3bdf
Merge pull request 'Honour shorewall INVALID_DISPOSITION and UNTRACKED_DISPOSITION' (#31) from benvin/invalid-disposition into main
benvin2026-10-04 15:42:40 +11:00
d6dfeb62b6
Merge remote-tracking branch 'origin/main' into benvin/v4-only-family
unkin-agent2026-10-04 15:40:58 +11:00
11fafc0e6a
Merge pull request 'Fix large-batch netlink errors and revert failed try applies' (#30) from benvin/try-apply-error into main
benvin2026-10-04 15:40:08 +11:00
d949fc4772
Create the nftables table in the configured address family
unkin-agent2026-10-04 15:36:03 +11:00
2ed5b958b4
default dispositions to continue before the nil-conf return; test bad disposition values
unkin-agent2026-10-04 15:35:58 +11:00
c3049e3ed4
honour shorewall INVALID_DISPOSITION and UNTRACKED_DISPOSITION
unkin-agent2026-10-04 15:34:11 +11:00
fe689e99ed
Raise netlink buffers for large batches; restore snapshot when try apply fails
unkin-agent2026-10-04 15:34:08 +11:00
1e32bde555
Merge pull request 'Emit the implied ACCEPT for DNAT and REDIRECT rules' (#29) from benvin/dnat-implied-accept into main
v0.3.1
benvin2026-10-04 15:28:05 +11:00
87be6bc6af
Merge remote-tracking branch 'origin/main' into benvin/dnat-implied-accept
unkin-agent2026-10-04 15:22:41 +11:00
599c483cd8
Merge pull request 'Accept DHCP on dhcp interfaces as shorewall does' (#27) from benvin/dhcp-option into main
benvin2026-10-04 15:21:51 +11:00
110b109d97
Merge pull request 'Include firewall zone in all/any rule expansion' (#28) from benvin/all-includes-fw into main
benvin2026-10-04 15:21:24 +11:00
ac63f65f2f
Keep rule extras off the DNAT implied accept, expand all/any DNAT sources and match SPORT
unkin-agent2026-10-04 15:12:29 +11:00
e3130b6c3b
Expand all/any firewall pairs per zone and dedupe fw
unkin-agent2026-10-04 15:10:49 +11:00
ff4c9b63e8
Include firewall zone in all/any rule expansion
unkin-agent2026-10-04 15:06:24 +11:00
e48e9079bd
Accept DHCP on dhcp interfaces as shorewall does
unkin-agent2026-10-04 15:06:11 +11:00
2dd408c54e
Merge pull request 'Create a Gitea release on tag' (#26) from benvin/gitea-releases into main
v0.3.0
benvin2026-10-04 15:00:18 +11:00
6fc8ae9256
Run release step on prebuilt tea image
unkin-agent2026-10-04 14:51:14 +11:00
b849626a8c
Merge pull request 'Attach conntrack helpers via ct helper objects' (#25) from benvin/ct-helpers into main
benvin2026-10-04 14:17:23 +11:00
da32729556
Create a Gitea release with binary, RPM and checksums on tag
unkin-agent2026-10-04 13:59:34 +11:00
b85ba61fe6
Merge remote-tracking branch 'origin/main' into benvin/ct-helpers
unkin-agent2026-10-04 13:58:25 +11:00
9abaa85d6a
Merge pull request 'Compile conntrack rules into raw-priority chains' (#22) from benvin/notrack-raw into main
benvin2026-10-04 13:55:36 +11:00
9078f410ee
Reject conntrack fw DEST without an address in prerouting
unkin-agent2026-10-03 23:56:29 +10:00
da65c5d0a8
Treat conntrack SOURCE all/any as global like an omitted source
unkin-agent2026-10-03 23:54:37 +10:00
90d2875301
Reject zone exclusions in conntrack entries
unkin-agent2026-10-03 23:53:09 +10:00
bf235291d0
Fail closed on unknown/none conntrack DEST and pair all+ symmetrically
unkin-agent2026-10-03 23:50:18 +10:00
1c379bf5f1
Merge remote-tracking branch 'origin/main' into benvin/notrack-raw
unkin-agent2026-10-03 23:49:40 +10:00
b6d67897de
Expand all!zone exclusions and fail closed on unknown zones
unkin-agent2026-10-03 23:48:08 +10:00
9432bb05c9
Reject unknown and excluded zone names in rule, blrule and conntrack specs
unkin-agent2026-10-03 23:48:08 +10:00
9a7d1ab35b
Merge pull request 'Bump google/nftables to v0.3.0' (#23) from benvin/nftables-v0.3.0 into main
benvin2026-10-03 23:45:34 +10:00
3c5d23a811
Merge pull request 'Match source/dest zones on conntrack rules' (#24) from benvin/conntrack-zones into benvin/notrack-raw
benvin2026-10-03 23:44:11 +10:00
337490d995
Reject fw source on prerouting conntrack and pin global omitted-zone entries
unkin-agent2026-10-03 23:01:29 +10:00
6af17a4c02
Restrict raw_output to fw sources and reject unmatched prerouting dest zones
unkin-agent2026-10-03 22:59:14 +10:00
3c5f1cacd4
Match source/dest zones and addresses on conntrack rules
unkin-agent2026-10-03 22:56:26 +10:00
c9adff32f6
Compile conntrack rules into raw-priority chains
unkin-agent2026-10-03 22:54:34 +10:00
63c46fec81
Merge pull request 'Match dest zone oif on output-chain rules and policies' (#20) from benvin/output-oif into main
v0.2.1
benvin2026-10-03 22:51:28 +10:00
5238886c6e
Merge remote-tracking branch 'origin/main' into benvin/output-oif
unkin-agent2026-10-03 22:46:09 +10:00
532bd80a8a
Merge pull request 'Match ORIGDEST in DNAT and filter rules' (#21) from benvin/origdest into main
benvin2026-10-03 22:44:37 +10:00
036021d726
Treat only non-negated addresses as scoping interfaceless zones
unkin-agent2026-10-03 22:20:41 +10:00
ff5a52b9e2
Reject ORIGDEST on forwarded rules and mixed-family lists
unkin-agent2026-10-03 22:18:48 +10:00
44e1ba852e
Skip rules and policies for zones without interfaces
unkin-agent2026-10-03 22:18:10 +10:00
34cf6dc9ab
Match ORIGDEST in DNAT and filter rules
unkin-agent2026-10-03 22:16:40 +10:00
b5be665902
Match dest zone oif on output-chain rules and policies
unkin-agent2026-10-03 22:15:24 +10:00
78afe7c242
Merge pull request 'fix: stop differential apply rewriting unchanged rules' (#18) from benvin/diff-expr-equality into main
v0.2.0
benvin2026-10-03 21:24:48 +10:00
1ad025a4b7
Merge remote-tracking branch 'origin/main' into benvin/diff-expr-equality
unkin-agent2026-10-03 21:16:39 +10:00
aa0d3e10c2
Merge remote-tracking branch 'origin/main' into benvin/diff-expr-equality
unkin-agent2026-10-03 21:15:27 +10:00
3687baabe5
Merge pull request 'Fix MSS clamp loading the option as an IPv6 exthdr' (#19) from benvin/mss-clamp-tcpopt into main
benvin2026-10-03 21:15:19 +10:00
abbf434af5
Merge remote-tracking branch 'origin/main' into benvin/mss-clamp-tcpopt
unkin-agent2026-10-03 21:14:10 +10:00
937556abeb
Merge pull request 'Add try/confirm safe-apply with out-of-process revert' (#17) from benvin/safe-apply into main
benvin2026-10-03 21:13:57 +10:00
a7be035456
Merge pull request 'Match any listed port or protocol in a rule' (#15) from benvin/multiport-multiproto into main
benvin2026-10-03 21:13:10 +10:00
e6244d6bf0
Merge pull request 'Expand comma zone lists in rule source and dest' (#16) from benvin/comma-zones into benvin/multiport-multiproto
benvin2026-10-03 21:12:52 +10:00
0b92f1c2f3
Refuse mutating commands during a try and scope reverts to the try ID
unkin-agent2026-10-03 20:56:52 +10:00
6ac03e1012
Persist try snapshot and arm a systemd revert timer
unkin-agent2026-10-03 20:52:42 +10:00
7f9c010e1a
Drop agent auto-revert; skip agent apply while a try is pending
unkin-agent2026-10-03 20:52:42 +10:00
df7ebb8efe
fix: preserve rule order in diff and insert replacements in place
unkin-agent2026-10-03 20:52:01 +10:00
457056d58a
Pick reject type by resolved protocol number
unkin-agent2026-10-03 20:51:25 +10:00
8efed72c96
Match exact all/any zone tokens, skip only interface-less ip zones, keep DNAT free of rule extras, reject '!' inside address lists
unkin-agent2026-10-03 20:50:36 +10:00
ed3209681d
Load MSS option via tcpopt exthdr op in clamp rule
unkin-agent2026-10-03 20:50:13 +10:00
852d6bf2ca
Resolve common IANA protocol names and reject ports on portless protocols
unkin-agent2026-10-03 20:49:54 +10:00
f522589a83
Merge remote-tracking branch 'origin/benvin/multiport-multiproto' into benvin/comma-zones
unkin-agent2026-10-03 20:48:31 +10:00
e16d95fb63
fix: compare rule expressions by value in diff
unkin-agent2026-10-03 20:48:29 +10:00
9c30f1fa54
Reject unknown protocols and dports on mixed ICMP proto lists
unkin-agent2026-10-03 20:47:46 +10:00
ad2dd9e3e7
Merge benvin/multiport-multiproto; reject limits on zone and address lists
unkin-agent2026-10-03 20:46:37 +10:00
cc12c4a43a
Add try/confirm safe-apply and agent auto-revert
unkin-agent2026-10-03 20:45:57 +10:00
benvin
unkin-agent