v0.5.0
ci/woodpecker/tag/release Pipeline was successful
Stable
unkinben
released this
2026-10-09 23:28:54 +11:00
| 9 commits to main since this release
- Merge pull request 'Match zones defined by hosts entries' (#38) from benvin/hosts-zones into main
- Honour hosts routeback for same-interface intra-zone pairs
- Merge remote-tracking branch 'origin/main' into benvin/hosts-zones
- Merge pull request 'Accept intra-zone traffic between different interfaces' (#37) from benvin/intrazone-multi-iface into main
- Guard zone host exclusions with the address family
- Skip fw->fw policies and treat dest-side + as intra-zone override
- Match zones defined by hosts entries
- Accept intra-zone traffic between different interfaces
Downloads
v0.4.0
ci/woodpecker/tag/release Pipeline was successful
Stable
unkinben
released this
2026-10-05 21:46:58 +11:00
| 17 commits to main since this release
- Merge pull request 'Add boot unit applying a local config' (#34) from benvin/boot-unit into main
- Merge pull request 'Revert agent generations that cut off the control plane' (#35) from benvin/agent-safe-apply into main
- Merge pull request 'ci: use container-rpmbuilder image' (#36) from benvin/rpmbuilder-image into main
- ci: use container-rpmbuilder image
- Apply the cached config without safe-apply and keep reverted generations in memory
- Apply agent generations as a pending try with a revert timer
- Cap boot unit restarts so it fails open
- Revert agent generations that cut off the control plane
- Order boot unit before sysinit and retry on failure
- Add boot unit applying a local config
Downloads
v0.3.3
ci/woodpecker/tag/release Pipeline was successful
Stable
unkinben
released this
2026-10-04 18:19:06 +11:00
| 27 commits to main since this release
- Merge pull request 'Rate-limit log sites with LOGLIMIT' (#33) from benvin/loglimit into main
- Drop the name from named shorewall LOGLIMIT values
- Keep rule match extras on the limited log rule
- Rate-limit log sites with shorewall LOGLIMIT
Downloads
v0.3.2
ci/woodpecker/tag/release Pipeline was successful
Stable
unkinben
released this
2026-10-04 15:43:03 +11:00
| 31 commits to main since this release
- Merge pull request 'Create the nftables table in the configured address family' (#32) from benvin/v4-only-family into main
- Merge pull request 'Honour shorewall INVALID_DISPOSITION and UNTRACKED_DISPOSITION' (#31) from benvin/invalid-disposition into main
- Merge remote-tracking branch 'origin/main' into benvin/v4-only-family
- Merge pull request 'Fix large-batch netlink errors and revert failed try applies' (#30) from benvin/try-apply-error into main
- Create the nftables table in the configured address family
- default dispositions to continue before the nil-conf return; test bad disposition values
- honour shorewall INVALID_DISPOSITION and UNTRACKED_DISPOSITION
- Raise netlink buffers for large batches; restore snapshot when try apply fails
Downloads
v0.3.1
ci/woodpecker/tag/release Pipeline was successful
Stable
unkinben
released this
2026-10-04 15:28:05 +11:00
| 39 commits to main since this release
- Merge pull request 'Emit the implied ACCEPT for DNAT and REDIRECT rules' (#29) from benvin/dnat-implied-accept into main
- Merge remote-tracking branch 'origin/main' into benvin/dnat-implied-accept
- Merge pull request 'Accept DHCP on dhcp interfaces as shorewall does' (#27) from benvin/dhcp-option into main
- Merge pull request 'Include firewall zone in all/any rule expansion' (#28) from benvin/all-includes-fw into main
- Keep rule extras off the DNAT implied accept, expand all/any DNAT sources and match SPORT
- Expand all/any firewall pairs per zone and dedupe fw
- Count firewall-expanded all/any specs for limiter guard
- Emit the implied ACCEPT for DNAT and REDIRECT rules
- Scope DHCP accept rules to IPv4
- Include firewall zone in all/any rule expansion
- Accept DHCP on dhcp interfaces as shorewall does
Downloads
v0.3.0
ci/woodpecker/tag/release Pipeline was successful
Stable
unkinben
released this
2026-10-04 15:00:18 +11:00
| 50 commits to main since this release
- Merge pull request 'Create a Gitea release on tag' (#26) from benvin/gitea-releases into main
- Run release step on prebuilt tea image
- Merge pull request 'Attach conntrack helpers via ct helper objects' (#25) from benvin/ct-helpers into main
- Create a Gitea release with binary, RPM and checksums on tag
- Merge remote-tracking branch 'origin/main' into benvin/ct-helpers
- Merge pull request 'Compile conntrack rules into raw-priority chains' (#22) from benvin/notrack-raw into main
- Reject conntrack fw DEST without an address in prerouting
- Treat conntrack SOURCE all/any as global like an omitted source
- Reject zone exclusions in conntrack entries
- Attach conntrack helpers via ct helper objects
- Fail closed on unknown/none conntrack DEST and pair all+ symmetrically
- Merge remote-tracking branch 'origin/main' into benvin/notrack-raw
- Expand all!zone exclusions and fail closed on unknown zones
- Reject unknown and excluded zone names in rule, blrule and conntrack specs
- Merge pull request 'Bump google/nftables to v0.3.0' (#23) from benvin/nftables-v0.3.0 into main
- Merge pull request 'Match source/dest zones on conntrack rules' (#24) from benvin/conntrack-zones into benvin/notrack-raw
- Reject fw source on prerouting conntrack and pin global omitted-zone entries
- Restrict raw_output to fw sources and reject unmatched prerouting dest zones
- Match source/dest zones and addresses on conntrack rules
- bump google/nftables to v0.3.0
- Compile conntrack rules into raw-priority chains
Downloads