v1.7.0

Changelog

Features

• 3885184: feat(model,report,cmd): report a port this host forwards elsewhere (@MemorManeo)
• e3f038c: feat(policy,report,cmd): fail_on_unknown covers a forward with no ports (@MemorManeo)

Fixes

• 9f24831: fix(report): name the protocol a meta key compares against (@MemorManeo)

Other

• e45478f: docs: record how a forwarded port became an endpoint (@MemorManeo)
• bcf844c: docs(upstream): rebase the nftables patch onto current main (@MemorManeo)

v1.6.0

Changelog

Features

• 7da09ee: feat(collect,model,report): decode a hand-written dnat (@MemorManeo)

Other

• 91dbec7: test(integration): find out whether a hand-written port forward is visible (@MemorManeo)
• 02af9bb: test(integration): capture what a hand-written dnat compiles to (@MemorManeo)
• 0665898: docs: record the forwarded-port blind spot the NAT probe found (@MemorManeo)

v1.5.0

Changelog

Features

• cf58a1c: feat(model): answer tcp flags, and sweep the rest of a hand-written chain (@MemorManeo)
• 628546c: feat(collect,model): resolve meta skuid, and record why it breaks the rule (@MemorManeo)

Other

• a08867f: test(integration): ask the kernel what meta skuid does on the input path (@MemorManeo)

v1.4.0

Changelog

Fixes

• 21bf9a8: fix(collect,model): model the interface index, not just its name (@MemorManeo)
• 2e0b056: fix(model): an omitted bitwise xor is zero, not a refusal (@MemorManeo)
• c886991: fix(model): read a prefix of an address, not only the whole address (@MemorManeo)

Other

• 7212c4c: docs: prepare the upstream patch decision 0006 said whyopen owes (@MemorManeo)
• c763140: test(integration): census a hand-written ruleset (@MemorManeo)
• 917988d: test(integration): ask whether a hand-written ruleset actually resolves (@MemorManeo)
• 121f746: test(integration): make the hand-written failure a capture (@MemorManeo)
• c07db60: test(integration): log what whyopen decoded, not only what nft wrote (@MemorManeo)
• c500fa0: docs: say that both native-ruleset audiences are tested against a kernel (@MemorManeo)

v1.3.0

Changelog

Features

• 929801f: feat: decode fib, and read the routes one of its shapes needs (@MemorManeo)

Other

• bb41e94: test(integration): capture what a fib expression carries (@MemorManeo)
• a590dd8: test(integration): assert both halves of the reverse-path check (@MemorManeo)

v1.2.0

Changelog

Features

• d1e6d65: feat(collect,model): decode ct status, which a real firewalld needs (@MemorManeo)
• bb3e65e: feat(model): read an interval that runs to the top of the range (@MemorManeo)

Other

• dfe8699: test(integration): run against a real firewalld, and capture the interval whyopen refuses (@MemorManeo)
• 5c95fb4: test(integration): scope the firewalld job and make its failure a capture (@MemorManeo)
• 784d3e9: test(integration): capture the interval shapes that decide the ambiguity (@MemorManeo)

v1.1.0

Changelog

Features

• 19fff62: feat: decode ranges and interval sets, and the fourth recent mode (@MemorManeo)

Other

• 1dfc310: test(integration): capture what a range and a recent --remove really look like (@MemorManeo)
• 906d076: docs: mark expr.Range and recent --remove closed in the after-1.0 list (@MemorManeo)

v1.0.0

Changelog

Fixes

• b114da2: fix(facts,cmd): read documents from earlier builds, and write the rule down (@MemorManeo)

Other

• 3892e9b: docs: record the policy file and the decision to send packets (@MemorManeo)
• 7de6ff5: test(integration): cover the policy, --json and probe paths against a kernel (@MemorManeo)
• fbba74b: test(integration): cover a dead publish, the last fixture the spec named (@MemorManeo)
• 2006c6c: docs: state what 1.0 promises, and what it deliberately does not (@MemorManeo)

v0.6.0

Changelog

Features

• 9e15b27: feat(collect): keep the payload of extensions the library types too (@MemorManeo)

v0.5.0

Changelog

Features

• 9ea94d8: feat(collect,model): read chain hook devices so ingress narrows to them (@MemorManeo)