Skip to content

v1.58.0

Choose a tag to compare

View all tags
@DannyRuizB DannyRuizB released this 16 Oct 14:36
· 3 commits to main since this release
v1.58.0
19b538a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Two new smells:

  • limit-burst-invalid (error) — --limit-burst outside 0-10,000, --hashlimit-burst outside 1-1,000,000, or nft burst 0 packets stop the file from loading. And the trap: --limit-burst 0 parses, then legacy refuses the table at COMMIT (the box boots with INPUT at ACCEPT) while nf_tables loads it and quietly applies the default burst of 5 — measured, 5 of 6 pings through a 1/hour limit.
  • ct-state-never-matches (warning) — two state lists with nothing in common (-m state --state NEW -m conntrack --ctstate ESTABLISHED, nft ct state new ct state established) load fine and never match: 0 packets of 3 real connections.

Measured with real loads (iptables 1.8.11 nf_tables + legacy, nftables 1.1.3). New sample iptables-burst-zero-dead-state.txt in the Load sample dropdown. 72 smells, tests 368. (#81)

Assets 2
Loading