v2.24.0

Changelog

Features

• f9a66a0: feat(core): a forwarded rule opens its port in every family with a container network; block keeps IPv6 out (2.24 D1-D3) (@jp1337)
• b82cff9: feat(core): bridge detection learns IPv6 networks, never link-local (2.24 D4) (@jp1337)
• 84d674b: feat(core): status names a Docker network the rules in force do not know (2.24 D5) (@jp1337)
• 4ec58e8: feat: easywall-core status and the dashboard name an unknown Docker network (2.24 D5) (@jp1337)

Bug Fixes

• 6a5939b: fix(2.24): qualify IPv6-under-block claims, third closed-change, br-* IPv6 trust, bakedBridges overflow gap, demo unknown-bridge removal (@jp1337)
• 43b465a: fix(core): IPv6 proof review round 1 — prove br-ew6 has fe80:: before D4, IPv4 control under block, readable readback (@jp1337)
• a758d67: fix(core): forward-chain review round 1 — twin aliasing proof, guard parity, parse-error coverage (@jp1337)
• 63489e0: fix(core): the published-port check reads Docker's iptables-nft rules and the ip6 family (2.24 D6) (@jp1337)
• f22dac2: fix(ui-check): focus/blocked-action contrast composites a translucent backdrop instead of reading it raw (2.24 D5 review round 2) (@jp1337)
• b05fb1c: fix(web): a link inside an alert clears 3:1 focus contrast in dark mode (2.24 D5 review round 1) (@jp1337)

Other

• 412e172: Merge 2.24 Task 2: the forward chain opens a forwarded port in every family with a container network (@jp1337)
• 07104f5: Merge 2.24 Task 5: easywall-core status and the dashboard name an unknown Docker network (@jp1337)
• 860671e: Merge 2.24 Task 6: an IPv6 client reaches a named container port and no other, on a real kernel (@jp1337)
• 6b77b46: Merge 2.24 Task 7: documentation, changelog and version for 2.24.0 (@jp1337)
• 2c507d9: Revert "fix(web): a link inside an alert clears 3:1 focus contrast in dark mode (2.24 D5 review round 1)" (@jp1337)
• 39cfd48: plan, spec: 2.24 amended by the pre-dispatch plan review (@jp1337)
• b24d1df: plan: 2.24 — containers answer over IPv6 (@jp1337)
• dc5e4af: spec: 2.24 — containers answer over IPv6 (@jp1337)
• 1b0a082: test(core): an IPv6 client reaches a named container port and no other, on a real kernel (2.24) (@jp1337)
• 7247008: test(core): an xtables DNAT whose port is not flagged keeps the published port (@jp1337)
• 6a81a8c: test(core): capture the IPv4-only forward chain before 2.24 (D2 golden) (@jp1337)
• 1f7ddb4: test(core): prove the grouping branch of unknownBridges (review round 1) (@jp1337)