v2.5.0

Changelog

Features

• 7d60c56: feat(core): handle SIGHUP, and read the acceptance duration per apply (@jp1337)
• 8fe5b1c: feat(core): replace the IPv6 boolean with three honest modes (@jp1337)
• a56f45b: feat(web): give the installation count somewhere to go (@jp1337)
• b40f44f: feat(web): make the first run a short pass through the choices that matter (@jp1337)

Bug Fixes

• b72f047: fix(build): make -ldflags reach the version it is setting (@jp1337)
• 7e7ab0e: fix(build): stop compiling the whole repository into both stylesheets (@jp1337)
• ce53381: fix(ci): let the layout check read the layout it is checking (@jp1337)
• 0df5c78: fix(core): bound both nft invocations, pipes included (@jp1337)
• 2965774: fix(core): bound custom-rule validation, and check a valid set in one pass (@jp1337)
• 57f7978: fix(core): correct the port-forwarding direction and honour the acceptance switch (@jp1337)
• 36592fd: fix(core): count every rate per source, not once for the whole machine (@jp1337)
• e2fbef9: fix(core): drop the broadcast traffic the option says it drops (@jp1337)
• 4dea6d9: fix(core): export the staged rule set, which is the half import replaces (@jp1337)
• 019c675: fix(core): give a packaged installation a socket and a rule store it can use (@jp1337)
• df71736: fix(core): give routed traffic a switch, instead of a chain that eats it (@jp1337)
• 4c1b5ef: fix(core): keep the staged edits through a rollback, and stop claiming a late (@jp1337)
• ac4e9e4: fix(core): lock the config, and make failures look like failures (@jp1337)
• 2287e82: fix(core): log the final drop behind the custom rules, not in front of them (@jp1337)
• 50b8c6e: fix(core): make every switch on the options page reach the firewall (@jp1337)
• 7bec12c: fix(core): make the two files only root reads readable by root only (@jp1337)
• ac38745: fix(core): persist the config under the same lock that updates it (@jp1337)
• 5e96ba3: fix(core): refuse a second apply instead of queueing it behind the window (@jp1337)
• a85dcff: fix(core): refuse rules that cannot become rules, instead of skipping them (@jp1337)
• d51d60f: fix(core): report the firewall's real state, and say what changed (@jp1337)
• d40bf5f: fix(core): roll back when the daemon stops inside an acceptance window (@jp1337)
• 58e1a79: fix(core): say when a limit is substituted, and refuse one that cannot work (@jp1337)
• 968ee64: fix(core): serialise the rules store, which was losing 187 saves in 200 (@jp1337)
• c2f5f98: fix(core): stop an imported custom rule from reaching another table (@jp1337)
• dd8248c: fix(core): stop one checkbox from leaving the host with no firewall (@jp1337)
• 2637cf1: fix(core): stop snapshot rotation from deleting the audit log (@jp1337)
• ed8e46b: fix(core): stop the bogon filter from dropping what the operator allowed (@jp1337)
• 62218a0: fix(core): validate docker custom networks on both sides (@jp1337)
• 6d2b570: fix(deb): put the binaries in the package (@jp1337)
• 15fe3fb: fix(docker): make the shipped compose file produce a working container (@jp1337)
• c7c197b: fix(docker): stop shipping a known session key and running the web process as root (@jp1337)
• 3225f94: fix(docs): one copy of each schema, describing the config easywall accepts (@jp1337)
• c3da754: fix(docs): re-render diagrams for mermaid 11.16.1, and notice next time (#107) (@jp1337)
• a906fb1: fix(packaging): make the installed package actually start (@jp1337)
• fd5ddad: fix(release): keep :latest on stable releases, and stamp images with their commit (@jp1337)
• 4bf00a8: fix(ui): let the content column shrink so wide tables scroll instead of the page (@jp1337)
• 4f285ce: fix(web): count list entries on the dashboard the way every other page does (@jp1337)
• 79737f5: fix(web): guard the web config, which every request reads and a password change writes (@jp1337)
• 1dc8b6d: fix(web): keep a rejected address list on screen, with the reasons (@jp1337)
• 4911f3b: fix(web): keep the stored hash out of the journal when it is unusable (@jp1337)
• e2b5663: fix(web): keep web.toml's documentation when easywall writes to it (@jp1337)
• 192a8fd: fix(web): make a session stop working when its cookie says it has (@jp1337)
• 201dffb: fix(web): make the demo write the audit log the core writes (@jp1337)
• 657a673: fix(web): make the logout button end the session (@jp1337)
• cf453df: fix(web): one definition of "signed in", so a refused session settles (@jp1337)
• 4935311: fix(web): refuse an unusable password hash instead of panicking on it (@jp1337)
• d378292: fix(web): refuse to start without the interface it is supposed to serve (@jp1337)
• f1bf524: fix(web): render the settings markup, and let the demo say what changed (@jp1337)
• 7492a2b: fix(web): say "unknown" when the core cannot be reached, not "idle" (@jp1337)
• 1abaa78: fix(web): stop deleting the operator's notes, and validate once for everyone (@jp1337)
• 4692dd2: fix(web): stop the browser serving the previous release's assets (@jp1337)
• d32e1d3: fix(web): stop the dashboard waiting on github, and four more claims (@jp1337)
• 6a15686: fix(web): stop the login page from telling an attacker the account name (@jp1337)
• 722ebe7: fix(web): stop the rule editors discarding rows and misreading ports (@jp1337)
• 1f5ec1a: fix(web): stop the wizard from staging a rule set that locks you out (@jp1337)

Other

• 39f3fcb: chore(deps-dev): Bump mermaid from 11.16.0 to 11.16.1 (#105) (@dependabot[bot])
• 43fa3ce: chore(docs): re-render the diagrams with the pinned mermaid (@jp1337)
• 7da89aa: chore(release): 2.5.0 (@jp1337)
• 6c7ddc1: ci: build the documentation on a pull request, not only on the way out (@jp1337)
• 929a2e3: ci: check the generated assets are the ones their sources produce (@jp1337)
• 3e0f1f8: ci: drop gosec's test-file permission findings from the alert list (@jp1337)
• 56e12d0: ci: install the package it builds, and check the interface comes up (@jp1337)
• 8afa1e7: ci: let CodeQL see the build it is analysing, and give gosec the test code (@jp1337)
• 48c9e05: ci: let the coverage uploads fail, and say which half arrived (@jp1337)
• 26df9bd: ci: let the package check read what it installed, and stop raising test findings (@jp1337)
• ddeb7d7: ci: read the generated certificate through sudo as well (@jp1337)
• 1607d94: ci: stop queueing a demo deploy for a runner that does not exist (@jp1337)
• 72eb922: test(ci): count the integration suite's coverage, and cover the log builder (@jp1337)
• 4a720f1: test: drive the interface in a browser on every push (@jp1337)