v2.7.0

Changelog

Features

• 4d46389: feat(core): a marker that says the machine is deliberately unfiltered (@jp1337)
• 5a52834: feat(core): easywall-core status, panic and resume (@jp1337)
• 7707cef: feat(core): panic and resume (@jp1337)
• 2aafeac: feat(core): put the stored rules back at startup (@jp1337)
• 5d66977: feat(core): restore again if the docker bridges arrive late (@jp1337)
• 961815b: feat(core): restore the stored rules without an acceptance window (@jp1337)
• c5b5e80: feat(core): the console tool works with no daemon running (@jp1337)
• 74ce0ff: feat(shared): PANIC and RESUME, the sixteenth and seventeenth commands (@jp1337)
• 0530335: feat(web): make the server side aware of panic mode (@jp1337)
• bdc2833: feat(web): show panic mode in the topbar on every authenticated page (@jp1337)

Bug Fixes

• 5f1999e: fix(core): a failed panic teardown is recorded under the action coloured for it (@jp1337)
• a684812: fix(core): a panic entry records the teardown that happened, not the one intended (@jp1337)
• 5d2beb4: fix(core): a rollback torn down by panic mode is coloured like every other one (@jp1337)
• 9b51364: fix(core): a rollback under panic mode still reverts the rules file (@jp1337)
• 914c2f4: fix(core): an unreadable panic marker no longer withdraws the rollback (@jp1337)
• ff43e2e: fix(core): bootBridges reflects the most recent restore, and the deadline test proves the deadline fired (@jp1337)
• ba73570: fix(core): console output needs no linter exemption, and resume proves what it prints (@jp1337)
• 88f3cc7: fix(core): daemonAbsent had no test that could catch a wrong verdict, its comment overstated what a refused socket proves, and the panic fallback wrote nothing to the audit log (@jp1337)
• 34e460c: fix(core): make the panic refusal reach the caller, and fix its tests (@jp1337)
• 2ef2550: fix(core): panic mode outranks an in-flight apply (@jp1337)
• 66d088f: fix(core): record a failed restore that never reached the kernel (@jp1337)
• e1b7e93: fix(core): restore happens before the socket exists (@jp1337)
• 905091e: fix(core): restore lifecycle improvements for correctness (@jp1337)
• 5cb8819: fix(core): restore's wait ends when the restore does (@jp1337)
• b5a485f: fix(core): rollback_skipped reports the revert it made, not the one it attempted (@jp1337)
• 7051d88: fix(core): the panic marker is re-read after every write to the table (@jp1337)
• 89e8b57: fix(core): the panic marker is re-read on the paths that report failure too (@jp1337)
• b2a73b6: fix(core): the panic marker reaches the disk before EngagePanic returns (@jp1337)
• 4c6ccdf: fix(core): the unreadable-marker log line stays where its text is true (@jp1337)
• 914fb12: fix(shared): PANIC waits for nft, RESUME does not (@jp1337)
• e9a4956: fix(shared): one list of commands, three consumers (@jp1337)
• 16b2281: fix(shared): the command list cannot silently lose an entry (@jp1337)
• 5a19c0c: fix(shared): the regex for command declarations cannot silently skip a line (@jp1337)
• 1e09a58: fix(web): show timestamps in the operator's zone, not in UTC (@jp1337)
• 6c08cef: fix(web): the demo stores time the way the core does (@jp1337)

Other

• 915c68a: Merge origin/main: reconcile the Jekyll docs restructure with 2.7.0 (@jp1337)
• 91f9ed9: chore(release): 2.7.0 (@jp1337)
• 98c6dff: chore: ignore local agent-runner directories (@jp1337)
• 7423f41: chore: ignore the git worktree directory (@jp1337)
• 01bdb48: refactor(shared): one socket transport for both callers (@jp1337)
• bd8d736: test(cmd): the no-daemon fallback's audit user string is pinned (@jp1337)
• ceb42b5: test(core): a reboot, measured by whether the rules come back (@jp1337)
• 7a5ea1e: test(core): assert the restored port carries the accept verdict, not just its number (@jp1337)
• 4ec9d19: test(core): every kernel write is pinned to the panic check that follows it (@jp1337)
• 87e4220: test(core): the boot restore's position in Daemon.Start is pinned by its source (@jp1337)
• c9da00c: test(web): remove a flaky window, document the TZ cache trap, pin the day-boundary case (@jp1337)
• fd2d5dd: test: point the doc-guard tests at the moved /docs paths (@jp1337)