v0.2.4

shorewall-nft 0.2.4

Three fixes from shorewall-users feedback (thanks, Winston Sorfleet).

rules: the all/any meta-zone with an address restriction. A rule like DROP net all:192.168.45.0/24 failed with unknown zone all. The parser recognised the all/any catch-all only when it stood alone, not when it carried an address. It now splits the address off first, in both rules and blrules, and the address is applied across the expanded zone pairs.

shorewall6 rtrules: bracketed IPv6 addresses. An rtrules SOURCE or DEST like [2607:f2c0:f00e:b700::/64] failed with invalid interface name '[2607'. The brackets exist precisely to keep the address colons out of the interface:address split; the parser now strips them and also handles the interface:[address] combined form.

interfaces: rpfilter is now enforced. The rpfilter option was accepted but warned as not applied. It now emits a strict reverse-path check (fib saddr . iif oif missing drop) per flagged interface, disposed via RPFILTER_DISPOSITION. Established traffic is exempt, so asymmetric return traffic on a multi-ISP box is not caught, and a DHCP client handshake is let through, both matching upstream. sfilter and norfc1918 remain accepted but warned; for anti-spoofing on older setups routefilter (the kernel rp_filter sysctl) is also available.

Full Changelog: v0.2.3...v0.2.4