Skip to content

v0.2.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jul 04:59
· 55 commits to main since this release
v0.2.5
6bbaed9

shorewall-nft 0.2.5

Support for older nftables, so a mixed Debian and Ubuntu fleet moves to shorewall-nft with one package and one configuration.

Debian 10, Debian 11 and Ubuntu 20.04 ship nftables between 0.9.0 and 0.9.8, below the 1.0.2 baseline. shorewall-nft now probes the local nft and kernel and emits the ruleset form they can load, chosen per box. A modern release keeps today's output unchanged; an older one gets an equivalent ruleset.

What the compiler adapts on an older nft:

  • Numeric chain priorities in place of the names nft 0.9.0 lacks.
  • Bitwise tcp flags (tcp flags & (syn|rst) == syn) in place of the mask shorthand nft 0.9.x cannot parse.
  • Plain dnat to without the ip/ip6 qualifier, which nft 0.9.0 rejects.
  • A de-concatenated zone dispatch (one rule per interface pair) where the kernel has no set concatenation, as on Debian 10's stock 4.19 kernel.

Two features need a newer nftables than the oldest releases ship. They are refused at check time with a clear, located message, never emitted as rules that fail to load: NETMAP needs nftables 0.9.5 (Ubuntu 20.04 has 0.9.3), and ECN control needs tcp flag names added after 0.9.0 (Debian 10). The rest of the configuration compiles and loads.

Every choice is driven by a capability probe that loads a test construct, so a kernel gap counts as well as a parser gap. Compat CI now installs on each release and loads every corpus ruleset with that release's own nftables, including a forced-legacy pass on the oldest userspaces. The package also depends on netbase, which provides /etc/protocols for resolving ipv6-icmp.

See docs/design/legacy-nft.md for the design and the measured capability map.

Full Changelog: v0.2.4...v0.2.5

Assets 6
Loading