v0.2.6

shorewall-nft 0.2.6

This release brings back shorewall monitor, teaches the compiler the documented upstream address-column forms, and folds in two rounds of feedback from the shorewall-users list.

shorewall monitor

shorewall monitor is back. The classic view is a refreshing text screen equivalent to upstream's, built on the standard library so it is always available. shorewall monitor fancy is a new interactive TUI (optional, needs textual): it draws a zone-flow diagram, the firewall as a hub with one weighted spoke per zone, with a live zone selector you open with o, plus a per-interface throughput and denied-chain strip below it. It reads the nftables counters (set COUNTERS=Yes) and /proc/net/dev, never a packet capture. monitor fancy --once prints a static snapshot and needs only rich.

Upstream address-column compatibility

Five documented SOURCE/DEST forms from shorewall-rules(5) now compile and match upstream behaviour, each locked against the upstream compiler by a differential corpus case: zone:[!]interface, zone:interface:address, the included!excluded exclusion, the zone:(...) grouping, and &interface (the interface's primary address, resolved at load the way upstream resolves $SW_<IF>_ADDRESS).

Fixes from the list

A DNAT whose source-zone list names an empty zone is now skipped with a warning rather than rejecting the whole configuration, matching upstream. The RATE LIMIT column now applies to DNAT and REDIRECT, so rate limiting an incoming connection works; it was silently dropped before. &interface now resolves in the DNAT and NAT address columns too, not only in a rule SOURCE or DEST, so it is no longer emitted as a literal that nft treats as a hostname. A params file that uses shell logic, a loop, an include glob or a bash builtin, is sourced through bash the way upstream sources it, so bash-form params and their .inc includes work; permissions are checked first, so REQUIRE_SECURE_CONFIG=Yes refuses a writable params before it is sourced. shorewall6 configuration paths infer the IPv6 family, and address-column errors report the offending file and line. The state directory /var/lib/shorewall-nft is now 0750, like shorewall's.

Full Changelog: v0.2.5...v0.2.6