Skip to content

v0.2.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 06:35
· 24 commits to main since this release
v0.2.7
f153ec4

shorewall-nft 0.2.7 brings IPSEC zones, more upstream-compatible policy and zone columns, native standard actions, a connection lister, and three fixes for configs a user hit on a live shorewall6 box.

IPSEC zones

The ipsec, ipsec4 and ipsec6 zone types now compile. A zone is scoped to its security association, so cleartext on the tunnel interface is not in the zone. A site-to-site tunnel keys on reqid or spi, tunnel mode matches the outer addresses, and a reqid-less zone matches any SA inbound. When a cleartext zone shares the interface, decrypted traffic is excluded from it, so per-host encryption is correct. On an nft too old for the ipsec match (0.9.0) the zone is refused with a located error rather than a rule that will not load.

Upstream compatibility

The policy RATE LIMIT and CONNLIMIT columns are honoured. The zones file OPTIONS, IN OPTIONS and OUT OPTIONS columns are accepted.

Standard actions

Standard Shorewall actions are now native nftables rather than the upstream action files, which carry embedded Perl and inline iptables and cannot be expanded as-is.

  • AllowICMPs accepts the ICMP types a network needs: the RFC 4890 set on IPv6, destination-unreachable and time-exceeded on IPv4 (#14).
  • The conntrack-state actions New, Established, Related, Invalid and Untracked, and the allowInvalid and dropInvalid wrappers, match ct state.
  • Broadcast and Multicast and their allowBcast, dropBcast, allowMcast and dropMcast wrappers match the destination address type.

Monitoring

shorewall show connections lists the tracked connections. It uses the conntrack command when present and /proc/net/nf_conntrack otherwise, so there is no hard dependency on conntrack-tools.

Fixes

  • A bracketed IPv6 SNAT target, SNAT([2001:db8::1]), compiles again. It had been rejected as an invalid target since the 0.1 series.
  • A firewall with only a policy and no rules file compiles, matching upstream, instead of failing on the missing file.
  • An excluded interface primary address, !&interface, in a REDIRECT or DNAT original-destination now resolves to the interface's address set instead of a literal nft rejects (#15).
Assets 6
Loading