adam/housecarl
Watch
1
0
Fork
You've already forked housecarl
 0
Code Issues Pull requests Projects Releases 36 Packages 2 Wiki Activity Actions
36 releases 36 tags
  • v0.1.1-rc.1 1e6c085ef9

    Housecarl v0.1.1-rc.1 Pre-release

    adam released this 2026-10-20 08:43:46 +01:00 | -20 commits to main since this release

    Added

    • Zone names at import: hc import --zone enp2s0=lan (repeat;
      interfaces given one name share a zone; Zone names on the Import
      page), and a note listing each zone and where its name came from.
      Defines holding a VLAN sub-interface (enp2s0.20) name their zone,
      and _ifname, _device and _nic are taken off define names too
      (docs/import.md, "How things are named").
    • Import: sets with flags timeout become dynamic sets; a DNAT of
      several ports becomes one port forward per port.

    Fixed

    • Import: two base chains on one hook had their rules imported twice,
      and the second chain's leading built-ins were moved above the first
      chain's rules; they now follow each other by priority (read in a
      fixed order), with the stricter policy, and a note.
    • Import: a rule inside a jumped-to chain that stays raw kept only its
      own text and so applied to everything; the jump's condition now goes
      in front. A jump and a rule matching the same field are combined only
      when one's addresses lie within the other's; else the rule stays raw.
      A jump's ports, ICMP types, connection status and hop limit were
      dropped; a limit or log on the jump is no longer silently lost.
    • Import: a second match on the same field (ip saddr A ip saddr != B)
      replaced the first; != on the hop limit and TCP flags was read as
      ==. Such rules now stay raw, as written.
    • Import: a forward-chain accept to a forwarded host and port without
      ct status dnat was folded into the port forward, which only lets
      forwarded connections through; it stays a rule now. An IPv6 accept
      limited to an interface no longer becomes a pinhole open to all.
    • Import: raw rules naming a set of the old table made nftables refuse
      the ruleset; address sets are now renamed NAME_v4/NAME_v6, other
      sets written out with their elements, and what can't be is left out
      with a note. Rules naming a set that isn't imported stay raw instead
      of failing validation.
    • Import: a DNAT to an IPv6 address, or with matches a port forward
      can't hold (an interface excluded, a limit, a log), is left out with a
      note instead of being imported without them.
    Downloads