debian/changelog

   1 pve-firewall (3.0-18) unstable; urgency=medium
   2
   3   * fix #1606: Add nf_conntrack_allow_invalid option
   4
   5   * log reject : add space after policy REJECT like drop
   6
   7   * fix #1891: Add zsh command completion for pve-firewall
   8
   9  -- Proxmox Support Team <support@proxmox.com>  Mon, 04 Mar 2019 10:27:01 +0100
  10
  11 pve-firewall (3.0-17) unstable; urgency=medium
  12
  13   * fix #2005: only allow ascii port digits
  14
  15   * fix #2004: do not allow backwards ranges
  16
  17   * add conntrack logging via libnetfilter_conntrack and allow one to enable
  18     it through the firewall host configuration
  19
  20  -- Proxmox Support Team <support@proxmox.com>  Wed, 09 Jan 2019 16:56:17 +0100
  21
  22 pve-firewall (3.0-16) unstable; urgency=medium
  23
  24   * api/rules: fix macro return type
  25
  26  -- Proxmox Support Team <support@proxmox.com>  Fri, 30 Nov 2018 16:02:59 +0100
  27
  28 pve-firewall (3.0-15) unstable; urgency=medium
  29
  30   * fix #1971: display firewall rule properties
  31
  32  -- Proxmox Support Team <support@proxmox.com>  Fri, 23 Nov 2018 14:01:33 +0100
  33
  34 pve-firewall (3.0-14) unstable; urgency=medium
  35
  36   * fix #1841: avoid ebtable reloads when containers have multiple network
  37     interfaces
  38
  39  -- Proxmox Support Team <support@proxmox.com>  Fri, 24 Aug 2018 10:51:04 +0200
  40
  41 pve-firewall (3.0-13) unstable; urgency=medium
  42
  43   * avoid unnecessary reloads of ebtable ruleset
  44
  45  -- Proxmox Support Team <support@proxmox.com>  Thu, 28 Jun 2018 14:47:16 +0200
  46
  47 pve-firewall (3.0-12) unstable; urgency=medium
  48
  49   * fix deleted iptables chains not being properly detected as a change
  50
  51  -- Proxmox Support Team <support@proxmox.com>  Tue, 12 Jun 2018 12:01:02 +0200
  52
  53 pve-firewall (3.0-11) unstable; urgency=medium
  54
  55   * #1764: rename 'ebtales_enable' option to 'ebtables'
  56
  57  -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Jun 2018 16:18:13 +0200
  58
  59 pve-firewall (3.0-10) unstable; urgency=medium
  60
  61   * fix #1764: handle existing ebtables rules and allow disabling ebtables
  62
  63   * ebtables handling can be disabled via /etc/pve/firewall/cluster.fw's new
  64     ebtables_enable option.
  65
  66  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 May 2018 15:14:33 +0200
  67
  68 pve-firewall (3.0-9) unstable; urgency=medium
  69
  70   * fix creation of ebltables FORWARD rule entry
  71
  72  -- Proxmox Support Team <support@proxmox.com>  Thu, 17 May 2018 14:41:27 +0200
  73
  74 pve-firewall (3.0-8) unstable; urgency=medium
  75
  76   * add ebtables support for better MAC filtering
  77
  78  -- Proxmox Support Team <support@proxmox.com>  Wed, 11 Apr 2018 14:25:41 +0200
  79
  80 pve-firewall (3.0-7) unstable; urgency=medium
  81
  82   * support distinct source and destination multi-port matching
  83
  84   * multi-port matching: when specifying the same list of ports for source and
  85     destination require them both to match, rather than one of them, as this
  86     was rather unexpected behavior
  87
  88  -- Proxmox Support Team <support@proxmox.com>  Mon, 12 Mar 2018 14:58:08 +0100
  89
  90 pve-firewall (3.0-6) unstable; urgency=medium
  91
  92   * fix #1319: don't fail postinst with masked service
  93
  94   * debian: switch to compat 9, drop init scripts, drop preinst
  95
  96   * check multiport limit in port ranges
  97
  98   * build: use git rev-parse for GITVERSION
  99
 100  -- Proxmox Support Team <support@proxmox.com>  Thu, 08 Mar 2018 13:53:11 +0100
 101
 102 pve-firewall (3.0-5) unstable; urgency=medium
 103
 104   * fix issue with disabled flag not being honored within groups
 105
 106  -- Proxmox Support Team <support@proxmox.com>  Thu, 07 Dec 2017 08:31:42 +0100
 107
 108 pve-firewall (3.0-4) unstable; urgency=medium
 109
 110   * fix issues with ipsets reloading unnecessarily or too late
 111
 112   * fix some typos in the logs
 113
 114  -- Proxmox Support Team <support@proxmox.com>  Thu, 16 Nov 2017 11:41:56 +0100
 115
 116 pve-firewall (3.0-3) unstable; urgency=medium
 117
 118   * Fix #1492: logger: use current timestamp if the packet doesn't have one
 119
 120  -- Proxmox Support Team <support@proxmox.com>  Tue, 12 Sep 2017 14:43:06 +0200
 121
 122 pve-firewall (3.0-2) unstable; urgency=medium
 123
 124   * Fix #1446: remove masks in case the package had previously been removed but
 125     not purged.
 126
 127   * improve logging on errors in the firewall configuration
 128
 129   * forbid trailing commas in lists as iptables-restore doesn't support them
 130
 131  -- Proxmox Support Team <support@proxmox.com>  Mon, 17 Jul 2017 15:24:40 +0200
 132
 133 pve-firewall (3.0-1) unstable; urgency=medium
 134
 135   * rebuild for Debian Stretch
 136
 137  -- Proxmox Support Team <support@proxmox.com>  Thu, 9 Mar 2017 14:04:17 +0100
 138
 139 pve-firewall (2.0-33) unstable; urgency=medium
 140
 141   * ipset: don't allow zero-prefix entries
 142
 143  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 Nov 2016 12:18:04 +0100
 144
 145 pve-firewall (2.0-32) unstable; urgency=medium
 146
 147   * improve search for local-network
 148
 149  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 Nov 2016 06:35:08 +0100
 150
 151 pve-firewall (2.0-31) unstable; urgency=medium
 152
 153   * don't try to apply ports to rules which don't support them
 154
 155  -- Proxmox Support Team <support@proxmox.com>  Thu, 06 Oct 2016 08:31:51 +0200
 156
 157 pve-firewall (2.0-30) unstable; urgency=medium
 158
 159   * add multicast DNS to the list of Macros
 160
 161   * add missing parameter descriptions
 162
 163   * build-depends: add dh-systemd
 164
 165  -- Proxmox Support Team <support@proxmox.com>  Fri, 16 Sep 2016 08:53:16 +0200
 166
 167 pve-firewall (2.0-29) unstable; urgency=medium
 168
 169   * prevent overwriting ipsets/sec. groups by renaming
 170
 171  -- Proxmox Support Team <support@proxmox.com>  Fri, 03 Jun 2016 16:46:10 +0200
 172
 173 pve-firewall (2.0-28) unstable; urgency=medium
 174
 175   * use pve-common's ipv4_mask_hash_localnet
 176
 177   * fix allowed group name length
 178
 179   * make group digest stable
 180
 181  -- Proxmox Support Team <support@proxmox.com>  Fri, 03 Jun 2016 11:01:47 +0200
 182
 183 pve-firewall (2.0-27) unstable; urgency=medium
 184
 185   * fix #972: make PVEFW-FWBR-* rule order stable
 186
 187  -- Proxmox Support Team <support@proxmox.com>  Tue, 17 May 2016 07:59:52 +0200
 188
 189 pve-firewall (2.0-26) unstable; urgency=medium
 190
 191   * fix #988: set rp_filter=2
 192
 193  -- Proxmox Support Team <support@proxmox.com>  Mon, 09 May 2016 10:01:28 +0200
 194
 195 pve-firewall (2.0-25) unstable; urgency=medium
 196
 197   * fix #945: add uninitialized check in lxc ipset compilation
 198
 199  -- Proxmox Support Team <support@proxmox.com>  Thu, 21 Apr 2016 09:58:33 +0200
 200
 201 pve-firewall (2.0-24) unstable; urgency=medium
 202
 203   * Build-Depend on pve-doc-generator
 204
 205   * generate manpage with pve-doc-generator
 206
 207  -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Apr 2016 10:52:45 +0200
 208
 209 pve-firewall (2.0-23) unstable; urgency=medium
 210
 211   * use only the top bit for our accept marks
 212
 213  -- Proxmox Support Team <support@proxmox.com>  Fri, 01 Apr 2016 07:35:38 +0200
 214
 215 pve-firewall (2.0-22) unstable; urgency=medium
 216
 217   * Use cfs_config_path from PVE::QemuConfig
 218
 219  -- Proxmox Support Team <support@proxmox.com>  Tue, 08 Mar 2016 11:47:40 +0100
 220
 221 pve-firewall (2.0-21) unstable; urgency=medium
 222
 223   * added new 'ipfilter' option
 224
 225  -- Proxmox Support Team <support@proxmox.com>  Thu, 03 Mar 2016 09:43:39 +0100
 226
 227 pve-firewall (2.0-20) unstable; urgency=medium
 228
 229   * fix 901: encode unicode characters in sha digest
 230
 231  -- Proxmox Support Team <support@proxmox.com>  Mon, 29 Feb 2016 12:40:14 +0100
 232
 233 pve-firewall (2.0-19) unstable; urgency=medium
 234
 235   * Add radv option to VM options
 236
 237  -- Proxmox Support Team <support@proxmox.com>  Sat, 27 Feb 2016 10:24:42 +0100
 238
 239 pve-firewall (2.0-18) unstable; urgency=medium
 240
 241   * Add ndp option to host and VM firewall options
 242
 243   * Add router-solicitation to NeighborDiscovery macro
 244
 245  -- Proxmox Support Team <support@proxmox.com>  Fri, 19 Feb 2016 10:01:22 +0100
 246
 247 pve-firewall (2.0-17) unstable; urgency=medium
 248
 249   * Don't leave empty FW config files behind
 250
 251  -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Feb 2016 14:09:24 +0100
 252
 253 pve-firewall (2.0-16) unstable; urgency=medium
 254
 255   * logger: basic ipv6 support
 256
 257   * add DHCPv6 macro
 258
 259   * add dhcpv6 support to the dhcp option
 260
 261  -- Proxmox Support Team <support@proxmox.com>  Tue, 26 Jan 2016 16:52:14 +0100
 262
 263 pve-firewall (2.0-15) unstable; urgency=medium
 264
 265   * fix bug #859: use $security_group_name_pattern in iptables_get_chains
 266
 267   * fix some regular expressions mixups
 268
 269  -- Proxmox Support Team <support@proxmox.com>  Thu, 07 Jan 2016 16:33:23 +0100
 270
 271 pve-firewall (2.0-14) unstable; urgency=medium
 272
 273   * fix systemd service dependencies
 274
 275  -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Nov 2015 10:52:57 +0100
 276
 277 pve-firewall (2.0-13) unstable; urgency=medium
 278
 279   * allow numeric icmp types
 280
 281  -- Proxmox Support Team <support@proxmox.com>  Fri, 23 Oct 2015 13:21:53 +0200
 282
 283 pve-firewall (2.0-12) unstable; urgency=medium
 284
 285   * implement bash completions
 286
 287   * convert pve-firewall into a PVE::Service class
 288
 289  -- Proxmox Support Team <support@proxmox.com>  Thu, 24 Sep 2015 12:15:00 +0200
 290
 291 pve-firewall (2.0-11) unstable; urgency=medium
 292
 293   * iptables_get_chains: fix veth device name
 294
 295  -- Proxmox Support Team <support@proxmox.com>  Tue, 08 Sep 2015 07:54:35 +0200
 296
 297 pve-firewall (2.0-10) unstable; urgency=medium
 298
 299   * new helper: clone_vmfw_conf()
 300
 301  -- Proxmox Support Team <support@proxmox.com>  Tue, 25 Aug 2015 06:47:49 +0200
 302
 303 pve-firewall (2.0-9) unstable; urgency=medium
 304
 305   * remove firewall config file subroutine added
 306
 307  -- Proxmox Support Team <support@proxmox.com>  Wed, 19 Aug 2015 15:42:51 +0200
 308
 309 pve-firewall (2.0-8) unstable; urgency=medium
 310
 311   * adopt regresion tests for lxc containers
 312
 313   * removed firewall code for openVZ
 314
 315   *  Subroutine verify_rule fixed to correctly check only for "net\d+"
 316   interface device names
 317
 318  -- Proxmox Support Team <support@proxmox.com>  Wed, 12 Aug 2015 12:01:43 +0200
 319
 320 pve-firewall (2.0-7) unstable; urgency=medium
 321
 322   * added firewall code for lxc
 323
 324  -- Proxmox Support Team <support@proxmox.com>  Mon, 10 Aug 2015 09:21:14 +0200
 325
 326 pve-firewall (2.0-6) unstable; urgency=medium
 327
 328   * firewall ipversion comparison fix
 329
 330  -- Proxmox Support Team <support@proxmox.com>  Tue, 04 Aug 2015 11:14:51 +0200
 331
 332 pve-firewall (2.0-5) unstable; urgency=medium
 333
 334   * add ipv6 neighbor discovery and solicitation macros
 335
 336   * ip6tables accepts both spellings of the word neighbor
 337
 338   * added Ceph macro
 339
 340  -- Proxmox Support Team <support@proxmox.com>  Mon, 27 Jul 2015 13:20:55 +0200
 341
 342 pve-firewall (2.0-4) unstable; urgency=medium
 343
 344   * include manual page for pve-firewall
 345
 346  -- Proxmox Support Team <support@proxmox.com>  Sat, 27 Jun 2015 16:26:28 +0200
 347
 348 pve-firewall (2.0-3) unstable; urgency=medium
 349
 350   * use noawait trigers for pve-api-updates
 351
 352  -- Proxmox Support Team <support@proxmox.com>  Mon, 01 Jun 2015 12:33:06 +0200
 353
 354 pve-firewall (2.0-2) unstable; urgency=medium
 355
 356   * trigger pve-api-updates event
 357
 358  -- Proxmox Support Team <support@proxmox.com>  Tue, 05 May 2015 15:10:24 +0200
 359
 360 pve-firewall (2.0-1) unstable; urgency=medium
 361
 362   * recompile for debian jessie
 363
 364  -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Feb 2015 12:22:04 +0100
 365
 366 pve-firewall (1.0-18) unstable; urgency=low
 367
 368   * fix alias lookup
 369
 370  -- Proxmox Support Team <support@proxmox.com>  Mon, 09 Feb 2015 09:32:03 +0100
 371
 372 pve-firewall (1.0-17) unstable; urgency=low
 373
 374   * fix restart behavior
 375
 376  -- Proxmox Support Team <support@proxmox.com>  Thu, 15 Jan 2015 06:45:58 +0100
 377
 378 pve-firewall (1.0-16) unstable; urgency=low
 379
 380   * use new Daemon class from pve-common
 381
 382  -- Proxmox Support Team <support@proxmox.com>  Thu, 18 Dec 2014 09:45:07 +0100
 383
 384 pve-firewall (1.0-15) unstable; urgency=low
 385
 386   * bug fix: load cluster conf for host rules
 387
 388  -- Proxmox Support Team <support@proxmox.com>  Fri, 12 Dec 2014 06:33:28 +0100
 389
 390 pve-firewall (1.0-14) unstable; urgency=low
 391
 392   *  do not use ipset list chains
 393
 394   *  remove preinst script (not needed anymore)
 395
 396  -- Proxmox Support Team <support@proxmox.com>  Fri, 05 Dec 2014 13:42:00 +0100
 397
 398 pve-firewall (1.0-13) unstable; urgency=low
 399
 400   * fix ipset remove order
 401
 402  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 12:45:48 +0100
 403
 404 pve-firewall (1.0-12) unstable; urgency=low
 405
 406   * add preinst script to clear ipset from older installation (because
 407     sets cannot be swapped if there type does not match.
 408
 409  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 08:59:38 +0100
 410
 411 pve-firewall (1.0-11) unstable; urgency=low
 412
 413   * bug fix: correctly set ipversion for aliases in verify_rule
 414
 415   * save restore commands into files to make debugging
 416     easier (/var/lib/pve-firewall/)
 417
 418  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 08:04:05 +0100
 419
 420 pve-firewall (1.0-10) unstable; urgency=low
 421
 422   * add IPv6 support for VMs (hostfw is IPv4 only)
 423
 424  -- Proxmox Support Team <support@proxmox.com>  Wed, 26 Nov 2014 07:00:29 +0100
 425
 426 pve-firewall (1.0-9) unstable; urgency=low
 427
 428   * fix max ipset name name length
 429
 430  -- Proxmox Support Team <support@proxmox.com>  Tue, 14 Oct 2014 16:29:34 +0200
 431
 432 pve-firewall (1.0-8) unstable; urgency=low
 433
 434   * implement permission
 435
 436  -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Sep 2014 12:15:21 +0200
 437
 438 pve-firewall (1.0-7) unstable; urgency=low
 439
 440   * proxy host rule API calls to correct node
 441
 442   * always generate MAC and IP filter rules if firewall is enabled on NIC
 443
 444  -- Proxmox Support Team <support@proxmox.com>  Thu, 26 Jun 2014 07:12:57 +0200
 445
 446 pve-firewall (1.0-6) unstable; urgency=low
 447
 448   * ipmlement ipfilter ipsets
 449
 450  -- Proxmox Support Team <support@proxmox.com>  Thu, 12 Jun 2014 08:37:08 +0200
 451
 452 pve-firewall (1.0-5) unstable; urgency=low
 453
 454   * remove ipsets when firewall disabled
 455
 456  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 08:50:18 +0200
 457
 458 pve-firewall (1.0-4) unstable; urgency=low
 459
 460   * depend on iptables and ipset
 461
 462  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 06:45:33 +0200
 463
 464 pve-firewall (1.0-3) unstable; urgency=low
 465
 466   * change dh_installinit order (register pvefw-logger before pve-firewall)
 467
 468  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 06:24:21 +0200
 469
 470 pve-firewall (1.0-2) unstable; urgency=low
 471
 472   * add experimental nflog logging daemon
 473
 474  -- Proxmox Support Team <support@proxmox.com>  Thu, 13 Mar 2014 08:27:01 +0100
 475
 476 pve-firewall (1.0-1) unstable; urgency=low
 477
 478   * initial package
 479
 480  -- Proxmox Support Team <support@proxmox.com>  Mon, 03 Mar 2014 08:37:06 +0100
 481