debian/changelog

   1 pve-firewall (3.0-21) unstable; urgency=medium
   2
   3   * fix ipv6 PVEFW-reject
   4
   5   * fix #2193: arpfilter: CT: remove mask from net IP/CIDR to avoid
   6     ebtables doing the wrong thing here
   7
   8  -- Proxmox Support Team <support@proxmox.com>  Wed, 08 May 2019 10:09:31 +0000
   9
  10 pve-firewall (3.0-20) unstable; urgency=medium
  11
  12   * use IPCC to read config and rule files, if the are backed by pmxcfs which
  13     has better handling for pmxcfs restarts
  14
  15   * fix #2178: endless loop on ipv6 extension headers
  16
  17  -- Proxmox Support Team <support@proxmox.com>  Fri, 19 Apr 2019 05:10:13 +0000
  18
  19 pve-firewall (3.0-19) unstable; urgency=medium
  20
  21   * ebtables: add arp filtering
  22
  23   * fix: #2123 Logging of user defined firewall rules
  24
  25   * fix Razor macro
  26
  27   * allow to enable/disable and modify cluster wide log ratelimits
  28
  29  -- Proxmox Support Team <support@proxmox.com>  Tue, 02 Apr 2019 11:15:16 +0200
  30
  31 pve-firewall (3.0-18) unstable; urgency=medium
  32
  33   * fix #1606: Add nf_conntrack_allow_invalid option
  34
  35   * log reject : add space after policy REJECT like drop
  36
  37   * fix #1891: Add zsh command completion for pve-firewall
  38
  39  -- Proxmox Support Team <support@proxmox.com>  Mon, 04 Mar 2019 10:27:01 +0100
  40
  41 pve-firewall (3.0-17) unstable; urgency=medium
  42
  43   * fix #2005: only allow ascii port digits
  44
  45   * fix #2004: do not allow backwards ranges
  46
  47   * add conntrack logging via libnetfilter_conntrack and allow one to enable
  48     it through the firewall host configuration
  49
  50  -- Proxmox Support Team <support@proxmox.com>  Wed, 09 Jan 2019 16:56:17 +0100
  51
  52 pve-firewall (3.0-16) unstable; urgency=medium
  53
  54   * api/rules: fix macro return type
  55
  56  -- Proxmox Support Team <support@proxmox.com>  Fri, 30 Nov 2018 16:02:59 +0100
  57
  58 pve-firewall (3.0-15) unstable; urgency=medium
  59
  60   * fix #1971: display firewall rule properties
  61
  62  -- Proxmox Support Team <support@proxmox.com>  Fri, 23 Nov 2018 14:01:33 +0100
  63
  64 pve-firewall (3.0-14) unstable; urgency=medium
  65
  66   * fix #1841: avoid ebtable reloads when containers have multiple network
  67     interfaces
  68
  69  -- Proxmox Support Team <support@proxmox.com>  Fri, 24 Aug 2018 10:51:04 +0200
  70
  71 pve-firewall (3.0-13) unstable; urgency=medium
  72
  73   * avoid unnecessary reloads of ebtable ruleset
  74
  75  -- Proxmox Support Team <support@proxmox.com>  Thu, 28 Jun 2018 14:47:16 +0200
  76
  77 pve-firewall (3.0-12) unstable; urgency=medium
  78
  79   * fix deleted iptables chains not being properly detected as a change
  80
  81  -- Proxmox Support Team <support@proxmox.com>  Tue, 12 Jun 2018 12:01:02 +0200
  82
  83 pve-firewall (3.0-11) unstable; urgency=medium
  84
  85   * #1764: rename 'ebtales_enable' option to 'ebtables'
  86
  87  -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Jun 2018 16:18:13 +0200
  88
  89 pve-firewall (3.0-10) unstable; urgency=medium
  90
  91   * fix #1764: handle existing ebtables rules and allow disabling ebtables
  92
  93   * ebtables handling can be disabled via /etc/pve/firewall/cluster.fw's new
  94     ebtables_enable option.
  95
  96  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 May 2018 15:14:33 +0200
  97
  98 pve-firewall (3.0-9) unstable; urgency=medium
  99
 100   * fix creation of ebltables FORWARD rule entry
 101
 102  -- Proxmox Support Team <support@proxmox.com>  Thu, 17 May 2018 14:41:27 +0200
 103
 104 pve-firewall (3.0-8) unstable; urgency=medium
 105
 106   * add ebtables support for better MAC filtering
 107
 108  -- Proxmox Support Team <support@proxmox.com>  Wed, 11 Apr 2018 14:25:41 +0200
 109
 110 pve-firewall (3.0-7) unstable; urgency=medium
 111
 112   * support distinct source and destination multi-port matching
 113
 114   * multi-port matching: when specifying the same list of ports for source and
 115     destination require them both to match, rather than one of them, as this
 116     was rather unexpected behavior
 117
 118  -- Proxmox Support Team <support@proxmox.com>  Mon, 12 Mar 2018 14:58:08 +0100
 119
 120 pve-firewall (3.0-6) unstable; urgency=medium
 121
 122   * fix #1319: don't fail postinst with masked service
 123
 124   * debian: switch to compat 9, drop init scripts, drop preinst
 125
 126   * check multiport limit in port ranges
 127
 128   * build: use git rev-parse for GITVERSION
 129
 130  -- Proxmox Support Team <support@proxmox.com>  Thu, 08 Mar 2018 13:53:11 +0100
 131
 132 pve-firewall (3.0-5) unstable; urgency=medium
 133
 134   * fix issue with disabled flag not being honored within groups
 135
 136  -- Proxmox Support Team <support@proxmox.com>  Thu, 07 Dec 2017 08:31:42 +0100
 137
 138 pve-firewall (3.0-4) unstable; urgency=medium
 139
 140   * fix issues with ipsets reloading unnecessarily or too late
 141
 142   * fix some typos in the logs
 143
 144  -- Proxmox Support Team <support@proxmox.com>  Thu, 16 Nov 2017 11:41:56 +0100
 145
 146 pve-firewall (3.0-3) unstable; urgency=medium
 147
 148   * Fix #1492: logger: use current timestamp if the packet doesn't have one
 149
 150  -- Proxmox Support Team <support@proxmox.com>  Tue, 12 Sep 2017 14:43:06 +0200
 151
 152 pve-firewall (3.0-2) unstable; urgency=medium
 153
 154   * Fix #1446: remove masks in case the package had previously been removed but
 155     not purged.
 156
 157   * improve logging on errors in the firewall configuration
 158
 159   * forbid trailing commas in lists as iptables-restore doesn't support them
 160
 161  -- Proxmox Support Team <support@proxmox.com>  Mon, 17 Jul 2017 15:24:40 +0200
 162
 163 pve-firewall (3.0-1) unstable; urgency=medium
 164
 165   * rebuild for Debian Stretch
 166
 167  -- Proxmox Support Team <support@proxmox.com>  Thu, 9 Mar 2017 14:04:17 +0100
 168
 169 pve-firewall (2.0-33) unstable; urgency=medium
 170
 171   * ipset: don't allow zero-prefix entries
 172
 173  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 Nov 2016 12:18:04 +0100
 174
 175 pve-firewall (2.0-32) unstable; urgency=medium
 176
 177   * improve search for local-network
 178
 179  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 Nov 2016 06:35:08 +0100
 180
 181 pve-firewall (2.0-31) unstable; urgency=medium
 182
 183   * don't try to apply ports to rules which don't support them
 184
 185  -- Proxmox Support Team <support@proxmox.com>  Thu, 06 Oct 2016 08:31:51 +0200
 186
 187 pve-firewall (2.0-30) unstable; urgency=medium
 188
 189   * add multicast DNS to the list of Macros
 190
 191   * add missing parameter descriptions
 192
 193   * build-depends: add dh-systemd
 194
 195  -- Proxmox Support Team <support@proxmox.com>  Fri, 16 Sep 2016 08:53:16 +0200
 196
 197 pve-firewall (2.0-29) unstable; urgency=medium
 198
 199   * prevent overwriting ipsets/sec. groups by renaming
 200
 201  -- Proxmox Support Team <support@proxmox.com>  Fri, 03 Jun 2016 16:46:10 +0200
 202
 203 pve-firewall (2.0-28) unstable; urgency=medium
 204
 205   * use pve-common's ipv4_mask_hash_localnet
 206
 207   * fix allowed group name length
 208
 209   * make group digest stable
 210
 211  -- Proxmox Support Team <support@proxmox.com>  Fri, 03 Jun 2016 11:01:47 +0200
 212
 213 pve-firewall (2.0-27) unstable; urgency=medium
 214
 215   * fix #972: make PVEFW-FWBR-* rule order stable
 216
 217  -- Proxmox Support Team <support@proxmox.com>  Tue, 17 May 2016 07:59:52 +0200
 218
 219 pve-firewall (2.0-26) unstable; urgency=medium
 220
 221   * fix #988: set rp_filter=2
 222
 223  -- Proxmox Support Team <support@proxmox.com>  Mon, 09 May 2016 10:01:28 +0200
 224
 225 pve-firewall (2.0-25) unstable; urgency=medium
 226
 227   * fix #945: add uninitialized check in lxc ipset compilation
 228
 229  -- Proxmox Support Team <support@proxmox.com>  Thu, 21 Apr 2016 09:58:33 +0200
 230
 231 pve-firewall (2.0-24) unstable; urgency=medium
 232
 233   * Build-Depend on pve-doc-generator
 234
 235   * generate manpage with pve-doc-generator
 236
 237  -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Apr 2016 10:52:45 +0200
 238
 239 pve-firewall (2.0-23) unstable; urgency=medium
 240
 241   * use only the top bit for our accept marks
 242
 243  -- Proxmox Support Team <support@proxmox.com>  Fri, 01 Apr 2016 07:35:38 +0200
 244
 245 pve-firewall (2.0-22) unstable; urgency=medium
 246
 247   * Use cfs_config_path from PVE::QemuConfig
 248
 249  -- Proxmox Support Team <support@proxmox.com>  Tue, 08 Mar 2016 11:47:40 +0100
 250
 251 pve-firewall (2.0-21) unstable; urgency=medium
 252
 253   * added new 'ipfilter' option
 254
 255  -- Proxmox Support Team <support@proxmox.com>  Thu, 03 Mar 2016 09:43:39 +0100
 256
 257 pve-firewall (2.0-20) unstable; urgency=medium
 258
 259   * fix 901: encode unicode characters in sha digest
 260
 261  -- Proxmox Support Team <support@proxmox.com>  Mon, 29 Feb 2016 12:40:14 +0100
 262
 263 pve-firewall (2.0-19) unstable; urgency=medium
 264
 265   * Add radv option to VM options
 266
 267  -- Proxmox Support Team <support@proxmox.com>  Sat, 27 Feb 2016 10:24:42 +0100
 268
 269 pve-firewall (2.0-18) unstable; urgency=medium
 270
 271   * Add ndp option to host and VM firewall options
 272
 273   * Add router-solicitation to NeighborDiscovery macro
 274
 275  -- Proxmox Support Team <support@proxmox.com>  Fri, 19 Feb 2016 10:01:22 +0100
 276
 277 pve-firewall (2.0-17) unstable; urgency=medium
 278
 279   * Don't leave empty FW config files behind
 280
 281  -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Feb 2016 14:09:24 +0100
 282
 283 pve-firewall (2.0-16) unstable; urgency=medium
 284
 285   * logger: basic ipv6 support
 286
 287   * add DHCPv6 macro
 288
 289   * add dhcpv6 support to the dhcp option
 290
 291  -- Proxmox Support Team <support@proxmox.com>  Tue, 26 Jan 2016 16:52:14 +0100
 292
 293 pve-firewall (2.0-15) unstable; urgency=medium
 294
 295   * fix bug #859: use $security_group_name_pattern in iptables_get_chains
 296
 297   * fix some regular expressions mixups
 298
 299  -- Proxmox Support Team <support@proxmox.com>  Thu, 07 Jan 2016 16:33:23 +0100
 300
 301 pve-firewall (2.0-14) unstable; urgency=medium
 302
 303   * fix systemd service dependencies
 304
 305  -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Nov 2015 10:52:57 +0100
 306
 307 pve-firewall (2.0-13) unstable; urgency=medium
 308
 309   * allow numeric icmp types
 310
 311  -- Proxmox Support Team <support@proxmox.com>  Fri, 23 Oct 2015 13:21:53 +0200
 312
 313 pve-firewall (2.0-12) unstable; urgency=medium
 314
 315   * implement bash completions
 316
 317   * convert pve-firewall into a PVE::Service class
 318
 319  -- Proxmox Support Team <support@proxmox.com>  Thu, 24 Sep 2015 12:15:00 +0200
 320
 321 pve-firewall (2.0-11) unstable; urgency=medium
 322
 323   * iptables_get_chains: fix veth device name
 324
 325  -- Proxmox Support Team <support@proxmox.com>  Tue, 08 Sep 2015 07:54:35 +0200
 326
 327 pve-firewall (2.0-10) unstable; urgency=medium
 328
 329   * new helper: clone_vmfw_conf()
 330
 331  -- Proxmox Support Team <support@proxmox.com>  Tue, 25 Aug 2015 06:47:49 +0200
 332
 333 pve-firewall (2.0-9) unstable; urgency=medium
 334
 335   * remove firewall config file subroutine added
 336
 337  -- Proxmox Support Team <support@proxmox.com>  Wed, 19 Aug 2015 15:42:51 +0200
 338
 339 pve-firewall (2.0-8) unstable; urgency=medium
 340
 341   * adopt regresion tests for lxc containers
 342
 343   * removed firewall code for openVZ
 344
 345   *  Subroutine verify_rule fixed to correctly check only for "net\d+"
 346   interface device names
 347
 348  -- Proxmox Support Team <support@proxmox.com>  Wed, 12 Aug 2015 12:01:43 +0200
 349
 350 pve-firewall (2.0-7) unstable; urgency=medium
 351
 352   * added firewall code for lxc
 353
 354  -- Proxmox Support Team <support@proxmox.com>  Mon, 10 Aug 2015 09:21:14 +0200
 355
 356 pve-firewall (2.0-6) unstable; urgency=medium
 357
 358   * firewall ipversion comparison fix
 359
 360  -- Proxmox Support Team <support@proxmox.com>  Tue, 04 Aug 2015 11:14:51 +0200
 361
 362 pve-firewall (2.0-5) unstable; urgency=medium
 363
 364   * add ipv6 neighbor discovery and solicitation macros
 365
 366   * ip6tables accepts both spellings of the word neighbor
 367
 368   * added Ceph macro
 369
 370  -- Proxmox Support Team <support@proxmox.com>  Mon, 27 Jul 2015 13:20:55 +0200
 371
 372 pve-firewall (2.0-4) unstable; urgency=medium
 373
 374   * include manual page for pve-firewall
 375
 376  -- Proxmox Support Team <support@proxmox.com>  Sat, 27 Jun 2015 16:26:28 +0200
 377
 378 pve-firewall (2.0-3) unstable; urgency=medium
 379
 380   * use noawait trigers for pve-api-updates
 381
 382  -- Proxmox Support Team <support@proxmox.com>  Mon, 01 Jun 2015 12:33:06 +0200
 383
 384 pve-firewall (2.0-2) unstable; urgency=medium
 385
 386   * trigger pve-api-updates event
 387
 388  -- Proxmox Support Team <support@proxmox.com>  Tue, 05 May 2015 15:10:24 +0200
 389
 390 pve-firewall (2.0-1) unstable; urgency=medium
 391
 392   * recompile for debian jessie
 393
 394  -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Feb 2015 12:22:04 +0100
 395
 396 pve-firewall (1.0-18) unstable; urgency=low
 397
 398   * fix alias lookup
 399
 400  -- Proxmox Support Team <support@proxmox.com>  Mon, 09 Feb 2015 09:32:03 +0100
 401
 402 pve-firewall (1.0-17) unstable; urgency=low
 403
 404   * fix restart behavior
 405
 406  -- Proxmox Support Team <support@proxmox.com>  Thu, 15 Jan 2015 06:45:58 +0100
 407
 408 pve-firewall (1.0-16) unstable; urgency=low
 409
 410   * use new Daemon class from pve-common
 411
 412  -- Proxmox Support Team <support@proxmox.com>  Thu, 18 Dec 2014 09:45:07 +0100
 413
 414 pve-firewall (1.0-15) unstable; urgency=low
 415
 416   * bug fix: load cluster conf for host rules
 417
 418  -- Proxmox Support Team <support@proxmox.com>  Fri, 12 Dec 2014 06:33:28 +0100
 419
 420 pve-firewall (1.0-14) unstable; urgency=low
 421
 422   *  do not use ipset list chains
 423
 424   *  remove preinst script (not needed anymore)
 425
 426  -- Proxmox Support Team <support@proxmox.com>  Fri, 05 Dec 2014 13:42:00 +0100
 427
 428 pve-firewall (1.0-13) unstable; urgency=low
 429
 430   * fix ipset remove order
 431
 432  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 12:45:48 +0100
 433
 434 pve-firewall (1.0-12) unstable; urgency=low
 435
 436   * add preinst script to clear ipset from older installation (because
 437     sets cannot be swapped if there type does not match.
 438
 439  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 08:59:38 +0100
 440
 441 pve-firewall (1.0-11) unstable; urgency=low
 442
 443   * bug fix: correctly set ipversion for aliases in verify_rule
 444
 445   * save restore commands into files to make debugging
 446     easier (/var/lib/pve-firewall/)
 447
 448  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 08:04:05 +0100
 449
 450 pve-firewall (1.0-10) unstable; urgency=low
 451
 452   * add IPv6 support for VMs (hostfw is IPv4 only)
 453
 454  -- Proxmox Support Team <support@proxmox.com>  Wed, 26 Nov 2014 07:00:29 +0100
 455
 456 pve-firewall (1.0-9) unstable; urgency=low
 457
 458   * fix max ipset name name length
 459
 460  -- Proxmox Support Team <support@proxmox.com>  Tue, 14 Oct 2014 16:29:34 +0200
 461
 462 pve-firewall (1.0-8) unstable; urgency=low
 463
 464   * implement permission
 465
 466  -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Sep 2014 12:15:21 +0200
 467
 468 pve-firewall (1.0-7) unstable; urgency=low
 469
 470   * proxy host rule API calls to correct node
 471
 472   * always generate MAC and IP filter rules if firewall is enabled on NIC
 473
 474  -- Proxmox Support Team <support@proxmox.com>  Thu, 26 Jun 2014 07:12:57 +0200
 475
 476 pve-firewall (1.0-6) unstable; urgency=low
 477
 478   * ipmlement ipfilter ipsets
 479
 480  -- Proxmox Support Team <support@proxmox.com>  Thu, 12 Jun 2014 08:37:08 +0200
 481
 482 pve-firewall (1.0-5) unstable; urgency=low
 483
 484   * remove ipsets when firewall disabled
 485
 486  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 08:50:18 +0200
 487
 488 pve-firewall (1.0-4) unstable; urgency=low
 489
 490   * depend on iptables and ipset
 491
 492  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 06:45:33 +0200
 493
 494 pve-firewall (1.0-3) unstable; urgency=low
 495
 496   * change dh_installinit order (register pvefw-logger before pve-firewall)
 497
 498  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 06:24:21 +0200
 499
 500 pve-firewall (1.0-2) unstable; urgency=low
 501
 502   * add experimental nflog logging daemon
 503
 504  -- Proxmox Support Team <support@proxmox.com>  Thu, 13 Mar 2014 08:27:01 +0100
 505
 506 pve-firewall (1.0-1) unstable; urgency=low
 507
 508   * initial package
 509
 510  -- Proxmox Support Team <support@proxmox.com>  Mon, 03 Mar 2014 08:37:06 +0100
 511