debian/changelog

   1 pve-firewall (3.0-17) unstable; urgency=medium
   2
   3   * fix #2005: only allow ascii port digits
   4
   5   * fix #2004: do not allow backwards ranges
   6
   7   * add conntrack logging via libnetfilter_conntrack and allow one to enable
   8     it through the firewall host configuration
   9
  10  -- Proxmox Support Team <support@proxmox.com>  Wed, 09 Jan 2019 16:56:17 +0100
  11
  12 pve-firewall (3.0-16) unstable; urgency=medium
  13
  14   * api/rules: fix macro return type
  15
  16  -- Proxmox Support Team <support@proxmox.com>  Fri, 30 Nov 2018 16:02:59 +0100
  17
  18 pve-firewall (3.0-15) unstable; urgency=medium
  19
  20   * fix #1971: display firewall rule properties
  21
  22  -- Proxmox Support Team <support@proxmox.com>  Fri, 23 Nov 2018 14:01:33 +0100
  23
  24 pve-firewall (3.0-14) unstable; urgency=medium
  25
  26   * fix #1841: avoid ebtable reloads when containers have multiple network
  27     interfaces
  28
  29  -- Proxmox Support Team <support@proxmox.com>  Fri, 24 Aug 2018 10:51:04 +0200
  30
  31 pve-firewall (3.0-13) unstable; urgency=medium
  32
  33   * avoid unnecessary reloads of ebtable ruleset
  34
  35  -- Proxmox Support Team <support@proxmox.com>  Thu, 28 Jun 2018 14:47:16 +0200
  36
  37 pve-firewall (3.0-12) unstable; urgency=medium
  38
  39   * fix deleted iptables chains not being properly detected as a change
  40
  41  -- Proxmox Support Team <support@proxmox.com>  Tue, 12 Jun 2018 12:01:02 +0200
  42
  43 pve-firewall (3.0-11) unstable; urgency=medium
  44
  45   * #1764: rename 'ebtales_enable' option to 'ebtables'
  46
  47  -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Jun 2018 16:18:13 +0200
  48
  49 pve-firewall (3.0-10) unstable; urgency=medium
  50
  51   * fix #1764: handle existing ebtables rules and allow disabling ebtables
  52
  53   * ebtables handling can be disabled via /etc/pve/firewall/cluster.fw's new
  54     ebtables_enable option.
  55
  56  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 May 2018 15:14:33 +0200
  57
  58 pve-firewall (3.0-9) unstable; urgency=medium
  59
  60   * fix creation of ebltables FORWARD rule entry
  61
  62  -- Proxmox Support Team <support@proxmox.com>  Thu, 17 May 2018 14:41:27 +0200
  63
  64 pve-firewall (3.0-8) unstable; urgency=medium
  65
  66   * add ebtables support for better MAC filtering
  67
  68  -- Proxmox Support Team <support@proxmox.com>  Wed, 11 Apr 2018 14:25:41 +0200
  69
  70 pve-firewall (3.0-7) unstable; urgency=medium
  71
  72   * support distinct source and destination multi-port matching
  73
  74   * multi-port matching: when specifying the same list of ports for source and
  75     destination require them both to match, rather than one of them, as this
  76     was rather unexpected behavior
  77
  78  -- Proxmox Support Team <support@proxmox.com>  Mon, 12 Mar 2018 14:58:08 +0100
  79
  80 pve-firewall (3.0-6) unstable; urgency=medium
  81
  82   * fix #1319: don't fail postinst with masked service
  83
  84   * debian: switch to compat 9, drop init scripts, drop preinst
  85
  86   * check multiport limit in port ranges
  87
  88   * build: use git rev-parse for GITVERSION
  89
  90  -- Proxmox Support Team <support@proxmox.com>  Thu, 08 Mar 2018 13:53:11 +0100
  91
  92 pve-firewall (3.0-5) unstable; urgency=medium
  93
  94   * fix issue with disabled flag not being honored within groups
  95
  96  -- Proxmox Support Team <support@proxmox.com>  Thu, 07 Dec 2017 08:31:42 +0100
  97
  98 pve-firewall (3.0-4) unstable; urgency=medium
  99
 100   * fix issues with ipsets reloading unnecessarily or too late
 101
 102   * fix some typos in the logs
 103
 104  -- Proxmox Support Team <support@proxmox.com>  Thu, 16 Nov 2017 11:41:56 +0100
 105
 106 pve-firewall (3.0-3) unstable; urgency=medium
 107
 108   * Fix #1492: logger: use current timestamp if the packet doesn't have one
 109
 110  -- Proxmox Support Team <support@proxmox.com>  Tue, 12 Sep 2017 14:43:06 +0200
 111
 112 pve-firewall (3.0-2) unstable; urgency=medium
 113
 114   * Fix #1446: remove masks in case the package had previously been removed but
 115     not purged.
 116
 117   * improve logging on errors in the firewall configuration
 118
 119   * forbid trailing commas in lists as iptables-restore doesn't support them
 120
 121  -- Proxmox Support Team <support@proxmox.com>  Mon, 17 Jul 2017 15:24:40 +0200
 122
 123 pve-firewall (3.0-1) unstable; urgency=medium
 124
 125   * rebuild for Debian Stretch
 126
 127  -- Proxmox Support Team <support@proxmox.com>  Thu, 9 Mar 2017 14:04:17 +0100
 128
 129 pve-firewall (2.0-33) unstable; urgency=medium
 130
 131   * ipset: don't allow zero-prefix entries
 132
 133  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 Nov 2016 12:18:04 +0100
 134
 135 pve-firewall (2.0-32) unstable; urgency=medium
 136
 137   * improve search for local-network
 138
 139  -- Proxmox Support Team <support@proxmox.com>  Tue, 29 Nov 2016 06:35:08 +0100
 140
 141 pve-firewall (2.0-31) unstable; urgency=medium
 142
 143   * don't try to apply ports to rules which don't support them
 144
 145  -- Proxmox Support Team <support@proxmox.com>  Thu, 06 Oct 2016 08:31:51 +0200
 146
 147 pve-firewall (2.0-30) unstable; urgency=medium
 148
 149   * add multicast DNS to the list of Macros
 150
 151   * add missing parameter descriptions
 152
 153   * build-depends: add dh-systemd
 154
 155  -- Proxmox Support Team <support@proxmox.com>  Fri, 16 Sep 2016 08:53:16 +0200
 156
 157 pve-firewall (2.0-29) unstable; urgency=medium
 158
 159   * prevent overwriting ipsets/sec. groups by renaming
 160
 161  -- Proxmox Support Team <support@proxmox.com>  Fri, 03 Jun 2016 16:46:10 +0200
 162
 163 pve-firewall (2.0-28) unstable; urgency=medium
 164
 165   * use pve-common's ipv4_mask_hash_localnet
 166
 167   * fix allowed group name length
 168
 169   * make group digest stable
 170
 171  -- Proxmox Support Team <support@proxmox.com>  Fri, 03 Jun 2016 11:01:47 +0200
 172
 173 pve-firewall (2.0-27) unstable; urgency=medium
 174
 175   * fix #972: make PVEFW-FWBR-* rule order stable
 176
 177  -- Proxmox Support Team <support@proxmox.com>  Tue, 17 May 2016 07:59:52 +0200
 178
 179 pve-firewall (2.0-26) unstable; urgency=medium
 180
 181   * fix #988: set rp_filter=2
 182
 183  -- Proxmox Support Team <support@proxmox.com>  Mon, 09 May 2016 10:01:28 +0200
 184
 185 pve-firewall (2.0-25) unstable; urgency=medium
 186
 187   * fix #945: add uninitialized check in lxc ipset compilation
 188
 189  -- Proxmox Support Team <support@proxmox.com>  Thu, 21 Apr 2016 09:58:33 +0200
 190
 191 pve-firewall (2.0-24) unstable; urgency=medium
 192
 193   * Build-Depend on pve-doc-generator
 194
 195   * generate manpage with pve-doc-generator
 196
 197  -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Apr 2016 10:52:45 +0200
 198
 199 pve-firewall (2.0-23) unstable; urgency=medium
 200
 201   * use only the top bit for our accept marks
 202
 203  -- Proxmox Support Team <support@proxmox.com>  Fri, 01 Apr 2016 07:35:38 +0200
 204
 205 pve-firewall (2.0-22) unstable; urgency=medium
 206
 207   * Use cfs_config_path from PVE::QemuConfig
 208
 209  -- Proxmox Support Team <support@proxmox.com>  Tue, 08 Mar 2016 11:47:40 +0100
 210
 211 pve-firewall (2.0-21) unstable; urgency=medium
 212
 213   * added new 'ipfilter' option
 214
 215  -- Proxmox Support Team <support@proxmox.com>  Thu, 03 Mar 2016 09:43:39 +0100
 216
 217 pve-firewall (2.0-20) unstable; urgency=medium
 218
 219   * fix 901: encode unicode characters in sha digest
 220
 221  -- Proxmox Support Team <support@proxmox.com>  Mon, 29 Feb 2016 12:40:14 +0100
 222
 223 pve-firewall (2.0-19) unstable; urgency=medium
 224
 225   * Add radv option to VM options
 226
 227  -- Proxmox Support Team <support@proxmox.com>  Sat, 27 Feb 2016 10:24:42 +0100
 228
 229 pve-firewall (2.0-18) unstable; urgency=medium
 230
 231   * Add ndp option to host and VM firewall options
 232
 233   * Add router-solicitation to NeighborDiscovery macro
 234
 235  -- Proxmox Support Team <support@proxmox.com>  Fri, 19 Feb 2016 10:01:22 +0100
 236
 237 pve-firewall (2.0-17) unstable; urgency=medium
 238
 239   * Don't leave empty FW config files behind
 240
 241  -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Feb 2016 14:09:24 +0100
 242
 243 pve-firewall (2.0-16) unstable; urgency=medium
 244
 245   * logger: basic ipv6 support
 246
 247   * add DHCPv6 macro
 248
 249   * add dhcpv6 support to the dhcp option
 250
 251  -- Proxmox Support Team <support@proxmox.com>  Tue, 26 Jan 2016 16:52:14 +0100
 252
 253 pve-firewall (2.0-15) unstable; urgency=medium
 254
 255   * fix bug #859: use $security_group_name_pattern in iptables_get_chains
 256
 257   * fix some regular expressions mixups
 258
 259  -- Proxmox Support Team <support@proxmox.com>  Thu, 07 Jan 2016 16:33:23 +0100
 260
 261 pve-firewall (2.0-14) unstable; urgency=medium
 262
 263   * fix systemd service dependencies
 264
 265  -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Nov 2015 10:52:57 +0100
 266
 267 pve-firewall (2.0-13) unstable; urgency=medium
 268
 269   * allow numeric icmp types
 270
 271  -- Proxmox Support Team <support@proxmox.com>  Fri, 23 Oct 2015 13:21:53 +0200
 272
 273 pve-firewall (2.0-12) unstable; urgency=medium
 274
 275   * implement bash completions
 276
 277   * convert pve-firewall into a PVE::Service class
 278
 279  -- Proxmox Support Team <support@proxmox.com>  Thu, 24 Sep 2015 12:15:00 +0200
 280
 281 pve-firewall (2.0-11) unstable; urgency=medium
 282
 283   * iptables_get_chains: fix veth device name
 284
 285  -- Proxmox Support Team <support@proxmox.com>  Tue, 08 Sep 2015 07:54:35 +0200
 286
 287 pve-firewall (2.0-10) unstable; urgency=medium
 288
 289   * new helper: clone_vmfw_conf()
 290
 291  -- Proxmox Support Team <support@proxmox.com>  Tue, 25 Aug 2015 06:47:49 +0200
 292
 293 pve-firewall (2.0-9) unstable; urgency=medium
 294
 295   * remove firewall config file subroutine added
 296
 297  -- Proxmox Support Team <support@proxmox.com>  Wed, 19 Aug 2015 15:42:51 +0200
 298
 299 pve-firewall (2.0-8) unstable; urgency=medium
 300
 301   * adopt regresion tests for lxc containers
 302
 303   * removed firewall code for openVZ
 304
 305   *  Subroutine verify_rule fixed to correctly check only for "net\d+"
 306   interface device names
 307
 308  -- Proxmox Support Team <support@proxmox.com>  Wed, 12 Aug 2015 12:01:43 +0200
 309
 310 pve-firewall (2.0-7) unstable; urgency=medium
 311
 312   * added firewall code for lxc
 313
 314  -- Proxmox Support Team <support@proxmox.com>  Mon, 10 Aug 2015 09:21:14 +0200
 315
 316 pve-firewall (2.0-6) unstable; urgency=medium
 317
 318   * firewall ipversion comparison fix
 319
 320  -- Proxmox Support Team <support@proxmox.com>  Tue, 04 Aug 2015 11:14:51 +0200
 321
 322 pve-firewall (2.0-5) unstable; urgency=medium
 323
 324   * add ipv6 neighbor discovery and solicitation macros
 325
 326   * ip6tables accepts both spellings of the word neighbor
 327
 328   * added Ceph macro
 329
 330  -- Proxmox Support Team <support@proxmox.com>  Mon, 27 Jul 2015 13:20:55 +0200
 331
 332 pve-firewall (2.0-4) unstable; urgency=medium
 333
 334   * include manual page for pve-firewall
 335
 336  -- Proxmox Support Team <support@proxmox.com>  Sat, 27 Jun 2015 16:26:28 +0200
 337
 338 pve-firewall (2.0-3) unstable; urgency=medium
 339
 340   * use noawait trigers for pve-api-updates
 341
 342  -- Proxmox Support Team <support@proxmox.com>  Mon, 01 Jun 2015 12:33:06 +0200
 343
 344 pve-firewall (2.0-2) unstable; urgency=medium
 345
 346   * trigger pve-api-updates event
 347
 348  -- Proxmox Support Team <support@proxmox.com>  Tue, 05 May 2015 15:10:24 +0200
 349
 350 pve-firewall (2.0-1) unstable; urgency=medium
 351
 352   * recompile for debian jessie
 353
 354  -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Feb 2015 12:22:04 +0100
 355
 356 pve-firewall (1.0-18) unstable; urgency=low
 357
 358   * fix alias lookup
 359
 360  -- Proxmox Support Team <support@proxmox.com>  Mon, 09 Feb 2015 09:32:03 +0100
 361
 362 pve-firewall (1.0-17) unstable; urgency=low
 363
 364   * fix restart behavior
 365
 366  -- Proxmox Support Team <support@proxmox.com>  Thu, 15 Jan 2015 06:45:58 +0100
 367
 368 pve-firewall (1.0-16) unstable; urgency=low
 369
 370   * use new Daemon class from pve-common
 371
 372  -- Proxmox Support Team <support@proxmox.com>  Thu, 18 Dec 2014 09:45:07 +0100
 373
 374 pve-firewall (1.0-15) unstable; urgency=low
 375
 376   * bug fix: load cluster conf for host rules
 377
 378  -- Proxmox Support Team <support@proxmox.com>  Fri, 12 Dec 2014 06:33:28 +0100
 379
 380 pve-firewall (1.0-14) unstable; urgency=low
 381
 382   *  do not use ipset list chains
 383
 384   *  remove preinst script (not needed anymore)
 385
 386  -- Proxmox Support Team <support@proxmox.com>  Fri, 05 Dec 2014 13:42:00 +0100
 387
 388 pve-firewall (1.0-13) unstable; urgency=low
 389
 390   * fix ipset remove order
 391
 392  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 12:45:48 +0100
 393
 394 pve-firewall (1.0-12) unstable; urgency=low
 395
 396   * add preinst script to clear ipset from older installation (because
 397     sets cannot be swapped if there type does not match.
 398
 399  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 08:59:38 +0100
 400
 401 pve-firewall (1.0-11) unstable; urgency=low
 402
 403   * bug fix: correctly set ipversion for aliases in verify_rule
 404
 405   * save restore commands into files to make debugging
 406     easier (/var/lib/pve-firewall/)
 407
 408  -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Nov 2014 08:04:05 +0100
 409
 410 pve-firewall (1.0-10) unstable; urgency=low
 411
 412   * add IPv6 support for VMs (hostfw is IPv4 only)
 413
 414  -- Proxmox Support Team <support@proxmox.com>  Wed, 26 Nov 2014 07:00:29 +0100
 415
 416 pve-firewall (1.0-9) unstable; urgency=low
 417
 418   * fix max ipset name name length
 419
 420  -- Proxmox Support Team <support@proxmox.com>  Tue, 14 Oct 2014 16:29:34 +0200
 421
 422 pve-firewall (1.0-8) unstable; urgency=low
 423
 424   * implement permission
 425
 426  -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Sep 2014 12:15:21 +0200
 427
 428 pve-firewall (1.0-7) unstable; urgency=low
 429
 430   * proxy host rule API calls to correct node
 431
 432   * always generate MAC and IP filter rules if firewall is enabled on NIC
 433
 434  -- Proxmox Support Team <support@proxmox.com>  Thu, 26 Jun 2014 07:12:57 +0200
 435
 436 pve-firewall (1.0-6) unstable; urgency=low
 437
 438   * ipmlement ipfilter ipsets
 439
 440  -- Proxmox Support Team <support@proxmox.com>  Thu, 12 Jun 2014 08:37:08 +0200
 441
 442 pve-firewall (1.0-5) unstable; urgency=low
 443
 444   * remove ipsets when firewall disabled
 445
 446  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 08:50:18 +0200
 447
 448 pve-firewall (1.0-4) unstable; urgency=low
 449
 450   * depend on iptables and ipset
 451
 452  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 06:45:33 +0200
 453
 454 pve-firewall (1.0-3) unstable; urgency=low
 455
 456   * change dh_installinit order (register pvefw-logger before pve-firewall)
 457
 458  -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jun 2014 06:24:21 +0200
 459
 460 pve-firewall (1.0-2) unstable; urgency=low
 461
 462   * add experimental nflog logging daemon
 463
 464  -- Proxmox Support Team <support@proxmox.com>  Thu, 13 Mar 2014 08:27:01 +0100
 465
 466 pve-firewall (1.0-1) unstable; urgency=low
 467
 468   * initial package
 469
 470  -- Proxmox Support Team <support@proxmox.com>  Mon, 03 Mar 2014 08:37:06 +0100
 471