Changelog
Features
- e47498b: feat(core): decode NFLOG packets into a ring, with a self-rotating spill file (@jp1337)
- c5dc527: feat(core): log rules send to NFLOG, and the core reads what they refused (@jp1337)
- 144e14a: feat(demo): a stream of refused packets on documentation addresses (@jp1337)
- 34a85b5: feat(shared): the packet log's types, [packet_log], and GET_PACKET_LOG (@jp1337)
- 33374ca: feat(web): /blocked — what the firewall refused, filterable, with a live tail (@jp1337)
- 567c636: feat(web): stage whitelist, blacklist or open-port from a refused packet — refused if it locks you out (@jp1337)
Bug Fixes
- 75aa2bb: fix(core): a Stop during the NFLOG bind ends the listener, and unit tests stay off the real group (@jp1337)
- bdb4848: fix(core): set the log sink under d.mu with the listener, and say what the integration test measured (@jp1337)
- 1bba6d1: fix(core,web,docs): five 2.21 residuals — a stale comment, a dead field pair, and an untested tail path (@jp1337)
- dfef0a1: fix(deps): update module github.com/go-webauthn/webauthn to v0.18.2 (#190) (@renovate[bot])
- 8783e87: fix(web): "proxy" only for a trusted proxy — a header from anyone else proves nothing (@jp1337)
- ed51486: fix(web): /blocked — bounded screenshot, bracketed IPv6, and four render-only defects (@jp1337)
- f099004: fix(web): the row-action guard, pinned per action — and a header-less proxy named as one (@jp1337)
- 2cb8ac7: fix(web,core): /blocked tells unreadable apart from false, and a stopped listener apart from a bind failure (@jp1337)
Other
- 49525e3: chore(ci): update dependency ruby to v4.0.7 (#188) (@renovate[bot])
- 7da0b99: chore(ci): update dependency ubuntu to v26 (@renovate[bot])
- 22d5237: release: 2.21.0 (@jp1337)
- 4317de1: test(ui): /blocked at five widths in both themes; screenshots re-taken for the new nav item (@jp1337)
- a2a40c2: test(ui): keep the sidebar-less screenshots at their pre-branch bytes (@jp1337)