Changelog
Features
- c00b87a: feat(core): the packet log records an ICMP packet's type and code (@jp1337)
- 2a1e02b: feat(web): a default drop on /blocked says why, and a module's chip leads to its option (@jp1337)
- 79beba6: feat(web): every switch on /options says what it breaks (@jp1337)
Bug Fixes
- 82a8319: fix(config): docker.enabled ships true — a Docker host no longer loses its (@jp1337)
- 82b5545: fix(core): an IPv4-mapped network is written as the IPv4 network it names (@jp1337)
- 8303664: fix(core): fragment drop, ICMP flood and TCP RST flood act on real traffic (@jp1337)
- 58fdef9: fix(debian): depend on adduser, which postinst calls (@jp1337)
- 89f8f35: fix(docker): compose keeps the account out of the checkout, and CI runs compose (@jp1337)
- 4c366ac: fix(docker): the health check follows bind_addr (@jp1337)
- 7f0b3ed: fix(security): the core never writes where the web user can (@jp1337)
- 02f593c: fix(security): the migration never writes into web/ in place, and the image check proves the owner (@jp1337)
- 5b31fde: fix(shared): the lockout check ignores a port rule that only filters forwarded traffic (@jp1337)
- bc566ff: fix(web): a signed-out htmx request navigates to /login instead of swapping it in (@jp1337)
- 9f3b91b: fix(web): the drop-reason tests hold their guards; mapped and Docker sources get no false reason (@jp1337)
- 2683add: fix(web): the first run asks for a setup token from the host's log (@jp1337)
- 0bd4977: fix(web): the health check pins a zoned IPv6 bind as its source too (@jp1337)
- 6c01b2d: fix(web): the health check pins the certificate it expects instead of skipping verification (@jp1337)
- ca580aa: fix(web): the own-address rule matches a zoned bind (@jp1337)
Other
- 5d3b8b1: chore(ci): remove the dormant deploy-demo job (@jp1337)
- d7c3050: chore(release): 2.22.0 (@jp1337)
- cd8e080: test(core): pin ICMP-in-IPv6 and a truncated ICMP body (@jp1337)
- 0d5ec95: test(web): the options guard counts switches, so a card without its id is caught (@jp1337)
- ea366fb: test(web): the pasted-token test depends on the trim; the demo page shows the real log line (@jp1337)