Changelog
Features
- 7d60c56: feat(core): handle SIGHUP, and read the acceptance duration per apply (@jp1337)
- 8fe5b1c: feat(core): replace the IPv6 boolean with three honest modes (@jp1337)
- a56f45b: feat(web): give the installation count somewhere to go (@jp1337)
- b40f44f: feat(web): make the first run a short pass through the choices that matter (@jp1337)
Bug Fixes
- b72f047: fix(build): make -ldflags reach the version it is setting (@jp1337)
- 7e7ab0e: fix(build): stop compiling the whole repository into both stylesheets (@jp1337)
- ce53381: fix(ci): let the layout check read the layout it is checking (@jp1337)
- 0df5c78: fix(core): bound both nft invocations, pipes included (@jp1337)
- 2965774: fix(core): bound custom-rule validation, and check a valid set in one pass (@jp1337)
- 57f7978: fix(core): correct the port-forwarding direction and honour the acceptance switch (@jp1337)
- 36592fd: fix(core): count every rate per source, not once for the whole machine (@jp1337)
- e2fbef9: fix(core): drop the broadcast traffic the option says it drops (@jp1337)
- 4dea6d9: fix(core): export the staged rule set, which is the half import replaces (@jp1337)
- 019c675: fix(core): give a packaged installation a socket and a rule store it can use (@jp1337)
- df71736: fix(core): give routed traffic a switch, instead of a chain that eats it (@jp1337)
- 4c1b5ef: fix(core): keep the staged edits through a rollback, and stop claiming a late (@jp1337)
- ac4e9e4: fix(core): lock the config, and make failures look like failures (@jp1337)
- 2287e82: fix(core): log the final drop behind the custom rules, not in front of them (@jp1337)
- 50b8c6e: fix(core): make every switch on the options page reach the firewall (@jp1337)
- 7bec12c: fix(core): make the two files only root reads readable by root only (@jp1337)
- ac38745: fix(core): persist the config under the same lock that updates it (@jp1337)
- 5e96ba3: fix(core): refuse a second apply instead of queueing it behind the window (@jp1337)
- a85dcff: fix(core): refuse rules that cannot become rules, instead of skipping them (@jp1337)
- d51d60f: fix(core): report the firewall's real state, and say what changed (@jp1337)
- d40bf5f: fix(core): roll back when the daemon stops inside an acceptance window (@jp1337)
- 58e1a79: fix(core): say when a limit is substituted, and refuse one that cannot work (@jp1337)
- 968ee64: fix(core): serialise the rules store, which was losing 187 saves in 200 (@jp1337)
- c2f5f98: fix(core): stop an imported custom rule from reaching another table (@jp1337)
- dd8248c: fix(core): stop one checkbox from leaving the host with no firewall (@jp1337)
- 2637cf1: fix(core): stop snapshot rotation from deleting the audit log (@jp1337)
- ed8e46b: fix(core): stop the bogon filter from dropping what the operator allowed (@jp1337)
- 62218a0: fix(core): validate docker custom networks on both sides (@jp1337)
- 6d2b570: fix(deb): put the binaries in the package (@jp1337)
- 15fe3fb: fix(docker): make the shipped compose file produce a working container (@jp1337)
- c7c197b: fix(docker): stop shipping a known session key and running the web process as root (@jp1337)
- 3225f94: fix(docs): one copy of each schema, describing the config easywall accepts (@jp1337)
- c3da754: fix(docs): re-render diagrams for mermaid 11.16.1, and notice next time (#107) (@jp1337)
- a906fb1: fix(packaging): make the installed package actually start (@jp1337)
- fd5ddad: fix(release): keep :latest on stable releases, and stamp images with their commit (@jp1337)
- 4bf00a8: fix(ui): let the content column shrink so wide tables scroll instead of the page (@jp1337)
- 4f285ce: fix(web): count list entries on the dashboard the way every other page does (@jp1337)
- 79737f5: fix(web): guard the web config, which every request reads and a password change writes (@jp1337)
- 1dc8b6d: fix(web): keep a rejected address list on screen, with the reasons (@jp1337)
- 4911f3b: fix(web): keep the stored hash out of the journal when it is unusable (@jp1337)
- e2b5663: fix(web): keep web.toml's documentation when easywall writes to it (@jp1337)
- 192a8fd: fix(web): make a session stop working when its cookie says it has (@jp1337)
- 201dffb: fix(web): make the demo write the audit log the core writes (@jp1337)
- 657a673: fix(web): make the logout button end the session (@jp1337)
- cf453df: fix(web): one definition of "signed in", so a refused session settles (@jp1337)
- 4935311: fix(web): refuse an unusable password hash instead of panicking on it (@jp1337)
- d378292: fix(web): refuse to start without the interface it is supposed to serve (@jp1337)
- f1bf524: fix(web): render the settings markup, and let the demo say what changed (@jp1337)
- 7492a2b: fix(web): say "unknown" when the core cannot be reached, not "idle" (@jp1337)
- 1abaa78: fix(web): stop deleting the operator's notes, and validate once for everyone (@jp1337)
- 4692dd2: fix(web): stop the browser serving the previous release's assets (@jp1337)
- d32e1d3: fix(web): stop the dashboard waiting on github, and four more claims (@jp1337)
- 6a15686: fix(web): stop the login page from telling an attacker the account name (@jp1337)
- 722ebe7: fix(web): stop the rule editors discarding rows and misreading ports (@jp1337)
- 1f5ec1a: fix(web): stop the wizard from staging a rule set that locks you out (@jp1337)
Other
- 39f3fcb: chore(deps-dev): Bump mermaid from 11.16.0 to 11.16.1 (#105) (@dependabot[bot])
- 43fa3ce: chore(docs): re-render the diagrams with the pinned mermaid (@jp1337)
- 7da89aa: chore(release): 2.5.0 (@jp1337)
- 6c7ddc1: ci: build the documentation on a pull request, not only on the way out (@jp1337)
- 929a2e3: ci: check the generated assets are the ones their sources produce (@jp1337)
- 3e0f1f8: ci: drop gosec's test-file permission findings from the alert list (@jp1337)
- 56e12d0: ci: install the package it builds, and check the interface comes up (@jp1337)
- 8afa1e7: ci: let CodeQL see the build it is analysing, and give gosec the test code (@jp1337)
- 48c9e05: ci: let the coverage uploads fail, and say which half arrived (@jp1337)
- 26df9bd: ci: let the package check read what it installed, and stop raising test findings (@jp1337)
- ddeb7d7: ci: read the generated certificate through sudo as well (@jp1337)
- 1607d94: ci: stop queueing a demo deploy for a runner that does not exist (@jp1337)
- 72eb922: test(ci): count the integration suite's coverage, and cover the log builder (@jp1337)
- 4a720f1: test: drive the interface in a browser on every push (@jp1337)