- Update from version 1.8.10 to 1.8.11
- Update of rootfile not required
- Changelog
1.8.11
new features:
- New arptables-translate tool
- ebtables-nft:
- Support for --change-counters command, albeit not atomic
- Specify rule counters using iptables' '-c N,M' syntax
- Support --replace and --list-rules commands
- Support zeroing individual rules
- Print negations (exclamation marks) extrapositioned (i.e., before
the match they invert) for consistency with iptables
- iptables-translate:
- Align protocol name lookups with iptables
- iptables-translate: Support socket match and TPROXY target
- iptables-translate: Slightly improved avoidance of redundant 'ip
protocol'/'meta l4proto' matches
- iptables:
- Undo numeric protocol printing of v1.8.9 for well-known protocols
for consistency with iptables-save
- Enable implicit extension lookup for dccp and ipcomp protocols (so
no extra '-m <proto>' is needed after '-p <proto>')
- iptables-save: Avoid calls to getprotobynumber() for consistency and
improved performance with huge rule sets
- libxtables: Support use of both xtables_ipaddr_to_numeric() and
xtables_ipmask_to_numeric() as parameters to the same function call
- configure: Support disabling use of libnfnetlink
- Prefix xtables-monitor rule events by a typical command (iptables,
ip6tables) instead of -4/-6 flags for consistency with ebtables and
arptables events
fixes:
- arptables-nft:
- Ineffective masks when specified in --h-type, --opcode and
--proto-type matches
- Wrong formatting of --h-type values and --proto-type masks causing
misinterpretation by arptables-restore
- iptables-nft:
- Wrong error messages in corner-case error conditions
- Zeroing single rule counters broken (again!)
- Incorrect combination of inverted payload matches
- Spurious error when zeroing a specific builtin chain which doesn't
exist - Calling -Z command with bogus rule number must fail
- libiptc: Corner-case segfault upon renaming a chain
- ebtables-restore:
- Corner-case bug with --noflush
- Spurious failures when deleting multiple rules with among matches
- ebtables-nft:
- Different line number (--Ln) formatting than ebtables-legacy
- Off-by-one rule number when using -S command with rule number
- iptables-legacy: Broken --wait without timeout
- libxtables: Leak of matches' udata buffer
- Some matches stripped full value ranges from output even if inverted
- Illegal memory access when parsing '-c ""' (i.e., empty string
argument)
- Inverted full interface wildcards (e.g. '! -i +') stripped from
iptables-save output
- xtables-monitor:
- Incorrect output when not called with -4 or -6 options
- Flush stdout after each line to prevent buffers and help with
scripting
- Align output for builtin chains with that of tables
- Capture arptables chain events, too
- Empty 'EVENT:' lines printed for ebtables rule changes
- Fix for compiling against musl libc
- xtables-translate: Fix translation of TPROXY target
documentation updates:
- Extensions: string: Starting with linux-6.7, pattern matching no
longer extends past 'to' offset - update the man page accordingly
- Extensions: recent: Clarify ip_list_hash_size default value and
obsoleted state of ip_pkt_list_tot
- ebtables-nft.8: Note that --concurrent is a NOP
- Misc. typesetting, spelling and grammar fixes in man pages
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
projects / ipfire-2.x.git / commitdiff
