abrown38andClaude Opus 5.5
ebec2cfcca
A DNAT map (named or anonymous) becomes one port forward per element, named after the map; a verdict map becomes one rule per element, in place, with jumps inlined. A lookup matches one element at most, so the expanded rules do the same. A named map that can't be expanded (keyed by several fields) is left out with a note instead of a raw rule naming it, which nftables would refuse. Test fixture made with nft 1.1.3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
67 lines
3.6 KiB
Markdown
67 lines
3.6 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to Housecarl are documented here. The format follows
|
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
|
|
[Semantic Versioning](https://semver.org/).
|
|
|
|
## [Unreleased]
|
|
|
|
The first version of Housecarl, a firewall manager for nftables, built
|
|
the way Jarl and Steward are.
|
|
|
|
### Added
|
|
|
|
- **Zones, address sets and services:** interfaces grouped by what they
|
|
connect to (wildcards like `incusbr*`; external zones face the
|
|
internet); sets of IPv4 and IPv6 addresses, prefixes and ranges, mixed;
|
|
ports and ICMP types by name, with twenty built in (docs/rules.md).
|
|
- **Rules** in four chains (input, forward, output, and early, before
|
|
connection tracking), in order, matching by zone, address, service,
|
|
family, connection state and status, days and hours, a rate (also per
|
|
source address), and a connection count; accept, drop, reject (ICMP or
|
|
TCP reset) or log. Raw nftables rules for the rest.
|
|
- **IPv4 and IPv6 together:** one rule becomes the nftables rules each
|
|
family needs.
|
|
- **NAT:** port forwards as one object (DNAT, the forward accept, hairpin
|
|
NAT, and optionally an IPv6 pinhole to a host's own port); source NAT
|
|
(masquerade or an address; NAT66 on request); redirects to the firewall
|
|
(docs/nat.md).
|
|
- **Built-ins**, each switchable: loopback, established connections,
|
|
invalid packets, ICMPv6 (RFC 4890), ping from internal zones, DHCPv6
|
|
client replies, antispoofing with your own prefixes, MSS clamping, and
|
|
a flowtable fast path.
|
|
- **Changes checked twice and applied atomically:** validation of the
|
|
whole configuration with stable problem codes (docs/validation.md),
|
|
then `nft -c`, then one `nft -f` transaction that replaces Housecarl's
|
|
own table, `inet housecarl`, and nothing else. Dynamic sets' entries
|
|
and the counters carry across.
|
|
- **Probation:** a change made over the network rolls itself back unless
|
|
confirmed within two minutes (`hc confirm`, a banner in the web UI);
|
|
changes through the local socket are kept at once; a restart rolls
|
|
back what was pending. No rule is forced to keep SSH or the web UI
|
|
open.
|
|
- **At boot:** the confirmed ruleset is loaded by
|
|
`housecarl-ruleset.service` before the network comes up, without
|
|
housecarld. An empty configuration applies nothing.
|
|
- **Hits and the log:** packet and byte counters for every rule, NAT rule,
|
|
built-in and policy; packets logged by rules and policies, read from
|
|
netlink log group 4171 (`hc log -f`, the Log page).
|
|
- **Dynamic sets** whose entries expire by themselves, changed through
|
|
their own API with tokens that may be limited to one set
|
|
(`sets:write:guests`).
|
|
- **Import** of an existing nftables ruleset (`hc import`): rules keep
|
|
their order, defines name the sets, DNAT becomes port forwards, what
|
|
can't be translated stays as raw rules, with notes; `hc takeover`
|
|
deletes the old table, on probation (docs/import.md). DNAT maps and
|
|
verdict maps are expanded into one port forward or rule per element.
|
|
- **The `hc` CLI, the REST API and the web UI** (dashboard, rules per
|
|
chain with hits and reordering, NAT, zones, sets, services, the log,
|
|
settings, import, history with undo), with users, roles, scoped API
|
|
tokens, sessions, the audit log, and the web UI's certificate from
|
|
Let's Encrypt through Jarl, as in Steward.
|
|
- **Packaging:** Debian packages `housecarl` and `housecarl-cli`, a
|
|
systemd unit whose only privilege is `CAP_NET_ADMIN`, daily backups.
|
|
- **The Housecarl logo:** a carved Nordic doorway in Jarl's blue, with a
|
|
simplified version for small sizes, lighter on dark backgrounds; and a
|
|
HOUSECARL wordmark in Jarl's and Steward's angular letters.
|