Changes in 5.1.12.2

1)  Update release documents.

2)  Alter documentation to prefer ';;' over ';' in INLINE and
    IP[6]TABLES rules.

3)  Make 'update' convert ';' to ';;' in INLINE, IPTABLES and IP6TABLES
    rules.

4)  Correct typo that resulted in an "unknown function" Perl diagnostic.

4)  Correct "Invalid policy" message.

5)  Fix omitted SYN limiting.

Changes in 5.1.12.1

1)  Update release documents.

2)  Replace macro.SSDPServer with corrected macro.SSDPserver.

Changes in 5.1.12 Final

1)  Update release documents.

2)  Add INLINE_MATCHES=Yes to the deprecated list.

Changes in 5.1.12 RC 1

1)  Update release documents.

2)  Minor performance enhancements to Optimize Category 8.

3)  Always report IPSET_MATCH.

Changes in 5.1.12 Beta 2

1)  Update release documents.

2)  Delete undocumented OPTIMIZE_USE_FIRST option.

3)  Merge 5.1.11.

4)  Suppress trailing whitespace.

5)  Avoid awkward blank lines.

Changes in 5.1.12 Beta 1

1)  Update release documents.

2)  Code and manpage cleanup.

3)  Allow SNAT in the INPUT chain.

Changes in 5.1.11 Final

1)  Update release documents.

Changes in 5.1.11 RC 1

1)  Update release documents.

2)  Update versions and copyrights.

3)  Clear the connection mark on forwarded IPSEC tunneled connections.

4)  Make TRACK_PROVIDERS=Yes the default.

Changes in 5.1.11 Beta 2

1)  Update release documents.

2)  Be selective about verification of the conntrack utility when
    DYNAMIC_BLACKLIST=ipset,disconnect...

3)  Don't require shorewall to be started for 'allow' with ipset-based
    DBL.

4)  Make address variables play nice with the 'clear' command.

5)  Don't unconditionally enable forwarding during 'clear'.

Changes in 5.1.11 Beta 1

1)  Update release documents.

2)  Allow non-root to run some 'show' commands.

3)  Use synchain name in log messages rather than base chain name.

3)  Assume :syn for TCP CT entries in the conntrack file and HELPER.

4)  Limit depth of 'find' search when AUTOMAKE=Yes.

Changes in 5.1.10.2

1)  Update release documents.

2)  Limit 'find' to depth 1.

3)  Don't run find in an empty entry in $CONFIG_PATH

Changes in 5.1.10.1

1)  Update release documents.

2)  Fix Shorewall-core installer for sandbox case.

3)  Make /etc and /configfiles the same.

Changes in 5.1.10 Final

1)  Update release documents.

Changes in 5.1.10 RC 2

1)  Update release documents.

2)  Add warning re wildcard and OPTIONS.

3)  Correct IPv6 Universal interfaces file.

Changes in 5.1.10 RC 1

1)  Update release documents.

2)  Correct ingress policing.

3)  Fix Shorewall-init recompilation problem.

Changes in 5.1.10 Beta 2

1)  Update release documents.

2)  Allow a protocol to be associated with a regular action.

3)  Remove the PSH flag from the FIN action.

Changes in 5.1.10 Beta 1

1)  Update release documents.

2)  Allow CONFIG_PATH setting to begin with ':' to allow dropping the
    first directory by non-root.

3)  Correct several typos in the manpages (Roberto Sánchez).

4)  Correct typo in 'dump' processing.

5)  Reset all table counters during 'reset'.

Changes in 5.1.9 Final

1)  Update release documents.

2)  Use logical interface names in the Sample configs.

Changes in 5.1.9 RC 1

1)  Update release documents.

2)  Apply W Van den Akker's OpenWRT/Lede patches.

3)  Don't verify IP and SHOREWALL_SHELL paths when compiling
    for export.

4)  Support for Redfish remote console in macro.IPMI

Changes in 5.1.9 Beta 2

1)  Update release documents.

2)  Merge content from 5.1.8.

Changes in 5.1.9 Beta 1

1)  Update release documents.

2)  Add TCPMSS action in the mangle file.

3)  Inline the Broadcast action when ADDRTYPE match is available.

4)  Support logging in the snat file.

5)  Add shorewall-logging(5).

Changes in 5.1.8 Final

1)  Update release documents.

Changes in 5.1.8 RC 1

1)  Update release documents.

2)  Correct 'delete_default_routes()'.

3)  Delete default routes from 'main' when a fallback provider is
    successfully enabled.

4)  Don't restore default route when a fallback provider is enabled.

5)  Issue a warning when 'persistent' is used with
    RESTORE_DEFAULT_ROUTE=Yes.

6)  Don't dump SPD entries for the other address family.

Changes in 5.1.8 Beta 2

1)  Update release documents.

2)  Fix 'persistent' provider issues.

Changes in 5.1.8 Beta 1

1)  Update release documents.

2)  Treat LOG_TARGET the same as all other capabilities.

3)  Allow merging of rules with IPSEC policies

Changes in 5.1.7.1

1)  Update release documents.

2)  Correct 'reenable' logic for persistent providers.

3)  Align progress messages produced by 'reenable'.

Changes in 5.1.7 Final

1)  Update release documents.

Changes in 5.1.7 RC 2

1)  Update release documents.

2)  Correct module loading.

3)  Add DOCKER-INGRESS support.

Changes in 5.1.7 RC 1

1)  Update release documents.

2)  Correct handling of ipsets in the DEST column of the snat file.

3)  Allow NAT rules to be passed to perl_action_helper()

4)  Split NAT and ACCEPT rules in the Event actions.

5)  Correct VLSM verification logic in the 'ipcalc' command.

6)  Fix ADD_IP_ALIASES default.

7)  Remove empty/useless .tmp files created during shorewall-init stop.

Changes in 5.1.7 Beta 2

1)  Update release documents.

2)  Improve dynamic gateway detection.

Changes in 5.1.7 Beta 1

1)  Update release documents.

2)  Simplify Module Loading (Tuomo Soini)

3)  Eliminate MODULE_SUFFIX.

Changes in 5.1.6 Final

1)  Update release documents.

2)  Allow port variables as server port in DNAT rules.

3)  Change MODULE_SUFFIX standard default to "ko ko.xz"

4)  Added UDP rule to macro.RDP.

Changes in 5.1.6 RC 2

1)  Update release documents.

2)  Use MUTEX_TIMEOUT for ip[6]tables-restore --wait interval

Changes in 5.1.6 RC 1

1)  Update release documents.

2)  Make Shorewall's handling of '+' consistent with Netfilter's.

3)  Verify that parent and child zones have an interface in common.

4)  Allow runtime address variables as the DNAT server address.

5)  Prevent IPv4 and IPv6 firewalls from starting simultaneously under
    systemd.

6)  Use the ip[6]-tables --wait option, if available.

Changes in 5.1.6 Beta 2

1)  Update release documents.

2)  Pass arguments to the enable and disable user exit functions

3)  Export CONFDIR and SHAREDIR to the generated script.

4)  Correct handling of combining a policy chain with a normal chain.

Changes in 5.1.6 Beta 1

1)  Update release documents.

2)  Apply Bernhard M. Wiedemann's patch for reproducible builds.

3)  Patch configure.pl to support reproducible builds.

4)  Merge content from 5.1.5.1.

Changes in 5.1.5.2

1)  Update release documents.

2)  Correct source port handling when BASIC_FILTERS=Yes.

3)  Correct handling of USER/GROUP in the OUTPUT section of the
    accounting file.

4)  Correct handling of MAC addresses in the accounting file.

Changes in 5.1.5.1

1)  Update release documents.

2)  Process the snat file if the masq file is empty.

3)  Apply Bernhard Wiedemann's configure change.

4)  Make a similar change to configure.pl.

Changes in 5.1.5 Final

1)  Update release documents.

2)  Include IPv6 annotated config files.

3)  Add RESTORE_DEFAULT_ROUTE to shorewall6.conf.

Changes in 5.1.5 RC 1

1)  Update release documents.

2)  USE_NFLOG_SIZE option.

3)  Improve editing of port numbers/service names.

4)  Add dropBcasts action.

Changes in 5.1.5 Beta 2

1)  Update release documents.

2)  Consolidate Shorewall/Shorewall6 manpages.

Changes in 5.1.5 Beta 1

1)  Update release documents.

2)  Add defect repair through 5.1.4.2.

3)  Implement runtime port variables.

Changes in 5.1.4.4

1)  Update release documents.

2)  Correct handling of two or more fallback providers

Changes in 5.1.4.3

1)  Update release documents.

2)  Don't generate multihop routes unnecessarily

Changes in 5.1.4.2

1)  Update release documents.

2)  Correct many broken links in the manpages.

3)  Correct NFQUEUE without the 'c' option.

Changes in 5.1.4.1

1)  Update release documents.

2)  Update shorewall-rules(5).

3)  Expand LOGFORMAT documentation.

4)  Restore the BLACKLIST action in Shorewall6.

Changes in 5.1.4 Final

1)  Update release documents.

Changes in 5.1.4 RC 1

1)  Update release documents.

2)  Add PERL_HASH_SEED option.

Changes in 5.1.4 Beta 2

1)  Update release documents.

2)  Correct validation of string interface options.

3)  Correct handling of IPv6 tunnel-src and tunnel-dst.

4)  Documentation cleanup.

Changes in 5.1.4 Beta 1

1)  Update release documents.

2)  Unify Actions

3)  Report invocation site when generating ?info and ?warning messages

4)  Add IPv6 UPnP support.

5)  ?reset of action variable now sets $parmsmodified.

6)  Clean up column/value pair editing.

Changes in 5.1.3.1

1)  Update release documents.

2)  Correct typo in BLACKLIST_DEFAULT settings

3)  Fix 'add+' handling.

4)  Correct two-interface snat file.

Changes in 5.1.3 Final

1)  Update release documents.

2)  Quote 'none' AND SMURF_LOG_LEVEL in _DEFAULT settings.

3)  Correct IPv6 Multicast action.

4)  Tabify new actions.

5)  Add Multicast to the deprecated A_Drop and A_Reject actions.

6)  Correct log message from IPv6 Multicast action.

Changes in 5.1.3 RC 2

1)  Update release documents.

2)  Enclose _LEVEL and _DEFAULT settings in quotes during update.

3)  Expand variables during .conf processing except when updating.

Changes in 5.1.3 RC 1

1)  Update release documents.

2)  Re-add Multicast to IPv6 samples.

3)  Add dropInvalid to IPv6 samples.

Changes in 5.1.3 Beta 2

1)  Update release documents.

2)  Clear firewall on Debian systemd 'stop'.

3)  Correct tcp-reset handling.

4)  Implement PROTO=tcp:!syn.

5)  Quote "$LOG_LEVEL" in shorewall[6].conf samples.

6)  Modify rejNotSyn and dropNotSyn to use the two preceding changes.

7)  Merge 5.1.2.2/3 fixes.

8)  Quote $LOG_LEVEL in shorewall[6].conf samples.

9)  'reload' documentation corrections.

10) Set TC_ENABLED=Shared in IPv6 samples.

11) Remove Multicast from IPv6 policy actions.

Changes in 5.1.3 Beta 1

1)  Update release documents.

2)  Installer/uninstaller changes from Matt Darfeuille.

3)  Replace determinism sorts with PERL_HASH_SEED.

4)  Correct recent compiler directives WRT omitting

5)  Eliminate builtin actions.

Changes in 5.1.2.1

1)  Update release documents.

2)  Document fix for 'show action allowinUPdP'.

3)  Document fix for logging in BLACKLIST.

Changes in 5.1.2

1)  Update release documents.

Changes in 5.1.2 RC 1

1)  Update release documents.

2)  Fix LOG_LEVEL

3)  Fix allowMcast

4)  Make 'show action' work (sort of) with builtin actions.

Changes in 5.1.2 Beta 2

1)  Update release documents.

2)  Change policy actions.

3)  Fix IPv6 dropBcasts.

4)  Add LOG_LEVEL option.

5)  Separate broadcast and multicast handling

Changes in 5.1.2 Beta 1

1)  Update release documents.

2)  Implement default action lists.

3)  Manpage updates.

Changes in 5.1.0 Final.

1)  Update release documents.

Changes in 5.1.1 RC 1

1)  Update release documents.

2)  Make BALANCE_PROVIDERS default the setting of USE_DEFAULT_RT.

3)  Add BLACKLIST policy

4)  Add BLACKLIST action

5)  Implement ?REQUIRE

6)  Implement 'show action <action>'

7)  Implement 'section' action option

8)  Embed BLACKLIST macro logic into the BLACKLIST action.

Changes in 5.1.1 Beta 2

1)  Update release documents.

2)  Replace USE_DEFAULT_RT=Exact with BALANCE_PROVIDERS=No.

3)  Handle optional interfaces correctly in process_a_provider().

Changes in 5.1.1 Beta 1

1)  Update release documents.

2)  Catch routefilter/provider conflicts.

3)  Set 'logmartians' along with 'routefilter'.

4)  Implement USE_DEFAULT_RT=Exact.

Changes in 5.1.0.1

1)  Update release documents.

2)  Correct Shorewall6-lite .service file

3)  Propagate PAGER setting to -lite systems.

Changes in 5.1.0 Final

1)  Update release documents.

2)  Ignore SUBSYSLOCK when $SERVICEDIR is non-empty

3)  Correct splitting of IP(6)TABLES options.

4)  Allow compact IPv6 addresses in IP6TABLES() parameters.

Changes in 5.1.0 RC 2

1)  Update release documents.

2)  Eliminate use of 'echo' escape sequences

3)  Update kernel module files

Changes in 5.1.0 RC 1

1)  Update release documents.

2)  Move the action files into their own directory.

3)  Add the 'show ipsec' command.

4)  Remove rawpost support.

5)  Add Stateful IPv6 netmapping

Changes in 5.1.0 Beta 2

1)  Update release documents.

2)  Fatal error on empty action file and presense of a file with
    the same name as the action.

3)  Use 'ip xfrm' to dump SPD and SAD

4)  Create CLI symlinks

5)  Correct intra-zone processing in policies.

Changes in 5.1.0 Beta 1

1)  Update release documents.

2)  Unify the CLI

3)  Extend SOURCE/DEST syntax in the rules files

4)  Remove CHAIN_SCRIPT support.

5)  Avoid needless duplicate action chains.

6)  Implement support for NFQUEUE CPU Fanout.
