~jdstrand/ufw/ufw-master-import

ufw (0.37) UNRELEASED; urgency=medium

  * snap packaging updates:
    - ufw-init: use '-n' instead of '-s' with --rootdir and --datadir
      (LP: #1808463)
    - backend_iptables.py: ufw-init is in --rootdir (which is SNAP, not
      SNAP_DATA for the snap)
    - snap-files/bin/srv:
      + don't copy $SNAP/lib/ufw; create $SNAP_DATA/lib/ufw
      + cleanup $SNAP_DATA after old snap revisions
    - snap-files/bin/init: use SNAP_REVISION to match snap-files/bin/srv
  * update man page for limit since IPv6 has been supported since 0.33
    (LP: #1831186)
  * add direction when no interfaces specified in get_app_tuple()
    (LP: #1838764)
  * various testsuite adjustments for iptables 1.8
  * doc/ufw.8:
    - ::/0 is also a synonym for 'Anywhere'
    - document --force with 'ufw delete NUM'
    - document 'insert' and 'prepend' can't be used to update comments
      (LP: #1927737)
  * prefer python3
  * empty out IPT_MODULES and update documentation (LP: #1556419)
  * check-requirements:
    - adjust check-requirements to look for other firewall software
    - update for python 3.10+
  * conf/sysctl.conf: remove tcp_sack=1 and non-firewall sysctls
    (LP: #1884821)
  * src/backend_iptables.py:
    - remove unreachable code (LP: #1927734)
    - unconditionally reload user rules with 'delete' (LP: #1933117)
  * src/ufw-init-functions: set default policy after loading rules. Thanks to
    Mauricio Faria de Oliveira. (LP: #1946804)
  * src/util.py:
    - properly parse /proc/pid/stat for WSL (LP: #2015645)
    - mitigate odd length string with unhexlify (Closes: 1034568)
    - support vrrp protocol (LP: #1996636)
  * add locales/po/ro.po. Thanks Remus-Gabriel Chelu (Closes: 1034119)
  * add '-h' and show help with no args (LP: #1965462)
  * src/backend.py: add get_rules_ipv4() and get_rules_ipv6() (LP: #1951018)
  * tests/root: normalize 'ACCEPT {all,tcp}' and 'ACCEPT N' for newer systems

 -- Jamie Strandboge <jdstrand@ubuntu.com>  Tue, 16 May 2023 07:04:50 -0500

ufw (0.36) RELEASED; urgency=medium

  * doc/ufw-framework.8:
    - fix path for user[6].rules
    - reference nf_conntrack_sane
    - fix syntax error in example rule (LP: #1782384)
  * snap packaging:
    - adjust snappy packaging for series 16 and to use snapcraft
    - add bash completer to snap packaging
    - add ipset and conntrack
  * doc/ufw-on-snappy.8: update for series 16
  * src/backend_iptables.py: properly calculate the path to state_dir when
    specifying --rootdir and --datadir (ie, fix regression in 0.35 final)
  * conf/before6.rules:
    - adjust ufw6-before-output rules for echo-reply and echo-request
      (LP: #1633698)
    - move echo-reply for ufw6-before-input before INVALID (LP: #1664133,
      LP: #1509725)
  * conf/ufw.defaults: mention nf_conntrack_sane
  * adjust runtime tests to use daytime/port 13 instead of ssh/port 22
    everywhere and adjust to use daytime/port 13 instead of http/port 80 and
    https/port 443 in good/logging and ipv6/bad_args6 (Closes: 849628)
  * don't disable syncookies and instead use the system's value by default
  * Bittorrent can also use UDP (LP: #1695718)
  * doc/ufw.8: remove spurious apostrophes from man page. Thanks to Tom
    Spurling
  * common.py:
    - adjust regex to be more liberal with non-meta characters in interface
      names (LP: #1719211)
    - don't allow interfaces longer than 15 characters
  * shell-completion/bash: use _have() instead of have(). Thanks to Andrew
    Nowak and Paulo Marcel Coelho Aragao (LP: #1775043)
  * support concurrent updates (LP: #1204579, LP: #1652163, LP: #1377600,
    Closes: 686248)
  * add 'prepend' command to better support IPS (fail2ban, etc. LP: #1368411,
    LP: #1586258, Closes: 909163)
  * backend.py: only warn if initcaps() fails is disabled (Closes: 884932)
  * conf/before.rules: remove extraneous source quench rule (LP: #1558068)

 -- Jamie Strandboge <jamie@ubuntu.com>  Fri, 14 Dec 2018 12:01:29 -0600

ufw (0.35) RELEASED; urgency=medium

  * update check-requirements and README for python 3.5
  * update unit tests to not fail when /proc/net/* has no useful information
    (Closes: 797020)
  * update rsyslog example to use 'stop' instead of the deprecated '~'
    (Closes: 798100)
  * add --rootdir and --datadir options to ufw and ufw-init to make
    relocatable
  * files owned by 'clickpkg' are ok too
  * add preliminary snappy packaging
  * add support for comments (LP: #448503)
  * don't allow 'route delete NUM' and suggest 'delete NUM' instead
  * move user[6].rules to /etc/ufw (LP: #728128)
  * update README: python3 < 3.4 is no longer supported

 -- Jamie Strandboge <jamie@ubuntu.com>  Sun, 07 Feb 2016 16:55:26 -0600

ufw (0.34) RELEASED; urgency=low

  * refactor capabilities checks and only call when needed
  * error out early instead of tracing back with iptables errors in
    get_netfilter_capabilities() (LP: #1044361)
  * fix TypeError which somehow only manifested itself when using zh_CN
  * add 'reload' to help (LP: #1059060)
  * check-requirements now gives iptables output on failure. Patch thanks to
    S. Nizio.
  * use conntrack instead of state module. Patch based on work by S. Nizio.
    (LP: #1065297)
  * don't use get_netfilter_capabilities() with ipv6 if ipv6 is disabled
    (LP: #1039729, LP: #1062521)
  * fix parse error when finding PPID (LP: #1101304)
  * implement before and after hooks in /etc/ufw/(before|after).init
    (LP: #1075975) TODO: add tests
  * add unit test framework and cleanup, remove dead and refactor some code
  * honor UFW_SKIP_CHECKS=1 environment variable with setup.py, which eases
    testing
  * tests/check-requirements: add a check for -m rt --rt-type 0 (LP: #1191197)
  * match simple rule syntax and don't allow ports with esp and ah protocols
    with extended rule syntax
  * when displaying extended rules via parser.get_command(), show "out" if the
    direction is "out" and there is no corresponding interface
  * fix return of various invalid extended rules in parser.get_command()
  * clarify 'limit' command in man page (LP: #1089262)
  * implement route rules (ie, manage FORWARD, LP: #262421). See man page for
    details. This change reworked interface parsing and we now allow
    interfaces with '_' in the name (LP: #1098472)
  * add state RELATED,ESTABLISHED rule to ufw-before-forward in before*.rules
    like we do with ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * add ufw[6]-track-forward chain and handle it the same as for
    ufw[6]track-input and ufw[6]-track-output
  * document ufw[6]-track-* in README (dropped in previous commit)
  * fix for 'status' not distingushing between some v4/v6 targets
    (LP: #1078665)
  * add safe icmp packets packets to ufw-before-forward in before*.rules like
    we do for ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * update check-requirements for python 3.3 and 3.4
  * add 5269/tcp to XMPP (LP: #1327162)
  * fix traceback with forward rule
  * import new and updated Launchpad translations:
    - po/ar.po, po/ast.po, po/bg.po, po/bs.po, po/ca.po, po/ce.po, po/cs.po,
      po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
      po/et.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
      po/ja.po, po/ko.po, po/lv.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
      po/pt.po, po/ru.po, po/se.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po,
      po/tl.po, po/tr.po, po/uk.po, po/ur.po, po/zh_CN.po, po/zh_TW.po
    - thanks to all contributors: https://translations.launchpad.net/ufw
  * also use .lower() on translations for 'yes' (LP: #1438647)
  * adjust/rearrange before6.rules for rfc4890 'must not be blocked' and
    'should not be blocked' (LP: #1434525, LP: #1030214)
  * doc/systemd.example: add service file from Ubuntu (LP: #1341083)
  * correctly spell qBittorrent (LP: #1273965)
  * update man page for app rules (LP: #1155292)
  * support igmp protocol (LP: #946322)
  * adjust testsuite for systems supporting smtp/udp (LP: #815982)
  * enforce that basic commands don't have arguments (LP: #1155250)
  * update command completion for --dry-run, --force, --help and route
    (LP: #1225666)
  * support gre protocol (LP: #1418879)
  * support ./setup.py build (LP: #819600)
  * doc/ufw.8:
    - clarify log level behavior (LP: #1461701)
    - add app profile syntax
    - add protocol support
  * skip profiles with invalid port declarations (LP: #1201934)
  * tests/check-locales: skip locales that fail to install or generate

 -- Jamie Strandboge <jamie@ubuntu.com>  Thu, 20 Aug 2015 11:48:13 -0500

ufw (0.33) RELEASED; urgency=low

  * conf/after6.rules: also use correct ports for DHCPv6. Thanks to Marco
    Davids (LP: #1007326)
  * src/util.py: add get_netfilter_capabilities() for getting the capabilities
    set for things we want to support but may not be in all kernels/iptables
    versions
  * add IPv6 limit support (LP: #951462)
  * import new and updated Launchpad translations:
    - po/ast.po, po/bs.po, po/cs.po, po/de.po, po/el.po, po/en_AU.po,
      po/en_GB.po, po/es.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/it.po,
      po/nb.po, po/nl.po, po/pt_BR.po, po/pt.po, po/sk.po, po/sl.po, po/sv.po,
      po/zh_CN.po, po/zh_TW.po (new, LP: #868195)
    - thanks to all contributors: https://translations.launchpad.net/ufw
  * README.translations: updated for paths and testing
  * add 'show added' report (LP: #987784)
  * remove ACCEPT_NO_TRACK option since it never worked (LP: #787955)
  * src/backend_iptables.py: display output of ufw-init if it fails
  * don't traceback if can't determine iptables version

 -- Jamie Strandboge <jamie@ubuntu.com>  Sun, 12 Aug 2012 10:58:04 -0500

ufw (0.32) RELEASED; urgency=low

  * Obsolete python2.5 in preparation for python3 support
  * Adjust gettext initialization so that _() always returns unicode. Patch
    thanks to Barry Warsaw
  * Add python3 support (LP: #1001657)
  * profiles/ufw-directoryserver: use LDAPS key for LDAPS

 -- Jamie Strandboge <jamie@ubuntu.com>  Sat, 19 May 2012 08:48:15 -0500

ufw (0.31.1) RELEASED; urgency=low

  * src/util.py: revert revert r752 which introduced problems with other
    locales (LP: #953372)
  * add tests/check-locales. This is Debian/Ubuntu specific, but will help
    avoid commits like r752.

 -- Jamie Strandboge <jamie@ubuntu.com>  Mon, 12 Mar 2012 20:26:28 -0500

ufw (0.31) RELEASED; urgency=low

  * allow UPnP multicast for service discovery (LP: #764933)
  * conf/ufw.defaults:
    - remove IRC connection tracking, which is only required for DCC
    - allow nf_conntrack_netbios_ns (Samba) (LP: #360975)
  * enable IPv6 by default
  * fix 'allow to any ipv6' when IPv6 is enabled
  * update manpage references to ufw and ufw-framework to include the section
  * update check-requirements to prompt to continue with tests that may
    autoload modules. Add '-f' option to check-requirements and update test
    suite accordingly (LP: #782816)
  * don't fail when running 'show listening' under fakeroot (LP: #812516)
  * add syntax-check to Makefile
  * add man-check to Makefile
  * src/util.py: use codes.open(..., 'UTF-8') to better support non-english
    locales in third-party frontends. Analysis and patch suggestion thanks to
    S. Nizio. (LP: #921758)
  * conf/ufw.defaults and doc/ufw-framework.8: add info on tftp connection
    tracking modules
  * fix traceback when specifying '--dry-run' with no arguments (LP: #946332)
  * tests/testlib.sh: add 'http-or-www' argument to do_cmd() to try to
    account for /etc/services files with http/udp instead of www/udp. Adjust
    bad/apps and root/normalization for this (LP: #947224)
  * conf/before6.rules: use correct ports for DHCPv6 and limit source and
    destination addresses to autoconfiguration addresses (fe80::/10). Thanks
    to Mathieu Trudel-Lapierre (LP: #947416)
  * import new and updated Launchpad translations:
    - po/ar.po, po/ast.po (new), po/bg.po, po/bs.po (new), po/ca.po, po/cs.po,
      po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
      po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
      po/ja.po (new), po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po, po/pt.po,
      po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po,
      po/ur.po (new), po/zh_CN.po
    - thanks to all contributors: https://translations.launchpad.net/ufw
  * allow multiple interface matching via '+'. Thanks to Oliver Hookins.
    (LP: #611838)
  * allow application profiles to start with a digit (LP: #663632)
  * don't traceback in show listening when a rule references a non-existent
    interface (LP: #840500)

 -- Jamie Strandboge <jamie@ubuntu.com>  Fri, 09 Mar 2012 14:24:24 -0600

ufw (0.30.1) RELEASED; urgency=low

  * allow for python 2.7 (verified to work with python 2.7.1)
  * fix improper display of error messages. Patch thanks to Serguey Basalaev
    (LP: #580032)
  * profiles/ufw-mailserver: remove Postfix reference
  * fix typo in warning (LP: #637876)
  * fix manpage reference to /etc/default/ufw (Closes: 601111)
  * mention quoting of application profile names with spaces (LP: #715676)
  * fix man-page hyphenation in ufw.8
  * run_tests.sh: adjust PATH if iptables can't be found
  * adjust /etc/ufw/sysctl.conf to have commented out entries for ipv6 privacy
    addressing
  * profiles/ufw-fileserver: add svnserve profile (LP: #501140)
  * use 'UFW AUDIT INVALID' for INVALID packets in medium and higher
  * DROP packets with RH0 headers (LP: #740249)
  * update README to discuss the default ruleset
  * only allow mDNS multicast (LP: #740256)
  * allow ping replies from multicast (LP: #720605)

 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 22 Mar 2011 12:06:10 -0500

ufw (0.30) RELEASED; urgency=low

  * add example Upstart script
  * error out when filesystem is read-only (LP: #430053)
  * catch exception if can't find parent pid when refreshing application
    profiles (LP: #424528)
  * update manpage to clarify 'show' command (LP: #453083)
  * update setup.py to use sys.executable and cleanup required binaries
  * update test suite
    - better handle iptables < 1.4 (tested with 1.3.8)
    - allow alternate interpreter
  * write loglevel rules to user rules (LP: #459925)
  * properly log INVALID packets for medium and higher (LP: #480789)
  * Makefile: clean up POTFILES target
  * generate binary translations in setup.py rather than shipping them in
    source (LP: #490366)
  * src/ufw-init-functions: don't run 'already started' check unless
    ENABLED. This should improve boot speed such that iptables is not
    needlessly called which results in an unneeded modprobe.
  * manpage fixes thanks to Loic Minier
  * set "default" sysctl values before "all" values. Thanks to Loic Minier
  * clean up parser to make it easier to add new functionality
  * don't log LIMIT rules if logging is off (LP: #512131)
  * fix for noisy services getting logged. Added new 'skip-to-policy' chains
    that are now used in after*.rules (LP: #488032)
  * add rsyslog example configuration and update README
  * add reset command (LP: #436608)
  * add --force option to enable (LP: #496267)
  * decode("utf-8") some strings in 'status' to correct formatting errors with
    with multibyte characters
  * add more reports
  * add delete by rule number (LP: #367571)
  * add support for IPv6 tunnels and 6to4 (LP: #502655)
  * fix occasional ufw errors during boot with upstart (/tmp not available)
    (LP: #521359)
  * normalize IPv6 addresses to standard python shortened notation
  * follow iptables and don't require that an interface ends with a number
    (LP: #568877)
  * really allow IPv6 neighbor discovery (LP: #611982)
  * add support for IPSec via the esp and ah protocols (LP: #606997)
  * fix traceback in 'show listening' report (LP: #624199)
  * fix inaccuracies in 'show listening' report with IPv6 (LP: #625340)
  * update check-requirements to not check ip6tables modules needed for the
    'limit' command
  * import updated Launchpad translations:
    - po/ar.po, po/bg.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po,
      po/en_AU.po, po/en_GB.po, po/es.po, po/fi.po, po/fr.po, po/he.po,
      po/hu.po, po/id.po, po/it.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
      po/pt.po, po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po,
      po/zh_CN.po
    - thanks to all contributors: https://translations.launchpad.net/ufw

 -- Jamie Strandboge <jamie@ubuntu.com>  Fri, 27 Aug 2010 15:30:43 -0500

ufw (0.29) RELEASE; urgency=low

  * add egress filtering support:
    - CLI command allows specifying direction in simple and extended syntax
    - status reporting shows outgoing policy and outgoing rules
    - allow changing default outgoing policy
    - connection tracking rules for state NEW, when using a default policy
      of ACCEPT for INPUT and OUTPUT, are now put in their own chains, rather
      than configured in before*.rules
    - add state RELATED,ESTABLISHED rule to ufw-before-output in before*.rules
      like we do with ufw-before-input, to increase performance
    - DEFAULT_OUTPUT_POLICY and DEFAULT_INPUT_POLICY can now also be set to
      ACCEPT_NO_TRACK, which avoids adding connection tracking rules for
      state NEW
    - update documentation for the above
  * add tests/check-requirements and integrate into test suite. This script
    can be used to make sure that your system has all the required iptables
    and netfilter functionality as described in README
  * add doc/ufw-framework.8
  * allow deletion of non-existent application rules introduced in 0.24.
    (LP: #407810)
  * import Launchpad translations:
    - po/ar.po, po/bg.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po,
      po/en_AU.po, po/en_GB.po, po/fi.po, po/fr.po, po/he.po, po/hu.po,
      po/id.po, po/it.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po, po/pt.po,
      po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po, po/zh_CN.po
    - thanks to all contributors: https://translations.launchpad.net/ufw
    - moved translations into locales/po and locales/mo. setup.py installs
      files in locales/mo
    - translations are now installed into ${prefix}/share/ufw/messages

 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 25 Aug 2009 09:12:10 -0500

ufw (0.28) RELEASE; urgency=low

  * translation fixes
  * add interface rules
  * update Makefile to fail if byte-compiling failed
  * install rules files 0640 (LP: #393187)
  * adjust help command for proper translation and bash completion support
  * add limit command to help (LP: #358964)
  * add shell-completion/bash. Based on work by Didier Roche
  * tests/*: updated with 'nostats' option so redundant tests are counted
    in test results. Update many root tests to use 'nostats'
  * look for location of iptables and set IPTABLES_DIR in common.py. Adjust
    calls to ip[6]tables* to use IPTABLES_DIR
  * fix harmless but annoying bug where multi-rule application rules ended
    up with ::/0 in the tuple line in user.rules (IPV4) when not specifying a
    destination or source address and IPV6 is enabled
  * make insert rule logic more robust
  * update setup.py to install user rules and init script helpers into
    /lib, rather than /var/lib and /usr/share/ufw. Update tests,
    backend_iptables.py, ufw-init and documentation accordingly. (LP: #400208)

 -- Jamie Strandboge <jamie@ubuntu.com>  Wed, 15 Jul 2009 09:30:25 -0500

ufw (0.27.1) RELEASE; urgency=low

  * update README for instructions on integrating ufw into the boot process
  * adjust strings to better conform with translation guidelines (LP: #353424)
  * adjust translation location to work with rosetta

 -- Jamie Strandboge <jamie@ubuntu.com>  Mon, 23 Mar 2009 12:06:27 -0500

ufw (0.27) RELEASE; urgency=low

  * don't do symlink check anymore (LP: #317700)
  * don't do hidden file check anymore (LP: #319226). Hidden application
    profiles are already skipped, so this check only bumps into revision
    control systems
  * add 'status numbered' command
  * more comments in conf/sysctl.conf
  * add insert rule support (LP: #260745)
  * read in rules from /var/lib/ufw/*.rules. This helps keep status inline
    with reality and fixes (LP: #262975)
  * add loglevel support. This also changed the default rules files
  * add per rule logging support
  * get rid of redundant RETURN rules
  * update LIMIT logging prefix
  * update setup.py to use subprocess instead of Popen3

 -- Jamie Strandboge <jamie@ubuntu.com>  Sat, 17 Jan 2009 07:15:25 -0600

ufw (0.26) RELEASE; urgency=low

  * fix formatting when using 'app update all' (LP: #300726)
  * add runtime version check for iptables and warn if using IPv6 application
    rules with iptables < 1.4
  * Makefile: depend on translations when making tarball
  * remove more useless newlines
  * man page updates
  * display interfaces and exact packet counters in 'status raw'
  * support REJECT for rules, default policy and default application policy
    (LP: #197322)
  * only flush and delete ufw chains
  * add a 'flush-all' command to ufw-init
  * add MANAGE_BUILTINS option to /etc/default/ufw, and when set to 'yes'
    flush the built-in chains too

 -- Jamie Strandboge <jamie@ubuntu.com>  Fri, 16 Jan 2009 07:01:38 -0600

ufw (0.25) RELEASE; urgency=low

  * new ChangeLog files for upstream tarballs. See ChangeLog.pre-0.25 for
    previous changes, including Ubuntu-specific changes
  * setup.py: don't install initscript anymore
  * add example (non-LSB) initscript to doc/initscript.example
  * split out initscript into ufw-init-functions, ufw-init (for use by
    ufw itself) and doc/initscript.example (for use by distributions). This
    makes ufw more robust and portable
  * don't stop the firewall via the initscripts if ufw is not enabled
    (LP: #311066)
  * rename skel-ui to skel-ui.example
  * README:
    - add Distributions section
    - update for initscript changes
    - update What's in a Name

 -- Jamie Strandboge <jamie@ubuntu.com>  Mon, 22 Dec 2008 08:53:14 -0600