ufw (0.35) UNRELEASED; urgency=medium
* update check-requirements and README for python 3.5
* update unit tests to not fail when /proc/net/* has no useful information
(Closes: 797020)
* update rsyslog example to use 'stop' instead of the deprecated '~'
(Closes: 798100)
* add --rootdir and --datadir options to ufw and ufw-init to make
relocatable
* files owned by 'clickpkg' are ok too
* add preliminary snappy packaging
* add support for comments (LP: #448503)
* don't allow 'route delete NUM' and suggest 'delete NUM' instead
* move user[6].rules to /etc/ufw (LP: #728128)
* update README: python3 < 3.4 is no longer supported
-- Jamie Strandboge <jamie@ubuntu.com> Sun, 07 Feb 2016 16:55:26 -0600
ufw (0.34) RELEASED; urgency=low
* refactor capabilities checks and only call when needed
* error out early instead of tracing back with iptables errors in
get_netfilter_capabilities() (LP: #1044361)
* fix TypeError which somehow only manifested itself when using zh_CN
* add 'reload' to help (LP: #1059060)
* check-requirements now gives iptables output on failure. Patch thanks to
S. Nizio.
* use conntrack instead of state module. Patch based on work by S. Nizio.
(LP: #1065297)
* don't use get_netfilter_capabilities() with ipv6 if ipv6 is disabled
(LP: #1039729, LP: #1062521)
* fix parse error when finding PPID (LP: #1101304)
* implement before and after hooks in /etc/ufw/(before|after).init
(LP: #1075975) TODO: add tests
* add unit test framework and cleanup, remove dead and refactor some code
* honor UFW_SKIP_CHECKS=1 environment variable with setup.py, which eases
testing
* tests/check-requirements: add a check for -m rt --rt-type 0 (LP: #1191197)
* match simple rule syntax and don't allow ports with esp and ah protocols
with extended rule syntax
* when displaying extended rules via parser.get_command(), show "out" if the
direction is "out" and there is no corresponding interface
* fix return of various invalid extended rules in parser.get_command()
* clarify 'limit' command in man page (LP: #1089262)
* implement route rules (ie, manage FORWARD, LP: #262421). See man page for
details. This change reworked interface parsing and we now allow
interfaces with '_' in the name (LP: #1098472)
* add state RELATED,ESTABLISHED rule to ufw-before-forward in before*.rules
like we do with ufw-before-input. This will only affect systems with ip
forwarding enabled via sysctl
* add ufw[6]-track-forward chain and handle it the same as for
ufw[6]track-input and ufw[6]-track-output
* document ufw[6]-track-* in README (dropped in previous commit)
* fix for 'status' not distingushing between some v4/v6 targets
(LP: #1078665)
* add safe icmp packets packets to ufw-before-forward in before*.rules like
we do for ufw-before-input. This will only affect systems with ip
forwarding enabled via sysctl
* update check-requirements for python 3.3 and 3.4
* add 5269/tcp to XMPP (LP: #1327162)
* fix traceback with forward rule
* import new and updated Launchpad translations:
- po/ar.po, po/ast.po, po/bg.po, po/bs.po, po/ca.po, po/ce.po, po/cs.po,
po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
po/et.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
po/ja.po, po/ko.po, po/lv.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
po/pt.po, po/ru.po, po/se.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po,
po/tl.po, po/tr.po, po/uk.po, po/ur.po, po/zh_CN.po, po/zh_TW.po
- thanks to all contributors: https://translations.launchpad.net/ufw
* also use .lower() on translations for 'yes' (LP: #1438647)
* adjust/rearrange before6.rules for rfc4890 'must not be blocked' and
'should not be blocked' (LP: #1434525, LP: #1030214)
* doc/systemd.example: add service file from Ubuntu (LP: #1341083)
* correctly spell qBittorrent (LP: #1273965)
* update man page for app rules (LP: #1155292)
* support igmp protocol (LP: #946322)
* adjust testsuite for systems supporting smtp/udp (LP: #815982)
* enforce that basic commands don't have arguments (LP: #1155250)
* update command completion for --dry-run, --force, --help and route
(LP: #1225666)
* support gre protocol (LP: #1418879)
* support ./setup.py build (LP: #819600)
* doc/ufw.8:
- clarify log level behavior (LP: #1461701)
- add app profile syntax
- add protocol support
* skip profiles with invalid port declarations (LP: #1201934)
* tests/check-locales: skip locales that fail to install or generate
-- Jamie Strandboge <jamie@ubuntu.com> Thu, 20 Aug 2015 11:48:13 -0500
ufw (0.33) RELEASED; urgency=low
* conf/after6.rules: also use correct ports for DHCPv6. Thanks to Marco
Davids (LP: #1007326)
* src/util.py: add get_netfilter_capabilities() for getting the capabilities
set for things we want to support but may not be in all kernels/iptables
versions
* add IPv6 limit support (LP: #951462)
* import new and updated Launchpad translations:
- po/ast.po, po/bs.po, po/cs.po, po/de.po, po/el.po, po/en_AU.po,
po/en_GB.po, po/es.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/it.po,
po/nb.po, po/nl.po, po/pt_BR.po, po/pt.po, po/sk.po, po/sl.po, po/sv.po,
po/zh_CN.po, po/zh_TW.po (new, LP: #868195)
- thanks to all contributors: https://translations.launchpad.net/ufw
* README.translations: updated for paths and testing
* add 'show added' report (LP: #987784)
* remove ACCEPT_NO_TRACK option since it never worked (LP: #787955)
* src/backend_iptables.py: display output of ufw-init if it fails
* don't traceback if can't determine iptables version
-- Jamie Strandboge <jamie@ubuntu.com> Sun, 12 Aug 2012 10:58:04 -0500
ufw (0.32) RELEASED; urgency=low
* Obsolete python2.5 in preparation for python3 support
* Adjust gettext initialization so that _() always returns unicode. Patch
thanks to Barry Warsaw
* Add python3 support (LP: #1001657)
* profiles/ufw-directoryserver: use LDAPS key for LDAPS
-- Jamie Strandboge <jamie@ubuntu.com> Sat, 19 May 2012 08:48:15 -0500
ufw (0.31.1) RELEASED; urgency=low
* src/util.py: revert revert r752 which introduced problems with other
locales (LP: #953372)
* add tests/check-locales. This is Debian/Ubuntu specific, but will help
avoid commits like r752.
-- Jamie Strandboge <jamie@ubuntu.com> Mon, 12 Mar 2012 20:26:28 -0500
ufw (0.31) RELEASED; urgency=low
* allow UPnP multicast for service discovery (LP: #764933)
* conf/ufw.defaults:
- remove IRC connection tracking, which is only required for DCC
- allow nf_conntrack_netbios_ns (Samba) (LP: #360975)
* enable IPv6 by default
* fix 'allow to any ipv6' when IPv6 is enabled
* update manpage references to ufw and ufw-framework to include the section
* update check-requirements to prompt to continue with tests that may
autoload modules. Add '-f' option to check-requirements and update test
suite accordingly (LP: #782816)
* don't fail when running 'show listening' under fakeroot (LP: #812516)
* add syntax-check to Makefile
* add man-check to Makefile
* src/util.py: use codes.open(..., 'UTF-8') to better support non-english
locales in third-party frontends. Analysis and patch suggestion thanks to
S. Nizio. (LP: #921758)
* conf/ufw.defaults and doc/ufw-framework.8: add info on tftp connection
tracking modules
* fix traceback when specifying '--dry-run' with no arguments (LP: #946332)
* tests/testlib.sh: add 'http-or-www' argument to do_cmd() to try to
account for /etc/services files with http/udp instead of www/udp. Adjust
bad/apps and root/normalization for this (LP: #947224)
* conf/before6.rules: use correct ports for DHCPv6 and limit source and
destination addresses to autoconfiguration addresses (fe80::/10). Thanks
to Mathieu Trudel-Lapierre (LP: #947416)
* import new and updated Launchpad translations:
- po/ar.po, po/ast.po (new), po/bg.po, po/bs.po (new), po/ca.po, po/cs.po,
po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
po/ja.po (new), po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po, po/pt.po,
po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po,
po/ur.po (new), po/zh_CN.po
- thanks to all contributors: https://translations.launchpad.net/ufw
* allow multiple interface matching via '+'. Thanks to Oliver Hookins.
(LP: #611838)
* allow application profiles to start with a digit (LP: #663632)
* don't traceback in show listening when a rule references a non-existent
interface (LP: #840500)
-- Jamie Strandboge <jamie@ubuntu.com> Fri, 09 Mar 2012 14:24:24 -0600
ufw (0.30.1) RELEASED; urgency=low
* allow for python 2.7 (verified to work with python 2.7.1)
* fix improper display of error messages. Patch thanks to Serguey Basalaev
(LP: #580032)
* profiles/ufw-mailserver: remove Postfix reference
* fix typo in warning (LP: #637876)
* fix manpage reference to /etc/default/ufw (Closes: 601111)
* mention quoting of application profile names with spaces (LP: #715676)
* fix man-page hyphenation in ufw.8
* run_tests.sh: adjust PATH if iptables can't be found
* adjust /etc/ufw/sysctl.conf to have commented out entries for ipv6 privacy
addressing
* profiles/ufw-fileserver: add svnserve profile (LP: #501140)
* use 'UFW AUDIT INVALID' for INVALID packets in medium and higher
* DROP packets with RH0 headers (LP: #740249)
* update README to discuss the default ruleset
* only allow mDNS multicast (LP: #740256)
* allow ping replies from multicast (LP: #720605)
-- Jamie Strandboge <jamie@ubuntu.com> Tue, 22 Mar 2011 12:06:10 -0500
ufw (0.30) RELEASED; urgency=low
* add example Upstart script
* error out when filesystem is read-only (LP: #430053)
* catch exception if can't find parent pid when refreshing application
profiles (LP: #424528)
* update manpage to clarify 'show' command (LP: #453083)
* update setup.py to use sys.executable and cleanup required binaries
* update test suite
- better handle iptables < 1.4 (tested with 1.3.8)
- allow alternate interpreter
* write loglevel rules to user rules (LP: #459925)
* properly log INVALID packets for medium and higher (LP: #480789)
* Makefile: clean up POTFILES target
* generate binary translations in setup.py rather than shipping them in
source (LP: #490366)
* src/ufw-init-functions: don't run 'already started' check unless
ENABLED. This should improve boot speed such that iptables is not
needlessly called which results in an unneeded modprobe.
* manpage fixes thanks to Loic Minier
* set "default" sysctl values before "all" values. Thanks to Loic Minier
* clean up parser to make it easier to add new functionality
* don't log LIMIT rules if logging is off (LP: #512131)
* fix for noisy services getting logged. Added new 'skip-to-policy' chains
that are now used in after*.rules (LP: #488032)
* add rsyslog example configuration and update README
* add reset command (LP: #436608)
* add --force option to enable (LP: #496267)
* decode("utf-8") some strings in 'status' to correct formatting errors with
with multibyte characters
* add more reports
* add delete by rule number (LP: #367571)
* add support for IPv6 tunnels and 6to4 (LP: #502655)
* fix occasional ufw errors during boot with upstart (/tmp not available)
(LP: #521359)
* normalize IPv6 addresses to standard python shortened notation
* follow iptables and don't require that an interface ends with a number
(LP: #568877)
* really allow IPv6 neighbor discovery (LP: #611982)
* add support for IPSec via the esp and ah protocols (LP: #606997)
* fix traceback in 'show listening' report (LP: #624199)
* fix inaccuracies in 'show listening' report with IPv6 (LP: #625340)
* update check-requirements to not check ip6tables modules needed for the
'limit' command
* import updated Launchpad translations:
- po/ar.po, po/bg.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po,
po/en_AU.po, po/en_GB.po, po/es.po, po/fi.po, po/fr.po, po/he.po,
po/hu.po, po/id.po, po/it.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
po/pt.po, po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po,
po/zh_CN.po
- thanks to all contributors: https://translations.launchpad.net/ufw
-- Jamie Strandboge <jamie@ubuntu.com> Fri, 27 Aug 2010 15:30:43 -0500
ufw (0.29) RELEASE; urgency=low
* add egress filtering support:
- CLI command allows specifying direction in simple and extended syntax
- status reporting shows outgoing policy and outgoing rules
- allow changing default outgoing policy
- connection tracking rules for state NEW, when using a default policy
of ACCEPT for INPUT and OUTPUT, are now put in their own chains, rather
than configured in before*.rules
- add state RELATED,ESTABLISHED rule to ufw-before-output in before*.rules
like we do with ufw-before-input, to increase performance
- DEFAULT_OUTPUT_POLICY and DEFAULT_INPUT_POLICY can now also be set to
ACCEPT_NO_TRACK, which avoids adding connection tracking rules for
state NEW
- update documentation for the above
* add tests/check-requirements and integrate into test suite. This script
can be used to make sure that your system has all the required iptables
and netfilter functionality as described in README
* add doc/ufw-framework.8
* allow deletion of non-existent application rules introduced in 0.24.
(LP: #407810)
* import Launchpad translations:
- po/ar.po, po/bg.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po,
po/en_AU.po, po/en_GB.po, po/fi.po, po/fr.po, po/he.po, po/hu.po,
po/id.po, po/it.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po, po/pt.po,
po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po, po/zh_CN.po
- thanks to all contributors: https://translations.launchpad.net/ufw
- moved translations into locales/po and locales/mo. setup.py installs
files in locales/mo
- translations are now installed into ${prefix}/share/ufw/messages
-- Jamie Strandboge <jamie@ubuntu.com> Tue, 25 Aug 2009 09:12:10 -0500
ufw (0.28) RELEASE; urgency=low
* translation fixes
* add interface rules
* update Makefile to fail if byte-compiling failed
* install rules files 0640 (LP: #393187)
* adjust help command for proper translation and bash completion support
* add limit command to help (LP: #358964)
* add shell-completion/bash. Based on work by Didier Roche
* tests/*: updated with 'nostats' option so redundant tests are counted
in test results. Update many root tests to use 'nostats'
* look for location of iptables and set IPTABLES_DIR in common.py. Adjust
calls to ip[6]tables* to use IPTABLES_DIR
* fix harmless but annoying bug where multi-rule application rules ended
up with ::/0 in the tuple line in user.rules (IPV4) when not specifying a
destination or source address and IPV6 is enabled
* make insert rule logic more robust
* update setup.py to install user rules and init script helpers into
/lib, rather than /var/lib and /usr/share/ufw. Update tests,
backend_iptables.py, ufw-init and documentation accordingly. (LP: #400208)
-- Jamie Strandboge <jamie@ubuntu.com> Wed, 15 Jul 2009 09:30:25 -0500
ufw (0.27.1) RELEASE; urgency=low
* update README for instructions on integrating ufw into the boot process
* adjust strings to better conform with translation guidelines (LP: #353424)
* adjust translation location to work with rosetta
-- Jamie Strandboge <jamie@ubuntu.com> Mon, 23 Mar 2009 12:06:27 -0500
ufw (0.27) RELEASE; urgency=low
* don't do symlink check anymore (LP: #317700)
* don't do hidden file check anymore (LP: #319226). Hidden application
profiles are already skipped, so this check only bumps into revision
control systems
* add 'status numbered' command
* more comments in conf/sysctl.conf
* add insert rule support (LP: #260745)
* read in rules from /var/lib/ufw/*.rules. This helps keep status inline
with reality and fixes (LP: #262975)
* add loglevel support. This also changed the default rules files
* add per rule logging support
* get rid of redundant RETURN rules
* update LIMIT logging prefix
* update setup.py to use subprocess instead of Popen3
-- Jamie Strandboge <jamie@ubuntu.com> Sat, 17 Jan 2009 07:15:25 -0600
ufw (0.26) RELEASE; urgency=low
* fix formatting when using 'app update all' (LP: #300726)
* add runtime version check for iptables and warn if using IPv6 application
rules with iptables < 1.4
* Makefile: depend on translations when making tarball
* remove more useless newlines
* man page updates
* display interfaces and exact packet counters in 'status raw'
* support REJECT for rules, default policy and default application policy
(LP: #197322)
* only flush and delete ufw chains
* add a 'flush-all' command to ufw-init
* add MANAGE_BUILTINS option to /etc/default/ufw, and when set to 'yes'
flush the built-in chains too
-- Jamie Strandboge <jamie@ubuntu.com> Fri, 16 Jan 2009 07:01:38 -0600
ufw (0.25) RELEASE; urgency=low
* new ChangeLog files for upstream tarballs. See ChangeLog.pre-0.25 for
previous changes, including Ubuntu-specific changes
* setup.py: don't install initscript anymore
* add example (non-LSB) initscript to doc/initscript.example
* split out initscript into ufw-init-functions, ufw-init (for use by
ufw itself) and doc/initscript.example (for use by distributions). This
makes ufw more robust and portable
* don't stop the firewall via the initscripts if ufw is not enabled
(LP: #311066)
* rename skel-ui to skel-ui.example
* README:
- add Distributions section
- update for initscript changes
- update What's in a Name
-- Jamie Strandboge <jamie@ubuntu.com> Mon, 22 Dec 2008 08:53:14 -0600
Mini Shell