ufw (0.36.2) RELEASED; urgency=medium
* src/ufw-init-functions: set default policy after loading rules. Thanks to
Mauricio Faria de Oliveira. (LP: #1946804)
* doc/ufw.8:
- document 'insert' and 'prepend' can't be used to update comments
(LP: #1927737)
* src/backend_iptables.py: remove unreachable code (LP: #1927734)
* src/util.py:
- properly parse /proc/pid/stat for WSL (LP: #2015645)
- mitigate odd length string with unhexlify (Closes: 1034568)
- support vrrp protocol (LP: #1996636)
* add locales/po/ro.po. Thanks Remus-Gabriel Chelu (Closes: 1034119)
* add '-h' and show help with no args (LP: #1965462)
* src/backend.py: add get_rules_ipv4() and get_rules_ipv6() (LP: #1951018)
* tests/check-requirements: update for python 3.10+
* tests/root: normalize 'ACCEPT {all,tcp}' and 'ACCEPT N' for newer systems
-- Jamie Strandboge <jdstrand@ubuntu.com> Thu, 18 May 2023 08:45:30 -0500
ufw (0.36.1) RELEASED; urgency=medium
* snap packaging updates:
- ufw-init: use '-n' instead of '-s' with --rootdir and --datadir
(LP: #1808463)
- backend_iptables.py: ufw-init is in --rootdir (which is SNAP, not
SNAP_DATA for the snap)
- snap-files/bin/srv:
+ don't copy $SNAP/lib/ufw; create $SNAP_DATA/lib/ufw
+ cleanup $SNAP_DATA after old snap revisions
- snap-files/bin/init: use SNAP_REVISION to match snap-files/bin/srv
* update man page for limit since IPv6 has been supported since 0.33
(LP: #1831186)
* add direction when no interfaces specified in get_app_tuple()
(LP: #1838764)
* various testsuite adjustments for iptables 1.8
* doc/ufw.8:
- ::/0 is also a synonym for 'Anywhere'
- document --force with 'ufw delete NUM'
* prefer python3
* empty out IPT_MODULES and update documentation (LP: #1556419)
* adjust check-requirements to look for other firewall software
* src/backend_iptables.py: unconditionally reload user rules with 'delete'
(LP: #1933117)
-- Jamie Strandboge <jdstrand@ubuntu.com> Sat, 18 Sep 2021 19:41:55 -0500
ufw (0.36) RELEASED; urgency=medium
* doc/ufw-framework.8:
- fix path for user[6].rules
- reference nf_conntrack_sane
- fix syntax error in example rule (LP: #1782384)
* snap packaging:
- adjust snappy packaging for series 16 and to use snapcraft
- add bash completer to snap packaging
- add ipset and conntrack
* doc/ufw-on-snappy.8: update for series 16
* src/backend_iptables.py: properly calculate the path to state_dir when
specifying --rootdir and --datadir (ie, fix regression in 0.35 final)
* conf/before6.rules:
- adjust ufw6-before-output rules for echo-reply and echo-request
(LP: #1633698)
- move echo-reply for ufw6-before-input before INVALID (LP: #1664133,
LP: #1509725)
* conf/ufw.defaults: mention nf_conntrack_sane
* adjust runtime tests to use daytime/port 13 instead of ssh/port 22
everywhere and adjust to use daytime/port 13 instead of http/port 80 and
https/port 443 in good/logging and ipv6/bad_args6 (Closes: 849628)
* don't disable syncookies and instead use the system's value by default
* Bittorrent can also use UDP (LP: #1695718)
* doc/ufw.8: remove spurious apostrophes from man page. Thanks to Tom
Spurling
* common.py:
- adjust regex to be more liberal with non-meta characters in interface
names (LP: #1719211)
- don't allow interfaces longer than 15 characters
* shell-completion/bash: use _have() instead of have(). Thanks to Andrew
Nowak and Paulo Marcel Coelho Aragao (LP: #1775043)
* support concurrent updates (LP: #1204579, LP: #1652163, LP: #1377600,
Closes: 686248)
* add 'prepend' command to better support IPS (fail2ban, etc. LP: #1368411,
LP: #1586258, Closes: 909163)
* backend.py: only warn if initcaps() fails is disabled (Closes: 884932)
* conf/before.rules: remove extraneous source quench rule (LP: #1558068)
-- Jamie Strandboge <jamie@ubuntu.com> Fri, 14 Dec 2018 12:01:29 -0600
ufw (0.35) RELEASED; urgency=medium
* update check-requirements and README for python 3.5
* update unit tests to not fail when /proc/net/* has no useful information
(Closes: 797020)
* update rsyslog example to use 'stop' instead of the deprecated '~'
(Closes: 798100)
* add --rootdir and --datadir options to ufw and ufw-init to make
relocatable
* files owned by 'clickpkg' are ok too
* add preliminary snappy packaging
* add support for comments (LP: #448503)
* don't allow 'route delete NUM' and suggest 'delete NUM' instead
* move user[6].rules to /etc/ufw (LP: #728128)
* update README: python3 < 3.4 is no longer supported
-- Jamie Strandboge <jamie@ubuntu.com> Sun, 07 Feb 2016 16:55:26 -0600
ufw (0.34) RELEASED; urgency=low
* refactor capabilities checks and only call when needed
* error out early instead of tracing back with iptables errors in
get_netfilter_capabilities() (LP: #1044361)
* fix TypeError which somehow only manifested itself when using zh_CN
* add 'reload' to help (LP: #1059060)
* check-requirements now gives iptables output on failure. Patch thanks to
S. Nizio.
* use conntrack instead of state module. Patch based on work by S. Nizio.
(LP: #1065297)
* don't use get_netfilter_capabilities() with ipv6 if ipv6 is disabled
(LP: #1039729, LP: #1062521)
* fix parse error when finding PPID (LP: #1101304)
* implement before and after hooks in /etc/ufw/(before|after).init
(LP: #1075975) TODO: add tests
* add unit test framework and cleanup, remove dead and refactor some code
* honor UFW_SKIP_CHECKS=1 environment variable with setup.py, which eases
testing
* tests/check-requirements: add a check for -m rt --rt-type 0 (LP: #1191197)
* match simple rule syntax and don't allow ports with esp and ah protocols
with extended rule syntax
* when displaying extended rules via parser.get_command(), show "out" if the
direction is "out" and there is no corresponding interface
* fix return of various invalid extended rules in parser.get_command()
* clarify 'limit' command in man page (LP: #1089262)
* implement route rules (ie, manage FORWARD, LP: #262421). See man page for
details. This change reworked interface parsing and we now allow
interfaces with '_' in the name (LP: #1098472)
* add state RELATED,ESTABLISHED rule to ufw-before-forward in before*.rules
like we do with ufw-before-input. This will only affect systems with ip
forwarding enabled via sysctl
* add ufw[6]-track-forward chain and handle it the same as for
ufw[6]track-input and ufw[6]-track-output
* document ufw[6]-track-* in README (dropped in previous commit)
* fix for 'status' not distingushing between some v4/v6 targets
(LP: #1078665)
* add safe icmp packets packets to ufw-before-forward in before*.rules like
we do for ufw-before-input. This will only affect systems with ip
forwarding enabled via sysctl
* update check-requirements for python 3.3 and 3.4
* add 5269/tcp to XMPP (LP: #1327162)
* fix traceback with forward rule
* import new and updated Launchpad translations:
- po/ar.po, po/ast.po, po/bg.po, po/bs.po, po/ca.po, po/ce.po, po/cs.po,
po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
po/et.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
po/ja.po, po/ko.po, po/lv.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
po/pt.po, po/ru.po, po/se.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po,
po/tl.po, po/tr.po, po/uk.po, po/ur.po, po/zh_CN.po, po/zh_TW.po
- thanks to all contributors: https://translations.launchpad.net/ufw
* also use .lower() on translations for 'yes' (LP: #1438647)
* adjust/rearrange before6.rules for rfc4890 'must not be blocked' and
'should not be blocked' (LP: #1434525, LP: #1030214)
* doc/systemd.example: add service file from Ubuntu (LP: #1341083)
* correctly spell qBittorrent (LP: #1273965)
* update man page for app rules (LP: #1155292)
* support igmp protocol (LP: #946322)
* adjust testsuite for systems supporting smtp/udp (LP: #815982)
* enforce that basic commands don't have arguments (LP: #1155250)
* update command completion for --dry-run, --force, --help and route
(LP: #1225666)
* support gre protocol (LP: #1418879)
* support ./setup.py build (LP: #819600)
* doc/ufw.8:
- clarify log level behavior (LP: #1461701)
- add app profile syntax
- add protocol support
* skip profiles with invalid port declarations (LP: #1201934)
* tests/check-locales: skip locales that fail to install or generate
-- Jamie Strandboge <jamie@ubuntu.com> Thu, 20 Aug 2015 11:48:13 -0500
ufw (0.33) RELEASED; urgency=low
* conf/after6.rules: also use correct ports for DHCPv6. Thanks to Marco
Davids (LP: #1007326)
* src/util.py: add get_netfilter_capabilities() for getting the capabilities
set for things we want to support but may not be in all kernels/iptables
versions
* add IPv6 limit support (LP: #951462)
* import new and updated Launchpad translations:
- po/ast.po, po/bs.po, po/cs.po, po/de.po, po/el.po, po/en_AU.po,
po/en_GB.po, po/es.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/it.po,
po/nb.po, po/nl.po, po/pt_BR.po, po/pt.po, po/sk.po, po/sl.po, po/sv.po,
po/zh_CN.po, po/zh_TW.po (new, LP: #868195)
- thanks to all contributors: https://translations.launchpad.net/ufw
* README.translations: updated for paths and testing
* add 'show added' report (LP: #987784)
* remove ACCEPT_NO_TRACK option since it never worked (LP: #787955)
* src/backend_iptables.py: display output of ufw-init if it fails
* don't traceback if can't determine iptables version
-- Jamie Strandboge <jamie@ubuntu.com> Sun, 12 Aug 2012 10:58:04 -0500
ufw (0.32) RELEASED; urgency=low
* Obsolete python2.5 in preparation for python3 support
* Adjust gettext initialization so that _() always returns unicode. Patch
thanks to Barry Warsaw
* Add python3 support (LP: #1001657)
* profiles/ufw-directoryserver: use LDAPS key for LDAPS
-- Jamie Strandboge <jamie@ubuntu.com> Sat, 19 May 2012 08:48:15 -0500
ufw (0.31.1) RELEASED; urgency=low
* src/util.py: revert revert r752 which introduced problems with other
locales (LP: #953372)
* add tests/check-locales. This is Debian/Ubuntu specific, but will help
avoid commits like r752.
-- Jamie Strandboge <jamie@ubuntu.com> Mon, 12 Mar 2012 20:26:28 -0500
ufw (0.31) RELEASED; urgency=low
* allow UPnP multicast for service discovery (LP: #764933)
* conf/ufw.defaults:
- remove IRC connection tracking, which is only required for DCC
- allow nf_conntrack_netbios_ns (Samba) (LP: #360975)
* enable IPv6 by default
* fix 'allow to any ipv6' when IPv6 is enabled
* update manpage references to ufw and ufw-framework to include the section
* update check-requirements to prompt to continue with tests that may
autoload modules. Add '-f' option to check-requirements and update test
suite accordingly (LP: #782816)
* don't fail when running 'show listening' under fakeroot (LP: #812516)
* add syntax-check to Makefile
* add man-check to Makefile
* src/util.py: use codes.open(..., 'UTF-8') to better support non-english
locales in third-party frontends. Analysis and patch suggestion thanks to
S. Nizio. (LP: #921758)
* conf/ufw.defaults and doc/ufw-framework.8: add info on tftp connection
tracking modules
* fix traceback when specifying '--dry-run' with no arguments (LP: #946332)
* tests/testlib.sh: add 'http-or-www' argument to do_cmd() to try to
account for /etc/services files with http/udp instead of www/udp. Adjust
bad/apps and root/normalization for this (LP: #947224)
* conf/before6.rules: use correct ports for DHCPv6 and limit source and
destination addresses to autoconfiguration addresses (fe80::/10). Thanks
to Mathieu Trudel-Lapierre (LP: #947416)
* import new and updated Launchpad translations:
- po/ar.po, po/ast.po (new), po/bg.po, po/bs.po (new), po/ca.po, po/cs.po,
po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
po/ja.po (new), po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po, po/pt.po,
po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po,
po/ur.po (new), po/zh_CN.po
- thanks to all contributors: https://translations.launchpad.net/ufw
* allow multiple interface matching via '+'. Thanks to Oliver Hookins.
(LP: #611838)
* allow application profiles to start with a digit (LP: #663632)
* don't traceback in show listening when a rule references a non-existent
interface (LP: #840500)
-- Jamie Strandboge <jamie@ubuntu.com> Fri, 09 Mar 2012 14:24:24 -0600
ufw (0.30.1) RELEASED; urgency=low
* allow for python 2.7 (verified to work with python 2.7.1)
* fix improper display of error messages. Patch thanks to Serguey Basalaev
(LP: #580032)
* profiles/ufw-mailserver: remove Postfix reference
* fix typo in warning (LP: #637876)
* fix manpage reference to /etc/default/ufw (Closes: 601111)
* mention quoting of application profile names with spaces (LP: #715676)
* fix man-page hyphenation in ufw.8
* run_tests.sh: adjust PATH if iptables can't be found
* adjust /etc/ufw/sysctl.conf to have commented out entries for ipv6 privacy
addressing
* profiles/ufw-fileserver: add svnserve profile (LP: #501140)
* use 'UFW AUDIT INVALID' for INVALID packets in medium and higher
* DROP packets with RH0 headers (LP: #740249)
* update README to discuss the default ruleset
* only allow mDNS multicast (LP: #740256)
* allow ping replies from multicast (LP: #720605)
-- Jamie Strandboge <jamie@ubuntu.com> Tue, 22 Mar 2011 12:06:10 -0500
ufw (0.30) RELEASED; urgency=low
* add example Upstart script
* error out when filesystem is read-only (LP: #430053)
* catch exception if can't find parent pid when refreshing application
profiles (LP: #424528)
* update manpage to clarify 'show' command (LP: #453083)
* update setup.py to use sys.executable and cleanup required binaries
* update test suite
- better handle iptables < 1.4 (tested with 1.3.8)
- allow alternate interpreter
* write loglevel rules to user rules (LP: #459925)
* properly log INVALID packets for medium and higher (LP: #480789)
* Makefile: clean up POTFILES target
* generate binary translations in setup.py rather than shipping them in
source (LP: #490366)
* src/ufw-init-functions: don't run 'already started' check unless
ENABLED. This should improve boot speed such that iptables is not
needlessly called which results in an unneeded modprobe.
* manpage fixes thanks to Loic Minier
* set "default" sysctl values before "all" values. Thanks to Loic Minier
* clean up parser to make it easier to add new functionality
* don't log LIMIT rules if logging is off (LP: #512131)
* fix for noisy services getting logged. Added new 'skip-to-policy' chains
that are now used in after*.rules (LP: #488032)
* add rsyslog example configuration and update README
* add reset command (LP: #436608)
* add --force option to enable (LP: #496267)
* decode("utf-8") some strings in 'status' to correct formatting errors with
with multibyte characters
* add more reports
* add delete by rule number (LP: #367571)
* add support for IPv6 tunnels and 6to4 (LP: #502655)
* fix occasional ufw errors during boot with upstart (/tmp not available)
(LP: #521359)
* normalize IPv6 addresses to standard python shortened notation
* follow iptables and don't require that an interface ends with a number
(LP: #568877)
* really allow IPv6 neighbor discovery (LP: #611982)
* add support for IPSec via the esp and ah protocols (LP: #606997)
* fix traceback in 'show listening' report (LP: #624199)
* fix inaccuracies in 'show listening' report with IPv6 (LP: #625340)
* update check-requirements to not check ip6tables modules needed for the
'limit' command
* import updated Launchpad translations:
- po/ar.po, po/bg.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po,
po/en_AU.po, po/en_GB.po, po/es.po, po/fi.po, po/fr.po, po/he.po,
po/hu.po, po/id.po, po/it.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
po/pt.po, po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po,
po/zh_CN.po
- thanks to all contributors: https://translations.launchpad.net/ufw
-- Jamie Strandboge <jamie@ubuntu.com> Fri, 27 Aug 2010 15:30:43 -0500
ufw (0.29) RELEASE; urgency=low
* add egress filtering support:
- CLI command allows specifying direction in simple and extended syntax
- status reporting shows outgoing policy and outgoing rules
- allow changing default outgoing policy
- connection tracking rules for state NEW, when using a default policy
of ACCEPT for INPUT and OUTPUT, are now put in their own chains, rather
than configured in before*.rules
- add state RELATED,ESTABLISHED rule to ufw-before-output in before*.rules
like we do with ufw-before-input, to increase performance
- DEFAULT_OUTPUT_POLICY and DEFAULT_INPUT_POLICY can now also be set to
ACCEPT_NO_TRACK, which avoids adding connection tracking rules for
state NEW
- update documentation for the above
* add tests/check-requirements and integrate into test suite. This script
can be used to make sure that your system has all the required iptables
and netfilter functionality as described in README
* add doc/ufw-framework.8
* allow deletion of non-existent application rules introduced in 0.24.
(LP: #407810)
* import Launchpad translations:
- po/ar.po, po/bg.po, po/ca.po, po/cs.po, po/da.po, po/de.po, po/el.po,
po/en_AU.po, po/en_GB.po, po/fi.po, po/fr.po, po/he.po, po/hu.po,
po/id.po, po/it.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po, po/pt.po,
po/ru.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po, po/tl.po, po/zh_CN.po
- thanks to all contributors: https://translations.launchpad.net/ufw
- moved translations into locales/po and locales/mo. setup.py installs
files in locales/mo
- translations are now installed into ${prefix}/share/ufw/messages
-- Jamie Strandboge <jamie@ubuntu.com> Tue, 25 Aug 2009 09:12:10 -0500
ufw (0.28) RELEASE; urgency=low
* translation fixes
* add interface rules
* update Makefile to fail if byte-compiling failed
* install rules files 0640 (LP: #393187)
* adjust help command for proper translation and bash completion support
* add limit command to help (LP: #358964)
* add shell-completion/bash. Based on work by Didier Roche
* tests/*: updated with 'nostats' option so redundant tests are counted
in test results. Update many root tests to use 'nostats'
* look for location of iptables and set IPTABLES_DIR in common.py. Adjust
calls to ip[6]tables* to use IPTABLES_DIR
* fix harmless but annoying bug where multi-rule application rules ended
up with ::/0 in the tuple line in user.rules (IPV4) when not specifying a
destination or source address and IPV6 is enabled
* make insert rule logic more robust
* update setup.py to install user rules and init script helpers into
/lib, rather than /var/lib and /usr/share/ufw. Update tests,
backend_iptables.py, ufw-init and documentation accordingly. (LP: #400208)
-- Jamie Strandboge <jamie@ubuntu.com> Wed, 15 Jul 2009 09:30:25 -0500
ufw (0.27.1) RELEASE; urgency=low
* update README for instructions on integrating ufw into the boot process
* adjust strings to better conform with translation guidelines (LP: #353424)
* adjust translation location to work with rosetta
-- Jamie Strandboge <jamie@ubuntu.com> Mon, 23 Mar 2009 12:06:27 -0500
ufw (0.27) RELEASE; urgency=low
* don't do symlink check anymore (LP: #317700)
* don't do hidden file check anymore (LP: #319226). Hidden application
profiles are already skipped, so this check only bumps into revision
control systems
* add 'status numbered' command
* more comments in conf/sysctl.conf
* add insert rule support (LP: #260745)
* read in rules from /var/lib/ufw/*.rules. This helps keep status inline
with reality and fixes (LP: #262975)
* add loglevel support. This also changed the default rules files
* add per rule logging support
* get rid of redundant RETURN rules
* update LIMIT logging prefix
* update setup.py to use subprocess instead of Popen3
-- Jamie Strandboge <jamie@ubuntu.com> Sat, 17 Jan 2009 07:15:25 -0600
ufw (0.26) RELEASE; urgency=low
* fix formatting when using 'app update all' (LP: #300726)
* add runtime version check for iptables and warn if using IPv6 application
rules with iptables < 1.4
* Makefile: depend on translations when making tarball
* remove more useless newlines
* man page updates
* display interfaces and exact packet counters in 'status raw'
* support REJECT for rules, default policy and default application policy
(LP: #197322)
* only flush and delete ufw chains
* add a 'flush-all' command to ufw-init
* add MANAGE_BUILTINS option to /etc/default/ufw, and when set to 'yes'
flush the built-in chains too
-- Jamie Strandboge <jamie@ubuntu.com> Fri, 16 Jan 2009 07:01:38 -0600
ufw (0.25) RELEASE; urgency=low
* new ChangeLog files for upstream tarballs. See ChangeLog.pre-0.25 for
previous changes, including Ubuntu-specific changes
* setup.py: don't install initscript anymore
* add example (non-LSB) initscript to doc/initscript.example
* split out initscript into ufw-init-functions, ufw-init (for use by
ufw itself) and doc/initscript.example (for use by distributions). This
makes ufw more robust and portable
* don't stop the firewall via the initscripts if ufw is not enabled
(LP: #311066)
* rename skel-ui to skel-ui.example
* README:
- add Distributions section
- update for initscript changes
- update What's in a Name
-- Jamie Strandboge <jamie@ubuntu.com> Mon, 22 Dec 2008 08:53:14 -0600
Generated by dwww version 1.16 on Sat Oct 3 05:30:47 CEST 2026.