All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog.
- IPv6 part of group of dual stack virtual interfaces was not marked as redundancy group, leading to unexpected error message.
- The Netspoc server or some other policy distribution point accesses managed routers to deploy generated firewall rules. Netspoc writes the IP address that is used to access a router named 'X' into a file 'X.info'. If a router has loopback interfaces, these are preferred. But for routers inside a cyclic part of the topology, loopback interfaces have been ignored until now. This has been fixed. The IP address of loopback interfaces are preferred always now.
- Blocking pathrestrictions are now always shown in error message.
- For a rule starting or ending at an interface inside a cyclic subgraph, some valid paths were not found and some pathrestrictions were ignored. This has been fixed.
- A pathrestriction must use at most one interface at border of loop. If some pathrestriction uses more than one interface at border of loop, a warning will be shown. It should be split into multiple pathrestrictions, before this version is activated.
- VPN tunnels in dual stack topology now also support IPv6 traffic.
- Commands for Cisco ASA have been fixed:
- 'ipv6 local pool' now leaves first address unused.
- 'ipv6-address-pools' is used to apply an IPv6 pool.
- Attribute 'subnet_of' in NAT definition of dual stack interface is ignored in IPv6 part.
- Attribute 'subnet_of' of dual stack loopback interface now works correctly in case of subnet relation is holding for IPv4 and IPv6.
- Netspoc now aborts on inconsistently defined area having contradictory attributes "border" and "inclusive_border" (#48).
- Program "export-netspoc"
- no longer generates cryptic name for dual stack service with missing IPv4/v6 part (#58),
- no longer generates empty IPv6 rule for service with "foreach" and "ipv4_only" (#57).
- Program "print-path" no longer panics when finding path between dual stack object and IPv6 object (#56).
- Program "export-netspoc" exports visible services again. This was still needed.
- Fixed bug where Netspoc no longer terminated when finding path through two loops connected by an interface with pathrestriction.
- Program "export-netspoc" no longer exports visible services. Lists are empty now.
- Program "export-netspoc" no longer adds email with empty owner list to file "email".
- IP address with prefix length 0 is ignored at unnamed aggregate. I.e. any:[ip=0.0.0.0/0 & network:n1] is handled like any:[network:n1]. This prevents accessing only the IPv4 part of a dual stack zone.
- Automatic group of area that only has IPv4 borders or IPv4 anchor, now also includes dual stack objects located inside this area.
- If an unnamed aggregate without IP matches IPv4 and IPv6 networks, it is marked as dual stack now.
- Fixed handling of 'ipv4_only' and 'ipv6_only' with 'foreach'.
- A better error message is shown if restrictions block all paths between source and destination. Restrictions blocking fewer paths are shown first, as they typically represent earlier bottlenecks in the topology.
- Attribute 'subnet_of' used at dual stack network no longer only applies to IPv4 address. It now declares, that IPv4 oder IPv6 or both addresses are in subnet relation.
- It is no longer mandatory for a virtual or secondary interface of dual stack interface to be dual stack as well.
- Secondary optimization is enabled for network having invisible aggregate as supernet.
- Only matching networks of attribute 'merge_tunnelspecified' are added to split-tunnel ACL.
- Also check aggregates that are subnet of networks for unexpected access from supernet rules.
- More manual pages:
- export-netvis
- print-path
- remove-service
- transpose-service
- Dual stack networks and interfaces now require an uniform use of attributes ip/ip6, unnumbered/unnumbered6, negotiated/negotiated6.
- Program "export-netspoc" now exports attribute 'zone' also for hosts and interfaces and no longer for only networks and aggregates.
- Added missing check for supernet rules at crypto interface, but crypto interface with attribute detailed_crypto_acl is left out.
- Fixed panic from attribute "nat_in" at crypto interface.
- Program "print-group": Fixed missing dual stack internet.
- Program "export-netvis": Also export v6-only interfaces of dual stack router.
- Program "cut-netspoc": Fixed ip6 attribute in dual stack aggregate from intersection.
- Fixed program "export-netspoc". Unused named aggregates are exported again for use in internal program "kmprep".
- Netspoc-API and program "modify-netspoc-api" no longer support
deprecated methods
- modify_host
- create_owner
- add_to_group
- Program "export-netspoc" no longer exports aggregates not used in any rules.
- Program "format-netspoc" no longer inserts white space at
delimiter -,:,/ of
- IP range of host (IPv4 and IPv6)
- port range of protocol tcp and udp
- source and destination port of protocol tcp and udp
- type/code of protocol icmp
- Program "format-netspoc" now sorts IPv6 hosts by address.
- Added manual pages for programs
- add-to-netspoc
- check-acl
- cut-netspoc
- expand-group
- export-netspoc
- export-netspoc-syntax
- format-netspoc
- modify-netspoc-api
- netspoc
- print-group
- print-service
- remove-from-netspoc
- rename-netspoc
- Attribute 'bind_nat' is no longer valid. Use 'nat_out' instead.
- No longer superflously create zones from nat_in.
- Attribute 'has_subnets' is ignored at IPv6 part of dual stack object. But 'has_subnets' is still applied to both parts of network if both addresses have /0 address.
- A warn message is shown on useless attribute 'has_subnets'.
- A warn message is shown on useless attribute 'subnet_of' at NAT definition of network.
- Better warn message for empty IPv6 area from dual stack area.
- Better warn message for IPv6 subnet of dual stack object. It is no longer proposed to add 'subnet_of', but to split the network into separate IPv4 and IPv6 objects.
- No longer show error message 'Must not use only IPv6 / IPv4 part of dual stack object', if supernet of missing network is still applied.
- Program "cut-netspoc" now works with dual-stack topology.
- Fixed attribute 'nat_in'. Previously it was only applied to the first suitable interface and hence only usable at router with two interfaces.
- Attribute 'radius_attributes' is no longer valid. Use 'vpn_attributes' instead.
- Changed name of attribute 'bind_nat' to 'nat_out'. This version supports both attributes. But support for 'bind_nat' will be removed in next version.
- Introduced new attribute 'nat_in' at interface of router. "nat_in = t1;" at an interface means: If packets enter this interface, then NAT defined by "nat:t1" is applied at each outgoing interface without "nat_in = t1;". See #23 for details.
- Fixed inversed inheritance at unnamed aggregate:
- Contained unnamed aggregate is ignored.
- Unnamed aggregate no longer inherits from enclosing unnamed aggregate.
- Fixed static route with sole virtual interface as next hop. Use IP of virtual interface instead of physical interface.
- No longer accidently split NAT domains. This fixes #22.
- Attribute 'radius_attributes' in Netspoc syntax has been renamed to 'vpn_attributes'. This version supports both attributes. But support for 'radius_attributes' will be removed in next version.
- Support for vpn_attribute 'client-bypass-protocol' has been added. Example: "vpn_attributes = { client-bypass-protocol = enable; }" is added to group-policy as "client-bypass-protocol enable"
- No longer show warning on redundant owner at dual stack object if owner is inherited from pure IPv4 or pure IPv6 object.
- Attribute 'subnet_of' is ignored at IPv6 part of dual stack object.
- If attribute 'bind_nat' is given at pure IPv6 interface, this attribute is ignored and a warning is shown.
- It is no longer allowed to use only IPv4 part or only IPv6 part of dual stack objects in rules. When displaying such a partial rule in Netspoc-Web, it can't be distinguished from a complete rule.
- Attribute .cluster of a zone now has a dual stack zone as first element if this zone cluster has at least one dual stack zone.
- It is no longer valid to connect IPv4 zone to multiple IPv6 zones or vice versa if a non matching aggregate is defined at this zone which would match both, IPv4 and IPv6 addresses.
- Attributes 'ipv4_only' and 'ipv6_only' are no longer valid at areas. This is needed to prevent creating partial rules.
- If owner is given at dual stack zone this owner is now correctly applied to IPv6 part of this zone.
- Processing error message for thousands of duplicate rules needed too much time, resulting in a seemingly stalled run of program 'netspoc'. This has been fixed.
- Applied multiple fixes for named, non matching dual stack aggregates,
e.g. any:a = { link = network:n; }
- Fixed non determinism in export-netspoc. IPv4 and IPv6 adddresses are now always shown, if avalaible.
- Dual stack property is no longer lost for copied aggregates in zone cluster.
- Applied multiple fixes for unnamed, non matching aggregates,
e.g. any:[network:n]
- If any:[ip=0.0.0.0/0 & network:n] is used in dual stack zone, this no longer implicitly adds an any:[ip6=::/0 & network:n].
- Only if any:[network:n] is used in dual stack zone, this adds IPv4 and IPv6 aggregates.
- any:[network:n] in dual stack zone must not be used in pure IPv4 or IPv6 rule. Use any:[ip=0.0.0.0/0 & network:n] or any:[ip6=::/0 & network:n] instead.
- 'CHANGELOG.md' Newest entries are used to maintain github releases page.
- 'nfpm.yaml' configures program 'nfpm' to build 'rpm' + 'deb' packages.
- Current date and time is used as version number.