1 release 197 tags

RSS feed

• v2.3.2 cebfeb420e

  Compare

  Publish a ruleset on kernels whose iptables names nothing

  Ghost released this 2026-07-28 14:32:37 +03:00 | 16 commits to main since this release

  A kernel without xt_multiport is already handled: the port list has no
  single-rule form there, so each interval becomes its own rule. Which
  build of iptables reports the gap decided whether that happened.
  1.8.11 warns about the missing module and then complains about the
  port list it can no longer parse, and both signals were required
  before rebuilding — a port complaint alone is also what a genuinely
  malformed list produces. 1.8.4 legacy says "Couldn't find match
  `multiport'" and nothing else, so the second signal never arrived and
  a device that only needed the poorer ruleset was told its ruleset was
  unsupported and refused to start.

  Reading the wording more cleverly does not end: every build words this
  differently. The capability set is two flags wide and every reduction
  of it is survivable, so a test rejection nobody could name now retires
  multiport as well as connbytes, and the outcome stops depending on
  vendor phrasing at all. The wording table is still consulted first,
  where it keeps the diagnostic precise, but it no longer decides
  whether the service can run.

  Covered by the 1.8.4 wording from the field report, the 1.8.11 wording
  that already worked, and a build that names nothing whatsoever.

  Co-Authored-By: Claude Opus 5 noreply@anthropic.com

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download