From e48aacc3e3c7bbf24237f9beba031f9dc8a2c064 Mon Sep 17 00:00:00 2001 From: MotherSphere Date: Sun, 6 Sep 2026 16:03:17 +0200 Subject: [PATCH] chore(release): 0.5.0 A minor bump, not a patch, and the reason is behaviour rather than API: a hostname the daemon did not confirm against the address no longer satisfies an `allow --dst-host`. On a host running the DNS observer most names come from observed answers, so an allow rule written against a name may stop matching where it used to. It stands aside rather than failing open - the rules beneath it answer - and a `deny --dst-host` is unchanged. Anyone leaning on a hostname allow rule should read the `dst_host` section of docs/HARDENING.md before upgrading. Two smaller ones in the same direction: `cfc status`'s `enforcing` now answers about the nftables table rather than about whether a packet was ever seen, so a machine whose ruleset was removed stops reporting yes; and a rule scoped to a digest the daemon cannot compute now abstains instead of handing the flow to a lower-precedence allow. Everything the release guards cover moves together, including the kernel crate's own lock file - which `check-versions.sh` learned about this round precisely because the 0.3.0 and 0.4.0 bumps had both left it behind. --- CHANGELOG.md | 2 ++ Cargo.lock | 18 +++++++++--------- Cargo.toml | 2 +- crates/cfc-ebpf/Cargo.lock | 2 +- packaging/rpm/colony-firewall-control.spec | 9 ++++++++- pkg/PKGBUILD | 2 +- pkg/README.md | 2 +- pkg/colony.json | 4 ++-- 8 files changed, 25 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index aa05568..8c2080e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ and [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +## [0.5.0] - 2026-09-06 + ### Security - **The fast path could grant what the packet path denies.** The two deciders diff --git a/Cargo.lock b/Cargo.lock index b7e1dad..f4b7bd8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -690,7 +690,7 @@ dependencies = [ [[package]] name = "cfc-cli" -version = "0.4.0" +version = "0.5.0" dependencies = [ "anyhow", "cfc-client", @@ -719,7 +719,7 @@ dependencies = [ [[package]] name = "cfc-client" -version = "0.4.0" +version = "0.5.0" dependencies = [ "anyhow", "cfc-core", @@ -739,7 +739,7 @@ dependencies = [ [[package]] name = "cfc-core" -version = "0.4.0" +version = "0.5.0" dependencies = [ "chrono", "ipnet", @@ -754,7 +754,7 @@ dependencies = [ [[package]] name = "cfc-daemon" -version = "0.4.0" +version = "0.5.0" dependencies = [ "anyhow", "aya", @@ -793,11 +793,11 @@ dependencies = [ [[package]] name = "cfc-ebpf-common" -version = "0.4.0" +version = "0.5.0" [[package]] name = "cfc-proto" -version = "0.4.0" +version = "0.5.0" dependencies = [ "prost", "serde", @@ -809,7 +809,7 @@ dependencies = [ [[package]] name = "cfc-tray" -version = "0.4.0" +version = "0.5.0" dependencies = [ "anyhow", "cfc-client", @@ -826,7 +826,7 @@ dependencies = [ [[package]] name = "cfc-ui" -version = "0.4.0" +version = "0.5.0" dependencies = [ "anyhow", "cfc-client", @@ -6414,7 +6414,7 @@ checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f" [[package]] name = "xtask" -version = "0.4.0" +version = "0.5.0" [[package]] name = "y4m" diff --git a/Cargo.toml b/Cargo.toml index 1c8884b..ca793d1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -17,7 +17,7 @@ members = [ exclude = ["crates/cfc-ebpf"] [workspace.package] -version = "0.4.0" +version = "0.5.0" edition = "2021" rust-version = "1.88" license = "GPL-3.0-or-later" diff --git a/crates/cfc-ebpf/Cargo.lock b/crates/cfc-ebpf/Cargo.lock index 510312d..b84df45 100644 --- a/crates/cfc-ebpf/Cargo.lock +++ b/crates/cfc-ebpf/Cargo.lock @@ -106,7 +106,7 @@ dependencies = [ [[package]] name = "cfc-ebpf-common" -version = "0.4.0" +version = "0.5.0" [[package]] name = "itoa" diff --git a/packaging/rpm/colony-firewall-control.spec b/packaging/rpm/colony-firewall-control.spec index 5e73720..0830fd8 100644 --- a/packaging/rpm/colony-firewall-control.spec +++ b/packaging/rpm/colony-firewall-control.spec @@ -11,7 +11,7 @@ %global debug_package %{nil} Name: colony-firewall-control -Version: 0.4.0 +Version: 0.5.0 Release: 1%{?dist} Summary: Application-aware outbound firewall for Linux @@ -239,6 +239,13 @@ fi %{_datadir}/selinux/devel/include/distributed/%{modulename}.if %changelog +* Sun Sep 06 2026 MotherSphere - 0.5.0-1 +- Security: the fast path could grant what the packet path denies (uid divergence) +- Security: a rule that could not be decided was walked past into a lower allow +- Security: an unconfirmed hostname may now refuse but not admit +- Security: ICMP refusals no longer forged with a multicast source, and are budgeted off-box +- The measured cost of the fast path, and scripts/vm-bench that measures it + * Sat Sep 05 2026 MotherSphere - 0.4.0-1 - Fast-allow path, opt-in: lastingly allowed processes skip the NFQUEUE round trip - eBPF ABI v4 diff --git a/pkg/PKGBUILD b/pkg/PKGBUILD index 6fb965e..22a2e7a 100644 --- a/pkg/PKGBUILD +++ b/pkg/PKGBUILD @@ -4,7 +4,7 @@ # For building from a git checkout during development, see PKGBUILD-git. pkgname=colony-firewall-control -pkgver=0.4.0 +pkgver=0.5.0 pkgrel=1 pkgdesc="Application-aware outbound firewall for Linux, written in Rust" arch=('x86_64') diff --git a/pkg/README.md b/pkg/README.md index 1f96bc9..80dd2f1 100644 --- a/pkg/README.md +++ b/pkg/README.md @@ -148,7 +148,7 @@ To reproduce the tarball locally, from the repo root: cargo build --workspace --release --locked cargo xtask build-ebpf # cfc-ebpf.o; postInstall fails outright without it -V=0.4.0 +V=0.5.0 NAME="colony-firewall-control-${V}-linux-x86_64" STAGE="$(mktemp -d)/${NAME}" mkdir -p "${STAGE}" diff --git a/pkg/colony.json b/pkg/colony.json index ca50c4f..35d00ec 100644 --- a/pkg/colony.json +++ b/pkg/colony.json @@ -1,7 +1,7 @@ { "id": "colony-firewall-control", "name": "Colony Firewall Control", - "version": "0.4.0", + "version": "0.5.0", "description": "Application-aware outbound firewall for Linux. Per-app prompts, persistent rules, live connection feed.", "license": "GPL-3.0-or-later", "homepage": "https://github.com/Project-Colony/Colony-Firewall-Control", @@ -11,7 +11,7 @@ "tags": ["firewall", "security", "network", "outbound", "opensnitch"], "platforms": { "linux-x86_64": { - "asset": "colony-firewall-control-0.4.0-linux-x86_64.tar.zst", + "asset": "colony-firewall-control-0.5.0-linux-x86_64.tar.zst", "binaries": ["colony-firewalld", "colony-firewall", "colony-firewall-tray", "cfc"], "installPath": "/usr/bin", "postInstall": [