CHANGELOG

- 2.0.2 | Apr 11 2026:

  -- New Features --

[New] Connection tracking limit (CT_LIMIT): global per-IP connection limit via
      periodic conntrack table scanning; configurable threshold, scan interval,
      block duration, port/state filters, TIME_WAIT exclusion, CIDR exemptions;
      VNET per-IP overrides; temp-deny blocking with PERMBLOCK escalation;
      CLI: --ct-scan (manual scan), --ct-status (show config and active blocks)
[New] GeoIP country blocking: ipset-based high-performance country filtering
      using cc_deny.rules/cc_allow.rules with ISO 3166-1 alpha-2 codes and
      continent shorthand (@EU, @AS, @NA, @SA, @AF, @OC); tiered data sources
      (ipverse.net, ipdeny.com) with CC_CACHE_TTL freshness tracking; atomic
      ipset swap for zero downtime updates; audit mode (CC_LOG_ONLY) for impact
      measurement; dual-stack IPv4/IPv6; advanced per-port/protocol syntax;
      granular entry removal (apf -u preserves unrelated entries for same CC);
      --cc IP reverse lookup via awk CIDR containment; --cc CC detail display;
      per-CC download progress feedback; geoip_lib.sh shared metadata library
[New] Structured event logging via elog_lib.sh: dual log model (application log
      + JSONL audit trail at /var/log/apf/audit.log); severity filtering;
      eout() backward-compatible wrapper; 23 audit events across 9 event types
      covering trust, blocking, config, and error lifecycle
[New] SYN flood protection: SYNFLOOD chain rate-limits inbound TCP SYN packets
      via iptables limit module; configurable rate/burst thresholds, LOG +
      DROP for excess, dual-stack support
[New] SMTP outbound blocking: SMTP_BLOCK restricts outbound SMTP (ports 25,
      465, 587) to whitelisted users/groups; SMTP_ALLOWUSER/SMTP_ALLOWGROUP
      exemptions; works independently of EGF toggle
[New] Temporary allow/deny with per-entry TTL: apf -ta/-td HOST TTL adds
      time-limited trust entries (300, 5m, 1h, 7d); automatic cron expiry;
      list with --templ, flush with --tempf; block escalation auto-promotes
      repeat temp denies to permanent via PERMBLOCK_COUNT/PERMBLOCK_INTERVAL
[New] Custom hook scripts: hook_pre.sh/hook_post.sh sourced before/after
      iptables rules; activated by chmod 750; preserved across upgrades
[New] Silent IP blocking: silent_ips.rules drops all traffic to/from listed
      addresses with no logging; IPv4/IPv6 supported; preserved across upgrades
[New] CLI overhaul: new commands (-g search, --rules, --info, --lookup,
      --validate, --list-allow/--list-deny, --cc/--cc-update, --dump-config);
      subcommand architecture (apf <noun> <verb>) with 7 groups (trust, cc,
      config, status, gre, ipset, ct); per-group help; CSF compatibility
      aliases (-ar, -dr, -tr, -i) with --csf-help mapping; all 2.0.x flat
      flags preserved as silent aliases
[New] Per-port connection limiting via xt_connlimit: IG_TCP_CLIMIT and
      IG_UDP_CLIMIT with port:limit pairs, port range support, VNET binding
[New] ipset 7-field format: per-list refresh interval and max entry count;
      backward-compatible auto-migration from 4-field and 5-field formats;
      batch loading via ipset restore for large block lists
[New] Advanced trust syntax in CLI: apf -a/-d/-ta/-td/-u accept
      proto:flow:port:ip format (e.g., "tcp:in:d=22:s=10.0.0.0/8") for
      protocol/direction/port-scoped trust rules; duplicate detection, IPv6
      bracket syntax, and port ranges supported
[New] FQDN pre-resolution in trust system: hostnames resolved via getent
      before loading into iptables; multiple A/AAAA records, IPv6 support,
      configurable timeout via FQDN_TIMEOUT; resolved= metadata enables
      removal without DNS; refresh (apf -e) re-resolves FQDNs; --lookup
      resolves FQDN entries when queried with an IP address
[New] validate_config(): startup config validation with clear error messages
      covering interfaces, stop targets, rate/burst formats, connlimit
      syntax, RAB parameters, logging, expiry, and sysctl settings
[New] Ban expiry: structured addedtime=EPOCH markers in all trust entries
      for reliable expiry; backward-compatible with pre-2.0.2 entries
[New] Auto-detection for USE_IPSET, IPT_LOCK_SUPPORT, and DOCKER_COMPAT:
      each resolves at startup based on system capabilities; CentOS 6
      (iptables 1.4.7, no -w) safely degrades; replaces hardcoded defaults
      with "auto" (upgrade-safe)
[New] install.sh: auto-detect default network interface and conflicting
      firewall services (firewalld, ufw); structured output via pkg_lib;
      post-install dependency warnings; fix directory permissions (750/640);
      verify source files; prevent backup collision; re-create periodic cron
      entries on upgrade
[New] Unified download helper: curl primary with wget fallback, redirect
      following, timeouts, retries; TLS diagnostic hints on failure
[New] uninstall.sh: removes all system-wide artifacts including cron, man
      page, symlinks, and audit log directory; prompts before removing
      install directory and logs
[New] Bash tab completion: apf.bash-completion installed to
      /etc/bash_completion.d/apf; subcommand-aware with context-sensitive
      completions for trust hosts, temp TTL values, and country codes
[New] RPM and DEB packaging with FHS-compliant layout: binary at /usr/sbin/apf,
      libraries at /usr/lib/apf/internals/, config at /etc/apf/; 25-symlink
      backward-compatible farm for /etc/apf/internals/; .symlink-manifest and
      pkg_fhs_verify_farm() startup self-healing; Docker build infrastructure
      (RPM el7/el9, DEB Debian 12); package install verification test suite;
      migration from install.sh via importconf; 11 RPM conffiles with
      %config(noreplace)
[New] RPM/DEB: auto-detect default network interface via ip route on fresh
      install; sets IFACE_UNTRUSTED in conf.apf when system default differs
      from eth0
[New] Man page (apf.8) and README restructure with complete CLI, trust
      system, GeoIP, and configuration reference

  -- Bug Fixes --

[Fix] apf --cc <CC> and apf cc info <CC>: restore geoip_cc_known() function
      deleted by canonical lib sync; production saw "command not found" for
      every country code input
[Fix] importconf: fix config merge corruption on reinstall; drop
      pkg_config_merge for internals.conf (conditional syntax was mangled);
      guard vnet/*.rules glob; preserve hook permissions and TCR_PORTS during
      upgrade; restore internals.conf from backup; migrate DOCKER_COMPAT,
      USE_IPSET, IPT_LOCK_SUPPORT to "auto"
[Fix] RPM: move install.sh migration from %pre to %pretrans to prevent
      .rpmnew conffile conflicts; abort on backup failure; pass explicit
      BK_LAST to importconf
[Fix] RPM/DEB: wipe legacy install path after backup to prevent cpio
      dir-to-symlink extraction failure; clean pre-decomposition files and
      runtime state on removal; fix SysV init double-stop on RHEL; DEB adds
      util-linux dependency for flock
[Fix] install.sh: graceful migration from RPM/DEB FHS symlink farm. Detects
      and removes /etc/apf/{extras,doc} dir symlinks plus per-file symlinks
      under internals/ and vnet/vnetgen pointing into /usr/lib/apf or
      /usr/share/doc/apf before pkg_copy_tree. Without this, install.sh over
      a package-managed install failed with "cp: cannot overwrite
      non-directory" and would silently write through per-file symlinks into
      package-managed paths. User-created symlinks are preserved.
[Fix] Trust validation: anchor grep/sed patterns to prevent IP substring
      collisions; glob expansion protection in trust_parse_fields(); control
      character and metacharacter rejection in valid_trust_entry(); add hint
      for abbreviated CIDR notation (e.g., '0/0' -> '0.0.0.0/0')
[Fix] Add mutex_lock to -a, -d, -u, -ta, -td CLI handlers; closes race
      window with cron --temp-expire on flock-absent systems
[Fix] Trust removal: spec-based iptables rule deletion in cli_trust_remove();
      also delete from TGALLOW/TGDENY chains (global trust entries were left
      in live iptables until restart); reorder orphan comment cleanup so FQDN
      resolved= metadata is available for IP resolution
[Fix] lgate_mac(): use $VF_LGATE instead of undefined $LGATE_MAC; gateway
      MAC filtering was non-functional
[Fix] expirebans(): fix $ip variable shadowing global iproute2 path; defer
      removals until after iteration to avoid modifying trust files while
      reading; add date parse error handling
[Fix] Fast load: atomic snapshot writes via mktemp+mv; validate snapshots
      before iptables-restore; flush partial rules on restore failure; check
      firewall exit code to prevent saving broken state; backend marker
      tracking for nft/legacy compatibility
[Fix] cl_cports(): reset EG_DROP_CMD, SMTP, and connlimit variables between
      VNET iterations to prevent rule leaking
[Fix] sysctl.rules: fix wrong proc paths for secure_redirects,
      send_redirects, and proxy_arp; per-interface sysctls were silently
      never applied
[Fix] SMTP_BLK: add chain-exists guard for VNET re-sourcing; add to Docker
      compat flush chain list; warn on empty SMTP_PORTS
[Fix] refresh(): populate REFRESH_TEMP from trust files instead of
      iptables-save parsing; protect bare IPv6 entries during refresh
[Fix] Cron lifecycle: clean runtime-created refresh.apf and apf_develmode
      entries during install, uninstall, and firewall stop; remove trailing &
      from cron_refresh() preventing exit code tracking
[Fix] apf: restart (-r) now propagates exit codes from flush/start
      sub-invocations; prevents silent firewall-down with success exit code
[Fix] GeoIP: fix IPv4-as-FQDN false positive in --cc IP lookup; fix IFS
      leak corrupting LOG rules; fix --cc-update timestamp tracking; fix temp
      CC expiry destroying permanent entries; harden eval in LOG rule removal;
      reject unknown country codes in --cc detail display; prevent duplicate
      temp CC iptables rules; temp-to-perm upgrade preserves entry and strips
      ttl/expire markers instead of silently skipping
[Fix] ipset_migrate_rules(): add 5-field (v2.0.1) to 7-field migration;
      5-field entries were silently dropped on upgrade
[Fix] glob_allow/deny_download(): validate entries with valid_host() instead
      of raw file copy
[Fix] ctlimit.apf: add valid_ip_cidr() guard on conntrack-sourced IPs;
      fix grep -Fv substring match that could remove unrelated IP entries;
      add numeric validation for VNET-overridden CT_LIMIT values
[Fix] CLI output: unknown options exit 1; error messages to stderr;
      list() uses cat for pipes and silent pager fallback for TTY; restrict
      elog stdout module to elog() source only to prevent duplicate output
      from elog_event() structured events
[Fix] Preserve file inodes: logrotate copytruncate for tail -f consumers;
      trim() uses cat+rm instead of mv
[Fix] vnetgen: strip Docker @ifN suffix from ip link output to prevent
      duplicate VNET rules in containers
[Fix] Portability: fix coreutils resolution for pre-usr-merge distros
      (CentOS 6, Ubuntu 12.04)
[Fix] Port dedup: deduplicate comma-separated port lists before rule
      generation in _port_filter_loop, _uid_filter_loop, _icmp_filter,
      cdports, and BLK_P2P_PORTS; prevents duplicate iptables rules from
      duplicate config entries
[Fix] --help: detect minimized Ubuntu/Debian man stub and fall back to
      built-in help instead of displaying "unminimize" advisory
[Fix] refresh: REFRESH_TEMP now includes IPs from advanced trust entries
      (proto:flow:d=port:s=FQDN); previously skipped all entries containing
      '=' leaving advanced FQDN rules unprotected during refresh
[Fix] pkg_lib 1.0.7 -> 1.0.8: process substitution broke sh install.sh on
      bash 4.2 POSIX mode (CentOS 7/6); ln -sfn symlink-to-directory safety
[Fix] CT_LIMIT: IPv6 conntrack offenders were silently dropped at validation
      gate (valid_ip_cidr rejects IPv6); IPv6 CIDRs in exempt list were
      silently ignored by IPv4-only awk parser; now uses valid_host() and awk
      IPv6 CIDR prefix matching
[Fix] gretunnel: default keepalive retries to 3 when GRE_KEEPALIVE contains
      only an interval value; single-field input caused silent ip tunnel failure
[Fix] bash-completion: apf cc <TAB> now shows verbs and country codes together;
      _apf_complete_cc() was overwriting the verb COMPREPLY array
[Fix] mutex_lock: detect and remove empty lock files left by flock wrapper;
      noclobber fallback timed out after 60s instead of acquiring the lock

  -- Changes --

[Change] Remove unused per-module APF_*_VERSION constants from apf.lib.sh and
      9 apf_*.sh sub-libraries; assigned but never read (no version-check
      consumer ever materialized); canonical version remains VERSION in
      files/apf
[Change] Vendored libraries: elog_lib 1.0.6, pkg_lib 1.0.10, geoip_lib 1.0.7
[Change] Documentation: add VNET section to man page; add logrotate to FILES;
      add -ta/-td to bash completion; add CentOS 6 and Ubuntu 12.04 to
      README platforms; add ctlimit cron to README key files; expose
      ELOG_AUDIT_FILE in conf.apf
[Change] Conntrack module migration: use -m conntrack --ctstate when available,
      falling back to -m state --state on legacy systems
[Change] File-based flock mutex: replace FD-based exec/flock with noclobber +
      PID fallback; EXIT trap releases lock on signal; trust CLI operations
      acquire lock for cron race prevention
[Change] ESTABLISHED,RELATED state tracking moved earlier in INPUT chain;
      established connections fast-path past VNET and port filtering
[Change] Fast load uptime threshold raised from 5 to 10 minutes
[Change] Consolidate 3 cron files into single cron.d.apf with daily restart,
      hourly ipset refresh, and per-minute temp expiry
[Change] Performance: single-pass trust loading with iptables-restore --noflush
      reducing lock acquisitions from O(n) to O(1); subprocess replacement
      with bash builtins across hot paths
[Change] refresh(): exit 0 (not 1) when trust rules are unchanged since
      last refresh; may affect automation checking for non-zero on no-op
[Change] Remove vestigial kernel 2.4 ipchains code, orphaned global TIME
      variable, dead UNAME/LSM/RMM/KREL binary discovery, and unimplemented
      trust flush --deny/--allow stubs; eliminates 5 unnecessary subshell
      forks at startup

- 2.0.1 | Feb 20 2026:

  -- New Subsystems --

[New] Docker/container chain preservation mode (DOCKER_COMPAT); surgical
      flush via flush_apf_chains() removes only APF-owned chains, preserving
      Docker, containerd, Kubernetes, and Podman chains in FORWARD and nat.
      save_external_baseline()/restore_external_baseline() captures and
      replays non-APF INPUT/OUTPUT rules across flush cycles. Fast load
      and snapshot save auto-disabled in compat mode (conf.apf,
      functions.apf, apf, .ca.def)
[New] ipset block list support: kernel-level hash tables for O(1) IP
      matching. USE_IPSET config toggle, ipset.rules definition file,
      ipset_load()/ipset_update()/ipset_flush() lifecycle functions,
      --ipset-update CLI for cron hot-reload, cron.d.apf_ipset job,
      ip_set/xt_set module loading (conf.apf, internals.conf,
      functions.apf, bt.rules, apf, install.sh, ipset.rules)
[New] GRE tunnel support: encapsulated point-to-point links with dedicated
      GRE_IN/GRE_OUT chains, protocol 47 rules, per-tunnel interface accept
      rules. USE_GRE config toggle, gre.rules definition file, lifecycle
      functions (create_gretun/destroy_gretun/gre_init/gre_flush/
      gre_teardown/gre_status), --gre-up/--gre-down/--gre-status CLI,
      auto-MTU, keepalive, tunnel key, role routing (conf.apf, internals.conf,
      gretunnel.sh, gre.rules, firewall, functions.apf, apf, .ca.def)
[New] Centralized dependency checking via check_deps(); validates iptables,
      ip, modprobe, ip6tables (critical) and wget, iptables-save/restore,
      diff (warning) before firewall start with OS-aware install hints
      (functions.apf, apf)
[New] systemd service unit (apf.service); install.sh prefers systemd over
      SysV init when /run/systemd/system detected (install.sh)
[New] -v|--version CLI option outputs version number (apf, functions.apf)
[New] Adaptive conntrack scaling (SYSCTL_CONNTRACK_ADAPTIVE); auto-scales
      conntrack_max when usage exceeds 80%, capped at SYSCTL_CONNTRACK_HIGH.
      Hash table sizing via SYSCTL_CONNTRACK_BUCKETS (sysctl.rules, conf.apf)
[New] nf_conntrack_helper disabled by default to reduce ALG attack surface
      (CVE-2013-6390, CVE-2019-8956) (sysctl.rules)

  -- IPv6 Dual-Stack Support --

[New] Dual-stack iptables helpers: ipt() applies to both $IPT/$IP6T when
      USE_IPV6=1; ipt4()/ipt6() for protocol-specific rules; ipt_for_host()
      routes by address family; ipt_dst()/ipt_src() for VNET-aware port
      rules. Adopted across firewall, bt.rules, log.rules, cports.common,
      functions.apf
[New] valid_host() and valid_ip_cidr() input validation functions; validates
      IPv4 octets (0-255), CIDR masks (0-32 / 0-128), IPv6 colon groups,
      compressed forms (::1, ::/0), FQDN dot requirement (functions.apf)
[New] IPv6 port filtering with ipt_dst()/ipt_src() VNET-aware helpers;
      ICMPv6 filtering via IG_ICMPV6_TYPES/EG_ICMPV6_TYPES; NDP types
      133-136 always permitted (cports.common, conf.apf, functions.apf)
[New] IPv6 PKT_SANITY: IN_SANITY6/OUT_SANITY6 chains with TCP flag checks,
      INVALID state blocking, PZERO6 port-zero filtering, and FRAG_UDP6 for
      fragmented UDP; includes RAB integration matching IPv4 (bt.rules)
[New] IPv6 multicast blocking; MCAST6 chain blocks ff00::/8 when
      BLK_MCATNET=1 and USE_IPV6=1, with NDP ICMPv6 types 133-136
      exempted before DROP to preserve neighbor discovery (bt.rules)
[New] IPv6 trust system: cli_trust(), cli_trust_remove(), allow_hosts(),
      deny_hosts() detect IPv6 addresses and route to ip6tables with ::/0;
      bracket notation for advanced trust (e.g., d=22:s=[2001:db8::1])
      with trust_protect_ipv6()/trust_restore_ipv6() escaping; .localaddrs6
      prevents local IPv6 from being trust-listed (functions.apf)
[New] IPv6 fast load save/restore; ip6tables snapshot saved as .apf6.restore,
      restored when USE_IPV6=1; falls through to full load when
      ip6tables-restore missing or snapshot absent (apf)
[New] IPv6 sysctl hardening when USE_IPV6=1: disables accept_source_route,
      accept_redirects, accept_ra on /conf/all/ and /conf/$IFACE_UNTRUSTED/;
      disables forwarding when SYSCTL_ROUTE=1; route flush alongside IPv4;
      all writes guarded behind proc file existence (sysctl.rules)
[New] IPv6 DNS filtering; resolv.conf nameservers routed to ipt4/ipt6
      by address type (firewall)
[New] IPv6 PROHIBIT chain with icmp6-adm-prohibited reject target (firewall)
[New] IPv6 local address detection; .localaddrs6 generated when USE_IPV6=1
      (firewall)
[New] IPv6 kernel module loading (ip6_tables, ip6table_filter,
      nf_conntrack_ipv6) when USE_IPV6=1 (functions.apf)
[New] $IP6TS/$IP6TR variables for ip6tables-save/restore (internals.conf)
[New] nft backend detection; snapshot includes backend marker
      (.apf.restore.backend) for safe restore across nft/legacy (apf)
[Change] Chain creation, MSS clamping, connection state, default policies,
         helpers (FTP/SSH/Traceroute), logging, P2P/IDENT, cdports, RAB/
         RABPSCAN, blocklist chains (PHP/DSHIELD/SDROP), ECN shame, dnet()
         converted to ipt()/ipt4()/ipt6()/ipt_for_host() for dual-stack
         (firewall, bt.rules, log.rules, functions.apf, cports.common)
[Change] flush() refactored with ipt4/ipt6 table loops; list()/refresh()
         handle IPv6; cl_cports() clears ICMPv6 between VNET iterations
         (functions.apf)
[Change] VNET IPv4-only limitation documented in conf.apf

  -- Security Hardening --

[Fix] SYSCTL_ROUTE else branch removed; previously enabled ip_forward,
      bootp_relay, and forwarding when routing disabled, turning server
      into a router (sysctl.rules)
[Fix] GRE eval command injection: create_gretun() replaced eval with direct
      $ip tunnel add using if/else for optional key flag (gretunnel.sh)
[Fix] Advanced trust syntax rejects unrecognized flow, direction, or protocol
      fields; prevents malformed entries from injecting arbitrary iptables
      arguments (functions.apf)
[Fix] Trust system input validation: cli_trust() and cli_trust_remove()
      validate via valid_host(); allow_hosts()/deny_hosts() validate plain
      IP entries before passing to iptables (functions.apf)
[Fix] Blocklist integrity: valid_ip_cidr() applied in all dlist_* download
      functions including ecnshame; garbage from corrupted downloads rejected
      at parse time (functions.apf)
[Fix] sed delimiter hardened to % in cli_trust_remove() and expirebans();
      cli_trust_remove() pattern anchored with ^ and \b to prevent substring
      matching (functions.apf)
[Fix] EG_DROP_CMD LOG rule now includes --cmd-owner filter; previously logged
      ALL packets in DEG chain (cports.common)
[Fix] Predictable temp files replaced with mktemp: refresh(), list(), and all
      7 download functions now use mktemp/mktemp -d (functions.apf)
[Fix] for-in-$(cat) glob expansion: allow_hosts(), deny_hosts(), all
      dlist_*_hosts(), dnet(), expirebans(), refresh() converted to
      while IFS= read -r (functions.apf)
[Fix] wget exit code checked in all 7 download functions; partial downloads
      no longer processed (functions.apf)
[Fix] Unquoted variable expansion hardened in file operations (install.sh,
      functions.apf)
[Change] DLIST download URLs updated from HTTP to HTTPS for all upstream
         sources: cdn.rfxn.com, spamhaus.org, feeds.dshield.org (conf.apf,
         .ca.def)

  -- Bug Fixes --

[Fix] OUT_SANITY missing 4 TCP flag pairs vs IN_SANITY; added ALL FIN,URG,PSH,
      ALL SYN,RST,ACK,FIN,URG, ALL ALL, ALL FIN to both IPv4 OUT_SANITY and
      IPv6 OUT_SANITY6 (bt.rules)
[Fix] DNS INPUT rules now require ESTABLISHED,RELATED state; prevents spoofed
      packets from being accepted on source port 53 (firewall)
[Fix] RESET chain catch-all DROP added for non-TCP packets (firewall)
[Fix] SSH helper: removed dead rule (mutually exclusive --syn + --state
      ESTABLISHED,RELATED); removed spurious UDP rule (SSH is TCP-only);
      return traffic port range corrected from 513:65535 to 1024:65535
      (firewall)
[Fix] RAB_PSCAN_LEVEL always-true condition; || changed to && (firewall)
[Fix] EG_DROP_CMD dead code; == "1" changed to non-empty check (cports.common)
[Fix] Missing $ prefix on LOG_DROP variable reference (cports.common)
[Fix] RESV_DNS_DROP duplicate ACCEPT rules removed (firewall)
[Fix] DNS port range corrected from 1023:65535 to 1024:65535 (firewall)
[Fix] ovars() broken AWK rewritten with ${!var} indirect expansion
      (functions.apf)
[Fix] Duplicate IPFLOW variable checks corrected to PFLOW x6 (functions.apf)
[Fix] flush() inoperative on nft backend; /proc/net/ip_tables_names absent
      causes flush to skip; now falls back to hardcoded table list
      (functions.apf)
[Fix] expirebans() flock deadlock; spawned apf -u child tried to acquire
      parent's flock; changed to direct cli_trust_remove() (functions.apf)
[Fix] expirebans() sed not anchored; 10.0.0.1 removal also deleted 10.0.0.10;
      added ^ anchor and \b word boundary (functions.apf)
[Fix] cli_trust_remove() error suppression; "|| true" masked IPv6 errors
      leaving $IPT_H stale (functions.apf)
[Fix] cli_trust_remove() first-match-only deletion; converted to tac + loop
      for complete INPUT/OUTPUT cleanup (functions.apf)
[Fix] cli_trust() duplicate check matched comment lines; now filters comments
      and uses whole-word matching (functions.apf)
[Fix] refresh() detection changed from PROHIBIT grep to TALLOW chain; works
      with non-default UDP_STOP (functions.apf)
[Fix] refresh() double REFRESH_TEMP flush removed; allow rules no longer
      destroyed before deny rules loaded (functions.apf)
[Fix] refresh() IPv4-only load check; falls back to $IP6T when USE_IPV6=1
      (functions.apf)
[Fix] IPv6 plain trust addresses silently dropped; grep -v ":" changed to
      grep -v "=" to filter only advanced syntax (functions.apf)
[Fix] DLIST disabled regression: else branches now clear rules file instead
      of restoring from backup, matching operator intent (functions.apf)
[Fix] DShield /24 host inflation: no longer appends /24 to individual host
      IPs; prevents collateral blocking of 256 addresses per host
      (functions.apf)
[Fix] dlist download resilience: backup before download, restore on failure;
      prevents failed downloads from emptying rules files (functions.apf)
[Fix] flush_apf_chains() IPv6 chain list missing PHP, DSHIELD, SDROP; caused
      -N errors on subsequent start with DOCKER_COMPAT=1 (functions.apf)
[Fix] --gre-down stale chains; gre_teardown() now flushes/deletes GRE_IN/
      GRE_OUT and removes jumps (gretunnel.sh)
[Fix] --gre-up idempotent; guards chain creation with existence check
      (gretunnel.sh)
[Fix] --gre-up/--gre-down/--ipset-update now acquire mutex_lock (apf)
[Fix] GRE tunnel creation exit codes checked; failure aborts before adding
      rules for non-existent interfaces (gretunnel.sh)
[Fix] GRE endpoint validation uses valid_ip_cidr(); tunnel key validated as
      integer (gretunnel.sh)
[Fix] Fast load error handling: restore exit codes checked; corrupted
      snapshots fall through to full load; IPv6 snapshot gap detected when
      USE_IPV6=1 but no .apf6.restore exists (apf)
[Fix] apf -u now reports success/failure instead of unconditionally printing
      "removed" (apf)
[Fix] cron.daily rewritten to call APF directly instead of /etc/init.d/apf;
      install.sh sed-replaces path for custom INSTALL_PATH (cron.daily,
      install.sh)
[Fix] All 8 $IP6T calls now include $IPT_FLAGS lock flag (functions.apf,
      firewall, bt.rules)
[Fix] IPv6 loopback rules corrected from 0/0 to ::/0 (firewall)
[Fix] SYSCTL_TCP_NOSACK non-empty test corrected to == "1" (sysctl.rules)
[Fix] tcp_tw_recycle and tcp_fack guarded behind /proc file existence;
      removed in kernel 4.12 and 4.15 respectively (sysctl.rules)
[Fix] 4 duplicate sysctl writes removed (sysctl.rules)
[Fix] VER updated from "1.7.6-2" to "2.0.1" (apf)
[Fix] ALL_STOP unconditional override removed; now defaults only when unset
      (internals.conf)
[Fix] tosroute() uses return instead of break (functions.apf)
[Fix] EG_DROP_CMD default changed from space-separated to comma-separated
      matching tr ',' parser (conf.apf)
[Fix] DEVEL_ON timing: fast load checks DEVEL_MODE directly (apf)
[Fix] BLK_P2P_PORTS duplicate port 6346 removed (conf.apf)
[Fix] Dead variables removed: $ADR (+ MD5_FILES reference), LSTOP, LACCEPT,
      TOS_DEF_TOS, DSTOP, unused MOD in ml(); duplicate MD5_FILES in apf
      removed (internals.conf, apf, functions.apf)
[Fix] $TIF undefined replaced with $IFACE_TRUSTED (vnetgen)
[Fix] vnetgen: [ -f "$ip" ] changed to [ -n "$ip" ]; ifconfig fallback fixed
      for modern net-tools; SET_VNET=0 exits 0 not 1 (vnetgen)
[Fix] Interface validation error messages reference specific failing interface
      instead of entire list (firewall)
[Fix] Dead head command removed from CNF error path (firewall)
[Fix] Hardcoded paths replaced: /sbin/ip→$ip, /sbin/iptables-save→$IPTS,
      /sbin/route→command -v route, 35+ /etc/apf/→$INSTALL_PATH, /etc/init.d/
      apf→$INSTALL_PATH/apf (firewall, vnetgen, functions.apf, apf)
[Fix] IP6_NET link-local filter: grep -v fe80 before head -n1 prevents fe80::
      from being selected over global unicast (internals.conf)
[Fix] $ip usage guarded behind -n check (internals.conf)
[Fix] reserved.networks: added 0.0.0.0/8 "this network" (RFC 1122);
      private.networks: added RFC 6598 100.64.0.0/10 (data files)
[Fix] ipchains check guarded behind kernel 2.4 (functions.apf)
[Fix] --cmd-owner runtime detection with graceful skip (cports.common)
[Fix] Deprecated $[...] arithmetic replaced with $((...)) across all files
[Fix] get_ports IPv6: rev|cut -d: replaced with sed; ::1 filtered (get_ports)
[Fix] Typos corrected: lgate_mac() "FORIGN"→"FOREIGN", trim() "triming"→
      "trimming", fastload "1h"→"12h" (functions.apf, apf)
[Fix] head() email standardized to proj@rfxn.com (apf)

  -- Code Modernization --

[Change] Backtick command substitutions modernized to $() across all files;
         165 total replacements (functions.apf, cports.common, apf, firewall,
         bt.rules, vnetgen, main.vnet, importconf, install.sh, internals.conf)
[Change] Variable quoting hardened across critical paths: eout(), trim(),
         cli_trust*(), status(), devm(), trust file checks, apf entry point,
         vnetgen, firewall, bt.rules (functions.apf, apf, vnetgen, firewall,
         bt.rules)
[Change] which replaced with command -v (POSIX) for all 16 binary discovery
         variables (internals.conf)
[Change] mutex_lock()/mutex_unlock() rewritten with flock for atomic
         kernel-level locking (functions.apf)
[Change] Module loading rewritten with modprobe --dry-run for portable
         detection across .ko/.ko.xz/.ko.zst (functions.apf)
[Change] ip route primary with route fallback for interface validation;
         ifconfig optional, ip primary in VNET (firewall, vnetgen, main.vnet)
[Change] get_ports uses ss primary with netstat fallback (extras/get_ports)
[Change] list() editor discovery uses command -v loop (functions.apf)
[Change] URL/filename extraction uses ${URL##*/} parameter expansion
         (functions.apf)
[Change] wget -4 flag removed; dual-stack via happy eyeballs (functions.apf)
[Change] Loopback rules use ipt() with redundant 0/0 removed (firewall)

  -- Configuration & Documentation --

[Change] conf.apf comment improvements: compressed DEVEL_MODE, USE_IPV6,
         SET_VERBOSE, SET_EXPIRE, VF_ROUTE, RAB intro/log options,
         SYSCTL_TCP_NOSACK, DLIST_PHP, DLIST_ECNSHAME; added SET_FASTLOAD
         DEVEL_MODE bypass note, SET_VNET IPv6 limitation, SYSCTL_ROUTE
         IPv6 forwarding note, LOG_IA LOG_DROP dependency (conf.apf, .ca.def)
[Fix] conf.apf factual errors: PKT_SANITY_FUDP UDP fragmentation claim,
      TCP/UDP/ALL_STOP option lists (added PROHIBIT), SYSCTL_SYN backlog
      direction, SET_REFRESH scope, LOG_DROP wording, BLK_PORTS grammar,
      LOG_TARGET ULOG deprecation, dead MBone URL, stale USE_RD/USE_ECNSHAME
      references, DShield "top networks"→"top hosts" (conf.apf, .ca.def)
[Fix] conf.apf/.ca.def typos: assignement, by-pass, hand-shake, subsiquent,
      inital, allot, "2109"→"2019", your→you're, HTTP→HTTPS URLs, a→an ICMP,
      first-person removed from LOG_LEVEL (conf.apf, .ca.def)
[Fix] .ca.def SET_REFRESH_MD5 description corrected to boolean (0/1) (.ca.def)
[Change] .ca.def synchronized: LOG_IA/SYSCTL_CONNTRACK comments match
         conf.apf; TCR_PASS/TCR_PORTS split to separate lines (.ca.def)
[New] .ca.def variable imports: USE_IPSET, IPSET_LOG_RATE, USE_GRE, GRE_*,
      SYSCTL_CONNTRACK_*; hardcoded SET_TRIM/TOS_DEF_RANGE/TCR_PORTS/
      SYSCTL_ROUTE/DLIST_RESERVED converted to $variable (.ca.def)
[Change] README overhaul: compressed introduction and config sections to
         concise variable-first format; new sections for Remote Block Lists,
         Logging & Control, Implicit Blocking, Kernel Tuning, trust controls;
         Docker compat, ipset, GRE, IPv6 documentation added; removed
         fabricated Dynamic Trust Files section and dead forum reference;
         support email updated; DEVEL_MODE warning added (README, README.md)
[Fix] README corrections: GRE "encrypted"→"encapsulated", DLIST "ARIN"→
      "IANA", real IPs→RFC 5737, epoch updated, ipset.rules/gre.rules format
      corrected, "docs"→"doc" install path (README, README.md)
[New] README.md Markdown version with anchor-linked TOC, fenced code blocks,
      and tables (README.md)
[New] IPv6 trust syntax documentation with bracket notation examples added
      to all 4 trust rules files (allow/deny_hosts.rules, glob rules)
[Fix] Data file corrections: "line-seperated"→"line-separated" in 4 trust
      files; dead MBone URL in multicast.networks; reserved.networks label
      and IANA URL; private.networks canonical RFC URL (data files)
[Fix] vnetgen.def: "defined"→"define", "iptable"→"iptables", invalid IP→
      RFC 5737 192.0.2.1 (vnet/vnetgen.def)
[New] Inline comments added to sysctl.rules (conntrack timeouts, port range,
      tcp_tw_recycle note), log.rules (LOG_IA purpose), bt.rules (INVALID
      states, p2p ports) (sysctl.rules, log.rules, bt.rules)
[Change] help() output: added --ipset-update/--gre-*/--gre-status; -a/-d
         show IP/IPv6/CIDR/FQDN; error messages mention IPv6 (functions.apf)
[Change] Subsystem file naming: gre.conf→gre.rules; ipset.rules/gre.rules
         cross-reference conf.apf sections
[Change] conf.apf GA_URL/GD_URL example URLs updated to HTTPS (conf.apf)

  -- Install, Init & Upgrade --

[Fix] install.sh: copies files before sed to prevent source tree corruption;
      sed only runs when INSTALL_PATH != /etc/apf; mkdir -p with backup
      validation; rotates apf_log instead of deleting; sed-replaces cron.daily
      and init/systemd paths for custom INSTALL_PATH (install.sh)
[Fix] importconf: preserves glob_allow/deny.rules, ipset.rules, and gre.rules
      during upgrade; copy destinations use $INSTALL_PATH; paths quoted
      (importconf)
[Change] logrotate.d.apf: weekly rotation with compression; removed stale
         postrotate (killall rsyslogd irrelevant — APF writes log via eout())
         (logrotate.d.apf)
[Change] apf.init modernized: removed RHEL-specific init.d/functions
         dependency, uses $INSTALL_PATH, added status command (apf.init)

  -- Test Suite --

[New] BATS smoke test suite: 261 tests across 20 files with Docker
      (--privileged) and network namespace support (veth-pub, veth-priv);
      cross-distro netcat portability; backend-portable iptables assertions
      via iptables -S (tests/)
[New] CI matrix: Debian 12, CentOS 7, Rocky 8/9, Ubuntu 20.04/22.04/24.04
      via GitHub Actions with buildx layer caching; deep legacy manual
      targets: CentOS 6, Ubuntu 12.04 (.github/workflows/, tests/Dockerfile.*)
[New] Test coverage: install/CLI, chains, ports, trust, interfaces, IPv6,
      packet sanity, fast load, flush, validation, advanced trust, sysctl,
      refresh/expiry, install paths, RAB, dependency checks, ipset, GRE,
      DLIST, Docker compat (tests/01-20)
[New] Parallel test targets: make -C tests test-all-parallel (tests/Makefile)
[Change] Test performance: APF pre-installed during Docker build; fast
         reset-apf.sh helper; consolidated flush+start cycles; per-test
         teardown prevents dirty state leaks (tests/)
[Fix] Cross-OS test compatibility: IPv6 skip guards for missing ip6tables;
      packet sanity patterns widened for 3 output formats (SYN,FIN / flags:
      0x03 / tcpflags: 0x03); portable ipset v6.x member counting; timeout
      for apf -l when vi present; GRE protocol 47 pattern widened (tests/)
[Change] Removed dead Ubuntu 16.04/18.04 Dockerfiles (tests/)

- 1.7.6-2 | Nov 18 2020:
[New] add iptables locking support with iptables >= 1.4.20; pr #36
      IPT_LOCK_SUPPORT
      IPT_LOCK_TIMEOUT
[Fix] typos

- 1.7.6-1 | Jun 18 2019:
[New] add mitigation options for TCP SACK Panic vulnerability
      SYSCTL_TCP_NOSACK and BLK_TCP_SACK_PANIC added to conf.apf
      https://access.redhat.com/security/vulnerabilities/tcpsack
[Change] updated autoconf template
[Change] ignore value of BLK_TCP_SACK_PANIC when SYSCTL_TCP_NOSACK is set
[Change] make init script LSB compliant for use with systemd; pr #26
[Fix] README typos; pr #28
[Fix] flush ip6tables rules on stop/flush if USE_IPV6 enabled; pr #28
[Fix] only the first nameserver in resolv.conf would be whitelisted when
      RESV_DNS_DROP is set enabled; issue #25
[Fix] change ipv4.ip_local_port_range to not emmit errors ref:
      Marco Padovan <evcz at evcz.tk>
      https://access.redhat.com/solutions/2887631
      https://www.spinics.net/lists/netdev/msg330895.html

- 1.7.5-2 | Sep 18 2017:
[Fix] ipt/xt_recent detection for RAB w/ compressed kernel modules
[Fix] el7.4 for some reason does not set CONFIG_MODULE_COMPRESSED_XZ=y in config-$(uname -r); addressed with more trivial check
[Fix] rewrite mutex_lock to behave more like an actual mutex, with timeout on both entering the lock and clearing old lock files.
      This helps resolve race conditions and works to fix #16
[Fix] typo in sysctl.conf for setting tcp_tw_reuse=1
[Change] SET_REFRESH_MD5 hashing now performed on start calls instead of only on '-e|--refresh'
[Change] if setting VF_ROUTE to disabled there should be no check whether interfaces are actually routed to something
[Fix] wget fails when ipv6 is disabled on host
[Fix] IP addresses interpreted as regex
[Change] support for custom INSTALL_PATH during installation
[Change] increased default conntrack limit from 65k to 128k
[Change] increased default rule trim count from 200 to 250
[Change] added configuration options for adaptive conntrack tuning during
         start/restart/reload operations

- 1.7.5 | Feb 4th 2014:
[New] added USE_IPV6 configuration option for enabling/disabling IPv6 support/rule creation
[New] added SET_EXPIRE configuration option for controlling deny_hosts ban expiration time
[New] added SET_REFRESH_MD5 configuration option which controls validation checks on trust rules and skips refresh if no changes
[New] use of keywords 'static' or 'noexpire' in ban comments (e.g: apf -d IP "noexpire http flood") will cause
      an address to never expire from the deny_hosts till removed with 'apf -u HOST/IP' or manually deleted
      from file
[New] Versioning scheme changed as follows:
      - MAJOR#.MINOR#.REVISION#
      - [0.]9.7-3 becomes 1.7.3
      - 1.7.3 Mar 11th 2013 contained many backported items from dev tree that became 1.7.4; merged trees into 1.7.5
      - New versioning scheme will become consistent across all rfxn.com projects
      - The old versioning scheme had no real value and had become a never
        ending release tree
[New] added locking support to prevent multiple start,stop,restart,refresh operations from running on top of each other
[New] added mutliport support to trust syntax
[Change] replaced usage of ifconfig with ip command for determining interface addresses, preserved ifconfig support for older <=EL4 systems
[Change] removed extras dshield package which was rarely utilized, users can of course still manually download it from dshield.org
[Change] updates --refresh|-e to utilize new consolidated allow/deny functions and improve performance of refresh (reload) operations
[Change] modified CHANGELOG versioning history to contain release dates back to initial Mar 2003 release
[Change] modified cron.daily to use init script restart operation instead of hard flushing and starting with CLI wrapper
[Change] replace IFACE_IN/OUT variables with IFACE_UNTRUSTED variable in conf.apf
[Change] removed defunct crondcheck() function
[Change] modified devel mode function to use cron.d file instead of directly editing /etc/crontab
[Change] removed glob_allow and glob_deny functions, modified allow|deny_hosts functions to support generic usage across any trust based rule files
[Change] modified ml() and modinit() functions to remove unnecessary checks and simplify usage
[Change] modified cli_trust_remove to remove unnecessary checks and improve accuracy in removing addresses from the running firewall set
[Change] consolidated cli_trust_add|deny into single cli_trust() function; reduce unnecessary checks and redundant scripting
[Change] modified rfxn.com URI references in conf.apf to cdn.rfxn.com
[Change] improved sysctl.conf TCP defaults to reduce TW socket states
[Change] dshield, spamhaus and projecthoneypot drop lists now only filter traffic sourced
         from addresses in the respective lists to reduce rule counts instead of to/from
         (src & dst)
[Change] internalize a list of local ip addresses and ignore generic to/from allow trust rules
         on said local ip list to prevent firewall loopholes due to misconfiguration
[Change] modified tospre/post route function into consolidated tosroute function
[Change] modified preroute/postroute.rules files to remove callouts to tos functions which
         are now called prior to the pre/post route file inclusions
[Change] modified cli allow/deny trust functions for improved sanity checks through consolidated
         validation callouts
[Change] preroute rules now load before implicit trust on loopback interface traffic so rules can be
         applied against loopback traffic if so desired
[Change] consolidated TMP_DROP and TMP_ALLOW chains into REFRESH_TEMP
[Change] updated copyright dates in all output and file headers
[Change] removed use of *_URL_PROT variables, URL's should now be fully qualified URI's (e.g: http://domain.com/path/file)
[Fix] expirebans() would only remove bans that contained comments
[Fix] allow rules in the format advanced trust syntax, when otherwise not defining a protocol, were only applying to TCP traffic
[Fix] trust rules refresh cronjob modified to remove MAILTO & SHELL variables which were causing crond
      'bad minute' errors on some systems
[Fix] reordered chain flushes on refresh() to avoid any possible packet loss or loss of connectivity
      from hosts in the allow tables
[Fix] SYSCTL_CONNTRACK better handles varied kernel and iptables versions to apply value on correct sysctl
      hook file; nf_conntrack_max or ip_conntrack_max
[Fix] set local DNS servers as configured in resolv.conf to bypass RABPSCAN to prevent potential Denial of Service from forged packets
[Fix] restarts in some situations can cause 'iptables: Resource temporarily unavailable' errors, added 2sec
      sleep delay on restarts between flush() and start() to prevent resource errors
[Fix] block rules for BLK_PRVNET and BLK_RESNET were being added with no interface modifier and as such had
      the potential to block traffic over private and loopback interfaces when it was otherwise not intended
[Fix] in some situations, RABPSCAN would not enable due to kernel module extension variable not being scoped
      properly and the check_rab function returning that the kernel did not support ipt/xt_recent.

- 0.9.7-2 | Feb 19th 2012
[Fix] xt/ipt_recent module path changed under RHEL/CentOS 6
[Fix] kernel version tests for 2.4/2.6 kernel modules failed under kernel 3.x
[Change] RAB should default to a minimal level of sensitivity; lowered RAB_PSCAN_LEVEL to 1
[Change] flush() function now clears bans from xt/ipt_recent iptables module
[Fix] removed disabling of tcp window scaling from SYSCTL_TCP; no longer the route breaking
      feature it once was
[Fix] check_rab() was not properly evaluating the status of the xt/ipt_recent kernel module
[New] added condrestart to apf.init for conditional restart only if apf is already running,
      thanks to mmckinst [at] nexcess.net for submission
[Change] TOS mangling now applies to UDP traffic
[Change] default conntrack limit increased to 65536

- 0.9.7-1 | Oct 19th 2011
[Fix] bt.rules and associated import of deny_hosts now loads into FW before allow rules
[Fix] added stricter checking of local addresses in the trust system
[Fix] if wget disappears while remote rules are being fetched it can cause apf
      to panic and drop all packets
[Change] removed stuffed routing sanity filtering
[Change] set DLIST_RESERVED=1 to force reserved.networks updating; does not
         change value of BLK_RESNET

- 0.9.6-5 | Mar 13 2009
[Change] refresh function now stores old rules in temporary chain while new
         rules load, temporary chain is cleared upon completion of function
[Change] renamed drop list related functions for better consistency
[New] added projecthoneypot aggregated block list for harvesters, spammers and
      dictionary attackers, see conf.apf option DLIST_PHP
[Change] all remote drop lists in conf.apf have had variables renamed as DLIST_
[Change] more changes to cli_trust_remove() to better handle rule deletion from
         all trust chains relative to line number based removals
[Fix] issue with cli_trust_remove() was not deleting trust rules in all 
      situations

- 0.9.6-4 | Aug 25th 2008
[Change] install.sh will now check against init.d and rc.d/init.d and as a
         last resort set apf to start from /etc/rc.local
[Fix] changed the cron.daily entry to use /etc/apf/apf instead of init script
[Fix] Ubntu Linux has changed default pointer of /bin/sh to /bin/dash instead
      of the traditional /bin/bash, as such for POSIX standards and compat.
      reasons, all internal pointers to /bin/sh have been updated to /bin/bash

- 0.9.6-3 | Feb 12th 2008
[Fix] the cli_trust_remove() function was not checking global trust rules
      before passing allow/deny addresses onto the firewall which caused
      conflicting trust data if the same address was present in more than
      a single rule file
[New] added SET_REFRESH to conf.apf which controls the rate at which trust
      rules are automatically refreshed, defaults to 10 minutes
[New] added SET_TRIM to conf.apf which controls the max allowed entries in the
      deny trust system, defaults to 50 lines
[New] added -e|--refresh flag to apf command that is used to flush & refresh the
      (global)trust system chains, this will also re-download any global rules
      and re-resolve any DNS names in the rules
[Change] the cli_trust_remove() function has been updated to support the new
         (global)trust system chains
[Change] modified the trust system to load rules into specific chains to better
         support dynamic refreshing of the rules, the new chains are as follows
         TALLOW TDENY (standard trust)
         TGALLOW TGDENY (global trust)
[Fix] the cli_trust_remove() function was not using the ALL_STOP variable when
      matching rules in the firewall for removal, would fail if ALL_STOP was set
      to anything other than default value
[Change] set SYSCTL_ROUTE to default off as it was causing issues with VPS
         installations
[Fix] RAB_LOG_HIT was being enabled even with RAB parent variable disabled
      causing some noise in the logs
[Fix] the p2p drop chains are now implicit that the client side ports must be
      high ports (1024+) before a drop takes place
[Fix] the HELPER_SSH and HELPER_FTP variables in conf.apf were not referenced
      by the correct variable name in the back end
[Change] more netfilter module renaming in 2.6.20+, the ip_conntrack_* modules
         are now known as nf_conntract_* - compatibility support added
         [this was a silent compatibility change in previous 0.9.6-2 release]
[Change] more complete preload list for iptables modules added
[Fix] cli_trust_remove() now better handles situations where addresses appear
      in multiple trust files
[Change] appended /dev/null stdout redirects onto apf calls in the init script
         to prevent verbose output during boot/init operations
[Fix] added a check routine to the fast load feature so snapshots are no longer
      saved when there are no iptables chains loaded (i.e: double run apf -f)
[Change] scrub of APF to remove all ties to antidos, the antidos subsystem has
         been removed and will be replaced with expanded RAB features
[Change] very extensive updates to the README.apf file
[Change] a_cli_tr() and d_cli_tr() functions renamed to cli_trust_allow() and
         cli_trust_deny()
[Change] the --unban command flag has been changed to --remove with the former
         silently being preserved for compatibility
[Change] unban() function renamed to cli_trust_remove()
[Fix] the optional comment string on --allow|-a and --deny|-d was being cut
      short in certain circumstances
[Change] force disable fast load when devel mode is enabled
[Change] cron.daily entry for apf restart has been changed from 'fw' to 'apf',
         the install.sh will now remove old file and replace with the new
[New] added ability to log RAB HIT and TRIP events with variables RAB_LOG_HIT and
      RAB_LOG_TRIP
[Change] reserved.networks file now dynamically updated on the r-fx server daily
         from http://www.iana.org/assignments/ipv4-address-space

- 0.9.6-2 | Jun 10th 2007
[New] added Reactive Address Blocking (RAB), see conf.apf RAB section for
      detailed information
[Change] removed BLK_P2P variable, BLK_P2P_PORTS now self activating string
         where if no values defined then the feature is simply disabled
[Change] modified clamp-mss-to-pmtu rule to load earlier in the firewall
[Change] SYSCTL_TCP now sets tcp_sack, tcp_dsack and tcp_fack enabled for
         more reliable connections, especially over otherwise unreliable links
[Fix] SYSCTL_TCP was setting tcp_fin_timeout to an inordinately high value, 
      this was not "that" dangerous as this value only controls FIN-WAIT-2
      socket states which eat a maximum of 1.5k of memory - was just bad form
[New] added USE_ECNSHAME to set postrouting rules to turn off ECN while
      communicating with hosts that have known broken TCP/IP implementations
      from the ECN SHAME list, dependant on SYSCTL_ECN being enabled
[Change] structural format of conf.apf modified slightly along with a number
         of the variable descriptions reworded or expanded
[Change] reworded some of the usage descriptions on the apf command
[Fix] dns discover chain expanded as some applications such as wget had issues
      resolving hostnames in isolated situations - to compensate for the
      relaxed security, packet states on DNS requests are more strictly enforced
[Fix] extended tcp/ip packet header logging would only apply to the default
      drop chains and not custom drop chains like dshield
[New] md5sum validation of *.rule & *.networks files for fast load expiration
      on detected file changes
[New] added SET_VERBOSE option to conf.apf to allow for displaying of status
      log to the console as firewall is used
[Change] most rule restrictions against the in/out interfaces have been lifted
         to better accommodate the SET_ADDIFACE feature
[Change] the conf.apf description for the dshield block list has been expanded
[New] added Spamhaus Don't Route Or Peer List (DROP), USE_DROP var added to
      conf.apf with detailed description
[Fix] bt.rules referenced an out of date drop target, replaced with ALL_STOP
[Change] set BLK_RESNET enabled by default in conf.apf
[Change] the conf.apf description of PKT_SANITY_STUFFED var has long been 
         lacking, it has now been more clearly described
[Change] set PKT_SANITY_STUFFED enabled by default in conf.apf
[Change] set TOS 8 on ports 21,20,80, set TOS 16 on ports 25,110,143
[Change] TOS_DEF_TOS variable changed to TOS_DEF
[Fix] the dshield chain was not properly logging under certain circumstances
[Change] created line spaces between (rev:#) statements under the same 
         release tree in CHANGELOG file
[Fix] install.sh would under certain circumstances create the apf.bk.last link
      to the incorrect previous APF version causing importconf script to import
      options from an earlier version than your last version
[Fix] typo in the apf command usage help display of --ovars
[Change] init script used an old custom flush routine on stops, now set to use
         the apf flush() function
[New] fast load feature added that allows APF to load rules from saved snapshot
      using iptables-save/restore commands
[Fix] some apf operations that would output data to the log file were not 
      properly stating the subsystem they were called from
[Fix] the VF_LGATE feature was trying to turn on even when disabled, this had
      no real implication other than an empty chain being created - just messy
[Fix] the P2P block rules were not part of a chain and had no capacity to log
      like other block rules
[Change] all custom filtering chains have been redesigned for more efficent 
         packet flow patterns - this also makes the apf -l (iptables -L) output
         MUCH cleaner and opens up more feature possibilities in the future
[Change] LOG_IA chain updated to reflect HELPER_SSH_PORT value
[New] vnet rules now created for addresses on interfaces other than those 
      set by IFACE_* vars - added SET_ADDIFACE to conf.apf for toggling - 
      detailed description of this feature in conf.apf caption for the var
[Change] vnet rules now skipped for addresses no longer bound to interfaces
[Fix] updated functions.apf to accommodate ipt_state/ipt_multiport now 
      known as xt_ in kern 2.6.15+
[Change] replace DSTOP target with ALL_STOP, antidos and conf.apf updated
[Change] modified the statful connection helper chains for SSH and FTP to be
	 togglable through conf.apf as HELPER_SSH/HELPER_FTP - also makes
	 APF more portable when you desire to change these service ports
[Fix] The variable naming scheme for interfaces was inconsistent in some rule
      files, although the old variables for interfaces are backward compatible
      - it just looks better when things appear as intended
[Fix] removed default drops in reserved.networks for now in use networks, these
      changes auto-propigate to APF installs from the US_RD feature:
 7/8 ARIN
 46/8 RELIST IANA RESERVED
 77/8 RIPE
 78/8 RIPE
 79/8 RIPE
 92/8 RIPE
 93/8 RIPE
 96/8 ARIN
 97/8 ARIN
 98/8 ARIN
 99/8 ARIN
 116/8 APNIC
 117/8 APNIC
 118/8 APNIC
 119/8 APNIC
 120/8 APNIC
[Change] replace the common drop var CDPORTS with BLK_PORTS, conf.apf updated
[Fix] added the missing LOG_DROP/LOG_ACCEPT log prefix onto LD/LA chain targets

- 0.9.6-1 | Jan 16th 2007
[New] added unban() function with -u|--unban run flag to unban hosts and remove
      from rule files/active running firewall
[Change] changed RESV_DNS to default enabled
[New] added NETBLOCK/NETBLOCK_MASK to conf.antidos for toggling the already
      in-place feature of banning all seen ip's on the same /24 subnet of an
      attacking ip; default set to disabled now
[Change] modified icmp rate limiting to have a disabled toggle
[New] added resnet_download() function to keep reserved.networks updated
[Change] modified sanity chains to be more granular for conf.apf toggles; as
	 such the following variable options have been added:
 PKT_SANITY
 PKT_SANITY_INV
 PKT_SANITY_FUDP
 PKT_SANITY_PZERO
 PKT_SANITY_STUFFED
[Fix] trust system allow function a_cli_tr() for cli banning; rules added only
      for tcp; removed protocol option from rule
[Change] functions gd,ga renamed glob_allow|deny_download
[Change] modified traceroute specific rules to have conf.apf toggle var TCR_*
[Change] forced ip whois to search only for abuse address
[Change] moved ip whois code in antidos; less repetitive
[Fix] removed default drops in reserved.networks for now in use networks, these
      changes auto-propigate to APF installs from the US_RD feature:
 041/8  AFRINIC
 058/8  APNIC
 059/8  APNIC
 073/8  ARIN
 074/8  ARIN
 075/8  ARIN
 076/8  ARIN
 189/8  LACNIC
 190/8  LACNIC 
[New] added LOG_LEVEL var to conf.apf to denote logging level of firewall logs;
      all log chains throughout the project have been updated to reflect this
      feature as applicable
[Change] DROP_LOG var in conf.apf changed to LOG_DROP
[Change] LGATE_LOG var in conf.apf changed to LOG_LGATE
[Change] EXLOG var in conf.apf changed to LOG_EXT
[Change] IPTLOG var in conf.apf changed to LOG_APF
[Change] LRATE var in conf.apf change to LOG_RATE
[Change] renamed README to README.apf
[Change] FWPATH var in conf.apf changed to INSTALL_PATH
[Fix] removed default drops in reserved.networks for the following netblocks:
 089/8 RIPE NCC
 090/8 RIPE NCC
 091/8 RIPE NCC
[Change] DEVM var in conf.apf changed to DEVEL_MODE
[Change] EN_VNET var in conf.apf changed to SET_VNET
[Change] MONOKERN var in conf.apf changed to SET_MONOKERN
[Fix] more /tmp cleanups to prevent possible race conditions
[Change] importconf script now copies itself to extras/ folder post-install
[Change] changed short switch -st to -t; -st preserved for compat but no longer
         documented or printed in help output
[New] added -o|--ovars to output all configured variables for debug purposes
[Fix] INVALID state check removed from postrouting chain
[Change] modified a/d_cli_tr to keep comments within single line
[New] expanded p2p blocks; conf.apf var BLK_P2P & BLK_P2P_PORTS
[Change] increased verbosity of a number of rules to status log
[Change] modified sanity bt filters, more verbose status log
[Change] moved bulk of TOS declarations in pre/postrouting.rules into functions
[New] expanded TOS routines, new TOS_* vars added to conf.apf
[New] added conf.apf var to change the default log target; LOG_TARGET
[Fix] dshield.org changed block list to feeds.dshield.org/top10-2.txt
[Change] changed ordering of version history (this file); revisions now list
         in reverse order from latest to oldest revision 
[New] added chain targets GTA,GTD,TA,GD for allocating trust rules to more 
      organized chain policies; will also facilitate features to reload trusts
[Change] added OUTPUT reject targets for ident if not opened in *_TCP_CPORTS
[New] added SF_TY var to conf.antidos in order to define tcp connection states
      to look for as syn-flood attacks
[Fix] removed default drop of 58-59/8 in reserved.networks
 058/8   Apr 04   APNIC
 059/8   Apr 04   APNIC

- 0.9.5-1 | Feb 19th 2005
[Fix] removed default drop of 124-126/8 in reserved.networks
 124/8   Jan 05   APNIC        
 125/8   Jan 05   APNIC
 126/8   Jan 05   APNIC
[New] added auto-commenting of all allow/deny trust rules with date & time
      along with custom comment feature as an argument on bans
      (i.e: apf -a 1.2.1.2 "home lan")
[New] added postroute.rules to correspond with preroute.rules TOS settings
[Change] modified *route.rules to declare in/out interface in rules
[New] added in remote download feature for glob_allow/deny.rules
[Change] changed many conf.apf default settings, reverted many options disabled
         till end user reads/enables the options
[New] created importconf script that imports critical conf.apf options from
      previous install; also copy's trust rules and conf.antidos
[Fix] modified RESV_DNS option to ignore # characters in /etc/resolv.conf

- 0.9.4-8 | Jan 24th 2005
[New] added filter rules for edonky,kazaa,morpheus; recent php-injection
      exploits install p2p pirating clients
[Change] removed UID 0 checks from firewall/apf script, irrelivent as perms
         enforce root-only access
[Fix] chmod permissions on top-level /etc/apf were set 755; changed to 750
[New] global trust rules created; glob_allow/deny.rules, appropriate for an
      external/maintained ban list
[Change] modified install.sh to symlink apf.bk.$UTIME too /etc/apf.bk.last/

- 0.9.4-7 | Jan 2nd 2005
[New] added SYSCTL_CONNTRACK var to conf.apf; relative to ip_conntrack_max
[Fix] removed default drop of 085-088/8 in reserved.networks
071/8   Aug 04   ARIN                                (whois.arin.net)
072/8   Aug 04   ARIN                                (whois.arin.net)
085/8   Apr 04   RIPE NCC                            (whois.ripe.net)
086/8   Apr 04   RIPE NCC                            (whois.ripe.net)
087/8   Apr 04   RIPE NCC                            (whois.ripe.net)
088/8   Apr 04   RIPE NCC                            (whois.ripe.net)

- 0.9.4-6 | Sep 1st 2004
[Fix] cports.common, EGF_UID; error in multi-port routine
[Change] modified conf.antidos default values

- 0.9.4-5 | Jul 28th 2004
[Change] revised all log chains that did not conform too the DROP_LOG toggle
[Change] revised invalid tcp flag order drop rules; into IN/OUT_SANITY chain
[Change] merged ingress nmap style scan drop rules; into IN_SANITY chain
[Change] revised install.sh script; more verbose install output
[Fix] trust based CLI rule insertion cross validates trust files too prevent
      duplicate/conflicting entries; previously only checked respective mode
      file (deny file for deny insertions and allow for allow insertions) 
[Fix] direct path too 'ip' binary was not specified in vnetgen script
[Fix] 'stat' command not compatible with debian, replaced with use of 'ls'
[Change] cleanup ifconfig/ip binary inconsistencies; revised fallback support
	 between 'ip' & 'ifconfig'
[Fix] vnetgen.def referenced invalid storage variable for ip information

- 0.9.4-3 | Jun 1st 2004
[Fix] removed default drop of 70/8 in reserved.networks
070/8   Jan 04   ARIN                                (whois.arin.net)
[Fix] fixed outgoing traceroute requests
[New] added uid-match egress filtering routine
[Fix] invalid wildcard destination address when EN_VNET=0 for cports routine
[Fix] sysctl.rules output redirected to /dev/null
[Fix] missing '"' (SYSCTL_ROUTE="0) in conf.apf
[Change] revised LGATE_MAC routine; added run-time log output for successful
         loading of the routine. revised logging options for the routine &
         created an independent log/reject chain for forign MAC addresses.
[New] added LGATE_LOG option to toggle forign gateway mac logging

- 0.9.4-2 | Mar 3rd 2004
[Change] updated ad/tlog; structure cleanup
[Change] revised ignore facility for antidos
[Fix] corrected protocol missing error in untrusted name server drop chain
[Change] added get_ports script to generate in-use ports list during install
[Fix] corrected output redirect for antidos lock routine to antidos log file
[Fix] set install script to set mode 750 ad/tlog
[Fix] corrected log prefix for lock routine in antidos
[Fix] identify IN/OUT_IF and declare identified ip in apf_log during init
[Fix] addressed issues with local ip discovery on ipv6-enabled systems
[Change] added fallback from 'ip' to 'ifconfig' binary for local ip discovery
         of aliased interafaces in vnet/vnetgen
[Change] moved get_ports into extras/ path
[Change] added traceroute (33434_33450) to common drop ports
[Fix] fixed egress established/related connection rules
[New] added EN_VNET var to conf.apf for global toggle of vnet sub-system
[Change] modified sysctl.rules; reorganized for tcp, syn, routing, & misc.
         settings. Disabled syncookies; incrased ip_conntrack_mx.
[Change] various entries added to sysctl.rules and/or modified entries.
[New] added SYSCTL_TCP SYSCTL_SYN SYSCTL_ROUTE SYSCTL_LOGMARTIANS SYSCTL_ECN
      SYSCTL_SYNCOOKIES SYSCTL_OVERFLOW vars to conf.apf for sysctl seperation.
[Change] revised DEVM so when enabled; log and output warnings are issued.
[Fix] modified internals.conf and vnetgen script to be explicit for ipv4 only
      with ip-fetch routines
[New] added multiple interface support with seperation of trusted and untrusted
      interfaces
[Change] revised majority of firewall rules to be explicit for untrusted
         interface only
[New] added extended logging support; logchains can output tcp/ip options
      using EXLOG var in conf.apf
[Fix] DET_SF routine was not parsing ignore file while fetching syn info.

- 0.9.3-5 | Feb 11th 2004
[New] added tlog script to antidos; track log length; instead of 'tail -n'
[New] added lockfile feature to antidos
[Fix] added cl_cports function to clear any set cport values between rule files
[Fix] export call to PATH var; typo as 'export $PATH' instead of 'export PATH'
[New] added check routines for support of linux 2.6 module extentions (.ko);
      thanks to mmontgomery@theplanet.com
[Change] removed use of unclean module; deprecated and breaks ECN
[Change] removed calls to 'vnetgen' from apf init script
[Change] revised default drop policy rules
[New] added RESV_DNS var to conf.apf for dns discovery routine

- 0.9.3-4 | Jan 21st 2004
[Change] removed fwmark preroute rules
[Change] oversight typo in deny_hosts.rules
[Change] reformated sysctl.conf; added GEN_SYSCTL & HARDEN_SYSCTL to conf.apf
[Change] revised high port connection fixes
[New] dynamic discovery of local resolv.conf nameservers/specific dns rules
      to such resolv ip's
[New] added load check/load 12 run-cap; antidos
[Change] removed bandmin execution from cron.daily event; apf already has an
         internal function to execute bandmin on start sequence
[Change] added check-routines to --status for pico, nano and vi as editor

- 0.9.3-2 | Jan 2nd 2004
[Fix] corrected ip mask in private.networks file; 128.66.0.0/8 -> /16
[Fix] attempted fix of certian state connection fixes
[Fix] misplaced '-i $IF' statment in certian rules; results 'lo' if being logged
[Change] enforced log chains against $IF device
[Fix] error in EG_ICMP_TYPES routine; failed to check if EGF is set
[Change] modified default CDPORTS
[Change] more sanity checks added to bd.rules; for smurf style attacks
[Change] trimmed down firewall code, refined rules, removed duplicate rules
[Fix] revised help() output
[Fix] typo in the accepted cli arguments for stop & start
[Change] all references to r-fx.net changed to r-fx.org
[Fix] default drop of ports 137-139 set to tcp & udp (was only tcp by mistake)
[Change] renamed addons/ folder to extras/
[Change] added a bit more error checking to install script
[Change] exported bulk of operations to functions in 'internals/functions.apf'
[Change] removed unroutable net filtering rules; replaced with a more intuitive
	 stand-in that has conf.apf options for mcast,private net, & reserved
[Change] refined the cports code; exported to 'internals/cports.common'
[New] reimplamented ICMP rate limiting; ICMP_LIM; conf.apf
[New] IG/EG_ICMP_TYPES; similar to CPORTS only accepts ICMP types (0-255)
[New] IG/EG_* options can now be defined in individual vnet rules
[New] filter style for TCP/UDP packet filtering; TCP_STOP, UDP_STOP; conf.apf
[New] added RESET/PROHIBIT chains
[Change] log format revised; syslog style, eout() function created
[Change] revised all rules to make use of applicable TCP/UDP_STOP filter vars
[Change] revised all log output for use with eout()
[Change] comments added to default vnet rule files
[Change] revised invalid packet flag filters, bt.rules
[Change] CDPORTS var added to drop/ignore logging of common ports (e.g: netbios)
[Fix] corrected a few logic errors with flow control on trust rules syntax
[Change] chopped down some of the comments in conf.apf and changed layout of file
[Change] changed martian sources to on & ecn to off; sysctl.rules
[Change] revised flush routine for init script and apf handler
[Change] removed vnet.common; set vnet system to use 'internals/cports.common'
[Change] revised antidos IPT_BL routine; use eout() for apf logging
[Change] revised preroute.rules; changed TOS values for highports
[Change] revised preroute.rules; removed qdisk routines
[Change] added more module error checking
[Change] revised antidos logging format; syslog style

- 0.9.2-10 | Dec 15th 2003
[Change] added tcp port 43 to default EG_TCP_CPORTS options for whois
[Fix]: removed default drop rules for the following three 8-bit ipv4 blocks
060/8   Apr 03   APNIC                               (whois.apnic.net)
221/8   Jul 02   APNIC                               (whois.apnic.net)
222/8   Feb 03   APNIC                               (whois.apnic.net)
[Fix] deprecated TCP_CPORTS option in ident routine
[Change] exported trust routines to internals/trust.common
[Change] moved main.common file to internals/ path
[Change] moved internals.conf to internals/ path
[Change] modified TOS vals for highport connections
[Change] reverted rev:14 ACK,PSH+established fix to as-was in rev:13 
[Change] packaging format changed to name-version_revision.extention
[Change] changed all copyright & licensing headers; changed cli output headers
[Change] changed cli flag assignment/usage for apf handler script
[New] added -a/-d options to apf handler script for trust rules insertion
[Change] changed antidos to insert ban rules rather than reload whole firewall
[Change] reordered highport connection fix routines
[Change] removed deprecated option $STOP
[New] added INVALID output filtering for icmp
[Change] modified dns(53) tcp output fixes
[Change] modified main firewall script; remove '-t filter' usage
[New] added more generalized (laxed?) est/rel connection fixes
[Change] comment modifications to trust files
[Change] exported more vars from conf.apf to internals.conf; smaller conf file
[Change] comment modifications to conf.apf
[New] range support added to trust rule system; underscore seperator (137_139)
[New] added default drop of ports 137-139 to deny_hosts.rules
[Change] modified install script; old install copied to /etc/apf.bkMMDDYY-UTIME
         rather than old format of /etc/apf.bk$$
[Change] removed deprecated option FWRST; antidos

- 0.9.2-8 | Nov 13th  2003
[Fix] corrected packet flag sanity checks; ACK,PSH+established issues
[Change] set sysctl hook for martian sources to zero (0) value default (off)
[Change] set use of reset chain for certian protocol abuses; as opposed to drop
[Change] revised log chain routines; more descriptive prefixes
[Fix] added egress log chain for default drops
[Change] revised chain pattern file for antidos; conform to new prefixes
[Change] rewrite to log chain routines; code cleanup
[Fix] added PATH definition to vnetgen; fix file not found errors
[Fix] made ipt_state & ipt_multiport required modules; fix lockup on init
[Fix] modified routines to reload apf [if new bans] after ad() func.; antidos
[Change] resorted configuration files setup to be more friendly
[Change] more syn-flood routine changes and again tweaked default values
[Change] README.antidos definition changes for conf.antidos vars
[New] added syn-flood trigger ports option; antidos
[Fix] revised syn-flood routine to prevent false positives; antidos
[Change] revised config defaults; antidos

- 0.9.2-4 | Sep 6th 2003
[Fix] DET_SF error setting val SRC; antidos
[Fix] usr.msg syntax error; antidos
[Change] revised config defaults, comments and ordering; antidos
[Fix] DET_SF error setting DST; antidos
[Fix] line-break errors in usr/arin.msg
[Change] permissions enforced on new files from last few releases
[New] syn-flood detection routine created; antidos
[Change] defaults changed in conf.antidos and new syn-flood options added; antidos
[Change] revised README.antidos to reflext new options and config vars
[Change] removed apf-m dialog menu system; implamentation will be made in 0.9.2 or later
[Fix] revised validation routine to prevent duplicate emails; antidos
[New] APF-M v0.2; apf-manager is a dialog menu based manager for APF; addon
[Change] revised install script to detect ncurses and install apf-m
[Change] reordered bt.rules and purged duplicate entries
[New] added crafted drop chains to bt.rules to further slow/hinder nmap
[Fix] permissions issue with install script for addon package apf-m
[Fix] syntax error in rewrite routine for edit_apf.menu; apf-m
[Fix] port zero drop chain - invalid flow order
[Fix] outbound highport routine; syntax error
[New] outbound udp dns routine
[Fix] /tmp temp file creation cleanup fix for dshield block.txt parsing
[Fix] corrected vnet common ports insertion; error prevented proper completion
[Change] increased firewall init logging
[Fix] added EGF value check before EG_*_CPORTS is loaded
[Change] reordered certian init logging events
[Change] various modifications to dshield parser client & install script
[Fix] corrected VNET var issue in vnet.common
[Change] revised apf.init to log stop sequences

- 0.9.1 | Aug 14th 2003:
[New] 'addons/' directory added to apf base path
[New] dshield client parser/reporter with install script placed in addons/ path
[Change] modified README file to conform with new conf.apf options 
[New] toggle for egress filtering in conf.apf
[Change] modified main.common structure to conform with new CPORTS setup
[Change] more commenting changes to conf.apf for new CPORTS setup
[Change] egress specific highport fixes added
[Change] modified CPORTS structure and conf.apf ordering of cports
[Change] modified highport connection fixes to conform with new CPORTS setup
[New] egress (outbound) filtering & common ports option added
[New] LRATE var added to conf.apf for log rate limiting
[New] added monolithic kernel toggle to conf.apf for disabling lkm checks
[Change] modified default ignore ports; antidos
[Change] modified attack IP/8 comparison to /16; antidos
[Fix] bcast syntax error in main firewall script
[Change] increased drop chain log limit
[Change] reordered bt.rules entries
[Change] modified default trust syntax to set bidirectional rules
[Change] modified high port connection fixes for UDP
[Change] modified log prefix strings in bt.rules; conform to apf log style
[Fix] corrected tcp flag sanity check to be bidirectional
[Change] modified README file to further explain rules setup

- 0.9 | Aug 1st 2003:
[Change] export udp/tcp.rules to central main.rules
[Change] exported CPORTS routine for main adapter to main.common
[New] added logrotate.d check routine/rotate script for apf log files
[New] added fragmented udp drop for input/output
[Change] modified app. name output to log files
[New] added port zero drop routine for input/output
[New] added version/revision tagging to /etc/apf/VERSION
[New] added vnetgen execution after install completion
[Change] modified README feature list
[Fix] CPORTS load routine, syntax error in tcp.rules
[Change] exported CPORTS routine for vnet rules to vnet.common
[Change] modified default vnet template
[Fix] more tweaks to established ftp check in LP_SNORT; antidos
[Change] text formating changes to usr.msg/arin.msg; antidos
[Change] removed IPTSNORT feature; modified all relivent files
[Change] removed ICMP/FTP packet rate limiting; modified all relivent files
[Change] modified default udp/tcp drop log prefix
[Change] modified default apf cmdline output; more verbose
[Change] tweaks to the ident reject chain
[Fix] tcp high port connection fixes
[Change] modified noncrit.ports default values; antidos
[Change] modified arin.msg to note 'whois' server in dynamic fashion; antidos
[Fix] usr.msg/arin.msg log tail showing null output in some situations; antidos
[Change] modified usr.msg to note whois contact for src attack host; antidos

- 0.8.7 | Jul 26th 2003:
[Fix] fixed ml() in main firewall script to properly exit on failed module loads
[Change] added comments to conf.apf and README regarding ipt_string.o module
[Fix] fixed stdout redirect for trust files to log file
[Change] removed stdout null output redirect for init script; show fatal errors
[Change] exported misc. conf.apf vars to internals.conf
[Fix] fixed ident check routine
[Change] revised dshield url parser routine
[New] added best-match ip whois for ARIN,RIPE,APNIC, & LACNIC to antidos script
[Fix] modified $PREV var placment in antidos to fix looped ip checks
[Change] moved certian temp file creation from /tmp to install path
[New] added src ip/8 comparison to antidos; filter same network attacks quicker
[Fix] DROP_IF function in antidos not ignoring eth0
[Change] modified logging rate limit from 10/minute to 25 for TCP/UDP DROP 
[New] noncrit.ports file to ignore IF drops based on destination port; antidos
[New] src port/dst port loging for antidos events log
[Fix] dropped interface log event not being sent with usr email; antidos
[Fix] ignore FTP (pasv.) false positives for snort portscan log; antidos
[New] ROUTE_REJ ignore routine if SRC attacker equals eth0 IP
[New] config var for tcp/udp drop log chain toggling
[Fix] suppresed main.vnet error output if no aliased ip's found
[Fix] corrected source include path for main.vnet dynamic entries

- 0.8.6 | Jun 20th 2003:
[Change] revised vnetgen.def and main.vnet
[Change] removed routable network from default drop routes
[Change] trust files revised, new syntax support for proto,flow,port,ip
[New] ident check routine/reject chain
[Change] moved CPORTS inclusions to bottom of respective files
[Change] hourly restart cronjob of APF, set/moved to daily
[Change] range support added for CPORTS and trust syntax
[Fix] added missing escape to log var in vnetgen.def
[Change] revised scipt header notes
[New] added check routine for bandmin/load badmin ipt rules
[Change] revised dns UDP fix in udp.rules

- 0.8.5 | Jun 4th 2003:
[New] added default TCP log chain
[Change] updated chains table for antidos
[Change] added common irc proxy probed ports to antidos ignore file
[Fix] fixed FWRST var in conf.antidos
[New] set sysctl parm to double ip_conntrack_max
[New] created user alert feature; seperated from arin alert
[Change] revised arin.msg file; created usr.msg file
[Change] added TMZ var to conf.antidos for GMT offset
[Change] revised conf.antidos
[New] set global ports to log during loading - for user debuging
[New] set interface/ip to log during loading - for user debuging
[Change] modified dshield.org block list feature; cleaner code
[Change] rewrite of README file; moved GPL to COPYING.GPL
[Change] rewrite of SRC/DST fetch function in antidos for snort/klog method
[New] added hardset $PATH var too apf, firewall, & antidos scripts
[Fix] fixed location reference to apf config file in antidos config file
[Change] revised install.sh file
[Fix] fixed log creation vars
[Change] changed drop_hosts.rules to deny_hosts.rules

- 0.8.4 | May 27th 2003:
[Change] moved default policy for udp to bottom of main firewall script
[Change] removed header comments from vnetgen.def
[New] added ipt_string.o verification check before loading iptsnort rules
[Fix] fixed iptsnort and looping issues; causing init start to never complete
[Change] revised whole iptsnort system; now logs chains before drop
[Fix] added ipt_limit.o verfication for ftp port; otherwise default no ipt_limit
[Fix] corrected typo in DEVM cronjob
[Fix] revised DEVM feature to write directly to crontab; cron.d proved unreliable
[Change] revised install.sh

- 0.8.3 | May 20th 2003:
[New] added prelog.rules file; for addition of log chains
[Fix] fixed preroute.rules and invalid APF log pointer
[Change] disabled ICMP type 8, inbound; by default
[Change] set all ports closed by default; 22 (SSH) left open (globally) in conf.apf
[New] added ipchains check/removal code
[Change] rewrote iptables module insertion code
[Fix] fixed CPORTS option relating to FTP_LIM value
[Change] made install.sh backup old APF install to /etc/apf.bk$$
[Change] comments modified/changed in variouse files
[Change] moved icmp.rules insertion after vnet rules insertion
[Fix] fixed typo in global ports code that caused undesired results
[Change] revised conf.apf; more comments and better organized
[New] created DEVM setting to put APF into devel testing mode
[Change] revised README, and install.sh to meet needs of DEVM feature
[Fix] fixed cleanup issue with ds_hosts.rules file

- 0.8.2 | May 2nd 2003:
[Change] revised vnet system
[Change] made TCP_CPORTS/UDP_CPORTS into for loop; 15+ ports support
[Change] revised conf.apf
[Change] variouse tweaks to snort string match signatures
[Change] variouse tweaks to iptsnort structure
[Change] readme file changes
[Change] revised install.sh

- 0.8.1 | Apr 12th 2003:
[Fix] fixed issues with vnetgen and the adapter variable
[Change] changed cron.hourly job to use the init script
[Change] reimplamented antidos system with snort portscan.log support
[Fix] fixed argument order for ad() function
[Change] readme file changes
[Fix] changed colum location for src/dst address in kernel log [antidos]
[Fix] permissions tightened on all files per default install
[New] added rate limiting per/second on ICMP/FTP protocols, configurable via conf.apf
[New] added iptables based rules for snort signatures; using string match rules
[Fix] removed errored private network ban in main firewall script; was banning valid networks

- 0.8 | Mar 10th 2003:
[New] first public release of APF, formerly known as FWMGR