Version 0.9.1: (2005-11-10)
===========================
o Bugfixes
    + fixed bug in netdev helper
    + fixed gcc 3.4 and 4.0 compile errors and warnings
    + fixed compatibility to some iptables matches (e.g. physdev)


Version 0.9.0: (2005-26-09)
===========================
o New Features
    + ported everything to Linux kernel 2.6
    + kernel patch is now fairly non-intrusive: it only adds one simple
      function to ip_tables.c. The rest of the patch introduces new files
      to the kernel.
    + added support for SINGLE PATH lookup
    + using RCU: no locking during lookup required anymore
    + improved lookup performance, less overhead
    + removed support for counters
    + increased number of possible dimensions from 16 to 32
    + added support for hotdrop in extractor functions and hipac_match
    + added support for iptables 1.2.x and 1.3.x
    + added iptables match and target revision support
    + added native support for state UNTRACKED
    + added native support for ESTABLISHED,RELATED match
    + allow ranges in protocol dimension
    + changed semantic of parse_native_protocol:
      protocol definitions involving 0 now allowed
    + lots of changes to the nf-hipac user space tool in order to increase
      compatibility with iptables extensions (iptables matches and targets)
  
o Bugfixes
    + fixed delete-by-rule for rules which contain a chain target
    + fixed delete-by-rule for rules which contain an iptables target
    + fixed delete of user-defined chains
    + rules containing a state match were not rejected if the kernel fails to
      load the nf-HiPAC connection tracking helper module
    + fixed memory leaks in nf-hipac user space tool
    + fixed bug that triggered kernel warnings during module removal
    + fixed bug that triggered spinlock context warnings during rule listings
    + fixed rule listing deadlock
    + fixed bug that caused the HiPAC core to fail whenever allocs were made
      that were not of size pow of 2. This bug caused panics on Linux 2.6,
      but never appeared on 2.4.

o Details about changes in the HiPAC algorithm core:
    + replaced btree implementation with better rlp implementation:
	- based on static binary search
	- enables arbitrary number of wildcard dimensions
	- removed support for BIT_U8 dimensions
    + directly return defined netfilter targets from hipac_match

o Details about changes in the nf-HiPAC kernel module:
    + required changes for Linux kernel 2.6, e.g.:
	- module refcounting
        - extractor functions
	- iptables matches and targets support:
	  switching to ipt_find_target and ipt_find_match
	- netlink and socket changes
	- new kbuild language
    + added support for non-linear skbs
    + accept incomplete local ip packets
    + removed skb_ok function: checks now incorporated into extractor functions
    + complete reimplemention of netdev helper:
	- using netdev notifier
	- not based on veto functionality
	  => patches to dev.c and netdevice.h not required anymore
	- no locking required during lookup
    + rewrote parts of netlink based kernel <-> user space communication:
        - using existing netlink_dump_* functions instead of patching the kernel
        - removed struct nfhp_err
	- removed 128KB allocs for skbs in kernel and user space
    + changed netlink proto number from 7 to 26
    + added kernel thread to process the netlink messages and rule updates
    + replaced nf_change_prio_hook with nf_register_hook and nf_unregister_hook
      in order to avoid kernel patch
    + changed default invocation order at netfilter hooks:
      nf-HiPAC is now called before iptables
    + merged TCP_SPORT, TCP_DPORT and UDP_SPORT, UDP_DPORT into SPORT and DPORT
    + changed BIT_U8 to BIT_U16 dimensions in order to get rid of 8 bit support
    + moved state dimension to first dimension
    + moved fragment dimension below proto dimension
    + renamed tcp_flags: now called syn dimension
    + make sure that only the source and destination ip dimensions are wildcard
      dimensions. This allows the use of additional non-wildcard 32-bit
      dimensions.
    + removed superfluous connection tracking configure option


Version 0.8: (2003-06-25)
=========================
o General Changes
    + major rewrite of most of the code

o New Features
    + optimized kernel-user protocol (netlink): improved rule listing speed
    + libnfhipac: netlink library for kernel-user communication
    + native match support for:
        - fragment
    + generic support for iptables targets and matches (binary compatibility)
    + integration into the netfilter connection tracking facility
    + user-defined chains support
    + 64 bit atomic counters
    + kernel module autoloading
    + /proc/net/nf-hipac/info:
        - general information
	    # cat /proc/net/nf-hipac/info
        - dynamically limit the maximum memory usage
	    # echo <size in MB> > /proc/net/nf-hipac/info
        - nf-hipac invoked before iptables:
            # echo nf-hipac-first > /proc/net/nf-hipac/info
        - iptables invoked before nf-hipac:
            # echo iptables-first > /proc/net/nf-hipac/info
    + extended statistics via /proc/net/nf-hipac/statistics/*:
        - general memory statistics:
            # cat /proc/net/nf-hipac/statistics/mem
        - btree statistics (per hook):
            # cat /proc/net/nf-hipac/statistics/btree_{input,forward,output}
        - dimtree statistics (per hook):
            # cat /proc/net/nf-hipac/statistics/dimtree_{input,forward,output}
        - hipac rule statistics (per hook):
            # cat /proc/net/nf-hipac/statistics/hipac_rules_{input,forward,output}
        - hipac chain statistics:
            # cat /proc/net/nf-hipac/statistics/hipac_chains

o Bugfixes
    + check for invalid tcp/udp/icmp headers added
    + proto match did not work for fragmented packets; this has been fixed


Version 0.1a: (2002-12-30)
==========================
o Bugfixes
    + get_tcp_flags fixed (--syn and --not-syn now work properly)
    + minor bug in hipac statistics struct fixed:
      btree_type_stats_u16[] and btree_type_stats_u8[] are now __u32


Version 0.1: (2002-12-08)
=========================
o New Features
    + support for 64 bit architectures: nf-hipac should now work on all
      architectures supported by the Linux kernel
    + dynamically change invocation order of iptables and nf-hipac via
      /proc/net/nf-hipac without losing your rules:
        - nf-hipac invoked before iptables:
            # echo nfhp_first > /proc/net/nf-hipac
        - iptables invoked before nf-hipac:
            # echo ipt_first > /proc/net/nf-hipac
    + support for negation (!) in matches
    + autoloading of the kernel module nf_hipac.o
    + install and uninstall target added to Makefile

o Bugfixes
    + output of /proc/net/nf-hipac can be larger than 4K
    + interface matching code: now you can match arbitrary interfaces,
      existing or non-existing ones, unload and reload the device driver
      and rename your interfaces as you like without breaking the match
    + rules containing dns names expand to multiple rules containing all ips
      that resolve to the dns name; if source and destination ip is a dns
      name all combinations of ips are present in the expanded rule set
    + catch-all matches aren't submitted to the kernel anymore
    + rudimentary in-kernel sanity checks of submitted rules


Version 0.0.2: (2002-09-04)
===========================
o New Features
    + /proc/net/nf-hipac added:
        - algorithm statistics available via
            # cat /proc/net/nf-hipac
        - allows to dynamically limit the maximum memory usage
            # echo <size in MB> > /proc/net/nf-hipac

o Bugfixes
    + icmp type match fixed
    + added correct memory handling
    + moved netlink protocol number from NETLINK_FIREWALL to 6
    + fixed 16 bit matches for btrees with more than 2944 elements


Version 0.0.1: (2002-08-24)
===========================
o First public release
