# Firewall Builder Release Notes

## Version 1.1.0

Released 11/23/03
GUI and compilers v1.1.0 require API library libfwbuilder version 1.0.2

## Summary

For those who wish to build from source, instructions are outlined in the document "Install and Build instructions" on our web site http://www.fwbuilder.org/archives/cat_installation.html

This version is stable, future changes to v1.1 will be limited and will only include bug fixes.

## What's new

- Improvements in the GUI:

  - Implemented Feature Req. #809106: "Netmask should not be automatically filled in dialogs". Dialogs that expect IP address and netmask should not fill the netmask entry fields with a netmask calculated from the IP address assuming that the address is classful
  - added GUI widgets for new 'fixup' commands in PIX v6.3(3)
  - Added GUI support for the new logging options available in PIX v6.3 (syslog level and logging interval can now be set for an individual ACL rule)
  - added GUI controls for setting syslog device-id (PIX v6.3)
  - added GUI controls for logging in EMBLEM format (PIX v6.3)
  - added GUI controls for using ACL remarks to associate generated PIX ACL commands with original rule numbers
  - commands "sysopt route dnat" and "sysopt security fragguard" are deprecated in PIX v6.3. GUI is now aware of that.
  - added GUI elements to support PIX options "max_conns" and "emb_limit" used for TCP syn flood protection and to establish a limit on the number of nat'ted connections.
- Improvements in policy compiler for iptables:

  - implemented Feature Request #819761 "support new iptables option 'icmp-admin-prohibited'". This option is supported in iptables 1.2.9 in combination with target REJECT.
  - changed algorithm in the rule optimizer to improve policy compile speed. This significantly speeds up compilation of rules that create huge numbers of combinations of objects (typically a rule with large address ranges or large groups of hosts in both source and destination, or large group of hosts in src or dst and large group of services in srv)
  - iptables script generated by policy compiler fwb_ipt can now properly find and load kernel modules for Linux kernel 2.6 (module file names have extension .ko in 2.6)
- Improvements in policy compiler for ipfiler:

  - Optimizaiton in the policy compiler for ipfilter: compile speed improved for rules that generate huge numbers of combinations of objects (many objects in src, dst and/or srv). Number of generated rules changed from N^3 to 3N for rules with very large number of combinations of objects. Compile time has been reduced by the same factor.

- Improvements in policy compilers for all platforms:

  - added check for dynamic interface with IP address child object in all policy compilers.
  - fixed bug #827697: "Configure interfaces adds both the NAT and the local". Option "configure interfaces" used to add virtual addresses that are needed for NAT rules and configure regular interfaces of the firewall. These two functions are now controlled by separate checkboxes in the "Firewall" tab of the firewall object dialog: "Configure interfaces" and "Add virtual addresses for NAT".
  - implemented Feature Request #815168: "Support for IPTables 'IPRange'", however instead of using patch-o-matic patch "iprange" I've implemented an algorithm that converts address range into a set of networks rather than N hosts. This works for all policy compilers (rather than only for iptables) and works even if the patch "iprange" is not applied.

- New components:

  - Added Address Range objects "broadcast" (address 255.255.255.255) and "old-broadcast" (address 0.0.0.0) to the standard objects tree. These objects are used to build rules permitting broadcast-based protocols such as DHCP.
  - fixed bug #810497: "Add UDP service microsoft-rpc"

## Bugs fixed in libfwbuilder API:

- fixed bug #840427: Problems with libxml2. The GUI won't start if libxml2 v 2.6.2 was installed, the error looked like this:

  I/O warning : failed to load external entity "/resources.xml"

  Function xmlParseFile broke in libxml2 v2.6.2 so I had to switch to xmlParseMemory.

## Bugs fixed in GUI:

- fixed bug #811056: "Preserve tab selection". Active notebook tab is now "sticky" in Firewall and Host dialogs, that is while switching between different firewall objects the new dialog opens with the same tab active.
- fixed bug #810400 : "GUI can not show address 0.0.0.0 in AddressRange obj".
- fixed bug #810000: "Druid creates wrong rule for DHCP". If firewall works as DHCP server for the local net, the rule permitting DHCP requests should include both firewall object and a broadcast address object in destination. This rule uses new standard address range object "broadcast". The rule permitting DHCP replies should use only firewall obejct in source.
- fixed bug #827688: "PIX-Network Zone Def is missing ". Policy compiler complained that interface "outside" had no network zone on a new firewall object, while in fact the Network zone of that interface was set to 'Any'.
- fixed bug #834739: "network discovery creates bogus Policy objects for hosts". Network discovery druid would add Interface Policy objects to interfaces of Host objects discovered during network crawl (SNMP).
- fixed bug #834726: "No physical address (MAC) for dynamic address in wizard." The GUI would not let user add a physical address (MAC address) object to the interface marked as "dynamic" or "unnumbered".

## Bugs fixed in iptables policy compiler fwb_ipt:

- fixed bug 811860: "IPTables Compiler Firewall IP to Input Chain". On a bridging firewall rules not associated with interfaces should go into INPUT/OUTPUT chain on interfaces that do routing and into FORWARD chain on bridging interfaces. Sometimes bridging interfaces are not created in the GUI, so to play it safe we will split the rule and put it into both FORWARD and INPUT/OUTPUT chain.
- fixed bug #834799: "fwb_ipt: Compiler.cc:264 Assertion`o' failed". This error happened if dynamic interface had an IP address child object which was used somewhere in the policy rule. Compiler issued a warning saying that this address was going to be ignored, and removed it from the interface. If this address object was used in the policy rule, it caused this assertion to fail because it had no parent.
- fixed bug #837236: "ipt compiler tries to find wildcard interfaces". Code that checks if interfaces of the firewall object exist on the firewall machine should not try to find wildcard interfaces such as "ppp*".
- fixed bug #828243: "bug with double NAT". A dual translation NAT rule (the one that translates both source and destination addresses) that involves negation in OSrc or ODst used to generate code doing double negation.
- fixed bug #830093 "Don't set custom services in NAT rules". Compiler fwb_ipt would ignore custom service objects in NAT rules.

## Bugs fixed in iptables policy compiler fwb_ipf:

- none

## Bugs fixed in iptables policy compiler fwb_pf:

- fixed bug #822744: "fwb_pf problem". While compiling policy for the firewall running on FreeBSD and using pf, compiler would not define variable PFCTL in the firewall activation script ( the .fw file).