                         Firewall Builder Release Notes

  Version 0.9.6

   For the first time in this release the code has been split into three
   major parts: general API, GUI and compilers. Having base classes in a
   separate API library helps us maintain cleaner code and will simplify
   development of policy compilers for different firewall platforms.

   This release also fixes bugs reported during testing of Firewall Builder
   v0.9.5

  What's new in this release:

     * Internal code reorganization has been done. Base classes have been
       moved to a separate API library. Note that API library has its own
       version number which is differnet from that of fwbuilder. If you use
       pre-built binary packages, please make sure you download and install
       three packages:

          * libfwbuilder
          * fwbuilder
          * fwbuilder-iptables

       Those who want to compile from source will need to download and unpack
       two tar.gz archives: libfwbuilder-0.10.0.tar.gz and
       fwbuilder-0.9.6.tar.gz. Each package needs to be compiled and
       installed separately using standard procedure "./configure; make; make
       install"

     * Firewall Builder Tutorial has been published on the web site. See it
       here
     * GUI now features "Find" function which provides a way to quickly find
       and open an object by its name and type.
     * Per feature request #427061, GUI now can show properties of objects in
       the tree view. The properties display can be turned on and off in the
       global Options dialog
     * Objects in the tree are now separated onto two groups: objects created
       by user and standard objects coming with Firewall Builder. These two
       groups appear in two separate trees.
     * GUI has been tested on systems with different screen size and
       resolution, different standard font sizes and different GTK themes.
       Many dialogs have been corrected
     * Few obscure bugs were fixed in GUI, where user could accidentally move
       object in unusual place in the tree using Copy/Paste mechanism
     * "Host OS" option is now supported for Firewall objects. Depending on
       chosen host OS, user can set various kernel options and parameters in
       the "Network" dialog tab. Policy compiler includes appropriate code
       for the target OS at the beginning of the firewall script.
     * Changes to network discovery algorithm:
          * Option controlling whether crawler will cross point-to-point
            links added
          * Algorithm which detects virtual addresses has been improved
          * Crawler now correctly detects interfaces which are in
            "administratively down" state
          * Minor adjustments in the "Objects Discovery" Druid
     * New parameters added to iptables options list:
          * Option "load modules" is back in iptables options in the firewall
            dialog. Our testing showed that some iptables modules do not get
            loaded automatically by the kernel and require manual pre-load.
            Checking this option on will cause policy compiler to generate
            code loading modules "ip_conntrack_ftp", "ip_nat_ftp".
          * "Accept established TCP sessions after firewall restart" provides
            a way to control whether TCP packets never seen by the firewall
            before and missing SYN flag would be accepted. This option is ON
            by default, meaning that the firewall would accept TCP sessions
            established before firewall restart.
          * Now user can set PATH environment variable in the script
            generated by Firewall Builder. This may be useful in environments
            where iptables is installed in non-standard directory.
     * Changes to policy compiler for iptables:
          * support has been added for the new options mentioned above
          * iptables policy compiler code which generates commands to add ARP
            entries for static NAT has been improved. Now it adds ARP entries
            for both SNAT and DNAT translations using "other" IP addresses
          * iptables compiler now does not add spaces to the custom log
            prefix. Spaces in the log prefix break iptables-save /
            iptables-restore
          * General info is now added on top of the generate sctipt in the
            form of shell comment. The info includes warning saying that the
            script is automatically generated and should not be modified by
            hand, timestamp, user name of user who ran the program and
            version of Firewall Builder used

  Bugs fixed in iptables compiler:

     * #448693 and #453966: setting rule options did not make any difference
       in iptables code produced by policy compiler. In particular, setting
       limit on rule did not work
     * #449638 and #452070: port mapping did not work in iptables
     * #464628: incorrect handling of negations in NAT rules

  Bugs fixed in GUI:

     * #449133: GUI used to hang if very long word was entered in the comment
       field in the policy rule
     * #454812: GUI allowed duplicates in policy rules elements
     * fixed bug where incorrect manipulation of clipping rectangles in
       policy item widget caused strange effects to happen with other GUI
       widgets under some GTK themes

  Known issues in this release

     * Checkbox "Turn off stateful inspection for this rule" in the rule
       options dialog in fact only turns of detection of "NEW" sessions.
       Module ip_conntrack, if loaded, will keep track of state anyway and
       rule matching "ESTABLISHED,RELATED" sessions will match regardless of
       the state of this checkbox. We are working on this issue and expect to
       fix it in the next release.
