                         Firewall Builder Release Notes

Version 1.0.4

   GUI v1.0.4 requires API library libfwbuilder version 0.10.8

Summary

   The main goal of this release is to incorporate fixes for bugs discovered
   in the GUI and in the new policy compiler for iptables (fwb_ipt). It also
   includes internationalization support with French, German and Russian
   translations.

   Procedure for building from source has changed starting from this version!
   Now you should run script autogen.sh instead of configure in both
   libfwbuilder and fwbuilder. This script regenerates aclocal.m4 and
   configure using OS-specific macros and takes the same arguments as
   configure.

What is new in the GUI

     * GNU gettext support. French and German translations. Minimal Russian
       translation.
     * all platform-specific dialogs now packaged as part of the modules
       providing support for particular firewall. The GUI itself is
       independent. Dialogs are compiled and linked as dynamically loaded
       modules (using dlopen/dlsym).
     * Added support for target platform capabilities. Now certain elements
       in the GUI can be enabled or disabled depending on whether target
       platform supports feature they control.
     * improved scrolling in object tree widget: now tree can be scrolled up
       and down, while its title bar stays in place.

     ----------------------------------------------------------------------

Bugs fixed in libfwbuilder API:

     * bugs #571990 and #573038 - AddressRange overrun for ranges that end
       with IP address ending with 255
     * bug #580027: Firewall::duplicate replaces references to the old
       firewall with references to the new one in policy and NAT rules

     ----------------------------------------------------------------------

Bugs fixed in GUI:

     * bug #573985 (could not change interface attributes in Host object
       dialog)
     * bug #582271: fwbuilder goes postal when compiling. Added usleep(100)
       into idle event handler so that GUI won't consume lots of CPU time
       while serving output of background process

Bugs fixed in iptables policy compiler fwb_ipt:

     * bug #572848: new chain created in inappropriate table in iptables
       script generated for NAT rules with negation
     * bugs #570694, #572847 : problems in NAT & transparent proxy rules.
     * bug #572746: fwb_ipt: rule option confusion. This bug addressed
       several issues: 1) limit_value and limit_burst are applied to the
       logging option. In fwb_iptables they are applied to the actual action
       (eg accept) as the dialog text indicates.2) the output of limit_burst
       is missing a space: --limit-burst0 3) tcp-rst option on reject does
       not work. The compiler forgets to output --reject-with tcp-reset.
       fwb_iptables works ok. 4) The single rule created on the loopback
       interface by the druid (permit all protocols on loopback) does not
       work. I changed this to two rules as produced by older versions of the
       druid, this works. (this problem may already be reported)
     * bugs #571824 and #571524 : compiler used to create rule in FORWARD
       chain with missing interface specification for interface policy rules
     * bug #574836 (useless state NEW w/ ESTABLISHED,RELATED in fwb_ipt)
     * bug #575492 - compiler erroneously combined single ports and port
       ranges in NAT rules using multiport.
     * bug #576598 (user reported a problem with configuration where DNAT
       translation was provided using IP addresses on DMZ (interface eth3,
       routable IP), but connection was actually coming from outside.
       Compiler used to add "-i eth3" to the generated code which broke his
       DNAT rule because packets were actually entering firewall through
       different interface.
     * bug #575674 - compiler added "limit" option to all generated iptables
       rules instead of adding it to only LOG and ACCEPT/DROP/REJECT rules.
     * bug #577060: compiler used to add word "inet" to every rule in
       ipf.conf file. This bug was introduced when I fixed bug #569942.
     * bug #574106: added script autogen.sh - this script regenerates all
       critical scripts and config files (aclocal.m4, ltmain.sh and ltconfig,
       configure etc) using aclocal, automake and libtool. This needs to be
       done to properly build on different platforms.
     * bug #578162: Invalid syntax on REJECT w/tcp-rst. Compiler now issues
       warning and clears action-on-reject flag if reject with TCP RST is
       ordered on the rule with non-TCP services
     * bug #581814: fwb_ipt incorrectly combines objects with source port or
       source port range with objects with destination port or port range in
       NAT rules using multiport.
     * bug #580937: Log without prefix. fwb_ipt did not include custom log
       prefix in the rule generated for option "Log or dropped packets".
     * Bugs fixed in ipfilter policy compiler (fwb_ipf):

     * bug #580916: added gloabl option to control action on reject for
       fwb_ipf

Bugs fixed in ipfilter policy compiler (fwb_pf):

     * bug #581695: option "modulate state" applies only to TCP service in
       OpenBSD PF.
