# Firewall Builder Release Notes

## Version 1.0.8

GUI and compilers v1.0.8 require API library libfwbuilder version 0.10.12

## Summary

This is bug fix release.

For those who wish to build from source, instructions are outlined in the document "Install and Build instructions" on our web site here

## What's new

- Improvements in the GUI:

  - The title bar in the policy and NAT view stays in place while rules are being scrolled up or down.
  - The GUI can show object icons in the tree (this feature can be turned on and off in the main Options dialog, under "GUI/Tree View")
  - Few more rules have been added to the "Help me build policy druid":

    - SSH access to the firewall
    - DNS queries made by the firewall
    - DNS access from internal LAN to the firewall
    - DHCP access from internal LAN to the firewall
  - Feature request #611604 has been implemented: Added main menu item "Open Recent" which shows a submenu with 4 recently opened file names.
- Improvements in policy compiler for iptables:

  - Support for TCP flag masks implemented in the API and the GUI. We can now generate rules that inspect only certain subset of TCP flags (e.g. can inspect all flags and match if none set). This is supported in iptables, ipf and pf.
  - Feature request #579374 has been implemented: Compiler can now add blocks of virtual addresses to provide support for one-to-one translations that map the whole networks (rules with target NETMAP).
- Improvements in policy compiler for ipfiler:

  - Feature request #633534: Ipf Proxies. Support for h323 and ipsec proxies has been added in ipfilter 'map' NAT rules. Compiler generates code for proxies only when OSrv object used in the rule matches port number and protocol of the respective proxy.
  - Feature request #557042: ipf isims. Ipfilter rules are now installed in "inactive" filter and filters are immediately swapped with "ipf -s". Firewall admin can quickly revert to that "last known good" policy by doing "ipf -s".
  - Feature request #604840: support for round-robin rules has been added. Rules with multiple objects (or a group) in "Translated destination" generate code for simple round-robin based load balancing using keyword "round-robin".
  - added support for NONAT rules in ipfilter per information from ipfilter mailing list as reported by lupe@lupe-christoph.de (Lupe Christoph): using "0/0" on the right side of the "map" rule makes it do no translation. I could not verify this actually works that way, but ipnat accepts this syntax.
  - feature request #653803: flags for TCP keep state has been implemented. See http://false.net/ipfilter/2002_12/0176.html

- Improvements in policy compilers for all platforms:

  - New sanity check for policy rules implemented in API and all policy compilers: now compilers can find and eliminate groups that have no elements. Before, compilers treated these groups as 'any' which had obvious security risk. In the current implementation compiler treats empty group as a fatal error and aborts processing. Activating checkbox "Ignore empty groups" (available in the "Firewall" tab for all platforms) changes this behaviour and makes compiler remove empty groups from rule elements, but if rule element becomes empty after the last empty group has been removed, then the whole rule is ignored. The default state for this checkbox is off, that is empty gorups are treated as an error. Sometimes firewall administrator may want to use a group to control access to or from a bunch of computers because it is easy to quickly add or remove them in a group (and therefore in certain rules where this group is used). It may be desired to ignore the whole rule that uses this group if all computers have been removed from the group.

- New components:

  - General object lookup tool 'fwblookup' has been added to the distribution. This tool can be used in scripts that need to find and inspect objects in the database, for example firewall policy install sctipt could use this tool to find the firewall and identify its management address.
  - Install script fwb_install is now part of the package and is installed in /usr/local/bin/ or /usr/bin (depends on the parameter --prefix given to autogen.sh). This script has been fixed and now uses object lookup tool fwblookup, so it does not directly depend on XML DTD anymore (since it works though API). This script has been contributed by David Gullasch and its original version was distributed via "Contrib" area of our SourceForge site. See inside the script for David's contact info.
  - GUI now includes all dialogs for all platforms, including Cisco PIX. Packages fwbuilder-ipt, fwbuilder-pf, fwbuilder-ipf and fwbuilder-pix contain only policy compilers for respective platforms.

## Bugs fixed in libfwbuilder API:

- bug #635849: old and annoying problem where GUI detected non-existent change in the data tree once the user opened firewall object or any of the policy objects (InterfacePolicy, Policy or NAT). It then asked if the user wants to save the data before exiting the GUI.
- bug #637694: bridge enabled / management. Background: if firewall object is used in destination of the rule of the bridging firewall, chain needs to be still INPUT.
- bug #642161: problem with NAT rules that translate port numbers but do not change addresses.

## Bugs fixed in GUI:

- bug #635844: GUI crash while dragging a rule near the bottom of the ruleset when ruleset is large and the widget has been scrolled to show the last rule.
- bug #636279: Save As behavior seems wrong (main window did not update title when user saved data in a different file using Save As main menu item)
- bug #637858: Bad Behavior on Firewall Interface object (the GUI sometimes did not properly update object's label in the tree)
- bug #635849: old and annoying problem where GUI detected non-existent change in the data tree once the user opened firewall object or any of the policy objects (InterfacePolicy, Policy or NAT). It then asked if the user wants to save the data before exiting the GUI.
- bug #640481: Typo in Help Me Build wizard
- bug #642873: no way to block null scans (added support for TCP flag masks to libfwbuilder::TCPService and to the GUI).
- bug #641217: print HTML buglet (while printing rules with multi-line comments, '\n' in comments should be replaced with tag
  )

## Bugs fixed in iptables policy compiler fwb_ipt:

- bug #637488: compiler chose wrong chain for rules where interface with multiple addresses was used in Src or Dst
- bug #634275: iptables modules loaded with -k
- bug #633211: rule shading when firewall is not part of 'any' - when option "firewall is part of any" is OFF, object "Any" does not shade firewall
- bug #637694 - bridge enbaled / management. Compiler can now put rules with broadcast/multicast into FORWARD chain, but still recognizes rules controlling access to the firewall itself and puts those in INPUT chain.
- bug #636497: MAC address compile mistake. (Problem happened in rules with MAC address filtering and no destination, or fw object in destination).
- bug #634825: problem with dynamic external interface in MASQ NAT rule
- bug #642161: problem with NAT rules that translate port numbers but do not change addresses.
- bug #644138: 1.0.7 NAT mis-compiles rules (problem with rules that do only port translation, this bug is similar to #642161, but there is a difference: rule mentioned in this bug should generate iptables command with target REDIRECT)
- bug #636497: MAC address compile mistake (there was space missing between --mac-source and --source-port in rules that used TCP/UDP service with non-empty source port definition)
- bug #644684: REDIRECT instead of DNAT (now we consider rule REDIRECt only if TDst is firewall, in all other cases we generate DNAT rule.)
- bug #645553: NAT rules assigned to wrong interface (when firewall's external and dmz interfaces are on overlapping subnets and NAT rule uses negation)
- bug (no number) : option "Accept TCP sessions opened prior to firewall restart" should not depend on "assume firewall is part of any". Even if the former option is OFF, with this fix compiler generates code to block TCP packets in state NEW and no SYN flag headed both for firewall and machines behind it.