                         Firewall Builder Release Notes

  Version 0.9.7

     ----------------------------------------------------------------------

  What's new in this release:

     * We now support single floppy router/firewall "floppyfw"
       (http://www.zelow.no/floppyfw/index.html) See file README.floppyfw in
       the doc directory for instructions. We provide install script for
       floppyfw, so generated firewall script can be conveniently written to
       floppfw floppy disk just with a few clicks of a mouse. Install script
       and documentation are packed in a separate RPM called
       fwbuilder-floppyfw

     * Changes in data structures.
       The following new attributes have been added to XML DTD:
          * Attribute "label" which provides a way to assign alternative name
            to Interface. This attribute allows for assigning descriptive
            labels to interfaces, such as "inside", "outside", "dmz"
          * Each interface now is has new attribute called "security_level".
            Security level is described by integer number between 0 and 100,
            where 0 represents least secure and 100 most secure one. Some
            firewall platforms (namely Cisco PIX) use this concept. Old flag
            "external" corresponds to security zone "0". Conversion from old
            data format to the new one is transparent and happens
            automatically when data file is loaded in fwbuilder GUI v0.9.7
            for the first time
          * Attribute "physAddress" added to Interface. This attribute
            represents physical address of the interface. For Ethernet this
            is its MAC address

     * New options and features added for iptables:
          * "Clamp MSS to MTU" is supported
          * New macro for custom log prefix: "%I" is replaced with interface
            name
          * code for adding static ARP entries uses /sbin/ip tool. Package
            iproute seems to be a standard in all major Linux distributions
            so this should not be a problem
          * firewall script generated by fwb_iptables turns off ip forwarding
            before removing all rules and turns it on only after all rules
            have been added
          * implemented filtering by MAC addresses (feature request #478087)
          * firewall script makes log record when activated (feature request
            #476517)
          * compiler can now optimize generated script for repeating source
            or destination addresses. It generates special user-defined
            chain, so source or destination address is checked only once in
            INPUT/OUTPUT/FORWARD chains. If there are multiple rules with the
            same source or destination address, all further checks are done
            in dedicated chain
          * compiler can also use "multiport" module to collapse multiple
            script lines together if all parameters are the same and only
            port numbers are different
          * compiler adds implied iptables rule to accept ESTABLISHED and
            RELATED packets only if checkbox in firewall dialog called
            "Accept ESTABLISHED and RELATED packets" is checked. This implied
            rule is always added on top of the policy script and inspects all
            the packets before any other rule defined by user. If this
            behavior is undesired, the checkbox "Accept ESTABLISHED and
            RELATED packets" should be unchecked and rule using service
            "ESTABLISHED" should be added to the policy by hand. This rule
            can be placed in any appropriate place in the policy, so it won't
            match packets matched by rules above it.
          * Predefined standard service called "ESTABLISHED" is now part of
            stadard objects database coming with Firewall Builder. This
            service object is added to existing xml files when file is loaded
            in the GUI v0.9.7 for the first time. This service adds rule
            which matches with ESTABLISHED and RELATED packets, as defined by
            ip_conntrack module

     * New functions and features in GUI:
          * GUI can copy rules between Global and Interface policies and
            between different firewall objects
          * Added basic support for foreighn locales
          * Implemented alternative object quick view method: flying mouse
            over object's icon in the policy can show its properties either
            on status bar or in a tooltip window
          * Object "Host" has new parameter - its MAC address.
          * Dependency on Gnome libraries has been eliminated completely;
            Firewall Builder now needs only GTK and GTK--. This makes it
            possible to port Firewall Builder to other OS, including MS
            Windows. This also should make it lot easier to run it on Linux
            systems with KDE.

  Bugs fixed in iptables compiler:

     * #478444: Implemented workaround for a bug in iptables 1.2.3 which
       caused error when log level was specified by name. Now log level can
       be specified either by name or by number
     * #475155: compiler generated incorrect code for REDIRECT NAT rules with
       negation
     * #476520, #480473: avoid duplicates while adding static arp entries or
       alias addresses for certain NAT rules
     * #480410: optimizer used to remove NAT rules with the same address in
       both source and destination. This caused problems in certain network
       configurations where SNAT rule was necessary to support translation
       for connects from internal net to the server on the same net, using
       its external URL
     * #480658: code optimization can now be turned off for NAT rules
     * #480801: removed memory leak in compiler; tested on policy with lots
       of rules

  Bugs fixed in GUI:

     * #472344: icon for negated service was corrupted
     * #472677: object properties shown in the tree should have changed when
       object has been edited
     * #472678: pop-up menu and object quick view overlap
