                         Firewall Builder Release Notes

Version 1.0.8

   GUI and compilers v1.0.8 require API library libfwbuilder version 0.10.12

Summary

   This is bug fix release.

   For those who wish to build from source, instructions are outlined in the
   document "Install and Build instructions" on our web site here

What's new

     * Improvements in the GUI:

          * The title bar in the policy and NAT view stays in place while
            rules are being scrolled up or down.
          * The GUI can show object icons in the tree (this feature can be
            turned on and off in the main Options dialog, under "GUI/Tree
            View")
          * Few more rules have been added to the "Help me build policy
            druid":

               * SSH access to the firewall
               * DNS queries made by the firewall
               * DNS access from internal LAN to the firewall
               * DHCP access from internal LAN to the firewall
          * Feature request #611604 has been implemented: Added main menu
            item "Open Recent" which shows a submenu with 4 recently opened
            file names.
     * Improvements in policy compiler for iptables:

          * Support for TCP flag masks implemented in the API and the GUI. We
            can now generate rules that inspect only certain subset of TCP
            flags (e.g. can inspect all flags and match if none set). This is
            supported in iptables, ipf and pf.
          * Feature request #579374 has been implemented: Compiler can now
            add blocks of virtual addresses to provide support for one-to-one
            translations that map the whole networks (rules with target
            NETMAP).

     * Improvements in policy compiler for ipfiler:

          * Feature request #633534: Ipf Proxies. Support for h323 and ipsec
            proxies has been added in ipfilter 'map' NAT rules. Compiler
            generates code for proxies only when OSrv object used in the rule
            matches port number and protocol of the respective proxy.
          * Feature request #557042: ipf isims. Ipfilter rules are now
            installed in "inactive" filter and filters are immediately
            swapped with "ipf -s". Firewall admin can quickly revert to that
            "last known good" policy by doing "ipf -s".
          * Feature request #604840: support for round-robin rules has been
            added. Rules with multiple objects (or a group) in "Translated
            destination" generate code for simple round-robin based load
            balancing using keyword "round-robin".
          * added support for NONAT rules in ipfilter per information from
            ipfilter mailing list as reported by lupe@lupe-christoph.de (Lupe
            Christoph): using "0/0" on the right side of the "map" rule makes
            it do no translation. I could not verify this actually works that
            way, but ipnat accepts this syntax.
          * feature request #653803: flags for TCP keep state has been
            implemented. See http://false.net/ipfilter/2002_12/0176.html

     * Improvements in policy compilers for all platforms:

          * New sanity check for policy rules implemented in API and all
            policy compilers: now compilers can find and eliminate groups
            that have no elements. Before, compilers treated these groups as
            'any' which had obvious security risk. In the current
            implementation compiler treats empty group as a fatal error and
            aborts processing. Activating checkbox "Ignore empty groups"
            (available in the "Firewall" tab for all platforms) changes this
            behaviour and makes compiler remove empty groups from rule
            elements, but if rule element becomes empty after the last empty
            group has been removed, then the whole rule is ignored. The
            default state for this checkbox is off, that is empty gorups are
            treated as an error. Sometimes firewall administrator may want to
            use a group to control access to or from a bunch of computers
            because it is easy to quickly add or remove them in a group (and
            therefore in certain rules where this group is used). It may be
            desired to ignore the whole rule that uses this group if all
            computers have been removed from the group.

     * New components:

          * General object lookup tool 'fwblookup' has been added to the
            distribution. This tool can be used in scripts that need to find
            and inspect objects in the database, for example firewall policy
            install sctipt could use this tool to find the firewall and
            identify its management address.
          * Install script fwb_install is now part of the package and is
            installed in /usr/local/bin/ or /usr/bin (depends on the
            parameter --prefix given to autogen.sh). This script has been
            fixed and now uses object lookup tool fwblookup, so it does not
            directly depend on XML DTD anymore (since it works though API).
            This script has been contributed by David Gullasch and its
            original version was distributed via "Contrib" area of our
            SourceForge site. See inside the script for David's contact info.
          * GUI now includes all dialogs for all platforms, including Cisco
            PIX. Packages fwbuilder-ipt, fwbuilder-pf, fwbuilder-ipf and
            fwbuilder-pix contain only policy compilers for respective
            platforms.

     ----------------------------------------------------------------------

Bugs fixed in libfwbuilder API:

     * bug #635849: old and annoying problem where GUI detected non-existent
       change in the data tree once the user opened firewall object or any of
       the policy objects (InterfacePolicy, Policy or NAT). It then asked if
       the user wants to save the data before exiting the GUI.
     * bug #637694: bridge enabled / management. Background: if firewall
       object is used in destination of the rule of the bridging firewall,
       chain needs to be still INPUT.
     * bug #642161: problem with NAT rules that translate port numbers but do
       not change addresses.

Bugs fixed in GUI:

     * bug #635844: GUI crash while dragging a rule near the bottom of the
       ruleset when ruleset is large and the widget has been scrolled to show
       the last rule.
     * bug #636279: Save As behavior seems wrong (main window did not update
       title when user saved data in a different file using Save As main menu
       item)
     * bug #637858: Bad Behavior on Firewall Interface object (the GUI
       sometimes did not properly update object's label in the tree)
     * bug #635849: old and annoying problem where GUI detected non-existent
       change in the data tree once the user opened firewall object or any of
       the policy objects (InterfacePolicy, Policy or NAT). It then asked if
       the user wants to save the data before exiting the GUI.
     * bug #640481: Typo in Help Me Build wizard
     * bug #642873: no way to block null scans (added support for TCP flag
       masks to libfwbuilder::TCPService and to the GUI).
     * bug #641217: print HTML buglet (while printing rules with multi-line
       comments, '\n' in comments should be replaced with tag
       )

Bugs fixed in iptables policy compiler fwb_ipt:

     * bug #637488: compiler chose wrong chain for rules where interface with
       multiple addresses was used in Src or Dst
     * bug #634275: iptables modules loaded with -k
     * bug #633211: rule shading when firewall is not part of 'any' - when
       option "firewall is part of any" is OFF, object "Any" does not shade
       firewall
     * bug #637694 - bridge enbaled / management. Compiler can now put rules
       with broadcast/multicast into FORWARD chain, but still recognizes
       rules controlling access to the firewall itself and puts those in
       INPUT chain.
     * bug #636497: MAC address compile mistake. (Problem happened in rules
       with MAC address filtering and no destination, or fw object in
       destination).
     * bug #634825: problem with dynamic external interface in MASQ NAT rule
     * bug #642161: problem with NAT rules that translate port numbers but do
       not change addresses.
     * bug #644138: 1.0.7 NAT mis-compiles rules (problem with rules that do
       only port translation, this bug is similar to #642161, but there is a
       difference: rule mentioned in this bug should generate iptables
       command with target REDIRECT)
     * bug #636497: MAC address compile mistake (there was space missing
       between --mac-source and --source-port in rules that used TCP/UDP
       service with non-empty source port definition)
     * bug #644684: REDIRECT instead of DNAT (now we consider rule REDIRECt
       only if TDst is firewall, in all other cases we generate DNAT rule.)
     * bug #645553: NAT rules assigned to wrong interface (when firewall's
       external and dmz interfaces are on overlapping subnets and NAT rule
       uses negation)
     * bug (no number) : option "Accept TCP sessions opened prior to firewall
       restart" should not depend on "assume firewall is part of any". Even
       if the former option is OFF, with this fix compiler generates code to
       block TCP packets in state NEW and no SYN flag headed both for
       firewall and machines behind it.
