                         Firewall Builder Release Notes

Version 1.0.10

   Released 05/21/2003
   GUI and compilers v1.0.10 require API library libfwbuilder version 1.0.0

Summary

   For those who wish to build from source, instructions are outlined in the
   document "Install and Build instructions" on our web site here

What's new

     * Improvements in the GUI:
          * GUI and compilers compile and work on Solaris (again).
          * implemented caching of all icons and images supported through the
            class SimplePixmaps (icons in the policy and group views and
            icons on buttons). This helped to significantly speed-up the GUI,
            it is especially noticeable in time it takes to load a long
            policy.
          * If user called "Save As" operation, but the file with suggested
            name already exists, the GUI asks user if they want to overwrite
            existing file
          * A GUI crash has been found and eliminated: if an IP address or
            network object has somehow been created with illegal IP address
            or netmask, it could not have been used in the policy. The GUI
            just crashed as soon as user dropped such object in the rule
            element.
          * The check of the correctness of the IP address on every keystroke
            has been disabled in a widget that manages IP address or netmask
            field. All dialogs that use this widget should check it before
            storing the data. It was annoying when program popped an error
            dialog on every typo.

     * Improvements in policy compiler for iptables:
          * Feature Req. 551137: Improvement for dynamic ext. interfaces.
            Compiler generates shell code that determines addresses of all
            dynamic interfaces and assigns them to variables, which can then
            be used in rules. This lets us correctly implement anti-spoofing
            rules for dynamic interfaces, among other things. If the script
            can not determine the address of a dynamic interface, it won't
            install the policy.
          * implemented a better way to configure blocks of virtual addresses
            for firewall's interfaces (works with busybox shell that does not
            support fancy regular expression operators)
          * DNAT rules are no longer assigned to interfaces. This simplifies
            many configurations where packets headed for the address used for
            DNAT enter the firewall through "wrong" interface (e.g. users on
            internal LAN access web server using its DNAT address; in this
            case packets with destination address belonging to the external
            interface enter firewall through internal interface. If
            translation works right, these packets will go back through the
            same interface and never cross external one. Should DNAT rule
            have "-i..." clause, it would never work.)
          * SNAT rules are now assigned to interfaces (using "-o iface_name")
            as follows:

               * if firewall's interface or its address is in TSrc, the rule
                 the uses its address for "--to-source" and its name for "-o"
               * if firewall object is in TSrc, then it gets replaced with
                 its interfaces except for unnumbered and loopback interfaces
                 and rule is processed using each interface as described
                 above
               * if some other object is in TSrc, the rule is assigned to all
                 interfaces of the firewall except for unnumbered and
                 loopback inetrfaces using "-o" argument and address of the
                 object in TSrc is used for "--to-source". Compiler combines
                 interfaces with similar names using "+" notation to reduce
                 overall number of rules. There are reasons why rule has to
                 be explicitly assigned to all interfaces using "-o" as
                 opposed to skipping "-o" all together. Consider for example
                 a configuration with an unnumbred tunnel interface (e.g.
                 ipsec0) used for "road varrior" connections where IP address
                 on the other end of the tunnel is unknown. We can not add a
                 "no nat" rule because we do not know address of the net on
                 the other side of the tunnel, but fortunately ipsec0 is
                 skipped in the assignment of SNAT rule because it is
                 unnumbered, so the firewall won't translate packets going
                 through this interface.

          * Implemented feature Req. #700994: "DNAT rule with chain OUTPUT".
            A new option "local NAT" have been added on the "Firewall" tab of
            the firewall dialog. This option, when enabled, causes policy
            compiler to generate NAT rules in OUTPUT chain for DNAT rules
            where firewall is in OSrc. Rules where OSrc is 'any' are split
            and also generate code in the OUTPUT chain if both options
            "assume firewall is part of any" and "local NAT" are enabled.

            Note: With iptables 1.2.7a and later, DNAT rules using OUTPUT
            chain are supported only if the kernel has been compiled with
            option CONFIG_IP_NF_NAT_LOCAL
          * Compiler generates shell code that can properly add virtual
            addresses for point-to-point interfaces
          * generated policy script does not turn ip forwarding off before
            installing firewall policy. It used to turn it off, but it seems
            to be an overkill since we set default policy to DROP on all
            chains anyway. Firewalls with really long policies that take a
            long time to install cause all sorts of problems (like dropped
            ssh sessions and tripped monitoring) because of disabled
            forwarding. Now administrator can add rules for ssh sessions and
            monitoring systems on the top of the policy so that even if
            policy takes a long time to install, those rules will be
            activated first.
          * Feature Req. #684604: TIME restrictions in interface policies.
            Firewall Builder now supports time restrictions in the Interface
            Policy rules for platforms that can match time intervals.
          * added optimizer that removes duplicate iptables rules
          * Global policy rules that have firewall object in both source and
            destination now use all interfaces of the firewall, including
            loopback. Previously address "127.0.0.1" was used only if the
            rule was associated with loopback interface.
          * Feature Req. #669022: "Support for multiple negated targets in
            NAT table". Port translation rules that change only port and do
            not change destination address now allow multiple objects in
            Original Destination (with or without negation).
          * Port translation rules with TDst 'any' now generate iptables
            command with " ... -j DNAT --to-destination :80" (no address in
            front of the ':' ). Similar rules with firewall object in ODst
            and TDst 'any' are treated as redirection rules and generate
            iptables command using target REDIRECT.

     * Improvements in policy compiler for ipfiler:

          * 'map' rules are now assigned to interfaces using the same
            algorithm as in compiler for iptables:

               * if firewall's interface or its address is in TSrc, the rule
                 the uses its address to the right of -> and its name for map
                 ifname construct.
               * if firewall object is in TSrc, then it gets replaced with
                 its interfaces except for unnumbered and loopback interfaces
                 and rule is processed using each interface as described
                 above
               * if some other object is in TSrc, the rule is assigned to all
                 interfaces of the firewall except for unnumbered and
                 loopback inetrfaces using map ifname and address of the
                 object in TSrc is used to the right of ->.

     * Improvements in policy compiler for pf:

          * Feature Req. #680055: implemented custom log prefix in PF using
            'label' keyword. NOTE:  According to the PF author, custom
            logging labels will be implemented after OpenBSD 3.3 is out. So,
            tentatively, this should be expected in 3.4.
          * 'rdr' rules in PF are not associated with particular interface
            anymore. This allows for configurations where translation is
            supposed to happen on igress interface (e.g. NAT is done on enc0
            interface for IPSEC tunnel)
          * 'nat' rules are now assigned to interfaces using the same
            algorithm as in compiler for iptables. Rules

               * if firewall's interface or its address is in TSrc, the rule
                 the uses its address to the right of -> and its name for nat
                 on
               * if firewall object is in TSrc, then it gets replaced with
                 its interfaces except for unnumbered and loopback interfaces
                 and rule is processed using each interface as described
                 above
               * if some other object is in TSrc, the rule is assigned to all
                 interfaces of the firewall except for unnumbered and
                 loopback inetrfaces using nat on argument and address of the
                 object in TSrc is used to the right of ->. Compiler combines
                 interfaces with similar names using
                 {ifname1,ifname2,ifname2} notation to reduce overall number
                 of rules.

     * Improvements in policy compilers for all platforms:

          * implemented action 'Accounting'. This provides for rules that
            only count packets they match but do not make any decision
            whether the packet should be passed or blocked. This action can
            be used for logging-only rules as well. In iptables, Accounting
            is implemented via user-defined chain with target RETURN. In pf
            it is implemented using action 'pass' without option 'quick'. In
            ipf and ipfw it uses action 'count' This implements Feature Req.
            #597259: "'NILL' action rule at top of mainchains" and #672272:
            "Log-only Rules"
          * Number of code optimizations have been made in API and all policy
            compilers. This helped to reduce compile time, sometimes
            significantly.
          * Compilers for iptables and PF: added support for NAT rules that
            can translate both source and destination. This allows for nice
            single rule for the classic "DNAT back to the same LAN" rule.
            This rule looks like this: OSrc is internal net, ODst is a
            translated address for the server, TSrc is firewall's internal
            interface and TDst is a real server's object. This generates two
            NAT rules: one DNAT rule to translate destination and another
            SNAT rule to translate source. This is more logical than
            previously recommended combination of two rules because our model
            assumes that the first rule that matches the packet works and
            further rules are not consulted. The recommended two rule
            combination silently broke this assumption which was
            counter-intuitive and caused confusion.

     * New components:

          * This version includes experimental policy compiler that supports
            ipfw and Mac OS X. The new ipfw (ipfw2) is not supported yet,
            this is only for the old one. Ipfw2 is supposed to be backwards
            compatible though. NAT is not supported at all at this time (
            will add support for natd in the future).
          * added service objects pop3s, nntps, netbios-ssn (TCP),
            ftp_data_passive, WINS replication, LDAP GC and LDAP GC SSL.
          * additional objects added to the objects database per Microsoft
            Knowledge Base article #179442. Groups "WinNT" and "Win2000" have
            been created in accrodance with this article.
          * install script fwb_install now uses ssh-agent to interact with
            the user. User's key should be protected with a good passphrase,
            the script uses agent to ask for passphrase and then unlock the
            key.

     ----------------------------------------------------------------------

Bugs fixed in GUI:

     * bug #686156: "Insert Firewall Object" Druid not translated. Added
       missing files to the list in POTFILES.in
     * bug #686154: Print Dialog not translated. Added missing files to the
       list in POTFILES.in
     * bug #686962: can not create network 0.0.0.0/8
     * bug in NewHostDruid and NewFirewallDruid - both druids run in a
       non-modal windows and should not insert newly created object into the
       tree until all its parameters have been entered in the Druid.
     * bug #691698: child object deletion. Bug caused the GUI to crash if
       interface of the firewall or one of its addresses was used in the
       policy rule of another firewall, and the first firewall was deleted.
     * bug #702661: "NETBIOS ports wrong"

Bugs fixed in policy compiler fwb_ipt:

     * bug #685165: "using dynamic interface in global policy". Address of
       dynamic interface is now determined at the policy activation time and
       then used in rules.
     * bug #685611: add_addr statements even if switched off in fw config.
       Policy compiler should generate commands to configure firewall's
       interfaces only if option "Configure interfaces" is on.
     * bug #687589: problems on floppyfw. Generated script should not use
       'which' and shell arithmetics operations. Now script does not check if
       specified paths and names for command line utilities it uses are
       correct. This is to avoid having to use 'which'. Script will abort
       anyway if these path/name specifications are incorrect. Arithmetics
       operator $(( )) has been replaced with a call to 'expr' which is more
       portable since it is available in systems built around busybox
       (floppyfw, Devil Linux etc.)
     * bug #685947 "Rules with firewall object allow too much"
     * bug #685624 "Interface rules with strange result".
     * bug #691522: rule 'any any any accept both' on loopback. Compiler can
       detect a special case where rule with 'any' in both src and dst is
       used on a loopback interface and option 'assume firewall is part of
       any' is OFF. Generated code should go into INPUT and OUTPUT chains.
       This also implements Feature Req. #688799: Allow all traffic on
       loopback interface.
     * bug #698687: creating ips for the all interfaces should also bring
       them up. The requestor wanted generated firewall script to not only
       configure all interfaces defined in the object in the GUI, but also
       bring them up (ifconfig eth0 up). Why not.
     * bug #698705: bad mac-address in nat rules. Two problems here: 1) GUI
       did not allow to change option "Use MAC address filtering" in the Host
       object dialog, and 2) compiler should generate code checking MAC
       address only if this option is ON. Also matching MAC addresses is
       allowed in NAT rules only in PREROUTING chain.
     * bug #698711: "DNAT to range of ips". Compiler should generate code for
       DNAT rule with multiple destination addresses if AddressRange object
       or multiple Host objects are used in TDst. Address range defined this
       way must be contiguous.
     * bug #715601: SNAT to specific host uses wrong interface. SNAT rules
       are now assigned to all interfaces (using "+" notation); this should
       take care of configurations where address that belongs to subnet of
       one interface of the firewall is used for translation for packets that
       exit firewall through another interface.
     * fixed a bug (no number) where iptables 1.2.7a did not like "-m time"
       with its parameters if it appeared after "-j ULOG". Target "-j ULOG"
       with its parameters should be the last in the command.
     * fixed bug #727229: "0/0 address in to-destination". Port translation
       rules with TDst 'any' should generate iptables command with " ... -j
       DNAT --to-destination :80" (no address in front of the ':' )
     * fixed bug #727324: policy rules generated wrong code if service
       contained a single object with negation.

Bugs fixed in policy compiler fwb_ipf:

     * bug #694189: incomplete ipnat map rules. Ipfilter needs "portmap
       tcp/udp auto" statement to dynamically relocate TCP/UDP ports of
       connections translated by 'map' rules.
     * bug #697504: Wrong interface is chosen for ipnat compiled rule.
     * bug #698396: wrong values in "skip" rules (The lines-to-skip counters
       were wrong because they have to be calculated independently for "in"
       and "out" rules.)
     * bug #697388: netmask is not passed to ifconfig command in add_addr()
     * bug #697235: "or-block" is used in the "block" rules
     * bug #700092: "Wrong interface is chosen for ipnat compiled rule
       (again)". Compiler for ipfilter should use OSrc to assign NAT rules
       that generate 'rdr' command to appropriate interface. If OSrc is 'any'
       or does not correspond to any interface, compiler should assign the
       rule to all interfaces.
     * bug #725853: "Flag for no SYN by default for tcp". Implemented support
       for option "Accept TCP sessions opened prior to firewall restart" in
       ipfilter. This can be used in redundand firewall pairs where backup
       firewall takes over when the primary one goes down and should not drop
       sessions opened before failover happens.
     * bug #732176: "FwBuilder 1.0.9 and ip_fragments". Keyword "fragment"
       used in OpenBSD pf to match on ip fragments can not be used with
       ipfilter.

Bugs fixed in policy compiler fwb_pf:

     * bug #692043: problem with redirection NAT rules in PF. This is rather
       obscure case of dependency between policy and redirection NAT rules.
       See ChangeLog for more details.

Bugs fixed in other components:

     * fixed bug #713582: Cannot build libfwbuilder from rpm src file on RH
       8.0. Libfwbuilder should detect presence of net-snmp before it checks
       for ucd-snmp because RH8.0 comes with both libnetsnmp and libsnmp.
     * bug #686434: fwblookup is broken in 1.0.9 and #686486: error parsing
       /usr/share/fwbuilder
     * fixed bug #720250. Generated script defines varialbe LOGGER containing
       a path and name for the "logger" tool. Script should use this variable
       to call logger. This has been fixed in policy compilers for all
       platforms.
