# Firewall Builder Release Notes

## Version 1.0.2

GUI v1.0.2 requires API library libfwbuilder version 0.10.6

## Summary

This version incorporated fixes for bugs filed in April of 2002, as well as few new features. In particular, this version comes with new experimental policy compiler for iptables (fwb_ipt).

### New policy compiler for iptables

This compiler comes in the package called fwbuilder-ipt. There are multiple reasons why it is the time to rewrite the compiler, so fwbuilder-ipt is a complete rewrite. For once, I have been asked to add support for ip aliases (in other words, support virtual ip addresses on interfaces), but this feature could not be implementd with the old compiler. New compiler, on the other hand, will have support for it in the future. New compiler is based on libfwbuilder API, just like compilers for ipfilter and OpenBSD pf, this makes code maintenance easier. In addition, I could reuse certain pieces of code for all three compilers.

I consider fwbuilder-ipt beta quality at this time and I am asking for lots of testing. Please run it on your data sets and see what comes out.

I would like to switch to the new policy compiler as soon as possible, hopefully in a span of two versions. I stop fixing bugs in the old policy compiler fwbuilder-iptables now to free up cycles to support the new one and work on other features. I have already made sure that bugs currently opened against fwbuilder-iptables do not exist in fwbuilder-ipt. In fact, as of version 1.0.2 fwbuilder-iptables is in freeze mode and will be retired as of 1.0.4. This means I won't release RPM with fwbuilder-iptables when I release version 1.0.4, will remove it from CVS repository and will stop running test builds. Please see project roadmap on the web site http://www.fwbuilder.org/pages/documents.html

Version 1.0.2 still comes preconifgured to call the old policy compiler for iptables firewall objects. Those who want to test new compiler should follow instructions below. As of version 1.0.3 GUI will be preconfigured to use new compiler by default.

In order to test new compiler, download and install package fwbuilder-ipt-1.0.2. This package installs compiler's binary /usr/bin/fwb_ipt and man page fwb_ipt(1). New compiler can be used either from command line prompt or with fwbuilder GUI. In the latter case type "fwb_ipt" in the entry field called "Compiler (if different from default)" in the tab "Compile/Install" in firewall dialog, apply and then save changes to the file. See man page for command line options.

### Porting Firewall Builder to win32 platform

Work is still being done on Windows port of Firewall Builder, however we ran into problems and it is going to take some time to get this port done.

## What is new in the API library

- Internal changes have been made in oder to speed up the API
- Algorithms used in configure.in have been improved so that script can now properly find and use Bind libraries installed in unusual places
- API has been debugged on 64-bit architecture (Alpha)
- fwcompiler now provides few standard rule processing algorithms for policy compilers
- Work continues to port API to win32 platform
- Classes supporting background operations have been simplified and debugged on other platforms (FreeBSD and Solaris)

## What is new in the GUI

- GUI is faster when working with large policies. It does not redraw the whole policy anymore every time user adds or deletes rule.

## What is new in iptables compiler

- Added new log prefix macro %C - prints chain name as part of log prefix (feature req. #535950)
- applied patch #535447 (command line option -w supresses compiler warnings)

## What is new in the standard objects database

- Few new objects have been added: PCAnywhere, winterm, Citrix ICA
- IPService object IPSEC have been renamed to ESP, IPService object AH and service group IPSEC have been added.

## Bugs fixed in GUI:

- code now works on 64-bit platforms (tested on Alpha)

## Bugs fixed in iptables policy compiler fwb_iptables:

- applied patch #535447 (command line option -w supresses compiler warnings)

## The following bugs were fixed and feature request were implemented in the new policy compiler for iptables (fwb_ipt)

- improved code checking for modules installed on the system so it will now detect compressed modules (*.o.gz). Bug #544587
- implemented support for AddressRange in Src/Dst for pf,ipf,ipt. Bug #543335, #552865
- implemented support for negation in NAT for the new iptables compiler. Bug #545028
- implemented support for AddressRange in SNAT and DNAT rules (feature req. #476511)

## Bugs fixed in OpenBSD PF policy compiler (fwb_pf):

- Added support for policy rules and translations on interfaces with dynamic addresses per feature req. #542705
- added check for DNAT rules with service "any" (bug #541814 )
- implemented support for AddressRange in Src/Dst for pf,ipf,ipt. Bug #543335
- implemented support for negation in NAT for OpenBSD PF (using "no nat" ) This has been done as part of work on bug #545028

## Bugs fixed in ipfilter policy compiler (fwb_ipf):

- added "keep frag" rule option for ipf per support req. #541753
- added rule option "return_icmp_as_dest" for ipf per support req. #543768
- added support for built-in application proxies in "map" rules for ipfilter per support req. #543383
- implemented support for AddressRange in Src/Dst for pf,ipf,ipt. Bug #543335
- "skip" with "quick" options do not work together in ipfilter. Bug #546195