                         Firewall Builder Release Notes

Version 1.0.11

   Released 09/03/03
   GUI and compilers v1.0.11 require API library libfwbuilder version 1.0.1

Summary

   For those who wish to build from source, instructions are outlined in the
   document "Install and Build instructions" on our web site here

What's new

     * Improvements in the GUI:

          * when host object is discovered by network discover druid but it
            does not answer SNMP query and its interfaces can not be learned,
            the program assigns generic name to the interface object it
            creates. The name has been changed from 'interface1' to 'nic1'.
          * Code compiles and runs with gettext 0.12.1
          * Code compiles and runs on FreeBSD 4.9

     * Improvements in policy compiler for iptables:

          * implemented Feature Request #57561: "restricting log prefix to 29
            chars". Compiler issues a warning and truncates log prefix if it
            is longer than 29 characters.
          * implemented Feature Request #731761: "support for interfaces that
            can be down". Firewall script skips rules using dynamic interface
            if that interface had no IP address assigned to it at the moment
            when firewall policy was activated. Firewall script will be
            activated and policy will work even if one or more dynamic
            interfaces are down or just do not have IP addresses. This helps
            use generated firewall script if firewall separates networks with
            statically assigned IP addresses and at the same time has one or
            more interfaces with dynamically assigned address which can
            sometimes be down (e.g. Internet connection using PPP protocol).
          * implemented support for 'wildcard' interfaces. If interface of
            the firewall has a name that ends with '*' (e.g. 'ppp*'), it is
            considered a wildcard interface, that is compiler assumes that
            rules associated with this interface or using its address should
            be associated, or use address of all interfaces that match a
            'wildcard'. For interface 'ppp*' that would be ppp0, ppp1, ppp2
            etc. Rules created in the interface policy of this interface get
            "-i" or "-o" clause with an interface name ending in a '+'
            ('ppp*' gets simply converted into 'ppp+'). To provide support
            for rules using an address of such interface, compiler creates a
            loop where it finds all real interfaces that match pattern
            defined by the wildcard interface name and then copies the rule
            command using an actual address of each interface it finds.
          * implemented Feature Req. 730501: "ulog-ulgroup option for
            logging". ULOG ulgroup can be set both globally and for
            individual rules.

     * Improvements in policy compiler for ipfiler:

          * implemented Feature Request #778150: per-rule log level setting
            for ipfilter. Now policy compiler for ipfilter can generate "log
            level facility.level" options for individual rules in firewall
            policy.

     * Improvements in policy compiler for PF:

          * Added support for "(if)" syntax for OpenBSD pf. PF can
            automatically change address of the dynamic interface when its
            name in the rule is specified in parentheses.
          * Added GUI and policy compiler support for the following 'scrub'
            options for PF:

               * no-df
               * random-id
               * min-ttl
               * max-mss
               * fragment reassemble
               * fragment crop
               * fragment drop-ovl

          * Added GUI and policy compiler support for the following 'set'
            commands for PF:

               * set timeout interval
               * set timeout frag
               * set limit frags
               * set limit states
               * set optimization

     * Improvements in policy compilers for all platforms:

          * added a check for the situation when a host or a firewall object
            that has a dynamic interface is used in the policy or NAT rule of
            another firewall. Compiler aborts processing because it can not
            build a rule using dynamic interface of another object (its
            address is unknown at compile time and can not be determined at a
            run time)
          * Added a check for the typical error: dynamic interface should not
            have IPv4 child object(s). Compiler issues a warning if it does
            and ignores it.
          * implemented Feature Request #774727: Firewall General tab comment
            inserted into shell script. Compiler now inserts comment from the
            General tab of the firewall dialog into the generated firewall
            script.

     * New components:

          * standard Custom service object "ESTABLISHED" is now configured
            for iptables and ipfw.
          * service objects that describe DNS (UDP and TCP, port 53) have
            been renamed to 'domain' and service group 'DNS' including both
            of them has been added.
          * fwbedit: a general purpose object tree editing command-line tool.
            This tool can be used for writing scripts to batch-process data
            file without loading it in the GUI. Currently fwbedit can delete
            given object from the tree, as well as add and remove objects in
            the groups. More operations will be added in the future. See
            manual page fwbedit(1) for more information and usage examples.
          * fwb_compile_all: a wrapper script that provides a way to compile
            policies for several firewalls in one batch job. See man page
            fwb_compile_all(1)
          * fwbinstaller: a universal policy installer script. It uses Perl
            module Net::SSH::Perl and at this point can install generated
            policy on Linux/iptables, FreeBSD/ipf, OpenBSD/pf and Cisco PIX
            firewalls. Script is distributed in a separate package
            fwbuilder-installer. To simplify installation, it is packed using
            perl module PAR so that all modules it depends on, and the script
            itself, are packed inside of the single executable. Fwbinstaller
            will eventually replace old script fwb_install.

     ----------------------------------------------------------------------

Bugs fixed in libfwbuilder API:

     * fixed bug #773271: program crashes while doing network object
       discovery.
     * fixed bug #774462: wrong interface made external if fw was discovered
       by the crawler.
     * fixed bug #774834: compiler hangs on a group referencing itself. If a
       group referenced itself, policy compilers either hang or dumped core.

Bugs fixed in GUI:

     * fixed bug #747287: GUI crashes after "Open recent". This bug triggered
       only on some data sets, where opening the file using the "File/Open
       Recent" main menu caused GUI to become unstable and crash when global
       policy was opened.
     * fixed bug #751656: "menu item Rules/Install does not get enabled when
       interface is shown in dialog".
     * fixed bugs #759665: "popup menu does not work in empty group" and
       #760536: "cannot paste object to group". Right mouse click in the
       group editing dialog of the group object did not open popup menu if
       the group was empty.
     * fixed bug (no number) where the GUI called firewall policy instllation
       script without command line option "-d". The command line options for
       policy compilers and installation scripts should be the same, see
       manual page fwb_install(1). Option "-d" specifies working directory,
       i.e. the directory where data file currently opened in the GUI is
       located.
     * implemented Feature Req. 730501: "ulog-ulgroup option for logging".
       ULOG ulgroup can be set both globally and for individual rules.
     * GUI works with a copy of the main object tree when processes objects
       for printing. This helped to get rid of the annoying warning that
       something in the data has changed every time user tried to print.
     * GUI uses popup dialog to show the output from the printing subsystem -
       good for debugging if lpr returned an error.
     * fixed bug #764278 "Print error. uiltinDialog". Using background
       execution class from libfwbuilder and corresponding widget to call lpr
       so that user can see the output generated by it. Using new method
       XMLTools::transformFileToFile to apply XSLT transformation to the data
       file.
     * fixed bug #772723: "new firewall wizard assigns external interface
       wrong". "New Firewall" wizard ignored setting made by the user to mark
       external interface of the firewall.
     * fixed bug (no number) where "About" dialog showed empty boxes instead
       of the characters in the title line if font Helvetica was not
       available.

Bugs fixed in iptables policy compiler fwb_ipt:

     * fixed bug #741933: "compiler does not skip unnumbered interface".
       Policy compiler should skip unnumbered interfaces if the firewall
       object is used in ODst
     * fixed bug #751052: "Problem with more than 15 Services in Group
       (iptables)". Compiler should use no more than 15 ports in one
       invocation of the NAT rule using multiport module.
     * fixed bug #759655: "certain rules on loopback do not get added to
       OUTPUT chain". If option "assume firewall is part of any" is ON, then
       the rule "any fw_obj any" should generate code for the OUTPUT chain.
     * fixed bug #762489: "rule and logging option". Here is how policy
       compiler uses various limits: logging limit set globally in 'Firewall'
       tab of the firewall dialog applies only to logging; limit set in the
       rule options dialog applies only to the corresponding rule's target.
     * fixed bug #766161: "kernel 2.4.20-18.8custom / rh 8". Iptables does
       not allow using "--mac --source-mac" in the OUTPUT chain. Policy
       compiler for iptables now specifically checks for this situation.
     * fixed bug #772092: fwb_ipt uses bash synatx in generated script.
       fwb_ipt used operator == to compare strings; this syntax is specific
       to bash and won't work if shell /bin/sh does not support it.
     * fixed bugs #774455: "fwb_ipt produces wrong code when loopback used in
       the rule" and #781453: "compiler generates incorrect firewall script".
       Compiler produced broken iptables command if loopback interface object
       was used in the global policy rule.
     * fixed bug #778734: Multiple interface address in src/dst in global
       policy. Compiler used to eliminate too many rules as duplicates when
       firewall has two or more dynamic interfaces
     * fixed bug #780345: "wrong chain is chosen for the rule in bridging
       fw". If bridging firewall's interface address object had a netmask of
       255.255.255.255 in fwbuilder GUI, and firewall object or its interface
       was used in the Destination rule element, then compiler erroneously
       placed this rule in the FORWARD chain instead of INPUT.
     * fixed bug #780708: "Multiple dest IPs in NAT Table can be compiled
       (but aren't)". DNAT rules now allow multiple objects in Original
       Destination.
     * fixed bug #782687: Protocol 'ip' is not always recognized by iptables.
       Although iptables permits using protocol name with "-p" option, we've
       got reports that it sometimes can not properly interpret protocol name
       'ip'. Using 'all' instead seems to be a proper, supported way.
     * fixed bug #784029: "Problems with generated Script". Under certain
       circumstances generated script could not determine the type of the
       firewall's interface (POINTOPOINT vs BROADCAST) and could not
       configure its IP address.
     * fixed bug #788586: "ICMP and NAT". Compiler used to ignore a group of
       ICMP services used together with TCP or UDP services in the same NAT
       rule.

Bugs fixed in iptables policy compiler fwb_ipf:

     * fixed bug #782927: a way to get "any tcp" in the rdr rule. Ipfilter
       permits using "port 0" as a way to match on any tcp or udp port in rdr
       rules.
     * fixed bug #783931: "wrong interface picked for rdr rule". In the case
       when both OSrc and ODst are not 'any' in the rdr rule, fwb_ipf failed
       to pick up right interface for the rule.

Bugs fixed in iptables policy compiler fwb_pf:

     * fixed bug #771993: pf in OpenBSD-3.3 requires explicit protocols. PF
       in OpenBSD 3.3 does not allow using "proto ip" in nat and rdr rules.
     * fixed bug #772460: missing space in the script generated by fwb_pf

Bugs fixed in iptables policy compiler fwb_ipfw:

     * fixed bug #772799: "fwb_ipfw ignores custom services". Policy compiler
       for ipfw did not generate code for Custom service objects used in the
       policy rules.
     * 
