# Firewall Builder Release Notes

## Version 1.0.1

GUI v1.0.1 requires API library libfwbuilder version 0.10.5

## Summary

This version incorporated fixes for bugs filed in January and February of 2002, as well as some new features. Among other additions comes support for OpenBSD pf and ipf (ipfilter) packet filters. See below for details.

We started working on the policy management framework which will provide mechanism for policy installation on the remote firewall. The GUI will authenticate to the daemon running on the remote firewall using private/public key pair. This version comes with experimental support for the key and certificate management in "Options" dialog. The rest will become available in stages as we are nearing 1.1

We also started Windows port of Firewall Builder. Parts of the code already work on win32 platform, however some more work needs to be done to complete it.

In anticipation of wide distribution of gcc3.0 we've done extensive testing to make sure both libfwbuilder and fwbuilder compile well with gcc 3.0 and g++ 3.0

## What is new in the API library

- API now supports AddressRange object type
- API includes new classes for firewall management and policy deployment via firewall management daemon (fwbd, in the process of development) or via old-style install script.
- API includes new classes for writing policy compilers and for OS configuration
- Autoupgrade xslt script makes the following changes to the user's data files:

  - changes fwbuilder object database version from v0.10.4 to v0.10.5
  - adds group "Address Ranges" (ID='stdid14')
  - adds subelement Management to Host and Firewall and moves attributes snmp_read_community and snmp_write_community to Management/SNMPManagement
  - moves attributes inst_script and inst_cmdline to the element PolicyInstallScript
  - fixes Interface elements that have address element which is an empty string
  - adds missing TCP flags 'PSH' and 'URG' to all TCPService elements
  - changes platform name 'ipfilter' -> 'ipf'
- Work is being done to port API to win32 platform

## What is new in the GUI

- GUI now uses gdk_pixbuf instead of imlib library for image rendering
- Dialog "Options" provides interface for keys and certificate management system. These keys will be used in the future to authenticate to fwbd daemon running on remote firewall machine.
- GUI now supports new object type: Address Range. Not all policy compilers support it yet though.
- GUI now provides all the necessary elements to support PIX policy compiler (network zones, security levels on interfaces, etc).
- GUI provides all the necessary elements to support policy compilers for OpenBSD pf and ipf.
- Support for previously missing TCP flags PSH and URG has been added to the GUI
- GUI has been corrected to work properly with gtk+ 1.2.10 and gtkmm 1.2.8
- added support for --limit-burst option for iptables in the rule options dialog

## Policy compiler for OpenBSD PF

This is initial release of the policy compiler for OpenBSD pf. In this compiler for the first time we use our new compiler framework classes. Code has been tested on OpenBSD 3.0

Code status: beta

What is supported:

- both pf.conf and nat.conf files are generated
- negation in policy rules
- grouping in "from", "to" and in ports using '{' '}'
- rule with "scrub" policy is generated if object ip_fragments is used as service and action is Deny or Reject
- turning off stateful inspection in rule options
- choice of icmp or tcp rst replies for rules with action "Reject"
- matching on TCP flags
- compiler can generate commands to add virtual address to the firewall if NAT rule requires translation to or from address which does not belong to any interface.

What is not supported (yet)

- Address ranges in both policy and NAT
- negation in NAT
- custom services
- setting flags "no-df", "min-ttl" and "allow-opts" via rule options

## Policy compiler for ipf (ipfilter)

This is initial release of this version of policy compiler for ipf. This code is based on our new compiler framework classes. We tested on FreeBSD 4.4 with ipf v1.3.20

Code status: beta

What is supported:

- both ipf.conf and nat.conf files are generated
- negation in policy rules (using 'skip')
- rule with ip option 'short' is generated if object ip_fragments is used as service
- turning off stateful inspection in rule options
- choice of icmp or tcp rst replies for rules with action "Reject"
- matching on TCP flags
- compiler can generate commands to add virtual address to the firewall if NAT rule requires translation to or from address which does not belong to any interface.

What is not supported (yet)

- Address ranges in both policy and NAT
- negation in NAT
- custom services

## OS where Firewall Builder can configure networking parameters in the kernel

Firewall Builder can generate script to configure network parameters for certain OS. These are:

- Linux (kernels 2.4.x)
- OpenBSD 3.0
- FreeBSD (tested on 4.4, perhaps will work on 4.5)
- Solaris (tested on Solaris 8)

At the moment we can configure only few parameters for each OS, however we plan to expand the list in the future.

## Supported OS and firewall platforms

Operating Systems Firewall Builder has been ported to:

OS | Compiler | GUI and policy compilers
--- | --- | ---
Linux | gcc 2.96 | compile and work
Linux | gcc 3.0 | compile but do not link, need more testing
Solaris 8 | gcc 2.95 | compile and work
FreeBSD |  | compile, need more testing
OpenBSD |  | not tested
Win32 |  | compile but need more work

Matrix of supported OS and firewall platforms:

OS | Firewall
--- | ---
iptables | ipf | pf
Linux (kernel 2.4.x) | yes | n/a | n/a
Solaris | n/a | yes | n/a
FreeBSD 4.4 (4.5) | n/a | yes | n/a
OpenBSD 3.0 | n/a | yes | yes

## Bugs fixed in GUI:

- #502534: segmentation fault during certain operations with Copy/Paste in groups
- #511271 (copy of Debian bug #130789): Crash if user tries to delete a Service or Time from the user tree using Cut from the level above, instead of 'Cut Object' from the Edit menu.
- #504109: hang on `Edit' of object in changed rule
- #516028: Comments don't copy
- #520845: configure fails on solaris
- #521545: extra brackets in the call to GroupIconList->drag_data_received.connect which broke compile with g++ 3.
- #532432: Some fields do not accept keypad digits. This was also Debian bug# 140330 ( fwbuilder: Can't set interface address with numpad )

## Bugs fixed in iptables policy compiler:

- #511868: duplicated "-f" generated for ip_fragment service if both "all fragments" and "'short' fragments" where checked
- #507209 and #507972: The "accept source route" and other OS options were not correctly handled by the compiler
- #501021: optimizer should not supress destination address if it is broadcast
- #511260 (copy of Debian bug #131637): fwbuilder could incorrectly re-use iptables rule names when trying to optimize common sources and destinations.
- #511296: commands "ip addr ... " used to remove ipv6 addresses from interfaces
- (no number) fixed bug which caused iptables policy compiler to ignore multiple objects in "Time" rule element if optimization was enabled.
- #516033 (tcp-flags... - added missing flags PSH and URG)
- #516378: correct matching broadcast for iptables if destination is firewall with negation
- #520886: multi-line string literals cause warning if code is compiled with gcc3
- #523652: "destination to myself: rule in forward ". Checking if destination address in the rule is the same as an address of one of firewall's interfaces (rule should go into INPUT chain.
- #527187: %I in Generic Log Prefix: compiler cores
- #530133: Postrouting rule contains trailing colon (certain NAT rules caused compiler to generate code with extra ':' after --to-source ADDRESS)