                         Firewall Builder Release Notes

Version 1.0.7

   GUI and compilers v1.0.7 require API library libfwbuilder version 0.10.11

Summary

   This is bug fix release.

   For those who wish to build from source, instructions are outlined in the
   document "Install and Build instructions" on our web site here

What's new

     * Code compiles and works on Linux distributions based on gcc 3.2
       (tested on Mandrake 9.0 and RedHat 8.0)
     * Redesigned print dialog.
     * Can work with both ucd-snmp and net-snmp libraries (net-snmp is newer
       version of ucd-snmp. FreeBSD comes with net-snmp.)
     * added support for rule shading detection in the policy for all
       firewall platforms (both compiler and checkbox in the GUI dialog).
     * Changed code that loads iptables modules so that it would load all
       available modules regardless of their names.
     * Iptables firewall script generated by policy compiler fwb_ipt can
       verify interfaces configured in the GUI for the firewall object by
       checking if they really exist in the firewall machine. This feature is
       controlled by a checkbox "Verify interfaces before loading firewall
       policy" in the tab "Firewall" of the firewall object dialog. Caveat:
       if you configured interface object after interface alias (something
       like "eth0:0"), then script will treat it as non-existant interface
       and will abort firewall script without making any changes to the
       firewall policy. This way generated script just follows the behavior
       of netfilter, which does not recognize interface aliases and uses
       corresponding "main" interface instead. In reality aliases are just a
       secondary IP addresses on the "main" interface. If for any reason you
       configure interface objects after interface aliases, we strongly
       suggest you reconsider your design.
     * implemented feature req. #614034: Cross Rule consolidation. Policy
       compiler can find and eliminate duplicate atomic rules. Implemented
       only for ipfilter.

     ----------------------------------------------------------------------

Bugs fixed in libfwbuilder API:

     * fixed bug #626238: address 0.0.0.0/8 not detected correctly

Bugs fixed in GUI:

     * interface of the newly created host object gets netmask
       255.255.255.255 if "quick create" method was used.
     * Fixed printing in html and plain text formats. Redesigned print
       dialog.
     * fixed bug #617005: sigsev when creating standard rules (missing
       InterfacePolicy child elements on interfaces of firewall object
       created via Network Discovery Druid).
     * GUI removes national locale characters from the rule comment fields to
       avoid problems with XML format (we do not use real UTF-8 encoding at
       this time and therefore can not support non-ascii characters in XML).

Bugs fixed in iptables policy compiler fwb_ipt:

     * fixed bug #617001: wrong module names used for ip_conntrack etc. if
       version of iptables is set to >1.2.6
     * fixed bug #624842: mac addrress lost when multiple hosts with MAC
       addresses using withing group of objects.
     * Bugs fixed in ipfilter policy compiler fwb_ipf:

     * fixed bugs #616482 and #623376: rule with negation and logging logged
       everything.
     * fixed bug #616951: block return-icmp can not be used with direction
       'outbound'
     * fixed bug #629359: GUI did not mark rule as having non-default options
       when return-icmp-as-dest was checked in rule options.
