                         Firewall Builder Release Notes

Version 1.0.2

   GUI v1.0.2 requires API library libfwbuilder version 0.10.6

Summary

   This version incorporated fixes for bugs filed in April of 2002, as well
   as few new features. In particular, this version comes with new
   experimental policy compiler for iptables (fwb_ipt).

  New policy compiler for iptables

   This compiler comes in the package called fwbuilder-ipt. There are
   multiple reasons why it is the time to rewrite the compiler, so
   fwbuilder-ipt is a complete rewrite. For once, I have been asked many
   times to add support for ip aliases (in other words, support virtual ip
   addresses on interfaces), but this feature could not be implementd with
   the old compiler. New compiler, on the other hand, can support it. New
   compiler is based on libfwbuilder API, just like compilers for ipfilter
   and OpenBSD pf, this makes code maintenance easier. In addition, I could
   reuse certain pieces of code for all three compilers.

   I consider fwbuilder-ipt beta quality at this time and I am asking for
   lots of testing. Please run it on your data sets and see what comes out.

   I would like to switch to the new policy compiler as soon as possible,
   hopefully in a span of two versions. I stop fixing bugs in the old policy
   compiler fwbuilder-iptables now to free up cycles to support the new one.
   I have already made sure that bugs currently opened against
   fwbuilder-iptables do not exist in fwbuilder-ipt. In fact, as of version
   1.0.2 fwbuilder-iptables is in freeze mode and will be retired as of
   1.0.4. This means I won't release RPM with fwbuilder-iptables when I
   release version 1.0.4, will remove it from CVS repository and will stop
   running test builds. Please see project roadmap on the web site
   http://www.fwbuilder.org/pages/documents.html

   Work is still being done on Windows port of Firewall Builder, however we
   ran into problems and it is going to take some time to get this port done.

What is new in the API library

     * Internal changes have been made in oder to speed up the API
     * Algorithms used in configure.in have been improved so that script can
       now properly find and use Bind libraries installed in unusual places
     * API has been debugged on 64-bit architecture (Alpha)
     * fwcompiler now provides few standard rule processing algorithms for
       policy compilers
     * Work continues to port API to win32 platform
     * Classes supporting background operations have been simplified and
       debugged on other platforms (FreeBSD and Solaris)

What is new in the GUI

     * GUI is faster when working with large policies. It does not redraw the
       whole policy anymore every time user adds or deletes rule.

What is new in iptables compiler

     * Added new log prefix macro %C - prints chain name as part of log
       prefix (feature req. #535950)
     * applied patch #535447 (command line option -w supresses compiler
       warnings)

What is new in the standard objects database

     * Few new objects have been added: PCAnywhere, winterm, Citrix ICA
     * IPService object IPSEC have been renamed to ESP, IPService object AH
       and service group IPSEC have been added.

     ----------------------------------------------------------------------

Bugs fixed in GUI:

     * code now works on 64-bit platforms (tested on Alpha)

Bugs fixed in iptables policy compiler fwb_iptables:

     * applied patch #535447 (command line option -w supresses compiler
       warnings)

The following bugs were fixed and feature request were implemented in the new
policy compiler for iptables (fwb_ipt)

     * improved code checking for modules installed on the system so it will
       now detect compressed modules (*.o.gz). Bug #544587
     * implemented support for AddressRange in Src/Dst for pf,ipf,ipt. Bug
       #543335
     * implemented support for negation in NAT for the new iptables compiler.
       Bug #545028
     * implemented support for AddressRange in SNAT and DNAT rules (feature
       req. #476511)

Bugs fixed in OpenBSD PF policy compiler (fwb_pf):

     * Added support for policy rules and translations on interfaces with
       dynamic addresses per feature req. #542705
     * added check for DNAT rules with service "any" (bug #541814 )
     * implemented support for AddressRange in Src/Dst for pf,ipf,ipt. Bug
       #543335
     * implemented support for negation in NAT for OpenBSD PF (using "no nat"
       ) This has been done as part of work on bug #545028

Bugs fixed in ipfilter policy compiler (fwb_ipf):

     * added "keep frag" rule option for ipf per support req. #541753
     * added rule option "return_icmp_as_dest" for ipf per support req.
       #543768
     * added support for built-in application proxies in "map" rules for
       ipfilter per support req. #543383
     * implemented support for AddressRange in Src/Dst for pf,ipf,ipt. Bug
       #543335
     * "skip" with "quick" options do not work together in ipfilter. Bug
       #546195
