1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<link rel="stylesheet" type="text/css" href="http://www.fwbuilder.org/pages/fwbuilder.css">
</head>
<body>
<h1> Firewall Builder Release Notes </h1>
<br>
<h2> Version 2.0 </h2>
<br>
<p>
Released 07/28/04
<br>
<b>GUI and compilers v2.0 require API library libfwbuilder version 2.0</b>
<br>
<h2>Summary </h2>
<p>
<b>Firewall Builder GUI v2.0 has been completely rewritten using QT</b>
<p>
<b>For those who wish to build from source, instructions are outlined
in <a
href="http://www.fwbuilder.org/archives/cat_installation.html">"Install
and Build instructions"</a></b>
<h2>What's new</h2>
<p>
The GUI has been rewritten from scratch. The new GUI is based on
QT 3.x. It has been tested with Qt v3.1.1, 3.2.3 and 3.3.1. We
build on RedHat 9.0, Mandrake 10, SuSE 9.1, FreeBSD 5.2 using QT
packages that come with these systems.
<p>The GUI has been redesigned to addresses problems known to
exist in fwbuilder 1.1.x user interface:
<ul>
<li>Speed imporevements in the GUI. Firewall policy that consist
of 1000 rules renders just as fast as policy that has only 10
rules. The GUI has actually been tested with 1000 rules
policies.</li>
<li>Object tree is not synchronized with firewall policy
view. Selecting an object in the tree does not immediately open
it in the right hand panel in the main window. Right hand side
panel is dedicated for the policy view and always shows policy
or NAT rules of the firewall selected in the pull-down menu
above it. Editing of all objects is done in a separate floating
editor window that can be kept open at all times.
</li>
<li>Properties of an object selected in the tree or in any rule
are shown in the information panel under the tree. The size of
the panel can be changed; the panel has three modes of
operation: a) hidden, b) showing only comment associated with
selected object, c) showing its parameters and comment. User can
choose the mode by clilcking on the toolbar button under the
information panel.</li>
<li>"Find object" function finds obejcts by their name in the
tree, in groups and in rules. Regular expressions are
recognized.</li>
<li>Built-in version control based on RCS provides for a simple
way to track changes.</li>
<li>Data file can be opened read-only for inspection. If the
file is checked out and locked by a different user, it can only
be opened read-only.</li>
<li>Data file can be given on the command line without "-f"
switch. The "-f" is also supported for backwards
compatibility. </li>
<li>The program does not make copies of standard objects in user
data file anymore (per Feature Request #810504 "'Standard'
definitions should not be saved" )</li>
<li>Users can create and distribute their own libraries of
objects. The GUI allows for objects to be exported to external
library file with extension .fwl and imported from such
file.</li>
<li>Objects in the 'Standard' objects library, as well as
objects in libraries imported from external files, are
read-only</li>
<li>Added an option for autosave - if this option is turned on,
the gui periodically saves data to the file. The autosave
interval can be set between 1 minute and 2 hours.</li>
<li>The GUI detects collisions between objects when external
library is imported. Collision is detected when any attribute of
an objects in the tree is different from that attribute in the
object with the same unique ID in the file being imported. Some
old data files may trigger collisions because of subtle
differences in comments</li>
<li>Whenever user changes the name of a firewall, host or an
interface object, the GUI asks whether they want to also rename
all IP and MAC addresses that belong to that firewall or
host. If user agrees to rename them, the program generates names
automatically using scheme 'host_name:interface_name:ip' and
'host_name:interface_name:mac'</li>
<li>Deleted objects are moved to a special library and can be
recovered with "Undelete" operation</li>
<li>Rules can be color-labeled in all policies.</li>
<li>Window size and position is remembered across multiple
sessions for all dialogs.</li>
<li>Two modes of drag-and-drop of objects in policy and NAT
rules: dragging of an object moves it; dragging of an object
with Ctrl key pressed copies it</li>
<li>Multiple objects can be selected in the tree. Operations
such as duplication, moving between libraries, copy/paste can be
performed on multiple selected objects</li>
<li>Multiple rules can also be selected for operations such as
moving, deleting, copy/paste, setting colors</li>
<li>A collection of firewall template objects comes in a
separate XML file with the package. You can create a new
firewall object using one for these templates. This replaced
"help me build firewall" wizard. </li>
<li>The "Help me build firewall policy" wizard was phased out
and replaced with firewall templates. The template library will
be extended in the future releases.</li>
<li>GUI has a built-in installer that uses external ssh client
to communicate with firewall. Installer has simple GUI interface
and works on both Linux and Windows (uses putty or SecureCRT on
Windows). There is no need in external install script
fwb_install anymore.</li>
<li>An option has been added to firewall platforms iptables,
ipfilter, pf and ipfw that sets up a policy rule to permit ssh
access from one specified IP address to the firewall regardless
of other rules. This is for a backup ssh access from the
management workstation in case of an error in the policy that
locks user out of the firewall. The option (a checkbox and entry
field for the management station address) is located in the
"Compiler" tab of the firewall settings dialog. A command that
permits ssh to the firewall from the given address is added on
top of all other rules.</li>
<li>Packages for Windows 2000, Windows XP and Mac OS X will be
distributed under a different license.</li>
<li>The build process is based on qmake and uses autoconf
sparingly. Libtool is not used at all.</li>
<li>Internationalization is done using gettext 0.14.1 which
supports QT .qm files</li>
<li>Reasonably complete French translation is provided.</li>
<li>Object names and comments are stored in the object file in
UTF-8 format. This allows for names and comments to be entered
and displayed in local languages. Although object names can be
localized, it is recommended to keep firewall names in plain
ASCII because compilers do not support UTF-8 yet. This fixes
very old bug #657156: "Special characters problem".</li>
<li>Code compiles with gcc 3.4</li>
</ul>
<br>
<br>
<br>
<h2>New firewall platforms and new features that apply to all
platforms:</h2>
<ul>
<li>
Added support for Linksys devices running Sveasoft
firmware. Firewall object should be configured as platform
"iptables", host OS "linksys". Policy installer works both
using password and public key authentication.</li>
<li>Added an option to firewall platforms iptables, ipfilter, pf
and ipfw that sets up a policy rule to permit ssh access from
one specified IP address to the firewall regardless of other
rules. This is for a backup ssh access from the management
workstation in case of an error in the policy that locks user
out of the firewall. The option (a checkbox and entry field for
the management station address) is located in the "Compiler" tab
of the firewall settings dialog. A command that permits ssh to
the firewall from the given address is added on top of all other
rules.</li>
<li>added attribute 'lastModified' to element FWBObjectDatabase
in DTD. this attribute holds time of last modification done to
any object in the database (GMT). Added support for this
attribute in class FWObjectDatabase. This attribute is
implied.</li>
</ul>
<br>
<br>
<hr>
<h2>Bugs fixed in libfwbuilder API:</h2>
<ul>
<li>fixed bug that appeared only when used with libxml2 2.6.6
and libxslt 1.0.33 - '*Group' elements were not converted
properly (losing all child elements). It worked on RH 9 with
libxml2 2.5.4 and libxslt 1.0.27. Fix tested with libxml2 2.6.6
and libxslt 1.0.33 on Fedora C1 </li>
<li>Method Firewall::duplicate replaces references to the
firewall, its interfaces as well as IPv4 and physical addresses
of the interfaces in all rule sets with references to the copies
of corresponding objects. Now firewall created from another one
using 'duplicate' does not reference interfaces or addresses
that belong to the original firewall object. </li>
<li>bug #950857: "Incorrect conversion of address range" -
address range that consisted of two IP addresses was converted
to a set of networks incorrectly.</li>
<li>bug that occured on big endian architecture (e.g. Macintosh)
because of incorrect usage of preprocessor directives to check
BYTE_ORDER. This bug caused incorrect address arithmetics.</li>
<li>bug #906709: "A dynamic interface". Dynamic interface used
to "shadow" old broadcast object (0.0.0.0)</li>
</ul>
<br>
<br>
<h2>New features in iptables policy compiler fwb_ipt:</h2>
<ul>
<li>Feature Request #913273: make "assume fw is part of any" a
per-rule option</li>
<li>Processing of policy rules where firewall object is used in
src or dst with negation (possibly in combination with other
objects) has been optimized. Before, generated script would
match firewall's addresses in INPUT/OUTPUT and FORWARD chains
which added redundant checks in the FORWARD chain.</li>
</ul>
<br>
<br>
<h2>Bugs fixed in iptables policy compiler fwb_ipt:</h2>
<ul>
<li>
bug #956544: "Error into load modules script generation",
where generated script would not load kernel modules with
names "module.ko.gz". Regular expression should match on
".ko.*$" to find these modules properly. Thanks to Andrey
Kaminsky <and@fao.lv> who pointed this out.
</li>
<li>bug #934949: "duplicate rules". fwb_ipt created duplicate
rules for a bridging firewall if fw object or its interfaces or
their addresses were not in the source or desintaion</li>
<li>bug #912849: "Reorder activation of network interfaces in
IPT" - script generated by the compiler for iptables sets
default policy to DROP, flushes all rules and then reconfigures
interfaces of the firewall (it used to reconfigure intefaces and
then flush the rules).</li>
<li>bug #906709: "A dynamic interface". Dynamic interface used
to "shadow" old broadcast object (0.0.0.0)</li>
<li>bug #979484: "improper command for rule with service any and
action reject." For rules like that, and if rule options dialog
does not specify particular way to handle this combination, the
compiler splits the rule; the first iptables command rejects any
tcp packet with TCP RST, while the second rejects everything
else with ICMP message.</li>
<li>bug #917422: "compiler misinterprets interface with addr
0.0.0.0". If an interface has IP address "0.0.0.0", it is
considered an error.</li>
<li>bug #978854: "false rule generated for fw object in
interface rule". Policy compiler for iptables generated
incorrect code for rules using negated firewall object in source
or destination when global option "assume firewall is part of
any" was turned off.</li>
<li>bug #925199: "compiles wrongly a double negation". Policy
compiler for iptables generated incorrect code for rules where
two rule elements used negation (i.e. both src and dst, or dst
and srv, etc.)</li>
<li>bug #988860: "Logging missing when firewall start is
aborted". When iptables script generated by fwb_ipt finds
missing interfaces, it prints error message both on stdout and
sends it to the log.</li>
<li>bug #965558: "False ruleset generated for iptables (negate
w/ nat)". There were problems with double negations in NAT rules
(OSrc and ODst, or ODst and OSrv, etc).</li>
<li>bugs #935794: "dual translation and negation in fwb_ipt" and
#986376: "Wrong result for negated source in NAT rules". Dual
translation rule with negation in OSrc did not process negation
in the second half (POSTROUTING rule, the one that translates
the source).</li>
<li>bug #990037: "Wrong rule generated: fw interface included in
negated group". Rules with negation should not generate code in
INPUT/OUTPUT chains if option "assume firewall is part of any"
is off.</li>
</ul>
<br>
<br>
<h2>Bugs fixed in iptables policy compiler fwb_pf:</h2>
<ul>
<li> bug (no number) where fwb_pf would not include code defined by
custom service object in the .conf file</li>
<li>bug #985527: pf NAT rules miss destination port
specification. NAT rules that translate to "map" missed
destination port specification. </li>
<li>bug #986518: "PF redirection always point to loopback
address"</li>
</ul>
</body>
</html>
|
