Firewall Builder Release Notes
Version 1.0.10
Released 05/21/2003
GUI and compilers v1.0.10 require API library libfwbuilder version 1.0.0
Summary
For those who wish to build from source, instructions are outlined
in the document "Install and Build instructions" on our web site here
What's new
- Improvements in the GUI:
-
GUI and compilers compile and work on Solaris (again).
-
implemented caching of all icons and images supported
through the class SimplePixmaps (icons in the policy and
group views and icons on buttons). This helped to
significantly speed-up the GUI, it is especially
noticeable in time it takes to load a long policy.
-
If user called "Save As" operation, but the file with
suggested name already exists, the GUI asks user if they
want to overwrite existing file
-
A GUI crash has been found and eliminated: if an IP
address or network object has somehow been created with
illegal IP address or netmask, it could not have been used
in the policy. The GUI just crashed as soon as user
dropped such object in the rule element.
-
The check of the correctness of the IP address on every
keystroke has been disabled in a widget that manages IP
address or netmask field. All dialogs that use this widget
should check it before storing the data. It was annoying
when program popped an error dialog on every typo.
- Improvements in policy compiler for iptables:
- Improvements in policy compiler for ipfiler:
-
'map' rules are now assigned to interfaces using the same
algorithm as in compiler for iptables:
- if firewall's interface or its address is in TSrc,
the rule the uses its address to the right of ->
and its name for map ifname construct.
- if firewall object is in TSrc, then it gets replaced
with its interfaces except for unnumbered and loopback
interfaces and rule is processed using each interface as
described above
- if some other object is in TSrc, the rule is
assigned to all interfaces of the firewall except for
unnumbered and loopback inetrfaces using map
ifname and address of the object in TSrc is used to
the right of ->.
- Improvements in policy compiler for pf:
-
Feature Req. #680055: implemented custom log prefix in
PF using 'label' keyword.
NOTE: According to the PF author, custom
logging labels will be implemented after OpenBSD 3.3 is
out. So, tentatively, this should be expected in 3.4.
-
'rdr' rules in PF are not associated with particular
interface anymore. This allows for configurations where
translation is supposed to happen on igress interface
(e.g. NAT is done on enc0 interface for IPSEC tunnel)
-
'nat' rules are now assigned to interfaces using the same
algorithm as in compiler for iptables. Rules
- if firewall's interface or its address is in TSrc,
the rule the uses its address to the right of ->
and its name for nat on
- if firewall object is in TSrc, then it gets replaced
with its interfaces except for unnumbered and loopback
interfaces and rule is processed using each interface as
described above
- if some other object is in TSrc, the rule is
assigned to all interfaces of the firewall except for
unnumbered and loopback inetrfaces using nat on
argument and address of the object in TSrc is used to
the right of ->. Compiler combines interfaces
with similar names using
{ifname1,ifname2,ifname2} notation to reduce
overall number of rules.
- Improvements in policy compilers for all platforms:
-
implemented action 'Accounting'. This provides for rules
that only count packets they match but do not make any
decision whether the packet should be passed or
blocked. This action can be used for logging-only rules as
well.
In iptables, Accounting is implemented via
user-defined chain with target RETURN. In pf it is
implemented using action 'pass' without option
'quick'. In ipf and ipfw it uses action 'count'
This implements Feature Req. #597259: "'NILL' action
rule at top of mainchains" and #672272: "Log-only Rules"
-
Number of code optimizations have been made in API and all
policy compilers. This helped to reduce compile time,
sometimes significantly.
-
Compilers for iptables and PF: added support for NAT rules
that can translate both source and destination. This
allows for nice single rule for the classic "DNAT back to
the same LAN" rule. This rule looks like this: OSrc is
internal net, ODst is a translated address for the server,
TSrc is firewall's internal interface and TDst is a real
server's object. This generates two NAT rules: one DNAT
rule to translate destination and another SNAT rule to
translate source. This is more logical than previously
recommended combination of two rules because our model
assumes that the first rule that matches the packet works
and further rules are not consulted. The recommended two
rule combination silently broke this assumption which was
counter-intuitive and caused confusion.
-
New components:
-
This version includes experimental policy compiler that
supports ipfw and Mac OS X. The new ipfw (ipfw2) is not
supported yet, this is only for the old one. Ipfw2 is
supposed to be backwards compatible though. NAT is not
supported at all at this time ( will add support for natd
in the future).
-
added service objects pop3s, nntps, netbios-ssn (TCP),
ftp_data_passive, WINS replication, LDAP GC and LDAP GC SSL.
-
additional objects added to the objects database per
Microsoft Knowledge Base article #179442. Groups "WinNT"
and "Win2000" have been created in accrodance with this
article.
-
install script fwb_install now uses ssh-agent to interact
with the user. User's key should be protected with a good
passphrase, the script uses agent to ask for passphrase
and then unlock the key.
Bugs fixed in GUI:
-
bug #686156: "Insert Firewall Object" Druid not
translated. Added missing files to the list in POTFILES.in
-
bug #686154: Print Dialog not translated. Added missing files
to the list in POTFILES.in
-
bug #686962: can not create network 0.0.0.0/8
-
bug in NewHostDruid and NewFirewallDruid - both druids run in
a non-modal windows and should not insert newly created object
into the tree until all its parameters have been entered in
the Druid.
-
bug #691698: child object deletion. Bug caused the GUI to
crash if interface of the firewall or one of its addresses was
used in the policy rule of another firewall, and the first
firewall was deleted.
-
bug #702661: "NETBIOS ports wrong"
Bugs fixed in policy compiler fwb_ipt:
-
bug #685165: "using dynamic interface in global
policy". Address of dynamic interface is now determined at the
policy activation time and then used in rules.
-
bug #685611: add_addr statements even if switched off in fw
config. Policy compiler should generate commands to configure
firewall's interfaces only if option "Configure interfaces" is
on.
-
bug #687589: problems on floppyfw. Generated script should not
use 'which' and shell arithmetics operations. Now script does
not check if specified paths and names for command line
utilities it uses are correct. This is to avoid having to use
'which'. Script will abort anyway if these path/name
specifications are incorrect. Arithmetics operator $(( )) has
been replaced with a call to 'expr' which is more portable
since it is available in systems built around busybox
(floppyfw, Devil Linux etc.)
-
bug #685947 "Rules with firewall object allow too much"
-
bug #685624 "Interface rules with strange result".
-
bug #691522: rule 'any any any accept both' on
loopback. Compiler can detect a special case where rule with
'any' in both src and dst is used on a loopback interface and
option 'assume firewall is part of any' is OFF. Generated code
should go into INPUT and OUTPUT chains. This also implements
Feature Req. #688799: Allow all traffic on loopback interface.
-
bug #698687: creating ips for the all interfaces should also
bring them up. The requestor wanted generated firewall script
to not only configure all interfaces defined in the object in
the GUI, but also bring them up (ifconfig eth0 up). Why not.
-
bug #698705: bad mac-address in nat rules. Two problems here:
1) GUI did not allow to change option "Use MAC address
filtering" in the Host object dialog, and 2) compiler should
generate code checking MAC address only if this option is
ON. Also matching MAC addresses is allowed in NAT rules only
in PREROUTING chain.
-
bug #698711: "DNAT to range of ips". Compiler should generate
code for DNAT rule with multiple destination addresses if
AddressRange object or multiple Host objects are used in
TDst. Address range defined this way must be contiguous.
-
bug #715601: SNAT to specific host uses wrong interface. SNAT
rules are now assigned to all interfaces (using "+"
notation); this should take care of configurations where
address that belongs to subnet of one interface of the
firewall is used for translation for packets that exit
firewall through another interface.
-
fixed a bug (no number) where iptables 1.2.7a did not like "-m
time" with its parameters if it appeared after "-j
ULOG". Target "-j ULOG" with its parameters should be the last
in the command.
-
fixed bug #727229: "0/0 address in to-destination". Port
translation rules with TDst 'any' should generate iptables
command with " ... -j DNAT --to-destination :80" (no address
in front of the ':' )
-
fixed bug #727324: policy rules generated wrong code if service
contained a single object with negation.
Bugs fixed in policy compiler fwb_ipf:
-
bug #694189: incomplete ipnat map rules. Ipfilter needs
"portmap tcp/udp auto" statement to dynamically relocate
TCP/UDP ports of connections translated by 'map' rules.
-
bug #697504: Wrong interface is chosen for ipnat compiled
rule.
-
bug #698396: wrong values in "skip" rules (The lines-to-skip
counters were wrong because they have to be calculated
independently for "in" and "out" rules.)
-
bug #697388: netmask is not passed to ifconfig command in
add_addr()
-
bug #697235: "or-block" is used in the "block" rules
-
bug #700092: "Wrong interface is chosen for ipnat compiled
rule (again)". Compiler for ipfilter should use OSrc to assign
NAT rules that generate 'rdr' command to appropriate
interface. If OSrc is 'any' or does not correspond to any
interface, compiler should assign the rule to all interfaces.
-
bug #725853: "Flag for no SYN by default for tcp". Implemented
support for option "Accept TCP sessions opened prior to
firewall restart" in ipfilter. This can be used in redundand
firewall pairs where backup firewall takes over when the
primary one goes down and should not drop sessions opened
before failover happens.
- bug #732176: "FwBuilder 1.0.9 and ip_fragments". Keyword
"fragment" used in OpenBSD pf to match on ip fragments can not
be used with ipfilter.
Bugs fixed in policy compiler fwb_pf:
-
bug #692043: problem with redirection NAT rules in PF. This is
rather obscure case of dependency between policy and
redirection NAT rules. See ChangeLog for more details.
Bugs fixed in other components:
-
fixed bug #713582: Cannot build libfwbuilder from rpm src file
on RH 8.0. Libfwbuilder should detect presence of net-snmp
before it checks for ucd-snmp because RH8.0 comes with both
libnetsnmp and libsnmp.
-
bug #686434: fwblookup is broken in 1.0.9 and #686486: error
parsing /usr/share/fwbuilder
-
fixed bug #720250. Generated script defines varialbe LOGGER
containing a path and name for the "logger" tool. Script
should use this variable to call logger. This has been fixed
in policy compilers for all platforms.