onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-03-19 17:57:22 +01:00
Code Issues Releases Wiki Activity
fwbuilder/doc/ChangeLog
Vadim Kurland 5ef36c5a52 2008-12-25 vadim <vadim@vk.crocodile.org> 
* All policy compilers: using FWObjectDatabase::createClass
methods to create rules and other objects in compilers wherever
the type is known at the (code) compile time. This makes code
cleaner and speeds it up a little because of eliminated cast() and
string comparison.

* changes in libfbuilder: eliminated excessive use of dynamic_cast
and long chains of "if" comparing object type names in
FWObjectDatabase in methods that create new objects of given type.
2008-12-25 20:38:53 +00:00

7869 lines
325 KiB
Plaintext
Raw Blame History

2008-12-25 vadim <vadim@vk.crocodile.org>
* All policy compilers: using FWObjectDatabase::createClass
methods to create rules and other objects in compilers wherever
the type is known at the (code) compile time. This makes code
cleaner and speeds it up a little because of eliminated cast() and
string comparison.
* changes in libfbuilder: eliminated excessive use of dynamic_cast
and long chains of "if" comparing object type names in
FWObjectDatabase in methods that create new objects of given type.
2008-12-23 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printSrcAddr):
implemented feature req. #2353737 "use -m iprange". Using module
iprange for AddressRange objects if iptables version is set to
>=1.2.11.
2008-12-21 vadim <vadim@vk.crocodile.org>
* SSHSession.cpp (SSHSession::heartBeat): built-in installer
periodically "pings" the other end to keep ssh session alive. This
helps recreate state in the firewall state table if it is cleared
when rules are reloaded, which in turn prevents installer from
hanging.
* PolicyCompiler_pf.cpp (PolicyCompiler_pf::addDefaultPolicyRule):
Deprecated options "generate commands for both in and out" and
"pass all outgoing" in compiler for PF. Before, user could choose
whether compiler was to generate only commands to match inbound
packets or both inbound and outbound. The distinction between
these two modes became very minimal in the recent versions of
fwbuilder because algorithm was mostly controlled by the setting
of "direction" in the policy rules. Now these two options have
been removed completely, the behavior of the compiler is as if
option "generate both in and out" was used.
* pf.cpp (main): Compiler can add command "pfctl -F states" after
command "pfctl -f file.conf" to flush states that existed in
memory from sessions opened prior to the policy reload. The reason
is that some of these sessions might be denied by the new policy,
but if state is not flushed, they will still work after policy
reload. This is optional and is controller by checkbox in the
"Script" tab of the "advanced" settings dialog for the PF
firewall.
2008-12-20 vadim <vadim@vk.crocodile.org>
* PrintingController.cpp (PrintingController::addObjectsToTable):
fixed bug #2388067: "Print out FWB 3.0.3 not ok". File/Print
function failed to print objects used by rules of the firewall.
2008-12-19 vadim <vadim@vk.crocodile.org>
* ProjectPanel_file_ops.cpp (ProjectPanel::loadFile): Implemented
feature request #2412323: "feature request: command line flag to
skip RCSFilePreview". New command line switch "-r" makes the GUI
automatically open RCS head revision of the file given on command
line if the file is in RCS. If the file is not in RCS, the new
switch does nothing and the file is opened as usual.
2008-12-18 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::renameGroup): fixed bug #2412310:
"Umlauts in group names". The GUI should properly handle non-ascii
characters in the rule group names
2008-12-15 vadim <vadim@vk.crocodile.org>
* ipt.cpp, ipfw.cpp, pf.cpp, iosacl.cpp: changes for FR #2431602:
support for rulesets configured as "dual address family", that is,
rulesets that should be compiled for both ipv4 and ipv6. Compiler
processes rulesets like this twice, first for ipv4 and then for
ipv6. On each pass it will only use address and service objects
that match address family it uses for the ruleset. This also
applies to "compile-time" DNSName objects, that is, it will use
getaddrinfo() to get AF_INET address on ipv4 pass and AF_INET6 on
ipv6 pass.
Rules with "any" in rule elements in the "dual address family"
ruleset yield iptables commands for both families. This was the
reason I made setting exclusive in the first place. This means
that users who do not want fwbuilder to generate ipv6 policy for
them and want all ipv6 accepted, should not use "dual address
family" setting. If the do, the bottom catch-all rule will install
ip6tables command to block all ipv6 automatically even if all
rules have absolutely no ipv6 objects at all.
* RuleSetDialog.cpp (RuleSetDialog::applyChanges): implemented
feature request #2431602: "Feature request: Unified
policies (IPv4/v6)". RuleSet object now has two variables that
define which address family it should be compiled for - ipv4 or
ipv6. It is possible to have both set, in which case the same
ruleset will be compiled for both address families.
2008-12-13 Vadim Kurland <vadim@vk.crocodile.org>
* VERSION (VERSION): started v3.0.4
* v3.0.3 released, merged to trunk. This comment is -r689
2008-12-08 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::contextMenu): fixed bug #2407141
"label markers". Color label text set in Preferences was not used
in the contet menus where user can actually apply those colors to
rules.
* RCS.cpp: fixed bug #2405909: "Umlauts in RCS log". RCS log is
stored in RCS file in Utf8, need to convert it back from Utf8 on
read. Technical note: rcs tools on windows do not seem to process
properly rcs comments converted with toLocal8Bit, comment text
comes out as '????' when inspected with rlog.exe from the command
line. Comment text stored in Utf8, on the other hand, appears
intact even though it can not be read in the output of rlog.exe.
2008-12-07 Vadim Kurland <vadim@vk.crocodile.org>
* FWObjectDatabase_tree_ops.cpp (_recursivelyCopySubtree): (change
in libfwbuilder) additional fixes in algorithm that recursively
copies object subtree between different data files. Making sure we
do not create duplicates of groups referred to by other groups.
* ObjectManipulator.cpp (ObjectManipulator::pasteObj): changes to
speed up GUI when user copies many objects between different data
files (do not reload and redraw object tree widget until last
object is copied). Refactoring of the pasteObj to keep the same
object ID mapping table for the duration of the bulk paste
operation, this helps deduplicate objects. Also using the same
".copy_of_NNNN" object attribute to deduplicate objects.
2008-12-06 Vadim Kurland <vadim@vk.crocodile.org>
* iptables.g: Changes in grammar for iptables: removed
ambiguitiesin parser; added lexer rules for elements of ipv6
address. Rules for IPV6 address parsing do not work yet, commented
out as work in progress. No new functionality in the parser for
iptables, only clean-up and preparations for ipv6.
2008-12-05 Vadim Kurland <vadim@vk.crocodile.org>
* InetAddr.cpp (InetAddr::toString): (change in libfwbuilder):
Should use bits==128 because inet_net_ntop_ipv6 on FreeBSD applies
mask constructed from the bits argument to the result, so with
bits==0 it always returned "::/0"
2008-12-04 Vadim Kurland <vadim@vk.crocodile.org>
* ProjectPanel.cpp (ProjectPanel::closeEvent): (fixed bug (no #):
need to check if object in the object editor panel has been
modified and needs to be saved when user closes internal window
using "close" button in its title bar.
* FWWindow.cpp (FWWindow::closeEvent): fixed bug (no #): GUI
crashed if user closed internal window so no object files were
left open, then closed application using "close" button in the
main window title bar.
2008-12-03 Vadim Kurland <vadim@vk.crocodile.org>
* iosacl.g (certificate): fixed bug #2334007: "Problem parsing
Cisco config". Parser now recognizes IOS configuration lines
"certificate", "ip community-list", "controller
... description". These lines are recognized and ignored, they
should not stop parser from processing the rest of the
configuration.
* ipt.cpp (main): fixed bug #2378672: "fwb 3.0.2 build 676
iptables script is not executable". Generated .fw file should have
executable permissions.
2008-12-02 Vadim Kurland <vadim@vk.crocodile.org>
* FWObjectDatabase_tree_ops.cpp (recursivelyCopySubtree): (change
in libfwbuilder) fixed bug #2375327: "Crash copying multiple
groups between different data files". Using better algorithm to
copy objects between different data files.
* ObjectManipulator.cpp (ObjectManipulator::duplicateWithDependencies):
using FWObjectDatabase::recusrivelyCopySubtree() to copy objects if
they are located in different data files.
* FWObjectDatabase_tree_ops.cpp (_recursivelyCopySubtree): (change
in libfwbuilder) Implemented additional check for object
duplicates while copying objects. The problem happened when
several object were copied in a batch operation (e.g. when user
selected several objects in the GUI and then used copy/paste to
copy them all). If some of these objects were groups that referred
to other objects from the same batch, the program would copy the
object and then create another copy of it when it copied the group
using it. To avoid such multiplication it now creates special
hidden attribute in the object when it makes a copy to keep track
of the original object. When the same original object needs to be
copied again, the program can find its copy in the target data
tree using this attribute. This creates another problem because
the attribute used to track original object is persistent for the
duration of the program run. The scenario that leads to this is as
follows: user copies object A, modifies it and then copies group B
using the orignal of A. The end result is that the program does
not recognize that the copy of A has changed and makes copy of
group B use it anyway. This means the new group points at modified
object A. This can not be easily fixed because we do not have
"last_modified" attribute in each object.
2008-12-01 vadim <vadim@vk.crocodile.org>
* Started v3.0.3
* v3.0.2 released, merged -r565:676 to trunk. This changelog
record is in rev 678
2008-11-28 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::prepareFileMenu): fixed bug #2353052
"fwbuilder crashes on import without open object file". Fixed in
rev 676.
* ipt.cpp (dumpScript): fixed bug 2356131 "Iptables-restore option
broken for multiple policy sets". If firewall was configured to
use iptables-restore to activate policy and if it had two or more
policy rule sets, compiler used to put "echo COMMIT" line at the
bottom of each ruleset. This was incorrect, iptables-restore
expects only one COMMIT line at the end of each table. Fixed in
rev 675.
2008-11-28 User Vadim <vadim@vk.crocodile.org>
* InetAddr.cpp (InetAddr::toString): (change in libfwbuilder) Our
included copy of inet_net_ntop does not add "/netmask" to IPv6
addresses if argument #3 is -1 (bits). However, the same function
included in libc on FreeBSD returns EINVAL for bits=-1. It appears
the function in libc in FreeBSD is based on the same code as our
copy, but has been updated and instead of doing check "if ((bits <
-1) || (bits > 128))" probably checks for (bits < 0). Because of
this, fwbuilder GUI crashed when user tried to create IPv6 network
object on FreeBSD. To fix, will use bits=0 in call to
inet_net_ntop in InetAddr::toString and then strip /0 that
inet_net_ntop adds to the generated string. Both our copy of
inet_net_ntop and the one shipped with FreeBSD add "/0"
consistently, so this works on all platforms.
2008-11-26 Vadim Kurland <vadim@vk.crocodile.org>
* IPTImporter.cpp (IPTImporter::pushRule): fixed crash in the
importer for iptables
* iptables.g (m_comment): rudimentary support for iptables module
"comment"
2008-11-24 Vadim Kurland <vadim@vk.crocodile.org>
* tcpservicedialog_q.ui: fixed bug #2333759: "A really small camp".
Fixes in dialog layouts for KDE4 theme Oxygen
* Build fixes for FreeBSD.
* Added GUI elements for krcmd and ekshell options for ipfilter
Thanks to Cy.Schubert@komquats.com for the patch!
* Using QT4 stylesheet to improve layout of TCP Service, UDP
Service and group object dialogs when program is used with KDE
theme Oxygen.
2008-11-23 Vadim Kurland <vadim@vk.crocodile.org>
* Help.cpp, StartTipDialog.cpp: the GUI will use English help
files for online help (where available) and "start tip" dialog if
it is started in the non-enligsh locale and help file for this
locale inot available. This is better than to show an empty
dialog.
2008-11-22 vadim <vadim@vk.crocodile.org>
* StartTipDialog.cpp (StartTipDialog::StartTipDialog): Added
"start tip" dialog that shows brief information on the online
resources available to the user (web site URL, links to the
Firewall Builder FAQ, HOWTOs, Cook Book). Linked pages open in the
standard browser.
* FWWindow.cpp: added menu item Help/Firewall Builder Help that
opens a page with information about online resources for Firewall
Builder (the same page that is shown in the "start tip" dialog).
* ipf.cpp (main): fixed bug #2328330: "basic_string::erase error
in fwb_ipf". Compiler for ipfilter aborted processing with error
"basic_string::erase" when compilation was launched from the GUI.
2008-11-21 vadim <vadim@vk.crocodile.org>
* Improved Mac OS X bundle: included qt.conf file to make it look
only inside the bundle for QT libraries and plugins, this
eliminated warnings about QT libraries being loaded from two
places if the system where fwbuilder GUI was running had QT
installed on it. Now packaging QT accessibility plugin library,
this should make the GUI run with acessibility features if
accessibility aids are turned on system-wide.
2008-11-20 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printLogPrefix): fixed
bug #2318639: "bug in logging (rule number)". Added logging prefix
macro %R that gets expanded to the ruleset name. This can be
useful in logging prefixes for rules in branch rulesets.
2008-11-19 vadim <vadim@vk.crocodile.org>
* printerStream.cpp (printerStream::begin): fixed printing with QT
4.4. QT 4.4 correctly sets physical resolution of the printer and
sets its logical resolution to 1200dpi. This caused rulesets to be
printed incorrectly on Windows and Mac where we use QT 4.4.1. This
fix restores printing on these platforms.
* Printing from command line: user can print firewall object and
all its rulesets from command line without running the program in
interactive GUI mode using command line
"fwbuilder -f file -P fw_object -o print_output_file.pdf". Making
sure this works on Mac OS X as well where the program should be
launched as "fwbuilder3.app/Contents/MacOS/fwbuilder"
* RuleSetView.cpp (RuleSetView::updateGroups): fixed printing from
command line which was broken some time ago (perhaps in
3.0.1). When user prints firewall policy from command line using
"fwbuilder -f file -P fw_object" all rule groups are always
printed expanded.
2008-11-18 vadim <vadim@vk.crocodile.org>
* prefsdialog_q.ui: better layout of the first page of Preferences
dialog to make sure long path to the working directory fits in the
input widget.
* SSHPIX.cpp (SSHPIX::stateMachine): bugfix: installer for Cisco
routers and PIX could not find generated file because variable
conffile is now always a full absolute path. This bug was
introduced earlier during installer rewrite for v3.0.2. Tested
installer for router and PIX using default generated file name, as
well as custom generated file name, defined both as absolute and
as relative path. Tested batch install of combination of a router
and a pix in one batch (the same user account, then same enable
password on both)
2008-11-17 Vadim Kurland <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator::duplicateObject): fix
bug #2303486: "Operation of duplicating firewall should switch
policy". When firewall object is duplicated, the GUI should
automatically open policy of the new object rather than keep
policy of the original open. At the same time, reset lastModified,
lastCompiled, lastInstalled of the new firewall instead of keeping
copies from the original.
* instDialog.cpp (instDialog::testFirewall): Check to make sure
paths to ssh and scp utilities are properly configured in
Preferences before running install. Show aprropriate error dialog
to the user if path to ssh or scp is not configured.
2008-11-15 Vadim Kurland <vadim@vk.crocodile.org>
* antlr/CharScanner.hpp: applied patch for gcc 4.4 from bug#
2282828 "patch for gcc-4.4"
* AddressTable.cpp (AddressTable::AddressTable): (change in
libfwbuilder) fixed bug# 2293052 "Saving file with empy
AddressTable produces corrupt XML". When new AddressTable object
is created, its "filename" attribute is empty. If data file was
saved right after such new AddressTable object was created,
resultant file could not be loaded back into the program becaise
it violated XML DTD.
2008-11-13 Vadim Kurland <vadim@vk.crocodile.org>
* IPTImporter.cpp (IPTImporter::pushPolicyRule): policy importer
for iptables properly creates TagService objects and places them
into action of the rule finds iptables rule with target "-j MARK"
* IPTImporter.cpp (IPTImporter::pushPolicyRule): policy importer
for iptables correctly imports user-defined chain, configures rule
with action "Chain" and establishes association between it and
ruleset created for the user-defined chain. Multiple rules with
this action can point at the same ruleset.
2008-11-12 Vadim Kurland <vadim@vk.crocodile.org>
* IPTImporter.cpp (IPTImporter::finalize): fixed bug (no #):
policy importer used to create separate Policy objects for chains
INPUT, FORWARD, OUTPUT.
* CircularQueue.hpp (OFFSET_MAX_RESIZE): a temporary fix for the
problem in ANTLR that causes crash on import of very large config
files. This affected import of both iptables and Cisco IOS
configurations and depended just on their size.
2008-11-10 vadim <vadim@vk.crocodile.org>
* instOptionsDialog.cpp (instOptionsDialog::instOptionsDialog):
for bug #2135827: "'Store a copy of fwb file...' very slow" -
need to enable option "store copy of data file on the firewall"
for the batch install.
* RuleSetDialog.cpp (RuleSetDialog::applyChanges): fixed bug
#2255591 Adding new ipv6 policy is always type "mangle". When user
added new Policy object to the iptables firewall and made and
saved any changes in the object editor (switched to "top rule set"
or toggled setting "filter+mangle"="mangle only"), the setting of
the ruleset would switch to "mangle only" and stick there. There
was no way to switch it back to "filter+mangle". This is fixed in
build 641.
2008-11-09 <vadim@vk.crocodile.org>
* Added updated Japanese translation by Tadashi Jokagi ( elf2000 )
from bug #2214440
* FirewallInstallerUnx.cpp(FirewallInstallerUnx::packInstallJobsList):
fixed a bug introduced some time earlier and reported in the bug
report #2135827: policy installer would only copy .fwb file to the
firewall when "Store data file on the firewall" was activated and
skipped actual generated policy file(s) (.fw). This only happened
on Windows.
2008-11-01 vadim <vadim@vk.crocodile.org>
* fwbuilder/Rule.cpp (PolicyRule::PolicyRule): a bugfix in the
PolicyRule class, fixes errors in some operations in policy
compilers that were caused by switch to a more efficient way to
find rule element objects in rules.
2008-10-30 vadim <vadim@vk.crocodile.org>
* Added Japanese translation by Tadashi Jokagi ( elf2000 )
Translation converted from the .po file generated for
fwbuilder 2.1.19. Since translation was done for the old version
of the product, it is incomplete, however at least menus seem
to be translated.
* ObjectIconView.cpp (ObjectIconView::event): fixed bug #2209210
"crash in fwbuilder: ObjectIconView.cpp:90:". The GUI crashed if
user moved mouse cursor over object icons in a group object editor
when tooltips were activated.
2008-10-26 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::setRuleColor): making sure no rule
operations are allowed when rule set or parent firewall object are
read-only. This fixes GUI crash that happened when user tried to
remove rule from a group in the read-only firewall.
2008-10-25 vadim <vadim@vk.crocodile.org>
* ProjectPanel_file_ops.cpp (ProjectPanel::loadFromRCS): more
fixes for bug #2194829: use toLocal8Bit() instead of toLatin1() in
all calls to libfwbuilder functions that deal with
files (FWObjectDatabase::load() etc.), as well as system functions
such as unlink(), rename(), access(). Now I can open, save, check
out and check in file if it is in directory with non-ascii name
and also can use non-ascii characters in RCS checkin log records.
* instDialog_compile.cpp (instDialog::prepareArgForCompiler):
fixed bug #2194829: "the gui can not locate data file in non-ascii
directory". This seems to have happened only on Windows and Mac;
if data file was located in the directory with the name with
non-ascii characters, the gui generated incorrect command line for
the compiler when user tried to compile the data file more than
once.
2008-10-23 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (isChainDescendantOfOutput): more for the
bug #2186568 "Again User service - group/negate". Support for
groups of user service with negation. Now have a framework to keep
track of chain "descendants", so that compiler can tell if some
chain can be traced back to INPUT or OUTPUT through the sequence
of chains calling each other.
2008-10-22 vadim <vadim@vk.crocodile.org>
* various dialogs: fixed bug #2187094: "fwbuilder does not use
system colors for text boxes". Some dialogs would not properly
pick up KDE theme. This was especially visible if theme used dark
background colors and white font, in which case many input fields
in dialogs would use white text on white background.
* PolicyCompiler_ipt.cpp (separateUserServices::processNext):
fixed bug #2186568 "Again User service - group/negate". Compiler
for iptables did not support groups and negation of the
UserService objects.
2008-10-21 vadim <vadim@vk.crocodile.org>
* PolicyCompiler.cpp (PolicyCompiler::checkForShadowing): (change
in libfwbuilder) Optimisations in the code that detects rule
shadowing. Combined with improvements in classes Rule and
RuleElement, this yields speed-up in shadowing detection by a
factor of about 5.
2008-10-20 vadim <vadim@vk.crocodile.org>
* PolicyCompiler.cpp (PolicyCompiler::checkForShadowing): (change
in libfwbuilder) Using internal caching to speed-up shadowing
detection. This cuts time of shadowing detection almost in half
for large policies with many rules.
* dns.cpp (list): (change in libfwbuilder) getHostByName() used to
insert duplicate IP addresses into the list of the results. Now
making sure ip addresses in the result are unique.
* Compiler.cpp (Compiler::_expand_addr_recursive): (change in
libfwbuilder) change in the algorithm used to decide which
interfaces of the host or firewall object to use in a rule when
this host or firewall object is found in source or
destination. Previously, compiler would skip loopback interface
unless user associated the rule with loopback by putting it in the
"Interface" rule element. This made it impossible to create rules
with address 127.0.0.1 in destination but attached to interface
other than loopback (such rule is used for transparent proxy
configuration). Now if user explicitly put loopback interface
object into rule element, we always keep it. However when compiler
expands interfaces from a host or firewall object, it will skip
loopback as before, unless the rule is attached to loopback
interface.
2008-10-19 vadim <vadim@vk.crocodile.org>
* fixed object type icon in the RuleSet and Interface object dialogs.
* ProjectPanel.cpp (ProjectPanel::openEditor): fixed bug: object
editor panel resized itself erratically when user switched between
objects while editor was open. This happened on Windows and Mac OS
X.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval):
fixed bug #2180556: "broken support for the "old" time module for
iptables". Compiler generated incorrect parameters for the "time"
module for versions <1.4.0
2008-10-18 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (singleDstNegation::processNext): while
processing single object negation, consider hosts and firewalls
with one normal interface and loopback interface
eligible (i.e. ignore loopback address even though formally such
object has at least two ip addresses).
* PolicyCompiler_ipt.cpp (singleDstNegation::processNext): fixed
bug (no #): policy compiler for iptables did not handle correctly
rules where a host that has multiple addresses was a single object
in a rule element and had negation.
* NATCompiler_ipt.cpp (singleObjectNegation::processNext): added
support for single object negation in OSrc and ODst in NAT rules.
This provides for more compact iptables script in the often used
case where single object is used with negation in these elements
of a NAT rule. Other improvements in handling NAT rules with
negation.
2008-10-15 vadim <vadim@vk.crocodile.org>
* ipt.cpp (dumpScript): Explicitly use "\n" instead of endl to
avoid implicit conversion to "\r\n" on Windows (generated script
is for iptables which can only run on Linux, so it is safe to use
"\n" instead of endl).
2008-10-13 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (PolicyCompiler_ipt::compile): fixed
bug (no #): policy compiler for iptables would crash with
assertion when AddressTable or DNSName object was used in a rule
in pure mangle table ruleset. This could be related to crash
reported in bug #2157121.
2008-10-11 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (finalizeChain::processNext): Always
placing rules with action "Accept" in table mangle in chain
PREROUTING
* RuleSetDialog.cpp (RuleSetDialog::loadFWObject): Added attribute
to the Policy object for iptables to indicate that this policy
ruleset should be compiled into filter and mangle tables or only
for the mangle table. This makes sense (and is only shown) for
iptables firewalls. By default the attribute is set to
"filter+mangle" which means compiler will try to figure out which
table each rule should go to. However some combinations of service
objects and actions are ambiguous and can be used in both filter
and mangle tables. In cases like these, user can help by creating
separate Policy ruleset that will be translated only into iptables
rules in the mangle table.
* PolicyCompiler_ipt.cpp (singleSrvNegation::processNext): fixed
bug #2148378: "Negation does not work on Tag Service". Policy
compiler for iptables should be able to use "!" single-object
negation for TagService obejcts
* ObjectTreeView.cpp (ObjectTreeView::updateTreeItems): fixed bug
#2149503: ever since attribute "read-only" of FWObject has been
converted from a dictionary entry to a member variable, the GUI
could not properly check if an object is read-only and could not
update context menu and icon in the object tree. This lead to
unstable behavior when an object was set read-only because the GUI
could not show corresponding icon to indicate its status change,
did not switch context menu items and permitted operations that
should not have been permitted.
* ProjectPanel.cpp (ProjectPanel::getDeleteMenuState): fixed bug
#2149585 "Deleting Routing object breaks file". The GUI should not
allow the user to delete "Routing" ruleset object, as well as any
other top-level ruleset object. This applies to both deleting them
via context menu item or Delete key stroke.
* PolicyCompiler_ipt.cpp (PolicyCompiler_ipt::newIptables): fixed
bug #2151898: "use of "--icmp-type any" iptables 1.2.6a". Iptables
v1.2.6a and older do not have option "-m icmp --icmp-type any".
* PrefsDialog.cpp (PrefsDialog::PrefsDialog): Added tab "Data
File" to the Preferences dialog; added checkbox "Enable data file
compression" to this tab. If this checkbox is turned on, the GUI
will compress data file when it is saved to disk.
* FWBSettings.cpp (FWBSettings::getCompression): saving data file
compression flag in user settings.
* ProjectPanel_file_ops.cpp (ProjectPanel::exportLibraryTo): added
support for data file compression. This fixes bug# 2130128: "Option
to compress the FWB file".
* pix.pro, iosacl.pro: should be ../../install.sh rather than
../../install
2008-10-10 User Vadim <vadim@vk.crocodile.org>
* FirewallInstallerUnx.cpp: fixed bug #2158561: "Solaris fwb 3.0.2-b599
build prob" Fixed build problems on FreeBSD and Solaris
* pix.pro, iosacl.pro: fixed bug #2158407: "iosacl and pix install
probs"
2008-10-10 Vadim Kurland <vadim@vk.crocodile.org>
* iosacl.cpp (main): fixed bug #2154906 "Post script is missing /
Cisco ACL handling". Prolog/epilog sections were not added to the
generated script for Cisco IOS ACLs.
2008-10-09 vadim <vadim@vk.crocodile.org>
* ipt.cpp (main): Compiler for iptables uses QT functions to
properly process non-ascii file names and firewall object
names. Compiler correctly creates generated script when its file
name contains non-ascii characters on all supported OS. The GUI
can find the file and built-in installer can copy it to the
firewall and activate it there. QT helps manage encodings and
locales in OS-independent manner. Caveats:
- Dependency on QT libraries means compilers can not be deployed
on the firewall separately from the GUI.
- pscp.exe on Windows does not seem to be able to pick up file
with non-ascii characters in name when program runs on Windows
with standard English locale. Could not test on Windows running
with national locale. As a workaround, user can specify
alternative name for the generated script in the firewall settings
dialog (tab "Compiler").
- Support for non-ascii firewall object and generated script
names is currently only available in compiler for iptables
* instDialog_compile.cpp (instDialog::prepareArgForCompiler):
always provide "-o" command line option to compilers when calling
them from the GUI. The output file name defined this way can be
encoded properly for the OS encoding and locale (compilers do not
use QT so it is hard to do there).
2008-10-08 vadim <vadim@vk.crocodile.org>
* merged branch "new-installer" -r569:HEAD
* PrefsDialog.cpp (PrefsDialog::accept): Added GUI control for the
path to scp utility used by built-in policy installer
* All compilers: firewall object can be specified by its ID in
addition to by name. Command line option "-i" tells compiler that
the last parameter of the command line is object ID. This works
reliably when firewall object name contains non-ascii characters
and the program runs under locale using 8 bit characters. Built-in
installer now uses this method while calling all policy compilers.
2008-10-07 vadim <vadim@vk.crocodile.org>
* pf.cpp, ipf.cpp: Policy compilers for pf and ipf use file name
and path specified with "-o" command line option for the name and
path for all .fw and .conf files they generate.
* instDialog.cpp: built-in installer finds all generated files
when user specifies alternative name (possibly full path) for the
generated script.
* FirewallInstaller.cpp (FirewallInstaller::getGeneratedFileFullPath):
built-in installer works properly when firewall name contains
non-english characters. In this case generated firewall script
also has name that contains non-english characters.
* FWWindowPrint.cpp, RuleSetView.cpp, FWBSettings.h,
ProjectPanel_state_ops.cpp: got rid of references to
InterfacePolicy class; build fixes for FreeBSD 7 (should fix
compile problems on other systems too, such as Solaris)
2008-10-06 vadim <vadim@vk.crocodile.org>
* SSHPIX.cpp (SSHPIX::stateMachine): fixed crash in built-in
installer that happened when existing PIX configuration was saved
before loading new one.
* pixAdvancedDialog.cpp (pixAdvancedDialog::accept): fixed crash
that happened when user opened PIX firewall "advanced" settings
dialog and then tried to save changes by clicking OK.
* FirewallInstaller.h (class FirewallInstaller): all installer
logic moved to separate classes FirewallInstaller,
FirewallInstallerCisco and FirewallInstallerUnx. These classes
launch background process (via SSHSession or QProcess) and control
all steps of policy installation and activation, but do not deal
with the UI. This provides for good separation of functions
between UI and core logic classes. The code is much cleaner and
easier to maintain now.
2008-10-05 vadim <vadim@vk.crocodile.org>
* instDialog_unx.cpp (instDialog::copyFileOnUnx): Using
scp (pscp.exe on windows) to copy files to the firewall. This
helps improve performance of the installer. This fixes bug
#2135827: "Store a copy of fwb file..." very slow
* instDialog.cpp (instDialog::instDialog): refactored installer
classes to make code more manageable.
* VERSION: started 3.0.2
2008-10-04 Vadim Kurland <vadim@vk.crocodile.org>
* v3.0.1 released Oct 4, 2008. Merged branch "v3" r513:565 to trunk
* global.h (SETTINGS_PATH_PREFIX): making sure all modules store
settings under the same path prefix "3.0/" (applies to all OS).
2008-10-03 Vadim Kurland <vadim@vk.crocodile.org>
* GroupObjectDialog.cpp (GroupObjectDialog::iconContextMenu):
fixed bug #2144122 "Segfault when trying to add an address to a
group"
* ProjectPanel_file_ops.cpp (ProjectPanel::chooseNewFileName):
fixed bug #2144358 "Double check with 'save as'". The GUI used to
ask twice if user wants to overwrite the file in Save As operation
if file with given name already existed.
* FWWindow.cpp (FWWindow::projectWindowClosed): fixed bug #2144114
"fwbuilder * exits if the last object file is closed". The GUI
will not terminate after the last window is closed but instead
will just show empty main window.
* fwbedit.cpp (main): fixed bug #2143894: "fwbedit list does not
show objects". Command "fwbedit list -f file" did not print
anything unless option "-F" was supplied. This change adds default
value for this option so that when it is missing, the command
prints object path.
* fwbedit.1: fixed bug #2143961: a typo in the man page fwbedit.1
2008-10-02 Vadim Kurland <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::finishInstall): fixed bug #2125604:
"Cancel button does not kill the installer". Cancel button of the
installer wizard in fact kills background process. Second issue
raised in this bug report is that "Finish" button was always
enabled. This is now fixed.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTarget): fixed
bug #2141911: "no ULOG for ip6tables". ULOG target has not been
implemented for ip6tables yet, so the compiler should fall back to
LOG target while compiling ipv6 policy.
* RuleSetView.cpp (RuleSetView::updateGeometries): fixed crash
that happened on Ubuntu with QT 4.3.x because of recursive call to
updateGeometries()
* fixed icon for rule action "Mark"
2008-09-30 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (PolicyView::PolicyView): constructors of rule
set view classes (PolicyView, NATView, RoutingView) used to set
"dirty" flag in the object database which caused the GUI to ask
the user if they wanted to save modifications before exisitng the
program even when there were no modifications made. This change
fixes this annoying problem.
2008-09-29 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::updateGroups): using setSpan to
make row holding rule group head span across all columns. Without
this, clicking on table cell in column >1 caused visual
artifacts (cell color would turn white, possibly erasing part of
the group name).
* FindWhereUsedWidget.cpp (FindWhereUsedWidget::showObject): fixed
bug #2129726: "Where Used" not working on collapsed groups.
* RuleSetView.cpp (RuleSetView::paintEvent): fixed bug related to
#2123152 "Fwbuilder 3.0.0 Gui very slow and doesn't refresh
properly". There seems to be a bug in QT 4.4.1 (not sure of 4.4.0,
definitely not in 4.3.x) which causes the last row of the rule set
view table to come out blank when the table is redrawn. This
happens when rows have very different height and looks like the
last row comes out blank when user scrolls the table up. The last
row is finally redrawn when most of it is already visible.
2008-09-26 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::_printAF): fixed
bug (no #): policy compiler for PF used to insert both "inet" and
"inet6" into generated pf.conf lines for the IPv6 policy.
* RuleSetView.cpp (RuleSetView::getFullRuleGroupTitle): Added
tooltip in the rule set view for the column showing rule group
handle, the tooltip shows group name and number of rules.
2008-09-25 Vadim Kurland <vadim@vk.crocodile.org>
* FirewallDialog.cpp (FirewallDialog::openFWDialog): fixed bug
#2105977: "Viewing firewall settings change state to
edited". Opening firewall "advanced" settings dialog triggered
internal flag that signalled that something in the object tree has
changed.
* FWObject.cpp (FWObject::setInt): (change in libfwbuilder) fixed
bug #2128261: "fwbuilder thinks the file has changed when opened
read-only". Operation "find where used" triggered "dirty" flag on
the object tree even though it does not change anything.
* NetworkDialog.cpp (NetworkDialog::addressEntered): Network and
NetworkIPv6 object dialogs accept CIDR notation in the "address"
input field. Netmask input field is filled automatically using
"/NN" entered as part of the address when user hits Return or Tab
or switches to another input element using mouse click.
* ProjectPanel_file_ops.cpp (ProjectPanel::saveIfModified): fixed
GUI crash that happened when user made modifications in the
default object tree but did not save the changes and then tried to
exit the program.
* FWBTree.cpp (FWBTree::createNewLibrary): fixed bug #2126524:
"User Service created in the Service Group section".
* objects_init.xml.in: bug #2126524: "User Service created in the
Service Group section" - added missing group UserServices to the
standard objects file.
2008-09-24 Vadim Kurland <vadim@vk.crocodile.org>
* Network.cpp (Network::Network): (change in libfwbuilder) set
netmask to /32 when new Network object is created. This used to be
the default in fwbuilder v2.1. New default of 0.0.0.0 appears to
be confusing and error-prone, by user's requests changing default
back to /32. This fixes bug #2125542: New Address objects added
with netmask of "0.0.0.0"
* FWObjectPropertiesFactory.cpp (getObjectProperties): do not
print netmask of the IPv4 and IPv6 objects in tooltips and "info"
panel unless such object is child of an Interface. This fixes bug
#2125542: New Address objects added with netmask of "0.0.0.0"
* RuleSetView.cpp (RuleSetView::updateGeometries): fixed bug
#2124804: "Policy list "jump" when using groups". Combination of
rule groups and very tall rows in the rule set view caused
problems with vertical scrolling.
2008-09-23 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::insertRule): fixed bug #2123150:
"add new rule below inserts at end of rulebase". The program used
to append rule at the bottom of the policy when user tried to
insert it n the middle when there were rule groups.
* RuleSetView.cpp (RuleSetView::saveCollapsedGroups): fixed bug #
2106266: "Save collapse/expand state of groups in policy". The GUI
will remember state of the rule groups (expanded/collapsed)
between sessions. The state is saved in preferences. Groups are
referenced by combination of file name (full path), firewall object
name, ruleset name, group name. Since state is saved in
preferences rather than in the data file, state of the rule groups
is separate for each user.
2008-09-21 Vadim Kurland <vadim@vk.crocodile.org>
* NATCompiler_pix.cpp (mergeNATCmd::processNext): fixed crash in
compiler for PIX that happened when compiler tried to merge
"global" commands and some of the interfaces of the firewall had
dynamic address.
* FWObject.cpp (FWObject::fromXML): (change in libfwbuilder)
converted attribute "ro" (read-only) from a dictionary variable to
the member variable of class FWObject. We check read-only status
of objects very often and dictionary lookups were slowing compiler
down considerably.
* FWObjectDatabase.cpp (FWObjectDatabase::getStringId): (change in
libfwbuilder) generate unique string object id on demand instead
of in the call to generateUniqeueId. This helps speed up compiler
operations by a factor of about 3 because we generate unique int
ID every time object is created or copied, yet string ID is only
needed when object is stored in external XML file. Also using
sprintf to assemble string ID, it works faster than ostringstream.
* RoutingCompiler.cpp (reachableAddressInRGtw::processNext): (change
in libfwbuilder) fixed crashes in RoutingCompiler that happened
because Routing ruleset object being processed is disconnected
from the firewall parent at the time compiler works with it.
* RoutingCompiler.cpp (rItfChildOfFw::processNext): (change in
libfwbuilder) fixed compiler error "Error (iptables): The object
"eth0" used as interface in the routing rule 0 (main) is not a
child of the firewall the rule belongs to!" that also happened
because Routing ruleset object being processed is disconnected
from the firewall parent at the time compiler works with it.
2008-09-19 Vadim Kurland <vadim@vk.crocodile.org>
* ipfw.cpp (main): Basic suport for IPv6 for ipfw. IPv6 rules
should be kept in a separate policy, just like for all other
platforms. Branching rules are not supported so there is no
support for multiple policies (although there is no check for that
at this time either). Both ipv4 and ipv6 rules are loaded into the
same ipfw set "1" with globally unique increasing rule
numbers. The order in which ipv4 and ipv6 policies are processed
is controlled by an option in firewall settings dialog.
* FWWindow.cpp (startupLoad): Using list of strings openDocFiles
to pass names of the files that should be opened at start up time
both when these names come from the command line and from odoc
signal handler on Mac. This finally makes the GUI properly open a
file given on the command line or via odoc signal (double clicking
in Finder on Mac) in a single sub window, replacing default
objects tree.
2008-09-16 Vadim Kurland <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::fileOpen): when the program is started
without data file, it shows panel with just default objects, with
a title "Untitled". If user opens data file, it is loaded into the
same panel and its title changes accordingly. If user makes
changes and then saves using "Save As", its title also changes
accordingly (and there is still one panel). If user uses "File/New
data file" and enters the name of the new data file, it is loaded
into the same panel and its title changes accordingly. Still,
after this there is only one panel. However if the panel shows
contents of some data file, operations "File/Open" and "File/New"
load second data file into a new panel.
2008-09-16 vadim <vadim@vk.crocodile.org>
* IPv4.cpp (IPv4::fromXML): (change in libfwbuilder) filter
addresses and strip leading and trailing whitespaces and other
non-digit characters before converting to InetAddr. This will help
with annoying problem where v2.1 allowed such characters in
address attributes of Address objects but v3.0 applies strict
checks during file load and rejects such data files.
2008-09-15 vadim <vadim@vk.crocodile.org>
* ProjectPanel_file_ops.cpp (ProjectPanel::fileOpen): workaround
for a problem that only appears on Mac: if user uses File/Open but
cancels operation, the main window used to switch from the
subwindow that was active to another one (usually the empty
default window with only standard objects tree).
* FWWindow.cpp (FWWindow::FWWindow): Experiment: since MDI looks
very foreign on Mac and can not be fixed, trying tabbed
presentation of internal subwindows. Only on Mac OS X.
2008-09-14 vadim <vadim@vk.crocodile.org>
* DiscoveryDruid.cpp, debugDialog.cpp, filePropDialog.cpp: enable
"close" button in the dialog window title (it was not shown on
Mac).
2008-09-14 Vadim Kurland <vadim@vk.crocodile.org>
* ProjectPanel_state_ops.cpp (ProjectPanel::loadLastOpenedLib):
change in the logic applied when the program decided which library
to open at start time. If a file is opened and there is settings
record pointing to the library that was opened in this file last
time the program was used, this library is opened. If there is no
such settings record, the program tries to find the first not
system library in the file but prefers the one named "User". If
the program starts without data file, it shows library "User" from
the standard objects file.
* instDialog.cpp (instDialog::addToLog): better regex to recognize
compiler erorrs.
* TimeDialog.cpp (TimeDialog::loadFWObject): Changed format of the
start and stop date fields in the Time Interval object to show
year as four digits. Also enabled calendar in these widgets.
* bug #2099700 "Association of the .fwb and .fwl file types with
app". Implemented support for the association of the application
and data file type on Windows. Double-clicking on .fwb and .fwl
files in Explorer will now open application and load files
automatically.
2008-09-13 Vadim Kurland <vadim@vk.crocodile.org>
* GroupObjectDialog.cpp (GroupObjectDialog::listContextMenu):
fixed bug #2109833: "Crash on right mouse click in the object
group".
* FWWindow.cpp (FWWindow::prepareWindowsMenu): fixed bug #2109675:
"file Title bar contains redundant info". Internal page title
should be coordinated with items in the Windows main menu. There
is also no need to add "Firewall Builder" to the title of internal
windows.
* instDialog.cpp (instDialog::interpretLogLine): fixed bug
#2109660: "Compiler Progress: bar is incomplete". Compiler
progress bar failed to show full length bar when operation was
complete for some firewall platforms.
* ObjectManipulator.cpp (ObjectManipulator::contextMenuRequested):
fixed bug #2109431: "context menu item "Where used" is missing for
rulesets".
* RuleSetView.cpp (RuleSetView::selectRE): fixed bug # 2109432:
"double click on results in "Where used" list opens wrong rule."
* objects_init.xml.in: fix for bug #2099631: there used to be
object "icmpv6 unreachables" in the Deleted Objects library in the
file of standard objects that comes with the package.
* FindWhereUsedWidget.cpp (FindWhereUsedWidget::showObject): fixed
bug #2090332: "Where used search function does not always work.".
WhereUsed function could not find firewall if it was used in its
own rules.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval):
fixed bug (no #): compiler for iptables used date entered for the
beginning of the interval in "Time" object both for the beginning
and for the end.
2008-09-12 Vadim Kurland <vadim@vk.crocodile.org>
* GroupObjectDialog.cpp (GroupObjectDialog::applyChanges): fixed
bug #2107004: "Fwbuilder crashes while deleting objects in
groups". I could only reproduce the crash when there were two
identical objects in the group and I was trying to delete
both. v3.0 does not allow the user to add the same object twice to
the group so this condition should not be possible.
2008-09-11 Vadim Kurland <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::addToLog): working on bug #2105111:
"use color for compiler status and errors". Compilation and
installation status is color coded in the left panel of
compile/install dialog (Error is red, Success is green). Also
coloring compiler error messages red in the compiler progress
panel.
* RuleSetView.cpp (RuleSetView::updateGroups): fixed bug #2106124:
"Crash after deletion of (last rule in + whole) rule group".
* RuleSetView.cpp (RuleSetView::paintCell): working on bug
#2106280: "option to change color of rule group head". Made rule
group head colored in "medium dark", actual color depends on
chosen QT theme.
* RuleSetView.cpp (RuleTableModel::headerData): fixed bug #2106229
"Disable-Icon bad position in rule group". Icon that indicates
that a rule is disabled used to be drawn in the wrong row of the
ruleset table.
* ProjectPanel_state_ops.cpp (ProjectPanel::loadLastOpenedLib):
more for bug #2091225: "Can objects in the left pane remember last
state.". If there is no record of the last library used by he user
in the settings, the GUI opens library "User" or the first
non-system library if there is non named "User". Minor bug-fix to
prevent desynchronization of the tree view and pull-down list of
libraries.
2008-09-10 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::pasteRuleAbove): More checks for
operations with rules and ruleset on the deleted Policy or NAT
object. User should not be able to change anything in rule set
object that has been deleted because it does not have parent
firewall object.
* FWWindow.cpp (FWWindow::prepareEditMenu): more fixes for bug
#2100415: "cannot re-create or clone Routing object". Properly
synchronizing main menu Edit to make sure user can not delete
Ruleset objects.
* instDialog.cpp (instDialog::initiateCopy): fixed bug (no #): if
the name of the plink.exe program was specified in upper case in
Preferences dialog, built-in installer failed to provide correct
command line options to it.
* ObjectManipulator.cpp (ObjectManipulator::getMenuState): fixed
bug #2100415: "cannot re-create or clone Routing object". The GUI
does not let the user to delete Routing object. Policy and NAT
objects can be deleted as long as there is at least one more
left. Also "top" rule set objects can not be deleted at all.
* ObjectManipulator.cpp (ObjectManipulator::pasteTo): fixed
bug (no #): added ability to copy/paste rule set objects.
2008-09-09 Vadim Kurland <vadim@vk.crocodile.org>
* FWBSettings.cpp (FWBSettings::setExpandedObjectIds): bug
#2091225: "Can objects in the left pane remember last state.". The
program saves state of the object tree branches (expanded or
collapsed) between sessions.
* FWBSettings.cpp (FWBSettings::getVisibleRuleSetId): bug #2099631
"GUI should rememver firewall object that was opened last". The
program remembers opened ruleset between sessions.
2008-09-08 Vadim Kurland <vadim@vk.crocodile.org>
* fwbedit.cpp (usage): fixed "usage" in fwbedit, command line
option that specifies object attributes for the command "new" is
"-a", not "-o". Also fixed this in the man page.
2008-09-08 vadim <vadim@vk.crocodile.org>
* main.cpp (odocHandler): bug #2099700 "Association of the .fwb
and .fwl file types with app on Mac". Implemented support for the
association of the application and data file type on Mac OS
X. Double-clicking on .fwb and .fwl files in Finder will now open
application and load files automatically. User can open several
files by selecting them in Finder and double-clicking.
* main.cpp (main): remove "safe mode" command line flag -s because
on Mac OS X the program is started with flag -psn when it is
launched via finder. This caused undesired effects.
2008-09-06 Vadim Kurland <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::projectWindowClosed): fixed bug
#2091520: "Crash FWB". The GUI crashed if user closed mdi window
showing just standard objects and then tried to close the main
window.
* FWWindow.cpp (FWWindow::fileNew): fixed bug #2091507: "Create
New Firewall problem.". If user created new data file using
File/New main menu item, items in the main menu File used to stay
disabled and file could only be saved using "File/Save As" (which
did not make sense because the name has already been assigned to
the file during File/New operation).
* ProjectPanel_file_ops.cpp (ProjectPanel::fileSaveAs): bugfix: if
user called "Save As" and then hit Cancel in the dialog where they
choose file name, internal RCS object used to be deleted anyway.
* v3.0.1 started
* v3.0.0 released Sep 1, 2008. Merged branch "v3" r512 to trunk
2008-09-01 Vadim Kurland <vadim@vk.crocodile.org>
* res.pro: Do not try to install icons if variable ICONSDIR was
not defined by configure. This is the case on FreeBSD, I do not
know where application icons should be installed there.
* ActionsDialog.cpp: more fixes for compile problems on FreeBSD
2008-08-31 Vadim Kurland <vadim@vk.crocodile.org>
* ObjectTreeViewItem.cpp: more fixes for compile problems on
FreeBSD
2008-08-30 Vadim Kurland <vadim@vk.crocodile.org>
* PrefsDialog.cpp: more fixes for compile problems on FreeBSD
* instDialog.cpp (instDialog::fillCompileSelectList): fixed a bug:
firewall table in the compile/install dialog did not show "last
compiled", "last modified", "last installed" time stamps on
windows and mac.
* RuleSetDialog.cpp: fixing compile problems on FreeBSD 7.0
* instDialog.cpp (instDialog::fillCompileSelectList): resize rows
in the table that lists all firewalls for compile/install to make
rows minimal required height.
* FWWindow.cpp (FWWindow::FWWindow): fixed GUI crash that happened
when user clicked toolbar button "Install" right after gui start
before any data file was opened.
* instDialog.cpp (instDialog::fillCompileSelectList): disabled
font manipulations in install/compile dialog, it did not work
right on windows
* InterfaceDialog: layout adjustment for bug #2078671: "fwbuilder
3.0.0 build 487 - add/edit interface". Layout did not work quite
right with QT4 themes Plastique and Oxygen with default font size
14.
2008-08-29 Vadim Kurland <vadim@vk.crocodile.org>
* ObjectEditor.cpp: more missing #include for FreeBSD
* ObjectManipulator.cpp: Added missing #include for FreeBSD 7.0
port
* making sure dialogs do not enforce font type and size if not
necessary. Main window and install dialog used to override system
font which led to problems with dialog layouts on some systems.
2008-08-27 Vadim Kurland <vadim@vk.crocodile.org>
* configure.in: Applied patch per bug #2079941: "Patch for
configure.in --with-qmake". Patch adds option --with-qmake to
configure in libfwbuilder and fwbuilder.
* iosaclAdvancedDialog.cpp (toggleGenerateLogging): fixed bug
#2078107: "IOS ACL compiler issue". Logging commands for IOS ACL
were not generated properly (settings made in the GUI were
ignored). Also added checkbox to completely enable or suppress
generation of logging commands, this checkbox is off by
default. This provides for better backwards compatibility for
existing routers.
* various object type dialogs: layout changes for bug #2078671:
"fwbuilder 3.0.0 build 487 - add/edit interface". Dialogs did not
look right under QT theme with large fonts.
2008-08-26 Vadim Kurland <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::addToLog): fixed bug (no #): compile
and install progress window was stuck showing the topmost part of
the output of the compiler or installer. Need to make the window
automatically scroll and follow the output so that the latest
output lines are always visible.
2008-08-24 Vadim Kurland <vadim@vk.crocodile.org>
* HttpGet.cpp (HttpGet::httpDone): reset last_error when new http
operation begins to make sure we do not accumulate error messages
on top of those from previous http ops.
2008-08-23 Vadim Kurland <vadim@vk.crocodile.org>
* PrefsDialog.cpp (PrefsDialog::checkSwUpdates): Added setting for
http proxy used with automatic checks for the new version of the
program. Proxy can be defined by "host:port" pair; if port is not
specified, port 80 is assumed.
* FWObject.cpp (FWObject::toXML): (change in libfwbuilder) moved
saving of XML attributes name and comment from FWObject::toXML()
to implementations of this virtual method in all classes that are
supposed to have name and comment. When user created an object
with empty name, the old code used to save such object into XML
file w/o attribute "name" which violated DTD. This is fixed now.
2008-08-22 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::keyPressEvent): fixed bug (no #):
while navigating between rule elements using keyboard, it was not
possible to reach the very last rule if ruleset contained rule
groups
* RuleSetView.cpp (RuleSetView::paintCell): do not draw green
frame around rule group; draw black bracket line in the column #0
longer, almost to the bottom of the last rule row. Draw rule group
head row grey to make it visually stand out.
* ipt.cpp (main): additional fix for the bug #2051629 "group with
dns names are handled as empty": Compiler should check if any
rules of given address family exists before running
preprocessor. This is to prevent it from trying to resolve DNSName
objects for IPv6 when there are no ipv6 rules.
2008-08-21 Vadim Kurland <vadim@vk.crocodile.org>
* ProjectPanel_file_ops.cpp (ProjectPanel::load): truncating very
long error messages that happen when GUI tries to load broken .fwb
file. These error messages contain complete output of the XML
parser which can be very long and does not fit in the normal error
dialog. Message will be cut off at 1000 characters, which is
enough to see the topmost part of the parser output.
2008-08-20 vadim <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (ObjectTreeView::ObjectTreeView): Fixed GUI
crash on Ubuntu Hardy that happened b/c of a bug in QT
4.3.4. Crash happened when user added second object to any branch
of the tree. When second object was added to the tree, the program
terminated with assertion "ASSERT: "left.level > right.level" in
file itemviews/qtreeview.cpp". This did not happen with QT 4.4.1
and 4.3.2 (could not test with 4.3.5). The fix was to disable
sorting in the QTreeView widget used to represent object tree.
2008-08-19 Vadim Kurland <vadim@vk.crocodile.org>
* NATCompiler_PrintRule.cpp (PrintRule::_printSrcService): fixed
bug (no #): policy compielr for iptables used multiport module
option "--destination-port" instead of "--dports" when version was
set to 1.4.0. Option "--destination-port" is only for very old
versions of iptables (<1.2.6). This change makes compiler properly
compare version numbers rather than compare them as strings.
* RuleSetView.cpp (RuleSetView::pasteRuleAbove): Permit copy/paste
of individual rules between two data files. When a rule is copied
this way, all objects used in this rule are copied as well.
* FWWindow.cpp (FWWindow::recreateWindowsMenu): fixed typo in the
main menu item name
2008-08-18 Vadim Kurland <vadim@vk.crocodile.org>
* Compiler.cpp (Compiler::complexMatch): (change in libfwbuilder)
fixed bug (no #): policy compiler for iptables used chain OUTPUT
instead of FORWARD if NetworkIPv6 was used in "source".
2008-08-17 Vadim Kurland <vadim@vk.crocodile.org>
* ipt.cpp (main): fixed bug #2054755: "Duplicate Chain". Compiler
for iptables used to generate duplicate "iptables -N chain"
commands for the same chain in some cases.
* Preprocessor_pf.cpp (Preprocessor_pf::convertObject): fixed bug
#2056510 "Compile time" address tables objects dont
work. Preprocessor in compiler for PF for some reason used to
convert all compile time AddressTable objects to run-time. There
was no mention of this in changelog and no comment in the module.
* RuleSetView.cpp (RuleSetView::copySelectedObject): fixed bug
#2055984: "Negate Objects not work". the problem really was not
related to negated objects, instead, user could not copy an object
from rule element into clipboard more than once. Copying whole
rule into clipboard worked fine, but individual object inside the
rule could be placed in clipboard only one time.
2008-08-15 Vadim Kurland <vadim@vk.crocodile.org>
* Preprocessor.cpp (Preprocessor::isUsedByThisFirewall): fixed bug
#2051629: "group with dns names are handled as empty". This bug
triggered when object group that consisted of DNSName objects set
to resolve at compile time was used in policy rule and at the same
none of these DNSName objects were used in rules. If an object
from the group was itself used in a rule, compiler properly
converted it to address. But object was never used in rules by
itself, it was not converted.
2008-08-14 Vadim Kurland <vadim@vk.crocodile.org>
* SSHUnx.cpp (SSHUnx::SSHUnx): fixed bug #2051005: "install to
localhost fails with pam_thinkfinger". Built-in installer
recognizes password prompt produced by pam_thinkfinger module that
accepts both password or asks user to swipe finger against
fingerprint reader device. Note that installer is likely to not
work with fingerprint authentication because it will not wait once
it gets to the point where pam_thinkfinger module asks for the
password or fingerprint and will try to enter password. However
with this change password prompt from pam_thinkfiger is recognized
and password authentication becomes possible.
2008-08-13 Vadim Kurland <vadim@vk.crocodile.org>
* NATCompiler_ipt.cpp (NATCompiler_ipt::getInterfaceVarName):
fixed bug 2047082: "Beta 3.0 Build 456: IPv4 & IPv6 mixed
firewall". Compiler used ipv4 address of a dynamic interface in
the ipv6 policy rules if interface address was determined
dynamically at run time. This change makes compiler properly
determine ipv4 address for ipv4 rules and ipv6 address for ipv6
rules.
2008-08-12 Vadim Kurland <vadim@vk.crocodile.org>
* ObjectListViewItem.cpp (ObjectListViewItem::operator<): (and
several other places): code fixes to address warnings issued by
gcc 4.3
* Helper.cpp (Helper::findInterfaceByNetzone): fixed bug in policy
compiler for pix - it could not properly identify interface with
network zone "any"
* ObjectManipulator.cpp (ObjectManipulator::contextMenuRequested):
fixed bug #2047992: "segfault cloning policies in version
3". "Duplicate" and "Move" context menu items should not be
presented if an object for which context menu is called is policy
or interface.
* Rule.cpp (PolicyRule::removeRef): (change in libfwbuilder) fixed
bug #2047991 "Drag & Drop in CHAIN actions, version 3". THe bug
report consits of 3 parts, part 3 is "When I change the Action
from CHAIN to ACCEPT and switch it back to CHAIN it still shows
the last policy target I used. EVEN WHEN I DELETED this object
meanwhile. I manually have to remove the policy object from the
properties of the CHAIN action.". PolicyRule::removeRef removes
references to RuleSets and TagSErvice objects from rule options
when corresponding RuleSet or TagService object is deleted.
2008-08-11 Vadim Kurland <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (ObjectTreeView::edit): double-clicking on an
object in the tree opens it in the editor panel. Normally,
QTreeWidget also expands or collapses tree branch on double click
if the object has children. This was confusing. This change makes
tree not expand and collapse branches on double click.
* RoutingCompiler_ipt_writers.cpp (PrintRule::processNext):
Applied a one-line patch from <jringle@users.sourceforge.net> to
fix problem in the generated iptables script where it would
delete default route if routing rules were used.
2008-08-10 Vadim Kurland <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::checkForUpgrade): the GUI checks if
updated version is available on startup by making simple HTTP GET
request to the web site at http://www.fwbuilder.org. This can be
turned off in the Preferences dialog. Preferences dialog also
provides a button to perform this query at any time. If function
is enabled in Preferences, it is performed at every time the GUI
is launched. The query does not transmit any data to the server,
but the URL of the query includes the version of the Firewall
Builder.
2008-08-06 Vadim Kurland <vadim@vk.crocodile.org>
* new_object.cpp (newObject): fixed bug # 1997469: "Create a new
User library via fwbedit". Fwbedit creates new library and
populates it with correct set of standard folders.
2008-08-05 Vadim Kurland <vadim@vk.crocodile.org>
* pfAdvancedDialog_en_US.html: Help page for the advanced settings
dialog for PF firewall
2008-08-04 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printActionOnReject):
fixed bug #2037806: "Beta 3.0 Build 437: IPTABLES IPv6 policy ICMP
reject action". Ip6tables target REJECT accepts different
arguments for the --reject-with.
* OSConfigurator_linux24.cpp (printPathForAllTools): fixed bug
#2037809: "Beta 3.0 Build 437: IP6TABLES_RESTORE missing". Added
missing variable declaration for IP6TABLES_RESTORE to the
generated iptables script
2008-08-03 Vadim Kurland <vadim@vk.crocodile.org>
* ProjectPanel_file_ops.cpp: bug #2037314: "b449 does not
build". More missing #include for gcc 4.3
* newhostdialog_q.ui: fixed bug # 2036963 "Add new Host Object on
MacOSX". The "new host" dialog was too big and did not fit on low
resolution screen
* res.pro: Now installing fwbuilder.desktop file on Linux and
application icons under $DATADIR/icons/hicolor/ (sizes 128x128
16x16 24x24 256x256 32x32 48x48 512x512 72x72)
* bug #2036912 "fwbuilder b442 does not build". Added missing
forward declarations and #include for gcc 4.3
* Applied patch for gcc 4.3 per bug #2036881 "gcc 4.3 patch for
b442", Mandriva Cooker patch
http://svn.mandriva.com/cgi-bin/viewvc.cgi/packages/cooker/fwbuilder/current/SOURCES/fwbuilder-3.0.0-gcc4.3.patch
2008-08-02 Vadim Kurland <vadim@vk.crocodile.org>
* iptAdvancedDialog_en_US.html: Added help file for the firewall
settings dialog for iptables firewalls
* Help.cpp (Help::Help): generic built-in help framework. Help
files are created in .html format in src/res/help directory. Help
files can be localized, locale name is part of the file name; we
need to create separate file for each supported language.
First dialog to get associated help panel that can be activated by
clicking "Help" button is Linux 2.4/2.6 firewall host settings
dialog.
2008-08-01 Vadim Kurland <vadim@vk.crocodile.org>
* ipt.pro: Eliminated dependency on QT in all policy compilers.
Compiler binaries can be deployed on machines without QT and X11.
* ObjectManipulator.cpp (ObjectManipulator::contextMenuRequested):
fixed bug #2023243: "IPv6 - Some objects missing from context
menus". Added items "New Address IPv6" and "New Network IPv6" to
context menus associated with folders "Addresses" and "Networks"
in the tree.
2008-08-01 Vadim Kurland <vadim@vk.crocodile.org>
* Fixed build on Mac, starting with rev 433 code is built with QT
4.4.1 and works on both Leopard and Tiger.
* list_object.cpp (getAttributeValue): added command "list" to
fwbedit. This command can print contents of one object, an object
and all objects below it in the tree or contents of a
group. Object's attributes can be arranged in the output according
to the provided format string where attributes are represented by
macros of the format "%attr_name%" where attr_name is the name of
the attribute.
* fwbedit.1: Man page fwbedit.1 has been updated with the list of
commands, options, supported attributes and examples.
* with addition of the "list" command to fwbedit, utility
fwblookup has been deprecated and removed from the package and
source code tree.
2008-07-31 Vadim Kurland <vadim@vk.crocodile.org>
* fwbedit.cpp (usage): Redesigned command line interface for
fwbedit. The first command line argument is a command (one of
"new", "delete", "modify", "list", "add", "remove", "upgrade" or
"checktree") followed by options. Now fwbedit can be used not only
to add or remove objects, but also to modify object
attributes. The CLI is lot more consistent and can be extended
with new commands in the future.
2008-07-30 Vadim Kurland <vadim@vk.crocodile.org>
* fwbedit.cpp: fixes for the bug #2030331: fwbedit/fwblookup
issues: added option "-c" for fwbedit, with this option user can
specify comment for the object being created; fixed both fwblookup
and fwbedit to properly handle objects with duplicate names when
operations are performed on objects specified by their path in the
tree. Now, if several objects have the same name, operation will
be performed on all such objects. Note that this includes
deletion, that is, command
"fwbedit -f file.fwb -l /User/Objects/Addresses/TestAddress"
deletes all objects with name "TestAddress" if there are several.
Added ability to create IPv6 and NetworkIPv6 objects in fwbedit.
New command line option "-c text" can be used to set comment for
the object created via "-t type -n name".
2008-07-30 vadim <vadim@vk.crocodile.org>
* fwbedit.cpp (main): fixed bug #1997475: "Adding Interface via
fwbedit breaks .fwb file"
2008-07-28 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator::removeLib): fixed
crash that happened upon exit on some platforms. Need to break
away from the loop after lists were modified because iterators
become undefined.
2008-07-28 Vadim Kurland <vadim@vk.crocodile.org>
* New application icon
2008-07-27 Vadim Kurland <vadim@vk.crocodile.org>
* ObjectManipulator.h (class ObjectManipulator): removed strange
methods copyObjWithDeep and copyObj2Tree. Fixed drag&drop between
different data files. Copy/Paste and D&D between different data
files properly copy all dependencies and fix references in rules
and groups. Tested with recursive groups (group references itself)
and firewalls with rules referencing other firewalls with groups
and other objects.
* ObjectManipulator.cpp (ObjectManipulator::duplicateWithDependencies):
duplicate object that references other objects and create copies
of these other objects. Examples: firewall (rules reference other
object) and groups. This method is used in "Paste" operation. Will
use it for d&d as well.
2008-07-26 Vadim Kurland <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator::moveObj): code
refactoring and cleaning up. Movig all loops over mdi child
windows from ObjectManipulator class to the FWWindow class that
owns all children windows. Along the way fixed few bugs, such as
restored functions "Duplicate to .. " and "Move to ..." that are
available via context menu associated with an object in the tree.
* ProjectPanel_file_ops.cpp (ProjectPanel::saveIfModified):
refactored class ProjectPanel to keep code more organized in
several modules.
2008-07-25 Vadim Kurland <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::closeEvent): properly checking for
unsaved modifications when user hits File/Exit or tries to close
main window.
* ProjectPanel.cpp (ProjectPanel::fileCommit): fixed bug (no #):
crash while doing File/Commit.
* PolicyCompiler_ipt.cpp (checkForMatchingBroadcastAndMulticast):
fixed bug (no #): crash in fwb_ipt when interface object is used
in destination and chain is INPUT.
* init.cpp: removed #include <QCoreApplication>, trying to fix bug
#2027918: "Cannot compile fwbuilder-3.0.0-b413 on x86_64"
2008-07-24 Vadim Kurland <vadim@vk.crocodile.org>
* RCS.cpp (RCS::RCS): If data file has been added to RCS, show its
revision history properly sorted by the revision number in
ascending order and automatically select the latest revision in
the dialog
2008-07-24 vadim <vadim@vk.crocodile.org>
* init.cpp (guessExecPath): properly managing path to the bundle
on Mac.
2008-07-22 Vadim Kurland <vadim@vk.crocodile.org>
* FWWindow.cpp: Applied patch to make code compile with gcc 4.3 per
http://svn.mandriva.com/cgi-bin/viewvc.cgi/packages/cooker/fwbuilder/current/SOURCES/fwbuilder-3.0.0-gcc43.patch
2008-07-21 Vadim Kurland <vadim@vk.crocodile.org>
* ProjectPanel.h (libfwbuilder): Added missing declarations for
gcc 4.3 per bug #2023292: "fwbuilder 3.0.0 does not build"
* (libfwbuilder) Applied patch for gcc 4.3 per bug #2023676:
"libfwbuilder does not build against gcc 4.3".
* (libfwbuilder) fwbuilder.pro: removed unnecessary override in
target.path to make it install in a proper place on 64 bit
machines'
2008-07-20 <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleTableModel::insertRow): fixed bug (no #)
which caused crash on windows when new rule group was
created. This happened only on win32.
2008-07-20 Vadim Kurland <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::moveRule): fixed bug (no #): if
rule set had several rule groups, moving rules within rule set did
not work and caused weird effects.
* NetworkIPv6.cpp (NetworkIPv6::NetworkIPv6): per bug #2023140:
"Default prefix for IPv6 addresses" setting default netmask to /64
for NetworkIPv6 object.
* InterfaceDialog.cpp (InterfaceDialog::loadFWObject): fixed bug
#2023141: "Can't set interface options". The GUI kept all controls
in the interface object editor enabled when interface was child of
a Host object, even though some controls do not apply to
interfaces of a host. These controls were not saved into interface
objects and the whoile behavior of the GUI was rather
confusing. Now only proper controls are enabled when interface is
a child of a host object.
* RuleSetView.cpp (RuleSetView::removeRule): Fixed bug (no #):
"remove rule" function used to remove wrong rule in the rule set
if rule groups were used.
2008-07-18 <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::installerSuccess): bugfixes in the
built-in installer on Windows in case of successfull and
unsuccessfull termination of the process. Tests for when plink.exe
asks whether user wants to accept new ssh host key from the
firewall.
2008-07-18 Vadim Kurland <vadim@vk.crocodile.org>
* NATCompiler_PrintRule.cpp (PrintRule::_printAddr): fixed bugs in
compiler for iptables where it sometimes would not print netmasks
in ipv6 network objects in policy and nat rules.
* Added control for IPv6 forwarding setting in "host settings"
dialogs for Linux, OpenBSD and FreeBSD. This is in addition to the
old ip forwarding control. Corresponding policy compilers add
proper commands to generated scripts to turn ipv6 forwarding on or
off in the kernel.
* ipt.cpp (main): compiler for iptables puts build number in
addition to the version number into "Generated with ..." comment
in the produced script
* instDialog.cpp (instDialog::installerError): fixed crash in the
installer that happened when policy activation ended with an error
* ipt.cpp (main): fixed bug (no #): if generated script used
iptables-restore and if there were automatically generated rules
in the magle table, for example for the "clamp MSS to MTU" rule,
but no other rules in the mangle table, compiler would not add
COMMIT.
2008-07-17 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (prepareForMultiport::processNext): fixed
bug (no #) where compiler for iptables ignored ICMP6 Service
objects used in the same rule in combination with tcp or udp
service objects.
* objects_init.xml.in: Added few more ICMPv6 objects to the Standard
objects library:
type name comment
133 routersol Router solicitation
134 routeradv Router advertisement
135 neighbrsol Neighbor solicitation
136 neighbradv Neighbor advertisement
137 redir Shorter route exists
* ObjectManipulator.cpp (ObjectManipulator::delObj): fixed bug (no
#): GUI crashed when user deleted one of the rule set objects of
a firewall.
* many dialogs: adjusted shape and size of many dialogs that used
to be too big.
* utils.cpp (getAddrByName): getAddrByName() works on all
platforms and gets ipv4 and ipv6 addresses as requested. It looks
like for it to work on Windows Vista machine needs to be
configured with routable ipv6 addresses. When machine only had
Link-local address on fe80:: net, even when ipv6 was enabled,
getaddrinfo sent proper dns request for AAAA record, got reply but
did not pass it back to the application. Once machine was
configured with routable ipv6 address, getaddrinfo started working
as expected. This problem was not observed on Linux and Mac OS X.
* IPv6Dialog.cpp (IPv6Dialog::DNSlookup): Added "DNS Looup" button
to the IPv6 object dialog.
* dns.cpp (list): (libfwbuilder) Using getaddrinfo on all OS to
perform dns lookup for different address families (AF_INET or
AF_INET6).
* utils.cpp (getAddrByName): using DNS::getHostByName instead of
QT functions to perform host name lookup. This should allow us to
do it for both AF_INET and AF_INET6 address families. Needs more
testing.
2008-07-16 Vadim Kurland <vadim@vk.crocodile.org>
* ipt.cpp (dumpScript): Fixed bug (no #) that triggered when
iptables script was geenrated with option that uses
iptables-restore for activation. If ipv6 policy was empty,
compiler added "( ) | ip6tables-restore" anyway which caused
syntax errors.
* RuleSetView.cpp (RuleSetView::addToGroupAbove): Additional check
for a bug where adding very long list of rules to a rule group
caused crash once. Bug is hard to reproduce.
2008-07-15 vadim <vadim@vk.crocodile.org>
* testing and bug fixes with QT 4.4.
* Testing on Mac OS X and Windows Vista.
2008-07-08 vadim <vadim@vk.crocodile.org>
* fwcompiler.pro (LIBS): fixed build errors on Ubuntu Hardy.
Background info: need to include -lfwbuilder while linking
fwcompiler library on all Unix platforms because of the linker
option -Wl,-Bsymbolic-functions . Discovered this on Ubuntu Hardy
where libsnmp adds this option via net-snmp-config --libs
2008-07-07 Vadim Kurland <vadim@vk.crocodile.org>
* listOfLibraries.cpp (listOfLibraries::listOfLibraries): Removed
support for add-on libraries in the GUI. User can now open their
working file and external library file simultaneously and copy
objects from one to another. This removes the need for the
cumbersome add-on libraries feature. Will keep module
listOfLibraries and corresponding code fragments in ProjectPanel
and FWWindow until removal of this feature is validated by users.
* PolicyCompiler_pf_writers.cpp: Support for "synproxy state"
option for PF per FR #1098098: "Per-rule Synproxy"
* templates.xml.in: Updated template firewall objects to include
"top_rule_set" attribute.
* RuleSetDialog.cpp (RuleSetDialog::loadFWObject): Added attribute
"top_rule_set" to Policy, NAT and Routing objects. This attribute
is controlled by a checkbox "Top rule set" in the corresponding
object dialog.
The attribute has platform-specific meanning. On iptables, "top"
rule set goes into the built-in chains INPUT, OUTPUT, FORWARD; if
this flag is unchecked, rules go into user-defined chain with the
name the same as the name of the rule set. On PF, If this flag is
unchecked, rules go into anchor with the name the same as the name
of the rule set. On Ciscio IOS ACL If this flag is unchecked,
generated access list will not be assigned to interfaces with "ip
access-group" command and also the name of the ACL will be
prefixed with the name of the rule set to make it unique.
One policy, nat and routing rule set must be marked as
"top". Other rule sets are secondary and will be placed in their
own unique chains, anchors or access lists (depending on the
platform). Control may or may not be passed to these chains and
anchors. One way to pass control is by using rule action "Branch"
in the top rule set. However if control is not passed that way,
compiler will still generate corresponding commands which can be
used by means external to the firewall builder.
Auto-upgrade migration script will assign attribute "top_rule_set"
to Policy objects with name "Policy", NAT objects with name "NAT"
and Routing objects with name "Routing". This provides for
consistent backwards-compatible behaviour after upgrade from v2.1
2008-07-06 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_iosacl_writers.cpp (PrintRule::_printAddr):
Support for IPv6 in Cisco IOS ACL compiler fwb_iosacl.
* iptAdvancedDialog.cpp (iptAdvancedDialog::iptAdvancedDialog):
Removed option "Enable IPv6 support" in the "advanced" dialog for
all platforms. Now user needs to explicitly declare rule sets as
ipv6. Since by default all rule sets are ipv4, there is no need
in yet another parameter to enable ipv6 support.
* RuleSetDialog.cpp (RuleSetDialog::applyChanges): Objects Policy,
NAT and Routing now have attribute that tells compiler that
corresponding rule set is ipv4 or ipv6. The attribute is
controlled by radio-buttons in corresponding object dialog. Every
policy or nat rule set is treated as exclusively either ipv4 or
ipv6 by compilers, however the user can put objects of both
address families in rules. This allows for creation of object
groups that include objects of both address families. Such groups
can be used in both ipv4 and ipv6 rule sets. Compilers pick
objects that match address family declared for the rule set and drop
others.
One of the reasons why this attribute was added is to avoid
generation of unwanted iptables or acl lines for rules that can
not be unambiguously attributed to particular address
family. Example of such rule is rule with "any" in both source and
destination (e.g. "catch all and deny" rule typically found at the
bottom of the policy). Without this attribute compilers tried to
process every rule set for both ipv4 and ipv6. This way rule "any
any any deny" found in ipv4 policy yielded corresponding line in
the ipv6 policy, which was wrong.
* instDialog.cpp (instDialog::installSelected): minor fixed in
installer dialog (fixed progress bar and buffering of the compiler
output)
2008-07-05 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_iosacl_writers.cpp (PrintRule::_printTOS):
Support for TOS and DSCP matching in IOS access lists.
* PolicyCompiler_pf_writers.cpp (PrintRule::_printDstService):
Support for tos matching in compiler for pf. PF does not support
DSCP matching.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printIP): Support for
TOS and DSCP matching in compiler for iptables.
* IPServiceDialog.cpp (IPServiceDialog::loadFWObject): Added
support for attriutes "tos" and "dscp" in IPService object. FR
#1948944: "support for TOS matching".
* PolicyCompiler_PrintRule.cpp (PrintRule::_printModules):
Implemented support for combinations of srcip, dstip, srcport,
dstport options of the hashlimit module for iptables per bug
#1812388: "add srcip,dstip to choices for hashlimit mode"
2008-07-03 Vadim Kurland <vadim@vk.crocodile.org>
* fwbuilder.1: updated man page for fwbuilder GUI.
* ipt.cpp (main): document iptables version settings from the
firewall object in generated script (for support and debugging).
* MangleTableCompiler_ipt.cpp (flushAndSetDefaultPolicy): iptables
rule with target TCPMSS generated for option "Clamp MSS to MTU" is
valid only in mangle table in iptables 1.3.x and later. Still
generate this command in the filter table for earlier versions of
iptables
* PrefsDialog.cpp (PrefsDialog::getFontDescription): Tab "Fonts"
of the Preferences dialog shows currently selected fonts for both
the tree and rules.
2008-07-02 Vadim Kurland <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::addToLog): fixes in built-in
installer; pretty printing of the external process output;
properly enable "next" and "finish" buttons.
2008-07-01 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printProtocol):
compiler for iptables distinguishes ICMPService and ICMP6Service
* objects_init.xml.in: Added few standard ICMP6 objects
* ObjectManipulator.cpp (ObjectManipulator::newICMP6): Added
support for ICMP6Service object type in the GUI
* ICMP6Service.cpp (ICMP6Service::ICMP6Service): Added class
ICMP6Service
* fwbuilder.dtd.in: Added XML element ICMP6Service
2008-06-30 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printProtocol): do not
generate "-m icmp6 --icmp6-type any" for ipv6 for object "any
icmp".
2008-06-28 Vadim Kurland <vadim@vk.crocodile.org>
* DiscoveryDruid.cpp (DiscoveryDruid::loadDataFromDNS): object
"discovery" by DNS zone transfer is not supported anymore.
2008-06-27 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printProtocol):
should use "-p ipv6-icmp" for ipv6 rules.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printProtocol): skip
"-p all" for ipv6 to avoid warning "Warning: never matched
protocol: all. use exension match instead"
2008-06-26 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printIP): using
"-m frag --fragmore" for IPService objects that should match ip
fragments.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printDstService):
compiler uses "--icmpv6-type" and "-m icmp6" options while
generating ipv6 script.
2008-06-20 <alek@codeminders.com>
* FWWindowPrint.cpp: fixed bug # 1896771: "printing user defined
chains".
* main.cpp: implemented printing of the firewall object contents
from CLI per bug #1996739: "Feature: CLI printing or policy export".
Use command line flag "-P <firewall_name>" to print and exit.
2008-06-16 <alek@codeminders.com>
* newHostDiaog.cpp: fixed bug #1899488: "Unable to set MAC address
while adding a host"
2008-06-13 <alek@codeminders.com>
* GroupObjectDialog.cpp: implemented sorting by name and parameter
in group dialogs per bug #646804: "No sort in Group".
2008-06-10 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval):
support for the "new" time module for iptables
2008-06-08 Vadim Kurland <vadim@vk.crocodile.org>
* merged branch "id-experiment" r233:HEAD
2008-06-07 Vadim Kurland <vadim@vk.crocodile.org>
* main.cpp (main): support for integer object ids
2008-06-06 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::_printUser): Support
for UserService in compiler for PF. FR #1948872: "User based
rules"
* FWBSettings.cpp (FWBSettings::restoreGeometry): the program will
remember window size and restore it on subsequent runs, but will
not remember window position on the screen. This caused problems
on Mac OS X (because window title bar and tool bar weren't taken
into account, so window would slide up on every next run)
2008-06-05 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (checkUserServiceInWrongChains::processNext):
Support for UserService in compiler for iptables. FR #1948872:
"User based rules"
* IPv6 suport implemented in the GUI and compilers for iptables
and pf: FR #1517015, 1705261, 1706246, 1826325
* Rules with action Tag reference TagService objects. User drags
and drops TagService object into a drop area in the rule action
dialog. FR #1696841: "Mark action and TagService"
2008-06-05 <alek@codeminders.com>
* IPv4Dialog, NetworkDialog, newHostDialog, newFirewallDialog:
netmask can be entered as bit length, in addition to the bit mask
format supported before. Both formats are recognized. FR #995452,
1617297, 1666016
2008-06-05 Vadim Kurland <vadim@vk.crocodile.org>
* ipt.cpp, pf.cpp: Compilers for iptables and pf recognize branch
rule sets that belong to different firewall objects. FR #737132:
"Linkable Rules", #1224898 "Rule Link"
* PolicyCompiler_ipt.cpp (dropTerminatingTargets::processNext):
bugfix in the shadowing detection for non-terminating rules in the
mangle table.
* All compilers: all compilers include error and warning messages
produced during compilation in the generated script. Messages are
grouped by corresponding section (Policy, NAT, all branches
etc.). Normally only warnings will be included because compilers
stop when they encounter an error condition, however if compiler
is being ran with "-xt" command line option, it does not stop and
includes error messages in the output as well. This helps catch
changes that generate warnings but do not translate into
differences in generated configuration.
2008-06-02 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval):
Support for --weekdays parameter in iptables 1.4.0 module "time".
Per bugs #1914371: "iptables 1.4.0", #1806045: "latest 1.3.8
time match changed", #853364: "Time Restriction feature request".
* platforms.cpp (list): Added iptables version 1.4.0 to the list.
Will use it for the "new" time module support. Bugs #1914371:
"iptables 1.4.0" and #1806045: "latest 1.3.8 time match changed"
2008-05-30 Vadim Kurland <vadim@vk.crocodile.org>
* pf.cpp (main): Like compiler for iptables, compiler for PF now
supports multiple rule sets for policy and nat. Each rule set is
translated into corresponding anchor .conf file. If some rule in
another rule set references it via action Branch, corresponding
"anchor" configuration line is generated, but if it is not
references from any rule, the anchor .conf file is still
created. Rule sets "Policy" and "NAT" are configured "main" or
"root" and placed in the main .conf file with the name of the
firewall object.
2008-05-29 Vadim Kurland <vadim@vk.crocodile.org>
* ipt.cpp (main): Compiler for iptables processes all Policy and
NAT rulesets that firewall object has, regardless of whether they
are referenced from any rules with action Branch or not. This is a
change compared to the behavior of 2.1 which processed only those
branch rule sets that were used in Branch rules. Each rule set
that has name other than "Policy" is placed in a chain with the
name the same as the name of the rule set. This way the user can
create multiple rule sets and place them in different chains,
control to these chains can be passed in the iptables commands
supplied in prolog or epilog scripts.
Another reason for this is to allow the user to place rules for
ipv4 and ipv6 in separate rule sets. An attribute "address_family"
will be added to objects Policy and NAT later on to be able to
mark rule sets as belonging to either ipv4 or ipv6 address
family. This separation helps avoid ambiguity that is possible in
mixed rule sets (when both ipv4 and ipv6 rules are mixed in the
same rule set). Suppose we allow the user to put both ipv4 and
ipv6 rules in the same rule set and the user creates a rule with
ipv4 object in Dst with negation. "Not host A", where "host A"
translates into one ipv4 address should probably include "all
ipv6" as well, which means that this simple rule can inadvertenly
block all ipv6 without user even noticing it. This can be very
confusing and difficult to troubleshoot. Placing rules acting on
different address families into different rule sets helps avoid
this problem.
* ipt.cpp: Compiler for iptables can determine if a rule set is
referenced by a rule with action Branch and option "branch in
mangle table in addition to the filter table" and correctly places
referenced rule set in both filter and mangle tables.
2008-05-29 <alek@codeminders.com>
* ObjectManipulator.cpp: new feature v3: Policy rules can now be
arranged in multiple rule sets with names. These rule sets are
shown in the tree under the firewall object (next to its
interfaces). Each rule set is independent from others, user can
add as many as they want. Rules with action "Branch" refer to
existing rule sets, user associates them by dragging rule set
object into action parameters dialog of the branching rule. This
also fixes bug #1753297: "duplicate chain tab".
2008-05-23 Vadim Kurland <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (countChainUsage::processNext): New
feature: compiler for iptables keeps track of chain usage and
removes unused chains from the generated iptables script. This
helps optimize generated script and makes it smaller, especially
in mixed IPv4/IPv6 configurations.
2008-05-22 Vadim Kurland <vadim@vk.crocodile.org>
* ipt.cpp (main): Policy compiler for iptables supports
IPv6. Added command line switches "-4" and "-6" which force
compiler to generate script for only one specified address
family (by default it does both). Compiler can generate simple
ipv6 iptables script. Generated script still can be improved but
seems to be formally correct at this time.
2008-05-18 Vadim Kurland <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp: compiler for iptables converted to
use exclusively methods getAddressPtr and getNetmaskPtr. Checking
for when Address object has no IP address where
appropriate (getAddressPtr() returns NULL in this case).
2008-05-10 vadim <vadim@vk.crocodile.org>
* pf.cpp: (from 2.1) fixed bug #1961202: "Pf Timeouts overriden by
Optimization". Compiler should generate "set optimization" command
before "set timeout" commands.
2008-05-08 vadim <vadim@vk.crocodile.org>
* FWWindowPrint.cpp (printFirewall): (from 2.1): fixed bug
#1562726: "policy print rule cut-off". Long rulesets would not
print correctly on Windows, the bottom of the ruleset table was
just printed solid grey with no rules visible.
* PolicyCompiler.cpp (PolicyCompiler::checkForShadowing): (from
2.1): partial fix for bugs #1789059 "shadow issue when using
action chain" and #1945149: "Shadowing test for rules with action
"chain". The mechanism for rule shadowing detection we have at
this time can only detect shadowing of one rule by another. In
case of branching it is a combination of the branching rule and
rules inside the branch that may shadow other rules. I plan to
redesign this part of the code in the future, but it won't happen
in upcoming v3.
Meanwhile, I am fixing it in 2.1 by making compiler ignore rules
with action Branch.
2008-05-05 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::processNext),
RuleOptionsDialog.cpp (RuleOptionsDialog::loadFWObject): (from
2.1) fixed bug #1821573: "Rule options limits allow for multiple
overload tables". PF allows only for one "overload" option per
rule.
* IPTImporter.cpp (IPTImporter::pushPolicyRule), (from 2.1)
iptables.g (target_options): fixed bug #1949438: "parser expects
decimal - hex is not accepted". Importer for iptables should be
able to process "--set-mark" with hex argument.
* fwbedit.1: (from 2.1) fixed bug #1949103: "manpage slightly
broken". Minor fixes in fwbedit.1 man page.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printOptionalGlobalRules):
(from 2.1) fixed bug# 1940504: "Clamp MSS to MTU". Iptables
command that invokes "-j TCPMSS --clamp-mss-to-pmtu" in FORWARD
chain should go before the one that matches "--state
ESTABLISHED,RELATED" in order to work for the packets in these
states.
* RuleOptionsDialog.cpp (RuleOptionsDialog::loadFWObject): (from
2.1) fixed bug #1938985: Rate in hashlimit in local language
2008-04-28 <alek@codeminders.com>
* v3 feature: rules can be grouped in Policy, NAT and
Routing. Group of rules can have a name and color and can be
collapsed or expanded. Collapsed rule groups take room equivalent
to one rule in the ruleset panel. This implements Feature Requests
#1961702, 1938992, 1751141, 1602294, 1372620, 1083981, 1017566,
848553, 811542,
2008-04-13 Vadim Kurland <vadim@vk.crocodile.org>
* NATCompiler_PrintRule.cpp (PrintRule::_printAddr): fixed bug (no
#): compiler fwb_ipt used to treat host objects as networks in
TDst and generate iptables output with /netmask of the interface.
* (various places in src/ipt): PREPARATION FOR IPV6: Changing
IPv4::cast to dynamic_cast<InetAddrMask*> everywhere. In loops
that walk child objects of interfaces, cast child objects to
InetAddrMask* or to FWObject* instead of IPv4*. This is to
facilitate support for ipv6 in the future. In all these places we
need to use two aspects of the child objects: either their
position in the tree, in which case FWObject* is sufficient, or
their address/netmask, in which case we should use InetAddrMask.
* (various places in src/pflib): PREPARATION FOR IPV6: Changing
IPv4::cast to dynamic_cast<InetAddrMask*> everywhere.
2008-03-09 vadim <vadim@vk.crocodile.org>
* (from 2.1) pf.cpp: fixed bug #1899914: "Script to apply the new
rules." It is enough to execute "pfctl -f file.conf" to load PF
policy. There is no need to purge filter and nat rules first, then
reload it.
* (from 2.1) RCS.cpp (RCSEnvFix::RCSEnvFix): fixed bug #1908351:
"rcs does not save log message and file remains locked"
* (from 2.1)
Compiler.cpp (emptyGroupsInRE::countChildren): (libfwbuilder)
fixed bug #1905718: "Group of DNS Name objects considered empty"
2008-03-06 <alek@codeminders.com>
* v3 feature: Firewall Builder v3 GUI redesigned as MDI
interfaces. Several data files can be opened simultaneously and
objects dragged and dropped from one file to another. FR # 984979
"split window view of tabs".
* v3 feature: the GUI allows the user to change font used for the
UI, object tree and rules (separately). FR #1621799: "main window
font_size & column resizing" (although column width is not saved).
* v3 feature: The user can switch between icons 25x25 and 16x16 in
rules. FR #1844437 "25x25 Icons to 16x16"
2008-03-05 vadim <vadim@vk.crocodile.org>
* VERSION: started v2.1.18
* src/cisco_lib, src/iosacl, src/pix: Code for policy compilers
for Cisco IOS ACL and PIX has been released under
GPL and merged into the main fwbuilder tree.
2008-02-18 vadim <vadim@vk.crocodile.org>
* CircularQueue.hpp (antlr): fixed crash of the policy importer on
64-bit systems. This fixes bug #1886575: "Seg Fault on reading
vanilla Fedora iptables file". See comment in module
CircularQueue.hpp for details.
2008-02-10 vadim <vadim@vk.crocodile.org>
* pt_BR.po: updated Brazilian Portuguese translation by Rubens
Ferreira Neto <rubens.ferreiraneto@ig.com.br> and Jose
Carlos Medeiros <jose@psabs.com.br>
* PrefsDialog.cpp (PrefsDialog::PrefsDialog): fixed bug #1886570:
Diagnostic related to Edit->Preferences. Removed harmless but
annoying error message that appeared on stderr when user opened
Preferences dialog.
* IPTImporter.cpp (IPTImporter::pushPolicyRule): Fixed bug
1883536: "fwbuilder segfaults when importing iptables conf". Added
support for TCPMSS target with option --clamp-mss-to-pmtu in
iptables importer; also made importer upderstand option
--tcp-option but skip it since it is not supported in fwbuilder.
2008-02-06 <vadim@vk.crocodile.org>
* RCS.cpp (RCSEnvFix::RCSEnvFix): fixed bug #1849392: "RCS using
windows 2003 without administrator rights". Pass TMP and TEMP
environment variables to RCS tools
* pix_os.xml.in: more for the bug #1816798: "Installing policy on
PIX 501 fails". The fix that was made for v2.1.16 did not cover
test-mode install, which is now fixed too. Command "terminal pager
" is valid only for PIX 7.x and caused error while installing
policy on PIX 6.3. Removed this command from the install sequence,
it was not essential.
2007-12-29 <vadim@vk.crocodile.org>
* SSHUnx.cpp (SSHUnx::stateMachine): using signal proper for qt4
(bytesWritten(quint64) instead of wroteToStdin)
2007-12-19 vadim <vadim@vk.crocodile.org>
* v2.1.16 release
2007-12-15 vadim <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp
(OSConfigurator_linux24::printRunTimeWrappers):
fixed bug #1851166: "Installscript does not test for destination
ip address". The problem affected specific case of a firewall with
two (or more) interfaces that get their address dynamically and a
policy rule that has one such interface in source and another in
destination. Generated iptables script retrieves actual addresses
of both interfaces and assigns them to variables, then uses these
variables in actual iptables rules. Special check is provided in
case some interface did not obtain any ip address at a time of
execution of the script. Previously such test was only done for
one dynamic interface per rule. This change makes the script check
for both.
* ipt.cpp: bug #1850352: "Install script wrongly completes
successful". Storing exit status of iptables-restore so that
generated firewall script can return the same status after it
executes commands that set kernel parameters and runs user-defined
epilog code.
* PolicyCompiler_pf_writers.cpp (PrintRule::_printRouteOptions):
applied patch #1850357: "Add support fo load balancing with pf to
PolicyRule::Route" by Tom Judge (tomjudge@users.sourceforge.net)
that adds support for load balancing rules in PF. Extended the
patch adding support for address/netmask format of the next hop.
Added checks for illegal IP addresses and netmasks in the next
hop. Test cases for the PF load balancing rules are in
test/pf/objects-for-regression-tests.fwb, firewall object
firewall40-1.
2007-12-13 vadim <vadim@vk.crocodile.org>
* linux24.xml.in: working on bug #1850352: "Install script wrongly
completes successful". Added more checks to the installer
scriptlet to make it properly terminate with non-zero error code
if iptables-restore returned error. Previously "echo" in the end
of the generated masked error code returned by iptables-restore
and made the GUI report successfull install even when it
terminated with an error. Also added test for the presence of
pkill on the system so that the script does not try to run it if
it is not available.
* platforms.cpp (list): applied patch #1850368: 'PF 3.7 has
support for "set skip on"'. Patch by tomjudge@users.sourceforge.net
extends support for "set skip on" option to pf 3.7.
* platforms.cpp (isDefaultPolicyRuleOptions): fixed bug #1850346:
"GUI has 2 views on which actions should be stateless". Even
though GUI made rules with action Route stateful by default, code
that determined if combination of options of a given policy rules
was default thought these rules should be stateless.
* ipt.cpp: Applied patch 1835308: "Patch for adding "-q" option to
fwb_ipt". Option "-q" suppresses timestamp that is normally
included in the generated script. This way, if no objects or rules
changed in the firewall builder, generated script will be exactly
the same. Timestamps made generated script different even if
nothing really changed in the objects, which made external version
control systems detect changes when there were none.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printOptionalGlobalRules):
fixed bug 1848204: "ULOG-Setting ignored for invalid packets",
applied patch #1848609 provided by reporter. Code that matched and
logged packets in state INVALID always used target LOG, which was
a problem for iptables installations that only come with target
ULOG.
* tcpservicedialog_q.ui: patch #1849500: "tooltip patch for
tcpservicedialog_q.ui". Additional tooltips in the TCP Service
dialog to explain function of tcp flags masks and settings.
2007-12-12 vadim <vadim@vk.crocodile.org>
* ipt.cpp: fixed bug #1849328: "iptables restore unusable in
2.1.15". This bug was introduced by the change for the bug
1812295. If option "use iptables-restore to activate policy" is
on, we always generate script that prints iptables commands using
echo and sends them to the input of iptables-restore via pipe.
* VERSION (FWB_MICRO_VERSION): begin v2.1.16
2007-12-08 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::processNext): fixed
bug #1821576: "Rule option tracking gives inavlid config with
default value". Compiler should skip max-src-nodes when it is set
to default '0' in the GUI.
* Added Brazilian Portuguese translation by Jose Carlos Medeiros
<jose@psabs.com.br>
2007-11-25 vadim <vadim@vk.crocodile.org>
* Starting with build 320 Windows packages install on Vista
2007-11-15 vadim <vadim@vk.crocodile.org>
* FWObjectDropArea.cpp (FWObjectDropArea::paintEvent): more fixes
for bug #1826558: need to fill background rectangle in "object
drop" widget for search.
* RuleSetView.cpp (RuleSetView::paintCell): more fixes for bug
#1826558: need to fill background rectangle in action, options and
comment columns.
2007-11-14 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::paintCell): fixed bug #1826558:
"OSX 10.5 font problem". This problem appeared only in Mac OS X
Leoprard (10.5) build, other platforms were unaffected.
2007-11-02 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::installSelected): previous fix for
the bug #1811781: "Batch Install" was insufficient. Needed to
clear altAddress input field in the install options dialog in case
of the batch install.
2007-10-28 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (PolicyCompiler_ipt::createPrintRuleProcessor):
fixed bug #1812295: "Can't use runtime address tables AND
iptabels-restore". Script generated by fwb_ipt used "here
document" if the option "use iptables-restore to activate policy"
was turned on. This did not work in case policy used any tun-time
address table objects. Now generated script always uses "echo" to
generate iptables commands that it sends to th standard input of
iptables-restore.
* instDialog.cpp (instDialog::doInstallPage): fixed bug #1811781:
"Batch Install". Built-in installer used address of the first
firewall of the batch to communicate with all firewalls in the
"batch install" mode.
* PolicyCompiler_pf.cpp (PolicyCompiler_pf::addDefaultPolicyRule):
fixed bug #1800875 "'keep state' missing from pass out going
traffic rule". Compilers for pf, ipf and ipfw were affected.
* pix_os.xml.in: fixed bug #1816798: "Installing policy on PIX 501
fails". Command "terminal pager " is valid only for PIX 7.x and
caused error while installing policy on PIX 6.3. Removed this
command from the install sequence, it was not essential.
2007-10-06 vadim <vadim@vk.crocodile.org>
* ipfAdvancedDialog.cpp (ipfAdvancedDialog::ipfAdvancedDialog):
applied patch by <Cy.Schubert@komquats.com> to add support for
Kerberos rcmd and Kerberos ekshell proxies in ipfilter NAT rules.
* VERSION (FWB_MICRO_VERSION): begin v2.1.15
2007-09-10 vadim <vadim@vk.crocodile.org>
* 2.1.14 release
2007-09-08 vadim <vadim@vk.crocodile.org>
* configure.in: patch by Carlos Silva <r3pek@r3pek.org> to add
third parameter to AC_DEFINE_UNQUOTED
2007-08-25 vadim <vadim@vk.crocodile.org>
* RuleOptionsDialog.cpp (RuleOptionsDialog::loadFWObject): fixed
bug #1764971: "allowed value range for burst limit". Iptables
"--limit-burst" option should not be limited in the GUI.
* instDialog.cpp (instDialog::continueRun): fixed bug #1772722:
"installer should recognize when it uses plink 0.60". We detect
when installer uses plink on Windows by checking the name of the
configured ssh client. The check should be case-insensitive.
2007-08-06 vadim <vadim@vk.crocodile.org>
* configure.in: applied patch by Carlos Silva <r3pek@r3pek.org> to
make configure.in use ANTLR C++ run-time installed on the system
if it can find one; otherwise it uses copy in src/antlr
2007-08-05 vadim <vadim@vk.crocodile.org>
* IPTImporter.cpp: fixed bug (no num): importer for iptables
should properly assign rule options when it finds "-m limit" and
"--limit" options in the input file.
* IPTImporter.cpp: added a workaround for a situation when several
iptables commands pass control to the same user-define chaine in
the iptables-save file. As of fwbuilder v2.1, branch ruleset is a
child object of PolicyRule. This means two different rules can not
point at the same branch ruleset. This is unfortunate but it is
hard to fix in the current version because it requires changes XML
DTD and API. Will do this in 3.0. Meanwhile, checking if branch
ruleset with requested name already exists and change the name by
adding suffix '1', '2' etc to make it different. Imported rule is
marked as 'bad' (red background) and gets a comment explaining this.
* iptables.g (tcp_flags_list): fixed bug #1764988: "iptables
import -> GUI crash": syntax for TCP flag matching in
iptables-save should allow for more than 2 flags in 'comp' part
* iptables.g (target_options): added missing supprot for
"--log-tcp-sequence", "--log-tcp-options" and "--log-ip-options"
options for target LOG to iptables policy importer
* iptables.g (protocol_word): fixed bug (no num): iptables policy
importer should properly parse numeric protocol
specification (e.g. "-p 47").
* Importer.cpp (Importer::getTCPService): fixed bug #1764988:
"iptables import -> GUI crash": iptables policy importer
recognizes and parses TCP flag parameters ALL and NONE
* IPTImporter.cpp (IPTImporter::pushPolicyRule): fixed bug
#1764988: "iptables import -> GUI crash": iptables policy importer
recognizes and parses target RETURN
2007-08-01 Vadim <vadim@debian-unstable.vk.crocodile.org>
* FirewallDialog.cpp: fixed bug reported in Debian Bug report
#417685 - added missing #include <algorithm> to make code
compile with gcc 4.3
* fixed bug #1761373: "libfwbuilder doesn't build on Mandriva
cooker". Applied fixes to make the code compile with gcc 4.2
* VERSION: started 2.1.14
2007-07-18 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (InterfaceAndDirection::processNext):
compiler permits setting direction in the rule while interface
field is "All". This generates iptables command in chain INPUT or
OUTPUT with "-i +" or "-o +" interface specification to match all
interfaces.
2007-07-14 vadim <vadim@vk.crocodile.org>
* platforms.cpp (isDefaultPolicyRuleOptions): platform "iosacl"
does not have any rule options at this time; making sure we never
show an icon indicating non-default options.
* templates.xml: added simple template for Cisco router 36xx
* pf.cpp (main): Added support for "set skip on <ifspec>" command
for PF. If an interface is marked as "unprotected" in the GUI,
compiler generates this command for it. This is useful for loopback
or other virtual interfaces.
* PolicyCompiler_pf_writers.cpp (PrintRule::processNext): better
compliance with PF 4.x. Feature Req. #1679793: "add 'no state' and
'flags any'". If version is set to 4.x, compiler skips "flags S/SA
keep state" for rules mathcing tcp services. However, according to
the section "1.2. Operational changes" in PF FAQ at
http://www.openbsd.org/faq/upgrade41.html , there should be a way
to add "keep state" explicitly for rules on interface enc0. Added
this option to the rule options dialog.
* pf.cpp (main): implemented support for PF limit options
"src-nodes", "tables" and "table-entries". Feature Req. #1674919:
"Support "set limit table-entries""
2007-07-12 vadim <vadim@vk.crocodile.org>
* SSHSession.cpp: More key caching request and other messages for
wider variety of ssh clients.
* SSHPIX.cpp (SSHPIX::stateMachine): fixed bug #1753188: "policy
activation fails on PIX and IOS". Installer failed if account used
to authenticate to the router or PIX went straight to 'enable'
mode after login.
2007-07-07 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::_printLogging): fixed
bug #1747828: "anchors generation - "log" not supported". "Log"
keyword is not allowed in "anchor" rules; compiler should not
generate it even if user turned logging on in a rule with action
'Branch'
* PolicyCompiler_ipt.cpp (checkForRestoreMarkInOutput::processNext):
fixed bug #1747332: "missing CONNMARK/ restore mark in Output Chain"
* PolicyCompiler_PrintRule.cpp (PrintRule::_flushAndSetDefaultPolicy):
fixed bug #1746257: "fwbuilder breaks IPv6". Added an option to
the firewall settings dialog for iptables that controls whether
compiler should skip generation of the code to set default policy
of all ipv6 chains to DROP. This option is off by default, that is
compiler puts the code in. This helps maintain backwards
compatibility with old data files that do not have this option,
which is equivalent to this option being "off".
2007-07-06 vadim <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator::unlockObject): fixed
bug #1743117: "crash while editing any". Added check, user should
not be able to unlock Standard objects library
* FWObject.cpp (FWObject::shallowDuplicate): fixed bug #1740766:
"lock not saved". This method now copies the value of "ro"
attribute (read-only). Clear it in the caller if
neccessary. Method duplicate() clears it after calling
shallowDuplicate in order to be able to modify the object, then
restores this attribute to its original value.
2007-06-23 vadim <vadim@vk.crocodile.org>
* v2.1.12 release
* iptables.g (target_options): parser for iptables is aware of
"--set-tos" target option. Even though fwbuilder does not support
target TOS, importer should be able to import policy that uses it
without crashing.
2007-06-20 vadim <vadim@vk.crocodile.org>
* FWWindowPrint.cpp (printFirewall): fixed bug #1739373: "FWB2111,
register Routing not printed". Tab "Routing" was not included in
the printed copy of firewall policies.
* NATCompiler_pf.h: fixed bug #1740545: "AddressTable in NAT
section". Policy compiler for PF crashed if AddressTable object
was used in TDst element of a NAT rule.
2007-06-17 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::initiateCopy): fixed bug (no number)
where installer failed to properly copy .fwb file over to the
firewall if file name contained whitespace
2007-06-16 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::prepareInstallerOptions): discovered
and fixed bug in the installer: if management interface of the
firewall is dynamic (i.e. had no IP address) and address of the
firewall was given in the "Installer" tab of the firewall object
dialog, installer failed to copy it to the instOptionsDialog and
filled corresponding entry field with 0.0.0.0
* OSConfigurator_linux24.cpp
(OSConfigurator_linux24::printShellFunctions): fixed bug 1737733:
"install script doesn't detect BROADCAST if eth is NO-CARRIER".
If firewall script runs before network interface comes up (i.e. is
still in NO-CARRIER state), script failed to add virtual addresses
for NAT.
2007-06-13 vadim <vadim@vk.crocodile.org>
* ActionsDialog.cpp (registerOption): after changes made in the
compiler to simplify algorithm used to decide which chain a rule
with action Tag should go to, rule action option "Mark connections
in PREROUTING chain" ( "ipt_mark_prerouting" ) has been
deprecated.
2007-06-12 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::reopenFirewall): Added platform
capability element "supports_nat" - if True, platform supports NAT
rules so the main window should show tab "NAT" in the policy
view. If this parameter is False, the tab disappears.
* DiscoveryDruid.cpp (DiscoveryDruid::DiscoveryDruid): added main
menu item "File -> Import Policy" that activates Discovery Druid
and opens it on the page where user can choose configuration file
for import.
2007-06-09 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_flushAndSetDefaultPolicy):
fixed bug #1711595: "ip6tables DROPs". Compiler adds rules to
permit any-to-any on loopback interface for ipv6 in addition to
rules that set default policy to DROP for all chains in ipv6
2007-06-06 vadim <vadim@vk.crocodile.org>
* antlr.pro: Added ANTLR C++ runtime to the project under src/antlr
2007-06-05 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (setChainPreroutingForTag::processNext):
streamlined algorithm that assigns chain to a rule with action
Tag. The goal is to always use chain PREROUTING for rules with
direction Inbound or Both and a combination of OUTPUT and
POSTROUTING for rules with direction Outbound and Both.
2007-06-02 vadim <vadim@vk.crocodile.org>
* DiscoveryDruid.cpp (DiscoveryDruid::importPlatformChanged):
finalized rule importer GUI.
2007-06-01 vadim <vadim@vk.crocodile.org>
* IPTImporter.cpp (IPTImporter::pushNATRule): NAT import now works
2007-05-30 vadim <vadim@vk.crocodile.org>
* pf.cpp (main): fixed bug #1727715: "Policy Installer failed but
indicates succes". Activation script for PF exits with non-zero
return code if script activation fails.
* IPTImporter.cpp (IPTImporter::addSrv): import of target MARK and
TagService for iptables
* IPTImporter.cpp (IPTImporter::pushRule): support for module
"limit" in importer for iptables
2007-05-29 vadim <vadim@vk.crocodile.org>
* IPTImporter.cpp (IPTImporter::pushRule): meaningful import of
iptables-restore files with all actions for filter table. Action
"Continue" helps import iptables commands with targets LOG and
ULOG.
* PolicyCompiler_ipt.cpp (PolicyCompiler_ipt::compile): Added
support for action "Continue" (an empty action) in the GUI and
compiler for iptables. This action creates a rule that does
nothing, however it generates iptables command with target "-j
LOG" if logging is turned on. This can be useful if one wants only
to log packets that match certain pattern but not make any policy
decision in the same rule.
2007-05-28 vadim <vadim@vk.crocodile.org>
* IPTImporter.cpp (IPTImporter::pushRule): basic iptables-restore
import works (only policy rules, only minimal set of modules)
2007-05-27 vadim <vadim@vk.crocodile.org>
* IPTImporter.cpp: initial work on iptables importer
* OSConfigurator_linux24.cpp
(OSConfigurator_linux24::generateCodeForProtocolHandlers): Fixed
bug in the shell code that finds netfilter modules (missing
closing '"'). This bug broke generated iptables script. Bug was
introduced in 2.1.12 some time before build 270
2007-05-25 vadim <vadim@vk.crocodile.org>
* iosacl.g (vlan): ignore "vlan" commands while importing IOS
config
* IOSImporter.cpp (IOSImporter::finalize): IOS accesslists
importer properly handles situation when the same list is applied
to multiple interfaces with different directions.
2007-05-22 vadim <vadim@vk.crocodile.org>
* run-tests.sh: simple framework for automated unit tests
* importer_test.cpp: unit test for Cisco IOS access lists
importer
* IOSImporter.cpp (IOSImporter::finalize): IOS access lists
importer works with a large complex test file. Test can be
imported and then compiled with no manual changes.
* PolicyCompiler_ipt.cpp (InterfacePolicyRulesWithOptimization):
allow for object group in "Interface" rule element
2007-05-21 vadim <vadim@vk.crocodile.org>
* DiscoveryDruid.cpp (DiscoveryDruid::loadDataFromImporter):
finished configuration importer GUI
2007-05-16 vadim <vadim@vk.crocodile.org>
* RoutingCompiler_ipt_writers.cpp: fixed bug #1718791: "Bug with
more than one router". This bug affected routing rules.
* OSConfigurator_linux24.cpp (OSConfigurator_linux24::generateCodeForProtocolHandlers):
fixed bug #1720022: "Fail to load modules .ko.gz".
* MangleTableCompiler_ipt.cpp (keepMangleTableRules::processNext):
fixed bug #1720480: '"-A POSTROUTING -i interface" in branching
rules'. Compiler should not generate iptables commands in
POSTROUTING chain with "-i interface" clause.
2007-05-15 vadim <vadim@vk.crocodile.org>
* DiscoveryDruid.cpp (DiscoveryDruid::importConfig): basic GUI
support for the configuration importer
* IOSImporter.h (class IOSImporter): derived class - importer for
Cisco IOS ACLs
* Importer.h: generalized policy importer framework. Requires
grammar for each platform.
* iosacl.g: ANTLR grammar for IOS ACLs. Only "access-list ", "ip
access-list extended" and certain "interface" commands cam be
parsed
2007-05-11 vadim <vadim@vk.crocodile.org>
* SSHSession.cpp (SSHSession::readFromStdout): note about
built-in installer on windows. Installer seems to have broke with
upgrade of QT to 3.3.8. Specifically, in
SSHSession::readFromStdout(), proc->readStdout() returns a byte
array that contains actual output from the device, with some
garbage appeneded to it. The garbage is included in the size()
count of QByteArray returned by readStdout so it gets included
into the QString which we append to stdoutBuffer. This happens
only on win32; reverting to QT 3.3.7 fixes the problem.
2007-05-10 vadim <vadim@vk.crocodile.org>
* SSHPIX.cpp (SSHPIX::stateMachine): implemented support for
scheduled reload for PIX firewalls (for roll-back).
* instOptionsDialog.cpp (instOptionsDialog::instOptionsDialog):
PIX and Cisco routers (IOS) : built-in installer can schedule
reboot of the firewall before activating new policy, then cancel
it if the policy has been activated successfully.
* instOptionsDialog.cpp (instOptionsDialog::instOptionsDialog):
fixed long-standing problem with size of the built-in installer
options dialog. The dialog was too big and did not properly resize
itself when some options were hidden.
* SSHIOS.cpp (SSHIOS::stateMachine): installer for Cisco routers
2007-05-09 vadim <vadim@vk.crocodile.org>
* InterfaceDialog.cpp (InterfaceDialog::loadFWObject): added
support for the new attribute "unprotected" for the Interface
object in the GUI. Compilers skip this interface while assigning
ACLs or policy rules to interfaces. This is supported only in the
compiler for Cisco IOS ACLs at this time.
2007-05-08 vadim <vadim@vk.crocodile.org>
* iosAdvancedDialog.cpp (iosAdvancedDialog::iosAdvancedDialog):
Added dialogs and resource files for Cisco IOS ACLs
2007-05-07 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::changeAction): setting option
"stateless" appropriately when new rule is created.
* objects_init.xml: added object "All TCP established" - a tcp
object with open port range and flag "established"
* PolicyCompiler_ipf.cpp (PolicyCompiler_ipf::compile): using rule
processor CheckForTCPEstablished in compilers for iptables, ipf
and pf to check for TCP service objects with flag
"established". This is considered an error because these platforms
do not provide support for "established".
* PolicyCompiler_ipfw_writers.cpp (PrintRule::processNext): using
new TCPService object flag "established" in compiler for ipfw.
* PolicyCompiler_ipf.cpp (doSrcNegation::processNext) and
PolicyCompiler_ipfw.cpp: rules created for negation with action
'Continue' should be stateless.
* PolicyCompiler_ipt.cpp (Branching::expandBranch): fixed bug (no
number): compiler used to not set unique internal id for rules in
branches, which lead to chain names like 'C.0' in generated
script.
* PolicyCompiler_PrintRule.cpp (PrintRule::_printLogPrefix): fixed
bug (no number): when a rule number is inserted into a log record
in place of macro %N, it should be formatted as "N/M" for rules in
a branch.
* PolicyCompiler_ipt.cpp (decideOnChainForClassify::processNext):
fixed bug (no number): setting chain for Classify action only if
it has not been set before. Setting chain to POSTROUTING always
broke things if a rule with action 'Classify' was used in a
branch (so the chain has been set to that of the branch)
* RuleSetView.cpp (RuleSetView::changeAction): working on bugs
#1676635: "no way to match on state if the action is drop" and
#1671910: "2.1.8 In 'Branch' acton compiler doesn't insert NEW
stanza". Rule option 'stateless' is automatically set when user
changes rule action so it becomes anything except 'Accept', 'Tag'
or 'Route'. This option is also automatically cleared when action
is switched to any of these three actions. The user can override
these default settings by checking or unchecking the option in the
rule options dialog.
* PolicyCompiler_PrintRule.cpp: working on bugs #1676635: "no way
to match on state if the action is drop" and #1671910: "2.1.8 In
'Branch' acton compiler doesn't insert NEW stanza". Rely only on
rule option 'stateless' to decide whether the rule should have
"-m state --state NEW".
2007-05-06 vadim <vadim@vk.crocodile.org>
* v2.1.12 started
2007-04-28 vadim <vadim@vk.crocodile.org>
* v2.1.11 release
2007-04-24 vadim <vadim@vk.crocodile.org>
* SSHUnx.cpp (SSHUnx::SSHUnx): fixed bug #1702830: "fwbuilder does
not detect errors during policy install". Built-in installer
detects error messages printed by iptables and iptables-restore
and aborts installation process. Summary page shown in the end
reflects this as failed install.
* instOptionsDialog.cpp (instOptionsDialog::updateRollback): fixed
bug #1701971: "Enabeling test mode doent activate the reboot
interval". Checking "Test mode" checkbox in the installer options
dialog should enable widgets that configure automatic reboot
timeout.
2007-04-23 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printModules): bug
#1699483: "hashlimit-htable-expire not set". Compiler
automatically generates name for the --hashlimit-name option if it
is not set in the GUI.
* PolicyCompiler_ipt.cpp (TagIfSrcFw::processNext): fixed bug
#1703954: "Mark target in postrouting chain". Packets that
originate on the firewall should be marked in the OUTPUT
chain. According to the netfilter packet flow diagram at
http://www.shorewall.net/NetfilterOverview.html , rerouting
happens after OUTPUT hook but before POSTROUTING hook.
* FWBTree.cpp (FWBTree::isSystem): fixed bug #1703595: "build 230
crashes when seaching for a deleted object"
2007-04-13 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printModules): fixed
bug 1699483: "hashlimit-htable-expire not set". Added GUI controls
and compiler support for hashlimit module options
"--hashlimit-name", "--hashlimit-htable-size",
"--hashlimit-htable-max", "--hashlimit-htable-expire" and
"--hashlimit-htable-gcinterval"
* OSConfigurator_linux24.cpp (linux24::generateCodeForProtocolHandlers):
fixed bug #1697832: "fc5 kernel 2.6.20 moved *conntrack* modules".
Starting with kernel 2.6.20, netfilter installs *conntrack*
modules in "/lib/modules/`uname -r`/kernel/net/netfilter/" rather
than "/lib/modules/`uname
-r`/kernel/net/ipv4/netfilter/". Modified shell code that finds
and loads all "*conntrack*" and "*nat*" modules, it should now
work with both old and new kernels.
I do not know if this directory change was introduced only by
Fedora or it is general for the netfilter.
* TCPServiceDialog.cpp (TCPServiceDialog::validate): fixed bug
#1695481: "compliation error with lower end port". Before, user
could enter start port range number greater than the end port
range number. Neither the GUI nor compiler noticed this, which
resulted in the incorrect firewall configuration. This fix adds
check in the GUI to not let the user enter port ranges like that.
2007-04-03 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipf_writers.cpp (PrintRule::_printWith): fixed
bug #1676845: "lsrr option not compiling"
* PolicyCompiler_ipf_writers.cpp (PrintRule::_printWith): fixed
bug #1678410: "Ipfilter compiler uses wrong keyword for "fragment""
* utils.cpp (getUserName): fixed bug #1684334: "RCS should use
$LOGNAME when commit"
* ActionsDialog.cpp (ActionsDialog::loadFWObject): fixed bug
#1692411: "can't set accouting rule name (fwbuilder 2.1.11)"
2007-03-24 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::paintCell): fixed bug #1685741:
"GUI crash: click on an empty part of obj tree, then desktop"
2007-03-21 vadim <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (ObjectTreeView::focusOutEvent): working on
the bug #1685741: "GUI crash: click on an empty part of obj tree,
then desktop"
2007-03-18 vadim <vadim@vk.crocodile.org>
* InterfaceDialog.cpp (InterfaceDialog::loadFWObject): minor
redesign of the interface object dialog to make network zone more
prominent and easier to set when network and group objects have
long names.
2007-03-13 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::processNext): fixed
bug #1674940: "if max-src-conn == 0: syntax error". Options
max-src-conn and max-src-states can not have value '0'
* TimeDialog.cpp (TimeDialog::loadFWObject): redesigned TimeService
object dialog
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval):
fixed bug #1672191: "Time limit generates unexpected iptables
command"
* PolicyCompiler_PrintRule.cpp (PrintRule::_printTimeInterval):
Added support for --datestart and --datestop options for module
'time' in compiler for iptables
* started v2.1.11
2007-02-17 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::findWhereUsedSlot): added an item
"Where used" to the context menu associated with objects in rules
* FWWindow.cpp (FWWindow::setPolicyBranchTabName): a workaround
for the bug 1629461: "Policy tabs do not scroll @ window extent on
OSX". The tab widget used to show policy, nat, routing and policy
branch rulesets does not switch to a "folded" mode on Mac OS X
when it needs to show more tabs that fit in the window. Since I
can't figure out a way to force it to do that, I am dropping
"Policy/" from the tab titles for branches to make them
shorter. This will help users with policies with many branches,
however it does not solve the problem because as they keep adding
branches, at some point they won't fit in the window again.
2007-02-15 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::fileCompare): fixed bug #1659832: "No
compile with QT without STL support"
* instDialog.cpp (instDialog::initiateCopy): fixed bug #1661140:
"built-in installer broken in 2.1.9 for PF". Installer incorrectly
set name for files it copied to the firewall if compiler generated
more than one file. Normally two files are generated for PF and
ipfilter.
* v2.1.10 started
2007-02-10 vadim <vadim@vk.crocodile.org>
* v2.1.9 release
* main.cpp (tty_raw): bug #1650369: "[patch] please add support
for GNU/kFreeBSD". Applied patch to make code compile on kFreeBSD.
2007-02-03 vadim <vadim@vk.crocodile.org>
* listOfLibraries.cpp (list): fixed bug #1620284: "conflict when
adding library to Preferences/Libraries". When the user tried to
add a library to the list in Preferemces/Libraries when a data
file with the same object library was loaded, the GUI detected the
conflict and showed error dialog.
* FWWindow.cpp (FWWindow::fileCompare): New feature: new operation
"Tools/Find Conflicting Objects in Two Data Files". This operation
inspects two data files (either .fwb or .fwl) and finds
conflicting objects. Conflicting objects have the same internal ID
but different attributes. Two data files can not be merged, or one
imported into another, if they contain such objects. This
operation also helps identify changes made to objects in two
copies of the same data file. This operation does not find objects
present in one file but not in the other, such objects present no
problem for merge or import operations. This operation works with
two external files, neither of which needs to be opened in the
program. Currently opened data file is not affected by this
operation and objects in the tree do not change. In the process of
this operation user is presented with series of dialogs showing
conflicting objects side by side. In the end the program can
generate report and write it to a text file.
2007-01-30 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::initiateCopy): more for the bug
#1617501:"Install fails after compile". Making sure we always
strip directory path from the file name if user specified full
path for the policy file in the "Output file name" input field in
the "Compiler" tab of firewall object dialog. Need to strip path
when macro "%FWSCRIPT%" is substituted in installation scriptlets
and in some other places.
2007-01-15 vadim <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (linux24::printRunTimeWrappers):
fixed bug (no num.): data files used for run-time AddressTable
objects can have empty lines, the script should skip them.
2007-01-14 vadim <vadim@vk.crocodile.org>
* iptAdvancedDialog.cpp (iptAdvancedDialog::iptAdvancedDialog):
more for bug #1618381: "CLASSIFY/MARK are non-terminating".
Emulation of the terminating behavior for Classify and Tag actions
is now controlled by a global option in the "Compiler" tab of the
firewall properties dialog. This means emulation can be turned on
and off for all rules that might require it at once. It is
impossible to mix such rules with terminating and non-termninating
behavior. The reason for this is that shadowing detection
algorithm can only work with either terminating or non-terminating
rules, not with the mix. Hopefully this is the last change made
for this bug.
* PolicyCompiler_ipt.cpp (ipt::getAddressTableVarName): fixed bug
#1632054: "Runtime AddressObjects FAIL to load if "Name:" contains
"."". Compiler checks if the name of the run-time AddressTable
object contains characters that have special meaning in sheel and
relaces them with '_' when it generates the name of the temporary
shell variable.
* PolicyCompiler_ipt.cpp (splitNonTerminatingTargets): update for
bug #1618381: "CLASSIFY/MARK are non-terminating". Adding iptables
rule with target ACCEPT to make Tag and Classify rules
terminating. This is controlled by checkbox in the action dialog
for actions Classify and Tag. Default setting is off.
2007-01-09 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::scheduleRuleSetRedraw): fixed bug (no
num.): GUI used show fanthom 'Policy', 'NAT' and 'Routing' tabs
when user deleted objects from the Deleted Objects library,
provided some of these objects were previously deleted firewalls.
2007-01-07 vadim <vadim@vk.crocodile.org>
* GroupObjectDialog.cpp (GroupObjectDialog::dropped): fixed bug
#1624577: "group window doesn't stay open on multiple-adds". Using
special flag to tell ObjectTreeView that it should ignore
MouseReleaseEvent it gets after d&d operation, so it wont switch
object in the editor panel. Note the bug triggered only on Mac OS
X.
* FWWindow.cpp (FWWindow::FWWindow): "Apply" and "Close" buttons
in the objct editor panel should be of fixed size horizontally
2007-01-06 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::testFirewall): fixed bug
#1617501:"Install fails after compile". The GUI got confused when
user enter full path to the policy file in the "Output file name"
input field in the "Compiler" tab of firewall object dialog.
* SimpleTextEditor.cpp (SimpleTextEditor::loadFromFile): fixed bug
1619930: "Prolog tab's ScriptEditor's import fails to overwrite"
* OSConfigurator_linux24.cpp (linux24::printRunTimeWrappers):
fixed bug #1628989: "run-time-loaded rules don't accept ";" as
line comment"
* RuleOptionsDialog.cpp (RuleOptionsDialog::changed): fixed bug
#1620206: "RuleOptions' "Apply" button greyed-out until menu
selection"
* SimpleTextEditor.cpp (SimpleTextEditor::SimpleTextEditor): fixed
bug #1619842: "prolog "script editor" opens behind other windows"
* RuleSetView.cpp (RuleSetView::removeRule): fixed bug #1629521:
"can't delete empty chain/policy tab"
* instOptionsDialog.cpp (instOptionsDialog::hidePIXOptions):
installOptionsDialog was too large and did not fit on some laptop
screens. Doing tricks to make sure the dialog properly resized
after unused GUI elements are hidden.
2007-01-04 vadim <vadim@vk.crocodile.org>
* PolicyCompiler.cpp (DetectShadowingForNonTerminatingRules::processNext):
(API change)
fixed bug #1618381: "CLASSIFY/MARK are non-terminating". Non-terminating
rules shadow each other "backwards", that is more general rule
shadows other rules _above_ it. Added flag 'reverse' to the method
find_more_general_rule and added new rule processor
DetectShadowingForNonTerminatingRules that finds such cases of
'reverse' shadowing. Using it for rules in the mangle table for iptables.
* PolicyCompiler_ipt.cpp (finalizeChain::processNext): working on
bug #1618381
* For action Branch with option to add branching rule to the
mangle table: we now generate rules in PREROUTING, POSTROUTING,
INPUT, OUTPUT and FORWARD chains. This is because some targets
can only work in PREROUTING or POSTROUTING chains but we do not
know what rules will user put in the branch. So we need to branch
in all chains
* For rules in mangle table with direction set to Inbound or
Outbound force chain to PREROUTING or POSTROUTING respectively
early. This eliminates duplicates such as the same rule in
PREROUTING and INPUT chains. Also since most (all?) targets that
require mangle table go into either PREROUTING or POSTROUTING
chains, it should be enough to use these two chains.
2007-01-01 vadim <vadim@vk.crocodile.org>
* ActionsDialog.cpp (ActionsDialog::setRule),
PolicyCompiler_ipt.cpp (splitNonTerminatingTargets::processNext):
working on bug #1618381: "CLASSIFY/MARK are
non-terminating". Converting non-terminating targets MARK and
CLASSIFY into equivalent of terminating targets using intermediate
chain and "-g" option to pass control to it. Added a checkbox to
the rule options dialog for action Classify for this, by default
this feature is off.
2006-12-27 vadim <vadim@vk.crocodile.org>
* Compiler.cpp (Compiler::expandGroupsInRuleElement): fixed bug
#1620925: "compile-time AddressTable object with empty file".
Compile-time AddressTable object that uses file with no addresses
should be treated as an empty group according to the "Ignore empty
groups" option. Changes are made as follows:
- Compiler::expandGroupsInRuleElement does not call
s->setAnyElement(); to set rule element to 'any' before adding
addresses from the group. This means that if group is empty, rule
element remains empty (not even 'any', just with no children,
i.e. with size()==0). Note that AddressTable::loadFromSource()
leaves AddressTable object empty if the file does not have any
addresses.
- Compiler::emptyGroupsInRE specifically checks for run-time
MultiAddress objects and skips them so they wont be treated as
empty groups (since they are indeed empty). Compile-time
MultiAddress objects are treated as groups and algorithm that
depends on option 'ignore empty groups' is executed for both empty
regular groups and empty compile-time MultiAddress objects.
* PolicyCompiler_ipt_optimizer.cpp (optimize1::optimizeForRuleElement):
fixed bug #1623113: 'connlimit fails in compiled "address table" rules'
Module connlimit can only be used in iptables rules matching TCP services.
Such iptables commands have "-p tcp" and/or "-m tcp" options. If
a rule in fwbuilder uses TCP Service and connlimit option and has
multiple objects in src and dst, optimizer used to split it to minimize
matches. It however preserved connlimit option in all subrules,
even though some of them did not have TCP service after the split. This
lead to generation of incorrect iptables commands.
* PolicyCompiler_ipt.cpp (Branching::expandBranch): fixed bug
#1623338: "Can not disable rules in a branch". Compiler for
iptables ignored flag 'disabled' on rules in a branch.
2006-12-26 vadim <vadim@vk.crocodile.org>
* VERSION (FWB_MICRO_VERSION): set version to 2.1.9
2006-12-03 vadim <vadim@vk.crocodile.org>
* v2.1.8 released
2006-11-30 vadim <vadim@vk.crocodile.org>
* FirewallDialog.cpp (FirewallDialog::applyChanges): fixed bug
#1589743: "compiler setting should be erased when fw platform
changes". If user configured firewall object to use thrid-party
compiler, this setting should be erased when firewall platform of
this object changes. 1) compilers are always platform-specific and
old compiler most likely won't work with different platform; 2)
'advanced' firewall settings dialog may not have an entry field
for the compiler (e.g. dialog for PIX does not have it)
2006-11-26 vadim <vadim@vk.crocodile.org>
* gui.pro (TARGET): All binaries are renamed to drop suffix
'21'. Opinion poll amongs the mailing list sbscribers showed
majority of users does not care for the ability to install and run
both old and new versions of fwbuilder on the same machine. This
feature creates substantial problems because of the symlinks to
libfwbuilder libraries that have the same name regardless of the
library version ('libfwbuilder.so' and 'libfwcompiler.so'). These
symlinks are required on Linux and *BSD and can not be avoided
easily. The only simple alternative was to rename libraries to
libfwbuilder21 and libfwcompiler21. I was impartial and thought of
doing this but FreeBSD port maintainer did not like this
solution. Given that most users said in the poll they do not want
this feature anyway, I am reverting binary and man page names back
to the old standard scheme without suffix '21'.
2006-11-16 vadim <vadim@vk.crocodile.org>
* FindObjectWidget.cpp (FindObjectWidget::matchAttr): added back
search by regexp - object name or port, protocol or ICMP type
numbers can be defined as regular expressions.
2006-11-09 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (PrintRule::_printDirectionAndInterface):
fixed bug #1593221: "iptables filtering bridge problem - PHYSDEV:
no physdev opti..." Some times rules were generated with "-m
physdev" but witout "--physdev-in" or "--physdev-out" options.
* PolicyCompiler_ipt.cpp (Branching::expandBranch): fixed bug
#1592130: "Policy Chaining Issues". Policy compiler should expand
rule subsets recursively
* FWWindow.cpp (FWWindow::addPolicyBranchTab): working on bug
#1592130: "Policy Chaining Issues". The GUI should properly
display nested branch rulesets.
* set version to 2.1.8
2006-10-30 vadim <vadim@vk.crocodile.org>
* v2.1.7 released
2006-10-28 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (RuleSetView::paintCell): fixes for QT w/o STL support
2006-10-24 vadim <vadim@vk.crocodile.org>
* manually removed <includehint> from findobjectwidget_q.ui and
findwhereusedwidget_q.ui
* build 155
2006-10-23 vadim <vadim@vk.crocodile.org>
* platforms.cpp (getRouteOptions_pf_ipf): fixed bug (no num): the
program used to incorrectly save "route option" parameter that is
used for pf anf ipf firewalls when user edited action "Routing"
for iptables firewall. This would corrupt saved XML file if the
program was used under non-English locale.
2006-10-22 vadim <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (ObjectTreeView::updateTreeItems): eliminated
useless creation of interim QPixmap objects. It appears this was
responsible for creation of tons of extra pixmaps that triggered
bug 1582130 on windows.
Bug ##1582130: "GUI crashes on windows when very large data file
is opened" is now fixed.
2006-10-21 vadim <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator::addTreePage): working
on bug #1582130: "GUI crashes on windows when very large data file
is opened". Using QPixmapCache everywhere.
* PixmapFactory.cpp (PixmapFactory::getPixmap): bug #1582130 "GUI
crashes on windows when very large data file is opened". Ran into
a known limitation on number of simultaneously created pixmaps on
Windows. If the data file contains over 3000 obects or so, the GUI
crashes on Windows. This is caused by the fact that GDI has global
limit on the number of pixmaps. See here:
http://lists.trolltech.com/qt-interest/2005-01/thread00679-0.html
Using QPixmapCache class to cache and reuse pixmaps, using it via
simple wrapper PixmapFactory that automatically creates pixmaps
not found in the cache.
2006-10-20 vadim <vadim@vk.crocodile.org>
* listOfLibraries.cpp (listOfLibraries::listOfLibraries): fixes
for QT w/o STL support on win32
2006-10-19 vadim <vadim@vk.crocodile.org>
* DialogData.cpp (DialogData::loadToWidget): properly using
remapping tables while loading strings into QComboBox when program
runs under international locale. Strings for qomboboxes are
defined in platforms.cpp and need to be translated accordingly.
2006-10-16 vadim <vadim@vk.crocodile.org>
* RCSFileDialog.cpp (RCSFileDialog::getSelectedRev): fixed bug
#1578502: "crashing opening file". The GUI crashed if the user
switched "open file" dialog to detailed list mode and then tried
to open a file.
2006-10-15 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::_printAction): All
compilers print error mesage when they encounter unknow action in
a rule
* Preprocessor.cpp (Preprocessor::convertObject): fixed bug
#1575355: "Compiler tries to resove deleted AddressTable
objects". Using findWhereUsed to find if MultiAddress object is
used in firewall being compiled so we don't try to resolve objects
that are not used anywhere.
* FWObjectDatabase.cpp (FWObjectDatabase::findObjectsInGroup):
code refactoring: moved methods findObjectsInGroup and
findWhereUsed from the GUI to API.
2006-10-08 vadim <vadim@vk.crocodile.org>
* v2.1.6 build 134: major improvements in support for outbound
ACLs in PIX 7.0 in compiler for PIX. Added file
'v21_migration_notes.txt' to fwbuilder-pix package
2006-10-07 vadim <vadim@vk.crocodile.org>
* NATCompiler_PrintRule.cpp (PrintRule::_printDstService): fixed
bug#1572735: "Wrong syntax with TagService in NAT table". Added
mssing "-m mark"
2006-10-06 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipfw.cpp (SpecialRuleActionsForShadowing::processNext):
rule with action 'Pipe' or 'Custom' should not shadow other rules
* PolicyCompiler_ipfw_writers.cpp (PrintRule::processNext):
compiler for ipfw generates rule with action check-state depending
on the setting of he option "Add rule to accept packets matching
dynamic rules created for known sessions". This option is
controlled by a checkbox in the firewall settings dialog.
* TableFactory.cpp (TableFactory::PrintTables): if AddressTable
object is configured to resolve at run time but file name is left
blank, compiler for PF generates PF configuration as follows:
"table <tblname> persist". That is, it omits 'file "filename"'
clause all together. This is useful if table is updated
automatically using "max-src-conn, overload <table>" option and
does not need to be pre-populated with addresses from a file.
2006-10-05 vadim <vadim@vk.crocodile.org>
* pixAdvancedDialog.cpp (pixAdvancedDialog::pixAdvancedDialog):
added option "Generate outbound ACLs" for PIX 7.0
2006-10-02 vadim <vadim@vk.crocodile.org>
* Checking in updated German translation by Hans Peter Dittler
<hpdittler@braintec-consult.de>
2006-09-29 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (ipt::compile): fixed bug #1567873:
"CLASSIFY/Logging". eed to run rule processor
decideOnChainForClassify before rule is split for negation or
logging to properly pick up chain for action Classify. Previously
rules with this action and either negation or logging would match
packets in chains INPUT/OUTPUT/FORWARD but use chain POSTROUTING
when applying action.
2006-09-28 vadim <vadim@vk.crocodile.org>
* pf.cpp (main): 'Prolog' section of the generated script can now
be added in different places:
- to the activation shell script, as before
- at the very top of generated .conf file
- after 'set' commands in the generated .conf file
- after 'scrub' commands in the generated .conf file
- after table definitions in the generated .conf file but
before all policy commands
2006-09-26 vadim <vadim@vk.crocodile.org>
* checking in updated Russian localization by <sov@rbsec.ru>
2006-09-21 vadim <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator::deleteObj): fixed bug
#1562965: "no confirmation when deleting an object". In a scenario
when user starts with an emty object tree, then adds a firewall
with an interfaces, then tries to delete the interface, the GUI
would just delete it without presenting the user with "Are you
sure ?" confirmation dialog.
2006-09-20 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (convertAnyToNotFWForShadowing::processNext):
fixed bug #1562348: "a case of undetected rule shadowing".
Compiler did not detect shadowing in the pair of rules where first
rule was 'any any service' (flag 'firewall is part of any' is ON)
and the second was 'fw any service' when global flag 'firewall is
part of any' is OFF
* confirmdeleteobjectdialog_q.ui: fixed bug #1561165: "Delete
dialog box sizing incorrect"
* FWObject.cpp (FWObject::shallowDuplicate): API change: fixed bug
1562290: "GUI crashes in discovery
druid". FWObject::shallowDuplicate should add to database index
only if dbroot is defined. If dbroot==NULL, trying to copy it from
parameter x of shallowDuplicate (the object we are duplicating),
but need to check if dbroot is != NULL after that as well, because
object we are dulicating may not belong to any object tree. This
is the case with interface objects created in
SNMPQuery::fetchInterfaces
2006-09-17 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (PrintRule::processNext): feature
request #1531599: "max-src-conn and max-src-conn-rate". Added
support for max-src-conn and max-src-conn-rate options n compiler
for PF.
* RuleOptionsDialog.cpp (RuleOptionsDialog::loadFWObject): feature
request #1531599: "max-src-conn and max-src-conn-rate". Added GUI
elements to support these PF options.
2006-09-16 vadim <vadim@vk.crocodile.org>
* SSHPIX.cpp (SSHPIX::stateMachine): fixed a bug in the code that
deals with previously unseen ssh host key. Properly terminating
session if user hits 'No'; stopping heartbeat timer while waiting
for user input.
* FWWindow.cpp (FWWindow::install): compile/install wizard is now
a top level non-modal window, it can be used in parallel with the
main window so one can inspect and fix rules while still looking
at the output produced by the compiler, or work with objects and
rules while pushing policy update to the firewall.
2006-09-15 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog::installerError): fixed bug #1559697:
"built-in installer crashes on incorrect password"
2006-09-14 vadim <vadim@vk.crocodile.org>
* FWObjectClipboard.h: clipboard holds list of object IDs instead
of object copies. Clearing clipboard when an object is deleted
from the "Deleted objects" library in ObjectManipulator::delObj.
* FWWindow.cpp (FWWindow::load): calling FWObjectDatabase::reIndex
to fix object reference counters and rebuild the index after
object tree is loaded from .fwb file. Doing the same in all policy
compilers.
* NATCompiler_pf.cpp (splitForTSrc::processNext): fixed bug
#1556984" "Nat statements in PF are missing (source-natting)"
Compiler was too restrictive checking firewall's interfaces while
generating 'nat' rules. It generated such rule only when it was
able to find an interface with address/netmask combination that
defined subnet to which TSrc address belonged. 2.0.X used to be
more liberal and created nat rule even if such interface was not
found, in such case it generated nat rule bound to all interfaces
of the firewall.
2006-09-13 vadim <vadim@vk.crocodile.org>
* ActionsDialog.cpp (ActionsDialog::iptRouteContinueToggled):
fixed bug #1557827: "iptables, routing, iif and continue". GUI
enforces rules on options to iptables target ROUTE: 'continue' is
mutually exclusive with --iif and --tee, therefore checking option
'Continue packet inspection' disables options 'Change inbound
interface to' and 'Make a copy' (GUI elements are greyed out).
2006-09-10 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::scheduleRuleSetRedraw): using timer
event to make sure rule sets are redrawn no more than once when
needed.
2006-09-08 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::load): using
FWObjectDatabase::addToIndexRecursive to quickly reindex whole
database once datafile is loaded. This works very fast.
Fixes everywhere for the new format of FWObjectDatabase::create
2006-09-07 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::load): improvements in the GUI
ergonomics when working with very large data files:
- The main window opens before the file specified on the command
line is loaded
- Using status bar to print messages indicating progress of the
file loading process
- Enforcing objects indexing after the file is loaded, this
speeds things up later
* ObjectEditor.cpp (ObjectEditor::actionChanged): fixed bug
#1553394: "Options windows stays the same".
2006-09-05 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow::killInstDialog): compile/install dialog
is now not modal, this means the user can look at the policy and
objects while compilation and/or installation is going on. This is
especially convenient as it allows one to inspect the rules after
failed compilation while still having compiler error on screen.
* VERSION: set version to 2.1.6
* configure.in: added check to make sure qmake found by configure
really is part of QT 3.x. This should help avoid build failures on
systems where both QT 3.x and 4.x are installed and where
/usr/bin/qmake is really QT 4.x qmake which we can not use.
2006-08-31 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipfw.cpp (processMultiAddressObjectsInRE):
checking for (currently unsupported) run-time AddressTable objects
* All compilers: fixed bug #1544488: 'Error with DNS_name object
when "resolve during run time"'. Needed to swap run-time DNSName
and AddressTable objects with MultiAddressRunTime during rule
shadowing run
2006-08-29 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (readFromStdout): properly processing text coming
from the background process if it comes buffered in chunks that
include several lines of text and possibly incomplete last
line. Previously, text would come out werdly formatted in the log
window.
* instDialog.cpp (processExited): detectig situation when
background process (compiler) crashes or is killed
* RuleSetView.cpp (fixRulePosition): this method fixes rule
position if it is incorrect (this happens sometimes because of
errors in auto-upgrade transformations). fixRulePosition checks if
object the rule belongs to is read-only or belongs to a read-only
subtree in the database and temporarily breaks the lock in order
to be able to fix rule position. This method is recursive so it
supports cases when several objects between the rule and database
root are read-only.
2006-08-27 vadim <vadim@vk.crocodile.org>
* instDialog.cpp (prepareInstallerOptions): Added checkbox 'save
copy of fwb file on the firewall' to the installer options
dialog. If this checkbox is on, installer copies .fwb file to the
firewall before it copies generated configuration and activates
it. This can be used as last resort backup but should be avoided
if firewall is managed from remote workstation and especially if
many firewalls are managed from dedicated management
workstation (because storing fwb file on each firewall means
security policy of all firewalls resides on all every one of them).
This option is off by default.
2006-08-26 vadim <vadim@vk.crocodile.org>
* ConfirmDeleteObjectDialog.cpp (findForObject): redesign of the
dialog: now showing objects to be deleted and their parent objects
in the same list with selection disabled. This removes confusion
caused by the text in the dialog saying that 'seletect objects'
were bout to be deleted and ability to select objects in the
confirmation dialog.
2006-08-20 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf.cpp (fillDirection::processNext): fixed bug
#1543684: "fwb 2.1.5 IPFilter fallback rule issues". Fallback rule
should be 'pass out' if option 'Pass all outgoing' is used.
2006-08-19 vadim <vadim@vk.crocodile.org>
* MangleTableCompiler_ipt.cpp (processNext): (new feature): added
checkbox to the action 'Branch' for iptables "In addition to
'filter', create branching rule in 'mangle' table as well". When
this parameter is activated, compiler creates branching rules in
both filter and mangle tables; in mangle table it always uses
chains PREROUTING, INPUT, OUTPUT and FORWARD.
* PolicyCompiler_ipt.cpp (processNext): fixed bug #1534423 "2.1.5,
mark action rules in branches". Added checkbox "Mark packets in
PREROUTING chain" to the action "Tag" for iptables. Compiler
places rule into PREROUTING chain when this parameter is
activated.
2006-08-18 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (compile): working on bug #1534423
"2.1.5, mark action rules in branches". Branch rules with action
Tag go into mangle table.
2006-08-17 vadim <vadim@vk.crocodile.org>
* gui.cw: this file is used by QT to save descriptions of custom
widgets
* ObjectManipulator.h: added bunch of missing virtual destructors
to various classes
2006-08-10 Vadim <vadim@vk.crocodile.org>
* ConfirmDeleteObjectDialog.cpp (ConfirmDeleteObjectDialog):
completed implementation of feature request #1116454: "Where Used
Option". When the user tries to delete an object from the tree,
the GUI presents a list of groups and firewall rules where this
object is used.
2006-08-09 Vadim <vadim@vk.crocodile.org>
* instDialog.cpp (findFirewalls): main menu item 'Compile' and
corresponding toolbar button activate compilation/installation for
all firewalls in all libraries. This fixes bug #1531007: "no
firewall in comp/inst dialog if standard library selected"
* utils.h (findByObjectType): added parameter bool skip_system_libs.
This method will skip libraries DELETED_LIB and TEMPLATE_LIB if this
parameter is true (which is its default value).
2006-08-08 Vadim <vadim@vk.crocodile.org>
* ObjectEditor.cpp (validateAndClose): fixed bug (no num.):
"Apply" button in the editor panel would not activate when user
reopened an object after it was edited and then editor panel
closed.
2006-08-08 Vadim <vadim@vk.crocodile.org>
* ObjectEditor.cpp (apply): fixed bug #1531020: "gui behaviour on
object renaming". Changing name of the selected object in the
editor updated it in the tree but not in the rule set view.
* ActionsDialog.cpp (applyChanges): fixed bug #1531008: "gui
behaviour improvements". Gui used to reset rule selection after
user selected different object in the tree.
2006-08-05 Vadim <vadim@vk.crocodile.org>
* newFirewallDialog.cpp (newFirewallDialog): fixed bug #1525808:
"fwbuilder21: Windows are too large ". One of the pages of the
firewall creation druid was too large vertically, as the result
whole druid would not fit on screens 1024x768 with standard font
bigger than 18pt
* FindWhereUsedWidget.h (class FindWhereUsedWidget): Feature
request #1116454: "Where Used Option". Ilya implemented "Find
Where Used" function which quickly finds and shows rules of all
firewalls that utilize a given object.
2006-07-23 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (copyRule): still debugging problems caused by
QT w/o STL support. Also got rid of methods RuleSetView::isSrc,
isDst, isSrv etc, makes code cleaner cause these methods violated
data access boundaries in the class hierarchy.
2006-07-22 vadim <vadim@vk.crocodile.org>
* FWObjectPropertiesFactory.cpp (getPolicyRuleOptions): fixes in
bunch of places where code assumed QT is built with STL support
2006-07-20 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt_optimizer.cpp (processNext): checking if
objects in srv are of the type TCPService or UDPService; if they
are, treat srv as if it has one object even if there are several in
it. This eliminates uncessesary rule splitting that optimizer used
to do.
* PolicyCompiler_ipt.cpp (compile): moved
InterfacePolicyRulesWithOptimization further down the chain of
rule processors to let other processors properly decide on chain
for rules that are associated with multiple interfaces. Such rule
is now treated as if it has one interface, and most of the chain
and target decisions are made before the rule is split. When the
rule is split in InterfacePolicyRulesWithOptimization, each part
gets one interface from the original list.
* PolicyCompiler_ipt.cpp (SrcNegation): all rule processors that
work with negation reset "Interface" rule element in subrules they
create except for the very first.
* main.cpp (main): removed plays with styles on Mac, they proved
unnecessary
2006-07-18 vadim <vadim@vk.crocodile.org>
* unit_tests.cpp (main): unit test for RCS module, currently only
checks if rlog reading routing works right
* RCS.cpp (RCS): trying to fix mysterious bug that causes RCS
module to misinterpret RCS log in some cases and read modification
date/time instead of the name of the user who apparently opened
and locked the file. However in cases like that the file in fact
is checked in and unlocked. Instead of reading rlog output line by
line and using regex to parse each line separately, we now read
the output in chunks using '------' as a separator. Each chunk
corresponds to one revision and all regexps are written to work on
the whole chunk instead of one line.
2006-07-17 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (paintCell): When user selects an object in the
rule set, all references to the same object in other rules are
highlighted by drawing thin red frame around them. Similarly, when
an object is selected in the tree, all references to it in the
currently visible ruleset are similarly highlighted. This helps
enforce the notion that all instances of the object in rules are
really references to the same object, as well as helps locate
these references visually.
2006-07-12 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (exportLibraryTo): user choses libraries for export
using spearate modal dialog instead of built-in panel in the file
choosing dialog in the "File/Export Library" function
2006-07-11 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (FWWindow): FindObjectWidget is not a custom widget
anymore - this is a workaround for QT bug #85440 :
http://www.trolltech.com/developer/task-tracker/index_html?id=85440&method=entry
2006-07-09 vadim <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (contentsMouseReleaseEvent): bugfix: the GUI
used to switch object in the editor if user tried to open a
different library and expand/collapse subtree in it. It should not
do this, expading/collapsing subtrees should not cause object
switch in the editor.
2006-06-30 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (paintCell): highlighting whole table cell for
rule options/actions/directions/etc when corresponding rule
element is selected.
* Added title bar with icon and object type name to dialog panels
for all object types
2006-06-25 vadim <vadim@vk.crocodile.org>
* PrefsDialog.cpp (PrefsDialog): removed "Data format" tab from
the Preferences dialog. Option that turns off saving standard
objects in every users data file was on by default for a long
time, now it is time to remove the GUI control all together.
* FWBSettings.h: using macro SETTINGS_PATH_PREFIX to define path
prefix for settings. This makes it easier to change the prefix
when new version is introduced
2006-06-23 vadim <vadim@vk.crocodile.org>
* DiscoveryDruid.cpp (): using QDns to get host names for
discovered ip addresses instead of our own DNS methods
2006-06-21 vadim <vadim@vk.crocodile.org>
* NATCompiler_pf_writers.cpp (_printPort): fixed bug #1509411:
"FWB does not build correct PF RDR port ranges". RDR rules should
support port ranges in the RHS of "->"
* qmake.inc.in: Passing CXXFLAGS from environment to the build
process. Fedora engineers had to add a hack to their .spec file to
do this, this change makes their hack unnecessary
2006-06-17 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (_printRouteOptions): implemented
spport for action Route for PF
2006-06-15 vadim <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (contentsMouseReleaseEvent): fixed selection
of multiple objects in the tree and interaction with editor.
2006-06-14 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): implemented support for
action Route for iptables
2006-06-13 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (openObjectInTree): selecting object in a rule
automatically opens it in the tree (both when editor opened and
when it is closed)
2006-06-11 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (requestEditorOwnership): moved all the logic
controlling switching between objects whith editor open to this
method of FWWindow, this significantly simplifies other
classes. Now we can properly process situations when user opens an
object in a rule, edits it and then tries to open an object in the
tree for editing. This also works in other situations when object
with unsaved changes is opened in the editor and user tries to
switch to another one, possibly in a different panel or
widget. Still need to explore ways to maintain synchronized object
highlighting in the tree and in rules.
2006-06-06 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (maybeTip): directions are represented only by
icons with no text; added tooltip for directions
* ObjectEditor.cpp (validateAndSave): cleanup in ObjectEditor
class - reusing method validateAndSave in methods close,
validateAndClose
* FirewallDialog.cpp (loadFWObject): "snmp" tab of the firewall
object dialog has been deprecated
2006-06-04 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (revealObjectInTree): change in the GUI
behavior: - selection in the tree and ruleset are mutually
exclusive, that is selecting an object in ruleset turn selection
off in the tree and vice versa. Added menu item "Reveal in tree"
to the context menu that appears when user clicks right mouse
button on an object in ruleset.
* PolicyCompiler_ipt.cpp (processNext): Added support for CONNMARK
as an option for rules with action Tag. If a checkbox "Mark
connections created by packets that match this rule" in rule
options of a rule with action Tag is checked, compiler adds
iptables command to save mark set by the Tag action into connmark
module, and then adds another command at the beginning of the
policy to restore it.
2006-06-03 vadim <vadim@vk.crocodile.org>
* ActionsDialog.cpp (setRule): New rule action: "Route", to be
mapped to ROUTE target for iptables and 'route' option for pf and
ipf
2006-05-31 vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (paintCell): When a group is opened in the
editor, an object can be highlighted there which is different from
the object highlighted in rules. Using alternatie color to
highlight object in rules when user switches keyboard focus to the
editor panel. This helps avoid confusion caused by identical look
of objects highlighted in rules and group view. Currently using
QColorGroup::midlight() to get color for when ruleset widget has
no focus. This is probably incorrect because color should change
when widget's colorGroup() changes from active to normal. Using
midlight color may lead to incorrect results if QT theme does not
define this color properly.
2006-05-25 vadim <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (edit): GUI opens objects in the editor
panel on single mouse click on an object in the tree if editor
panel is opened. If it is closed, click just changes selection in
the tree. Drag and drop works because object is opened in the
editor on mouse release. Similarly, if user navigates in the tree
using keyboard, object is opened in the editor on keyReleased
event. Multiple selection works both by mouse and by keyboard.
2006-05-20 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf.cpp (swapAddressTableObjectsInRE):
AddressTable objects are converted to PF tables with the name of
the object in both run-time and compile-time mode. This is so only
for PF because other compilers simply expand compile-time
AddressTable objects as a group of addresses (and lose its name in
the process). Administrator can use compile-time AddressTable
object to create tables with names known beforehand. In the future
these tables can be used with 'overflow' rule option that updates
tables automatically.
* TableFactory.cpp (init): implemented persistent tables in
compiler for PF: compiler maintains list of tables it creates
between passes for NAT and policy rules. This reduces duplication
if the same tables need to be created for both policy and NAT
rules. Tables for branched rule sets (anchors) are generated
separately and may duplicate those in the main rule set (although
their name is different).
2006-05-16 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf.cpp (processMultiAddressObjectsInRE): DNSName
object now inherits MultiAddress, this allows for DNSName to be
expanded into multiple addresses at compile time. Run time support
hasn't changed because most fw platforms automatically expand
domain name into all IP addresses defined as DNS A records for
this name.
2006-05-14 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (unselectRules): rule set should lose focus when
object editor is opened in a panel. Object shown in the editor is
highlighted in the tree anyway. This works better during search
when "find next" finds object in the tree
* NATCompiler_PrintRule.cpp (processNext): fixed bug #1476797:
"ipt NETMAP, POSTROUTING** chain --to problem with multiple
network targets".
* PolicyCompiler_PrintRule.cpp (_printModules): Added support for
hashlimit module for iptables (with an option for older systems
where the same module is called dstlimit)
2006-05-13 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (_printModules): added support for
connlimit module for iptables
2006-05-12 vadim <vadim@vk.crocodile.org>
* RuleOptionsDialog.cpp (loadFWObject): added input fieds for
iptables module "connlimit"
* Many dialogs: converting all object, rule options and actions
editors from pop-up dialogs to built-in panels.
2006-05-07 vadim <vadim@vk.crocodile.org>
* PrefsDialog.cpp (accept): removed entry field for scp, it is not
used by the installer. Cleaned up in all places where we check if
path to ssh is configured to make sure installer can use it.
* TableFactory.cpp (createTablesForRE): names for tables that go
into an anchor have anchor name prepended to them as a prefix to
ensure global uniqueness. One side effect of this is that
AddressTable objects can only be used either in global rules or in
an anchor, but not in both at the same time because the name of
the table created for such object follows the name of the object
and hence appears the same in the main rule set and in the anchor.
2006-05-06 vadim <vadim@vk.crocodile.org>
* pf.cpp (main): Added support for branching rules for PF,
imlpemented via anchors. Rules defined in branches are stored in
separate .conf files and loaded by the .fw file using
pfctl -a <anchor_name> -f <anchor_rules_file> Anchor rule files
are also added to manifest in the .fw file to make sure the built-in
installer will copy them to the firewall.
* PolicyCompiler_ipt.cpp (processNext): support for branching
rules for iptables (via user-ddefined chain, chain name is
specified as action parameter for action 'Chain')
* FWWindow.cpp (reopenFirewall): added support for policy
branches. Setting rule action to "Chain" or "Anchor" (depending on
platform) creates additional tab with a policy rule set. These
rules represent a branch in the policy, implemented by means of a
user-defined chain for iptables and anchor for pf. Chain or anchor
name is set as action parameter through standard action options
dialog.
* FWWindow.cpp (fileSaveAs): fixed bug #1424880: "Save As" works
incorrectly. "Save As" works as follows:
* a new file is created with the name provided by user, this file
captures the state of the object database as of the moment when
user executed 'Save As' operation.
* if the old file was not in RCS, then any changes made to it
since it was saved to disk last time are lost. In other words,
next time user opens the old file, its content will be as it was
when it was saved to disk last time before using 'Save As'
operation
* if the old file was in RCS, then it is reverted to the head
revision in RCS
* fixed bug #1434321: firewall name heading incorrect after
duplicate. After a firewall object is duplicated, the name of the
new object as shown in the tree and in pull-down list of firewalls
was incorrect.
* ActionsDialog.cpp (setRule): Added GUI support for action
'Branch' (represented as 'Chain' for iptables and 'Anchor' for pf)
2006-04-30 vadim <vadim@vk.crocodile.org>
* platforms.cpp (getActionNameForPlatform): remapping names of
some new actions depending on the target firewall platform. For
example, action "Tag" appears as "Tag" for PF and as "Mark" for
iptables. Also remapping name for actions Pipe and
Accounting. This should help adoption of the new actions by people
who are familiar with corresponding features of the target
firewall platforms. Name mapping is done only for presentation;
all internal references to actions use their abstract internal
names both in the GUI and in all compilers.
2006-04-30 <vadim@beaver.vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (_printOptionalGlobalRules): fixed
bug #1464806: "Global custom log prefix not applied to built in
options". Autogenerated rule that blocks packets matching INVALID
state will use globally set custom logging prefix. "-1" is used
for the rule number; macro "%C" is replaced with the chain name
"drop_invalid"
* NATCompiler_pf_writers.cpp (processNext): fixed bug #1407328:
"NAT / RDR Exception PF problem". "no nat" rule in PF can
translate either into 'no nat' or 'no rdr', depending on what the
user really needs to achieve. There is no way fwbuilder can guess
right by just analysing this single rule, so it will generate both
variants.
2006-04-23 vadim <vadim@vk.crocodile.org>
* SSHSession.h: fix for bug #1455772 did not work on windows where
QProcess added '\0' to each line of the stream passed to the ssh
client. On Unix we run fwbuilder as a wrapper for ssh client and
can intercept and filter these characters but on windows we do not
use wrapper and can't fix the problem that way. Better fix is to
avoid QString (and therefore conversions UTF8 <-> Unicode) all
together. Changed last parameter for constructor of SSHSession and
derived classes from QStringList to list<string>. Now instDialog
reads script as sequence of bytes and does not convert it to
Unicode, then passes to the ssh client via SSHSession as-is. In
principle, this alleviates the need in the hack in main.cpp but I
leave it there just in case. (Forward ported from 2.0.12)
2006-04-23 vadim <vadim@vk.crocodile.org>
* pixAdvancedDialog.cpp (displayCommands): changed title of the
tab where user controls protocol inspectors from "Fixup" to
"Inspect". Added a button to show commands that will be generated
by the compiler for a current combination of inspector
configuration, this button calls policy compiler fwb_pix and feeds
XML to it via standard input. Doing this automatically every time
user touches something in the inspector control widgets may be
slow on underpowered machines or when the data tree is very large
because the GUI needs to start external process, which reads and
parses the whole XML file.
2006-04-22 vadim <vadim@vk.crocodile.org>
* pixAdvancedDialog.cpp (pixAdvancedDialog): calling fwb_pix to
generate protocol inspection commands. Need to implement saving
into a buffer in FWObjectDatabase to make this work.
2006-04-19 ilya <yalovoy@gmail.com>
* FWWindow.cpp (singleInstall): batch compile and intsall
operations are possible when user selects several firewalls in the
tree and uses context menu items "Compile" and "install". Selected
firewalls are automatically checked in the batch install dialog.
* FirewallDialog.cpp (loadFWObject): support for attribute
"inactive" in Firewall. Inactive firewalls are not picked for
batch compile and install operations.
2006-04-10 vadim <vadim@vk.crocodile.org>
* NATCompiler_ipf.cpp (processNext),
ipfAdvancedDialog.cpp (ipfAdvancedDialog): Added support for PPTP
and IRC proxies for ipfilter
2006-04-07 ilya <yalovoy@gmail.com>
* instDialog.cpp (selected): implemented batch compile and batch
install modes. Requires some work to polish the UI but basic
functionality works
2006-03-26 vadim <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (generateCodeForProtocolHandlers):
fixed bug#1364060: "conntrack modules not found". The name of the
'conntrack' module in Linux 2.6 is 'ip_conntrack.ko' and
'ipt_conntack.ko'. Changed shell pattern to match new modules as
well as old ones.
* linux24.xml.in: made "chmod +x" part of the sequence that
copieswall script to make the script is executable. This fixed bug
#1455748: "make firewall script executable"
* main.cpp (main): it appears some older versions of Qt have a bug
referred to in the following article:
http://lists.trolltech.com/qt-interest/2004-10/thread00024-0.html
This bug causes '\0' to be appended to strings passed to/from
QProcess if they are converted to/from utf-8. Added workaround in
the ssh wrapper code to skip zeros. In combination with converting
config file strings from/to utf-8 this fixes bug #1455772: "Problem
with UTF8 Descriptions in FW Objects"
* instDialog.cpp (initiateCopy): need to convert strings of the
config file from utf-8 in order to be able to use methods of
QString to process them. Strings are converted back to utf-8 right
before they are sent to the background ssh process to be copied to
the firewall in SSHSession::sendLine()
2006-03-22 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (prolog): switched from
Compiler::objcache to object index in FWObjectDatabase. Replaced
calls to Compiler::getCachedObject with calls to
FWReference::getPointer() everywhere
2006-03-20 vadim <vadim@vk.crocodile.org>
* ipf.cpp, ipt.cpp, pf.cpp, ipfw.cpp (main): added call to
Preprocessor::compile() to convert DNSName and AddressTable
objects before rule processing starts
2006-03-18 vadim <vadim@vk.crocodile.org>
* OSConfigurator_solaris.cpp (printPathForAllTools): fixed bug
#1393004: "Solaris does not have "egrep -q". Since egrep shipped
with Solaris does not have option '-q', using '-s'
* ipf.cpp (main): fixed bug #1386226: "generated -nat.conf is not
removed when nat rules removed.". Old fw-nat.conf was left in
place when user deleted all NAT rules (the new one was not created
either). Now compiler deletes *-ipf.conf and *-nat.conf files
before creating new ones, also installer gets correct list of
files to read.
* PolicyCompiler_PrintRule.cpp (PolicyRuleToString): fixed bug
#1375432: "fwb_ipt with twice -m state". Compiler used to generate
options "-m state --state XYZ" twice in a situation when
administrator uses custom service that already includes this code
and rule is not stateless.
2006-03-15 ilya <yalovoy@gmail.com>
* ObjectManipulator.cpp (findFirewallsForObject): Using method
findWhereUSed to find firewalls that require compile/install after
an object is modified.
2006-03-15 vadim <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (_findWhereUsed): generic recursive method
that finds all groups and rules that use an object.
2006-03-10 ilya <yalovoy@gmail.com>
* ObjectManipulator.cpp (contextMenu): added temporary pop-up menu
item 'simulate Install' for testing.
* ObjectManipulator.cpp (__Is_Object_Ref_In_Firewall): added
support for detection of firewall objects that require compile and
install after any object in the tree is modified. The code keeps
track of changes made to firewall's policy rules, as well as
changes in all objects in the tree. After the user applies changes
in an object editor, the program inspects every firewall trying to
determine if the object is used in one of its rules. When one or
more firewalls using this object are found, corresponding items in
the tree are highlighted. Indirect usage, such as if the object is
a member of a group that is used in a rule, is also
detected. Multi-level group membership is detected too.
2006-03-07 vadim <vadim@vk.crocodile.org>
* All compilers: compiler prints only one 'success' message at the
and of processing instead of after each section (policy, NAT
etc). This makes it easier to keep track of its progress and is
less confusing if it runs in a silent mode and takes a long time
to process one section. Before, when it printed "Rules compiled
successfully" after each section, the user could interpret this
message as if compiler was done, while in fact it was still
working on the next section
2006-03-06 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (removeFW): restored rule processor that
removes firewall object from src or dst to simplify rule if it
uses OUTPUT or INPUT chain. Doing this only if original rule did
not have negation and we do not add any virtual addresses for NAT.
After removal the rule collapses to a simple command like this:
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
this works fine except if we have added virtual addresses for
NAT. It is assumed that firewall object in rules represents
combination of addresses configured in its interfaces in the
GUI. Virtual addresses added for NAT are considered to be a side
effect and connections should not be implicitly permitted to them
by a rule with fw object in destination. The same applies to fw
object in source. See bug #685947 for discussion. To avoid
inadvertently opening holes in the firewall by a rule like that,
we remove fw object only when it is safe to do so.
2006-03-05 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (decideOnChainForClassify): setting chain
to POSTROUTING for rules with action Classify. Also added checks
for this action in all rule processors that split rules in order
to assign them to INPUT/OUTPUT/FORWARD chains later because this
is not needed for this action (since only one chain is allowed
anyway)
* PolicyCompiler_PrintRule.cpp (_printDstService): added checks
for iptables version "1.3.0"
* PolicyCompiler_PrintRule.cpp (_printDirectionAndInterface):
added support for physdev module for bridging firewalls. This
module is used if interface a rule is associated with is marked as
bridge port and iptables version is set to 1.3.0 or later in the
firewall settings. Feature Request #1000757: "bridging: using physdev"
* All compilers: by default treating bridge port interfaces the
same as unnumbered interfaces, unless target firewall platform
provides special support for bridge ports, such as module
'physdev' in iptables
* InterfaceDialog.cpp (loadFWObject): added support for bridge
port interface
2006-03-04 vadim <vadim@vk.crocodile.org>
* fwbedit.cpp (main), fwblookup.cpp (main): using global variable
instead of singleton FWObjectDatabase::db. FWObjectDatabase::db
is not used in fwbuilder2 anywhere and can be eliminated.
* FWObjectClipboard.cpp (add): must create new objects using
current instance of FWObjectDatabase because it maintains internal
object index. Replacing FWObjectDatabase::db with mw->db() to
accomplish that
* getting rid of singleton FWObjectDatabase::db in the GUI -
replacing it everywhere with mw->db()
2006-02-28 Vadim <vadim@vk.crocodile.org>
* FWObjectPropertiesFactory.cpp (getObjectProperties): printing
firewall's lastModified, lastCompiled and lastInstalled timestamps
in the info window and in tooltips
2006-02-26 ilya <yalovoy@gmail.com>
* ObjectManipulator.cpp (updateLastModifiedTimestamp): added
methods to keep timestamps for the moments when a Firewall has
been modified, compiled and installed. Using these timestamps to
provide visual indication for when a firewall needs to be
installed using bold font for its name in the tree view. Will use
the same mechanism to automatically suggest which firewalls to
install when user hits "Install" menu item or toolbar
button. Still need to implement object modification tracking to
properly detect which firewall needs to be marked when an object
is modified (an object can be used in a firewall rule directly or
indirectly if it is a member of a group)
2006-02-19 vadim <vadim@vk.crocodile.org>
* FWWindow.cpp (reopenFirewall): the GUI shows "Routing" tab only
if the corresponding policy compiler for a give host OS supports
it. Using <capabilities> element in the res/os/OS.xml resource
file.
* FirewallDialog.cpp (fillVersion): fixed a bug where firewall
versions would appear in a mixed order in the 'version' pull-down
in firewall object dialog
2006-02-18 vadim <vadim@vk.crocodile.org>
* Added support for load balancing rules in PF
* Added support for address ranges and network objects in TSrc in
NAT rules for PF
* Added support for pool types in NAT rules for PF ('bitmask',
'random', 'source-hash', 'round-robin') as well as 'static-port'
option
* PolicyCompiler_ipf_writers.cpp (_printAction): basic support for
Custom action for ipfilter. Lack of examples for actions 'auth'
and 'call' in ipfilter documentation or anywhere on the web makes
it hard to implement right.
* PolicyCompiler_ipfw_writers.cpp (_printAction): Added support
for policy rule action Custom for ipfw
* PolicyCompiler_ipfw_writers.cpp (_printAction): Fwbuilder policy
rule action 'Classify' is mapped to ipfw actions 'pipe' or
'queue'. Fwbuilder policy rule action 'Pipe' is mapped to ipfw
action 'divert'
2006-02-17 ilya <yalovoy@gmail.com>
* execDialog.cpp (saveLog): Added a button and function to save
compile or install progress log to a file with extension .txt
* killed startup wizard; the GUI starts accordingly to the setting
on the first page of the Preferences dialog - it can either start
up showing just standard objects library or automatically open
file the user was editing last time the GUI was used.
* object created using "Duplicate" menu item is automatically
activated and opened in the editor
2006-02-15 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (_printQueue): implemented support
for action 'Classify' in compiler for PF, mapped to a filtering
rule option 'queue _queue_name_'
* PolicyCompiler_PrintRule.cpp (PrintRule): implemented support
for actions 'Classify' and 'Custom' in compiler for
iptables. Action 'Classify' is mapped to '-j CLASSIFY --set-class M:N';
action 'Custom' is used verbatim
2006-02-15 ilya <yalovoy@gmail.com>
* :version 2.1.5
* :Added new Actions 'Classify' and 'Custom'.
* :Added new dialog NATRuleOptionsDialog.
* RuleSetView: In NATView inserted new column "Options" for
viewing of Nat Rule Options.
2006-02-11 ilya <yalovoy@gmail.com>
* DiscoveryDruid.cpp (checkSNMPCommunity): unified method to check
validity of the host name/ip address for dns name server used for
zone transfer and seed host used for snmp crawler
2006-02-09 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (_printDstService): added support
for the TagService object (using 'tagged')
* PolicyCompiler_PrintRule.cpp (_printDstService): added support
for the TagService service object (using --mark)
2006-02-09 ilya <yalovoy@gmail.com>
* DiscoveryDruid.cpp (DiscoveryDruid): improvements in the
implementation of the address and name validity for snmp crawler
seed host and dns server for dns zone import. Implemented support
for IP aliases in snmp crawler
2006-02-05 ilya <yalovoy@gmail.com>
* DiscoveryDruid.cpp (save): saving/restoring parameters of the
DiscoveryDruid between sessions
2006-01-27 ilya <yalovoy@gmail.com>
* DiscoveryDruid.cpp (changedSelected): proper implementation of
long/short name generation for dns zone import; proper checks for
correctness of the seed host address for snmp crawler; showing
number of interfaces in discovered hosts on the results page
2006-01-21 vadim <vadim@vk.crocodile.org>
* gui.pro (IMAGES): grand icons clean-up and update. Removed old
unused icons and images, added new icon theme by Irina Filvarova
2006-01-20 ilya <yalovoy@gmail.com>
* DiscoveryDruid.cpp (changedSelected): working version of
discovey druid. Got rid of all calls to setModal, hence
workarounds defined in qt_workarounds.h are not needed anymore
2006-01-16 vadim <vadim@vk.crocodile.org>
* DiscoveryDruid.cpp (stripObjects): minor formatting cleanup in
DiscoveryDruid; fixed typos in DiscoveryDruid ('wasCanceled' ->
'wasCancelled'); refactored #includes to improve compilation speed
in DiscoveryDruid
* DiscoveryDruid.cpp: had to move '#include "DiscoveryDruid.h"'
below all qt #include's to make code compile on windows. When this
#include was above qt includes, compiler would stop with an error:
------------------------------------------------------------
C:\Qt\3.3.1\include\qlistbox.h(139) : warning C4003: not enough actual parameter
s for macro 'index'
C:\Qt\3.3.1\include\qlistbox.h(139) : error C2059: syntax error : ')'
C:\Qt\3.3.1\include\qlistbox.h(139) : error C2143: syntax error : missing ')' be
fore ';'
------------------------------------------------------------
I haven't figured out where does 'index' macro come from
* discoverydruid_q.ui.h: added workarounds for missing
QDialog::setModal in QT 3.1
* FWWindow.cpp (doCompile): since we now package platform and os
resource files with externally packaged compilers, we do not need
to use "-r" flag while calling compilers anymore
2006-01-10 ilya <yalovoy@gmail.com>
* DiscoveryDruid.cpp (startHostsScan): implemented object import
from a file in "/etc/hosts" format. This includes druid page where
user selects objects from the list, a page where they can assign
object type for each record and a page where they chose a library
new objects should be part of
2006-01-07 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipfw_writers.cpp (_printAction): support for
action Pipe in ipfw. This action can be implemented using
"divert", "pipe" or "queue" rule actions in ipfw; the method is
chosen using rule action parameters dialog in the GUI.
* ActionsDialog.cpp (setRule): support for action Pipe for ipfw in
the GUI.
* PolicyCompiler_pf_writers.cpp (_printAction): added support for
Tag action for PF
2006-01-03 vadim <vadim@vk.crocodile.org>
* ipt.cpp (main): implemented checks for the situation when
compiler produces an empty script. In such cases we avoid printing
any header or commit commands (such as '*mangle' and 'COMMIT'
if iptables-restore format is used)
* PolicyCompiler_ipt.cpp (processNext): implemented support for
QUEUE target in compiler for iptables. Commands with this target
are generated for fwbuilder rules with action "Pipe"
* MangleTableCompiler_ipt.h: Implemented support for MARK target
for iptables. Iptables commands with target MARK are generated for
fwbuilder rules using action "Tag". Rules are placed in
INPUT,OUTPUT and FORWARD chain of the "mangle" table, this ensures
that DNAT happens before rules placed in the mangle table see the
packet. PREROUTING chain in mangle table is executed before
PREROUTING chain in the nat table, so placing tagging rules in the
PREROUTING chain would make them fire before DNAT. POSTROUTING
chain of the mangle table, as well as its FORWARD and OUTPUT
chains, work before corresponding chains of the nat table. In all
cases the goal is to make sure DNAT rules process the packet
before, and SNAT rules process it after filtering and tagging
rules.
* AddressTableDialog.cpp (preview): AddressTable dialog "preview"
function looks for the table file in the same directory as
currently opened data file if file name is entered as relative
path
2005-12-16 ilya <yalovoy@gmail.com>
* FWObjectPropertiesFactory.cpp : For objects of type 'interface'
a path to library is included in "detailed properties".
* FWWindow.cpp : Added new menu "/tools/Discovery Druid"
* DiscoveryDruid.cpp : Created basic gui for Discovery druid
2005-12-16 ilya <yalovoy@gmail.com>
* SimpleTextView.cpp: new custom text viewer.
* AddressTableDialog.cpp: file preview uses SimpleTextView.
* newfirewalldialog_q.ui: Dialog size fixed (now all internal
widgets are visible)
* fwbedit.cpp : fixed run with unknown options. Added a new option:
-u - interactive file upgrade
2005-12-14 ilya <yalovoy@gmail.com>
* Added detailed tooltips for rule options for all fw platforms
* Redrawing policy view if user changes firewall version; this
ensures that icon that indicates non-default rule options is
correctly updated in case different versions of the same fw
platform support different combinations of rule options.
* Redesigned page of the new host dialog where user adds
interfaces manually. Before buttons "add","Update","remove" were
hidden because dialog was too small.
2005-12-13 vadim <vadim@vk.crocodile.org>
* po.pro: Added Swedish translation made by Daniel Nylander
<yeager@lidkoping.net>
2005-12-13 ilya <yalovoy@gmail.com>
* RuleSetView.cpp (maybeTip): added tooltips for rule elements
Action and Options
2005-12-02 vadim <vadim@vk.crocodile.org>
* NATCompiler_ipf.cpp (processNext): Run-time AddressTable objects
are not supported in ipfilter; added a placeholder for
corresponding rule processors, aborting compilation when such
object is detected in a rule
* OSConfigurator_linux24.cpp (printPathForAllTools): fixed bug
#1361564: "Prolog script env settings unavailable". Need to define
env variables IPTABLES, LSMOD etc before prolog.
(OSConfigurator_linux24::printChecksForRunTimeAddressTables):
compiler for iptables inserts shell code to ensure that data files
used in run-time AddressTable objects are present before firewall
policy is activated.
* PolicyCompiler_PrintRule.cpp (processNext): implemented run-time
mode for AddressTable object in compiler for iptables. Current
implementation *dos not* emulate dynamic table reloads as can be
done for PF using "pfctl -t table -Treplace" command. The whole
policy script must be run again if data file AddressTable object
refers to changes. Current implementation does not allow comments
in the data file
2005-12-01 ilya <yalovoy@gmail.com>
* version 2.1.4
* new object type TagService
Actions 'Mark' and 'Queue' renamed as 'Tag' and 'Pipe'
respectively.
* fwbedit.cpp: fixing of absent 'TagServices' group added.
* ActionsDialog.cpp: new actions control dialog
* RuleSetView.cpp: changed actions context menu to use new
parameters dialog (support of actions with parameters).
2005-11-24 vadim <vadim@vk.crocodile.org>
* PolicyCompiler_pf.cpp (processNext): added support for run-time
AddressTable objects for PF.
* PolicyCompiler_pf (PrintRule::_printAddr)
* TableFactory.cpp (TableFactory::PrintTables): support for DNSName
run-time mode in compiler for pf, ipfw and ipf
* PolicyCompiler_PrintRule.cpp (_printAddr): support for DNSName
run-time mode in compiler for iptables
2005-11-23 Vadim <vadim@vk.crocodile.org>
* AddressTable object dialog
2005-11-22 vadim <vadim@vk.crocodile.org>
* TableFactory.cpp (createTablesForRE): class TableFactory reuses
existing tables separately for NAT and policy rules. Reuse of
tables created for NAT in the policy rules is difficult because
tables themselves are created in the temporary copy of the tree in
the NAT compiler (the same applies to the objects - members of the
tables)
2005-11-21 vadim <vadim@vk.crocodile.org>
* NATCompiler_pf_writers.cpp (_printAddr): Improvement in the
compiler for PF: using '!' syntax for one-object negations
* NATCompiler_pf.cpp (CeateTables): Improvement in the compiler
for PF: Using tables for NAT rules
* TableFactory.cpp (createTablesForRE): using the same class to
generate tables for both policy and NAT rules for pf. Table names
are composed using rule positions so that table names do not
change between compiler runs (they used to change because they
were created using rule IDs, which changed because compiler
generated lots of copies of rules)
2005-11-14 Vadim <vadim@tourist.vk.crocodile.org>
* version 2.1.3
new object type DNSName
using this method in Compiler::prolog to resolve DNSName objects
that are supposed to be resolved at compile-time
Redesigned RuleOptionsDialog to make room for new options
Added actions MARK and QUEUE with basic support in API and GUI
Added new object type AddressTable
2005-11-05 vadim <vadim@tower.vk.crocodile.org>
* iptAdvancedDialog.cpp (iptAdvancedDialog): fixed bug #1349326
"ulogd option does not work". There was a typo in the class
iptAdvancedDialog ( useULOG instead of use_ULOG )
*** Ported from 2.0.10 ***
2005-11-01 vadim <vadim@tower.local>
* NATCompiler_ipt.cpp (processNext): fixed bug #1342495: "SNAT
with address range". Compiler used to print warning "Adding
virtual addresses for NAT is not supported for address range" even
if adding virtual addresses for NAT was turned off.
*** Ported from 2.0.10 ***
2005-10-26 vadim <vadim@tower.local>
* PolicyCompiler_ipt.cpp (processNext): fixed bug #1313420:
"OUTPUT chain is built wrong under certain conditions." Rules
that have firewall in SRC and DST, while DST has negation, should
be split so that the second generated rule goes into OUTPUT chain
rather than FORWARD
*** Ported from 2.0.10 ***
2005-10-24 vadim <vadim@tower.local>
* FirewallDialog.cpp (openFWDialog): fixed bug #1315892:
"fwbuilder crashes on missing OS template" The GUI crashed if user
added new hostOS or firewall platform template under resources/os
or resources/platforms, then reinstalled the package (and
therefore lost their custom template files), then tried to open
firewall or host OS settings dialog for the object using new
template.
*** Ported from 2.0.10 ***
* RuleOptionsDialog.cpp (loadFWObject): fixed bug #1305933:
"fwbuilder/Solaris: compilation errors". Another case of implicit
type conversion QString->string which does not compile on systems
with QT built w/o STL support.
*** Ported from 2.0.10 ***
* main.cpp: fixed bug #1304878: fwbuilder: signal.h
required (Solaris). Using 'AC_CHECK_HEADERS([signal.h])' in
configure.in to check for the appropriate #include.
*** Ported from 2.0.10 ***
* configure.in: fixed bug #1304764: "configure script: Sun make
check fails". Need to use ${MAKE-make} instead of $ac_make when
checking for GNU make.
*** Ported from 2.0.10 ***
* fixed bug #1304785: "fwbuilder - Solaris has no libutil". Using
better way to check whether we need to link with libutil.
*** Ported from 2.0.10 ***
2005-10-22 vadim <vadim@vk.crocodile.org>
* VERSION: set version to 2.0.10 in branch fwb2-2.0-maint
2005-09-29 Vadim <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (InterfacePolicyRulesWithOptimization):
new rule processor: checks if the rule is associated with an
interface and uses setInterfaceId to record its id. If the rule is
associated with multiple interfaces, splits the rule
accordingly. Unlike basic processor
PolicyCompiler::InterfacePolicyrules, this processor tries to
optimize rules applied to multiple interfaces using user-defined
chain
***** Policy compilers support multiple interfaces and negation in
"Interface" rule element
2005-09-28 Vadim <vadim@vk.crocodile.org>
* RuleSetView.cpp (paintCell): merged interface policies with
global policy. Keeping most of the code that implements interface
policy tabs just in case.
* set version to 2.1.2
2005-09-26 Vadim <vadim@vk.crocodile.org>
* RoutingRuleOptionsDialog.cpp (loadFWObject): Added support for
routing rules. Using "fwbuilder-routing" patch provided by Tidei
Maurizio <fwbuilder-routing at compal.de>
* set version to 2.1.1
* ObjectManipulator.cpp (createObject),(newDNSName),
newHostDialog.cpp (accept): added checks for broken object tree
2005-09-20 <vadim@vk.crocodile.org>
* DNSNameDialog.cpp (loadFWObject): new object type: DNSName
(Illiya)
2005-09-17 <vadim@vk.crocodile.org>
* 2.0.9 release in branch fwb2-2.0-maint
2005-09-12 <vadim@vk.crocodile.org>
* fwsm.xml.in: Added support for Cisco FWSM (platform and host OS)
* pixAdvancedDialog.cpp (pixAdvancedDialog): Added support for
manual ACL commit in FWSM
2005-09-11 <vadim@vk.crocodile.org>
* SSHPIX.cpp (SSHPIX): enable_prompt should include string "Access
Rules Download Complete" which is _sometimes_ printed by FWSM when
in auto-commit mode.
2005-09-07 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (lockObject): Added ability to lock/unlock
individual objects in the tree (Illiya)
* GroupObjectDialog.cpp (listViewSelectionChanged): Illiya
implemented Feature Req #1151208: "Allow multiple objects select
to make an action (Group)"
2005-09-07 <vadim@vk.crocodile.org>
* SSHSession.cpp (cmpPrompt): overloaded method
SSHSession::cmpPrompt to be able to specify prompt as a regular
expression. This variant is very convenient for PIX prompts.
2005-09-05 <vadim@vk.crocodile.org>
* fixed bug #1254775: "RCS checkin fails on Windows when data file
is too big". RCS tools failed to check the file in if it consisted
of one huge line of text. This fix makes th GUI save data file
(.fwb) in formatted form on Windows, just like on Linux. This
means each XML element is saved on separate line instead of all of
them being on the same line.
2005-09-04 <vadim@vk.crocodile.org>
* NATCompiler_pf.cpp (processNext): fixed bug #1276083:
"Destination NAT rules". Old restriction on "rdr" rules that
required service in OSrv is not valid anymore, pf supports rdr
rules with no protocol specification. (ported from 2.0.9)
2005-09-04 Vadim Kurland <vadim@vk.crocodile.org>
* FWWindow.cpp (fileCommit): properly handling situation when user
hits Cancel in check-in log dialog (should abort File/Commit
operation entirely)
* main.cpp (main): added a workaround to make the GUI work in
Spanish locale (QT 3.3.4 ships with broken qt_es.qm file at least
on Fedora-C4 and Mac OS X)
2005-08-31 <vadim@vk.crocodile.org>
* SSHUnx.cpp (stateMachine): fixed bug #1277129: "script is
truncated when installed by the GUI running on Mac". Large script
was getting truncated while copied to the firewall if GUI was
running on Mac OS X (bugfix ported from 2.0.9)
2005-08-17 <vadim@vk.crocodile.org>
* fwbedit.cpp (usage): Finished implementation of RFE #1211612
"fwbedit - add object?". Using "-p","-L","n" and "-o" command line
switches to specify parent, library, name and attributes of an
object
2005-08-04 <vadim@vk.crocodile.org>
* fwbedit.cpp (main): Illiya is working on RFE #1211612: "fwbedit
- add object?" and #1114501: "Data file repair". Fwbedit can now
add objects as well as repair tree structure. Still needs some
more work.
2005-07-31 <vadim@vk.crocodile.org>
* LINGUAS: Added Spanish translation, thanks to Carlos Lozano
<clozano@andago.com>
2005-07-30 <vadim@vk.crocodile.org>
* Started v2.1.0
2005-07-30 <vadim@vk.crocodile.org>
* FWWindow.cpp (fileCommit): Illya implemented Feature Request
#1187461 "Add "commit" menu item". This menu item commits opened
data file to RCS but keeps it opened so the user can continue
editing.
2005-07-29 <vadim@vk.crocodile.org>
* FWWindowPrint.cpp (addObjectsToTable): Illiya implemented
Feature Request #1225393 "FeatureRequest Print comments on
objects"
2005-07-23 <vadim@vk.crocodile.org>
* RuleSetView.cpp (dragMoveEvent): Illiya fixed bug #1226069:
"Segfault: Drag&Drop between two instances"
2005-07-21 <vadim@vk.crocodile.org>
* platforms.cpp (getLogFacilities): Illiya moved definitions of
log levels, log facilities and actions on reject to module
platforms.cpp. Methods getLogLevel, getLogFacilities and
getActionsOnReject return string lists suitable for using with
DialogData to provide mapping between localized and english
strings so that the user sees translated ones but enlish ones are
written into FWOptions object and used by compilers. This fixes
bugs #1240205: "Iilegal --log-level Information" and #1233165:
"Illegal Logging-Limit string.".
2005-07-08 <vadim@vk.crocodile.org>
v2.0.8 released
2005-07-05 <vadim@vk.crocodile.org>
* SSHSession.cpp (allDataSent): calling allDataSent from heartBeat
slot method because on windows signal 'wroteToStdin' is emitted
before I had a chance to connect it to a slot in
SSHUnx::stateMachine in state PUSHING_CONFIG after entire file has
been transmitted. I used to send an extra '\n' to force signal
'wroteToStdin', but that made the file to be sligltly different on
the receiving end and I do not like that.
* RuleSetView.cpp (dragMoveEvent): not really a change: bug
1226069 "Segfault: Drag&Drop between two instances" requires
redesign of the drag&drop mechanism so that live pointer to
FWObject is not passed between sender and receiver.
2005-07-04 <vadim@vk.crocodile.org>
* SSHSession.cpp (startSession): fixed bug #1232478: "FWB shuts
down on incorrect password". Bug was intorduced in build 624 while
working on installer stalls and undescriptive ssh termination
error when OpenSSH 4.0 was used.
2005-07-02 Vadim Kurland <vadim@vk.crocodile.org>
* main.cpp (main): ignore SIGHUP in the child process in ssh
wrapper. Closing stdin at the end of the file copy sends SIGHUP to
the child. By some reason, this caused ssh to terminate with error
message "killed by signal 1" and return code 255 on Fedora C4
which uses OpenSSH v4.0p1
2005-07-02 <vadim@vk.crocodile.org>
* main.cpp (tty_raw): switched from TCSAFLUSH to TCSANOW in call
to tcsetattr when we switch tty to raw mode in ssh wrapper
code. This should fix mysterious stalls in the installer that were
introduced when I worked on the wrapper code to fix bug #1213361
(problems with file copies on FreeBSD 5.4)
* instDialog.cpp (initiateCopy): added missing "-v" option to ssh
call used to copy policy script to the firewall if "verbose"
checkbox is checked. This should help troubleshoot problems with
installer when ssh fails and terminates with an error.
2005-06-25 <vadim@vk.crocodile.org>
* configure.in: need to call macro AC_PROG_MAKE_SET before
using $ac_make to check for GNU make
* configure.in: added check for cfmakeraw (which is absent on Solaris)
* configure.in: make script continue if forkpty is not found,
the program will use emulation.
2005-06-13 <vadim@vk.crocodile.org>
* FWObjectPropertiesFactory.cpp (getObjectPropertiesDetailed):
sorting list of objects for tooltips. Sorting is done by object
name, alphabetically. TODO: use locale-aware sort and ignore
case of the letters.
2005-06-12 <vadim@vk.crocodile.org>
* main.cpp (main): need to switch the pipe and stdin in the child
process to raw mode in order to ensure proper communication when
fwbuilder works in ssh wrapper mode. This (really) fixes bug
#1213361
* configure.in: Added path to QT where it is installed on 64-bit
systems to the list configure tries while searching for QT
2005-06-11 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): fixed bug #1215279: "rate
limiting rule logs everything". Rule utlilizing "limit" module to
rate limit packets with logging logged every packet and dropped
those that exceeded the limit. The fix makes it apply the limit
first and then log only packets that were dropped.
* main.cpp (forkpty): fixed bug #1072842: "fwbuilder: Solaris and
forkpty". We need forkpty fr built-in installer but this function
is not awailable on Solaris. I am adding re-implementation, but it
hasn't been tested since I do not have Solaris machine.
* FWObjectPropertiesFactory.cpp (getObjectPropertiesDetailed):
fixed bug #1212179: "tool tips for TCP services cuts off some
services". The gui would show very long tooltip for large groups;
if the group was too large, the tooltip did not fit on the screen.
* main.cpp (main): fixed bug #1213361: "PF on FreeBSD-5.4R". Bug
description is misleading, the probem was caused by built-in
installer rather than by compiler for PF. Installer would not copy
generated script over ssh if the script was longer than some
threshold and the gui was running on FreeBSD.
2005-06-05 <vadim@vk.crocodile.org>
* linux24.xml.in: fixed bug #1212121: "sudo shutdown doesn't
work". Installer needs to schedule reboot when the user activates
policy in a test mode. There was a bug in the installer script
that improperly used sudo to run shutdown when installation was
performed using regular user account.
* linux24.xml.in: fixed bug #1212123: "executing file below /tmp
as root". Avoiding world-writable directory /tmp/ while activating
policy in the test mode. This change makes installer use
subdirectory "tmp" under directory specified in the "intaller" tab
of firewall settings dialog. That directory is expected to have
proper permissions; subdirectory "tmp" can be created manually,
otherwise installer creates it. Either way, it is not
world-writable, therefore unauthorized users can not create
scripts in it.
* freebsd.xml.in: Using pkill to find running shutdown process and
kill it to cancel pending reboot. Pkill simplifies the scriptlet
so we don't need to deal with output redirection etc. Pkill is
available on FreeBSD, Linux, OpenBSD and Solaris.
* linux24.xml.in: another fix for a bug #1201406: "shutdown
messages should be suppressed". Scriptlet has been modified to
make sure it works in both sh and csh (user who installs the
policy may have tcsh as their login shell, root may use tcsh too)
2005-05-30 <vadim@vk.crocodile.org>
* src/res/os/*.xml.in: fixed bug #1201406: "shutdown messages
should be suppressed". Installation scriptlet tries to kill
shutdown process, if there is one, to cancel pending shutdown that
might have been left over from test install. If there is none, the
script prints an error message "shutdown process not found" or
similar, which confuses user. Needed to suppress these error
messages.
* fixed bug #1155351: "Remote install of FW rulset fails due to
race condition". Generated ipfw firewall script could not be ran
reliably over ssh session because "ipfw -f" flushes all rules and
all state, which breaks ssh session. As soon as the script needed
to print anything, it got I/O error from the system because TCP
session for ssh was blocked; this stopped the script and did not
let it activate new firewall policy.
* PolicyCompiler_ipfw_writers.cpp (processNext): improvemet in the
compiler for ipfw: added "established" rule on top of the regular
backup ssh access rule; this allows to maintain management ssh
session after the policy is reloaded. both "ipfw -f" and swapping
sets flushes all states, so the ssh session used to upload and
activate new policy breaks. A rule with "established" keyword
maintains this session.
* PolicyCompiler_ipfw_writers.cpp (processNext): improvement in
the compiler for ipfw: using rule sets to atomically swap old and
new rules. New rules are loaded in the set 1 and then swapped into
set 0. If there is an error in a new rule set, it is caught while
loading rules into inactive set 1, at which point script stops
without changing old firewall rules.
* PolicyCompiler_pf.cpp (addDefaultPolicyRule): implemented
support for subnets for backup ssh access for pf,ipf,ipfw. Subnet
can be defined using either full netmask or bitlength: both
"192.168.1.0/255.255.255.0" and "192.168.1.0/24" are
acceptable. Single host address works too, both as "192.168.1.10"
and as "192.168.1.10/255.255.255.255" or
"192.168.1.10/32". Incorrect address or netmask cause compiler to
abort processing.
2005-05-28 <vadim@vk.crocodile.org>
* GroupDialog: fixed bug #1207983: "incorrect size of "I" and "L"
buttons in the group view dialog". Tested with large font and
cleaned up layout in many dialogs.
* HostDialog.cpp (loadFWObject): removed 'snmp community' option
from the Host object dialog - it was not used anywhere
* ipt.cpp (main): fixed bug #1205665: "Error with summer time when
compiling script". Sometimes timezone name has "'" in it which
confuses shell and causes an error when generated script prints
"Activating firewall policy..." log message
* RCS.cpp (RCSEnvFix): fixed bug #1204067: "incorrect timezone
handling in RCS". Windows version of RCS incorrectly converts
check-in time when time zone is east of GMT. Had to use "-z"
option on all RCS commands to explicitly set offset; "-zLT"
produces wrong results in rlog.
* fwb_compile_all (LIB): fixed bug #1200902: "fwb_compile_all does
not work in 2.0". Script fwb_compile_all broke because of changes
in data file format
* PolicyCompiler_PrintRule.cpp (_printTimeInterval): fixed bug
#191423: "Weekend Time restriction not created correctly". Rules
with time restriction spanning from Saturday to Sunday were
generated with incorrect "--day" option
* objects_init.xml.in: fixed bug #210518: 'Incorrect ending day in
the standard object "weekends"'. This object defined time interval
ending at 23:59 on Monday instead of Sunday
* implemented Feature Request #1145666: "Print RCS
Log". File/Properties dialog can now print RCS log. Thanks to
"Ilya V. Yalovoy" <yalovoy@pilot.aip.mk.ua> for the patch.
2005-05-23 <vadim@vk.crocodile.org>
* added updated German translation by Hans Peter Dittler
<hpdittler@braintec-consult.de>
2005-05-20 <vadim@vk.crocodile.org>
* set version to 2.0.8
2005-05-08 <vadim@vk.crocodile.org>
* v2.0.7 released
2005-05-04 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (printPathForAllTools): fixed bug
#1195201: "getaddr function return error ip address". Yet another
change in the way we use grep to find IP addresses of an interface
on Linux. We can't use regex (bug #1123748) and need to filter out
secondary addresses from the "ip addr show" output. It looks like
"grep -v :" neatly solves the problem without using regex.
2005-05-02 <vadim@vk.crocodile.org>
* snmp.cpp: API change: Compiled all OIDs. The program may run on
a system where MIBs are not installed, so we can not always use
symbolic OID names Also using snmp_out_toggle_options to turn
numeric output in all responses (equivalent to -On in snmp tools)
2005-05-01 <vadim@vk.crocodile.org>
* snmp.cpp (walk): API changes: verbose error message, printing
response->errstat code as well as corresponding error string; this
should help debug snmp -related problems better
* snmp.cpp (walk): API changes: using snmp_error to print last
snmp error string
2005-04-27 <vadim@vk.crocodile.org>
* implemented support for SNMP operations in Windows packages
* qmake.inc files overhaul
2005-04-26 <vadim@vk.crocodile.org>
* newFirewallDialog.cpp (getInterfacesViaSNMP): switched to using
QT class DNS to get host/firewall name in new HostDialog and
newFirewallDialog classes. This seems to work better on Windows.
Also added more locks to prevent reentering getInterfacesViaSNMP
if user clicks the button multiple times in quick succession
2005-04-23 <vadim@vk.crocodile.org>
* newFirewallDialog.cpp (accept): fixed bug #1187248: using "find"
for an address "192.168.10*" several times after a firewall
objects has been created using templates caused GUI to crash
2005-04-17 <vadim@vk.crocodile.org>
* findDialog.cpp (matchAttr): implemented feature request
#1151206: "Search for IP Addresses". "Find" dialog searches for
objects by a combination of name and one of the following
attributes: address, tcp/udp port, ip protocol number or icmp
message type. Regular expressions can be used for both name and
attribute.
* ObjectTreeView.cpp (getSimplifiedSelection): fixed bug #1151212:
"Collapsed sub-objects shouldn't be added if they are
hidden". When user selects multiple objects in the tree some of
which have child objects, those child objects used to be also
selected and added to groups in addition to their parent
objects via drag-and-drop operation.
* GroupObjectDialog.cpp (pasteObj): fixed bug #1184791: "can not
copy/paste multiple objects into a group"
* FWWindow.cpp (doCompile): implemented feature req. #1151220:
"Close" button should change is caption/title to "Install". When
user clicks "Install" toolbar button or main menu item, the
"Close" button in the pop-up window that displays compiler
progress changes its text caption to "Install"
2005-04-13 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (addPredefinedPolicyRules): fixed bug
#1181359: "Missing traling space in "INVALID state" syslog
message"
2005-04-10 <vadim@vk.crocodile.org>
* instDialog.cpp (continueRun): Improvement in built-in installer:
user can specify additional command line parameters for ssh that
built-in installer runs to access firewall. This allows for
alternative ssh port or alternative ssh identity to be used when
accessing firewall. Parameters can be added in the "Installer" tab
of firewall settings dialog for all platforms.
2005-04-09 <vadim@vk.crocodile.org>
* ipt.cpp (main): fixed bug #1179103: 'compiled rules can not be
install'. Generated iptables script could not be used on systems
with non-English locale where timezone name used local characters
because these characters were printed as hex ( "&#21488;" ) and
'&' caused problems with shell. Now using single quotes to make
shell ignore any characters in the string. Will deal with proper
printing of localazed timezone later.
2005-04-07 <vadim@vk.crocodile.org>
* OSConfigurator_freebsd.cpp (printPathForAllTools): function
getaddr() falls back to 0.0.0.0/32 if dynamic interface has not
been assigned an address yet or is down. Ipfilter policy using
run-time substitution of dynamic interface addresses will be
functional even if these interfaces are down or do not have IP
address.
2005-04-05 <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRule.cpp (_flushAndSetDefaultPolicy): fixed
bug #1176890: "block IPv6". Generated iptables script sets default
policies to DROP in all ipv6 filter chains. More detailed control
can be implemented using prolog or epilog scripts.
2005-04-03 <vadim@vk.crocodile.org>
* PolicyCompiler_pf.cpp (separateSrcPort): fixed bug #1176051:
"incorrect rule generated for TCP service ftp-data". If a rule
used several TCP or UDP service objects and one of them has source
port range configured, generated PF filter rule incorrectly
matched on a combiantion of that source port range _and_
destination port ranges from all other service objects. This bug
affected compilers for OpenBSD PF and ipfilter
2005-03-31 <vadim@vk.crocodile.org>
* FWWindowPrint.cpp (filePrint): fixed bug #1155163: "print does
not print group contents". The program printed only number of
objects contaned in object or service groups. Now it prints lists
of member objects for all groups used in rules. If groups contain
other groups, they are printed recursively.
2005-03-30 <vadim@vk.crocodile.org>
* objects_init.xml.in: fixed bug #1172620: "Add tcp service object
for icslap". Added this object to the objects library "Standard".
* FWWindow.cpp (info): fixed bug #1151243: "Maintain format of
description text". The GUI ignored text formatting in object
comment when displayed it in the info panel (lower left corner of
the main windows)
* FWOptions.cpp (toXML): API change: fixed bug #1173801: '"&"
character in prolog/epilog'. Needed to call xmlEncodeSpecialChars
to encode special characters in firewall options
2005-03-29 <vadim@vk.crocodile.org>
* ipf.cpp (printActivationCommandWithSubstitution): fixed bug
#1173064: "support for dynamic interfaces in ipfilter". Actual
address of dynamic interface is now determined at run-time in the
policy activation script <firewall_name>.fw generated by
fwbuilder. If dynamic interface is used somewhere in the policy or
nat rules, it will be replaced with its actual address by
activation script before configuration is sent to ipf or ipnat for
activation. This run-time substitution is done only if a checkbox
is checked in the "Script options" tab of firewall settings
dialog. Default behavior is to use "any". This is because ipfilter
configuration files <firewall>-ipf.conf and <firewall>-nat.conf
that rely on run-time substitution of dynamic interface address
can not be loaded using standard activation scripts that come with
FreeBSD.
This also fixes another problem in fwb_ipf where it generated rdr
and nat commands with address 0.0.0.0/32 if dynamic interface was
used in a NAT rule.
2005-03-28 vadim <vadim@tourist2.local>
* PolicyCompiler_PrintRule.cpp (_printMultiport): fixed bug
#1160186: 'IPTables Compiler - Multiport Issue'. When 16 or 31
ports were used in a single rule, compiler generated command with
conflicting options "-m multiport --dport"
* NATCompiler_ipf.cpp (processNext): fixed bug #1173067: "support
for port ranges in NAT rules (ipfilter)" - policy compiler for
ipfilter should split DNAT rules (rdr) that use TCP or UDP objects
with port ranges. A warning is issued if more than 20 rules are
created.
2005-03-20 <vadim@vk.crocodile.org>
* utils.cpp (getFileDir): fixed bug #1157976: "patches to make
fwbuilder compile under NetBSD 1.6". Applied patches.
* newHostDialog.cpp (newHostDialog): fixed bug #1151219: "New Host
creation window is not well dimensioned". Fixed wrong dialog page
layout in the new host wizard.
* OSConfigurator_linux24.cpp (printPathForAllTools): fixed bug
#1123748: "busybox grep -E". Busybox in floppyfw is compiled
without support for egrep (or grep -E). Switched to using "plain"
grep.
* InterfaceDialog.cpp (loadFWObject): fixed bug #1151052: "Not
external interfaces marked as external". Dialog for an interface
object that belongs to a host should not show checkbox "external
(insecure) interface"
* Tools.cpp: API change: fixed bug #1158870: "mutexes are not
properly created on FreeBSD". Mutexes gethostbyname_mutex and
gethostbyaddr_mutex were never created but used on OS where
thread-safe resolver is not available.
2005-02-17 <vadim@vk.crocodile.org>
* v2.0.6 released
2005-02-17 <vadim@vk.crocodile.org>
* ipt.cpp (main): fixed bug #1123933 "iptables add_addr() expr
binary not found". As it turns out, /usr/bin/ is not in PATH
during boot time on Slackware. I added /usr/bin/ to PATH variable
in generated iptables script.
2005-02-16 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (printPathForAllTools): fixed bug
#1123748 "busybox grep -E". Busybox does not support option "-E"
with grep, however it has "egrep".
2005-02-12 <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog): proper localization in the
installer where it displays progress of the installation operation
2005-02-11 <vadim@vk.crocodile.org>
* main.cpp (main): Troubleshooting weird case of data file
corruption during install
* RCS.cpp (RCS): fixed bug #1120904: "GUI hangs when accessing RCS
file". Improved parsing of rlog output.
2005-02-09 <vadim@vk.crocodile.org>
* utils.cpp (getUserName): working on bug #1118717: "fwbuilder 206
on Windows XP SP2: error checking out". Env variable USERNAME was
not set in user's profile, which triggered this bug. Now using
getuid to get user name on Unix and GetUserName on Windows. This
should make the program more resilient for situations when
environment variable LOGNAME or USERNAME is not set
2005-02-08 <vadim@vk.crocodile.org>
* ipt.cpp (main): Using getuid to read real user's ID on Unix
2005-02-07 <vadim@vk.crocodile.org>
* instDialog.cpp (continueRun): Fix for support request #1118039:
"Error when Windows client calls plink -ssh". The problem is that
putty ignores protocol and port specified in the session file if
command line option -ssh is given. On the other hand, the sign of
session usage is an empty user name, so we can check for that. If
user name is empty, then putty will use current Windows account
name to log in to the firewall and this is unlikely to work
anyway. This seems to be a decent workaround.
* printerStream.cpp (printQTable): further bugfixes in printing,
in particular fixed a problem with partially greyed-out horizontal
and vertical headers when ruleset was small enough to fit on the
first page.
2005-02-05 <vadim@vk.crocodile.org>
* RuleSetView.cpp (selectionChanged): fixed bug #1030538:
"incorrect highlighting when selecting multiple rules". This bug
seems to be specific to Mac OS X
* printerStream.cpp (printQTable): improvements in printing:
- if a rule set does not fit on a single page, the program
repeats table header on each page ("Source","Destination","Service" etc)
- the program does not draw the whole rule set in memory
anymore. Instead, it "scrolls" the table and only draws section
that fits on a single page. This means we can now print really
huge policies that can not be drawn as a whole because they
exceed maximum coordinate value. Tested with a rule set that
consists of 1200 rules which has size of 677x34884 pixels on my
machine.
2005-02-03 <vadim@vk.crocodile.org>
* instDialog.cpp (selected): working on bug #1115412: "Problem
installer FWbuilder 2.0.5 for Windows". Switched to command line
option "-l" to specify user name for external ssh in
installer. This was necessary because Van Dyke SecureCRT on
Windows does not support user@host syntax.
* instDialog.cpp: Installer verbose and quiet modes work as follows:
- if quiet is off, verbose is off: prints everything that
firewall script prints on stdout and stderr; does not add "-v"
to calls to external ssh utilities
- if quiet is off, verbose is on: adds "-v" to ssh command line
- if quiet is on - supresses script output but still prints short
messages to indicate when it copies files to the firewall and when
it executes them
2005-02-01 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (delObj): slightly changed logic with user
warnings in the object removal code. The program asks the user for
confirmation if they remove an ordinary object from a regular
library. Confirmation is not asked if object is removed from
"Deleted objects" library or when a library is being deleted (in
this case we ask a different quastion later anyway). This helps
avoid double warning when a library is deleted.
2005-01-31 <vadim@vk.crocodile.org>
* POmakefile.in (POTFILES): Added module FWWindowPrint.cpp to the
list of files processed for localization
* FWWindowPrint.cpp (filePrint): Added small margin inside table
cells in Legend and Object tables in the printout.
2005-01-30 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): fixed bug #1112470:
"Problem with FW part of ANY in Bridged mode". If fw is
considered part of any, we should place rule in INPUT/OUTPUT
chains even if it is a bridging fw since fw itself may send or
receive packets.
* PolicyCompiler_ipt.cpp (accounting): implemented feature
req. #1112980: "Need unique names for accounting rules". User can
now specify a unique name for rules with action 'Accounting'; this
name will be converted to a chain name. This simplifies accounting
since chain name for such rule won't change if the user adds or
removes rules above or below.
* PolicyCompiler_ipt.cpp (accounting): fixed bug #1112976:
"Accounting rule with logging produces looped iptables command"
* FWWindowPrint.cpp (beginPage): implemented Feature
Req. #1112778: "include date and time on printouts". Added date
and time to the header on each printed page.
* RuleSetView.cpp (paintCell): fixed bug #1112776: "some items
touching seperator lines on printouts". Rule elements "Action",
"Direction", "Options" and "Comment" were placed right at the top
of the table cell which led to their clipping when rule set was
printed on Mac OS X. Need more testing.
* FWWindowPrint.cpp (filePrint): fixed bug #1112764: "some Objects
are partially obscured in printout". Parts of the "Objects" table
were clipped. Need to test some more.
2005-01-29 <vadim@vk.crocodile.org>
* FWBSettings.cpp (init): fixed bug #1112264: "Load last edited
file" setting doesn't work. This was broken only on Mac OS X.
* FWObjectDatabase.cpp (merge): API change: fixed bug #1105167:
"Crash when importing a library that has been deleted".
2005-01-27 <vadim@vk.crocodile.org>
* NATCompiler_pf_writers.cpp (_printPort): not quite fixed bug
#1105755 "Custom Service objects not working for PF
compiler". User tried to generate a nat rule like this using
CustomService object:
nat on eth1 proto {tcp udp icmp gre} from 192.168.1.0/24 to any -> 22.22.22.22
Taken from the bug report:
it turned out, I can not fix this. You are trying to use Custom
Service object to insert protocol list into a "nat"
rule. Normally, a service object such as TCP or UDP service
generates two components for any rule where it is used: a protocol
specification and port specification
(type/ code spec for ICMP). PF is sensitive to the order of
parameters in the rule, in particular, protocol must be defined
after interface but before src/dst addresses in the rule, while
port numbers go after addresses. Compiler easily retrieves this
information from IP, TCP, UDP and ICMP services and places it in a
proper slots in the rule it generates. CustomService does not
have a notion of protocol and parameters for it, so compiler puts
a string that is configured in the CustomService in the place
reserved for port numbers. This means you can not use
CustomService to specify protocols.
There still was a bug in fwb_pf where it would print
"custom_service" in place of protocol. This is fixed in 2.0.6
build 542. Protocols can not be inserted with Custom Service
though.
Feature request #1111267 "CustomService should specify protocol
and parameters for it" has been opened
* PolicyCompiler_ipt.cpp (processNext): fixed bug #1102629: "lost
chain in accounting rules". Rules with multiple objects in one of
the rule elements and action 'Accounting' generated code that
ignored objects in that rule element
* ObjectManipulator.cpp (newPhysicalAddress): fixed bug #1111244
"GUI allows to add more than one MAC address to an
interface". There can only be one MAC address for each interface.
* FWWindowPrint.cpp (printQTable): While printing rule sets, the
program makes sure rule set tables are broken on the rule
boundaries while switching to a new page.
* Added "Page setup" dialog to set parameters such as printing
header, printing of a legend and object lists etc.
* fixed bug #1109174: "Cannot print rule base" - implemented
printing
2005-01-25 <vadim@vk.crocodile.org>
* instDialog.cpp (selected): fixed bug #1109631: "can not copy
firewall script to /etc on Linksys". Added an option ot all OS
resource files that determines whether user is allowed to change
installation directory on the firewall. Currently it is allowed on
all supported OS except Linksys/Sveasoft because there /etc/
resides on read-only filesystem
2005-01-24 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): fixed bug #1101910: "Samba
problem with Bridged Firewall". Need to split rule to take care of
broadcasts forwarded by the bridge and broadcasts that are
accepted by the firewall itself. Need to do this only if the rule
is not associated with any bridging interface.
* PolicyCompiler_PrintRule.cpp (_printOptionalGlobalRules): fixed
bug #1106701: 'backup ssh access' and statefulness
interation. Need to add rules matching states ESTABLISHED and
RELATED for the backup ssh access to make sure it works even if
global rule matching these states is disabled.
* configure.in: fixed bug #1107838: "bug in configure script in
fwbuilder 2.0.6". Need to specify path "./" when calling
runqmake.sh
* FWWindowPrint.cpp (filePrint): printing legend and a list of
objects at the bottom of a printed document.
* Compiler_ops.cpp (operator==): API change: fixed bug #1108861:
"two rules using MAC address matching shadow each other". Need to
check for MAC addresses while processing rules for shadowing.
2005-01-21 <vadim@vk.crocodile.org>
* FWWindowPrint.cpp (filePrint): Implemented printing of firewall
rule sets. Using standard QT class QPrinter; can print to a system
printers or to a file (PostScript), both in black and white or a
color where available. Prints policies of the currently opened
firewall. The program can calculate total number of pages and
offer the user a choice in the Print dialog only if QT v3.2 and
later is used. Each printed page has a header with the file name,
RCS revision and a page number. Currently, the header can not be
turned off (will implement in the future).
2005-01-07 <vadim@vk.crocodile.org>
* v2.0.5 released
2005-01-06 <vadim@vk.crocodile.org>
* RCS.cpp (isDiff): writing RCS log in UTF-8, this simplified
localization
2005-01-02 <vadim@vk.crocodile.org>
* RCS.cpp (RCS): working on localization of RCS log entries. Build
516 converts log strings into 8bit string into locale-specific
format on Unix before sending it to ci. Strings returned by rlog
are converted from locale-specific format. No conversion is done
on Windows and Mac OS X.
* objects_init.xml.in: fixed bug (no num) that caused GUI crash
when user created new firewall object using template with three
interfaces.
2004-12-30 <vadim@vk.crocodile.org>
* PolicyCompiler_ipfw_writers.cpp (processNext): fixed bug
#1093620: "path (to ipfw) with spaces fails". Generated script
failed if path to ipfw contained space. I only worked around this
problem for ipfw; paths to sysctl and logger must be standard and
never contain spaces.
* PolicyCompiler_ipfw.cpp (processNext): fixed bug #1093472: "ipfw
port range(s) errors". There can only be one port range in a
single ipfw rule.
* PolicyCompiler_ipfw_writers.cpp (_printProtocol): fixed bug
#1093461: "problem with 'established' in ipfw". Ipfw requires
protocol to be set to 'tcp' if option 'established' is used in a
rule.
2004-12-29 <vadim@vk.crocodile.org>
* RCS.cpp (RCS): fixed bug #1092810: "Multiline RCS comments are
shown as a single line on windows". As it turned out, this bug
affected all platforms.
* RCS.cpp (ci): an attempt to fix a bug that does not allow to
enter RCS comment using non-english locale.
2004-12-28 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (getInterfaceVarName): fixed bug
#1059393: "function getaddr failed for eth1.0020". Generated
script can now work with interfaces that have a dot in their name
(such as "eth1.0020" - vlan interface)
* PolicyCompiler_PrintRule.cpp (_printOptionalGlobalRules): fixed
bug #1092141: "irritating FORWARD rule for established
connections". Need rule in FORWARD chain only if ip forwarding is
on or set to "no change"
2004-12-22 <vadim@vk.crocodile.org>
* Compiler.cpp (createRuleLabel): API change: fixed bug #1068119:
"additional whitespace for Rule comments in .fw file". Added extra
space between rule number and interface spec in rule comments.
* PolicyCompiler_ipfw.cpp (processNext): fixed bug #1089866:
"multiple services in one rule confuses ipfw compiler". If several
UDP or TCP objects were used in the same policy rule and these
service objects had source port ranges defined, the compiler would
produce incorrect code by combining source port range
specifications together in the same ipfw command.
* main.cpp (main): Pull-down menu "On startup" in the "General"
tab of the preferences dialog now has three items: "Load standard
objects", "Load last edited file" and "Ask user what to do". The
last item is default.
* PolicyCompiler_PrintRule.cpp (_printProtocol): fixed bug
#1089586: "default --icmp-type value is 0 in iptables <
1.2.9". The problem concerns policy rules using service object
"any ICMP". A rule like this is supposed to match any ICMP
packet. Few versions ago I had to add option "-m icmp" (and "-m
udp", "-m tcp") because I've discovered that iptables-restore on
some systems (linksys sveasoft firmware, iptables v1.2.11) refused
to load rules without it. Now it turns out that iptables v < 1.2.9
(tested on 1.2.6a and 1.2.7a) implicitly adds equivalent of
"--icmp-type 0" to rules with "-p icmp -m icmp" and without
"--icmp-type" option. Since type 0 is actually icmp echo reply, a
rule like this does not match "any ICMP" as it was supposed to
do. Iptables 1.2.9 implicitly adds "--icmp-type 255" which matches
any icmp type. Using "--icmp-type 255" on iptables 1.2.6 and 1.2.7
does not work (a rule does not match icmp packets with type
different from 255). The fix generates "-p icmp -m icmp
--icmp-type any" for iptables 1.2.9 and later, as well as when
iptables version is not specified in the firewall object settings.
It generates just "-p icmp" for versions < 1.2.9.
2004-12-19 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (newInterfaceAddress): GUI change: main
menu item "Object/New Object/Address" and corresponding toolbar
button always creates an Address object under Objects/Addresses
folder in the tree. Address of an interface can be created using
pop-up menu item "Add IP Address"
2004-12-16 <vadim@vk.crocodile.org>
* Bunch of cosmetic bugfixes in the GUI
* PrefsDialog.cpp (setButtonColor): implemented feature request:
colors that are used to color rules can be changed in Preferences
dialog.
2004-12-13 <vadim@vk.crocodile.org>
* FWWindow.cpp (fileOpen): when user clicks menu item "File/Open"
to open a new file, the GUI should save and close currently opened
file only after the user chooses new file. If user clicks Cancel
in the File/Open dialog, operation should be cancelled so the user
can continue working with currently opened file. The same applies
to operation File/New.
2004-12-12 <vadim@vk.crocodile.org>
* po.pro: fixed bug (no num): localization was broken on win32 and
mac os x because translation files were not installed properly.
* ObjectManipulator.cpp (pasteTo): improved behavior of the main
menu "Edit" as well as pop-up menu that appears when user right
mouse clicks on an object in the tree. Menu item "Paste" should
only be enabled if the clipboard is not empty and objects that are
stored in it can be pasted into selected object in the tree.
2004-12-10 <vadim@vk.crocodile.org>
* RCSFilePreview.cpp (selectedRevision): fixed bug (localization):
RCS log entries made using non-ascii characters used to appear as
'???' in Open File and File/Properties dialogs.
* ObjectEditor.cpp (validateAndClose): more bugfixes for the
behavior of the object editor dialogs. Dialog should ask if user
wants to save data and then validate it when user clicks on [x] to
close editor dialog. It used to validate the data first, then ask
if they want to close dialog.
2004-12-09 <vadim@vk.crocodile.org>
* FWWindow.cpp (load): when user opens data file in the old format
(fwbuilder v1.1.x, extension .xml) and after autoupgrade the
program discovers that the same file with extension .fwb already
exists, it offers the user a chance to choose different name. If
user clicks "Cancel" at this point, the program cancel operation
and reverts upgraded data file back to its original name and
version.
* listOfLibraries.cpp (add): fixed bug (internal #34) the program
should issue a warning when user tries to add a library file
(.fwl) that contains object library that already exists in the
opened data file.
* ObjectEditor.cpp (validate): Streamlined logic in the object
editor dialog. This improves handling of the situation when user
closes dialog by clicking on [x] while 1) there are unsaved data
and/or 2) some of the object's parameters have illegal values. The
dialog behavior also depends on the setting of the global flag
"Autosave" that causes dialog to automatically save data when user
switches between objects.
2004-12-08 <vadim@vk.crocodile.org>
* listOfLibraries.cpp (add): numerous fixes for localization
2004-12-05 <vadim@vk.crocodile.org>
* ObjectManipulator.h: numerous bugfixes:
- properly synchronizing state of the items main menu with state
of corresponding items in the pop-up menu that appears when user
right-mouse-clicks on an object in the tree
- fixes for non-localized text strings in dialogs (mostly
"Continue", "Yes"/"No" etc. in many places)
- proper localization of the human-readable version number text
for iptables; also made info window print readable text instead of
"lt_1.2.6"
- cosmetic changes in some dialogs layout to make the look better
when localized text makes strings much longer
- firewall object dialog tab "Templates" has been hidden. It is
unlikely that this feature will be implemented in 2.0.X series.
2004-12-04 <vadim@vk.crocodile.org>
* listOfLibraries.cpp (add): fixed bug (no num): the GUI crashed
when user tried to add a library file for auto-load in
Preferences/Libraries and the first library object in that file
had a name using non-ascii characters
* Bunch of other fixes to avoid '????' in various places for
localized strings
2004-12-04 <vadim@vk.crocodile.org>
version 2.0.4 released
2004-12-02 <vadim@vk.crocodile.org>
* utils.cpp (fillLibraries): fixed bug (no num): if a library was
assigned a name with non-ascii characters, it would appear
distorted in the pull-down list in object dialogs.
* fixed bug #1077496 ] Error compiling libfwbuilder in FreeBSD:
The problem was caused by changed major version number of libnetsnmp library
in the latest net-snmp port (v5.2)
2004-12-01 <vadim@vk.crocodile.org>
* FWWindow.cpp (openFirewall): fixed bug #1077072: "CrossPlatform
Firewall Builder Crash" - pressing arrow down key on the keyboard
right after the GUI started with no firewall objects defined
caused crash.
2004-11-30 <vadim@vk.crocodile.org>
* po/ru.qm: Updated Russian translation
2004-11-25 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (splitIfSrcNegAndFw::processNext): fixed
bug #1073491: incorrect code for rules using two interfaces with
negation. If a rule had two (or more) interfaces of the firewall
in the destination, with negation, the code generated by compiler
would check one interface's address in INPUT chain and another in
FORWARD chain. It should check addresses of all interfaces from
the corresponding rule element in the INPUT chain and also check
addresses and possibly services from other rule elements in the
FORWARD chain. This bug affected rules with two or more interfaces
both in source and destination.
* po/LINGUAS: translators maintain Russian localization using QT
linguist rather than gettext, removed ru locale from gettext
Makefiles but left it in po.pro for installation
* fwblookup.cpp: a fix to make it compile on FreeBSD w/o gnugetopt
port
* utils.cpp (addPopupMenuItem): minor fix to help localization
('add object' and operation on rules pull-down menus did not
translate properly)
2004-11-23 <vadim@vk.crocodile.org>
* instDialog.cpp (continueRun): built-in installer checks exit
status of the script it runs on the firewall and aborts
installation sequence if it detects an error. OS resource files
have been updated accordingly so they return exit status '1' in
case of error and '0' when they succeed.
* Compiler_ops.cpp (checkForShadowing): API change: still working
on the IPService object shadowing changes. ip fragments object was
shadowing GRE object, which was incorrect. Hopefully this change
finally fixes it.
2004-11-21 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (printPathForAllTools): fixed bug (no
number): policy compiler for iptables used "tail -1" in the shell
script that read actual IP addresses of interfaces of the
firewall. This shell code failed to determine correct address of
an interface that was configured with a secondary
address. Reverted to using grep (I switched to tail when ran into
limitations of one of the beta builds of Sveasoft Linksys firmware
that did not have grep)
2004-11-18 <vadim@vk.crocodile.org>
* NATCompiler_ipt.cpp (processNext): fixed bug #1068936:
"unnumbered interace not using MASQUERADE". Comiler for iptables
will use target "MASQUERADE" if unnumbered interface is used in
Translated Source in a NAT rule.
* utils.cpp (fillLibraries): fixed bug (no num): group object
dialog showed incorrect library name for groups located in the
"Standard" library
2004-11-17 <vadim@vk.crocodile.org>
* listOfLibraries.cpp (add): fixed bug (no number): GUI could not
find names of the object libraries in external library files that
user added for automatic load in the Preferences dialog on
Windows. It would find the name of the library in the first file,
but failed to find library names in subsequent files and used the
name from the first file. Since this library was only present in
the first file, object tree was getting corrupted when the program
attempted to load this library from every file configured for
automatic pre-load. This only happened on Windows.
* dns.cpp (init): API change: fixed bug (no number): program
crashed on FreeBSD 5.3 when using SNMP to obtain parameters for
hosts and interfaces. Crash occurred because of use of
uninitialized mutex variables in module dns.cpp
2004-11-16 <vadim@vk.crocodile.org>
* main.cpp (main): improved error handling: if the GUI is started
with a file on the command line or is configured to open a file
automatically on startup and RCS can not check the file out, the
GUI will come up empty (with only standard objects loaded).
* po/ja.po: Added Japanese translation by Tadashi Jokagi
<elf@elf.no-ip.org>
* DialogFactory.cpp (createFWDialog): added XML element
FWBuilderResources/Target/dialog to platform and host OS resource
files. This element describes GUI dialog that should be opened for
the firewall object for a given firewall platform or host OS. This
is to be used with customized resource files, e.g. when user wants
to add their own host OS resource file to change commands used to
load and activate policy on the firewall. Such customized resource
file will have unique "description" element (the value of this
element appears in the pull-down menu in firewall object dialog)
and the same values for "family" and "dialog" elements to indicate
which firewall family it belongs to and which dialog should be
used. Policy compilers consult "family" element to check if the
firewall platform is supported by the compiler.
* GroupObjectDialog.cpp (addIcon): fixed bug (no number): group
object dialog corrupted object names if they contained non-ascii
characters.
2004-11-13 <vadim@vk.crocodile.org>
* pixAdvancedDialog.cpp (pixAdvancedDialog): Removed "always new"
mode for access lists and object groups for PIX
configurations. This mode works well when user installs new
configuration but causes problems if they want to reinstall the
same configuration.
Also converted old option "pix_add_clear_statements" to one of the
confgiuration script modes. So, final list of script modes for PIX
is as follows:
- basic or old format when access lists are cleared and added
from scratch. This is the simplest mode which can be used if
management station connects to the firewall from inside. Remote
management over IPSEC tunnel may be difficult since tunnel
traffic is blocked as soon as "clear access-list" command is
executed.
- access-list and object-group commands are generated but "clear
access-list" and "clear object-groups" commands are not
added. User's installation scripts should take care of that. This
option replaces old option pix_add_clear_statements (with
opposite semantics)
- temporary access list is created and added to outside
interface, then main lists and object groups are added with
permanent names and assigned to interfaces. Temporary list
permits all traffic from a single subnet configured in the GUI
via option pix_acl_temp_addr. Temporary list is small and is not
cleared in the end. Temporary list helps maintain IPSEC tunnel
for the time when access-lists are cleared and firewall is
running with default acl that does implict deny for all traffic.
2004-11-12 <vadim@vk.crocodile.org>
* pf.cpp (main): fixed bug (no number): pfctl expects "-F Sources"
and "-F Tables" command line options with "Sources" and "Tables"
capitalized.
* FWObjectDatabase.cpp (merge): API change: changes in the object
database merge algorithm: when an object database we are trying to
merge has non-empty "Deleted objects" library, deleted objects
from this library should be ignored (they used to be deleted from
the current tree). Likewise, when current tree has non-empty
"Deleted objects" library and objects in it match objects being
merged in, objects should be removed from "Deleted objects"
library to avoid creating duplicate IDs with objects being merged
in.
2004-11-10 <vadim@vk.crocodile.org>
* Compiler_ops.cpp (checkForShadowing): API change: fixed bug (no
number): rule shadowing algorithm now assumes that IPService
object with protocol number '0' shadows any other service just
like 'any' does.
* PolicyCompiler_ipt_optimizer.cpp (optimizeForRuleElement): fixed
bug #1063953: "Wrong accept/multiport rule generated". Compiler
generated wrong code for rules using multiple service objects of
different types (TCP and UDP, or TCP and ICMP etc), multiple
addresses in src or dst with option that requires using TCP RST
for action REJECT.
2004-11-07 <vadim@vk.crocodile.org>
* SSHPIX.cpp (getACLs): New feature: added support for new
configuration script formats for PIX in installer:
- basic or old format when access lists are cleared and added
from scratch
- access lists have unique names each time policy is recompiled,
lists are added without clearing.
- access lists are added with temporary names and assigned to
interfaces, then the same lists are added with permanent names,
lists are swapped and temporary lists cleared
Last two methods provide for instantaneous access list swap so
that the firewall never runs with empty lists. This helps maintain
access to the firewall if configuration is installed remotely.
* SSHPIX.cpp: New feature: Installer always clears unused access
lists after confgiuration is loaded.
2004-11-06 <vadim@vk.crocodile.org>
* fwcompiler/Compiler.cpp (complexMatch): fixed bug #1055937:
"Any->all_multicasts not in INPUT Chain". Need to check if network
objects are multicasts; assume that multicast always matches
firewall object (e.g fwb_ipt will put rule with such network
object in destination in INPUT chain)
* instDialog.cpp (instDialog): Added an option to push PIX
configuration to a standby firewall at the end of install.
2004-11-01 <vadim@vk.crocodile.org>
* NATCompiler_PrintRule.cpp (_printDstService): fixed bug (no
number) where compiler for iptables used option
"--destination-port" with module "multiport" for versions of
iptables that do not understand it (1.2.6 and later, as well as
default version setting 'any'). The option should be
"--destination-ports" or "--dports".
2004-10-31 <vadim@vk.crocodile.org>
* FWBSettings.cpp (init): fixed bug (no number): Policy installer
failed if the following conditions were met:
- it was running on Linux, FreeBSD or Mac OS X
- working directory configured in the "General" tab of the
Preferences dialog did not exist and could not be created or its
permissions did not allow user that runs the GUI to access it
* NATCompiler_ipt.cpp (processNext): fixed bug (no number) in
fwb_ipt that caused no-nat rules with firewall in OSrc to be
placed only in OUTPUT chain. Packets originating on the firewall
go into OUTPUT and POSTROUTING chains, so no-nat rules must be
placed in both. Other minor improvements for NAT of the locally
originated connections have been done as well.
2004-10-30 <vadim@vk.crocodile.org>
* NATCompiler_PrintRuleIptRst.cpp (_endRuleLine): fixed bug (no
number): compiler placed extra quote '"' at the end of each NAT
command in the script using iptables-restore; this happened
only if all interfaces of the firewall had static addresses.
* PolicyCompiler_PrintRule.cpp (_printProtocol): testing policy
installation via iptables-restore with old versions of iptables
(1.2.6a). Need to include "-m tcp", "-m udp" or "-m icmp",
otherwise iptables-restore does not understand options "--dport",
"--tcp-flags" and some others. Also had to use "--tcp-flags
SYN,RST,ACK SYN" instea dof "--syn" for better backwards
compatibility.
2004-10-26 <vadim@vk.crocodile.org>
* ipt.cpp (main): iptables: Added ability to instert shell
commands defined in the prolog script in three places:
- on the top of generated script
- after interface configuration but before resetting existing
iptables policy
- after existing policy rules are flushed and optional global
implied rules added but before all policy and NAT rules
2004-10-24 <vadim@vk.crocodile.org>
* PolicyCompiler_PrintRuleIptRst.cpp (_createChain): implemented
Feature Request #1021201: "output iptables-restore compatible
config from fwb_ipt". Policy compiler for iptables can use
iptables-restore to activate firewall policy. Iptables-restore
provides for atomic policy load and allows to load large policy
much faster. Atomic load means the whole filter or nat table is
activated at once, and if there is an error, nothing is
changed. Compiler generates script in three possible formats:
- the ususal shell script that adds rules one at a time by
executing iptables command with an "-A" flag to add a rule;
- commands are fed to iptables-restore, this format is used when
all interfaces of the firewall have static IP addresses and
script does not need to determine addresses at run time;
- script determines IP addresses of interfaces and discovers
dynamic interfaces that were defined as a "wildcard" interface
in fwbuilder (e.g. 'ppp*'); code that is sent to
iptables-restore is generated dynamically by the script at run
time.
Using iptables-restore is optional and is controlled by
the checkbutton in the "Script options" tab of firewall settings
dialog. Path to iptables-restore utility can be set in the "Paths"
tab of the host settings dialog.
* A change in the script generated by fwb_ipt: if iptables-restore
is not used to load policy, generated shell script purges existing
firewall policy (all tables and chains) and sets default chain
policies after it configures interfaces of the firewall.
Previously, it would flush tables and set default policy before it
configured interfaces.
2004-10-23 <vadim@vk.crocodile.org>
* RuleSetView.cpp (pasteRuleAbove): fixed bug #1028866: "incorrect
order when several rules copied using copy/paste". Pasting
multiple rules into an empty policy caused rules to be inserted in
the wrong order.
* freebsdAdvancedDialog.cpp (freebsdAdvancedDialog): fixed bug
#1046345: "ipfw - no option to specify ipfw executable". Added GUI
control to let user specify alternative path to "ipfw" on
FreeBSD. Control like that was previously available only for Mac
OS X
* PolicyCompiler_ipt.cpp (checkForMatchingBroadcastAndMulticast),
Compiler.cpp (_complexMatchWithInterface): fixed bug #1040773:
need to match network address as well as broadcast. Packets sent
to the network address (192.168.1.0 for net 192.168.1.0/24) go in
the broadcast frame and behave just like IP broadcast packets
(sent to 192.168.1.1255 for the same net)
* PolicyCompiler_ipt.cpp (finalizeChain::processNext): fixed bug
#1040599: "unnecessary FORWARD rules". If ip forwarding is turned
off in the host settings dialog of the linux-based firewall,
compiler should not generate rules in FORWARD chain.
2004-10-20 <vadim@vk.crocodile.org>
* linux24.xml.in: Added element "Target/family" to all OS resource
XML files. Compilers use "family" resource element to determine if
host OS is supported. User may want to copy host OS resource file
to modify installer scriptlets; as long as the family element is
kept the same, compiler will accept new resource file.
* linksys.xml.in: Added elements
"Target/options/suppress_comments" and
"Target/options/suppress_modules" to the OS resource files
linksys.xml and linux24.xml. These options suppress printing
comments in the generated script and remove commands that load
kernel modules. These options are used for Linksys/Sveasoft
appliance but can also be used for other firewalls based on Linux.
2004-10-19 <vadim@vk.crocodile.org>
* pf.cpp (main): Activation script for PF flushes only information
about rules, nat, source and tables (it used to flush "all"). This
preserves queue entries and states.
* ipt.cpp (main): moved rule permitting backup ssh access from the
management station to the firewall to the top of the script. This
helps maintain ssh session, otherwise it may stall or break
because stdout buffer is filled with diagnostic or progress output
from the script that is printed after all chains are flushed but
before rule permitting ssh to the firewall is added. If stdout
buffer is full, ssh stops and tries to send the text to the
management station but times out because firewall blocks it.
* ipt.cpp: removed code that added iptables command to the "drop"
table to drop and log all dropped packets. This rule used
obsoleted patch-o-matic patch "drop" which is not available
anymore.
2004-10-17 <vadim@vk.crocodile.org>
* ipt.cpp (main): fixed bug (no number): all policy compilers
properly detect an error when the output file can not be created
or overwritten and print error message to warn the user.
* New feature: added support for prolog and epilog scripts for all
firewall platforms. This was available for PIX for some time, now
it has been added for all platforms. "Prolog/Epilog" tab of the
firewall settings dialog allows for editing of two blocks of
commands that will be added to the generated firewall script
verbatim. Prolog block is added on top, while epilog block is
added at the bottom. Both prolog and epilog are expected to be
shell scripts and are added to the generated shell script that
activates firewall. For iptables and ipfw all compiler generates
is this shell script and prolog and epilog commands are inserted
into it. These commands may execute some actions, as well as add
any policy or nat commands. For ipf and pf prolog and epilog
commands are added to the activation shell script ( .fw file);
prolog is added immediately after the command that flushes all
rules. This way user may either execute shell commands or add
policy and/or nat rules by loading them from external file.
2004-10-10 <vadim@vk.crocodile.org>
* FWWindow.cpp (addFirewallToList): fixed bug (no number)
introduced in 2.0.3 when GUI crashed if user tried to choose
pull-down menu item in the firewall list after the very first
firewall object has been created.
* SSHPIX.cpp: Added #include <errno.h> to make code compile with
gcc 3.4.2 and glibc 2.3.3
* ipt.cpp (main): fixed bug #1040788: fwb_ipt and user
name. Compiler used to read environment variable "USER" to find
out user's name. Sometimes this variable is not set, which caused
compiler to abort. Using env variable LOGNAME in addition to USER.
2004-09-30 <vadim@vk.crocodile.org>
* v2.0.3 released
2004-09-28 <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog): since config diff is broken for pix
v6.3(3) (because it does not permit adding duplicate ACL entries),
"save diff to file" option is temporary disabled. "Incremental"
install renamed to "install only ACL,icmp,telnet,ssh,nat,global
and static commands"
2004-09-27 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (printPathForAllTools): script
generated by compiler for iptables checks if /usr/sbin/ip exists
on the firewall before it tries to use it to verify interfaces and
configure IP addresses. This check is only performed if user
activated options that use this tool. An error message "Interface
eth0 does not exist" was generated if package iproute2 was not
installed on the firewall, which was confusing.
* FWWindow.cpp (doCompile): Added option "output file name" to
firewall settings dialogs for all platforms. User can specify the
name for the output file; this name is then used by built in
installer in place of a macro %FWSCRIPT%.
* ipt.cpp (main): Added command line option "-o" for all compilers
* FWWindow.cpp (save): fixed bug #1035800: "Autosave failure opens
error window repeatedly". This bug was in fact fixed earlier.
2004-09-26 <vadim@vk.crocodile.org>
* FWWindow.cpp (fileSaveAs): fixed bug #1035130: 'Persistent
"Save" dialog box'. Certain combination of actions on user's part
used to lead to an indefinite loop of "do you want to save the
data" dialogs. The problem was triggered if user skipped choosing
a name for the new file in startup dialog.
* linux24.xml.in: fixed bug #1035132: "compile errors with default
Linksys firewall object". This bug has been introduced in build
435. When user created a new firewall object using one of the
template objects, the GUI would add bunch of garbage to the
firewall options. This garbage violated XML DTD, so compilers and
the GUI would not accept the data file anymore.
2004-09-25 <vadim@vk.crocodile.org>
* ipt.cpp (main): using "set -x" to turn debugging on in generated
iptables script. This will work even if the script is activated
with "sh script.fw" command.
* OSConfigurator_linux24.cpp (generateCodeForProtocolHandlers):
changed commmand line for sed to more portable version. We used to
use 'stmt; stmt' syntax, which is not always portable. Switched to
a supposedly more portable syntax using multiple "-e" command line
options.
2004-09-23 <vadim@vk.crocodile.org>
* instDialog.cpp (getActivationCmd): fixed bug (no number): as of
build #430, installer ignored activation command configured in the
"install" tab of firewall settings dialog. Restored this
functionality.
* OSConfigurator_linux24.cpp (printPathForAllTools): just like
with "tail -1", some busybox based systems require "head -1" to be
changed to "head -n1"
2004-09-22 <vadim@vk.crocodile.org>
* instDialog.cpp (testRunRequested): fixed bugs in installer that
prevented it from working on OpenBSD. Enabled shceduled reboot for
all OS except PIX.
2004-09-21 <vadim@vk.crocodile.org>
* instDialog.cpp (testRunRequested): "schedule reboot" option is
only enabled for linksys since it does not work on other platforms
(yet)
* FWWindow.cpp (openFirewall): implemented Feature Request
#1032126: "Firewall label for clarity". Printing the name of the
firewall object that is opened in the policy panel in a large font
right above interface/policy tabs. This was easy to implement but
I consider it an experiment. Will request feedback from users.
* SSHSession.cpp (startSession): refactored code in built-in
installer. Moved interaction with ssh to classes SSHSession,
SSHUnx and SSHPIX. Moved "scriptlets" that are executed on
firewall to activate policy in different modes to resource
files. Using ssh rather than scp to copy policy script to
unix-based firewalls (pscp.exe on Windows works only if the server
supports sftp, but dropbear on Linksys does not support it so
installer breaks if we use scp/pscp.exe to copy the policy).
Still having problems with scheduled reboot option on Linux/BSD
firewalls (it works on Linksys though).
* OSConfigurator_linux24.cpp (printPathForAllTools): bugfix: some
editions of busybox do not support "tail -1" syntax and require
"tail -n1"
2004-09-19 <vadim@vk.crocodile.org>
* instDialog.cpp (getActivationCmd): Improvement in the built-in
installer: added an option to schedule automatic firewall reboot
in specified time (in minutes) after policy activation. This
option is available for all firewall platforms but PIX. This
option only works if user requested policy activation in a test
mode, in which case policy is copied and activated on the firewall
but not stored in the permanent location. After reboot the
firewall reverts to the previous version of the policy. To cancel
scheduled reboot, run installer again with "test run" option
turned off. Installer stores the policy in the permanent location,
activates it and cancels scheduled reboot.
* src/res/os/linux24.xml.in and other: moved all commands used by
built-in installer to resource files.
2004-09-18 <vadim@vk.crocodile.org>
* NATCompiler_pf.cpp (processNext): NAT rule of type DNAT (rdr
rule) is assigned to an interface of the firewall if interface
object or its address object is used in ODst. To get rdr rule
without interface assignment, use an Address or a Host object that
has the same IP address as that of firewall's interface but that
is not a child of an interface. This is the same approach that is
used in iptables.
* PolicyCompiler_pf.cpp (compile): Compiler for pf always uses
tables; this breaks compatibility with older OpenBSD systems (3.2
and 3.3)
* PolicyCompiler_pf.cpp (findDynamicInterfaces): Compiler for pf
puts interface name in a table even if interface is dynamic for
rules that use multiple objects in src or dst and one of these
objects is dynamic interface of the firewall that is being
processed. Using dynamic interface of another object in a rule is
still considered an error. Compiler puts the name of dynamic
interface in a table verbatim, without brackets '(' ')' since pf
does not replace dynamic interface with its address dynamically if
it is used in a table (pfctl issues an error if interface is put
in brackets)
2004-09-17 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (configureInterfaces): flushing only
secondary ip addresses on interfaces. This should fix a bug that
caused linksys/sveasoft unit to lose default route upon reboot if
external interface has static IP address.
2004-09-15 <vadim@vk.crocodile.org>
* PolicyCompiler_pf.cpp (addDefaultPolicyRule): fixed bug
#1028980: "need an option to turn logging on on fallback rule"
* PolicyCompiler_pf_writers.cpp (processNext): fixed bug #1028973:
fwb_pf: missing "flags S/SA" in front of "modulate state"
* pfAdvancedDialog.cpp (pfAdvancedDialog): added an option to
permit tcp sessions opened prior to firewall restart. This is
needed now since compiler generates "flags S/SA" for the "keep
state" and "modulate state" rules which means firewall won't
permit TCP sessions unless it saw opening SYN packet.
* instDialog.cpp (getActivationCmd): improvements in policy
installer: added an option for test run. When this option is
activated, policy script is pushed to the firewall and is executed
but is not stored there permanently. Firewall reverts to the last
working configuration after reboot.
* NATCompiler_ipt_writers.cpp (processNext): using abbreviated
versions of "--dport", "--sport", "--dports", "--sports" options
to make generated iptables script smaller. Also changed the name
of the variables used to hold IP address of dynamic interface from
"interface_<ifname>" to "i_<ifname>". All this should help to fit
larger policies into small FLASH on linksys. These changes shrunk
my test script from 7964 bytes to 7430 bytes
2004-09-14 <vadim@vk.crocodile.org>
* platforms.cpp (isDefaultOptions): fixed bug #1028078:
"options.png is not displayed for "Assume firewall is part..."
* pfAdvancedDialog.cpp (pfAdvancedDialog): fixed bug (no num):
"firewall settings" dialog for OpenBSD pf did not save option "Use
tables".
* instDialog.cpp (getActivationCmd): implemented compression of
the firewall script for Linksys/Sveasoft combo. Using gzip and
uuencode/uudecode to compress the script and store it in flash
variable 'fwb'. Installer prints flash memory stats after
commiting changes. Installer uses scp to copy firewall script to
the firewall and autogenerated prompt to detect when it logged in;
it does not depend on Linksys shell prompt anymore.
2004-09-12 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (addPredefinedPolicyRules): implemented
feature request #1023430: "add checkbox for INVALID support in fw
settings". Added two checkboxes to the firewall settings dialog:
one adds a rule to drop INVALID packets and another adds logging
to the rule.
* FWWindow.cpp (fileSaveAs): fixed bug #1026945: '"Save As" does
not work if current file is in RCS'
* FWWindow.cpp (removeFirewallFromList): fixed a bug (no number):
after deleting a library firewall objects that belong to it were
not removed from the pull-down list
* PolicyCompiler_ipt_optimizer.cpp (optimizeForRuleElement): fixed
bug #1026794: multiple SRC ntwks --> "iptables: invalid
argument". Recent changes in optimizer introduced this bug. Rules
with multiple objects in src or dst, TCP service, action Reject
and option "reject with TCP RST" would generate iptables command
that used option "--reject-with tcp-reset" without "-p tcp"
* PolicyCompiler_pf_writers.cpp (_printDstAddr): fixed bug
#1006906: "Negated network causes pass on network". Compiler for
pf uses native negation syntax that is now available in pf
2004-09-11 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (TimeNegation): fixed bug #1022216:
"negated time produces incorrect iptables rule". Implemented
negation for the "Time" rule element for iptables
* PolicyCompiler_ipt.cpp (processNext): fixed bug #1026509:
"incorrect rules generated for dual negation with time". Compiler
generated incorrect iptables commands for rules that had negation
in two or more rule elements, one of which was Time.
2004-09-09 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (prolog): rules that permit packets
associated with ESTABLISHED,RELATED states moved to the beginning
of the script before NAT rules.
* PolicyCompiler_ipt_writers.cpp: added a checkbox and support in
policy compiler for iptables to generate rules that drop packets
that are associated with no know connection (state "INVALID")
2004-09-08 <vadim@vk.crocodile.org>
* Firewall.cpp (duplicate): API change: fixed bug (no number): all
references to the interfaces, as well as their IP and MAC
addresses, in policy and NAT rules should be replaced when
Firewall object is duplicated. Until now only references to the
firewall object itself and to its interfaces were replaced with
references to the newly created copies of object. References to IP
and MAC addresses still pointed at the old objects.
* FWObjectDatabase.cpp (IDcounter): fixed bug #1022788: "GUI
corrupts XML file after creating a second firewall". Global object
ID counter was getting reset every time new FWObjectDatabase
object was created. This lead to the ID collision if user quickly
created and deleted complex objects (such as Firewall) and used
database merge. This should also fix bug #1022785: "GUI corrupts
XML file after creating a host entry"
* PolicyCompiler_ipt_optimizer.cpp (processNext): fixed bug
#1024861: "optimizer is broken in fwb_ipt". Used idea and a patch
by Mark Vevers <mark@vevers.net>. Fixed compiler fwb_ipt generates
more efficient iptables script for rules with multiple objects in
all rule elements. The script is smaller and eliminates
unnecessary comparisons for packet attributes. Every attribute
(i.e. source address, destination address, protocol and port
numbers) is checked by the script only once. This should help
reduce load on firewalls with lots of complex rules.
* VERSION: set version to 2.0.3
2004-08-31 <vadim@vk.crocodile.org>
* v2.0.2 released
2004-08-31 <vadim@vk.crocodile.org>
* ipt.cpp (main): fixed bug #1019943: "Missing ip addresses in the
rule using interfaces"
* linksysAdvancedDialog.cpp (linksysAdvancedDialog): fixed bug
#1019691: "040829 nightly build doesn't add paths for linksys"
2004-08-30 <vadim@vk.crocodile.org>
* VERSION (VERSION): version 2.0.2, revision 1
* aboutdialog_q.ui.h (init): "About" dialog shows registration
status (used only in non-GPL versions)
2004-08-28 <vadim@vk.crocodile.org>
* fixed FreeBSD port, now compiles on 5.3BETA
2004-08-25 <vadim@vk.crocodile.org>
* RuleOptionsDialog.cpp (loadFWObject): Added support for options
"max", "max-src-nodes" and "max-src-states" in pf. These allow to
limit number of concurrent state table entries ("max"), number of
source addresses that can simultaneously have state table entries
("max-src-nodes") and number of simultaneous state entries per
source address ("max-src-states") per rule.
* LibExportDialog.cpp (accept): fixed bug #1015884: "Export more
than one library fails with 0 references". Export library
operation failed if user exported two libraries with groups or
rules in one library referencing objects in the other.
2004-08-24 <vadim@vk.crocodile.org>
* pfAdvancedDialog.cpp (pfAdvancedDialog): Implemented support for
all timeout settings in pf: tcp.first,tcp.opening,tcp.established,
tcp.closing,tcp.finwait,tcp.closed,udp.first,udp.single,udp.multiple,
icmp.first,icmp.error,other.first,other.single,other.multiple, including
adaptive timeout scaling options adaptive.start and adaptive.end
2004-08-23 <vadim@vk.crocodile.org>
* FWBTree.cpp (getStandardSlotForObject): fixed bug #1014725:
"adding new ICMP types". If user created service group with the
name "ICMP", the GUI would place new ICMP objects under this group
instead of the standard folder "ICMP". There was the same problem
with other object types, too.
* ObjectManipulator.cpp (simplifySelection): debugging in
operations "delete object", "move object", "undelete". Making sure
we can delete and undelete libraries, delete and move several
objects at once, group several objects. There were problems if
user selected several host or firewall objects using Shift-Click
(although interface and address objects were not visible to the
user, they were selected and acted upon in delete or move
functions; this lead to unexected results or crashes).
2004-08-22 <vadim@vk.crocodile.org>
* templates.xml.in: added template firewall objects for Linksys
firewall and a web server.
* templates.xml.in: fixed bug #1013957: "incorrect NAT rule in
firewall created from template #3". The problem was caused by
incorrect ip address of interface "dmz" in the template object #3.
* pixAdvancedDialog.cpp (pixAdvancedDialog): implemented a backup
ssh access rule. The user specifies management station IP in the
firewall settings dialog for PIX and compiler adds a rule on top
of all other rules to permit ssh from this address to the
firewall.
2004-08-21 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (prolog): avoiding grep in the
generated iptables script - Sveasoft Alchemy pre-5.2.3 does not
have grep
* API change: fixed bug #1012733: "configure --libdir=DIR will be
ignored at installation". Needed to use macro _libdir to specify
target directory for libraries. Used it in configure, qmake.in,
libfwbuilder-config-2 and a .spec file
* objects_init.xml.in: added new service objects to the Standard
objects library: "xmas scan" (old object renamed "xmas scan -
full"), rsync, distcc, cvspserver, cvsup, afp, whois, bgp, radius
and radius acct, SSDP and UPnP. This fixes bug #1011248: "need two
xmas scan service objects"
* FWWindow.cpp (fileImport): function File/Import offers a choice
of .fwl, .fwb and "all files" in the open file dialog. This fixes
bug #1013485: "File/Import should allow to import .fwb file"
* FWWindow.cpp (load): fixed bug #1008956: "Existing .fwb file
gets overwritten if has wrong extension". If the GUI needs to
rename a data file with old extension .xml to .fwb, it checks if a
file with new extension exists and offers user a chance to choose
a different name. It also treats symlinks in a special way: if
user creates a symlink with extension .xml pointing at a file with
extension .fwb, the GUI simply follows the link and works with
.fwb file. This should work with Windows shortcuts, too.
* instDialog.cpp (instDialog): built-in installer uses shell
prompt string patterns configured in the host OS settings dialog
for linksys. This fixes bug #1013022: "can not install policy
script on linksts Alchemy pre-5.2"
* linksysAdvancedDialog.cpp (linksysAdvancedDialog): Added host OS
settings dialog for linksys/Sveasoft. Dialog provides entry fields
for paths to iptables, lsmod, modprobe, logger tools and two shell
prompt string patterns, this should help to work around changes in
the shell prompt on Linksys. This fixes bug #1013018: "host OS
settings" dialog is missing for linksys
2004-08-20 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (contextMenu): fixed bug #1009345: "Can
only move one host object at a time between libraries"
* ObjectManipulator.cpp (deleteObj): fixed bug #1013177: "deleting
multiple hosts causes crash"
* DTD change: fixed bug #1011617: "deleting physcal address object
leads to the DTD violation"
2004-08-08 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt_writers.cpp (_printDstService): fixed bug
#1005148: "MAC matching - space missing". Space was missing
between MAC address and custom service code.
2004-08-06 <vadim@vk.crocodile.org>
* listOfLibraries.cpp (add): fixed compile problem on systems
where QT is built without STL support
* PolicyCompiler_ipt_writers.cpp (_printLimit): fixed bug #1004153
"limit-burst = 0 is not valid". Iptables does not accept the rule
using "limit-burst" option if it is set to zero.
2004-08-04 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (pasteTo): fixed bug #1003068: "object
copy/paste not always working". IP address object could not be
placed under interface using copy/paste operation. Now ip address
object can be pasted to interface as well as to Objects/Addresses
folder.
* FWWindow.cpp (fileDiscard): Operation File/Discard closes the
file, discards all the changes that have been made to it and
replaces it with a fresh copy of the head revision from RCS. This
works if user wants to abort file upgrade when they switch to the
new version of fwbuilder.
2004-08-02 <vadim@vk.crocodile.org>
* FWObject.cpp (deleteChildren): fixed bug #1001833: "memory leak"
- children objects were not deleted when FWObjectDatabase object
was destroyed.
* iptAdvancedDialog.cpp (accept): fixed bug #1002388: "Clamp MSS
to MTU" option is missing in 2.0
2004-08-01 <vadim@vk.crocodile.org>
* objects_init.xml.in: there were two TCP Service objects
"linuxconf" in the Standard objects library. Object with ID
id3AED0D6D has been removed. It seems this object has been
duplicated long time ago (at least it was like this in 1.1.2)
* FWObject.cpp (getPath): fixed bug #1001725: "object with empty
name can not be deleted". the problem was caused by the algorithm
used in FWObject::getPath. If object had had a blank name, the
path returned by this method would end with the name of its parent
without slash.
* FWWindow.cpp (showFirewalls): fixed bug #1000485: "Firewalls in
the drop-down box not ordered". List of firewalls in the pull-down
that controls policy views is now alphabetically sorted on program
startup.
* utils.cpp (fillLibraries): fixed bug #1000862: "Creating groups
in Deleted Objects". Library "Deleted objects" should not be
offered as a choice for "group objects" operation.
* ObjectManipulator.cpp (contextMenu): fixed bug #1001275: "object
duplication fails w/ no action". GUI used to not allow user to
duplicate IP address object. Now any object can be duplicated so
that the copy is placed under the same parent, including IP
address.
* ICMPServiceDialog.cpp (applyChanges): fixed bug #1001521: "Cant
create ICMP service". ICMP Service dialog did not save icmp code
and type numbers in the object.
2004-07-29 <vadim@vk.crocodile.org>
* 2.0 released, CVS tag set
2004-07-27 <vadim@vk.crocodile.org>
* FWWindow.cpp (install): the GUI calls external installer script
if it is configured in firewall settings dialog when user clicks
'Install', otherwise it should use built-in installer.
2004-07-24 <vadim@vk.crocodile.org>
* RuleSetView.cpp (insertRule): correctly copying rule direction
when interface rule is copied/pasted
* instDialog.cpp (selected): proper error messages for management
interface misconfigurations
2004-07-20 <vadim@vk.crocodile.org>
* ICMPServiceDialog.cpp (loadFWObject): ICMP service dialog allows
for setting type and code to 'any' (-1)
2004-07-19 <vadim@vk.crocodile.org>
* OSConfigurator_linux24.cpp (processFirewallOptions): fixed bug
#992969: "argument to log should be quoted"
2004-07-14 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): working on bug #990037:
"Wrong rule generated: fw interface included in negated
group". Rules with negation should not generate code in
INPUT/OUTPUT chains if option "assume firewall is part of any" is
off.
* ObjectManipulator.cpp (delObj): fixed bug #990675: "Application
crashes when deleting objects"
2004-07-11 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (splitIfSrcNegAndFw): optimized
processing of policy rules where firewall object is used in src or
dst with negation (possibly in combination with other
objects). Before, generated script would match firewall's
addresses in INPUT/OUTPUT and FORWARD chains which added redundant
checks in the FORWARD chain.
* NATCompiler_ipt.cpp (processNext): fixed bugs #935794: "dual
translation and negation in fwb_ipt" and #986376: "Wrong result
for negated source in NAT rules". Dual translation rule with
negation in OSrc did not process negation in the second half
(POSTROUTING rule, the one that translates the source).
* NATCompiler_ipt.cpp (processNext): fixed bug #965558: "False
ruleset generated for iptables (negate w/ nat)". There were
problems with double negations in NAT rules (OSrc and ODst, or
ODst and OSrv, etc).
* OSConfigurator_linux24.cpp (printPathForAllTools): fixed bug
#988860: "Logging missing when firewall start is aborted". When
iptables script generated by fwb_ipt finds missing interfaces,
it prints error message both on stdout and sends it to the log.
2004-07-10 <vadim@vk.crocodile.org>
* FWObject.cpp (_moveToDeletedObjects): now move deleted objects
to the special library with id 'sysid99' rather than delete them
completely. This serves two purposes:
1. can easily provide for undelete function which is very
useful
2. can catch a situation when an object has been deleted
fromt he external library but is still used in the data
file
* FWObjectDatabase.cpp: while merging object trees, checking for
deleted objects. If an object is present in the current tree but
has been deleted in the file being merged in, special form of
conflict resolution dialog is shown. User has only one option - to
delete the object from the file. Typical situation when this
happens is when an object from external library is used in a rule
or group in a data file, then this object is deleted in the
external library. If this external library is preloaded and then
the data file using this object is opened, conflict occurs because
this object is present in the file but is in the "Deleted objects"
in the library. The problem is that the library is read-only, so
if we kept the object (actually, its copy coming from the data
file), the user would not be able to delete it. So, not only
object magically reappeared after it has been deleted from the
library, it appeared in read-only library and can not be deleted
anymore. To avoid this situation we must delete it in the file if
it has been deleted in the library.
* ObjectManipulator.cpp (delObj): "delete object" function moves
it to "Deleted objects" library.
* PrefsDialog.cpp (accept): Added checkbox "Show deleted objects"
to the preferences dialog. If this option is on, user has access
to deleted objects via library "Deleted objects".
* ObjectManipulator.cpp (contextMenu): pull-down menu item "Move"
turns into "Undelete" if an object is in "Deleted objects"
library. This provides for a simple undelete function.
2004-07-09 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): fixed bug #925199:
"compiles wrongly a double negation". Policy compiler for iptables
generated incorrect code for rules where two rule elements used
negation (i.e. both src and dst, or dst and srv, etc.)
* PolicyCompiler_ipt.cpp (prolog): fixed bug #978854: "false rule
generated for fw object in interface rule". Policy compiler for
iptables generated incorrect code for rules using negated firewall
object in source or destination when global option "assume
firewall is part of any" was turned off.
* fwb_ipt: implemented Feature Request #913273: make "assume fw is
part of any" a per-rule option
2004-07-08 <vadim@vk.crocodile.org>
* FWWindow.cpp (setupAutoSave): Added an option for autosave - if
this option is turned on, the gui periodically saves data to the
file. The autosave interval can be set between 1 minute and 2
hours.
* ipt.cpp (main): fixed bug #917422: "compiler misinterprets
interface with addr 0.0.0.0". If an interface has IP address
"0.0.0.0", it is considered an error.
* added option "strip comments in the script" to the installer
for Linksys and PIX
* do "nvram uset rc_firewall" before loading fw script on
Linksys
* added the following to the list of errors for Linksys
/dev/nvram: Cannot allocate memory
* skip table "mangle" when flushing iptables rules
2004-07-07 <vadim@vk.crocodile.org>
* NATCompiler_ipt_writers.cpp (processNext): fwb_ipt does not
include comments in the script if it is intended for linksys
firewall. Linksys has small nvram and script should be kept small,
otherwise it may not fit in nvram.
* NATCompiler_pf.cpp (processNext): fixed bug #986518: "PF
redirection always point to loopback address"
2004-07-06 <vadim@vk.crocodile.org>
* instDialog4.cpp (stateMachineLinksys): Activating policy on
Linksys/Sveasoft wothout reboot (using command "nvram get
rc_firewall | /bin/sh" instead)
* OSConfigurator_linux24.cpp (prolog): added an option to firewall
platforms iptables, ipfilter, pf and ipfw that sets up a policy
rule to permit ssh access from one specified IP address to the
firewall regardless of other rules. This is for a backup ssh
access from the management workstation in case of an error in the
policy that locks user out of the firewall. The option (a checkbox
and entry field for the management station address) is located in
the "Compiler" tab of the firewall settings dialog. A command that
permits ssh to the firewall from the given address is added on top
of all other rules.
2004-07-05 <vadim@vk.crocodile.org>
* RuleSetView.cpp (dropEvent): fixed bug #985187: "Usability bug:
Copy objects from one rule to another". Dragging an object from
one rule to another with Ctrl down makes a copy. If Ctrl is up,
then the object is moved.
* instDialog4.cpp (stateMachineLinksys): Added support for Linksys
devices running Sveasoft firmware. Firewall object should be
configured as platform "iptables", host OS "linksys". Policy
installer works both using password and public key authentication.
* NATCompiler_pf_writers.cpp (processNext): fixed bug #985527: pf
NAT rules miss destination port specification. NAT rules that
translate to "map" missed destination port specification.
* main.cpp: the gui can now use external wrapper scipts for ssh
and scp all the way (removed all direct references to commands
"ssh" and "scp", use whatever is configured in preferences
everywhere)
2004-07-04 <vadim@vk.crocodile.org>
* RuleSetView.cpp (contextMenu): fixed bugs in the rule
selection. The user can select one rule with a simple left-click
on the rule number, or multiple consequtive rules using
shift-left-click. Selecting non-ajacent rules with ctrl-click is
not supported; ctrl-click acts as normal click. Right-click calls
context menu and uses existing selection if click is on one of the
selected rules, or resets it if click is outside of the selection.
2004-06-29 <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (dragObject): implemented drag and drop of
multiple objects. User can select and then drag several objects
from the tree to a group or a rule.
* LibExportDialog.cpp (accept): a change in the export library
algorithm. We now permit exporting several libraries to one file,
but check that all these libraries have only references to each
other and to objects in the Standard lib and have no references to
objects in libraries that are not going to be exported to the same
file. This ensures integrity of this file and helps avoid pulling
objects from other libraries into it. User can edit objects in the
exported libraries by opening this file as usual; the GUI does not
preload libraries configured in Preferences/Libraries when .fwl
file is opened and unlocks all libraries in this file so objects
can be edited. This way user can edit objects and move them
between libraries in the .fwl file.
2004-06-28 <vadim@vk.crocodile.org>
* RCS.cpp (RCSEnvFix): fixed a bug (no #) that appeared only on
Windows: the GUI failed to check a file in to RCS if it was
launched by windows explorer via file extension association.
* platform.cpp: pull-down "versions" is now translatable and says
"1.2.9 or later" for iptables v > 1.2.9
2004-06-26 <vadim@vk.crocodile.org>
* LibExportDialog.cpp: when a library is exported to a file, the
program checks whether any groups or rules in this library use
objects in the othe libraries. Only self-contained libraries can
be exported.
2004-06-24 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): fixed bug #979484:
"improper command for rule with servie any and action reject."
For rules like that, and if rule options dialog does not specify
particular way to handle this combination, the compiler splits the
rule; the first iptables command rejects any tcp packet with TCP
RST, while the second rejects everything else with ICMP message.
* minor bugfixes in the gui
* incorporated changes suggested by a user to make code compile
with gcc 3.4
2004-06-23 <vadim@vk.crocodile.org>
* LINGUAS: added Vietnamese translation .po file
* FWBSettings.cpp (init): Option "do not save standard libraries
in the user's data file" is now ON by default. User can still turn
it off though.
* FWWindow.cpp (save): Usability fixes in methods that work with
libraries:
- libary files have extension .fwl
- preloaded libraries are always read-only (flag RO is set when
library file is loaded, regardless of the value this attribute
has in the file)
- user can open library file using normal File/Open
operation. Read-only flag is cleared when library file is
opened, so it can be edited. File can be added to RCS and saved
using normal File/Save or File/SaveAs operations.
- When user opens library file for editing, other libraries that
are configured in Preferences/Libraries are not preloaded.
2004-06-22 <vadim@vk.crocodile.org>
* LibExportDialog.cpp (init): when object library is exported to a
file, the file gets extension .fwl to distinguish it from the
regular data file. The GUI allows to export only one library to a
file.
* FWWindow.cpp (fileDiscard): added main menu function
"File/discard" which discard all changes that have been done to
the data and saved to the file and checks out clean copy of its
head revision from RCS. This provides for a quick way to roll back
to the latest revision. Older revisions can be checked out from RCS
using list of versions in the right hand panel in open file dialog
(this creates a branch in RCS).
2004-06-20 <vadim@vk.crocodile.org>
* IPv4Dialog.cpp (DNSlookup): "DNS Lookup" button in the IP
address dialog runs dns query for the name of the address object
and if that fails, repeats query for the name of the host or
firewall object this address belongs to. If address object is in
the folder "Addresses", it does only one DNS lookup on its name.
2004-06-18 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator): disabled ability to
drop objects into groups in the tree. It was confusing and not
really useful. Objects can still be dropped into a group opened in
the editor dialog.
* ObjectTreeView.cpp (dragObject): enabled dragging of all objects
in the tree. It turns out, QListView will highlight multiple items
in the tree in Extended selection mode when user drags mouse
across items _and_ the first item they started cursor move on is
not drag-enabled. So, to avoid this unexpected highlighting
behavior, need to enable drag of all objects. We then make sure
that system folder can not be dropped anywhere.
2004-06-16 <vadim@vk.crocodile.org>
* Compiler_ops.cpp (checkForShadowing): fixed bug #906709: "A
dynamic interface". Dynamic interface used to "shadow" old
broadcast object (0.0.0.0)
* OSConfigurator_linux24.cpp (configureInterfaces): fixed bug
#912849: "Reorder activation of network interfaces in IPT" -
script generated by the compiler for iptables sets default policy
to DROP, flushes all rules and then reconfigures interfaces of the
firewall (it used to reconfigure intefaces and then flush the rules).
* IPv4Dialog.cpp (DNSlookup): Button "DNS lookup" in the IP
address editor dialog does DNS lookup on the address object name
if the object is located in the "Addresses" folder, or on the
parent host object name if it belongs to an interface of a host or
a firewall.
* ObjectManipulator.cpp (moveObject): refactored "move object"
functions and added debug printing. Trying to debug crash reported
by one of the users.
2004-06-15 <vadim@vk.crocodile.org>
* ObjectEditor.cpp (hide): checking if screen position for the
dialog is 0,0 and not storing this value. This should help to work
around a weird bug where screen position of dialogs sometimes is
returned as 0,0 when GUI runs in Gnome.
* Object names and comments are stored in the object file in UTF-8
format. This allows for names and comments to be entered and
displayed in local languages. Although object names can be
localized, it is recommended to keep firewall names in plain ASCII
because compilers do not support UTF-8 yet. This fixes very old
bug #657156: "Special characters problem".
2004-06-13 <vadim@vk.crocodile.org>
* init.cpp (init): the program uses reasonable default for the
directory where user might want to save their data files on each
OS. ( $HOME on Unix, $HOME/Documents on Mac,
$USERPROFILE/Documents in windows)
* ObjectManipulator.cpp (updateObjName): whenever user changes the
name of a firewall, host or an interface object, the GUI asks
whether they want to also rename all IP and MAC addresses that
belong to that firewall or host. If user agrees to rename them,
the program generates names automatically using scheme
'host_name:interface_name:ip' and 'host_name:interface_name:mac'
2004-06-12 <vadim@vk.crocodile.org>
* newHostDialog.cpp (selected): implemented "new host"
wizard. User can choose to add interfaces manually or can use a
library of predefined host object templates.
2004-06-10 <vadim@vk.crocodile.org>
* PolicyCompiler_pf_writers.cpp (_printDstService): fixed a bug
(no number) where fwb_pf would not include code defined by custom
service object in the .conf file
2004-06-08 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (copyObj): implemented multi-object and
multi-rule copy/cut/paste operations
* ObjectManipulator.cpp (moveObject): implemented "move object"
operation - moves object to another library; operation is accessed
via pull-down menu in the object tree.
2004-06-06 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (groupObjects): added ability to select
multiple objects in the tree. Currently the following operations
are performed on multiple objects: delete, duplicate, group.
* ObjectManipulator.cpp (groupObjects): operation of grouping of
selected obejcts. User selects several objects in the tree and
choses menu item "group" in the pull-down menu; the GUI brings up
a dialog asking for the new group name and a library it should be
put in. New group is created and all selected objects are
automatically added to it when user hits "Create group" button.
2004-06-05 <vadim@vk.crocodile.org>
* pixAdvancedDialog.cpp (accept): added "Installer" tab to the PIX
firewall settings dialog
* FWBSettings.cpp (getScreenPosition): checking if the window fits
in the screen before restoring its geometry.
* ObjectListView.cpp (dragObject): setting hot spot in the center
of the object icon for drag and drop.
* FWObjectPropertiesFactory.cpp (getObjectPropertiesDetailed):
showing group members in tooltips and conflict resolution dialog
* ObjectEditor.cpp (ObjectEditor): redesigned ObjectEditor
class. All individual object editor classes are now inherited from
QDialog and are top-level windows. Class ObjectEditor is just a
manager that opens and hides appropriate dialog and manages its
size and position on the screen. Geometry is remembered separately
for each dialog for each object type, so we can have group object
editor open wider than, say, IP service object editor. Each object
editor has its optimal size.
* pfAdvancedDialog.cpp (pfAdvancedDialog): yet another redesign of
PF firewall settings dialog. Using individual checkboxes to
enable/disable each "limit" and "timeout" option
* ipt.cpp (main): all compilers do not create any files if there
was an error during rule processing (not even empty ones)
2004-06-04 <vadim@vk.crocodile.org>
* RuleSetView.cpp : Info window shows properties of an object
selected in rules
* RuleSetView.cpp (paintCell): added tooltips for objects in the
policy view, using the same detailed properties text that is used
for Info panel.
* iptAdvancedDialog.cpp (accept): the actual command that
installer should run on the firewall to activate the policy can
now be specified in the "installer" tab of firewall settings
dialog for all platforms. If this input field is left blank,
installer will run firewall script, using sudo if user name used
to authenticate to the firewall is not 'root'. On Windows,
installer also does chmod +x on the file.
* FWBSettings.cpp (setSSHPath): directory path and a file name for
the secure file transfer and secure shell utilities can be
configured in the Preferences (tab "SSH"). This allows for using
of different SSH packages on Windows, as well as using SSH
installed in a non-standard directory on Unix.
2004-06-03 <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (dragObject): standard folders in the tree
can not be dragged into groups or rules and open/close on double
click. Regular objects open editor on doubleclick.
* ipt.cpp (main): compiler for iptables sets up PATH environment
variable at the beginning of the generated script. This is
particularly useful if policy is compiled on windows or mac for
Linux firewall that runs unknown version of Linux, so we cant be
sure where standard tools such as iptables, lsmod etc are
located. Most systems place them in /sbin, but for example SuSe
places iptables in /usr/sbin. If policy is compiled on one of the
Linux systems, we assume generated script will run on the same
system (which may not be true, btw), but if we compile on Windows,
there is no way to know where these tools are located
beforehand. In this case we need PATH. User can always override
this behavior and specify full path to all tools explicitly.
2004-06-02 <vadim@vk.crocodile.org>
* linux24.xml.in: changed "Linux 2.4" to "Linux 2.4/2.6" in all
menu
* iptAdvancedDialog.cpp (iptAdvancedDialog): removed "log all
dropped packets" option from the firewall settings dialog for
iptables. This option required p-o-m patch that has become
obsoleted and is not included in p-o-m anymore.
* FWWindow.cpp (install): when user hits "Install", the GUI checks
if objects in the database were modified since policy of a
firewall has been compiled last time. If existing policy file is
older than the database, program offers the user to compile it
before it is installed. There are options to recompile, install
old copy or cancel the operation.
2004-05-31 <vadim@vk.crocodile.org>
* RuleSetView.cpp: Added support for operations that act on
multiple rules: setting rule color, moving to a different position
in rule set, disabling/enabling, deleting. User can select
multiple rules by dragging mouse across several rows in the column
that shows rule numbers. Copy/Cut/Paste operations of multiple
rules are not supported yet.
2004-05-29 <vadim@vk.crocodile.org>
* RuleSetView.cpp (dragObject): implemented drag-and-drop of
objects in the rules
* utils.cpp (setDisabledPalette): all entry fields in the object
editor are disabled if an object is read-only or is located in
read-only library. Object editor is still opened for read-only
objects, but since all fields are disabled, changes are not
allowed. Opening object editor for read-only and standard objects
allows for inspection of their properties.
* FWWindow.cpp (load): file objects_init.xml does not include
empty "User" library anymore. Instead, this library is created
dynamically using method FWBTree::createNewLibrary when user
creates new data file. This simplified things since 1) "User"
library now has unique random ID in every data file so it can be
safely exported and then imported back without any conflicts; 2)
since its ID is unique, it can be renamed without creating any
conflicts. The library is only created in FWWindow::load()
(i.e. when new data file is created). It is not created when
existing data file is loaded because it is supposed to be
there. Old data files that still have this library with
semi-standard ID will load it as before, but the ID loses its
standard meaning.
2004-05-23 <vadim@vk.crocodile.org>
* filePropDialog.cpp (filePropDialog): added "File properties"
main menu item and dialog
* debugDialog.cpp (debugDialog): added "debug" menu item under "Help"
2004-05-20 <vadim@vk.crocodile.org>
* instDialog.cpp : built-in installer works with all supported
firewall platforms: iptables, ipf, pf, ipfw and pix.
* instDialog.cpp (instDialog): built-in installer reads list of
files that policy compiler generated for a given firewall object
("manifest") from the .fw file and installs them on the
firewall. One file in the manifest needs to be marked as
executable, installer runs it after all files are copied.
* all policy compilers: all compilers include a list of files
generated for a given firewall object ("manifest") in .fw file.
2004-05-18 <vadim@vk.crocodile.org>
* RuleSetView.cpp (contextMenu): split long context menu that used
to be shown when user clicked right mouse button on an object in a
rule. Now this menu has only actions related to the object, while
actions for the whole rule belong in the context menu shown when
user clicks right mouse button on the rule number.
* fr.po, ru.po: checked in updated French translation by
Jean-Michel Poure and added some rudimentary Russian
translation. Both translations are done in UTF-8.
2004-05-15 <vadim@vk.crocodile.org>
* init.cpp (init): define global var localepath that is
initialized with a path to the directory where translation files
(*.qm) are installed. This path is defined as $respath/locale on
all systems (on Unix this typically is
/usr/share/fwbuilder/locale, while on Windows and Mac it will be a
subdirectory "locale" in the directory where the binary is
installed)
2004-05-14 <vadim@vk.crocodile.org>
* ColorLabelMenuItem.cpp (ColorLabelMenuItem): implemented RFE
#725461: "Colors". Added ability to color-code rules in the
policy. User can pick one of the 7 predefined colors (plus none)
in the pop-down menu that appears when they right-mouse-click on
the policy or NAT rule. Custom text can be associated with each
color using a panel in the Preferences dialog, this text appears
as a tool tip when user flies mouse cursor over color buttons in
the pop-down menu.
2004-05-12 <vadim@vk.crocodile.org>
* src/gui/ui: QT's ui translator uic creates code in this directory.
This allows me to add generated files to the internationalization
infrastructure (include in the .pot file). also added *.cpp files
in src/gui/ui to cvs so translators can look at them to better understand
context without having full QT development environment.
2004-05-09 <vadim@vk.crocodile.org>
* PolicyCompiler_ipt.cpp (processNext): fixed bug #934949:
"duplicate rules". fwb_ipt created duplicate rules for a bridging
firewall if fw object or its interfaces or their addresses were
not in the source or desintaion
2004-05-04 <vadim@vk.crocodile.org>
* newFirewallDialog.cpp (accept): "new firewall" wizard can create
a new firewall object using predefined templates from the file
templates.xml (the file is a pat of the package and is installed
in /usr/share/fwbuilder on Linux and in c:\FWBuilder\resources on
Windows). User picks a template and the program creates a
duplicate of the template object in the "User" object library. The
wizard page where user picks template shows a diagram of the
firewall configuration that illustrates its interfaces, their
configuration and addresses. Comment text associated with template
object explains its specific properties and is shown on the page
as well.
2004-05-02 <vadim@vk.crocodile.org>
* templates.xml.in : a library of firewall object templates. This
library is a part of the distribution and is installed in
${prefix}/share/fwbuilder on Linux and BSD and in
C:FWBuilder/resources on windows (the same dir where standard
objects are installed). This library is not loaded by default
though.
* listOfLibraries.cpp (listOfLibraries): Added a page to the
preferences dialog to manage add-on libraries. The GUI maintains a
list of available add-on libraries and allows user to define which
ones will be automatically loaded when the GUI is started. The
program always adds "standard" and "templates" libraries to the
list, then scans directory $HOME/.fwbuilder/lib/ (
C:\FWBuilder\lib on windows) and adds all .fwb files found there
to the list. It stores list of libraries in the user's preferences
together with a boolean flag that is set if a library should be
loaded on a start-up. Library added using main menu "Import
Library" is also added to the list so the user can make the
program load it automatically.
2004-04-29 <vadim@vk.crocodile.org>
* Makefile.in: Added support for internationalization. Using
gettext 0.14.1. This is the first version where support for QT
lanuage files is available, but it is not available in RedHat or
other Linux distributions yet. Therefore had to copy some m4 macro
colelctions from example to directory 'm4', as well as copied a
Makefile.in and script remove-potcdate.sin to directory 'po'. New
version of xgettext recognizes standard QT localization method
tr() and can generate usual .pot files from strings used with
it. The nwe msgfmt can generate .qm files from translated .po
files.
2004-04-25 <vadim@vk.crocodile.org>
* instDialog.cpp (cmd): this method can be used whenever we need
to execute several commands on the firewall sequentially.
* (instDialog): install dialog hides incremental install options
if 'diff' program can not be found (perhaps compiler that comes
with it is not installed)
* instDialog2.cpp (PIXincrementalInstall): integrated with
fwb_pix_diff
* instDialog2.cpp (PIXbackup): implemented function that stores
backup copy of firewall configuration in a file
2004-04-18 <vadim@vk.crocodile.org>
* findDialog.cpp (find): 'find object' function is implemented by
means of an external modeless dialog that allows for searching in
the tree and or policy rules and supports matching with regular
expressions.
* newFirewallDialog.cpp (getInterfacesViaSNMP): 'new firewall'
wizard can discover interfaces using SNMP. Finished work on the
page where user can arrange interfaces according to their security
levels.
2004-04-15 <vadim@vk.crocodile.org>
* newFirewallDialog.cpp (accept): added 'new firewall'
wizard. Still need to work on the page where user sets security
levels of interfaces.
2004-04-14 <vadim@vk.crocodile.org>
* VERSION (BETA): added a variable in the VERSION file that
designates code revision as beta and stores beta testing period
expiration time (+30 days). Currently only About dialog shows this
time, but in the future I may make the program disable itself if
it is used past this time. The released version won't have this
limitation. This can be used to prompt people to upgrade, so I do
not have to support old versions.
2004-04-11 <vadim@vk.crocodile.org>
* FWBSettings.cpp (restoreGeometry): added ability for dialogs to
automatically remember and restore their geometry (size and
relative position on the screen). Currently only main window, conflict
resolution dialog and object editor dialogs do this. Geometry is
stored in preferences. Main window comes up with a default geometry
100,100,750,600 (x,y,w,h) when no geometry is found in settings.
2004-04-10 <vadim@vk.crocodile.org>
* FWWindow.cpp (ConflictResolutionPredicate): implemented conflict
detection and resolution for the "merge" operation. The same
mechanism works for "open file" since it is also based on
merge. When there is a conflict during merge, the program opens a
dialog and asks the user which copy of the object they want to
keep.
2004-04-09 <vadim@vk.crocodile.org>
* instDialog3.cpp (stateMachineSSHSUDO): builtin installer works
with Linux/BSD systems using combination of ssh on the client side
and sudo on the firewall. User provides a password for
authentication and the program logs in into the firewall as that
user, copies firewall script to "/etc/fw" (directory path is
hardcoded), then executes it using sudo. Sudo should be configured
for this user or group she belong to to be able to execute this
script as root with no password.
2004-04-08 <vadim@vk.crocodile.org>
* instDialog.cpp (instDialog): added universal (hopefully) policy
installer program. The program uses ssh in a background on both
Unix and Windows (on Windows it requires putty/plink) to
communicate with the firewall. Currently only supports PIX but I
will add Linux/BSD later. Installer GUI asks user for a password.
2004-04-07 <vadim@vk.crocodile.org>
* RuleOptionsDialog.cpp (loadFWObject): added rule options dialog
for ipt
2004-04-06 <vadim@vk.crocodile.org>
* FWWindow.cpp (search): implemented advanced search method that
finds and highlights objects both in the tree and in any rule of
any firewall. This resolves problem outlined in Feature Request
#837448: '"Where used" only shows fw objects'
2004-04-04 <vadim@vk.crocodile.org>
* FWWindow.cpp (save): implemented saving data file without making
copies of objects in the 'Standard' library (Feature Request
#810504). This feature is considered experimental and is off by
default. An option in Preferences dialog activates it.
* FWWindow.cpp (load): All load is done via merging of the loaded
file with a standard object tree. Now we can load files saved
without copies of unused standard objects.
* FWWindow.cpp (fileImport): implemented data import. Using method
FWObjectDatabase::merge to merge imported data with current object
tree. Only object IDs are compared, so modified standard object in
the imported file will be ignored and its changes will be lost.
2004-04-03 <vadim@vk.crocodile.org>
* export.cpp (exportLibrary): Implemented library export
* StartWizard.cpp (StartWizard): added simple startup wizard that
asks user if they want to open existing file or create a new
one. It also sets some useful preferences such as adds new file to
RCS and makes the program automatically open it when it is started
next time.
* OSConfigurator_linux24.cpp (generateCodeForProtocolHandlers):
Fixed bug #956544: "Error into load modules script generation",
where generated script would not load kernel modules with names
"module.ko.gz". Regular expression should match on ".ko.*$" to
find these modules properly. Thanks to Andrey Kaminsky
<and@fao.lv> who pointed this out.
* RuleSetView.cpp (doubleClicked): double-clicking on an object in
the policy rule opens that object in the editor
2004-04-02 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (ObjectManipulator): using combobox widget
instead of a tab widget for libraries. This way we can fit more
libraries without making interface cluttered.
2004-03-31 <vadim@vk.crocodile.org>
* ipt.cpp (main): the GUI saves path to the DTD and resources in
user's settings using QT QSettings class. Policy compilers and
other tools can read this setting to quickly determine location of
DTD and resources.
2004-03-29 <vadim@vk.crocodile.org>
* getting rid of STL classes in the GUI. The idea is to make GUI
use QT classes in most of the code and use STL classes such as
'string', 'map', 'list' where it has to pass data to and from API
which is STL-based. This should simplify using QT compiled without
STL support (much less conversions between string and QString).
2004-03-28 <vadim@vk.crocodile.org>
* main.cpp (main): the data file can be specified on a command
line both as an argument for option '-f' and after all
options. Option '-f' is preserved for compatibility with old
versions. Preferred method is to specify the file name as a
parameter without any option: "fwbuilder file.fwb"
2004-03-27 <vadim@vk.crocodile.org>
* platforms.cpp (getVersionsForPlatform): usability improvement:
"combo boxes" that do not allow typing in them should not have
empty choices. Fixed this for a drop-down menu of version numbers
in firewall dialog.
2004-03-26 <vadim@vk.crocodile.org>
* RuleSetView.cpp (insertRule): counting rules from zero in the GUI
* (RuleSetView): this is not a change, I just wanted to document
that I tested the GUI with a policy that has 1000 rules. I haven't
noticed any delay in loading this policy compared with when it had
<100 rules.
2004-03-25 <vadim@vk.crocodile.org>
* FWWindow.cpp (fileSaveAs): gui automatically chooses working dir
if none is set and user calls 'file save as' menu item :
* on Unix will use current dir.
* on Windows will use user's document dir.
* NATCompiler_ipt.cpp (processNext): added a workaround for a bug
(no number): if address range object was used in SNAT or DNAT rule
and option 'manage virtual addresses' was on, compilerwould not
add virtual address properly. It still won't do it, but at least
there is a check for this situation and it prints appropriate
warning message. The problem with this is that if the range is
large, we end up with potentially lots of virtual addresses. Let
the user deal with this themselves.
* ipt.cpp: compiler(s) understand new command line option '-R',
which should specify a full path to the resources. This is useful
on Windows and Mac where resources are installed in a non-fixed
place by the GUI package, but need to be used by the compilers.
2004-03-24 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (contextMenu): each system group object in
the tree has an item in its pop-down menu that allows user to
quickly add an object to that group.
* IPv4Dialog.cpp (DNSlookup): added ability to determine IP
address of an Address object using DNS lookup (using QDns class)
* FWBSettings.cpp (FWBSettings): explicitly setting scope for
QSettings as "User"
2004-03-22 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp (addTreePage): added attribute 'ro' to all
elements in DTD (see API). This provides for a way of locking down
parts of the tree.
* ObjectManipulator.cpp (addTreePage): read-only subtrees are
marked with an icon of a lock and text 'read-only'
* objects_init.xml : standard objects tree is now read-only. User
objects can not be moved into 'standard' tree and standard objects
can not be edited but can be duplicated (a copy is automatically
created in the first user-defined library, most often it is a
library 'User')
* FWWindow.cpp (install): GUI supplies a path to the firewall
object as a parameter to installation script rather than just its
name (as before). This is because the path has changed when
library element has been added. Changes made in the GUI (send path
instead of name) and in fwb_install script (to make it interpret
path).
2004-03-21 <vadim@vk.crocodile.org>
* pixosAdvancedDialog.cpp (pixosAdvancedDialog): 'advanced host
settings' dialog for PIX
* RuleSetView.cpp (contentsMousePressEvent): selectedObject is
chosen in mouse press and key press even handlers; got rid of
currentChanged slot all together. This eliminated flicker that was
caused by extra repaint of the cell when selected object was
chosen in currentChanged slot.
2004-03-20 <vadim@vk.crocodile.org>
* DialogData.cpp (DialogOption): universal class to load and save
data in dialogs
* pixAdvancedDialog.cpp (pixAdvancedDialog): 'advanced' firewall
options dialog for PIX. Implemented tabls 'Compiler options',
'Prolog/Epilog', 'Timeouts' and partially 'Fixups'. Fixup pages
are disabled using resource string that defines which fixups are
available in certain PIX version.
* FirewallDialog.cpp (openFWDialog): firewall dialog saves version
from the widget to the object before opening 'advanced' firewall
options dialog. This is a departure from the dialog logic where
all data is stored when user clicks 'Apply changes' button.
2004-03-19 <vadim@vk.crocodile.org>
* FWBSettings.cpp: added support for an "object autosave" option
(automatic saving of changes in dialogs while switching between
objects)
* RuleSetView.cpp (insertRule): added main menu items "insert
rule" and "add rule after current"
* RuleSetView.cpp (contextMenu): added pop-up menu items for
adding, removing and moving rules up and down, as well as standard
copy/cut/paste operations on moves. Similar menu items added to
the main menu.
* RuleSetView.cpp (paintCell): implemented double-buffering in
paintCell to improve performance and remove flickering
2004-03-17 <vadim@vk.crocodile.org>
* FWBSettings.cpp: saving the size of the info window in settings
* RCSFileDialog.cpp (RCSFileDialog): 'open file' dialog
automatically looks for files in the working directory configured
in a global preferences dialog.
* main.cpp (main): added a global setting "startup action" in
Preferences. Currently two actions are available: "load standard
objects" and "load last edited file".
* FWBSettings.cpp (FWBSettings): a specialized wrapper for
QSettings. I will be adding methods to this class to simplify
access to whatever global program preferences and options I
need. Currently it supports 'working dir' and 'info window style'
settings. Settings are stored in a platform-depended way as
QSettings does it.
2004-03-16 <vadim@vk.crocodile.org>
* NATCompiler_ipt_writers.cpp (_printOPorts): minor bugifx - fixed
typo ( '==' -> '=' )
* ObjectEditor.cpp (closeEvent): object editor checks for
modifications before closing if user closes it using window
manager buttons.
* FWWindow.cpp (unselectRules): the main window maintains single
selection across objects in the tree and in the policy
view. Selecting an object in the tree automatically unselects
object in the policy and vice versa. Now I can implement
copy/cut/paste functions driven by the main menu; these operations
will work on the currently selected object either in the tree or
in the policy.
* FWWindow.cpp (editCut): copy/cut/paste operations work between
the tree and policy views using both context menus and main
menu.
* ipt.cpp: output stream is created with a mode ios::binary on
Windows
* RCS.cpp (isDiff): having problems with rcsdiff.exe in windows,
for now will assume that the file always changes and needs checkin
comment.
2004-03-15 <vadim@vk.crocodile.org>
* RCS.cpp (co): using windows-specific functions to create a
temporary file for the file checkout
* global.h: added redefinition of macro assert to be able to use
it on windows where we compile without debugging info. (the reason
I do not build Debug version on win32 is because I use precompiled
libraries libxml2 etc that are built using Release CRT, and I
can't mix different runtimes).
* RCS.cpp (co): GUI makes sure that if the file has been opened
and locked by a user, another user can only open it read-only. The
same user has a choice of opening it read-only or read-write. The
latter case is useful in case of a program crash that leaves
opened files in the locked state.
* RCS.cpp (co): added ability to open older revision of the file
read-only. Requested revision is checked out into temporary file,
which is then loaded and immediately deleted. The object tree is
locked read-only and 'save' and 'save as' operations are disabled.
2004-03-14 <vadim@vk.crocodile.org>
* RCS.cpp (add): using "rcs -i -kb" to add a file to RCS, this
should help avoid extra CR in the file while working on windows
because it makes RCS use binary mode while working with the file.
2004-03-13 <vadim@vk.crocodile.org>
* ObjectManipulator.cpp: GUI redesign: switched to a single window
design. Object manipulation happens inside three classes:
ObjectManipulator (the tree widgets and algorithms), ObjectEditor
(a stack of editor widgets and a glue logic), obejct info browser
(class QTextBrowser). Object editor appears as a non-modal dialog
when user double-clicks an object in the tree. Single click
updates data in the info window but does not open the
editor. Objects can be selected in the tree in any supported way -
keyboard arrows, keyboard shortcuts, hitting the first letter of
the objects's name, mouse click. In any case, appropriate object
is selected and info window is updated with its attributes.
Info window has three modes: collapsed (there is no info window),
showing only comment attrbibute and showing brief summary of
object's parameters and a comment. User can switch between modes
using a button located on the main window panel directly under the
info widget.
2004-03-12 <vadim@vk.crocodile.org>
* build environment is based on qmake: file qmake.inc is included
from qmake project files in all subdirectories. File qmake.inc
defines all variables for all platforms, so project files in
subdirs only add lists of files and take care of exceptions. File
qmake.inc is generated by configure, but all substitutions are
only needed for Unix and Mac. This file is checked in to cvs so it
could be used on Windows without a need to run configure.
All qmake project files in subdirectories need no substitutions
by configure, so they all are checked in to cvs and can be used on
windows right away.
Qmake project files fwbuilder2.pro and src/src.pro use template
'subdirs' and make qmake descent into subdirectories and rebuild
projects there.
Now using qmake to generate Makefile and MSVC project files in
src/fwblookup, src/fwbedit, src/ipt. Makes it easier to generate
consistent MSVC projects without having to edit them manually.
resource files (src/res/*.xml and src/res/*/*.xml) are generated
by configure, however, since substitutions made in them are only
relevant on Unix and Mac, generated files are checked in to cvs so
they can be used on windows without running configure.
No need to run configure (or autogen.sh) on Windows anymore.
To build on Unix and Mac:
$ autogen.sh
$ make
$ make install
To build on windows:
run qmake, then make in the root dir. of the project
Open fwbuilder2.dsw in MSVC and rebuild all
* NATCompiler_ipt.cpp, PolicyCompiler_ipt.cpp and others in
src/ipt: code cleanup. Removed all unused variables and added
handling for 'default' case in switch operators.
2004-03-10 <vadim@vk.crocodile.org>
* FWWindow.cpp (compile): implemented main menu items "Rules/compile"
and "Rules/install". Still need to add toolbar buttons though.
* execDialog.cpp (execDialog): a dialog for a background execution
of external commands. This class is used to call external policy
compilers and installer scripts. Uses QT class QProcess.
* ipt.cpp: transfered compiler for iptables over to fwb2. Only
minor changes: new file name schema (*.h, *.cpp); proper choice of
the directory where resource files are located; eliminated last
dependencies on glib
2004-03-09 <vadim@vk.crocodile.org>
* iptAdvancedDialog.cpp (accept): firewall settings dialog saves
all data in the object.
2004-03-07 <vadim@vk.crocodile.org>
* iptAdvancedDialog.cpp (iptAdvancedDialog): firewall settings
dialog for iptables. Saving of the data back in the firewall
object is not implemented yet.
* DialogFactory.cpp (createDialog): DialogFactory: class that
creates dialogs for all object types.
* FWBTree.cpp (FWBTree): refactored code: all methods that enforce
our standard tree structure now belong to the class FWBTree
* TimeDialog.cpp (applyChanges): added dialog for the Time
interval object.
2004-03-06 <vadim@vk.crocodile.org>
* GroupObjectDialog.cpp (setupPopupMenu): added pop-up menu in the
group view (both icon and list modes) with oprations
copy,cut,paste and delete.
* all dialogs: object is moved from library to library when user
clicks 'apply changes' (before it would move immediately when the
library was changed in the pop-down menu).
* CustomServiceDialog.cpp (loadFWObject): added dialog for the
Custom Service object
2004-03-05 <vadim@vk.crocodile.org>
* PropertyEditor.cpp (copyObj): added pop-up menu to object tree
view; implemented functions 'duplicate', 'copy', 'cut', 'paste'
2004-03-04 <vadim@vk.crocodile.org>
* ObjectTreeView.cpp (contentsMouseReleaseEvent): objects in the
tree are selected with double-click.
2004-03-03 <vadim@vk.crocodile.org>
* RuleSetView.cpp (getRE): added platform capabilities check for
columns 'Time' and 'log/options' in policy views
* RuleSetView.cpp (dragMoveEvent): support for d&d of Time objects
2004-03-02 <vadim@vk.crocodile.org>
* InterfaceDialog.cpp (loadFWObject): added dialog elements for
interface security level, 'external' checkbox, network zone.
* RCS.cpp (isDiff): added a wrapper for rcsdiff in RCS class
2004-02-29 <vadim@vk.crocodile.org>
* PropertyEditor.cpp (createObject): properly creating interfaces
and addresses for the firewall object
* further testing and improvements in RCS integration
2004-02-28 <vadim@vk.crocodile.org>
* FWWindow.cpp (load): file can be opened with or without RCS, a
head revision or any specific revision, read-write or
read-only. File name, revision number and read-only status is
displayed on the main window's title bar.
* FWWindow.cpp (load): added ability to open data files read-only
* RCS.cpp (RCS): refactored the code, made class RCS a wrapper for
the command-line rcs tools. It should be possible to use the same
or similar interface for other version control system if needed.
2004-02-26 <vadim@vk.crocodile.org>
* RCSFilePreview.cpp (showFileRLog): Open File dialog shows RCS
revisions of the chosen file in a preview panel. Added button "add
to RCS" that allows user to add selected file to RCS right from
the "open file" dialog. Added elements for opening file read-only
and with or without locking (but these functions have not been
implemented yet).
2004-02-23 <vadim@vk.crocodile.org>
* RCS.cpp (rlog): class RCS provides simple integration with
RCS. Uses portable functions provided by QT to call external RCS
programs.
* configure.in: added checks for external RCS programs ci, co,
rlog.
2004-02-22 <vadim@vk.crocodile.org>
* FWWindow.cpp: added basic integration with RCS. Every time a
data file is opened, it is checked out from RCS and locked. If the
file has not been added to RCS, an initial checkin is performed
with a generic comment. Every time an opened file is saved (using
"save" or "save as" menu), it is checked in and kept in a locked
state. A new menu item "File/Close" has been added; this menu item
checks the file in and removes lock (does 'ci -u') so other users
can work on it, then it reopens a standard objects database in the
GUI. Opening a file while another file is already opened in the
GUI causes the latter to be closed (checked in and lock removed)
and a new one opened as described above.
still TODO: add a dialog to ask the user for a checkin comment
text. Add a global option "Use RCS" so that using version control
is optional. Test the whole thing on Windows.
2004-02-16 <vadim@vk.crocodile.org>
* PropertyEditor.cpp (PropertyEditor): added dialogs for
interface, MAC address, network, address range and other objects.
* FWObjectDrag.h: implemented custom drag class FWObjectDrag; all
widgets dynamically check if the object being dragged can be
dropped in them. User can drag objects from the tree into groups
and rules, as well as from a group into the tree.
2004-02-08 <vadim@vk.crocodile.org>
* IPServiceDialog.cpp (libChanged): implemented gui elements and
support for moving objects between libraries.
2004-01-20 <vadim@vk.crocodile.org>
* added dialog for object IPv4. This object can now be created in
a standard place in the tree in a group Objects/Addresses as well
as as a child object of interface (as before in fwbuilder 1). This
allows for using object IPv4 as an abstract for an IP address
which is simpler than using a Host object.
2004-01-04 <vadim@vk.crocodile.org>
* GroupObjectDialog.cpp: Experiment: user and standard object tree
views have different background colors. This provides simple
visual clue of what library the object shown in the editor panel
belongs to. This is especially useful if a standard object is
referenced from the user defined group and user opens it; in this
case the tree switches from user-defined objects to the standard
onces but this switch may not be evident from the first glance,
thus user loses context and may be confused why his objects
apparently have gone away.
2004-01-03 <vadim@vk.crocodile.org>
* PropertyEditor.cpp (PropertyEditor): property editor has window
type "dialog" and always stays on top of the main
window. Implemented simple history feature for the object
navigation and added a button "Back" to the toolbar.
* GroupObjectDialog.cpp (loadFWObject): group object dialog can
now show group contents as a set of icons or as a list; switching
between two modes is done using toggle buttons a-la file list
modes in the "open file" dialog.
* PropertyEditor.cpp (loadObjects): merged object tree and object
property editor in one dialog.
2003-12-20 <vadim@vk.crocodile.org>
* main.cpp (main): resources and preferences files can now be
found dynamically, using a full path to the directory the binary
has been launched from. The RES_DIR macro defined in config.h
now specifies relative path to the resource files starting from
the application root dir. If program is installed in
/usr/local/bin, then the application root is "/usr/local" and
resources should be located in /usr/local/$RES_DIR directory.
Reference in New Issue View Git Blame Copy Permalink