mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-06-25 02:19:37 +02:00
188 lines
7.4 KiB
HTML
188 lines
7.4 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
|
|
<link rel="stylesheet" type="text/css" href="http://www.fwbuilder.org/pages/fwbuilder.css">
|
|
</head>
|
|
<body>
|
|
<h1> Firewall Builder Release Notes </h1>
|
|
<br>
|
|
<h2> Version 2.1.9 </h2>
|
|
<br>
|
|
<p>
|
|
Released 02/10/2007
|
|
<br>
|
|
<b>GUI and compilers v2.1.9 require API library libfwbuilder version 2.1.9</b>
|
|
<br>
|
|
<h2>Summary </h2>
|
|
<p>
|
|
This is bugfix release.
|
|
|
|
<p>
|
|
<b>For those who wish to build from source, instructions are outlined
|
|
in the document "Install and Build instructions" on our web site <a
|
|
href="http://www.fwbuilder.org/archives/cat_installation.html">here</a></b>
|
|
|
|
|
|
|
|
<h2>Improvements and bug fixes in the GUI</h2>
|
|
<ul>
|
|
|
|
<li>New feature: new operation "Tools/Find Conflicting Objects in
|
|
Two Data Files". This operation inspects two data files (either
|
|
.fwb or .fwl) and finds conflicting objects. Conflicting objects
|
|
have the same internal ID but different attributes. Two data files
|
|
can not be merged, or one imported into another, if they contain
|
|
such objects. This operation also helps identify changes made to
|
|
objects in two copies of the same data file. This operation does
|
|
not find objects present in one file but not in the other, such
|
|
objects present no problem for merge or import operations. This
|
|
operation works with two external files, neither of which needs to
|
|
be opened in the program. Currently opened data file is not
|
|
affected by this operation and objects in the tree do not
|
|
change. In the process of this operation user is presented with
|
|
series of dialogs showing conflicting objects side by side. In the
|
|
end the program can generate report and write it to a text
|
|
file.</li>
|
|
|
|
|
|
<li>installOptionsDialog was too large and did not fit on some
|
|
laptop screens. Doing tricks to make sure the dialog properly
|
|
resized after unused GUI elements are hidden.
|
|
</li>
|
|
|
|
<li>bug #1629521: "can't delete empty chain/policy tab"</li>
|
|
|
|
<li>bug #1619842: "prolog "script editor" opens behind other
|
|
windows"</li>
|
|
|
|
<li>bug #1620206: "RuleOptions' "Apply" button greyed-out until menu
|
|
selection"</li>
|
|
|
|
<li>bug 1619930: "Prolog tab's ScriptEditor's import fails to
|
|
overwrite"</li>
|
|
|
|
<li>bug #1617501:"Install fails after compile". The GUI got confused
|
|
when user enter full path to the policy file in the "Output file
|
|
name" input field in the "Compiler" tab of firewall object
|
|
dialog. Making sure we always strip directory path from the file
|
|
name if user specified full path for the policy file in the
|
|
"Output file name" input field in the "Compiler" tab of firewall
|
|
object dialog. Need to strip path when macro "%FWSCRIPT%" is
|
|
substituted in installation scriptlets and in some other
|
|
places.</li>
|
|
|
|
<li>"Apply" and "Close" buttons in the objct editor panel should be
|
|
of fixed size horizontally</li>
|
|
|
|
<li>bug #1624577: "group window doesn't stay open on
|
|
multiple-adds". Using special flag to tell ObjectTreeView that it
|
|
should ignore MouseReleaseEvent it gets after d&d operation, so it
|
|
wont switch object in the editor panel. Note the bug triggered
|
|
only on Mac OS X.</li>
|
|
|
|
<li>bug (no num.): GUI used show fanthom 'Policy', 'NAT' and
|
|
'Routing' tabs when user deleted objects from the Deleted Objects
|
|
library, provided some of these objects were previously deleted
|
|
firewalls.</li>
|
|
|
|
<li>bug #1620284: "conflict when adding library to
|
|
Preferences/Libraries". When the user tried to add a library to
|
|
the list in Preferemces/Libraries when a data file with the same
|
|
object library was loaded, the GUI detected the conflict and
|
|
showed error dialog.</li>
|
|
|
|
<li>bug #1650369: "[patch] please add support for
|
|
GNU/kFreeBSD". Applied patch to make code compile on kFreeBSD.</li>
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
<h2>Compiler for iptables</h2>
|
|
<ul>
|
|
<li>bug #1623338: "Can not disable rules in a branch". Compiler for
|
|
iptables ignored flag 'disabled' on rules in a branch.
|
|
</li>
|
|
|
|
<li>bug #1623113: 'connlimit fails in compiled "address table"
|
|
rules' Module connlimit can only be used in iptables rules
|
|
matching TCP services. Such iptables commands have "-p tcp"
|
|
and/or "-m tcp" options. If a rule in fwbuilder uses TCP Service
|
|
and connlimit option and has multiple objects in src and dst,
|
|
optimizer used to split it to minimize matches. It however
|
|
preserved connlimit option in all subrules, even though some of
|
|
them did not have TCP service after the split. This lead to
|
|
generation of incorrect iptables commands.</li>
|
|
|
|
<li>bug #1620925: "compile-time AddressTable object with empty
|
|
file". Compile-time AddressTable object that uses file with no
|
|
addresses should be treated as an empty group according to the
|
|
"Ignore empty groups" option.</li>
|
|
|
|
<li>bug #1618381: "CLASSIFY/MARK are non-terminating". This bug
|
|
report in fact reported several problems.
|
|
<p>
|
|
<ul>
|
|
<li>For action Branch with option to add branching rule to the
|
|
mangle table: we now generate rules in PREROUTING,
|
|
POSTROUTING, INPUT, OUTPUT and FORWARD chains. This is
|
|
because some targets can only work in PREROUTING or
|
|
POSTROUTING chains but we do not know what rules will user
|
|
put in the branch. So we need to branch in all chains
|
|
</li>
|
|
|
|
<li>For rules in mangle table with direction set to Inbound or
|
|
Outbound force chain to PREROUTING or POSTROUTING
|
|
respectively early. This eliminates duplicates such as the
|
|
same rule in PREROUTING and INPUT chains. Also since most
|
|
(all?) targets that require mangle table go into either
|
|
PREROUTING or POSTROUTING chains, it should be enough to use
|
|
these two chains.
|
|
</li>
|
|
|
|
<li>Non-terminating rules shadow each other "backwards", that
|
|
is more general rule shadows other rules _above_ it. Added
|
|
flag 'reverse' to the method find_more_general_rule and
|
|
added new rule processor
|
|
DetectShadowingForNonTerminatingRules that finds such cases
|
|
of 'reverse' shadowing. Using it for rules in the mangle
|
|
table for iptables.
|
|
</li>
|
|
|
|
<li>Adding iptables rule with target ACCEPT to emulate
|
|
terminating behavior for Tag and Classify actions. Emulation
|
|
is controlled by a global option in the "Compiler" tab of
|
|
the firewall properties dialog (default is "off"). This
|
|
means emulation can be turned on and off for all rules that
|
|
might require it at once. It is impossible to mix such rules
|
|
with terminating and non-termninating behavior. The reason
|
|
for this is that shadowing detection algorithm can only work
|
|
with either terminating or non-terminating rules, not with
|
|
the mix. </li>
|
|
|
|
</ul>
|
|
</p>
|
|
</li>
|
|
|
|
<li>bug #1628989: "run-time-loaded rules don't accept ";" as line
|
|
comment"</li>
|
|
|
|
<li>bug #1632054: "Runtime AddressObjects FAIL to load if "Name:"
|
|
contains "."". Compiler checks if the name of the run-time
|
|
AddressTable object contains characters that have special meaning
|
|
in sheel and relaces them with '_' when it generates the name of
|
|
the temporary shell variable.</li>
|
|
|
|
<li>bug (no num.): data files used for run-time AddressTable objects
|
|
can have empty lines, the script should skip them.</li>
|
|
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</body>
|
|
</html>
|