Firewall Builder Release Notes
Version 1.0.7
GUI and compilers v1.0.7 require API library libfwbuilder version 0.10.11
Summary
This is bug fix release.
For those who wish to build from source, instructions are outlined
in the document "Install and Build instructions" on our web site here
What's new
-
Code compiles and works on Linux distributions based on gcc
3.2 (tested on Mandrake 9.0 and RedHat 8.0)
-
Redesigned print dialog.
-
Can work with both ucd-snmp and net-snmp libraries (net-snmp
is newer version of ucd-snmp. FreeBSD comes with net-snmp.)
-
added support for rule shading detection in the policy for all
firewall platforms (both compiler and checkbox in the GUI
dialog).
-
Changed code that loads iptables modules so that it would load
all available modules regardless of their names.
-
Iptables firewall script generated by policy compiler fwb_ipt
can verify interfaces configured in the GUI for the firewall
object by checking if they really exist in the firewall
machine. This feature is controlled by a checkbox "Verify
interfaces before loading firewall policy" in the tab
"Firewall" of the firewall object dialog. Caveat: if
you configured interface object after interface alias
(something like "eth0:0"), then script will treat it as
non-existant interface and will abort firewall script without
making any changes to the firewall policy. This way generated
script just follows the behavior of netfilter, which does not
recognize interface aliases and uses corresponding "main"
interface instead. In reality aliases are just a secondary IP
addresses on the "main" interface. If for any reason you
configure interface objects after interface aliases, we
strongly suggest you reconsider your design.
-
implemented feature req. #614034: Cross Rule
consolidation. Policy compiler can find and eliminate
duplicate atomic rules. Implemented only for ipfilter.
Bugs fixed in libfwbuilder API:
-
fixed bug #626238: address 0.0.0.0/8 not detected correctly
Bugs fixed in GUI:
-
interface of the newly created host object gets netmask
255.255.255.255 if "quick create" method was used.
-
Fixed printing in html and plain text formats. Redesigned
print dialog.
-
fixed bug #617005: sigsev when creating standard rules
(missing InterfacePolicy child elements on interfaces of
firewall object created via Network Discovery Druid).
-
GUI removes national locale characters from the rule comment
fields to avoid problems with XML format (we do not use real
UTF-8 encoding at this time and therefore can not support
non-ascii characters in XML).
Bugs fixed in iptables policy compiler fwb_ipt:
-
fixed bug #617001: wrong module names used for ip_conntrack
etc. if version of iptables is set to >1.2.6
-
fixed bug #624842: mac addrress lost when multiple hosts with
MAC addresses using withing group of objects.
-
Bugs fixed in ipfilter policy compiler fwb_ipf:
-
fixed bugs #616482 and #623376: rule with negation and logging
logged everything.
-
fixed bug #616951: block return-icmp can not be used with
direction 'outbound'
-
fixed bug #629359: GUI did not mark rule as having non-default
options when return-icmp-as-dest was checked in rule options.