| 1 | Version 2.0.15 |
|---|
| 2 | * Add media support to desc.xml |
|---|
| 3 | * Fix Javascript: disable NAT protocol field for non-TCP/UDP protocols |
|---|
| 4 | |
|---|
| 5 | Version 2.0.14 (2009-02-16) |
|---|
| 6 | * Fix the LDAP backend in nupyf to include the UDP rules (instead of just |
|---|
| 7 | the TCP rules) |
|---|
| 8 | |
|---|
| 9 | Version 2.0.13 (2009-01-09) |
|---|
| 10 | * Fix LDAP backend for an ACL with multiple groups (previously only |
|---|
| 11 | one user group was stored in LDAP) |
|---|
| 12 | * Fix nupyf to support authentication objected linked to another |
|---|
| 13 | authentication object |
|---|
| 14 | * Always show "Create new ..." button for objects (authentication, |
|---|
| 15 | protocols, periods, etc.) |
|---|
| 16 | |
|---|
| 17 | Version 2.0.12 (2008-11-03) |
|---|
| 18 | * Fix HTML and CSS for Internet Explorer 7 for the ACL list |
|---|
| 19 | and an highlighted an ACL group |
|---|
| 20 | * Recompute all descsorts after a new ACL is created |
|---|
| 21 | * Fix nupyf for the descsort of a FORWARD ACL when the source or |
|---|
| 22 | destination is an broadcast address |
|---|
| 23 | * Network description parser from nupyf module reads "enabled" attribute |
|---|
| 24 | |
|---|
| 25 | Version 2.0.11 (2008-11-20) |
|---|
| 26 | * Block layer7 object deletion if it's used by a protocol |
|---|
| 27 | * Fix iptables generation for authentication rules in rescue mode: |
|---|
| 28 | generate also the logging rules |
|---|
| 29 | * Saving an ACL (forward, local IN or local OUT) closes the form and |
|---|
| 30 | displays a message (ACL saved correctly) |
|---|
| 31 | * /etc/init.d/init-firewall script remembers the previous mode (with NuFW |
|---|
| 32 | or without NuFW): reuse the previous mode for start or reload actions |
|---|
| 33 | * Remove value "--" for fields defaultaction and action of layer7 objects. |
|---|
| 34 | When loading old rulesets, set defaultaction to "drop" and action to |
|---|
| 35 | "accept" if the value is empty or not set |
|---|
| 36 | |
|---|
| 37 | Version 2.0.10 (2008-10-15) |
|---|
| 38 | * Don't use SNAT on IPSEC packets (use "-m policy --pol none --dir out") |
|---|
| 39 | * NAT form: use a text area of 30x3 characters (instead of 30x1) |
|---|
| 40 | * Fix iptables generation for NAT rules: sort the rules using the numeric |
|---|
| 41 | value and not the string value (1, 2, ..., 10 instead of 1, 10, 2, ...) |
|---|
| 42 | * NAT iptables rules: don't write -s 0.0.0.0/0 nor -d 0.0.0.0/0 |
|---|
| 43 | to get shorter rules |
|---|
| 44 | |
|---|
| 45 | Version 2.0.9 (2008-10-13) |
|---|
| 46 | * Fix the order of the IPSEC dispatch rules |
|---|
| 47 | * Fix tunnel-src/tunnel-dst arguments of IPSEC dispatch rules |
|---|
| 48 | (invert source and destination for the output rules) |
|---|
| 49 | |
|---|
| 50 | Version 2.0.8 (2008-10-09) |
|---|
| 51 | * Fix gendesc for a OpenVPN client: create a direct network of class C, |
|---|
| 52 | eg. "Convert peer-to-peer address 10.8.0.66 to 10.8.0.0/24" |
|---|
| 53 | * complete_resources_from_desc() replace the name on duplicate |
|---|
| 54 | (eg. "INTERNET" becomes "INTERNET-2") |
|---|
| 55 | * Support IP protocols "GRE" and "VRRP" |
|---|
| 56 | * Disallow letters with diacritics for the ACL names |
|---|
| 57 | * Fix "Internet Explorer" application in the ruleset template |
|---|
| 58 | (use "*\explorer.exe" and "*\iexplore.exe" instead of "*\iexplorer.exe") |
|---|
| 59 | * Use nuauth_command in init-firewall to reload nuauth cache and periods |
|---|
| 60 | * Simplify generated nulayer7 rules: don't write |
|---|
| 61 | "iptables -t mangle" prefix |
|---|
| 62 | * Disallow to use the transparent proxy without NuFW authentication |
|---|
| 63 | (revert the change made in 2.0.7) |
|---|
| 64 | * Fix the CSS for Internet Explorer 6: don't set position to absolute |
|---|
| 65 | for the completion list and fix some Javascript functions |
|---|
| 66 | * Don't generate duplicate iptables rules (eg. ACL with multiple |
|---|
| 67 | operating systems and applications) |
|---|
| 68 | * Unit tests: write tests with authenticating ACLs, |
|---|
| 69 | use --nufw and --same-iface options for nupyf, create a command |
|---|
| 70 | to regenerate the unit tests |
|---|
| 71 | |
|---|
| 72 | Version 2.0.7 (2008-09-18) |
|---|
| 73 | * Create "override proxy" value for the transparent proxy |
|---|
| 74 | * Allow to use the transparent proxy without NuFW authentication |
|---|
| 75 | |
|---|
| 76 | Version 2.0.6 (2008-07-16) |
|---|
| 77 | * Always show new ACL/NAT rule button (patch by afhide) |
|---|
| 78 | * Improve rules propagation, now support multiples hosts (patch |
|---|
| 79 | by afhide) |
|---|
| 80 | * Fix iptables generation with ACLs using layer7 filtering |
|---|
| 81 | * gendesc: create --ignore option to ignore some interfaces |
|---|
| 82 | |
|---|
| 83 | Version 2.0.5 (2008-07-10) |
|---|
| 84 | * Fix init-firewall script: replace non breaking spaces by simple space |
|---|
| 85 | |
|---|
| 86 | Version 2.0.4 (2008-07-08) |
|---|
| 87 | * Create transparent proxy option (default: disabled) |
|---|
| 88 | * Fix nupyf to parse correctly ACL periodicity |
|---|
| 89 | * gen_desc: accept link type other than loopback (eg. interface tun0) |
|---|
| 90 | * Fix iptables rules generation: truncate log prefix if it's too long |
|---|
| 91 | * Python 2.5: use builtin ElementTree library of Python 2.5 if available, |
|---|
| 92 | replace old Set class by builtin set |
|---|
| 93 | * Rename project Nuface to NuFace |
|---|
| 94 | |
|---|
| 95 | Version 2.0.3 (2008-05-27) |
|---|
| 96 | * Fix operating system and application filtering: |
|---|
| 97 | * Create OSRelease field in operation system form |
|---|
| 98 | * Fix nupyf (LDAP backend) to fill correctly the operation system |
|---|
| 99 | fields (OsName, OsVersion and OsRelease) |
|---|
| 100 | * Allow antislash in ApplicationPath and in sub-element name |
|---|
| 101 | * Fix operation systems and applications in ruleset template (empty.xml) |
|---|
| 102 | * Sort groups in authentication form |
|---|
| 103 | * Fix nupyf (LDAP backend) for REJECT decision |
|---|
| 104 | * Escape antislash in Javascript error message |
|---|
| 105 | * Fix "make install" used without first "make" command call |
|---|
| 106 | |
|---|
| 107 | Version 2.0.2 (2008-04-28) |
|---|
| 108 | * Fix contextual help (i18n didn't work) |
|---|
| 109 | * Fix Makefile: compile and install HTML documentation |
|---|
| 110 | * Fix "Populate from DNS" button on resource page |
|---|
| 111 | * Fix french translation |
|---|
| 112 | * Add a message when acls.php is called with "acl=0" |
|---|
| 113 | |
|---|
| 114 | Version 2.0.1 (2008-03-28) |
|---|
| 115 | * Fix iptables rules generation (nupyf) for ACL using NuFW but with no |
|---|
| 116 | protocol |
|---|
| 117 | * Fix L7 rules creation |
|---|
| 118 | * ACL description in LDAP: use same formant than ULOG prefix |
|---|
| 119 | * Disallow authenticated FORWARD ACL with empty protocol |
|---|
| 120 | * main.css: Applied the same font family as in NuLog (Verdana, Arial, |
|---|
| 121 | Helvetica, sans-serif). |
|---|
| 122 | |
|---|
| 123 | Version 2.0.0 (2008-03-21) |
|---|
| 124 | * No longer copy empty ruleset to create a new ruleset, but use a dedicated button |
|---|
| 125 | * New layout for statistic on the first page |
|---|
| 126 | * New layout for acl edition |
|---|
| 127 | * Allow to write user comment in log prefix |
|---|
| 128 | * Write aclbase class to factorize acl and local classes code |
|---|
| 129 | * ACL consistency check is more strict |
|---|
| 130 | * Remove reference to /etc/network/firewall |
|---|
| 131 | * Use new nuphp library (shared with NuConf project) |
|---|
| 132 | * Nupyf now requires --nufw argument to enable authentication |
|---|
| 133 | (use NFQUEUE target) |
|---|
| 134 | * init-firewall: remove panic command, and "nonufw" and "standard" command |
|---|
| 135 | enable IPv4 forward |
|---|
| 136 | |
|---|
| 137 | Version 2.0rc4 (2007-02-06) |
|---|
| 138 | * gendesc now takes care of routed networks |
|---|
| 139 | * gendesc can uses command output |
|---|
| 140 | * create option to log or not the packets |
|---|
| 141 | * detect browser preferred language |
|---|
| 142 | * optimize PHP and Javascript code |
|---|
| 143 | * checkdesc doesn't check that identifiers are increasing |
|---|
| 144 | * don't set PHP session name, keep default name |
|---|
| 145 | * nupyf forces "same iface" option when only one network interface |
|---|
| 146 | controler is available |
|---|
| 147 | * nupyf simplify iptables output: it doesn't write "-d 0.0.0.0/0" nor |
|---|
| 148 | duplicate "-d IP/mask" if it's already filtered by dispatch rules |
|---|
| 149 | * bugfix: avoid creation of duplicate "INTERNET" resource |
|---|
| 150 | * bugfix: fix minor CSS bugs |
|---|
| 151 | |
|---|
| 152 | Version 2.0rc3 (2007-01-15) |
|---|
| 153 | * gettext: Finish french translation |
|---|
| 154 | * empty.xml: add more examples: periodicities, durations, operating |
|---|
| 155 | systems and applications |
|---|
| 156 | * Create favorite icon |
|---|
| 157 | * Add XSS protection: remove "<" and ">" characters |
|---|
| 158 | * Set default language to english |
|---|
| 159 | * init-firewall supports fail2ban |
|---|
| 160 | * Ruleset constructor checks "applied" attribute (used by NuConf) |
|---|
| 161 | * Reorganize ACL form |
|---|
| 162 | * elt class: check period consistency |
|---|
| 163 | * nupyf: rename "--no-same-iface" option to "--same-iface" and fix same |
|---|
| 164 | iface mode |
|---|
| 165 | * nupyf: remove manage_input and manage_output (always enabled) |
|---|
| 166 | * nupyf: write better timestamp to generate iptables scripts |
|---|
| 167 | * Don't set modified state on "save a copy" action |
|---|
| 168 | * Always set PHP error level to E_ALL to show fatal errors |
|---|
| 169 | * nat class: constructor checks rule consistency |
|---|
| 170 | * Fix ACL history for deleted rules |
|---|
| 171 | * Rewrite "alphanum" regular expression, used for text validation |
|---|
| 172 | * "make install" doesn't replace existing nupyf.conf configuration |
|---|
| 173 | * Create configuration option: $apply_firewall_rules |
|---|
| 174 | |
|---|
| 175 | Version 2.0rc2 |
|---|
| 176 | * Rules modelization evolution for better ergonomy, simplified model. |
|---|
| 177 | This also means that NuFace 2.0 data model is NOT compatible |
|---|
| 178 | with former versions. |
|---|
| 179 | * Switch to GPLv3 |
|---|
| 180 | * PHP4 is no longer suported => use PHP5 with PHP exceptions |
|---|
| 181 | * Check desc.xml version (1.3) and acl.xml (2.0) |
|---|
| 182 | * Fix spelling mistakes, rename "ressource" to "resource" |
|---|
| 183 | and "periodicitys" to "periodicities" |
|---|
| 184 | * Rename "Subject" to "Source" and "Resource" to "Destination" in ACL form |
|---|
| 185 | * Many ergonomy enhancements |
|---|
| 186 | * Contextual help added |
|---|
| 187 | * Added init script to block (drop) input and forward traffic |
|---|
| 188 | until the real firewall rules are started. |
|---|
| 189 | * Use checkdesc in NuFace: run it before loading a desc.xml |
|---|
| 190 | * Change charset to utf8, instead of ISO-8859-1 |
|---|
| 191 | * Store ACL files in /var/lib/nuface/acls/ |
|---|
| 192 | * Use gettext for internationalization |
|---|
| 193 | * NuFace always check object's consistency (duplicate ID, broken link, ...) |
|---|
| 194 | * IP 127.0.0.0/8 is forbidden |
|---|
| 195 | * Don't load firewall rules if propagation failed |
|---|
| 196 | |
|---|
| 197 | 1.2.0 |
|---|
| 198 | * Support for Layer7 (http://l7-filter.sourceforge.net/) filtering |
|---|
| 199 | * Rules modelization evolution for more granular ACLs ordering. |
|---|
| 200 | * Many ergonomy fixes |
|---|
| 201 | * Generate iptables-restore formated rules for better loading performances |
|---|
| 202 | |
|---|
