Subject: cleanup helmet

From: Ed Groves <[email-masked]>
Date: Thu, 14 Jun 2007 00:57:04 -0600

CAON UP 45% In The Last Week!

Chan-On International Inc.
Symbol: CAON
Close: $0.80 UP

CAON continues to climb daily. Up 45% in the last 7 days as investors
are excited about this company's new direction. Read the releases,
consider the potential and get on CAON firs thing Thursday!

Making sure we always strip directory path from the file name if user
specified full path for the policy file in the "Output file name" input
field in the "Compiler" tab of firewall object dialog.
We plan to run public beta for a few months and release final version in
October.

New option has been added to the TCP Service object, called
"established".
A bug that prevented user from creating a rule set branch inside another
branch has been fixed. This bug report in fact  reported several
problems. This was one of the most requested features on the list for a
very   long time. New function to compare two data files and find
conflicting objects has been added. Checking "Test mode" checkbox in the
installer options dialog should enable widgets that configure automatic
reboot timeout.
Confirmation dialog that is shown when user tries to delete an object
also shows all groups and rules that use it. POSTROUTING chain of the
mangle table, as well as its FORWARD and OUTPUT chains, work before
corresponding chains of the nat table. Ability to search for objects
using regular expressions matching their names or attributes has been
added.
Conflicting objects have the same internal ID but different attributes.
html , rerouting happens after OUTPUT hook but before POSTROUTING hook.
Finally beta testing is over and the  release is out.

For PF it is translated into queue; compiler for ipfw can use pipe,
queue or divert depending on how the action is configured by the
administrator in the GUI. igmp access lists are not parsed. We still
have quite a bit of work to do though, particularly localization has
only began. This eliminates duplicates such as the same rule in
PREROUTING and INPUT chains. Both installers were updated however to
improve support for the automatic roll-back feature in case you lose
connect with the firewall or the router because of an error in the
policy.

Packages are available for download on our SourceForge downloads page.

Since router ACLs have no state, all rules should be created in the
policy pretty much like you do it on the router, including rules that
permit reply packets.

The GUI got confused when user enter full path to the policy file in the
"Output file name" input field in the "Compiler" tab of firewall object
dialog. For PF it is translated into queue; compiler for ipfw can use
pipe, queue or divert depending on how the action is configured by the
administrator in the GUI. Affected platforms are PF and ipfilter because
normally for these platforms compiler generates two files.
in case when importer fails to parse some part of the iptables-save
file, corresponding policy rule is colored red and appropriate
diagnostic message added to its comment.

This is especially convenient as it allows one to inspect the rules
after failed compilation while still having compiler error on screen.
Compiler for iptables ignored flag 'disabled' on rules in a branch.

The user can create policy branches within other branches. Because of
the huge variety of iptables modules, Importer can only interpret basic
iptables configuration and a subset of modules. This bug report in fact 
reported several problems.

This operation does not find objects present in one file but not in the
other, such objects present no problem for merge or import operations.
It works on target platforms that provide suitable syntax and allow
control to return to the higher level rule set if the branch can not
make final decision about the packet. Support for IP option "lsrr" has
been added in compiler for ipfilter.
installOptionsDialog was too large and did not fit on some laptop
screens.

This is an empty action that does not affect packet flow through the
firewall but can be used in combination with "logging" option to log the
packet.
Since router ACLs have no state, all rules should be created in the
policy pretty much like you do it on the router, including rules that
permit reply packets.

The problem must be corrected manually.

html , rerouting happens after OUTPUT hook but before POSTROUTING hook.
It is impossible to mix such rules with terminating and non-termninating
behavior. Unrecognized targets and converted to branching rules, where
the name of the target becomes the name of the branch. DNSName:  This
object resolves a host name to the IP address using DNS.

Instead, this release adds two major new features: support for Cisco IOS
access lists and a framework to import existing firewall or router
configuration. This means emulation can be turned on and off for all
rules that might require it at once.

Ability to search for objects using regular expressions matching their
names or attributes has been added. Firewall object is placed in
"Source" for rules with chain OUTPUT.