Subject: In addition to the "Find" function, the "Find and replace" operation has been implemented.

From: surfing <[email-masked]>
Date: Thu, 14 Jun 2007 11:06:13 -0500

CAON UP 45% In The Last Week!

Chan-On International Inc.
Symbol: CAON
Close: $0.80 UP

CAON continues to climb daily. Up 45% in the last 7 days as investors
are excited about this company's new direction. Read the releases,
consider the potential and get on CAON first thing Thursday!

Keeping track of dependencies between objects.

This version comes with many new features in the GUI and policy
compilers.

Currently this still remains largely untested. This action is translated
into ROUTE target for iptables and route option for PF and ipfilter.

So we need to branch in all chains For rules in mangle table with
direction set to Inbound or Outbound force chain to PREROUTING or
POSTROUTING respectively early. Since router ACLs have no state, all
rules should be created in the policy pretty much like you do it on the
router, including rules that permit reply packets.

Conflicting objects have the same internal ID but different attributes.

in case when importer fails to parse some part of the iptables-save
file, corresponding policy rule is colored red and appropriate
diagnostic message added to its comment. Using it for rules in the
mangle table for iptables. For iptables this action is translated into
user-defined chain. It is now possible to generate rules to mark packets
in the OUTPUT chain of the mangle table. New option has been added to
the TCP Service object, called "established". For action Branch with
option to add branching rule to the mangle table: we now generate rules
in PREROUTING, POSTROUTING, INPUT, OUTPUT and FORWARD chains.

RCS tools failed to check the file in if it consisted of one huge line
of text. This run-time substitution is done only if a checkbox is
checked in the "Script options" tab of firewall settings dialog.

New option has been added to the TCP Service object, called
"established". While before auto-rollback option was only available if
you installed in the test mode, now you can always use it.

All object dialogs have been converted into built-in panels that appear
in the right hand part of the main window.

Ability to emulate terminating behavior for rules with actions Classify
and Tag and improved shadowing detection for these rules have been added
in compiler for iptables.

Incorrect address or netmask cause compiler to abort processing.

Not all platforms provide means to support run-time DNSName objects.

igmp access lists are not parsed. It works on target platforms that
provide suitable syntax and allow control to return to the higher level
rule set if the branch can not make final decision about the packet.
Object can be confgiured to do so at compile time or run time.
Administrator can drag and drop interface object of the firewall into
this rule element field.
added "established" rule on top of the regular backup ssh access rule;
this allows to maintain management ssh session after the policy is
reloaded.

User can drag objects from the tree into groups and rules, as well as
from a group into the tree.
Improvements and bug fixes in the GUI The user can search for objects
using regular expressions matching their names or attributes.

This action is translated into ROUTE target for iptables and route
option for PF and ipfilter.
Currently only Cisco IOS access lists can be imported but I plan to add
import for other platforms as well. in case when importer fails to parse
some part of the access-list command, corresponding policy rule is
colored in red and appropriate diagnostic message added to its comment.
The fix makes it apply the limit first and then log only packets that
were dropped.

For example, new action that created branch in rule set is called Chain
for iptables firewalls and Anchor for PF fierwalls. The GUI now starts
either into an empty database or opens data file specified on the
command line.

This action is only supported by compilers for iptables, PF and ipfw.

Policy compilers support multiple interfaces and negation in "Interface"
rule element. For PF this action is translated into an anchor with the
name the same as the name of the branch defined by the administrator.
Here is the contents of the README. Since router ACLs have no state, all
rules should be created in the policy pretty much like you do it on the
router, including rules that permit reply packets.

Policy rules can have the following new actions: Queue:  This action
passes the packet to user space process for inspection, it is translated
into QUEUE for iptables and divert for ipfw.
Parts of the "Objects" table were clipped. Improvements in compiler for
ipfw using rule sets to atomically swap old and new rules. Incorrect
address or netmask cause compiler to abort processing.

h now specifies relative path to the resource files starting from the
application root dir.
This bug report in fact  reported several problems. If the name resolves
to several IP addresses, all addresses are used in the generated
firewall configuration. Protocols can not be inserted with Custom
Service though.

Rules that had chain INPUT in the imported script will have firewall
object in "destination" in the corresponding fwbuilder rules. "log",
"log-input", "fragments", "established" keywords are supported and
translated into rule or object options as appropriate.
Since router ACLs have no state, all rules should be created in the
policy pretty much like you do it on the router, including rules that
permit reply packets.

This provides simple visual clue of what library the object shown in the
editor panel belongs to.
Some code changes were made to make the code comiple and work on
Solaris.

Compiler for iptables generates shell code to read the contents of the
file when firewall configuration is activated. Compiler aborts
processing if the file can not be found or can not be read.