
 IPchains Firewalling Webmin Module - CHANGES
 Copyright (C) 1999-2000 by Tim Niemueller <tim@niemueller.de>
 http://www.niemueller.de/webmin/modules/ipchains/

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.

 Created  : 20.09.1999



 This file describes the changes made to the IPchains Firewalling Webmin Module.
 (Version history).


 Changes
 ==============================================================================
 30.10.1999  - Added support for SYN-Bit and Fragment
 (0.74.1)    - Added support for ICMP-type, get types from "ipchains -h icmp"
             - Protocol field is now a list, content is generated
               by parsing /etc/protocols
             - Type Of Service (TOS) is now supported
             - Module can now handle a list of often used hosts and you
               now can select hosts comfortable via a file-chooser-like window
             - Port can now be defined as service from /etc/services,
               comfortable access via popup window
             - Script manager now accessible through index
 15.11.1999  - You may not INPUT and APPEND a rule instead of only appending
 (0.74.2)    - Fixed bug in save_policy.cgi, it now uses $ipchains_path to
               save the new rule instead of using $config{'ipchains_path'}
             - You do not need to deliver Source and Destination Address any
               more for ICMP Protocol (as it is often not use in conjunction
               with --icmp-type
             - You may now choose MASQ as Target in any user defined chain,
               the script controls if there's any non-forward chain that points
               to the appropriate chain (on adding a MASQ-Target to the chain
               and if the user tries to add a jump target to the appropriate
               chain from any other chain)
             - Fixed some minor errors in rm_jump() and find_chain_struct()
             - Did several changes to get all functions supporting -I Insertion
             - Added entry for Caldera OpenLinux in module.info
             - Now uses foreign_calls to net-module for getting a list of
               active interfaces (easier and more comfortable way)
 16.11.1999  - Wrote a short help to edit_chains.cgi
 (0.74.2)    - I have no school today ;)
 10.03.2000  - Added the promised Script Manager features, it can now make
 (0.78.1)      the a bootup script, create and delete it and remove boot entry
             - It is now possible to clone existing rules. So it is easier to
               write new rules
             - Logging flag (-l) is now supported
             - Changed the "Edit Chain" page. New rule creation is now on
               another page. Changed the layout of the creation mask.
             - Fixed $ipchains bug
             - Fixed change_policy bug, now rewrites these rules correctly
             - Added ACL features
 13.03.2000  - Fixed bug in change_policy.cgi
 (0.78.2)    - Fixed bug in ipchains-lib.pl (missing $cl in error message for
               missing script file)
 14.03.2000  - Fix of some bugs
 (0.78.3)
 
 20.03.2000  - Fix of some bugs more (often said chain instead of chains in
 (0.78.4)      ACL checks
             - Fixed bug when saving a rule with only dest or source, not both.
               Before the save_rule set the -s AND -d option, although if one
               was empty...
 22.03.2000  - Fixed a bug in save_host.cgi, again a problem with the ACL code,
 (0.78.5)      I shouldn't do such things after a gaming session...

 08.06.2000  - Fixed bug with ICMP Type option, must be --icmp-type, not
 (0.80.1)      --icmptype as I wrote. An older special patched version used
               this style, but it seems that all distros are nowadays using
               the new format
 30.06.2000  - Added "Execute Script" in Script Manager
 (0.80.2)
 03.07.2000  - Added move_rule.cgi, you can now move rules up and down in the
               file.
             - Changed the way Append and Insert are handled in save_rule.
               Therefore I removed the support for the -I insert flag. It
               generally appends new rules. But with insert the module now
               places the line for this rule at the beginning of this chain.
               So it is easier to maintain the rules. The -I flag is just a
               solution if you forgot a rule on manual setup, but when editing
               a file it makes is just more complex and it is not really needed
               Because you can now move rules up and down this is the best
               thing I can to I think.
 11.07.2000  - Added chinese translation patch. Thanks to Leo Liang (from
               Turbo Linux China) for this patch.
             - Configuration now only available on index as in standard mods
             - Smaller CleanUps.
 12.07.2000  - Added import.cgi to import current system settings. Getting
               info directly from /proc. Indication works fine, now I have to
               implement the correct rule creation (in the script). But now I
               have first to sleep a little bit (it's 3:00 am ;).
             - It's done. Now you can import current system settings into a
               script. Works fine with all supported arguments (including
               their negation of course). Some hours of sleep are wonderful ;)
             - Removed bug in find_param_2, it added ! as a value if it was
               the negation of a following line argument
               (example: -s 192.168.1.1/32 ! -y).
 14.07.2000  - Removed critical bug in import.cgi. I forgot a =, so that I
               didn't compare but set the proto value. So the protocol was
               always ICMP. Big fault. Thanks to Manuel Carrasco from
               Lucent Technologies for reporting this.
 30.08.2000  - Some new major changes in the firewall module. I added now two
 (0.80.4)      new editing modes: Template and Newbie mode.
               The template mode offers a matrix of possible options and then
               creates the rules automatically from your choices. In order to
               be as versatile as possible I tried to keep IPs out of it. It
               is defined on a per-interface basis. So that you have two
               interfaces. One outside and one inside interface.
               The newbie mode is for the ones who come from the Windoze
               Coloured-Clicki world. They just decide between three
               security levels an trust me that I made good choices...
               So this will make it much more easier. Any templates are
               welcome, as well as additions and changes that should be made.
             - It's still the 30th, but a little bit later :) I had a new
               idea. Two more modes: Maybe someone wants to disable the fire-
               wall (yes, there ARE stupid people in the world!) or maybe
               to batten down the hatches on the system (yes, there are also
               VERY paranoic ones ;). So I just added them. The templates for
               these modes were easy to write ;) Now I have to build all the
               protocol templates...
 03.09.2000  - I decided to make this the next version since I have done many
 (0.80.5)      changes to this "double"-version...
             - I have added a feature to the newbie mode, you can now customize
               your firewall settings
             - Added support for masquerading,first templates filled
             - added new tokens for the templates, INTIP, INTNM, EXTIP and
               EXTNM. I think you understand what they mean :)
             - Ran the first test, and it worked, could no longer reach Webmin
               Forgot to allow it with the firewall rules... So, it is safe :)
 09.09.2000  - What I write for this day applies to the last week :)
             - I worked now the whole weeks on the templates for 19 protocols.
               I still have to add traceroute, NNTP and Napster ;) I decided
               to include Quake to have something to play with :) I could not
               test the rules yet, maybe someone can help me on that.
             - I changed template_save.cgi. It now checks for double lines in
               the script (which can happen for example if you have
               masqueraded HTTP from inside to outside and HTTP from Firewall
               to outside). It now places a message containing the line number
               where the rule already appeared.
             - Added new tokens INTBC, EXTBC, WEBMINPORT
             - Changed the way Masquerading is handled. You can now define
               with preceeding ##MASQ: or ##NOMASQ: to define if the rule
               should only be enabled if Masquerading is enabled (MASQ) or
               not (NOMASQ). Otherwise they will just be comments in the
               scriptfile due to the double pound (##)
             - Rewrote change_level.cgi to reflect the changes done to the
               template_save.cgi file. It now also removes double lines and
               gives line references as comment. It also does not handle the
               masquerading stuff differently.
 10.09.2000  - Added icons to the expert mode for the different actions
               Thanks for that to George Vieira <georgev@cybertech.net.au>
               who contributed the idea and the icons.
             - Ugh, maybe someone has a dynamic IP on the outside interface
               (in fact I have on myself). This was not yet supported by the
               module. It always set the address to the outside IP the
               interface had when creating the module...
               No there is a hack which allows the external interface to be
               DHCP, I really like awk ;)
 15.09.2000  - Added the option to edit the raw file to expert mode (experts
               like to do that ;)
             - Refined the parse_line functions, so that now comments and
               foreign commands are seen and not longer false syntax errors
             - Changed expert mode startpage a little bit, removed all the
               tables at the bottom and just added links to the appropriate
               functions (which they have been in most cases anyway).
             - Added insert_line function. Changed create_chain.cgi and
               save_policy.cgi so that -P and -N rules now are inserted in
               begin of the script. Otherwise errors could happen for example
               if you used a chain as a jump target before it was defined...
             - Finally added the option "Execute script" to expert modes
               start page ;)
 17.09.2000  - Added "Insert rule after current" to edit_chain.cgi. This means
               that insert now depends on the context. So you can insert rules
               more precisely.
             - Changed clone_rule.cgi, the cloned rule is now inserted right
               after the original rule. This makes more sense
             - Some smaller re-arrangements to met the new requirements
 09.10.2000  - It took a long time but I had to start a job and my civil
               service and I am back home in Germany...
             - Fixed a bug in lib, it was confused when searching for the
               internal or external interface when one of these interfaces
               had aliases (like eth0 and eth0:1)
             - Fixed bug in SSH-fwin and fwout, multiple -p flags
             - Fixed bug in FTP.Active-inout, insmod expects -p and not -q, I
               think I was a little bit tired... ;)
             - Fixed Typo in SMTP-fwout
             - Corrected and restructured the spoof protection addresses in
               lib in write_basics(). Used bigger subnets to reduce rule number
               and removed 66, 67 and 217 which are for assigned IPs. Oops.
             - Fixed bug that caused error messages when network configuration
               module not available (and the user already defined the available
               interfaces in the module configuration).
 18.10.2000  - Finnally working on finishing the big fix release 0.81.1.
             - Fixed the bug that the ICMP type was not displayed in Expert
               mode
             - New templates for BigBrother and IDENT (thanks to Chris Dos)
             - Some fixes and polish translation (thanks to Andrzej M.
               Krzysztofowicz)
 22.10.2000  - Applied parts of the patch from Andrzej M.Krzysztofowicz
               This fixes some "Schludrigkeiten" (whoever wants to know what
               that means has either to learn German or to find a good
               vocabulary ;) in the internationalization stuff
             - New templates for NNTP and Proxy
 26.11.2000  - Critical Bug Fix. Some subnets were blocked that should not
               be blocked (for example the one that freshmeat.net is in,
               big Oops ;)
             - Added the template for Traceroute. Traceroute is a really
               Bad Program (TM)
 

 
 To do
 ==============================================================================
 - iptables support (maybe a new module).
 - bastion host support in newbie and template mode
 - add more protocols
 - write help files
   And I thought OK, that's it, more for the iptables module ;)


### END of CHANGES ###.
