  Slackfire 0.65.e

  * Iptables-1.4.3.2, which ships with Slackware-13.0 (as well as a number
    of prior versions of iptables) uses slightly another syntax to denote
    "protocol NOT" than prior versions. Namely, "! -p" instead of "-p !"
    used earlier.  This change is reflected in the current update of SF.

+--------------------------+

  Slackfire 0.65.d

  * This is a rewrite of version 0.45.d adapted for 2.6 kernels, which
    classify some packets that were previously NEW-not-SYN as INVALID.
    This is the only reason for `6' instead of `4' in the version number.

    "New" packets are classified as NEW if they have only the following
    bits set:
            SYN
            URG,SYN
            PSH,SYN
            URG,PSH,SYN

    NEW-not-SYN are packets with the following bits set:
            ACK                       (ACK-scan of Nmap, see "-sA")
            URG,ACK
            ACK,PSH
            URG,ACK,PSH

    Packets with any other combinations of bits set as well as no bits set
    (NULL scan) are considered as INVALID.

  Other changes:

  * The script is splitted into pieces which are located in /usr/share/slackfire

  * Removed support for "noisy_hosts". There remain "ignore_new.[in|out]"
    and "ignore_noise.[in|out]".  In these files, one can use protocols other
    than TCP providing they involve port numbers.  In other words, one cannot
    use these files to drop ICMP noise.  This can be fixed if needed.
    There are ignore_noise.[in|out] instead of ignore_nns.[in|out]
    since they apply not only for NEW-not-SYN but also to INVALID packets
    (both TCP and UDP).

  * STATE="-m conntrack --ctstate" instead of STATE="-m state --state"

  * A check for "unclean" packets removed.

  * A check for fragmented ICMP packets removed.  I don't see this check
    working.

  * More accurate creation of temporary files implemented.

+--------------------------+

Sun Jan 13 11:24:52 2008

  Slackfire 0.45.d

  * A chain that checks for different TCP scans is extended.

  * Silent filtering of NEW-not-SYN TCP packets and `proper'
    new TCP and UDP packets is now configured via ignore_nns.{in,out} 
    and ignore_new.{in,out} files respectively. Files noisy_hosts
    and ignored_ports are still read if present but are not provided
    with the script any more.

+--------------------------+

Fri Mar 10 11:00:51 2006

  Slackfire 0.44.3b

  * A minor change in the test that a service port is in the HARDEN_SERVICES
    list.
+--------------------------+

Wed Mar  8 11:08:43 MSK 2006

  Slackfire 0.44.3a

  * A "recent" match is introduced via HARDEN_SERVICES.  Must be checked and
    documented!
+--------------------------+

Wed Mar  8 09:45:43 MSK 2006

  SlackFire 0.44.2

  * Temporary files are now created using mktemp (located in /usr/bin).
    Setting umask is no longer needed and thus omitted.
+--------------------------+

Mon Feb 20 11:24:41 MSK 2006

  SlackFire 0.44.1

  * A minor change in bash syntax:

    cat $FILE | egrep -v '^(#|$)' > $FILE.tmp

    instead of

    cat $FILE | grep -v '^#' | egrep [0-9] > $FILE.tmp

    Obviously, this is not exactly the same but I like this more.
+--------------------------+

Tue Jan 31 10:39:07 MSK 2006

  SlackFire 0.44

  * The deny_connects function is called when building the main chains,
    not beforehand.

  * A style of the code changed.  Explicit PATH to iptables and a number
    of general programs (such as grep) introduced, $IPT replaced by 
    "iptables", a couple of functions that shorten constructions like
    echo -e "\t\tBlah-blah" introduced.

  * Minor cosmetic changes in Sect. 7 "Tuning of a number of ipv4-sysctl
    settings."
+--------------------------+

Wed Jan 18 16:11:45 MSK 2006

  SlackFire 0.44.b5

  * Removed a check for broken connections, added LOG_NEW_NOT_SYN_{IN,OUT}.
    Broken connections are "captured" in the rules that use the two
    settings.  NEW not SYN are no longer possible in the OUTPUT chain.

  * Introduced noisy_hosts.

  * A minor cleanup of the code (-j $LOG, -j $LOG_SCAN, $FORWARD,
    $INPUT, $OUTPUT).

  * Removed a check for DRDOS, replaced it with a check for SYN,ACK
    in a new TCP packet coming from a privileged port.
+--------------------------+

Fri Jan 13 11:46:35 MSK 2006

  SlackFire 0.44.b4

  This version can work with configuration files of previous versions
  but I strongly recommend to check new slackfire.conf since there are
  many changes there.

  * Added support for iprange.  Now, IP addresses may be given as
    "10.11.0.0-10.12.255.255". A 2.6 or a patched 2.4 kernel is needed
    for this to work.

  * Introduced denied_services -- an attempt to provide granular rules
    for denying access to public services.

  * IANA_RESERVED are excluded from the script.  The list is moved to
    blocked_hosts.  Consequently, LOG_RESERVED is excluded from
    slackfire.conf

  * Added support for a CUPS server. By default, such a server
    sends ads via port 631, udp.  Now, the script works on both
    a CUPS server and a CUPS client located in one LAN.  This
    doesn't work for the default policy though because a client
    doesn't expect to receive legal NEW packets.

  * Renamed the connection_attempt chain to "new_connection_attempt"
    because it only works for NEW packets. :-)

    Provided more detailed logging in new_connection_attempt,
    added "Fired possible traceroute".

  * Now, NAT=1 assumes ROUTER=1.  Thus the latter setting may be
    deleted from slackfire.conf if desired.

  * Added a setting LOG_INVALID=1

  * Added a setting LOG_PINGS=1. Changed "Fired PING request" to
    "Fired ECHO request."

  * Added a setting CHECK_UNCLEAN=1.  Regardless of
    its value, a check for unclean packets in the OUTPUT chain
    is omitted because I have never seen it matching.

  * Added a setting CHECK_MARTIANS=1. The setting affects all interfaces.

  * Introduced LOG_TROJANS_IN and LOG_TROJANS_OUT in slackfire conf.

  * Introduced LOG_TO_BLOCKED and LOG_FROM_BLOCKED instead of just LOG_BLOCKED.

  * Added an option to disable SYN-flood protection
    (DISABLE_SYNFLOOD_PROTECTION=1).

  * Added an option to log new but not properly formed TCP
    packets that are likely to be a part of a broken (lost) connection
    (LOG_BROKEN=1).

  * Added a rule to log and drop new TCP packets forwarded from
    the LAN but not properly formed.  Such packets were blocked
    anyway but log messages were sometimes confusing.

  * Fixed setting of /proc/sys/net/ipv4/igmp_max_memberships.
    It wasn't restored to the default value (20) in case settings
    switched from ROUTER=0 to ROUTER=1.  The same for
    /proc/sys/net/ipv4/conf/*/send_redirects

  * echo 256 > /proc/sys/net/ipv4/tcp_max_syn_backlog
    instead of
    echo 64 > /proc/sys/net/ipv4/tcp_max_syn_backlog

    in case HARDEN_SYSCTL_SETTINGS=1, see comments in the script.

  * CHECK_CLIENT_PORTS variable changed for IGNORE_CLIENT_PORTS
    with a kind of consistency with other checks (that are mostly
    performed as '= "1"').

  * PRESERVE_TCP_SETTINGS setting changed for HARDEN_SYSCTL_SETTINGS,
    again, for the aim of consistency.

  * Added a check whether a NEW TCP or UDP connection attempt
    originates from a privileged port, see the connection_attempt chain.
    The check doesn't performed if FIRST_CLIENT_PORT=1 in slackfire.conf.

  * Excluded the first two rules in the FORWARD chain.  They checked
    whether an incoming packet is addressed to the LAN and whether
    this is a broadcast packet.  They never matched any packet
    (until our neighbours misconfigured their Windoops router :-)).

  * It is no longer assumed that an interior interface has an IP
    address at the moment SlackFire is started.  This allows one
    to define, say, INT_IF="ppp+".

    INT_BCAST variable is excluded from the script since it is not
    used any more.

  * SYN,ACK from SPT=80 is checked before (former) check for DRDOS.
    A special rule for SYN,ACK packets originating from port 22 is added.
    Also, I don't think DRDOS makes sense for a home or small-office
    machine thus the log message is put another way (Fired a special SPT).
    The order of ports checked in this chain is rearranged.

  * ip_conntrack_ftp and possibly ip_conntrack_irc are unloaded when
    the firewall is `stopped' on a stand-alone machine.  I am not sure
    this is useful.  Perhaps, I will drop them after a while.

  * Excluded a couple of rules meant to provide anti-spoofing
    protection (3.2, 4.2, 6.2 in SF 0.43).  I have never seen
    them matching a packet.

+--------------------------+
Wed Apr  6 16:35:18 2005

  SlackFire 0.44.a1

  * An option FIRST_CLIENT_PORT is added to slackfire.conf.
    This cause a number of changes in the tcpudp_{client,server} functions.
    Also, FTP_PORTS variable is introduced in tcpudp_server.

  * The project is now hosted at http://slackfire.berlios.de/   
+--------------------------+
Wed Mar 23 14:19:01 2005

  SlackFire 0.43

  * Just a cleanup of the script.  Implementation of other ideas is postponed
    until v. 0.44.a1. :-)
+--------------------------+
Sun Mar 20 12:08:48 2005

  Slackfire 0.43.pre_final

  * FORWARD chain is filled before INPUT and OUTPUT chains, the server part
    of the latter two chains is built before the client one.  This allows us
    to eliminate unneeded communication with DNS servers while making rules.

  * A couple of rules to check that source/destination ports of TCP and UDP
    packets do not equal zero are added to invalid_packet chain.

  * A check for a new TCP packet with only ACK,FIN bits set added.

  * Minor cosmetic changes.
+--------------------------+
Wed Mar 16 12:01:08 2005

  Slackfire 0.43.rc4

  * Fixed my error in the list of networks reserved by IANA:
    124/8, 125/8, 126/8 not belong to APNIC.
+--------------------------+
Sat Mar 12 10:40:36 MSK 2005

  Slackfire 0.43.rc3

  * SYN,ACK is checked for ALL flags in TCP packet headers, instead of
    just SYN,ACK SYN,ACK (which can mistakenly trigger instead of XMAS-PUSH).
    Checks for only SYN,RST or SYN,FIN being set (scans) are performed
    _after_ checks for nmap scans by the same reason.

  * A check for `unclean' packets is now performed _before_ checking
    new (incoming) TCP packets.

  * Checks for existing deny_* chains are performed as iptables -nL
    instead of -L. This prevents unnecessary communication with DNS
    servers when the check is performed in FORWARD chain.
+--------------------------+
Fri Mar 11 11:25:55 MSK 2005

  Slackfire 0.43.rc2

  * A rule that checks for possible DRDOS abuse now only checks TCP
    packets with SYN and ACK bits set.  Port 80 removed from the list
    of `suspected' ports because it is present in the next rule which
    selects scans originating from this port.
+--------------------------+
Wed Mar  9 16:34:13 MSK 2005

  Slackfire 0.43.rc1

  * SCAN_CHECK variable is introduced, see slackfire.conf.

  * The list of reserved nets is further optimized.

  * Messages (and the corresponding checks) "Fired NEW tcp/udp connect"
    are excluded.  Onle "Fired NEW connect" is left instead.
+--------------------------+
Tue Mar  8 16:15:07 2005

  Slackfire 0.43.a6

  * MANGLE_TOS variable is removed from slackfire.conf.  Another file,
    mangle_tos is introduced instead.  IMO, this provides greater flexibility
    since TOS values are no more `hard-coded' inside the script but can
    be defined `manually'.
+--------------------------+
Mon Mar  7 17:43:46 2005

  Slackfire 0.43.a5

  * denied_hosts are now read separately, before any client connections
    are enabled.  This allows us to avoid unnecessary communication with
    DNS servers.  Similar to blocked_hosts, the "denied" chains are used
    before meaningful checking of incoming packets thus packets from
    denied hosts will not appear in the corresponding log records (as "scan",
    "DRDOS", etc., see the README file for details).  Still, connection
    attempts from denied hosts can be logged by setting LOG_DENIED=1 in
    slackfire.conf.

  * A check for DRDOS attack is included in check_new_tcp_packets.

  * Replaced a number of "scan" messages by "new", e.g., "Fired ACK,RST scan"
    is now replaced by "Fired new ACK,RST" because the "scan" message may be
    misleading.  A couple of checks (--sport 80) are added.

  * Checks of outgoing (forwarded) packets are excluded.  These checks give
    a lot of noise from web browsers.

  * The multiport extension can now be used in the list of Trojan ports.
    Thus the list is rearranged (trojan_ports).  This saves a number
    of rules.

  * PRESERVE_TCP_SETTINGS variable is introduced in slackfire.conf.
    tcp_reordering preserves its default value.

  * A minor change in sf4sf: an `identification' of possible traceroute
    excuded because it gives false results for port numbers that consist
    of less than 5 digits.

  * GNU GPL included due to the rules of the maintainers of linuxpackages.net.
    :-)
+--------------------------+
Fri Mar  4 11:18:27 2005

  Slackfire 0.43.a4

  * TCP/SYN parameters are only changed for stand-alone machines.

  * A bug in setting tcp_timestamps fixed.
+--------------------------+
Thu Mar  3 10:09:52 2005

  Slackfire 0.43.a3

  * A check for a packet being INVALID now comes before a check of TCP
    packets.

  * A check of TCP packets is split in two chains: one checks for a possible
    scanning (and checks only new packets), another one checks flags.

  * Two checks for possible scanning added. (Yes, I observe them every day.)

  * A check for SYN,URG bits being set simultaneously omitted.

  * For forwarded packets, mangling of TOS is reverted back to POSTROUTING
    instead of FORWARD chain (just to see which way is better).

  * Separate messages for TCP and UDP new connection attempts added.

  * Private nets are added to the blocked_hosts file.
    Due to this, bad_guys* chains are renamed to block_hosts*. :-)

  * Presentation of the list of networks reserved by the IANA optimized.
    Outgoing connections to reserved networks are blocked with a "net-prohibited"
    ICMP message.

  * Connections to blocked hosts are blocked with a "host-prohibited" ICMP
    message instead of "host-unreachable".  IMO, this is more honest. :-)
+--------------------------+
Sun Feb 27 14:51:45 2005

  Slackfire 0.43.a2 (and 0.42.2).

  * A list of IPv4 addresses reserved by IANA updated.

  * A bug in a chain dealing with forwarding replies to inbound
    ICMP packets fixed.  Sorry.
+--------------------------+

Wed Feb 23 21:24:05 2005

  Slackfire 0.43.a1.

  * The main change is an addition of TRUSTED_IF variable.
    It is useful in case one has a gateway/router with a trusted
    LAN behind.  This is probably an ordinary situation for home
    networks.  With this variable being set, all traffic between the
    router and its interior LAN flows freely.  This setting
    doesn't affect forwarded traffic.

    Currently, this is implemented in a pretty awkward way.  Still,
    I hope this is a step towards usability of Slackfire without
    loss of security.  Much more remains to be done. :-)

    Thanks again to Todd Aiken for posing the problem!

  * For forwarded packets, mangling of TOS is made in FORWARD chain
    instead of PREROUTING.  More than this, one more setting is
    introduced, namely, MANGLE_TOS.  The reason is that I sometimes
    observe some forwarded (and mangled) packets being mistakenly blocked.
    I am not sure that this is the "fault" of TOS mangling but let this
    setting be until I figure out what is going on.

  * A check that /proc/sys/net/ipv4/igmp_max_memberships exists is
    added.  Otherwise, an error message appears if Slackfire is started
    on a stand-alone machine running Slackware 9.0.

  * A couple of cosmetic changes made.

  * Upon upgrade, you may safely delete all files with suffix "new"
    in /etc/slackfire but slackfire.conf.new.  This one should be
    renamed to slackfire.conf and filled following the instructions
    given therein.
+--------------------------+

Wed Feb 23 09:28:37 2005

  Slackfire 0.42.1.

  * A typo fixed (line 1180).  It only affected logging, not security.
    Upon upgrade, you may safely delete all files with suffix "new"
    in /etc/slackfire.
+--------------------------+

Sun Feb 13 16:46:45 2005

  Slackfire 0.42.

  * The web page repainted to look more like fire. :-)

  * The script is rearranged: INPUT and OUTPUT chains are now built 
    in parallel.  This doesn't affect the way script works but IMO
    makes its structure more clear.

  * Rules for ICMP packets are rewritten.  Now the roles of icmp.in and
    icmp.out are similar to those of tcpudp.in and tcpudp.out, i.e., they
    are used to list new connections only.  RELATED ICMP packets of types
    3, 11, and 12 are allowed to come in, and RELATED packets of types
    3 and 11 are allowed to go out.

  * Rules for NTP added.  Thanks to Todd Aiken (Bishop's University)
    for letting me know about the bug, and for the very stimulating
    and helpful correspondence which followed.

  * Rules for DHCP added.

  * Network devices not mentioned in slackfire.conf as EXT_IF and INT_IF
    are _not_ affected by iptables rules for packets addressed directly to
    the box running SlackFire.

  * Certain configuration parameters changed.  In particular, there is
    no PINGABLE any more.  Allow incoming pings in icmp.in instead.

  * Rules to check a possible DRDOS attack slightly changed.
    Namely, port 20 is excluded from the list of checked source ports
    since it gives false positives with some (misconfigured?) ftp servers.

  * A couple of bugs in dealing with ftp connections is fixed.

  * reject.in is removed from the "fwd" directory.

  * DROP is replaced by REJECT in rules that block outgoing packets to
    "bad guys" and Trojan ports.  This, in particular, makes connections
    to web pages with `banned' ads much more fast.

  * Support for the multiport extension added.  Now one can list ports this
    way:

    21,22,25,80,110   tcp   0/0

    instead of putting each of them on a separate line.

  * DNAT extended.  Now a redirection of ports is possible.

  * Mangling of packets extended.

  * A couple of logging parameters tuned.

  * A bug of mine in sf4sf fixed.
+--------------------------+
