Subject: hygienically

From: castrate <[email-masked]>
Date: Thu, 7 Jun 2007 22:29:23 -0300

Shortcomings of this version: importer does not use address and service
objects that existed in the tree before the operation has started, it
creates new ones.

The problem must be corrected manually.

html , rerouting happens after OUTPUT hook but before POSTROUTING
hook.

It is impossible to mix such rules with terminating and non-termninating
behavior. Unrecognized targets and converted to branching rules, where
the name of the target becomes the name of the branch.

Deduplication only works for objects created in the process of import.
Instead, this release adds two major new features: support for Cisco IOS
access lists and a framework to import existing firewall or router
configuration.

This means emulation can be turned on and off for all rules that might
require it at once. Ability to search for objects using regular
expressions matching their names or attributes has been added.

Finally beta testing is over and the release is out. This allows you to
mark some interfaces to be skipped by the compiler when it picks
interfaces for ACL rules. Interface objects can now have an attribute to
mark them as bridge ports, used for bridging firewalls.

It is impossible to mix such rules with terminating and non-termninating
behavior.

For example, Windows can convert more limited set of service names
compared to Linux or BSD.

We plan to run public beta for a few months and release final version in
October. This is useful when many firewalls in the tree use the same set
of objects.

Compiler aborts processing if the file can not be found or can not be
read. Ability to search for objects using regular expressions matching
their names or attributes has been added. Interface objects can now have
an attribute to mark them as bridge ports, used for bridging firewalls.
If option that activates CONNMARK target is used, compiler also adds a
rule at the very top of the policy to restore the mark.

This will help users with policies with many branches, however it does
not solve the problem because as they keep adding branches, at some
point they won't fit in the window again.

We'll remove this suffix when final version is released.

See Release Notes for the complete list.