News
netspoc-3.2, January 02, 2011
New features:
- Support for Cisco ASA devices as packet filter, as VPN gateway
and for LAN-to-LAN IPSec tunnels.
- Support "easy VPN" at Cisco VPN clients.
- Generated chains for Linux iptables are highly optimized
now. Deeply nested chains are generated to minimize the number of
tests for each checked packet.
- Support port address translation (PAT) to an interface for PIX
and ASA.
Language:
- Changed syntax for defining crypto tunnels to support multiple
VPN gateways.
- Renamed attribute "nat = .." at interface to "bind_nat = ..".
This allows better distinction between binding and definition of NAT.
- Allow multiple NAT tags at attribute bind_nat of an interface.
This simplifies definition of NAT for devices with multiple interfaces.
- Extended concept of secondary packet filter to "primary" packet
filter. All rules which pass a primary filter are implemented
as secondary filters on other devices
- Enhanced policy definitions to support template rule-sets which
operate individually on each element of "users". This uses new
keyword 'foreach' and nested expressions with 'user'. This concept
replaces 'any:[local]' from previous versions.
- Added automatic group "network:[any:xx]", the group of all
networks inside a security domain.
- Removed "interface:xx.[back]". This was not widely used and
can easily be expressed with complement: "interface:xx.[all] & !
interface:xx.[auto]".
- Renamed "interface:xx.[front]" back to the old syntax
"interface:xx.[auto]" which was still valid syntax in previous
versions.
- Added attribute "crosslink" for networks. A crosslink network
combines two or more routers to a cluster of routers. Filtering
occurs only at the outside interfaces of the cluster. The
crosslink interfaces permit any traffic because traffic has
already been filtered by some other device of the cluster.
- Added attribute "no_in_acl" for interfaces. With this
attribute, no incoming ACL is generated for an interface.
Outgoing ACLs are added to all other interfaces of the same device
instead.
- Networks with isolated and promiscuous ports (RFC 5517) are
supported now. Added attribute "isolated_ports" at
networks and attribute "promiscuous_port" at interfaces. If a
network has attribute "isolated_ports", hosts inside this network
are not allowed to talk directly to each other. Instead the
traffic must go through an interface which is marked as
"promiscuous_port".
- Hosts no longer support multiple IP addresses, but only single
IP addresses or ranges.
- Attribute "owner" no longer holds simple strings, but references
to one or more 'admin', which has name and email address.
Other:
- Added the concept of 'private' configuration contexts. This
allows to partition the configuration files in a multi user
environment such that one user can't define rules for network
objects which belong to another user.
- Added consistency check: All interfaces and hosts of a network
must be located in that part of the network which doesn't
overlap with some subnet.
- Pathrestriction at a border interface of a loop is supported
now. Valid paths inside a loop can now be defined
individually depending on the interface where the loop is
entered.
- Unmanaged device is allowed to have pathrestriction now.
- Processing for large topology with clusters of loops has been
optimized. A cluster of loops is a set of loops which are connected by a
single node (network or router).
- Checks for unenforceable, duplicate and redundant rules have been
added.
- A check for duplicate elements in groups has been added.
- iptables-restore is used now to load rules for iptables.
- Default values for command line options of netspoc can be
defined in a file named 'config' in toplevel directory of netspoc
configuration.
- Added command line tool "print-group" which reads a netspoc
configuration and prints the contents of a group.
Bug fixes:
- The result of interface.xx.[back] was always empty if interface was
located inside a loop.
- There was a bug when printing the result of check for missing
transient any rules. The result was only printed if some rule was
missing more than once.
- Fixed bug in check for missing transient any rules when
comparing stateless rules.
netspoc-3.1, January 2, 2008
New features:
- Support for negotiated interfaces which dynamically get an
IP address out of an attached network has been added.
- Support for loopback interfaces which are not attached to any
network has been added.
- Support for Cisco VPN 3000 devices has been added, but currently
isn't well documented.
Language:
- Flags for services have been introduced. These flags modify the
way in which rules are applied to stateless devices or to devices in
general. As an example, it is now possible to define a rule for FTP
traffic which permits the data channel only at stateless devices, but
not at stateful devices.
- New "automatic" groups have been introduced which allow to define
new groups from other groups or from the topology. Examples: The group of
networks which contain an already defined group of hosts. The group of
interfaces of a network. The group of security domains of an area.
- Automatic groups of interfaces can be restricted to interfaces of
managed devices.
- Set operations "complement" and "intersection" are available to
define new groups.
- The concept of "auto" interfaces has been extended.
interface:router.[back] denotes the interface(s) which are on the
opposite side in respect to the other object in a rule.
interface:router.[auto], which denotes the interface(s) on the same
side, has been renamed to interface:router.[front]. But [auto] is
still supported for compatibility.
- A simple means has been introduced to define an area which
contains the whole topology.
- New syntax has been defined to individually select a secondary IP
address of an interface in a rule.
- network:[local] denotes the network connected to an interface.
- A feature from version 3.0 to individually define an interface as
full or secondary filter has been removed. This feature wasn't used
anywhere, but prevented a run-time optimization.
- The following language elements are no longer supported, because they can
better be expressed by newly introduced automatic groups: "every:x",
"any:[all]", "interface:[managed].x", "interface:[all].x"
Other:
- Pathrestrictions are added automatically for each set of
virtual interfaces now.
- Enhanced command generation for Cisco PIX devices with dynamic
NAT. If multiple networks are mapped to a single dynamic pool, now a
single "global" command is generated, which is referenced by multiple
"nat" commands.
- Added a check for "transient any rules".
If we have a security
domain any_A and two rules "permit XX → any_A" and "permit any_A
→ YY" then this implies a rule "permit XX → YY" which may
not have been wanted. Netspoc now looks for this situation and
aborts if the implied rule is not explicitly defined.
- Added a check to enforce that different hosts inside a network
don't have the same IP address.
- Multiple optimizations were done which improve the run-time
performance for configurations with large rule sets and topologies.
- New command line option "-time_stamps" shows run-time in seconds
for different compilation steps.
Bug fixes:
- Correctly handle the case were two different loops touch each
other directly. This occurs if one loop starts at a network A and
the other one at a router B and A and B are directly connected.
- Added missing "static" entries at pix devices for networks which
have a dynamic NAT at some other device.
- Fixed a bug where Netspoc aborted if an area was defined by
attribute "anchor".
- Fixed some problems with disabled interfaces.
netspoc-3.0
New features:
- IPSec encryption is supported now. A powerful syntax was added to easily
define a large number of crypto tunnels of either a hub and spoke topology or
a fully meshed topology. Crypto configuration for Cisco IOS routers and PIX
firewalls is generated.
- Improved optimization by automatically joining rules with adjacent port
ranges if possible.
- No restrictions on overlapping port ranges any longer.
- Unenforceable rules with no managed device between source and destination
have been silently ignored in previous versions. Now there is a command line
switch to enable a check for unenforceable rules.
- Netspoc may now read from stdin and write to stdout.
- The new program 'cut-netspoc' is used to cut a large netspoc configuration
into small self-contained parts. cut-netspoc gets the location of a netspoc
configuration and one or more policy names as arguments. It generates a
minimal configuration that contains only the given policies and enough
elements from the topology to get all references intact.
Language:
- New concept of areas was introduced. An area denotes a part of the
topology which is delimited by a set of interfaces. Areas are a convenient
means to access all networks or security domains of some part of the topology.
- Syntax was extended to individually define an interface as full or
secondary filter.
- IP address and mask of networks may alternatively be declared as IP
address and prefix length. For example ip = 1.2.3.0/24.
- New optional attribute 'owner' for network objects of type 'host',
'network', 'any' and 'area'. It takes a comma separated list of strings as
value. This isn't used by netspoc but can be used for documentation purposes.
Bug fixes:
- Made code 64 bit clean. This was necessary when applying complement and
left-shift to 32 bit IP addresses.
- Improved error handling to prevent unhandled internal errors.
netspoc-2.6
Bug fixes:
- There was a bug in local optimization which was introduced in version
2.2. Some deny rules could inadvertently be marked as redundant, leading to
missing ACLs for these rules in generated code. This bug has been fixed.
- NetSPoC automatically generates reverse rules for stateless packet
filters if protocol is of type TCP, UDP or IP. For TCP, a reverse rule is
generated which matches any packet that doesn't request a new connection. This
was wrong for deny rules, because it would prevent answer packets for any
port, not only for the port of the original rule. Therefore no reverse rules
will be generated for deny rules of protocol TCP.
netspoc-2.5
New features:
- PIX commands like "icmp" and "telnet", which filter traffic for the
device itself, are generated now.
Bug fixes:
- There was a syntax error with IOS routers when applying an access-list to
an interface.
netspoc-2.4
New features:
- Access lists for multicast packets of redundancy protocols are generated
now.
- Tighter check of source address and protocol for multicast packets of
routing protocols.
Language:
- Syntax for virtual interfaces of redundancy protocols has been changed and
extended.
Other:
- Better handling of path traversal for a special case with
interfaces inside a loop as source or destination. (See ChangeLog for details.)
netspoc-2.3
Bug fixes:
- Fixed a bug in internal handling of NAT. This could lead to missing
optimization of sub-nets and possibly to wrong code.
netspoc-2.2
New features:
- Support 'chains' of iptables and 'object-groups' of Cisco PIX. Generates
much shorter and more efficient code for rule sets, where one of source or
destination is unchanged.
- Support masquerading, i.e dynamic NAT of multiple networks to a single
address range.
- Generates NAT code for PIX ('static' and 'global') for both directions:
inside - outside and vice versa.
Language:
- Global NAT definition. This is used to declare masquerading for a large
part of the topology.
- any:[local] denotes the security domain connected to an interface.
- Hyphen may now be used in names.
- New attribute 'no_group_code' for routers. This disables generation of
object-groups and chains.
- Removed attribute 'static_manual' for routers.
Other:
- New local optimization step for each router.
- Improved handling of sub-nets to get better results from optimization.
- Options may be changed from command line. No need for altering the source
code any longer.
- Interfaces referenced in pathrestriction must be managed.
- Code for 'any' rules is now inserted at top of ACLs, following deny
rules. This usually gives better performance, because 'any' rules match many
packets.
- No automatically inserted deny rules any longer. Instead, 'any' rules are
checked for global rule semantics and router semantics to be equivalent.
Bug fixes:
- PIX code: Added missing 'interface' keyword in 'access-group'.
netspoc-2.1
New features:
- Routing protocol EIGRP is supported.
Language:
- Trailing comma is allowed at end of lists now.
netspoc-2.0
New features:
- Virtual IP addresses for supporting VRRP / HSRP are introduced.
- Code for Linux iptables and ip route is generated.
- Network address translation (NAT) is supported.
- Groups of all routers and all managed routers are implicitly defined.
- New syntax for denoting an interface at "the right side" of a router.
- General cyclic graphs are supported. Restriction to simple loops
has gone.
- "Path restrictions" are introduced to restrict the use to some of multiple
paths inside cyclic sub-graphs.
Other:
- Improved optimization.
- Use of short interfaces (without an IP address) is much less
restricted.
- When expanding a router to its interfaces, unnumbered interfaces are
left out now.
- Rules outside of policies aren't supported any longer.
Bug fixes:
- Code for OSPF was incomplete.
- Removed minor bug with 'any' objects and routers with more than 2
interfaces.
netspoc-1.7
Fixed bugs:
- ACLs for secondary packet filter were too permissive
for rules having an interface of a full packet filter as source or destination.
netspoc-1.6
New features:
- Introduced policies: A policy is a named group of related rules, which
all refer to the same network objects in their source or
destination.
- The functionality of NetSPoC is available as a Perl module now.
netspoc-1.5
New features:
- Topology allows simple loops now which must be neither nested nor
adjacent.
- Secondary packet filters are introduced, which have much shorter
access lists for traffic which is already filtered by a full packet
filter.
- New option $auto_default_route to optimize the number of routing
entries per router.
- Attribute 'routing=OSPF' for interfaces: disables generation of
static routes and generates access lists which automatically permit
OSPF packets.
- NetSPoC warns if different interfaces have an identical IP address.
Fixed bugs:
- Routing entries were missing for traffic back from destination to source if
there was no other rule which allowed traffic from destination to source.
- It was possible to link an 'any' object to an undefined router object.
- Script 'newpolicy' now uses 'update -d'.
Other:
- Option $strict_subnets now may have values 0, 'warn' or 1.
netspoc-1.4
Fixed bugs:
- Some valid configuration was rejected for certain combinations of
services with port ranges.
- Some traffic was rejected even if the traffic was explicitly
allowed by another rule. See examples/auto-any-deny for an example.
netspoc-1.3
Language:
- Source port may be specified for TCP and UDP services
Other:
- Changed code generation for stateless IOS routers:
Answer packets for TCP and UDP connections are no longer restricted to
ports > 1023 for two reasons:
- This didn't work for services like IKE with source port < 1024.
- It was too difficult to handle correctly during optimization.
netspoc-1.2
New features:
- Preliminary support for stateless Cisco IOS routers
(without Firewall Feature Set)
This is untested until now.
- Interfaces of managed IOS routers are automatically protected from
unwanted access. Permitting access to a network which is directly
attached to the interface of an managed router, no longer implicitly
gives access to the interface. If desired, access to an interface has
to be stated explicitly by a rule. (This feature isn't implemented for
PIX firewalls, because they protect themselves.)
Language:
- Switched names for Cisco IOS routers:
- 'IOS' is used now for stateless IOS routers,
- 'IOS_FW' is used for stateful IOS routers.
Fixed bugs:
- Routing to unnumbered networks now works
- Hosts aren't allowed any longer in unnumbered networks
- Unnumbered networks must be connected to at most two interfaces
- Script 'newpolicy': home directory; quotes in messages
Other:
- added some small examples
netspoc-1.1
Optimization:
- Hosts with successive IP addresses are converted to ranges.
- Duplicate ACL entries are no longer generated for rules with an 'any'
object as source or destination
Language:
- Overlapping networks are rejected unless this relation is declared
explicitly using new attributes 'route_hint' or 'subnet_of'.
This may be useful for a large topology, where a network may easily be
redefined by mistake.
Use option 'strict_subnets' to (de)active this new behavior.
Other:
- Warning messages are shown for unused groups and servicegroups.
This may be switched off using option 'warn_unused_groups'.
- NetSPoC doesn't accept rules with an 'any' object both as source and
destination any longer.
Fixed bugs:
- pix security levels: all interfaces except inside and outside got
level 1.
- For rules with an 'any' object as destination, too few deny rules for
intermediate networks were generated in some cases.
- Routing entries were generated for disabled networks in some cases.
netspoc-1.0
Initial public release.