Skip to main content

rWeb 8.0-9.7 Release Notes

The release notes of rWeb versions between 8.0.x and 9.7.x are shown here. Older version release notes are available in the older combined format (alongside RIOS) for previous versions back to 5.2, as shown in the sidebar.

rWeb 9.7.3.release.0​

This release fixes a number of bugs that impact usability and reporting.

Bug Fixes

  • Fixed an issue where tcpdumps that didn't capture any packets could prevent new tcpdump jobs from being started.
  • Fixed an issue preventing reports from being scheduled to run on a Sunday.
  • Fixed a migration issue that could potentially leave some tables using the wrong size sequence for their id columns.
  • Fixed an edge case in victim processing that could cause it to crash if devices reported an identical victim in two different zones.
  • Searching for templates will now search by case-insensitive partial match of the template name. Previously it only searched by full leading case-sensitive matches.
  • Fixed an error with confirmation dialogue when clearing the filter list under AT61.

rWeb 9.7.2.release.0​

This release has a fix for problems around template ownership and a few small graphical glitches. It's recommended that you upgrade if you regularly move Zones or Groups between Groups, or have deleted Groups that previously owned widely used templates.

Bug Fixes

  • Fixed an issue with template visibility after a group move and config rollback. Templates are owned by Groups, and a Zone can generally use the templates owned by any of its parent Groups. However, if you move a Zone between Groups (or a Group to a different Group), its possible that your configuration history has reference to a Template you no longer have access to. This prevents you from rolling back or even diffing your changes. The internal API has been changed so that if you try to roll back to or diff a Template no longer owned by one of the parent Groups, it will be allowed as long as you previously had historical access.
  • Fixed an issue where an interaction with the Bitwarden extension's CSS causes a blank background on the login page.
  • Fixed an issue where elements could overlap on the historical alerts page.

rWeb 9.7.1.release.1​

This release has a fix specific to using Certificate Authroities on a clustered rWeb.

Bug Fixes

rWeb 9.7.0.release.1​

This release introduces the ability to turn off unwrapping of tunneled traffic on a device by device basis. This configuration is most relevant to users who are transit providers providing filtering for their customers, and if you fall into this category you should review the associated features.

New Features

  • Starting in RIOS 8.7, filter devices support the ability to turn off unwrapping of tunneled traffic. Some additional controls have been added to AT62 to make it easier to drop tunneled packets or perform some basic validation on them if they are no longer being unwrapped.

Enhancements

  • Victim reports for filter list attack types will now list source IPs that ended up in the filter list instead of searching for packet samples (which aren't sent for filter list attack types).
  • Enhanced performance of background cleanup of old data.
  • Deleting expired blacklist entries is now easier to do via API with the new expiry_time parameter.
  • Improved resiliency and ergonomics of the background jobs API. Previously this was also not explained well, so it is now formally documented under this link.

Bug Fixes

  • Added missing subtype descriptions for AT20.
  • Fixed an edge case where a background statistics poller can hang if a device connection is disrupted at just the right moment.
  • Fixed an issue where hitting Select All Zones while mapping a shared list wouldn't always select all zones if the group selected was particularly large.
  • Fixed a bug where Export matching results would still return all blacklist entries if you exported to CSV.
  • Fixed a bug where the local timezone display wouldn't be set properly if logging in using OIDC.
  • Fixed an issue where trusted CA certificates weren't properly populated after a restore.
  • Blacklist and Whitelist searches now handle partial IP inputs correctly. Previously it was doing exact string matchs which could either fail to match an enclosing subnet entry or be interpreted incorrectly for IPv6 prefixes (not handling omitted leading zeroes).
  • Fixed a bug where bulk list imports were not correctly respecting Group Limits.
  • Fixed a bug where attempting to delete blacklists or whitelists using a filter that matched no entries could put the database into an incorrect state.

rWeb 9.6.0.release​

New Features

Enhancements

  • Overhauled performance of rFlow processing (provides the data for Top List et al.) to reduce disk I/O and database impacts. Also, improved the UI for Top List and other "Top" components to explicitly show the time range of each sampling period.
  • Enabled controls for Force On in AT2 and AT3. Similar to AT1 Force On modes, this is a limited IP configuration that allows faster processing of attacks specific to TCP SYN-ACK and ACK packets. This capability is supported in devices running RIOS >= 8.4.2. Usage is now also separately tracked in Device Zone Management. This changed how the Group Configurations API behaves, as AT2/3 can now be subject to resource limits in the same way as AT1.
  • Improved reporting for transient fan failures in device logging.
  • In order to facilitate OIDC integration, User Admin is now a separate permission.
  • Victim webhook events now directly include the IP address of the victim.
  • Updated schema for filter list data for better efficiency.

Bug Fixes

  • Fixed a bug where user update validation was not correctly reporting errors making it seem like an update operation succeeded when instead it had failed.
  • Suppressed cases where an alert box with no usable message could be shown to users.
  • Changed data cleanup methodology to reduce likelihood it could fall behind.
  • Small language changes for better grammer and clarity.
  • Fixed case where blacklist subscription updates could get interrupted and not pull on time.
  • Fixed a corner case that could occur during subscription license polling.
  • Fixed a typo and same pagination errors observed in RIOS Version administration.
  • Fixed some cases where incorrect end times could be calculated for filter list entries.
  • Fixed cases where editing a prefix would not be correctly tracked.
  • Fixed a problem where staging an online version of rWeb could fail.

rWeb 9.5.2.release​

Bug Fixes

  • Fixed a bug where Map to Global was not correctly mapping a Shared Whitelist as a global entry, but instead creating it against the Default Zone only. This affected whitelists only; blacklists were not affected.
  • Fixed a bug where Blacklist subscriptions was merging entries, rather than replacing the shared list with the set provided by the URL.
  • Fixed an internal authentication error thrown when a Blacklist subscription was updating entries.

rWeb 9.5.1.release​

Bug Fixes

  • Fixed a bug where the "Map to Zone" function for Shared Lists would not render all zones correctly if there were over 100 zones.
  • Fixed an issue where an internal component could unintentionally use too much memory over time.
  • Fixed an issue where an rWeb restore could fail on a larger backup.
  • Fixed an issue where an rWeb upgrade could finish but not be marked as complete, preventing other manual commands like rebooting or further upgrades.
  • Implemented a workaround for a small memory leak associated with database connections.

rWeb 9.5.0.release​

New Features

Bug Fixes

  • Improved performance of the Zone Management page when the selected device has a large number of Zones mapped against it.

rWeb 9.4.2.release​

Bug Fixes

  • Fix for Top Attacker aggregation that could cause the rFlow process to crash and lose current statistics.

rWeb 9.4.1.release​

Bug Fixes

  • Security fix for CVE-2024-3596 (Blast-RADIUS). With this fix in place, rWeb will now always include a Message-Authenticator attribute in requests. Existing RADIUS server configurations should be changed to make Message-Authenticator mandatory if at all possible. Pre-existing configurations will have "Require Message-Authenticator" unchecked, and adding new RADIUS servers will check this option by default.

rWeb 9.4.0.release​

New features

Enhancements

Bug Fixes

  • Fixed a permissions bug where a user could potentially see attack packets samples for a zone they don't have permissions on.
  • Fixed a logging error that could occur while handling an email notification error. The logging error was caught and handled, but was still worth fixing for clarity of log reviews.
  • Fixed a bug where the Dashboard bar chart widgets would not render days of activity if there was too great a disparity between the low and high values within the 30 day window. This was a display rendering problem only: the underlying data was correctly calculated.
  • Fixed a bug where the Disk Usage section could fail to load if rWeb was managing a RIOS device still using a self-installed license.
  • Fixed some validation problems with the Group Configuration API.
  • Fixed an issue where the "Add to all Groups and Zones" prompt when first adding a device would not properly map the device to the Default Group.

rWeb 9.3.1.release​

Bug Fixes

  • Fixed a case where a user could receive an error message about a Group they have no permissions for.

rWeb 9.3.0.release​

info

This release performs some internal database migrations that may take longer than normal (half an hour or longer). This upgrade will take more time depending on how many Sample packets you have stored.

New Features

Enhancements

Bug Fixes

  • Fixed some Dashboard widgets that could display improperly in certain failure edge cases.
  • Tuned memory consumption of the web server processes. We still recommend providing resources under our "Recommended" tier if running a VM, but if you're below this the webserver is now less likely to run out of memory.
  • Subscription list updates that fail will now produce an alert rather than fail silently.
  • Added a workaround fix for the terrapin SSH attack (CVE-2023-48795).
  • Adjusted how moving a Zone works so that you can't hit apply before selecting a new Group, as previously this could produce confusing error messages.
  • Fixed a bug where creating a new template could occasionally not show the Group selection UI to choose which Group should own the template.
  • Fixed some font mismatch problems that could appear under specific OS/Browser combinations.
  • Fixed AT61 Rule Builder validation that was improperly checking created regexes.
  • Fixed a case where delayed jobs could get orphaned if the API process was restarted.
  • Fixed inconsistent field displays when selecting a Billing scheduled report.
  • Fixed an issue where percent chart updates could cause apparent browser freezes.
  • Fixed an issue where a Zone under attack could have a window title of "Zone Zone Under Attack".
  • Fixed an issue where the Dashboard's "Groups under attack" widget was instead showing the number of Zones under attack.
  • Fixed an issue where the database could be restarted prematurely partway through an upgrade, causing problems and potentially causing the upgrade to fail.
  • Eliminated an unnecessary worker process for the /setup web UI.
  • Removed some extraneous log messages from a backend process.
  • Fixed an issue where old sessions were not being cleaned up. The sessions themselves would expire correctly (requiring users to log in again) but the records for expired sessions were previously not being removed at a set interval after expiry as intended.
  • Fixed an internal error that was observed when sending emails. This never seemed to prevent emails from sending successfully, and so needed to be fixed because it was misleading.
  • Fixed an issue where an internal monitoring process could fail to restart a monitored process, and then crash itself.
  • Backend processes will now log their database connection ID for better failure analysis.
  • Fixed an issue that prevented log files from being rotated properly.
  • Fixed cases where hardware disk alerts could be improperly propagated to an rWeb VM.
  • Fixed an issue where systemd timeouts could interfere with database migrations during an upgrade.
  • Fixed an issue that prevented rWeb syslog messages from being transmitted to configured remote syslog servers.
  • Fixed a bug where Top List entries for Source Whitelist and Source Blacklist were swapped. This was a display bug only, so selecting Source Whitelist would show top Source Blacklist entries, and vice versa.

rWeb 9.2.2.release​

Bug Fixes

  • Fixed a bug preventing the erase_all_data serial command from running successfully.
  • Fixed an error in VM manufacturing in 9.2.1.release.1.

rWeb 9.2.1.release.1​

Bug Fixes

  • Fixed a bug where turning off Allow API Key Authentication would still allow use of API tokens in API calls. Disabling it now properly disables all use of API tokens.
  • Fixed a bug where global list utilization alerts were erroneously thrown once global blacklist or whitelist entries were created, regardless of how many entries were actually configured on a device.
  • Fixed a bug where the Zone Management page would show the same value for both global IPv4 and global IPv6 source whitelist usage.
  • Fixed a bug where device subnet usage in Zone Management would report 0 immediately after upgrading to 9.2.0 but before any new subnet entries were added or changed on a device (after which it would show the correct value).
  • Added a guard against victim notifications causing database deadlocks.
  • Extended the timeout for internal dabase connections.

rWeb 9.2.0.release​

New Features

  • Users can now enable API Keys for easier use of the API, versus the older style of cookie based authentication.
  • There is now initial support for adding Director instances to rWeb. This allows users to edit the main Director configuration file from rWeb without needing to directly ssh into Director.

Enhancements

Bug Fixes

  • Fixed an error in blacklist migrations that could create an empty row, preventing devices from being mapped to the containing zone.
  • Fixed a bug where AT61 controls and dropdowns could duplicate on the page.
  • Fixed an issue where Zone Management could show incorrect numbers of blacklist entries.
  • Fixed an issue where the rWeb console wasn't loading when the window was at specific width ranges.
  • Adjusted rWeb OVA packaging to follow current OVF standards for 2.1.1.

rWeb 9.1.3.release​

Enhancements

  • Now when toggling "Enable inheritance" on the group subnets page, it will automatically copy over the derived inherited subnets for further manual adjustments. This will make it significantly easier to change between modes, instead of needing to describe your prefixes manually ahead of time if not using inheritance.

Bug Fixes

  • Fixed a permission error caused by logging out and logging back in as another user. It was most observable when using IP search, as the search would attempt to look up resources available to the initial user due to a cached value.
  • Fixed an issue where a check of associated group subnets could fail if it overlapped with that of a previously deleted zone.

rWeb 9.1.2.release​

Bug Fixes

rWeb 9.1.1.release​

info

This release addresses the cluster problem from rWeb 9.1.0, and can be upgraded to directly while clustered.

Bug Fixes

  • Fixed the issue causing normal operations to fail after upgrading a clustered system to rWeb 9.1.0.
  • Users can no longer initiate a check on a blacklist subscription without having entered a URL. Previously this could cause the task to hang and block other rWeb operations.
  • Additional data processing is now prevented if a subscription request doesn't return a 200 status code.

rWeb 9.1.0.release​

warning

Known Issue: Clustered rWebs can experience an issue after upgrading to this version, preventing normal operations. We recommend waiting for a patched version, or if you want to upgrade, completely breaking the cluster first and individually upgrading your rWebs.

New Features

  • Shared blacklists can now be configured to retrieve their configuration from an external source (like a third party IP reputation list).
  • rWeb now has the ability to generate a support upload, similar to how RIOS devices provide a support upload. This enables RioRey to perform more diagnostics without needing to request access to your rWeb.

Enhancements

  • Two new metrics are available in Prometheus to help derive data for ancestor or child groups/zones: rweb_zone_path and rweb_group_path. There are also two new metrics to help track device resource utilization: rweb_rios_resource_usage and rweb_rios_resource_limit.
  • Device LED status codes now have summary hover text when looking at the Device Adminstration page.
  • Added a show_ip command to the serial console to help view the current system address. This can help troubleshoot in cases where the configured state shown in status differs from the system's current active state.
  • The Zone and Zones API resources can now be queried using an additional flag to return their routes directly.
  • Reorganized AT62 and updated controls for clarity and more consistent ordering.
  • The omnibar will now explictly show the ID of the resource being presented, versus the user having to infer it from the URL of the page.
  • The various rWeb Adminstration sections were re-organized for better clarity and logical cohesiveness.
  • Configuration elements are now available for the new AT1 and AT2 ECN validation checks introduced in RIOS 8.4.0.
  • Blacklists and Whitelists can now use a .csv file format when exporting or importing.

Bug Fixes

  • Internal fixes to certain subprocess launches.
  • Fixed a bug with the AT61 Regex Tester where it wouldn't work with IPv6 packets in an uploaded capture file.
  • Fixed a bug with Advanced Configuration where if you deleted configuration rows but cancelled the operation it would not properly refresh with your current configuration (instead making it look like you did delete those rows).
  • Updated a Python library that had a known vulnerability.
  • Changed some internal networking programs to make better use of NetworkManager.
  • Updated to Java 11.
  • Fixed internal victim subtype tracking to better de-duplicate entries of the same subtype (treat it as a set more than a list).
  • Removed redundant browser to server communications related to session state. This mostly won't be observable, but now if a user still has a valid open session they will be redirected to the Dashboard rather than forced to log in again if trying to use the top level URL for rWeb.
  • Fixed an issue where looking at the data partition drilldown for disk usage could create a visual overlap with the title.
  • Fixed an issue where the 'Claim' button wouldn't properly appear. It should appear when an rWeb is configured with a device that is currently being run by a different rWeb, as a way to claim ownership of the device. The most common case where this should happen is after breaking a cluster.
  • Discontinued use of several weak algorithms for SSH. The algorithm for host key generation used during clustering is now Ed25519.
  • A unnecessary warning pop-up for a Zone with no devices mapped to it will no longer appear if the user had previously saved a per-device traffic chart and navigates to that Zone.
  • Minor quality of life fixes for limited resource elements (e.g. preventing an add a rule pop up in AT61 when your ruleset already has the maximum 5 rules).
  • Improved validation error message for blacklist and whitelist API.
  • Fixed an issue where RIOS device configuration was not being pushed post 9.0 upgrade in certain circumstances.

rWeb 9.0.3.release​

Bug Fixes

  • Fixed an issue where Template operations were erroneously enforcing system admin level permissions. This prevented users from deleting or renaming their own templates, despite being able to create them.

rWeb 9.0.2.release​

Bug Fixes

  • Fixed an issue with AT9 configuration validation that was causing issues with templates and configuration changes.
  • Fixed an incorrect subtype description that was being presented for AT62 subtypes 28 (Invalid TCP Checksum) and 29 (Invalid UDP Checksum). ST 28 was using 29's display string, and 29's was missing.

rWeb 9.0.1.release​

info

This release can either be done as a fresh install, or an upgrade from 9.0.0 only. You won't be able to upgrade from a pre-9.0 release version.

New Features

  • A custom Prometheus exporter is now included with rWeb. More details about available metrics and configuration is available here. Included in the documentation are a few example Grafana dashboards.

Bug Fixes

  • Backup restores will now forcibly close existing DB connections when restoring the database. This fix has no impact on any user system, and was entirely to prevent problems during our internal testing. If you are running 9.0 already and don't want Prometheus, you do not need to upgrade to this release.

rWeb 9.0.0.release​

New Features

info

The base OS of rWeb has been upgraded by a whole major version, along with upgrades for many major components like the database and internal Python environment. This will require a fresh installation (new disks for hardware rWebs or a fresh image install for VMs) as outlined here.

  • Users can now set preferences to view rWeb in dark mode. There is also now a separate customizable logo that can be set for use in dark mode.
  • Zones can now be moved or cloned. Zones can be moved between groups (versus having to delete and recreate them), and clone operations will create a copy of the zone without any subnets in the same group.
  • Users can now set up rWeb to receive notifications of new updates on the login server, and optionally download them. This requires you to set up token access with your user credentials on login.riorey.com.
  • Admin level users can now create shared lists, for easier centralized maintenance of blacklists or whitelists that are common between multiple zones.

Enhancements

  • Device status pages are now using more distinct colors for "unknown" versus "unprovisioned" states.
  • Reworded "Global Traffic Controls" to "Zone Traffic Controls" for clarity (as it affects the zone, not all traffic as implied by "Global").
  • When viewing a specific victim on the Zone Victim Tab, there is now a "DDos Type" help link that will bring you directly to the documentation for that attack type.
  • The 'status' command for rWeb serial console will now also report uptime and system version.
  • An alert will now be generated when rWeb has 2GB or less of usable disk space.
  • Added an explicit Victim Reporting Threshold control to AT63.

Bug Fixes

  • The top level "Administration" link now acts correctly as a hoverable dropdown menu. Previously it could be forced to stay open after following a completely different link.
  • Fixed a case where post-restore cleanup operations were not being performed correctly.
  • Fixed a case where an rWeb VM disk resize (KVM or VMWare) could fail if the disk was already too full.
  • Fixed an issue where rFlow reporting (Top List, etc.) would invisibly stop working if it lost its connection to the database.
  • Fixed an uninitialized value in backend connection code.
  • Removed our workaround for CVE-2017-7529 added in 8.3.0.release1, as rWeb is now running nginx 1.20.1 and no longer vulnerable.
  • Fixed case where an incorrect license may be shown if a configured device was replaced with a different device (either replaced at the same management address or set to point to a different address).
  • Device Summary hardware status now reports memory (and VM memory requirements) in convential powers of 1024 vs 1000 (e.g. GiB vs G).
  • Emails now have an internal queue limit to prevent excessive email queue sizes from impacting email delivery.
  • Adjusted traffic summary logic to always attempt to use a table with data when looking across time periods that may cross disk retention end times.
  • Fixed typo in pop-up message when sending a support upload to RioRey.
  • Made the report generation processes more resilient to failure cases with better automatic restarts. Previously database migrations could potentially cause partial failures.
  • rWeb will now use iburst for its configured NTP servers for faster convergence time.
  • Fixed an issue that could prevent a cluster switchover from completing successfully.
  • Added a loop so the rWeb VM graphical console was not restarting after every command.
  • Added checks to prevent hangs of backend processes when attempting to connect to a RIOS device managed by another rWeb.
  • Fixed an issue where alerts for deleted devices were being retained.
  • Fixed an issue where reporting would overreport packet and byte totals by the amount of 'Other' traffic observed in the relevant groups/zones.
  • Restore operations will now be visible in rWeb logs.
  • Fixed an issue with IP search where certain categories of search results would be generated but not displayed.
  • Fixed case where a traffic detail chart could fail to render properly if rWeb had never connected to a RIOS device.
  • The older Query Filter List widget should now only appear if rWeb is managing a device running an old enough to require it (RIOS <5.6.0, which needless to say is not recommended).
  • The RE Status page should now have a help link.
  • Fixed cases where the device, group, and interface displays under Net Stats would be incorrect compared to their zoomed in version.
  • Renamed the "CPE Device Configuration" display to "Zone Devices" on the Zone Routing tab for clarity.
  • Adjusted the MTU used by the cluster background application to prevent potential problems caused by fragments not being delivered properly.
  • rWeb Clusters will now issue claim operations on all configured devices after a switchover to ensure it has full positive control.
  • rWeb logs will now group together device disconnect messages into five minute blocks with a repeated message count rather than showing a fresh disconnect message roughly every 30 seconds.
  • Fixed issues where editing a blacklist or whitelist entry and changing it to a different category (e.g. from an IP prefix to an ASN) would fail silenty.
  • Added additional guards to ensure rWeb cluster switchovers always execute cleanly.
  • Fixed the Dashboard "Attack for the Last 30 Days" widget, which was scaling values incorrectly.
  • Fixed the table of results in Search. Previously it was only displaying results for the first ten categories searched, which could omit results depending on previous search order and number of cagtegories.

rWeb 8.3.0.release.1​

New Features

  • Traffic to a zone can now be viewed on a per device basis.

  • Zone traffic reporting is now aggregated into several tables of different time windows (30 second, 5 minute, 1 hour, 1 day), rather than storing all data in 30 second time increments. This allows for better usage of disk space and faster queries of older historical data. Each table can be configured for different data retention settings. All of the reports will now also use the best fitting table instead of doing 95th percentile calculations, making them much faster to generate.

    The initial migration from old to new tables will take some time after first upgrading. rWeb will still be usable and show you data from whatever tables are available, but reports will wait until the migration is complete before running to enable use of the newer tables.

  • There is a new serial command that will factory reset rWeb ('erase_all_data').

Enhancements

  • Victim tracking now shows both current bits per second/packets per second (BPS/PPS) and peak observed values for each victim. Previously this would only show the calculated average value (based on bit/packet counts and victim duration). Display and email thresholds will now trigger based on the peak value.
  • Top Application will now break down reporting on samples as clean, attack, or aggregate of both types of traffic, for either source or destination ports (previously reporting was only for aggregate destination).
  • Added UI controls for checksum functionality that was added in RIOS 8.1.0 to AT62.
  • Slightly reworked support upload UI.
  • Better visualization of current algorithm mode when navigating settings or looking at zone control settings.
  • You can now look at a more detailed and zoomed in chart by clicking a thumbnail on the Net Stats page.
  • Implemented better techniques for victim processing that should improve overall database performance.
  • TCP Flags will now report TCP traffic that is missing flags (SYN, SYN-ACK, ACK, RST, or FIN) as TCP Other.
  • The networking tab will now directly show the current bypass status if there is a bypass available for the given device.

Bug Fixes

  • The backup restore option now immediately opens a file selection dialog rather than making you hit the button again for file selection.
  • Fixed tcpdump, where previously it was automatically appending a /32 mask to IPv6 addresses with no mask specified.
  • Changed wording on notifications configuration to clarify that both email and syslog notifications will be generated.
  • Changed wording on blacklist and whitelist header sections to better differentiate between global and zone configuration.
  • rWeb will now prevent users from issuing new long running commands while it is already working on one (e.g. you won't be able to stage an upgrade while rWeb is generating a backup).
  • Fixed an issue where deleting a group or zone while looking at it or a child group/zone would give you errors on that page without redirecting you somewhere functional.
  • Fixed an issue where advanced controls wouldn't compare to the currently selected template correctly.
  • The alert icon in the bottom right of the screen now also links to the alerts page (previously you had to click on the number of alerts).
  • The backend system is now fully stopped during an upgrade process. Previously users could have partially complete upgrades, causing us to recommend a reboot following upgrades to 8.1 versions. rWeb reboots should again no longer be necessary following an upgrade.
  • Fixed a potentially unsafe data validation path for disk usage settings.
  • Fixed minimum requirements for some disk usage settings.
  • Fixed display categories for some settings under disk usage settings. Several traffic related categories were previously being reported under "configuration" instead.
  • Instituted rate limiting of victim packet samples to prevent excessive disk usage for long running attacks.
  • When comparing zone configuration history, the previous revision will now always be on the left.
  • Fixed some incorrect default values for AT8 advanced controls.
  • Fixed a case where it was possible to run a regex/rule builder test that wouldn't account for newly added rules/regexes.
  • Device alarms will now display for LLCF failing to engage and for individual port media failures on the RE10/RS40.
  • Top Application and Top Protocol API calls will now have a separate "description" field and "port" will be entirely numeric. Previously Top Protocol would return these two combined. Top Application will now return a description for well known (also referred to as system) ports.
  • Fixed a bug that could be thrown when a license pull was issued for a device that had a license loaded while it was on a different rWeb.
  • Fixed interactions with Global Blacklist that could cause interactions with the Default Zone Blacklist to fail, requiring a page refresh.
  • Fixed incorrect seed values for an internal report table.
  • Added a fix to close orphaned victims that could be created after an extended disconnect from the filter device that reported them.
  • Added a guard against victim updates from multiple devices deadlocking.
  • Fixed display text for AT4, AT18, and AT24 (0 is an allowed value, and if set will not allow any fragmented traffic of the selected protocol).
  • Fixed several API calls that would fail without a sort order specified (instead of having a safe default) and then throw a 500 error while trying to return a 400 error to show sort order was required.
  • Fixed several cases where editing a group description may not show that description correctly.
  • rWeb will now recheck NTP after DNS settings are updated.
  • Fixed an issue in filter list command processing.
  • Fixed an issue where email scheduling was crashing due to a victim query bug.
  • Fixed an issue where a clustered rWeb may not properly alert on an issue with the secondary.
  • Fixed a case where the secondary rWeb in a cluster would not restart the database in the same way as the primary.
  • Increased timeouts for database restarts.
  • Fixed a case where rFlow would stop logging internal syslog messages.
  • Fixed an issue where the internal monitoring process could interfere with upgrading the secondary in a clustered rWeb.
  • Removed unused Log4J modules that are vulnerable to CVE-2021-44228. Previous versions of rWeb are not vulnerable to this CVE as Log4J was never used for logging.
  • Added a workaround for CVE-2017-7529, affecting rWeb's current version of nginx (1.10.2). None of the remaining CVEs for this version of nginx apply to rWeb's current usage.
  • License pulls will now automatically refresh the table showing the updated status for all connected devices.

rWeb 8.1.1.release​

info

In order to ensure all aspects of the upgrade complete successfully, it's recommended that you reboot your rWeb following the upgrade to 8.1.1.

Bug Fixes

  • Fixed blacklist/whitelist configuration not being pushed properly when AS or CC based entries were used in the Default Zone.

rWeb 8.1.0.release​

info

In order to ensure all aspects of the upgrade complete successfully, it's recommended that you reboot your rWeb following the upgrade to 8.1.0.

New Features

  • Device support for the new RE100 device.
  • HTTP Rule parsing and regex testing functionality added to AT61.
  • Physical rWebs will now report more metrics on their current disk status.

Enhancements

  • Clicking on victim entries found on IP search will now directly take you to the victim detail for that entry (previously it just brought you to the Zone).
  • Device Summary reports additional error counters for DPDK systems (RS40, RE10, RE100, VM10).
  • rFlow Reporting (Top Attacker, Top List, Top Application, Top Protocol, Top VLAN) is now available in shorter time windows (30 second and 5 minute). Data retention for these windows can be set separately, and windows can each be searched independently for results. Lastly, Top Protocol now returns a full breakdown of all protocol types seen (most non-standard types were previously reported as 'Other').
  • Global Blacklist, Graylist, and Whitelist entries have new UI for easier management.
  • Cluster rWebs can now be manually repaired if the cluster breaks or set to attempt automatic recovery. Previously this required breaking and then re-pairing the systems. You can also adjust settings to change the amount of space allocated for Write Ahead Logging (WAL).

Bug Fixes

  • Fixed case where an upgrade could be initiated before the new RIOS was fully sent to a device.
  • Reports for deleted Groups will now be properly cleaned up.
  • Fixed case where editing a RADIUS or TACAS authentication server entry could leave the edit window open in a state where it wouldn't save changes.
  • Minor alignment fixes to a few widgets.
  • Changed the display on the license widget on the dashboard to show < 60 days for license expiration status for devices in that state (previously was worded differently).
  • Changed wording for rWeb subscription license issues popup.
  • Small fixes for victim notification email handling.
  • Fixed an issue where the configuration process could hang if there were too many disconnected devices (> 10). This isn't common amongst our customers, but a bug is a bug.
  • Traffic detail now shows it requires devices running 8.0 or greater (similar to other version dependent UI in rWeb).
  • Using the calendar picker to populate dates and times will now correctly default to picking 12 noon on the selected day (this was previously being offset depending on the user's system and rWeb's timezone).
  • Fixed an issue in the backend caused when processing a new SSL certificate with DOS line endings.
  • Fixed an issue where Tomcat restarts were leaving behind orphaned processes.
  • Moved javascript and css dependencies to a versioned URL for better caching.
  • Fixed case where a Dashboard widget could break if there was too much attack traffic (we don't expect most customers to see 100Gbps plus continuously every day for months like our test environment, but we're ready for it).
  • The original IP behind rtime1.riorey.com is no longer available to us, and our DNS record now points this to a publicly available NTP server in Sweden. The upgrade will remap any RIOS devices still using our original default IP to this new server.
  • rWeb cookies are now set to use the SameSite=Strict property.
  • Updated timezone data.
  • Fixed a case where a backup could fail to restore properly.
  • Fixed issues with SSL certificate uploads caused by one of several problems: DOS line endings, non-ASCII fields, or other signature algorithms.

Known Issues

  • When entering blacklist or whitelist entries in the Default Zone using AS or CC, the configuration update will fail and prevent filter devices from getting the correct configuration. An immediate patch is being worked on for rWeb 8.1.1.

rWeb 8.0.1.release​

Bug Fixes

  • Fixed repeated transient alerts that could appear when using a RIOS subscription license.
  • Fixed a cascading failure condition that could be caused by trying to download tcpdumps from unconnected devices.
  • Force updates the internal interface revision. This was only incorrect for the original 8.0 rWeb VM uploads; all other rWebs upgraded to 8.0 are correct already.

Known Issues

  • There are a number of cases that can cause uploading SSL certificates to have problems (these will all be fixed in rWeb 8.1.0):
    1. If the certificate is uploaded with DOS line endings. Please ensure it is using Unix style line endings instead.
    2. If the certificate has non-ASCII characters in the Subject or Issuer fields.
    3. If the certificate is using a signature algorithm other than ones presented in the rWeb UI (SHA1, SHA256, SHA512).

rWeb 8.0.0.release​

New Features

Enhancements

  • Migrated backend processing to a newer version of Python.
  • An alert will now show up if maintenance override is enabled.
  • Enhanced processing of victims.
  • Mitigation config pages now have quick links to the previous and next set of configurations.
  • Tcpdumps will now be labeled with the group name to help identify both group and zone used for the capture.

Bug Fixes

  • Removed excessive permission requirement for using AS/CC lookups. This was unintentionally creating multiple permission errors for non-admin users when looking at victim data.
  • IP Search will now properly search only the selected categories when starting a search. Previously it would search categories that had the option to select them suppressed by the searching user's permissions.
  • Fixed a permission issue for Group Info on Groups that have subgroup users with Mitigation Reporting Read/Write.
  • Fixed an issue where the database would stop and not restart during an upgrade.
  • Fixed an issue where clustering would break if a system's hostname included upper case characters.
  • Added cleanup code for previous database version upgrades.
  • Fixed an issue where the alerting process could die if a device exceeded its blacklist limit.
  • Fixed an issue with rWeb restore that could wipe the database the next time the rWeb was rebooted.
  • Fixed a problem where AS/CC couldn't look up entries by IP properly.
  • Fixed an issue where the database schema could be slightly different based on upgrade paths used.
  • Fixed an issue where the settings section could be blank if opened too quickly when loading the mitigation config page.
  • Adjusted the length of timestamp entry boxes so they accommodate the full timestamp on all browsers and platforms.
  • The API resource for NTP now returns meaningful configuration information rather than a 500 error if there are problems with the configuration.
  • Fixed an issue where the primary in a cluster could be showing out of date status entries for the secondary.
  • rWeb VM should now respond cleanly to hypervisor shutdown requests.
  • Fixed an issue where mitigation config would load AT25 after coming back to the page, even if you were previously looking at a different set of controls.
  • Fixed an issue where device NTP configuration was failing on blank entries.
  • The login page now works better with password managers.
  • Fixed an issue where zones with disconnected devices would prevent insertion of new whitelist or blacklist entries.
  • The reboot button for a device will no longer be clickable while the device is already in the process of rebooting.
  • Fixed issue where attack types with filter sensitivity would appear to save changes even if you cancelled the change.
  • Minor fixes to tcpdump text and widget alignment.
  • Adjusted the database template used by VM rWeb to prevent potential out of memory problems for systems running at minimum requirements.
  • Fixed a potential race condition when establishing a cluster pair.