WebMarshal 7.4 Release Notes

Last Revision: February 03, 2021

These notes are additional to the WebMarshal User Guide and supersede information supplied in that Guide.

The information in this document is current as of the date of publication. To check for any later information, please see Trustwave Knowledge Base article Q21117.

Table of Contents

New Features
System Requirements
Upgrade Instructions
Uninstalling
Release History

New Features

For more information about additional minor features and bug fixes, see the release history.

Features New in 7.4.5

Brotli compression support

WebMarshal supports decompression and compression of web requests using the Brotli compression format.

Header Matching

WebMarshal provides a rule condition to match or compare HTTP headers.

Features New in 7.4.1

Google Web Risk support

WebMarshal implements use of the Google Web Risk API as a scan engine.

Features and Changes in 7.4

Syslog Support

WebMarshal can deliver traffic logging to a Syslog server from processing nodes. See Trustwave Knowledge Base article Q21116.

Google Safe Browsing support disabled

The plug-in for Google Safe Browsing support is disabled due to a change in Google Terms of Service. For more information, see Trustwave Knowledge Base article Q21118. Trustwave plans to provide access to Google threat data through the Web Risk API in a future release.

Features New in 7.3.1

Improved Performance and Scalability

 Default settings are updated to take advantage of the performance gains available with 64 bit systems. Enhanced threading also improves performance.

Features New in 7.3

Supports TLS 1.3

WebMarshal client and server connections and rules support TLS 1.3.

Features New in 7.2

Header Rewrite

WebMarshal allows you to add or update one or more request headers with a Standard Rule action.

WebSockets Content Inspection

WebMarshal allows you to inspect content in a WebSockets connection.

Features New in 7.1

Google Safe Browsing support

WebMarshal implements Safe Browsing as a scan engine (similar to TRACEnet).

WebSockets support

WebMarshal supports proxying  of the WebSockets protocol with Connection Rules. Inspection of WebSockets content is not available in this version.

Additional Categories in Trustwave Web Filter Database

The WFDB now includes additional categories "Downloads", "Violence", and "Translation Services".

Additional Wildcards in FileFilter

FileFilter now accepts the * wildcard at the beginning and/or end of the domain part, in addition to the previous stemming behavior.

SSL Improvements

WebMarshal supports Elliptic Curve key exchange and enforces the strongest available cipher for SSL connections from clients.

Features New in 7.0

Native 64-Bit Architecture

All services are now compiled as 64-bit applications. Malware scanner plug-ins are also provided in 64-bit versions.

Full IPv6 Support

IPv6 addresses can be used in all product settings and filtering.

Enhancements to file typing and unpacking

The file type and unpacking functions have been extended. The functionality can be updated automatically.

Enhancements to TextCensor

TextCensor now supports regular expressions.

Enhancements to URL Categories

URLs in categories and FileFilter can now match on querystring text

Features New in 6.12

Large Address Aware

The Engine, Controller, and Array Manager are now able to access up to 4GB of memory on a 64 bit system. Performance enhancement is expected (assuming adequate memory is available).

Supports Bitdefender for Marshal

The Bitdefender for Marshal malware scanner is included in the product installer and supported by the automatically generated trial key.

URL Category Entries for Individual Files

WebMarshal URL Categories and FileFilter entries can now include a specific file name as well as a folder path.

Supports checking of certificate revocation

WebMarshal HTTPS rules can now validate the revocation status of the certificate presented by a web server. For more information, see Trustwave Knowledge Base article Q20605.

Supports use of SQL Server 2014 and SQL Express 2014 for database logging

WebMarshal has been validated with these database engines.

Features New in 6.11

Supports TLS 1.1 and TLS 1.2

When HTTPS Content Inspection is enabled, these versions of TLS are used to negotiate connections by default, and can be selected in rule conditions.

SSLv2 and SSLv3 outbound connections blocked by default

When HTTPS Content Inspection is enabled, connections that use these versions of SSL protocol are blocked by default regardless of rule conditions. To configure the list of SSL and TLS protocols that will be negotiated and allowed, see Trustwave Knowledge Base article Q20067.

Optional unpacking limits

A new setting allows you to bypass unpacking for files larger than a specified size in specified URL categories.

Earlier Feature Enhancements

To review earlier feature enhancement history, see the release notes for earlier WebMarshal versions, available through the Trustwave Knowledge Base.

System Requirements

Hardware required is dependent on the number of concurrent web users and the rules in use. Use of Filtering Lists improves performance. Heavy use of TextCensor decreases performance. Be prepared to adjust specification as required.

Typically a computer with the following specifications is adequate as a processing server for 250-500 concurrent users.

• Dual core processor, 2GHz or better. Use of HTTPS Content Inspection significantly increases CPU usage (due to encryption and decryption load).
• 20 GB free disk space. 30 GB additional free space required for Proxy Caching with the default settings. (Additional disk required for Filtering Lists and text logging.)
• 3 GB RAM available for this application. If CRL Checking is enabled, up to 500MB may be consumed on each processing node for cached CRL information. See also the upgrade note on proxy threads for 6.9.5.

WebMarshal Array Manager, processing servers, and Console require the following software:

• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 or 2012 R2
• Windows Server 2008 R2 with Service Pack 1
• Windows 10
• Windows 8.1
• Windows 7 SP1 and above.

Note: Install Windows using the English language version.

• Utility prerequisites:
  • Microsoft Visual C++  2015 runtime
  • Microsoft .NET 4.6.2
    • Note: The above software will be installed as part of the WebMarshal installation if necessary. Installation of .NET 4.6.2 may require a restart. If your WebMarshal policy blocks download of executable files, the automatic installation of .NET 4.6.2 will fail on any server where Internet Explorer proxy settings point to WebMarshal. You must make a temporary exception or install .NET 4.6.2 in another way.
• For database logging (optional), SQL Server 2016 or 2016 Express, SQL Server 2014 or 2014 Express (SP1 or above), SQL Server 2012 or 2012 Express (SP3 or above), SQL Server 2008 R2 or 2008 R2 Express (SP3 or above).
  
  • A WebMarshal installation package that includes SQL 2014 Express SP1 is available. If no local installation of SQL is found, this package will offer to install SQL Express locally with appropriate options (Named Pipes and TCP/IP enabled).
  • SQL Server or SQL Express requires Windows Installer 4.5 and .NET 4.6.
• For NDS integration, Novell NDS Client 2.

Upgrade Instructions

Upgrade from 7.X is a standard in-place upgrade. Upgrade/migration from 6.X uninstalls the 32-bit software and installs the 64-bit software.

To upgrade from a WebMarshal 6.11 or later release, run the product installer on each server where WebMarshal components are installed (including the Array Manager, and any additional processing node servers and Console installations). 

To upgrade from versions prior to 6.11, you must first upgrade to at least 6.11.0.

• Upgrade the Array Manager first and then upgrade any additional nodes. For more information, see Trustwave Knowledge Base article Q13031.
• It is best practice to back up your WebMarshal configuration before upgrading.

• If you are logging data to a SQL database, the database must be upgraded. If necessary, the installer will prompt for credentials of a database user with permission to upgrade the database (database owner privilege). If the database is not upgraded, database logging will be disabled until you upgrade the database and re-enable logging. For more information and instructions, see Trustwave Knowledge Base article Q12030.

• Be sure to upgrade any WebMarshal Console installations on other workstations.

See the upgrade notes below for version-specific information. For upgrade notes relating to versions prior to 6.11, please see earlier Release Note documents available through the Trustwave Knowledge Base.

Upgrade Notes

• Version 7.4.1 Google Web Risk API Key: On upgrade to 7.4.1 or above from 7.4.0 or below, Google Safe Browsing is replaced by Google Web Risk. Any Google API Key that had been entered for Google Safe Browsing will be removed. To enable Google Web Risk integration you must enter a Google API Key valid for this service.
• Version 7.1.0 Trustwave Web Filter Database Categories: After upgrade, if you use the Trustwave WFDB, you should add the WFDB categories "Downloads", "Violence", and "Translation Services" to related WebMarshal URL Categories. The new WFDB categories will be populated at the next update of the database.
• Version 7.0.1 Proxy Cache: Upgrade/migration from 6.X clears the Proxy Cache if it is located within the WebMarshal install folder. If you want to retain the content of the Proxy Cache, before upgrading ensure the cache is in a custom location outside the install folder. For information about how to update the location and move existing cache files, see the User Guide.
• Version 7.0 64-bit Installation: Upgrade/migration from 6.X uninstalls the 32-bit software and installs the 64-bit software in the new default location (or a location you select).
  • The configuration files are moved to the new location. All configuration settings are preserved.
  • Malware/Virus scanners must be manually installed. 64-bit versions of all "for marshal" virus scanners are available.
    • You must manually install the 64-bit scanners on each processing node and complete the engine and signature updates before starting the new WebMarshal engine.
    • If no other 32-bit products are using the scanners (Trustwave SEG or Trustwave ECM), you can uninstall the 32-bit scanner packages.
    • At this release, the Symantec and SAVI (Sophos) scanners are not supported, as 64-bit interfaces are not currently available. Trustwave will support these scanners if the manufacturers provide the appropriate interfaces. Note that Sophos for Marshal is available and can be used as an alternative to SAVI. Sophos for Marshal can be provided for the term of your SAVI license at no additional cost. To license Sophos for Marshal, contact Trustwave.
• Version 7.0 TextCensor upgrade: Version 7.0 implements a new TextCensor with slightly changed functionality. See the User Guide for details of the features and matching behavior. In rare cases the small changes in matching behavior could affect the sensitivity of scripts triggering.
  • The upgrade process checks existing scripts for compatibility with the new engine. If any scripts are incompatible, you should update them manually before proceeding. If you choose to ignore errors, upgrade will continue but the Engine will not start until errors are resolved.
• Version 7.0 .NET 4.6.2 installation: If your WebMarshal policy blocks download of executable files, the automatic installation of .NET 4.6.2 will fail on any server where Internet Explorer proxy settings point to WebMarshal. You must make a temporary exception or install .NET 4.6.2 in another way.
• Version 7.0 URL Filtering Lists Removed: MarshalFilter and Secure Computing SmartFilter are not available in this release. 
  • You MUST remove any references to these items in configuration before upgrading. Services will not start if any references remain.
  • For URL filtering, use the Trustwave Web Filter Database (formerly known as M86 Filter List).
• Version 6.12 Malware Scanners Removed: The Pest Patrol and CounterSpy scanners are not present in this release. These scanners are no longer available for licensing. Ensure that you remove any references in configuration before upgrading. Spyware protection is provided by the available malware scanners.
• Version 6.12 SSL/TLS versions: SSLv2 is no longer supported and all configuration for this obsolete protocol version is removed from WebMarshal. When HTTPS inspection is enabled, Trustwave recommends you use the rule condition "Where SSL/TLS could not be negotiated" to block any attempt to connect with SSLv2. A rule to block connections "Where SSL/TLS could not be negotiated" is created and enabled on upgrade.
• Version 6.11.0 TLS/SSL negotiation: Best practice is to block use of SSLv2 and SSLv3, which are considered deprecated and insecure protocols. By default, if HTTPS Content Inspection is enabled, WebMarshal attempts to block use of these protocols for all connections from browsers and to websites. Depending on the web browser version, users could see a WebMarshal block page or a "could not connect" message from the browser.
  • SSLv2 might not be correctly negotiated with websites in some cases (this is a pre-existing behavior). To ensure that any websites that use only SSLv2 are controlled, create a HTTPS rule to block connections where SSL could not be negotiated. A rule to cover this case is enabled by default for new installations of 6.11, but cannot be created on upgrade.
  • For more information, see Trustwave Knowledge Base article Q20067.

For upgrade notes relating to versions prior to 6.11, please see earlier Release Note documents available on the Trustwave website.

Uninstalling

WebMarshal can be installed in a variety of scenarios. For full information on uninstalling WebMarshal from a production environment, see the WebMarshal User Guide.

To uninstall a trial installation on a single computer:

1. Close the WebMarshal applications including the Console and Reports on all workstations.
2. On the WebMarshal server(s), use the Windows Add/Remove Programs control panel to remove WebMarshal.
3. If you selected a location outside the WebMarshal install folder for files created by WebMarshal (such as Proxy Cache or Configuration Backup), the uninstallation will not remove the files. Delete these files manually if required.
4. On any other workstations where WebMarshal components were installed, use the Windows Add/Remove Programs control panel to remove them. These components can include WebMarshal console software and older versions of WebMarshal Reports.
5. You can drop the WebMarshal database from the SQL server by using the SQL Express administration tools.

Release History

The following additional items have been changed or updated in the specific build versions of WebMarshal listed.

7.4.5 (February 03, 2021) 

7.4.1 (February 4, 2020)

7.4.0 (November 19, 2019)

7.3.2 (July 4, 2019)

7.3.1 (May 14, 2019)

7.3.0 (January 29, 2019)

7.2.0 (December 18, 2018)

7.1.0 (June 20, 2018)

Note: To review change history for earlier versions, please see the Release Notes for the specific version of WebMarshal. All Release Notes are available through the Trustwave Knowledge Base.

Legal Notice

Copyright © 2021 Trustwave Holdings, Inc.

All rights reserved. This document is protected by copyright and any distribution, reproduction, copying, or decompilation is strictly prohibited without the prior written consent of Trustwave. No part of this document may be reproduced in any form or by any means without the prior written authorization of Trustwave. While every precaution has been taken in the preparation of this document, Trustwave assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

While the authors have used their best efforts in preparing this document, they make no representation or warranties with respect to the accuracy or completeness of the contents of this document and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the author nor Trustwave shall be liable for any loss of profit or any commercial damages, including but not limited to direct, indirect, special, incidental, consequential, or other damages.

Trademarks

Trustwave and the Trustwave logo are trademarks of Trustwave. Such trademarks shall not be used, copied, or disseminated in any manner without the prior written permission of Trustwave.

About Trustwave®

Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com.