KUAL Firewall with BBB filter

[iivann]

Ok. Thanks again. It's nothing urgent

Perhaps now is time for reading, its still waiting for his primary function. I will turn airplane mode for now.
After I bought kindle, I spent this 1-2 days only to install hacks and settings for now.

[knc1]

Originally Posted by iivann

Ok. Thanks again. It's nothing urgent

Perhaps now is time for reading, its still waiting for his primary function. I will turn airplane mode for now.
After I bought kindle, I spent this 1-2 days only to install hacks and settings for now.

You can read stuff with these devices ??

I thought they where just hobby electronic things for playing with.

[twobob]

Originally Posted by knc1

You can read stuff with these devices ??

I thought they where just hobby electronic things for playing with.

BBB and all your filtering are the only things (okay maybe backdoor-lock too) that have kept my devices from going batshit during my down-time.

Thanks.

[knc1]

Originally Posted by twobob

BBB and all your filtering are the only things (okay maybe backdoor-lock too) that have kept my devices from going batshit during my down-time.

Thanks.

I still have to get that dangling comma out of the ntpdate *.json file to make KUAL-2 happy.

It is one of the open windows in front of me.

I have one trouble report to fix on the BBB filter - it is somehow blocking one of the Wifi security protocals that I didn't have a way to test.

Also, since I posted that Firewall + BBB filter button - -
There has been that post about setting a script to be run on a re-start event (which would otherwise clear the filter).
I want to see if I can combine the two things - so that the KUAL.Firewall/BBB filter gets "re-loaded" on re-starts.

- - - - -

I am trying to increase my set of "test devices" here so that I have the full set of devices supported by KUAL.

[hfpop]

I am interested to block the call-home "feature" of Kindle (I mean, not sending the logs). Is BBB the right thing to do, or this is too much, and simply editing /usr/bin/showlog is enough?

A non-related question, does the kindle distro have the patch binary? If yes, it is not in the path.

Thank you for the support.

[knc1]

Originally Posted by hfpop

I am interested to block the call-home "feature" of Kindle (I mean, not sending the logs). Is BBB the right thing to do, or this is too much, and simply editing /usr/bin/showlog is enough?

A non-related question, does the kindle distro have the patch binary? If yes, it is not in the path.

Thank you for the support.

Editing /usr/bin/showlog :

• Modifies a file in the Amazon image.
• Will only effect sending of logs, not other data mining.

So that is sort of up to the end-user, if that is sufficiently "private".

In contrast:

• The KUAL firewall introduces a structured set of filter chains.
• The BBB filter itself may be disabled "by button".
• Firewall and BBB filter rules are in USB storage, may be edited by end-user if desired. No changes made in the Amazon image files.
• Opening in-bound access to a service may be easily automated. The rule is always *added* as rule #1 in the appropriate chain and *removed* by an "exact match" delete command.
  (No button(s) for the common services in the current release.)
• The "report" functions of counter clearing and reporting works on both the KUAL.firewall and the stock Amazon firewall.
• User can revert to the stock Amazon firewall with a button (no restart required - heck, you can even leave the TCP/IP connections up ).

I like the additional feature set that the KUAL firewall brings to the system. Ah, but I am biased, I wrote it.

Three known "problems" with the current release:

• Does not use the 'reject' target when dropping packets.
• Must be re-activated by the end-user after any "cold start" (full re-boot) of the kernel. Which, for a normal end-user, is rare.
• Seems to interfere with certain Wifi security protocols, even when using a personal, private, access point.

I am not ignoring those things, it is just that I am on semi-holiday from Kindle Hacking this summer.

[hfpop]

@knc1: Thank you for the detailed answer.

[knc1]

Originally Posted by hfpop

@knc1: Thank you for the detailed answer.

Your welcome.

I missed one:
The 'patch' utility is not in the Amazon provided image files.

It might be among all of those things twobob cross-compiled for the Kindles before he had to take a summer break.

If you plan to write a pair of KUAL buttons to change and revert that Amazon file using the patch utility . . .

There is a plan in place of where the newly installed patch utility should be installed at under */extensions/system.

The plan:
https://bitbucket.org/twobob/kual-system

And a write-up on how to adjust the path and other parts of root's profile:
http://kual.knetconnect.com/kindles-...g-custom-apps/

Note:
Those projects are not "dead" - just "resting".

[hfpop]

Originally Posted by knc1

If you plan to write a pair of KUAL buttons to change and revert that Amazon file using the patch utility . . .

I did write two buttons, for disable and enable the log thing. The first idea was by using patch. As I did not find it, I reverted to a simple copy of one of two previously prepared filed. But this only works for a particular version of the firmware.

The complete story would assume that the shell script should:
- detect model and firmware of the Kindle;
- based on that, state the file to be updated;
- do the update based on a simple sed command - I believe (from my K3 and K5) that the two lines to be changed are the same on each Kindle, maybe at different positions.

sed seems more flexible than patch w.r.t. applying the same change on different files.

[knc1]

Originally Posted by hfpop

I did write two buttons, for disable and enable the log thing. The first idea was by using patch. As I did not find it, I reverted to a simple copy of one of two previously prepared filed. But this only works for a particular version of the firmware.

The complete story would assume that the shell script should:
- detect model and firmware of the Kindle;
- based on that, state the file to be updated;
- do the update based on a simple sed command - I believe (from my K3 and K5) that the two lines to be changed are the same on each Kindle, maybe at different positions.

sed seems more flexible than patch w.r.t. applying the same change on different files.

Well, you already know where the find the version and pretty_version files.

Take a look at my new "Hardware Report" button's script to see how it ID's the hardware (as provided by NiLuJe):
https://www.mobileread.com/forums/sho...36&postcount=1

You can also find decoding of the serial number examples in /etc/upstart/functions.
I suspect that non-upstart devices have a similar set of "canned functions" somewhere.

[twobob]

Originally Posted by hfpop

I did write two buttons, for disable and enable the log thing. The first idea was by using patch. As I did not find it, I reverted to a simple copy of one of two previously prepared filed. But this only works for a particular version of the firmware.

....

Patch?
Here's one that should work on all devices AFAIK.
Ragged it from an old k3 build.

[NiLuJe]

@knc1: Yep, older devices have it in /etc/rc.d/functions IIRC . The actual content is slightly different, though. (ie. it might not be as simple as just swapping the script to source).

[knc1]

Originally Posted by NiLuJe

@knc1: Yep, older devices have it in /etc/rc.d/functions IIRC . The actual content is slightly different, though. (ie. it might not be as simple as just swapping the script to source).

Thanks!

I am working backward in history -

I should have a K5-touch to play with by the time I finish with the K5-paperwhites.

Have K4s - in both colors (and more parts on the way).

Have my own k3+3G (and more in various states of "broke") on the way.

Have some DX "parts" on the way, if required by the DXG that was donated to the KUAL project. (The get your spare joystick button now, while they are cheap, strategy).

Have some K2s on the way both Wifi and Wifi+3G

By the time I finish "mixing and matching" all the parts, I hope to have a complete set of "testing machines" here (in time for this fall).

- - - - -

Oh, and I have a ton of Wall Warts/Charger Cables on the way - -
just to keep all of the above junk nursing on electricity.

So many in fact, that I might give them away as incentives on wiki.knetconnect.com, when that site reopens for new registration (sometime) this fall.

Will be giving that "incentive" program some thought until then.

[zxczxc]

how could i make this load at boot, so i would not have to worry about forgetting to restart it afterwards? surely there is a start up file that can be written to that could be easily implemented for everyone via a kual button?

[twobob]

mine loads by default.

I'll dig out what I did but in essence its iptables < theRules.txt or something in the startup file.

not really that complicated.

You DO need to be parsing a custom startup location though.
http://kual.knetconnect.com/kindles-...g-custom-apps/