KUAL Firewall with BBB filter

[knc1]

Originally Posted by twobob

If I NEVER have to do that config again? it will be WAY too soon.

Will delve into your commit. Thanks mate.

If that is the case, you will really love those 2,000 line kernel configs I pushed this morning.

[iivann]

I recently bought Kindle 4 NT, install some stuff from here. Now I trying to set data/time with wifi ON, but when I open Kual and load BBB filter my wifi connection not work. I try to connect but kindle never connected.
If I remove BBB filter or load default firewall I got message that my kindle is not authorized to test... and I must to install devcerts_install.bin again to enable KUAL, CR3...

What I am doing wrong?

[knc1]

Originally Posted by iivann

I recently bought Kindle 4 NT, install some stuff from here. Now I trying to set data/time with wifi ON, but when I open Kual and load BBB filter my wifi connection not work. I try to connect but kindle never connected.
If I remove BBB filter or load default firewall I got message that my kindle is not authorized to test... and I must to install devcerts_install.bin again to enable KUAL, CR3...

What I am doing wrong?

Wifi not connecting to anything -
Try adding:
WIFI_NO_NET_PROBE
filename (may be an empty file) to the root of USB storage (at the same top level as /documents, not inside of /documents).

Getting the date/time from the Amazon time servers -
With the BBB filter enabled, that is just not going to happen (unless I messed up very badly ).

Setting date/time: There is a button for that (tm) -
Install the KUAL ntpdate button, that one uses public ntp servers and/or public ntp networks. The defaults should "just work" but they can be changed by the user.

Now this ntpdate button and KUAL-V2.0 do not like each other -
There is a dangling comma in the json file.
Just remove the one comma at the end of the "Items" list.

I.E: /extensions/helper2/bin/menu.json
make it look like this (no comma after the { .... } in the menu item list):

{
    "items": [
        {
        "name": "Helper",
        "priority": 0,
        "items": [
            {"name": "Set DateTime from Server", "priority": 1, "action": "bin/ntpdate.sh"}
        ]
        }
    ]
}

I must remember to fix that in my posted button archive!
Really sorry about that, but my mind is on semi-permanent holiday, I keep forgetting to update that json file.

- - - -

Unrelated to the above -

The disappearing devcerts -
I recall seeing reports of that posted here, I do not recall the solution.

Is your Kindle registered?
If not, register it, see if that makes the problem go away.
NOTE: It is "normal" (by lab126 standards) to trash the devcerts file when you change the registration status.
You will have to replace them (once) after any change to the registration.

[iivann]

Wifi not connecting to anything -
Try adding:
WIFI_NO_NET_PROBE
filename (may be an empty file) to the root of USB storage (at the same top level as /documents, not inside of /documents).

Still nothing. Kindle can't connect to wifi, I always get message unable to acess network. This only happens when BBB fileter is ON.

KUAL now correctly display ntpdate button with this correction. Thanks!

[knc1]

Originally Posted by iivann

Still nothing. Kindle can't connect to wifi, I always get message unable to acess network. This only happens when BBB fileter is ON.

KUAL now correctly display ntpdate button with this correction. Thanks!

Are you writing about connecting to a "Free Wifi" access point?

If so, then that is normal operation.
With the BBB filter "on" the device can not connect to Amazon to get the account details (like who to bill) to send to the operator of the "Free" access point.

If you are writing about connecting to your own (private) at-home wifi - - that should work just fine with the BBB filter "on".

Thanks for your patience, I really do need to post a corrected ntpdate package.

[iivann]

Originally Posted by knc1

Are you writing about connecting to a "Free Wifi" access point?

No, it's my home network.

[knc1]

Originally Posted by iivann

No, it's my home network.

Your home network and you can connect when you unload the BBB filter but can not when the BBB filter is active, correct?

You did place that flag file in the root of USB storage, correct?

Two yes'es above wins you the chance to answer another question for me.

[iivann]

Yes, WIFI_NO_NET_PROBE is in root of USB storage.
Yes. Kindle connect without problem when remove BBB filter or load factory firewall.

[knc1]

Originally Posted by iivann

Yes, WIFI_NO_NET_PROBE is in root of USB storage.
Yes. Kindle connect without problem when remove BBB filter or load factory firewall.

Great, that means I understand the setup there.
And this does sound like a for-real failure of the BBB filter.

Now we get to play with some of those: "Why did he put this button in the set?" buttons. (Some are for producing reports that help me debug your firewall behavior.)

Do in the following order:

• Enable "Airplane Mode"
• BBB - Load firewall/BBB filter (Ignore this BBB-Last-Action doc)
• BBB - Generate packet report (Ignore this BBB-Last-Action doc)
• Disable "Airplane Mode"
• Select your local access point and let the Kindle try to connect.
• After it fails -
• BBB - Generate packet report (THIS is the BBB-Last-Action doc that is needed!!)

What the above sequence does is gives a packet report that has (or should have) only the counts associated with the connection attempt and failure.
(Makes the guessing much easier here.)

Unplug/plug the USB cable to get back into storage mode if not already there.

Move the /documents/BBB-Last-Action.txt file to your PC and attach to your next post.

PS: If you can't see the '.txt' on the report, then that extension is being hidden by your PC, so check to be certain that the /WIFI_NO_NET_PROBE filename does not also have a hidden '.txt' extension on it.
A "hidden from view" extension on that filename would result in the failure you describe.

- - - -

When we find the cause of this failure, I'll re-post a corrected KUAL.FireWall app.

[iivann]

Picture of my Kindle usb storage:


BBB-LastAction is in attachment.

Thanks for helping!

[knc1]

The Kindle tried to output 28 packets:

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   28  1805 wlan-out   all  --  *      wlan0   0.0.0.0/0            0.0.0.0/0

Which where sent to the Wifi output filter chain:

Chain wlan-out (1 references)
 pkts bytes target     prot opt in     out     source               destination
   18  1080 DROP       all  --  *      *       0.0.0.0/0            207.171.160.0/19    
   10   725 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Those 28 where split into two groups, the 18 to amazon dropped and the other 10 went out on the air.
(See the spoiler below.)

Coming in, off the air, there where 25 packets:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   25  2534 wlan-in    all  --  wlan0  *       0.0.0.0/0            0.0.0.0/0

Which where sent to the Wifi input filter chain:

Chain wlan-in (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
   10  1890 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           state ESTABLISHED 
    5   360 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           
   10   284 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Of those 25, 10 udp packets where related to the 10 udp packets that where sent and allowed in.

The 5 udp packets that where dropped, where not detected as related to the ones that where sent.

The other 10 packets (which had to be 'non-echo request' icmp) where originated by something 'on the air' because the Kindle firewall protects against all link control messages other than "echo request" (such as funky re-directs).
So the firewall did its thing and dropped them on the floor.

Grumble, grumble, grumble.
Phooey!

What "access type setting" is this Wifi connection using?
It might be an access protocal that I did not allow for.

PS: This Linux firewall can also (with a couple non-Amazon modules added) write PCAP files. I just hope it does not come to that.

Spoiler:

NetRange:       207.171.160.0 - 207.171.191.255
CIDR:           207.171.160.0/19
OriginAS:       AS16509
NetName:        AMAZON-01
NetHandle:      NET-207-171-160-0-1
Parent:         NET-207-0-0-0-0
NetType:        Direct Assignment
RegDate:        1999-09-23
Updated:        2012-03-02
Ref:            http://whois.arin.net/rest/net/NET-207-171-160-0-1

OrgName:        Amazon.com, Inc.
OrgId:          AMAZON-4
Address:        1918 8th Ave
City:           SEATTLE
StateProv:      WA
PostalCode:     98101-1244
Country:        US
RegDate:        1995-01-23
Updated:        2013-06-25
Ref:            http://whois.arin.net/rest/org/AMAZON-4

[iivann]

What "access type setting" is this Wifi connection using?

What you exactly mean?
Its secured WPA-PSK, I also try to connect without protection but its same.

[knc1]

Originally Posted by iivann

What you exactly mean?
Its secured WPA-PSK, I also try to connect without protection but its same.

That is what I meant.

Hmm...
Will have to see if I own an access point that supports that.

PS: What firmware version is this Kindle running.

(I have to be able to duplicate the problem here before I stand a chance of fixing it. )

[iivann]

Its last: Kindle 4.1.1 (1813030025)

[knc1]

Originally Posted by iivann

Its last: Kindle 4.1.1 (1813030025)

Great!
I have a test device running that.

Now, I need to go dig into my various access points, find my packet capture setup, waste a bunch of time feeding the person here, and dealing with "life", etc.

No idea how long this may take.

For now, I guess you just have to let Amazon track your reading habits.

PS: Thanks for the trouble report and the help in testing.