KUAL Firewall with BBB filter

[knc1]

Originally Posted by baf

I once built netfilter kernel modules for KT 5.3.2 (attached). I had an idea to block outgoing connections by process id (-m owner --pid-owner), but it turned out that this option is not supported by modern kernels anymore.

Thanks.
They load into 5.3.3 (K5 Paperwhite) not just into 5.3.2 (K5 touch) and should load into any kernel with the same version string.
And perhaps earlier kernels using "force" but that is a bit risky.

core2quad netfilter $ modinfo ./ipt_LOG.ko
filename:       ./ipt_LOG.ko
description:    Xtables: IPv4 packet logging to syslog
author:         Netfilter Core Team <coreteam@netfilter.org>
license:        GPL
depends:        
vermagic:       2.6.31-rt11-lab126 mod_unload ARMv7

On Kpw-5.3.3:

[root@kindle root]# lsmod
Module                  Size  Used by
g_ether                27500  0 
arcotg_udc_yoshime     17472  1 g_ether
pkt_monitor             3532  0 
cyttsp                 25692  0 
fuse                   59316  2 
mxc_epdc_fb            42504  3 
eink_fb_waveform      557596  1 mxc_epdc_fb

[root@kindle root]# insmod ./ipt_REJECT.ko

[root@kindle root]# lsmod
Module                  Size  Used by
ipt_REJECT              2792  0 
g_ether                27500  0 
arcotg_udc_yoshime     17472  1 g_ether
pkt_monitor             3532  0 
cyttsp                 25692  0 
fuse                   59316  2 
mxc_epdc_fb            42504  3 
eink_fb_waveform      557596  1 mxc_epdc_fb

[root@kindle root]# cat /proc/version
Linux version 2.6.31-rt11-lab126 (jenkins-official@jbuild03) (collect2: ld returned 1 exit status) #1 Tue Jan 8 22:06:21 PST 2013

Thanks.
That will let me start testing BBB-1.1.0 rule-set (on the K5s) with a proper "REJECT" target and BBB-1.1.x rule-set (developer packet capture).

@baf : You didn't happen to build the ulogd daemon did you?

[twobob]

[root@kindle root]# cat /proc/version

Linux version 2.6.31-rt11-lab126 (jenkins-official@jbuild02) (collect2: ld returned 1 exit status) #1 Wed Dec 12 19:58:30 PST 2012

[root@kindle root]# what

Kindle Touch!

[knc1]

Is jbuild01 on the K4?

[twobob]

"Not Sure". will happily test should my grubby mits ever own one

[baf]

Originally Posted by knc1

@baf : You didn't happen to build the ulogd daemon did you?

You will find this package at the bottom of my xterm page. I have never used it before and now just played a bit. I included working config (with adjusted paths etc) in the package to start with.

[knc1]

Originally Posted by baf

You will find this package at the bottom of my xterm page. I have never used it before and now just played a bit. I included working config (with adjusted paths etc) in the package to start with.

I grabbed a copy, thanks.

That is the new v-2 ULOGD -
Not sure if the old v-1 flavor wouldn't do the job of just copying packets without all the extra bells and whistles.

Will play with both to get a better idea.

[baf]

Originally Posted by knc1

That is the new v-2 ULOGD -
Not sure if the old v-1 flavor wouldn't do the job of just copying packets without all the extra bells and whistles.

For me simple LOG target is enough

[knc1]

Originally Posted by baf

For me simple LOG target is enough

I used to feed PSAD with ULOG target, back when I was on that project.

Now I want the entire packet to add specific rules for using parts of the Amazon network services while blocking others.

I.E: For the 'developer rule-set'.

For other uses, the LOG target is probably enough, will just have to do something about the place that syslog-ng is writing to (and where its configure file is at).

A neat challenge, what with the KUAL objective of never touching system image files.
Will probably end up with over-mounting that file or directory with something, maybe a tmpfs something. (then everything goes away on re-boot)

[slantybard]

Just in case there are some other users as unintelligent as I am.....

When I unpacked the bbb-1.0.0 zip it gave me a folder bbb-1.0.0 and I stupidly dragged that folder to the extensions folder (yes, I did read the instructions several times...). This give you the following screenshot.

Solution is to only drag the bbb folder, not the bbb-1.0.0 folder to the extensions folder. Just in case this comes up with anyone else.

Smart people can ignore everything I just wrote.

[knc1]

Originally Posted by slantybard

Just in case there are some other users as unintelligent as I am.....

When I unpacked the bbb-1.0.0 zip it gave me a folder bbb-1.0.0 and I stupidly dragged that folder to the extensions folder (yes, I did read the instructions several times...). This give you the following screenshot.

Solution is to only drag the bbb folder, not the bbb-1.0.0 folder to the extensions folder. Just in case this comes up with anyone else.

Smart people can ignore everything I just wrote.

That is the common practice in the "real world" (outside of the hobby world) to always put the archive contents into a directory of the same name.

Next time - bbb-1.0.1 (or whatever) will unpack into its own directory name - making it possible to keep them separate on the system.

The practice also protects against: "tar-bombs" (google that if you have to).

[twobob]

Hint... it's not this

[DuckieTigger]

Originally Posted by knc1

That is the common practice in the "real world" (outside of the hobby world) to always put the archive contents into a directory of the same name.

Next time - bbb-1.0.1 (or whatever) will unpack into its own directory name - making it possible to keep them separate on the system.

The practice also protects against: "tar-bombs" (google that if you have to).

It does not unless you explicitly say to extract it into its own folder. Both your zip and tar.gz extract not only one, but 2 directories: bbb and refs. See here for the tgz, the zip has same contents.

$ tar tf bbb-1.0.0.tar.gz
bbb/
bbb/menu.json
bbb/frags/
bbb/frags/fw-base.txt
bbb/bin/
bbb/bin/load-bbb.sh
bbb/bin/del-filter.sh
bbb/bin/report-cnts.sh
bbb/bin/load-factory.sh
bbb/config.xml
refs/
refs/LICENSE.txt
refs/amazon-net.txt

[knc1]

Quote, from top post of the thread:

There will be two directories created when you un-pack the archive: bbb and: refs.
The 'refs' directory does not have to be on the Kindle - keep it wherever you keep your reference materials.

Does that sentence need to be clarified?

[DuckieTigger]

Originally Posted by knc1

Quote, from top post of the thread:

Does that sentence need to be clarified?

No it doesn't need to be clarified.

Next time - bbb-1.0.1 (or whatever) will unpack into its own directory name

That one does not make sense. Why change all of the sudden and package the next version different from the first? If you so strongly believe it should have been done to start with, then maybe you should have.

There will be user-errors no matter how you package it.

[knc1]

Originally Posted by DuckieTigger

There will be user-errors no matter how you package it.

I was only replying to the Poster's Comment:

When I unpacked the bbb-1.0.0 zip it gave me a folder bbb-1.0.0 and I stupidly dragged that folder to the extensions folder (yes, I did read the instructions several times...). This give you the following screenshot.

If they want to do it "Their way" - then the next time it will come out different for them than it did this first time.