iptables module for smb browsing

[Alexander Larsson]

In my quest to make SMB browsing work with the default firewall rules,
thus fixing:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133478
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=113918

I have now written a kernel conntrack module (attached) that marks
replies to netbios name requests as RELATED to the original connection.
This means the default firewall rules will work when this module is
loaded. I'm not actually an expert in netbios or firewall stuff, so I'd
love if someone who knew this better took a look at it and made sure it
looks ok.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Alexander Larsson                                            Red Hat, Inc 
                   alexl(a)redhat.com    alla(a)lysator.liu.se 
He's an impetuous crooked stage actor on a mission from God. She's a 
warm-hearted foul-mouthed opera singer from a different time and place. They 
fight crime!

[Chuck Anderson]

On Wed, Sep 29, 2004 at 11:00:59AM +0200, Alexander Larsson wrote:
>  In my quest to make SMB browsing work with the default firewall
> rules,
>  thus fixing:
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133478
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=113918
>  
>  I have now written a kernel conntrack module (attached) that marks
>  replies to netbios name requests as RELATED to the original connection.
>  This means the default firewall rules will work when this module is
>  loaded. I'm not actually an expert in netbios or firewall stuff, so I'd
>  love if someone who knew this better took a look at it and made sure it
>  looks ok. 
Yay!  Thank you!  Does this work for other multi/broadcast protocols, 
or is it specific to netbios?  I think a generic solution would be 
nice.

I'll take a look and test this...

[Alexander Larsson]

On Wed, 2004-09-29 at 09:28 -0400, Charles R. Anderson wrote:
>  On Wed, Sep 29, 2004 at 11:00:59AM +0200, Alexander Larsson wrote:
>  > In my quest to make SMB browsing work with the default firewall rules,
>  > thus fixing:
>  > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133478
>  > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=113918
>  > 
>  > I have now written a kernel conntrack module (attached) that marks
>  > replies to netbios name requests as RELATED to the original connection.
>  > This means the default firewall rules will work when this module is
>  > loaded. I'm not actually an expert in netbios or firewall stuff, so I'd
>  > love if someone who knew this better took a look at it and made sure it
>  > looks ok.
>  
>  Yay!  Thank you!  Does this work for other multi/broadcast protocols, 
>  or is it specific to netbios?  I think a generic solution would be 
>  nice. 
It hardcodes the netbios port, but i guess more ports could be added, ot
it could be a module parameter.

I posted this upstream, lets see what they think:
https://lists.netfilter.org/pipermail/netfilter-devel/2004-September/0169...

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Alexander Larsson                                            Red Hat, Inc 
                   alexl(a)redhat.com    alla(a)lysator.liu.se 
He's a world-famous overambitious messiah in a wheelchair. She's a virginal 
gold-digging lawyer living homeless in New York's sewers. They fight crime!

[John Mizell]

Any idea when we might see the iptables match code for
port scan detection in fedora or rawhide?

--- Alexander Larsson <alexl(a)redhat.com&gt; wrote:

>  On Wed, 2004-09-29 at 09:28 -0400, Charles R.
>  Anderson wrote:
>  > On Wed, Sep 29, 2004 at 11:00:59AM +0200,
>  Alexander Larsson wrote:
>  > > In my quest to make SMB browsing work with the
>  default firewall rules,
>  > > thus fixing:
>  > >
>  
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133478
>  > >
>  
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=113918
>  >
> >   
>  > > I have now written a
> kernel conntrack module
>  (attached) that marks
>  > > replies to netbios name requests as RELATED to
>  the original connection.
>  > > This means the default firewall rules will work
>  when this module is
>  > > loaded. I'm not actually an expert in netbios or
>  firewall stuff, so I'd
>  > > love if someone who knew this better took a look
>  at it and made sure it
>  > > looks ok.
> >   
>  > Yay!  Thank you!  Does this work for other
>  multi/broadcast protocols, 
>  > or is it specific to netbios?  I think a generic
>  solution would be 
>  > nice.
>  
>  It hardcodes the netbios port, but i guess more
>  ports could be added, ot
>  it could be a module parameter.
>  
>  I posted this upstream, lets see what they think:
>  
https://lists.netfilter.org/pipermail/netfilter-devel/2004-September/0169...
>  
>  
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>   Alexander Larsson                                  
>           Red Hat, Inc 
>                     alexl(a)redhat.com   
>  alla(a)lysator.liu.se 
>  He's a world-famous overambitious messiah in a
>  wheelchair. She's a virginal 
>  gold-digging lawyer living homeless in New York's
>  sewers. They fight crime! 
>  
>  -- 
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  
http://www.redhat.com/mailman/listinfo/fedora-devel-list
>

[Alan Cox]

On Wed, Sep 29, 2004 at 08:03:57AM -0700, John Mizell wrote:
>  Any idea when we might see the iptables match code for
>  port scan detection in fedora or rawhide? 
Why do you want to - if you want to know if you are under attack just
checked the connected light on your modem or dsl.

[John Mizell]

Oh yes very true, but it would be nice to have the
ablity in order to launch a program to monitor the
event and take any defined actions based on an event
such as notifing you if you were not located close to
see the light on the modem or dsl of the scan/attack.

--- Alan Cox <alan(a)redhat.com&gt; wrote:

>  On Wed, Sep 29, 2004 at 08:03:57AM -0700, John
>  Mizell wrote:
>  > Any idea when we might see the iptables match code
>  for
>  > port scan detection in fedora or rawhide?
>  
>  Why do you want to - if you want to know if you are
>  under attack just
>  checked the connected light on your modem or dsl.
>  
>  -- 
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  
http://www.redhat.com/mailman/listinfo/fedora-devel-list
>

[Axel Thimm]

On Wed, Sep 29, 2004 at 12:09:36PM -0400, Alan Cox wrote:
>  On Wed, Sep 29, 2004 at 08:03:57AM -0700, John Mizell wrote:
>  > Any idea when we might see the iptables match code for
>  > port scan detection in fedora or rawhide?
>  
>  Why do you want to - if you want to know if you are under attack just
>  checked the connected light on your modem or dsl. 
What if it's in the basement? ;)

Jokes aside, there already is such code in the pom, along with
tarpitting such connects and other nice stuff. But nothing that is of
packaging and distribution release stability yet.
-- 
Axel.Thimm at ATrpms.net