| Message ID | 20240813060456.12507-1-fe@dev.tdt.de |
|---|---|
| State | Accepted |
| Delegated to: | Hauke Mehrtens |
| Headers | show
Return-Path:
<openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org>
X-Original-To: incoming@patchwork.ozlabs.org
Delivered-To: patchwork-incoming@legolas.ozlabs.org
Authentication-Results: legolas.ozlabs.org;
dkim=pass (2048-bit key;
secure) header.d=lists.infradead.org header.i=@lists.infradead.org
header.a=rsa-sha256 header.s=bombadil.20210309 header.b=lEDQ527c;
dkim-atps=neutral
Authentication-Results: legolas.ozlabs.org;
spf=none (no SPF record) smtp.mailfrom=lists.openwrt.org
(client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org;
envelope-from=openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org;
receiver=patchwork.ozlabs.org)
Received: from bombadil.infradead.org (bombadil.infradead.org
[IPv6:2607:7c80:54:3::133])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)
(No client certificate requested)
by legolas.ozlabs.org (Postfix) with ESMTPS id 4WjgtT6D9nz1ybZ
for <incoming@patchwork.ozlabs.org>; Tue, 13 Aug 2024 16:08:33 +1000 (AEST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=lists.infradead.org; s=bombadil.20210309; h=Sender:
Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:Cc
:To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
List-Owner; bh=rvMGDHVFu8ANIMWlNd34xyX7aL+zGtXKXP1OAju3aPE=; b=lEDQ527c3sI1V2
qaGK8fNXsmSV0thA0YS7vi4Jsqoy6JVqFJRXSgpm3HtIxKTOkwXRdX5iNZQu0AsKa85/Bkitcl2tU
/gQuOsPFAop8ucgmWtRBF3Vv3FmHsbhTZ9Y7Lkc/yJuneA0rL+7J/V4W0uZxRsbAe8HHLoniausj4
9hFqH932zejkfR2idy/YmQFxRCCbGye2F8oPqcY2SYf91wBB6oSHIZhl/yfiV1QdvFqS+Sn3jPcnN
MdeT4xvXJQwF4Cy4oh1fx4JhIcTqdJMiLg8ORrvQ6Mh5m3/chbUKMPGuzgsDfQI5qO/2K+9ZZtmt4
5QW5p9Nswp/47YyNRPbw==;
Received: from localhost ([::1] helo=bombadil.infradead.org)
by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux))
id 1sdkgN-00000002Wjt-3VMe;
Tue, 13 Aug 2024 06:06:59 +0000
Received: from mxout70.expurgate.net ([91.198.224.70])
by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux))
id 1sdkea-00000002WJb-1lSc
for openwrt-devel@lists.openwrt.org;
Tue, 13 Aug 2024 06:05:10 +0000
Received: from [127.0.0.1] (helo=localhost)
by relay.expurgate.net with smtp (Exim 4.92)
(envelope-from <prvs=1969c49a3f=fe@dev.tdt.de>)
id 1sdkeT-005M6z-Tf; Tue, 13 Aug 2024 08:05:01 +0200
Received: from [195.243.126.94] (helo=securemail.tdt.de)
by relay.expurgate.net with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.92)
(envelope-from <fe@dev.tdt.de>)
id 1sdkeT-002MZH-7i; Tue, 13 Aug 2024 08:05:01 +0200
Received: from securemail.tdt.de (localhost [127.0.0.1])
by securemail.tdt.de (Postfix) with ESMTP id EF3AF240040;
Tue, 13 Aug 2024 08:05:00 +0200 (CEST)
Received: from mail.dev.tdt.de (unknown [10.2.4.42])
by securemail.tdt.de (Postfix) with ESMTP id E726E240036;
Tue, 13 Aug 2024 08:05:00 +0200 (CEST)
Received: from localhost.localdomain (unknown [10.2.3.40])
by mail.dev.tdt.de (Postfix) with ESMTPSA id 659C93864B;
Tue, 13 Aug 2024 08:05:00 +0200 (CEST)
From: Florian Eckert <fe@dev.tdt.de>
To: hauke@hauke-m.de
Cc: Eckert.Florian@googlemail.com,
openwrt-devel@lists.openwrt.org
Subject: [PATCH 1/2] netfilter: add nf_conntrack_netbios_ns to
kmod-nf-nathelper-extra
Date: Tue, 13 Aug 2024 08:04:55 +0200
Message-ID: <20240813060456.12507-1-fe@dev.tdt.de>
X-Mailer: git-send-email 2.39.2
MIME-Version: 1.0
X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED,
T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED,URIBL_DBL_BLOCKED_OPENDNS,
URIBL_ZEN_BLOCKED_OPENDNS autolearn=ham autolearn_force=no
version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail.dev.tdt.de
X-purgate-type: clean
X-purgate: clean
X-purgate-ID: 151534::1723529101-18EDDE81-74DFC5BA/0/0
X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3
X-CRM114-CacheID: sfid-20240812_230508_630234_D0B83D37
X-CRM114-Status: GOOD ( 10.31 )
X-Spam-Score: -2.6 (--)
X-Spam-Report: Spam detection software,
running on the system "bombadil.infradead.org",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: NetBIOS name service requests are sent as broadcast
messages
from an unprivileged port and responded to with unicast messages to the
same
port. This make them hard to firewall properly because connect [...]
Content analysis details: (-2.6 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low
trust
[91.198.224.70 listed in list.dnswl.org]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[91.198.224.70 listed in
bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[91.198.224.70 listed in
sa-trusted.bondedsender.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[91.198.224.70 listed in sa-accredit.habeas.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
X-BeenThere: openwrt-devel@lists.openwrt.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: OpenWrt Development List <openwrt-devel.lists.openwrt.org>
List-Unsubscribe: <https://lists.openwrt.org/mailman/options/openwrt-devel>,
<mailto:openwrt-devel-request@lists.openwrt.org?subject=unsubscribe>
List-Archive: <http://lists.openwrt.org/pipermail/openwrt-devel/>
List-Post: <mailto:openwrt-devel@lists.openwrt.org>
List-Help: <mailto:openwrt-devel-request@lists.openwrt.org?subject=help>
List-Subscribe: <https://lists.openwrt.org/mailman/listinfo/openwrt-devel>,
<mailto:openwrt-devel-request@lists.openwrt.org?subject=subscribe>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Sender: "openwrt-devel" <openwrt-devel-bounces@lists.openwrt.org>
Errors-To:
openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org
|
| Series |
[1/2] netfilter: add nf_conntrack_netbios_ns to kmod-nf-nathelper-extra
|
expand
|
diff --git a/include/netfilter.mk b/include/netfilter.mk index 7d1f03891b..5bc336eb44 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -207,6 +207,7 @@ $(eval $(call nf_add,NF_NATHELPER,CONFIG_NF_NAT_FTP, $(P_XT)nf_nat_ftp)) # nathelper-extra $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_BROADCAST, $(P_XT)nf_conntrack_broadcast)) +$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_NETBIOS_NS, $(P_XT)nf_conntrack_netbios_ns)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_AMANDA, $(P_XT)nf_conntrack_amanda)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_AMANDA, $(P_XT)nf_nat_amanda)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_H323, $(P_XT)nf_conntrack_h323))
NetBIOS name service requests are sent as broadcast messages from an unprivileged port and responded to with unicast messages to the same port. This make them hard to firewall properly because connection tracking doesn't deal with broadcasts. So let´s enable this in the kernel and add them to 'kmod-nf-nathelper-extra'. Signed-off-by: Florian Eckert <fe@dev.tdt.de> --- include/netfilter.mk | 1 + 1 file changed, 1 insertion(+)