OpenBCM V1.07b12 (Linux)

Packet Radio Mailbox

SR8BBS

[OBCM_Lublin]

 Login: GUEST





  
I0OJJ  > JNOS     21.03.21 01:55z 106 Lines 3696 Bytes #55 (0) @ WW
BID : 356G_I0OJJ
Read: GUEST
Subj: Re: malformed DNS packets, NOS crashing, and a first fix ..
Path: SR8BBS<OK0NBR<F3KT<OK0NAG<DB0ERF<DB0RES<ON0AR<GB7CIP<GB7YEW<VE3CGR<
      OK2PEN<VE2PKT<I0OJJ
Sent: 210321/0135z @:I0OJJ.ITA.EU [Rome] $:356G_I0OJJ

>From i0ojj@i0ojj.ampr.org Sun Mar 21 02:35:39 2021
Received: from ir0rm-7.ampr.org by i0ojj.ampr.org (JNOS2.0m.5G) with SMTP
	id AA146680 ; Sun, 21 Mar 2021 02:35:39 +0100
References: <A0DAC_VE4KLM@ve2pkt.bbs>
>From: Gustavo Ponza <i0ojj@i0ojj.ampr.org>
Organization: SICD Rome
Message-Id: <146681@i0ojj.ampr.org>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:78.0) Gecko/20100101
 Thunderbird/78.8.1
MIME-Version: 1.0
In-Reply-To: <A0DAC_VE4KLM@ve2pkt.bbs>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit

Hi Maiko and all,

On 3/20/21 9:39 PM, ve4klm@ve4klm.#wpg.mb.can.noam wrote:
> R:210320/2043Z @:VE2PKT.#TRV.QC.CAN.NOAM #:43128 $:A0DAC_VE4KLM
> R:210320/2042Z 59913@K5DAT.#CWI.WI.USA.NOAM LinBPQ6.0.21
> R:210320/2040z @:N2NOV.#RICH.NY.USA.NOAM $:A0DAC_VE4KLM
> R:210320/2039z @:VE4KLM.#WPG.MB.CAN.NOAM [Winnipeg] $:A0DAC_VE4KLM
> 
>>From ve4klm%ve4klm.#wpg.mb.can.noam@n2nov.ampr.org Sat Mar 20 16:40:39 2021
> Received: from n2nov.ampr.org by n2nov.ampr.org (JNOS2.0m.5F) with SMTP
> 	id AA201951 ; Sat, 20 Mar 2021 16:40:39 EDT
> Message-Id: <A0DAC_VE4KLM@ve4klm.bbs>
>> From: ve4klm@ve4klm.#wpg.mb.can.noam
> X-JNOS-User-Port: Uplink   (VE4KLM on port axipv)  -> Sending message
> 
> Good day,
> 
> What I originally thought was DNS attacks, seem to be more a case of
> JNOS querying
> some DNS server, and getting a malformed response, looks like it
> anyways. Thanks to
> Jean for the PI time and allowing me access, and Janusz for his gdb
> reports and such.
> 
> It does happen, sometimes it suggests networking issues or other
> factors, I'm not an
> expert on what causes malformed responses, outside of malicious activity
> ... so at the
> same time if you see 'malformed dns packet' it doesn't mean the firewall
> should come
> out right away ? any experts out there to add to this or correct my
> train of thought ?
> 
> I have a patch (technically very simple, checking qdcount for starters)
> that should be a
> big help in stopping JNOS from crashing on most malformed DNS packets. I
> suspect
> the reports I hear from time to time about JNOS crashing all the time,
> could very well
> be because of this DNS issue. Seems to be more prevalent these days I hear.
> 
> You can rsync (if you already do) or you can download specific patch below :
> 
>      https://www.langelaar.net/jnos2/januszDNSfix.tar
> 
> It contains domhdr.c, domain.[ch], most of those have not changed for
> eons, so you can
> probably work them into any version of JNOS from the past few years or
> so. Make sure,
> and do a diff just to be on the safe side. I have also improved the
> error logging for some
> of the DNS packet functions. If you get a malformed packet, logfile will
> now say so, and
> you should see the IP address of the server in question.
> 
> This is the first fix, I'm sure it will get refined over time.
> 
> Maiko / VE4KLM


Very often by 'tcpdump' the tun0 I can see several repeated
'unknown protocol' from linux and jnos2... but it perhaps is
related to the proto (93).

Good about the whole rsync download and recompile is that
I can safely #undef the vara and the winrpr drivers and
get the normal steady rock jnos2 work.

Not so good: the MBOX SID report since it is sometimes
messed-up: see the following example:

a. wrong report.

[OPENBCM-1.08-5-G2F4A-AB1D1FHMRW$]
  obcm   01:42:25  44.135.49.2:6300

b. right report

[OPENBCM-1.08-5-G2F4A-B1FHM$]
  i0ojj  01:51:48  I0OJJ-2 on port hub

Then the string 'Auth ....' introduced in this last days
is disappeared... and perhaps (since I'm sleeping) the
MFA excluded line, too... :)

-- 
73 and ciao, gustavo i0ojj/ir0aab/ir0eq
non multa, sed multum




Read previous mail | Read next mail


 25.01.2022 02:19:51zGo back Go up