Skip to content

Compile the kernel with SYNPROXY module #4993

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Roki100 opened this issue Apr 13, 2022 · 2 comments
Closed

Compile the kernel with SYNPROXY module #4993

Roki100 opened this issue Apr 13, 2022 · 2 comments

Comments

@Roki100
Copy link

Roki100 commented Apr 13, 2022 •
edited
Loading

Describe the bug

The raspberry pi os's kernel is compiled without SYNPROXY module, which is pretty useful for some projects

Steps to reproduce the behaviour

Try to use SYNPROXY via iptables

Device (s)

Raspberry Pi 4 Mod. B

System

Raspberry Pi reference 2022-01-28
Mar 24 2022 13:19:26
Linux raspberrypi 5.15.32-v8+ #1538 SMP PREEMPT Thu Mar 31 19:40:39 BST 2022 aarch64 GNU/Linux

Logs

No response

Additional context

I got told to make an issue here: https://forums.raspberrypi.com/viewtopic.php?t=332870
So, generally having SYNPROXY won't affect the general performance for everybody using the kernel itself, the memory usage impact should be zero, yet it would be helpful and useful to have it for people that want to use it
It can be used for various use cases, where one of them is a DDoS and port-scan protection, and as we all know, there are a lot of people using Raspberry Pi as a small server for various things
I don't see any reason on why currently the kernel is compiled without SYNPROXY, as there is no gain on this, the real gain is on compiling it imho
Please consider compiling the kernel with SYNPROXY module, as it expands firewalling possibilities which are good for security, yet it shouldn't impact any user that won't use it.
pelwell added a commit that referenced this issue Apr 19, 2022
@pelwell
config: Enable the NFT_SYNPROXY module
0086da6 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
@pelwell
Copy link
Contributor

pelwell commented Apr 19, 2022

There are a few "SYNPROXY" config settings, but I see from the thread that it is CONFIG_NFT_SYNPROXY=m that is required - which is in now.

pelwell added a commit that referenced this issue Apr 20, 2022
@pelwell
config: Enable the NFT_SYNPROXY module
502dcb9 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pelwell added a commit that referenced this issue Apr 20, 2022
@pelwell
config: Enable the NFT_SYNPROXY module
e296c9b 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pelwell added a commit that referenced this issue Apr 20, 2022
@pelwell
config: Enable the NFT_SYNPROXY module
fe84e7b 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pelwell added a commit that referenced this issue Apr 20, 2022
@pelwell
config: Enable the NFT_SYNPROXY module
4faaca7 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue Apr 20, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
60e0a08 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix added a commit to raspberrypi/firmware that referenced this issue Apr 22, 2022
@popcornmix
kernel: Clock Framework Improvements, and removal of clock requests API
6b787e7 
See: raspberrypi/linux#4940

kernel: config: Enable the NFT_SYNPROXY module
See: raspberrypi/linux#4993

kernel: configs: (Re)Enable CONFIG_IR_TOY
See: raspberrypi/linux#4997
popcornmix added a commit to raspberrypi/rpi-firmware that referenced this issue Apr 22, 2022
@popcornmix
kernel: Clock Framework Improvements, and removal of clock requests API
1edb1cc 
See: raspberrypi/linux#4940

kernel: config: Enable the NFT_SYNPROXY module
See: raspberrypi/linux#4993

kernel: configs: (Re)Enable CONFIG_IR_TOY
See: raspberrypi/linux#4997
@popcornmix
Copy link
Collaborator

Should be in latest rpi-update kernel.

popcornmix pushed a commit that referenced this issue Apr 25, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
4304dfd 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue Apr 25, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
ab0378d 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue Apr 28, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
4cac2fa 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
pelwell added a commit that referenced this issue May 3, 2022
@pelwell
config: Enable the NFT_SYNPROXY module
50b607f 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue May 4, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
2989ec5 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue May 4, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
82de55f 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
xukuohai pushed a commit to xukuohai/linux-raspberry-pi that referenced this issue May 9, 2022
@pelwell @xukuohai
config: Enable the NFT_SYNPROXY module
142c358 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue May 9, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
c4ea340 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue May 9, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
671a328 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue May 9, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
77f6da4 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
xukuohai pushed a commit to xukuohai/linux-raspberry-pi that referenced this issue May 12, 2022
@pelwell @xukuohai
config: Enable the NFT_SYNPROXY module
535716d 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue May 14, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
ef782ee 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue May 16, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
34d4f27 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue May 16, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
47d8c42 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Noltari pushed a commit to Noltari/rpi-linux that referenced this issue May 17, 2022
@pelwell @Noltari
config: Enable the NFT_SYNPROXY module
70c7989 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue May 21, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
a093aa7 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue May 23, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
80f946a 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue May 25, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
bfc4bb3 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue May 25, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
f2e03fb 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue May 26, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
bf9920c 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue Jun 1, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
84b569a 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue Jun 6, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
114626e 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue Jun 14, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
9e5cfa4 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue Jun 21, 2022
@pelwell @herrnst
config: Enable the NFT_SYNPROXY module
2a37b06 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
popcornmix pushed a commit that referenced this issue Jun 23, 2022
@pelwell @popcornmix
config: Enable the NFT_SYNPROXY module
b4fcfd6 
The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: #4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
@pelwell pelwell closed this as completed Jul 20, 2022
papamoose pushed a commit to papamoose/ubuntu-kernel-raspi-jammy that referenced this issue Sep 3, 2022
@pelwell @juergh
config: Enable the NFT_SYNPROXY module
ae2d636 
BugLink: https://bugs.launchpad.net/bugs/1975599

The NFT_SYNPROXY module is apparently useful for port scan protection,
and at 11kB barely changes the size of the downloads.

See: raspberrypi/linux#4993

Signed-off-by: Phil Elwell <phil@raspberrypi.com>

(cherry picked from commit 0086da6acd41600d47b87b05874f99704216426f rpi-5.15.y)
Signed-off-by: Juerg Haefliger <juergh@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
@Chrome-GitHub Chrome-GitHub mentioned this issue Apr 26, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@popcornmix @pelwell @Roki100