There are several protocols used for discovery of network services that
currently cannot be made to work on Fedora simply due to the restrictive
firewall we use by default.

For example, a broadcast SNMP query to discover network printers is sent
as a UDP packet from an unprivileged local port to SNMP port of the
broadcast address.  Network printers respond by sending a UDP packet in
response, from the SNMP port back to the local unprivileged port.

The default firewall drops these packets.  However, there is no "canned"
firewall setting to allow these packets in.  No checkbox or on/off
switch will do it except "Disable Firewall".

In system-config-printer I try to get it to modify the firewall to allow
in the various network query responses that we expect, but I find it
cannot be done for SNMP or NetBIOS (which works in a similar way).

There is an open bug against the kernel for general broadcast query
response tracking:
https://bugzilla.redhat.com/show_bug.cgi?id=538675

In the mean time, I'm left wondering whether I ought to teach
system-config-printer how to temporarily insert a rule to allow in all
UDP packets from source port SNMP and with destination port > 1024...

Until then people will end up just turning off their firewalls
altogether in order to get things to work.

Tim.
*/

Attachment: signature.asc
Description: This is a digitally signed message part

-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel

Reply via email to