Notification of possible firewall problems

[Guido Diepen]

Hi,

one recurring problem we encounter frequently is that people have problems
with SynCE, it is not working for them and often it turns out that they
have a firewall running. Currently this means that they have to find this
information on some forum, or that they have to find this by asking
questions on the mailing list or IRC channel.

Unfortunately I am not very familiar with all the details of how synce-hal
works, but would the following extension be possible (and if so, would you
guys think it would be useful).

When synce-hal detects a new device, it sets up the interface via DHCP,
after which it sends the UDP packet to the device which will have the
device initiate all subsequent connections.

Couldn't synce-hal somehow check with a timeout function whether the
DHCP/initial handshake connection has been made within a given timelimit
after the device has been detected? I don't think that this should be a
very large timeout, normally this should happen within a matter of
seconds. If this situation is detected (i.e. synce-hal did not reach the
state of a connection be set up completely), you could have synce-hal
trigger a dbus signal signifying a problem with the connected device. The
clients (synce-trayicon / synce-kpm) can then listen for this particular
signal and notify the user of a connection problem and provide the user
with possible solutions (e.g. change firewall settings).

Would this be possible in synce-hal, and if so, what do you guys think
about it?

Kind regards,

Guido Diepen


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
SynCE-Devel mailing list
SynCE-Devel@...
https://lists.sourceforge.net/lists/listinfo/synce-devel

[Mark Ellis]

On Wed, 2009-08-05 at 12:04 +0200, Guido Diepen wrote:

> Hi,
>
> one recurring problem we encounter frequently is that people have problems
> with SynCE, it is not working for them and often it turns out that they
> have a firewall running. Currently this means that they have to find this
> information on some forum, or that they have to find this by asking
> questions on the mailing list or IRC channel.
>
> Unfortunately I am not very familiar with all the details of how synce-hal
> works, but would the following extension be possible (and if so, would you
> guys think it would be useful).
>
> When synce-hal detects a new device, it sets up the interface via DHCP,
> after which it sends the UDP packet to the device which will have the
> device initiate all subsequent connections.
>
> Couldn't synce-hal somehow check with a timeout function whether the
> DHCP/initial handshake connection has been made within a given timelimit
> after the device has been detected? I don't think that this should be a
> very large timeout, normally this should happen within a matter of
> seconds. If this situation is detected (i.e. synce-hal did not reach the
> state of a connection be set up completely), you could have synce-hal
> trigger a dbus signal signifying a problem with the connected device. The
> clients (synce-trayicon / synce-kpm) can then listen for this particular
> signal and notify the user of a connection problem and provide the user
> with possible solutions (e.g. change firewall settings).
>
> Would this be possible in synce-hal, and if so, what do you guys think
> about it?
>

It's definitely possible to add a timeout to the hal stuff, but I don't
know how much would be gained. There are so many reasons why this might
happen, though a firewall is definitely the most common, as we know :)

I think what we actually need is an FAQ / troubleshooting guide. I'm
also working on a more generic installation guide, but as always with
these things I dont have enough eyes/hands/brains !

There were some thoughts thrown around about the firewall problem a
while ago, that came to no real conclusions either.

Mark

> Kind regards,
>
> Guido Diepen
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> SynCE-Devel mailing list
> SynCE-Devel@...
> https://lists.sourceforge.net/lists/listinfo/synce-devel

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
SynCE-Devel mailing list
SynCE-Devel@...
https://lists.sourceforge.net/lists/listinfo/synce-devel

[Guido Diepen]

On Saturday 08 August 2009 11:53:01 Mark Ellis wrote:

> On Wed, 2009-08-05 at 12:04 +0200, Guido Diepen wrote:
> > Hi,
> >
> > one recurring problem we encounter frequently is that people have
> > problems with SynCE, it is not working for them and often it turns out
> > that they have a firewall running. Currently this means that they have to
> > find this information on some forum, or that they have to find this by
> > asking questions on the mailing list or IRC channel.
> >
> > Unfortunately I am not very familiar with all the details of how
> > synce-hal works, but would the following extension be possible (and if
> > so, would you guys think it would be useful).
> >
> > When synce-hal detects a new device, it sets up the interface via DHCP,
> > after which it sends the UDP packet to the device which will have the
> > device initiate all subsequent connections.
> >
> > Couldn't synce-hal somehow check with a timeout function whether the
> > DHCP/initial handshake connection has been made within a given timelimit
> > after the device has been detected? I don't think that this should be a
> > very large timeout, normally this should happen within a matter of
> > seconds. If this situation is detected (i.e. synce-hal did not reach the
> > state of a connection be set up completely), you could have synce-hal
> > trigger a dbus signal signifying a problem with the connected device. The
> > clients (synce-trayicon / synce-kpm) can then listen for this particular
> > signal and notify the user of a connection problem and provide the user
> > with possible solutions (e.g. change firewall settings).
> >
> > Would this be possible in synce-hal, and if so, what do you guys think
> > about it?
>
> It's definitely possible to add a timeout to the hal stuff, but I don't
> know how much would be gained. There are so many reasons why this might
> happen, though a firewall is definitely the most common, as we know :)

It is true that there are more possible options. However, with this additional
signal triggered after a certain timeout of no connection being set up after
the device is connected, we can at least notify the user about the fact that
yes there is a device connected, but there are connection problems. We could
add some extra possible instructions to a dialog:
* Try to switch of any firewalls you might have running on the computer
* Try switching a wm6 device to legacy instead of rndis (IIRC this is what
windows will pop up with also if there are problems with the device)

This way, in case users do have problems, we at least know that HAL detected
the device as WM device, but something went wrong after it.


>
> I think what we actually need is an FAQ / troubleshooting guide. I'm
> also working on a more generic installation guide, but as always with
> these things I dont have enough eyes/hands/brains !

For sure we need such a guide, but indeed I know the problem about too much
work, too little time :)


>
> There were some thoughts thrown around about the firewall problem a
> while ago, that came to no real conclusions either.

I know, but I think with the additional option, we could at least make it
clear to users something was happening with the device, but during the actual
connection making something went wrong.

Kind regards,

Guido Diepen

--
Guido Diepen <guido@...>
Aviation is proof that given the will, we have the capacity to achieve the
impossible.
     --Eddie Rickenbacker

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
SynCE-Devel mailing list
SynCE-Devel@...
https://lists.sourceforge.net/lists/listinfo/synce-devel

[Adam Williamson-4]

On Wed, 2009-08-05 at 12:04 +0200, Guido Diepen wrote:
> Hi,
>
> one recurring problem we encounter frequently is that people have problems
> with SynCE, it is not working for them and often it turns out that they
> have a firewall running. Currently this means that they have to find this
> information on some forum, or that they have to find this by asking
> questions on the mailing list or IRC channel.

On Mandriva they can run the firewall configuration tool and click the
special box for synchronizing with Windows Mobile devices. :)

> Unfortunately I am not very familiar with all the details of how synce-hal
> works, but would the following extension be possible (and if so, would you
> guys think it would be useful).
>
> When synce-hal detects a new device, it sets up the interface via DHCP,
> after which it sends the UDP packet to the device which will have the
> device initiate all subsequent connections.

I'm not sure that would really work. There has been some discussion on
Fedora's development lists recently about some kind of 'firewallkit'
which would allow (trusted packaged, obviously) applications to open
some firewall holes on installation in some way, but it seems to have
petered out, and it may not be applicable to all distros even if written
(I think the end of the discussion was focussing on ways to do it via
SELinux). In the absence of that, better documentation is probably all
we can do :/

What would be nice is a firewalling system that's smart enough not to
apply the firewall to an rndis0 interface when the connected device is a
Windows Mobile phone in ActiveSync mode (this is in fact all information
that's available to the system). That might be a complex patch to write,
though.

--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
SynCE-Devel mailing list
SynCE-Devel@...
https://lists.sourceforge.net/lists/listinfo/synce-devel

[Guido Diepen]

Hi,

On Thursday 13 August 2009 18:39:43 Adam Williamson wrote:

> On Wed, 2009-08-05 at 12:04 +0200, Guido Diepen wrote:
> > Hi,
> >
> > one recurring problem we encounter frequently is that people have
> > problems with SynCE, it is not working for them and often it turns out
> > that they have a firewall running. Currently this means that they have to
> > find this information on some forum, or that they have to find this by
> > asking questions on the mailing list or IRC channel.
>
> On Mandriva they can run the firewall configuration tool and click the
> special box for synchronizing with Windows Mobile devices. :)

Would be nice if this would be cross distro :)

>
> > Unfortunately I am not very familiar with all the details of how
> > synce-hal works, but would the following extension be possible (and if
> > so, would you guys think it would be useful).
> >
> > When synce-hal detects a new device, it sets up the interface via DHCP,
> > after which it sends the UDP packet to the device which will have the
> > device initiate all subsequent connections.
>
> I'm not sure that would really work. There has been some discussion on
> Fedora's development lists recently about some kind of 'firewallkit'
> which would allow (trusted packaged, obviously) applications to open
> some firewall holes on installation in some way, but it seems to have
> petered out, and it may not be applicable to all distros even if written
> (I think the end of the discussion was focussing on ways to do it via
> SELinux). In the absence of that, better documentation is probably all
> we can do :/
>
> What would be nice is a firewalling system that's smart enough not to
> apply the firewall to an rndis0 interface when the connected device is a
> Windows Mobile phone in ActiveSync mode (this is in fact all information
> that's available to the system). That might be a complex patch to write,
> though.

One problem with rndis0 is that it is not always called rndis0. Currently on
my computer it is renamed to eth1.

The thing is that with this timeout I do not want to change anything to
firewalls or whatever, but with this in my opinion we can signal the user
that there are connection problems and that this might be related to a
firewall. In the message we could tell the user to try first with legacy
(=ppp) mode and if that does not work, check firewall settings. Furthermore,
we can mention that for the firewall settings he must look at the
documentation of the distro running.

It would be nice if there would be one generic way cross distros to have SynCE
open some ports in the firewall, but while that is not present, my suggestion
is to at least provide the user with some more instructions.

Kind regards,

Guido Diepen

--
Guido Diepen <guido@...>
Aviation is proof that given the will, we have the capacity to achieve the
impossible.
     --Eddie Rickenbacker

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
SynCE-Devel mailing list
SynCE-Devel@...
https://lists.sourceforge.net/lists/listinfo/synce-devel

[masterpatricko]

Guido Diepen wrote:

> On Thursday 13 August 2009 18:39:43 Adam Williamson wrote:
>  
>> On Wed, 2009-08-05 at 12:04 +0200, Guido Diepen wrote:
>>
>> one recurring problem we encounter frequently is that people have
>> problems with SynCE, it is not working for them and often it turns out
>> that they have a firewall running. Currently this means that they have to
>> find this information on some forum, or that they have to find this by
>> asking questions on the mailing list or IRC channel.
>>    
>> On Mandriva they can run the firewall configuration tool and click the
>> special box for synchronizing with Windows Mobile devices. :)
>>    
> Would be nice if this would be cross distro :)
>
>  
>>> Unfortunately I am not very familiar with all the details of how
>>> synce-hal works, but would the following extension be possible (and if
>>> so, would you guys think it would be useful).
>>>
>>> When synce-hal detects a new device, it sets up the interface via DHCP,
>>> after which it sends the UDP packet to the device which will have the
>>> device initiate all subsequent connections.
>>>      
>> I'm not sure that would really work. There has been some discussion on
>> Fedora's development lists recently about some kind of 'firewallkit'
>> which would allow (trusted packaged, obviously) applications to open
>> some firewall holes on installation in some way, but it seems to have
>> petered out, and it may not be applicable to all distros even if written
>> (I think the end of the discussion was focussing on ways to do it via
>> SELinux). In the absence of that, better documentation is probably all
>> we can do :/
>>
>> What would be nice is a firewalling system that's smart enough not to
>> apply the firewall to an rndis0 interface when the connected device is a
>> Windows Mobile phone in ActiveSync mode (this is in fact all information
>> that's available to the system). That might be a complex patch to write,
>> though.
>>    
>
> One problem with rndis0 is that it is not always called rndis0. Currently on
> my computer it is renamed to eth1.
>
> The thing is that with this timeout I do not want to change anything to
> firewalls or whatever, but with this in my opinion we can signal the user
> that there are connection problems and that this might be related to a
> firewall. In the message we could tell the user to try first with legacy
> (=ppp) mode and if that does not work, check firewall settings. Furthermore,
> we can mention that for the firewall settings he must look at the
> documentation of the distro running.
>
> It would be nice if there would be one generic way cross distros to have SynCE
> open some ports in the firewall, but while that is not present, my suggestion
> is to at least provide the user with some more instructions.
>
> Kind regards,
>
> Guido Diepe

As an aside, the situation on SuSE is that we have a /etc/sysconfig
method of adding services (interface+ports) to the SuSEfirewall2
configuration dialog, though it is still up to the user to ultimately
enable it. It's not included in the rpm's at the moment because I hadn't
figured out an safe way around the interface name changes without asking
for open SynCE ports on all interfaces. Adam, what is the solution on
Mandriva?

But anyway, I am not aware of any cross-distro firewall solution ...
would be a nice project along the lines of PolicyKit and PackageKit though.

But +1 for a message informing the user that one reason for why the
connection failed might be a broken firewall configuration. There isn't
really much else SynCE can do AFAICS. Maybe include information about
necessary ports in the man pages?

Regards,

Tejas <MasterPatricko>

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
SynCE-Devel mailing list
SynCE-Devel@...
https://lists.sourceforge.net/lists/listinfo/synce-devel

[Adam Williamson-4]

On Thu, 2009-08-13 at 21:02 +0100, MasterPatricko wrote:

> As an aside, the situation on SuSE is that we have a /etc/sysconfig
> method of adding services (interface+ports) to the SuSEfirewall2
> configuration dialog, though it is still up to the user to ultimately
> enable it. It's not included in the rpm's at the moment because I hadn't
> figured out an safe way around the interface name changes without asking
> for open SynCE ports on all interfaces. Adam, what is the solution on
> Mandriva?

It opens the ports on all interfaces. Admittedly, that's not ideal, but
I figured it would usually be OK as nothing else in the distro uses
those ports.

> But anyway, I am not aware of any cross-distro firewall solution ...
> would be a nice project along the lines of PolicyKit and PackageKit though.

Maybe we should see if there's an appropriate freedesktop.org list or
something to bring it up on, I can ping the people who started the
discussion on fedora-devel-list if you like...

--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net


--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
SynCE-Devel mailing list
SynCE-Devel@...
https://lists.sourceforge.net/lists/listinfo/synce-devel