http://bugzilla.opensuse.org/show_bug.cgi?id=943691 http://bugzilla.opensuse.org/show_bug.cgi?id=943691#c4 Michael Andres changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ma@suse.com) | --- Comment #4 from Michael Andres --- (In reply to Lars Müller from comment #3)

Then the question is if it is possible to cause FW_LOAD_MODULES="nf_conntrack_netbios_ns" being set as soon as dolphin or a KDE pattern gets installed.

Therefore requesting information from Michael as he's defined as the libzypp/ zypper bug owner.

This is no issue for zypp. If dolphin and/or one of the kde pattern-packages need to adjust firewall settings, they have to arrange this in their post-install or post-trans script. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=943691 http://bugzilla.opensuse.org/show_bug.cgi?id=943691#c6 Dominique Leuenberger changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dimstar@opensuse.org, | |lmuelle@suse.com Flags| |needinfo?(lmuelle@suse.com) --- Comment #6 from Dominique Leuenberger --- (In reply to Malvern Star from comment #5)

Forgive my likely ignorance, but should the Firewall simply be set during install to allow outgoing connections on the relevant ports? This would not only allow KDE to browse shares by default but other desktop environments too.

I actually agree: the FW change is something that samba-client should take care off... I could be using any DE (GNOME, KDE, XFCE) and even CLI tools to browse shares. the only common denominator would be samba libraries / client to actually handle that. @Lars? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=943691 http://bugzilla.opensuse.org/show_bug.cgi?id=943691#c8 --- Comment #8 from Dominique Leuenberger --- (In reply to Lars Müller from comment #7)

(In reply to Dominique Leuenberger from comment #6)

...

(In reply to Malvern Star from comment #5)

...

Forgive my likely ignorance, but should the Firewall simply be set during install to allow outgoing connections on the relevant ports? This would not only allow KDE to browse shares by default but other desktop environments too.

I actually agree: the FW change is something that samba-client should take care off... I could be using any DE (GNOME, KDE, XFCE) and even CLI tools to browse shares.

the only common denominator would be samba libraries / client to actually handle that.

This might open the ports in too many cases. The goal is to modify the firewall setting if one of the desktop patterns gets selected. But not in general if one of libsmbclient or samba-clients gets installed.

We're talking about poutgoing connections that need a crazy connection tracking handler to be able to receive a reply (which is the purpose of the FW_LOAD_MODULES="nf_conntrack_netbios_ns" statement).. incoming connections (not initiated from the client) are of course a different ballgame -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=943691 http://bugzilla.opensuse.org/show_bug.cgi?id=943691#c11 Dominique Leuenberger changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cruftremover@picodata.net Flags| |needinfo?(cruftremover@pico | |data.net) --- Comment #11 from Dominique Leuenberger --- (In reply to Marcus Meissner from comment #10)

Yes, the connection tracking module is needed because the netbios sends out broadcasts, but replies arrive back from specific machines.

The question is if this module in the firewall configuration helps already?

Also, if you are browsing network shares you are probably in a "safe" network already and do not need the strict firewall?

Malvern, can you verify and confirm the above? Does it actually work if this is set? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=943691 Michael Andres changed: What |Removed |Added ---------------------------------------------------------------------------- CC|ma@suse.com | -- You are receiving this mail because: You are on the CC list for the bug.