Resolving Kaspersky IoT Secure Gateway Network Protector application errors

Issue

The Kaspersky IoT Secure Gateway Network Protector application crashes because it cannot process incoming traffic, and then Kaspersky IoT Secure Gateway 1000 switches to emergency support mode. This may occur when processing specific types of network packets sent via the SIP, SMB, SMTP, DNS, HTTP, or HTTP2 protocols.

The SIP protocol is involved in establishing a connection from external IP addresses if the modem is being used as the main communication channel and has an installed SIM card whose IP address can be accessed directly from the internet.

Solution

To restore the functionality of the Kaspersky IoT Secure Gateway Network Protector application and the system, apply a patch to disable processing of unsupported traffic.

You can only apply the patch on top of the Kaspersky IoT Secure Gateway 1000 firmware version build 3.1.0.130 already installed on the device with the Kaspersky IoT Secure Gateway Network Protector application installed. The application is installed by default together with the Kaspersky IoT Secure Gateway 1000 firmware after the device automatically restarts.

To apply the Kaspersky IoT Secure Gateway 1000 patch to fix the Kaspersky IoT Secure Gateway Network Protector shutdown error:

1. Prepare a USB drive containing any Linux Live CD distribution that supports SSHD.

   You are advised to download the SystemRescueCd distribution image from the official SystemRescue website and create a bootable USB drive using a utility such as dd, for example:

   $ dd if=systemrescuecd-<version number>.iso of=/dev/<USB drive name>

2. Turn off the Kraftway Rubezh-N device.
3. Connect a USB drive containing any Linux Live CD distribution that supports SSHD to the device.
4. Turn on the device and press the DELETE key during startup to enter the BIOS.
5. Choose to boot the Live CD image from the USB drive.
6. Create a file named "patch.sh" in any directory.
7. Open "patch.sh" in a text editor and copy the lines from the drop-down block below.

   Contents of the "patch.sh" file.

   #!/bin/bash

   PATCH_CONTENT=`cat <<EOF

   --- suricata.yaml 2024-09-05 18:41:03.547307385 +0300

   +++ suricata.yaml.patch 2024-09-05 18:41:33.535624456 +0300

   @@ -648,6 +648,10 @@

   # "detection-only" enables protocol detection only (parser disabled).

   app-layer:

   protocols:

   + http2:

   + enabled: no

   + sip:

   + enabled: no

   tls:

   enabled: yes

   detection-ports:

   @@ -672,7 +676,7 @@

   # (may be resource intensive)

   # This field supercedes all others because it turns the entire

   # process on or off

   - decode-mime: yes

   + decode-mime: no

   # Decode MIME entity bodies (ie. base64, quoted-printable, etc.)

   decode-base64: yes

   @@ -697,7 +701,7 @@

   msn:

   enabled: detection-only

   smb:

   - enabled: yes

   + enabled: no

   detection-ports:

   dp: 139, 445

   # smb2 detection is disabled internally inside the engine.

   @@ -708,6 +712,7 @@

   nfs:

   enabled: no

   dns:

   + enabled: no

   # memcaps. Globally and per flow/state.

   #global-memcap: 16mb

   #state-memcap: 512kb

   @@ -717,15 +722,15 @@

   #request-flood: 500

   tcp:

   - enabled: yes

   + enabled: no

   detection-ports:

   dp: 53

   udp:

   - enabled: yes

   + enabled: no

   detection-ports:

   dp: 53

   http:

   - enabled: yes

   + enabled: no

   # memcap: 64mb

   # default-config: Used when no server-config matches

   EOF

   `

   mkdir packageManager

   mount /dev/sda21 packageManager

   mkdir container

   mount packageManager/apps/kaspersky.kisg.netprotector/res/net_protector_container.img container

   if echo "${PATCH_CONTENT}" | busybox patch -N container/suricata.yaml &> /dev/null ; then echo "The patch has been successfully applied via busybox patch"

   elif [ $? -eq 1 ] ; then echo "The patch has been already updated via busybox patch"

   elif echo "${PATCH_CONTENT}" | patch -N -r - container/suricata.yaml &> /dev/null ; then echo "The patch has been successfully applied via native patch"

   elif [ $? -eq 1 ] ; then echo "The patch has been already updated via native patch"

   else

   echo "Failed to apply the patch: error code $?"

   fi

   umount container

   umount packageManager

   rmdir container

   rmdir packageManager

8. Save the "patch.sh" file and grant it the Execute permission.
9. Run the "patch.sh" script:

   ./patch.sh

10. After the script is finished, restart the device with the Kaspersky IoT Secure Gateway 1000 system boot (by default or via BIOS) and check the operation of the system.
11. Run Kaspersky IoT Secure Gateway Network Protector if it wasn't run automatically.

After applying the patch, the active emergency support mode indicator will not be displayed, and you will be able to start the Kaspersky IoT Secure Gateway Network Protector application. When unsupported traffic traverses the device, the application will continue to operate without crashing, and the system will not switch to emergency support mode.