Impressive works, It allows you to knock on 80 and 443 ports without drivers!
Indeed, nice works !!
Show HN: Knockles – eBPF Port Knocking Tool
11–20 of 24 posts
Re: Show HN: Knockles – eBPF Port Knocking Tool
#12Last year's discussion of a vaguely similar technology introduced me to TCP MD5 (RFC2385) with native kernel support... ignore injected RST's!
Re: Show HN: Knockles – eBPF Port Knocking Tool
#13If you have a Mikrotik kicking around, you can build firewall rules for this (IIRC, it's just a wrapper over top of linux iptables).
Basically a "knock" on a port adds an IP to a list for N seconds. A knock on port 2 from an IP in that list adds the port to another list for N seconds. A final knock on a third port adds an IP in the third list to the allowlist for a period of time (generally as long as there is activity).
For extra fun, add some guard ports around the knock ports that cause an immediate IP ban.
Re: Show HN: Knockles – eBPF Port Knocking Tool
#14Ha, the red balloon in the commit message gave my brain a quick "wait what's wrong, why does this repo have a bunch of red circles?". Just trained to see that and immediately think "something is broken". Anyway, interesting approach using a secret like this. Is this approach used elsewhere? Based on this it looks like the service will change what port it's listening on every N seconds. What happens if a port on the s…
> Anyway, interesting approach using a secret like this. Is this approach used elsewhere?
yes, fwknop https://github.com/mrash/fwknop
Re: Show HN: Knockles – eBPF Port Knocking Tool
#15From TFA: - A single SYN request is sent on an opened || closed port - It carries an OTP for authentication so you can be the only one to open a port - Once authentified, a random (HMAC based) port is opened for a TCP connection - Then, the port is closed as soon as a connection has been established Very clever. The fake SYN carries data, an OTP. Very nice!
Clever, yes. But this will break in presence of middle-boxen that rewrite IP-ID [1] and/or TCP-SEQ/ACK [2] numbers (SSL inspection firewalls, WAN optimizers, older satellite modems, even some particularly bad carrier-grade NAT devices).
[1] https://en.wikipedia.org/wiki/IPv4#Identification
[2] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...
Re: Show HN: Knockles – eBPF Port Knocking Tool
#16Port knocking is just a channel to send a password. Usually a static plaintext password.
It's overengineering to the nth degree.
If you want to send a password without any TCP baggage then just send a UDP packet. It's not as "cool", perhaps, but it'll be orders of magnitude easier to make secure.
Or use TCP MD5, and even a sniffer can't RST your TCP session.
Re: Show HN: Knockles – eBPF Port Knocking Tool
#17From TFA: - A single SYN request is sent on an opened || closed port - It carries an OTP for authentication so you can be the only one to open a port - Once authentified, a random (HMAC based) port is opened for a TCP connection - Then, the port is closed as soon as a connection has been established Very clever. The fake SYN carries data, an OTP. Very nice!
Clever, yes. But this will break in presence of middle-boxen that rewrite IP-ID [1] and/or TCP-SEQ/ACK [2] numbers (SSL inspection firewalls, WAN optimizers, older satellite modems, even some particularly bad carrier-grade NAT devices). [1] https://en.wikipedia.org/wiki/IPv4#Identification [2] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...
Yes, putting the HMAC in the IP ID field is brittle.
Maybe a TCP option could be used.
Re: Show HN: Knockles – eBPF Port Knocking Tool
#18Any reason to do this instead of using iptables (which is what people usually use in the linux space for this for over a decade). Example: https://www.digitalocean.com/community/tutorials/how-to-conf...
Apart from what others have mentioned already,the whole point of BPF is to replace iptables.
Re: Show HN: Knockles – eBPF Port Knocking Tool
#19What are use cases for something like this?
Re: Show HN: Knockles – eBPF Port Knocking Tool
#20Ha, the red balloon in the commit message gave my brain a quick "wait what's wrong, why does this repo have a bunch of red circles?". Just trained to see that and immediately think "something is broken". Anyway, interesting approach using a secret like this. Is this approach used elsewhere? Based on this it looks like the service will change what port it's listening on every N seconds. What happens if a port on the s…
> Is this approach used elsewhere?
Yes, or at least in a similar fashion. An alternative variant of port knocking is SPA (Single Packet Authorization). Often SPA protocols use UDP and contain within the body field an encrypted payload containing all the required data to authenticate and authorize a particular request.
There are multiple different implementations of SPA: OpenSPA [1] (full disclosure: I am the author of OpenSPA), fwknop [2] just to name a few.
SDP (Software Defined Perimeter) often builds upon SPA technologies in order to achieve a form of zero trust access.
[1] - https://github.com/greenstatic/openspa
[2] - https://github.com/mrash/fwknop
I am currently re-writting the OpenSPA protocol (version 2) and I plan on playing around with eBPF as well, so thanks eeriedusk for paving the way :)