Skip to content

Add option to set a cooldown time between successful attempts #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Metalcape wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add option to set a cooldown time between successful attempts #87

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
75c7f2d
Add knock cooldown
Metalcape Mar 9, 2023
18b09cd
fix time comparison
Metalcape Mar 9, 2023
c6be283
Minor fixes
Metalcape Mar 10, 2023
a690305
Add option to manual
Metalcape Mar 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions doc/knockd.1.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,12 @@ be replaced with the knocker's IP address. This directive is optional.
If not present it will automatically fallback onto the same IPV4
\fBStop_Command\fP value. You can use empty value to force
doing nothing.
.TP
.B "Seq_Cooldown = <cooldown>"
Time to wait (in seconds) before a completed sequence can be completed again.
Knock attempts received during the cooldown will be ignored for that sequence.
The default cooldown period is 0.
.TP
.SH SECURITY NOTES
Using the \fB-l\fP or \fB--lookup\fP commandline option to resolve DNS names
for log entries may be a security risk! An attacker may find out the first port
Expand Down
27 changes: 27 additions & 0 deletions src/knockd.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ static char version[] = "0.8";
#define SEQ_TIMEOUT 25 /* default knock timeout in seconds */
#define CMD_TIMEOUT 10 /* default timeout in seconds between start and stop commands */
#define SEQ_MAX 32 /* maximum number of ports in a knock sequence */
#define SEQ_COOLDOWN 0 /* default cooldown timer after a successful knock */

typedef enum _flag_stat {
DONT_CARE, /* 0 */
Expand All @@ -88,6 +89,8 @@ typedef struct opendoor {
time_t cmd_timeout;
char *stop_command;
char *stop_command6;
time_t last_opened;
time_t seq_cooldown;
flag_stat flag_fin;
flag_stat flag_syn;
flag_stat flag_rst;
Expand Down Expand Up @@ -615,6 +618,8 @@ int parseconfig(char *configfile)
door->cmd_timeout = CMD_TIMEOUT; /* default command timeout (seconds) */
door->stop_command = NULL;
door->stop_command6 = NULL;
door->last_opened = 0;
door->seq_cooldown = SEQ_COOLDOWN; /* default port cooldown (seconds) */
door->flag_fin = DONT_CARE;
door->flag_syn = DONT_CARE;
door->flag_rst = DONT_CARE;
Expand Down Expand Up @@ -741,6 +746,9 @@ int parseconfig(char *configfile)
}
strcpy(door->stop_command6, ptr);
dprint("config: %s: stop_command_6: %s\n", door->name, door->stop_command6);
} else if(!strcmp(key, "SEQ_COOLDOWN") || !strcmp(key, "COOLDOWN")) {
door->seq_cooldown = (time_t)atoi(ptr);
dprint("config: %s: seq_cooldown: %d\n", door->name, door->seq_cooldown);
} else if(!strcmp(key, "TCPFLAGS")) {
char *flag;
strtoupper(ptr);
Expand Down Expand Up @@ -1526,6 +1534,18 @@ void process_attempt(knocker_t *attempt)
stop_command = attempt->door->stop_command;
}

/* Check if the cooldown period is not over */
dprint("%s: time = %d, last_opened = %d, seq_cooldown = %d\n", attempt->door->name, time(NULL),
attempt->door->last_opened, attempt->door->seq_cooldown);
if((time(NULL) - attempt->door->last_opened) < attempt->door->seq_cooldown) {
vprint("%s: knock ignored due to cooldown\n", attempt->door->name);
attempt->stage = -1; // Erase the attempt
return;
} else {
/* We clear the last_opened field if the cooldown is over*/
attempt->door->last_opened = 0;
}

/* level up! */
attempt->stage++;
if(attempt->srchost) {
Expand All @@ -1543,6 +1563,13 @@ void process_attempt(knocker_t *attempt)
vprint("%s: %s: OPEN SESAME\n", attempt->src, attempt->door->name);
logprint("%s: %s: OPEN SESAME", attempt->src, attempt->door->name);
}

/* Start the cooldown for this sequence */
if(attempt->door->last_opened == 0) {
attempt->door->last_opened = time(NULL);
dprint("%s: %s: set last_opened time to %d\n", attempt->src, attempt->door->name, attempt->door->last_opened);
}

if(start_command && strlen(start_command)) {
/* run the associated command */
if(fork() == 0) {
Expand Down