search

jvinet / knock

A port-knocking daemon
http://www.zeroflux.org/projects/knock
GNU General Public License v2.0
549 stars 113 forks source link

Fixes for IPv6 #84

Open BitBlit88 opened 2 years ago

BitBlit88 commented 2 years ago

This repo fixes issues with IPv6. There were errors like:

IPv6 is not supported under this link-layer type

if the interface has only an IPv6 address but no IPv4 address.

TDFKAOlli commented 2 years ago

@BitBlit88 , not sure if that works. My version derived a bit due to different work on memory safety issues (#74) which were merged here in this repo and what I did on my fork. I had questions about the last changes but they where merged before those where clarifed. @dimkr used lint or another code checker to find the memory issues in the code and I always dreamed of making the core code unit testable so to be able to really test all situations and thereby find all leaks. I think if you want to take stuff from my fork you need to cherry pick.

dimkr commented 2 years ago

@TDFKAOlli I used Valgrind and -fsanitize=address. I can help with conflict resolution and code review, if needed.

TDFKAOlli commented 2 years ago

@dimkr Thanks. I checked through the conflicts and resolved them, creating a new pull request on my master. In the end the changes on this master seems logic and I couldn't see issues anymore (and I don't know which ones I have seen in the past 😄 ).

@BitBlit88 So the conflicts are at least resolved. I have not tested the result yet, but will try to do so with the branch created. Not sure if you can do additional commits here for your "any" feature.

@jvinet I have adapted the copyright notes in my branch just to mention the contributers. That might not been right, its your code base, so you might want to change this back to what you had before.

EDIT: Damn, seems somehow some bugs where fetched. The pcap-filter "tcp-psh" is wrong it has to be "tcp-push". That was right on my branch, now it is broken in the new branch... 😢

TDFKAOlli commented 2 years ago

So, now cleaned up a bit and also built for my OpenWrt router. Seems all fine. tcp-psh vs. tcp-push seemed to be my commit from 2019, I guess based on tcpdump information. I have tested with tcp-push and that seems to compile fine.

@dimkr Thanks, will also have a look at your comments.

TDFKAOlli commented 2 years ago

@dimkr Should be fine now. @BitBlit88 I have added the "any" interface support as described in the issue discussion. It doesn't seem to work on my OpenWrt. I can configure the 'any' interface, but the packets are not captured. Have to check what is the problem there, because that would be useful for me too. 😏

TDFKAOlli commented 2 years ago

Fixed the problem that 'any' doesn't capture on OpenWRT. That was my fault in adding the check for 'any'. 😄 Now there is another problem with setting the any interface... I do get each packet twice. Apparently from the same IP source and dest address as the logs state. That breaks the attempts as duplicates are currently not allowed. Have to check where that is coming from.