search

jvinet / knock

A port-knocking daemon
http://www.zeroflux.org/projects/knock
GNU General Public License v2.0
549 stars 113 forks source link

Faced a problem with knockd not receiving packets because of ETHERTYPE_VLAN #89

Open Regressor opened 1 year ago

Regressor commented 1 year ago

Hi. I have a vps with ubuntu 22. I installed knockd using apt and can't get it working

I started it with debug and copied filter string. Then I started tcpdump with that string and got knocking packets. knockd just prints listening on eth0 and nothing happens.

I downloaded sources from git added some debug prints and compiled them. Sniff triggered on incoming packets but exits at line 1639:

    if(ntohs(eth->ether_type) != ETHERTYPE_IP && ntohs(eth->ether_type) != ETHERTYPE_IPV6) {
        return;
    }

I added debug print and got ntohs(eth->ether_type) == ETHERTYPE_VLAN (0x8100)

There is no any vlan config in linux so I just can't disable it

Is there any way to get it working ?

Regressor commented 1 year ago

Solved it for myself adding some dirty code:

    if(lltype == DLT_EN10MB) {
        eth = (struct ether_header*)packet;
        if(ntohs(eth->ether_type) != ETHERTYPE_IP && ntohs(eth->ether_type) != ETHERTYPE_IPV6 && ntohs(eth->ether_type) != ETHERTYPE_VLAN) {
            return;
        }

        int tag_size = 0;
        if (ntohs(eth->ether_type) == ETHERTYPE_VLAN) {
            tag_size = 4;
        }

        ip = (struct ip*)(packet + sizeof(struct ether_header) + tag_size);
        ip6 = (struct ip6_hdr*)(packet + sizeof(struct ether_header) + tag_size);

        int tag_size = 0;
        if (ntohs(eth->ether_type) == ETHERTYPE_VLAN) {
                tag_size = 4;
        }

        ip = (struct ip*)(packet + sizeof(struct ether_header) + tag_size);
        ip6 = (struct ip6_hdr*)(packet + sizeof(struct ether_header) + tag_size);