Re: new match extension to implement port knocking in one

[Eric Leblond <eric@inl.fr>]

[-- Attachment #1: Type: text/plain, Size: 1735 bytes --]

Le mardi 17 octobre 2006 à 09:19 -0300, J. Federico Hernandez a écrit :
> On 10/16/06, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > J. Federico Hernandez wrote:
> > >> On Oct 14, 2006, Michael Rash wrote:
> > >>
> > >> Well, I agree that having an implementation that builds some port
> > >> knocking capabilities directly into iptables is a good thing for the
> >
> > Perhaps I'm just influenced by my first impression but I think that this
> > thing should be in userspace. We are providing the appropiate netfilter
> > netlink subsystems (nfqueue, nflog...) to implement this as a userland
> > daemon.
> >
> 
> When all you want is to open a port after a correct sequence of
> knocks, instead of sending from the kernel all the knocks to the
> userspace, and then setting a new iptables rule so the kernel firewall
> takes an action, it would be better to leave the whole work to the
> kernel and avoid the transition kernel->userspace->kernel.

kernel->userspace->kernel is really not a problem for nowadays computer.
Simply think about snort-inline which is able to handle a great amount
of traffic.

> In other more complex situations, you can recognize the knocks in the
> kernel and let a userspace app take an action using netlink sockets,
> as you say, but you should never allow a port knocking app to add or
> remove firewall rules on the fly.

I don't think this was Pablo's intention : you can queue packet for all
port including the one that must pass through and when the port knocking
sequence is complete, allow packet to go through target port from
userspace.

BR,
-- 
Éric Leblond, eleblond@inl.fr
Téléphone : 01 44 89 46 39, Fax : 01 44 89 45 01
INL, http://www.inl.fr

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]