Commit Graph

23 Commits

Author SHA1 Message Date
305ba29c50 add openwrt kernel configuration instruction
All checks were successful
continuous-integration/drone/push Build is passing
2024-04-25 21:16:26 -06:00
f8be95c8d0 add fortinet integration example
All checks were successful
continuous-integration/drone/push Build is passing
2024-04-23 22:11:00 -06:00
0942fb132f QoL feature - select best interface on current system
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
When generating a default config instead of using a canned value like "eth0", hypd will isntead look at what interfaces the system has and make a best guess based on progressively narrowing filters.
2024-04-20 19:25:15 -06:00
6b1bfb3a01 Better usage in hyp and hypd readme's
All checks were successful
continuous-integration/drone/push Build is passing
2024-04-20 18:31:14 -06:00
f660a5a2e5 More readme content
All checks were successful
continuous-integration/drone/push Build is passing
2024-04-20 16:11:10 -06:00
d1239867ae Add support for timeout action
There is also capability of performing another new authentic knock sequence to refresh their timeout timer so they can remain open
2024-04-20 15:41:26 -06:00
a52f3f0d43 fix incorrect logic in rotateSequence
This was introduced in the previous few commits when adding support for multiple secrets in knockd.  The logic to push and pop entries from the knockSequences slice needed to be adjusted to cound for the number of secrets that are loaded by hypd.
2024-04-20 13:27:00 -06:00
2951c1f684 add support for multiple secrets (independent agents) on the knock daemon
Some checks failed
continuous-integration/drone/push Build is failing
This allows you to generate more than one pre-shared secret on the knock daemon so that you can distribute the secret and control revocation at a more granular level.  Each additional secret creates one more concurrent authentic knock sequence.
2024-04-19 22:04:00 -06:00
05e37193b4 Make the success action configurable
Instead of using the hardcoded proof of concept for iptables, the success action is now read from the hypd configuration file and whatever is defined there is executed.
2024-04-18 11:22:03 -06:00
79aa8136c5 add openwrt-wireguard example
All checks were successful
continuous-integration/drone/push Build is passing
2024-04-18 09:39:21 -06:00
344d874c02 minor formatting changes 2024-04-18 09:39:05 -06:00
1ffadf5c86 BREAKING: Interface name is now specified by configuration file
All checks were successful
continuous-integration/drone/push Build is passing
The syntax for the hypd server command has changed.  Now instead of specifying an interface name as an argument to the server command, you instead specify a configuration file path.

Example:
./hypd server hypdconfig.json
2024-04-17 19:41:24 -06:00
e95b4972da add scaffolding for configuration file 2024-04-17 19:12:01 -06:00
e9aefaf8d6 README add/edit 2024-04-16 20:09:37 -06:00
beed9726e3 remove unreferenced macros...
These were previously used while trying to parse out specific headers.  They are no longer required though because the current length bounds checks covers edge cases.
2024-04-16 20:09:01 -06:00
2c43affac9 fix typo in help message 2024-04-16 19:43:39 -06:00
fbf1758ccb added generated go code from ebpg-go
All checks were successful
continuous-integration/drone/push Build is passing
2024-04-14 21:03:22 -06:00
7f2e3c0ed9 Added pre-compiled ebpf programs 2024-04-14 21:00:31 -06:00
5f10c27b0f add knock sequence timeout
All checks were successful
continuous-integration/drone/push Build is passing
This provides another layer of additional protection against sweep attacks by ensuring the correct sequence be entered rapidly, within 3 seconds by default.  It also prevents a client from sitting stuck forever part way through an old knock sequence.
2024-04-14 18:14:24 -06:00
2efe3344b4 knock frames should not contain any data, only headers 2024-04-13 21:50:20 -06:00
0ad3e2b0d4 enter eBPF, libpcap and CGO = bloat 2024-04-13 21:22:22 -06:00
ead7578544 change pcap snaplen to 126 bytes
We really only care getting as far as the UDP header and can discard the rest.  This should reduce load, and perhaps enable full pcap with ports on the BPF filter

UDP header = 8 bytes
IPv4 max size = 60 bytes
IPv6 fixed size = 40 bytes
Ethernet header size = 18 bytes
2024-04-11 15:21:48 -06:00
291cbaabd4 BREAKING: changes to CLI interface, moved to cobra CLI
To better support configuration and user friendliness, migrated to cobra based CLI.  The source tree structure has also changed to single go module, the server has been renamed hypd and client has been named hyp.  The original structure came into being organically, but now that the vision is more complete it's best to make these adjustments now.
2024-04-10 21:42:38 -06:00