Import Upstream version 0.5

COPYING

@@ -0,0 +1,340 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+ 		59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
+
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	Appendix: How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) 19yy  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) 19yy name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Library General
+Public License instead of this License.

ChangeLog

@@ -0,0 +1,37 @@
+VERSION         DESCRIPTION
+-----------------------------------------------------------------------------
+0.5           - Added ability to change the knocking protocol (TCP/UDP) on a
+                per-port basis using the knock client (instead of the -u
+                switch)
+              - Patches from Philippe Lovis <philippe.lovis@gmx.ch>:
+                - Fixed memory leaks and potential security vulnerabilities
+                - Added --lookup option for DNS lookups (default is off)
+                - Added support for one-time sequences
+                - Added Interface directive to select the listening interface
+                - Moved packet filtering to kernel space with BPF filters
+                - Support for excluding TCP flags with "!"
+                - Removed the leftover/deprecated layer-2 MAC logic
+0.4           - Added support for DLT_RAW (PPPoE) interfaces
+              - Changed packet inspection to use the interface's IP address
+                to determine the flow direction, rather than the ethernet
+                MAC address
+              - Changed logging date format to ISO (yyyy-mm-dd)
+              - Added hostnames to logging output
+0.3.1         - Fixed a segfault occurring when a hostname cannot be resolved
+              - Patch from Simon Matter <simon.matter@ch.sauter-bc.com>:
+                - fixes build errors on Fedora
+              - Patch from Per Cederberg <per@percederberg.net>:
+                - fixes TCP SYN timeouts in knock client
+0.3           - Added PPP (LINUX_SLL) support
+              - Patches from Leo Costela:
+                - added Start_Command, Stop_Command, Cmd_Timeout directives,
+                  allowing a single door to open and then close after a
+                  timeout period
+                - knockd now re-reads config when a HUP is received
+                - multiple protocols supported on a per-port basis
+0.2.1         - Bugfix for TCP flag discrimination
+0.2           - Fixed the zombie process problem
+              - Added patch from Leo Costela:
+                - PidFile configuration directive
+                - support for specific TCP flags
+0.1           - Initial release

Makefile.in

@@ -0,0 +1,85 @@
+#
+#  knock
+#
+#  Copyright (c) 2004 by Judd Vinet <jvinet@zeroflux.org>
+#
+#  This program is free software; you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation; either version 2 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program; if not, write to the Free Software
+#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, 
+#  USA.
+#
+
+DESTDIR =
+prefix = @prefix@
+exec_prefix = @prefix@
+
+VERSION = 0.5
+
+BINDIR  = @bindir@
+SBINDIR = @sbindir@
+MANDIR  = @mandir@
+
+INSTALL = @INSTALL@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@ $(AM_INSTALL_PROGRAM_FLAGS)
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+
+TOPDIR = @srcdir@
+SRCDIR = $(TOPDIR)/src/
+OBJDIR = $(TOPDIR)/src/
+MANSRC = $(TOPDIR)/doc/
+
+CXX = @CC@
+CXXFLAGS += @CFLAGS@ -g -Wall -pedantic -fno-exceptions \
+            -D_GNU_SOURCE -I.
+LDFLAGS += @LDFLAGS@
+
+SRCS = $(SRCDIR)knockd.c \
+			 $(SRCDIR)knock.c \
+			 $(SRCDIR)list.c
+
+all: knockd knock man
+
+knockd: $(OBJDIR)knockd.o $(OBJDIR)list.o
+	$(CXX) $(OBJDIR)knockd.o $(OBJDIR)list.o -o $@ $(LDFLAGS) -lpcap
+
+knock: $(OBJDIR)knock.o
+	$(CXX) $(OBJDIR)knock.o -o $@ $(LDFLAGS)
+
+.c.o: $(SRCS)
+	$(CXX) $(CXXFLAGS) -o $@ -c $<
+
+man: $(MANSRC)knockd.1 $(MANSRC)knock.1
+
+%.1: %.1.in
+	sed -e "s/#VERSION#/$(VERSION)/" $< > $@
+
+dist: distclean
+	(cd ..; tar czvf knock-$(VERSION).tar.gz knock-$(VERSION))
+
+install: all
+	$(INSTALL) -D -m0755 knockd $(DESTDIR)$(SBINDIR)/knockd
+	$(INSTALL) -D -m0755 knock $(DESTDIR)$(BINDIR)/knock
+	$(INSTALL) -D -m0644 $(MANSRC)knockd.1 $(DESTDIR)$(MANDIR)/man1/knockd.1
+	$(INSTALL) -D -m0644 $(MANSRC)knock.1 $(DESTDIR)$(MANDIR)/man1/knock.1
+	$(INSTALL) -D -m0644 knockd.conf $(DESTDIR)/etc/knockd.conf
+
+clean:
+	rm -f *~ $(OBJDIR)*.o $(MANSRC)*.1
+
+distclean: clean
+	rm -f knockd knock
+	rm -f Makefile
+	rm -f config.h config.status config.log
+
+# End of file

README

@@ -0,0 +1,53 @@
+knock :: A port-knocking implementation
+=======================================
+
+Copyright (c) 2004-2005, Judd Vinet <jvinet@zeroflux.org>
+
+=========
+  ABOUT  
+=========
+This is a port-knocking server/client.  Port-knocking is a method where a
+server can sniff one of its interfaces for a special "knock" sequence of
+port-hits.  When detected, it will run a specified event bound to that port
+knock sequence.  These port-hits need not be on open ports, since we use
+libpcap to sniff the raw interface traffic.
+
+===========
+  EXAMPLE  
+===========
+The example below could be used to run a strict (DENY policy) firewall that
+can only be accessed after a successful knock sequence.
+
+1) Client sends four TCP SYN packets to Server, at the following ports:
+      38281, 29374, 4921, 54918
+
+2) Server detects this and runs an iptables command to open port 22 to Client.
+
+3) Client connects to Server via SSH and does whatever it needs to do.
+
+4) Client sends four more TCP SYN packets to Server:
+      37281, 8529, 40127, 10100
+
+5) Server detects this and runs another iptables to close port 22 to Client.
+
+
+====================
+  KNOCKING CLIENTS
+====================
+The accompanying knock client is very basic.  If you want to more advanced
+knocks (eg, setting specific tcp flags) then you should take look at hping,
+sendip or packit.
+
+  http://freshmeat.net/projects/hping/
+  http://freshmeat.net/projects/sendip/
+  http://freshmeat.net/projects/packit/
+
+
+=========================
+  OTHER IMPLEMENTATIONS  
+=========================
+Here are some other implementations of port-knocking:
+
+  http://sourceforge.net/projects/pasmal/
+  http://doorman.sourceforge.net/
+

TODO

@@ -0,0 +1,6 @@
+- allow IP ACLs for doors
+  - eg, allow = 192.168.0.0/24
+- dynamic knock mechanism
+  - the knock sequence itself could define the port to open
+  - the knock sequence could be tied to predictable variables
+		- date: hour of the day, day of the month, year, etc

config.h.in

@@ -0,0 +1,131 @@
+/* config.h.in.  Generated from configure.ac by autoheader.  */
+
+/* Define to 1 if you have the <arpa/inet.h> header file. */
+#undef HAVE_ARPA_INET_H
+
+/* Define to 1 if you don't have `vprintf' but do have `_doprnt.' */
+#undef HAVE_DOPRNT
+
+/* Define to 1 if you have the `fork' function. */
+#undef HAVE_FORK
+
+/* Define to 1 if you have the `inet_ntoa' function. */
+#undef HAVE_INET_NTOA
+
+/* Define to 1 if you have the <inttypes.h> header file. */
+#undef HAVE_INTTYPES_H
+
+/* Define to 1 if you have the `pcap' library (-lpcap). */
+#undef HAVE_LIBPCAP
+
+/* Define to 1 if your system has a GNU libc compatible `malloc' function, and
+   to 0 otherwise. */
+#undef HAVE_MALLOC
+
+/* Define to 1 if you have the `memmove' function. */
+#undef HAVE_MEMMOVE
+
+/* Define to 1 if you have the <memory.h> header file. */
+#undef HAVE_MEMORY_H
+
+/* Define to 1 if you have the <netdb.h> header file. */
+#undef HAVE_NETDB_H
+
+/* Define to 1 if you have the <netinet/in.h> header file. */
+#undef HAVE_NETINET_IN_H
+
+/* Define to 1 if you have the <pcap.h> header file. */
+#undef HAVE_PCAP_H
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#undef HAVE_STDINT_H
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#undef HAVE_STDLIB_H
+
+/* Define to 1 if you have the `strcasecmp' function. */
+#undef HAVE_STRCASECMP
+
+/* Define to 1 if you have the `strdup' function. */
+#undef HAVE_STRDUP
+
+/* Define to 1 if you have the <strings.h> header file. */
+#undef HAVE_STRINGS_H
+
+/* Define to 1 if you have the <string.h> header file. */
+#undef HAVE_STRING_H
+
+/* Define to 1 if you have the `strstr' function. */
+#undef HAVE_STRSTR
+
+/* Define to 1 if you have the <syslog.h> header file. */
+#undef HAVE_SYSLOG_H
+
+/* Define to 1 if you have the <sys/socket.h> header file. */
+#undef HAVE_SYS_SOCKET_H
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#undef HAVE_SYS_STAT_H
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#undef HAVE_SYS_TYPES_H
+
+/* Define to 1 if you have <sys/wait.h> that is POSIX.1 compatible. */
+#undef HAVE_SYS_WAIT_H
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#undef HAVE_UNISTD_H
+
+/* Define to 1 if you have the `vfork' function. */
+#undef HAVE_VFORK
+
+/* Define to 1 if you have the <vfork.h> header file. */
+#undef HAVE_VFORK_H
+
+/* Define to 1 if you have the `vprintf' function. */
+#undef HAVE_VPRINTF
+
+/* Define to 1 if `fork' works. */
+#undef HAVE_WORKING_FORK
+
+/* Define to 1 if `vfork' works. */
+#undef HAVE_WORKING_VFORK
+
+/* Define to the address where bug reports for this package should be sent. */
+#undef PACKAGE_BUGREPORT
+
+/* Define to the full name of this package. */
+#undef PACKAGE_NAME
+
+/* Define to the full name and version of this package. */
+#undef PACKAGE_STRING
+
+/* Define to the one symbol short name of this package. */
+#undef PACKAGE_TARNAME
+
+/* Define to the version of this package. */
+#undef PACKAGE_VERSION
+
+/* Define as the return type of signal handlers (`int' or `void'). */
+#undef RETSIGTYPE
+
+/* Define to 1 if you have the ANSI C header files. */
+#undef STDC_HEADERS
+
+/* Define to 1 if your <sys/time.h> declares `struct tm'. */
+#undef TM_IN_SYS_TIME
+
+/* Define to empty if `const' does not conform to ANSI C. */
+#undef const
+
+/* Define to rpl_malloc if the replacement function should be used. */
+#undef malloc
+
+/* Define to `int' if <sys/types.h> does not define. */
+#undef pid_t
+
+/* Define to `unsigned' if <sys/types.h> does not define. */
+#undef size_t
+
+/* Define as `fork' if `vfork' does not work. */
+#undef vfork

doc/knock.1.in

@@ -0,0 +1,36 @@
+.TH knock 1 "June 26, 2005" "knockd #VERSION#" ""
+.SH NAME
+knock \- port-knock client
+.SH SYNOPSIS
+\fBknock [options] <host> <port[:proto]> [port[:proto]] ...\fP
+.SH DESCRIPTION
+\fBknock\fP is a \fIport-knock\fP client.  It sends TCP/UDP packets
+to each specified \fIport\fP on \fIhost\fP, creating a special knock
+sequence on the listening server (see the \fBknockd\fP manpage for more
+info on this).
+.SH OPTIONS
+.TP
+.B "\-u, \-\-udp"
+Make all port hits use UDP (default is TCP).
+If you want each port to use a different protocol (TCP or UDP), then you
+can specify the protocol on a per-port basis.  See the example below.
+.TP
+.B "\-v, \-\-verbose"
+Output verbose status messages.
+.TP
+.B "\-V, \-\-version"
+Display the version.
+.TP
+.B "\-h, \-\-help"
+Syntax help.
+.SH EXAMPLES
+.nf
+knock myserver.example.com 123:tcp 456:udp 789:tcp
+knock -u myserver.example.com 8284 4721 18592 42912
+.fi
+.SH SEE ALSO
+\fBknockd\fP is the accompanying port-knock server.
+.SH AUTHOR
+.nf
+Judd Vinet <jvinet@zeroflux.org>
+.fi

doc/knockd.1.in

@@ -0,0 +1,203 @@
+.TH knockd 1 "June 26, 2005" "knockd #VERSION#" ""
+.SH NAME
+knockd \- port-knock server
+.SH SYNOPSIS
+\fBknockd [options]\fP
+.SH DESCRIPTION
+\fBknockd\fP is a \fIport-knock\fP server.  It listens to all traffic on
+an ethernet (or PPP) interface, looking for special "knock" sequences of port-hits.
+A client makes these port-hits by sending a TCP (or UDP) packet to a
+port on the server.  This port need not be open -- since knockd listens
+at the link-layer level, it sees all traffic even if it's destined for a
+closed port.  When the server detects a specific sequence of port-hits, it
+runs a command defined in its configuration file.  This can be used to open
+up holes in a firewall for quick access.
+.SH COMMANDLINE OPTIONS
+.TP
+.B "\-i, \-\-interface <int>"
+Specify an interface to listen on.  The default is \fIeth0\fP.
+.TP
+.B "\-d, \-\-daemon"
+Become a daemon.  This is usually desired for normal server-like operation.
+.TP
+.B "\-c, \-\-config <file>"
+Specify an alternate location for the config file.  Default is
+\fI/etc/knockd.conf\fP.
+.TP
+.B "\-D, \-\-debug"
+Ouput debugging messages.
+.TP
+.B "\-l, \-\-lookup"
+Lookup DNS names for log entries. This may be a security risk! See section
+\fBSECURITY NOTES\fP.
+.TP
+.B "\-v, \-\-verbose"
+Output verbose status messages.
+.TP
+.B "\-V, \-\-version"
+Display the version.
+.TP
+.B "\-h, \-\-help"
+Syntax help.
+.SH CONFIGURATION
+knockd reads all knock/event sets from a configuration file.  Each knock/event
+begins with a title marker, in the form \fB[name]\fP, where \fIname\fP is the
+name of the event that will appear in the log.  A special marker, \fB[options]\fP,
+is used to define global options.
+.TP
+.SH Example #1:
+.RS
+This example uses two knocks.  The first will allow the knocker to access port
+22 (SSH), and the second will close the port when the knocker is complete.
+As you can see, this could be useful if you run a very restrictive (DENY policy)
+firewall and would like to access it discreetly.
+
+.nf
+[options]
+	logfile = /var/log/knockd.log
+
+[openSSH]
+	sequence    = 7000,8000,9000
+	seq_timeout = 10
+	tcpflags    = syn
+	command     = /usr/sbin/iptables -A INPUT -s %IP% -j ACCEPT
+
+[closeSSH]
+	sequence    = 9000,8000,7000
+	seq_timeout = 10
+	tcpflags    = syn
+	command     = /usr/sbin/iptables -D INPUT -s %IP% -j ACCEPT
+
+.fi
+.RE
+.TP
+.SH Example #2:
+.RS
+This example uses a single knock to control access to port 22 (SSH).  After receiving
+a successful knock, the daemon will run the \fBstart_command\fP, wait for the time
+specified in \fBcmd_timeout\fP, then execute the \fBstop_command\fP.  This is useful
+to automatically close the door behind a knocker.  The knock sequence uses both UDP
+and TCP ports.
+
+.nf
+[options]
+	logfile = /var/log/knockd.log
+
+[opencloseSSH]
+	sequence      = 2222:udp,3333:tcp,4444:udp
+	seq_timeout   = 15
+	tcpflags      = syn,ack
+	start_command = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --syn -j ACCEPT
+	cmd_timeout   = 5
+	stop_command  = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --syn -j ACCEPT
+
+.fi
+.RE
+.TP
+.SH Example #3:
+.RS
+This example doesn't use a single, fixed knock sequence to trigger an event,
+but a set of sequences taken from a sequence file (one time sequences),
+specified by the \fBone_time_sequences\fP directive.  After each successful
+knock, the used sequence will be invalidated and the next sequence from the
+sequence file has to be used for a successful knock.  This prevents an attacker
+from doing a replay attack after having discovered a sequence (eg, while
+sniffing the network).
+
+.nf
+[options]
+	logfile = /var/log/knockd.log
+
+[opencloseSMTP]
+	one_time_sequences = /etc/knockd/smtp_sequences
+	seq_timeout        = 15
+	tcpflags           = fin,!ack
+	start_command      = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 25 -j ACCEPT
+	cmd_timeout        = 5
+	stop_command       = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 25 -j ACCEPT
+	
+.fi
+.RE
+.SH CONFIGURATION: GLOBAL DIRECTIVES
+.TP
+.B "UseSyslog"
+Log action messages through syslog().  This will insert log entries into your
+/var/log/messages or equivalent.
+.TP
+.B "LogFile = /path/to/file"
+Log actions directly to a file, usually /var/log/knockd.log.
+.TP
+.B "PidFile = /path/to/file"
+Pidfile to use when in daemon mode, default: /var/run/knockd.pid.
+.TP
+.B "Interface = <interface_name>"
+Network interface to listen on. Only its name has to be given, not the path to
+the device (eg, "eth0" and not "/dev/eth0"). Default: eth0.
+.SH CONFIGURATION: KNOCK/EVENT DIRECTIVES
+.TP
+.B "Sequence = <port1>[:<tcp|udp>][,<port2>[:<tcp|udp>] ...]"
+Specify the sequence of ports in the special knock. If a wrong port with
+the same flags is received, the knock is discarded.  Optionally, you can
+define the protocol to be used on a per-port basis (default is TCP).
+.TP
+.B "One_Time_Sequences = /path/to/one_time_sequences_file"
+File containing the one time sequences to be used.  Instead of using a fixed
+sequence, knockd will read the sequence to be used from that file.  After each
+successful knock attempt this sequence will be disabled by writing a '#'
+character at the first position of the line containing the used sequence.  That
+used sequence will then be replaced by the next valid sequence from the file.
+
+Because the first character is replaced by a '#', it is recommended that you
+leave a space at the beginning of each line.  Otherwise the first digit in
+your knock sequence will be overwritten with a '#' after it has been used.
+
+Each line in the one time sequences file contains exactly one sequence and has
+the same format as the one for the \fBSequence\fP directive.  Lines beginning
+with a '#' character will be ignored.
+
+\fBNote\fP: Do not edit the file while knockd is running!
+.TP
+.B "Seq_Timeout = <timeout>"
+Time to wait for a sequence to complete in seconds. If the time elapses
+before the knock is complete, it is discarded.
+.TP
+.B "TCPFlags = fin|syn|rst|psh|ack|urg"
+Only pay attention to packets that have this flag set.  When using TCP flags,
+knockd will IGNORE tcp packets that don't match the flags.  This is different
+than the normal behavior, where an incorrect packet would invalidate the entire
+knock, forcing the client to start over.  Using "TCPFlags = syn" is useful if
+you are testing over an SSH connection, as the SSH traffic will usually
+interfere with (and thus invalidate) the knock.
+
+Separate multiple flags with commas (eg, TCPFlags = syn,ack,urg).  Flags can be
+explicitly excluded by a "!" (eg, TCPFlags = syn,!ack).
+.TP
+.B "Start_Command = <command>"
+Specify the command to be executed when a client makes the correct
+port-knock.  All instances of \fB%IP%\fP will be replaced with the
+knocker's IP address.  The \fBCommand\fP directive is an alias for
+\fBStart_Command\fP.
+.TP
+.B "Cmd_Timeout = <timeout>"
+Time to wait between \fBStart_Command\fP and \fBStop_Command\fP.  This
+directive is optional, only required if \fBStop_Command\fP is used.
+.TP
+.B "Stop_Command = <command>"
+Specify the command to be executed when \fBCmd_Timeout\fP seconds have passed 
+since \fBStart_Command\fP has been executed.  All instances of \fB%IP%\fP will
+be replaced with the knocker's IP address.  This directive is optional.
+.SH SECURITY NOTES 
+Using the \fB-l\fP or \fB--lookup\fP commandline option to resolve DNS names
+for log entries may be a security risk!  An attacker may find out the first port
+of a sequence if he can monitor the DNS traffic of the host running knockd.
+Also a host supposed to be stealth (eg, dropping packets to closed TCP ports
+instead of replying with an ACK+RST packet) may give itself away by resolving a
+DNS name if an attacker manages to hit the first (unknown) port of a sequence.
+.SH SEE ALSO
+\fBknock\fP is the accompanying port-knock client, though \fBtelnet\fP or
+\fBnetcat\fP could be used for simple TCP knocks instead.
+For more advanced knocks, see \fBhping\fP, \fBsendip\fP or \fBpackit\fP.
+.SH AUTHOR
+.nf
+Judd Vinet <jvinet@zeroflux.org>
+.fi

install-sh

@@ -0,0 +1,251 @@
+#!/bin/sh
+#
+# install - install a program, script, or datafile
+# This comes from X11R5 (mit/util/scripts/install.sh).
+#
+# Copyright 1991 by the Massachusetts Institute of Technology
+#
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
+#
+# Calling this script install-sh is preferred over install.sh, to prevent
+# `make' implicit rules from creating a file called install from it
+# when there is no Makefile.
+#
+# This script is compatible with the BSD install script, but was written
+# from scratch.  It can only install one file at a time, a restriction
+# shared with many OS's install programs.
+
+
+# set DOITPROG to echo to test this script
+
+# Don't use :- since 4.3BSD and earlier shells don't like it.
+doit="${DOITPROG-}"
+
+
+# put in absolute paths if you don't have them in your path; or use env. vars.
+
+mvprog="${MVPROG-mv}"
+cpprog="${CPPROG-cp}"
+chmodprog="${CHMODPROG-chmod}"
+chownprog="${CHOWNPROG-chown}"
+chgrpprog="${CHGRPPROG-chgrp}"
+stripprog="${STRIPPROG-strip}"
+rmprog="${RMPROG-rm}"
+mkdirprog="${MKDIRPROG-mkdir}"
+
+transformbasename=""
+transform_arg=""
+instcmd="$mvprog"
+chmodcmd="$chmodprog 0755"
+chowncmd=""
+chgrpcmd=""
+stripcmd=""
+rmcmd="$rmprog -f"
+mvcmd="$mvprog"
+src=""
+dst=""
+dir_arg=""
+
+while [ x"$1" != x ]; do
+    case $1 in
+	-c) instcmd="$cpprog"
+	    shift
+	    continue;;
+
+	-d) dir_arg=true
+	    shift
+	    continue;;
+
+	-m) chmodcmd="$chmodprog $2"
+	    shift
+	    shift
+	    continue;;
+
+	-o) chowncmd="$chownprog $2"
+	    shift
+	    shift
+	    continue;;
+
+	-g) chgrpcmd="$chgrpprog $2"
+	    shift
+	    shift
+	    continue;;
+
+	-s) stripcmd="$stripprog"
+	    shift
+	    continue;;
+
+	-t=*) transformarg=`echo $1 | sed 's/-t=//'`
+	    shift
+	    continue;;
+
+	-b=*) transformbasename=`echo $1 | sed 's/-b=//'`
+	    shift
+	    continue;;
+
+	*)  if [ x"$src" = x ]
+	    then
+		src=$1
+	    else
+		# this colon is to work around a 386BSD /bin/sh bug
+		:
+		dst=$1
+	    fi
+	    shift
+	    continue;;
+    esac
+done
+
+if [ x"$src" = x ]
+then
+	echo "install:	no input file specified"
+	exit 1
+else
+	:
+fi
+
+if [ x"$dir_arg" != x ]; then
+	dst=$src
+	src=""
+	
+	if [ -d $dst ]; then
+		instcmd=:
+		chmodcmd=""
+	else
+		instcmd=$mkdirprog
+	fi
+else
+
+# Waiting for this to be detected by the "$instcmd $src $dsttmp" command
+# might cause directories to be created, which would be especially bad 
+# if $src (and thus $dsttmp) contains '*'.
+
+	if [ -f $src -o -d $src ]
+	then
+		:
+	else
+		echo "install:  $src does not exist"
+		exit 1
+	fi
+	
+	if [ x"$dst" = x ]
+	then
+		echo "install:	no destination specified"
+		exit 1
+	else
+		:
+	fi
+
+# If destination is a directory, append the input filename; if your system
+# does not like double slashes in filenames, you may need to add some logic
+
+	if [ -d $dst ]
+	then
+		dst="$dst"/`basename $src`
+	else
+		:
+	fi
+fi
+
+## this sed command emulates the dirname command
+dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'`
+
+# Make sure that the destination directory exists.
+#  this part is taken from Noah Friedman's mkinstalldirs script
+
+# Skip lots of stat calls in the usual case.
+if [ ! -d "$dstdir" ]; then
+defaultIFS='
+	'
+IFS="${IFS-${defaultIFS}}"
+
+oIFS="${IFS}"
+# Some sh's can't handle IFS=/ for some reason.
+IFS='%'
+set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'`
+IFS="${oIFS}"
+
+pathcomp=''
+
+while [ $# -ne 0 ] ; do
+	pathcomp="${pathcomp}${1}"
+	shift
+
+	if [ ! -d "${pathcomp}" ] ;
+        then
+		$mkdirprog "${pathcomp}"
+	else
+		:
+	fi
+
+	pathcomp="${pathcomp}/"
+done
+fi
+
+if [ x"$dir_arg" != x ]
+then
+	$doit $instcmd $dst &&
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else : ; fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else : ; fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else : ; fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else : ; fi
+else
+
+# If we're going to rename the final executable, determine the name now.
+
+	if [ x"$transformarg" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		dstfile=`basename $dst $transformbasename | 
+			sed $transformarg`$transformbasename
+	fi
+
+# don't allow the sed command to completely eliminate the filename
+
+	if [ x"$dstfile" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		:
+	fi
+
+# Make a temp file name in the proper directory.
+
+	dsttmp=$dstdir/#inst.$$#
+
+# Move or copy the file name to the temp name
+
+	$doit $instcmd $src $dsttmp &&
+
+	trap "rm -f ${dsttmp}" 0 &&
+
+# and set any options; do chmod last to preserve setuid bits
+
+# If any of these fail, we abort the whole thing.  If we want to
+# ignore errors from any of these, just make sure not to ignore
+# errors from the above "$doit $instcmd $src $dsttmp" command.
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else :;fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else :;fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else :;fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else :;fi &&
+
+# Now rename the file to the real destination.
+
+	$doit $rmcmd -f $dstdir/$dstfile &&
+	$doit $mvcmd $dsttmp $dstdir/$dstfile 
+
+fi &&
+
+
+exit 0

knockd.conf

@@ -0,0 +1,15 @@
+[options]
+	logfile = /var/log/knockd.log
+
+[openSSH]
+	sequence    = 7000,8000,9000
+	seq_timeout = 5
+	command     = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
+	tcpflags    = syn
+
+[closeSSH]
+	sequence    = 9000,8000,7000
+	seq_timeout = 5
+	command     = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
+	tcpflags    = syn
+

src/knock.c

@@ -0,0 +1,166 @@
+/*
+ *  knock.c
+ * 
+ *  Copyright (c) 2004-2005 by Judd Vinet <jvinet@zeroflux.org>
+ * 
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, 
+ *  USA.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <netdb.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <string.h>
+#include <resolv.h>
+#include <getopt.h>
+#include <fcntl.h>
+
+static char version[] = "0.5";
+
+#define PROTO_TCP 1
+#define PROTO_UDP 2
+
+/* function prototypes */
+void vprint(char *fmt, ...);
+void ver();
+void usage();
+
+int o_verbose = 0;
+int o_udp     = 0;
+
+int main(int argc, char** argv)
+{
+	int sd;
+	struct hostent* host;
+	struct sockaddr_in addr;
+	int opt, optidx = 1;
+	static struct option opts[] =
+	{
+		{"verbose",   no_argument,       0, 'v'},
+		{"udp",       no_argument,       0, 'u'},
+		{"help",      no_argument,       0, 'h'},
+		{"version",   no_argument,       0, 'V'},
+		{0, 0, 0, 0}
+	};
+
+	while((opt = getopt_long(argc, argv, "vuhV", opts, &optidx))) {
+		if(opt < 0) {
+			break;
+		}
+		switch(opt) {
+			case 0:   break;
+			case 'v': o_verbose = 1; break;
+			case 'u': o_udp = 1; break;
+			case 'V': ver();
+			case 'h': /* fallthrough */
+			default: usage();
+		}
+	}
+	if((argc - optind) < 2) {
+		usage();
+	}
+
+	host = gethostbyname(argv[optind++]);
+	if(host == NULL) {
+		fprintf(stderr, "Cannot resolve hostname\n");
+		exit(1);
+	}
+	for(; optind < argc; optind++) {
+		unsigned short port, proto = PROTO_TCP;
+		char *ptr, *arg = strdup(argv[optind]);
+
+		if((ptr = strchr(arg, ':'))) {
+			*ptr = '\0';
+			port = atoi(arg);
+			arg = ++ptr;
+			if(!strcmp(arg, "udp")) {
+				proto = PROTO_UDP;
+			} else {
+				proto = PROTO_TCP;
+			}
+		} else {
+			port = atoi(arg);
+		}
+		
+		if(o_udp || proto == PROTO_UDP) {
+			sd = socket(PF_INET, SOCK_DGRAM, 0); 
+			if(sd == -1) {
+				fprintf(stderr, "Cannot open socket\n");
+				exit(1);
+			}
+		} else {
+			int flags;
+			sd = socket(PF_INET, SOCK_STREAM, 0); 
+			if(sd == -1) {
+				fprintf(stderr, "Cannot open socket\n");
+				exit(1);
+			}
+			flags = fcntl(sd, F_GETFL, 0);
+			fcntl(sd, F_SETFL, flags | O_NONBLOCK);
+		}
+		memset(&addr, 0, sizeof(addr));
+		addr.sin_family = AF_INET;
+		addr.sin_addr.s_addr = *((long*)host->h_addr_list[0]);
+		addr.sin_port = htons(port);
+		if(o_udp || proto == PROTO_UDP) {
+			vprint("hitting udp %s:%u\n", inet_ntoa(addr.sin_addr), port);
+			connect(sd, (struct sockaddr*)&addr, sizeof(struct sockaddr));
+			send(sd, NULL, 0, MSG_DONTWAIT);
+		} else {
+			vprint("hitting tcp %s:%u\n", inet_ntoa(addr.sin_addr), port);
+			connect(sd, (struct sockaddr*)&addr, sizeof(struct sockaddr));
+		}
+		close(sd);
+	}
+
+	return(0);
+}
+
+void vprint(char *fmt, ...)
+{
+	va_list args;
+	if(o_verbose) {
+		va_start(args, fmt);
+		vprintf(fmt, args);
+		va_end(args);
+		fflush(stdout);
+	}
+}
+
+void usage() {
+	printf("usage: knock [options] <host> <port[:proto]> [port[:proto]] ...\n");
+	printf("options:\n");
+	printf("  -u, --udp            make all ports hits use UDP (default is TCP)\n");
+	printf("  -v, --verbose        be verbose\n");
+	printf("  -V, --version        display version\n");
+	printf("  -h, --help           this help\n");
+	printf("\n");
+	printf("example:  knock myserver.example.com 123:tcp 456:udp 789:tcp\n");
+	printf("\n");
+	exit(1);
+}
+
+void ver() {
+	printf("knock %s\n", version);
+	printf("Copyright (C) 2004-2005 Judd Vinet <jvinet@zeroflux.org>\n");
+	exit(0);
+}
+
+/* vim: set ts=2 sw=2 noet: */

src/list.c

@@ -0,0 +1,248 @@
+/*
+ *  list.c
+ * 
+ *  Copyright (c) 2002-2005 by Judd Vinet <jvinet@zeroflux.org>
+ * 
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, 
+ *  USA.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include "list.h"
+
+PMList* list_new()
+{
+	PMList *list = NULL;
+	
+	list = (PMList*)malloc(sizeof(PMList));
+	if(list == NULL) {
+		return(NULL);
+	}
+	list->data = NULL;
+	list->prev = NULL;
+	list->next = NULL;
+	return(list);
+}
+
+void list_free(PMList *list)
+{
+	if(list == NULL) {
+		return;
+	}
+	if(list->data != NULL) {
+		free(list->data);
+		list->data = NULL;
+	}
+	if(list->next != NULL) {
+		list_free(list->next);
+	}
+	free(list);
+	return;
+}
+
+PMList* list_add(PMList *list, void *data)
+{
+	PMList *ptr, *lp;
+
+	ptr = list;
+	if(ptr == NULL) {
+		ptr = list_new();
+	}
+
+	lp = list_last(ptr);
+	if(lp == ptr && lp->data == NULL) {
+		/* nada */
+	} else {
+		lp->next = list_new();
+		if(lp->next == NULL) {
+			return(NULL);
+		}
+		lp->next->prev = lp;
+		lp = lp->next;
+	}
+	lp->data = data;
+	return(ptr);
+}
+
+PMList* list_remove(PMList* list, void* data)
+{
+	PMList *ptr, *lp;
+
+	ptr = list;
+
+	for(lp = list; lp; lp = lp->next) {
+		if(lp->data == data) {
+			if(lp->prev != NULL) {
+				lp->prev->next = lp->next;
+			}
+			if(lp->next != NULL) {
+				lp->next->prev = lp->prev;
+			}
+			/* test if we just removed the head */
+			if(lp == ptr) {
+				ptr = lp->next;
+			}
+		}
+	}
+	return ptr;
+}
+
+int list_count(PMList *list)
+{
+	int i;
+	PMList *lp;
+
+	for(lp = list, i = 0; lp; lp = lp->next, i++);
+	return(i);
+}
+
+int list_isin(PMList *haystack, void *needle)
+{
+	PMList *lp;
+
+	for(lp = haystack; lp; lp = lp->next) {
+		if(lp->data == needle) {
+			return(1);
+		}
+	}
+	return(0);
+}
+
+/* Test for existence of a string in a PMList
+ */
+int is_in(char *needle, PMList *haystack)
+{
+	PMList *lp;
+
+	for(lp = haystack; lp; lp = lp->next) {
+		if(lp->data && !strcmp(lp->data, needle)) {
+			return(1);
+		}
+	}
+	return(0);
+}
+
+/* List one is extended and returned
+ */
+PMList* list_merge(PMList *one, PMList *two)
+{
+	PMList *lp, *ptr;
+
+	if(two == NULL) {
+		return one;
+	}
+
+	ptr = one;
+	if(ptr == NULL) {
+		ptr = list_new();
+	}
+
+	for(lp = two; lp; lp = lp->next) {
+		if(lp->data) {
+			ptr = list_add(ptr, lp->data);
+			lp->data = NULL;
+		}
+	}
+
+	return(ptr);
+}
+
+PMList* list_last(PMList *list)
+{
+	PMList *ptr;
+
+	for(ptr = list; ptr && ptr->next; ptr = ptr->next);
+	return(ptr);
+}
+
+/* Helper function for sorting a list of strings
+ */
+int list_strcmp(const void *s1, const void *s2)
+{
+	char **str1 = (char **)s1;
+	char **str2 = (char **)s2;
+
+	return(strcmp(*str1, *str2));
+}
+
+PMList *list_sort(PMList *list)
+{
+	char **arr = NULL;
+	PMList *lp;
+	unsigned int arrct;
+	int i;
+
+	if(list == NULL) {
+		return(NULL);
+	}
+
+	arrct = list_count(list);
+	arr = (char **)malloc(arrct*sizeof(char*));
+	for(lp = list, i = 0; lp; lp = lp->next) {
+		arr[i++] = (char *)lp->data;
+	}
+
+	qsort(arr, (size_t)arrct, sizeof(char *), list_strcmp);
+
+	lp = NULL;
+	for(i = 0; i < arrct; i++) {
+		lp = list_add(lp, strdup(arr[i]));
+	}
+
+	if(arr) {
+		free(arr);
+		arr = NULL;
+	}
+
+	return(lp);
+}
+
+void list_display(const char *title, PMList *list)
+{
+	PMList *lp;
+	int cols, len, maxcols = 80;
+	char *cenv = NULL;
+
+	cenv = getenv("COLUMNS");
+	if(cenv) {
+		maxcols = atoi(cenv);
+	}
+
+	len = strlen(title);
+	printf("%s ", title);
+
+	if(list) {
+		for(lp = list, cols = len; lp; lp = lp->next) {
+			int s = strlen((char*)lp->data)+1;
+			if(s+cols >= maxcols) {
+				int i;
+				cols = len;
+				printf("\n");
+				for (i = 0; i < len+1; i++) {
+					printf(" ");
+				}
+			}
+			printf("%s ", (char*)lp->data);
+			cols += s;
+		}
+		printf("\n");
+	} else {
+		printf("None\n");
+	}
+}
+
+/* vim: set ts=2 sw=2 noet: */

src/list.h

@@ -0,0 +1,48 @@
+/*
+ *  list.h
+ * 
+ *  Copyright (c) 2002-2005 by Judd Vinet <jvinet@zeroflux.org>
+ * 
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, 
+ *  USA.
+ */
+#ifndef _PAC_LIST_H
+#define _PAC_LIST_H
+
+#define FREELIST(p) { list_free(p); p = NULL; }
+
+/* your average linked list */
+typedef struct __pmlist_t {
+	void*   data;
+	struct __pmlist_t* prev;
+	struct __pmlist_t* next;
+} PMList;
+
+PMList* list_new();
+void list_free(PMList* list);
+PMList* list_add(PMList* list, void* data);
+PMList* list_remove(PMList* list, void* data);
+int list_count(PMList* list);
+int list_isin(PMList *haystack, void *needle);
+int is_in(char *needle, PMList *haystack);
+PMList* list_merge(PMList *one, PMList *two);
+PMList* list_last(PMList* list);
+int list_strcmp(const void *s1, const void *s2);
+PMList *list_sort(PMList *list);
+void list_display(const char *title, PMList *list);
+
+#endif
+
+/* vim: set ts=2 sw=2 noet: */