pkpoc-bpf | Stateful packet processing : port knocking PoC in BPF

pkpoc-bpf is a Python library. pkpoc-bpf has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. However pkpoc-bpf build file is not available. You can download it from GitHub.

Port knocking is a port obfuscation measure that consists in a secret sequence of “knocks” which have to be transmitted to a server before the latter opens a given port, usually SSH, for the client. Here the experiment creates two network namespaces, a client and a server. The client wants to reach a given server port, here TCP port 9922. It sends the packets of the secret sequence but, before those packets reach the network, they are caught by an eBPF filter installed on the tc (Linux traffic control) hook of the interface. The port knocking occurs at this level: thanks to tables, eBPF can implement the OpenState layer and provide stateful processing for the flow. So if the client sends the correct sequence of packets, the state is set to OPEN and the server sees traffic on its port 9922. Otherwise, all packets are dropped at the client's interface. The idea behind this PoC is to explore eBPF's stateful capabilities, and to integrate it, at a later stage, in a BPF version of a full BEBA switch.