feat: implement the knock-cli

knock-cli/Cargo.toml

@@ -7,3 +7,5 @@ edition = "2021"
 
 [dependencies]
 clap = { version = "4.5.1", features = ["derive"] }
+serde = { version = "1.0.197", features = ["derive"] }
+serde_yaml = "0.9.32"

knock-cli/config.yaml

@@ -0,0 +1,15 @@
+rules:
+  - name: "enable_ssh"
+    host: "example.com"
+    sequence:
+      - 12345
+      - 54321
+      - 32768
+      - 18933
+  - name: "disable_ssh"
+    host: "example.com"
+    sequence:
+      - 18933
+      - 32768
+      - 54321
+      - 12345

knock-cli/src/config/config.rs

@@ -0,0 +1,15 @@
+extern crate serde;
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Rule {
+    pub name: String,
+    pub host: String,
+    pub sequence: Vec<i32>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct Config {
+    pub rules: Vec<Rule>,
+}

knock-cli/src/config/mod.rs

@@ -0,0 +1,28 @@
+use std::fs::File;
+use std::io::Read;
+
+pub use config::Config;
+pub use config::Rule;
+pub mod config;
+
+pub fn load_config(path: &str) -> Result<Config, Box<dyn std::error::Error>> {
+    let mut file = File::open(path)?;
+    let mut content = String::new();
+
+    file.read_to_string(&mut content)?;
+    let config: Config = serde_yaml::from_str(&content)?;
+
+    Ok(config)
+}
+
+// test case for load_config
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_load_config() {
+        let config = load_config("config.yaml").unwrap();
+        assert_eq!(config.rules.len(), 2);
+    }
+}

knock-cli/src/main.rs

@@ -1,5 +1,8 @@
 use clap::Parser;
 
+mod config;
+mod rule;
+
 #[derive(Parser, Debug)]
 #[command(version = env!("VERSION"), about, long_about = "A port knocking console application written in Rust")]
 struct Args {
@@ -13,7 +16,6 @@ struct Args {
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let args = Args::parse();
-
     let rule = match args.rule {
         Some(rule) => rule,
         None => {
@@ -22,7 +24,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         }
     };
 
-    println!("rule: {}", rule);
+    let config = config::load_config(&args.config)?;
+    let executor = rule::RuleExecutor::new(config);
+    executor.run(&rule)?;
 
     Ok(())
 }

knock-cli/src/rule.rs

@@ -0,0 +1,44 @@
+use crate::config::Config;
+use crate::config::Rule;
+use std::collections::HashMap;
+use std::net::{SocketAddr, TcpStream, ToSocketAddrs};
+use std::time::Duration;
+
+pub struct RuleExecutor {
+    rules: HashMap<String, Rule>,
+}
+
+impl RuleExecutor {
+    pub fn new(config: Config) -> RuleExecutor {
+        let mut rules = HashMap::new();
+        for rule in config.rules {
+            rules.insert(rule.name.clone(), rule);
+        }
+
+        RuleExecutor { rules }
+    }
+
+    pub fn run(&self, name: &str) -> Result<(), Box<dyn std::error::Error>> {
+        if let Some(rule) = self.rules.get(name) {
+            println!("Executing rule: {}", rule.name);
+            // Iterate over the ports and attempt to connect to each
+            for port in rule.sequence.iter() {
+                let address = format!("{}:{}", rule.host, port);
+                let addr: Vec<SocketAddr> = address.to_socket_addrs()?.collect();
+                println!("knocking at: {:?}", addr);
+
+                // Attempt to connect to the target IP and port
+                if let Ok(stream) = TcpStream::connect_timeout(&addr[0], Duration::from_millis(100))
+                {
+                    drop(stream);
+                }
+            }
+        } else {
+            println!("Rule not found: {}", name);
+            return Ok(());
+        }
+
+        println!("Rule execution complete.");
+        Ok(())
+    }
+}

knockd/config.yaml

@@ -1,19 +1,19 @@
 interface: "enp3s0"
 timeout: 5
 rules:
-  - name: "Enable SSH"
+  - name: "enable_ssh"
     command: "/usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT"
     sequence:
       - 15523
       - 17767
       - 32768
       - 28977
       - 51234
-  - name: "Disable SSH"
+  - name: "disable_ssh"
     command: "/usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT"
     sequence:
       - 51234
       - 28977
       - 32768
       - 17767
-      - 15523
+      - 15523