Skip to content

CMD_CYCLE_OPEN for multiple ports #327

@EDEADLINK

Description

@EDEADLINK

I am using CMD_CYCLE_OPEN to make fwknopd play nice with nftables,
like so:

CMD_CYCLE_TIMER     30s
CMD_CYCLE_OPEN      /usr/sbin/nft add element inet filter fwknop_allow { $IP . $PROTO . $PORT timeout 30s expires 30s }
CMD_CYCLE_CLOSE     __NONE__

and for a single port this works fine.
But if I use -A tcp/22,udp/60000 or similar the open command is only run for the first port i.e. tcp/22.
I was expecting CMD_CYCLE_OPEN to be executed once for every port in the protocol/port list.

Using -T it looks like it sends the list correctly
Message String: <redacted ip>,tcp/22,udp/60000

The server is running fwknopd 2.6.10

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions