[Bug 273860] security/knock does not open port anymore on freebsd 13.2

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273860

            Bug ID: 273860
           Summary: security/knock does not open port anymore on freebsd
                    13.2
           Product: Ports & Packages
           Version: Latest
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: Individual Port(s)
          Assignee: sbz@FreeBSD.org
          Reporter: zero1@zaclys.net
             Flags: maintainer-feedback?(sbz@FreeBSD.org)
          Assignee: sbz@FreeBSD.org

Hi,

knock doesn't work on 13.2,  it's like it isn't triggered or doesn't received
the signal, yet tcpdump shows the packets received from the client sent via
security/knock.
The firewall doesn't seem involved because I tried with pf or ipfw but in vain
the result is the same. 
Meanwhile on Freebsd 12.4 security/knock works just fine, so the problem is
coming from 13.2.

Just in case, I put the link of the forum's thread that talks about it.
https://forums.freebsd.org/threads/the-knock-of-amd64-freebsd-cannot-listen-for-information.90272/


Freebsd 12.4 as client
root@fbsd12 ~ : freebsd-version ; uname -asm
12.4-RELEASE-p5
FreeBSD fbsd12 12.4-RELEASE-p5 FreeBSD 12.4-RELEASE-p5 GENERIC  amd64
root@fbsd12 ~ : ifconfig vtnet0 | grep inet
        inet 192.168.2.172 netmask 0xffffff00 broadcast 192.168.2.255
root@fbsd12 ~ : knock -v 192.168.2.173 7000:tcp 8000:tcp 9000:tcp
hitting tcp 192.168.2.173:7000
hitting tcp 192.168.2.173:8000
hitting tcp 192.168.2.173:9000
root@fbsd12 ~ : nmap -p 22 192.168.2.173 | grep ssh
22/tcp filtered ssh

Freebsd 13.2 as serveur
root@fbsd13 ~ :  freebsd-version ; uname -asm
13.2-RELEASE-p3
FreeBSD fbsd13 13.2-RELEASE-p3 FreeBSD 13.2-RELEASE-p3 GENERIC amd64

root@fbsd13 ~ : ifconfig vtnet0 | grep inet
        inet 192.168.2.173 netmask 0xffffff00 broadcast 192.168.2.255

root@fbsd13 ~ : cat /var/log/knockd.log
[2023-09-16 18:42:56] starting up, listening on vtnet0

root@fbsd13 ~ : tcpdump -n -t -i vtnet0 tcp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vtnet0, link-type EN10MB (Ethernet), capture size 262144 bytes
IP 192.168.2.172.64594 > 192.168.2.173.7000: Flags [S], seq 3144177609, win
65535, options [mss 1460,nop,wscale 6,sackOK,TS val 3683868432 ecr 0], length 0
IP 192.168.2.172.26006 > 192.168.2.173.8000: Flags [S], seq 2244267204, win
65535, options [mss 1460,nop,wscale 6,sackOK,TS val 1283481177 ecr 0], length 0
IP 192.168.2.172.57766 > 192.168.2.173.9000: Flags [S], seq 233451712, win
65535, options [mss 1460,nop,wscale 6,sackOK,TS val 2416705257 ecr 0], length 0
^C
3 packets captured
10 packets received by filter
0 packets dropped by kernel


Looking at the /var/log/knockd.log there is nothing expect when the service is
stopped or started and the port 22 remains closed.


Now if I invert the role meaning using freebsd 12.4 as server and freebsd 13.2
as client everything works.
Note that I've used the same exact knockd config file in both case.

root@fbsd13 ~ : knock -v 192.168.2.172 7000:tcp 8000:tcp 9000:tcp
hitting tcp 192.168.2.172:7000
hitting tcp 192.168.2.172:8000
hitting tcp 192.168.2.172:9000
root@fbsd13 ~ : nmap -p 22 192.168.2.172 | grep ssh
22/tcp open  ssh

root@fbsd12 ~ : tail -f /var/log/knockd.log
[2023-09-16 19:32:59] 192.168.2.173: openSSH: Stage 1
[2023-09-16 19:32:59] 192.168.2.173: openSSH: Stage 2
[2023-09-16 19:32:59] 192.168.2.173: openSSH: Stage 3
[2023-09-16 19:32:59] 192.168.2.173: openSSH: OPEN SESAME
[2023-09-16 19:32:59] openSSH: running command: /sbin/ipfw -q add 95 allow
proto tcp src-ip 192.168.2.173 dst-port 22


I hope I gave you enough information.  
Thank you in advance.

-- 
You are receiving this mail because:
You are the assignee for the bug.