[sslh] Port Knocking for SSLH

[ondra+sslh at mistotebe.net]

On Mon, Sep 16, 2013 at 11:36:07AM +0200, Kai wrote:
> Hello all,
> 
> I guess it is not implemented but I have the following question of a
> feature that might be interesting to implement:
> 
> There is something called Port Knocking where I can for example
> access the SSH port after I knocked on another port before.
> 
> My question is now whether and how it would be possible to implement
> this in SSLH.

You could have a probe that checks the remote host's address against a
database that is populated when you perform the handshake. The
complexity of that would depend on what kind of database that is and the
amount of traffic you'd expect sslh to handle.

Current probe design does not allow for asynchronous probes, but
implementing that should not be that hard in the libevent-based
implementation I just drafted yesterday. Nevertheless, implementation of
a moderately sophisticated probe could easily surpass the size of sslh
as it stands.

Cheers,
Ondrej