#!/bin/bash
#
# Script: mjact_knocker
#
# Usage: mjact_knocker add
#
# Description: A tool for adding nftables port knocking sequences and generating
#              archives with knock scripts for Windows, macOS and Linux
#
# Author: Nikita Shchetinin
#
# Changelog:
# * 13.04.2021: Nikita Shchetinin
# - Initial write
# * 26.01.2023: Nikita Shchetinin
# - Switch to TCP to improve compatibility
# * 22.02.2024: Nikita Shchetinin
# - Added an option to generate a UDP script
# * 07.05.2026: Paul Bernal
# - Refactored to use nftables port-knocking instead of knockd
# - Removed knockd dependency
# - Server-side sequences managed via /etc/nftables/port_knocking/
# - 07.16.2026: Martins Adlaedio
# - Add (-f) flag to the hostname command.
# - 07.22.2026: Matias Eberhardt
# - Add delay flag (-d) to the knock command.

NFT_SEQ_DIR="/etc/nftables/port_knocking"

if [ "$(whoami)" != 'root' ]
then
        echo "You must execute this script as the root user!"
        exit 1
fi

ADD () {
        hostname=$(hostname -f)
        serverip=$(ip addr show eth0 | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | head -n1)
        if [ -z "$serverip" ]; then
                serverip=$(ip addr show | grep bond0 | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | head -n1)
        fi
        if [ -z "$serverip" ]; then
                read -p "Cannot determine server IP. Please enter it: " serverip
        fi
        date=$(date +%F)
        port1=$(</dev/urandom tr -dc 1-9 | head -c4)
        port2=$(</dev/urandom tr -dc 1-9 | head -c4)
        port3=$(</dev/urandom tr -dc 1-9 | head -c4)
        htpasswd_user=$(</dev/urandom tr -dc A-Za-z | head -c5)
        htpasswd_password=$(</dev/urandom tr -dc A-Za-z0-9 | head -c16)

        # Write and load nftables sequence
        SEQ_FILE="${NFT_SEQ_DIR}/seq_${port1}_${htpasswd_user}_${date}.nft"
        cat > "${SEQ_FILE}" <<EOF
# User: ${htpasswd_user} | Date: ${date}
add rule inet port_knocking input tcp dport ${port1} add @stage1 { ip saddr timeout 10s } drop
add rule inet port_knocking input ip saddr @stage1 tcp dport ${port2} add @stage2 { ip saddr timeout 10s } drop
add rule inet port_knocking input ip saddr @stage2 tcp dport ${port3} add @authorized { ip saddr timeout 24h } drop
EOF
        nft -f "${SEQ_FILE}"
        if [ $? -ne 0 ]; then
                echo "Failed to load nftables sequence. Check ${SEQ_FILE}."
                exit 1
        fi

        # Generate client scripts
        mkdir -p /home/httpd/html/files
        rm -rf /home/httpd/html/files/*
        mkdir -p /home/httpd/html/files/knocker/win
        mkdir -p /home/httpd/html/files/knocker/mac
        mkdir -p /home/httpd/html/files/knocker/linux

        echo "Options -Indexes
AuthName \"Restricted Area\"
AuthType Basic
AuthUserFile /home/httpd/html/files/.htpasswd
Require valid-user" > /home/httpd/html/files/.htaccess
        htpasswd -bc /home/httpd/html/files/.htpasswd $htpasswd_user $htpasswd_password > /dev/null 2>&1
        # Windows
        wget -q -O /home/httpd/html/files/knocker/win/knock.exe https://mjgit.mojohost.com/mojohost-production/public_files/raw/master/knockd/knock.exe
        echo "knock.exe -v $hostname $port1 $port2 $port3 -d 1000" > /home/httpd/html/files/knocker/win/knocker.bat
        # Mac
        wget -q -O /home/httpd/html/files/knocker/mac/knock https://mjgit.mojohost.com/mojohost-production/public_files/raw/master/knockd/knock
        echo "./knock -v $hostname $port1 $port2 $port3 -d 1000" > /home/httpd/html/files/knocker/mac/knocker.sh
        # Linux
        echo "knock -v $hostname $port1 $port2 $port3 -d 1000" > /home/httpd/html/files/knocker/linux/knocker.sh
        # Pack them up
        chmod -R 755 /home/httpd/html/files/knocker
        cd /home/httpd/html/files && zip -qr knocker.zip knocker
        rm -rf /home/httpd/html/files/knocker
        echo "An archive with knock scripts for all the major operating systems is available at https://$hostname/files/knocker.zip"
        echo "User: $htpasswd_user"
        echo "Password: $htpasswd_password"
        echo "To use the scripts, please uncompress the archive and run knocker.ps1 (Windows), or knocker.sh (macOS/Linux)"
}

HELP () {
echo "A tool for adding nftables port knocking sequences and generating archives with knock scripts"
echo "usage: mjact_knocker add"
}

if [ "$1" == "add" ]
then
    ADD
else
    HELP
fi