% Chapter about TCP/IP, used protocols and common firewall types
%

\section{Introduction to Firewalls} 
\subsection{Network security}

The need for network communication is large, and seems to be growing
if judging the ever growing numbers of connected hosts to the
Internet, the largest worldwide network. However this also
means that the issue of security is becoming very important,
as the number of hosts implies that the number of potential intrusions 
will increase as more people start using the net.
 
However, some means of controlling access to computers are already
present with special programs called `firewalls', an old fire-fighting
term for controlling damage when a fire has erupted.

To understand how a firewall works, a good understanding
of TCP/IP stack and the internal workings of Unix is needed. In
order for a computer to be connected to the Internet, it
has to have an IP address, so that packets can be sent to and received
from the correct computer. 
 
All current IP addresses are in what is called the decimal dotted
notation, which are four decimal numbers separated by dots.
For example 192.139.234.102 is an IP address in the dotted notation.
An IP address can also be stated in hex, the above address would
then be 0xC08BEA66, but this notation is more common in the internal
workings of the networking code. The IP addresses are classified
in five different classes, A, B, C, D and E class. E is reserved and
not normally used. The D is a multicast\footnote{Multicast is when one shared address is 
used to send data to several hosts.} address and is not used to specify a 
single host. One can easily see the class of an address by looking at the high order 
bits of the address, a class A address starts
with 0, B starts with 1, C starts with 11, D starts with 111 and E with 1111.
This corresponds to the ranges in Table~\ref{tab:IP}.

\begin{table}[h]
\begin{center}
\begin{tabular}{|c|c|c|c|} \hline
\emph{Class} & \emph{Range} & \emph{Net Id bits} & \emph{Host Id bits}\\
\hline\hline
A & 0.0.0.0 to 127.255.255.255 & 7 & 24 \\ 
B & 128.0.0.0 to 191.255.255.255 & 14 & 16 \\
C & 192.0.0.0 to 223.255.255.255 & 21 & 8 \\
D & 224.0.0.0 to 239.255.255.255 & 28 & N/A\\
E & 240.0.0.0 to 247.255.255.255 & N/A & N/A\\
\hline
\end{tabular}
\caption{Ranges of IP classes}
\label{tab:IP}
\end{center}
\end{table}

The difference in the classes is the number of network and host id bits.
The 7 bits of network id of class A restricts
the number of available class A networks, and thus only very large 
organizations may have A type addresses. The B type addresses have been the most
popular for medium to large size organizations as it allows the number
of hosts to grow beyond the effective maximum number of hosts of 
253 allowed by type C addresses\footnote
{As the host ID is 8bits, 256 hosts can be addressed. A host id
of 0 is reserved to mean the network and cannot be used. 
255 is reserved for the broadcast id and cannot either be used. 
The `way out' through the default router takes up one address. On UCCS
the router is at 128.198.x.254. This leaves a total of 253 hosts.}.
Because of its popularity, the type B address is almost `sold out'. 
UCCS uses a B address of 128.198.x.y, where `x' is the subnet and `y'
is the host. Section~\ref{sec:router} discusses the subnet term.
 
Since the addresses are running out, several propositions of
how the next format sometimes called IPng as in IP Next Generation\footnote{
I guess some of the authors are fans of Star Trek!} of IP addresses
are currently examined. As always when changing format, difficulties
will arise before all the hosts on the Internet will recognize
the new format.
 
When TCP/IP was designed, a very limited number of hosts were
coupled, and nobody thought Internet would grow the way it has
done. Thus Unix (which is the primary OS of Internet connected
hosts) is designed to allow several users at the same time to make the
cost per user as small as possible. All normal operations of a Unix computer
can be done by remote, but this becomes today a security risk, as a user who might
be on the other side of the world may be able to break in and steal information.
 
When the security increases, the performance of the system may
degrade.
There is a tradeoff between usability and security, 
as it will be more difficult to log into a computer
from `outside' of the firewall.

 
\subsection{How is a break-in achieved ?}

 
A break-in to a computer is done by finding a valid login/password
combination to a computer. This can be done in several ways: exploiting
bugs in existing code, cracking the password file, or IP spoofing\footnote 
{IP spoofing is when a computer claims to be another one by using a trusted
IP address of another computer, and thus gaining access to another
computer. Discussed in Section~\ref{sec:ip-spoofing}.}

Once a password file is found on a system, there are several programs
that can be used to guess the login/password file. 
Studies indicate that users tend to choose passwords that are easily remembered
like words or names. The password cracking programs take advantage
of this as they use word lists when guessing the passwords. Studies
indicate that 10-20\% of all passwords are easily cracked within
a few hours!\cite{wall:cheswick}

The primary goal of the intruder is often to crack
the `root' password. The `root' user of a Unix system is the system administrator,
who has total control over the computers in the local network. However, the goal
might just be to read an important directory. In that case it is
sufficient to crack the password of a user who has access to the directory.
 

 
\subsection{How will a Firewall help ?}
 

Firewall is slightly misleading, as a `real' firewall will stop
fire in either direction, whereas a computerized firewall will
behave like one-way street. Traffic should thus be able to go
though the firewall, but incoming traffic is thoroughly examined.
 
As traffic though the firewall is monitored, illegal attempts
to log into computers `behind' or `inside' the firewall will
be much more difficult than without a firewall.
 
To achieve maximum security, it is advisable that several firewalls
are installed. This is sometimes hard to do as this would mean
that the actual physical network has to be rewired. This is the
case here at UCCS, if firewalls are to be installed for each department,
large parts of the cables has to be rewired.
 
\section{How a firewall works}

Unfortunately almost everything that enhances the network security is called 
a firewall, which means that when two people are talking about firewalls
they are not necessarily talking about the same thing.
 
However, the two main classes of firewalls are the packet 
filter firewall and the proxying firewall.~\cite{wall:chapman}.

\subsection{Packet filter firewall}
\label{sec:pf}
A packet filter is a special router or a program that examines the IP packets 
received and decides if packets are to be forwarded by checking a set
of rules that specify what is to happen with the packet. The good thing about packet
filters is that it is transparent to the user and the applications.
All current software can be used without modifications, but
the firewall manager must know a great deal about the installed software of the
system in order to set up rules for the filter in order to keep the software
running. The default rule is usually to reject everything that
is not explicitly specified to be allowed to pass. The default
rule might also be to allow everything to pass except the packets that
are explicitly set to be denied, but in that case the firewall is easily bypassed.
 
A \emph{simple packet filter}, or PF for short, 
only checks the sender/receiver of the packet,
and what type of  protocol is used, but it does not usually check
the TCP connections status flags, nor can it check UDP packets
on the fly. The TCP flags are used to allow incoming calls \textbf{after}
the host on the inside of the packet filter has started the conversation. This is hard
to do with UDP since it is connectionless.

A packet filter that checks all outgoing TCP and UDP packets and only allows 
incoming packets to the same port is called a \emph{dynamic packet filter}, 
hereafter called DPF.
 
\subsection{Proxy firewalls}
\label{sec:proxy}
A proxying firewall is an intermediate server that both the internal
and external host talk to. The user thinks he is using the external
host directly, but everything is relayed through the proxy host.

The disadvantage with a proxying firewall is that all the existing
software has to be modified in order to be able to access the outer
side of the firewall. One of the more known proxy services is called
SOCKS, and new software usually have support for SOCKS. One of the more
popular programs that supports SOCKS is the web browser Netscape~\cite{http:socks_faq}.
However, most software packages that come with most Unix distributions do not support
SOCKS at this point.

The SOCKS manufacturer usually delivers a dynamically linked shared library which
makes all the network programs aware of SOCKS. However it is not certain that the 
system uses shared libraries at all, and in that case all applications has to be
recompiled with the new library. It is a major task to compile and then make sure
that all hosts on the network has the correct version installed.

Figure~\ref{fig:socks} shows the server and client model of SOCKS, where the
client is sandwiched between the transport and application layer of the TCP/IP 
protocol stack, and the proxy server is running as an application on the server. 
The actual server does not need any modifications.

\begin{figure}[h]
  \epsfig{figure=socks.eps,width=15cm}
  \caption{SOCKS at work}
  \label{fig:socks}
\end{figure}
 
\subsection{Screening routers}
A screening router is either a special piece of hardware that has two or more ethernet 
devices attached to it, or a computer with two or more ethernet devices.
If the screening router is a hardware device, configuration software is included 
for maintaining the rules about what packets are allowed to be routed.

If the screening host is a computer, it has to run special software that can do the
same thing as the hardware device can. This software is the packet filter, as
described in Section~\ref{sec:pf}.

The general name of this function is the screening router, but as both actually do
packet filtering I will mainly use the term packet filter.

The rules for setting up both the screening router and a PF generally don't have
the same syntax, but they should be able to do the following:
\begin{itemize}
\item
  Accept a packet from an IP source to an IP destination. It should be possible
  to setup what ports are allowed. It might be useful to be able to set a range
  of accepted ports, or any port. It should also be possible to select what
  protocol is allowed.
\item
  Deny. The same as for Accept but deny the packet to pass.
\item
  Default policy. When no rule applies, this sets the default policy.
\end{itemize}

It is also handy if it is possible to set the rule before or after another rule,
as the order of the rules might determine if the packet is allowed to pass or not.

\subsection{Router or Gateway ?}
\label{sec:router}
There is a lot of confusion about if the term gateway or router should be used.
Both do more or less the same job of forwarding packets from one segment of the
ethernet to another one. A segment is a networking term that means
that hosts are using the same physical media when communicating with
each other. If thin or thick ethernet is used it is especially important
that the network is segmented as packet collisions will otherwise occur when
hosts are trying to send at the same time. Segments are often assigned
different subnet numbers. A subnet is a logical arrangement of the IP 
addresses used. As UCCS uses a type B class IP address of 128.198.x.y, it
makes it easy to use `x' as a subnet and `y' as a host on the subnet.
Routers binds together the segments so that packets can traverse the
entire network.

According to Stevens~\cite{tcp:stevens} the term gateway should be used when
talking about an application gateway that connects two different protocol suites
like TCP/IP and for instance IBM's SNA. The term router should be used when 
forwarding packets between segments. 
I will thus mainly be using the term router, but many of the
Unix diagnostic tools will use the term gateway when they actually mean a router.

Other terms for routers are bridges or repeaters. A bridge or a
repeater is a device that forwards packets between segments. 
The forwarding is usually done in hardware, which means that
\textbf{all} packets are forwarded, even packets that should stay in
the local segment (the packet was to another host on the same
segment). This is also what happens here on UCCS, if a packet reaches
the backbone, it is passed to all computers. The UCCS backbone has
thus (unnecessarily) quite heavy traffic. One simple solution to the
traffic trouble of the backbone is to install \emph{hubs} with twisted
pair ethernet. Unlike thin or thick ethernet, twisted pair can only
connect at most two hosts at the same time. Instead of using the `bus'
architecture of the thin or thick ethernet, the hosts are connected in
a `star' architecture with a hub. By connecting hubs to other hubs, the traffic can
traverse the network. The nice thing about hubs is that if traffic is
between two of the hosts on the same hub, the hub realizes this, and
the traffic never goes out to the backbone.

\begin{figure}[h]
  \epsfig{figure=topology.eps,width=15cm}
  \caption{Network topologies}
  \label{fig:topology}
\end{figure}

Figure~\ref{fig:topology} shows the same number of hosts on two
different network architectures, the bus architecture and the star
architecture. 
In the example there is little to be gained by using the star architecture with hubs.
However, if the network grows, the star topology will scale much better
as a hub will not allow collisions on each segment. Each hub controls
a number of hosts. When more hosts are needed than a single hub can
handle, another hub is bought,
and the new hub is connected to the old hub in another star. The link to
the top central hub is called uplink or downlink (depending on which
direction the traffic is supposed to go). If two hosts on the same hub
are communicating, the hub will not forward the traffic to the up or
down links. The hub thus acts as a router as well. When hubs are
connected, the the up and down links should be kept to a minimum,
i.e., the topology should be as flat as possible. The single host on
the hub in the leftmost bottom is a bad example of how hosts should be
connected. The host should be connected directly to the uplink hub
instead. Perhaps the idea was that the single host should soon be
joined by other hosts.

When scaling up a bus architecture, collisions will eventually occur and network
performance will go down. `Smart' routers can be used on
the bus architecture that will not forward packets blindly like
repeaters or bridges usually do. 

\section{Firewall Architectures}
Usually a firewall uses both packet filters and proxy servers
to achieve maximum security.
 
In Figures~\ref{fig:dual}, \ref{fig:screen} and \ref{fig:peri} some of the most 
common setups are shown. Figure~\ref{fig:dual} shows the dual homed host architecture,
Figure~\ref{fig:screen} shows a screened host setup and finally Figure~\ref{fig:peri} 
shows the perimeter network setup.

The difference between the setups is the amount of extra hardware used, for 
instance screening routers.
By adding screening routers more security is added, but more things have
to be setup. For instance all the screening router rule sets have
to be carefully examined so that normal and allowed traffic can pass the
screening router, and everything else is stopped. 
This sounds easier than it is, as the rules for setting up a screening router are
usually cryptic. 
Also, when new network software is installed on the 
intranet hosts, the rule sets have to be maintained\footnote
{It is quite easy to get conflicts in the rule sets, so one can not
  just add a rule and hope for the best.}. 
The expenses for the extra hardware should be of no concern if enhanced
security is the goal. 

It may be more cost-effective to use a computer and run a PF program
than buying a screening router.
Running a PF program does not usually take that much computing
power so even an older computer may be adequate to carry out the task. 
However, if a DPF is used, the computer may need additional memory as
additional information is stored. 
How much memory will be used is hard to tell, as it depends on the amount
of traffic and how fragmented the packets are. To send a never ending
stream of fragmented packets without sending the first packet to a host running a PF
program can actually make the host to consume all available
memory. 

This has to do with the way the IP packets are split (fragmented) by the IP layer
when the data passed from the TCP or UDP layer is larger than the
maximum size allowed on the device to be used.
When a packet is fragmented, only the IP header is copied to
the new subpackets, not the TCP or UDP header. As the port number is stored in
the TCP or UDP header, a PF has to store all fragments until it gets
the first packet which specifies the receiving port number. If the
first packet never arrives, the memory eventually runs out. This method
of `attack' is called denial of service.
 
\subsection{Dual homed host}
 
The configuration of the dual homed host in Figure~\ref{fig:dual} 
can supply excellent security, if the host used does not allow routing of packets from
the inside to the outside\footnote
{It is important to check this, some Unix versions have routing turned on by default,
and packets that arrive on one of the network devices will be passed to to other.
To be able to use routing of packets in Linux, you must recompile the kernel.}.
To be able to access the other side of the network, 
users must log onto the dual homed host and perform network access from this
computer.

However, this firewall architecture is not transparent to the user, as he has to know
the name of the dual homed host, and have a valid login/password on that computer
to be able to access the outside world.
 
Also, if the host is compromised, all intranet hosts are wide open for attacks.

\begin{figure}[h]
  \epsfig{figure=dual_homed_host.eps,width=15cm}
  \caption{Dual Homed Host}
  \label{fig:dual}
\end{figure}

\subsection{Screened host}
If the users on the intranet are to be able to use the internet 
in a more transparent way, the screened host configuration in Figure~\ref{fig:screen} 
may be used. 
The bastion\footnote{A bastion host may also be called a stronghold.} 
host provides the necessary proxying, 
see Section~\ref{sec:proxy} for a brief explanation of what proxying is. The proxying
is necessary as the screened router is setup to only allow packets from the bastion
host to pass through it.
 
The bastion host is a good place to put network services using protocols like SMTP, 
HTTP, FTP, etc.
See Section~\ref{sec:protocols} for a brief description of the network service protocols.

The weakness of this setup is that the bastion host resides on the intranet, and
if the packet filter is misconfigured and the bastion host bypassed, the attacker have 
access to the intranet. 
A positive factor about proxying is that it keeps the names or the IP addresses 
of the hosts on the intranet away from the internet. 
This makes it harder for an attacker to select a host to attack.
 
\begin{figure}[h]
  \epsfig{figure=screened_host.eps,width=15cm}
  \caption{Screened Host}
  \label{fig:screen}
\end{figure}
 
\subsection{Perimeter network}

This perimeter setup is shown in Figure~\ref{fig:peri}.
The weakness of having the bastion host of the screened host setup on the intranet
is corrected by setting up a perimeter network, 
also called `Demilitarized Zone', where the only traffic allowed  
is to/from the bastion host and the screening routers. To verify that this setup
is safe, a device\footnote
{Either a actual hardware device or a computer with a suitable program like tcpdump,
see Section~\ref{sec:tools} for a description of tcpdump.} 
with packet sniffing capabilities is allowed to sniff the packets that pass by.
If all packets are to/from the bastion host, everything is ok.

This setup is the safest of the firewall setups mentioned so far, since an 
intruder has to execute the following steps in order to get to the intranet:

\begin{enumerate} 
\item
  Pass the first packet filter to give access to the bastion host.
\item
  Break into the bastion host.
\item
  Pass the second packet filter to give access to the intranet.
\end{enumerate}
 
\begin{figure}[h]
  \epsfig{figure=perimeter.eps,width=15cm}
  \caption{Perimeter network}
  \label{fig:peri}
\end{figure}

\section{IP spoofing}
\label{sec:ip-spoofing}
IP spoofing is when a host claims to be another host that is trusted
by the host to which access is wanted by trying to use the trusted
hosts IP address.


IP spoofing is however not that easy to do, as the offending computer has to be on the
same segment as the real host in order to succeed. This is because packets
are routed by masking the IP address with the network mask, and by the
resulting IP address determine how packets are routed. The effect is that is
it quite possible to use an already taken IP address, and to send
packets to the host you want to gain access to, but when the host in
turn replies the packets are routed not to the illegal host but to the
official segment they \textbf{should} originate from. However, if this
is the case an attacker can penetrate a host on the real segment
first. Once this is done it is not to difficult to arrange
IP spoofing. In order to succeed the real host must be silenced
somehow as chaos occurs if two hosts share the same IP address. 
If all these steps succeeds it is possible to make a `tunnel',
i.e. another IP envelope is added to the original to be able to send
it to the illegal host which simply removes the additional IP envelope
and processes the packet in the usual manner. When sending data the
same process is repeated in reverse order.

Another possibility is that the offender has successfully cracked into one of the major
routers, and is able to successfully change the routing tables to make the packets
arrive to the offending computer. In order to maintain the charade the
offender must also disable the dynamic routing table update, as the
route otherwise might be changed due to congestion.

\cite{art:ipspoofing} discusses in detail an attempt at IP
spoofing.

\section{Protocols}

The two most used transport protocols are UDP and TCP.
The major differences is that TCP is connection-based and safe regarding lost packets,
arrival order and retransmissions, whereas UDP is not\footnote
{UDP does not give any guarantees about anything.
If you want your bytes to arrive in order, use TCP.}.
Even so, there are several applications that uses UDP transport protocol, like NFS, as
the overhead of sending large byte streams is less, and NFS was from the beginning 
thought to be used only on intranets, where the packet loss rate can be 
controlled.

Most of the application protocols use either UDP or TCP as transport protocols, 
and then only add the application specific data
as a field in the transported data. This means that a DPF will work with most of
the applications in use today (and hopefully tomorrow) without any modifications. 

There are some low level protocols like ICMP that may also be used.
The ICMP is used for routing purposes, and for diagnostics like the 
\emph{ping}\footnote{See Section~\ref{sec:tools}.} program.

The DPF will only recognize the above mentioned transport protocols, 
if other protocols are used, the rules for the PFs have to be added manually.

The low level Address Resolution Protocol (ARP) and Reverse Address
Resolution Protocol (RARP) are unaffected as
they are handled at lower levels and the DPF is never notified. 
See Section~\ref{sec:arp} for a discussion about ARP and RARP.

The Internet Group Management Protocol (IGMP) used for managing multicast are
not handled by the DPF. 
If they are to be used rules for the PFs has to be added manually.

\subsection{Application protocols}
\label{sec:protocols}
In Table~\ref{tab:packets} some of the most common application protocols are
shown. The statistics are from~\cite{tcp:stevens3}.
The statistics are based on the National Science Foundation (NSFnet) backbone. 
The total decline of packets after
Oct. 1994 can be explained by the fact that other backbones started replacing the 
NSFnet, and not by a decrease of usage of the internet.
All the application protocols in Table~\ref{tab:packets} have been tested and works 
fine behind the DPF firewall, which mean that they use either TCP or UDP as network
protocols. 
  
The application protocols are the following:
\begin{itemize}
\item
  Hyper Text Transfer Protocol (HTTP) is the basis for the world wide web which has 
  had an incredible growth rate since January 1994. 
  HTTP and the Hyper Text Markup Language (HTML) are intimately connected as HTTP
  is mainly used to allow the web client (browser) to read HTML
  documents stored on a web server. The user running the browser can
  select hypertext links where to go next.
\item
  Network News Transfer Protocol (NNTP) is used to read the UseNet mailing groups 
  where all kinds of (mis)information can be found.
\item
  File Transfer Protocol (FTP) is used to transfer files. 
  FTP is discussed in Section~\ref{sec:ftp}.
\item
  Telnet is used to remotely logon to hosts. 
  The \emph{rlogin} program is similar, but in
  order to use rlogin\footnote
  {The other r* commands are also only allowed from a trusted host. 
    It is possible to override the system setting
    by using a .rhosts file which contains the trusted hosts and the login names.} 
  the host has to be `trusted', i.e. the administrator of the
  system allows a host to use another one.
  Telnet is discussed in Section~\ref{sec:telnet-out}.
\item
  Simple Mail Transfer Protocol (SMTP) is used for delivery of email.
\item
  Domain Name System (DNS) is used for host to IP name resolution. The DNS 
  protocol works by a client querying a DNS server. If the DNS server does not
  have the answer, it in turn recursively queries other DNS servers until 
  a result is achieved.
\end{itemize} 

\begin{table}[h]
\begin{center}
\begin{tabular}{|c|c|c|c|c|c|c|c|} \hline
\emph{Date} & \emph{HTTP} & \emph{NNTP} & \emph{FTP(data)} & 
\emph{Telnet} & \emph{SMTP} & \emph{DNS} & \emph{\#Packets x10\(^{9}\)} \\
\hline\hline
1994 Jan. & 1.5\%  & 8.8\%  & 21.4\% & 15.4\% & 7.4\% & 5.8\% & 55\\
1994 Apr. & 2.8\%  & 9.0\%  & 20.0\% & 13.2\% & 8.4\% & 5.0\% & 71\\
1994 Jul. & 4.5\%  & 10.6\% & 19.8\% & 13.9\% & 7.5\% & 5.3\% & 74\\
1994 Oct. & 7.0\%  & 9.8\%  & 19.7\% & 12.6\% & 8.1\% & 5.3\% & 100\\
1995 Jan. & 13.1\% & 10.0\% & 18.8\% & 10.4\% & 7.4\% & 5.4\% & 87\\
1995 Apr. & 21.4\% & 8.1\%  & 14.0\% & 7.5\%  & 6.4\% & 5.4\% & 59\\
\hline
\end{tabular}
\caption{Packet count for protocols on NSFnet backbone}
\label{tab:packets}
\end{center}
\end{table}


%%% Local Variables: 
%%% mode: latex
%%% TeX-master: "main"
%%% End: 
