\documentclass{myslides}
%\documentclass{report}

\usepackage{epsfig}
%\special{papersize=8.5in,11in}
%\special{landscape}
%\usepackage{landscape}


\begin{document}
\begin{center}
  \Huge
  Enhanced Network Security by a Dynamic Packet Filter\\
  \vspace{5cm}
  by\\
  Heikki Julkunen \\
\end{center}
\normalsize

\pagebreak
\normalsize
%\tableofcontents\pagebreak
\listoffigures
\listoftables\pagebreak

\begin{center}
\section*{Introduction}
\end{center}
\Large

A `firewall' is a program that is used to control the access to a host
on the internet. The term firewall has no exact definition!


In order to be able to specify a computer or host on a network, some
addressing scheme must be used. There are five types of addresses in
the TCP/IP stack. 
\marginpar{Table~\ref{tab:IP},page~\pageref{tab:IP}.}

\begin{table}[p!]
\begin{center}
\begin{tabular}{|c|c|c|c|} \hline
\emph{Class} & \emph{Range} & \emph{Net Id bits} & \emph{Host Id bits}\\
\hline\hline
A & 0.0.0.0 to 127.255.255.255 & 7 & 24 \\ 
B & 128.0.0.0 to 191.255.255.255 & 14 & 16 \\
C & 192.0.0.0 to 223.255.255.255 & 21 & 8 \\
D & 224.0.0.0 to 239.255.255.255 & 28 & N/A\\
E & 240.0.0.0 to 247.255.255.255 & N/A & N/A\\
\hline
\end{tabular}
\caption{Ranges of IP classes}
\label{tab:IP}
\end{center}
\end{table}

Two common firewall types:
\begin{itemize}
\item
  Packet filter firewall. Can be \emph{simple} or \emph{dynamic}.
  A dynamic packet filter maintains a history of packets.
\item
  Proxying firewall. Requires modifications of existing software
  either by relinking or using shared dynamic libraries. An example of
  proxying is SOCKS. 
  \marginpar{Figure~\ref{fig:socks},page~\pageref{fig:socks}.}
\end{itemize}

\begin{figure}[p!]
  \epsfig{figure=socks.eps,width=15cm,angle=-90}
  \caption{SOCKS at work}
  \label{fig:socks}
\end{figure}

\begin{center}
\subsection*{Networks}
\end{center}

To make a firewall effective the physical layout of the network
must only allow one path between the hosts. The firewall host must be
in the middle.

Commonly used network terms used.
\marginpar{Figure~\ref{fig:topology},page~\pageref{fig:topology}.}

\begin{itemize}
\item
  Segment. A physical part of the network where the hosts communicate
  using the same medium. 
\item
  Subnet. A logical grouping of hosts. May or may not be the same as a
  segment. UCCS is subnetted. IP address space: 128.198.x.y
\item
  Router. The packets travel a route from the source to the
  destination. The packet is routed through the router. Most new
  routers have some kind of `screening' of packets. They are called
  screening routers or packet filters. A screening router follows a
  set of rules which determine what will happen to the packet.
\item
  Gateway. Same as router, but should be used when connecting two
  different protocol suites like TCP/IP and SNA.
\item
  Repeater or Bridge. Repeat or Bridge packets between two
  segments. May be done only in hardware.
\item
  Hub. Controls a couple of hosts using twisted pair ethernet. Is a
  combination of a router and an access mediator in the same box.
  Uses the `star' topology.
\end{itemize}

\begin{figure}[p!]
  \epsfig{figure=topology.eps,width=15cm,angle=-90}
  \caption{Network topologies}
  \label{fig:topology}
\end{figure}

\begin{center}
\subsection*{Firewall architectures}
\end{center}

There are three commonly used architectures:
\begin{itemize}
\item
  Dual homed host. Access to the internet is through a computer with
  two network devices. Not transparent to the
  user. 
  \marginpar{Figure~\ref{fig:dual},page~\pageref{fig:dual}.}
\item
  Screened host. A screening router is setup to only allow packets to
  and from the Bastion host which provides proxying for the other
  hosts on the intranet. 
  \marginpar{Figure~\ref{fig:screen},page~\pageref{fig:screen}.}
\item
  Perimeter network. An enhanced screened host setup using an
  additional screening router for the intranet. 
  \marginpar{Figure~\ref{fig:peri},page~\pageref{fig:peri}.}
\end{itemize}

\begin{figure}[p!]
  \epsfig{figure=dual_homed_host.eps,width=15cm,angle=-90}
  \caption{Dual Homed Host}
  \label{fig:dual}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=screened_host.eps,width=15cm,angle=-90}
  \caption{Screened Host}
  \label{fig:screen}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=perimeter.eps,width=15cm,angle=-90}
  \caption{Perimeter network}
  \label{fig:peri}
\end{figure}

\begin{center}
\subsection*{Break-in techniques}
\end{center}

Some of the most common break-in techniques are the following:

\begin{itemize}
\item
  Password cracking by guessing passwords in the encrypted password
  file.
\item
  Exploiting bugs in existing software like the mail delivery
  system. Even if a login is not possible, make the mail delivery
  program to mail the password file to the intruder.
\item 
  IP spoofing. Use a trusted hosts IP address to get access. 
\end{itemize}

A dynamic packet filter will make the system more difficult to
penetrate. There is no protection against IP spoofing. A DPF does not
either protect against `fixed' data in packets.

\begin{center}
\subsection*{Protocols}
\end{center}

A firewall should work with the most commonly used network
application protocols. Some of these are:

\begin{itemize}
\item
  Hyper Text Transfer Protocol (HTTP) is the basis for the world wide
  web which has  had an incredible growth rate since January 1994. 
\item
  Network News Transfer Protocol (NNTP) is used to read the UseNet 
  mailing groups.
\item
  File Transfer Protocol (FTP) is used to transfer files. 
\item
  Telnet is used to remotely logon to hosts. 
\item
  Simple Mail Transfer Protocol (SMTP) is used for delivery of email.
\item
  Domain Name System (DNS) is used for host to IP name resolution. 
\end{itemize} 

\begin{table}[p!]
\begin{center}
\begin{tabular}{|c|c|c|c|c|c|c|c|} \hline
\emph{Date} & \emph{HTTP} & \emph{NNTP} & \emph{FTP(data)} & 
\emph{Telnet} & \emph{SMTP} & \emph{DNS} & \emph{\#Packets x10\(^{9}\)} \\
\hline\hline
1994 Jan. & 1.5\%  & 8.8\%  & 21.4\% & 15.4\% & 7.4\% & 5.8\% & 55\\
1994 Apr. & 2.8\%  & 9.0\%  & 20.0\% & 13.2\% & 8.4\% & 5.0\% & 71\\
1994 Jul. & 4.5\%  & 10.6\% & 19.8\% & 13.9\% & 7.5\% & 5.3\% & 74\\
1994 Oct. & 7.0\%  & 9.8\%  & 19.7\% & 12.6\% & 8.1\% & 5.3\% & 100\\
1995 Jan. & 13.1\% & 10.0\% & 18.8\% & 10.4\% & 7.4\% & 5.4\% & 87\\
1995 Apr. & 21.4\% & 8.1\%  & 14.0\% & 7.5\%  & 6.4\% & 5.4\% & 59\\
\hline
\end{tabular}
\caption{Packet count for protocols on NSFnet backbone}
\label{tab:packets}
\end{center}
\end{table}

\begin{center}
\section*{Linux}
\end{center}

The dynamic packet filter was developed using Linux. 

\begin{itemize}
\item 
  The Linux kernel was created by Linus Torvalds, Finland.
\item 
  Linux runs currently on these processors:
  \begin{itemize}
  \item
    i386
  \item
    Sparc
  \item
    Alpha
  \item
    m68k
  \end{itemize}
\item
  The kernel source is included.
\item
  Linux has all the common free tools for Unix.
\end{itemize}

The Linux kernel supports packet filters in the kernel.
The PFs provided are the following:
\begin{itemize}
  \item 
    Incoming PF.
    All incoming packets are checked against the rules 
    in the incoming PF chain.
  \item 
    Forwarding PF.
    All packets that need to be forwarded are checked against these rules.
  \item 
    Outgoing PF. All outgoing packets are checked against these rules. 
  \item
    Accounting PF. All packets are checked against these
    rules. Increases a counter for each rule that matches a
    packet. Used for statistics.
\end{itemize}

\begin{center}
\subsection*{Administration of the Linux packet filters}
\end{center}

An example of administration using the \emph{ipfwadm} program:\\
\emph{ipfwadm -I -a reject -P all -S badhost -D 0/0}

\begin{center}
\section*{Operation of the DPF}
\end{center}

The idea behind a dynamic packet filter is to limit incoming
traffic. If traffic is allowed, the hosts on the intranet should
initiate the connections to hosts on the internet. 

\begin{center}
\subsection*{Setup}
\end{center}

A straightforward setup is used to be able to confirm the function of
the DPF. 
\marginpar{Figure~\ref{fig:setup},page~\pageref{fig:setup}.}

\begin{center}
\subsection*{Outgoing packets}
\end{center}

Sniff for packets the DPF host sends and add outgoing packets in 
`reverse' on Incoming PF. The packet has to pass the Outgoing PF first.
\marginpar{Figure~\ref{fig:output},page~\pageref{fig:output}.}

\begin{center}
\subsection*{Forwarding packets}
\end{center}

Sniff for packets that are to be forwarded between two or more network
devices. The packet has to pass the Incoming PF
first. 
\marginpar{Figure~\ref{fig:forward},page~\pageref{fig:forward}.}

\begin{center}
\subsection*{DPF timeout values}
\end{center}

The rule appended by the DPF will timeout after a predefined
interval. The interval can be changed.
The intervals are:
\begin{itemize}
\item
  TCP. 15 minutes, except when both the client and server has sent the
  FIN flag. In this case the timeout is 2 minutes.
\item
  UDP. 5 minutes.
\item 
  ICMP. 2 minutes.
\end{itemize}

\begin{figure}[p!]
  \epsfig{figure=setup.eps,width=15cm,angle=-90}
  \caption{Setup used in tests}
  \label{fig:setup}
\end{figure}


\begin{figure}[p!]
  \epsfig{figure=output.eps,width=15cm,angle=-90}
  \caption{DPF processing of outgoing packets}
  \label{fig:output}
\end{figure}


\begin{figure}[p!]
  \epsfig{figure=forward.eps,width=15cm,angle=-90}
  \caption{DPF processing of forwarded packets}
  \label{fig:forward}
\end{figure}


\begin{center}
\section*{Test of DPF}
\end{center}

The hosts must be carefully setup to use Gandalf as
router. 
\marginpar{Figure~\ref{fig:setup},page~\pageref{fig:setup}.}
The initial setup can be tested by rejecting forwarding of packets.

Telnet, FTP and NFS was tried with the DPF in operation to verify its
function. The DPF should append rules in the according PF chains when
a packet is sent or forwarded.

\begin{center}
\subsection*{FTP}
\end{center}

The FTP application is ill suited for running behind the DPF as it is
the server that initiates the network connection. There are two
solutions:
\begin{enumerate}
\item
  Let the DPF scan for the PORT command sent to the
  server. 
  \marginpar{Figure~\ref{fig:ftp},page~\pageref{fig:ftp}.}
\item
  Compile a newer version of the FTP client which initiates the
  network connection. The server must support the PASV command.
\end{enumerate}

\begin{center}
\subsection*{FTP tcpdump trace}
\end{center}
\label{sec:tcpdump}
The \emph{tcpdump} program has been extensively used to trace what
happens on the ethernet. The example shows the server trying to
connect to the client. It works since the DPF scanned for the PORT command.\\

\ttfamily\large
12:13:08.677104 odorf.uccs.edu.ftp-data > bilbo.uccs.edu.40001: S 3245975086:3245975086(0) win 512 <mss 1460> [tos 0x8]\\
12:13:08.677104 bilbo.uccs.edu.40001 > odorf.uccs.edu.ftp-data: S 256500895:256500895(0) ack 3245975087 win 15360 <mss 1460>\\
12:13:08.677104 odorf.uccs.edu.ftp-data > bilbo.uccs.edu.40001: . ack 1 win 15360 [tos 0x8]\\
12:13:08.677104 odorf.uccs.edu.ftp > bilbo.uccs.edu.1031: P 204:257(53) ack 70 win 15360 (DF) [tos 0x10]\\
12:13:08.697105 bilbo.uccs.edu.1031 > odorf.uccs.edu.ftp: . ack 257 win 15360 [tos 0x10]\\
12:13:08.727105 odorf.uccs.edu.ftp-data > bilbo.uccs.edu.40001: P 1:1025(1024) ack 1 win 15360 (DF) [tos 0x8]\\
12:13:08.727105 odorf.uccs.edu.ftp > bilbo.uccs.edu.1031: P 257:281(24) ack 70 win 15360 (DF) [tos 0x10]\\
12:13:08.747105 bilbo.uccs.edu.1031 > odorf.uccs.edu.ftp: . ack 281 win 15360 [tos 0x10]\\
12:13:08.747105 bilbo.uccs.edu.40001 > odorf.uccs.edu.ftp-data: . ack 1025 win 15360 [tos 0x8]\\
12:13:08.747105 odorf.uccs.edu.ftp-data > bilbo.uccs.edu.40001: P 1025:1265(240) ack 1 win 15360 (DF) [tos 0x8]\\
12:13:08.747105 odorf.uccs.edu.ftp-data > bilbo.uccs.edu.40001: F 1265:1265(0) ack 1 win 15360 [tos 0x8]\\
12:13:08.747105 bilbo.uccs.edu.40001 > odorf.uccs.edu.ftp-data: . ack 1266 win 15360 [tos 0x8]\\
12:13:08.757105 bilbo.uccs.edu.40001 > odorf.uccs.edu.ftp-data: F 1:1(0) ack 1266 win 15360 [tos 0x8]\\
12:13:08.757105 odorf.uccs.edu.ftp-data > bilbo.uccs.edu.40001: . ack 2 win 15360 [tos 0x8]\\

\normalfont\Large

\begin{figure}[p!]
  \epsfig{figure=ftp.eps,width=15cm,angle=-90}
  \caption{FTP port command. 156*256+65=40001}
  \label{fig:ftp}
\end{figure}

\begin{center}
\section*{Performance}
\end{center}

The DPF adds overhead to the packet processing so it is interesting to
see how much. The benchmarks were done using the \emph{netperf}
program. A bulk transfer and a request response measurement was
performed. As Bilbo and Frodo use a 100Mbps and a 10Mbps ethernet
device it would be interesting to see the difference.

Three types of kernels where benchmarked:
\begin{enumerate}
\item
  Without the packet filters mentioned earlier.
\item
  With the packet filters.
\item
  With the DPF functionality.
\end{enumerate}

As each step adds overhead there should be a performance loss.

\begin{center}
\subsection*{Bulk transfer}
\end{center}

The bulk transfer performance test sends packets to the DPF host as
fast as possible. The DPF host running the netperf server counts the
number of packets and returns this number to the netperf client.
\marginpar{Table~\ref{tab:ip-calc},page~\pageref{tab:ip-calc}.}
\marginpar{Figure~\ref{fig:streamcomp},page~\pageref{fig:streamcomp}.}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/streamcomp.eps,width=15cm,angle=180}
  \caption{Bulk transfer comparison}
  \label{fig:streamcomp}
\end{figure}

\begin{center}
\subsection*{Request Response}
\end{center}

The RR test sends like the bulk test a packet to the DPF host, but
this time the netperf client wants a response. When the DPF host
replies, the DPF will add an entry to the linked list. The next time
a request is sent to the DPF host the entry is found quickly.
\marginpar{Figure~\ref{fig:rrcomp},page~\pageref{fig:rrcomp}.}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/rrcomp.eps,width=15cm,angle=180}
  \caption{Request Response comparison}
  \label{fig:rrcomp}
\end{figure}

\begin{center}
\section*{Conclusions and improvements}
\end{center}

\begin{itemize}
\item
  The DPF will correctly used enhance the security for an intranet in
  one step. No software has to be replaced.
\item
  Linux is well suited for development, but it would need some more
  documentation.
\item
  The performance of the DPF could be improved by using two linked
  lists, one for outgoing packets and one for incoming ones.
\end{itemize}
\pagebreak


\begin{center}
\section*{Extra}
\end{center}
Material which might be used to answer questions, or if ample of time
is left at the end of the presentation.

\begin{center}
\subsection*{Hashing}
\end{center}

\label{sec:hashing}
Hashing is done to speed up matching of packets. The search for a
packet in a linked list starts at the index calculated below.

\large\begin{verbatim}
struct ip_dyn *ip_dyn_get(struct iphdr *iph)
{
  __u16 icmp_ports[] = {0, 0};
  __u16 *portptr = icmp_ports;
  int protocol;
  __u32 s_addr, d_addr;
  __u16 s_port, d_port;
  struct ip_dyn *ret;

  protocol = iph->protocol;
  if (protocol != IPPROTO_ICMP) 
          portptr = (__u16 *)&(((char *)iph)[iph->ihl*4]);

  s_addr = iph->saddr;
  s_port = portptr[0];
  d_addr = iph->daddr;
  d_port = portptr[1];

  /* Try first to find the 5-tuple as it is */
  ret = ip_dyn_get_2(protocol, s_addr, s_port, d_addr, d_port);
  if (ret != NULL) {
          ret->flags &= ~IP_DYN_F_REVERSED;
  }

  /* Now try to find the reversed ditto */
  else {
          ret = ip_dyn_get_2(protocol, d_addr, d_port, s_addr, s_port);
          if (ret != NULL)
                  ret->flags |= IP_DYN_F_REVERSED;
  }
  return(ret);
}
\end{verbatim}\Large


To get the the hashed index, the ip\_dyn\_get\_2() seen above will in
turn call the following:

\large\begin{verbatim}
static __inline__ 
unsigned ip_dyn_hash_key(unsigned proto, __u32 addr, __u16 port)
{
  return (proto^ntohl(addr)^ntohs(port)) & 
         (IP_DYN_TAB_SIZE-1);
}
\end{verbatim}\Large


Example: The netperf server is resident at port
12865 on Gandalf. 12865 is 0x3241 in hex. 
Gandalfs IP address is 128.198.9.118, which is 0x80c60976 in hex.
The netperf uses UDP for the the benchmark.

\begin{table}[p!]
\begin{center}
\begin{tabular}{|c|r|c|r|} \hline
\emph{Variable} & \emph{Value} & \emph{Operation} & \emph{Result} \\
\hline\hline
IP    & 0x7609c680 & assign & 0x7609c680 \\
Port  & 0x4132     & assign & 0x4132 \\
Proto & 0x00000006 & assign & 0x00000006 \\
SIZE  & 0xff       & assign & 0xff \\
\hline
Proto         & 0x00000006 & xor & 0x00000006 \\
ntohl(IP)     & 0x80c60976 & xor & 0x80c60970 \\
ntohs(Port)   & 0x00003241 & xor & 0x80c60b31 \\
SIZE          & 0x000000ff & and & 0x00000031 \\
\hline
Hash          &            & assign & 0x00000031 \\
\hline
\end{tabular}
\caption{Hash calculation}
\label{tab:ip-calc}
\end{center}
\end{table}

\begin{center}
\subsection*{NFS}
\end{center}

NFS was one of the applications used when verifying the function of
the DPF. 
\marginpar{Figure~\ref{fig:nfs},page~\pageref{fig:nfs}.}

The following steps are done when mounting a NFS filesystem.
\marginpar{Figure~\ref{fig:mount},page~\pageref{fig:mount}.}

\begin{enumerate}
  \item
    The \emph{mountd} daemon registers itself on the server with the portmapper 
    program which is started when the system boots.
  \item
    The \emph{mount} program is executed on the client to mount a remote server. 
  \item
    The portmapper returns the port of the mount daemon.
  \item
    The mount program sends a request to the server that it wants to mount
    some parts of the server's file-system. 
  \item
    The mount daemon sends back a file-handle to the file-system in question.
  \item
    The file-handle is passed to the NFS portion of the client kernel.
\end{enumerate}

\begin{figure}[p!]
  \epsfig{figure=nfs.eps,width=15cm,angle=-90}
  \caption{NFS client and server}
  \label{fig:nfs}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=mount.eps,width=15cm,angle=-90}
  \caption{Steps taken to mount a remote file-system}
  \label{fig:mount}
\end{figure}

\begin{center}
\subsection*{Detailed graphs of all the tests}
\end{center}

The graphs are the following:
\begin{itemize}
\item
  PF UDP bulk transfer 100Mbps.
  \marginpar{Figure~\ref{fig:pf100},page~\pageref{fig:pf100}.}
\item
  PF UDP bulk transfer 10Mbps.
  \marginpar{Figure~\ref{fig:pf10},page~\pageref{fig:pf10}.}
\item
  DPF UDP bulk transfer 100Mbps.
  \marginpar{Figure~\ref{fig:dpf100},page~\pageref{fig:dpf100}.}
\item
  DPF UDP bulk transfer 10Mbps.
  \marginpar{Figure~\ref{fig:dpf10},page~\pageref{fig:dpf10}.}
\item
  PF UDP request response 100Mbps.
  \marginpar{Figure~\ref{fig:pf100rr},page~\pageref{fig:pf100rr}.}
\item
  PF UDP request response 10Mbps.
  \marginpar{Figure~\ref{fig:pf100rr},page~\pageref{fig:pf100rr}.}
\item
  DPF UDP request response 100Mbps.
  \marginpar{Figure~\ref{fig:dpf100rr},page~\pageref{fig:dpf100rr}.}
\item
  DPF UDP request response 10Mbps.
  \marginpar{Figure~\ref{fig:dpf10rr},page~\pageref{fig:dpf10rr}.}
\end{itemize}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/pf100.eps,width=15cm,angle=180}
  \caption{100Mbps PF results.}
  \label{fig:pf100}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/pf10.eps,width=15cm,angle=180}
  \caption{10Mbps PF results.}
  \label{fig:pf10}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/dpf100.eps,width=15cm,angle=180}
  \caption{100Mbps DPF results.}
  \label{fig:dpf100}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/dpf10.eps,width=15cm,angle=180}
  \caption{10Mbps DPF results.}
  \label{fig:dpf10}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/pf100rr.eps,width=15cm,angle=180}
  \caption{100Mbps PF RR results.}
  \label{fig:pf100rr}
\end{figure}


\begin{figure}[p!]
  \epsfig{figure=benchmarks/pf10rr.eps,width=15cm,angle=180}
  \caption{10Mbps PF RR results.}
  \label{fig:pf10rr}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/dpf100rr.eps,width=15cm,angle=180}
  \caption{100Mbps DPF RR results.}
  \label{fig:dpf100rr}
\end{figure}

\begin{figure}[p!]
  \epsfig{figure=benchmarks/dpf10rr.eps,width=15cm,angle=180}
  \caption{10Mbps DPF RR results.}
  \label{fig:dpf10rr}
\end{figure}



\end{document}
