Semantics-Preserving Simplification of Real-World Firewall Rule Sets

Abstract

The security provided by a firewall for a computer network almost completely depends on the rules it enforces. For over a decade, it has been a well-known and unsolved problem that the quality of many firewall rule sets is insufficient. Therefore, there are many tools to analyze them. However, we found that none of the available tools could handle typical, real-world iptables rulesets. This is due to the complex chain model used by iptables, but also to the vast amount of possible match conditions that occur in real-world firewalls, many of which are not understood by academic and open source tools. In this paper, we provide algorithms to transform firewall rulesets. We reduce the execution model to a simple list model and use ternary logic to abstract over all unknown match conditions. These transformations enable existing tools to understand real-world firewall rules, which we demonstrate on four decently-sized rulesets. Using the Isabelle theorem prover, we formally show that all our algorithms preserve the firewall's filtering behavior.

Agile Network Access Control in the Container Age

“…NetKAT [43]; VeriFlow [49]; FML [50] Firmato [38]; FLIP [3]; NetKAT [43]; Mignis [51]; Or-BAC [52]; topoS step C+D HSA [53]; Anteater [54]; Config-Checker [55] Fireman [2]; HSA [53]; Anteater [54]; ConfigChecker [55]; VeriFlow [49] Fireman [2]; ITVal [56]; fffuu Iptables Semantics [19] translates maps verifies Fig. 17.…”

“…Horizontal Enhancements: Most analysis tools make simplifying assumptions about the underlying network boxes. Diekmann et al [19] present simplification of iptables firewalls. This makes complex real-world firewalls available for tools which were built with simplifying assumptions about rulesets.…”

“…In contrast, tools such as model checkers, automated theorem provers (atp), or smt solvers are not sufficient for this task. Traditional model checkers are unsuitable since one cannot simply exhaust all the state space of our model (for example, our model includes an arbitrary function to model an oracle for iptables match conditions, thus also supporting match conditions which are not even developed yet [19]). In addition, atps and smt solvers usually fail or time out on the complicated arXiv:1903.00720v1 [cs.NI] 2 Mar 2019 Security Requirements (e. g., Figure 3) Security Policies (e. g., Figure 4) iptables (e. g., Figure 8) topoS Policy Construction topoS Serialize fffuu Policy Inference topoS Verification Fig.…”

Achieving Reproducible Network Environments with INSALATA

“…Those express the connectivity between Network Components. The latter can be represented as raw dumps (Firewall Raw ) or in a simplified format (Firewall Rule) to ease transformation between different firewall applications as proposed in [10]. As a simplification is not free of information loss, the raw information is stored additionally.…”

Certifying spoofing-protection of firewalls

“…Nor are the tools themselves formally verified, which limits confidence in their results. In addition, the tools only support a limited subset of real-world firewalls [19]. If the firewall under analysis exceeds this feature set, the tools either produce erroneous results or cannot continue [19].…”