Timing,... in Firewall Testing

Transcription

1 ,... in Firewall Testing Information Security ETH Zurich Semester Thesis, Winter Term 2006/07 Prof. Dr. D. Basin, Tutor: Diana von Bidder April 1, 2007

2 Overview

3 Firewall Testing Tool Definition of testcases tp file, parsed at startup Inject & receive test packets using internal structure Log irregularities Detect: Internal structure received packets

4 of Semester Thesis 1. Analysis of Problem Improve of 2. Analysis of Independence of testcases Implement of testcases

5 Estimation of Timer Value Goal: Minimize timer value t Depending on choice: t too large waisting time t too small packets delayed wrong results Packets: sent by forwarded by FW captured by traveling time Many factors can influence traveling time Firewall-Type Firewall SW/HW Current load situation of FW

6 Estimation of Timer Value Approach: Estimate timer value based on traveling times of previously sent (and received) packets extend internal structure timestamp at send & recv Changed control flow: analyze update statistics calculate timer value send packets out start timer

7 Delayed Packets Problem Packets that are processed too late by firewall: Packet of timestep t+1 is processed by firewall before packet of timestep t Can trigger firewall to behave other than intended If delayed packets are not detected wrong test results! Solution Not possible to prevent BUT can be detected log testcase-nr.

8 Motivation Parallel processing of independent testcases. Approach Re-order testcases/packets descriptions at parsing by Grouping together testcases with equal dependencies. In every timestep at most one packet out of each dependency is processed dependent packets/testcases are processed sequentially dependencies resolved

9 : Re-Ordering Aspects Dependencies FW perspective Stateful FW complex (ICMP example) Consequences 1 Independence := Protocol Source / Destination IP Source / Destination Port (or similar) 2 Time Constraint Necessary to get deterministic results TCP simplified state machine UDP single packet / stream ICMP request / answer

10 : Design 1 At startup: Build dependency list dependent testcases grouped together 2 During runtime: Build internal structure of Compatibility (send/recv/analyze processes) 3 Independence at most one packet per dependency

11 s 1 Estimation of the Timer Value 2 huge time savings Additional speedup through parallel processing Not any longer deterministic order of testcase processing Dependency analysis difficult Which packets/testcases are dependent on each other depends on firewall / firewall-type Regarding time constraints: ICMP echo example seen before (may be some other value on other firewall)