11 P OLICY A NALYSIS U SING M ARGRAVE Shriram Krishnamurthi Brown University

22

3 ACL for External firewall: 1: DENY if: ifc=fw1_dmz, ipdest in blacklist 2: DENY if: ifc=fw1_ext, ipsrc in blacklist 3: DENY if: ifc=fw1_dmz, portdest=telnet 4: ACCEPT if: ifc=fw1_ext, ipdest=mailserver, portdest=smtp, proto=tcp 5: ACCEPT if: ifc=fw1_ext, ipdest=webserver, portdest=http, proto=tcp 6: ACCEPT if: ifc=fw1_dmz, ipdest=any outside, portdest=http, proto=tcp, ipsrc=manager 7: DROP otherwise

4 intdmz ext DMZ employees contractors manager

5 blacklist telnet www tcp smtp tcp www tcp

6 smtp tcp  www tcp fw2_staticipsrc smtp tcp

7 Problem The manager can’t connect to the Web.

8 ?When can a connection from the manager’s PC be denied if it’s  to port 80 (www)  over TCP  to any machine?

9  p.p.dstprt = www  p.proto = TCP  p.ipdest  outIPs  p.ipsrc = manager  Int.ACL denies p  p’. Int.NAT translates p to p’  p’.dstprt = p.dstprt  p’.proto = p.proto  p’.ipdest = p.ipdest  Ext.ACL denies p’

10 ?When can a connection from the manager’s PC be denied if it’s  to port 80 (www)  over TCP  to any machine?  Always:  Int’s ACL accepts the packet via rule 4.  Int’s NAT applies to the packet.  Ext’s ACL denies the post-NAT packet via rule 7.

M ARGRAVE D ESIGN P RINCIPLES 11

Property-Free Analysis (e.g., Change Impact) 12

13 P ⊦  Does the policy satisfy its property?

14 P ⊦  Can people state them? Are they good enough?

15 ACL for External firewall: 1: DENY if: ifc=fw1_dmz, ipdest in blacklist 2: DENY if: ifc=fw1_ext, ipsrc in blacklist 3: DENY if: ifc=fw1_dmz, portdest=telnet 4: ACCEPT if: ifc=fw1_ext, ipdest=mailserver, portdest=smtp, proto=tcp 5: ACCEPT if: ifc=fw1_ext, ipdest=webserver, portdest=http, proto=tcp 6: ACCEPT if: ifc=fw1_dmz, ipdest=any outside, portdest=http, proto=tcp, ipsrc=managerfw2_static 7: DROP otherwise

16  p.Int.ACL accepts p   p’. Int.NAT translates p to p’  p’.dstprt = p.dstprt  p’.proto = p.proto  p’.ipdest = p.ipdest  ((Ext.ACL denies p’  Ext.ACLNew accepts p’)  (Ext.ACL accepts p’  Ext.ACLNew denies p’))

17 p.entry-interface = fw2_int p.ipsrc = manager p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp p.entry-interface = fw2_int p.ipsrc = employee p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp p.entry-interface = fw2_int p.ipsrc = contractor p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp

18 Defining Difference p.entry-interface = fw2_int p.ipsrc = employee p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp p.entry-interface = fw2_int p.ipsrc = contractor p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp packets  Deny to Permit Permit to Deny A function mapping requests to changes in outcome

19 Change as a First-Class Entity Restrict changes to External Firewall View Which machines lost privileges? Query Confirm no machines gained privileges Verification

20 Configuration checking Upgrade checkingFinding hotspots “What if” questions Mutation testing ? Refactoring testing

Scenario-Based Output 21 p.entry-interface = fw2_int p.ipsrc = employee p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp p.entry-interface = fw2_int p.ipsrc = contractor p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp

Exhaustive Answers (in Some (Useful) Cases) Bernays-Scho ̈ nfinkel-Ramsey + overloading (subtyping) and empty sorts 22

Minimality 23

Multi-Lingual Support Datalog-based intermediate language 24

25 Margrave Supports… Most of XACML 1.0 and 2.0 Cisco IOS: –ACL: standard and extended –NAT: static; dynamic: ACL-based, map-based –routing: static and policy-based –limited: BGP announcements and VPN endpoints Amazon Access Policy Language (in SQS) Hypervisor, based on sHype (IBM)

How SDNs Change Things Global view of Configuration and State:  Current networks: hard  SDNs: easy (But you already know all that.) 26

27

Principles Recap Property-free analysis Change-impact w/ first-class changes Scenario-based output Exhaustive answers (where possible) Minimality Multi-lingual support 28

29 Dan Dougherty [WPI] Kathi Fisler [WPI] Tim Nelson [WPI] Alums: –Chris Barratt [Brown ScM  BEA] –Leo Meyerovich [Brown u.g.  Berkeley] –Michael Tschantz [Brown u.g.  CMU]