20% more formulas. Verified Firewall Ruleset Verification. Now with. with Isabelle/HOL. Cornelius Diekmann

(1)

α

A

β

λ → _{Verified Firewall Ruleset Verification – corny} _{Technische Universit ¨at M ¨unchen}

Now with

20%

more

form

ula

s

Verified Firewall Ruleset Verification

with Isabelle/HOL

(2)

α

A

β

Introduction to Firewalls

Chain INPUT (policy ACCEPT)

target prot source destination DOS_PROTECT all 0.0.0.0/0 0.0.0.0/0

ACCEPT all 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED DROP tcp 0.0.0.0/0 0.0.0.0/0 tcp dpt:22

DROP tcp 0.0.0.0/0 0.0.0.0/0 multiport dports 21,873,5005,5006,80,548,. . . DROP udp 0.0.0.0/0 0.0.0.0/0 multiport dports 123,111,2049,892,5353 ACCEPT all 192.168.0.0/16 0.0.0.0/0

DROP all 0.0.0.0/0 0.0.0.0/0

Chain DOS_PROTECT (1 references)

target prot source destination

RETURN icmp 0.0.0.0/0 0.0.0.0/0 icmptype 8 limit: avg 1/sec burst 5 DROP icmp 0.0.0.0/0 0.0.0.0/0 icmptype 8

RETURN tcp 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5 DROP tcp 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04

(3)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(4)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(5)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(6)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(7)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(8)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(9)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(10)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(11)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(12)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(13)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(14)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(15)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(16)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(17)

α

A

β

Introduction to Firewalls

DROP all 0.0.0.0/0 0.0.0.0/0

(18)

α

A

β

Problem

“there are no good high-complexity rule sets”

“firewalls are (still) poorly configured

”

“tools do not understand real-world firewall rules”

A. Wool, A Quantitative Study of Firewall Configuration Errors, Computer, IEEE, vol. 37, no. 6, pp. 62–67, Jun. 2004.

A. Wool, Trends in Firewall Configuration Errors: Measuring the Holes in Swiss Cheese, Internet Computing, IEEE, vol. 14, no. 4, pp. 58–65, Jul. 2010.

C. Diekmann, L. Hupel, and G. Carle, Semantics-Preserving Simplification of Real-World Firewall Rule Sets, in Formal Methods (FM). Springer, pp. 195–212. Jun. 2015

(19)

α

A

β

Problem

”

C. Diekmann, L. Hupel, and G. Carle, Semantics-Preserving Simplification of Real-World Firewall Rule Sets, in Formal Methods (FM). Springer, pp. 195–212. Jun. 2015

(20)

α

A

β

Problem

”

(21)

α

A

β

A Tool for Ruleset Verification

Specification

I

Documentation

I

What is a correct ruleset?

I

Goal: Spoofing protection

I

Needs: Model of iptables

Implementation

I

Code, tool

I

Performance

(22)

α

A

β

A Tool for Ruleset Verification

Specification

I

Documentation

I

Goal: Spoofing protection

I

Implementation

I

Code, tool

I

Performance

(23)

α

A

β

Specification

I

Documentation

I

Implementation

I

Code, tool

I

Performance

(24)

α

A

β

Specification

I

Documentation

I

Implementation

I

Code, tool

I

Performance

(25)

α

A

β

A Tool for Ruleset Verification

Specification

I

Documentation

I

Implementation

I

Code, tool

I

Performance

α

A

β

λ

_→ http://isabelle.in.tum.de/

(26)

α

A

β

Specification

I

Documentation

I

Goal: Spoofing protection

I

Implementation

I

Code, tool

I

Performance

α

A

β

λ

_→

⇐

Proof

⇒

http://isabelle.in.tum.de/

(27)

α

A

β

Specification

I

Documentation

I

Implementation

I

Code, tool

I

Performance

α

A

β

λ

_→

⇐

Proof

⇒

(28)

α

A

β

Match Expressions: Syntax and Semantics

Syntax

I

How to represent match expressions?

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

Example:

(29)

α

A

β

Syntax

I

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

Polymorphic: arbitrary type

0

a

Example:

(30)

α

A

β

Match Expressions: Syntax and Semantics

Syntax

I

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

0

a

Example:

(31)

α

A

β

Syntax

I

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

0

a

Example:

(32)

α

A

β

Syntax

I

How to represent match expressions?

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

0

a

Recursive datatype

Example:

(33)

α

A

β

Syntax

I

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

0

a

Recursive datatype

Example:

(34)

α

A

β

Syntax

I

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

Example:

(35)

α

A

β

Syntax

I

datatype

0

a mexpr

=

Match

0

a

|

MatchAny

|

MatchNot

0

a mexpr

|

MatchAnd

0

a mexpr

0

a mexpr

Primitive

Example:

(36)

α

A

β

Semantics

I

What do match expressions mean?

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(37)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(38)

α

A

β

Match Expressions: Syntax and Semantics

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(39)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(40)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(41)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(42)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(43)

α

A

β

Match Expressions: Syntax and Semantics

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(44)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(45)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(46)

α

A

β

Semantics

I

matches

::

0

a

⇒

0

p

⇒

B

⇒

0

a mexpr

⇒

0

p

⇒

B

matches

γ

(

Match

a

)

p

←→

γ

a p

matches

MatchAny

←→

True

matches

γ

(

MatchNot

m

)

p

←→ ¬

matches

γ

m p

(47)

α

A

β

Iptables Semantics: Filtering Behavior

SKIP γ,p` [], t ⇒t ACCEPT matchesγm p γ,p` [(m,Accept)], ?⇒ ! DROP matchesγm p γ,p` [(m,Drop)], ?⇒ % REJECT matchesγm p γ,p` [(m,Reject)], ?⇒% NOMATCH ¬matchesγm p γ,p` [(m,a)], ?⇒ ? DECISION t 6 = ? γ,p` rs, t ⇒t SEQ γ,p` rs₁, ?⇒t γ,p`rs₂,t⇒t0 γ,p` rs₁:::rs₂, ?⇒t0 LOG matchesγm p γ,p` [(m,Log)], ?⇒ ? EMPTY matchesγm p γ,p` [(m,Empty)], ?⇒ ?

CALLRESULT matchesγm p γ,p `

Γc, ?⇒t γ,p`

[(m,Callc)], ?⇒t

CALLRETURN

matchesγm p Γc=rs₁::: (m0,Return) ::rs₂ matchesγm0p γ,p`

rs₁, ?⇒ ?

γ,p`

[(m,Callc)], ?⇒ ?

(48)

α

A

β

Iptables Semantics: Filtering Behavior

SKIP γ,p` [], t ⇒t ACCEPT matchesγm p γ,p` [(m,Accept)], ?⇒ ! DROP matchesγm p γ,p` [(m,Drop)], ?⇒ % REJECT matchesγm p γ,p` [(m,Reject)], ?⇒% NOMATCH ¬matchesγm p γ,p` [(m,a)], ?⇒ ? DECISION t 6 = ? γ,p` rs, t ⇒t SEQ γ,p` rs₁, ?⇒t γ,p`rs₂,t⇒t0 γ,p` rs₁:::rs₂, ?⇒t0 LOG matchesγm p γ,p` [(m,Log)], ?⇒ ? EMPTY matchesγm p γ,p` [(m,Empty)], ?⇒ ?

CALLRESULT matchesγm p γ,p `

Γc, ?⇒t γ,p`

[(m,Callc)], ?⇒t

CALLRETURN

matchesγm p Γc=rs₁::: (m0,Return) ::rs₂ matchesγm0p γ,p`

rs₁, ?⇒ ?

γ,p`

[(m,Callc)], ?⇒ ?

(49)

α

A

β

Semantics Explained

Primitive matcher

Packet

γ ,

p

`

rs

,

s

⇒

t

ruleset

start state

(e.g.,

?

)

final state

(50)

α

A

β

Semantics Explained

Primitive matcher

Packet

γ ,

p

`

rs

,

s

⇒

t

ruleset

start state

(e.g.,

?

)

final state

(51)

α

A

β

Semantics Explained

Primitive matcher

Packet

γ ,

p

`

rs

,

s

⇒

t

ruleset

start state

(e.g.,

?

)

final state

(52)

α

A

β

Semantics Explained

Primitive matcher

Packet

γ ,

p

`

rs

,

s

⇒

t

ruleset

start state

(e.g.,

?

)

final state

(e.g.,

!

,

%

)

(53)

α

A

β

Semantics Explained

Primitive matcher

Packet

γ ,

p

`

rs

,

s

⇒

t

ruleset

start state

(e.g.,

?

)

final state

(54)

α

A

β

Semantics Explained

Primitive matcher

Packet

γ ,

p

`

rs

,

s

⇒

t

ruleset

start state

(e.g.,

?

)

final state

(55)

α

A

β

Semantics Explained: SKIP

γ,

p

`

[]

,

t

⇒

t

(56)

α

A

β

Semantics Explained: SKIP

Precondition

Conclusion

γ,

p

`

[]

,

t

⇒

t

I

no precondition

I _{Holds unconditionally} I IFTRUEthenγ,p` [], t ⇒t

(57)

α

A

β

Precondition

Conclusion

γ,

p

`

[]

,

t

⇒

t

I

no precondition

(58)

α

A

β

Semantics Explained: SKIP

Precondition

Conclusion

γ,

p

`

[]

,

t

⇒

t

I

no precondition

(59)

α

A

β

Precondition

Conclusion

γ,

p

`

[]

,

t

⇒

t

I

no precondition

(60)

α

A

β

γ,

p

`

[]

,

t

⇒

t

I

Empty Ruleset

I

Start state equals final state

(61)

α

A

β

Semantics Explained: SKIP

γ,

p

`

[]

,

t

⇒

t

I

Empty Ruleset

I

(62)

α

A

β

γ,

p

`

[]

,

t

⇒

t

I

Empty Ruleset

I

(63)

α

A

β

Semantics Explained: SKIP

γ,

p

`

[]

,

t

⇒

t

I

Empty Ruleset

I

(64)

α

A

β

Semantics Explained: ACCEPT

matches

γ

m p

γ,

p

`

[(

m

,

Accept

)]

,

?

⇒

!

I

Ruleset: single rule

I

matches

I

The action of the rule is

Accept

rule

I

The firewall does not have a decision yet

I

It will accept the packet

(65)

α

A

β

matches

γ

m p

γ,

p

`

[(

m

,

Accept

)]

,

?

⇒

!

I

matches

I

Accept

rule

I

It will accept the packet

(66)

α

A

β

Semantics Explained: ACCEPT

matches

γ

m p

γ,

p

`

[(

m

,

Accept

)]

,

?

⇒

!

I

matches

I

Accept

rule

I

(67)

α

A

β

matches

γ

m p

γ,

p

`

[(

m

,

Accept

)]

,

?

⇒

!

I

matches

I

Accept

rule

I

(68)

α

A

β

matches

γ

m p

γ,

p

`

[(

m

,

Accept

)]

,

?

⇒

!

I

matches

I

Accept

rule

I

(69)

α

A

β

matches

γ

m p

γ,

p

`

[(

m

,

Accept

)]

,

?

⇒

!

I

matches

I

Accept

rule

I

(70)

α

A

β

matches

γ

m p

γ,

p

`

[(

m

,

Accept

)]

,

?

⇒

!

I

matches

I

Accept

rule

I

(71)

α

A

β

Semantics Explained: CALLRETURN

matchesγm p Γc =rs1::: (m0,Return) ::rs2 matchesγm0p γ,p`

rs1, ?⇒ ?

γ,p`

[(m, Callc)], ?⇒ ?

I

matches

I

The called chain

c

in the background ruleset

Γ

is defined as

rs

1

::: (

m

0

,

Return

) ::

rs

2

I

First part

rs

1

is processed without result

I

Then there is a matching

Return

(72)

α

A

β

rs1, ?⇒ ?

γ,p`

[(m, Callc)], ?⇒ ?

I

matches

I

The called chain

c

in the background ruleset

Γ

is defined as

rs

1

::: (

m

0

,

Return

) ::

rs

2

I

First part

rs

1

I

Return

(73)

α

A

β

rs1, ?⇒ ?

γ,p`

[(m, Callc)], ?⇒ ?

I

matches

I

The called chain

c

Γ

is defined as

rs

1

::: (

m

0

,

Return

) ::

rs

2

I

First part

rs

1

I

Return

(74)

α

A

β

rs1, ?⇒ ?

γ,p`

[(m, Callc)], ?⇒ ?

I

matches

I

The called chain

c

Γ

is defined as

rs

1

::: (

m

0

,

Return

) ::

rs

2

I

First part

rs

1

is processed without result

I

Return

(75)

α

A

β

rs1, ?⇒ ?

γ,p`

[(m, Callc)], ?⇒ ?

I

matches

I

The called chain

c

Γ

is defined as

rs

1

::: (

m

0

,

Return

) ::

rs

2

I

First part

rs

1

I

Return

(76)

α

A

β

rs1, ?⇒ ?

γ,p`

[(m, Callc)], ?⇒ ?

I

matches

I

The called chain

c

Γ

is defined as

rs

1

::: (

m

0

,

Return

) ::

rs

2

I

First part

rs

1

I

Return

(77)

α

A

β

Semantics Explained: CALLRETURN

rs1, ?⇒ ?

γ,p`

[(m, Callc)], ?⇒ ?

I

matches

I

The called chain

c

Γ

is defined as

rs

1

::: (

m

0

,

Return

) ::

rs

2

I

First part

rs

1

I

Return

(78)

α

A

β

Semantics-Preserving Simplification

γ,

p

`

rs,

s

⇒

t

iff

γ,

p

`

f

rs,

s

⇒

t

I

f

::

0

a ruleset

⇒

0

a ruleset

I

f

does not change filtering behavior of firewall

I

Removing

Log

rules

I

Unfolding of user-defined chains

(79)

α

A

β

γ,

p

`

rs,

s

⇒

t

iff

γ,

p

`

f

rs,

s

⇒

t

I

f

::

0

a ruleset

⇒

0

a ruleset

I

f

I

Removing

Log

rules

I

(80)

α

A

β

γ,

p

`

rs,

s

⇒

t

iff

γ,

p

`

f

rs,

s

⇒

t

I

f

::

0

a ruleset

⇒

0

a ruleset

I

f

I

Removing

Log

rules

I

(81)

α

A

β

Semantics-Preserving Simplification

γ,

p

`

rs,

s

⇒

t

iff

γ,

p

`

f

rs,

s

⇒

t

I

f

::

0

a ruleset

⇒

0

a ruleset

I

f

I

Removing

Log

rules

I

(82)

α

A

β

γ,

p

`

rs,

s

⇒

t

iff

γ,

p

`

f

rs,

s

⇒

t

I

f

::

0

a ruleset

⇒

0

a ruleset

I

f

I

Removing

Log

rules

I

(83)

α

A

β

γ,

p

`

rs,

s

⇒

t

iff

γ,

p

`

f

rs,

s

⇒

t

I

f

::

0

a ruleset

⇒

0

a ruleset

I

f

I

Removing

Log

rules

I

(84)

α

A

β

Embedding in Ternary Logic

B

=

{

True

,

False

}

Ternary

=

{

True

,

False

,

Unknown

}

n

p

|

approx firewall

γ

stricter

rs

=

!

o

⊆

p

|

γ,

p

`

rs

,

?

⇒

!

⊆

n

p

|

approx firewall

γ

permissive

rs

=

!

o

I

Set of packets accepted by the firewall

I

We can specify a lot

. . .

(85)

α

A

β

Embedding in Ternary Logic

B

=

{

True

,

False

}

Ternary

=

{

True

,

False

,

Unknown

}

n

p

|

approx firewall

γ

stricter

rs

=

!

o

⊆

p

|

γ,

p

`

rs

,

?

⇒

!

⊆

n

p

|

approx firewall

γ

permissive

rs

=

!

o

I

. . .

(86)

α

A

β

B

=

{

True

,

False

}

Ternary

=

{

True

,

False

,

Unknown

}

n

p

|

approx firewall

γ

stricter

rs

=

!

o

⊆

p

|

γ,

p

`

rs

,

?

⇒

!

⊆

n

p

|

approx firewall

γ

permissive

rs

=

!

o

I

. . .

(87)

α

A

β

B

=

{

True

,

False

}

Ternary

=

{

True

,

False

,

Unknown

}

n

p

|

approx firewall

γ

stricter

rs

=

!

o

⊆

p

|

γ,

p

`

rs

,

?

⇒

!

⊆

n

p

|

approx firewall

γ

permissive

rs

=

!

o

I

. . .

(88)

α

A

β

B

=

{

True

,

False

}

Ternary

=

{

True

,

False

,

Unknown

}

n

p

|

approx firewall

γ

stricter

rs

=

!

o

⊆

p

|

γ,

p

`

rs

,

?

⇒

!

⊆

n

p

|

approx firewall

γ

permissive

rs

=

!

o

not executable

I

. . .

(89)

α

A

β

B

=

{

True

,

False

}

Ternary

=

{

True

,

False

,

Unknown

}

n

p

|

approx firewall

γ

stricter

rs

=

!

o

⊆

p

|

γ,

p

`

rs

,

?

⇒

!

⊆

n

p

|

approx firewall

γ

permissive

rs

=

!

o

executable

not executable

executable

I

(90)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

Spoofing Protection:

p

.

src ip

|

p

.

in iface

=

eth0

∧

γ,

p

`

rs

,

?

⇒

!

⊆

192

.

168

.

0

.

0

/

24

(91)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

Spoofing Protection:

p

.

src ip

|

p

.

in iface

=

eth0

∧

γ,

p

`

rs

,

?

⇒

!

⊆

192

.

168

.

0

.

0

/

24

(92)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

p

.

src ip

|

p

.

in iface

=

eth0

∧

γ,

p

`

rs

,

?

⇒

!

⊆

192

.

168

.

0

.

0

/

24

(93)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

p

.

src ip

|

p

.

in iface

=

eth0

∧

γ,

p

`

rs

,

?

⇒

!

⊆

192

.

168

.

0

.

0

/

24

(94)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

p

.

src ip

|

p

.

in iface

=

eth0

∧

γ,

p

`

rs

,

?

⇒

!

⊆

192

.

168

.

0

.

0

/

24

(95)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

p

.

src ip

|

p

.

in iface

=

eth0

∧

γ,

p

`

rs

,

?

⇒

!

⊆

192

.

168

.

0

.

0

/

24

(96)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

∀

eth

∈

ipassmt

.

keys

p

.

src ip

|

p

.

in iface

=

eth

∧

γ,

p

`

(97)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

check spoofing protection

ipassmt rs

−→

∀

eth

∈

ipassmt

.

keys

p

.

src ip

|

p

.

in iface

=

eth

∧

γ,

p

`

(98)

α

A

β

Spoofing Protection

ipassmt

::

interface

⇒

IP set

Example:

ipassmt

= [

eth0

7→

192

.

168

.

0

.

0

/

24

]

check spoofing protection

ipassmt rs

−→

∀

eth

∈

ipassmt

.

keys

p

.

src ip

|

p

.

in iface

=

eth

∧

γ,

p

`

(99)

α

A

β

(100)

α

A

β

Service Matrix

internal

servers

multicast

INET

localhost

ip

₁

ip

₂

AS routers

INET’

I

Partitions complete IPv4

space

I

All IP addresses in each

group have same access

rights

I

Cannot be compressed any

(101)

α

A

β

Sources

Firewall Rulesets

←

plz contribute

https://github.com/diekmann/net-network

Isabelle Theories + Haskell Tool:

https://github.com/diekmann/net-network

https://github.com/diekmann/Iptables_Semantics