bgreenb / firewall

Experimental per group firewall for openflow capable switches using the ryu controller framework

OpenFlow Switch as a Low Impact Firewall

Description

• Use iptables style rules and a json based config file to make a low impact firewall on an openflow capable switch

• Ability to create groups of related ip addresses, subnets, hostnames, ... etc, for easier rule creation.

• Extended capabilities include python-style regex support and expandability via plugins for letting packets through

Compatibility

• Written only for Python 2 for now

• Tested on systems running CentOS 6.8 and 7 with a test network using a Pica8 3290 openflow capable switch

Installation

1. This program uses the Ryu controller framework, so make sure that is installed first.
2. Required Additional Python Packages from PyPI :

• Pycryptodome
• IPy
• netaddr

3. Depending on what type of networking you are running the controller on, you might have to register the controller's ip address on the switch side. In my case I had to do this, otherwise no packets would be sent to the controller.

Running the Firewall

• Use the included GroupGen utility to make your group config file
• Start the controller using:

ryu-manager firewall_v3.py --user-flags flags.py --Rules YourRules.txt --Groups YourGroupConfig.conf --SigFile YourGroupSignature.sig --Key YourPublicKey.pub --verbose

• The user flags argument is used to tell Ryu what type of arguments to expect for the controller such as where the rules, config, and signature files are located.
• The public key provided to the --Key argument will be used to verify the group config file against the generated signature passed in by --SigFile

Writing Plugins

• In the plugins directory, you can write a small python script that can extend the number of ways to verify that incoming ip addresses to the controller are part of a defined group. Included in that directory is a template for a plugin that includes a verify method which the ryu app will call when the included methods of group checking fail.

• For now the controller will take anything in the plugins directory with a .py extension and treat it as a plugin.

firewall's Issues

Potential issue when doing UDP packet matching

• This seems to be a place to deal with UDP packet, but the last argument given to the compare() method is "tcp_dport":
  

  FireWall/apps/firewall_v3.py

  Line 264 in f726b5a

  matched_rule = self.comparison.compare(PROTOCOLS[ipProto], srcIp, dstIp, udp_sport, tcp_dport)

• Similar potential issue here: "... ,udp_dst=tcp_dport, ... "
  

  FireWall/apps/firewall_v3.py

  Line 272 in f726b5a

  udp_src=udp_sport, udp_dst=tcp_dport, eth_type=0x800)