Re: Proverbial appliance vs software based firewall

[Mikael Olsson <mikael.olsson () clavister com>]

"Patrick M. Hausen" wrote:
> A point that IMHO is still missing in this discussion is the
> funny impression that you just need to sit down with an empty
> file in your text editor and you could go and write a mature
> _and_ secure implementation of TCP/IP from scratch.
> It just needs to be small, the hardware vendor is in control
> of everything - do you really believe your average hardware/
> appliance manufacturer is competent enough to do that?

No, we are under no such silly impressions.

However, we're talking about firewalls here, not toasters.
Firewall vendors SHOULD be competent enough to do that -- how the 
heck are they otherwise supposed to be able to know where the 
problem areas are?

...

> As we are proven over and over again implementing these
> protocols is definitely non-trivial. And - as shown by
> new funny ways of exploiting stateful inspection firewalls
> (fragmentation tricks, partial ACK with carefully crafted
>  buffers, ...) - the firewall _must_ have a _complete_
> understanding of all protocols in question. 

... a point which you acknowledged here. [1]

And, yes, I personally agree that the useful limit of stateful packet 
filtering is layer four for TCP.  But that could be because I came up
with the attacks you mention :P [2]


> And all programmers are as smart as Van Jacobson, ...
> And they will get everything correct the first time that
> took Kahn, VJ, and all the other brilliant minds years
> to solve.

We have prior art to look at. There's a world of difference there.

> From a firewalling perspective, that's doubly useful, because (at 
least for open source stuff) we can look at it and try to determine
where the problem areas are.


> Just look at how long and painful the process of reimplementing
> the IP stack was for the Linux crowd. 3 implementations - or
> are we counting 4 already? That means at least 2 complete
> make-overs to get it right.

Oh please, don't get me started on the "quality of open source
in general" debate or we'll be at it until next year. [3]


> I'd pick an application level gateway based on a general
> purpose OS with a BSD based IP implementaion over something
> that is called "embedded" or "appliance" or "micro-blah"
> any time.

One thing here: Marcus didn't say "build _everything_ from scratch".
He said that "hardened" should mean "I started with the kernel
and built my way up from there" (<-- note, TCP/IP stack included)
rather than "I deleted a couple of SUID binaries and stopped inetd".


> Doesn't it feel good to know, that _they_ got tcp_input() right
> and you don't need to worry about partial ACKs or some such,
> when writing your application level proxy?

This point was less than well thought-through.

1. If you're writing an ALG, you don't ever have to worry about
   partial ACKs. Your interpretation is the correct one, since this
   is exactly what you'll be telling the other end.

And, as a sidenote:
2. SPF firewalls on top of linux are no less secure against partial ACKs.
   The fact that TCP/IP stack in Linux doesn't generate partial ACKs 
   has nothing to do with the operation of an SPF.  As a matter of 
   fact, one could quite convincingly argue that Linux stacks are 
   doing the wrong thing by refusing to re-send partial datagrams:
   it doesn't take into account resource shortages at the receiving end.


Regards,
/Mikael Olsson

-- 
Mikael Olsson, Clavister AB
Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
Fax: +46 (0)660 122 50       WWW: http://www.clavister.com

[1] On a related note: I also think IDSes that grep for attack 
    signatures in raw TCP are equally b0rken. There. Now I got to 
    say that too.

[2] Yeah, the Dataprotect people + Dug Song came up with the server 
    side variation of the fragmentation vulnerability independently 
    at the same time. (Hi guys! :))

[3] "gcc -c myfirstmajorcodingproject.c"
        ^^^^^ look mommy! shouldn't there be a
              "-Wall" somewhere around here?
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards