Finding the Dark Cloud: Static Analysis of Cloud Configurations

1. Finding the Dark Cloud:Static Analysis ofCloud Configurations Shriram KrishnamurthiBrown University 1

2. A Cloud of Policies Application Author:end-user access-control, … Datacenter Administrator:firewalls, hypervisor Chinese Walls, … Cloud-Based App Builder

3. Cloud-Based App Builder “Need isolation at serverand network level” —Shenoy

4. … and other dens of iniquity

7. employees contractors manager DMZ int dmz dmz ext

8. tcp www blacklist blacklist telnet tcp smtp tcp www

9. ACL for External firewall: 1: DENY if: ifc=fw1_dmz, ipdest in blacklist 2: DENY if: ifc=fw1_ext, ipsrc in blacklist 3: DENY if: ifc=fw1_dmz, portdest=telnet 4: ACCEPT if: ifc=fw1_ext, ipdest=mailserver, portdest=smtp, proto=tcp 5: ACCEPT if: ifc=fw1_ext, ipdest=webserver, portdest=http, proto=tcp 6: ACCEPT if: ifc=fw1_dmz, ipdest=any outside, portdest=http, proto=tcp, ipsrc=manager 7: DROP otherwise

10. tcp www tcp  smtp tcp smtp ipsrc fw2_static

11. Problem The manager can’t connect to the Web.

12. Policy Analysis Using Margrave 12

13. When can a connection from the manager’s PC be denied if it’s • to port 80 (www) • over TCP • to any machine?

14.  p . p.dstprt = www  p.proto = TCP  p.ipdest  outIPs  p.ipsrc = manager Int.ACL denies p   p’ . Int.NAT translates p to p’  p’.dstprt = p.dstprt  p’.proto = p.proto  p’.ipdest = p.ipdest  Ext.ACL denies p’

15. p.entry-interface = IntFW.int p.ipsrc = manager p.ipdest in outIPs p.srcprt = any p.dstprt = www p.proto = tcp p’ = p except p’.entry-interface = ExtFW.dmz p’.ipsrc = fw2_static

16. When can a connection from the manager’s PC be denied if it’s • to port 80 (www) • over TCP • to any machine? • Always.

17. …same query…,but with rule-tracing enabled. • …same response…, with • Int’s ACL accepts the packet via rule 4. • Int’s NAT applies to the packet. • Int’s ACL denies the post-NAT packet via rule 7.

18. tcp tcp www www ipsrc fw2_static tcp www

19. ACL for External firewall: 1: DENY if: ifc=fw1_dmz, ipdest in blacklist 2: DENY if: ifc=fw1_ext, ipsrc in blacklist 3: DENY if: ifc=fw1_dmz, portdest=telnet 4: ACCEPT if: ifc=fw1_ext, ipdest=mailserver, portdest=smtp, proto=tcp 5: ACCEPT if: ifc=fw1_ext, ipdest=webserver, portdest=http, proto=tcp 6: ACCEPT if: ifc=fw1_dmz, ipdest=any outside, portdest=http, proto=tcp, ipsrc=managerfw2_static 7: DROP otherwise

20. thepolicy  ⊦ P • Does • its property? • satisfy

21.  Can people state them? Are they good enough? ⊦ P “They tend to think in terms of procedures,rather than goals” —Anderson 21

22. - P P’ Help people with policy evolution: study what has changed 22

23.  p . Int.ACL accepts p   p’ . Int.NAT translates p to p’  p’.dstprt = p.dstprt  p’.proto = p.proto  p’.ipdest = p.ipdest  ((Ext.ACL denies p’  Ext.ACLNew accepts p’)  (Ext.ACL accepts p’  Ext.ACLNew denies p’))

24. p.entry-interface = fw2_int p.ipsrc = contractor p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp p.entry-interface = fw2_int p.ipsrc = employee p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp Presenting “Change” A function mappingrequests tochanges in outcome Deny to Permit Permit to Deny  packets

25. Denied  Permit p.entry-interface = fw2_int p.ipsrc = manager p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp p.entry-interface = fw2_int p.ipsrc = contractor p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp p.entry-interface = fw2_int p.ipsrc = employee p.ipdest in outIPs p.srcprt = any p.dstprt = www p.protocol = tcp

26. Change as a First-Class Entity • Restrict changes to External Firewall View • Which machines lost privileges? Query • Confirm no machines gained privileges Verification

27. Configuration checking Refactoring testing ? “What if” questions Upgrade checking Finding “hotspots” Mutationtesting 27

28. Scope of Margrave • Most of XACML 1.0 and 2.0 • Cisco IOS: • ACL: standard and extended • NAT: static; dynamic: ACL-based, map-based • routing: static and policy-based • limited: BGP announcements and VPN endpoints • Amazon Access Policy Language (in SQS) • Hypervisor, based on sHype (IBM) • A Datalog-based intermediate language

29. Performance Production firewall (1108 rules): Change-impact: Time: 2.5 sec Space: baseline + 83 Mb List all superfluous rules: Time: 10 min Space: baseline + 467 Mb Production XACML policy: Verification: Time: <10 millisec Space: baseline + 316 Kb Change-impact: Time: 2 millisec Space: baseline + 16 Kb

30. Under the Hood Translation into first-order logic Propositionalize to BDDs and SAT Bernays-Schönfinkel-Ramsey class Extended to multi-sorted logic Some small theories for networking Aggregation to compress i. and o. Rule-tracing  EDBs and IDBs in models

31. Upcoming Work • More sophisticated modeling of state • Visualization of output • Generating constraints on components • Suggesting repairs • Handling numerics

32. Dan Dougherty [WPI] • Kathi Fisler [WPI] • Tim Nelson [WPI] • Alums: • Leo Meyerovich [Brown u.g.  Berkeley] • Michael Tschantz [Brown u.g.  CMU] http://www.margrave-tool.org/