Benutzer:Grey/Security Tool Developement Projekt EN

Documentation

HowTo

For what do we need the testscript?

For testing a firewall, we need the ability to generate and send different packets through our firewall. Our testscript ist here the manager, who administer to the sending and generating of the packets, while using the wrapper-classes. The testscript is refered in the commandline(the path to the script is refered) to FWTEST, so that FWTEST has not be compiled again for using another testscript.

Which language is used to implement a testscript? And why this language?

Python.

Python has many advantages:

• simple syntax and easy to learn
• no memory management required TODO:in den dt. teil übernehmen
• no type declaration of variables TODO:in den dt. teil übernehmen
• a mighty programming library
• simple to integrate in C and reversed
• platformindependent

What abilities has a testscript?

• default packets
• IP-packets
• UDP-packets
• TCP-packets
• ICMP-packets
• sending packets
• everything that Python can

How does a breadboard construction for a testscript looking?

As a basic principle we can say that FWTEST has two agents- and one FWTEST-process.

We have two mostly used breadboard constructions.

variation 1:

We have three computers: the firewall, agent a(achen) and agent b(bchen). On achen and bchen is running an instance of our agent, additionaly is an instance of fwtest running on one of our agents (achen or bchen). So one agent adopts the function of fwtest.

A possible construction could be:

http://www.freitagsrunde.org/~grey/sonstiges/std/versuchsaufbau1.png

variation 2:

The ohther variation is based on four computers, two computers are functioning as agents and the third adopts the function of the controller (so FWTEST). The fourth, the firewall, is untouched.

A possible construction could be:

http://www.freitagsrunde.org/~grey/sonstiges/std/versuchsaufbau2.png

How am I writing my own testscripts?

Implementing a testscript is easy as breathing air. For example let us take a look at implementing a simple UDP-packet. At first the generation of a default ip-packet and its field modifications is done. After that a default UDP-packet is genrated, independently from the default IP-packet. We also have to modify the fields content of the UDP-packet, so that we meet our needs.

To finish, the default packets have to be melted together. We take the UDP-packet as payload for the IP-packet, followed by FIXUP, so that the chekcsum is corrected.

Now with the transceive-function the UDP/IP-packet can be send.

A detailed discription of writing a UDP-testscript can be found here: UDP-testscript

Limits of tests

Testscripts shall simulate the traffic and as a sequence representing a realistic packet exchange.

For example, in our netdate-example we have a restriction.

We don't really use the www.heise.de Server, but our agent take place of the Server, so that of course the IP-address from our agent b(bchen) is taken and shown in the IP-packet.

It is not really a restriction of the testscript, but of the breadboard construction. Is bchen www.heise.de the restriction is obsolete.

Another restriction is the complex emulation of a connection (road section), as the construction of ICMP Fragmentation Needed shows. We don't have all servers and computer that are needed for the reality, but that is not the point. We don't need them to test the firewall in a realistic way. We only want to test the firewall, if it has weak points or misconfigurations.

So only the packets, which pass the firewall are important.