<div class="csl-bib-body">
<div class="csl-entry">Bodei, C., Ceragioli, L., Degano, P., Focardi, R., Galletta, L., Luccio, F., Tempesta, M., & Veronese, L. (2021). FWS: Analyzing, Maintaining and Transcompiling Firewalls. <i>Journal of Computer Security</i>, <i>29</i>(1), 77–134. https://doi.org/10.3233/jcs-200017</div>
</div>
-
dc.identifier.issn
0926-227X
-
dc.identifier.uri
http://hdl.handle.net/20.500.12708/137703
-
dc.description.abstract
Firewalls are essential for managing and protecting computer networks. They permit specifying which packets are allowed to enter a network, and also how these packets are modified by IP address translation and port redirection. Configuring a firewall is notoriously hard, and one of the reasons is that it requires using low level, hard to interpret, configuration languages. Equally difficult are policy maintenance and refactoring, as well as porting a configuration from one firewall system to another.
To address these issues we introduce a pipeline that assists system administrators in checking if: (i) the intended security policy is actually implemented by a configuration; (ii) two configurations are equivalent; (iii) updates have the desired effect on the firewall behavior; (iv) there are useless or redundant rules; additionally, an administrator can (5) transcompile a configuration into an equivalent one in a different language; and (vi) maintain a configuration using a generic, declarative language that can be compiled into different target languages.
The pipeline is based on IFCL, an intermediate firewall language equipped with a formal semantics, and it is implemented in an open source tool called FWS. In particular, the first stage decompiles real firewall configurations for iptables, ipfw, pf and (a subset of) Cisco IOS into IFCL. The second one transforms an IFCL configuration into a logical predicate and uses the Z3 solver to synthesize an abstract specification that succinctly represents the firewall behavior.
System administrators can use FWS to analyze the firewall by posing SQL-like queries, and update the configuration to meet the desired security requirements. Finally, the last stage allows for maintaining a configuration by acting directly on its abstract specification and then compiling it to the chosen target language.
Tests on real firewall configurations show that FWS can be fruitfully used in real-world scenarios.
en
dc.language.iso
en
-
dc.publisher
IOS Press
-
dc.relation.ispartof
Journal of Computer Security
-
dc.subject
Software
-
dc.subject
Hardware and Architecture
-
dc.subject
Computer Networks and Communications
-
dc.subject
Z3
-
dc.subject
Safety, Risk, Reliability and Quality
-
dc.subject
Firewall
-
dc.subject
FWS
-
dc.subject
Transcompilation
-
dc.title
FWS: Analyzing, Maintaining and Transcompiling Firewalls