Changes between Version 8 and Version 9 of GENIEducation/SampleAssignments/OpenFlowFirewallAssignment/onepage

Timestamp:

08/14/13 14:57:52 (11 years ago)

Author:

epittore@bbn.com

Comment:

--

GENIEducation/SampleAssignments/OpenFlowFirewallAssignment/onepage

@@ -154 +154 @@
   Note that this approach to implementing a firewall has drawbacks. Because the OpenFlow controller does not, and can not efficiently, track the precise state of the TCP flow it is forwarding, the rules are a little bit sloppy. In particular, connections “in progress” when the firewall comes online are not differentiated from new connections created after the firewall is initialized, and connection closings can not be detected by the controller. The former can be managed by inspecting the packet headers included in the ''OFPT_PACKET_IN'' message when a connection is opened, but the latter cannot easily be mitigated. This means that connections with long idle times (and 300 s is not particularly unusual, in the long tail of TCP connection statistics!) will be disconnected unnecessarily, and new connections reusing recent four-tuples may be passed through the firewall without examination by the controller. [[BR]]
 
-'''Exercises and Questions for 3.1'''
+'''Exercises for 3.1'''
 
   1. '''Exercise 1:''' fill up the blanks in function `switch_ready` to insert rules into the openflow switch that allow ICMP and ARP packets to go through
@@ -200 +200 @@
   '''Extra Credit''' [[BR]]
   For extra credit (if permitted by your instructor), generate TCP reset segment at the firewall to reset rejected connections.
+
+
+ - '''3.2 Extending the Firewall'''
+
+ OpenFlow controllers can also make complex flow decisions based on arbitrary state. This is one benefit to removing the controller from the network device — the controller is free to perform any computation required over whatever data is available when making decisions, rather than being constrained to the limited computing power and storage of the network device. For this exercise, you will extend the firewall described in Section 3.1 to include rudimentary denial of service prevention using this capability.
+
+  '''Extended Firewall Configuration'''
+
+  You will extend the firewall configuration language to accept an additional final parameter, an integer representing the number of allowable connections matching a given rule at any point in time. As before, the keyword any will be used to indicate that no limiting is to be performed on the rule. The new firewall configuration syntax is:
+{{{
+<ip>/<netmask> <port> <ip>/<netmask> <port> <limit>
+}}}
+
+  '''Connection Limiting Semantics'''
+
+  The extended firewall will perform flow matching as before, with one added check: if the number of existing flows allowed by a given rule exceeds the limit specified in the configuration, a new flow matching that rule will be denied. The number of existing flows matching a given rule is computed as the number of currently active flow matches in the OpenFlow device for that rule. You may wish to look into the ''OFPT_FLOW_REMOVED'' message for help in implementing this. If a connection rule specifies any as the flow limit, no limiting will be performed by the controller. [[BR]]
+
+  Note that the timeout-based nature of flow removal dictates that small connection limits will be quite limiting. Keep this in mind when testing your firewall!
+
+
+'''Exercises for 3.2'''
+
+  1. '''Exercise 1:''' Extend the firewall.rb to take the new firewall configuration file and accept the additional parameter
+
+  '''Hints'''
+ - 
+  - 
+   - You probably want to change the `rule` structure defined in function `add_rule` to add two members: `limit` and `count` to store the maximum number of active flows allowed and the current number of active flows. 
+   - You should also over-ride the function `flow_removed` to subtract `count` when-ever a flow rule expired.
+   - You might also set the idle_timeout to a smaller number (e.g., 30) so that you do not need to wait for too long before they get removed
+   - To verify your implementation, use `-P` option in iperf to add TCP flows.