diff options
Diffstat (limited to 'pa4_ipsec/readme.md')
-rw-r--r-- | pa4_ipsec/readme.md | 102 |
1 files changed, 102 insertions, 0 deletions
diff --git a/pa4_ipsec/readme.md b/pa4_ipsec/readme.md new file mode 100644 index 0000000..3b06864 --- /dev/null +++ b/pa4_ipsec/readme.md @@ -0,0 +1,102 @@ +## PA4 IPsec + +### Introduction +In today's digital world, secure communication is vital to protect +sensitive information from malicious actors. This assignment explores +the implementation of IPsec (internet protocol security) using eBPF +(extended Berkeley Packet Filter) to safeguard the communication +between Alice and Bob. The goal is to prevent Eve, an eavesdropper, +from intercepting and sniffing their communication. This approach +ensures that the transmitted data remains confidential, meaning Eve +cannot see the message content. As an example, without IPsec, Eve can +indeed see a conversation between Alice and Bob as below: + + + +### Development setup using Multipass +- Follow instructions here to install Multipass: +[multipass.run](https://multipass.run/install) +- Eve will be your local machine (eg. laptop), Alice and Bob are two +different Multipass VMs. +```shell +## Launch Alice VM +$ multipass launch 22.04 --name alice --disk 10G --memory 4G --cpus 2 +## Launch Bob VM +$ multipass launch 22.04 --name bob --disk 10G --memory 4G --cpus 2 +## Get information (e.g., IP addresses) about Alice and Bob VMs +$ multipass info +## Open shell on Alice machine +$ multipass shell alice +## Open shell on Bob machine +$ multipass shell bob +``` +- Recreate the scenario in the introduction: + - On Eve machine (`localhost`): + `$ sudo tcpdump -i <broadcast interface> udp port 12345 -A`, + broadcast interface can be obtained on local machine with IP + `10.62.70.1`. + - On Alice VM: `$ nc -ul 12345` + - On Bob VM: `$ nc -u -p 12345 <Alice IP> 12345` + +### Key Components +1. Capture ingress & egress UDP packets port 12345 +2. Public key exchange share share key derive +3. Packet encryption and decryption +4. Message statistics + +### Capture ingress & egress UDP packets +Your very first task is to modify the provided [`ingress.c`](ingress.c) +file so that it can do the following. +- Capture both ingress and egress packets +- Only process UDP packets using port 12345 +- Print the UDP payload content to `trace_pipe` + +The expected result of this section is as follows: + + +### Public key exchange and share key derive +In this assignment, we will use the Diffie-Hellman key exchange +algorithm. +- To simplify the problem, we can keep the prime modulus `p = 23` and +generator `g = 5` as fixed values. However, Alice and Bob's private +number `a` and `b`, respecitvely, need to be randomly generated every +time the eBPF program is run. +- Since eBPF cannot generate the UDP packet on its own but rather +capture and manipulate packets passing through a network interface, we +need a way to exchange their public key `A` and `B` via the first +message sent from Alice and Bob. For example: + - From `netcat`, Alice and Bob send a message with a blank space at + the beginning of the conversation. + - From `eBPF`, you can replace the first egress message content + with their public key. +- After receiving the public key from their partner, Alice and Bob need +to derive the shared key using their partner's public key and their +private key. + +The expected result of this section is as follows: + + +### Message encryption and decryption +After Alice and Bob derive the shared key, meaning from the second +message onward, XOR encryption/decryption can be applied to keep Eve +from sniffing the message content. +- Encrypt egress messages +- Decrypt ingress messages + +The expected result of this section is as follows. Note that Alice and +Bob send a message with a blank space/line to initiate the key exchange +process at the beginning of their conversation. + + +### Message statistics +We want to know between Alice and Bob, who is more talkative? +- Count the number of egress messages and show the log at `trace_pipe` +- Count the number of ingress messages and show the log at `trace_pipe` + +### Usage +``` +$ ecc ebpf_ipsec.c +# ecli run package.json +# echo 1 > /sys/kernel/debug/tracing/tracing_on +# cat /sys/kernel/debug/tracing/trace_pipe +``` |