aboutsummaryrefslogtreecommitdiff
path: root/pa4_ipsec/readme.md
diff options
context:
space:
mode:
Diffstat (limited to 'pa4_ipsec/readme.md')
-rw-r--r--pa4_ipsec/readme.md102
1 files changed, 102 insertions, 0 deletions
diff --git a/pa4_ipsec/readme.md b/pa4_ipsec/readme.md
new file mode 100644
index 0000000..3b06864
--- /dev/null
+++ b/pa4_ipsec/readme.md
@@ -0,0 +1,102 @@
+## PA4 IPsec
+
+### Introduction
+In today's digital world, secure communication is vital to protect
+sensitive information from malicious actors. This assignment explores
+the implementation of IPsec (internet protocol security) using eBPF
+(extended Berkeley Packet Filter) to safeguard the communication
+between Alice and Bob. The goal is to prevent Eve, an eavesdropper,
+from intercepting and sniffing their communication. This approach
+ensures that the transmitted data remains confidential, meaning Eve
+cannot see the message content. As an example, without IPsec, Eve can
+indeed see a conversation between Alice and Bob as below:
+
+![example](img/example.png)
+
+### Development setup using Multipass
+- Follow instructions here to install Multipass:
+[multipass.run](https://multipass.run/install)
+- Eve will be your local machine (eg. laptop), Alice and Bob are two
+different Multipass VMs.
+```shell
+## Launch Alice VM
+$ multipass launch 22.04 --name alice --disk 10G --memory 4G --cpus 2
+## Launch Bob VM
+$ multipass launch 22.04 --name bob --disk 10G --memory 4G --cpus 2
+## Get information (e.g., IP addresses) about Alice and Bob VMs
+$ multipass info
+## Open shell on Alice machine
+$ multipass shell alice
+## Open shell on Bob machine
+$ multipass shell bob
+```
+- Recreate the scenario in the introduction:
+ - On Eve machine (`localhost`):
+ `$ sudo tcpdump -i <broadcast interface> udp port 12345 -A`,
+ broadcast interface can be obtained on local machine with IP
+ `10.62.70.1`.
+ - On Alice VM: `$ nc -ul 12345`
+ - On Bob VM: `$ nc -u -p 12345 <Alice IP> 12345`
+
+### Key Components
+1. Capture ingress & egress UDP packets port 12345
+2. Public key exchange share share key derive
+3. Packet encryption and decryption
+4. Message statistics
+
+### Capture ingress & egress UDP packets
+Your very first task is to modify the provided [`ingress.c`](ingress.c)
+file so that it can do the following.
+- Capture both ingress and egress packets
+- Only process UDP packets using port 12345
+- Print the UDP payload content to `trace_pipe`
+
+The expected result of this section is as follows:
+![p1](img/p1.png)
+
+### Public key exchange and share key derive
+In this assignment, we will use the Diffie-Hellman key exchange
+algorithm.
+- To simplify the problem, we can keep the prime modulus `p = 23` and
+generator `g = 5` as fixed values. However, Alice and Bob's private
+number `a` and `b`, respecitvely, need to be randomly generated every
+time the eBPF program is run.
+- Since eBPF cannot generate the UDP packet on its own but rather
+capture and manipulate packets passing through a network interface, we
+need a way to exchange their public key `A` and `B` via the first
+message sent from Alice and Bob. For example:
+ - From `netcat`, Alice and Bob send a message with a blank space at
+ the beginning of the conversation.
+ - From `eBPF`, you can replace the first egress message content
+ with their public key.
+- After receiving the public key from their partner, Alice and Bob need
+to derive the shared key using their partner's public key and their
+private key.
+
+The expected result of this section is as follows:
+![p2](img/p2.png)
+
+### Message encryption and decryption
+After Alice and Bob derive the shared key, meaning from the second
+message onward, XOR encryption/decryption can be applied to keep Eve
+from sniffing the message content.
+- Encrypt egress messages
+- Decrypt ingress messages
+
+The expected result of this section is as follows. Note that Alice and
+Bob send a message with a blank space/line to initiate the key exchange
+process at the beginning of their conversation.
+![p3](img/p3.png)
+
+### Message statistics
+We want to know between Alice and Bob, who is more talkative?
+- Count the number of egress messages and show the log at `trace_pipe`
+- Count the number of ingress messages and show the log at `trace_pipe`
+
+### Usage
+```
+$ ecc ebpf_ipsec.c
+# ecli run package.json
+# echo 1 > /sys/kernel/debug/tracing/tracing_on
+# cat /sys/kernel/debug/tracing/trace_pipe
+```