ecen5273

ECEN5273 Coursework
git clone https://git.pngu.org/ecen5273
Log | Files | Refs | README

readme.md (4005B)

PA4 IPsec

Introduction

In today’s digital world, secure communication is vital to protect sensitive information from malicious actors. This assignment explores the implementation of IPsec (internet protocol security) using eBPF (extended Berkeley Packet Filter) to safeguard the communication between Alice and Bob. The goal is to prevent Eve, an eavesdropper, from intercepting and sniffing their communication. This approach ensures that the transmitted data remains confidential, meaning Eve cannot see the message content. As an example, without IPsec, Eve can indeed see a conversation between Alice and Bob as below:

example

Development setup using Multipass

## Launch Alice VM
$ multipass launch 22.04 --name alice --disk 10G --memory 4G --cpus 2
## Launch Bob VM
$ multipass launch 22.04 --name bob --disk 10G --memory 4G --cpus 2
## Get information (e.g., IP addresses) about Alice and Bob VMs
$ multipass info
## Open shell on Alice machine
$ multipass shell alice
## Open shell on Bob machine
$ multipass shell bob

Key Components

  1. Capture ingress & egress UDP packets port 12345
  2. Public key exchange share share key derive
  3. Packet encryption and decryption
  4. Message statistics

Capture ingress & egress UDP packets

Your very first task is to modify the provided ingress.c file so that it can do the following. - Capture both ingress and egress packets - Only process UDP packets using port 12345 - Print the UDP payload content to trace_pipe

The expected result of this section is as follows: p1

Public key exchange and share key derive

In this assignment, we will use the Diffie-Hellman key exchange algorithm. - To simplify the problem, we can keep the prime modulus p = 23 and generator g = 5 as fixed values. However, Alice and Bob’s private number a and b, respecitvely, need to be randomly generated every time the eBPF program is run. - Since eBPF cannot generate the UDP packet on its own but rather capture and manipulate packets passing through a network interface, we need a way to exchange their public key A and B via the first message sent from Alice and Bob. For example: - From netcat, Alice and Bob send a message with a blank space at the beginning of the conversation. - From eBPF, you can replace the first egress message content with their public key. - After receiving the public key from their partner, Alice and Bob need to derive the shared key using their partner’s public key and their private key.

The expected result of this section is as follows: p2

Message encryption and decryption

After Alice and Bob derive the shared key, meaning from the second message onward, XOR encryption/decryption can be applied to keep Eve from sniffing the message content. - Encrypt egress messages - Decrypt ingress messages

The expected result of this section is as follows. Note that Alice and Bob send a message with a blank space/line to initiate the key exchange process at the beginning of their conversation. p3

Message statistics

We want to know between Alice and Bob, who is more talkative? - Count the number of egress messages and show the log at trace_pipe - Count the number of ingress messages and show the log at trace_pipe

Usage

$ ecc ebpf_ipsec.c
# ecli run package.json
# echo 1 > /sys/kernel/debug/tracing/tracing_on
# cat /sys/kernel/debug/tracing/trace_pipe

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
## PA4 IPsec

### Introduction
In today's digital world, secure communication is vital to protect
sensitive information from malicious actors. This assignment explores
the implementation of IPsec (internet protocol security) using eBPF
(extended Berkeley Packet Filter) to safeguard the communication
between Alice and Bob. The goal is to prevent Eve, an eavesdropper,
from intercepting and sniffing their communication. This approach
ensures that the transmitted data remains confidential, meaning Eve
cannot see the message content. As an example, without IPsec, Eve can
indeed see a conversation between Alice and Bob as below:

![example](img/example.png)

### Development setup using Multipass
- Follow instructions here to install Multipass:
[multipass.run](https://multipass.run/install)
- Eve will be your local machine (eg. laptop), Alice and Bob are two
different Multipass VMs.
```shell
## Launch Alice VM
$ multipass launch 22.04 --name alice --disk 10G --memory 4G --cpus 2
## Launch Bob VM
$ multipass launch 22.04 --name bob --disk 10G --memory 4G --cpus 2
## Get information (e.g., IP addresses) about Alice and Bob VMs
$ multipass info
## Open shell on Alice machine
$ multipass shell alice
## Open shell on Bob machine
$ multipass shell bob
```
- Recreate the scenario in the introduction:
    - On Eve machine (`localhost`): 
    `$ sudo tcpdump -i <broadcast interface> udp port 12345 -A`,
    broadcast interface can be obtained on local machine with IP
    `10.62.70.1`.
    - On Alice VM: `$ nc -ul 12345`
    - On Bob VM: `$ nc -u -p 12345 <Alice IP> 12345`

### Key Components
1. Capture ingress & egress UDP packets port 12345
2. Public key exchange share share key derive
3. Packet encryption and decryption
4. Message statistics

### Capture ingress & egress UDP packets
Your very first task is to modify the provided [`ingress.c`](ingress.c)
file so that it can do the following.
- Capture both ingress and egress packets
- Only process UDP packets using port 12345
- Print the UDP payload content to `trace_pipe`

The expected result of this section is as follows:
![p1](img/p1.png)

### Public key exchange and share key derive
In this assignment, we will use the Diffie-Hellman key exchange
algorithm.
- To simplify the problem, we can keep the prime modulus `p = 23` and
generator `g = 5` as fixed values. However, Alice and Bob's private
number `a` and `b`, respecitvely, need to be randomly generated every
time the eBPF program is run.
- Since eBPF cannot generate the UDP packet on its own but rather
capture and manipulate packets passing through a network interface, we
need a way to exchange their public key `A` and `B` via the first
message sent from Alice and Bob. For example:
    - From `netcat`, Alice and Bob send a message with a blank space at
    the beginning of the conversation.
    - From `eBPF`, you can replace the first egress message content
    with their public key.
- After receiving the public key from their partner, Alice and Bob need
to derive the shared key using their partner's public key and their
private key.

The expected result of this section is as follows:
![p2](img/p2.png)

### Message encryption and decryption
After Alice and Bob derive the shared key, meaning from the second
message onward, XOR encryption/decryption can be applied to keep Eve
from sniffing the message content.
- Encrypt egress messages
- Decrypt ingress messages

The expected result of this section is as follows. Note that Alice and
Bob send a message with a blank space/line to initiate the key exchange
process at the beginning of their conversation.
![p3](img/p3.png)

### Message statistics
We want to know between Alice and Bob, who is more talkative?
- Count the number of egress messages and show the log at `trace_pipe`
- Count the number of ingress messages and show the log at `trace_pipe`

### Usage
```
$ ecc ebpf_ipsec.c
# ecli run package.json
# echo 1 > /sys/kernel/debug/tracing/tracing_on
# cat /sys/kernel/debug/tracing/trace_pipe
```