To launch the springbok project you need to have:
- python
- networkX
- PyGtk
- matplotlib
- LaTeX (for the documentation)
- reportlab
- graphviz
apt-get install python-gtk2 python-networkx python-matplotlib python-reportlab python-netaddr
pip install graphviz
python springbok.py
- Cisco Asa
- Juniper Netscreen
- Fortinet Fortigate
- Iptables (cf. Using iptables)
v0.6:
- Add Iptables
- Implement VDOM for Fortigate
- Add generation of anonymous configuration file
You can import your script configuration file or the output of the iptables-save command.
In order to import iptables configuration files, you must concatenate the output of the ifconfig command with your configuration file :
ifconfig | cat - my_iptables.conf > /tmp/out && mv /tmp/out my_iptables.conf
Start to import a configuration file File → Import configuration.
You can select multiple files. For each file the tool will try to detect the equipment type.
Once the import finished, the tool launches the construction of ROBDD, which may decrease temporarily the performance of the tool. But don't worry, it won't block the software. In fact, the operation is launched in a thread.
You can open saved project File → Open project.
Once again, the tool launches the construction of ROBDD.
You can save the state of the current project File → Save project.
After importing files, the tool draws the network topology. You can interact with all elements. The elements can be moved and you can zoom in or out using your mouse scroll or the zoom bar at the bottom of the zone. The "Redraw" button redraws the topology. If you double click on an element a default action is launched.
Default action:
- Show the configuration file : the firewall configuration is not editable.
When you right click on a firewall a popup menu appears and you can:
- Show the configuration file : the firewall configuration is not editable.
- Add a note : this will display a small note on the firewall
- Detect anomaly : this will launch the internal anomaly detection
- Show configuration error : this will show unused objects and unbounded rules
- Show defined object list : this will show the list of defined objects
- Show enabled services : this will show all enable services (based on the rule destination ports)
- Generate anonymous configuration : this enables you to create an anonymous configuration file
- Remove : this will remove the selected firewall
Default action:
- Add a note : this will display a small note on the network
When you right click on a node a popup menu appear and you can:
- Add a note : this will display a small note on the network
- Add itinerary form this place : this will add the start marker on the network (see query path)
- Add itinerary to this place : this will add the end marker on the network (see query path)
- Change sensitivity : this enables you to change the color of the network (for faster overview)
Default action:
- Show all ACLs : this will show all ACLs from/to this network
When you right click on an edge a popup menu appear and you can:
- Select an ACL : this enables you to show an ACL from/to this network
When you right click on the background a popup menu appear and you can:
- Clear query path : this will remove marked paths and markers (see query path)
- Choose a background image : this will enable you to choose a background image (png file only)
Algorithms for detecting anomalies are based on the work of Al-Shaer and H. Hamed and the FIREMAN project.
-
Masked rules: The rule will not match any packets and action defined by the rule will never be taken.
-
Shadowing: The rule has been defined to accept/deny some packets which have been denied/accepted by preceding rules.
-
Redundancy: All the packets have been accepted/denied by preceding rules or will not take this path.
-
Redundancy and correlation: Part of the packets for this rule have been denied/accepted. Others are either accepted/denied or will not take this path.
-
Partially masked rules: The rule matches some packets that have already been matched.
-
Correlation: Part of the packets supposed to be accepted/denied by the rule have been denied/accepted by preceding rules.
-
Generalization: The rule is a generalization of preceding rules since preceding rules match a subset of the current rule but have a different action.
-
Redundant: If preceding rules are removed, all the packets that match preceding rules can still be accepted/denied by the current rule. Therefore, preceding rules are redundant.
- Shadowing: The rule is shadowed by upstream ACLs. It tries to accept some packets that are blocked on all reachable path.
- Raised security level: The rule probably reveals a raised security level. Certain packets might be allowed to access part of the network path but not to the end of this path.
- Redundant: The rule is probably a redundancy since the packets supposed to be denied will not reach this ACL anyway. However, multiple lines of defense are often encouraged in practice to increase overall security level.
- Correlation: The rule is probably an overlapping rule. Part of the packets intend to be accepted/denied by this rule have been denied/accepted by upstream ACLs.
You can launch the internal detection of a firewall by clicking on it Right click → Detect anomaly.
The internal detection will take each ACL of the firewall individually and will check for anomalies between the rules. The 'Deep search' option enables you to have all blamed rules on an anomaly. However, this option will take too much time to perform.
You can launch the distributed detection of all firewalls by clicking on the menu Audit → Distributed detection.
The distributed detection will construct rooted tree for each pair of network and will check for anomalies along the path. The 'Deep search' option enables you to have all blamed rules on an anomaly. However, this option will take too much time to perform.
You can seek for a path between two networks. To start a search:
- Place the start marker on a network
Right click on a network → Itinerary from this place - Place the end marker on another network
Right click on a network → Itinerary to this place
Then a popup shows up and you can specify:
- The protocol
- The ip source
- The port source
- The ip destination
- The port destination
You can leave a field empty to not take it into account.
If paths are found, you will be able to select a path in the right lateral pane.
- If you select a row, this will highlight the path on the network topology
- If you double click on a row, this will show you the concerned rules
You can import a query file to launch multiple query requests Audit → Import query file.
Each query must be separated with a single line of two hyphens.
The syntax is the following (if you don't want to specify a field just delete it):
protocol : protocol_value
ip-source : ip_value [optional_mask_value]
port-source : port_value
ip-destination : ip_value [optional_mask_value]
port-destination : port_value
You can export result of the following tabs Audit → Export result:
- Internal detection
- Distributed detection
- Configuration error
- Query path (automatic version only)
The Springbox cli is a small script using springbok's module to export equipment ACL to an unified csv format.
python springbox_cli.py [OPTION]... [FILE]
Usage: ./springbox_cli.py [OPTION]... [FILE]
Parse firewall configuration files (Cisco Asa, JuniperNetscreen, Fortinet Forigate) and export parsed rules to csv format.
Create a folder tree of the configuration ACL (springbok_rulesXXXXXX)
-h, --help show this help
-n, --no-confirm no confirmation on the device detected
Example:
./springbox_cli.py -n cisco_example1.conf cisco_example2.conf