Modification of Pktfilter tool 10/9/2015Pktfilter modification - Brad Baker1 Brad Baker CS591 Spring 2007 Term project

The Pktfilter tool  Open source project listed on sourceforge (  Developed by Jean-Baptiste Marchand, project inactive since February 2003  Uses the Win32 filtering API (Windows 2000 packet filtering)  Runs as a service, configures filtering API on start  Provides command line utility 10/9/2015Pktfilter modification - Brad Baker2

Pktfilter basics  Filtering is controlled through a rules file  Rules define a default action, then exceptions – For example, block everything then pass each allowed connection – Rule mixing isn't allowed, you can't block a connection after you have created a pass exception  Example of rule setup: – block in on eth0 all – block out on eth0 all – pass out on eth0 proto tcp from any to port = 80 – pass in on eth0 proto tcp from port = 80 to  Rules require numeric IP addresses  Rules can specify ports and ranges, protocols, and use the “any” keyword. 10/9/2015Pktfilter modification - Brad Baker3

Pktfiler Usage Installation is a manual process Copy the Pktfilter folder to program files or the desired directory From command prompt, run “pktfltsrv.exe -i” followed by the path to three files – Rules file, log file, DNS log file – This command installs as service Configure service to run automatically Configure the rules file as desired – Restrict access to the rules file 10/9/2015Pktfilter modification - Brad Baker4

My project goals In order of priority: – Research why the tool doesn't work on Windows Vista and Windows XP x64 version – Research and include rule mixing For example, after creating an exception for HTTP we would like to block a specific website – Research and fix the logging problem – Research and implement performing DNS IP resolution from the rules file – Research and implement localhost IP resolution 10/9/2015Pktfilter modification - Brad Baker5

Goal #1 – Windows Vista & x64  Windows Vista doesn't include this API  The “Windows Filtering Platform” replaces the packet filtering API  WFP is a much more robust filtering solution  WFP allows application based filtering, boot time filtering, and packet inspection  Moving Pktfilter to x64 just requires building with the correct platform  Conclusion: Save WFP for future, x64 was success 10/9/2015Pktfilter modification - Brad Baker6

Goals #2/#3 – Mixing & Logging  Mixing is not possible based on the design of the underlying API  The filtering engine is specifically designed to provide only the default and exception actions  Logging works with a fresh Windows XP installation  Changes to iphlpapi.dll in Service Pack 1 broke the logging function  Conclusion: Mixing and logging aren't possible due to larger system issues 10/9/2015Pktfilter modification - Brad Baker7

Goals #4/#5 – IP resolution Modified program to use brackets for DNS lookup “ [ ” Modified program to use “me” keyword for localhost lookup Looked at several DNS query methods First used: DnsQuery_A() in Then used: gethostbyname() in Finally: getaddrinfo() in Tool Produces a log file to document translation 10/9/2015Pktfilter modification - Brad Baker8

Example of IP resolution Log file output: Begin rule file parsing, GMT: :43:25 > local 'me' symbol resolved : ( : artos ) > Remote DNS lookup resolved : ( : slashdot.org ) > Remote DNS lookup resolved : ( : ) > Remote DNS lookup FAILED : ( - : test.my.blah ) > Remote DNS lookup FAILED : ( - : > Remote DNS lookup resolved : ( : ) > Remote DNS lookup resolved : ( : ) END, GMT: :43:30 Corresponding input configuration: # input rules rule 1: pass in on eth0proto udp from any port = 53 to any rule 2: pass in on eth0proto tcp from port = 80 to rule 3: pass in on eth0proto tcp from port = 80 to rule 4: pass in on eth0proto tcp from port = 80 to rule 5: pass in on eth0proto tcp from port = 80 to rule 6: pass in on eth0proto tcp from port = 80 to rule 7: pass in on eth0proto tcp from port = 80 to rule 8: pass in on eth0proto udp from any port = 67 to any port = 68 10/9/2015Pktfilter modification - Brad Baker9

Summary  The tool will remain effective until Windows Vista is a common platform  Several goals were not met, however the IP resolution will provide a benefit  Protected the application from long URLs and blank URLs – The rules file won't compromise the filtering configuration  Future enhancements can involve port information, fixing DNS timeout, etc  Security concerns with relying on DNS query – For example, the current Windows DNS server bug 10/9/2015Pktfilter modification - Brad Baker10

References Original Pktfilter project source – Information about filtering API – – NWU /public/02Whole.pdf NWU /public/02Whole.pdf WFP summaries – – DNS lookup information – – PfCreateInterface, references other filtering API functions – /9/2015Pktfilter modification - Brad Baker11