A packet filtering firewall automated testing method and system

Abstract

The present invention relates to an automated testing method and system for packet filtering firewalls, belonging to the technical field of packet filtering firewalls. The present invention employs a method for generating a quintuple using random numbers and constructing a test data packet. By sending a data packet and then receiving and verifying at a receiving end whether the data packet is uniquely generated by the random number, the effectiveness of the packet filtering firewall's policy is tested and verified. A script controller controls the generation of packet filtering firewall policies, as well as the sending, receiving, and verification of data packets, thereby enabling automated testing of the packet filtering firewall.

Description

Technical Field

[0001] The invention belongs to the technical field of packet filtering firewalls, and in particular relates to an automatic testing method and system for a packet filtering firewall. Background Art

[0002] Packet filtering firewalls are currently the primary network access control devices. They control network packets by configuring security policies—five-tuple filtering rules. They work by first configuring filtering rules, then matching the five-tuple information (source IP address, destination IP address, protocol, source port, and destination port) of a network packet against the filtering rules. Upon a successful match, the firewall rules are executed, either allowing or discarding the packet.

[0003] To verify the effectiveness of packet filtering firewalls, this functionality must be validated during development and evaluation. This functionality is tested by leveraging the working principles of packet filtering firewalls. By setting up a test topology, sending and receiving packets on both sides of the firewall to verify compliance with expected rule settings, the correct implementation of the packet filtering firewall's functionality can be determined.

[0004] However, manually verifying the packet filtering function requires determining the test items (i.e., which of the five items: source IP address, destination IP address, protocol, source port, and destination port) to test, configuring firewall rules based on the test items, sending data packets on one side of the firewall according to the rules, and checking whether the data packets are received on the other side of the firewall. Then, manually comparing the results to determine whether the function is valid. Moreover, for each test item in the five-tuple, different rules must be set and tested multiple times to ensure its functional completeness. Therefore, manually testing the packet filtering function is inefficient and easily affected by the tester's technical ability, resulting in erroneous test results. Therefore, how to achieve automated testing of packet filtering firewall functions remains a problem that urgently needs to be solved. Summary of the Invention

[0005] (1) Technical issues to be resolved

[0006] The technical problem to be solved by the present invention is: how to design an automatic testing method and system for a packet filtering firewall to realize automatic testing of the five-tuple filtering function of the packet filtering firewall and effectively improve the testing efficiency.

[0007] (2) Technical solution

[0008] In order to solve the above technical problems, the present invention provides a packet filtering firewall automated testing system, comprising: a test control module, a random number generation module, a script control module, a packet filtering firewall policy configuration module, a data packet sending module and a data packet receiving verification module;

[0009] The test control module is responsible for generating and driving packet filtering firewall security policy test cases. The test case selects an item from the five-tuple of the packet filtering firewall being tested, and calls the random number generation module to generate a random number for the test value of the test item and a random number for the test ID. The script control module is called to generate a firewall security policy configuration script, a data packet sending script, and a data packet receiving verification script, and drives the script control module to control the execution of each script.

[0010] The random number generation module is used to generate random numbers of test items and test IDs according to the instructions of the test control module;

[0011] The script control module is used to generate a firewall security policy configuration script, a data packet sending script, and a data packet receiving verification script. There is a timing relationship and triggering conditions between the scripts, wherein the firewall security policy configuration script is executed first, and the data packet receiving verification script is executed subsequently and waits for the data packet sending script to be executed until the data packet sending script is executed or the data packet receiving verification script exits after exceeding the time threshold;

[0012] The packet filtering firewall policy configuration module is used to configure the firewall security policy according to the configuration interface of the tested firewall, wherein the tested items in the security policy are specified by the test control module, the test values ​​are generated by the random number generation module, and the policy generation is controlled by the script control module;

[0013] The data packet sending module is used to generate a test data packet and an interference data packet according to a random number and send them, wherein the test items of the five-tuple in the test data packet are the same as those generated by the random number generation module, and the IP message ID is the same as the test ID; wherein the test items of the five-tuple in the interference data packet are different from those generated by the random number generation module, and the IP message ID is different from the test ID;

[0014] The data packet reception verification module is used to monitor data packets in the network within a certain time range. When the IP message ID of the data packet received within the time range is the same as the test ID, and no data packet with an IP message ID different from the test ID is received, the test is judged to be successful; conversely, if a data packet with an IP message ID different from the test ID is received within the time range or no data packet is received within the time range, the test is judged to be unsuccessful.

[0015] The invention also provides a packet filtering firewall automatic testing method implemented by adopting the system.

[0016] Preferably, the steps include:

[0017] 1) The test control module selects one item from the five-tuple as a test item;

[0018] 2) The random number generation module generates a random number A for the test item and a random number B for the test ID;

[0019] 3) The script control module generates three script commands: firewall security policy configuration script, data packet reception verification script, and data packet sending script;

[0020] 4) The firewall security policy configuration script drives the packet filtering firewall policy configuration module to configure the firewall security policy, wherein the default firewall policy is configured to "reject" data packets and a policy is added to allow data packets with the test item of random number A to pass through;

[0021] 5) The data packet reception verification script drives the data packet reception verification module to start the monitoring process and set a certain monitoring time range;

[0022] 6) The data packet sending script drives the data packet sending module to generate a test data packet, the test item of the test data packet is a random number A, and the IP message ID is a random number B;

[0023] 7) The data packet sending script drives the data packet sending module to generate an interference data packet, wherein the test item of the interference data packet is the non-random number A, and the IP message ID is the value of the non-random number B;

[0024] 8) The data packet sending module sends the test data packet and the interference data packet;

[0025] 9) If the data packet reception verification module receives a data packet and the IP message ID of the data packet is a random number B, and no other data packets are received, it indicates that the source IP address filtering function of the packet filtering firewall is valid; if the data packet reception verification module receives a data packet and the IP message ID of the data packet is not a random number B, it indicates that the source IP address filtering function of the packet filtering firewall is invalid; if the data packet reception verification module does not receive a data packet within the set monitoring time range, it indicates that the source IP address filtering function of the packet filtering firewall is invalid.

[0026] (3) Beneficial effects

[0027] The present invention uses a method of generating a quintuple using random numbers and constructing a test data packet. By sending a data packet and then receiving and verifying at the receiving end whether the data packet is the only one generated by the random number, the effectiveness of the packet filtering firewall policy is tested and verified. A script controller controls the generation of packet filtering firewall policies, data packet transmission, reception, and verification, thus enabling automated testing of the packet filtering firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a basic framework diagram of a packet filtering firewall automated testing system according to the present invention;

[0029] Figure 2 This is a flowchart of the firewall automation test of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below with reference to the accompanying drawings and examples.

[0031] The present invention provides an automatic testing method and system for a packet filtering firewall, which can realize automatic testing of the five-tuple filtering function of the packet filtering firewall.

[0032] refer to Figure 1 The packet filtering firewall automated testing system of the present invention is composed of a test control module, a random number generation module, a script control module, a packet filtering firewall policy configuration module, a data packet sending module and a data packet receiving verification module. Figure 1 shown.

[0033] The test control module is responsible for generating and driving packet filtering firewall security policy test cases. The test case selects an item from the five-tuple of the packet filtering firewall being tested (source IP address, destination IP address, protocol, source port, destination port), and calls the random number generation module to generate a random number for the test value of the test item and a random number for the test ID (identification ID). It calls the script control module to generate the firewall security policy configuration script, data packet sending script, and data packet receiving verification script, and drives the script control module to control the execution of the script.

[0034] The random number generation module is used to generate random numbers according to the instructions of the test control module, where the IP address (including the source IP address and the destination IP address) consists of four integers from 1 to 254; the protocol number is randomly selected from one of 1, 6, and 17; the port number (including the source port number and the destination port number) is randomly generated from integers 1 to 65535; and the test ID is randomly generated from integers 0 to 65535.

[0035] The script control module is used to generate a firewall security policy configuration script, a data packet sending script, and a data packet receiving verification script. There is a timing relationship and trigger conditions between the scripts. The firewall security policy configuration script is executed first, and the data packet receiving verification script is executed subsequently and waits for the data packet sending script to be executed until the data packet sending script is executed or the data packet receiving verification script exits after exceeding the time threshold.

[0036] The packet filtering firewall policy configuration module is used to configure the firewall security policy according to the configuration interface of the tested firewall, wherein the tested items in the security policy are specified by the test control module, the test value is generated by the random number generation module, and the policy generation is controlled by the script control module;

[0037] The data packet sending module is used to generate and send test data packets and interference data packets based on random numbers. The test items in the five-tuple of the test data packet must be the same as those generated by the random number generation module, and the IP packet ID must be the same as the test ID. The test items in the five-tuple of the interference data packet must be different from those generated by the random number generation module, and the IP packet ID must be different from the test ID.

[0038] The data packet reception verification module is used to monitor data packets in the network within a certain time range. When the IP message ID of the data packet received within the time range is the same as the test ID, and no data packet with an IP message ID different from the test ID is received, the test is judged to be successful; conversely, if a data packet with an IP message ID different from the test ID is received within the time range or no data packet is received within the time range, the test is judged to be unsuccessful.

[0039] Taking source IP address testing as an example, the test steps of a packet filtering firewall automation testing method and system of the present invention are as follows: Figure 2 As shown, the following steps are included:

[0040] 1) The test control module selects one item in the quintuple, such as the source IP address, as the test item;

[0041] 2) The random number generation module generates a random source IP address, which is composed of four random numbers from 1 to 254, such as 192.168.100.1, and generates a test ID as a random number from 0 to 65535, such as 32767;

[0042] 3) The script control module generates three script commands: script command 1 is a packet filtering firewall security policy configuration command; script command 2 is a data packet receiving verification script; and script command 3 is a data packet sending script.

[0043] 4) Script command 1 drives the packet filtering firewall policy configuration module to configure the firewall security policy, which configures the firewall default policy to "deny" data packets and adds a policy to allow data packets with a source IP address of 192.168.100.1 to pass through;

[0044] 5) Script command 2 drives the data packet receiving verification module to start the monitoring process and set a certain monitoring time range, such as 60 seconds;

[0045] 6) Script command 3 drives the data packet sending module to generate a test data packet. The source IP address of the test data packet is 192.168.100.1, and the IP message ID is 32767.

[0046] 7) Script command 3 drives the data packet sending module to generate an interference data packet. The source IP address of the interference data packet is an IP address other than 192.168.100.1, such as 10.0.0.1, and the IP packet ID is a value other than 32767, such as 15536.

[0047] 8) The data packet sending module sends the test data packet and the interference data packet;

[0048] 9) If the data packet reception verification module receives a data packet and the IP message ID of the data packet is 32767, and no other data packets are received, it indicates that the source IP address filtering function of the packet filtering firewall is valid; if the data packet reception verification module receives a data packet and the IP message ID of the data packet is not 32767, it indicates that the source IP address filtering function of the packet filtering firewall is invalid; if the data packet reception verification module does not receive a data packet within a certain monitoring time range, such as 60 seconds, it indicates that the source IP address filtering function of the packet filtering firewall is invalid.

[0049] It can be seen that in the present invention, when an item in the quintuple (i.e., any one of the source IP address, destination IP address, protocol, source port, and destination port) is selected as a test item, since the quintuples are all integer types, the present invention uses a random number generator to generate the value of the item as the test value, and generates another random number as the identification ID of the test case for testing the item.

[0050] The present invention adopts a script controller to configure the security policy through the security policy configuration interface of the packet filtering firewall to be tested, and the policy meets the following conditions: 1) adding a packet filtering firewall default policy to deny data packets from passing; 2) adding a security policy whose matching item is a value specified by a random number; 3) the security policy is to allow passing, that is, the data packets matching the policy are allowed to pass through the firewall.

[0051] The present invention uses a script controller to drive a data packet generator on the firewall's transmitting side to generate data packets to the packet filtering firewall. The data packets are divided into two categories: test data packets and interference data packets. Test data packets must meet the following conditions: 1) a value in a data packet quintuple is the same as a test value; 2) the IP packet ID of the data packet is the test case ID. Interference data packets must meet the following conditions: 1) the quintuple field corresponding to the test item in the interference data packet is different from the test value; 2) the IP packet ID of the interference data packet is different from the test case ID.

[0052] The present invention uses a script controller to start a data packet capturer on the other side of the firewall (receiving side). The data packet capturer captures data packets and makes judgments based on the received information. The test case passes if and only if the following conditions are met: 1) the data packet capturer captures a data packet whose IP message ID is the identification ID; 2) the data packet capturer does not capture a data packet whose IP message ID is different from the identification ID.

[0053] Through the above method, it can be verified that the packet filtering firewall policy is valid if and only if the receiving side receives a data packet sent by the sending side that is consistent with the identification ID generated by the random number generator; otherwise, the packet filtering firewall policy is invalid.

[0054] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A packet filtering firewall automated testing system, characterized in that: include: Test control module, random number generation module, script control module, packet filtering firewall policy configuration module, data packet sending module and data packet receiving verification module; The test control module is responsible for generating and driving packet filtering firewall security policy test cases. The test case selects an item from the tested packet filtering firewall quintuple, and calls the random number generation module to generate a random number for the test value of the test case and a random number for the test ID. The script control module is called to generate a firewall security policy configuration script, a data packet sending script, and a data packet receiving verification script, and drives the script control module to control the execution of each script. The random number generation module is used to generate random numbers of test items and test IDs according to the instructions of the test control module; The script control module is used to generate a firewall security policy configuration script, a data packet sending script, and a data packet receiving verification script. There is a timing relationship and triggering conditions between the scripts, wherein the firewall security policy configuration script is executed first, and the data packet receiving verification script is executed subsequently and waits for the data packet sending script to be executed until the data packet sending script is executed or the data packet receiving verification script exits after exceeding the time threshold; The packet filtering firewall policy configuration module is used to configure the firewall security policy according to the configuration interface of the tested firewall, wherein the tested items in the security policy are specified by the test control module, the test values ​​are generated by the random number generation module, and the policy generation is controlled by the script control module; The data packet sending module is used to generate a test data packet and an interference data packet according to a random number and send them, wherein the test items of the five-tuple in the test data packet are the same as those generated by the random number generation module, and the IP message ID is the same as the test ID; wherein the test items of the five-tuple in the interference data packet are different from those generated by the random number generation module, and the IP message ID is different from the test ID; The data packet reception verification module is used to monitor data packets in the network within a certain time range. When the IP message ID of the data packet received within the time range is the same as the test ID, and no data packet with an IP message ID different from the test ID is received, the test is judged to be successful; conversely, if a data packet with an IP message ID different from the test ID is received within the time range or no data packet is received within the time range, the test is judged to be unsuccessful.

2. A packet filtering firewall automated testing method implemented using the system as claimed in claim 1, characterized in that: The following steps are involved: 1) The test control module selects one item from the quintuple as the test item; 2) The random number generation module generates a random number A for the test item and a random number B for the test ID; 3) The script control module generates three script commands: firewall security policy configuration script, data packet reception verification script, and data packet sending script; 4) The firewall security policy configuration script drives the packet filtering firewall policy configuration module to configure the firewall security policy. The default firewall policy is set to "deny" packets and a policy is added to allow packets with the test item "random number A" to pass. 5) The data packet reception verification script drives the data packet reception verification module to start the monitoring process and set a certain monitoring time range; 6) The data packet sending script drives the data packet sending module to generate a test data packet. The test item of the test data packet is a random number A, and the IP packet ID is a random number B; 7) The data packet sending script drives the data packet sending module to generate an interference data packet. The test item of the interference data packet is the non-random number A, and the IP packet ID is the value of the non-random number B; 8) The data packet sending module sends test data packets and interference data packets; 9) If the data packet reception verification module receives a data packet and the IP message ID of the data packet is a random number B, and no other data packets are received, it indicates that the source IP address filtering function of the packet filtering firewall is valid; if the data packet reception verification module receives a data packet and the IP message ID of the data packet is not a random number B, it indicates that the source IP address filtering function of the packet filtering firewall is invalid; if the data packet reception verification module does not receive a data packet within the set monitoring time range, it indicates that the source IP address filtering function of the packet filtering firewall is invalid.

3. The method according to claim 2, wherein The items in the quintuple include source IP address, destination IP address, protocol, source port, and destination port.

4. The method according to claim 3, wherein In step 2), when generating the random number A for the test item, for the IP address in the quintuple, it consists of 4 integers ranging from 1 to 254.

5. The method according to claim 3, wherein In step 2), when generating the random number A of the test item, the random number of the protocol number is randomly selected from 1, 6, and 17.

6. The method according to claim 3, wherein In step 2), when generating the random number A for the test item, the random number of the port number is randomly generated from an integer between 1 and 65535.

7. The method according to claim 3, wherein In step 2), the random number of the test ID is randomly generated from integers 0 to 65535.

Images