Chapter 53 — Firewalls in the real world: host firewalls, cloud security groups, NACLs

Build it in Go (30 min) — firewall policy as executable tests

Firewall rules drift: someone adds a "temporary" rule and forgets it, or a migration loses a path. The fix is to write the intent down as tests and run them after every change, from every network segment that matters. This program reads allow/deny expectations and checks them in parallel:

// policytest: firewall policy as executable tests (Chapter 53).
//
// Write down what SHOULD be reachable and what should NOT, then let the
// program prove it -- from every network segment that matters, before and
// after every firewall change. Exit code 1 on any mismatch, so it fits in CI.
//
//	cat > policy.txt <<'EOF'
//	# expect   target               why
//	allow      example.com:443      public website
//	deny       example.com:22       SSH must not be exposed
//	allow      1.1.1.1:53           DNS resolver
//	EOF
//	go run ./policytest policy.txt
package main

import (
	"bufio"
	"errors"
	"fmt"
	"net"
	"os"
	"strings"
	"sync"
	"syscall"
	"time"
)

type rule struct {
	line   int
	expect string // "allow" or "deny"
	target string
	why    string
}

type result struct {
	rule
	outcome string // connected | refused | timeout | error
	ok      bool
}

func main() {
	if len(os.Args) != 2 {
		fmt.Println("usage: policytest policy.txt")
		os.Exit(2)
	}
	rules, err := load(os.Args[1])
	if err != nil {
		fmt.Println(err)
		os.Exit(2)
	}

	results := make([]result, len(rules))
	var wg sync.WaitGroup
	for i, r := range rules {
		wg.Add(1)
		go func() { // probes run in parallel: a "deny" waits for a timeout
			defer wg.Done()
			out := probe(r.target, 3*time.Second)
			// "deny" is satisfied by refused OR timeout: either way, no connection.
			ok := (r.expect == "allow") == (out == "connected")
			results[i] = result{r, out, ok}
		}()
	}
	wg.Wait()

	failed := 0
	for _, r := range results {
		mark := "PASS"
		if !r.ok {
			mark, failed = "FAIL", failed+1
		}
		fmt.Printf("%s  line %-3d expect %-5s %-24s got %-9s  %s\n", mark, r.line, r.expect, r.target, r.outcome, r.why)
	}
	fmt.Printf("\n%d rules, %d failed\n", len(results), failed)
	if failed > 0 {
		os.Exit(1)
	}
}

func probe(target string, timeout time.Duration) string {
	c, err := net.DialTimeout("tcp", target, timeout)
	var ne net.Error
	switch {
	case err == nil:
		c.Close()
		return "connected"
	case errors.Is(err, syscall.ECONNREFUSED):
		return "refused" // a REJECT rule, or nothing listening
	case errors.As(err, &ne) && ne.Timeout():
		return "timeout" // a DROP rule, or no route
	default:
		return "error"
	}
}

func load(path string) ([]rule, error) {
	f, err := os.Open(path)
	if err != nil {
		return nil, err
	}
	defer f.Close()
	var rules []rule
	sc := bufio.NewScanner(f)
	for n := 1; sc.Scan(); n++ {
		line := strings.TrimSpace(sc.Text())
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		fields := strings.Fields(line)
		if len(fields) < 2 || (fields[0] != "allow" && fields[0] != "deny") {
			return nil, fmt.Errorf("line %d: want 'allow|deny host:port [reason]'", n)
		}
		rules = append(rules, rule{n, fields[0], fields[1], strings.Join(fields[2:], " ")})
	}
	return rules, sc.Err()
}

$ cat policy.txt
# expect target why
allow example.com:443 public website
deny example.com:22 SSH must not be exposed
allow 1.1.1.1:53 DNS resolver
allow 127.0.0.1:1 this one should fail

$ go run ./policytest policy.txt
PASS  line 2   expect allow example.com:443          got connected  public website
PASS  line 3   expect deny  example.com:22           got timeout    SSH must not be exposed
PASS  line 4   expect allow 1.1.1.1:53               got connected  DNS resolver
FAIL  line 5   expect allow 127.0.0.1:1              got refused    this one should fail

4 rules, 1 failed
exit status 1

What to notice: "deny" passes on either refused or timeout, because both mean no connection was made. The output still records which one happened, and that tells you whether something listens behind the rule. The probes run concurrently because each "deny" waits for its full timeout; done one after another, 50 rules would take minutes.

Exercises:

1. Run the same policy file from three places: your laptop, a VM in the same VPC, and a VM in a different subnet. The results should differ. That difference is your segmentation, verified.
2. Add a -junit flag that writes JUnit XML, and run it in CI after every Terraform change to security groups.
3. Extend the format to allow-from <cidr> assertions by running the tool inside network namespaces (Chapter 52) with different source addresses.