CSEC3616Cybersecurity Engineering

    Stateless matching

    How a stateless firewall judges each packet in isolation, uses the TCP ACK flag to recognise replies, the lecture's mail-server and web-server rule tables, and when stateless is faster or slower than stateful.

    • Explain what a stateless firewall keeps and does not keep, and the cost trade-off against stateful.
    • Explain how the ACK flag stands in for connection state in a stateless rule table.
    • Read the lecture's stateless mail-server and web-server tables and say what each rule permits.
    • Explain why UDP cannot be filtered by reply direction the way TCP can.

    15 min read

    Intuition

    A stateless firewall has a rule list and nothing else. It looks at one packet, finds the first matching rule, and forgets the packet. It cannot know that a packet is a reply to a request from inside, because it never saw the request.

    So the administrator has to recognise replies from the packet itself. For TCP there is a field that does this job, the ACK flag. The rest of this page is what that costs in rule-writing and where it breaks down.

    Mechanism

    A stateless firewall operates only on the rules and each individual packet. No state information is generated when a packet is processed.

    • Keeping state is expensive and needs fast memory.
    • With only a few rules, stateless filtering may be faster.
    • With many rules, stateful filtering may be faster, since the majority of packets match the first rule.
    • As a rule of thumb, stateless is harder to configure, and mistakes are more likely.

    Compare

    Each packet judged in isolation by the rules. No state table, so less memory. Faster with few rules. Harder to configure correctly, because every direction of every flow needs a rule.

    Tracks connections, so replies are recognised by state. Needs more memory and hardware. Faster with many rules, since most packets match one established rule at the top. Easier to write the rules.

    Mechanism

    The TCP handshake is the cue a stateless rule uses. The client sends a packet with SYN. The server replies with SYN/ACK. The client confirms with a third packet carrying only ACK. After that, every packet during data transmission has ACK set.

    So the rule is: the first packet of a connection has no ACK and every later packet has it. A rule that accepts a reply requires ACK to be set. A rule that accepts a new connection puts * in the Ack column, so it admits both the setup and the ongoing packets.

    The lecture accepts one weakness. An attacker could send SYN/ACK in a first packet to trick the firewall, but the receiving host ignores it.

    UDP is different. It has no state information, so the Ack column is * for UDP (the web-server table below writes it as -). It also means the firewall cannot tell the sender from the responder in a UDP exchange.

    Mechanism

    The mail-server policy is the same one as on the stateful page: only email in and out, anyone inside may send to any mail server, incoming email only to the mail server.

    RuleInterfaceSource IPDestination IPProtocolSource portDestination portAckAction
    A1inetexternalmailserverTCP*25*Accept
    A2lanmailserverexternalTCP*> 1023YesAccept
    B1laninternalexternalTCP*25*Accept
    B2inetexternalinternalTCP*> 1023YesAccept
    C*******Drop
    • A1 lets incoming email reach the mail server.
    • A2 lets the mail server’s answers leave the network.
    • B1 and B2 are the same pair for outgoing email.
    • C drops everything else.

    The stateful version needed four rules. This one needs five, because each direction of each flow is its own rule. Source and destination addresses name external, internal and the mail server rather than using *, as a guard against spoofing. The slides say rules A1 and B2 then block spoofed inbound packets, and A2 and B1 do the same for outbound.

    Mechanism

    The second example is a LAN with a web server. The policy:

    • Allow HTTP traffic initiated by external hosts to the web server.
    • Allow internal hosts to initiate HTTP and DNS. HTTP is TCP port 80, DNS is UDP port 53.
    • Allow no other communication, in particular nothing initiated by external hosts to local hosts other than the web server.

    The stateless table:

    RuleInterfaceSource IPDestination IPProtocolSource portDestination portAckAction
    B1inetexternalwebserverTCP> 102380*Accept
    B2lanwebserverexternalTCP80> 1023YesAccept
    C1laninternalexternalTCP> 102380*Accept
    C2inetexternalinternalTCP80> 1023YesAccept
    D1laninternalexternalUDP> 102353-Accept
    D2inetexternalinternalUDP53> 1023-Accept
    E*******Drop

    Rows B1 and B2 serve the first line of the policy, C1 and C2 serve internal HTTP, D1 and D2 serve internal DNS, and E is the default deny.

    Worked example

    Answer1 is accepted by A1, 2 is dropped by C, 3 is accepted by B2.

    1. Packet 1 arrives on inet from an external host to the mail server, TCP, destination port 25, with SYN only so no ACK. Rule A1 matches, since its Ack column is *. Accepted.
    2. Packet 2 arrives on inet from an external host to an internal workstation, TCP, destination port 80, no ACK. A1 needs the mail server as destination, so no. A2 and B1 need interface lan, so no. B2 needs destination port above 1023 and ACK, so no. C matches everything. Dropped.
    3. Packet 3 arrives on inet from an external mail server to an internal host, TCP, destination port above 1023, ACK set. A1 needs the mail server as destination, so no. A2 and B1 need lan, so no. B2 matches. Accepted.

    Pitfall

    A stateless table accepts anything that fits the fields, including a packet that merely claims to be a reply. Packet 3 above is accepted because it has ACK set, not because the firewall knows an internal host asked. The lecture accepts this and relies on end hosts ignoring packets that belong to no connection they know. This is why the lecture calls stateless harder to configure and mistakes more likely.

    Exam detail

    Know the comparison the practice quiz tests: with fewer rules a stateless firewall may be faster, and a stateful firewall needs more hardware resources because it must maintain state. Both statements are true.

    For a stateless table, say what the Ack column is doing in each row. * for a rule that must allow both the first packet and the rest, Yes for a rule that only allows a reply. For UDP there is no ACK flag, so the column does not apply.

    Aside

    The lecture is inconsistent in one small place. The text says the Ack value for UDP is set to *, and the web-server table writes -. Both mean the field is not used for UDP. The slide copy of the web-server stateful table is too scrambled in extraction to reproduce, so this page gives only the stateless table. All that is legible is that the stateful version starts with a rule accepting established connections and ends with a drop. Check the slide before relying on anything else about it.

    Recall

    Why does a stateless rule for outgoing email in the mail-server table use * in the Ack column, but the rule for the answers requires Yes?

    The first packet of a connection has no ACK and later packets all have ACK. The rule that lets a connection start has to allow both, so it uses *. The rule for the answers only ever sees traffic inside an established connection, which always has ACK set, so it can require it.

    Recall

    • Stateless means each packet is judged alone, with no state kept. Cheaper in memory, faster with few rules, harder to configure.
    • TCP flags stand in for state. First packet has no ACK, every later packet has ACK.
    • Rules that start a connection use * for Ack. Rules for replies require Yes.
    • UDP has no ACK, so a stateless firewall cannot tell sender from responder.

    Source

    Week 9 slides PDF