ExaFS brings new functionality to the environment of routing protocols configuration for backbone network hardware security.
The tool extends network administrators toolset by adding an extra layer for configuration rules creation, validation, and authorization. With this new layer, a larger group of network administrators can safely create new BGP protocol rules to prevent DDoS and other forms of malicious cyber attacks.
ExaFS is open source with MIT license. The system is regularly used at CESNET - the Czech national e-infrastructure for science, research and education operator.
ExaFS provides both the user Web interface and the REST API for web service.
Key contributions of the system are user authorization mechanism and validation system for BGP commands.
Without ExaFS the system Root privileges are required for direct interaction with ExaBGP and networking hardware. ExaFS provides several user roles and access rights similarly to user roles in other software systems such as SQL. The system allows specifying user rights for various kinds of sub-nets following the network topology.
Validation system for BGP commands assures that only error-free messages can pass to the system BGP API. Both syntax and access rights are validated before a new rule can be stored in the database.
Thanks to the storage, all the rules can be restored quickly after a system reboot or failure. All rules are validated again, before sending them to ExaBPG from the storage, to prevent any malicious database manipulation.
ExaFS is an integral part of cybersecurity tools at CESNET. However, it can be used in any network where ExaBGP is available.
See how is ExaFS integrated into the network in the picture below.
- 2020 - CZ DDoS Protector v prostředí propojovacího uzlu NIX.CZ, Seminář o bezpečností sítí a služeb 2020
- 2019 - EN ExaFS: mitigating unwanted traffic, 10th SIG-NOC meeting, Prague
- 2019 - CZ Potlačení nežádoucího provozu pomocí BGP Flowspec, CSNOG 2019
- 2019 - CZ Nástroje pro FlowSpec a RTBH, Konference e-infrastruktury CESNET 2019
- 2019 - CZ Nástroje pro obranu proti útokům na páteřních směrovačích,Konference e-infrastruktury CESNET 2019
The central part of the ExaFS is a web application, written in Python3.6 with Flask framework. It provides a user interface for ExaBGP rule CRUD operations. The application also provides the REST API with CRUD operations for the configuration rules. The web app uses Shibboleth authorization; the REST API is using token-based authorization.
The app creates the ExaBGP commands and forwards them to ExaBGP process. All rules are carefully validated, and only valid rules are stored in the database and sent to the ExaBGP connector.
This second part of the system is another application that replicates the received command to the stdout. The connection between ExaBGP daemon and stdout of ExaAPI (ExaBGP process) is specified in the ExaBGP config.
This API was a part of the project, but now has been moved to own repository. You can use pip package exabgp-process or clone the git repo. Or you can create your own version.
Every time this process gets a command from ExaFS, it replicates this command to the ExaBGP service through the stdout. The registered service then updates the ExaBGP table – create, modify or remove the rule from command.
You may also need to monitor the ExaBGP and renew the commands after restart / shutdown. In docs you can find and example of system service named Guarda. This systemctl service is running in the host system and gets a notification on each restart of ExaBGP service via systemctl WantedBy config option. For every restart of ExaBGP the Guarda service will put all the valid and active rules to the ExaBGP rules table again.
- 1.0.2 - fixed bug in IPv6 Flowspec messages
- 1.0.1 . minor bug fixes
- 1.0.0 . Major changes
- Limits for nuber of rules in the system introduced. There are now limits for rules for organization and overall limit for the instalation. Database changed / migration is required. Migrating the database to version 1.0.x is a bit more complicated, you need to link existing rules to organizations. A more detailed description is in a separate document.
- Rules are now tied to organization. If the user belongs to more than one organization, the organization for the session must be selected after login.
- Bulk import for users enabled for admin.
- Introduced Swagger docs for API on the local system. Just open /apidocs url.
- New format of message for ExaAPI - now sends information about author of rule (user) for logging purposes.
- ExaAPI and Guarda modules moved outside of the project.
- ExaAPI is now available as a pip package exabgp-process, with own github repostiory.
- Watch of exabgp restart can be still done by guarda service - see docs. Or it can be done by override of the exabgp service settings.
- 0.8.1 application is using Flask-Session stored in DB using SQL Alchemy driver. This can be configured for other drivers, however server side session is required for the application proper function.
- 0.8.0 - API keys update. Run migration scripts to update your DB. Keys can now have expiration date and readonly flag. Admin can create special keys for certain machinnes.
- 0.7.3 - New possibility of external auth proxy.
- 0.7.2 - Dashboard and Main menu are now customizable in config. App is ready to be packaged using setup.py.
- 0.7.0 - ExaAPI now have two options - HTTP or RabbitMQ. ExaAPI process has been renamed, update of ExaBGP process value is needed for this version.
- 0.6.2 - External config for ExaAPI
- 0.6.0 - Bootstrap 5 in UI
- 0.5.5 - API v3 - auth api key in cookie not in url
- 0.5.4 - Right click menu on adress / Whois or Copy to clipboard
- 0.5.3 - Dashboard update, forms with default action
- 0.5.2 - API v2 with new keys
- 0.5.1 - Bug fixes
- 0.5.0 - New format of LOG table in database. Run migration scripts to update your DB. Removed foreign key user_id, author email is stored directly to logs for faster grep text search.
- 0.4.8 - Enhanced String Filtering
- 0.4.7 - Multi neighbor support enabled. See config example and update your config.py.
- 0.4.6 - Route Distinguisher for VRF is now supported. See config example and update your config.py.