Upload File

cujo - safe browsing with lua · safe browsing configuration # cat nf_{threat,safebro,http,ssl}.lua...

  • Home
  • Documents
  • CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \
31
CUJO - Safe Browsing with Lua Lourival Vieira Neto <[email protected]>

Upload: others

Post on 09-Aug-2020

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

CUJO - Safe Browsing with LuaLourival Vieira Neto <[email protected]>

Page 2: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Introduction➔ CUJO

◆ Smart Firewall◆ Safe Browsing◆ Parental Controls

Page 3: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Introduction➔ CUJO Firmware Team

◆ Gabriel Ligneul◆ Iruatã Souza◆ Katia Fernandes◆ Linas Nenorta◆ Lourival Vieira Neto◆ Marcel Moura◆ Savio Barbosa◆ Tadeu Bastos◆ Pedro Tammela

Page 4: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Introduction➔ Lunatik

◆ Lua in the Linux Kernel◆ "Scriptable Operating Systems with Lua"

● Vieira Neto, L., Ierusalimschy, R., de Moura, A.L. and Balmer, M.

➔ Luadata◆ “Zero-copy”

➔ NFLua◆ Netfilter Binding

Page 5: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Components

Page 6: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Configuration

safebro.json

Page 7: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Configuration

safebro.json

Lua c

hunk

Page 8: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Configuration

safebro.json

Lua c

hunk

Load config

Page 9: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Configuration

# cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua

# iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

-m lua --function nf_http -j DROP

# iptables -A FORWARD -p tcp --dport 443 --tcp-flags PSH PSH \

-m lua --function nf_ssl -j REJECT --reject-with tcp-reset

Page 10: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Configuration

threatd.lua

Page 11: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Configuration

xt_lua.c

Page 12: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Configuration

nf_safebro.lua

Page 13: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Filter

Cached?NoTC

P PS

H

nflua_match

Page 14: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Filter

Cached?NoTC

P PS

H

Hot drop

Lookup

nflua_match

Page 15: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Filter

Cached?NoTC

P PS

H

Hot drop

Lookup

Lookup

Reputation/

Category

Cloud Decision

nflua_match

Page 16: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Filter

Cached?NoTC

P PS

H

Hot drop

Add to ca

che

Lookup

Lookup

nflua_match

Reputation/

Category

Cloud Decision

Page 17: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Filter

TCP

retr

ansm

issi

on

nflua_match

Cached?Yes

Page 18: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Iptables

NICDriver

NetfilterNFLua

Luadata(zero copy)

Kernel

User space

Cloud

Luajson

Lunatik

Safe Browsing

Agent

threatd

nf.lua

nf_http.lua

nf_ssl.lua

nf_threat.lua

nf_safebro.lua

➔ Filter

TCP

retr

ansm

issi

on

nflua_match

Accept /

Block page

Cached?Yes

TCP reply

Page 19: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

xt_lua.c

Page 20: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

xt_lua.c

Page 21: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

nf_http.lua

Page 22: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

nf.lua

Page 23: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

nf_ssl.lua

Page 24: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

nf_ssl.lua

Page 25: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

nf_http.lua

Page 26: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Safe Browsing➔ Filter

Block page

Page 27: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Why Lua?➔ Extensible Extension Language

◆ Embeddable and Extensible

◆ C Library

➔ Almost Freestanding

➔ Small Footprint

◆ ~250 KB

➔ Fast

➔ MIT License

Page 28: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Why Lua?➔ Ease of Development

➔ High-level Language

➔ Dynamically Typed

➔ Domain-specific API

Page 29: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Why Lua?➔ Safety

➔ Automatic Memory Management

➔ Protected Call

➔ Fully Isolated States

➔ Cap the Number of Executed Instructions

➔ Test Suite

Page 30: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Why Lua?➔ Security

● A single vulnerability disclosed since 1993

Page 31: CUJO - Safe Browsing with Lua · Safe Browsing Configuration # cat nf_{threat,safebro,http,ssl}.lua > /proc/nf_lua # iptables -A FORWARD -p tcp --dport 80 --tcp-flags PSH PSH \

Benchmarks➔ Tinyproxy

◆ ~150 Mbps◆ CPU Bound

➔ NFLua◆ Slow Path: ~500 Mbps◆ Fast Path: ~750 Mbps◆ Not CPU Bound

➔ Bypass◆ ~890 Mbps

➔ Online Units: ~5.5 k


Sweet Dreams Infantil - Lua Lua

cLog Lua Extensions A Short Reference · cLog Lua Extensions A Short Reference Acknowledgments Lua is a wonderful scripting language. We thank Roberto Ierusalimschy s and the Lua

New PSH Prioritization Process

Catalogo PSH 2011

Lua Workshop 2016 - The Programming Language Lua · A bridge story Programming iOS in Lua Lua Workshop 2016 Jean-Luc Jumpertz @JLJump October 14, 2016. CodeFlow Live Application Development

Quick Development of a Mobile CICS Application Using Lua · •Got a CICS 3270 app, want it mobile… now! •Some options •What’s Lua? •Why Lua? •Using Lua to mobilize a

Game Development with Corona SDK and Lua - Lua Workshop 2014

Tutorial: Lua Scripting 10 Lua Scripting and EBus Usage · Tutorial: Lua Scripting 10 — Lua Scripting and EBus Usage ... A Static Mesh component should appear in the Entity

Psh sticks-comparison

Introducing Lua

Lua in the NetBSD Kernel · The Programming Language Lua Embedding Lua in C Programs Lua in the NetBSD Kernel Topics 1 The Programming Language Lua The Lua Interpreter Syntax and

PSH - Permanent Supportive Housing · 2011-09-07  · Before submitting a PSH electronic application Consumers must be registered with the Collaborative. You must first have a PSH

Lua 5.1.4 W. Celes Lua.org, August 2006 ISBN 85-903798-3-3sethc23.github.io/wiki/Stack/lua-Lua.5.1.4-Lua.5.1.Reference.Manual.… · de Figueiredo, W. Celes Lua.org, August 2006 ISBN

PSH 2017 - pakhep.orgpakhep.org/downloads/PSH-2017_Scientific_Program.pdf · PSH-2017 Core Scientific program Anchors Dr. Zia Uddin Dr. Iqbal Haider ... Farhan ul Amin, Mubashir Ijaz,

An Introduction to Tilde - Luafiles.luaforge.net/.../Tilde_Introduction_GCAP_2008... · Why Lua? Quick Lua Introduction. ... Lua is a powerful, fast, light-weight, embeddable scripting

[email protected] @thephantomderp October 14 , 2016 · Lua & Lua C API Lua Lua C API stateful, stack- based well-documented mostly clear semantics / mappings 3 of 38

Lua API++ library: Lua binding to C++11 · What is Lua API++ Purpose: embed Lua into C++ application – create and expose functions and data to Lua Easy to use – automatic stack

Extending Lua

+0 ......413*/(5*.&5"#-& 'PSNPSFJOGPSNBUJPOBCPVUXIBUXFEP PSXIFSFUIFIVCMPDBUJPOTBSF WJTJUVTBU XXX XPSDFTUFSDPNNVOJUZUSVTU PSH VLPSFNBJM+0:!XPSDFTUFSDPNNVOJUZUSVTU PSH VL

Kinetoterapia PSH 2

Lua Application Programming - Hisham · Lua, an extension language for scripting Lua 5.2 (2011) – Lua is an extension programming language designed to support general procedural

Why (and why not) Lua? · – NodeMCU ESP8266. 19 Size Lua 5.3 Lua 1.0 Lua 5.2 Lua 5.1 Lua 5.0 Lua4.0. 20 Simplicity Reference manual with ~100 pages (SPINE) Documents the language,

Typed Lua: An Optional Type System for Lua

Lua by the eyes of a Perl developer - GitHub Pagesichesnokov.github.io/talks/tpcig2018/lua-by-the-eyes-of-a-perl... · Lua 5.x versions •Lua 5.0 (Apr 2003) •Lua 5.1 (Feb 2006)

Perioperative Surgical Home (PSH) Model & Learning .../media/sites/psh/files/psh_anes17industrytheater.pdf- PSH Population Management: Allows for reporting of strategies and processes

THE PERIOPERATIVE SURGICAL HOME (PSH)/media/sites/psh/files/... · elements of the PSH program implemented, and stage of implementation. Most practices were still in the planning

Games Development 2 Lua Scripting CO3301 Week 6. Contents Introducing Lua –Comparison with Python Lua Language Overview Interfacing Lua with C++

Course Psh

2-Finger-Parallel-Gripper PSH 22 - 52 · Item Type PSH 22 PSH 32 PSH 42 PSH 52 1 max. screw-in depth for gri p-per fastening from the top M5 10.5 tief M6 13 tief M8 15 tief M10 20

Transforming the U.S. Market with a New Application of T ... · received and analyzed for both T -PSH and Q -PSH. • PSH siting guide has been developed. • PSH FERC licensing lessons

PSH Series High Efficiency Power Supplies · 2020. 11. 25. · PSH-12-080 PSH-24-080 PSH-48-080 Input (AC) Nominal Input Voltage 100–240 VAC Nominal Input Current 2–0.9 A Operational

5 ' XXX ZBTPEIBSB PSH

CSE 380 – Computer Game Programming Scripting and Lua Lua

PSH Upper Body Injuries

Lua — Introduction