ebfw is a Linux kernel module (LKM) firewall implementing RFC 3514 - The Security Flag in the IPv4 Header.

Comes with a Python script that interacts with the built-in character device /dev/ebfw to instantly toggle features and pull real-time firewall status.

Tested on Linux kernel version 5.4.0 and 5.3.0.

ebfw comes with the only three features you should need in a firewall:

• Evil Block Mode Block ALL incoming packets with the Evil Bit set.
• Evil User Mode Set the Evil Bit on ALL outgoing packets.
• Status List number of blocked packets and whether the modes are ON or OFF, respectively.

Load the kernel module

root@localhost$ make
root@localhost$ make load

or

root@localhost$ make
root@localhost$ insmod ebfw.ko

Interact with the kernel module

root@localhost$ ./client/client.py --help
usage: client.py [-h] [-U {ON,OFF}] [-B {ON,OFF}] [-S]

Client interaction with ebfw

optional arguments:
  -h, --help            show this help message and exit
  -U {ON,OFF}, --usermode {ON,OFF}
  -B {ON,OFF}, --blockmode {ON,OFF}
  -S, --status

Use Evil Block Mode to drop all incoming packets with the Evil Bit set to prevent packets with evil intent on reaching your systems.

Enable Evil Block Mode

./client.py --blockmode ON

Disable Evil Block Mode

./client.py --blockmode OFF

Use Evil User Mode to flag all outgoing packets as evil.

Note: Always enable Evil User Mode if you're attacking other systems over a network. Rather enable Evil User Mode once too much than once too little.

Enable Evil User Mode

./client.py --usermode ON

Disable Evil User Mode

 ./client.py --usermode OFF

Check whether Evil User Mode or Evil Block Mode is ON or OFF, respectively. Also shows the number of blocked incoming packets due to the Evil Bit set.

./client.py --status

Firewalls, packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. We define a security flag in the IPv4 header as a means of distinguishing the two cases.

The Evil Bit is a flag in the IPv4 header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.

The Evil Bit is the most significant bit of the Fragment Offset field or the Flags field (3 MSB's of Fragment Offset) in the IPv4 header.

Little Endian

iphdr->frag_off |= 0x80

Big Endian

iphdr->frag_off |= 0x8000

Little Endian

eb = iphdr->frag_off & 0x80

Big Endian

eb = iphdr->frag_off & 0x8000