media/lisa15/index.html

<!doctype html>
<html lang="en">

	<head>
		<meta charset="utf-8">

		<title>Testing and Monitoring Your Network Flows with Fwunit</title>

		<meta name="description" content="Presentation at LISA'15">
		<meta name="author" content="Dustin J. Mitchell & Michal Purzynski">

		<meta name="apple-mobile-web-app-capable" content="yes" />
		<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />

		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, minimal-ui">

		<link rel="stylesheet" href="css/reveal.css">
		<link rel="stylesheet" href="css/theme/moon.css" id="theme">

		<!-- Code syntax highlighting -->
		<link rel="stylesheet" href="lib/css/zenburn.css">

		<!-- Printing and PDF exports -->
		<script>
			var link = document.createElement( 'link' );
			link.rel = 'stylesheet';
			link.type = 'text/css';
			link.href = window.location.search.match( /print-pdf/gi ) ? 'css/print/pdf.css' : 'css/print/paper.css';
			document.getElementsByTagName( 'head' )[0].appendChild( link );
		</script>

		<!--[if lt IE 9]>
		<script src="lib/js/html5shiv.js"></script>
		<![endif]-->
	</head>

	<body>

		<div class="reveal">

			<!-- Any section element inside of this container is displayed as a slide -->
			<div class="slides">
				<section>
					<h1>Testing and Monitoring Your Network Flows</h1>
					<h1>With Fwunit</h1>
					<p>
                    <small>Dustin J. Mitchell / Michal Purzynski</small>
					</p>
				</section>

				<section>
					<h2>Motivating Examples</h2>
				</section>

				<section>
					<h2>What is fwunit?</h2>
				</section>

				<section>
					<h2>Commercial Tools</h2>
				</section>

				<section>
					<h2>Gathering Flow Data</h2>
				</section>

				<section>
					<h2>Querying Flows</h2>
				</section>

				<section>
					<h2>Comparing Flows Over Time</h2>
				</section>

				<section>
					<h2>Verifying Compliance</h2>
				</section>

                <!-- HANDOFF michal -> dustin --> 

				<section>
					<h2>Network Behavior</h2>

                    <blockquote>"The staging web servers should have access to the staging DB severs on port 5432."</blockquote>
                    <hr>
                    <blockquote>"The office network should not have access to the DB servers."</blockquote>
                    <hr>
                    <blockquote>"This route-table change should not affect reachability."</blockquote>
				</section>

				<section>
					<h2>Test Driven Development</h2>

                    <img src="tdd.svg" class="stretch" />
				</section>

                <section>
                    <section>
                        <h2>Unit Tests</h2>
                        <pre><code data-trim class="hljs python">
def test_worker_ssh():
    """Bug 1289789: worker managers have outbound access to all managed
    subnets via SSH"""
    rules.assertPermits(
        worker_managers,
        managed_use1 + managed_staging_use1 + managed1_usw2,
        'ssh')
                        </code></pre>
                    </section>
                    <section>
                        <h2>Unit Tests</h2>
                        <pre><code data-trim class="hljs python">
managed1_usw2 = IPSet([IP('10.14.136.0/24')])
managed1_use1 = IPSet([IP('10.13.136.0/24')])
managed1_staging_use1 = IPSet([IP('10.13.133.0/24')])

worker_managers = IPSet([
    host('worker-manager1.scl3.mozilla.com'),
    host('worker-manager2.scl3.mozilla.com'),
])
                        </code></pre>
                    </section>
				</section>

				<section>
					<h2>Readability?</h2>
                        <pre><code data-trim class="hljs python">
match {
    source-address [ worker-manager1 worker-manager2 ];
    destination-address worker-subnets;
    application junos-ssh;
}
then {
    permit;
}
                        </code></pre>
                        <pre><code data-trim class="hljs python">
def test_worker_ssh():
    """Bug 1289789: worker managers have outbound access to all managed
    subnets via SSH"""
    rules.assertPermits(
        worker_managers,
        managed_use1 + managed_staging_use1 + managed1_usw2,
        'ssh')
                        </code></pre>
				</section>

				<section>
                    <section>
                        <h2>Unit Tests as Documentation</h2>
                            <pre><code data-trim class="hljs python">
"""
Workers are EC2 instances created in various Amazon regions.  They
are managed by worker-managers, both via the AWS APIs and directly
by connecting to the workers using SSH.

Workers are not able to communicate between themselves, but do have full
Internet access.
"""
                            </code></pre>
                    </section>
                    <section>
<div style="text-align: left; border: thin solid #E0E0E5; padding: 1em; font-size: 75%;">
<h3>Workers</h3>
<p>Workers are EC2 instances created in various Amazon regions.  They are managed
by worker-managers, both via the AWS APIs and directly by connecting to the
workers using SSH.

<p>Workers are not able to communicate between themselves, but do have full
Internet access.

<hr>
<p><em>test_worker_ssh</em> - Bug 1289789: worker managers have outbound access to all
managed subnets via SSH
</div>
                    </section>
                </section>

				<section>
                    <section>
                        <h2>Design</h2>

                        <img src="singlematrix.svg" class="stretch" />

                    </section>
                    <section>
                        <h2>SRX</h2>

        <!-- firewall icon ==> matrices -->

                    </section>
                    <section>
                        <h2>AWS</h2>

        <!-- EC2 VPC icon ==> matrices -->

                    </section>
                    <section>
                        <h2>Combinder</h2>

        <!-- matrices ==> matrices (based on routing) -->

                    </section>
                </section>

				<section>
					<h2>Motivating Examples (revisited)</h2>
				</section>

				<section>
					<h2>Future Work</h2>
				</section>

            </div>

		</div>

		<script src="lib/js/head.min.js"></script>
		<script src="js/reveal.js"></script>

		<script>

			// Full list of configuration options available at:
			// https://github.com/hakimel/reveal.js#configuration
			Reveal.initialize({
				controls: true,
				progress: true,
				history: true,
				center: true,

				transition: 'slide', // none/fade/slide/convex/concave/zoom

				// Optional reveal.js plugins
				dependencies: [
					{ src: 'lib/js/classList.js', condition: function() { return !document.body.classList; } },
					{ src: 'plugin/markdown/marked.js', condition: function() { return !!document.querySelector( '[data-markdown]' ); } },
					{ src: 'plugin/markdown/markdown.js', condition: function() { return !!document.querySelector( '[data-markdown]' ); } },
					{ src: 'plugin/highlight/highlight.js', async: true, condition: function() { return !!document.querySelector( 'pre code' ); }, callback: function() { hljs.initHighlightingOnLoad(); } },
					{ src: 'plugin/zoom-js/zoom.js', async: true },
					{ src: 'plugin/notes/notes.js', async: true }
				]
			});

		</script>

	</body>
</html>