【アップデート】Network Firewall の SNI 詐称対策が強化されたので、再現して確かめてみた

#!/usr/bin/env bash
# 検証用 VPC、DNS Firewall ルールグループ、SSM 用 VPC エンドポイント、IAM ロールを作る。
# 前提: 一時認証情報が環境変数 (AWS_ACCESS_KEY_ID など) にある。AZ は第1引数 (例: ap-northeast-1a)。
set -euo pipefail
export AWS_DEFAULT_REGION=ap-northeast-1 AWS_PAGER=""
AZ="${1:?AZ name required}"
W=/tmp/nfw-riv; mkdir -p "$W"
TAG='{Key=project,Value=nfw-riv-1022}'

VPC=$(aws ec2 create-vpc --cidr-block 10.77.0.0/16 \
  --tag-specifications "ResourceType=vpc,Tags=[{Key=Name,Value=nfw-riv-vpc},$TAG]" \
  --query Vpc.VpcId --output text)
aws ec2 modify-vpc-attribute --vpc-id "$VPC" --enable-dns-support '{"Value":true}'
aws ec2 modify-vpc-attribute --vpc-id "$VPC" --enable-dns-hostnames '{"Value":true}'

IGW=$(aws ec2 create-internet-gateway \
  --tag-specifications "ResourceType=internet-gateway,Tags=[{Key=Name,Value=nfw-riv-igw},$TAG]" \
  --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --internet-gateway-id "$IGW" --vpc-id "$VPC"

FW_SUBNET=$(aws ec2 create-subnet --vpc-id "$VPC" --cidr-block 10.77.1.0/24 --availability-zone "$AZ" \
  --tag-specifications "ResourceType=subnet,Tags=[{Key=Name,Value=nfw-riv-fw},$TAG]" \
  --query Subnet.SubnetId --output text)
CL_SUBNET=$(aws ec2 create-subnet --vpc-id "$VPC" --cidr-block 10.77.2.0/24 --availability-zone "$AZ" \
  --tag-specifications "ResourceType=subnet,Tags=[{Key=Name,Value=nfw-riv-client},$TAG]" \
  --query Subnet.SubnetId --output text)
aws ec2 modify-subnet-attribute --subnet-id "$CL_SUBNET" --map-public-ip-on-launch

# DNS Firewall ルールグループ(ルールは空)を作り、VPC に関連付ける
FRG=$(aws route53resolver create-firewall-rule-group --name nfw-riv-frg \
  --tags "Key=project,Value=nfw-riv-1022" \
  --query FirewallRuleGroup.Id --output text)
ASSOC=$(aws route53resolver associate-firewall-rule-group --firewall-rule-group-id "$FRG" \
  --vpc-id "$VPC" --priority 101 --name nfw-riv-assoc \
  --query FirewallRuleGroupAssociation.Id --output text)

# クライアント用 SG とエンドポイント用 SG
CL_SG=$(aws ec2 create-security-group --group-name nfw-riv-client --description "nfw-riv client" --vpc-id "$VPC" \
  --tag-specifications "ResourceType=security-group,Tags=[{Key=Name,Value=nfw-riv-client},$TAG]" \
  --query GroupId --output text)
EP_SG=$(aws ec2 create-security-group --group-name nfw-riv-endpoint --description "nfw-riv ssm endpoints" --vpc-id "$VPC" \
  --tag-specifications "ResourceType=security-group,Tags=[{Key=Name,Value=nfw-riv-endpoint},$TAG]" \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$EP_SG" --protocol tcp --port 443 --source-group "$CL_SG" >/dev/null

# SSM 用インターフェイスエンドポイント(VPC 内通信なのでファイアウォールを通らない)
EPS=""
for svc in ssm ssmmessages ec2messages; do
  id=$(aws ec2 create-vpc-endpoint --vpc-id "$VPC" --vpc-endpoint-type Interface \
    --service-name "com.amazonaws.ap-northeast-1.$svc" --subnet-ids "$CL_SUBNET" \
    --security-group-ids "$EP_SG" --private-dns-enabled \
    --tag-specifications "ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=nfw-riv-$svc},$TAG]" \
    --query VpcEndpoint.VpcEndpointId --output text)
  EPS="$EPS $id"
done

# SSM 接続用 IAM ロールとインスタンスプロファイル
aws iam create-role --role-name nfw-riv-ssm-role --tags "Key=project,Value=nfw-riv-1022" \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}' >/dev/null
aws iam attach-role-policy --role-name nfw-riv-ssm-role --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
aws iam create-instance-profile --instance-profile-name nfw-riv-ssm-profile >/dev/null
aws iam add-role-to-instance-profile --instance-profile-name nfw-riv-ssm-profile --role-name nfw-riv-ssm-role

cat > "$W/ids.env" <<EOF
AZ=$AZ
VPC=$VPC
IGW=$IGW
FW_SUBNET=$FW_SUBNET
CL_SUBNET=$CL_SUBNET
FRG=$FRG
ASSOC=$ASSOC
CL_SG=$CL_SG
EP_SG=$EP_SG
EPS="$EPS"
EOF
cat "$W/ids.env"

#!/usr/bin/env bash
# Network Firewall のルールグループ、ポリシー(Resolved IP validation = ALERT)、ファイアウォールを作る。
# 前提: 01-setup-network.sh を実行済みで /tmp/nfw-riv/ids.env がある。
set -euo pipefail
export AWS_DEFAULT_REGION=ap-northeast-1 AWS_PAGER=""
W=/tmp/nfw-riv; source "$W/ids.env"
TAGS='[{"Key":"project","Value":"nfw-riv-1022"}]'
ALLOWED_DOMAIN=example.com

# ステートフルルール: ドメインリスト(許可リスト)。ターゲット種別は SNI と Host のみ(標準のドメインルール)
RG_ARN=$(aws network-firewall create-rule-group --rule-group-name nfw-riv-allow-domain \
  --type STATEFUL --capacity 100 --tags "$TAGS" \
  --rule-group "{
    \"RulesSource\": {\"RulesSourceList\": {
      \"Targets\": [\"$ALLOWED_DOMAIN\"],
      \"TargetTypes\": [\"TLS_SNI\", \"HTTP_HOST\"],
      \"GeneratedRulesType\": \"ALLOWLIST\"}},
    \"StatefulRuleOptions\": {\"RuleOrder\": \"STRICT_ORDER\"}}" \
  --query 'RuleGroupResponse.RuleGroupArn' --output text)

# ファイアウォールポリシー: Resolved IP validation を ALERT で有効化
POLICY_ARN=$(aws network-firewall create-firewall-policy --firewall-policy-name nfw-riv-policy \
  --tags "$TAGS" \
  --firewall-policy "{
    \"StatelessDefaultActions\": [\"aws:forward_to_sfe\"],
    \"StatelessFragmentDefaultActions\": [\"aws:forward_to_sfe\"],
    \"StatefulEngineOptions\": {\"RuleOrder\": \"STRICT_ORDER\"},
    \"StatefulDefaultActions\": [\"aws:drop_established\", \"aws:alert_established\"],
    \"StatefulRuleGroupReferences\": [{\"ResourceArn\": \"$RG_ARN\", \"Priority\": 100}],
    \"Route53ResolvedIPValidation\": {
      \"Action\": \"ALERT\",
      \"DNSFirewallRuleGroupId\": \"$FRG\",
      \"DNSExpiryExceptionPolicy\": \"CONTINUE\"}}" \
  --query 'FirewallPolicyResponse.FirewallPolicyArn' --output text)

aws network-firewall create-firewall --firewall-name nfw-riv-fw \
  --firewall-policy-arn "$POLICY_ARN" --vpc-id "$VPC" \
  --subnet-mappings "SubnetId=$FW_SUBNET" --tags "$TAGS" \
  --query 'Firewall.FirewallArn' --output text >/dev/null

# ログ出力先(CloudWatch Logs)
for t in flow alert; do
  aws logs create-log-group --log-group-name "/nfw-riv/$t" --tags project=nfw-riv-1022
  aws logs put-retention-policy --log-group-name "/nfw-riv/$t" --retention-in-days 1
done

echo "RG_ARN=$RG_ARN" >> "$W/ids.env"
echo "POLICY_ARN=$POLICY_ARN" >> "$W/ids.env"

# READY と同期完了を待つ(最大 25 分)
for i in $(seq 1 100); do
  s=$(aws network-firewall describe-firewall --firewall-name nfw-riv-fw \
    --query '[FirewallStatus.Status,FirewallStatus.ConfigurationSyncStateSummary]' --output text)
  echo "$(date +%H:%M:%S) $s"
  [ "$s" = "READY	IN_SYNC" ] && break
  sleep 15
done

# ロギング設定は 1 回の呼び出しで 1 つの出力先しか追加できない。FLOW → ALERT の順に 2 回呼ぶ
aws network-firewall update-logging-configuration --firewall-name nfw-riv-fw \
  --logging-configuration '{"LogDestinationConfigs":[
    {"LogType":"FLOW","LogDestinationType":"CloudWatchLogs","LogDestination":{"logGroup":"/nfw-riv/flow"}}]}' >/dev/null
aws network-firewall update-logging-configuration --firewall-name nfw-riv-fw \
  --logging-configuration '{"LogDestinationConfigs":[
    {"LogType":"FLOW","LogDestinationType":"CloudWatchLogs","LogDestination":{"logGroup":"/nfw-riv/flow"}},
    {"LogType":"ALERT","LogDestinationType":"CloudWatchLogs","LogDestination":{"logGroup":"/nfw-riv/alert"}}]}' >/dev/null

VPCE=$(aws network-firewall describe-firewall --firewall-name nfw-riv-fw \
  --query "FirewallStatus.SyncStates.\"$AZ\".Attachment.EndpointId" --output text)
echo "VPCE=$VPCE" >> "$W/ids.env"
echo "VPCE=$VPCE"

#!/usr/bin/env bash
# ルートテーブル(クライアント → ファイアウォール → IGW、戻りは IGW エッジ経由)と、
# クライアント EC2 / 詐称先(target)EC2 を作る。
# 前提: 02-create-firewall.sh を実行済み(/tmp/nfw-riv/ids.env に VPCE がある)。
set -euo pipefail
export AWS_DEFAULT_REGION=ap-northeast-1 AWS_PAGER=""
W=/tmp/nfw-riv; source "$W/ids.env"
TAG='{Key=project,Value=nfw-riv-1022}'

# --- ルーティング ---
FW_RT=$(aws ec2 create-route-table --vpc-id "$VPC" \
  --tag-specifications "ResourceType=route-table,Tags=[{Key=Name,Value=nfw-riv-fw-rt},$TAG]" \
  --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id "$FW_RT" --destination-cidr-block 0.0.0.0/0 --gateway-id "$IGW" >/dev/null
aws ec2 associate-route-table --route-table-id "$FW_RT" --subnet-id "$FW_SUBNET" >/dev/null

CL_RT=$(aws ec2 create-route-table --vpc-id "$VPC" \
  --tag-specifications "ResourceType=route-table,Tags=[{Key=Name,Value=nfw-riv-client-rt},$TAG]" \
  --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id "$CL_RT" --destination-cidr-block 0.0.0.0/0 --vpc-endpoint-id "$VPCE" >/dev/null
aws ec2 associate-route-table --route-table-id "$CL_RT" --subnet-id "$CL_SUBNET" >/dev/null

EDGE_RT=$(aws ec2 create-route-table --vpc-id "$VPC" \
  --tag-specifications "ResourceType=route-table,Tags=[{Key=Name,Value=nfw-riv-edge-rt},$TAG]" \
  --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id "$EDGE_RT" --destination-cidr-block 10.77.2.0/24 --vpc-endpoint-id "$VPCE" >/dev/null
EDGE_ASSOC=$(aws ec2 associate-route-table --route-table-id "$EDGE_RT" --gateway-id "$IGW" \
  --query AssociationId --output text)

# --- クライアント EC2 (ファイアウォール配下) ---
AMI=$(aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query Parameter.Value --output text)
CLIENT=""
for i in 1 2 3 4 5 6; do
  CLIENT=$(aws ec2 run-instances --image-id "$AMI" --instance-type t3.micro \
    --subnet-id "$CL_SUBNET" --security-group-ids "$CL_SG" \
    --iam-instance-profile Name=nfw-riv-ssm-profile \
    --metadata-options HttpTokens=required \
    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=nfw-riv-client},$TAG]" \
    --query 'Instances[0].InstanceId' --output text 2>/dev/null) && break
  echo "run-instances retry $i (instance profile propagation)"; sleep 10
done
aws ec2 wait instance-running --instance-ids "$CLIENT"
CLIENT_IP=$(aws ec2 describe-instances --instance-ids "$CLIENT" \
  --query 'Reservations[0].Instances[0].PublicIpAddress' --output text)

# --- 詐称先(target) EC2: 既定 VPC に置く。443 はクライアントの公開 IP からだけ許可 ---
DVPC=$(aws ec2 describe-vpcs --filters Name=is-default,Values=true --query 'Vpcs[0].VpcId' --output text)
DSUBNET=$(aws ec2 describe-subnets --filters Name=vpc-id,Values="$DVPC" Name=default-for-az,Values=true \
  --query 'Subnets[0].SubnetId' --output text)
T_SG=$(aws ec2 create-security-group --group-name nfw-riv-target --description "nfw-riv target" --vpc-id "$DVPC" \
  --tag-specifications "ResourceType=security-group,Tags=[{Key=Name,Value=nfw-riv-target},$TAG]" \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$T_SG" --protocol tcp --port 443 --cidr "$CLIENT_IP/32" >/dev/null

TARGET=$(aws ec2 run-instances --image-id "$AMI" --instance-type t3.micro \
  --subnet-id "$DSUBNET" --security-group-ids "$T_SG" --associate-public-ip-address \
  --metadata-options HttpTokens=required \
  --user-data file://"$(dirname "$0")/target-userdata.sh" \
  --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=nfw-riv-target},$TAG]" \
  --query 'Instances[0].InstanceId' --output text)
aws ec2 wait instance-running --instance-ids "$TARGET"
TARGET_IP=$(aws ec2 describe-instances --instance-ids "$TARGET" \
  --query 'Reservations[0].Instances[0].PublicIpAddress' --output text)

cat >> "$W/ids.env" <<EOF
FW_RT=$FW_RT
CL_RT=$CL_RT
EDGE_RT=$EDGE_RT
EDGE_ASSOC=$EDGE_ASSOC
CLIENT=$CLIENT
CLIENT_IP=$CLIENT_IP
DVPC=$DVPC
T_SG=$T_SG
TARGET=$TARGET
TARGET_IP=$TARGET_IP
EOF
echo "CLIENT=$CLIENT CLIENT_IP=$CLIENT_IP"
echo "TARGET=$TARGET TARGET_IP=$TARGET_IP"

#!/bin/bash
# 詐称先サーバー: 自己署名証明書で 443 を待ち受け、固定の文字列を返す
openssl req -x509 -newkey rsa:2048 -nodes -keyout /tmp/k.pem -out /tmp/c.pem -days 1 -subj "/CN=target"
cat > /tmp/s.py <<'EOF'
import http.server, ssl
class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        body = b"TARGET-SERVER-REACHED\n"
        self.send_response(200)
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def finish(self):
        # TLS の close_notify を送ってから閉じる(curl が EOF エラーにしないため)
        super().finish()
        try:
            self.connection.unwrap()
        except Exception:
            pass
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
ctx.load_cert_chain("/tmp/c.pem", "/tmp/k.pem")
s = http.server.HTTPServer(("0.0.0.0", 443), H)
s.socket = ctx.wrap_socket(s.socket, server_side=True)
s.serve_forever()
EOF
nohup python3 /tmp/s.py > /tmp/server.log 2>&1 &

#!/usr/bin/env bash
# ファイアウォールポリシーの Resolved IP validation を切り替える。
#   04-set-policy.sh none|ALERT|DROP|REJECT
# 変更後、ファイアウォールが READY / IN_SYNC になるまで待つ。
set -euo pipefail
export AWS_DEFAULT_REGION=ap-northeast-1 AWS_PAGER=""
W=/tmp/nfw-riv; source "$W/ids.env"
MODE="${1:?none|ALERT|DROP|REJECT}"

OUT=$(aws network-firewall describe-firewall-policy --firewall-policy-name nfw-riv-policy --output json)
TOKEN=$(python3 -c 'import json,sys; print(json.load(sys.stdin)["UpdateToken"])' <<<"$OUT")
NEW=$(python3 -c '
import json, sys
d = json.load(sys.stdin)["FirewallPolicy"]
mode, frg = sys.argv[1], sys.argv[2]
if mode == "none":
    d.pop("Route53ResolvedIPValidation", None)
else:
    d["Route53ResolvedIPValidation"] = {"Action": mode, "DNSFirewallRuleGroupId": frg, "DNSExpiryExceptionPolicy": "CONTINUE"}
print(json.dumps(d))' "$MODE" "$FRG" <<<"$OUT")

aws network-firewall update-firewall-policy --firewall-policy-name nfw-riv-policy \
  --update-token "$TOKEN" --firewall-policy "$NEW" --query 'FirewallPolicyResponse.FirewallPolicyStatus' --output text

# 反映待ち。ポリシー更新直後は IN_SYNC のままに見えることがあるので、少し待ってから判定する
sleep 20
for i in $(seq 1 60); do
  s=$(aws network-firewall describe-firewall --firewall-name nfw-riv-fw \
    --query '[FirewallStatus.Status,FirewallStatus.ConfigurationSyncStateSummary]' --output text)
  echo "$(date +%H:%M:%S) $s"
  [ "$s" = "READY	IN_SYNC" ] && break
  sleep 10
done
aws network-firewall describe-firewall-policy --firewall-policy-name nfw-riv-policy \
  --query 'FirewallPolicy.Route53ResolvedIPValidation' --output json

#!/usr/bin/env bash
# ドメインリストのルールグループのターゲット種別を切り替える。
#   05-set-rulegroup.sh sni        # TLS_SNI + HTTP_HOST のみ(標準のドメインルール)
#   05-set-rulegroup.sh resolved   # TLS_SNI + HTTP_HOST + AWS_ROUTE_53_RESOLVED_DOMAIN
set -euo pipefail
export AWS_DEFAULT_REGION=ap-northeast-1 AWS_PAGER=""
W=/tmp/nfw-riv; source "$W/ids.env"
MODE="${1:?sni|resolved}"
ALLOWED_DOMAIN=example.com

case "$MODE" in
  sni)      TYPES='"TLS_SNI", "HTTP_HOST"' ;;
  resolved) TYPES='"TLS_SNI", "HTTP_HOST", "AWS_ROUTE_53_RESOLVED_DOMAIN"' ;;
  *) echo "mode must be sni|resolved" >&2; exit 2 ;;
esac

TOKEN=$(aws network-firewall describe-rule-group --rule-group-arn "$RG_ARN" --query UpdateToken --output text)
aws network-firewall update-rule-group --rule-group-arn "$RG_ARN" --update-token "$TOKEN" \
  --rule-group "{
    \"RulesSource\": {\"RulesSourceList\": {
      \"Targets\": [\"$ALLOWED_DOMAIN\"],
      \"TargetTypes\": [$TYPES],
      \"GeneratedRulesType\": \"ALLOWLIST\"}},
    \"StatefulRuleOptions\": {\"RuleOrder\": \"STRICT_ORDER\"}}" \
  --query 'RuleGroupResponse.RuleGroupStatus' --output text

sleep 20
for i in $(seq 1 60); do
  s=$(aws network-firewall describe-firewall --firewall-name nfw-riv-fw \
    --query '[FirewallStatus.Status,FirewallStatus.ConfigurationSyncStateSummary]' --output text)
  echo "$(date +%H:%M:%S) $s"
  [ "$s" = "READY	IN_SYNC" ] && break
  sleep 10
done
aws network-firewall describe-rule-group --rule-group-arn "$RG_ARN" \
  --query 'RuleGroup.RulesSource.RulesSourceList' --output json