Seit ich die erste Cisco ASA in den Händen hielt fand ich die Geräte sofort interessant. Warum? Sie werden schnell warm ;)
Etwas, was andere vielleicht stört hat mich auf den Gedanken gebracht, dass drin wohl irgendwas schnelles sein muss. Ist es auch, drin ist ein kompletter x86-kompatibler PC mit USB und Audio (nicht angeschlossen).
Was läuft also auf der ASA? Mal schauen, wir nehmen dafür das aktuelle Image mit der Version 8.02:
sinuspl@mobile:~/asa$ ls -la asa802-k8.bin
-rw-r--r-- 1 sinuspl sinuspl 14524416 2008-08-08 14:15 asa802-k8.bin
sinuspl@mobile:~/asa$
Mal mit ‘strings’ reinschauen was lesbar ist (hier ein kleiner Auszug):
linux: fatal error: A20 gate not responding!
2.6.17.8 (kevfox@kevfox-lnx) #5 PREEMPT Mon May 7 18:35:37 EDT 2007
initrdBegin=
moving initrd
initrdSize
initrdBegin
Na dann… schauen wir mal, ob es eine initrd gibt:
sinuspl@mobile:~/asa$ hexdump -C asa802-k8.bin > asa802-k8.hex
sinuspl@mobile:~/asa$ ls -la asa802-k8.hex
-rw-r--r-- 1 sinuspl sinuspl 71393157 2008-08-08 14:33 asa802-k8.hex
sinuspl@mobile:~/asa$ grep "1f 8b 08 00 1d" asa802-k8.hex
001228b0 1f 8b 08 00 1d 3d 73 46 00 03 ec 3a 6d 54 14 57 |.....=sF...:mT.W|
sinuspl@mobile:~/asa$
Also doch! 001228b0 ist die Adresse an der es anfängt. Ein bischen rechnen:
sinuspl@mobile:~/asa$ echo "14524416-((0+11*16)+((8+2*16)*256)+((2+1*16)*65536))" | bc
13334352
sinuspl@mobile:~/asa$ tail -c 13334352 asa802-k8.bin > asa802-k8.initrd.gz
sinuspl@mobile:~/asa$ ls -la asa802-k8.initrd.gz
-rw-r--r-- 1 sinuspl sinuspl 13334352 2008-08-08 14:46 asa802-k8.initrd.gz
sinuspl@mobile:~/asa$
So, nun haben wir die (vermeintliche) initrd. Entpacken? Ja:
sinuspl@mobile:~/asa$ gzip -d asa802-k8.initrd.gz
gzip: asa802-k8.initrd.gz: decompression OK, trailing garbage ignored
sinuspl@mobile:~/asa$ ls -la asa802-k8.initrd
-rw-r--r-- 1 sinuspl sinuspl 31251968 2008-08-08 14:46 asa802-k8.initrd
sinuspl@mobile:~/asa$
Mal mit cpio die Daten zurückgewinnen:
sinuspl@mobile:~/asa$ mkdir initrd
sinuspl@mobile:~/asa$ cd initrd/
sinuspl@mobile:~/asa/initrd$ cpio -i --no-absolute-filenames --make-directories < ../asa802-k8.initrd
cpio: Removing leading `/' from member names
61039 blocks
sinuspl@mobile:~/asa/initrd$ ls
asa bin dev etc init lib linuxrc mnt proc sbin sys System.map usr vmlinuz
sinuspl@mobile:~/asa/initrd$
Also doch Linux ;) Jetzt versuchen wir mal mit QEMU. Zuerst mal wieder die initrd packen, flash-disk erzeugen und alles starten:
sinuspl@mobile:~/asa/initrd$ cd ..
sinuspl@mobile:~/asa$ gzip asa802-k8.initrd
sinuspl@mobile:~/asa$ dd if=/dev/zero of=FLASH bs=1M count=1 seek=254
1+0 records in
1+0 records out
1048576 bytes (1.0 MB) copied, 0.00604308 s, 174 MB/s
sinuspl@mobile:~/asa$ qemu -hda FLASH -m 256 -kernel ./initrd/vmlinuz -initrd asa802-k8.initrd.gz -kernel-kqemu -nographic -append "auto console=ttyS0,9600 bigphysarea=16384 ide1=noprobe"
Was rauskommt ist länger:
Linux version 2.6.17.8 (kevfox@kevfox-lnx) (gcc version 4.0.2) #5 PREEMPT Mon May 7 18:35:37 EDT 2007 BIOS-provided physical RAM map: BIOS-e820: 0000000000000000 - 000000000009fc00 (usable) BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved) BIOS-e820: 00000000000e8000 - 0000000000100000 (reserved) BIOS-e820: 0000000000100000 - 000000000fff0000 (usable) BIOS-e820: 000000000fff0000 - 0000000010000000 (ACPI data) BIOS-e820: 00000000fffc0000 - 0000000100000000 (reserved) 0MB HIGHMEM available. 255MB LOWMEM available. DMI not present or invalid. Allocating PCI resources starting at 20000000 (gap: 10000000:effc0000) Built 1 zonelists Kernel command line: auto console=ttyS0,9600 bigphysarea=16384 ide1=noprobe ide_setup: ide1=noprobe Enabling fast FPU save and restore... done. Enabling unmasked SIMD FPU exception support... done. Initializing CPU#0 PID hash table entries: 1024 (order: 10, 4096 bytes) Detected 1862.899 MHz processor. Using tsc for high-res timesource Console: colour dummy device 80x25 Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Memory: 178388k/262080k available (1553k kernel code, 82984k reserved, 348k data, 116k init, 0k highmem) Checking if this processor honours the WP bit even in supervisor mode... Ok. Calibrating delay using timer specific routine.. 3739.13 BogoMIPS (lpj=7478268) Mount-cache hash table entries: 512 CPU: L1 I cache: 32K, L1 D cache: 32K CPU: L2 cache: 2048K CPU: Intel Pentium II (Klamath) stepping 03 Checking 'hlt' instruction... OK. SMP alternatives: switching to UP code Freeing SMP alternatives: 0k freed Unpacking initramfs... done Freeing initrd memory: 12968k freed NET: Registered protocol family 16 PCI: PCI BIOS revision 2.10 entry at 0xfaa80, last bus=0 Setting up standard PCI resources PCI: Probing PCI hardware PCI quirk: region b000-b03f claimed by PIIX4 ACPI PCI quirk: region b100-b10f claimed by PIIX4 SMB PCI: Using IRQ router PIIX/ICH [8086/7000] at 0000:00:01.0 PCI: Ignore bogus resource 6 [0:0] of 0000:00:02.0 NET: Registered protocol family 2 IP route cache hash table entries: 2048 (order: 1, 8192 bytes) TCP established hash table entries: 8192 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 8192 bind 4096) TCP reno registered Total HugeTLB memory allocated, 0 bigphysarea: Allocated 16384 pages at 0xe0000000. Initializing Cryptographic API io scheduler noop registered io scheduler anticipatory registered (default) io scheduler deadline registered io scheduler cfq registered Limiting direct PCI/PCI transfers. PCI: PIIX3: Enabling Passive Release on 0000:00:01.0 Activating ISA DMA hang workarounds. Serial: 8250/16550 driver $Revision: #2 $ 4 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16450 loop: loaded (max 8 devices) pcnet32.c:v1.32 18.Mar.2006 tsbogend@alpha.franken.de tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2 ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx hda: QEMU HARDDISK, ATA DISK drive ide0 at 0x1f0-0x1f7,0x3f6 on irq 14 hda: max request size: 512KiB hda: 522240 sectors (267 MB) w/256KiB Cache, CHS=518/255/63 hda: cache flushes supported hda: TCP bic registered NET: Registered protocol family 1 NET: Registered protocol family 17 Using IPI Shortcut mode Freeing unused kernel memory: 116k freed mount: Mounting /dev/hda1 on /mnt/disk0 failed: No such device or address mount: Mounting /dev/hda1 on /mnt/disk0 failed: No such device or address TIPC: Activated (compiled May 2 2007 15:38:08) NET: Registered protocol family 30 TIPC: Started in single node mode TIPC: Started in network mode TIPC: Own node address , network identity 1234 TIPC: Enabled bearer , discovery domain , priority 10 Processor memory 164921344, Reserved memory: 20971520 (DSOs: 0 + kernel: 20971520) Guest RAM start: 0xd4c00080 Guest RAM end: 0xdd400000 LINA unit number: 1 Guest RAM brk: 0xd4c01000 MKDIR failed No such file or directory for /var/log/ Welcome to LINA - ( F1-on-Linux platform ) desktop version! ******************************************************************** * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING * * * * This product is for Cisco internal use ONLY!!! * * * * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING * ******************************************************************** i2c_read_byte_w_wait() error, slot = 0x4, device = 0xb0, address = 0 byte count = 1. Reason: I2C_SMBUS_UNSUPPORT Total SSMs found: 0 Ignoring PCI card in slot:0 (vendor:0x0 deviceid:0x0) Ignoring PCI card in slot:1 (vendor:0x0 deviceid:0x0) Ignoring PCI card in slot:2 (vendor:0x0 deviceid:0x0) Ignoring PCI card in slot:3 (vendor:0x0 deviceid:0x0) Ignoring PCI card in slot:4 (vendor:0x0 deviceid:0x0) Ignoring PCI card in slot:5 (vendor:0x0 deviceid:0x0) Ignoring PCI card in slot:6 (vendor:0x0 deviceid:0x0) Total NICs found: 6 Error in ioctl SIOGIFINDEX Failed to open linaeth for interface 0 - verify the support in kernel Error in ioctl SIOGIFINDEX Failed to open linaeth for interface 1 - verify the support in kernel Error in ioctl SIOGIFINDEX Failed to open linaeth for interface 2 - verify the support in kernel Error in ioctl SIOGIFINDEX Failed to open linaeth for interface 3 - verify the support in kernel Error in ioctl SIOGIFINDEX Failed to open linaeth for interface 4 - verify the support in kernel Error in ioctl SIOGIFINDEX Failed to open linaeth for interface 5 - verify the support in kernel INFO: Unable to read firewall mode from flash Writing default firewall mode (single) to flash WARNING: Unable to write firewall mode to flash, this is normal if flash is not formatted. -------------------------------------------------------------------------- . . | | ||| ||| .|| ||. .|| ||. .:||| | |||:..:||| | |||:. C i s c o S y s t e m s -------------------------------------------------------------------------- Cisco Adaptive Security Appliance Software Version 8.0(2) Cannot open interface card (media_ethernet/port/id/0) pix_idb_create: Unable to get link capabilities 0 pix_idb_create: Unable to get nic_stats for port 0 Cannot open interface card (media_ethernet/port/id/1) pix_idb_create: Unable to get link capabilities 1 pix_idb_create: Unable to get nic_stats for port 1 Cannot open interface card (media_ethernet/port/id/2) pix_idb_create: Unable to get link capabilities 2 pix_idb_create: Unable to get nic_stats for port 2 Cannot open interface card (media_ethernet/port/id/3) pix_idb_create: Unable to get link capabilities 3 pix_idb_create: Unable to get nic_stats for port 3 Cannot open interface card (media_ethernet/port/id/4) pix_idb_create: Unable to get link capabilities 4 pix_idb_create: Unable to get nic_stats for port 4 Cannot open interface card (media_ethernet/port/id/5) pix_idb_create: Unable to get link capabilities 5 pix_idb_create: Unable to get nic_stats for port 5 ****************************** Warning ******************************* This product contains cryptographic features and is subject to United States and local country laws governing, import, export, transfer, and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute, or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return the enclosed items immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. ******************************* Warning ******************************* Copyright (c) 1996-2007 by Cisco Systems, Inc. Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. Cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 open or write(ffsdev/2/write/32) failed Could not initialize system files in flash. i2c_read_byte_w_suspend() error, slot = 0x4, device = 0xb0, address = 0 byte count = 1. Reason: I2C_SMBUS_UNSUPPORT i2c_read_byte_w_suspend() error, slot = 0x4, device = 0xb0, address = 0 byte count = 1. Reason: I2C_SMBUS_UNSUPPORT Type help or '?' for a list of available commands. ciscoasa>
OK! Gewonnen! ;)
ciscoasa> enable Password: ciscoasa# show version Cisco Adaptive Security Appliance Software Version 8.0(2) Compiled on Fri 15-Jun-07 19:29 by builders System image file is "Unknown, monitor mode tftp booted image" Config file at boot was "startup-config" ciscoasa up 2 mins 30 secs Hardware: , 128 MB RAM, CPU Pentium II 1862 MHz Internal ATA Compact Flash, 0MB BIOS Flash Firmware Hub @ 0xffe00000, 1024KB 0: Ext: Ethernet0/0 : irq 255 1: Ext: Ethernet0/1 : irq 255 2: Ext: Ethernet0/2 : irq 255 3: Ext: Ethernet0/3 : irq 255 4: Ext: Ethernet0/4 : irq 255 5: Ext: Ethernet0/5 : irq 255 VLANs : 200 Failover : Active/Active 3DES-AES : Enabled Security Contexts : 20 GTP/GPRS : Enabled VPN Peers : 5000 WebVPN Peers : 2500 ADV END SEC : Enabled Serial Number: 123456789AB Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 Configuration register is 0x0 Configuration has not been modified since last system restart. ciscoasa# sh run : Saved : ASA Version 8.0(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted names ! interface Ethernet0/0 shutdown no nameif no security-level no ip address ! interface Ethernet0/1 shutdown no nameif no security-level no ip address ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Ethernet0/4 shutdown no nameif no security-level no ip address ! interface Ethernet0/5 shutdown no nameif no security-level no ip address ! passwd 2KFQnbNIdI.2KYOU encrypted ftp mode passive pager lines 24 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart no crypto isakmp nat-traversal telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list ! ! prompt hostname context Cryptochecksum:00000000000000000000000000000000 : end ciscoasa#