Solaris host-based firewall [PSARC/2008/580 FastTrack]

[Tony Nguyen]

Andrew Gabriel wrote:
> I've looked through the new spec.
> 
> I have some questions about how the current method of configuring 
> IPfilter will continue to work in the new framework. (I have programs 
> which build ipf.conf and reapply it dynamically as needed, and I don't 
> have any interest in automatically allowing/denying access based on SMF 
> service states. I guess that makes me an "advanced user" in your 
> terminology.)
> 
> So, if I understand correctly, to enable current mode of operation, I 
> would issue the commands:
> 
> svccfg -s svc:/network/ipfilter: setprop firewall_config_default/policy 
> = custom
> svcadm enable svc:/network/ipfilter

Andrew,

We also need to specify the rules file:

svccfg -s svc:/network/ipfilter: setprop firewall_config_default/policy
= astring: "/foo/bar.conf"


> This needs clearly stating as an example on a manpage (ipf(1M) and/or 
> ipf(4)).

will do.

> 
> What happens on upgrade of a system with an existing ipf.conf file and 
> IPfilter enabled? Will you automatically do this? If not, how do you 
> handle upgrade?

Good catch, I almost missed this. Yes, we need to set the above values 
appropriate on upgrade, most likely via a profile/upgrade script.

> In the ipf(1M) manpage, you have removed the ipf and ipnat command 
> examples. This is incorrect -- these are still used and required for 
> current method of operation. You perhaps just need to add a comment that 
> these wouldn't be used if using the SMF framework to automatically build 
> firewall rules. You have also effectively removed the instructions for 
> changing filter rules without either rebooting or disabling IPfilter. It 
> is an important feature of IPfilter that it allows rules to be changed 
> dynamically without disabling it or rebooting the system, and this needs 
> to remain on the manpage. ipf(1M) is a committed interface and a key 
> part of the access to important features of IPfilter.
> 

Actually, I removed that section for correctness and consistency, 
independently of firewall. IPfilter is an SMF service and should really 
be managed via SMF commands, in this case:

"svcadm restart ipfilter" for "ipf -E"
"svcadm refresh ipfilter" for "ipf -f ipf.conf; ipf -f nat.conf"

The argument here is choices for the customer but it can also be a 
little confusing to have the man page shows starting network/ipfilter 
with SMF command and restart/refresh actions are done with non-SMF 
commands.  Does it make sense?

Thanks,
tony