| blob | 3790a40c3d162fd099414f3710ded6f1e3508474 |
1 '\" te
2 .\" To view license terms, attribution, and copyright for IP Filter, the default path is /usr/lib/ipf/IPFILTER.LICENCE. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed
3 .\" location.
4 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
5 .\" Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
6 .TH SVC.IPFD 1M "Dec 30, 2015"
7 .SH NAME
8 svc.ipfd \- IP Filter firewall monitoring daemon
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fB/lib/svc/bin/svc.ipfd\fR
13 .fi
15 .LP
16 .nf
17 \fBsvc:/network/ipfilter:default\fR
18 .fi
20 .SH DESCRIPTION
21 .LP
22 The \fBsvc.ipfd\fR daemon monitors actions on services that use firewall
23 configuration and initiates update services' IP Filter configuration. The
24 daemon allows the system to react to changes in system's firewall configuration
25 in an incremental fashion, at a per-service level.
26 .sp
27 .LP
28 A service's firewall policy is activated when it is enabled, deactivated when
29 it is disabled, and updated when its configuration property group is modified.
30 \fBsvc.ipfd\fR monitors the services management facility (SMF) repository for
31 these actions and invokes the IP Filter rule-generation process to carry out
32 the service's firewall policy.
33 .sp
34 .LP
35 This daemon is started by the \fBnetwork/ipfilter\fR service either through the
36 \fBstart\fR or \fBrefresh\fR method. Thus, the daemon inherits the environment
37 variables and credentials from the method and runs as root with all zone
38 privileges.
39 .SS "Firewall Static Configuration"
40 .LP
41 A static definition describes a service's network resource configuration that
42 is used to generate service-specific IPF rules. The per-service
43 \fBfirewall_context\fR property group contains a service's static definition,
44 similar to the \fBinetd\fR property group in \fBinetd\fR managed services. This
45 property group supports:
46 .sp
47 .ne 2
48 .na
49 \fB\fBfirewall_context/name\fR\fR
50 .ad
51 .sp .6
52 .RS 4n
53 For non-\fBinetd\fR services. The IANA name or RPC name, equivalent to the
54 \fBinetd/name\fR property.
55 .RE
57 .sp
58 .ne 2
59 .na
60 \fB\fBfirewall_context/isrpc\fR\fR
61 .ad
62 .sp .6
63 .RS 4n
64 For non-\fBinetd\fR services. A boolean property where a \fBtrue\fR value
65 indicates an RPC service, equivalent to the \fBinetd/isrpc\fR property. For RPC
66 services, the value of \fBfirewall_context/name\fR is not an IANA name but is
67 either an RPC program number or name. See \fBrpc\fR(4).
68 .RE
70 .sp
71 .LP
72 Additionally, some services may require a mechanism to generate and supply
73 their own IPF rules. An optional property \fBipf_method\fR, provides a
74 mechanism to allow such custom rule generation:
75 .sp
76 .ne 2
77 .na
78 \fB\fBfirewall_context/ipf_method\fR\fR
79 .ad
80 .sp .6
81 .RS 4n
82 A command. Normally a script that generates IPF rules for a service. The
83 framework does not generate rules for services with this property definition.
84 Rather, the framework expects these services to provide their own rules.
85 .RE
87 .sp
88 .LP
89 A service's \fBipf_method\fR specifies a command that takes an additional
90 argument, its own fault management resource identifier (FMRI), and generates
91 the service's firewall rules and outputs those rules to stdout. To generate
92 rules for a service with the \fBipf_method\fR property, the framework execs the
93 command specified in \fBipf_method\fR, passing the service FMRI as the
94 additional argument, and stores the rules for that service by redirecting the
95 command output, the rules, to the service's rule file. Because an
96 \fBipf_method\fR is \fBexec\fR'ed from the context of either the
97 \fBnetwork/ipfilter\fR \fBstart\fR or \fBrefresh\fR method process, it inherits
98 the execution context and runs as root.
99 .sp
100 .LP
101 The service static configuration is delivered by the service developer and not
102 intended to be modified by users. These properties are only modified upon
103 installation of an updated service definition.
104 .SS "Firewall Policy Configuration"
105 .LP
106 A per-service property group, \fBfirewall_config\fR, stores the services'
107 firewall policy configuration. Because \fBnetwork/ipfilter:default\fR is
108 responsible for two firewall policies, the Global Default and Global Override
109 system-wide policies (as explained in \fBipfilter\fR(5)), it has two property
110 groups, \fBfirewall_config_default\fR and \fBfirewall_config_override\fR, to
111 store the respective system-wide policies.
112 .sp
113 .LP
114 Below are the properties, their possible values, and corresponding semantics:
115 .sp
116 .ne 2
117 .na
118 \fB\fBpolicy\fR\fR
119 .ad
120 .sp .6
121 .RS 4n
122 The \fBpolicy\fR has the following modes:
123 .sp
124 .ne 2
125 .na
126 \fB\fBnone\fR policy mode\fR
127 .ad
128 .sp .6
129 .RS 4n
130 No access restriction. For a global policy, this mode allows all incoming
131 traffic. For a service policy, this mode allows all incoming traffic to its
132 service.
133 .RE
135 .sp
136 .ne 2
137 .na
138 \fB\fBdeny\fR policy mode\fR
139 .ad
140 .sp .6
141 .RS 4n
142 More restrictive than \fBnone\fR. This mode allows incoming traffic from all
143 sources except those specified in the \fBapply_to\fR property.
144 .RE
146 .sp
147 .ne 2
148 .na
149 \fB\fBallow\fR policy mode\fR
150 .ad
151 .sp .6
152 .RS 4n
153 Most restrictive mode. This mode blocks incoming traffic from all sources
154 except those specified in the \fBapply_to\fR property.
155 .RE
157 .RE
159 .sp
160 .ne 2
161 .na
162 \fB\fBblock-policy\fR\fR
163 .ad
164 .sp .6
165 .RS 4n
166 The \fBblock-policy\fR property defines the handling of packets that
167 are blocked by the filter. It has the following modes:
168 .sp
169 .ne 2
170 .na
171 \fB\fBnone\fR block-policy mode\fR
172 .ad
173 .sp .6
174 .RS 4n
175 Block by dropping packets.
176 .RE
178 .sp
179 .ne 2
180 .na
181 \fB\fBreturn\fR block-policy mode\fR
182 .ad
183 .sp .6
184 .RS 4n
185 Block by returning RST (for TCP) or ICMP messages (for other
186 protocols) to the sender of the blocked packets.
187 .RE
189 .RE
191 .sp
192 .ne 2
193 .na
194 \fB\fBapply_to\fR\fR
195 .ad
196 .sp .6
197 .RS 4n
198 A multi-value property listing IPv4 network source entities to enforce the
199 chosen policy mode. Packets coming from the entities listed in \fBapply_to\fR
200 property will be denied if policy is \fBdeny\fR and allowed if policy is
201 \fBallow\fR. The syntax for possible values are:
202 .sp
203 .in +2
204 .nf
205 host: host:\fIIP\fR "host:192.168.84.14"
206 subnet: network:\fIIP/netmask\fR "network:129.168.1.5/24"
207 ippool: pool:\fIpool number\fR "pool:77"
208 interface: if:\fIinterface_name\fR "if:e1000g0"
209 .fi
210 .in -2
211 .sp
213 .RE
215 .sp
216 .ne 2
217 .na
218 \fB\fBapply_to_6\fR\fR
219 .ad
220 .sp .6
221 .RS 4n
222 A multi-value property listing IPv6 network source entities to enforce the
223 chosen policy mode. Packets coming from the entities listed in \fBapply_to_6\fR
224 property will be denied if policy is \fBdeny\fR and allowed if policy is
225 \fBallow\fR. The syntax for possible values are:
226 .sp
227 .in +2
228 .nf
229 host: host:\fIIP\fR "host:2001:DB8::12ff:fe34:5678"
230 subnet: network:\fIIP/netmask\fR "network:2001:DB8::/32"
231 ippool: pool:\fIpool number\fR "pool:77"
232 interface: if:\fIinterface_name\fR "if:e1000g0"
233 .fi
234 .in -2
235 .sp
237 .RE
239 .sp
240 .ne 2
241 .na
242 \fB\fBexceptions\fR\fR
243 .ad
244 .sp .6
245 .RS 4n
246 A multi-value property listing IPv4 network source entities to be excluded from
247 the \fBapply_to\fR list. For example, when \fBdeny\fR policy is applied to a
248 subnet, exceptions can be made to some hosts in that subnet by specifying them
249 in the \fBexceptions\fR property. This property has the same value syntax as
250 \fBapply_to\fR property.
251 .RE
253 .sp
254 .ne 2
255 .na
256 \fB\fBexceptions_6\fR\fR
257 .ad
258 .sp .6
259 .RS 4n
260 A multi-value property listing IPv6 network source entities to be excluded from
261 the \fBapply_to_6\fR list. For example, when \fBdeny\fR policy is applied to a
262 subnet, exceptions can be made to some hosts in that subnet by specifying them
263 in the \fBexceptions_6\fR property. This property has the same value syntax as
264 \fBapply_to_6\fR property.
265 .RE
267 .sp
268 .ne 2
269 .na
270 \fB\fBtarget\fR\fR
271 .ad
272 .sp .6
273 .RS 4n
274 A multi-value property listing IPv4 network destination entities to enforce the
275 chosen policy mode. Packets directed to the destination entities listed in
276 \fBtarget\fR property will be denied if policy is \fBdeny\fR and allowed if
277 policy is \fBallow\fR. This property has the same value syntax as \fBapply_to\fR
278 property, with the notable exception that specifying network interfaces is not
279 supported.
280 .RE
282 .sp
283 .ne 2
284 .na
285 \fB\fBtarget_6\fR\fR
286 .ad
287 .sp .6
288 .RS 4n
289 A multi-value property listing IPv6 network destination entities to enforce the
290 chosen policy mode. Packets directed to the destination entities listed in
291 \fBtarget_6\fR property will be denied if policy is \fBdeny\fR and allowed if
292 policy is \fBallow\fR. This property has the same value syntax as
293 \fBapply_to_6\fR property, with the notable exception that specifying network
294 interfaces is not supported.
295 .RE
297 .sp
298 .LP
299 For individual network services only:
300 .sp
301 .ne 2
302 .na
303 \fB\fBfirewall_config/policy\fR\fR
304 .ad
305 .sp .6
306 .RS 4n
307 A service's policy can also be set to \fBuse_global\fR. Services with
308 \fBuse_global\fR policy mode inherit the Global Default firewall policy.
309 .RE
311 .sp
312 .ne 2
313 .na
314 \fB\fBfirewall_config/block_policy\fR\fR
315 .ad
316 .sp .6
317 .RS 4n
318 A service's block policy can also be set to \fBuse_global\fR. Services with
319 \fBuse_global\fR block policy mode inherit the Global Default firewall block
320 policy.
321 .RE
323 .sp
324 .LP
325 For the Global Default only:
326 .sp
327 .ne 2
328 .na
329 \fB\fBfirewall_config_default/policy\fR\fR
330 .ad
331 .sp .6
332 .RS 4n
333 Global Default policy, \fBfirewall_config\fR property group in
334 \fBsvc:/network/ipfilter:default\fR, can also be set to \fBcustom\fR. Users can
335 set \fBpolicy\fR to \fBcustom\fR to use prepopulated IP Filter configuration,
336 for example, an existing IP Filter configuration or custom configurations that
337 cannot be provided by the framework. This Global Default-only policy mode
338 allows users to supply a text file containing the complete set of IPF rules.
339 When \fBcustom\fR mode is selected, the specified set of IPF rules is
340 \fBcomplete\fR and the framework will not generate IPF rules from configured
341 firewall policies.
342 .RE
344 .sp
345 .ne 2
346 .na
347 \fB\fBfirewall_config_default/custom_policy_file\fR\fR
348 .ad
349 .sp .6
350 .RS 4n
351 A file path to be used when Global Default policy is set to \fBcustom\fR. The
352 file contains a set of IPF rules that provide the desired IP Filter
353 configuration. For example, users with existing IPF rules in
354 \fB/etc/ipf/ipf.conf\fR can execute the following commands to use the existing
355 rules:
356 .RS +4
357 .TP
358 1.
359 Set custom policy:
360 .sp
361 .in +2
362 .nf
363 # \fBsvccfg -s ipfilter:default setprop \e
364 firewall_config_default/policy = astring: "custom"\fR
365 .fi
366 .in -2
367 .sp
369 .RE
370 .RS +4
371 .TP
372 2.
373 Specify custom file:
374 .sp
375 .in +2
376 .nf
377 # \fBsvccfg -s ipfilter:default setprop \e
378 firewall_config_default/custom_policy_file = astring: \e\fR
379 \fB"/etc/ipf/ipf.conf"\fR
380 .fi
381 .in -2
382 .sp
384 .RE
385 .RS +4
386 .TP
387 3.
388 Refresh configuration:
389 .sp
390 .in +2
391 .nf
392 # \fBsvcadm refresh ipfilter:default\fR
393 .fi
394 .in -2
395 .sp
397 .RE
398 .RE
400 .sp
401 .ne 2
402 .na
403 \fB\fBfirewall_config_default/open_ports\fR\fR
404 .ad
405 .sp .6
406 .RS 4n
407 Non-service program requiring allowance of its incoming traffic can request
408 that the firewall allow traffic to its communication ports. This multi-value
409 property contains protocol and port(s) tuple in the form:
410 .sp
411 .in +2
412 .nf
413 "{tcp | udp}:{\fIPORT\fR | \fIPORT\fR-\fIPORT\fR}"
414 .fi
415 .in -2
416 .sp
418 .RE
420 .sp
421 .LP
422 Initially, the system-wide policies are set to \fBnone\fR and network services'
423 policies are set to \fBuse_global\fR. Enabling \fBnetwork/ipfilter\fR activates
424 the firewall with an empty set of IP Filter rules, since system-wide policy is
425 \fBnone\fR and all services inherit that policy. To configure a more
426 restrictive policy, use \fBsvccfg\fR(1M) to modify network services and
427 system-wide policies.
428 .sp
429 .LP
430 A user configures firewall policy by modifying the service's
431 \fBfirewall_config\fR property group. A new authorization,
432 \fBsolaris.smf.value.firewall.config\fR, is created to allow delegation of the
433 firewall administration privilege to users. Users with Service Operator
434 privileges will need this new authorization to be able to configure firewall
435 policy.
436 .SS "Firewall Availability"
437 .LP
438 During boot, a firewall is configured for enabled services prior to the
439 starting of those services. Thus, services are protected on boot. While the
440 system is running, administrative actions such as service restarting, enabling,
441 and refreshing may cause a brief service vulnerability during which the service
442 runs while its firewall is being configured.
443 .sp
444 .LP
445 \fBsvc.ipfd\fR monitors a service's start and stop events and configures or
446 unconfigures a service's firewall at the same time that SMF is starting or
447 stopping the service. Because the two operations are simultaneous, there is a
448 possible window of exposure (less than a second) if the service is started
449 before its firewall configuration completed. RPC services typically listen on
450 ephemeral addresses, which are not known until the services are actually
451 running. Thus RPC services are subjected to similar exposure since their
452 firewalls are not configured until the services are running.
453 .SS "Developer Documentation"
454 .LP
455 Services providing remote capabilities are encouraged to participate in the
456 firewall framework to control network access to the service. While framework
457 integration is not mandatory, remote access to services that are not integrated
458 in the framework may not function correctly when a system-wide policy is
459 configured.
460 .sp
461 .LP
462 Integrating a service into the framework is as straightforward as defining two
463 additional property groups and their corresponding properties in the service
464 manifest. IP Filter rules are generated when a user enables the service. In the
465 non-trivial case of custom rule generation, where a shell script is required,
466 there are existing scripts that can be used as examples.
467 .sp
468 .LP
469 The additional property groups, \fBfirewall_config\fR and
470 \fBfirewall_context\fR, stores firewall policy configuration and provides
471 static firewall definition, respectively. Below is a summary of new property
472 groups and properties and their appropriate default values.
473 .sp
474 .LP
475 Firewall policy configuration:
476 .sp
477 .ne 2
478 .na
479 \fB\fBfirewall_config\fR\fR
480 .ad
481 .sp .6
482 .RS 4n
483 Access to the system is protected by a new authorization definition and a
484 user-defined property type. The new authorization should be assigned to the
485 property group \fBvalue_authorization\fR property in a way such as:
486 .sp
487 .in +2
488 .nf
489 <propval name='value_authorization' type='astring'
490 value='solaris.smf.value.firewall.config' />
491 .fi
492 .in -2
493 .sp
495 A third party should follow the service symbol namespace convention to generate
496 a user-defined type. Sun-delivered services can use
497 \fBcom.sun,fw_configuration\fR as the property type.
498 .sp
499 See "Firewall Policy Configuration," above, for more information.
500 .RE
502 .sp
503 .ne 2
504 .na
505 \fB\fBfirewall_config/policy\fR\fR
506 .ad
507 .sp .6
508 .RS 4n
509 This property's initial value should be \fBuse_global\fR since services, by
510 default, inherit the Global Default firewall policy.
511 .RE
513 .sp
514 .ne 2
515 .na
516 \fB\fBfirewall_config/apply_to\fR\fR
517 .ad
518 .sp .6
519 .RS 4n
520 An empty property, this property has no initial value.
521 .RE
523 .sp
524 .ne 2
525 .na
526 \fB\fBfirewall_config/exceptions\fR\fR
527 .ad
528 .sp .6
529 .RS 4n
530 An empty property, this property has no initial value.
531 .RE
533 .sp
534 .LP
535 Firewall static definition:
536 .sp
537 .ne 2
538 .na
539 \fB\fBfirewall_context\fR\fR
540 .ad
541 .sp .6
542 .RS 4n
543 A third party should follow service symbol namespace convention to generate a
544 user-defined type, Sun delivered services can use \fBcom.sun,fw_definition\fR
545 as the property type.
546 .sp
547 See "Firewall Static Configuration," above, for more information.
548 .RE
550 .sp
551 .ne 2
552 .na
553 \fB\fBfirewall_context/name\fR\fR
554 .ad
555 .sp .6
556 .RS 4n
557 Service with well-known, IANA defined port, which can be obtained by
558 \fBgetservbyname\fR(3SOCKET). The service's IANA name is stored in this
559 property. For RPC services, the RPC program number is stored in this property.
560 .RE
562 .sp
563 .ne 2
564 .na
565 \fB\fBfirewall_context/isrpc\fR\fR
566 .ad
567 .sp .6
568 .RS 4n
569 For RPC services, this property should be created with its value set to
570 \fBtrue\fR.
571 .RE
573 .sp
574 .ne 2
575 .na
576 \fB\fBfirewall_context/ipf_method\fR\fR
577 .ad
578 .sp .6
579 .RS 4n
580 In general, the specified firewall policy is used to generate IP Filter rules
581 to the service's communication port, derived from the
582 \fBfirewall_context/name\fR property. Services that do not have IANA-defined
583 ports and are not RPC services will need to generate their own IP Filter rules.
584 Services that generate their own rules may choose not to have
585 \fBfirewall_context/name\fR and \fBfirewall_context/isrpc\fR properties. See
586 the following services:
587 .sp
588 .in +2
589 .nf
590 svc:/network/ftp:default
591 svc:/network/nfs/server:default
592 svc:/network/ntp:default
593 .fi
594 .in -2
595 .sp
597 \&...and others with the \fBipf_method\fR for guidance.
598 .RE
600 .SH ATTRIBUTES
601 .LP
602 See \fBattributes\fR(5) for descriptions of the following attributes:
603 .sp
605 .sp
606 .TS
607 box;
608 c | c
609 l | l .
610 ATTRIBUTE TYPE ATTRIBUTE VALUE
611 _
612 Interface Stability Committed
613 .TE
615 .SH SEE ALSO
616 .LP
617 \fBsvcprop\fR(1), \fBsvcs\fR(1), \fBipf\fR(1M), \fBsvcadm\fR(1M),
618 \fBsvccfg\fR(1M), \fBgetservbyname\fR(3SOCKET), \fBrpc\fR(4),
619 \fBattributes\fR(5), \fBipfilter\fR(5), \fBsmf\fR(5)