NAME¶
tcprules - compile rules for tcpserver
SYNOPSIS¶
tcprules rules.cdb rules.tmp
OVERVIEW¶
tcpserver optionally follows rules to decide whether a TCP connection is
acceptable. For example, a rule of
18.23.0.32:deny
prohibits connections from IP address 18.23.0.32.
tcprules reads rules from its standard input and writes them into
rules.cdb in a binary format suited for quick access by
tcpserver.
tcprules can be used while
tcpserver is running: it ensures that
rules.cdb is updated atomically. It does this by first writing the
rules to
rules.tmp and then moving
rules.tmp on top of
rules.cdb. If
rules.tmp already exists, it is destroyed. The
directories containing
rules.cdb and
rules.tmp must be writable
to
tcprules; they must also be on the same filesystem.
If there is a problem with the input,
tcprules complains and leaves
rules.cdb alone.
The binary
rules.cdb format is portable across machines.
A rule takes up one line. A file containing rules may also contain comments:
lines beginning with # are ignored.
Each rule contains an
address, a colon, and a list of
instructions, with no extra spaces. When
tcpserver receives a
connection from that address, it follows the instructions.
ADDRESSES¶
tcpserver starts by looking for a rule with address
TCPREMOTEINFO@ TCPREMOTEIP. If it doesn't find
one, or if TCPREMOTEINFO is not set, it tries the address
TCPREMOTEIP. If that doesn't work, it tries shorter and shorter
prefixes of
TCPREMOTEIP ending with a dot. If none of them work, it
tries the empty string.
For example, here are some rules:
joe@127.0.0.1:first
18.23.0.32:second
127.:third
:fourth
::1:fifth
If
TCPREMOTEIP is
10.119.75.38,
tcpserver will follow the
fourth instructions.
If
TCPREMOTEIP is
::1,
tcpserver will follow the
fifth instructions. Note that you cannot detect IPv4 mapped addresses
by matching "::ffff", as those addresses will be converted to IPv4
before looking at the rules.
If
TCPREMOTEIP is
18.23.0.32,
tcpserver will follow the
second instructions.
If
TCPREMOTEINFO is
bill and
TCPREMOTEIP is
127.0.0.1,
tcpserver will follow the
third instructions.
If
TCPREMOTEINFO is
joe and
TCPREMOTEIP is
127.0.0.1,
tcpserver will follow the
first instructions.
ADDRESS RANGES¶
tcprules treats
1.2.3.37-53:ins as an abbreviation for the rules
1.2.3.37:ins,
1.2.3.38:ins, and so on up through
1.2.3.53:ins. Similarly,
10.2-3.:ins is an abbreviation for
10.2.:ins and
10.3.:ins.
INSTRUCTIONS¶
The instructions in a rule must begin with either
allow or
deny.
deny tells
tcpserver to drop the connection without running
anything. For example, the rule
:deny
tells
tcpserver to drop all connections that aren't handled by more
specific rules.
The instructions may continue with some environment variables, in the format
,VAR="VALUE".
tcpserver adds
VAR=VALUE to the
current environment. For example,
10.0.:allow,RELAYCLIENT="@fix.me"
adds
RELAYCLIENT=@fix.me to the environment. The quotes here may be
replaced by any repeated character:
10.0.:allow,RELAYCLIENT=/@fix.me/
Any number of variables may be listed:
127.0.0.1:allow,RELAYCLIENT="",TCPLOCALHOST="movie.edu"
SEE ALSO¶
tcprulescheck(1),
tcpserver(1),
tcp-environ(5)
