noip.c: Add debugging to most of the syscall wrappers.

[preload-hacks] / noip.1

diff --git a/noip.1 b/noip.1
index fe56efdecb3d47d7d7ca6876897b602cfb2b0ad1..8ab355f6f8666065035c633e3600973cfc7f27a9 100644 (file)
--- a/noip.1
+++ b/noip.1
@@ -79,9 +79,11 @@ reads configuration from
 .B .noip
 in the calling user's home directory, as determined by the
 .B HOME
 .B .noip
 in the calling user's home directory, as determined by the
 .B HOME

-environment, or, failing that, looking up the 
-.I real
-(not effective) user id in the password database.
+environment, or, failing that, looking up the effective user id in the
+password database.  However, if the environment variable
+.B NOIP_CONFIG
+is set, then the file it names is read instead (assuming it exists; if
+it doesn't, no configuration is read).

 .PP
 The configuration file has a simple line-based format.  A line is
 ignored if it consists only of whitespace, or if its first whitespace
 .PP
 The configuration file has a simple line-based format.  A line is
 ignored if it consists only of whitespace, or if its first whitespace


@@ -106,7 +108,19 @@ can be used to control this.
 .BI "socketdir " directory
 Store the Unix-domain sockets in
 .IR directory 
 .BI "socketdir " directory
 Store the Unix-domain sockets in
 .IR directory 

-rather than the default.
+rather than the default.  The environment variable
+.B NOIP_SOCKETDIR
+can also be used to control which directory is used for sockets.
+.TP
+.BI "autoports " min "\-" max
+Select which ports are used for implicit binding.  Allocating ports can
+be a bit slow, since checking whether a Unix domain socket is in use is
+difficult.  A wide range makes things easier, because
+.B noip
+starts by trying ports at random from the given range.  The environment
+variable
+.B NOIP_AUTOPORTS
+can also be used to control which ports are assigned automatically.

 .TP
 .BI "realbind " acl-entry
 Add an entry to the
 .TP
 .BI "realbind " acl-entry
 Add an entry to the


@@ -117,9 +131,23 @@ a socket to an address, the
 .B realbind
 ACL is consulted.  If the address is matched, then the program is
 allowed to bind a real Internet socket to that address; otherwise, the
 .B realbind
 ACL is consulted.  If the address is matched, then the program is
 allowed to bind a real Internet socket to that address; otherwise, the

-socket is bound to a Unix-domain socket.
+socket is bound to a Unix-domain socket.  Three environment variables
+are consulted too:
+.BR NOIP_REALBIND_BEFORE ,
+.BR NOIP_REALBIND ,
+and
+.BR NOIP_REALBIND_AFTER .
+The
+.B _BEFORE
+rules are inserted at the front of the list; the
+.B _AFTER
+rules are appended on the end.  Currently, the rules in
+.B NOIP_REALBIND
+are also put at the end (before the
+.B _AFTER
+rules), though this may change later.

 .TP
 .TP

-.BI "realbind " acl-entry
+.BI "realconnect " acl-entry

 Add an entry to the
 .B realconnect
 access control list (ACL).  When a program attempts to
 Add an entry to the
 .B realconnect
 access control list (ACL).  When a program attempts to


@@ -132,7 +160,21 @@ the
 .B realconnect
 ACL is consulted.  If the destination address is matched, then the
 program is allowed to contact the real Internet socket; otherwise, the
 .B realconnect
 ACL is consulted.  If the destination address is matched, then the
 program is allowed to contact the real Internet socket; otherwise, the

-attempt is made to contact a Unix-domain socket.
+attempt is made to contact a Unix-domain socket.  Three environment variables
+are consulted too:
+.BR NOIP_REALCONNET_BEFORE ,
+.BR NOIP_REALCONNECT ,
+and
+.BR NOIP_REALCONNECT_AFTER .
+The
+.B _BEFORE
+rules are inserted at the front of the list; the
+.B _AFTER
+rules are appended on the end.  Currently, the rules in
+.B NOIP_REALCONNECT
+are also put at the end (before the
+.B _AFTER
+rules), though this may change later.

 .PP
 (Aside: An attempt to connect to a remote host may not be a hopeless failure,
 even if a real IP socket is denied:
 .PP
 (Aside: An attempt to connect to a remote host may not be a hopeless failure,
 even if a real IP socket is denied:


@@ -144,14 +186,14 @@ servers.)
 .PP
 An
 .I acl-entry
 .PP
 An
 .I acl-entry

-has this format:
+is a comma-separated list of entries of the form:

 .IP
 .BR + | \-
 .IR address \c
 .RB [ \- \c
 .IR address | \c
 .BR / \c
 .IP
 .BR + | \-
 .IR address \c
 .RB [ \- \c
 .IR address | \c
 .BR / \c

-.IR mask ]| \c
+.IR prefix-length ]| \c

 .BR local | any
 .RB [ : \c
 .IR port [ \c
 .BR local | any
 .RB [ : \c
 .IR port [ \c


@@ -160,8 +202,7 @@ has this format:
 .PP
 (The spaces in the above are optional.)
 .PP
 .PP
 (The spaces in the above are optional.)
 .PP

-The leading sign says whether
-matching addresses should be 
+The leading sign says whether matching addresses should be

 .I accepted
 .RB (` + ')
 or
 .I accepted
 .RB (` + ')
 or


@@ -177,17 +218,18 @@ Matches all addresses.
 Matches the address of one of the machine's network interfaces.
 .TP
 .I address
 Matches the address of one of the machine's network interfaces.
 .TP
 .I address

-Matches just the given address
+Matches just the given IPv4 or IPv6 address.  An
+.I address
+may be enclosed in square brackets; IPv6 addresses must be so enclosed,
+because colons are significant in the rest of the ACL syntax.

 .TP
 .IB address \- address
 Matches any address which falls in the given range.  Addresses are
 compared lexicographically, with octets to the left given precedence
 over octets to the right.
 .TP
 .TP
 .IB address \- address
 Matches any address which falls in the given range.  Addresses are
 compared lexicographically, with octets to the left given precedence
 over octets to the right.
 .TP

-.IB address / mask
-Matches an address in the given network.  The
-.I mask
-may be a netmask in dotted-quad form, or a one-bit-count.
+.IB address / prefix-length
+Matches an address in the given network.

 .PP
 The port portion may be omitted (which means `match any port'), or may
 be a single
 .PP
 The port portion may be omitted (which means `match any port'), or may
 be a single


@@ -207,7 +249,7 @@ is empty, the default is to deny all addresses.
 For example, it may be useful to allow access at least to a DNS server.
 This can be accomplished by adding a line
 .VS
 For example, it may be useful to allow access at least to a DNS server.
 This can be accomplished by adding a line
 .VS

-realconnect +1.2.3.4:52
+realconnect +1.2.3.4:53

 .VE
 to the configuration file, where 1.2.3.4 is the IP address of one of
 your DNS server. 
 .VE
 to the configuration file, where 1.2.3.4 is the IP address of one of
 your DNS server. 


@@ -238,9 +280,9 @@ port to himself or a small group.
 is implemented as an
 .B LD_PRELOAD
 hack.  It won't work on setuid programs.  Also, perhaps more
 is implemented as an
 .B LD_PRELOAD
 hack.  It won't work on setuid programs.  Also, perhaps more

-importantly, it can't do anything a
+importantly, it can't do anything to prevent a

 .I malicious
 .I malicious

-program use of networking: a program could theoretically issue sockets
+program's use of networking: a program could theoretically issue sockets

 system calls directly instead of using the C library calls that
 .B noip
 intercepts.  It is intended only as a tool for enhancing the security of
 system calls directly instead of using the C library calls that
 .B noip
 intercepts.  It is intended only as a tool for enhancing the security of


@@ -275,4 +317,4 @@ child processes will be unaffected.
 .PP
 This manual is surprisingly long and complicated for such a simple hack.
 .SH AUTHOR
 .PP
 This manual is surprisingly long and complicated for such a simple hack.
 .SH AUTHOR

-Mark Wooding, <mdw@nsict.org>
+Mark Wooding, <mdw@distorted.org.uk>