X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~mdw/git/preload-hacks/blobdiff_plain/e4976bb0731d14a7d8bfa53067ec1d99e94617cb..17085e3f1ab86464e67d0d1a3c4b65b3617165a3:/noip.1 diff --git a/noip.1 b/noip.1 index fe56efd..8ab355f 100644 --- a/noip.1 +++ b/noip.1 @@ -79,9 +79,11 @@ reads configuration from .B .noip in the calling user's home directory, as determined by the .B HOME -environment, or, failing that, looking up the -.I real -(not effective) user id in the password database. +environment, or, failing that, looking up the effective user id in the +password database. However, if the environment variable +.B NOIP_CONFIG +is set, then the file it names is read instead (assuming it exists; if +it doesn't, no configuration is read). .PP The configuration file has a simple line-based format. A line is ignored if it consists only of whitespace, or if its first whitespace @@ -106,7 +108,19 @@ can be used to control this. .BI "socketdir " directory Store the Unix-domain sockets in .IR directory -rather than the default. +rather than the default. The environment variable +.B NOIP_SOCKETDIR +can also be used to control which directory is used for sockets. +.TP +.BI "autoports " min "\-" max +Select which ports are used for implicit binding. Allocating ports can +be a bit slow, since checking whether a Unix domain socket is in use is +difficult. A wide range makes things easier, because +.B noip +starts by trying ports at random from the given range. The environment +variable +.B NOIP_AUTOPORTS +can also be used to control which ports are assigned automatically. .TP .BI "realbind " acl-entry Add an entry to the @@ -117,9 +131,23 @@ a socket to an address, the .B realbind ACL is consulted. If the address is matched, then the program is allowed to bind a real Internet socket to that address; otherwise, the -socket is bound to a Unix-domain socket. +socket is bound to a Unix-domain socket. Three environment variables +are consulted too: +.BR NOIP_REALBIND_BEFORE , +.BR NOIP_REALBIND , +and +.BR NOIP_REALBIND_AFTER . +The +.B _BEFORE +rules are inserted at the front of the list; the +.B _AFTER +rules are appended on the end. Currently, the rules in +.B NOIP_REALBIND +are also put at the end (before the +.B _AFTER +rules), though this may change later. .TP -.BI "realbind " acl-entry +.BI "realconnect " acl-entry Add an entry to the .B realconnect access control list (ACL). When a program attempts to @@ -132,7 +160,21 @@ the .B realconnect ACL is consulted. If the destination address is matched, then the program is allowed to contact the real Internet socket; otherwise, the -attempt is made to contact a Unix-domain socket. +attempt is made to contact a Unix-domain socket. Three environment variables +are consulted too: +.BR NOIP_REALCONNET_BEFORE , +.BR NOIP_REALCONNECT , +and +.BR NOIP_REALCONNECT_AFTER . +The +.B _BEFORE +rules are inserted at the front of the list; the +.B _AFTER +rules are appended on the end. Currently, the rules in +.B NOIP_REALCONNECT +are also put at the end (before the +.B _AFTER +rules), though this may change later. .PP (Aside: An attempt to connect to a remote host may not be a hopeless failure, even if a real IP socket is denied: @@ -144,14 +186,14 @@ servers.) .PP An .I acl-entry -has this format: +is a comma-separated list of entries of the form: .IP .BR + | \- .IR address \c .RB [ \- \c .IR address | \c .BR / \c -.IR mask ]| \c +.IR prefix-length ]| \c .BR local | any .RB [ : \c .IR port [ \c @@ -160,8 +202,7 @@ has this format: .PP (The spaces in the above are optional.) .PP -The leading sign says whether -matching addresses should be +The leading sign says whether matching addresses should be .I accepted .RB (` + ') or @@ -177,17 +218,18 @@ Matches all addresses. Matches the address of one of the machine's network interfaces. .TP .I address -Matches just the given address +Matches just the given IPv4 or IPv6 address. An +.I address +may be enclosed in square brackets; IPv6 addresses must be so enclosed, +because colons are significant in the rest of the ACL syntax. .TP .IB address \- address Matches any address which falls in the given range. Addresses are compared lexicographically, with octets to the left given precedence over octets to the right. .TP -.IB address / mask -Matches an address in the given network. The -.I mask -may be a netmask in dotted-quad form, or a one-bit-count. +.IB address / prefix-length +Matches an address in the given network. .PP The port portion may be omitted (which means `match any port'), or may be a single @@ -207,7 +249,7 @@ is empty, the default is to deny all addresses. For example, it may be useful to allow access at least to a DNS server. This can be accomplished by adding a line .VS -realconnect +1.2.3.4:52 +realconnect +1.2.3.4:53 .VE to the configuration file, where 1.2.3.4 is the IP address of one of your DNS server. @@ -238,9 +280,9 @@ port to himself or a small group. is implemented as an .B LD_PRELOAD hack. It won't work on setuid programs. Also, perhaps more -importantly, it can't do anything a +importantly, it can't do anything to prevent a .I malicious -program use of networking: a program could theoretically issue sockets +program's use of networking: a program could theoretically issue sockets system calls directly instead of using the C library calls that .B noip intercepts. It is intended only as a tool for enhancing the security of @@ -275,4 +317,4 @@ child processes will be unaffected. .PP This manual is surprisingly long and complicated for such a simple hack. .SH AUTHOR -Mark Wooding, +Mark Wooding,