noip: set ACLs from environment variables.

[preload-hacks] / noip.1

diff --git a/noip.1 b/noip.1
index fe56efdecb3d47d7d7ca6876897b602cfb2b0ad1..36b4cf0eae14f4e18ac61cbc6cdc7accc8db8220 100644 (file)
--- a/noip.1
+++ b/noip.1
@@ -81,7 +81,11 @@ in the calling user's home directory, as determined by the
 .B HOME
 environment, or, failing that, looking up the 
 .I real
 .B HOME
 environment, or, failing that, looking up the 
 .I real

-(not effective) user id in the password database.
+(not effective) user id in the password database.  However, if the
+environment variable
+.B NOIP_CONFIG
+is set, then the file it names is read instead (assuming it exists; if
+it doesn't, no configuration is read).

 .PP
 The configuration file has a simple line-based format.  A line is
 ignored if it consists only of whitespace, or if its first whitespace
 .PP
 The configuration file has a simple line-based format.  A line is
 ignored if it consists only of whitespace, or if its first whitespace


@@ -106,7 +110,9 @@ can be used to control this.
 .BI "socketdir " directory
 Store the Unix-domain sockets in
 .IR directory 
 .BI "socketdir " directory
 Store the Unix-domain sockets in
 .IR directory 

-rather than the default.
+rather than the default.  The environment variable
+.B NOIP_SOCKETDIR
+can also be used to control which directory is used for sockets.

 .TP
 .BI "realbind " acl-entry
 Add an entry to the
 .TP
 .BI "realbind " acl-entry
 Add an entry to the


@@ -117,9 +123,23 @@ a socket to an address, the
 .B realbind
 ACL is consulted.  If the address is matched, then the program is
 allowed to bind a real Internet socket to that address; otherwise, the
 .B realbind
 ACL is consulted.  If the address is matched, then the program is
 allowed to bind a real Internet socket to that address; otherwise, the

-socket is bound to a Unix-domain socket.
+socket is bound to a Unix-domain socket.  Three environment variables
+are consulted too:
+.BR NOIP_REALBIND_BEFORE ,
+.BR NOIP_REALBIND ,
+and
+.BR NOIP_REALBIND_AFTER .
+The
+.B _BEFORE
+rules are inserted at the front of the list; the
+.B _AFTER
+rules are appended on the end.  Currently, the rules in
+.B NOIP_REALBIND
+are also put at the end (before the
+.B _AFTER
+rules), though this may change later.

 .TP
 .TP

-.BI "realbind " acl-entry
+.BI "realconnect " acl-entry

 Add an entry to the
 .B realconnect
 access control list (ACL).  When a program attempts to
 Add an entry to the
 .B realconnect
 access control list (ACL).  When a program attempts to


@@ -132,7 +152,21 @@ the
 .B realconnect
 ACL is consulted.  If the destination address is matched, then the
 program is allowed to contact the real Internet socket; otherwise, the
 .B realconnect
 ACL is consulted.  If the destination address is matched, then the
 program is allowed to contact the real Internet socket; otherwise, the

-attempt is made to contact a Unix-domain socket.
+attempt is made to contact a Unix-domain socket.  Three environment variables
+are consulted too:
+.BR NOIP_REALCONNET_BEFORE ,
+.BR NOIP_REALCONNECT ,
+and
+.BR NOIP_REALCONNECT_AFTER .
+The
+.B _BEFORE
+rules are inserted at the front of the list; the
+.B _AFTER
+rules are appended on the end.  Currently, the rules in
+.B NOIP_REALCONNECT
+are also put at the end (before the
+.B _AFTER
+rules), though this may change later.

 .PP
 (Aside: An attempt to connect to a remote host may not be a hopeless failure,
 even if a real IP socket is denied:
 .PP
 (Aside: An attempt to connect to a remote host may not be a hopeless failure,
 even if a real IP socket is denied:


@@ -144,7 +178,7 @@ servers.)
 .PP
 An
 .I acl-entry
 .PP
 An
 .I acl-entry

-has this format:
+is a comma-separated list of entries of the form:

 .IP
 .BR + | \-
 .IR address \c
 .IP
 .BR + | \-
 .IR address \c