tcprules - Online in the Cloud

PROGRAM:

NAME

tcprules - compile rules for tcpserver

SYNOPSIS

tcprules rules.cdb rules.tmp

OVERVIEW

tcpserver optionally follows rules to decide whether a TCP connection is acceptable. For
example, a rule of

18.23.0.32:deny

prohibits connections from IP address 18.23.0.32.

tcprules reads rules from its standard input and writes them into rules.cdb in a binary
format suited for quick access by tcpserver.

tcprules can be used while tcpserver is running: it ensures that rules.cdb is updated
atomically. It does this by first writing the rules to rules.tmp and then moving
rules.tmp on top of rules.cdb. If rules.tmp already exists, it is destroyed. The
directories containing rules.cdb and rules.tmp must be writable to tcprules; they must
also be on the same filesystem.

If there is a problem with the input, tcprules complains and leaves rules.cdb alone.

The binary rules.cdb format is portable across machines.

RULE FORMAT

A rule takes up one line. A file containing rules may also contain comments: lines
beginning with # are ignored.

Each rule contains an address, a colon, and a list of instructions, with no extra spaces.
When tcpserver receives a connection from that address, it follows the instructions.

ADDRESSES

tcpserver starts by looking for a rule with address TCPREMOTEINFO@TCPREMOTEIP. If it
doesn't find one, or if TCPREMOTEINFO is not set, it tries the address TCPREMOTEIP. If
that doesn't work, it tries shorter and shorter prefixes of TCPREMOTEIP ending with a dot.
If none of them work, it tries the empty string.

For example, here are some rules:

[email protected]:first
18.23.0.32:second
127.:third
:fourth
::1:fifth

If TCPREMOTEIP is 10.119.75.38, tcpserver will follow the fourth instructions.

If TCPREMOTEIP is ::1, tcpserver will follow the fifth instructions. Note that you cannot
detect IPv4 mapped addresses by matching "::ffff", as those addresses will be converted to
IPv4 before looking at the rules.

If TCPREMOTEIP is 18.23.0.32, tcpserver will follow the second instructions.

If TCPREMOTEINFO is bill and TCPREMOTEIP is 127.0.0.1, tcpserver will follow the third
instructions.

If TCPREMOTEINFO is joe and TCPREMOTEIP is 127.0.0.1, tcpserver will follow the first
instructions.

ADDRESS RANGES

tcprules treats 1.2.3.37-53:ins as an abbreviation for the rules 1.2.3.37:ins,
1.2.3.38:ins, and so on up through 1.2.3.53:ins. Similarly, 10.2-3.:ins is an
abbreviation for 10.2.:ins and 10.3.:ins.

INSTRUCTIONS

The instructions in a rule must begin with either allow or deny. deny tells tcpserver to
drop the connection without running anything. For example, the rule

:deny

tells tcpserver to drop all connections that aren't handled by more specific rules.

The instructions may continue with some environment variables, in the format ,VAR="VALUE".
tcpserver adds VAR=VALUE to the current environment. For example,

10.0.:allow,RELAYCLIENT="@fix.me"

adds [email protected] to the environment. The quotes here may be replaced by any
repeated character:

10.0.:allow,RELAYCLIENT=/@fix.me/

Any number of variables may be listed:

127.0.0.1:allow,RELAYCLIENT="",TCPLOCALHOST="movie.edu"

Use tcprules online using onworks.net services