.\" -*-nroff-*-
.\"
-.\" $Id: fw.1,v 1.13 2002/02/22 23:45:01 mdw Exp $
+.\" $Id: fw.1,v 1.16 2003/11/25 14:46:50 mdw Exp $
.\"
.\" Manual page for fw
.\"
.\" ---- Revision history ---------------------------------------------------
.\"
.\" $Log: fw.1,v $
+.\" Revision 1.16 2003/11/25 14:46:50 mdw
+.\" Update docco for new options.
+.\"
+.\" Revision 1.15 2003/01/24 20:13:04 mdw
+.\" Fix bogus examples. Explain quoting rules for `exec' endpoints.
+.\"
+.\" Revision 1.14 2002/02/23 00:05:12 mdw
+.\" Fix spacing around full stops (at last!).
+.\"
.\" Revision 1.13 2002/02/22 23:45:01 mdw
.\" Add option to change the listen(2) parameter.
.\"
.br
|
.I prefix
-.B .
+.B .\&
.I q-option
.br
|
.I file
::=
.B file
-.RB [ . ]
+.RB [ .\& ]
.I fspec
.RB [ ,
.IR fspec ]
.I exec
::=
.BR exec
-.RB [ . ]
+.RB [ .\& ]
.I cmd-spec
.br
.I cmd-spec
.RI ( argv0 )
is used.
.PP
+Note that the shell command or program name string must, if present,
+have any delimiter characters (including
+.RB ` / '
+and
+.RB ` . ')
+quoted; this is not required in the
+.RB ` [ '-enclosed
+argument list.
+.PP
The standard input and output of the program are forwarded to the other
end of the connection. The standard error stream is caught by
.B fw
.br
.I socket-source
::=
-.RB [ socket [ . ]]
+.RB [ socket [ .\& ]]
.RB [[ : ] \c
.IR addr-type \c
.RB [ : ]]
.br
.I socket-target
::=
-.RB [ socket [ . ]]
+.RB [ socket [ .\& ]]
.RB [[ : ] \c
.IR addr-type \c
.RB [ : ]]
.br
.I addr-elt
::=
-.B .
+.B .\&
|
.I word
.GE
.B inet
source address accepts the following options:
.OS "Socket options"
-.BR socket.inet. [ allow | deny ]
-.RB [ from ]
-.I address
+.B socket.inet.source.addr
+.RB [ = ]
+.RR any | \c
+.I addr
+.OD
+Specify the IP address on which to listen for incoming connections. The
+default is
+.BR any ,
+which means to listen on all addresses, though it may be useful to
+specify this explicitly, if the global setting is different.
+.OE
+.OS "Socket options"
+.BR socket.inet.source. [ allow | deny ]
+.RB [ host ]
+.I addr
.RB [ /
-.IR address ]
+.IR addr ]
.OD
Adds an entry to the source's access control list. If only one
.I address
mean the same), and the entry applies to any address which, when masked
by the netmask, is equal to the masked network address.
.OE
+.OS "Socket options"
+.BR socket.inet.source. [ allow | deny ]
+.B priv-port
+.OD
+Accept or reject connections from low-numbered `privileged' ports, in
+the range 0--1023.
+.OE
+.OS "Socket options"
+.B socket.inet.dest.addr
+.RB [ = ]
+.RR any | \c
+.I addr
+.OD
+Specify the IP address to bind the local socket to when making an
+outbound connection. The default is
+.BR any ,
+which means to use whichever address the kernel thinks is most
+convenient. This option is useful if the destination is doing
+host-based access control and your server is multi-homed.
+.OE
.PP
The access control rules are examined in the order: local entries first,
then global ones, each in the order given in the configuration file.
To emulate
.BR cat (1):
.VS
-from stdin, null to null, stdout
+from file stdin, null to file null, stdout
.VE
.
.\"--------------------------------------------------------------------------
.br
|
.I prefix
-.B .
+.B .\&
.I q-option
.br
|
.I file
::=
.B file
-.RB [ . ]
+.RB [ .\& ]
.I fspec
.RB [ ,
.IR fspec ]
.I exec
::=
.BR exec
-.RB [ . ]
+.RB [ .\& ]
.I cmd-spec
.br
.I cmd-spec
.br
.I socket-source
::=
-.RB [ socket [ . ]]
+.RB [ socket [ .\& ]]
.RB [[ : ] \c
.IR addr-type \c
.RB [ : ]]
.br
.I socket-target
::=
-.RB [ socket [ . ]]
+.RB [ socket [ .\& ]]
.RB [[ : ] \c
.IR addr-type \c
.RB [ : ]]
.br
.I addr-elt
::=
-.B .
+.B .\&
|
.I word
.PP
.RB [ = ]
.BR yes | no
.PP
-.BR socket.inet. [ allow | deny ]
-.RB [ from ]
-.I address
+.BR socket.inet.source. [ allow | deny ]
+.RB [ host ]
+.I addr
.RB [ /
-.IR address ]
+.IR addr ]
+.br
+.BR socket.inet.source. [ allow | deny ]
+.B priv-port
+.br
+.B socket.inet.source.addr
+.RB [ = ]
+.BR any | \c
+.I addr
+.br
+.B socket.inet.dest.addr
+.RB [ = ]
+.BR any | \c
+.I addr
.PP
.BR socket.unix.fattr. *
.