noip: set ACLs from environment variables.

[preload-hacks] / noip.1

diff --git a/noip.1 b/noip.1
index fe56efd..36b4cf0 100644 (file)
--- a/noip.1
+++ b/noip.1
@@ -81,7 +81,11 @@ in the calling user's home directory, as determined by the
 .B HOME
 environment, or, failing that, looking up the 
 .I real
-(not effective) user id in the password database.
+(not effective) user id in the password database.  However, if the
+environment variable
+.B NOIP_CONFIG
+is set, then the file it names is read instead (assuming it exists; if
+it doesn't, no configuration is read).
 .PP
 The configuration file has a simple line-based format.  A line is
 ignored if it consists only of whitespace, or if its first whitespace
@@ -106,7 +110,9 @@ can be used to control this.
 .BI "socketdir " directory
 Store the Unix-domain sockets in
 .IR directory 
-rather than the default.
+rather than the default.  The environment variable
+.B NOIP_SOCKETDIR
+can also be used to control which directory is used for sockets.
 .TP
 .BI "realbind " acl-entry
 Add an entry to the
@@ -117,9 +123,23 @@ a socket to an address, the
 .B realbind
 ACL is consulted.  If the address is matched, then the program is
 allowed to bind a real Internet socket to that address; otherwise, the
-socket is bound to a Unix-domain socket.
+socket is bound to a Unix-domain socket.  Three environment variables
+are consulted too:
+.BR NOIP_REALBIND_BEFORE ,
+.BR NOIP_REALBIND ,
+and
+.BR NOIP_REALBIND_AFTER .
+The
+.B _BEFORE
+rules are inserted at the front of the list; the
+.B _AFTER
+rules are appended on the end.  Currently, the rules in
+.B NOIP_REALBIND
+are also put at the end (before the
+.B _AFTER
+rules), though this may change later.
 .TP
-.BI "realbind " acl-entry
+.BI "realconnect " acl-entry
 Add an entry to the
 .B realconnect
 access control list (ACL).  When a program attempts to
@@ -132,7 +152,21 @@ the
 .B realconnect
 ACL is consulted.  If the destination address is matched, then the
 program is allowed to contact the real Internet socket; otherwise, the
-attempt is made to contact a Unix-domain socket.
+attempt is made to contact a Unix-domain socket.  Three environment variables
+are consulted too:
+.BR NOIP_REALCONNET_BEFORE ,
+.BR NOIP_REALCONNECT ,
+and
+.BR NOIP_REALCONNECT_AFTER .
+The
+.B _BEFORE
+rules are inserted at the front of the list; the
+.B _AFTER
+rules are appended on the end.  Currently, the rules in
+.B NOIP_REALCONNECT
+are also put at the end (before the
+.B _AFTER
+rules), though this may change later.
 .PP
 (Aside: An attempt to connect to a remote host may not be a hopeless failure,
 even if a real IP socket is denied:
@@ -144,7 +178,7 @@ servers.)
 .PP
 An
 .I acl-entry
-has this format:
+is a comma-separated list of entries of the form:
 .IP
 .BR + | \-
 .IR address \c