noip.1: Describe ACL entries in terms of <address-range> and <port-range>.

[preload-hacks] / noip.1

diff --git a/noip.1 b/noip.1
index d11ce7d..8687958 100644 (file)
--- a/noip.1
+++ b/noip.1
@@ -79,10 +79,8 @@ reads configuration from
 .B .noip
 in the calling user's home directory, as determined by the
 .B HOME
-environment, or, failing that, looking up the 
-.I real
-(not effective) user id in the password database.  However, if the
-environment variable
+environment, or, failing that, looking up the effective user id in the
+password database.  However, if the environment variable
 .B NOIP_CONFIG
 is set, then the file it names is read instead (assuming it exists; if
 it doesn't, no configuration is read).
@@ -191,28 +189,22 @@ An
 is a comma-separated list of entries of the form:
 .IP
 .BR + | \-
-.IR address \c
-.RB [ \- \c
-.IR address | \c
-.BR / \c
-.IR mask ]| \c
-.BR local | any
+.I address-range
 .RB [ : \c
-.IR port [ \c
-.BI \- \c
-.IR port ]]
+.IR port-range ]
 .PP
 (The spaces in the above are optional.)
 .PP
-The leading sign says whether
-matching addresses should be 
+The leading sign says whether matching addresses should be
 .I accepted
 .RB (` + ')
 or
 .I denied
 .RB (` \- ').
 .PP
-The IP-address portion may be any of the following
+The
+.I address-range
+portion may be any of the following.
 .TP
 .B any
 Matches all addresses.
@@ -221,20 +213,22 @@ Matches all addresses.
 Matches the address of one of the machine's network interfaces.
 .TP
 .I address
-Matches just the given address
+Matches just the given IPv4 or IPv6 address.  An
+.I address
+may be enclosed in square brackets; IPv6 addresses must be so enclosed,
+because colons are significant in the rest of the ACL syntax.
 .TP
 .IB address \- address
 Matches any address which falls in the given range.  Addresses are
 compared lexicographically, with octets to the left given precedence
 over octets to the right.
 .TP
-.IB address / mask
-Matches an address in the given network.  The
-.I mask
-may be a netmask in dotted-quad form, or a one-bit-count.
+.IB address / prefix-length
+Matches an address in the given network.
 .PP
-The port portion may be omitted (which means `match any port'), or may
-be a single
+The
+.I port-range
+may be omitted (which means `match any port'), or may be a single
 .I port
 or a range
 .IB port \- port
@@ -251,7 +245,7 @@ is empty, the default is to deny all addresses.
 For example, it may be useful to allow access at least to a DNS server.
 This can be accomplished by adding a line
 .VS
-realconnect +1.2.3.4:52
+realconnect +1.2.3.4:53
 .VE
 to the configuration file, where 1.2.3.4 is the IP address of one of
 your DNS server. 
@@ -282,9 +276,9 @@ port to himself or a small group.
 is implemented as an
 .B LD_PRELOAD
 hack.  It won't work on setuid programs.  Also, perhaps more
-importantly, it can't do anything a
+importantly, it can't do anything to prevent a
 .I malicious
-program use of networking: a program could theoretically issue sockets
+program's use of networking: a program could theoretically issue sockets
 system calls directly instead of using the C library calls that
 .B noip
 intercepts.  It is intended only as a tool for enhancing the security of
@@ -319,4 +313,4 @@ child processes will be unaffected.
 .PP
 This manual is surprisingly long and complicated for such a simple hack.
 .SH AUTHOR
-Mark Wooding, <mdw@nsict.org>
+Mark Wooding, <mdw@distorted.org.uk>