tcprules cdb tmp
tcpserver optionally follows rules to decide whether a TCP connection is acceptable. For example, the rule
22.214.171.124:denyprohibits connections from IP address 126.96.36.199.
tcprules reads rules from its standard input and writes them into cdb in a binary format suited for quick access by tcpserver.
tcprules can be used while tcpserver is running. It ensures that cdb is updated atomically. It does this by first writing the rules to tmp and then moving tmp on top of cdb. If tmp already exists, it is destroyed. The directories containing cdb and tmp must be writable to tcprules; they must also be on the same filesystem.
If there is a problem with the input or with tmp, tcprules complains and leaves cdb alone.
The binary cdb format is portable across machines.
Each rule contains an address, a colon, and a list of instructions, with no extra spaces. When tcpserver receives a connection from that address, it follows the instructions.
For example, here are some rules:
email@example.com:first 188.8.131.52:second :third 127.:fourthIf $TCPREMOTEIP is 10.119.75.38, tcpserver will follow the third instructions.
If $TCPREMOTEIP is 184.108.40.206, tcpserver will follow the second instructions.
If $TCPREMOTEIP is 127.0.0.1 and $TCPREMOTEINFO is bill, tcpserver will follow the fourth instructions.
If $TCPREMOTEIP is 127.0.0.1 and $TCPREMOTEINFO is joe, tcpserver will follow the first instructions.
You can use tcprulescheck to see how tcpserver will interpret rules in cdb.
:denytells tcpserver to drop all connections that aren't handled by more specific rules.
The instructions may continue with some environment variables, in the form ,var="x". tcpserver adds an environment variable $var with value x. For example,
10.0.:allow,RELAYCLIENT="@fix.me"adds an environment variable $RELAYCLIENT with value @fix.me. The quotes may be replaced by any repeated character:
10.0.:allow,RELAYCLIENTfirstname.lastname@example.org/Any number of variables may be listed: