ippool(5) - NetBSD Manual Pages

Command:
Section:
Arch:
Collection:
>>>
IPPOOL(5)                                                            IPPOOL(5)




NAME

       ippool, ippool.conf - IP Pool file format


DESCRIPTION

       The  format  for files accepted by ippool is described by the following
       grammar:

       line ::= table | groupmap .
       table ::= "table" role tabletype .
       groupmap ::= "group-map" inout role number ipfgroup
       tabletype ::= ipftree | ipfhash .

       role ::= "role" "=" "ipf" .
       inout ::= "in" | "out" .

       ipftree ::= "type" "=" "tree" number "{" addrlist "}" .
       ipfhash ::= "type" "=" "hash" number hashopts "{" hashlist "}" .

       ipfgroup ::= setgroup hashopts "{" grouplist "}" |
                    hashopts "{" setgrouplist "}" .
       setgroup ::= "group" "=" groupname .

       hashopts ::= size [ seed ] | seed .

       size ::= "size" number .
       seed ::= "seed" number .

       addrlist ::= [ "!" ] addrmask ";" [ addrlist ] .
       grouplist ::= groupentry ";" [ grouplist ] | addrmask ";" [ grouplist ] .

       setgrouplist ::= groupentry ";" [ setgrouplist ] .

       groupentry ::= addrmask "," setgroup .

       hashlist ::= hashentry ";" [ hashlist ] .
       hashentry ::= addrmask .

       addrmask ::= ipaddr | ipaddr "/" mask .

       mask ::= number | ipaddr .

       groupname ::= number | name .

       number ::= digit { digit } .

       ipaddr  = host-num "." host-num "." host-num "." host-num .
       host-num = digit [ digit [ digit ] ] .

       digit ::= "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" .
       name ::= letter { letter | digit } .

       The IP pool configuration file is used for  defining  a  single  object
       that contains a reference to multiple IP address/netmask pairs.  A pool
       may consist of a mixture of netmask sizes, from 0 to 32.

       At this point in time, only IPv4 addressing is supported.


OVERVIEW

       The IP pool configuration file  provides  for  defining  two  different
       mechanisms  for  improving  speed  in matching IP addresses with rules.
       The first, table , defines a lookup table to provide a single reference
       in  a  filter rule to multiple targets and the second, group-map , pro-
       vides a mechanism to target multiple groups from a single filter  line.

       The  group-map  command can only be used with filter rules that use the
       call command to invoke either fr_srcgrpmap or fr_dstgrpmap , to use the
       source or destination address, respectively, for determining which fil-
       ter group to jump to next for continuation of filter packet processing.


POOL TYPES

       Two  storage formats are provided: hash tables and tree structure.  The
       hash table is intended for use with objects  all  containing  the  same
       netmask  or  a  few different sized netmasks of non-overlapping address
       space and the tree is designed for being able to support exceptions  to
       a covering mask, in addition to normal searching as you would do with a
       table.  It is not possible to use  the  tree  data  storage  type  with
       group-map configuration entries.


POOL ROLES

       When a pool is defined in the configuration file, it must have an asso-
       ciated role.  At present the only supported role is ipf.  Future devel-
       opment  will  see  futher  expansion  of their use by other sections of
       IPFilter code.


EXAMPLES

       The following examples show how the pool  configuration  file  is  used
       with the ipf configuration file to enhance the ability for the ipf con-
       figuration file to be succinct in meaning.

       1      The first example shows how a filter rule makes reference  to  a
              specific pool for matching of the source address.
              pass in from pool/100 to any

       The  pool  configuration, which matches IP addresses 1.1.1.1 and any in
       2.2.0.0/16, except for those in 2.2.2.0/24.

       table role = ipf type = tree number = 100
               { 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24 };

       2      The following ipf.conf  extract  uses  the  fr_srcgrpmap/fr_dst-
              grpmap  lookups to use the group-map facility to lookup the next
              group to use for filter processing, providing  the  call  filter
              rule is matched.
              call now fr_srcgrpmap/1010 in all
              call now fr_dstgrpmap/2010 out all
              pass in all group 1020
              block in all group 1030
              pass out all group 2020
              block out all group 2040

       A  ippool configuration to work with the above ipf.conf file might look
       like this:

       group-map in role = ipf number = 1010
            { 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; };
       group-map out role = ipf number = 2010 group = 2020
            { 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; };


FILES

       /dev/iplookup
       /etc/ippool.conf
       /etc/hosts


SEE ALSO

       ippool(8), hosts(5), ipf(5), ipf(8), ipnat(8)



                                                                     IPPOOL(5)