WRAPPER(8)

NAME
wrapper - Protocol-independent access control wrapper

SYNOPSIS
wrapper [ -d ] <service>

DESCRIPTION
wrapper is a simple access control filter, similar in concept to tcp_wrapper's tcpd. Given a connected socket on standard input, it uses services and network prefixes from a configuration file to determine which server program (if any) to pass the connection to. This can be used as a simple method of access control based on client addresses, but must not be confused with strong security. The main useful feature of wrapper is that it was written to be protocol-family independent. That is, it should work with PF_INET (IPv4), PF_INET6 (IPv6), PF_LOCAL (UNIX domain sockets), and any other sockets protocol family with appropriate support in the runtime library. wrapper does not do IDENT lookups and it is not nearly as flexible as other access control filters like tcpd.

OPTIONS

-d  Record verbose debugging information to syslog. This option may not be available on your particular build of wrapper.

CONFIGURATION FILE
wrapper uses a simple configuration file, /etc/wrapper.conf. This file contains a list of rules, tested in order. If the rule is matched, the action specified for the rule is taken (usually, to run a server). Each rule is a whitespace-separated list of: service prefix command For example:
ftp    5f00::0/8    /usr/inet6/etc/ftpd -ld
service is the name of the service that might match this rule. Currently, this is not derived from the service name of the connection. Instead, this is compared with the service specified on the command line. A service of "*" may be used to match any service. prefix is the network prefix that might match this rule. A network prefix is a host name, optionally followed by a forward slash and a prefix length. For example, a prefix of "5f00::0/8" may match connections whose far addresses have "5f" in the first eight bits of their address. The format of the address is used to select the address family to which the rule applies. An address of "5f00::0" is parsable as an IPv6 address, therefore a rule with that address could be matched by PF_INET6 connections. But it is not parsable as an IPv4 address, therefore a rule with that address could not be matched by PF_INET connections. If no prefix length is supplied, the far address of the connection must match the specified host name exactly. Note that the host name is defined as with getaddrinfo(3), so it may be a symbolic name or numeric address, depending on protocol family. A prefix of "*" may be used to match any prefix. program is the command to be executed if the rule is matched. This command is split into an argument vector and executed by execv(3). No substitutions or expansions are made to this command, so things like wildcards and environment variables will not operate like they would with a command executed by a shell.

EXAMPLE
A sample configuration file is included with the distribution of wrapper and installed in /etc/wrapper.conf.

SEE ALSO
addrform(1), inetd(8)

AUTHOR
Craig Metz <cmetz@inner.net>