1 IPPOOL(4)               File Formats and Configurations              IPPOOL(4)
   2 
   3 
   4 
   5 NAME
   6        ippool, ippool.conf - IP Pool file format
   7 
   8 DESCRIPTION
   9        The format for files accepted by ippool is described by the following
  10        grammar:
  11 
  12        line ::= table | groupmap .
  13        table ::= "table" role tabletype .
  14        groupmap ::= "group-map" inout role number ipfgroup
  15        tabletype ::= ipftree | ipfhash .
  16 
  17        role ::= "role" "=" "ipf" .
  18        inout ::= "in" | "out" .
  19 
  20        ipftree ::= "type" "=" "tree" number "{" addrlist "}" .
  21        ipfhash ::= "type" "=" "hash" number hashopts "{" hashlist "}" .
  22 
  23        ipfgroup ::= setgroup hashopts "{" grouplist "}" |
  24                     hashopts "{" setgrouplist "}" .
  25        setgroup ::= "group" "=" groupname .
  26 
  27        hashopts ::= size [ seed ] | seed .
  28 
  29        size ::= "size" number .
  30        seed ::= "seed" number .
  31 
  32        addrlist ::= [ "!" ] addrmask ";" [ addrlist ] .
  33        grouplist ::= groupentry ";" [ grouplist ] | addrmask ";" [ grouplist ] .
  34 
  35        setgrouplist ::= groupentry ";" [ setgrouplist ] .
  36 
  37        groupentry ::= addrmask "," setgroup .
  38 
  39        hashlist ::= hashentry ";" [ hashlist ] .
  40        hashentry ::= addrmask .
  41 
  42        addrmask ::= ipaddr | ipaddr "/" mask .
  43 
  44        mask ::= number | ipaddr .
  45 
  46        groupname ::= number | name .
  47 
  48        number ::= digit { digit } .
  49 
  50        ipaddr  = host-num "." host-num "." host-num "." host-num .
  51        host-num = digit [ digit [ digit ] ] .
  52 
  53        digit ::= "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" .
  54        name ::= letter { letter | digit } .
  55 
  56        The IP pool configuration file is used for defining a single object
  57        that contains a reference to multiple IP address/netmask pairs.  A pool
  58        may consist of a mixture of netmask sizes, from 0 to 32.
  59 
  60        At this point in time, only IPv4 addressing is supported.
  61 
  62 OVERVIEW
  63        The IP pool configuration file provides for defining two different
  64        mechanisms for improving speed in matching IP addresses with rules.
  65        The first, table , defines a lookup table to provide a single reference
  66        in a filter rule to multiple targets and the second, group-map ,
  67        provides a mechanism to target multiple groups from a single filter
  68        line.
  69 
  70        The group-map command can only be used with filter rules that use the
  71        call command to invoke either fr_srcgrpmap or fr_dstgrpmap , to use the
  72        source or destination address, respectively, for determining which
  73        filter group to jump to next for continuation of filter packet
  74        processing.
  75 
  76 POOL TYPES
  77        Two storage formats are provided: hash tables and tree structure.  The
  78        hash table is intended for use with objects all containing the same
  79        netmask or a few different sized netmasks of non-overlapping address
  80        space and the tree is designed for being able to support exceptions to
  81        a covering mask, in addition to normal searching as you would do with a
  82        table.  It is not possible to use the tree data storage type with
  83        group-map configuration entries.
  84 
  85 POOL ROLES
  86        When a pool is defined in the configuration file, it must have an
  87        associated role.  At present the only supported role is ipf.  Future
  88        development will see further expansion of their use by other sections
  89        of IPFilter code.
  90 
  91 EXAMPLES
  92        The following examples show how the pool configuration file is used
  93        with the ipf configuration file to enhance the ability for the ipf
  94        configuration file to be succinct in meaning.
  95 
  96        1      The first example shows how a filter rule makes reference to a
  97               specific pool for matching of the source address.
  98               pass in from pool/100 to any
  99 
 100        The pool configuration, which matches IP addresses 1.1.1.1 and any in
 101        2.2.0.0/16, except for those in 2.2.2.0/24.
 102 
 103        table role = ipf type = tree number = 100
 104                { 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24 };
 105 
 106        2      The following ipf.conf extract uses the
 107               fr_srcgrpmap/fr_dstgrpmap lookups to use the group-map facility
 108               to lookup the next group to use for filter processing, providing
 109               the call filter rule is matched.
 110               call now fr_srcgrpmap/1010 in all
 111               call now fr_dstgrpmap/2010 out all
 112               pass in all group 1020
 113               block in all group 1030
 114               pass out all group 2020
 115               block out all group 2040
 116 
 117        A ippool configuration to work with the above ipf.conf file might look
 118        like this:
 119 
 120        group-map in role = ipf number = 1010
 121             { 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; };
 122        group-map out role = ipf number = 2010 group = 2020
 123             { 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; };
 124 
 125 FILES
 126        /dev/iplookup
 127        /etc/ippool.conf
 128        /etc/hosts
 129 
 130 SEE ALSO
 131        ippool(1M), hosts(4), ipf(4), ipf(1M), ipnat(1M), ipfilter(5)
 132 
 133 
 134 
 135                                  May 16, 2020                        IPPOOL(4)