From ef81ce6e80bc51741c24ffecd12cf094ef51c5c5 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 28 Mar 2019 17:14:39 +0100 Subject: [PATCH] man: clarify which addresses are affected by IPAddressAllow=/IPAddressDeny= For ingress traffic it's the source address of IP packets we check, for egress traffic it's the destination address. Mention that. --- man/systemd.resource-control.xml | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml index 5df345583e8..4a8c57f45ac 100644 --- a/man/systemd.resource-control.xml +++ b/man/systemd.resource-control.xml @@ -513,23 +513,27 @@ IPAddressDeny=ADDRESS[/PREFIXLENGTH]… - Turn on address range network traffic filtering for packets sent and received over AF_INET and AF_INET6 - sockets. Both directives take a space separated list of IPv4 or IPv6 addresses, each optionally suffixed - with an address prefix length (separated by a / character). If the latter is omitted, the - address is considered a host address, i.e. the prefix covers the whole address (32 for IPv4, 128 for IPv6). - - - The access lists configured with this option are applied to all sockets created by processes of this - unit (or in the case of socket units, associated with it). The lists are implicitly combined with any lists - configured for any of the parent slice units this unit might be a member of. By default all access lists are - empty. When configured the lists are enforced as follows: + Turn on address range network traffic filtering for IP packets sent and received over + AF_INET and AF_INET6 sockets. Both directives take a + space separated list of IPv4 or IPv6 addresses, each optionally suffixed with an address prefix + length in bits (separated by a / character). If the latter is omitted, the + address is considered a host address, i.e. the prefix covers the whole address (32 for IPv4, 128 + for IPv6). + + The access lists configured with this option are applied to all sockets created by processes + of this unit (or in the case of socket units, associated with it). The lists are implicitly + combined with any lists configured for any of the parent slice units this unit might be a member + of. By default all access lists are empty. Both ingress and egress traffic is filtered by these + settings. In case of ingress traffic the source IP address is checked against these access lists, + in case of egress traffic the destination IP address is checked. When configured the lists are + enforced as follows: - Access will be granted in case its destination/source address matches any entry in the - IPAddressAllow= setting. + Access will be granted in case an IP packet's destination/source address matches + any entry in the IPAddressAllow= setting. - Otherwise, access will be denied in case its destination/source address matches any entry - in the IPAddressDeny= setting. + Otherwise, access will be denied in case its destination/source address matches + any entry in the IPAddressDeny= setting. Otherwise, access will be granted. -- 2.39.2