Add -A|-a to s6-tcpserver-access and s6-tlsserver; prepare for 2.8.1.0HEADmain

4 files changed, 22 insertions, 3 deletions

diff --git a/doc/index.html b/doc/index.html
index 219b397..ddfc7d5 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -92,8 +92,8 @@ run-time requirement if you link against its shared version. </li>
 
 <ul>
  <li> The current released version of s6-networking is
-<a href="s6-networking-2.8.0.1.tar.gz">2.8.0.1</a>.
-You can access its checksum <a href="s6-networking-2.8.0.1.tar.gz.sha256">here</a>. </li>
+<a href="s6-networking-2.8.1.0.tar.gz">2.8.1.0</a>.
+You can access its checksum <a href="s6-networking-2.8.1.0.tar.gz.sha256">here</a>. </li>
  <li> Alternatively, you can checkout a copy of the
 <a href="//git.skarnet.org/cgit/s6-networking/">s6-networking
 git repository</a>:
diff --git a/doc/s6-tcpserver-access.html b/doc/s6-tcpserver-access.html
index 6de1ca6..b0a4bbd 100644
--- a/doc/s6-tcpserver-access.html
+++ b/doc/s6-tcpserver-access.html
@@ -31,7 +31,7 @@ just like tcpwrappers' <tt>tcpd</tt> program.
 <h2> Interface </h2>
 
 <pre>
-     s6-tcpserver-access [ -v <em>verbosity</em> ] [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -l <em>localname</em> ] [ -B <em>banner</em> ] [ -t <em>timeout</em> ] [ -i <em>rulesdir</em> | -x <em>rulesfile</em> ] <em>prog...</em>
+     s6-tcpserver-access [ -v <em>verbosity</em> ] [ -W | -w ] [ -D | -d ] [ -H ] [ -h ] [ -R | -r ] [ -P | -p ] [ -A | -a ] [ -l <em>localname</em> ] [ -B <em>banner</em> ] [ -t <em>timeout</em> ] [ -i <em>rulesdir</em> | -x <em>rulesfile</em> ] <em>prog...</em>
 </pre>
 
 <ul>
@@ -126,6 +126,16 @@ the connection if none of the results matches the address the connection
 is originating from. For safest results, pair that option with <tt>-w</tt>
 so any DNS error drops the connection. (Note that this still does not replace real
 authentication via a cryptographic protocol.) </li>
+ <li> <tt>-A</tt>&nbsp;: do not accept by default. If the <tt>-i</tt> or
+<tt>-x</tt> option is given, and the IP address and host name of the client
+do not match any rule in the ruleset, deny the connection. This is the
+default. </li>
+ <li> <tt>-a</tt>&nbsp;: accept by default. If the <tt>-i</tt> or
+<tt>-x</tt> option is given, and the IP address and host name of the client
+do not match any rule in the ruleset, accept the connection. This is
+useful for instance when expecting clients that may have a broken reverse
+DNS and so cannot match against rules involving host names, and these
+clients need to be able to connect. </li>
  <li> <tt>-l&nbsp;<em>localname</em></tt>&nbsp;: use <em>localname</em>
 as the value for the ${PROTO}LOCALHOST environment variable, instead of
 looking it up in the DNS. </li>
diff --git a/doc/s6-tlsserver.html b/doc/s6-tlsserver.html
index 313e369..b0d91df 100644
--- a/doc/s6-tlsserver.html
+++ b/doc/s6-tlsserver.html
@@ -177,6 +177,7 @@ to <em>prog</em>. </li>
  <li> <tt>-d</tt>, <tt>-D</tt>&nbsp;: enable or disable Nagle's algorithm </li>
  <li> <tt>-r</tt>, <tt>-R</tt>&nbsp;: enable or disable IDENT lookups </li>
  <li> <tt>-p</tt>, <tt>-P</tt>&nbsp;: enable or disable paranoid DNS cross-checking </li>
+ <li> <tt>-A</tt>, <tt>-a</tt>&nbsp;: reject or accept clients that do not match any rule in the ruleset </li>
  <li> <tt>-H</tt>&nbsp;: disable DNS lookups </li>
  <li> <tt>-h</tt>&nbsp;: consult <tt>/etc/hosts</tt> before DNS </li>
  <li> <tt>-l <em>localname</em></tt>&nbsp;: get the local name from the command line, don't look it up </li>
diff --git a/doc/upgrade.html b/doc/upgrade.html
index f36280b..dd18487 100644
--- a/doc/upgrade.html
+++ b/doc/upgrade.html
@@ -19,6 +19,14 @@
 
 <h1> What has changed in s6-networking </h1>
 
+<h2> in 2.8.1.0 </h2>
+
+<ul>
+ <li> New <tt>-A</tt>, <tt>-a</tt> options to
+<a href="s6-tcpserver-access.html">s6-tcpserver-access</a> and
+<a href="s6-tlsserver.html">s6-tlsserver</a>. </li>
+</ul>
+
 <h2> in 2.8.0.1 </h2>
 
 <ul>