The xfwp configuration file resides on the xfwp host machine and is used to determine whether X client data connection requests will be permitted or denied. The path to the file is specified at start-up time. If no configuration file is specified, all X client data connection requests routed through xfwp will be by default permitted, assuming that other X server authorization checks are successful. If a configuration file is supplied but none of its entries matches the connection request then the connection is by default denied. If a line in the configuration file begins with the '#' character or a new-line character, the line is ignored and the evaluator will skip the line. The configuration file supports two entirely independent authorization checks: one which is performed by xfwp itself, and a second which is the result of xfwp's querying the target X server. For the first of these, the configuration file employs a syntax and semantic similar to that of IP packet-filtering routers. It contains zero or more source-destination rules of the following form:
{permit | deny} <src> <src mask> [<dest> <dest mask> [<operator> <service>]]
permit/deny
the keywords ``permit'' or ``deny'' indicate whether the rule will enable or disable access, respectively
src
the IP address against the host who originated the connection request will be matched, expressed in IP format (x.x.x.x)
src mask
a subnet mask, also in IP format, for further qualifying the source mask. Bits set in the mask indicate bits of the incoming address to be ignored when comparing to the specified src
dest
the IP address against which the destination of the incoming connection request (i.e. the host IP of the X server to which the incoming client is attempting to connect) will be matched
dest mask
a subnet mask, also in IP format, for further qualifying the destination mask. Bits set in the mask indicate bits of the destination address to be ignored when comparing to the specified dest
operator
always ``eq'' (if the service field is not NULL)
service
one of the following three strings: ``pm'', ``fp'', or ``cd'', corresponding to proxy manager, xfindproxy, or client data, respectively
For the second type of authorization check, the configuration file contains zero or more site policy rules of the following form:
{require | disallow} sitepolicy <site_policy>
require
specifies that the X server must be configured with at least one of the corresponding site policies, else it must refuse the connection.
disallow
specifies that the X server must not be configured with any of the corresponding site policies, else it must refuse the connection.
sitepolicy
a required keyword
<site_policy>
specifies the policy string. The string may contain any combination of alphanumeric characters subject only to interpretation by the target X server