=======================
OpenFTPD ident@ip RULES
=======================

By default in OpenFTPD a GroupOp may do as follows:
SITE GADDUSER UserX password leech *@*.*.*.*

This behaviour is often not wanted, therefor a registry key called addiprules exists.
This key affects anybody who can add users but SiteOps and SuperUsers, if any of these
two userclasses need to test a new set of addiprules a key called addipdebug may be
created, this allows some playing around without affecting eg GroupOps.

=========================================
How OpenFTPD stores ident@ip's internally
=========================================
To be able to understund how the rules work you need to understund how OpenFTPD
stores ident@ip ranges internally, it works like this:

ident@<LO><HO>.<LO><HO>.<LO><HO>.<LO><HO>.<LO><HO>

LO = Low octet
HO = High octet

Eg, its possible to do "site addip UserX userx@192.168.15-17.*".

Internally this would be stored like: userx@<192><192>.<168><168>.<15><17>.<0><255>

Meaning user can connect if he/she comes from following ident@ip's:
userx@192.168.15.*
userx@192.168.16.*
userx@192.168.17.*

=========================================
How the rules work
=========================================
The rules is a set of space separated strings, they always follow the format
"ident@a.b.c.d" or they will be treated as invalid and always fail to match.
First match wins, if no match, ident@ip is not valid and ADDUSER/ADDIP operation
will fail.

The ident part can be anything or "*", it doesnt matter what the value is
if it is not a "*", it simply means a ident is required or not (if a "*").

The ip number part is the allowed difference between LO and HO. A "*" is the
same thing as 255.

With that said, these two rules are the same thing:
addiprules = ident@0.0.0.* ident@0.0.0.255

=========================================
A few examples
=========================================
Class B allowed with ident, Class C allowed without:
addiprules = ident@0.0.*.* *@0.0.0.*

If you want to be a little more restrictive eg allowing
255.255.240.0 (/20) netmasks with ident you do like this:

addiprules = ident@0.0.15.*

This means a GroupOp can do like this:
SITE ADDIP UserX userx@192.168.0-15.*
SITE ADDIP UserX userx@192.168.100-115.*
ofcourse its also possible for him/her to do also:
SITE ADDIP UserX userx@192.168.2-4.*
SITE ADDIP UserX userx@192.168.2.*

but not:
SITE ADDIP UserX userx@192.168.*.*
SITE ADDIP UserX userx@192.168.0-30.*

=========================================
<eof>
=========================================
