X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=secnet.git;a=blobdiff_plain;f=secnet.h;h=c85f90f3aab21e6166998f752e5bd81d87b13bc9;hp=92740597008cca2364e56300b18b59c28633e362;hb=3454dce4c6909648b711a59b57c5a527036b2a8e;hpb=5963521296680c2aeb40baeb72459dffc14cd996

diff --git a/secnet.h b/secnet.h
index 9274059..c85f90f 100644
--- a/secnet.h
+++ b/secnet.h
@@ -8,9 +8,10 @@
 #include <stdarg.h>
 #include <syslog.h>
 #include <sys/poll.h>
+#include <sys/types.h>
+#include <sys/time.h>
 #include <netinet/in.h>
 
-
 typedef char *string_t;
 typedef enum {False,True} bool_t;
 
@@ -23,6 +24,7 @@ typedef enum {False,True} bool_t;
 struct subnet {
     uint32_t prefix;
     uint32_t mask;
+    uint32_t len;
 };
 
 struct subnet_list {
@@ -32,12 +34,21 @@ struct subnet_list {
 
 /* Match an address (in HOST byte order) with a subnet list.
    Returns True if matched. */
-extern bool_t subnet_match(struct subnet_list *list, uint32_t address);
+extern bool_t subnet_match(struct subnet *s, uint32_t address);
+extern bool_t subnet_matches_list(struct subnet_list *list, uint32_t address);
+extern bool_t subnets_intersect(struct subnet a, struct subnet b);
+extern bool_t subnet_intersects_with_list(struct subnet a,
+					  struct subnet_list *b);
+extern bool_t subnet_lists_intersect(struct subnet_list *a,
+				     struct subnet_list *b);
 
 /***** END of shared types *****/
 
 /***** CONFIGURATION support *****/
 
+extern bool_t just_check_config; /* If True then we're going to exit after
+				    reading the configuration file */
+
 typedef struct dict dict_t;        /* Configuration dictionary */
 typedef struct closure closure_t;
 typedef struct item item_t;
@@ -114,6 +125,12 @@ extern void dict_read_subnet_list(dict_t *dict, string_t key, bool_t required,
 				  string_t desc, struct cloc loc,
 				  struct subnet_list *sl);
 extern uint32_t string_to_ipaddr(item_t *i, string_t desc);
+struct flagstr {
+    string_t name;
+    uint32_t value;
+};
+extern uint32_t string_list_to_word(list_t *l, struct flagstr *f,
+				    string_t desc);
 
 /***** END of configuration support *****/
 
@@ -178,15 +195,24 @@ extern void register_for_poll(void *st, beforepoll_fn *before,
 #define PHASE_GETOPTS       1  /* Process command-line arguments */
 #define PHASE_READCONFIG    2  /* Parse and process configuration file */
 #define PHASE_SETUP         3  /* Process information in configuration */
-#define PHASE_DROPPRIV      4  /* Last chance for privileged operations */
-#define PHASE_RUN           5
-#define PHASE_SHUTDOWN      6  /* About to die; delete key material, etc. */
-#define NR_PHASES           7
+#define PHASE_GETRESOURCES  4  /* Obtain all external resources */
+#define PHASE_DROPPRIV      5  /* Last chance for privileged operations */
+#define PHASE_RUN           6
+#define PHASE_SHUTDOWN      7  /* About to die; delete key material, etc. */
+#define NR_PHASES           8
 
 typedef void hook_fn(void *self, uint32_t newphase);
 bool_t add_hook(uint32_t phase, hook_fn *f, void *state);
 bool_t remove_hook(uint32_t phase, hook_fn *f, void *state);
 
+extern bool_t require_root_privileges; /* Some features (like netlink
+					  'soft' routes) require that
+					  secnet retain root
+					  privileges.  They should
+					  indicate that here when
+					  appropriate. */
+extern string_t require_root_privileges_explanation;
+
 /***** END of program lifetime support *****/
 
 /***** MODULE support *****/
@@ -343,24 +369,36 @@ struct transform_if {
 
 /* NETLINK interface */
 
-/* Used by netlink to deliver to site, and by site to deliver to netlink.
-   cid is the client identifier returned by netlink_regnets_fn */
+/* Used by netlink to deliver to site, and by site to deliver to
+   netlink.  cid is the client identifier returned by
+   netlink_regnets_fn.  If buf has size 0 then the function is just
+   being called for its site-effects (eg. making the site code attempt
+   to bring up a network link) */
 typedef void netlink_deliver_fn(void *st, void *cid, struct buffer_if *buf);
 /* site code can tell netlink when outgoing packets will be dropped,
-   so netlink can generate appropriate ICMP */
-typedef void netlink_can_deliver_fn(void *st, void *cid, bool_t can_deliver);
-/* Register for packets from specified networks. Return value is client
-   identifier. */
+   so netlink can generate appropriate ICMP and make routing decisions */
+#define LINK_QUALITY_DOWN 0   /* No chance of a packet being delivered */
+#define LINK_QUALITY_DOWN_STALE_ADDRESS 1 /* Link down, old address information */
+#define LINK_QUALITY_DOWN_CURRENT_ADDRESS 2 /* Link down, current address information */
+#define LINK_QUALITY_UP 3     /* Link active */
+#define MAXIMUM_LINK_QUALITY 3
+typedef void netlink_link_quality_fn(void *st, void *cid, uint32_t quality);
+/* Register for packets from specified networks. Return value is
+   client identifier.  'hard_route' indicates whether the routes being
+   registered are permanent (hard) or temporary (soft); some types of
+   netlink device can only cope with hard routes. */
+#define NETLINK_OPTION_SOFTROUTE    1
+#define NETLINK_OPTION_ALLOW_ROUTE  2
 typedef void *netlink_regnets_fn(void *st, struct subnet_list *networks,
 				 netlink_deliver_fn *deliver, void *dst,
 				 uint32_t max_start_pad, uint32_t max_end_pad,
-				 string_t client_name);
+				 uint32_t options, string_t client_name);
 
 struct netlink_if {
     void *st;
     netlink_regnets_fn *regnets;
     netlink_deliver_fn *deliver;
-    netlink_can_deliver_fn *set_delivery;
+    netlink_link_quality_fn *set_quality;
 };
 
 /* DH interface */