[secnet] / secnet.h

/* Core interface of secnet, to be used by all modules */

#ifndef secnet_h
#define secnet_h

#include "config.h"
#include <stdlib.h>
#include <stdarg.h>
#include <stdio.h>
#include <sys/poll.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>

typedef char *string_t;
typedef enum {False,True} bool_t;

#define ASSERT(x) do { if (!(x)) { fatal("assertion failed line %d file " \
					 __FILE__,__LINE__); } } while(0)

/***** CONFIGURATION support *****/

extern bool_t just_check_config; /* If True then we're going to exit after
				    reading the configuration file */
extern bool_t background; /* If True then we'll eventually run as a daemon */

typedef struct dict dict_t;        /* Configuration dictionary */
typedef struct closure closure_t;
typedef struct item item_t;
typedef struct list list_t;        /* A list of items */

/* Configuration file location, for error-reporting */
struct cloc {
    string_t file;
    uint32_t line;
};

/* Modules export closures, which can be invoked from the configuration file.
   "Invoking" a closure usually returns another closure (of a different
   type), but can actually return any configuration object. */
typedef list_t *(apply_fn)(closure_t *self, struct cloc loc,
			   dict_t *context, list_t *data);
struct closure {
    string_t description; /* For debugging */
    uint32_t type; /* Central registry... */
    apply_fn *apply;
    void *interface; /* Interface for use inside secnet; depends on type */
};

enum types { t_null, t_bool, t_string, t_number, t_dict, t_closure };
struct item {
    enum types type;
    union {
	bool_t bool;
	string_t string;
	uint32_t number;
	dict_t *dict;
	closure_t *closure;
    } data;
    struct cloc loc;
};

/* Note that it is unwise to use this structure directly; use the list
   manipulation functions instead. */
struct list {
    item_t *item;
    struct list *next;
};

/* In the following two lookup functions, NULL means 'not found' */
/* Lookup a value in the specified dictionary, or its parents */
extern list_t *dict_lookup(dict_t *dict, string_t key);
/* Lookup a value in just the specified dictionary */
extern list_t *dict_lookup_primitive(dict_t *dict, string_t key);
/* Add a value to the specified dictionary */
extern void dict_add(dict_t *dict, string_t key, list_t *val);
/* Obtain an array of keys in the dictionary. malloced; caller frees */
extern string_t *dict_keys(dict_t *dict);

/* List-manipulation functions */
extern list_t *list_new(void);
extern uint32_t list_length(list_t *a);
extern list_t *list_append(list_t *a, item_t *i);
extern list_t *list_append_list(list_t *a, list_t *b);
/* Returns an item from the list (index starts at 0), or NULL */
extern item_t *list_elem(list_t *l, uint32_t index);

/* Convenience functions */
extern list_t *new_closure(closure_t *cl);
extern void add_closure(dict_t *dict, string_t name, apply_fn apply);
extern void *find_cl_if(dict_t *dict, string_t name, uint32_t type,
			bool_t fail_if_invalid, string_t desc,
			struct cloc loc);
extern item_t *dict_find_item(dict_t *dict, string_t key, bool_t required,
			      string_t desc, struct cloc loc);
extern string_t dict_read_string(dict_t *dict, string_t key, bool_t required,
				 string_t desc, struct cloc loc);
extern uint32_t dict_read_number(dict_t *dict, string_t key, bool_t required,
				 string_t desc, struct cloc loc, uint32_t def);
extern bool_t dict_read_bool(dict_t *dict, string_t key, bool_t required,
			     string_t desc, struct cloc loc, bool_t def);
struct flagstr {
    string_t name;
    uint32_t value;
};
extern uint32_t string_to_word(string_t s, struct cloc loc,
			       struct flagstr *f, string_t desc);
extern uint32_t string_list_to_word(list_t *l, struct flagstr *f,
				    string_t desc);

/***** END of configuration support *****/

/***** UTILITY functions *****/

extern char *safe_strdup(char *string, char *message);
extern void *safe_malloc(size_t size, char *message);

extern int sys_cmd(const char *file, char *argc, ...);

/***** END of utility functions *****/

/***** SCHEDULING support */

/* "now" is current program time, in milliseconds. It is derived
   (once) from tv_now. If nfds_io is insufficient for your needs, set
   it to the required number and return ERANGE. timeout is in milliseconds;
   if it is too high then lower it. It starts at -1 (==infinite) */
typedef int beforepoll_fn(void *st, struct pollfd *fds, int *nfds_io,
			  int *timeout_io, const struct timeval *tv_now,
			  uint64_t *now);
typedef void afterpoll_fn(void *st, struct pollfd *fds, int nfds,
			  const struct timeval *tv_now, uint64_t *now);

/* Register interest in the main loop of the program. Before a call
   to poll() your supplied beforepoll function will be called. After
   the call to poll() the supplied afterpoll function will be called.
   max_nfds is a _hint_ about the maximum number of struct pollfd
   structures you may require - you can always ask for more in
   *nfds_io. */
extern void register_for_poll(void *st, beforepoll_fn *before,
			      afterpoll_fn *after, uint32_t max_nfds,
			      string_t desc);

/***** END of scheduling support */

/***** PROGRAM LIFETIME support */

/* The secnet program goes through a number of phases in its lifetime.
   Module code may arrange to be called just as various phases are
   entered. */

#define PHASE_INIT          0
#define PHASE_GETOPTS       1  /* Process command-line arguments */
#define PHASE_READCONFIG    2  /* Parse and process configuration file */
#define PHASE_SETUP         3  /* Process information in configuration */
#define PHASE_GETRESOURCES  4  /* Obtain all external resources */
#define PHASE_DROPPRIV      5  /* Last chance for privileged operations */
#define PHASE_RUN           6
#define PHASE_SHUTDOWN      7  /* About to die; delete key material, etc. */
#define NR_PHASES           8

typedef void hook_fn(void *self, uint32_t newphase);
bool_t add_hook(uint32_t phase, hook_fn *f, void *state);
bool_t remove_hook(uint32_t phase, hook_fn *f, void *state);

extern uint32_t current_phase;
extern void enter_phase(uint32_t new_phase);

/* Some features (like netlink 'soft' routes) require that secnet
   retain root privileges.  They should indicate that here when
   appropriate. */
extern bool_t require_root_privileges;
extern string_t require_root_privileges_explanation;

/***** END of program lifetime support *****/

/***** MODULE support *****/

/* Module initialisation function type - modules export one function of
   this type which is called to initialise them. For dynamically loaded
   modules it's called "secnet_module". */
typedef void init_module(dict_t *dict);

/***** END of module support *****/

/***** CLOSURE TYPES and interface definitions *****/

#define CL_PURE         0
#define CL_RESOLVER     1
#define CL_RANDOMSRC    2
#define CL_RSAPUBKEY    3
#define CL_RSAPRIVKEY   4
#define CL_COMM         5
#define CL_IPIF         6
#define CL_LOG          7
#define CL_SITE         8
#define CL_TRANSFORM    9
#define CL_DH          11
#define CL_HASH        12
#define CL_BUFFER      13
#define CL_NETLINK     14

struct buffer_if;

/* PURE closure requires no interface */

/* RESOLVER interface */

/* Answers to queries are delivered to a function of this
   type. 'address' will be NULL if there was a problem with the query. It
   will be freed once resolve_answer_fn returns. It is in network byte
   order. */
/* XXX extend to be able to provide multiple answers */
typedef void resolve_answer_fn(void *st, struct in_addr *addr);
typedef bool_t resolve_request_fn(void *st, string_t name,
				  resolve_answer_fn *cb, void *cst);
struct resolver_if {
    void *st;
    resolve_request_fn *request;
};

/* RANDOMSRC interface */

/* Return some random data. Returns TRUE for success. */
typedef bool_t random_fn(void *st, uint32_t bytes, uint8_t *buff);

struct random_if {
    void *st;
    bool_t blocking;
    random_fn *generate;
};

/* RSAPUBKEY interface */

typedef bool_t rsa_checksig_fn(void *st, uint8_t *data, uint32_t datalen,
			       string_t signature);
struct rsapubkey_if {
    void *st;
    rsa_checksig_fn *check;
};

/* RSAPRIVKEY interface */

typedef string_t rsa_makesig_fn(void *st, uint8_t *data, uint32_t datalen);
struct rsaprivkey_if {
    void *st;
    rsa_makesig_fn *sign;
};

/* COMM interface */

/* Return True if the packet was processed, and shouldn't be passed to
   any other potential receivers. */
typedef bool_t comm_notify_fn(void *state, struct buffer_if *buf,
			    struct sockaddr_in *source);
typedef void comm_request_notify_fn(void *commst, void *nst,
				    comm_notify_fn *fn);
typedef void comm_release_notify_fn(void *commst, void *nst,
				    comm_notify_fn *fn);
typedef bool_t comm_sendmsg_fn(void *commst, struct buffer_if *buf,
			       struct sockaddr_in *dest);
struct comm_if {
    void *st;
    uint32_t min_start_pad;
    uint32_t min_end_pad;
    comm_request_notify_fn *request_notify;
    comm_release_notify_fn *release_notify;
    comm_sendmsg_fn *sendmsg;
};

/* LOG interface */

typedef void log_msg_fn(void *st, int class, char *message, ...);
typedef void log_vmsg_fn(void *st, int class, char *message, va_list args);
struct log_if {
    void *st;
    log_msg_fn *log;
    log_vmsg_fn *vlog;
};
/* (convenience function, defined in util.c) */
extern void log(struct log_if *lf, int class, char *message, ...)
FORMAT(printf,3,4);

/* SITE interface */

/* Pretty much a placeholder; allows starting and stopping of processing,
   key expiry, etc. */
typedef void site_control_fn(void *st, bool_t run);
typedef uint32_t site_status_fn(void *st);
struct site_if {
    void *st;
    site_control_fn *control;
    site_status_fn *status;
};

/* TRANSFORM interface */

/* A reversable transformation. Transforms buffer in-place; may add
   data to start or end. Maximum amount of data to be added specified
   in max_start_pad and max_end_pad. (Reverse transformations decrease
   length, of course.)  Transformations may be key-dependent, in which
   case key material is passed in at initialisation time. They may
   also depend on internal factors (eg. time) and keep internal
   state. A struct transform_if only represents a particular type of
   transformation; instances of the transformation (eg. with
   particular key material) have a different C type. */

typedef struct transform_inst_if *transform_createinstance_fn(void *st);
typedef bool_t transform_setkey_fn(void *st, uint8_t *key, uint32_t keylen);
typedef void transform_delkey_fn(void *st);
typedef void transform_destroyinstance_fn(void *st);
/* Returns 0 for 'all is well', any other value for a problem */
typedef uint32_t transform_apply_fn(void *st, struct buffer_if *buf,
				    char **errmsg);

struct transform_inst_if {
    void *st;
    transform_setkey_fn *setkey;
    transform_delkey_fn *delkey;
    transform_apply_fn *forwards;
    transform_apply_fn *reverse;
    transform_destroyinstance_fn *destroy;
};

struct transform_if {
    void *st;
    uint32_t max_start_pad;
    uint32_t max_end_pad;
    uint32_t keylen;
    transform_createinstance_fn *create;
};

/* NETLINK interface */

/* Used by netlink to deliver to site, and by site to deliver to
   netlink.  cid is the client identifier returned by
   netlink_regnets_fn.  If buf has size 0 then the function is just
   being called for its site-effects (eg. making the site code attempt
   to bring up a network link) */
typedef void netlink_deliver_fn(void *st, struct buffer_if *buf);
/* site code can tell netlink when outgoing packets will be dropped,
   so netlink can generate appropriate ICMP and make routing decisions */
#define LINK_QUALITY_DOWN 0   /* No chance of a packet being delivered */
#define LINK_QUALITY_DOWN_STALE_ADDRESS 1 /* Link down, old address information */
#define LINK_QUALITY_DOWN_CURRENT_ADDRESS 2 /* Link down, current address information */
#define LINK_QUALITY_UP 3     /* Link active */
#define MAXIMUM_LINK_QUALITY 3
typedef void netlink_link_quality_fn(void *st, uint32_t quality);
typedef void netlink_register_fn(void *st, netlink_deliver_fn *deliver,
				 void *dst, uint32_t max_start_pad,
				 uint32_t max_end_pad);
typedef void netlink_output_config_fn(void *st, struct buffer_if *buf);
typedef bool_t netlink_check_config_fn(void *st, struct buffer_if *buf);
typedef void netlink_set_mtu_fn(void *st, uint32_t new_mtu);
struct netlink_if {
    void *st;
    netlink_register_fn *reg;
    netlink_deliver_fn *deliver;
    netlink_link_quality_fn *set_quality;
    netlink_output_config_fn *output_config;
    netlink_check_config_fn *check_config;
    netlink_set_mtu_fn *set_mtu;
};

/* DH interface */

/* Returns public key as a malloced hex string */
typedef string_t dh_makepublic_fn(void *st, uint8_t *secret,
				  uint32_t secretlen);
/* Fills buffer (up to buflen) with shared secret */
typedef void dh_makeshared_fn(void *st, uint8_t *secret,
			      uint32_t secretlen, string_t rempublic,
			      uint8_t *sharedsecret, uint32_t buflen);
struct dh_if {
    void *st;
    uint32_t len; /* Approximate size of modulus in bytes */
    dh_makepublic_fn *makepublic;
    dh_makeshared_fn *makeshared;
};

/* HASH interface */

typedef void *hash_init_fn(void);
typedef void hash_update_fn(void *st, uint8_t const *buf, uint32_t len);
typedef void hash_final_fn(void *st, uint8_t *digest);
struct hash_if {
    uint32_t len; /* Hash output length in bytes */
    hash_init_fn *init;
    hash_update_fn *update;
    hash_final_fn *final;
};

/* BUFFER interface */

struct buffer_if {
    bool_t free;
    string_t owner; /* Set to constant string */
    uint32_t flags; /* How paranoid should we be? */
    struct cloc loc; /* Where we were defined */
    uint8_t *base;
    uint8_t *start;
    uint32_t size; /* Size of buffer contents */
    uint32_t len; /* Total length allocated at base */
};

/***** LOG functions *****/

#define M_DEBUG_CONFIG 0x001
#define M_DEBUG_PHASE  0x002
#define M_DEBUG        0x004
#define M_INFO	       0x008
#define M_NOTICE       0x010
#define M_WARNING      0x020
#define M_ERR	       0x040
#define M_SECURITY     0x080
#define M_FATAL	       0x100

/* The fatal() family of functions require messages that do not end in '\n' */
extern NORETURN(fatal(char *message, ...));
extern NORETURN(fatal_perror(char *message, ...));
extern NORETURN(fatal_status(int status, char *message, ...));
extern NORETURN(fatal_perror_status(int status, char *message, ...));

/* The cfgfatal() family of functions require messages that end in '\n' */
extern NORETURN(cfgfatal(struct cloc loc, string_t facility, char *message,
			 ...));
extern void cfgfile_postreadcheck(struct cloc loc, FILE *f);
extern NORETURN(vcfgfatal_maybefile(FILE *maybe_f, struct cloc loc,
				    string_t facility, char *message,
				    va_list));
extern NORETURN(cfgfatal_maybefile(FILE *maybe_f, struct cloc loc,
				   string_t facility, char *message, ...));

extern void Message(uint32_t class, char *message, ...) FORMAT(printf,2,3);

/***** END of log functions *****/

#endif /* secnet_h */
Commit	Line	Data
2fe58dfd SE	1	/* Core interface of secnet, to be used by all modules */
	2
	3	#ifndef secnet_h
	4	#define secnet_h
	5
59635212	6	#include "config.h"
2fe58dfd	7	#include <stdlib.h>
2fe58dfd	8	#include <stdarg.h>
4f5e39ec	9	#include <stdio.h>
2fe58dfd	10	#include <sys/poll.h>
8689b3a9 SE	11	#include <sys/types.h>
8689b3a9 SE	12	#include <sys/time.h>
2fe58dfd	13	#include <netinet/in.h>
2fe58dfd	14
2fe58dfd SE	15	typedef char *string_t;
	16	typedef enum {False,True} bool_t;
	17
794f2398	18	#define ASSERT(x) do { if (!(x)) { fatal("assertion failed line %d file " \
4f5e39ec	19	__FILE__,__LINE__); } } while(0)
2fe58dfd SE	20
	21	/*** CONFIGURATION support ***/
	22
baa06aeb SE	23	extern bool_t just_check_config; /* If True then we're going to exit after
baa06aeb SE	24	reading the configuration file */
b2a56f7c	25	extern bool_t background; /* If True then we'll eventually run as a daemon */
baa06aeb	26
2fe58dfd SE	27	typedef struct dict dict_t; /* Configuration dictionary */
	28	typedef struct closure closure_t;
	29	typedef struct item item_t;
	30	typedef struct list list_t; /* A list of items */
	31
	32	/* Configuration file location, for error-reporting */
	33	struct cloc {
	34	string_t file;
	35	uint32_t line;
	36	};
	37
	38	/* Modules export closures, which can be invoked from the configuration file.
	39	"Invoking" a closure usually returns another closure (of a different
	40	type), but can actually return any configuration object. */
	41	typedef list_t (apply_fn)(closure_t self, struct cloc loc,
	42	dict_t context, list_t data);
	43	struct closure {
	44	string_t description; /* For debugging */
	45	uint32_t type; /* Central registry... */
	46	apply_fn *apply;
	47	void interface; / Interface for use inside secnet; depends on type */
	48	};
	49
	50	enum types { t_null, t_bool, t_string, t_number, t_dict, t_closure };
	51	struct item {
	52	enum types type;
	53	union {
	54	bool_t bool;
	55	string_t string;
	56	uint32_t number;
	57	dict_t *dict;
	58	closure_t *closure;
	59	} data;
	60	struct cloc loc;
	61	};
	62
ff05a229 SE	63	/* Note that it is unwise to use this structure directly; use the list
ff05a229 SE	64	manipulation functions instead. */
2fe58dfd SE	65	struct list {
	66	item_t *item;
	67	struct list *next;
	68	};
	69
	70	/* In the following two lookup functions, NULL means 'not found' */
	71	/* Lookup a value in the specified dictionary, or its parents */
	72	extern list_t dict_lookup(dict_t dict, string_t key);
	73	/* Lookup a value in just the specified dictionary */
	74	extern list_t dict_lookup_primitive(dict_t dict, string_t key);
	75	/* Add a value to the specified dictionary */
	76	extern void dict_add(dict_t dict, string_t key, list_t val);
	77	/* Obtain an array of keys in the dictionary. malloced; caller frees */
	78	extern string_t dict_keys(dict_t dict);
	79
	80	/* List-manipulation functions */
	81	extern list_t *list_new(void);
b2a56f7c	82	extern uint32_t list_length(list_t *a);
2fe58dfd SE	83	extern list_t list_append(list_t a, item_t *i);
	84	extern list_t list_append_list(list_t a, list_t *b);
	85	/* Returns an item from the list (index starts at 0), or NULL */
	86	extern item_t list_elem(list_t l, uint32_t index);
	87
	88	/* Convenience functions */
	89	extern list_t new_closure(closure_t cl);
	90	extern void add_closure(dict_t *dict, string_t name, apply_fn apply);
	91	extern void find_cl_if(dict_t dict, string_t name, uint32_t type,
	92	bool_t fail_if_invalid, string_t desc,
	93	struct cloc loc);
	94	extern item_t dict_find_item(dict_t dict, string_t key, bool_t required,
	95	string_t desc, struct cloc loc);
	96	extern string_t dict_read_string(dict_t *dict, string_t key, bool_t required,
	97	string_t desc, struct cloc loc);
	98	extern uint32_t dict_read_number(dict_t *dict, string_t key, bool_t required,
	99	string_t desc, struct cloc loc, uint32_t def);
	100	extern bool_t dict_read_bool(dict_t *dict, string_t key, bool_t required,
	101	string_t desc, struct cloc loc, bool_t def);
9d3a4132 SE	102	struct flagstr {
	103	string_t name;
	104	uint32_t value;
	105	};
b2a56f7c SE	106	extern uint32_t string_to_word(string_t s, struct cloc loc,
b2a56f7c SE	107	struct flagstr *f, string_t desc);
9d3a4132 SE	108	extern uint32_t string_list_to_word(list_t l, struct flagstr f,
9d3a4132 SE	109	string_t desc);
2fe58dfd SE	110
	111	/*** END of configuration support ***/
	112
7138d0c5 SE	113	/*** UTILITY functions ***/
	114
	115	extern char safe_strdup(char string, char *message);
	116	extern void safe_malloc(size_t size, char message);
2fe58dfd	117
4efd681a SE	118	extern int sys_cmd(const char file, char argc, ...);
4efd681a SE	119
2fe58dfd SE	120	/*** END of utility functions ***/
	121
	122	/***** SCHEDULING support */
	123
	124	/* "now" is current program time, in milliseconds. It is derived
	125	(once) from tv_now. If nfds_io is insufficient for your needs, set
	126	it to the required number and return ERANGE. timeout is in milliseconds;
	127	if it is too high then lower it. It starts at -1 (==infinite) */
	128	typedef int beforepoll_fn(void st, struct pollfd fds, int *nfds_io,
	129	int timeout_io, const struct timeval tv_now,
	130	uint64_t *now);
	131	typedef void afterpoll_fn(void st, struct pollfd fds, int nfds,
	132	const struct timeval tv_now, uint64_t now);
	133
	134	/* Register interest in the main loop of the program. Before a call
	135	to poll() your supplied beforepoll function will be called. After
	136	the call to poll() the supplied afterpoll function will be called.
	137	max_nfds is a _hint_ about the maximum number of struct pollfd
	138	structures you may require - you can always ask for more in
	139	nfds_io. /
	140	extern void register_for_poll(void st, beforepoll_fn before,
	141	afterpoll_fn *after, uint32_t max_nfds,
	142	string_t desc);
	143
	144	/***** END of scheduling support */
	145
	146	/***** PROGRAM LIFETIME support */
	147
	148	/* The secnet program goes through a number of phases in its lifetime.
	149	Module code may arrange to be called just as various phases are
	150	entered. */
	151
	152	#define PHASE_INIT 0
	153	#define PHASE_GETOPTS 1 /* Process command-line arguments */
	154	#define PHASE_READCONFIG 2 /* Parse and process configuration file */
	155	#define PHASE_SETUP 3 /* Process information in configuration */
baa06aeb SE	156	#define PHASE_GETRESOURCES 4 /* Obtain all external resources */
	157	#define PHASE_DROPPRIV 5 /* Last chance for privileged operations */
	158	#define PHASE_RUN 6
	159	#define PHASE_SHUTDOWN 7 /* About to die; delete key material, etc. */
	160	#define NR_PHASES 8
2fe58dfd SE	161
	162	typedef void hook_fn(void *self, uint32_t newphase);
	163	bool_t add_hook(uint32_t phase, hook_fn f, void state);
	164	bool_t remove_hook(uint32_t phase, hook_fn f, void state);
	165
7138d0c5 SE	166	extern uint32_t current_phase;
	167	extern void enter_phase(uint32_t new_phase);
	168
ff05a229 SE	169	/* Some features (like netlink 'soft' routes) require that secnet
	170	retain root privileges. They should indicate that here when
	171	appropriate. */
	172	extern bool_t require_root_privileges;
9d3a4132 SE	173	extern string_t require_root_privileges_explanation;
9d3a4132 SE	174
2fe58dfd SE	175	/*** END of program lifetime support ***/
	176
	177	/*** MODULE support ***/
	178
	179	/* Module initialisation function type - modules export one function of
	180	this type which is called to initialise them. For dynamically loaded
	181	modules it's called "secnet_module". */
469fd1d9	182	typedef void init_module(dict_t *dict);
2fe58dfd SE	183
	184	/*** END of module support ***/
	185
	186	/*** CLOSURE TYPES and interface definitions ***/
	187
469fd1d9 SE	188	#define CL_PURE 0
	189	#define CL_RESOLVER 1
	190	#define CL_RANDOMSRC 2
	191	#define CL_RSAPUBKEY 3
	192	#define CL_RSAPRIVKEY 4
	193	#define CL_COMM 5
	194	#define CL_IPIF 6
	195	#define CL_LOG 7
	196	#define CL_SITE 8
	197	#define CL_TRANSFORM 9
	198	#define CL_DH 11
	199	#define CL_HASH 12
	200	#define CL_BUFFER 13
	201	#define CL_NETLINK 14
2fe58dfd SE	202
	203	struct buffer_if;
	204
	205	/* PURE closure requires no interface */
	206
	207	/* RESOLVER interface */
	208
	209	/* Answers to queries are delivered to a function of this
	210	type. 'address' will be NULL if there was a problem with the query. It
	211	will be freed once resolve_answer_fn returns. It is in network byte
	212	order. */
ff05a229	213	/* XXX extend to be able to provide multiple answers */
2fe58dfd SE	214	typedef void resolve_answer_fn(void st, struct in_addr addr);
	215	typedef bool_t resolve_request_fn(void *st, string_t name,
	216	resolve_answer_fn cb, void cst);
	217	struct resolver_if {
	218	void *st;
	219	resolve_request_fn *request;
	220	};
	221
	222	/* RANDOMSRC interface */
	223
	224	/* Return some random data. Returns TRUE for success. */
	225	typedef bool_t random_fn(void st, uint32_t bytes, uint8_t buff);
	226
	227	struct random_if {
	228	void *st;
	229	bool_t blocking;
	230	random_fn *generate;
	231	};
	232
	233	/* RSAPUBKEY interface */
	234
	235	typedef bool_t rsa_checksig_fn(void st, uint8_t data, uint32_t datalen,
	236	string_t signature);
	237	struct rsapubkey_if {
	238	void *st;
	239	rsa_checksig_fn *check;
	240	};
	241
	242	/* RSAPRIVKEY interface */
	243
	244	typedef string_t rsa_makesig_fn(void st, uint8_t data, uint32_t datalen);
	245	struct rsaprivkey_if {
	246	void *st;
	247	rsa_makesig_fn *sign;
	248	};
	249
	250	/* COMM interface */
	251
	252	/* Return True if the packet was processed, and shouldn't be passed to
	253	any other potential receivers. */
	254	typedef bool_t comm_notify_fn(void state, struct buffer_if buf,
	255	struct sockaddr_in *source);
	256	typedef void comm_request_notify_fn(void commst, void nst,
	257	comm_notify_fn *fn);
	258	typedef void comm_release_notify_fn(void commst, void nst,
	259	comm_notify_fn *fn);
	260	typedef bool_t comm_sendmsg_fn(void commst, struct buffer_if buf,
	261	struct sockaddr_in *dest);
	262	struct comm_if {
	263	void *st;
ff05a229 SE	264	uint32_t min_start_pad;
ff05a229 SE	265	uint32_t min_end_pad;
2fe58dfd SE	266	comm_request_notify_fn *request_notify;
	267	comm_release_notify_fn *release_notify;
	268	comm_sendmsg_fn *sendmsg;
	269	};
	270
	271	/* LOG interface */
	272
b2a56f7c SE	273	typedef void log_msg_fn(void st, int class, char message, ...);
b2a56f7c SE	274	typedef void log_vmsg_fn(void st, int class, char message, va_list args);
2fe58dfd SE	275	struct log_if {
	276	void *st;
	277	log_msg_fn *log;
	278	log_vmsg_fn *vlog;
	279	};
	280	/* (convenience function, defined in util.c) */
4f5e39ec SE	281	extern void log(struct log_if lf, int class, char message, ...)
4f5e39ec SE	282	FORMAT(printf,3,4);
2fe58dfd SE	283
	284	/* SITE interface */
	285
	286	/* Pretty much a placeholder; allows starting and stopping of processing,
	287	key expiry, etc. */
	288	typedef void site_control_fn(void *st, bool_t run);
	289	typedef uint32_t site_status_fn(void *st);
	290	struct site_if {
	291	void *st;
	292	site_control_fn *control;
	293	site_status_fn *status;
	294	};
	295
	296	/* TRANSFORM interface */
	297
	298	/* A reversable transformation. Transforms buffer in-place; may add
	299	data to start or end. Maximum amount of data to be added specified
	300	in max_start_pad and max_end_pad. (Reverse transformations decrease
	301	length, of course.) Transformations may be key-dependent, in which
	302	case key material is passed in at initialisation time. They may
	303	also depend on internal factors (eg. time) and keep internal
	304	state. A struct transform_if only represents a particular type of
	305	transformation; instances of the transformation (eg. with
	306	particular key material) have a different C type. */
	307
	308	typedef struct transform_inst_if transform_createinstance_fn(void st);
	309	typedef bool_t transform_setkey_fn(void st, uint8_t key, uint32_t keylen);
	310	typedef void transform_delkey_fn(void *st);
	311	typedef void transform_destroyinstance_fn(void *st);
	312	/* Returns 0 for 'all is well', any other value for a problem */
	313	typedef uint32_t transform_apply_fn(void st, struct buffer_if buf,
	314	char **errmsg);
	315
	316	struct transform_inst_if {
	317	void *st;
	318	transform_setkey_fn *setkey;
	319	transform_delkey_fn *delkey;
	320	transform_apply_fn *forwards;
	321	transform_apply_fn *reverse;
	322	transform_destroyinstance_fn *destroy;
	323	};
	324
	325	struct transform_if {
	326	void *st;
	327	uint32_t max_start_pad;
	328	uint32_t max_end_pad;
	329	uint32_t keylen;
	330	transform_createinstance_fn *create;
	331	};
	332
	333	/* NETLINK interface */
	334
70dc107b SE	335	/* Used by netlink to deliver to site, and by site to deliver to
	336	netlink. cid is the client identifier returned by
	337	netlink_regnets_fn. If buf has size 0 then the function is just
	338	being called for its site-effects (eg. making the site code attempt
	339	to bring up a network link) */
469fd1d9	340	typedef void netlink_deliver_fn(void st, struct buffer_if buf);
4efd681a	341	/* site code can tell netlink when outgoing packets will be dropped,
70dc107b SE	342	so netlink can generate appropriate ICMP and make routing decisions */
	343	#define LINK_QUALITY_DOWN 0 /* No chance of a packet being delivered */
	344	#define LINK_QUALITY_DOWN_STALE_ADDRESS 1 /* Link down, old address information */
	345	#define LINK_QUALITY_DOWN_CURRENT_ADDRESS 2 /* Link down, current address information */
	346	#define LINK_QUALITY_UP 3 /* Link active */
	347	#define MAXIMUM_LINK_QUALITY 3
469fd1d9 SE	348	typedef void netlink_link_quality_fn(void *st, uint32_t quality);
	349	typedef void netlink_register_fn(void st, netlink_deliver_fn deliver,
	350	void *dst, uint32_t max_start_pad,
	351	uint32_t max_end_pad);
794f2398 SE	352	typedef void netlink_output_config_fn(void st, struct buffer_if buf);
794f2398 SE	353	typedef bool_t netlink_check_config_fn(void st, struct buffer_if buf);
d3fe100d	354	typedef void netlink_set_mtu_fn(void *st, uint32_t new_mtu);
2fe58dfd SE	355	struct netlink_if {
2fe58dfd SE	356	void *st;
469fd1d9	357	netlink_register_fn *reg;
2fe58dfd	358	netlink_deliver_fn *deliver;
70dc107b	359	netlink_link_quality_fn *set_quality;
794f2398 SE	360	netlink_output_config_fn *output_config;
794f2398 SE	361	netlink_check_config_fn *check_config;
d3fe100d	362	netlink_set_mtu_fn *set_mtu;
2fe58dfd SE	363	};
	364
	365	/* DH interface */
	366
	367	/* Returns public key as a malloced hex string */
	368	typedef string_t dh_makepublic_fn(void st, uint8_t secret,
	369	uint32_t secretlen);
	370	/* Fills buffer (up to buflen) with shared secret */
	371	typedef void dh_makeshared_fn(void st, uint8_t secret,
	372	uint32_t secretlen, string_t rempublic,
	373	uint8_t *sharedsecret, uint32_t buflen);
	374	struct dh_if {
	375	void *st;
	376	uint32_t len; /* Approximate size of modulus in bytes */
	377	dh_makepublic_fn *makepublic;
	378	dh_makeshared_fn *makeshared;
	379	};
	380
	381	/* HASH interface */
	382
	383	typedef void *hash_init_fn(void);
	384	typedef void hash_update_fn(void st, uint8_t const buf, uint32_t len);
	385	typedef void hash_final_fn(void st, uint8_t digest);
	386	struct hash_if {
	387	uint32_t len; /* Hash output length in bytes */
	388	hash_init_fn *init;
	389	hash_update_fn *update;
	390	hash_final_fn *final;
	391	};
	392
	393	/* BUFFER interface */
	394
	395	struct buffer_if {
	396	bool_t free;
	397	string_t owner; /* Set to constant string */
	398	uint32_t flags; /* How paranoid should we be? */
	399	struct cloc loc; /* Where we were defined */
	400	uint8_t *base;
	401	uint8_t *start;
	402	uint32_t size; /* Size of buffer contents */
	403	uint32_t len; /* Total length allocated at base */
	404	};
	405
4f5e39ec SE	406	/*** LOG functions ***/
	407
	408	#define M_DEBUG_CONFIG 0x001
	409	#define M_DEBUG_PHASE 0x002
	410	#define M_DEBUG 0x004
	411	#define M_INFO 0x008
	412	#define M_NOTICE 0x010
	413	#define M_WARNING 0x020
	414	#define M_ERR 0x040
	415	#define M_SECURITY 0x080
	416	#define M_FATAL 0x100
	417
	418	/* The fatal() family of functions require messages that do not end in '\n' */
	419	extern NORETURN(fatal(char *message, ...));
	420	extern NORETURN(fatal_perror(char *message, ...));
	421	extern NORETURN(fatal_status(int status, char *message, ...));
	422	extern NORETURN(fatal_perror_status(int status, char *message, ...));
	423
	424	/* The cfgfatal() family of functions require messages that end in '\n' */
	425	extern NORETURN(cfgfatal(struct cloc loc, string_t facility, char *message,
	426	...));
	427	extern void cfgfile_postreadcheck(struct cloc loc, FILE *f);
	428	extern NORETURN(vcfgfatal_maybefile(FILE *maybe_f, struct cloc loc,
	429	string_t facility, char *message,
	430	va_list));
	431	extern NORETURN(cfgfatal_maybefile(FILE *maybe_f, struct cloc loc,
	432	string_t facility, char *message, ...));
	433
	434	extern void Message(uint32_t class, char *message, ...) FORMAT(printf,2,3);
	435
	436	/*** END of log functions ***/
	437
2fe58dfd	438	#endif /* secnet_h */