From e0fc82203d677a6f1e808e9a1a46176c109d89be Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Mon, 15 Dec 2014 23:08:59 +0000 Subject: Initial commit --- doc/libs6net/accessrules.html | 331 ++++++++++++++++++++++++++++++++++++++++++ doc/libs6net/ident.html | 124 ++++++++++++++++ doc/libs6net/index.html | 63 ++++++++ 3 files changed, 518 insertions(+) create mode 100644 doc/libs6net/accessrules.html create mode 100644 doc/libs6net/ident.html create mode 100644 doc/libs6net/index.html (limited to 'doc/libs6net') diff --git a/doc/libs6net/accessrules.html b/doc/libs6net/accessrules.html new file mode 100644 index 0000000..ea996b7 --- /dev/null +++ b/doc/libs6net/accessrules.html @@ -0,0 +1,331 @@ + + + + + s6-networking: the accessrules library interface + + + + + + +

+libs6net
+s6-networking
+Software
+skarnet.org +

+ +

The accessrules library interface

+ +

+ The following functions and structures are declared in the s6-networking/accessrules.h header, +and implemented in the libs6net.a or libs6net.so library. +

+ +

General information

+ +

+ s6net_accessrules is an access control library. It looks up +a key in a user-specified database, then returns a code depending on +whether the database allows access (in which case additional information +can also be returned), denies access, or does not contain the key. +

+ +

+ accessrules has been designed to be easily extensible to any +database format and any key format. +

+ +

+ Check the s6-networking/accessrules.h header for the exact definitions. +

+ +

Data structures

+ + + +

Function types

+ +

Backend lookups

+ +

+ A s6net_accessrules_backend_func_t is the type of a function +that takes a single key, looks it up in a database, and returns the result. +Namely: +

+ +

+s6net_accessrules_result_t f (char const *key, unsigned int keylen, void *handle, s6net_accessrules_params_t *params) +

+ +

+ f looks up key key of length keylen in the database +represented by handle in an implementation-defined way. It returns a +number that says the key has been allowed, denied or not found, or an error +occurred. If the key has been allowed, f stores additional information +from the database into *params. +

+ +

+ Two s6net_accessrules_backend_func_t functions are natively implemented: +

+ + + +

Frontend key checking

+ +

+ A s6net_accessrules_keycheck_func_t is the type of a function that +takes a user-level key, makes a list of corresponding backend-level keys and +calls a s6net_accessrules_backend_func_t function until it finds +a match. Namely: +

+ +

+s6net_accessrules_result_t f (void const *key, void *handle, s6net_accessrules_params_t *params, s6net_accessrules_backend_func_t *backend) +

+ +

+ f derives a list of low-level keys to check from key. +Then, for each key k of length klen in this list, it calls +(*backend)(k, klen, handle, params), returning *backend's result if it +is not S6NET_ACCESSRULES_NOTFOUND. If no match can be found in the whole list, +f finally returns S6NET_ACCESSRULES_NOTFOUND. +

+ +

+ Five s6net_accessrules_keycheck_func_t functions are natively implemented: +

+ + + +

Ready-to-use functions

+ + Those functions are mostly macros; they're built by associating a frontend +function with a backend function. + +

+ s6net_accessrules_result_t s6net_accessrules_uidgid_cdb +(unsigned int u, unsigned int g, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for uid u +and gid g. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_uidgid_fs +(unsigned int u, unsigned int g, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for uid u +and gid g. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_reversedns_cdb +(char const *name, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +name FQDN. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_reversedns_fs +(char const *name, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +name FQDN. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip4_cdb +(char const *ip4, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +ip4 IPv4 address (4 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip4_fs +(char const *ip4, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +ip4 IPv4 address (4 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip6_cdb +(char const *ip6, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +ip6 IPv6 address (16 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip6_fs +(char const *ip6, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +ip6 IPv6 address (16 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip46_cdb +(ip46_t *ip, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +ip IP address. +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip46_fs +(ip46_t const *ip, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +ip IP address. +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ + + diff --git a/doc/libs6net/ident.html b/doc/libs6net/ident.html new file mode 100644 index 0000000..74a9217 --- /dev/null +++ b/doc/libs6net/ident.html @@ -0,0 +1,124 @@ + + + + + s6-networking: the ident library interface + + + + + + +

+libs6net
+s6-networking
+Software
+skarnet.org +

+ +

The ident library interface

+ +

+ The following functions and structures are declared in the s6-networking/ident.h header, +and implemented in the libs6net.a or libs6net.so library. +

+ +

General information

+ +

+ ident provides a C IDENT client, following RFC 1413. +

+ +

+ Please note that this protocol is of historical interest exclusively; +this client, as well as the minidentd +server, is only provided for convenience and interoperability with +legacy systems. The IDENT protocol absolutely cannot be relied on for +any kind of authentication or secure operation. +

+ +

Functions

+ +

+ Check the s6-networking/ident.h header for the exact function prototypes. +

+ +

Main interface

+ +

+ int s6net_ident_client (char *s, unsigned int max, ip46_t const *remoteip, uint16 remoteport, ip46_t const *localip, uint16 localport, +struct taia const *deadline, struct taia *stamp) +

+ +

+Makes an IDENT request to a server listening on IP remoteip port 113 +about the connection from IP remoteip port remoteport to +IP localip port localport. Writes the answer into +preallocated string s of max length max, and returns the +number of bytes in the answer. +

+ + + +

+ char const *s6net_ident_error_str (int e) +

+ +

+ Maps an error code representing a negative answer (i.e. errno when +s6net_ident_client returned 0) to a suitable string. +

+ +

Low-level functions

+ +

+ int s6net_ident_reply_get (char *s, ip46_t const *ra, uint16 rp, ip46_t const *la, uint16 lp, +struct taia const *deadline, struct taia *stamp) +

+ +

+The network part of s6net_ident_client. Connects to *ra:113 +and asks the server about (*ra:rp, *la:lp), +aborting if *deadline goes by. Writes the server answer into s; +at least S6NET_IDENT_REPLY_SIZE bytes must be preallocated in s. +Returns -1 if an error occurs, or the number of bytes written into s. +

+ +

+ int s6net_ident_reply_parse (char const *s, uint16 rp, uint16 lp) +

+ +

+The local part of s6net_ident_client. Parses the server answer in +s for the connection from port rp to port lp. +Returns -1 EPROTO if the answer does not make sense, 0 if the answer is +negative, or a positive number if the answer is positive. This number is +an index where the ID can be found in s. +

+ + + diff --git a/doc/libs6net/index.html b/doc/libs6net/index.html new file mode 100644 index 0000000..7a6a75b --- /dev/null +++ b/doc/libs6net/index.html @@ -0,0 +1,63 @@ + + + + + s6-networking: the s6net library interface + + + + + + +

+s6-networking
+Software
+skarnet.org +

+ +

The s6net library interface

+ +

General information

+ +

+ libs6net is a collection of networking-related utility +C interfaces, used in the s6-networking executables. +

+ +

Compiling

+ + + +

Linking

+ + + +

Programming

+ +

+ The s6-networking/s6net.h header is actually a +concatenation of other headers: +the libs6net is separated into several modules, each of them with its +own header. +

+ + + + + -- cgit v1.2.3