typedef int (*arp_handler) const struct arp_entry *entry void *arg arp_open void arp_add arp_t *a const struct arp_entry *entry arp_delete arp_t *a const struct arp_entry *entry arp_get arp_t *a struct arp_entry *entry arp_loop arp_t *a arp_handler callback void *arg arp_close arp_t *a

typedef int (*fw_handler) const struct fw_rule *rule void *arg fw_open void fw_add fw_t *f const struct fw_rule *rule fw_delete fw_t *f const struct fw_rule *rule fw_loop fw_t *f fw_handler callback void *arg fw_close fw_t *f

typedef int (*intf_handler) const struct intf_entry *entry void *arg intf_open void intf_get intf_t *i struct intf_entry *entry intf_get_src intf_t *i struct intf_entry *entry struct addr *src intf_get_dst intf_t *i struct intf_entry *entry struct addr *dst intf_set intf_t *i const struct intf_entry *entry intf_loop intf_t *i intf_handler callback void *arg intf_close intf_t *i

rand_open void rand_get rand_t *r void *buf size_t len rand_set rand_t *r const void *seed size_t len rand_add rand_t *r const void *buf size_t len rand_uint8 rand_t *r rand_uint16 rand_t *r rand_uint32 rand_t *r rand_shuffle rand_t *r void *base size_t nmemb size_t size rand_close rand_t *r

typedef int (*route_handler) const struct route_entry *entry void *arg route_open void route_add route_t *r const struct route_entry *entry route_delete route_t *r const struct route_entry *entry route_get route_t *r struct route_entry *entry route_loop route_t *r route_handler callback void *arg route_close route_t *r

Network addresses are described by the following structure: struct addr { uint16_t addr_type; uint16_t addr_bits; union { eth_addr_t __eth; ip_addr_t __ip; ip6_addr_t __ip6; uint8_t __data8[16]; uint16_t __data16[8]; uint32_t __data32[4]; } __addr_u; }; #define addr_eth __addr_u.__eth #define addr_ip __addr_u.__ip #define addr_ip6 __addr_u.__ip6 #define addr_data8 __addr_u.__data8 #define addr_data16 __addr_u.__data16 #define addr_data32 __addr_u.__data32

The following values are defined for addr_type : #define ADDR_TYPE_NONE 0 /* No address set */ #define ADDR_TYPE_ETH 1 /* Ethernet */ #define ADDR_TYPE_IP 2 /* Internet Protocol v4 */ #define ADDR_TYPE_IP6 3 /* Internet Protocol v6 */

The field addr_bits denotes the length of the network mask in bits.

addr_cmp compares network addresses a and b , returning an integer less than, equal to, or greater than zero if a is found, respectively, to be less than, equal to, or greater than b . Both addresses must be of the same address type.

addr_bcast computes the broadcast address for the network specified in a and writes it into b .

addr_net computes the network address for the network specified in a and writes it into b .

addr_ntop converts an address from network format to a string.

addr_pton converts an address (or hostname) from a string to network format.

addr_ntoa converts an address from network format to a string, returning a pointer to the result in static memory.

addr_aton is a synonym for addr_pton .

addr_ntos converts an address from network format to the appropriate struct sockaddr.

addr_ston converts an address from a struct sockaddr to network format.

addr_btos converts a network mask length to a network mask specified as a struct sockaddr.

addr_stob converts a network mask specified in a struct sockaddr to a network mask length.

addr_btom converts a network mask length to a network mask in network byte order.

addr_mtob converts a network mask in network byte order to a network mask length.

ARP cache entries are described by the following structure: struct arp_entry { struct addr arp_pa; /* protocol address */ struct addr arp_ha; /* hardware address */ };

arp_open is used to obtain a handle to access the kernel arp() cache.

arp_add adds a new ARP entry .

arp_delete deletes the ARP entry for the protocol address specified by arp_pa .

arp_get retrieves the ARP entry for the protocol address specified by arp_pa .

arp_loop iterates over the kernel arp() cache, invoking the specified callback with each entry and the context arg passed to arp_loop .

arp_close closes the specified handle.

Binary buffers are described by the following structure: typedef struct blob { u_char *base; /* start of data */ int off; /* offset into data */ int end; /* end of data */ int size; /* size of allocation */ } blob_t;

blob_new is used to allocate a new dynamic binary buffer, returning NULL on failure.

blob_read reads len bytes from the current offset in blob b into buf , returning the total number of bytes read, or -1 on failure.

blob_write writes len bytes from buf to blob b , advancing the current offset. It returns the number of bytes written, or -1 on failure.

blob_seek repositions the offset within blob b to off , according to the directive whence (see lseek() for details), returning the new absolute offset, or -1 on failure.

blob_index returns the offset of the first occurence in blob b of the specified buf of length len , or -1 on failure.

blob_rindex returns the offset of the last occurence in blob b of the specified buf of length len , or -1 on failure.

blob_pack converts and writes, and blob_unpack reads and converts data in blob b according to the given format fmt as described below, returning 0 on success, and -1 on failure.

The format string is composed of zero or more directives: ordinary characters (not % ), which are copied to / read from the blob, and conversion specifications, each of which results in reading / writing zero or more subsequent arguments.

Each conversion specification is introduced by the character % , and may be prefixed by length specifier. The arguments must correspond properly (after type promotion) with the length and conversion specifiers.

The length specifier is either a a decimal digit string specifying the length of the following argument, or the literal character * indicating that the length should be read from an integer argument for the argument following it.

The conversion specifiers and their meanings are:

D

An unsigned 32-bit integer in network byte order.

H

An unsigned 16-bit integer in network byte order.

b

A binary buffer (length specifier required).

c

An unsigned character.

d

An unsigned 32-bit integer in host byte order.

h

An unsigned 16-bit integer in host byte order.

s

A C-style null-terminated string, whose maximum length must be specified when unpacking.

Custom conversion routines and their specifiers may be registered via blob_register_pack , currently undocumented.

blob_print prints len bytes of the contents of blob b from the current offset in the specified style ; currently only is available.

blob_free deallocates the memory associated with blob b and returns NULL.

is used to obtain a handle to transmit raw Ethernet frames via the specified network device .

eth_get retrieves the hardware MAC address for the interface specified by e .

eth_set configures the hardware MAC address for the interface specified by e .

eth_send transmits len bytes of the Ethernet frame pointed to by buf .

eth_close closes the specified handle.

Firewall rules are described by the following structure: struct fw_rule { char fw_device[INTF_NAME_LEN]; /* interface name */ uint8_t fw_op; /* operation */ uint8_t fw_dir; /* direction */ uint8_t fw_proto; /* IP protocol */ struct addr fw_src; /* src address / net */ struct addr fw_dst; /* dst address / net */ uint16_t fw_sport[2]; /* range / ICMP type */ uint16_t fw_dport[2]; /* range / ICMP code */ };

The following values are defined for fw_op : #define FW_OP_ALLOW 1 #define FW_OP_BLOCK 2

The following values are defined for fw_dir : #define FW_DIR_IN 1 #define FW_DIR_OUT 2

fw_open is used to obtain a handle to access the local network firewall configuration.

fw_add adds the specified firewall rule .

fw_delete deletes the specified firewall rule .

fw_loop iterates over the active firewall ruleset, invoking the specified callback with each rule and the context arg passed to fw_loop .

fw_close closes the specified handle.

Network interface information is described by the following structure: #define INTF_NAME_LEN 16

struct intf_entry { u_int intf_len; /* length of entry */ char intf_name[INTF_NAME_LEN]; /* interface name */ u_short intf_type; /* interface type (r/o) */ u_short intf_flags; /* interface flags */ u_int intf_mtu; /* interface MTU */ struct addr intf_addr; /* interface address */ struct addr intf_dst_addr; /* point-to-point dst */ struct addr intf_link_addr; /* link-layer address */ u_int intf_alias_num; /* number of aliases */ struct addr intf_alias_addrs __flexarr; /* array of aliases */ };

The following bitmask values are defined for intf_type : #define INTF_TYPE_OTHER 1 /* other */ #define INTF_TYPE_ETH 6 /* Ethernet */ #define INTF_TYPE_LOOPBACK 24 /* software loopback */ #define INTF_TYPE_TUN 53 /* proprietary virtual/internal */

The following bitmask values are defined for intf_flags : #define INTF_FLAG_UP 0x01 /* enable interface */ #define INTF_FLAG_LOOPBACK 0x02 /* is a loopback net (r/o) */ #define INTF_FLAG_POINTOPOINT 0x04 /* point-to-point link (r/o) */ #define INTF_FLAG_NOARP 0x08 /* disable ARP */ #define INTF_FLAG_BROADCAST 0x10 /* supports broadcast (r/o) */ #define INTF_FLAG_MULTICAST 0x20 /* supports multicast (r/o) */

intf_open is used to obtain a handle to access the network interface configuration.

intf_get retrieves an interface configuration entry , keyed on intf_name . For all intf_get functions, intf_len should be set to the size of the buffer pointed to by entry (usually sizeof(struct intf_entry), but should be larger to accomodate any interface alias addresses.

intf_get_src retrieves the configuration for the interface whose primary address matches the specified src .

intf_get_dst retrieves the configuration for the best interface with which to reach the specified dst .

intf_set sets the interface configuration entry .

intf_loop iterates over all network interfaces, invoking the specified callback with each interface configuration entry and the context arg passed to intf_loop .

intf_close closes the specified handle.

is used to obtain a handle to transmit raw IP packets, routed by the kernel.

ip_add_option adds the header option for the protocol proto specified by optbuf of length optlen and appends it to the appropriate header of the IP packet contained in buf of size len , shifting any existing payload and adding NOPs to pad the option to a word boundary if necessary.

ip_checksum sets the IP checksum and any appropriate transport protocol checksum for the IP packet pointed to by buf of length len .

ip_send transmits len bytes of the IP packet pointed to by buf .

ip_close closes the specified handle.

sets the appropriate transport protocol checksum for the IPv6 packet pointed to by buf of length len .

is used to obtain a handle for fast, cryptographically strong pseudo-random number generation. The starting seed is derived from the system random data source device (if one exists), or from the current time and random stack contents.

rand_set re-initializes the PRNG to start from a known seed value, useful in generating repeatable sequences.

rand_get writes len random bytes into buf .

rand_add adds len bytes of entropy data from buf into the random mix.

rand_uint8 , rand_uint16 , and rand_uint32 return 8, 16, and 32-bit unsigned random values, respectively.

rand_shuffle randomly shuffles an array of nmemb elements of size bytes, starting at base .

rand_close closes the specified handle.

Routing table entries are described by the following structure: struct route_entry { struct addr route_dst; /* destination address */ struct addr route_gw; /* gateway address */ };

route_open is used to obtain a handle to access the kernel route() table.

route_add adds a new routing table entry .

route_delete deletes the routing table entry for the destination prefix specified by route_dst .

route_get retrieves the routing table entry for the destination prefix specified by route_dst .

route_loop iterates over the kernel route() table, invoking the specified callback with each entry and the context arg passed to route_loop .

route_close closes the specified handle.