/*
 * userv service (or standalone program) for per-user IP subranges.
 *
 * This is the service program, which is invoked as root from userv (or may
 * be invoked firectly).
 *
 * Its arguments are supposed to be, in order, as follows:
 *
 *  The first two arguments are usually supplied by the userv
 *  configuration.  See the file `ipif/ipif' in the source tree, which
 *  is installed in /etc/userv/services.d/ipif by `make install':
 *
 *  <config>
 *
 *      Specifies address ranges and gids which own them.  The default
 *      configuration supplies /etc/userv/ipif-networks, which is then read
 *      for a list of entries, one per line.
 *
 *  --
 *      Serves to separate the user-supplied and therefore untrusted
 *      arguments from the trusted first argument.
 *
 *  The remaining arguments are supplied by the (untrusted) caller:
 *
 *  <local-addr>,<peer-addr>,<mtu>[,[<proto>][,[<ifnamepat>]]]
 *
 *      As for slattach.  The only supported protocol is slip.
 *      Alternatively, set to `debug' to print debugging info and
 *      exit.  <local-addr> is address of the interface to be created
 *      on the local system; <peer-addr> is the address of the
 *      point-to-point peer.  They must be actual addresses (not
 *      hostnames).
 *
 *  <prefix>/<mask>,<prefix>/<mask>,...
 *
 *      List of additional routes to add for this interface.  routes will
 *      be set up on the local system arranging for packets for those
 *      networks to be sent via the created interface.  <prefix> must be an
 *      IPv4 address, and mask must be an integer (dotted-quad masks are
 *      not supported).  If no additional routes are to be set up, use `-'
 *      or supply an empty argument.
 *
 * Each <config> item - whether a line in a file such as
 * /etc/userv/ipif-networks, or the single trusted argument supplied
 * on the service program command line - is one of:
 *
 *   /<config-file-name>
 *   ./<config-file-name>
 *   ../<config-file-name>
 *
 *      Reads a file which contains lines which are each <config>
 *      items.
 *
 *   <gid>,[=][-|+]<prefix>/<len>(-|+<prefix>/<len>...)[,<junk>]
 *
 *      Indicates that <gid> may allocate addresses in the relevant address
 *      range (<junk> is ignored).  <gid> must be numeric.  To specify a
 *      single host address, you must specify a mask of /32.  If `=' is
 *      specified then the specific subrange is only allowed for the local
 *      endpoint address, but not for remote addresses.
 *
 *      More than one range may be given, with each range prefixed
 *      by + or -.  In this case each address range in the rule will
 *      scanned in order, and the first range in the rule that matches
 *      any desired rule will count: if that first matching range is
 *      prefixed by `+' (or nothing) then the rule applies, if it
 *      is prefixed by `-' (or nothing matches), the rule does not.
 *
 *   *
 *      Means that anything is to be permitted.  This should not appear in
 *      /etc/userv/ipif-networks, as that would permit any user on the
 *      system to create any interfaces with any addresses and routes
 *      attached.  It is provided so that root can usefully invoke the ipif
 *      service program directly (not via userv), without needing to set up
 *      permissions in /etc/userv/ipif-networks.
 *
 *      Only `*' permits interface name patterns other than the default
 *      value of `userv%d'.
 *
 *   #...
 *
 *      Comment.  Blank lines are also ignored.
 *
 *   NB: Permission is granted if _any_ config entry matches the request.
 *
 * The service program should be run from userv with no-disconnect-hup.
 */
/*
 * This file is part of ipif, part of userv-utils
 *
 * Copyright 1996-2013 Ian Jackson <ijackson@chiark.greenend.org.uk>
 * Copyright 1998 David Damerell <damerell@chiark.greenend.org.uk>
 * Copyright 1999,2003
 *    Chancellor Masters and Scholars of the University of Cambridge
 * Copyright 2010 Tony Finch <fanf@dotat.at>
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with userv-utils; if not, see http://www.gnu.org/licenses/.
 */

