netctx

type Declared struct {
	Site        string
	Reach       []netip.Prefix
	DNSSuffixes []string
	Internet    Internet
	Mode        Mode
}

type Detected struct {
	// OnLink are the prefixes of the host's own interfaces (container and
	// virtual bridges left out), sorted.
	OnLink []netip.Prefix
	// RoutesKnown: the routing table could be read.
	RoutesKnown bool
	// Routes are the usable routes (rejected and loopback left out).
	Routes []Route
	// DefaultV4 and DefaultV6: a default route exists (meaningful only
	// when RoutesKnown).
	DefaultV4, DefaultV6 bool
	// Gateways are the default routes' next hops, sorted.
	Gateways []netip.Addr
	// SystemResolvers are resolv.conf's name servers; Resolvers are the
	// ones the sensor's tools use (SENSOR_DNS_RESOLVERS when set).
	SystemResolvers, Resolvers []netip.Addr
	// ResolversFromEnv: Resolvers come from SENSOR_DNS_RESOLVERS.
	ResolversFromEnv bool
	// ResolvConfRead: resolv.conf could be read.
	ResolvConfRead bool
	// SearchDomains are resolv.conf's search (or domain) entries.
	SearchDomains []string
}

type Echo func(ctx context.Context) (EchoResult, error)

type EchoResult struct {
	Address netip.Addr
	// ViaProxy: the request went through a proxy (the control proxy).
	ViaProxy bool
}

type Egress struct {
	Internet Internet
	// Declared: the host owner set it (SENSOR_INTERNET).
	Declared bool
	Reason   string
	// Address is the address the platform saw (zero: no echo).
	Address  netip.Addr
	ViaProxy bool
}

type Iface struct {
	Name  string
	Flags net.Flags
	// Addrs are the interface's addresses with their prefix lengths.
	Addrs []netip.Prefix
}

type Internet string

type Mode string

type Options struct {
	Declared Declared
	// Sources are where detection reads (zero value: DefaultSources).
	Sources *Sources
	// Echo is the platform's egress echo (nil: the internet mode is
	// declared, "none" without a default route, or "unknown").
	Echo        Echo
	EchoTimeout time.Duration
	// Scope returns the local policy's targets.allow (nil: no limit). It
	// is called on every refresh, so a reloaded policy applies.
	Scope func() Scope
}

type Report struct {
	V    int  `json:"v"`
	Mode Mode `json:"mode"`
	// Fingerprint changes when the sensor moves (another network, other
	// gateways, resolvers, search domains or site); not when its egress
	// address changes.
	Fingerprint string   `json:"fingerprint"`
	Internet    Internet `json:"internet"`
	// InternetDeclared: the host owner set Internet.
	InternetDeclared bool `json:"internet_declared,omitempty"`
	// EgressAddress is the address the platform's echo saw (summary and
	// full only).
	EgressAddress string          `json:"egress_address,omitempty"`
	Declared      *ReportDeclared `json:"declared,omitempty"`
	Detected      *ReportDetected `json:"detected,omitempty"`
	// Trimmed counts prefixes narrowed or left out because the local
	// policy does not allow them, or because a list was over its bound.
	Trimmed int `json:"trimmed,omitempty"`
}

type ReportDeclared struct {
	Site        string   `json:"site,omitempty"`
	Reach       []string `json:"reach,omitempty"`
	DNSSuffixes []string `json:"dns_suffixes,omitempty"`
}

type ReportDetected struct {
	// OnLink are the on-link prefixes: private ones (summary), all (full).
	OnLink []string `json:"on_link,omitempty"`
	// PublicOnLink counts the public on-link prefixes summary leaves out.
	PublicOnLink int `json:"public_on_link,omitempty"`
	// Routes says whether the routing table was read: "known" or
	// "unknown" (DefaultV4/DefaultV6 mean nothing then).
	Routes        string   `json:"routes"`
	DefaultV4     bool     `json:"default_route_v4,omitempty"`
	DefaultV6     bool     `json:"default_route_v6,omitempty"`
	Resolvers     []string `json:"resolvers,omitempty"`
	SearchDomains []string `json:"search_domains,omitempty"`
}

type Route struct {
	Prefix  netip.Prefix
	Gateway netip.Addr // zero: on-link
	Iface   string
}

type Scope struct {
	// Set: targets.allow is set (or no target is allowed at all); only
	// prefixes inside Allow are named.
	Set   bool
	Allow []netip.Prefix
	// Deny are targets.deny ranges: a prefix inside one is not named.
	Deny []netip.Prefix
	// NoPrivate: private targets are refused, so no private prefix is
	// named.
	NoPrivate bool
}

type Sources struct {
	// Interfaces lists the host's interfaces.
	Interfaces func() ([]Iface, error)
	// RouteV4 and RouteV6 return the Linux routing tables
	// (/proc/net/route, /proc/net/ipv6_route); nil, or an error, means
	// "unknown" (other systems).
	RouteV4, RouteV6 func() ([]byte, error)
	// ResolvConf returns /etc/resolv.conf.
	ResolvConf func() ([]byte, error)
	// Lookup reads the environment (SENSOR_DNS_RESOLVERS).
	Lookup func(string) (string, bool)
}

type State struct {
	Declared Declared
	Detected Detected
	Egress   Egress
	Report   *Report
	At       time.Time
}

type Watcher struct {
	// contains filtered or unexported fields
}