mdw@git.distorted.org.uk Git - fwd/blob - acl.h

   1 /* -*-c-*-
   2  *
   3  * Access control list handling
   4  *
   5  * (c) 1999 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of the `fw' port forwarder.
  11  *
  12  * `fw' is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License as published by
  14  * the Free Software Foundation; either version 2 of the License, or
  15  * (at your option) any later version.
  16  *
  17  * `fw' is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with `fw'; if not, write to the Free Software Foundation,
  24  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  25  */
  26
  27 #ifndef ACL_H
  28 #define ACL_H
  29
  30 #ifdef __cplusplus
  31   extern "C" {
  32 #endif
  33
  34 /*----- Header files ------------------------------------------------------*/
  35
  36 #include <stdio.h>
  37
  38 #include <sys/types.h>
  39 #include <sys/socket.h>
  40 #include <netinet/in.h>
  41
  42 /*----- Data structures ---------------------------------------------------*/
  43
  44 /* --- An access control entry --- */
  45
  46 typedef struct acl_entry {
  47   struct acl_entry *next;               /* Next entry in the list */
  48   const struct acl_ops *ops;            /* Operations for the ACL entry */
  49   unsigned act;                         /* What to do with matching hosts */
  50 } acl_entry;
  51
  52 #define ACL_DENY 0                      /* Deny access to matching conns */
  53 #define ACL_ALLOW 1                     /* Allow access to matching conns */
  54 #define ACL_PERM 1u                     /* Bit mask for permission bit */
  55
  56 /* --- Host-based access control --- */
  57
  58 typedef struct acl_host {
  59   acl_entry a;                          /* Base structure */
  60   struct in_addr addr, mask;            /* Address and netmask */
  61 } acl_host;
  62
  63 /* --- ACL methods --- */
  64
  65 typedef struct acl_ops {
  66   int (*check)(void */*a*/, struct in_addr /*addr*/, unsigned /*port*/);
  67   void (*dump)(void */*a*/, FILE */*fp*/);
  68   void (*free)(void */*a*/);
  69 } acl_ops;
  70
  71 /*----- Functions provided ------------------------------------------------*/
  72
  73 /* --- @acl_check@ --- *
  74  *
  75  * Arguments:   @acl_entry *a@ = pointer to ACL to check against
  76  *              @struct in_addr addr@ = address to check
  77  *              @unsigned port@ = port number to check
  78  *              @int *act@ = verdict (should initially be @ACT_ALLOW@)
  79  *
  80  * Returns:     Zero if undecided, nonzero if a rule matched.
  81  *
  82  * Use:         Checks an address against an ACL.
  83  */
  84
  85 extern int acl_check(acl_entry */*a*/,
  86                      struct in_addr /*addr*/, unsigned /*port*/,
  87                      int */*act*/);
  88
  89 /* --- @acl_dump@ --- *
  90  *
  91  * Arguments:   @acl_entry *a@ = pointer to ACL to dump
  92  *              @FILE *fp@ = pointer to stream to dump on
  93  *
  94  * Returns:     ---
  95  *
  96  * Use:         Dumps an access control list to an output stream.
  97  */
  98
  99 extern void acl_dump(acl_entry */*a*/, FILE */*fp*/);
 100
 101 /* --- @acl_free@ --- *
 102  *
 103  * Arguments:   @acl_entry *a@ = pointer to a list of ACLs
 104  *
 105  * Returns:     ---
 106  *
 107  * Use:         Frees all of the memory used by an ACL.
 108  */
 109
 110 extern void acl_free(acl_entry */*a*/);
 111
 112 /* --- @acl_addhost@ --- *
 113  *
 114  * Arguments:   @acl_entry ***a@ = address of pointer to list tail
 115  *              @unsigned act@ = what to do with matching addresses
 116  *              @struct in_addr addr, mask@ = address and mask to match
 117  *
 118  * Returns:     ---
 119  *
 120  * Use:         Adds a host-authentication entry to the end of an access
 121  *              control list.
 122  */
 123
 124 extern void acl_addhost(acl_entry ***/*a*/, unsigned /*act*/,
 125                         struct in_addr /*addr*/, struct in_addr /*mask*/);
 126
 127 /* --- @acl_addpriv@ --- *
 128  *
 129  * Arguments:   @acl_entry ***a@ = address of pointer to list tail
 130  *              @unsigned act@ = what to do with matching addresses
 131  *
 132  * Returns:     ---
 133  *
 134  * Use:         Adds a privileged-port check to the end of an access control
 135  *              list.
 136  */
 137
 138 extern void acl_addpriv(acl_entry ***/*a*/, unsigned /*act*/);
 139
 140 /*----- That's all, folks -------------------------------------------------*/
 141
 142 #ifdef __cplusplus
 143   }
 144 #endif
 145
 146 #endif