3 * $Id: acl.h,v 1.4 2003/11/25 14:08:23 mdw Exp $
5 * Access control list handling
7 * (c) 1999 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of the `fw' port forwarder.
14 * `fw' is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * `fw' is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with `fw'; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Revision history --------------------------------------------------*
32 * Revision 1.4 2003/11/25 14:08:23 mdw
33 * Debianization. Socket target options. Internet binding.
35 * Revision 1.3 1999/07/27 18:30:53 mdw
36 * Various minor portability fixes.
38 * Revision 1.2 1999/07/26 23:28:16 mdw
39 * Minor modifications for new design.
41 * Revision 1.1.1.1 1999/07/01 08:56:23 mdw
53 /*----- Header files ------------------------------------------------------*/
57 #include <sys/types.h>
58 #include <sys/socket.h>
59 #include <netinet/in.h>
61 /*----- Data structures ---------------------------------------------------*/
63 /* --- An access control entry --- */
65 typedef struct acl_entry
{
66 struct acl_entry
*next
; /* Next entry in the list */
67 const struct acl_ops
*ops
; /* Operations for the ACL entry */
68 unsigned act
; /* What to do with matching hosts */
71 #define ACL_DENY 0 /* Deny access to matching conns */
72 #define ACL_ALLOW 1 /* Allow access to matching conns */
73 #define ACL_PERM 1u /* Bit mask for permission bit */
75 /* --- Host-based access control --- */
77 typedef struct acl_host
{
78 acl_entry a
; /* Base structure */
79 struct in_addr addr
, mask
; /* Address and netmask */
82 /* --- ACL methods --- */
84 typedef struct acl_ops
{
85 int (*check
)(void */
*a*/
, struct in_addr
/*addr*/, unsigned /*port*/);
86 void (*dump
)(void */
*a*/
, FILE */
*fp*/
);
87 void (*free
)(void */
*a*/
);
90 /*----- Functions provided ------------------------------------------------*/
92 /* --- @acl_check@ --- *
94 * Arguments: @acl_entry *a@ = pointer to ACL to check against
95 * @struct in_addr addr@ = address to check
96 * @unsigned port@ = port number to check
97 * @int *act@ = verdict (should initially be @ACT_ALLOW@)
99 * Returns: Zero if undecided, nonzero if a rule matched.
101 * Use: Checks an address against an ACL.
104 extern int acl_check(acl_entry */
*a*/
,
105 struct in_addr
/*addr*/, unsigned /*port*/,
108 /* --- @acl_dump@ --- *
110 * Arguments: @acl_entry *a@ = pointer to ACL to dump
111 * @FILE *fp@ = pointer to stream to dump on
115 * Use: Dumps an access control list to an output stream.
118 extern void acl_dump(acl_entry */
*a*/
, FILE */
*fp*/
);
120 /* --- @acl_free@ --- *
122 * Arguments: @acl_entry *a@ = pointer to a list of ACLs
126 * Use: Frees all of the memory used by an ACL.
129 extern void acl_free(acl_entry */
*a*/
);
131 /* --- @acl_addhost@ --- *
133 * Arguments: @acl_entry ***a@ = address of pointer to list tail
134 * @unsigned act@ = what to do with matching addresses
135 * @struct in_addr addr, mask@ = address and mask to match
139 * Use: Adds a host-authentication entry to the end of an access
143 extern void acl_addhost(acl_entry
***/
*a*/
, unsigned /*act*/,
144 struct in_addr
/*addr*/, struct in_addr
/*mask*/);
146 /* --- @acl_addpriv@ --- *
148 * Arguments: @acl_entry ***a@ = address of pointer to list tail
149 * @unsigned act@ = what to do with matching addresses
153 * Use: Adds a privileged-port check to the end of an access control
157 extern void acl_addpriv(acl_entry
***/
*a*/
, unsigned /*act*/);
159 /*----- That's all, folks -------------------------------------------------*/