1/*
2 * daemon/acl_list.h - client access control storage for the server.
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36/**
37 * \file
38 *
39 * This file keeps track of the list of clients that are allowed to
40 * access the server.
41 */
42
43#ifndef DAEMON_ACL_LIST_H
44#define DAEMON_ACL_LIST_H
45#include "util/storage/dnstree.h"
46#include "services/view.h"
47struct config_file;
48struct regional;
49
50/**
51 * Enumeration of access control options for an address range.
52 * Allow or deny access.
53 */
54enum acl_access {
55	/** disallow any access whatsoever, drop it */
56	acl_deny = 0,
57	/** disallow access, send a polite 'REFUSED' reply */
58	acl_refuse,
59	/** disallow any access to zones that aren't local, drop it */
60	acl_deny_non_local,
61	/** disallow access to zones that aren't local, 'REFUSED' reply */
62	acl_refuse_non_local,
63	/** allow full access for recursion (+RD) queries */
64	acl_allow,
65	/** allow full access for all queries, recursion and cache snooping */
66	acl_allow_snoop,
67	/** allow full access for recursion queries and set RD flag regardless
68	 *  of request */
69	acl_allow_setrd,
70	/** allow full access for recursion (+RD) queries if valid cookie
71	 *  present or stateful transport */
72	acl_allow_cookie
73};
74
75/**
76 * Access control storage structure
77 */
78struct acl_list {
79	/** regional for allocation */
80	struct regional* region;
81	/**
82	 * Tree of the addresses that are allowed/blocked.
83	 * contents of type acl_addr.
84	 */
85	rbtree_type tree;
86};
87
88/**
89 *
90 * An address span with access control information
91 */
92struct acl_addr {
93	/** node in address tree */
94	struct addr_tree_node node;
95	/** access control on this netblock */
96	enum acl_access control;
97	/** tag bitlist */
98	uint8_t* taglist;
99	/** length of the taglist (in bytes) */
100	size_t taglen;
101	/** array per tagnumber of localzonetype(in one byte). NULL if none. */
102	uint8_t* tag_actions;
103	/** size of the tag_actions_array */
104	size_t tag_actions_size;
105	/** array per tagnumber, with per tag a list of rdata strings.
106	 * NULL if none.  strings are like 'A 127.0.0.1' 'AAAA ::1' */
107	struct config_strlist** tag_datas;
108	/** size of the tag_datas array */
109	size_t tag_datas_size;
110	/* view element, NULL if none */
111	struct view* view;
112};
113
114/**
115 * Create acl structure
116 * @return new structure or NULL on error.
117 */
118struct acl_list* acl_list_create(void);
119
120/**
121 * Delete acl structure.
122 * @param acl: to delete.
123 */
124void acl_list_delete(struct acl_list* acl);
125
126/**
127 * Insert interface in the acl_list. This should happen when the listening
128 * interface is setup.
129 * @param acl_interface: acl_list to insert to.
130 * @param addr: interface IP.
131 * @param addrlen: length of the interface IP.
132 * @param control: acl_access.
133 * @return new structure or NULL on error.
134 */
135struct acl_addr*
136acl_interface_insert(struct acl_list* acl_interface,
137	struct sockaddr_storage* addr, socklen_t addrlen,
138	enum acl_access control);
139
140/**
141 * Process access control config.
142 * @param acl: where to store.
143 * @param cfg: config options.
144 * @param v: views structure
145 * @return 0 on error.
146 */
147int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg,
148	struct views* v);
149
150/** compare ACL interface "addr_tree" nodes (+port) */
151int acl_interface_compare(const void* k1, const void* k2);
152
153/**
154 * Initialise (also clean) the acl_interface struct.
155 * @param acl_interface: where to store.
156 */
157void acl_interface_init(struct acl_list* acl_interface);
158
159/**
160 * Process interface control config.
161 * @param acl_interface: where to store.
162 * @param cfg: config options.
163 * @param v: views structure
164 * @return 0 on error.
165 */
166int acl_interface_apply_cfg(struct acl_list* acl_interface, struct config_file* cfg,
167	struct views* v);
168
169/**
170 * Lookup access control status for acl structure.
171 * @param acl: structure for acl storage.
172 * @return: what to do with message from this address.
173 */
174enum acl_access acl_get_control(struct acl_addr* acl);
175
176/**
177 * Lookup address to see its acl structure
178 * @param acl: structure for address storage.
179 * @param addr: address to check
180 * @param addrlen: length of addr.
181 * @return: acl structure from this address.
182 */
183struct acl_addr*
184acl_addr_lookup(struct acl_list* acl, struct sockaddr_storage* addr,
185        socklen_t addrlen);
186
187/**
188 * Get memory used by acl structure.
189 * @param acl: structure for address storage.
190 * @return bytes in use.
191 */
192size_t acl_list_get_mem(struct acl_list* acl);
193
194/*
195 * Get string for acl access specification
196 * @param acl: access type value
197 * @return string
198 */
199const char* acl_access_to_str(enum acl_access acl);
200
201/* log acl and addr for action */
202void log_acl_action(const char* action, struct sockaddr_storage* addr,
203	socklen_t addrlen, enum acl_access acl, struct acl_addr* acladdr);
204
205#endif /* DAEMON_ACL_LIST_H */
206