389-ds-base/include/libaccess/aclstruct.h

/** BEGIN COPYRIGHT BLOCK
 * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
 * Copyright (C) 2005 Red Hat, Inc.
 * All rights reserved.
 *
 * License: GPL (version 3 or any later version).
 * See LICENSE for details.
 * END COPYRIGHT BLOCK **/

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#ifndef __aclstruct_h
#define __aclstruct_h

/*
 * Description (aclstruct.h)
 *
 *    This file defines types and data structures used to construct
 *    representations of Access Control Lists (ACLs) in memory.
 */

#include "base/systems.h"
#include "base/file.h"
#include "nsauth.h"    /* authentication types */
#include "symbols.h"   /* typed symbol support */
#include "ipfstruct.h" /* IP address filter structures */
#include "dnfstruct.h" /* DNS name filter structures */


NSPR_BEGIN_EXTERN_C

/* Forward type definitions */
typedef struct ACL_s ACL_t;

/*
 * Description (InetHost_t)
 *
 *    This type defines a structure which represents a list of Internet
 *    hosts by IP address and netmask, or by fully or partially
 *    qualified DNS name.
 */

typedef struct InetHost_s InetHost_t;
struct InetHost_s
{
    IPFilter_t inh_ipf;  /* reference to IP filter */
    DNSFilter_t inh_dnf; /* reference to DNS filter */
};

/*
 * Description (HostSpec_t)
 *
 *    This type describes a named list of hosts.
 */

typedef struct HostSpec_s HostSpec_t;
struct HostSpec_s
{
    Symbol_t hs_sym;    /* symbol name, type ACLSYMHOST */
    InetHost_t hs_host; /* host information */
};

/*
 * Description (UidUser_t)
 *
 *    This type represents a list of users and groups using unique
 *    integer identifiers.
 */

typedef struct UidUser_s UidUser_t;
struct UidUser_s
{
    USIList_t uu_user;  /* list of user ids */
    USIList_t uu_group; /* list of group ids */
};

/*
 * Description (UserSpec_t)
 *
 *    This type describes a named list of users and groups.
 */

typedef struct UserSpec_s UserSpec_t;
struct UserSpec_s
{
    Symbol_t us_sym;  /* list name, type ACLSYMUSER */
    int us_flags;     /* bit flags */
#define ACL_USALL 0x1 /* any authenticated user */

    UidUser_t us_user; /* user list structure */
};

/*
 * Description (ACClients_t)
 *
 *    This type defines the structure of action-specific information
 *    for access control directives with action codes ACD_ALLOW and
 *    ACD_DENY.  These directives specify access control constraints
 *    on users/groups and hosts.
 */

typedef struct ACClients_s ACClients_t;
struct ACClients_s
{
    ACClients_t *cl_next; /* list link */
    HostSpec_t *cl_host;  /* host specification pointer */
    UserSpec_t *cl_user;  /* user list pointer */
};

/*
 * Description (RealmSpec_t)
 *
 *    This type describes a named realm.
 */

typedef struct RealmSpec_s RealmSpec_t;
struct RealmSpec_s
{
    Symbol_t rs_sym;  /* realm name, type ACLSYMREALM */
    Realm_t rs_realm; /* realm information */
};

/*
 * Description (ACAuth_t)
 *
 *    This type defines the structure of action-specific information
 *    for an access control directive with action code ACD_AUTH,
 *    which specifies information about authentication requirements.
 */

typedef struct ACAuth_s ACAuth_t;
struct ACAuth_s
{
    RealmSpec_t *au_realm; /* pointer to realm information */
};

/*
 * Description (ACDirective_t)
 *
 *    This type defines a structure which represents an access control
 *    directive.  Each directive specifies an access control action
 *    to be taken during ACL evaluation.  The ACDirective_t structure
 *    begins an action-specific structure which contains the
 *    parameters for an action.
 */

typedef struct ACDirective_s ACDirective_t;
struct ACDirective_s
{
    ACDirective_t *acd_next; /* next directive in ACL */
    short acd_action;        /* directive action code */
    short acd_flags;         /* action modifier flags */

    /* Begin action-specific information */
    union
    {
        ACClients_t *acu_cl; /* ACD_ALLOW, ACD_DENY */
        ACAuth_t acu_auth;   /* ACD_AUTH */
    } acd_u;
};

#define acd_cl acd_u.acu_cl
#define acd_auth acd_u.acu_auth

/* Define acd_action codes */
#define ACD_ALLOW 1 /* allow access */
#define ACD_DENY 2  /* deny access */
#define ACD_AUTH 3  /* specify authentication realm */
#define ACD_EXEC 4  /* execute (conditionally) */

/* Define acd_flags values */
#define ACD_ACTION 0xf       /* bits reserved for acd_action */
#define ACD_FORCE 0x10       /* force of action */
#define ACD_DEFAULT 0        /* default action */
#define ACD_ALWAYS ACD_FORCE /* immediate action */
#define ACD_EXALLOW 0x20     /* execute if allow */
#define ACD_EXDENY 0x40      /* execute if deny */
#define ACD_EXAUTH 0x80      /* execute if authenticate */

/*
 * Description (RightDef_t)
 *
 *    This type describes a named access right.  Each access right has
 *    an associated unique integer id.  A list of all access rights
 *    known in an ACL context is maintained, with its head in the
 *    ACContext_t structure.
 */

typedef struct RightDef_s RightDef_t;
struct RightDef_s
{
    Symbol_t rd_sym;     /* right name, type ACLSYMRIGHT */
    RightDef_t *rd_next; /* next on ACContext_t list */
    USI_t rd_id;         /* unique id */
};

/*
 * Description (RightSpec_t)
 *
 *    This type describes a named list of access rights.
 */

typedef struct RightSpec_s RightSpec_t;
struct RightSpec_s
{
    Symbol_t rs_sym;   /* list name, type ACLSYMRDEF */
    USIList_t rs_list; /* list of right ids */
};

/*
 * Description (ACContext_t)
 *
 *    This type defines a structure that defines a context for a set
 *    of Access Control Lists.  This includes references to an
 *    authentication database, if any, and a symbol table containing
 *    access right definitions.  It also serves as a list head for the
 *    ACLs which are defined in the specified context.
 */

typedef struct ACContext_s ACContext_t;
struct ACContext_s
{
    void *acc_stp;          /* symbol table handle */
    ACL_t *acc_acls;        /* list of ACLs */
    RightDef_t *acc_rights; /* list of access right definitions */
    int acc_refcnt;         /* reference count */
};

/*
 * Description (ACL_t)
 *
 *    This type defines the structure that represents an Access Control
 *    List (ACL).  An ACL has a user-assigned name and an internally
 *    assigned identifier (which is an index in an object directory).
 *    It references a list of access rights which are to be allowed or
 *    denied, according to the ACL specifications.  It references an
 *    ordered list of ACL directives, which specify who has and who does
 *    not have the associated access rights.
 */

struct ACL_s
{
    Symbol_t acl_sym;        /* ACL name, type ACLSYMACL */
    ACL_t *acl_next;         /* next ACL on a list */
    ACContext_t *acl_acc;    /* context for this ACL */
    USI_t acl_id;            /* id of this ACL */
    int acl_refcnt;          /* reference count */
    RightSpec_t *acl_rights; /* access rights list */
    ACDirective_t *acl_dirf; /* first directive pointer */
    ACDirective_t *acl_dirl; /* last directive pointer */
};

/* Define symbol type codes */
#define ACLSYMACL 0   /* ACL */
#define ACLSYMRIGHT 1 /* access right */
#define ACLSYMRDEF 2  /* access rights list */
#define ACLSYMREALM 3 /* realm name */
#define ACLSYMHOST 4  /* host specifications */
#define ACLSYMUSER 5  /* user/group list */

/*
 * Description (ACLFile_t)
 *
 *    This type describes a structure containing information about
 *    an open ACL description file.
 */

typedef struct ACLFile_s ACLFile_t;
struct ACLFile_s
{
    ACLFile_t *acf_next; /* list link */
    char *acf_filename;  /* pointer to filename string */
    SYS_FILE acf_fd;     /* file descriptor */
    int acf_flags;       /* bit flags (unused) */
    int acf_lineno;      /* current line number */
    void *acf_token;     /* LEX token handle */
    int acf_ttype;       /* current token type */
};

NSPR_END_EXTERN_C

#endif /* __aclstruct_h */