acl.h 2.03 KB
Newer Older
1
/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
2 3 4 5 6 7 8 9 10 11 12 13

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
14
    along with this program.  If not, see <https://www.gnu.org/licenses/>.
15
 */
16

17
#pragma once
18

Daniel Salzman's avatar
Daniel Salzman committed
19
#include <stdbool.h>
20 21
#include <sys/socket.h>

Daniel Salzman's avatar
Daniel Salzman committed
22
#include "libknot/tsig.h"
23
#include "knot/conf/conf.h"
24

25 26
/*! \brief ACL actions. */
typedef enum {
27 28 29
	ACL_ACTION_NONE     = 0,
	ACL_ACTION_NOTIFY   = 1,
	ACL_ACTION_TRANSFER = 2,
30
	ACL_ACTION_UPDATE   = 3
31
} acl_action_t;
32

33 34 35 36 37 38 39 40 41 42 43 44 45 46 47
/*! \brief ACL update owner matching options. */
typedef enum {
	ACL_UPDATE_OWNER_NONE = 0,
	ACL_UPDATE_OWNER_KEY  = 1,
	ACL_UPDATE_OWNER_ZONE = 2,
	ACL_UPDATE_OWNER_NAME = 3,
} acl_update_owner_t;

/*! \bref ACL update owner comparison options. */
typedef enum {
	ACL_UPDATE_MATCH_SUBEQ = 0,
	ACL_UPDATE_MATCH_EQ    = 1,
	ACL_UPDATE_MATCH_SUB   = 2,
} acl_update_owner_match_t;

48
/*!
49 50
 * \brief Checks if the address and/or tsig key matches given ACL list.
 *
51
 * If a proper ACL rule is found and tsig.name is not empty, tsig.secret is filled.
52
 *
53 54 55 56 57 58 59
 * \param conf       Configuration.
 * \param acl        Pointer to ACL config multivalued identifier.
 * \param action     ACL action.
 * \param addr       IP address.
 * \param tsig       TSIG parameters.
 * \param zone_name  Zone name.
 * \param query      Update query.
60
 *
61
 * \retval True if authenticated.
62
 */
63
bool acl_allowed(conf_t *conf, conf_val_t *acl, acl_action_t action,
64 65
                 const struct sockaddr_storage *addr, knot_tsig_key_t *tsig,
                 const knot_dname_t *zone_name, knot_pkt_t *query);