unbound/daemon/acl_list.h

   1 /*
   2  * daemon/acl_list.h - client access control storage for the server.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file keeps track of the list of clients that are allowed to
  40  * access the server.
  41  */
  42
  43 #ifndef DAEMON_ACL_LIST_H
  44 #define DAEMON_ACL_LIST_H
  45 #include "util/storage/dnstree.h"
  46 struct config_file;
  47 struct regional;
  48
  49 /**
  50  * Enumeration of access control options for an address range.
  51  * Allow or deny access.
  52  */
  53 enum acl_access {
  54         /** disallow any access whatsoever, drop it */
  55         acl_deny = 0,
  56         /** disallow access, send a polite 'REFUSED' reply */
  57         acl_refuse,
  58         /** disallow any access to zones that aren't local, drop it */
  59         acl_deny_non_local,
  60         /** disallow access to zones that aren't local, 'REFUSED' reply */
  61         acl_refuse_non_local,
  62         /** allow full access for recursion (+RD) queries */
  63         acl_allow,
  64         /** allow full access for all queries, recursion and cache snooping */
  65         acl_allow_snoop
  66 };
  67
  68 /**
  69  * Access control storage structure
  70  */
  71 struct acl_list {
  72         /** regional for allocation */
  73         struct regional* region;
  74         /**
  75          * Tree of the addresses that are allowed/blocked.
  76          * contents of type acl_addr.
  77          */
  78         rbtree_t tree;
  79 };
  80
  81 /**
  82  *
  83  * An address span with access control information
  84  */
  85 struct acl_addr {
  86         /** node in address tree */
  87         struct addr_tree_node node;
  88         /** access control on this netblock */
  89         enum acl_access control;
  90 };
  91
  92 /**
  93  * Create acl structure
  94  * @return new structure or NULL on error.
  95  */
  96 struct acl_list* acl_list_create(void);
  97
  98 /**
  99  * Delete acl structure.
 100  * @param acl: to delete.
 101  */
 102 void acl_list_delete(struct acl_list* acl);
 103
 104 /**
 105  * Process access control config.
 106  * @param acl: where to store.
 107  * @param cfg: config options.
 108  * @return 0 on error.
 109  */
 110 int acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg);
 111
 112 /**
 113  * Lookup address to see its access control status.
 114  * @param acl: structure for address storage.
 115  * @param addr: address to check
 116  * @param addrlen: length of addr.
 117  * @return: what to do with message from this address.
 118  */
 119 enum acl_access acl_list_lookup(struct acl_list* acl,
 120         struct sockaddr_storage* addr, socklen_t addrlen);
 121
 122 /**
 123  * Get memory used by acl structure.
 124  * @param acl: structure for address storage.
 125  * @return bytes in use.
 126  */
 127 size_t acl_list_get_mem(struct acl_list* acl);
 128
 129 #endif /* DAEMON_ACL_LIST_H */