ipa_hbac  1.14.2
src/lib/ipa_hbac/ipa_hbac.h
00001 /*
00002     SSSD
00003 
00004     IPA Backend Module -- Access control
00005 
00006     Authors:
00007         Sumit Bose <sbose@redhat.com>
00008         Stephen Gallagher <sgallagh@redhat.com>
00009 
00010     Copyright (C) 2009 Red Hat
00011 
00012     This program is free software; you can redistribute it and/or modify
00013     it under the terms of the GNU General Public License as published by
00014     the Free Software Foundation; either version 3 of the License, or
00015     (at your option) any later version.
00016 
00017     This program is distributed in the hope that it will be useful,
00018     but WITHOUT ANY WARRANTY; without even the implied warranty of
00019     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00020     GNU General Public License for more details.
00021 
00022     You should have received a copy of the GNU General Public License
00023     along with this program.  If not, see <http://www.gnu.org/licenses/>.
00024 */
00025 
00026 #ifndef IPA_HBAC_H_
00027 #define IPA_HBAC_H_
00028 
00040 #include <stdint.h>
00041 #include <stdbool.h>
00042 #include <time.h>
00043 
00045 enum hbac_debug_level {
00046     HBAC_DBG_FATAL,     
00047     HBAC_DBG_ERROR,     
00048     HBAC_DBG_WARNING,   
00049     HBAC_DBG_INFO,      
00050     HBAC_DBG_TRACE      
00051 };
00052 
00053 #ifdef HAVE_FUNCTION_ATTRIBUTE_FORMAT
00054 #define HBAC_ATTRIBUTE_PRINTF(a1, a2) __attribute__((format(printf, a1, a2)))
00055 #else
00056 #define HBAC_ATTRIBUTE_PRINTF(a1, a2)
00057 #endif
00058 
00062 typedef void (*hbac_debug_fn_t)(const char *file, int line,
00063                                 const char *function,
00064                                 enum hbac_debug_level, const char *format,
00065                                 ...) HBAC_ATTRIBUTE_PRINTF(5, 6);
00066 
00071 void hbac_enable_debug(hbac_debug_fn_t external_debug_fn);
00072 
00074 enum hbac_eval_result {
00078     HBAC_EVAL_ERROR = -1,
00079 
00081     HBAC_EVAL_ALLOW,
00082 
00084     HBAC_EVAL_DENY,
00085 
00089     HBAC_EVAL_OOM
00090 };
00091 
00095 #define HBAC_CATEGORY_NULL 0x0000
00096 
00100 #define HBAC_CATEGORY_ALL  0x0001
00101 
00105 struct hbac_time_rules;
00106 
00113 struct hbac_rule_element {
00121     uint32_t category;
00122 
00130     const char **names;
00131 
00139     const char **groups;
00140 };
00141 
00145 struct hbac_rule {
00146     const char *name;
00147     bool enabled;
00148 
00153     struct hbac_rule_element *services;
00154 
00159     struct hbac_rule_element *users;
00160 
00164     struct hbac_rule_element *targethosts;
00165 
00169     struct hbac_rule_element *srchosts;
00170 
00174     struct hbac_time_rules *timerules;
00175 };
00176 
00180 struct hbac_request_element {
00188     const char *name;
00189 
00197     const char **groups;
00198 };
00199 
00205 struct hbac_eval_req {
00211     struct hbac_request_element *service;
00212 
00218     struct hbac_request_element *user;
00219 
00225     struct hbac_request_element *targethost;
00226 
00232     struct hbac_request_element *srchost;
00233 
00235     time_t request_time;
00236 };
00237 
00241 enum hbac_error_code {
00243     HBAC_ERROR_UNKNOWN = -1,
00244 
00246     HBAC_SUCCESS,
00247 
00249     HBAC_ERROR_NOT_IMPLEMENTED,
00250 
00252     HBAC_ERROR_OUT_OF_MEMORY,
00253 
00255     HBAC_ERROR_UNPARSEABLE_RULE
00256 };
00257 
00259 struct hbac_info {
00265     enum hbac_error_code code;
00266 
00271     char *rule_name;
00272 };
00273 
00274 
00288 enum hbac_eval_result hbac_evaluate(struct hbac_rule **rules,
00289                                     struct hbac_eval_req *hbac_req,
00290                                     struct hbac_info **info);
00291 
00297 const char *hbac_result_string(enum hbac_eval_result result);
00298 
00304 const char *hbac_error_string(enum hbac_error_code code);
00305 
00310 void hbac_free_info(struct hbac_info *info);
00311 
00313 #define HBAC_RULE_ELEMENT_USERS       0x01
00314 
00316 #define HBAC_RULE_ELEMENT_SERVICES    0x02
00317 
00319 #define HBAC_RULE_ELEMENT_TARGETHOSTS 0x04
00320 
00322 #define HBAC_RULE_ELEMENT_SOURCEHOSTS 0x08
00323 
00339 bool hbac_rule_is_complete(struct hbac_rule *rule, uint32_t *missing_attrs);
00340 
00344 #endif /* IPA_HBAC_H_ */