From e0fc82203d677a6f1e808e9a1a46176c109d89be Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Mon, 15 Dec 2014 23:08:59 +0000 Subject: Initial commit --- doc/libs6net/accessrules.html | 331 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 331 insertions(+) create mode 100644 doc/libs6net/accessrules.html (limited to 'doc/libs6net/accessrules.html') diff --git a/doc/libs6net/accessrules.html b/doc/libs6net/accessrules.html new file mode 100644 index 0000000..ea996b7 --- /dev/null +++ b/doc/libs6net/accessrules.html @@ -0,0 +1,331 @@ + + + + + s6-networking: the accessrules library interface + + + + + + +

+libs6net
+s6-networking
+Software
+skarnet.org +

+ +

The accessrules library interface

+ +

+ The following functions and structures are declared in the s6-networking/accessrules.h header, +and implemented in the libs6net.a or libs6net.so library. +

+ +

General information

+ +

+ s6net_accessrules is an access control library. It looks up +a key in a user-specified database, then returns a code depending on +whether the database allows access (in which case additional information +can also be returned), denies access, or does not contain the key. +

+ +

+ accessrules has been designed to be easily extensible to any +database format and any key format. +

+ +

+ Check the s6-networking/accessrules.h header for the exact definitions. +

+ +

Data structures

+ + + +

Function types

+ +

Backend lookups

+ +

+ A s6net_accessrules_backend_func_t is the type of a function +that takes a single key, looks it up in a database, and returns the result. +Namely: +

+ +

+s6net_accessrules_result_t f (char const *key, unsigned int keylen, void *handle, s6net_accessrules_params_t *params) +

+ +

+ f looks up key key of length keylen in the database +represented by handle in an implementation-defined way. It returns a +number that says the key has been allowed, denied or not found, or an error +occurred. If the key has been allowed, f stores additional information +from the database into *params. +

+ +

+ Two s6net_accessrules_backend_func_t functions are natively implemented: +

+ + + +

Frontend key checking

+ +

+ A s6net_accessrules_keycheck_func_t is the type of a function that +takes a user-level key, makes a list of corresponding backend-level keys and +calls a s6net_accessrules_backend_func_t function until it finds +a match. Namely: +

+ +

+s6net_accessrules_result_t f (void const *key, void *handle, s6net_accessrules_params_t *params, s6net_accessrules_backend_func_t *backend) +

+ +

+ f derives a list of low-level keys to check from key. +Then, for each key k of length klen in this list, it calls +(*backend)(k, klen, handle, params), returning *backend's result if it +is not S6NET_ACCESSRULES_NOTFOUND. If no match can be found in the whole list, +f finally returns S6NET_ACCESSRULES_NOTFOUND. +

+ +

+ Five s6net_accessrules_keycheck_func_t functions are natively implemented: +

+ + + +

Ready-to-use functions

+ + Those functions are mostly macros; they're built by associating a frontend +function with a backend function. + +

+ s6net_accessrules_result_t s6net_accessrules_uidgid_cdb +(unsigned int u, unsigned int g, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for uid u +and gid g. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_uidgid_fs +(unsigned int u, unsigned int g, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for uid u +and gid g. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_reversedns_cdb +(char const *name, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +name FQDN. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_reversedns_fs +(char const *name, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +name FQDN. If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip4_cdb +(char const *ip4, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +ip4 IPv4 address (4 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip4_fs +(char const *ip4, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +ip4 IPv4 address (4 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip6_cdb +(char const *ip6, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +ip6 IPv6 address (16 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip6_fs +(char const *ip6, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +ip6 IPv6 address (16 network byte order characters). +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip46_cdb +(ip46_t *ip, struct cdb *c, +s6net_accessrules_params_t *params)
+Checks the *c CDB database for an authorization for the +ip IP address. +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ +

+ s6net_accessrules_result_t s6net_accessrules_ip46_fs +(ip46_t const *ip, char const *dir, +s6net_accessrules_params_t *params)
+Checks the dir base directory for an authorization for the +ip IP address. +If the result is S6NET_ACCESSRULES_ALLOW, additional +information may be stored into params. +

+ + + -- cgit v1.2.3