rbac_acl.h

Go to the documentation of this file.

// Copyright (C) 2026 Internet Systems Consortium, Inc. ("ISC")
//
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
#ifndef RBAC_ACL_H
#define RBAC_ACL_H
 
#include <cc/data.h>
#include <exceptions/exceptions.h>
 
#include <list>
#include <map>
#include <set>
#include <string>
 
#include <boost/shared_ptr.hpp>
 
#include <rbac/rbac_api.h>
 
namespace isc {
namespace rbac {

class Acl;

typedef boost::shared_ptr<Acl> AclPtr;

typedef std::list<AclPtr> AclList;

typedef std::map<std::string, AclPtr> AclTable;

class Acl {
public:

    Acl(const std::string& name) : name_(name) {
        if (name.empty()) {
            isc_throw(Unexpected, "empty access control list name");
        }
    };

    virtual ~Acl() = default;

    std::string getClassName() const {
        return (name_);
    }

    virtual bool match(const std::string& command) = 0;

    static void initTable();

    static AclPtr parse(data::ConstElementPtr cfg);

    static AclList parseList(data::ConstElementPtr cfg);
 
protected:
    std::string name_;
};

class AliasAcl : public Acl {
public:

    AliasAcl(const std::string& name, const AclPtr& acl)
        : Acl("alias"), name_(name), acl_(acl) {
        if (!acl) {
            isc_throw(Unexpected, "null acl in alias");
        }
    }

    virtual bool match(const std::string& command) final {
        return (acl_->match(command));
    }

    std::string getName() const {
        return (name_);
    }

    const AclPtr& getAcl() const {
        return (acl_);
    }

    static void parse(data::ConstElementPtr def);
 
private:
    std::string name_;

    AclPtr acl_;
};


class NotAcl : public Acl {
public:

    NotAcl(const AclPtr& acl) : Acl("not"), acl_(acl) {
        if (!acl) {
            isc_throw(Unexpected, "null acl in not");
        }
    }

    virtual bool match(const std::string& command) final {
        return (!acl_->match(command));
    }

    const AclPtr& getAcl() const {
        return (acl_);
    }
 
private:
    AclPtr acl_;
};

class AndAcl : public Acl {
public:

    AndAcl(const AclList& acls) : Acl("and"), acls_(acls) {
        for (const AclPtr& acl : acls) {
            if (!acl) {
                isc_throw(Unexpected, "null acl in and");
            }
        }
    }

    void add(const AclPtr& acl) {
        if (!acl) {
            isc_throw(Unexpected, "add null acl in and");
        }
        acls_.push_back(acl);
    }

    virtual bool match(const std::string& command) final {
        for (const AclPtr& acl : acls_) {
            if (!acl->match(command)) {
                return (false);
            }
        }
        return (true);
    }

    const AclList& getAcls() const {
        return (acls_);
    }
 
private:
    AclList acls_;
};

class OrAcl : public Acl {
public:

    OrAcl(const AclList& acls) : Acl("or"), acls_(acls) {
        for (const AclPtr& acl : acls) {
            if (!acl) {
                isc_throw(Unexpected, "null acl in or");
            }
        }
    }

    void add(const AclPtr& acl) {
        if (!acl) {
            isc_throw(Unexpected, "add null acl in or");
        }
        acls_.push_back(acl);
    }

    virtual bool match(const std::string& command) final {
        for (const AclPtr& acl : acls_) {
            if (acl->match(command)) {
                return (true);
            }
        }
        return (false);
    }

    const AclList& getAcls() const {
        return (acls_);
    }
 
private:
    AclList acls_;
};

class AllAcl : public Acl {
public:

    AllAcl() : Acl("all") {
    }

    virtual bool match(const std::string&) final {
        return (true);
    }
};

class NoneAcl : public Acl {
public:

    NoneAcl() : Acl("none") {
    }

    virtual bool match(const std::string&) final {
        return (false);
    }
};

class CommandsAcl : public Acl {
public:

    CommandsAcl(const std::set<std::string>& commands)
        : Acl("commands"), commands_(commands) {
    }

    void add(const std::string& command) {
        // Insert an already existing member is a noop.
        static_cast<void>(commands_.insert(command));
    }

    virtual bool match(const std::string& command) final {
        return (commands_.count(command) != 0);
    }

    const std::set<std::string>& getCommands() const {
        return (commands_);
    }
 
private:
    std::set<std::string> commands_;
};

class AccessAcl : public Acl {
public:

    AccessAcl(const std::string& access) : Acl("access"), access_(access) {
    }

    virtual bool match(const std::string& command) final {
        ApiPtr api(Api::getApiByName(command));
        return (api && (api->getAccess() == access_));
    }

    std::string getAccess() const {
        return (access_);
    }
 
private:
    std::string access_;
};

class HookAcl : public Acl {
public:

    HookAcl(const std::string& hook) : Acl("hook"), hook_(hook) {
    }

    virtual bool match(const std::string& command) final {
        ApiPtr api(Api::getApiByName(command));
        return (api && (api->getHook() == hook_));
    }

    std::string getHook() const {
        return (hook_);
    }
 
private:
    std::string hook_;
};

extern AclTable aclTable;
 
} // end of namespace rbac
} // end of namespace isc
#endif