cryptlib  3.4.1
 All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Properties Macros
acl_perm.h
Go to the documentation of this file.
1 /****************************************************************************
2 * *
3 * ACL Permission Definitions *
4 * Copyright Peter Gutmann 1997-2005 *
5 * *
6 ****************************************************************************/
7 
8 #ifndef _ACL_PERM_DEFINED
9 
10 #define _ACL_PERM_DEFINED
11 
12 /****************************************************************************
13 * *
14 * Access Permission Flags *
15 * *
16 ****************************************************************************/
17 
18 /* Read/write/delete permission flags. Each object can have two modes, "low"
19  and "high", whose exact definition depends on the object type. At some
20  point an operation on an object (loading a key for a context, signing a
21  cert) will move it from the low to the high state, at which point a much
22  more restrictive set of permissions apply. The permissions are given as
23  RWD_RWD with the first set being for the object in the high state and the
24  second for the object in the low state.
25 
26  In addition to the usual external-access permssions, some attributes are
27  only visible internally. Normal attributes have matching internal-access
28  and external-access permssions but the internal-access-only ones have the
29  external-access permissions turned off.
30 
31  Some of the odder combinations arise from ACLs with sub-ACLs, for which
32  the overall access permission is the union of the permissions in all the
33  sub-ACLs. For example if one sub-ACL has xxx_RWx and another has xWD_xxx,
34  the parent ACL will have xWD_RWx. Finally, there are a small number of
35  special-case permissions in which internal access differs from external
36  access. This is used for attributes that are used for control purposes
37  (e.g. identifier information in cert requests) and can be set internally
38  but are read-only externally.
39 
40  Internal low ----++---- External high
41  Internal high --+||+--- External low */
42 #define ACCESS_xxx_xxx 0x0000 /* No access */
43 #define ACCESS_xxx_xWx 0x0202 /* Low: Write-only */
44 #define ACCESS_xxx_xWD 0x0303 /* Low: Write/delete */
45 #define ACCESS_xxx_Rxx 0x0404 /* Low: Read-only */
46 #define ACCESS_xxx_RWx 0x0606 /* Low: Read/write */
47 #define ACCESS_xxx_RWD 0x0707 /* Low: All access */
48 #define ACCESS_xWx_xWx 0x2222 /* High: Write-only, Low: Write-only */
49 #define ACCESS_xWD_xWD 0x3333 /* High: Write/delete, Low: Write/delete */
50 #define ACCESS_xWx_xxx 0x2020 /* High: Write-only, Low: None */
51 #define ACCESS_Rxx_xxx 0x4040 /* High: Read-only, Low: None */
52 #define ACCESS_Rxx_xWx 0x4242 /* High: Read-only, Low: Write-only */
53 #define ACCESS_Rxx_Rxx 0x4444 /* High: Read-only, Low: Read-only */
54 #define ACCESS_Rxx_RxD 0x4545 /* High: Read-only, Low: Read/delete */
55 #define ACCESS_Rxx_RWx 0x4646 /* High: Read-only, Low: Read/write */
56 #define ACCESS_Rxx_RWD 0x4747 /* High: Read-only, Low: All access */
57 #define ACCESS_RxD_RxD 0x5555 /* High: Read/delete, Low: Read/delete */
58 #define ACCESS_RWx_xxx 0x6060 /* High: Read/write, Low: None */
59 #define ACCESS_RWx_xWx 0x6262 /* High: Read/write, Low: Write-only */
60 #define ACCESS_RWx_Rxx 0x6464 /* High: Read/write, Low: Read-only */
61 #define ACCESS_RWx_RWx 0x6666 /* High: Read/write, Low: Read/write */
62 #define ACCESS_RWx_RWD 0x6767 /* High: Read/write, Low: All access */
63 #define ACCESS_RWD_xxx 0x7070 /* High: All access, Low: None */
64 #define ACCESS_RWD_xWD 0x7373 /* High: All access, Low: Write/delete */
65 #define ACCESS_RWD_RWD 0x7777 /* High: All access, Low: All access */
66 
67 #define ACCESS_INT_xxx_xxx 0x0000 /* Internal: No access */
68 #define ACCESS_INT_xxx_xWx 0x0200 /* Internal: None, write-only */
69 #define ACCESS_INT_xxx_Rxx 0x0400 /* Internal: None, read-only */
70 #define ACCESS_INT_xWx_xxx 0x2000 /* Internal: Write-only, none */
71 #define ACCESS_INT_xWx_xWx 0x2200 /* Internal: Write-only, write-only */
72 #define ACCESS_INT_Rxx_xxx 0x4000 /* Internal: Read-only, none */
73 #define ACCESS_INT_Rxx_xWx 0x4200 /* Internal: Read-only, write-only */
74 #define ACCESS_INT_Rxx_Rxx 0x4400 /* Internal: Read-only, read-only */
75 #define ACCESS_INT_Rxx_RWx 0x4600 /* Internal: Read-only, read/write */
76 #define ACCESS_INT_RWx_xxx 0x6000 /* Internal: Read/write, none */
77 #define ACCESS_INT_RWx_xWx 0x6200 /* Internal: Read/write, write-only */
78 #define ACCESS_INT_RWx_RWx 0x6600 /* Internal: Read/write, read/write */
79 
80 #define ACCESS_SPECIAL_Rxx_RWx_Rxx_Rxx \
81  0x4644 /* Internal = Read-only, read/write,
82  External = Read-only, read-only */
83 #define ACCESS_SPECIAL_Rxx_RWD_Rxx_Rxx \
84  0x4744 /* Internal = Read-only, all access,
85  External = Read-only, read-only */
86 
87 #define ACCESS_FLAG_x 0x0000 /* No access permitted */
88 #define ACCESS_FLAG_R 0x0004 /* Read access permitted */
89 #define ACCESS_FLAG_W 0x0002 /* Write access permitted */
90 #define ACCESS_FLAG_D 0x0001 /* Delete access permitted */
91 #define ACCESS_FLAG_H_R 0x0040 /* Read access permitted in high mode */
92 #define ACCESS_FLAG_H_W 0x0020 /* Write access permitted in high mode */
93 #define ACCESS_FLAG_H_D 0x0010 /* Delete access permitted in high mode */
94 
95 #define ACCESS_MASK_EXTERNAL 0x0077 /* External-access flags mask */
96 #define ACCESS_MASK_INTERNAL 0x7700 /* Internal-access flags mask */
97 
98 #define MK_ACCESS_INTERNAL( value ) ( ( value ) << 8 )
99 
100 /* The basic RWD access flags above are also used for checking some
101  parameters passed with keyset mechanism messages, however in addition to
102  these we have flags for getFirst/getNext functions that are only used
103  with keysets. Note that although these partially overlap with the high-
104  mode access flags for attributes this isn't a problem since keysets don't
105  distinguish between high and low states. In addition some of the
106  combinations may seem a bit odd, but that's because they're for mechanism
107  parameters such as key ID information which is needed for reads and
108  deletes but not writes, since it's implicitly included with the key which
109  is being written. Finally, one type of mechanism has parameter semantics
110  that are too complex to express via a simple ACL entry, these are given a
111  different-looking ACL entry xxXXxx to indicate to readers that this isn't
112  the same as a normal entry with the same value. In addition to this, the
113  semantics of some of the getFirst/Next accesses are complex enough that
114  we need to hardcode them into the ACL checking, leaving only a
115  representative entry on the ACL definition itself (see key_acl.c for more
116  details) */
117 
118 #define ACCESS_KEYSET_xxxxx 0x0000 /* No access */
119 #define ACCESS_KEYSET_xxXXx 0x0006 /* Special-case values (params optional) */
120 #define ACCESS_KEYSET_xxRxD 0x0005 /* Read and delete */
121 #define ACCESS_KEYSET_xxRWx 0x0006 /* Read/write */
122 #define ACCESS_KEYSET_xxRWD 0x0007 /* Read/write and delete */
123 #define ACCESS_KEYSET_FxRxD 0x0015 /* GetFirst, read, and delete */
124 #define ACCESS_KEYSET_FNxxx 0x0018 /* GetFirst/Next */
125 #define ACCESS_KEYSET_FNRWD 0x001F /* All access */
126 
127 #define ACCESS_FLAG_F 0x0010 /* GetFirst access permitted */
128 #define ACCESS_FLAG_N 0x0008 /* GetNext access permitted */
129 
130 /****************************************************************************
131 * *
132 * Conditional Access Permission Macros *
133 * *
134 ****************************************************************************/
135 
136 /* Many of cryptlib's capabilities can be selectively disabled, in which
137  case we also disable the use of the attributes that go with them. The
138  following macros take care of this selective disabling */
139 
140 #define MKPERM( perm ) ACCESS_##perm
141 #define MKPERM_INT( perm ) ACCESS_INT_##perm
142 
143 /* Certificate ACL macros */
144 
145 #ifdef USE_CERTIFICATES
146  #define MKPERM_CERTIFICATES( perm ) ACCESS_##perm
147  #define MKPERM_INT_CERTIFICATES( perm ) ACCESS_INT_##perm
148  #define MKPERM_SPECIAL_CERTIFICATES( perm ) ACCESS_SPECIAL_##perm
149 #else
150  #define MKPERM_CERTIFICATES( perm ) ACCESS_xxx_xxx
151  #define MKPERM_INT_CERTIFICATES( perm ) ACCESS_INT_xxx_xxx
152  #define MKPERM_SPECIAL_CERTIFICATES( perm ) ACCESS_xxx_xxx
153 #endif /* USE_CERTIFICATES */
154 
155 #ifdef USE_CERTREQ
156  #define MKPERM_CERTREQ( perm ) ACCESS_##perm
157  #define MKPERM_INT_CERTREQ( perm ) ACCESS_INT_##perm
158 #else
159  #define MKPERM_CERTREQ( perm ) ACCESS_xxx_xxx
160  #define MKPERM_INT_CERTREQ( perm ) ACCESS_INT_xxx_xxx
161 #endif /* USE_CERTREQ */
162 
163 #ifdef USE_CERTREV
164  #define MKPERM_CERTREV( perm ) ACCESS_##perm
165  #define MKPERM_INT_CERTREV( perm ) ACCESS_INT_##perm
166 #else
167  #define MKPERM_CERTREV( perm ) ACCESS_xxx_xxx
168  #define MKPERM_INT_CERTREV( perm ) ACCESS_INT_xxx_xxx
169 #endif /* USE_CERTREV */
170 
171 #if defined( USE_CERTREQ ) || defined( USE_CERTREV )
172  #define MKPERM_CERTREQ_REV( perm ) ACCESS_##perm
173 #else
174  #define MKPERM_CERTREQ_REV( perm ) ACCESS_xxx_xxx
175 #endif /* USE_CERTREQ || USE_CERTREV */
176 
177 #ifdef USE_CERTVAL
178  #define MKPERM_CERTVAL( perm ) ACCESS_##perm
179  #define MKPERM_INT_CERTVAL( perm ) ACCESS_INT_##perm
180 #else
181  #define MKPERM_CERTVAL( perm ) ACCESS_xxx_xxx
182  #define MKPERM_INT_CERTVAL( perm ) ACCESS_INT_xxx_xxx
183 #endif /* USE_CERTVAL */
184 
185 #if defined( USE_CERTREV ) || defined( USE_CERTVAL )
186  #define MKPERM_CERTREV_VAL( perm ) ACCESS_##perm
187  #define MKPERM_INT_CERTREV_VAL( perm ) ACCESS_INT_##perm
188 #else
189  #define MKPERM_CERTREV_VAL( perm ) ACCESS_xxx_xxx
190  #define MKPERM_INT_CERTREV_VAL( perm ) ACCESS_INT_xxx_xxx
191 #endif /* USE_CERTREV || USE_CERTVAL */
192 
193 #ifdef USE_CMSATTR
194  #define MKPERM_CMSATTR( perm ) ACCESS_##perm
195  #define MKPERM_INT_CMSATTR( perm ) ACCESS_INT_##perm
196  #define MKPERM_SPECIAL_CMSATTR( perm ) ACCESS_SPECIAL_##perm
197 #else
198  #define MKPERM_CMSATTR( perm ) ACCESS_xxx_xxx
199  #define MKPERM_INT_CMSATTR( perm ) ACCESS_INT_xxx_xxx
200  #define MKPERM_SPECIAL_CMSATTR( perm ) ACCESS_xxx_xxx
201 #endif /* USE_CMSATTR */
202 
203 #ifdef USE_PKIUSER
204  #define MKPERM_PKIUSER( perm ) ACCESS_##perm
205  #define MKPERM_INT_PKIUSER( perm ) ACCESS_INT_##perm
206 #else
207  #define MKPERM_PKIUSER( perm ) ACCESS_xxx_xxx
208  #define MKPERM_INT_PKIUSER( perm ) ACCESS_INT_xxx_xxx
209 #endif /* USE_PKIUSER */
210 
211 #ifdef USE_CERT_OBSOLETE
212  #define MKPERM_CERT_OBSOLETE( perm ) ACCESS_##perm
213 #else
214  #define MKPERM_CERT_OBSOLETE( perm ) ACCESS_xxx_xxx
215 #endif /* USE_CERT_OBSOLETE */
216 
217 #ifdef USE_CERT_DNSTRING
218  #define MKPERM_DNSTRING( perm ) ACCESS_##perm
219 #else
220  #define MKPERM_DNSTRING( perm ) ACCESS_xxx_xxx
221 #endif /* USE_CERT_DNSTRING */
222 
223 #ifdef USE_CMSATTR_OBSCURE
224  #define MKPERM_CMSATTR_OBSCURE( perm ) ACCESS_##perm
225 #else
226  #define MKPERM_CMSATTR_OBSCURE( perm ) ACCESS_xxx_xxx
227 #endif /* USE_CMSATTR_OBSCURE */
228 
229 #if defined( USE_CMSATTR_OBSCURE ) || defined( USE_TSP )
230  #define MKPERM_CMSATTR_OBSCURE_TSP( perm ) ACCESS_##perm
231 #else
232  #define MKPERM_CMSATTR_OBSCURE_TSP( perm ) ACCESS_xxx_xxx
233 #endif /* USE_CMSATTR_OBSCURE || USE_TSP */
234 
235 #ifdef USE_CERTLEVEL_PKIX_PARTIAL
236  #define MKPERM_CERT_PKIX_PARTIAL( perm ) ACCESS_##perm
237 #else
238  #define MKPERM_CERT_PKIX_PARTIAL( perm ) ACCESS_xxx_xxx
239 #endif /* USE_CERTLEVEL_PKIX_PARTIAL */
240 
241 #if defined( USE_CERTLEVEL_PKIX_PARTIAL ) && defined( USE_CERTREV )
242  #define MKPERM_CERTREV_PKIX_PARTIAL( perm ) ACCESS_##perm
243 #else
244  #define MKPERM_CERTREV_PKIX_PARTIAL( perm ) ACCESS_xxx_xxx
245 #endif /* USE_CERTLEVEL_PKIX_PARTIAL && USE_CERTREV */
246 #if defined( USE_CERTLEVEL_PKIX_FULL ) && defined( USE_CERTREV )
247  #define MKPERM_CERTREV_PKIX_FULL( perm ) ACCESS_##perm
248 #else
249  #define MKPERM_CERTREV_PKIX_FULL( perm ) ACCESS_xxx_xxx
250 #endif /* USE_CERTLEVEL_PKIX_FULL && USE_CERTREV */
251 
252 #if defined( USE_CERTLEVEL_PKIX_PARTIAL ) && defined( USE_CERT_OBSCURE )
253  #define MKPERM_PKIX_PARTIAL_OBSCURE( perm ) ACCESS_##perm
254 #else
255  #define MKPERM_PKIX_PARTIAL_OBSCURE( perm ) ACCESS_xxx_xxx
256 #endif /* USE_CERTLEVEL_PKIX_PARTIAL && USE_CERT_OBSCURE */
257 
258 #ifdef USE_CERTLEVEL_PKIX_FULL
259  #define MKPERM_CERT_PKIX_FULL( perm ) ACCESS_##perm
260 #else
261  #define MKPERM_CERT_PKIX_FULL( perm ) ACCESS_xxx_xxx
262 #endif /* USE_CERTLEVEL_PKIX_FULL */
263 
264 #if defined( USE_CERTLEVEL_PKIX_FULL ) && \
265  ( defined( USE_CERTREQ ) || defined( USE_CERTREV ) )
266  #define MKPERM_CERTREQ_REV_PKIX_FULL( perm ) ACCESS_##perm
267 #else
268  #define MKPERM_CERTREQ_REV_PKIX_FULL( perm ) ACCESS_xxx_xxx
269 #endif /* USE_CERTLEVEL_PKIX_FULL && ( USE_CERTREQ || USE_CERTREV ) */
270 
271 /* Device ACL macros */
272 
273 #ifdef USE_PKCS11
274  #define MKPERM_PKCS11( perm ) ACCESS_##perm
275  #define MKPERM_INT_PKCS11( perm ) ACCESS_INT_##perm
276 #else
277  #define MKPERM_PKCS11( perm ) ACCESS_xxx_xxx
278  #define MKPERM_INT_PKCS11( perm ) ACCESS_INT_xxx_xxx
279 #endif /* USE_PKCS11 */
280 
281 /* Envelope ACL macros */
282 
283 #ifdef USE_ENVELOPES
284  #define MKPERM_ENVELOPE( perm ) ACCESS_##perm
285  #define MKPERM_INT_ENVELOPE( perm ) ACCESS_INT_##perm
286 #else
287  #define MKPERM_ENVELOPE( perm ) ACCESS_xxx_xxx
288  #define MKPERM_INT_ENVELOPE( perm ) ACCESS_INT_xxx_xxx
289 #endif /* USE_ENVELOPES */
290 
291 #ifdef USE_COMPRESSION
292  #define MKPERM_COMPRESSION( perm ) ACCESS_##perm
293  #define MKPERM_INT_COMPRESSION( perm ) ACCESS_INT_##perm
294 #else
295  #define MKPERM_COMPRESSION( perm ) ACCESS_xxx_xxx
296  #define MKPERM_INT_COMPRESSION( perm ) ACCESS_INT_xxx_xxx
297 #endif /* USE_COMPRESSION */
298 
299 #if defined( USE_PGP ) || defined( USE_PGPKEYS )
300  #define MKPERM_PGP( perm ) ACCESS_##perm
301  #define MKPERM_INT_PGP( perm ) ACCESS_INT_##perm
302 #else
303  #define MKPERM_PGP( perm ) ACCESS_xxx_xxx
304  #define MKPERM_INT_PGP( perm ) ACCESS_INT_xxx_xxx
305 #endif /* USE_PGP || USE_PGPKEYS */
306 
307 /* Keyset ACL macros */
308 
309 #ifdef USE_DBMS
310  #define MKPERM_DBMS( perm ) ACCESS_##perm
311  #define MKPERM_INT_DBMS( perm ) ACCESS_INT_##perm
312 #else
313  #define MKPERM_DBMS( perm ) ACCESS_xxx_xxx
314  #define MKPERM_INT_DBMS( perm ) ACCESS_INT_xxx_xxx
315 #endif /* USE_DBMS */
316 
317 #ifdef USE_LDAP
318  #define MKPERM_LDAP( perm ) ACCESS_##perm
319  #define MKPERM_INT_LDAP( perm ) ACCESS_INT_##perm
320 #else
321  #define MKPERM_LDAP( perm ) ACCESS_xxx_xxx
322  #define MKPERM_INT_LDAP( perm ) ACCESS_INT_xxx_xxx
323 #endif /* USE_LDAP */
324 
325 #ifdef USE_HTTP
326  #define MKPERM_HTTP( perm ) ACCESS_##perm
327  #define MKPERM_INT_HTTP( perm ) ACCESS_INT_##perm
328 #else
329  #define MKPERM_HTTP( perm ) ACCESS_xxx_xxx
330  #define MKPERM_INT_HTTP( perm ) ACCESS_INT_xxx_xxx
331 #endif /* USE_HTTP */
332 
333 /* Session ACL macros */
334 
335 #ifdef USE_TCP
336  #define MKPERM_TCP( perm ) ACCESS_##perm
337  #define MKPERM_INT_TCP( perm ) ACCESS_INT_##perm
338 #else
339  #define MKPERM_TCP( perm ) ACCESS_xxx_xxx
340  #define MKPERM_INT_TCP( perm ) ACCESS_INT_xxx_xxx
341 #endif /* USE_TCP */
342 
343 #ifdef USE_SESSIONS
344  #define MKPERM_SESSIONS( perm ) ACCESS_##perm
345  #define MKPERM_INT_SESSIONS( perm ) ACCESS_INT_##perm
346 #else
347  #define MKPERM_SESSIONS( perm ) ACCESS_xxx_xxx
348  #define MKPERM_INT_SESSIONS( perm ) ACCESS_INT_xxx_xxx
349 #endif /* USE_SESSIONS */
350 
351 #ifdef USE_CMP
352  #define MKPERM_CMP( perm ) ACCESS_##perm
353  #define MKPERM_INT_CMP( perm ) ACCESS_INT_##perm
354 #else
355  #define MKPERM_CMP( perm ) ACCESS_xxx_xxx
356  #define MKPERM_INT_CMP( perm ) ACCESS_INT_xxx_xxx
357 #endif /* USE_CMP */
358 
359 #ifdef USE_SCEP
360  #define MKPERM_SCEP( perm ) ACCESS_##perm
361 #else
362  #define MKPERM_SCEP( perm ) ACCESS_xxx_xxx
363 #endif /* USE_SCEP */
364 
365 #ifdef USE_SSH
366  #define MKPERM_SSH( perm ) ACCESS_##perm
367  #define MKPERM_INT_SSH( perm ) ACCESS_INT_##perm
368 #else
369  #define MKPERM_SSH( perm ) ACCESS_xxx_xxx
370  #define MKPERM_INT_SSH( perm ) ACCESS_INT_xxx_xxx
371 #endif /* USE_SSH */
372 
373 #ifdef USE_SSH_EXTENDED
374  #define MKPERM_SSH_EXT( perm ) ACCESS_##perm
375 #else
376  #define MKPERM_SSH_EXT( perm ) ACCESS_xxx_xxx
377 #endif /* USE_SSH_EXTENDED */
378 
379 #ifdef USE_SSL
380  #define MKPERM_SSL( perm ) ACCESS_##perm
381  #define MKPERM_INT_SSL( perm ) ACCESS_INT_##perm
382 #else
383  #define MKPERM_SSL( perm ) ACCESS_xxx_xxx
384  #define MKPERM_INT_SSL( perm ) ACCESS_INT_xxx_xxx
385 #endif /* USE_SSL */
386 
387 #ifdef USE_TSP
388  #define MKPERM_TSP( perm ) ACCESS_##perm
389  #define MKPERM_INT_TSP( perm ) ACCESS_INT_##perm
390 #else
391  #define MKPERM_TSP( perm ) ACCESS_xxx_xxx
392  #define MKPERM_INT_TSP( perm ) ACCESS_INT_xxx_xxx
393 #endif /* USE_TSP */
394 
395 #endif /* _ACL_PERM_DEFINED */
Generated on Thu Jan 10 2013 10:00:48 for cryptlib by   doxygen 1.8.2