@cryptotaxi247 / netdata
Code Commits Issues Pulls Sessions CI/CD
master
master
h 167 lines 8.57 KB
Raw
1 // SPDX-License-Identifier: GPL-3.0-or-later
2
3 #ifndef NETDATA_HTTP_ACCESS_H
4 #define NETDATA_HTTP_ACCESS_H
5
6 typedef enum __attribute__((packed)) {
7 HTTP_USER_ROLE_NONE = 0,
8 HTTP_USER_ROLE_ADMIN = 1,
9 HTTP_USER_ROLE_MANAGER = 2,
10 HTTP_USER_ROLE_TROUBLESHOOTER = 3,
11 HTTP_USER_ROLE_OBSERVER = 4,
12 HTTP_USER_ROLE_MEMBER = 5,
13 HTTP_USER_ROLE_BILLING = 6,
14 HTTP_USER_ROLE_ANY = 7,
15
16 // keep this list so that lower numbers are more strict access levels
17 } HTTP_USER_ROLE;
18 const char *http_id2user_role(HTTP_USER_ROLE role);
19 HTTP_USER_ROLE http_user_role2id(const char *role);
20
21 typedef enum __attribute__((packed)) {
22 HTTP_ACCESS_NONE = 0, // adm man trb obs mem bil
23 HTTP_ACCESS_SIGNED_ID = (1 << 0), // User is authenticated A A A A A A
24 HTTP_ACCESS_SAME_SPACE = (1 << 1), // NC user+agent = same space A A A A A A
25 HTTP_ACCESS_COMMERCIAL_SPACE = (1 << 2), // NC P P P P P P
26 HTTP_ACCESS_ANONYMOUS_DATA = (1 << 3), // NC room:Read A A A SR SR -
27 HTTP_ACCESS_SENSITIVE_DATA = (1 << 4), // NC agent:ViewSensitiveData A A A - SR -
28 HTTP_ACCESS_VIEW_AGENT_CONFIG = (1 << 5), // NC agent:ReadDynCfg P P - - - -
29 HTTP_ACCESS_EDIT_AGENT_CONFIG = (1 << 6), // NC agent:EditDynCfg P P - - - -
30 HTTP_ACCESS_VIEW_NOTIFICATIONS_CONFIG = (1 << 7), // NC agent:ViewNotificationsConfig P - - - - -
31 HTTP_ACCESS_EDIT_NOTIFICATIONS_CONFIG = (1 << 8), // NC agent:EditNotificationsConfig P - - - - -
32 HTTP_ACCESS_VIEW_ALERTS_SILENCING = (1 << 9), // NC space:GetSystemSilencingRules A A A - A -
33 HTTP_ACCESS_EDIT_ALERTS_SILENCING = (1 << 10), // NC space:CreateSystemSilencingRule P P - - P -
34 } HTTP_ACCESS; // ---------------------
35 // A = always
36 // P = commercial plan
37 // SR = same room (Us+Ag)
38
39 #define HTTP_ACCESS_FORMAT "0x%" PRIx32
40 #define HTTP_ACCESS_FORMAT_CAST uint32_t
41
42 #define HTTP_ACCESS_ALL (HTTP_ACCESS)( \
43 HTTP_ACCESS_SIGNED_ID \
44 | HTTP_ACCESS_SAME_SPACE \
45 | HTTP_ACCESS_COMMERCIAL_SPACE \
46 | HTTP_ACCESS_ANONYMOUS_DATA \
47 | HTTP_ACCESS_SENSITIVE_DATA \
48 | HTTP_ACCESS_VIEW_AGENT_CONFIG \
49 | HTTP_ACCESS_EDIT_AGENT_CONFIG \
50 | HTTP_ACCESS_VIEW_NOTIFICATIONS_CONFIG \
51 | HTTP_ACCESS_EDIT_NOTIFICATIONS_CONFIG \
52 | HTTP_ACCESS_VIEW_ALERTS_SILENCING \
53 | HTTP_ACCESS_EDIT_ALERTS_SILENCING \
54 )
55
56 #define HTTP_ACCESS_MAP_OLD_ANY (HTTP_ACCESS)(HTTP_ACCESS_ANONYMOUS_DATA)
57
58 #define HTTP_ACCESS_MAP_OLD_MEMBER (HTTP_ACCESS)( \
59 HTTP_ACCESS_SIGNED_ID \
60 | HTTP_ACCESS_SAME_SPACE \
61 | HTTP_ACCESS_ANONYMOUS_DATA | HTTP_ACCESS_SENSITIVE_DATA)
62
63 #define HTTP_ACCESS_MAP_OLD_ADMIN (HTTP_ACCESS)( \
64 HTTP_ACCESS_SIGNED_ID \
65 | HTTP_ACCESS_SAME_SPACE \
66 | HTTP_ACCESS_ANONYMOUS_DATA | HTTP_ACCESS_SENSITIVE_DATA | HTTP_ACCESS_VIEW_AGENT_CONFIG \
67 | HTTP_ACCESS_EDIT_AGENT_CONFIG \
68 )
69
70 HTTP_ACCESS http_access2id_one(const char *str);
71 HTTP_ACCESS http_access2id(char *str);
72 struct web_buffer;
73 void http_access2buffer_json_array(struct web_buffer *wb, const char *key, HTTP_ACCESS access);
74 void http_access2txt(char *buf, size_t size, const char *separator, HTTP_ACCESS access);
75 HTTP_ACCESS http_access_from_hex(const char *str);
76 HTTP_ACCESS http_access_from_hex_mapping_old_roles(const char *str);
77 HTTP_ACCESS http_access_from_hex_str(const char *str);
78 HTTP_ACCESS http_access_from_source(const char *str);
79 bool log_cb_http_access_to_hex(struct web_buffer *wb, void *data);
80
81 #define HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(access) ((access & HTTP_ACCESS_SIGNED_ID) ? HTTP_RESP_FORBIDDEN : HTTP_RESP_PRECOND_FAIL)
82
83 typedef enum __attribute__((packed)) {
84 HTTP_ACL_NONE = (0),
85
86 HTTP_ACL_NOCHECK = (1 << 0), // Don't check anything - adding this to an endpoint, disables ACL checking
87
88 // transports
89 HTTP_ACL_API = (1 << 1), // from the internal web server (TCP port)
90 HTTP_ACL_API_UDP = (1 << 2), // from the internal web server (UDP port)
91 HTTP_ACL_API_UNIX = (1 << 3), // from the internal web server (UNIX socket)
92 HTTP_ACL_ACLK = (1 << 5), // from ACLK
93 HTTP_ACL_WEBRTC = (1 << 6), // from WebRTC
94
95 // HTTP_ACL_API takes the following additional ACLs, based on pattern matching of the client IP
96 HTTP_ACL_METRICS = (1 << 10),
97 HTTP_ACL_FUNCTIONS = (1 << 11),
98 HTTP_ACL_NODES = (1 << 12),
99 HTTP_ACL_ALERTS = (1 << 13),
100 HTTP_ACL_DYNCFG = (1 << 14),
101 HTTP_ACL_REGISTRY = (1 << 15),
102 HTTP_ACL_BADGES = (1 << 16),
103 HTTP_ACL_MANAGEMENT = (1 << 17),
104 HTTP_ACL_STREAMING = (1 << 18),
105 HTTP_ACL_NETDATACONF = (1 << 19),
106
107 // SSL related
108 HTTP_ACL_SSL_OPTIONAL = (1 << 28),
109 HTTP_ACL_SSL_FORCE = (1 << 29),
110 HTTP_ACL_SSL_DEFAULT = (1 << 30),
111 } HTTP_ACL;
112
113 #define HTTP_ACL_DASHBOARD (HTTP_ACL)( \
114 HTTP_ACL_METRICS \
115 | HTTP_ACL_FUNCTIONS \
116 | HTTP_ACL_ALERTS \
117 | HTTP_ACL_NODES \
118 | HTTP_ACL_DYNCFG \
119 )
120
121 #define HTTP_ACL_TRANSPORTS (HTTP_ACL)( \
122 HTTP_ACL_API \
123 | HTTP_ACL_API_UDP \
124 | HTTP_ACL_API_UNIX \
125 | HTTP_ACL_ACLK \
126 | HTTP_ACL_WEBRTC \
127 )
128
129 #define HTTP_ACL_TRANSPORTS_WITHOUT_CLIENT_IP_VALIDATION (HTTP_ACL)( \
130 HTTP_ACL_ACLK \
131 | HTTP_ACL_WEBRTC \
132 )
133
134 #define HTTP_ACL_ALL_FEATURES (HTTP_ACL)( \
135 HTTP_ACL_METRICS \
136 | HTTP_ACL_FUNCTIONS \
137 | HTTP_ACL_NODES \
138 | HTTP_ACL_ALERTS \
139 | HTTP_ACL_DYNCFG \
140 | HTTP_ACL_REGISTRY \
141 | HTTP_ACL_BADGES \
142 | HTTP_ACL_MANAGEMENT \
143 | HTTP_ACL_STREAMING \
144 | HTTP_ACL_NETDATACONF \
145 )
146
147 #define HTTP_ACL_ACLK_LICENSE_MANAGER (HTTP_ACL)( \
148 HTTP_ACL_NODES \
149 )
150
151 #ifdef NETDATA_DEV_MODE
152 #define ACL_DEV_OPEN_ACCESS HTTP_ACL_NOCHECK
153 #else
154 #define ACL_DEV_OPEN_ACCESS 0
155 #endif
156
157 #define http_can_access_dashboard(w) (((w)->acl & HTTP_ACL_DASHBOARD) == HTTP_ACL_DASHBOARD)
158 #define http_can_access_registry(w) (((w)->acl & HTTP_ACL_REGISTRY) == HTTP_ACL_REGISTRY)
159 #define http_can_access_badges(w) (((w)->acl & HTTP_ACL_BADGES) == HTTP_ACL_BADGES)
160 #define http_can_access_mgmt(w) (((w)->acl & HTTP_ACL_MANAGEMENT) == HTTP_ACL_MANAGEMENT)
161 #define http_can_access_stream(w) (((w)->acl & HTTP_ACL_STREAMING) == HTTP_ACL_STREAMING)
162 #define http_can_access_netdataconf(w) (((w)->acl & HTTP_ACL_NETDATACONF) == HTTP_ACL_NETDATACONF)
163 #define http_is_using_ssl_optional(w) (((w)->port_acl & HTTP_ACL_SSL_OPTIONAL) == HTTP_ACL_SSL_OPTIONAL)
164 #define http_is_using_ssl_force(w) (((w)->port_acl & HTTP_ACL_SSL_FORCE) == HTTP_ACL_SSL_FORCE)
165 #define http_is_using_ssl_default(w) (((w)->port_acl & HTTP_ACL_SSL_DEFAULT) == HTTP_ACL_SSL_DEFAULT)
166
167 #endif //NETDATA_HTTP_ACCESS_H