Allow filtering of tokens exposed by proxy module

p11-kit/fixtures/test-system-allow-tokens.conf

@@ -0,0 +1,9 @@
+
+# Merge in user config
+user-config: merge
+
+key1: system1
+key2: system2
+key3: system3
+
+allow-tokens: pkcs11:model=TEST%20MODEL;manufacturer=TEST%20MANUFACTURER;serial=TEST%20SERIAL;token=TEST%20LABEL

p11-kit/fixtures/test-system-deny-tokens.conf

@@ -0,0 +1,9 @@
+
+# Merge in user config
+user-config: merge
+
+key1: system1
+key2: system2
+key3: system3
+
+deny-tokens: pkcs11:model=TEST%20MODEL;manufacturer=TEST%20MANUFACTURER;serial=TEST%20SERIAL;token=TEST%20LABEL

p11-kit/modules.c

@@ -43,6 +43,7 @@
 #include "conf.h"
 #include "debug.h"
 #include "dict.h"
+#include "filter.h"
 #include "library.h"
 #include "log.h"
 #include "message.h"
@@ -53,6 +54,7 @@
 #include "private.h"
 #include "proxy.h"
 #include "rpc.h"
+#include "uri.h"
 #include "virtual.h"
 
 #include <sys/stat.h>
@@ -1887,6 +1889,9 @@ prepare_module_inlock_reentrant (Module *mod,
 	p11_virtual *virt;
 	bool is_managed;
 	bool with_log;
+	const char *allow_tokens;
+	const char *deny_tokens;
+	CK_RV rv = CKR_OK;
 
 	assert (module != NULL);
 
@@ -1909,12 +1914,73 @@ prepare_module_inlock_reentrant (Module *mod,
 		return_val_if_fail (virt != NULL, CKR_HOST_MEMORY);
 		destroyer = managed_free_inlock;
 
+		allow_tokens = module_get_option_inlock (NULL, "allow-tokens");
+		deny_tokens = module_get_option_inlock (NULL, "deny-tokens");
+
+		if (allow_tokens && deny_tokens) {
+			p11_message ("'%s' and '%s' are mutually exclusive",
+				     "allow-tokens", "deny-tokens");
+			rv = CKR_FUNCTION_NOT_SUPPORTED;
+		}
+
+		/* Add the filter if configured */
+		if (rv == CKR_OK && (allow_tokens || deny_tokens)) {
+			char *str, *tok, *saveptr;
+			P11KitUri *uri = NULL;
+
+			virt = p11_filter_subclass (virt, destroyer);
+			if (virt == NULL)
+				rv = CKR_HOST_MEMORY;
+			else
+				destroyer = p11_filter_release;
+
+			if (rv == CKR_OK) {
+				uri = p11_kit_uri_new ();
+				if (uri == NULL)
+					rv = CKR_HOST_MEMORY;
+			}
+
+			if (rv == CKR_OK) {
+				for (str = (char *) allow_tokens; ; str = NULL) {
+					tok = strtok_r (str, ", ", &saveptr);
+					if (tok == NULL)
+						break;
+					if (p11_kit_uri_parse (tok, P11_KIT_URI_FOR_TOKEN, uri) != P11_KIT_URI_OK) {
+						p11_message ("skipping unparsable URI '%s'",
+							     tok);
+					} else {
+						p11_filter_allow_token (virt, p11_kit_uri_get_token_info (uri));
+					}
+				}
+
+				for (str = (char *) deny_tokens; ; str = NULL) {
+					tok = strtok_r (str, ", ", &saveptr);
+					if (tok == NULL)
+						break;
+					if (p11_kit_uri_parse (tok, P11_KIT_URI_FOR_TOKEN, uri) != P11_KIT_URI_OK) {
+						p11_message ("skipping unparsable URI '%s'",
+							     tok);
+					} else {
+						p11_filter_deny_token (virt, p11_kit_uri_get_token_info (uri));
+					}
+				}
+			}
+
+			p11_kit_uri_free (uri);
+		}
+
 		/* Add the logger if configured */
-		if (p11_log_force || with_log) {
+		if (rv == CKR_OK && (p11_log_force || with_log)) {
 			virt = p11_log_subclass (virt, destroyer);
-			destroyer = p11_log_release;
+			if (virt == NULL)
+				rv = CKR_HOST_MEMORY;
+			else
+				destroyer = p11_log_release;
 		}
 
+		if (rv != CKR_OK)
+			return rv;
+
 		*module = p11_virtual_wrap (virt, destroyer);
 		if (*module == NULL)
 			return CKR_GENERAL_ERROR;

p11-kit/proxy.c

@@ -256,6 +256,11 @@ proxy_create (Proxy **res)
 	CK_ULONG i, count;
 	CK_RV rv = CKR_OK;
 	Proxy *py;
+	const char *envvar;
+
+	envvar = secure_getenv ("P11_KIT_PROXY_CONFIG");
+	if (envvar && *envvar != '\0')
+		p11_kit_override_system_files (envvar, NULL, NULL, NULL, NULL);
 
 	py = calloc (1, sizeof (Proxy));
 	return_val_if_fail (py != NULL, CKR_HOST_MEMORY);

p11-kit/test-modules.c

@@ -462,6 +462,54 @@ test_config_option (void)
 	finalize_and_free_modules (modules);
 }
 
+static void
+test_filter_tokens (void)
+{
+	CK_FUNCTION_LIST_PTR_PTR modules;
+	CK_FUNCTION_LIST_PTR module;
+	CK_ULONG count;
+	CK_RV rv;
+
+	modules = initialize_and_get_modules ();
+	module = lookup_module_with_name (modules, "four");
+	assert (module != NULL);
+	count = 32;
+	rv = (module->C_GetSlotList) (CK_TRUE, NULL, &count);
+	assert_num_eq (CKR_OK, rv);
+	assert_num_eq (1, count);
+	finalize_and_free_modules (modules);
+
+	p11_kit_override_system_files (SRCDIR "/p11-kit/fixtures/test-system-deny-tokens.conf",
+				       NULL,
+				       NULL,
+				       NULL,
+				       NULL);
+
+	modules = initialize_and_get_modules ();
+	module = lookup_module_with_name (modules, "four");
+	assert (module != NULL);
+	count = 32;
+	rv = (module->C_GetSlotList) (CK_TRUE, NULL, &count);
+	assert_num_eq (CKR_OK, rv);
+	assert_num_eq (0, count);
+	finalize_and_free_modules (modules);
+
+	p11_kit_override_system_files (SRCDIR "/p11-kit/fixtures/test-system-allow-tokens.conf",
+				       NULL,
+				       NULL,
+				       NULL,
+				       NULL);
+
+	modules = initialize_and_get_modules ();
+	module = lookup_module_with_name (modules, "four");
+	assert (module != NULL);
+	count = 32;
+	rv = (module->C_GetSlotList) (CK_TRUE, NULL, &count);
+	assert_num_eq (CKR_OK, rv);
+	assert_num_eq (1, count);
+	finalize_and_free_modules (modules);
+}
+
 int
 main (int argc,
       char *argv[])
@@ -480,6 +528,7 @@ main (int argc,
 	p11_test (test_config_option, "/modules/test_config_option");
 	p11_test (test_module_trusted_only, "/modules/trusted-only");
 	p11_test (test_module_trust_flags, "/modules/trust-flags");
+	p11_test (test_filter_tokens, "/modules/test_filter_tokens");
 
 	p11_kit_be_quiet ();