diff --git a/p11-kit/Makefile.am b/p11-kit/Makefile.am index 5ee1b718c..0113cb1e3 100644 --- a/p11-kit/Makefile.am +++ b/p11-kit/Makefile.am @@ -13,6 +13,7 @@ MODULE_SRCS = \ p11-kit/conf.c p11-kit/conf.h \ p11-kit/iter.c \ p11-kit/log.c p11-kit/log.h \ + p11-kit/filter.c p11-kit/filter.h \ p11-kit/modules.c p11-kit/modules.h \ p11-kit/pkcs11.h \ p11-kit/pin.c \ @@ -199,12 +200,16 @@ CHECK_PROGS += \ test-virtual \ test-managed \ test-log \ + test-filter \ test-transport \ $(NULL) test_log_SOURCES = p11-kit/test-log.c test_log_LDADD = $(p11_kit_LIBS) +test_filter_SOURCES = p11-kit/test-filter.c +test_filter_LDADD = $(p11_kit_LIBS) + test_managed_SOURCES = p11-kit/test-managed.c test_managed_LDADD = $(p11_kit_LIBS) diff --git a/p11-kit/filter.c b/p11-kit/filter.c new file mode 100644 index 000000000..3329f4552 --- /dev/null +++ b/p11-kit/filter.c @@ -0,0 +1,433 @@ +/* + * Copyright (c) 2016, Red Hat Inc. + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * * Redistributions in binary form must reproduce the + * above copyright notice, this list of conditions and + * the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * * The names of contributors to this software may not be + * used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF + * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH + * DAMAGE. + * + * + * CONTRIBUTORS + * Daiki Ueno + */ + +#include "config.h" + +#include "attrs.h" +#include "buffer.h" +#include "constants.h" +#include "debug.h" +#include "filter.h" +#include "message.h" +#include "p11-kit.h" +#include "virtual.h" + +#include +#include +#include +#include +#include +#include + +typedef struct { + p11_virtual virt; + CK_X_FUNCTION_LIST *lower; + p11_destroyer destroyer; + p11_array *filters; + bool allowed; + bool initialized; + CK_SLOT_ID *slots; + CK_ULONG n_slots; +} FilterData; + +extern int p11_match_uri_token_info (CK_TOKEN_INFO_PTR one, + CK_TOKEN_INFO_PTR two); + +static CK_RV +ensure_filters (FilterData *filter) +{ + CK_SLOT_ID *slots = NULL; + CK_ULONG count; + CK_ULONG i; + CK_TOKEN_INFO token; + CK_RV rv; + + if (filter->slots != NULL) + free (filter->slots); + filter->n_slots = 0; + + rv = filter->lower->C_GetSlotList (filter->lower, + CK_TRUE, + NULL, + &count); + if (rv != CKR_OK) + goto out; + + slots = calloc (count, sizeof (CK_SLOT_ID)); + if (slots == NULL) + goto out; + + rv = filter->lower->C_GetSlotList (filter->lower, + CK_TRUE, + slots, + &count); + if (rv != CKR_OK) + goto out; + + filter->slots = calloc (count, sizeof (CK_SLOT_ID)); + if (filter->slots == NULL) + goto out; + + if (filter->filters->num == 0) { + memcpy (filter->slots, slots, count * sizeof (CK_SLOT_ID)); + goto out; + } + + for (i = 0; i < count; i++) { + CK_RV rv2; + unsigned int j; + + rv2 = filter->lower->C_GetTokenInfo (filter->lower, + slots[i], + &token); + if (rv2 != CKR_OK) + continue; + + for (j = 0; j < filter->filters->num; j++) { + CK_TOKEN_INFO *f = filter->filters->elem[j]; + bool matched = p11_match_uri_token_info (f, &token); + if ((filter->allowed && matched) || + (!filter->allowed && !matched)) { + filter->slots[filter->n_slots++] = slots[i]; + break; + } + } + } + out: + free (slots); + return rv; +} + +static void +reinit_filter (FilterData *filter) +{ + CK_RV rv; + + rv = ensure_filters (filter); + if (rv == CKR_OK) + filter->initialized = true; + else { + filter->initialized = false; + p11_message ("filter cannot be initialized"); + } +} + +static CK_RV +filter_C_Initialize (CK_X_FUNCTION_LIST *self, + CK_VOID_PTR pInitArgs) +{ + FilterData *filter = (FilterData *)self; + CK_RV rv; + + rv = filter->lower->C_Initialize (filter->lower, pInitArgs); + if (rv == CKR_OK) + reinit_filter (filter); + return rv; +} + +static CK_RV +filter_C_Finalize (CK_X_FUNCTION_LIST *self, + CK_VOID_PTR pReserved) +{ + FilterData *filter = (FilterData *)self; + + free (filter->slots); + filter->n_slots = 0; + p11_array_clear (filter->filters); + filter->initialized = false; + filter->allowed = false; + + return filter->lower->C_Finalize (filter->lower, pReserved); +} + +static CK_RV +filter_C_GetSlotList (CK_X_FUNCTION_LIST *self, + CK_BBOOL tokenPresent, + CK_SLOT_ID_PTR pSlotList, + CK_ULONG_PTR pulCount) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG count; + + if (pulCount == NULL) + return CKR_ARGUMENTS_BAD; + + count = *pulCount; + *pulCount = filter->n_slots; + + if (pSlotList == NULL) + return CKR_OK; + + if (filter->n_slots > count) + return CKR_BUFFER_TOO_SMALL; + + memcpy (pSlotList, filter->slots, + filter->n_slots * sizeof (CK_SLOT_ID)); + *pulCount = filter->n_slots; + return CKR_OK; +} + +static CK_RV +filter_C_GetSlotInfo (CK_X_FUNCTION_LIST *self, + CK_SLOT_ID slotID, + CK_SLOT_INFO_PTR pInfo) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG i; + + for (i = 0; i < filter->n_slots; i++) + if (filter->slots[i] == slotID) + break; + + if (i == filter->n_slots) + return CKR_SLOT_ID_INVALID; + + return filter->lower->C_GetSlotInfo (filter->lower, slotID, pInfo); +} + +static CK_RV +filter_C_GetTokenInfo (CK_X_FUNCTION_LIST *self, + CK_SLOT_ID slotID, + CK_TOKEN_INFO_PTR pInfo) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG i; + + for (i = 0; i < filter->n_slots; i++) + if (filter->slots[i] == slotID) + break; + + if (i == filter->n_slots) + return CKR_SLOT_ID_INVALID; + + return filter->lower->C_GetTokenInfo (filter->lower, slotID, pInfo); +} + +static CK_RV +filter_C_GetMechanismList (CK_X_FUNCTION_LIST *self, + CK_SLOT_ID slotID, + CK_MECHANISM_TYPE_PTR pMechanismList, + CK_ULONG_PTR pulCount) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG i; + + for (i = 0; i < filter->n_slots; i++) + if (filter->slots[i] == slotID) + break; + + if (i == filter->n_slots) + return CKR_SLOT_ID_INVALID; + + return filter->lower->C_GetMechanismList (filter->lower, + slotID, + pMechanismList, + pulCount); +} + +static CK_RV +filter_C_GetMechanismInfo (CK_X_FUNCTION_LIST *self, + CK_SLOT_ID slotID, + CK_MECHANISM_TYPE type, + CK_MECHANISM_INFO_PTR pInfo) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG i; + + for (i = 0; i < filter->n_slots; i++) + if (filter->slots[i] == slotID) + break; + + if (i == filter->n_slots) + return CKR_SLOT_ID_INVALID; + + return filter->lower->C_GetMechanismInfo (filter->lower, + slotID, + type, + pInfo); +} + +static CK_RV +filter_C_InitToken (CK_X_FUNCTION_LIST *self, + CK_SLOT_ID slotID, + CK_UTF8CHAR_PTR pPin, + CK_ULONG ulPinLen, + CK_UTF8CHAR_PTR pLabel) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG i; + + for (i = 0; i < filter->n_slots; i++) + if (filter->slots[i] == slotID) + break; + + if (i == filter->n_slots) + return CKR_SLOT_ID_INVALID; + + return filter->lower->C_InitToken (filter->lower, slotID, + pPin, ulPinLen, pLabel); +} + +static CK_RV +filter_C_WaitForSlotEvent (CK_X_FUNCTION_LIST *self, + CK_FLAGS flags, + CK_SLOT_ID_PTR pSlot, + CK_VOID_PTR pReserved) +{ + return CKR_FUNCTION_NOT_SUPPORTED; +} + +static CK_RV +filter_C_OpenSession (CK_X_FUNCTION_LIST *self, + CK_SLOT_ID slotID, + CK_FLAGS flags, + CK_VOID_PTR pApplication, + CK_NOTIFY Notify, + CK_SESSION_HANDLE_PTR phSession) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG i; + + for (i = 0; i < filter->n_slots; i++) + if (filter->slots[i] == slotID) + break; + + if (i == filter->n_slots) + return CKR_SLOT_ID_INVALID; + + return filter->lower->C_OpenSession (filter->lower, slotID, flags, + pApplication, Notify, + phSession); +} + +static CK_RV +filter_C_CloseAllSessions (CK_X_FUNCTION_LIST *self, + CK_SLOT_ID slotID) +{ + FilterData *filter = (FilterData *)self; + CK_ULONG i; + + for (i = 0; i < filter->n_slots; i++) + if (filter->slots[i] == slotID) + break; + + if (i == filter->n_slots) + return CKR_SLOT_ID_INVALID; + + return filter->lower->C_CloseAllSessions (filter->lower, slotID); +} + +void +p11_filter_release (void *data) +{ + FilterData *filter = (FilterData *)data; + + return_if_fail (data != NULL); + p11_virtual_uninit (&filter->virt); + p11_array_free (filter->filters); + free (filter); +} + +p11_virtual * +p11_filter_subclass (p11_virtual *lower, + p11_destroyer destroyer) +{ + FilterData *filter; + CK_X_FUNCTION_LIST functions; + + filter = calloc (1, sizeof (FilterData)); + return_val_if_fail (filter != NULL, NULL); + + memcpy (&functions, &p11_virtual_stack, sizeof (CK_X_FUNCTION_LIST)); + functions.C_Initialize = filter_C_Initialize; + functions.C_Finalize = filter_C_Finalize; + functions.C_GetSlotList = filter_C_GetSlotList; + functions.C_GetSlotInfo = filter_C_GetSlotInfo; + functions.C_GetTokenInfo = filter_C_GetTokenInfo; + functions.C_GetMechanismList = filter_C_GetMechanismList; + functions.C_GetMechanismInfo = filter_C_GetMechanismInfo; + functions.C_InitToken = filter_C_InitToken; + functions.C_WaitForSlotEvent = filter_C_WaitForSlotEvent; + functions.C_OpenSession = filter_C_OpenSession; + functions.C_CloseAllSessions = filter_C_CloseAllSessions; + + p11_virtual_init (&filter->virt, &functions, lower, destroyer); + filter->lower = &lower->funcs; + filter->filters = p11_array_new ((p11_destroyer)free); + return &filter->virt; +} + +void +p11_filter_allow (p11_virtual *virt, + CK_TOKEN_INFO *token) +{ + FilterData *filter = (FilterData *)virt; + CK_TOKEN_INFO *token_copy; + + return_if_fail (filter->allowed || filter->filters->num == 0); + filter->allowed = true; + + token_copy = memdup (token, sizeof (CK_TOKEN_INFO)); + return_if_fail (token_copy != NULL); + + if (!p11_array_push (filter->filters, token_copy)) + return_if_reached (); + + if (filter->initialized) + reinit_filter (filter); +} + +void +p11_filter_deny (p11_virtual *virt, + CK_TOKEN_INFO *token) +{ + FilterData *filter = (FilterData *)virt; + CK_TOKEN_INFO *token_copy; + + return_if_fail (!filter->allowed || filter->filters->num == 0); + filter->allowed = false; + + token_copy = memdup (token, sizeof (CK_TOKEN_INFO)); + return_if_fail (token_copy != NULL); + + if (!p11_array_push (filter->filters, token_copy)) + return_if_reached (); + + if (filter->initialized) + reinit_filter (filter); +} diff --git a/p11-kit/filter.h b/p11-kit/filter.h new file mode 100644 index 000000000..90794811a --- /dev/null +++ b/p11-kit/filter.h @@ -0,0 +1,57 @@ +/* + * Copyright (c) 2016, Red Hat Inc. + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * * Redistributions in binary form must reproduce the + * above copyright notice, this list of conditions and + * the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * * The names of contributors to this software may not be + * used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF + * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH + * DAMAGE. + * + * + * CONTRIBUTORS + * Daiki Ueno + */ + +#ifndef P11_FILTER_H_ +#define P11_FILTER_H_ + +#include "virtual.h" + +p11_virtual *p11_filter_subclass (p11_virtual *lower, + p11_destroyer destroyer); + +void p11_filter_release (void *filterger); + +void + p11_filter_allow (p11_virtual *virt, + CK_TOKEN_INFO *token); + +void + p11_filter_deny (p11_virtual *virt, + CK_TOKEN_INFO *token); + +#endif /* P11_FILTER_H_ */ diff --git a/p11-kit/test-filter.c b/p11-kit/test-filter.c new file mode 100644 index 000000000..4c4e98219 --- /dev/null +++ b/p11-kit/test-filter.c @@ -0,0 +1,144 @@ +/* + * Copyright (c) 2016 Red Hat Inc + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * * Redistributions in binary form must reproduce the + * above copyright notice, this list of conditions and + * the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * * The names of contributors to this software may not be + * used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF + * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH + * DAMAGE. + * + * Author: Daiki Ueno + */ + +#include "config.h" +#include "test.h" + +#include "dict.h" +#include "library.h" +#include "filter.h" +#include "mock.h" +#include "modules.h" +#include "p11-kit.h" +#include "virtual.h" + +#include +#include +#include +#include + +static CK_TOKEN_INFO TOKEN_ONE = { + "TEST LABEL ", + "TEST MANUFACTURER ", + "TEST MODEL ", + "TEST SERIAL ", + CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_CLOCK_ON_TOKEN | CKF_TOKEN_INITIALIZED, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + { 75, 175 }, + { 85, 185 }, + { '1', '9', '9', '9', '0', '5', '2', '5', '0', '9', '1', '9', '5', '9', '0', '0' } +}; + +static void +test_allowed (void) +{ + CK_FUNCTION_LIST_PTR module; + p11_virtual virt; + p11_virtual *filter; + CK_ULONG count; + CK_RV rv; + + p11_virtual_init (&virt, &p11_virtual_base, &mock_module, NULL); + filter = p11_filter_subclass (&virt, NULL); + module = p11_virtual_wrap (filter, (p11_destroyer)p11_virtual_uninit); + assert_ptr_not_null (module); + + p11_filter_allow (filter, &TOKEN_ONE); + + rv = (module->C_Initialize) (NULL); + assert_num_eq (CKR_OK, rv); + + rv = (module->C_GetSlotList) (CK_TRUE, NULL, &count); + assert_num_eq (CKR_OK, rv); + assert_num_eq (count, 1); + + rv = (module->C_Finalize) (NULL); + assert_num_eq (CKR_OK, rv); + + p11_virtual_unwrap (module); + p11_filter_release (filter); +} + +static void +test_denied (void) +{ + CK_FUNCTION_LIST_PTR module; + p11_virtual virt; + p11_virtual *filter; + CK_ULONG count; + CK_RV rv; + + p11_virtual_init (&virt, &p11_virtual_base, &mock_module, NULL); + filter = p11_filter_subclass (&virt, NULL); + module = p11_virtual_wrap (filter, (p11_destroyer)p11_virtual_uninit); + assert_ptr_not_null (module); + + p11_filter_deny (filter, &TOKEN_ONE); + + rv = (module->C_Initialize) (NULL); + assert_num_eq (CKR_OK, rv); + + rv = (module->C_GetSlotList) (CK_TRUE, NULL, &count); + assert_num_eq (CKR_OK, rv); + assert_num_eq (count, 0); + + rv = (module->C_Finalize) (NULL); + assert_num_eq (CKR_OK, rv); + + p11_virtual_unwrap (module); + p11_filter_release (filter); +} + +int +main (int argc, + char *argv[]) +{ + p11_library_init (); + mock_module_init (); + + assert (p11_virtual_can_wrap ()); + p11_test (test_allowed, "/filter/test_allowed"); + p11_test (test_denied, "/filter/test_denied"); + + return p11_test_run (argc, argv); +}