dbus service : adding security feature (provided by a list of allowed service name)

[contrib/cloudeebus.git] / cloudeebus / cloudeebus.py

diff --git a/cloudeebus/cloudeebus.py b/cloudeebus/cloudeebus.py
index a432f07..f99153b 100755 (executable)
--- a/cloudeebus/cloudeebus.py
+++ b/cloudeebus/cloudeebus.py
@@ -51,10 +51,11 @@ from xml.etree.ElementTree import XMLParser
 
 ###############################################################################
 
-VERSION = "0.3.2"
+VERSION = "0.5.99"
 OPENDOOR = False
 CREDENTIALS = {}
 WHITELIST = []
+SERVICELIST = []
 NETMASK =  []
 
 ###############################################################################
@@ -278,6 +279,10 @@ class XmlCbParser: # The target object of the parser
 
 
        
+###############################################################################
+def createClassName(objectPath):
+    return re.sub('/', '_', objectPath[1:])
+
 ################################################################################       
 class DynDBusClass():
     def __init__(self, className, globalCtx, localCtx):
@@ -431,6 +436,7 @@ class CloudeebusService:
         self.permissions = {};
         self.permissions['permissions'] = permissions['permissions']
         self.permissions['authextra'] = permissions['authextra']
+        self.permissions['services'] = permissions['services']
         self.proxyObjects = {}
         self.proxyMethods = {}
         self.pendingCalls = []
@@ -571,7 +577,13 @@ class CloudeebusService:
                'errorCB': async_error_cb}
         if methodId not in self.servicePendingCalls:
             self.servicePendingCalls[methodId] = {'count': 0, 'calls': []}
-        pendingCallStr = json.dumps({'callIndex': len(self.servicePendingCalls[methodId]['calls']), 'args': args})
+            
+        try:
+            pendingCallStr = json.dumps({'callIndex': len(self.servicePendingCalls[methodId]['calls']), 'args': args})
+        except Exception, e:                
+            args = eval( str(args).replace("dbus.Byte", "dbus.Int16") )
+            pendingCallStr = json.dumps({'callIndex': len(self.servicePendingCalls[methodId]['calls']), 'args': args})
+               
         self.servicePendingCalls[methodId]['calls'].append(cb)
         self.servicePendingCalls[methodId]['count'] = self.servicePendingCalls[methodId]['count'] + 1
         factory.dispatch(methodId, pendingCallStr)
@@ -582,9 +594,12 @@ class CloudeebusService:
         arguments: busName, srvName
         '''
         busName = list[0]
-        self.bus =  cache.dbusConnexion( busName['name'] )
+        self.bus =  cache.dbusConnexion( busName )
         self.srvName = list[1]
-        if (self.services.has_key(self.srvName) == False):            
+        if not OPENDOOR and (SERVICELIST == [] or SERVICELIST != [] and self.permissions['services'] == None):
+            SERVICELIST.index(self.srvName)
+            
+        if (self.services.has_key(self.srvName) == False):
             self.services[self.srvName] = dbus.service.BusName(name = self.srvName, bus = self.bus)
         return self.srvName
 
@@ -598,7 +613,7 @@ class CloudeebusService:
             self.services.pop(self.srvName)
             return self.srvName
         else:
-            raise Exception(self.srvName + " do not exist")
+            raise Exception(self.srvName + " does not exist")
                    
     @exportRpc
     def serviceAddAgent(self, list):
@@ -607,7 +622,7 @@ class CloudeebusService:
         '''
         self.agentObjectPath = list[0]
         xmlTemplate = list[1]
-        self.className = re.sub('/', '_', self.agentObjectPath[1:])
+        self.className = createClassName(self.agentObjectPath)
         if (self.dynDBusClasses.has_key(self.className) == False):
             self.dynDBusClasses[self.className] = DynDBusClass(self.className, self.globalCtx, self.localCtx)
             self.dynDBusClasses[self.className].createDBusServiceFromXML(xmlTemplate)
@@ -626,7 +641,7 @@ class CloudeebusService:
         arguments: objectPath, xmlTemplate
         '''
         agentObjectPath = list[0]
-        className = re.sub('/', '_', agentObjectPath[1:])
+        className = createClassName(agentObjectPath)
 
         if (self.serviceAgents.has_key(className)):
             self.serviceAgents[self.className].remove_from_connection()
@@ -661,7 +676,8 @@ class CloudeebusServerProtocol(WampCraServerProtocol):
     
     def getAuthPermissions(self, key, extra):
          return {'permissions': extra.get("permissions", None),
-                 'authextra': extra.get("authextra", None)}   
+                 'authextra': extra.get("authextra", None),
+                 'services': extra.get("services", None)}   
     
     def getAuthSecret(self, key):
         secret = CREDENTIALS.get(key, None)
@@ -687,8 +703,13 @@ class CloudeebusServerProtocol(WampCraServerProtocol):
             if key is None:
                 raise Exception("Authentication failed")
             # check permissions, array.index throws exception
-            for req in permissions['permissions']:
+            if (permissions['permissions'] != None):
+                for req in permissions['permissions']:
                     WHITELIST.index(req);
+            # check allowed service creation, array.index throws exception
+            if (permissions['services'] != None):
+                for req in permissions['services']:
+                    SERVICELIST.index(req);
         # create cloudeebus service instance
         self.cloudeebusService = CloudeebusService(permissions)
         # register it for RPC
@@ -723,6 +744,8 @@ if __name__ == '__main__':
         help='path to credentials file')
     parser.add_argument('-w', '--whitelist',
         help='path to whitelist file')
+    parser.add_argument('-s', '--servicelist',
+        help='path to servicelist file')
     parser.add_argument('-n', '--netmask',
         help='netmask,IP filter (comma separated.) eg. : -n 127.0.0.1,192.168.2.0/24,10.12.16.0/255.255.255.0')
     
@@ -747,6 +770,11 @@ if __name__ == '__main__':
         WHITELIST = json.load(jfile)
         jfile.close()
         
+    if args.servicelist:
+        jfile = open(args.servicelist)
+        SERVICELIST = json.load(jfile)
+        jfile.close()
+        
     if args.netmask:
         iplist = args.netmask.split(",")
         for ip in iplist:
@@ -759,6 +787,14 @@ if __name__ == '__main__':
                 mask = "255.255.255.255" 
             NETMASK.append( {'ipAllowed': ipV4ToHex(ipAllowed), 'mask' : ipV4ToHex(mask)} )
     
+    if args.debug:
+        print "OPENDOOR='" + str(OPENDOOR) + "'" 
+        print "CREDENTIALS='" + str(args.credentials) + "'" 
+        print "WHITELIST='" + str(args.whitelist) + "'"
+        print "SERVICELIST='" + str(args.servicelist) + "'" 
+        print "NETMASK='" + str(args.netmask) + "'"
+        print 
+        
     uri = "ws://localhost:" + args.port
     
     factory = WampServerFactory(uri, debugWamp = args.debug)