dbus service : adding security feature (provided by a list of allowed service name)
[contrib/cloudeebus.git] / cloudeebus / cloudeebus.py
index f7588a3..f99153b 100755 (executable)
@@ -18,6 +18,7 @@
 #
 # Luc Yriarte <luc.yriarte@intel.com>
 # Christophe Guiraud <christophe.guiraud@intel.com>
+# Frederic Paut <frederic.paut@intel.com>
 #
 
 
@@ -48,15 +49,40 @@ from twisted.python import log
 # XML parser module
 from xml.etree.ElementTree import XMLParser
 
-# For debug only
-import os
-
 ###############################################################################
 
-VERSION = "0.2.1"
+VERSION = "0.5.99"
 OPENDOOR = False
 CREDENTIALS = {}
 WHITELIST = []
+SERVICELIST = []
+NETMASK =  []
+
+###############################################################################
+def ipV4ToHex(mask):
+    ## Convert an ip or an IP mask (such as ip/24 or ip/255.255.255.0) in hex value (32bits)
+    maskHex = 0
+    byte = 0
+    if mask.rfind(".") == -1:
+        if (int(mask) < 32):
+            maskHex = (2**(int(mask))-1)
+            maskHex = maskHex << (32-int(mask))
+        else:
+            raise Exception("Illegal mask (larger than 32 bits) " + mask)
+    else:
+        maskField = mask.split(".")
+        # Check if mask has four fields (byte)
+        if len(maskField) != 4:
+            raise Exception("Illegal ip address / mask (should be 4 bytes) " + mask)
+        for maskQuartet in maskField:
+            byte = int(maskQuartet)
+            # Check if each field is really a byte
+            if byte > 255:
+                raise Exception("Illegal ip address / mask (digit larger than a byte) " + mask)              
+            maskHex += byte
+            maskHex = maskHex << 8
+        maskHex = maskHex >> 8
+    return maskHex
 
 ###############################################################################
 class DbusCache:
@@ -149,41 +175,33 @@ class DbusCallHandler:
         '''
         return dbus error message
         '''
-        self.request.errback(error.get_dbus_message())
+        self.request.errback(Exception(error.get_dbus_message()))
         self.pending = False
 
 
 
 ################################################################################       
-class exec_code:
-    def __init__(self) :
+class ExecCode:
+    '''
+    Execute DynDBusClass generated code
+    '''
+    def __init__(self, globalCtx, localCtx) :
         self.exec_string = ""
         self.exec_code = None
         self.exec_code_valid = 1
         self.indent_level = 0
         self.indent_increment = 1
         self.line = 0
-
-    # __str__ : Return a string representation of the object, for
-    # nice printing.
-    def __str__(self) :
-        return self.exec_string
-
-    def p(self) :
-        print str(self)
+        self.localCtx = localCtx
+        self.globalCtx = globalCtx
+        
 
     def append_stmt(self, stmt) :
         self.exec_code_valid = 0
         self.line += 1
-        if (stmt != "\n"):
-            for x in range(0,self.indent_level):
-                self.exec_string = self.exec_string + ' '            
-            self.exec_string = self.exec_string + stmt + "\t\t# l:" + str(self.line) + '\n'
-        else:
-            if (stmt == "\n"):
-                self.exec_string = self.exec_string + "# l:" + str(self.line) + '\n'
-            else:
-                self.exec_string = self.exec_string + stmt + "\t\t# l:" + str(self.line) + '\n'
+        for x in range(0,self.indent_level):
+            self.exec_string = self.exec_string + ' '            
+        self.exec_string = self.exec_string + stmt + '\n'
 
     def indent(self) :
         self.indent_level = self.indent_level + self.indent_increment
@@ -196,17 +214,17 @@ class exec_code:
     def compile(self) :
         if not self.exec_code_valid :
             self.exec_code = compile(self.exec_string, "<string>", "exec")
-        self.exec_code_valid = 1
+        self.exec_code_valid = True
 
     def execute(self) :
         if not self.exec_code_valid :
             self.compile()
-        exec self.exec_code
+        exec(self.exec_code, self.globalCtx, self.localCtx)
 
 
 
 ################################################################################       
-class XmlCb_Parser: # The target object of the parser
+class XmlCbParser: # The target object of the parser
     maxDepth = 0
     depth = 0
     def __init__(self, dynDBusClass):
@@ -232,11 +250,15 @@ class XmlCb_Parser: # The target object of the parser
         # Set signature (in/out & name) for method
         if (tag == 'arg'):
             if (self.current == 'method'):
+                if (attrib.has_key('direction') == False):
+                    attrib['direction'] = "in"
                 self.dynDBusClass.add_signature(attrib['name'],
                                                 attrib['direction'],
                                                 attrib['type'])
                 return
             if (self.current == 'signal'):
+                if (attrib.has_key('name') == False):
+                    attrib['name'] = 'value'
                 self.dynDBusClass.add_signature(attrib['name'], 'in',
                                                 attrib['type'])
                 return
@@ -257,29 +279,42 @@ class XmlCb_Parser: # The target object of the parser
 
 
        
+###############################################################################
+def createClassName(objectPath):
+    return re.sub('/', '_', objectPath[1:])
+
 ################################################################################       
-class dynDBusClass():
+class DynDBusClass():
     def __init__(self, className, globalCtx, localCtx):
         self.className = className
-        self.xmlCB = XmlCb_Parser(self)
-        self.localCtx = localCtx
-        self.globalCtx = globalCtx        
+        self.xmlCB = XmlCbParser(self)
         self.signature = {}
-        self.class_code = exec_code()  
+        self.class_code = ExecCode(globalCtx, localCtx)  
         self.class_code.indent_increment = 4
         self.class_code.append_stmt("import dbus")
         self.class_code.append_stmt("\n")
-        self.class_code.append_stmt("\n")
         self.class_code.append_stmt("class " + self.className + "(dbus.service.Object):")
         self.class_code.indent()
         
         ## Overload of __init__ method 
         self.def_method("__init__")
-        self.add_method("bus, callback=None, objName='/sample', busName='org.cloudeebus'")
+        self.add_method("bus, callback=None, objPath='/sample', busName='org.cloudeebus'")
         self.add_stmt("self.bus = bus")
-        self.add_stmt("self.objName = objName")
+        self.add_stmt("self.objPath = objPath")
         self.add_stmt("self.callback = callback")        
-        self.add_stmt("dbus.service.Object.__init__(self, conn=bus, object_path=objName, bus_name=busName)")
+        self.add_stmt("dbus.service.Object.__init__(self, conn=bus, bus_name=busName)")
+        self.end_method()
+               
+        ## Create 'add_to_connection' method 
+        self.def_method("add_to_connection")
+        self.add_method("connection=None, path=None")
+        self.add_stmt("dbus.service.Object.add_to_connection(self, connection=self.bus, path=self.objPath)")
+        self.end_method()
+               
+        ## Create 'remove_from_connection' method 
+        self.def_method("remove_from_connection")
+        self.add_method("connection=None, path=None")
+        self.add_stmt("dbus.service.Object.remove_from_connection(self, connection=None, path=self.objPath)")
         self.end_method()
                
     def createDBusServiceFromXML(self, xml):
@@ -346,7 +381,6 @@ class dynDBusClass():
         
     def end_method(self):
         self.class_code.append_stmt("\n")
-        self.class_code.append_stmt("\n")        
         self.class_code.dedent()
         
     def add_dbus_method(self):
@@ -376,11 +410,10 @@ class dynDBusClass():
 
     def add_body_method(self):
         if (self.methodToAdd != None):
-            self.class_code.append_stmt("print 'In " + self.methodToAdd + "()'")
             if (self.args_str != str()):
-                self.class_code.append_stmt("self.callback('" + self.methodToAdd + "', dbus_async_cb, dbus_async_err_cb, %s)" % self.args_str)
+                self.class_code.append_stmt("self.callback('" + self.methodToAdd + "', self.objPath, '"  + self.ifName + "', " + "dbus_async_cb, dbus_async_err_cb, %s)" % self.args_str)
             else:        
-                self.class_code.append_stmt("self.callback('" + self.methodToAdd + "', dbus_async_cb, dbus_async_err_cb)")
+                self.class_code.append_stmt("self.callback('" + self.methodToAdd + "', self.objPath, '"  + self.ifName + "', " + "dbus_async_cb, dbus_async_err_cb)")
 
     def add_body_signal(self):
         self.class_code.append_stmt("return") ## TODO: Remove and fix with code ad hoc
@@ -390,19 +423,7 @@ class dynDBusClass():
         self.class_code.append_stmt(stmt)
         
     def declare(self) :
-        self.class_code.compile()
-        exec(self.class_code.exec_string, self.globalCtx, self.localCtx)
-     
-    def __str__(self) :
-        return self.class_code.exec_string
-
-    # p : Since it is often useful to be able to look at the code
-    # that is generated interactively, this function provides
-    # a shorthand for "print str(some_exec_code_instance)", which
-    # gives a reasonable nice look at the contents of the
-    # exec_code object.
-    def p(self) :
-        print str(self)
+        self.class_code.execute()
 
 
 
@@ -412,7 +433,10 @@ class CloudeebusService:
     support for sending DBus messages and registering for DBus signals
     '''
     def __init__(self, permissions):
-        self.permissions = permissions;
+        self.permissions = {};
+        self.permissions['permissions'] = permissions['permissions']
+        self.permissions['authextra'] = permissions['authextra']
+        self.permissions['services'] = permissions['services']
         self.proxyObjects = {}
         self.proxyMethods = {}
         self.pendingCalls = []
@@ -420,6 +444,8 @@ class CloudeebusService:
         self.services = {}  # DBus service created
         self.serviceAgents = {} # Instantiated DBus class previously generated dynamically, for now, one by classname
         self.servicePendingCalls = {} # JS methods called (and waiting for a Success/error response), containing 'methodId', (successCB, errorCB)
+        self.localCtx = locals()
+        self.globalCtx = globals()
 
 
     def proxyObject(self, busName, serviceName, objectName):
@@ -430,7 +456,7 @@ class CloudeebusService:
         if not self.proxyObjects.has_key(id):
             if not OPENDOOR:
                 # check permissions, array.index throws exception
-                self.permissions.index(serviceName)
+                self.permissions['permissions'].index(serviceName)
             bus = cache.dbusConnexion(busName)
             self.proxyObjects[id] = bus.get_object(serviceName, objectName)
         return self.proxyObjects[id]
@@ -457,7 +483,7 @@ class CloudeebusService:
         
         if not OPENDOOR:
             # check permissions, array.index throws exception
-            self.permissions.index(list[1])
+            self.permissions['permissions'].index(list[1])
         
         # check if a handler exists
         sigId = "#".join(list)
@@ -499,15 +525,33 @@ class CloudeebusService:
 
 
     @exportRpc
+    def emitSignal(self, list):
+        '''
+        arguments: agentObjectPath, signalName, result (to emit)
+        '''
+        objectPath = list[0]
+        className = re.sub('/', '_', objectPath[1:])
+        signalName = list[1]
+        result = list[2]
+        if (self.serviceAgents.has_key(className) == True):
+            exe_str = "self.serviceAgents['"+ className +"']."+ signalName + "(" + str(result) + ")"
+            eval(exe_str, self.globalCtx, self.localCtx)
+        else:
+            raise Exception("No object path " + objectPath)
+
+    @exportRpc
     def returnMethod(self, list):
         '''
-        arguments: methodId, success (=true, error otherwise), result (to return)
+        arguments: methodId, callIndex, success (=true, error otherwise), result (to return)
         '''
         methodId = list[0]
-        success = list[1]
-        result = list[2]
+        callIndex = list[1]
+        success = list[2]
+        result = list[3]
         if (self.servicePendingCalls.has_key(methodId)):
-            cb = self.servicePendingCalls[methodId]
+            cb = self.servicePendingCalls[methodId]['calls'][callIndex]
+            if cb is None:
+                raise Exception("No pending call " + str(callIndex) + " for methodID " + methodId)
             if (success):                
                 successCB = cb["successCB"]
                 if (result != None):
@@ -519,31 +563,58 @@ class CloudeebusService:
                 if (result != None):
                     errorCB(result)
                 else:
-                    errorCB()                    
-        
+                    errorCB()
+            self.servicePendingCalls[methodId]['calls'][callIndex] = None
+            self.servicePendingCalls[methodId]['count'] = self.servicePendingCalls[methodId]['count'] - 1
+            if self.servicePendingCalls[methodId]['count'] == 0:
+                del self.servicePendingCalls[methodId]
+        else:
+            raise Exception("No methodID " + methodId)
 
-    def srvCB(self, name, async_succes_cb, async_error_cb, *args):
-        print "self.srvCB(name='%s', args=%s')\n\n" % (name, str(args))
-        methodId = self.srvName + "#" + self.agentObjectPath + "#" + name
+    def srvCB(self, name, objPath, ifName, async_succes_cb, async_error_cb, *args):
+        methodId = self.srvName + "#" + objPath + "#" + ifName + "#" + name
         cb = { 'successCB': async_succes_cb, 
                'errorCB': async_error_cb}
-        self.servicePendingCalls[methodId] = cb
-        
-        print "factory.dispatch(methodId='%s', json.dumps(args)=%s')\n\n" % (methodId, json.dumps(args))
-        factory.dispatch(methodId, json.dumps(args))
-        
+        if methodId not in self.servicePendingCalls:
+            self.servicePendingCalls[methodId] = {'count': 0, 'calls': []}
+            
+        try:
+            pendingCallStr = json.dumps({'callIndex': len(self.servicePendingCalls[methodId]['calls']), 'args': args})
+        except Exception, e:                
+            args = eval( str(args).replace("dbus.Byte", "dbus.Int16") )
+            pendingCallStr = json.dumps({'callIndex': len(self.servicePendingCalls[methodId]['calls']), 'args': args})
+               
+        self.servicePendingCalls[methodId]['calls'].append(cb)
+        self.servicePendingCalls[methodId]['count'] = self.servicePendingCalls[methodId]['count'] + 1
+        factory.dispatch(methodId, pendingCallStr)
+                    
     @exportRpc
     def serviceAdd(self, list):
         '''
         arguments: busName, srvName
         '''
         busName = list[0]
-        self.bus =  cache.dbusConnexion( busName['name'] )
+        self.bus =  cache.dbusConnexion( busName )
         self.srvName = list[1]
-        if (self.services.has_key(self.srvName) == False):            
+        if not OPENDOOR and (SERVICELIST == [] or SERVICELIST != [] and self.permissions['services'] == None):
+            SERVICELIST.index(self.srvName)
+            
+        if (self.services.has_key(self.srvName) == False):
             self.services[self.srvName] = dbus.service.BusName(name = self.srvName, bus = self.bus)
         return self.srvName
-                    
+
+    @exportRpc
+    def serviceRelease(self, list):
+        '''
+        arguments: busName, srvName
+        '''
+        self.srvName = list[0]
+        if (self.services.has_key(self.srvName) == True):
+            self.services.pop(self.srvName)
+            return self.srvName
+        else:
+            raise Exception(self.srvName + " does not exist")
+                   
     @exportRpc
     def serviceAddAgent(self, list):
         '''
@@ -551,27 +622,34 @@ class CloudeebusService:
         '''
         self.agentObjectPath = list[0]
         xmlTemplate = list[1]
-        className = re.sub('/', '_', self.agentObjectPath[1:])
-        if (self.dynDBusClasses.has_key(className) == False):
-            self.dynDBusClasses[className] = dynDBusClass(className, globals(), locals())
-            self.dynDBusClasses[className].createDBusServiceFromXML(xmlTemplate)
+        self.className = createClassName(self.agentObjectPath)
+        if (self.dynDBusClasses.has_key(self.className) == False):
+            self.dynDBusClasses[self.className] = DynDBusClass(self.className, self.globalCtx, self.localCtx)
+            self.dynDBusClasses[self.className].createDBusServiceFromXML(xmlTemplate)
+            self.dynDBusClasses[self.className].declare()
+
+        ## Class already exist, instanciate it if not already instanciated
+        if (self.serviceAgents.has_key(self.className) == False):
+            self.serviceAgents[self.className] = eval(self.className + "(self.bus, callback=self.srvCB, objPath=self.agentObjectPath, busName=self.srvName)", self.globalCtx, self.localCtx)
             
-            # For Debug only
-            if (1):
-                if (1): ## Force deletion
-                    if os.access('./MyDbusClass.py', os.R_OK) == True:
-                        os.remove('./MyDbusClass.py')
+        self.serviceAgents[self.className].add_to_connection()
+        return (self.agentObjectPath)
                     
-                    if os.access('./MyDbusClass.py', os.R_OK) == False:
-                        f = open('./MyDbusClass.py', 'w')
-                        f.write(self.dynDBusClasses[className].class_code.exec_string)
-                        f.close()
-#                self.dynDBusClass[className].p()
-                self.dynDBusClasses[className].declare()
-            
-            if (self.serviceAgents.has_key(className) == False):            
-                exe_str = "self.serviceAgents[" + className +"] = " + className + "(self.bus, callback=self.srvCB, objName=self.agentObjectPath, busName=self.srvName)"
-                exec (exe_str, globals(), locals())
+    @exportRpc
+    def serviceDelAgent(self, list):
+        '''
+        arguments: objectPath, xmlTemplate
+        '''
+        agentObjectPath = list[0]
+        className = createClassName(agentObjectPath)
+
+        if (self.serviceAgents.has_key(className)):
+            self.serviceAgents[self.className].remove_from_connection()
+            self.serviceAgents.pop(self.className)
+        else:
+            raise Exception(agentObjectPath + " doesn't exist!")
+        
+        return (agentObjectPath)
                     
     @exportRpc
     def getVersion(self):
@@ -597,25 +675,41 @@ class CloudeebusServerProtocol(WampCraServerProtocol):
     
     
     def getAuthPermissions(self, key, extra):
-        return json.loads(extra.get("permissions", "[]"))
-    
+         return {'permissions': extra.get("permissions", None),
+                 'authextra': extra.get("authextra", None),
+                 'services': extra.get("services", None)}   
     
     def getAuthSecret(self, key):
         secret = CREDENTIALS.get(key, None)
         if secret is None:
             return None
         # secret must be of str type to be hashed
-        return secret.encode('utf-8')
+        return str(secret)
     
 
     def onAuthenticated(self, key, permissions):
         if not OPENDOOR:
+            # check net filter
+            if NETMASK != []:
+                ipAllowed = False
+                for netfilter in NETMASK:
+                    ipHex=ipV4ToHex(self.peer.host)
+                    ipAllowed = (ipHex & netfilter['mask']) == netfilter['ipAllowed'] & netfilter['mask']
+                    if ipAllowed:
+                        break
+                if not ipAllowed:
+                    raise Exception("host " + self.peer.host + " is not allowed!")
             # check authentication key
             if key is None:
                 raise Exception("Authentication failed")
             # check permissions, array.index throws exception
-            for req in permissions:
-                WHITELIST.index(req)
+            if (permissions['permissions'] != None):
+                for req in permissions['permissions']:
+                    WHITELIST.index(req);
+            # check allowed service creation, array.index throws exception
+            if (permissions['services'] != None):
+                for req in permissions['services']:
+                    SERVICELIST.index(req);
         # create cloudeebus service instance
         self.cloudeebusService = CloudeebusService(permissions)
         # register it for RPC
@@ -650,6 +744,10 @@ if __name__ == '__main__':
         help='path to credentials file')
     parser.add_argument('-w', '--whitelist',
         help='path to whitelist file')
+    parser.add_argument('-s', '--servicelist',
+        help='path to servicelist file')
+    parser.add_argument('-n', '--netmask',
+        help='netmask,IP filter (comma separated.) eg. : -n 127.0.0.1,192.168.2.0/24,10.12.16.0/255.255.255.0')
     
     args = parser.parse_args(sys.argv[1:])
 
@@ -671,7 +769,32 @@ if __name__ == '__main__':
         jfile = open(args.whitelist)
         WHITELIST = json.load(jfile)
         jfile.close()
+        
+    if args.servicelist:
+        jfile = open(args.servicelist)
+        SERVICELIST = json.load(jfile)
+        jfile.close()
+        
+    if args.netmask:
+        iplist = args.netmask.split(",")
+        for ip in iplist:
+            if ip.rfind("/") != -1:
+                ip=ip.split("/")
+                ipAllowed = ip[0]
+                mask = ip[1]
+            else:
+                ipAllowed = ip
+                mask = "255.255.255.255" 
+            NETMASK.append( {'ipAllowed': ipV4ToHex(ipAllowed), 'mask' : ipV4ToHex(mask)} )
     
+    if args.debug:
+        print "OPENDOOR='" + str(OPENDOOR) + "'" 
+        print "CREDENTIALS='" + str(args.credentials) + "'" 
+        print "WHITELIST='" + str(args.whitelist) + "'"
+        print "SERVICELIST='" + str(args.servicelist) + "'" 
+        print "NETMASK='" + str(args.netmask) + "'"
+        print 
+        
     uri = "ws://localhost:" + args.port
     
     factory = WampServerFactory(uri, debugWamp = args.debug)