Merge branch 'agent' of https://github.com/01org/cloudeebus into agent

diff --git a/README.md b/README.md
index eac3b55..b16bc38 100644 (file)
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ See the [Getting Started](https://github.com/01org/cloudeebus/wiki/Getting-start
 The Cloudeebus server must be run either with credentials and a whitelist to
  restrict access to DBus services, or in opendoor mode.
 
-       usage: cloudeebus.py [-h] [-v] [-d] [-o] [-p PORT] [-c CREDENTIALS] [-w WHITELIST]
+       usage: cloudeebus.py [-h] [-v] [-d] [-o] [-p PORT] [-c CREDENTIALS] [-w WHITELIST] [-n NETMASK,IP ADDRESS]
        
        Javascript DBus bridge.
        
@@ -40,6 +40,9 @@ The Cloudeebus server must be run either with credentials and a whitelist to
                                path to credentials file
          -w WHITELIST, --whitelist WHITELIST
                                path to whitelist file
+         -n NETMASK, --netmask NETMASK
+                               netmask,IP filter (comma separated.) eg. :
+                               -n 127.0.0.1,192.168.2.0/24,10.12.16.0/255.255.255.0
 
 
 Examples

diff --git a/TODO b/TODO
index 705454b..c728924 100644 (file)
--- a/TODO
+++ b/TODO
@@ -20,7 +20,3 @@ DBus service support:
 ---------------------
 - support sending signals
 
-
-Access control:
----------------
-- support restrictions on websocket origin domain

diff --git a/cloudeebus/__init__.py b/cloudeebus/__init__.py
index 6bafab5..105c17a 100644 (file)
--- a/cloudeebus/__init__.py
+++ b/cloudeebus/__init__.py
@@ -16,4 +16,5 @@
 #
 # Luc Yriarte <luc.yriarte@intel.com>
 # Christophe Guiraud <christophe.guiraud@intel.com>
+# Frederic Paut <frederic.paut@intel.com>
 #

diff --git a/cloudeebus/cloudeebus.js b/cloudeebus/cloudeebus.js
index e9e9578..8e911b3 100644 (file)
--- a/cloudeebus/cloudeebus.js
+++ b/cloudeebus/cloudeebus.js
@@ -28,7 +28,7 @@ var dbus = { // hook object for dbus types not translated by python-json
 
 /*****************************************************************************/
 
-var cloudeebus = window.cloudeebus = {version: "0.3.0"};
+var cloudeebus = window.cloudeebus = {version: "0.3.1"};
 
 cloudeebus.reset = function() {
        cloudeebus.sessionBus = null;

diff --git a/cloudeebus/cloudeebus.py b/cloudeebus/cloudeebus.py
index 1f79d56..c379791 100755 (executable)
--- a/cloudeebus/cloudeebus.py
+++ b/cloudeebus/cloudeebus.py
@@ -18,6 +18,7 @@
 #
 # Luc Yriarte <luc.yriarte@intel.com>
 # Christophe Guiraud <christophe.guiraud@intel.com>
+# Frederic Paut <frederic.paut@intel.com>
 #
 
 
@@ -50,10 +51,37 @@ from xml.etree.ElementTree import XMLParser
 
 ###############################################################################
 
-VERSION = "0.3.0"
+VERSION = "0.3.1"
 OPENDOOR = False
 CREDENTIALS = {}
 WHITELIST = []
+NETMASK =  []
+
+###############################################################################
+def ipV4ToHex(mask):
+    ## Convert an ip or an IP mask (such as ip/24 or ip/255.255.255.0) in hex value (32bits)
+    maskHex = 0
+    byte = 0
+    if mask.rfind(".") == -1:
+        if (int(mask) < 32):
+            maskHex = (2**(int(mask))-1)
+            maskHex = maskHex << (32-int(mask))
+        else:
+            raise Exception("Illegal mask (larger than 32 bits) " + mask)
+    else:
+        maskField = mask.split(".")
+        # Check if mask has four fields (byte)
+        if len(maskField) != 4:
+            raise Exception("Illegal ip address / mask (should be 4 bytes) " + mask)
+        for maskQuartet in maskField:
+            byte = int(maskQuartet)
+            # Check if each field is really a byte
+            if byte > 255:
+                raise Exception("Illegal ip address / mask (digit larger than a byte) " + mask)              
+            maskHex += byte
+            maskHex = maskHex << 8
+        maskHex = maskHex >> 8
+    return maskHex
 
 ###############################################################################
 class DbusCache:
@@ -643,6 +671,16 @@ class CloudeebusServerProtocol(WampCraServerProtocol):
 
     def onAuthenticated(self, key, permissions):
         if not OPENDOOR:
+            # check net filter
+            if NETMASK != []:
+                ipAllowed = False
+                for netfilter in NETMASK:
+                    ipHex=ipV4ToHex(self.peer.host)
+                    ipAllowed = (ipHex & netfilter['mask']) == netfilter['ipAllowed'] & netfilter['mask']
+                    if ipAllowed:
+                        break
+                if not ipAllowed:
+                    raise Exception("host " + self.peer.host + " is not allowed!")
             # check authentication key
             if key is None:
                 raise Exception("Authentication failed")
@@ -683,6 +721,8 @@ if __name__ == '__main__':
         help='path to credentials file')
     parser.add_argument('-w', '--whitelist',
         help='path to whitelist file')
+    parser.add_argument('-n', '--netmask',
+        help='netmask,IP filter (comma separated.) eg. : -n 127.0.0.1,192.168.2.0/24,10.12.16.0/255.255.255.0')
     
     args = parser.parse_args(sys.argv[1:])
 
@@ -704,6 +744,18 @@ if __name__ == '__main__':
         jfile = open(args.whitelist)
         WHITELIST = json.load(jfile)
         jfile.close()
+        
+    if args.netmask:
+        iplist = args.netmask.split(",")
+        for ip in iplist:
+            if ip.rfind("/") != -1:
+                ip=ip.split("/")
+                ipAllowed = ip[0]
+                mask = ip[1]
+            else:
+                ipAllowed = ip
+                mask = "255.255.255.255" 
+            NETMASK.append( {'ipAllowed': ipV4ToHex(ipAllowed), 'mask' : ipV4ToHex(mask)} )
     
     uri = "ws://localhost:" + args.port
     

diff --git a/setup.py b/setup.py
index a54f6da..9fc4d51 100755 (executable)
--- a/setup.py
+++ b/setup.py
@@ -24,7 +24,7 @@
 from setuptools import setup
 
 setup(name = "cloudeebus",
-       version = "0.3.0",
+       version = "0.3.1",
        description = "Javascript-DBus bridge",
        author = "Luc Yriarte, Christophe Guiraud, Frederic PAUT",
        author_email = "luc.yriarte@intel.com, christophe.guiraud@intel.com, frederic.paut@intel.com",