authentification: access control, check manifest on whitelist

diff --git a/cloudeebus/cloudeebus.js b/cloudeebus/cloudeebus.js
index bcb80f2..d085156 100644 (file)
--- a/cloudeebus/cloudeebus.js
+++ b/cloudeebus/cloudeebus.js
@@ -28,22 +28,37 @@ cloudeebus.reset = function() {
 };
 
 
-cloudeebus.log = function(msg) {
+cloudeebus.log = function(msg) { 
 };
 
 
-cloudeebus.connect = function(uri, successCB, errorCB) {
+cloudeebus.connect = function(uri, manifest, successCB, errorCB) {
        cloudeebus.reset();
        cloudeebus.uri = uri;
        
-       function onWAMPSessionConnectedCB(session) {
-               cloudeebus.wampSession = session;
+       function onWAMPSessionAuthenticatedCB(permissions) {
+cloudeebus.log("Authenticated: " + JSON.stringify(permissions));
                cloudeebus.sessionBus = new cloudeebus.BusConnection("session", cloudeebus.wampSession);
                cloudeebus.systemBus = new cloudeebus.BusConnection("system", cloudeebus.wampSession);
-               cloudeebus.log("Connected to " + cloudeebus.uri);
                if (successCB)
                        successCB();
        }
+       
+       function onWAMPSessionChallengedCB(challenge) {
+cloudeebus.log("Challenged: " + challenge);
+               var signature = cloudeebus.wampSession.authsign(challenge, manifest.key);
+cloudeebus.log("Signature: " + signature);
+               cloudeebus.wampSession.auth(signature).then(onWAMPSessionAuthenticatedCB, errorCB);
+       }
+       
+       function onWAMPSessionConnectedCB(session) {
+               cloudeebus.log("Connected to " + cloudeebus.uri);
+               cloudeebus.wampSession = session;
+               cloudeebus.wampSession.authreq(
+                               manifest.name, 
+                               {permissions: JSON.stringify(manifest.permissions)}
+                       ).then(onWAMPSessionChallengedCB, errorCB);
+       }
 
        function onWAMPSessionErrorCB(code, reason) {
                if (code == ab.CONNECTION_UNSUPPORTED) {

diff --git a/cloudeebus/cloudeebus.py b/cloudeebus/cloudeebus.py
index c533942..474f252 100755 (executable)
--- a/cloudeebus/cloudeebus.py
+++ b/cloudeebus/cloudeebus.py
@@ -30,7 +30,7 @@ glib2reactor.install()
 from twisted.internet import reactor, defer
 
 from autobahn.websocket import listenWS
-from autobahn.wamp import exportRpc, WampServerFactory, WampServerProtocol
+from autobahn.wamp import exportRpc, WampServerFactory, WampCraServerProtocol
 
 from dbus.mainloop.glib import DBusGMainLoop
 
@@ -204,18 +204,63 @@ class CloudeebusService:
 
 
 ###############################################################################
-class CloudeebusServerProtocol(WampServerProtocol):
+class CloudeebusServerProtocol(WampCraServerProtocol):
+       
+       PASSWD = {
+               "cloudeebus": "secret"
+               }
+       
+       WHITELIST = [
+               "com.intel.media-service-upnp",
+               "com.intel.renderer-service-upnp",
+               "org.freedesktop.DBus",
+               "org.freedesktop.DisplayManager",
+               "org.freedesktop.FileManager1",
+               "org.freedesktop.ModemManager",
+               "org.freedesktop.NetworkManager",
+               "org.freedesktop.Notifications",
+               "org.freedesktop.Tracker1",
+               "org.gnome.Nautilus",
+               "org.gnome.Rygel1",
+               "org.gnome.ScreenSaver",
+               "org.neard",
+               "org.ofono"
+               ]
+       
+
        def onSessionOpen(self):
+               # CRA authentication options
+               self.clientAuthTimeout = 0
+               self.clientAuthAllowAnonymous = True
+               # CRA authentication init
+               WampCraServerProtocol.onSessionOpen(self)
+       
+       
+       def getAuthPermissions(self, key, extra):
+               return json.loads(extra.get("permissions", "[]"))
+       
+       
+       def getAuthSecret(self, key):
+               return self.PASSWD.get(key, None)
+       
+
+       def onAuthenticated(self, key, permissions):
+               # check authentication key
+               if key is None:
+                       raise Exception("Authentication failed")
+               # check permissions, array.index throws exception
+               for req in permissions:
+                       self.WHITELIST.index(req)
                # create cloudeebus service instance
                self.cloudeebusService = CloudeebusService()
                # register it for RPC
                self.registerForRpc(self.cloudeebusService)
                # register for Publish / Subscribe
                self.registerForPubSub("", True)
-
-               
+       
+       
        def connectionLost(self, reason):
-               WampServerProtocol.connectionLost(self, reason)
+               WampCraServerProtocol.connectionLost(self, reason)
                if factory.getConnectionCount() == 0:
                        cache.reset()
 
@@ -228,15 +273,15 @@ if __name__ == '__main__':
        port = "9000"
        if len(sys.argv) == 2:
                port = sys.argv[1]
-
+       
        uri = "ws://localhost:" + port
-
+       
        factory = WampServerFactory(uri, debugWamp = True)
        factory.protocol = CloudeebusServerProtocol
        factory.setProtocolOptions(allowHixie76 = True)
-
+       
        listenWS(factory)
-
+       
        DBusGMainLoop(set_as_default=True)
-
+       
        reactor.run()

diff --git a/doc/dbus-tools/dbus-register.html b/doc/dbus-tools/dbus-register.html
index 5378562..7963a49 100644 (file)
--- a/doc/dbus-tools/dbus-register.html
+++ b/doc/dbus-tools/dbus-register.html
@@ -4,6 +4,29 @@
                <!-- include AutobahnJS .. that's all you need -->
                <script src="../../lib/autobahn.min.js"></script>
                <script language="javascript" type="text/javascript">
+               
+               var manifest = {
+                       name: "cloudeebus",
+                       version: "v0.0 / development",
+                       key: "secret",
+                       permissions: [
+                               "com.intel.media-service-upnp",
+                               "com.intel.renderer-service-upnp",
+                               "org.freedesktop.DBus",
+                               "org.freedesktop.DisplayManager",
+                               "org.freedesktop.FileManager1",
+                               "org.freedesktop.ModemManager",
+                               "org.freedesktop.NetworkManager",
+                               "org.freedesktop.Notifications",
+                               "org.freedesktop.Tracker1",
+                               "org.gnome.Nautilus",
+                               "org.gnome.Rygel1",
+                               "org.gnome.ScreenSaver",
+                               "org.neard",
+                               "org.ofono"
+                       ]
+               };
+               
                // WAMP session object
                var mSession = null;
 
@@ -12,9 +35,22 @@
 
                window.onload = function() {
 
+                       function onSessionAuthenticatedCB(permissions) {
+                               log_append("Session successfully authenticated.");
+                       }
+
+                       function onSessionChallengedCB(challenge) {
+                               var signature = mSession.authsign(challenge, manifest.key);
+                               mSession.auth(signature).then(onSessionAuthenticatedCB, log_append);
+                       }
+       
                        function onSessionConnectedCB(session) { // WAMP session was established
                                mSession = session;
-                               log_append("Session successfully connected.");
+                               log_append("Session connected, authenticating.");
+                               mSession.authreq(
+                                               manifest.name,
+                                               {permissions: JSON.stringify(manifest.permissions)}
+                                       ).then(onSessionChallengedCB, log_append);
                        }
 
                        function onSessionErrorCB(code, reason) { // WAMP session is gone

diff --git a/doc/dbus-tools/dbus-send.html b/doc/dbus-tools/dbus-send.html
index 007dcea..de1007d 100644 (file)
--- a/doc/dbus-tools/dbus-send.html
+++ b/doc/dbus-tools/dbus-send.html
@@ -4,6 +4,29 @@
                <!-- include AutobahnJS .. that's all you need -->
                <script src="../../lib/autobahn.min.js"></script>
                <script language="javascript" type="text/javascript">
+               
+               var manifest = {
+                       name: "cloudeebus",
+                       version: "v0.0 / development",
+                       key: "secret",
+                       permissions: [
+                               "com.intel.media-service-upnp",
+                               "com.intel.renderer-service-upnp",
+                               "org.freedesktop.DBus",
+                               "org.freedesktop.DisplayManager",
+                               "org.freedesktop.FileManager1",
+                               "org.freedesktop.ModemManager",
+                               "org.freedesktop.NetworkManager",
+                               "org.freedesktop.Notifications",
+                               "org.freedesktop.Tracker1",
+                               "org.gnome.Nautilus",
+                               "org.gnome.Rygel1",
+                               "org.gnome.ScreenSaver",
+                               "org.neard",
+                               "org.ofono"
+                       ]
+               };
+               
                // WAMP session object
                var mSession = null;
 
@@ -12,9 +35,22 @@
 
                window.onload = function() {
 
+                       function onSessionAuthenticatedCB(permissions) {
+                               log_append("Session successfully authenticated.");
+                       }
+
+                       function onSessionChallengedCB(challenge) {
+                               var signature = mSession.authsign(challenge, manifest.key);
+                               mSession.auth(signature).then(onSessionAuthenticatedCB, log_append);
+                       }
+       
                        function onSessionConnectedCB(session) { // WAMP session was established
                                mSession = session;
-                               log_append("Session successfully connected.");
+                               log_append("Session connected, authenticating.");
+                               mSession.authreq(
+                                               manifest.name,
+                                               {permissions: JSON.stringify(manifest.permissions)}
+                                       ).then(onSessionChallengedCB, log_append);
                        }
 
                        function onSessionErrorCB(code, reason) { // WAMP session is gone

diff --git a/doc/sample/cloudeebus.html b/doc/sample/cloudeebus.html
index 4b8d2fe..2c6c52f 100644 (file)
--- a/doc/sample/cloudeebus.html
+++ b/doc/sample/cloudeebus.html
@@ -3,6 +3,29 @@
     <head>
         <script src="../../lib/autobahn.min.js"></script>
         <script src="../../cloudeebus/cloudeebus.js"></script>
+        <script type="text/javascript">
+               var manifest = {
+                       name: "cloudeebus",
+                       version: "v0.0 / development",
+                       key: "secret",
+                       permissions: [
+                               "com.intel.media-service-upnp",
+                               "com.intel.renderer-service-upnp",
+                               "org.freedesktop.DBus",
+                               "org.freedesktop.DisplayManager",
+                               "org.freedesktop.FileManager1",
+                               "org.freedesktop.ModemManager",
+                               "org.freedesktop.NetworkManager",
+                               "org.freedesktop.Notifications",
+                               "org.freedesktop.Tracker1",
+                               "org.gnome.Nautilus",
+                               "org.gnome.Rygel1",
+                               "org.gnome.ScreenSaver",
+                               "org.neard",
+                               "org.ofono"
+                       ]
+               };
+        </script>
     </head>
    <body>
         <center><h1>cloudeebus</h1></center>
@@ -42,7 +65,7 @@ function errorCB(error) {
   cloudeebus.log("error: " + error + "\n");
 }
 
-cloudeebus.connect("ws://localhost:9000", connectSuccess, errorCB);
+cloudeebus.connect("ws://localhost:9000", manifest, connectSuccess, errorCB);
 </textarea>
                <br>
                <input type="button" value="run script" onclick="eval(document.getElementById('script').value)"/>