Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[22280] New property to select preferred key agreement algorithm #5413

Merged
merged 19 commits into from
Nov 28, 2024

Conversation

MiguelCompany
Copy link
Member

@MiguelCompany MiguelCompany commented Nov 21, 2024

Description

DDS security specifies the possibility of selecting the key agreement algorithm used to generate the shared secret at the end of the authentication phase.

The Fast DDS documentation indicates that Elliptic Curve Diffie-Hellman (ECDH) is used, but this is only the case if a participant from other vendor starts the authentication and proposes that method.

This pull request:

  1. Changes the default key agreement algorithm to the one indicated in the documentation
  2. Adds a new dds.sec.auth.builtin.PKI-DH.preferred_key_agreement property that allows choosing the preferred algorithm to use.

@Mergifyio backport 3.1.x

We will backport to 3.1.x, but leaving the default value of the new property to the old behavior.
We will then backport from there into 3.0.x 2.14.x 2.10.x

Contributor Checklist

  • Commit messages follow the project guidelines.
  • The code follows the style guidelines of this project.
  • Tests that thoroughly check the new feature have been added/Regression tests checking the bug and its fix have been added; the added tests pass locally
  • N/A Any new/modified methods have been properly documented using Doxygen.
  • Any new configuration API has an equivalent XML API (with the corresponding XSD extension)
  • Changes are backport compatible: they do NOT break ABI nor change library core behavior.
  • Changes are API compatible.
  • New feature has been added to the versions.md file (if applicable).
  • New feature has been documented/Current behavior is correctly described in the documentation.
  • Applicable backports have been included in the description.

Reviewer Checklist

  • The PR has a milestone assigned.
  • The title and description correctly express the PR's purpose.
  • Check contributor checklist is correct.
  • If this is a critical bug fix, backports to the critical-only supported branches have been requested.
  • Check CI results: changes do not issue any warning.
  • Check CI results: failing tests are unrelated with the changes.

@MiguelCompany MiguelCompany added needs-review PR that is ready to be reviewed doc-pending Issue or PR which is pending to be documented labels Nov 21, 2024
@MiguelCompany MiguelCompany added this to the v3.2.0 milestone Nov 21, 2024
@MiguelCompany MiguelCompany changed the title [19921] New property to select preferred key agreement algorithm [22280] New property to select preferred key agreement algorithm Nov 21, 2024
Copy link
Member

@Mario-DL Mario-DL left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting additions. Apart from the comments below, I think it would be interesting to have the possibility of specifying this property in the XML. If the suggestion is accepted, proper XMLParser test should be added.
Also, we would need to pair this PR with the corresponding one in docs

src/cpp/security/authentication/PKIDH.cpp Outdated Show resolved Hide resolved
src/cpp/security/authentication/PKIDH.cpp Outdated Show resolved Hide resolved
@Mario-DL Mario-DL removed the needs-review PR that is ready to be reviewed label Nov 22, 2024
@MiguelCompany
Copy link
Member Author

Apart from the comments below, I think it would be interesting to have the possibility of specifying this property in the XML. If the suggestion is accepted, proper XMLParser test should be added.

Properties are already parsed from the XML. There is no distinction or special processing for the security ones.
On commit c01c29d I have added the new property to the profiles of some of the security communication tests.

Mario-DL
Mario-DL previously approved these changes Nov 25, 2024
Mario-DL
Mario-DL previously approved these changes Nov 25, 2024
Copy link
Member

@Mario-DL Mario-DL left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with green CI

Mario-DL
Mario-DL previously approved these changes Nov 27, 2024
Copy link
Member

@Mario-DL Mario-DL left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with green CI

Copy link
Member

@Mario-DL Mario-DL left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Mario-DL
Copy link
Member

Ci already full green see here. Rebase conflicts only in versions.md. Marking as RTM

@Mario-DL Mario-DL added ready-to-merge Ready to be merged. CI and changes have been reviewed and approved. and removed ci-pending PR which CI is running labels Nov 28, 2024
@Mario-DL
Copy link
Member

@Mergifyio backport 3.1.x

Copy link
Contributor

mergify bot commented Nov 28, 2024

backport 3.1.x

✅ Backports have been created

@MiguelCompany MiguelCompany merged commit 8a99a07 into master Nov 28, 2024
3 checks passed
@MiguelCompany MiguelCompany deleted the feature/19921 branch November 28, 2024 15:14
mergify bot pushed a commit that referenced this pull request Nov 28, 2024
* Refs #19921. Implement selection of key agreement.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Change default to ECDH.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated publisher code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated subscriber code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add new parameter to BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on publisher properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on subscriber properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Improve emplace_back calls.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Uncrustify.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Use `DH` alias instead of `RSA`.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Add new property to communication tests XML profiles.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Configure key agreement on BB test depending on process id.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to new option.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to blackbox test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Remove unused lambda capture.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix failing blackbox tests.

Signed-off-by: Miguel Company <[email protected]>

* Update versions.md

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
(cherry picked from commit 8a99a07)

# Conflicts:
#	versions.md
MiguelCompany added a commit that referenced this pull request Nov 29, 2024
* New property to select preferred key agreement algorithm (#5413)

* Refs #19921. Implement selection of key agreement.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Change default to ECDH.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated publisher code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated subscriber code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add new parameter to BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on publisher properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on subscriber properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Improve emplace_back calls.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Uncrustify.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Use `DH` alias instead of `RSA`.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Add new property to communication tests XML profiles.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Configure key agreement on BB test depending on process id.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to new option.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to blackbox test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Remove unused lambda capture.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix failing blackbox tests.

Signed-off-by: Miguel Company <[email protected]>

* Update versions.md

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
(cherry picked from commit 8a99a07)

# Conflicts:
#	versions.md

* Fix conflicts.

Signed-off-by: Miguel Company <[email protected]>

* Change default value to `DH`.

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
Co-authored-by: Miguel Company <[email protected]>
mergify bot added a commit that referenced this pull request Nov 29, 2024
* New property to select preferred key agreement algorithm (#5413)

* Refs #19921. Implement selection of key agreement.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Change default to ECDH.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated publisher code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated subscriber code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add new parameter to BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on publisher properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on subscriber properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Improve emplace_back calls.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Uncrustify.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Use `DH` alias instead of `RSA`.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Add new property to communication tests XML profiles.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Configure key agreement on BB test depending on process id.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to new option.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to blackbox test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Remove unused lambda capture.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix failing blackbox tests.

Signed-off-by: Miguel Company <[email protected]>

* Update versions.md

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
(cherry picked from commit 8a99a07)

# Conflicts:
#	versions.md

* Fix conflicts.

Signed-off-by: Miguel Company <[email protected]>

* Change default value to `DH`.

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
Co-authored-by: Miguel Company <[email protected]>
(cherry picked from commit 4d793f0)
mergify bot added a commit that referenced this pull request Nov 29, 2024
* New property to select preferred key agreement algorithm (#5413)

* Refs #19921. Implement selection of key agreement.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Change default to ECDH.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated publisher code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated subscriber code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add new parameter to BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on publisher properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on subscriber properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Improve emplace_back calls.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Uncrustify.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Use `DH` alias instead of `RSA`.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Add new property to communication tests XML profiles.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Configure key agreement on BB test depending on process id.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to new option.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to blackbox test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Remove unused lambda capture.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix failing blackbox tests.

Signed-off-by: Miguel Company <[email protected]>

* Update versions.md

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
(cherry picked from commit 8a99a07)

# Conflicts:
#	versions.md

* Fix conflicts.

Signed-off-by: Miguel Company <[email protected]>

* Change default value to `DH`.

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
Co-authored-by: Miguel Company <[email protected]>
(cherry picked from commit 4d793f0)

# Conflicts:
#	test/blackbox/common/BlackboxTestsSecurity.cpp
#	versions.md
mergify bot added a commit that referenced this pull request Nov 29, 2024
* New property to select preferred key agreement algorithm (#5413)

* Refs #19921. Implement selection of key agreement.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Change default to ECDH.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated publisher code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated subscriber code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add new parameter to BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on publisher properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on subscriber properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Improve emplace_back calls.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Uncrustify.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Use `DH` alias instead of `RSA`.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Add new property to communication tests XML profiles.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Configure key agreement on BB test depending on process id.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to new option.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to blackbox test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Remove unused lambda capture.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix failing blackbox tests.

Signed-off-by: Miguel Company <[email protected]>

* Update versions.md

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
(cherry picked from commit 8a99a07)

# Conflicts:
#	versions.md

* Fix conflicts.

Signed-off-by: Miguel Company <[email protected]>

* Change default value to `DH`.

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
Co-authored-by: Miguel Company <[email protected]>
(cherry picked from commit 4d793f0)

# Conflicts:
#	test/blackbox/common/BlackboxTestsSecurity.cpp
#	versions.md
MiguelCompany pushed a commit that referenced this pull request Dec 3, 2024
…) (#5443)

* New property to select preferred key agreement algorithm (#5413)

* Refs #19921. Implement selection of key agreement.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Change default to ECDH.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated publisher code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Factor out duplicated subscriber code on BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add new parameter to BB test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on publisher properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Apply new parameter on subscriber properties.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Improve emplace_back calls.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Uncrustify.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Use `DH` alias instead of `RSA`.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Add new property to communication tests XML profiles.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix unit test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Configure key agreement on BB test depending on process id.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to new option.

Signed-off-by: Miguel Company <[email protected]>

* Refs #19921. Add `AUTO` value to blackbox test.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Remove unused lambda capture.

Signed-off-by: Miguel Company <[email protected]>

* Refs #22280. Fix failing blackbox tests.

Signed-off-by: Miguel Company <[email protected]>

* Update versions.md

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
(cherry picked from commit 8a99a07)

# Conflicts:
#	versions.md

* Fix conflicts.

Signed-off-by: Miguel Company <[email protected]>

* Change default value to `DH`.

Signed-off-by: Miguel Company <[email protected]>

---------

Signed-off-by: Miguel Company <[email protected]>
Co-authored-by: Miguel Company <[email protected]>
(cherry picked from commit 4d793f0)

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ready-to-merge Ready to be merged. CI and changes have been reviewed and approved.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants