Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[22280] New property to select preferred key agreement algorithm (backport #5413) (backport #5442) #5444

Open
wants to merge 1 commit into
base: 2.14.x
Choose a base branch
from

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Nov 29, 2024

Description

DDS security specifies the possibility of selecting the key agreement algorithm used to generate the shared secret at the end of the authentication phase.

The Fast DDS documentation indicates that Elliptic Curve Diffie-Hellman (ECDH) is used, but this is only the case if a participant from other vendor starts the authentication and proposes that method.

This pull request:

  1. Changes the default key agreement algorithm to the one indicated in the documentation
  2. Adds a new dds.sec.auth.builtin.PKI-DH.preferred_key_agreement property that allows choosing the preferred algorithm to use.

@Mergifyio backport 3.1.x

We will backport to 3.1.x, but leaving the default value of the new property to the old behavior.
We will then backport from there into 3.0.x 2.14.x 2.10.x

Contributor Checklist

  • Commit messages follow the project guidelines.
  • The code follows the style guidelines of this project.
  • Tests that thoroughly check the new feature have been added/Regression tests checking the bug and its fix have been added; the added tests pass locally
  • N/A Any new/modified methods have been properly documented using Doxygen.
  • Any new configuration API has an equivalent XML API (with the corresponding XSD extension)
  • Changes are backport compatible: they do NOT break ABI nor change library core behavior.
  • Changes are API compatible.
  • New feature has been added to the versions.md file (if applicable).
  • New feature has been documented/Current behavior is correctly described in the documentation.
  • Applicable backports have been included in the description.

Reviewer Checklist

  • The PR has a milestone assigned.
  • The title and description correctly express the PR's purpose.
  • Check contributor checklist is correct.
  • If this is a critical bug fix, backports to the critical-only supported branches have been requested.
  • Check CI results: changes do not issue any warning.
  • Check CI results: failing tests are unrelated with the changes.

This is an automatic backport of pull request #5413 done by [Mergify](https://mergify.com).
This is an automatic backport of pull request #5442 done by [Mergify](https://mergify.com).

* New property to select preferred key agreement algorithm (#5413)

* Refs #19921. Implement selection of key agreement.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Change default to ECDH.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Add unit test.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Factor out duplicated publisher code on BB test.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Factor out duplicated subscriber code on BB test.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Add new parameter to BB test.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Apply new parameter on publisher properties.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Apply new parameter on subscriber properties.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Improve emplace_back calls.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Uncrustify.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #22280. Use `DH` alias instead of `RSA`.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #22280. Add new property to communication tests XML profiles.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #22280. Fix unit test.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #22280. Configure key agreement on BB test depending on process id.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Add `AUTO` value to new option.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #19921. Add `AUTO` value to blackbox test.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #22280. Remove unused lambda capture.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Refs #22280. Fix failing blackbox tests.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Update versions.md

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

---------

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>
(cherry picked from commit 8a99a07)

# Conflicts:
#	versions.md

* Fix conflicts.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

* Change default value to `DH`.

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>

---------

Signed-off-by: Miguel Company <miguelcompany@eprosima.com>
Co-authored-by: Miguel Company <miguelcompany@eprosima.com>
(cherry picked from commit 4d793f0)

# Conflicts:
#	test/blackbox/common/BlackboxTestsSecurity.cpp
#	versions.md
@mergify mergify bot added the conflicts Backport PR wich git cherry pick failed label Nov 29, 2024
Copy link
Contributor Author

mergify bot commented Nov 29, 2024

Cherry-pick of 4d793f0 has failed:

On branch mergify/bp/2.14.x/pr-5442
Your branch is up to date with 'origin/2.14.x'.

You are currently cherry-picking commit 4d793f001.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   src/cpp/security/authentication/PKIDH.cpp
	modified:   test/dds/communication/security/secure_msg_crypto_besteffort_pub_profile.xml
	modified:   test/dds/communication/security/secure_msg_submsg_crypto_besteffort_pub_profile.xml
	modified:   test/dds/communication/security/secure_msg_submsg_crypto_besteffort_sub_profile.xml
	modified:   test/dds/communication/security/secure_submsg_crypto_besteffort_pub_profile.xml
	modified:   test/dds/communication/security/secure_submsg_crypto_besteffort_sub_profile.xml
	modified:   test/dds/communication/security/simple_secure_besteffort_pub_profile.xml
	modified:   test/dds/communication/security/simple_secure_besteffort_sub_profile.xml
	modified:   test/unittest/security/authentication/AuthenticationPluginTests.hpp
	modified:   test/unittest/security/authentication/BuiltinPKIDHTests.cpp

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   test/blackbox/common/BlackboxTestsSecurity.cpp
	both modified:   versions.md

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
conflicts Backport PR wich git cherry pick failed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant