niklas/cyclonedds
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Send crypto tokens after handshake is completely finished

Browse source 
Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
This commit is contained in:
Marcel Jordense 2020-03-26 18:51:01 +01:00 • committed by eboasson
parent a77fe10a04
commit 9175f44273
6 changed files with 86 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
View file

@ -64,6 +64,7 @@ struct security_entity_match {
ddsrt_avl_node_t avlnode;
struct guid_pair guids;
bool matched;
bool tokens_sent;
int64_t crypto_handle;
DDS_Security_ParticipantCryptoTokenSeq *tokens;
};
@ -85,6 +86,7 @@ struct proxypp_pp_match {
DDS_Security_ParticipantCryptoHandle pp_crypto_handle;
DDS_Security_PermissionsHandle permissions_handle;
DDS_Security_SharedSecretHandle shared_secret;
bool authenticated;
};
struct participant_sec_attributes {
@ -558,6 +560,20 @@ bool q_omg_security_remote_participant_is_initialized(struct proxy_participant *
*/
bool q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret);
/**
* @brief Sets the matching participant and proxy participant as authorized.
*
* When the authentication handshake has finished successfully and the
* volatile secure readers and writers are matched then with this function
* the matching local and remote participant are set to authenticated which
* allows the crypto tokens to be exchanged and the corresponding entities
* be matched.
*
* @param[in] pp The participant.
* @param[in] proxypp The proxy participant.
*/
void q_omg_security_set_remote_participant_authenticated(struct participant *pp, struct proxy_participant *proxypp);
/**
* @brief Removes a registered proxy participant from administation of the authentication,
* access control and crypto plugins.

43
src/core/ddsi/src/ddsi_security_omg.c
View file

@ -378,6 +378,7 @@ static struct proxypp_pp_match * proxypp_pp_match_new(struct participant *pp, DD
pm->pp_crypto_handle = pp->sec_attr->crypto_handle;
pm->permissions_handle = permissions_hdl;
pm->shared_secret = shared_secret;
pm->authenticated = false;
return pm;
}
@ -1753,6 +1754,37 @@ register_failed:
return ret;
}
void q_omg_security_set_remote_participant_authenticated(struct participant *pp, struct proxy_participant *proxypp)
{
struct proxypp_pp_match *pm;
ddsrt_mutex_lock(&proxypp->sec_attr->lock);
pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
if (pm)
pm->authenticated = true;
ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
}
static bool is_volatile_secure_endpoint(ddsi_entityid_t entityid)
{
return ((entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER) || (entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER));
}
static struct proxypp_pp_match * get_pp_proxypp_match_if_authenticated(struct participant *pp, struct proxy_participant *proxypp, ddsi_entityid_t entityid)
{
struct proxypp_pp_match *pm;
ddsrt_mutex_lock(&proxypp->sec_attr->lock);
pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
if (pm)
{
if (!pm->authenticated && !is_volatile_secure_endpoint(entityid))
pm = NULL;
}
ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
return pm;
}
void q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp)
{
struct ddsi_domaingv *gv = proxypp->e.gv;
@ -2028,11 +2060,9 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
struct security_entity_match *match;
bool send_tokens = false;
ddsrt_mutex_lock(&proxypp->sec_attr->lock);
pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
*crypto_handle = 0;
if (!pm)
if ((pm = get_pp_proxypp_match_if_authenticated(pp, proxypp, pwr->e.guid.entityid)) == NULL)
return false;
/* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.
@ -2380,10 +2410,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
*crypto_handle = 0;
ddsrt_mutex_lock(&proxypp->sec_attr->lock);
pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
if (!pm)
if ((pm = get_pp_proxypp_match_if_authenticated(pp, proxypp, prd->e.guid.entityid)) == NULL)
return false;
/* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.

3
src/core/ddsi/src/q_entity.c
View file

@ -3620,7 +3620,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
assert ((wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL) ||
(wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER));
}
wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL);
wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL || wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER);
wr->include_keyhash =
wr->e.gv->config.generate_keyhash &&
((wr->e.guid.entityid.u & NN_ENTITYID_KIND_MASK) == NN_ENTITYID_KIND_WRITER_WITH_KEY);
@ -4773,6 +4773,7 @@ void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp,
DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") processed\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
if (q_omg_security_register_remote_participant(pp, proxypp, shared_secret)) {
match_volatile_secure_endpoints(pp, proxypp);
q_omg_security_set_remote_participant_authenticated(pp, proxypp);
}
break;