niklas/cyclonedds
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Access Control on_revoke_permissions implementation in DDSI

Browse source 
Implement handler for access control on_revoke_permissions. This callback
function disconnects and deletes all proxy participant that are using the
revoked permissions handle (in case of remote permissions expire) and
proxy participant that are connected with a participant for which the
permissions expire (local permissions expire).

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
This commit is contained in:
Dennis Potman 2020-03-26 18:48:54 +01:00 • committed by eboasson
parent e6500b6528
commit d53cdce8fe
5 changed files with 103 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/security/api/include/dds/security/dds_security_api_authentication.h
View file

@ -29,7 +29,6 @@ typedef struct dds_security_authentication_listener dds_security_authentication_
/* AuthenticationListener interface */
typedef DDS_Security_boolean (*DDS_Security_authentication_listener_on_revoke_identity)(
dds_security_authentication_listener *context,
const dds_security_authentication *plugin,
const DDS_Security_IdentityHandle handle);

2
src/security/builtin_plugins/authentication/src/authentication.c
View file

@ -639,7 +639,7 @@ static void validity_callback(struct dds_security_timed_dispatcher_t *d, dds_sec
assert(listener);
dds_security_authentication_listener *auth_listener = (dds_security_authentication_listener *)listener;
if (auth_listener->on_revoke_identity)
auth_listener->on_revoke_identity(auth_listener, (dds_security_authentication *)info->auth, info->hdl);
auth_listener->on_revoke_identity((dds_security_authentication *)info->auth, info->hdl);
}
ddsrt_free(arg);
}

15
src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
View file

@ -1811,7 +1811,7 @@ fill_handshake_message_token(
}
CU_ASSERT_FATAL (rc == DDS_SECURITY_VALIDATION_OK);
assert(rc == DDS_SECURITY_VALIDATION_OK); // for Clang's static analyzer
set_binary_property_value(signature, "signature", sign, (uint32_t)signlen);
ddsrt_free(sign);
@ -1911,18 +1911,13 @@ fill_handshake_message_token(
}
static DDS_Security_boolean
on_revoke_identity_cb( dds_security_authentication_listener *instance,
const dds_security_authentication *plugin,
const DDS_Security_IdentityHandle handle)
static DDS_Security_boolean on_revoke_identity_cb(const dds_security_authentication *plugin, const DDS_Security_IdentityHandle handle)
{
DDSRT_UNUSED_ARG( instance );
DDSRT_UNUSED_ARG( plugin );
if (identity_handle_for_callback1 == DDS_SECURITY_HANDLE_NIL) {
DDSRT_UNUSED_ARG (plugin);
if (identity_handle_for_callback1 == DDS_SECURITY_HANDLE_NIL)
identity_handle_for_callback1 = handle;
} else if (identity_handle_for_callback2 == DDS_SECURITY_HANDLE_NIL) {
else if (identity_handle_for_callback2 == DDS_SECURITY_HANDLE_NIL)
identity_handle_for_callback2 = handle;
}
printf( "Listener called for handle: %lld Local:%lld Remote:%lld\n", (long long) handle, (long long) local_identity_handle, (long long) remote_identity_handle2);
return true;

6
src/security/core/tests/secure_communication.c
View file

@ -445,13 +445,13 @@ static void test_discovery_liveliness_protection(DDS_Security_ProtectionKind dis
{
struct domain_sec_config domain_config = { discovery_pk, liveliness_pk, PK_N, PK_N, BPK_N, NULL };
/* FIXME: add more asserts in wrapper or test instead of just testing communication */
test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, &set_encryption_parameters_disc);
test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, set_encryption_parameters_disc);
}
static void test_data_protection_kind(DDS_Security_ProtectionKind rtps_pk, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
{
struct domain_sec_config domain_config = { PK_N, PK_N, rtps_pk, metadata_pk, payload_pk, NULL };
test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, &set_encryption_parameters_basic);
test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, set_encryption_parameters_basic);
}
static void test_multiple_readers(size_t n_dom, size_t n_pp, size_t n_rd, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
@ -486,7 +486,7 @@ static void test_payload_secret(DDS_Security_ProtectionKind rtps_pk, DDS_Securit
memcpy (sample.text + n * strlen (secret), secret, strlen (secret));
sample.text[payload_sz - 1] = '\0';
test_init (&domain_config, 1, 1, 1, 1, &set_encryption_parameters_secret);
test_init (&domain_config, 1, 1, 1, 1, set_encryption_parameters_secret);
create_topic_name ("ddssec_secure_communication_", g_topic_nr++, name, sizeof name);
qos = get_qos ();
create_eps (&writers, &writer_topics, 1, 1, 1, name, &SecurityCoreTests_Type2_desc, g_pub_participants, qos, &dds_create_writer, DDS_PUBLICATION_MATCHED_STATUS);