OpenDDS  Snapshot(2023/04/05-13:10)
Modules | Classes | Typedefs | Enumerations | Functions | Variables
OpenDDS::Security Module Reference

Modules

 CommonUtilities
 
 SSL
 
 XmlUtils
 

Classes

class  AccessControlBuiltInImpl
 Implements the DDS built-in version of the Access Control plugin for the DDS Security Specification. More...
 
class  AuthenticationBuiltInImpl
 Implements the DDS built-in version of the Authentication plugin for the DDS Security Specification. More...
 
class  BuiltInPluginLoader
 
class  BuiltinPluginsInitializer
 
class  BuiltInSecurityPluginInst
 Factory object to create interfaces for the BuiltIn plugin. More...
 
class  CredentialHash
 
class  CryptoBuiltInImpl
 
struct  CryptoContent
 
struct  CryptoFooter
 
struct  CryptoHeader
 
struct  CryptoTransformIdentifier
 
class  Governance
 
class  HandleRegistry
 
struct  has_property
 
struct  KeyMaterial_AES_GCM_GMAC
 
class  LocalAccessCredentialData
 
class  LocalAuthCredentialData
 
struct  Permissions
 
struct  ReceiverSpecificMAC
 
class  SecurityConfig
 
class  SecurityPluginInst
 Base class for concrete security plugins to provide new objects. More...
 
class  SecurityRegistry
 
struct  SharedSecret
 
struct  SPDPdiscoveredParticipantData
 
class  TokenReader
 Implements some simple wrapper functions to provide a const API around the Token data structure as specified in the DDS security specification. More...
 
class  TokenWriter
 Implements some simple wrapper functions to provide a non-const API around the Token data structure as specified in the DDS security specification. More...
 
class  Utility
 
class  UtilityImpl
 

Typedefs

typedef DCPS::DisjointSequence::OrderedRanges< DDS::Security::DomainId_tDomainIdSet
 
typedef Governance::GovernanceAccessRules::iterator gov_iter
 
typedef Permissions::Grants::iterator grant_iter
 
typedef Permissions::Rules::iterator perm_topic_rules_iter
 
typedef Permissions::Actions::iterator perm_topic_actions_iter
 
typedef octet CryptoTransformKind[4]
 
typedef octet CryptoTransformKeyId[4]
 
typedef sequence< octet, 32 > KeyOctetSeq
 
typedef sequence< KeyMaterial_AES_GCM_GMACKeyMaterial_AES_GCM_GMAC_Seq
 
typedef octet SessionIdType[4]
 
typedef octet IV_SuffixType[8]
 
typedef octet ReceiverMAC_Type[16]
 
typedef sequence< ReceiverSpecificMACReceiverSpecificMACSeq
 
typedef octet CommonMAC_Type[16]
 
typedef DCPS::RcHandle< HandleRegistryHandleRegistry_rch
 
typedef DCPS::RcHandle< SecurityConfigSecurityConfig_rch
 
typedef std::pair< OPENDDS_STRING, OPENDDS_STRINGConfigProperty
 
typedef DCPS::RcHandle< SecurityPluginInstSecurityPluginInst_rch
 

Enumerations

enum  DiscoveredParticipantDataKind { DPDK_NONE, DPDK_ORIGINAL, DPDK_ENHANCED, DPDK_SECURE }
 

Functions

static const std::string PermissionsTokenClassId ("DDS:Access:Permissions:1.0")
 
static const std::string AccessControl_Plugin_Name ("DDS:Access:Permissions")
 
static const std::string AccessControl_Major_Version ("1")
 
static const std::string AccessControl_Minor_Version ("0")
 
static const std::string PermissionsCredentialTokenClassId ("DDS:Access:PermissionsCredential")
 
static bool challenges_match (const DDS::OctetSeq &c1, const DDS::OctetSeq &c2)
 
static void extract_participant_guid_from_cpdata (const DDS::OctetSeq &cpdata, DCPS::GUID_t &dst)
 
static bool validate_topic_data_guid (const DDS::OctetSeq &cpdata, const std::vector< unsigned char > &subject_name_hash, DDS::Security::SecurityException &ex)
 
const std::string Auth_Plugin_Name ("DDS:Auth:PKI-DH")
 
const std::string Auth_Plugin_Major_Version ("1")
 
const std::string Auth_Plugin_Minor_Version ("0")
 
const std::string Auth_Request_Class_Ext ("AuthReq")
 
const std::string Handshake_Request_Class_Ext ("Req")
 
const std::string Handshake_Reply_Class_Ext ("Reply")
 
const std::string Handshake_Final_Class_Ext ("Final")
 
static void make_reply_signature_sequence (const DDS::OctetSeq &hash_c2, const DDS::OctetSeq &challenge2, const DDS::OctetSeq &dh2, const DDS::OctetSeq &challenge1, const DDS::OctetSeq &dh1, const DDS::OctetSeq &hash_c1, DDS::BinaryPropertySeq &dst)
 
static void make_final_signature_sequence (const DDS::OctetSeq &hash_c1, const DDS::OctetSeq &challenge1, const DDS::OctetSeq &dh1, const DDS::OctetSeq &challenge2, const DDS::OctetSeq &dh2, const DDS::OctetSeq &hash_c2, DDS::BinaryPropertySeq &dst)
 
 ACE_FACTORY_DEFINE (OpenDDS_Security, BuiltInPluginLoader)
 
typedef OPENDDS_VECTOR (ConfigProperty) ConfigPropertyList
 

Variables

const DDS::Security::DomainId_t domain_id_min = 0
 
const DDS::Security::DomainId_t domain_id_max = ACE_INT32_MAX
 
const char Identity_Status_Token_Class_Id [] = "DDS:Auth:PKI-DH:1.0"
 
const char Auth_Peer_Cred_Token_Class_Id [] = "DDS:Auth:PKI-DH:1.0"
 
const char dds_cert_sn [] = "dds.cert.sn"
 
const char dds_cert_algo [] = "dds.cert.algo"
 
const char dds_ca_sn [] = "dds.ca.sn"
 
const char dds_ca_algo [] = "dds.ca.algo"
 
static BuiltinPluginsInitializer builtin_plugins_init
 
const unsigned long TransformKindIndex = 3
 
const octet CRYPTO_TRANSFORMATION_KIND_NONE = 0
 
const octet CRYPTO_TRANSFORMATION_KIND_AES128_GMAC = 1
 
const octet CRYPTO_TRANSFORMATION_KIND_AES128_GCM = 2
 
const octet CRYPTO_TRANSFORMATION_KIND_AES256_GMAC = 3
 
const octet CRYPTO_TRANSFORMATION_KIND_AES256_GCM = 4
 
const unsigned long FLAG_IS_SUBMESSAGE_ENCRYPTED = 1
 
const unsigned long FLAG_IS_PAYLOAD_ENCRYPTED = 2
 

Typedef Documentation

◆ CommonMAC_Type

typedef octet OpenDDS::Security::CommonMAC_Type[16]

Definition at line 92 of file CryptoBuiltIn.idl.

◆ ConfigProperty

Definition at line 20 of file SecurityConfigPropertyList.h.

◆ CryptoTransformKeyId

typedef octet OpenDDS::Security::CryptoTransformKeyId[4]

Definition at line 51 of file CryptoBuiltIn.idl.

◆ CryptoTransformKind

typedef octet OpenDDS::Security::CryptoTransformKind[4]

Definition at line 50 of file CryptoBuiltIn.idl.

◆ DomainIdSet

Definition at line 20 of file DomainIdSet.h.

◆ gov_iter

typedef Governance::GovernanceAccessRules::iterator OpenDDS::Security::gov_iter

Definition at line 38 of file AccessControlBuiltInImpl.cpp.

◆ grant_iter

typedef Permissions::Grants::iterator OpenDDS::Security::grant_iter

Definition at line 39 of file AccessControlBuiltInImpl.cpp.

◆ HandleRegistry_rch

Definition at line 107 of file HandleRegistry.h.

◆ IV_SuffixType

typedef octet OpenDDS::Security::IV_SuffixType[8]

Definition at line 73 of file CryptoBuiltIn.idl.

◆ KeyMaterial_AES_GCM_GMAC_Seq

Definition at line 70 of file CryptoBuiltIn.idl.

◆ KeyOctetSeq

typedef sequence<octet, 32> OpenDDS::Security::KeyOctetSeq

Definition at line 57 of file CryptoBuiltIn.idl.

◆ perm_topic_actions_iter

typedef Permissions::Actions::iterator OpenDDS::Security::perm_topic_actions_iter

Definition at line 41 of file AccessControlBuiltInImpl.cpp.

◆ perm_topic_rules_iter

typedef Permissions::Rules::iterator OpenDDS::Security::perm_topic_rules_iter

Definition at line 40 of file AccessControlBuiltInImpl.cpp.

◆ ReceiverMAC_Type

typedef octet OpenDDS::Security::ReceiverMAC_Type[16]

Definition at line 85 of file CryptoBuiltIn.idl.

◆ ReceiverSpecificMACSeq

Definition at line 91 of file CryptoBuiltIn.idl.

◆ SecurityConfig_rch

Definition at line 23 of file SecurityConfig_rch.h.

◆ SecurityPluginInst_rch

Definition at line 19 of file SecurityPluginInst_rch.h.

◆ SessionIdType

typedef octet OpenDDS::Security::SessionIdType[4]

Definition at line 72 of file CryptoBuiltIn.idl.

Enumeration Type Documentation

◆ DiscoveredParticipantDataKind

Enumerator
DPDK_NONE 
DPDK_ORIGINAL 
DPDK_ENHANCED 
DPDK_SECURE 

Definition at line 18 of file RtpsSecurity.idl.

Function Documentation

◆ AccessControl_Major_Version()

static const std::string OpenDDS::Security::AccessControl_Major_Version ( "1"  )
static

◆ AccessControl_Minor_Version()

static const std::string OpenDDS::Security::AccessControl_Minor_Version ( "0"  )
static

◆ AccessControl_Plugin_Name()

static const std::string OpenDDS::Security::AccessControl_Plugin_Name ( "DDS:Access:Permissions"  )
static

◆ ACE_FACTORY_DEFINE()

OpenDDS::Security::ACE_FACTORY_DEFINE ( OpenDDS_Security  ,
BuiltInPluginLoader   
)

◆ Auth_Plugin_Major_Version()

const std::string OpenDDS::Security::Auth_Plugin_Major_Version ( "1"  )

◆ Auth_Plugin_Minor_Version()

const std::string OpenDDS::Security::Auth_Plugin_Minor_Version ( "0"  )

◆ Auth_Plugin_Name()

const std::string OpenDDS::Security::Auth_Plugin_Name ( "DDS:Auth:PKI-DH"  )

◆ Auth_Request_Class_Ext()

const std::string OpenDDS::Security::Auth_Request_Class_Ext ( "AuthReq"  )

◆ challenges_match()

bool OpenDDS::Security::challenges_match ( const DDS::OctetSeq c1,
const DDS::OctetSeq c2 
)
static

Definition at line 1240 of file AuthenticationBuiltInImpl.cpp.

Referenced by OpenDDS::Security::AuthenticationBuiltInImpl::begin_handshake_reply(), OpenDDS::Security::AuthenticationBuiltInImpl::process_final_handshake(), and OpenDDS::Security::AuthenticationBuiltInImpl::process_handshake_reply().

1241 {
1242  if ((c1.length()) < 1 || (c2.length() < 1)) {
1243  return false;
1244  }
1245  if (c1.length() != c2.length()) {
1246  return false;
1247  }
1248 
1249  if (0 != std::memcmp(c1.get_buffer(), c2.get_buffer(), c2.length())) {
1250  return false;
1251  }
1252 
1253  return true;
1254 }

◆ extract_participant_guid_from_cpdata()

void OpenDDS::Security::extract_participant_guid_from_cpdata ( const DDS::OctetSeq cpdata,
DCPS::GUID_t dst 
)
static

Definition at line 422 of file AuthenticationBuiltInImpl.cpp.

References ACE_ERROR, ACE_TEXT(), OpenDDS::DCPS::ENDIAN_BIG, OpenDDS::RTPS::Parameter::guid, OpenDDS::DCPS::GUID_UNKNOWN, OpenDDS::DCPS::Encoding::KIND_XCDR1, LM_WARNING, OpenDDS::RTPS::PID_PARTICIPANT_GUID, and ACE_Message_Block::wr_ptr().

Referenced by validate_topic_data_guid().

423 {
424  dst = DCPS::GUID_UNKNOWN;
425 
426  ACE_Message_Block buffer(reinterpret_cast<const char*>(cpdata.get_buffer()), cpdata.length());
427  buffer.wr_ptr(cpdata.length());
428  OpenDDS::DCPS::Serializer serializer(&buffer,
429  DCPS::Encoding::KIND_XCDR1,
431  RTPS::ParameterList params;
432 
433  if (serializer >> params) {
434  for (unsigned int i = 0; i < params.length(); ++i) {
435  const RTPS::Parameter& p = params[i];
436 
437  if (p._d() == RTPS::PID_PARTICIPANT_GUID) {
438  dst = p.guid();
439  break;
440  }
441  }
442 
443  } else {
444  ACE_ERROR((LM_WARNING,
445  ACE_TEXT("(%P|%t) WARNING: extract_participant_guid_from_cpdata, ")
446  ACE_TEXT("failed to deserialize guid from cpdata.\n")));
447  }
448 
449 }
#define ACE_ERROR(X)
Class to serialize and deserialize data for DDS.
Definition: Serializer.h:369
const GUID_t GUID_UNKNOWN
Nil value for GUID.
Definition: GuidUtils.h:59
const ParameterId_t PID_PARTICIPANT_GUID
Definition: RtpsCore.idl:287
char * wr_ptr(void) const
ACE_TEXT("TCP_Factory")

◆ Handshake_Final_Class_Ext()

const std::string OpenDDS::Security::Handshake_Final_Class_Ext ( "Final"  )

◆ Handshake_Reply_Class_Ext()

const std::string OpenDDS::Security::Handshake_Reply_Class_Ext ( "Reply"  )

◆ Handshake_Request_Class_Ext()

const std::string OpenDDS::Security::Handshake_Request_Class_Ext ( "Req"  )

◆ make_final_signature_sequence()

static void OpenDDS::Security::make_final_signature_sequence ( const DDS::OctetSeq hash_c1,
const DDS::OctetSeq challenge1,
const DDS::OctetSeq dh1,
const DDS::OctetSeq challenge2,
const DDS::OctetSeq dh2,
const DDS::OctetSeq hash_c2,
DDS::BinaryPropertySeq dst 
)
static

Definition at line 550 of file AuthenticationBuiltInImpl.cpp.

References DDS::BinaryProperty_t::name, DDS::BinaryProperty_t::propagate, and DDS::BinaryProperty_t::value.

Referenced by OpenDDS::Security::AuthenticationBuiltInImpl::process_final_handshake(), and OpenDDS::Security::AuthenticationBuiltInImpl::process_handshake_reply().

557 {
558  DCPS::SequenceBackInsertIterator<DDS::BinaryPropertySeq> inserter(dst);
559 
560  {
562  p.name = "hash_c1";
563  p.value = hash_c1;
564  p.propagate = true;
565  *inserter = p;
566  }
567 
568  {
570  p.name = "challenge1";
571  p.value = challenge1;
572  p.propagate = true;
573  *inserter = p;
574  }
575 
576  {
578  p.name = "dh1";
579  p.value = dh1;
580  p.propagate = true;
581  *inserter = p;
582  }
583 
584  {
586  p.name = "challenge2";
587  p.value = challenge2;
588  p.propagate = true;
589  *inserter = p;
590  }
591 
592  {
594  p.name = "dh2";
595  p.value = dh2;
596  p.propagate = true;
597  *inserter = p;
598  }
599 
600  {
602  p.name = "hash_c2";
603  p.value = hash_c2;
604  p.propagate = true;
605  *inserter = p;
606  }
607 }

◆ make_reply_signature_sequence()

static void OpenDDS::Security::make_reply_signature_sequence ( const DDS::OctetSeq hash_c2,
const DDS::OctetSeq challenge2,
const DDS::OctetSeq dh2,
const DDS::OctetSeq challenge1,
const DDS::OctetSeq dh1,
const DDS::OctetSeq hash_c1,
DDS::BinaryPropertySeq dst 
)
static

Definition at line 491 of file AuthenticationBuiltInImpl.cpp.

References DDS::BinaryProperty_t::name, DDS::BinaryProperty_t::propagate, and DDS::BinaryProperty_t::value.

Referenced by OpenDDS::Security::AuthenticationBuiltInImpl::begin_handshake_reply(), and OpenDDS::Security::AuthenticationBuiltInImpl::process_handshake_reply().

498 {
499  DCPS::SequenceBackInsertIterator<DDS::BinaryPropertySeq> inserter(dst);
500 
501  {
503  p.name = "hash_c2";
504  p.value = hash_c2;
505  p.propagate = true;
506  *inserter = p;
507  }
508 
509  {
511  p.name = "challenge2";
512  p.value = challenge2;
513  p.propagate = true;
514  *inserter = p;
515  }
516 
517  {
519  p.name = "dh2";
520  p.value = dh2;
521  p.propagate = true;
522  *inserter = p;
523  }
524 
525  {
527  p.name = "challenge1";
528  p.value = challenge1;
529  p.propagate = true;
530  *inserter = p;
531  }
532 
533  {
535  p.name = "dh1";
536  p.value = dh1;
537  p.propagate = true;
538  *inserter = p;
539  }
540 
541  {
543  p.name = "hash_c1";
544  p.value = hash_c1;
545  p.propagate = true;
546  *inserter = p;
547  }
548 }

◆ OPENDDS_VECTOR()

typedef OpenDDS::Security::OPENDDS_VECTOR ( ConfigProperty  )

◆ PermissionsCredentialTokenClassId()

static const std::string OpenDDS::Security::PermissionsCredentialTokenClassId ( "DDS:Access:PermissionsCredential"  )
static

◆ PermissionsTokenClassId()

static const std::string OpenDDS::Security::PermissionsTokenClassId ( "DDS:Access:Permissions:1.0"  )
static

◆ validate_topic_data_guid()

bool OpenDDS::Security::validate_topic_data_guid ( const DDS::OctetSeq cpdata,
const std::vector< unsigned char > &  subject_name_hash,
DDS::Security::SecurityException ex 
)
static

Definition at line 451 of file AuthenticationBuiltInImpl.cpp.

References extract_participant_guid_from_cpdata(), OpenDDS::DCPS::GUID_t::guidPrefix, OpenDDS::Security::SSL::offset_1bit(), and OpenDDS::Security::CommonUtilities::set_security_error().

Referenced by OpenDDS::Security::AuthenticationBuiltInImpl::begin_handshake_reply(), and OpenDDS::Security::AuthenticationBuiltInImpl::process_handshake_reply().

454 {
455  if (cpdata.length() > 5u) { /* Enough to withstand the hash-comparison below */
456 
457  DCPS::GUID_t remote_participant_guid;
458  extract_participant_guid_from_cpdata(cpdata, remote_participant_guid);
459 
460  const DCPS::GuidPrefix_t& prefix = remote_participant_guid.guidPrefix;
461 
462  /* Make sure first bit is set */
463 
464  if ((prefix[0] & 0x80) != 0x80) {
465  set_security_error(ex, -1, 0, "Malformed participant_guid in 'c.pdata'; First bit must be set.");
466  return false;
467  }
468 
469  /* Check the following 47 bits match the subject-hash */
470 
471  /* First byte needs to remove the manually-set first-bit before comparison */
472  if ((prefix[0] & 0x7F) != SSL::offset_1bit(&subject_name_hash[0], 0)) {
473  set_security_error(ex, -1, 0, "First byte of participant_guid in 'c.pdata' does not match bits of subject-name hash in 'c.id'");
474  return false;
475  }
476  for (size_t i = 1; i <= 5u; ++i) { /* Compare remaining 5 bytes */
477  if (prefix[i] != SSL::offset_1bit(&subject_name_hash[0], i)) { /* Slide the hash to the right 1 so it aligns with the guid prefix */
478  set_security_error(ex, -1, 0, "Bits 2 - 48 of 'c.pdata' participant_guid does not match first 47 bits of subject-name hash in 'c.id'");
479  return false;
480  }
481  }
482 
483  } else {
484  set_security_error(ex, -1, 0, "Data missing in 'c.pdata'");
485  return false;
486  }
487 
488  return true;
489 }
static void extract_participant_guid_from_cpdata(const DDS::OctetSeq &cpdata, DCPS::GUID_t &dst)
bool set_security_error(DDS::Security::SecurityException &ex, int code, int minor_code, const char *message)
octet GuidPrefix_t[12]
Definition: DdsDcpsGuid.idl:19
unsigned char offset_1bit(const unsigned char array[], size_t i)
Gets byte from array as though it were shifted right one bit.

Variable Documentation

◆ Auth_Peer_Cred_Token_Class_Id

const char OpenDDS::Security::Auth_Peer_Cred_Token_Class_Id[] = "DDS:Auth:PKI-DH:1.0"

◆ builtin_plugins_init

BuiltinPluginsInitializer OpenDDS::Security::builtin_plugins_init
static

Definition at line 23 of file BuiltInPlugins.h.

◆ CRYPTO_TRANSFORMATION_KIND_AES128_GCM

const octet OpenDDS::Security::CRYPTO_TRANSFORMATION_KIND_AES128_GCM = 2

◆ CRYPTO_TRANSFORMATION_KIND_AES128_GMAC

const octet OpenDDS::Security::CRYPTO_TRANSFORMATION_KIND_AES128_GMAC = 1

◆ CRYPTO_TRANSFORMATION_KIND_AES256_GCM

const octet OpenDDS::Security::CRYPTO_TRANSFORMATION_KIND_AES256_GCM = 4

◆ CRYPTO_TRANSFORMATION_KIND_AES256_GMAC

const octet OpenDDS::Security::CRYPTO_TRANSFORMATION_KIND_AES256_GMAC = 3

◆ CRYPTO_TRANSFORMATION_KIND_NONE

const octet OpenDDS::Security::CRYPTO_TRANSFORMATION_KIND_NONE = 0

◆ dds_ca_algo

const char OpenDDS::Security::dds_ca_algo[] = "dds.ca.algo"

◆ dds_ca_sn

const char OpenDDS::Security::dds_ca_sn[] = "dds.ca.sn"

◆ dds_cert_algo

const char OpenDDS::Security::dds_cert_algo[] = "dds.cert.algo"

◆ dds_cert_sn

const char OpenDDS::Security::dds_cert_sn[] = "dds.cert.sn"

◆ domain_id_max

const DDS::Security::DomainId_t OpenDDS::Security::domain_id_max = ACE_INT32_MAX

◆ domain_id_min

const DDS::Security::DomainId_t OpenDDS::Security::domain_id_min = 0

Definition at line 21 of file DomainIdSet.h.

Referenced by OpenDDS::Security::XmlUtils::parse_domain_id_set().

◆ FLAG_IS_PAYLOAD_ENCRYPTED

const unsigned long OpenDDS::Security::FLAG_IS_PAYLOAD_ENCRYPTED = 2

◆ FLAG_IS_SUBMESSAGE_ENCRYPTED

const unsigned long OpenDDS::Security::FLAG_IS_SUBMESSAGE_ENCRYPTED = 1

◆ Identity_Status_Token_Class_Id

const char OpenDDS::Security::Identity_Status_Token_Class_Id[] = "DDS:Auth:PKI-DH:1.0"

◆ TransformKindIndex

const unsigned long OpenDDS::Security::TransformKindIndex = 3