diff --git a/code/CodeTester.cpp b/code/CodeTester.cpp index 250647824..afed8adfc 100644 --- a/code/CodeTester.cpp +++ b/code/CodeTester.cpp @@ -323,6 +323,7 @@ bool permissions_test( part_attr.properties.properties().emplace_back( "dds.sec.access.builtin.Access-Permissions.permissions", permissions_file); + RTPSParticipant* participant = RTPSDomain::createParticipant(0, part_attr); if (participant != nullptr) { diff --git a/docs/fastdds/faq/security/security.rst b/docs/fastdds/faq/security/security.rst index 6e4c60700..6f88da84b 100644 --- a/docs/fastdds/faq/security/security.rst +++ b/docs/fastdds/faq/security/security.rst @@ -46,6 +46,9 @@ Authentication |br| By setting the |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value`` ``builtin.PKI-DH``. For further information, refer to :ref:`auth-pki-dh`. + Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and + cryptography plugins together. + ---------- @@ -133,6 +136,8 @@ Data encryption .. collapse:: How is the DDS:Crypto:AES-GCM-GMAC authentication plugin activated? |br| By setting the |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. + Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and + cryptography plugins together. Moreover, this plugin needs the activation of the Authentication plugin: ``DDS:Auth:PKI-DH`` and the ``DDS:Access:Permissions``. For further information, refer to :ref:`crypto-aes-gcm-gmac`. diff --git a/docs/fastdds/property_policies/security.rst b/docs/fastdds/property_policies/security.rst index dce46aa87..208f61080 100644 --- a/docs/fastdds/property_policies/security.rst +++ b/docs/fastdds/property_policies/security.rst @@ -16,6 +16,9 @@ Authentication plugin settings The :ref:`DDS\:Auth\:PKI-DH ` authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value ``builtin.PKI-DH``. +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + The following table outlines the properties used for the :ref:`DDS\:Auth\:PKI-DH ` plugin configuration. .. list-table:: @@ -130,6 +133,9 @@ Cryptographic plugin settings The :ref:`DDS\:Crypto\:AES-GCM-GMAC ` authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + Moreover, this plugin needs the activation of the :ref:`auth-pki-dh`. The :ref:`DDS\:Crypto\:AES-GCM-GMAC ` plugin is configured using the :ref:`access-permissions`, i.e the cryptography plugin is configured through the properties diff --git a/docs/fastdds/security/access_control_plugin/access_control_plugin.rst b/docs/fastdds/security/access_control_plugin/access_control_plugin.rst index 4fb0d4ccd..7e16d96b8 100644 --- a/docs/fastdds/security/access_control_plugin/access_control_plugin.rst +++ b/docs/fastdds/security/access_control_plugin/access_control_plugin.rst @@ -37,6 +37,9 @@ in detail below. The DDS\:Access\:Permissions authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.access.plugin`` with the value ``builtin.Access-Permissions``. +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + The following table outlines the properties used for the DDS\:Access\:Permissions plugin configuration. .. list-table:: @@ -80,6 +83,11 @@ configuration. :start-after: DDS_SECURITY_ACCESS_CONTROL_PLUGIN<--> :end-before: <--> +.. important:: + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + The previous example focuses only on the access control plugin, but all three plugins must be configured. + .. _permissions_ca_cert: Permissions CA Certificate diff --git a/docs/fastdds/security/auth_plugin/auth_plugin.rst b/docs/fastdds/security/auth_plugin/auth_plugin.rst index 70b182ae0..4b16d3fbd 100644 --- a/docs/fastdds/security/auth_plugin/auth_plugin.rst +++ b/docs/fastdds/security/auth_plugin/auth_plugin.rst @@ -31,6 +31,9 @@ This shared secret can be used by other security plugins as :ref:`crypto-aes-gcm The DDS:\Auth\:PKI-DH authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value ``builtin.PKI-DH``. +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + The following table outlines the properties used for the DDS:\Auth\:PKI-DH plugin configuration. .. list-table:: @@ -88,6 +91,11 @@ configuration. :start-after: DDS_SECURITY_AUTH_PLUGIN<--> :end-before: <--> +.. important:: + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + The previous example focuses only on the authentication plugin, but all three plugins must be configured. + .. _generate_x509: Generation of X.509 certificates diff --git a/docs/fastdds/security/crypto_plugin/crypto_plugin.rst b/docs/fastdds/security/crypto_plugin/crypto_plugin.rst index fc41d82ca..928d307c7 100644 --- a/docs/fastdds/security/crypto_plugin/crypto_plugin.rst +++ b/docs/fastdds/security/crypto_plugin/crypto_plugin.rst @@ -29,6 +29,9 @@ It may also provide additional DataReader-specific Message Authentication Codes The DDS\:Crypto\:AES-GCM-GMAC authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + Moreover, this plugin needs the activation of the :ref:`auth-pki-dh`. The DDS\:Crypto\:\AES-GCM-GMAC plugin is configured using the :ref:`access-permissions`, i.e the cryptography plugin is configured through the properties and configuration files of the access control plugin. @@ -48,3 +51,8 @@ configuration. :language: xml :start-after: DDS_SECURITY_CRYPTO_PLUGIN_DOMAINPARTICIPANT<--> :end-before: <--> + +.. important:: + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + The previous example focuses only on the authentication plugin, but all three plugins must be configured. diff --git a/docs/fastdds/security/includes/intro.rst b/docs/fastdds/security/includes/intro.rst index 031c7c053..869d345d2 100644 --- a/docs/fastdds/security/includes/intro.rst +++ b/docs/fastdds/security/includes/intro.rst @@ -37,6 +37,12 @@ Security plugins can be activated through the |DomainParticipantQos| properties. A |Property-api| is defined by its name (:class:`std::string`) and its value (:class:`std::string`). +.. important:: + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + A laxer configuration can be achieved by configuring the access control plugin to be + permissive, but it is still mandatory to configure the authentication and cryptography plugins. + .. warning:: For the full understanding of this documentation it is required the user to have basic knowledge of network security since terms like Certificate Authority (CA), Public Key Infrastructure (PKI), and Diffie-Hellman encryption protocol