From b022e7347eb20d08afd578f84d43512ae3580095 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20Ferreira=20Gonz=C3=A1lez?= Date: Fri, 10 Jul 2026 08:21:54 +0200 Subject: [PATCH 1/3] Add all security plugins (#27) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Refs #24365: Add all security plugins Signed-off-by: Carlos Ferreira González * Refs #24365: Important note Signed-off-by: Carlos Ferreira González * Refs #24365: Review - Add more notes Signed-off-by: Carlos Ferreira González * Refs #24365: Review - Add notes to XML/Code examples Signed-off-by: Carlos Ferreira González --------- Signed-off-by: Carlos Ferreira González Signed-off-by: zesk1999 --- code/CodeTester.cpp | 4 ++++ code/DDSCodeTester.cpp | 4 ++++ docs/fastdds/faq/security/security.rst | 5 +++++ docs/fastdds/property_policies/security.rst | 6 ++++++ .../access_control_plugin/access_control_plugin.rst | 8 ++++++++ docs/fastdds/security/auth_plugin/auth_plugin.rst | 8 ++++++++ docs/fastdds/security/crypto_plugin/crypto_plugin.rst | 8 ++++++++ docs/fastdds/security/includes/intro.rst | 6 ++++++ 8 files changed, 49 insertions(+) diff --git a/code/CodeTester.cpp b/code/CodeTester.cpp index 250647824..5e3c15c20 100644 --- a/code/CodeTester.cpp +++ b/code/CodeTester.cpp @@ -323,6 +323,10 @@ bool permissions_test( part_attr.properties.properties().emplace_back( "dds.sec.access.builtin.Access-Permissions.permissions", permissions_file); + + // Activate Crypto:AES-GCM-GMAC plugin (all three security plugins must be configured together) + part_attr.properties.properties().emplace_back("dds.sec.crypto.plugin", + "builtin.AES-GCM-GMAC"); RTPSParticipant* participant = RTPSDomain::createParticipant(0, part_attr); if (participant != nullptr) { diff --git a/code/DDSCodeTester.cpp b/code/DDSCodeTester.cpp index 54c52283d..28595d61a 100644 --- a/code/DDSCodeTester.cpp +++ b/code/DDSCodeTester.cpp @@ -8126,6 +8126,10 @@ bool dds_permissions_test( "dds.sec.access.builtin.Access-Permissions.permissions", permissions_file); + // Activate Crypto:AES-GCM-GMAC plugin (all three security plugins must be configured together) + pqos.properties().properties().emplace_back("dds.sec.crypto.plugin", + "builtin.AES-GCM-GMAC"); + DomainParticipant* domain_participant = DomainParticipantFactory::get_instance()->create_participant(1, pqos); if (nullptr != domain_participant) diff --git a/docs/fastdds/faq/security/security.rst b/docs/fastdds/faq/security/security.rst index 6e4c60700..2bdf31d22 100644 --- a/docs/fastdds/faq/security/security.rst +++ b/docs/fastdds/faq/security/security.rst @@ -46,6 +46,9 @@ Authentication |br| By setting the |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value`` ``builtin.PKI-DH``. For further information, refer to :ref:`auth-pki-dh`. + Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and + cryptography plugins together. + ---------- @@ -133,6 +136,8 @@ Data encryption .. collapse:: How is the DDS:Crypto:AES-GCM-GMAC authentication plugin activated? |br| By setting the |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. + Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and + cryptography plugins together. Moreover, this plugin needs the activation of the Authentication plugin: ``DDS:Auth:PKI-DH`` and the ``DDS:Access:Permissions``. For further information, refer to :ref:`crypto-aes-gcm-gmac`. diff --git a/docs/fastdds/property_policies/security.rst b/docs/fastdds/property_policies/security.rst index dce46aa87..38448aaf4 100644 --- a/docs/fastdds/property_policies/security.rst +++ b/docs/fastdds/property_policies/security.rst @@ -16,6 +16,9 @@ Authentication plugin settings The :ref:`DDS\:Auth\:PKI-DH ` authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value ``builtin.PKI-DH``. +Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + The following table outlines the properties used for the :ref:`DDS\:Auth\:PKI-DH ` plugin configuration. .. list-table:: @@ -130,6 +133,9 @@ Cryptographic plugin settings The :ref:`DDS\:Crypto\:AES-GCM-GMAC ` authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. +Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + Moreover, this plugin needs the activation of the :ref:`auth-pki-dh`. The :ref:`DDS\:Crypto\:AES-GCM-GMAC ` plugin is configured using the :ref:`access-permissions`, i.e the cryptography plugin is configured through the properties diff --git a/docs/fastdds/security/access_control_plugin/access_control_plugin.rst b/docs/fastdds/security/access_control_plugin/access_control_plugin.rst index 4fb0d4ccd..f5db5fc1f 100644 --- a/docs/fastdds/security/access_control_plugin/access_control_plugin.rst +++ b/docs/fastdds/security/access_control_plugin/access_control_plugin.rst @@ -37,6 +37,9 @@ in detail below. The DDS\:Access\:Permissions authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.access.plugin`` with the value ``builtin.Access-Permissions``. +Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + The following table outlines the properties used for the DDS\:Access\:Permissions plugin configuration. .. list-table:: @@ -80,6 +83,11 @@ configuration. :start-after: DDS_SECURITY_ACCESS_CONTROL_PLUGIN<--> :end-before: <--> +.. important:: + Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + The previous example focuses only on the access control plugin, but all three plugins must be configured. + .. _permissions_ca_cert: Permissions CA Certificate diff --git a/docs/fastdds/security/auth_plugin/auth_plugin.rst b/docs/fastdds/security/auth_plugin/auth_plugin.rst index 70b182ae0..6c612eb70 100644 --- a/docs/fastdds/security/auth_plugin/auth_plugin.rst +++ b/docs/fastdds/security/auth_plugin/auth_plugin.rst @@ -31,6 +31,9 @@ This shared secret can be used by other security plugins as :ref:`crypto-aes-gcm The DDS:\Auth\:PKI-DH authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value ``builtin.PKI-DH``. +Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + The following table outlines the properties used for the DDS:\Auth\:PKI-DH plugin configuration. .. list-table:: @@ -88,6 +91,11 @@ configuration. :start-after: DDS_SECURITY_AUTH_PLUGIN<--> :end-before: <--> +.. important:: + Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + The previous example focuses only on the authentication plugin, but all three plugins must be configured. + .. _generate_x509: Generation of X.509 certificates diff --git a/docs/fastdds/security/crypto_plugin/crypto_plugin.rst b/docs/fastdds/security/crypto_plugin/crypto_plugin.rst index fc41d82ca..51c5f8a16 100644 --- a/docs/fastdds/security/crypto_plugin/crypto_plugin.rst +++ b/docs/fastdds/security/crypto_plugin/crypto_plugin.rst @@ -29,6 +29,9 @@ It may also provide additional DataReader-specific Message Authentication Codes The DDS\:Crypto\:AES-GCM-GMAC authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. +Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +cryptography plugins together. + Moreover, this plugin needs the activation of the :ref:`auth-pki-dh`. The DDS\:Crypto\:\AES-GCM-GMAC plugin is configured using the :ref:`access-permissions`, i.e the cryptography plugin is configured through the properties and configuration files of the access control plugin. @@ -48,3 +51,8 @@ configuration. :language: xml :start-after: DDS_SECURITY_CRYPTO_PLUGIN_DOMAINPARTICIPANT<--> :end-before: <--> + +.. important:: + Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + The previous example focuses only on the authentication plugin, but all three plugins must be configured. diff --git a/docs/fastdds/security/includes/intro.rst b/docs/fastdds/security/includes/intro.rst index 031c7c053..21ec5c3e9 100644 --- a/docs/fastdds/security/includes/intro.rst +++ b/docs/fastdds/security/includes/intro.rst @@ -37,6 +37,12 @@ Security plugins can be activated through the |DomainParticipantQos| properties. A |Property-api| is defined by its name (:class:`std::string`) and its value (:class:`std::string`). +.. important:: + Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + (authentication, access control and cryptography) to enable secure communication. + A laxer configuration can be achieved by configuring the access control plugin to be + permissive, but it is still mandatory to configure the authentication and cryptography plugins. + .. warning:: For the full understanding of this documentation it is required the user to have basic knowledge of network security since terms like Certificate Authority (CA), Public Key Infrastructure (PKI), and Diffie-Hellman encryption protocol From fe0f4f84254dae81c7f85f045a4c1bd94fb3da64 Mon Sep 17 00:00:00 2001 From: zesk1999 Date: Thu, 20 Aug 2026 10:50:04 +0200 Subject: [PATCH 2/3] Code removed Signed-off-by: zesk1999 --- code/CodeTester.cpp | 3 --- code/DDSCodeTester.cpp | 4 ---- 2 files changed, 7 deletions(-) diff --git a/code/CodeTester.cpp b/code/CodeTester.cpp index 5e3c15c20..afed8adfc 100644 --- a/code/CodeTester.cpp +++ b/code/CodeTester.cpp @@ -324,9 +324,6 @@ bool permissions_test( "dds.sec.access.builtin.Access-Permissions.permissions", permissions_file); - // Activate Crypto:AES-GCM-GMAC plugin (all three security plugins must be configured together) - part_attr.properties.properties().emplace_back("dds.sec.crypto.plugin", - "builtin.AES-GCM-GMAC"); RTPSParticipant* participant = RTPSDomain::createParticipant(0, part_attr); if (participant != nullptr) { diff --git a/code/DDSCodeTester.cpp b/code/DDSCodeTester.cpp index 28595d61a..54c52283d 100644 --- a/code/DDSCodeTester.cpp +++ b/code/DDSCodeTester.cpp @@ -8126,10 +8126,6 @@ bool dds_permissions_test( "dds.sec.access.builtin.Access-Permissions.permissions", permissions_file); - // Activate Crypto:AES-GCM-GMAC plugin (all three security plugins must be configured together) - pqos.properties().properties().emplace_back("dds.sec.crypto.plugin", - "builtin.AES-GCM-GMAC"); - DomainParticipant* domain_participant = DomainParticipantFactory::get_instance()->create_participant(1, pqos); if (nullptr != domain_participant) From f3a72b1d06c8e7f67c1eb434817e67b2f22e8de2 Mon Sep 17 00:00:00 2001 From: zesk1999 Date: Thu, 20 Aug 2026 11:04:05 +0200 Subject: [PATCH 3/3] Mark all-plugins security note as Pro exclusive Signed-off-by: zesk1999 --- docs/fastdds/faq/security/security.rst | 4 ++-- docs/fastdds/property_policies/security.rst | 4 ++-- .../security/access_control_plugin/access_control_plugin.rst | 4 ++-- docs/fastdds/security/auth_plugin/auth_plugin.rst | 4 ++-- docs/fastdds/security/crypto_plugin/crypto_plugin.rst | 4 ++-- docs/fastdds/security/includes/intro.rst | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/fastdds/faq/security/security.rst b/docs/fastdds/faq/security/security.rst index 2bdf31d22..6f88da84b 100644 --- a/docs/fastdds/faq/security/security.rst +++ b/docs/fastdds/faq/security/security.rst @@ -46,7 +46,7 @@ Authentication |br| By setting the |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value`` ``builtin.PKI-DH``. For further information, refer to :ref:`auth-pki-dh`. - Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and + Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and cryptography plugins together. @@ -136,7 +136,7 @@ Data encryption .. collapse:: How is the DDS:Crypto:AES-GCM-GMAC authentication plugin activated? |br| By setting the |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. - Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and + Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and cryptography plugins together. Moreover, this plugin needs the activation of the Authentication plugin: ``DDS:Auth:PKI-DH`` and the ``DDS:Access:Permissions``. For further information, refer to :ref:`crypto-aes-gcm-gmac`. diff --git a/docs/fastdds/property_policies/security.rst b/docs/fastdds/property_policies/security.rst index 38448aaf4..208f61080 100644 --- a/docs/fastdds/property_policies/security.rst +++ b/docs/fastdds/property_policies/security.rst @@ -16,7 +16,7 @@ Authentication plugin settings The :ref:`DDS\:Auth\:PKI-DH ` authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value ``builtin.PKI-DH``. -Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and cryptography plugins together. The following table outlines the properties used for the :ref:`DDS\:Auth\:PKI-DH ` plugin configuration. @@ -133,7 +133,7 @@ Cryptographic plugin settings The :ref:`DDS\:Crypto\:AES-GCM-GMAC ` authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. -Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and cryptography plugins together. Moreover, this plugin needs the activation of the :ref:`auth-pki-dh`. diff --git a/docs/fastdds/security/access_control_plugin/access_control_plugin.rst b/docs/fastdds/security/access_control_plugin/access_control_plugin.rst index f5db5fc1f..7e16d96b8 100644 --- a/docs/fastdds/security/access_control_plugin/access_control_plugin.rst +++ b/docs/fastdds/security/access_control_plugin/access_control_plugin.rst @@ -37,7 +37,7 @@ in detail below. The DDS\:Access\:Permissions authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.access.plugin`` with the value ``builtin.Access-Permissions``. -Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and cryptography plugins together. The following table outlines the properties used for the DDS\:Access\:Permissions plugin configuration. @@ -84,7 +84,7 @@ configuration. :end-before: <--> .. important:: - Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins (authentication, access control and cryptography) to enable secure communication. The previous example focuses only on the access control plugin, but all three plugins must be configured. diff --git a/docs/fastdds/security/auth_plugin/auth_plugin.rst b/docs/fastdds/security/auth_plugin/auth_plugin.rst index 6c612eb70..4b16d3fbd 100644 --- a/docs/fastdds/security/auth_plugin/auth_plugin.rst +++ b/docs/fastdds/security/auth_plugin/auth_plugin.rst @@ -31,7 +31,7 @@ This shared secret can be used by other security plugins as :ref:`crypto-aes-gcm The DDS:\Auth\:PKI-DH authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.auth.plugin`` with the value ``builtin.PKI-DH``. -Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and cryptography plugins together. The following table outlines the properties used for the DDS:\Auth\:PKI-DH plugin configuration. @@ -92,7 +92,7 @@ configuration. :end-before: <--> .. important:: - Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins (authentication, access control and cryptography) to enable secure communication. The previous example focuses only on the authentication plugin, but all three plugins must be configured. diff --git a/docs/fastdds/security/crypto_plugin/crypto_plugin.rst b/docs/fastdds/security/crypto_plugin/crypto_plugin.rst index 51c5f8a16..928d307c7 100644 --- a/docs/fastdds/security/crypto_plugin/crypto_plugin.rst +++ b/docs/fastdds/security/crypto_plugin/crypto_plugin.rst @@ -29,7 +29,7 @@ It may also provide additional DataReader-specific Message Authentication Codes The DDS\:Crypto\:AES-GCM-GMAC authentication plugin, can be activated setting the |DomainParticipantQos| |DomainParticipantQos::properties-api| ``dds.sec.crypto.plugin`` with the value ``builtin.AES-GCM-GMAC``. -Note that since Fast DDS ``v3.7.0``, secure participants must configure the authentication, access control, and +Note that since Fast DDS Pro ``v3.7.0``, secure participants must configure the authentication, access control, and cryptography plugins together. Moreover, this plugin needs the activation of the :ref:`auth-pki-dh`. @@ -53,6 +53,6 @@ configuration. :end-before: <--> .. important:: - Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins (authentication, access control and cryptography) to enable secure communication. The previous example focuses only on the authentication plugin, but all three plugins must be configured. diff --git a/docs/fastdds/security/includes/intro.rst b/docs/fastdds/security/includes/intro.rst index 21ec5c3e9..869d345d2 100644 --- a/docs/fastdds/security/includes/intro.rst +++ b/docs/fastdds/security/includes/intro.rst @@ -38,7 +38,7 @@ A |Property-api| is defined by its name (:class:`std::string`) and its value (:class:`std::string`). .. important:: - Since version v3.7.0, Fast DDS enforces to configure the three main security plugins + Since version v3.7.0, Fast DDS Pro enforces to configure the three main security plugins (authentication, access control and cryptography) to enable secure communication. A laxer configuration can be achieved by configuring the access control plugin to be permissive, but it is still mandatory to configure the authentication and cryptography plugins.