Skip to content

Add tests for SROS2 access control policies (Issue #238) #604

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Aaravanand00 wants to merge 1 commit into
base: rolling
Choose a base branch
from
Open

Add tests for SROS2 access control policies (Issue #238) #604

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions test_security/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,8 @@ if(BUILD_TESTING)
set(index 0)
# configure all non secure communication tests
set(SUBSCRIBER_SHOULD_TIMEOUT "false")
set(PUBLISHER_ENCLAVE "/publisher")
set(SUBSCRIBER_ENCLAVE "/subscriber")
while(index LESS ${n_non_secure_tests})
# here we define all the variables needed for security template expansion
list(GET non_secure_comm_PUBLISHER_ROS_SECURITY_ENABLE_LIST ${index} PUBLISHER_ROS_SECURITY_ENABLE)
Expand Down Expand Up @@ -163,6 +165,8 @@ if(BUILD_TESTING)
set(SUBSCRIBER_SHOULD_TIMEOUT "false")
set(PUBLISHER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}")
set(SUBSCRIBER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}")
set(PUBLISHER_ENCLAVE "/publisher")
set(SUBSCRIBER_ENCLAVE "/subscriber")
# configure all secure communication tests
while(index LESS ${n_secure_communication_tests})
# here we define all the variables needed for security template expansion
Expand Down Expand Up @@ -204,6 +208,8 @@ if(BUILD_TESTING)
set(PUBLISHER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}")
set(SUBSCRIBER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}")
set(SUBSCRIBER_SHOULD_TIMEOUT "true")
set(PUBLISHER_ENCLAVE "/publisher")
set(SUBSCRIBER_ENCLAVE "/subscriber")
# configure all not connecting tests
while(index LESS ${n_not_connecting_tests})
# here we define all the variables needed for security template expansion
Expand Down Expand Up @@ -240,6 +246,52 @@ if(BUILD_TESTING)
)
endif()
endwhile()

# Test suite for access control policies
set(index 0)
set(PUBLISHER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}")
set(SUBSCRIBER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}")
set(SUBSCRIBER_SHOULD_TIMEOUT "true")
set(access_control_PUBLISHER_ENCLAVE_LIST "/publisher_denied;/publisher")
set(access_control_SUBSCRIBER_ENCLAVE_LIST "/subscriber;/subscriber_denied")
list(LENGTH access_control_PUBLISHER_ENCLAVE_LIST n_access_control_tests)

while(index LESS ${n_access_control_tests})
set(PUBLISHER_ROS_SECURITY_ENABLE "true")
set(SUBSCRIBER_ROS_SECURITY_ENABLE "true")
set(PUBLISHER_ROS_SECURITY_STRATEGY "Enforce")
set(SUBSCRIBER_ROS_SECURITY_STRATEGY "Enforce")
list(GET access_control_PUBLISHER_ENCLAVE_LIST ${index} PUBLISHER_ENCLAVE)
list(GET access_control_SUBSCRIBER_ENCLAVE_LIST ${index} SUBSCRIBER_ENCLAVE)

set(test_suffix "__${TEST_MESSAGE_TYPE}${suffix}__access_control_${index}")
configure_file(
test/test_secure_publisher_subscriber.py.in
test_secure_publisher_subscriber${test_suffix}.py.configured
@ONLY
)
file(GENERATE
OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/test_secure_publisher_subscriber${test_suffix}_$<CONFIG>.py"
INPUT "${CMAKE_CURRENT_BINARY_DIR}/test_secure_publisher_subscriber${test_suffix}.py.configured"
)
math(EXPR index "${index} + 1")

add_launch_test(
"${CMAKE_CURRENT_BINARY_DIR}/test_secure_publisher_subscriber${test_suffix}_$<CONFIG>.py"
TARGET test_secure_publisher_subscriber${test_suffix}
APPEND_LIBRARY_DIRS "${append_library_dirs}"
ENV
PATH="${TEST_PATH}"
TIMEOUT 20
)
if(TEST test_secure_publisher_subscriber${test_suffix})
set_tests_properties(
test_secure_publisher_subscriber${test_suffix}
PROPERTIES DEPENDS "test_secure_publisher_cpp__${rmw_implementation};test_secure_subscriber_cpp__${rmw_implementation}"
FIXTURES_REQUIRED "sros_artifacts"
)
endif()
endwhile()
endforeach()
endmacro()

Expand Down
28 changes: 28 additions & 0 deletions test_security/test/sros_artifacts.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,34 @@ if(NOT ${GENERATE_ARTIFACTS_RESULT} EQUAL 0)
message(FATAL_ERROR "Failed to generate security artifacts: ${GENERATE_ARTIFACTS_ERROR}")
endif()

# Generate access control artifacts for publisher denied
set(generate_publisher_denied_command ${ROS2_EXECUTABLE} security generate_artifacts
-k ${KEYSTORE_DIRECTORY_NATIVE_PATH}
-e /publisher_denied
-p ${KEYSTORE_DIRECTORY_NATIVE_PATH}/policies/policy_publisher_denied.xml)
execute_process(
COMMAND ${generate_publisher_denied_command}
RESULT_VARIABLE GENERATE_ARTIFACTS_RESULT
ERROR_VARIABLE GENERATE_ARTIFACTS_ERROR
)
if(NOT ${GENERATE_ARTIFACTS_RESULT} EQUAL 0)
message(FATAL_ERROR "Failed to generate publisher denied artifacts: ${GENERATE_ARTIFACTS_ERROR}")
endif()

# Generate access control artifacts for subscriber denied
set(generate_subscriber_denied_command ${ROS2_EXECUTABLE} security generate_artifacts
-k ${KEYSTORE_DIRECTORY_NATIVE_PATH}
-e /subscriber_denied
-p ${KEYSTORE_DIRECTORY_NATIVE_PATH}/policies/policy_subscriber_denied.xml)
execute_process(
COMMAND ${generate_subscriber_denied_command}
RESULT_VARIABLE GENERATE_ARTIFACTS_RESULT
ERROR_VARIABLE GENERATE_ARTIFACTS_ERROR
)
if(NOT ${GENERATE_ARTIFACTS_RESULT} EQUAL 0)
message(FATAL_ERROR "Failed to generate subscriber denied artifacts: ${GENERATE_ARTIFACTS_ERROR}")
endif()

# deleting key of /publisher_missing_key
file(REMOVE "${KEYSTORE_DIRECTORY}/enclaves/publisher_missing_key/key.pem")

Expand Down
3 changes: 1 addition & 2 deletions test_security/test/test_secure_publisher.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,8 +74,7 @@ int main(int argc, char ** argv)
"pass a message type\n");
return 1;
}
const char * args[] = {"--ros-args", "--enclave", "/publisher"};
rclcpp::init(sizeof(args) / sizeof(char *), args);
rclcpp::init(argc, argv);
std::string message = argv[1];
std::string namespace_ = argv[2];
std::string node_name = "test_secure_publisher";
Expand Down
6 changes: 4 additions & 2 deletions test_security/test/test_secure_publisher_subscriber.py.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,13 @@ def generate_test_description():
launch_description = LaunchDescription()

publisher_cmd = [
'@TEST_PUBLISHER_EXECUTABLE@', '@TEST_MESSAGE_TYPE@', namespace
'@TEST_PUBLISHER_EXECUTABLE@', '@TEST_MESSAGE_TYPE@', namespace,
'--ros-args', '--enclave', '@PUBLISHER_ENCLAVE@'
]
subscriber_cmd = [
'@TEST_SUBSCRIBER_EXECUTABLE@', '@TEST_MESSAGE_TYPE@',
'@SUBSCRIBER_SHOULD_TIMEOUT@', namespace
'@SUBSCRIBER_SHOULD_TIMEOUT@', namespace,
'--ros-args', '--enclave', '@SUBSCRIBER_ENCLAVE@'
]

publisher_env = dict(os.environ)
Expand Down
3 changes: 1 addition & 2 deletions test_security/test/test_secure_subscriber.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,8 +124,7 @@ int main(int argc, char ** argv)
bool should_timeout =
((0 == strcmp(argv[2], "false")) || (0 == strcmp(argv[2], "0"))) ? false : true;

const char * args[] = {"--ros-args", "--enclave", "/subscriber"};
rclcpp::init(sizeof(args) / sizeof(char *), args);
rclcpp::init(argc, argv);
std::shared_ptr<rclcpp::Node> node = nullptr;
try {
node = rclcpp::Node::make_shared(node_name, namespace_);
Expand Down
24 changes: 24 additions & 0 deletions test_security/test/test_security_files/policies/policy_publisher_denied.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?xml version="1.0" encoding="UTF-8"?>
<policy version="0.2.0"
xmlns:xi="http://www.w3.org/2001/XInclude">
<enclaves>
<enclave path="/publisher_denied">
<profiles>
<profile ns="/" node="default">
<topics publish="DENY" subscribe="ALLOW">
<topic>chatter</topic>
</topics>
<topics publish="ALLOW" subscribe="ALLOW">
<topic>/*</topic>
</topics>
<services reply="ALLOW" request="ALLOW">
<service>/*</service>
</services>
<actions call="ALLOW" execute="ALLOW">
<action>/*</action>
</actions>
</profile>
</profiles>
</enclave>
</enclaves>
</policy>
24 changes: 24 additions & 0 deletions test_security/test/test_security_files/policies/policy_subscriber_denied.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?xml version="1.0" encoding="UTF-8"?>
<policy version="0.2.0"
xmlns:xi="http://www.w3.org/2001/XInclude">
<enclaves>
<enclave path="/subscriber_denied">
<profiles>
<profile ns="/" node="default">
<topics publish="ALLOW" subscribe="DENY">
<topic>chatter</topic>
</topics>
<topics publish="ALLOW" subscribe="ALLOW">
<topic>/*</topic>
</topics>
<services reply="ALLOW" request="ALLOW">
<service>/*</service>
</services>
<actions call="ALLOW" execute="ALLOW">
<action>/*</action>
</actions>
</profile>
</profiles>
</enclave>
</enclaves>
</policy>