Skip to content

Commit 3ab3102

Browse files
tempatetempate
authored
Limit permissions and include missing certificates in security tests (#418)
* Update backdoor security tests' descriptions Signed-off-by: tempate <danieldiaz@eprosima.com> * Different certificates for the publisher & subscriber in backdoor test Signed-off-by: tempate <danieldiaz@eprosima.com> * Different certificates for the publisher & subscriber in backdoor_dds test Signed-off-by: tempate <danieldiaz@eprosima.com> * Update secure_trespassing's test description Signed-off-by: tempate <danieldiaz@eprosima.com> * Different certificates for the publisher & subscriber in secure_trespassing test Signed-off-by: tempate <danieldiaz@eprosima.com> * Add note to explain Fast-DDS's security warnings Signed-off-by: tempate <danieldiaz@eprosima.com> * Update secure_wan's test description Signed-off-by: tempate <danieldiaz@eprosima.com> * Different certificates for the publisher & subscriber in secure_wan tests Signed-off-by: tempate <danieldiaz@eprosima.com> * Remove README files Signed-off-by: tempate <danieldiaz@eprosima.com> * Restrict permissions Signed-off-by: tempate <danieldiaz@eprosima.com> * Apply suggestions Signed-off-by: tempate <danieldiaz@eprosima.com> --------- Signed-off-by: tempate <danieldiaz@eprosima.com>
1 parent bda15bc commit 3ab3102

143 files changed

Lines changed: 3116 additions & 1328 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎ddsrouter_test/compose/test_cases/security/backdoor/README.md‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/governance.smime‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
MIME-Version: 1.0
2-
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----A88C8EFF7EB58DF8BE6B769F5330054A"
2+
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----2E59600AC192FF720C24020D1C9F2220"
33

44
This is an S/MIME signed message
55

6-
------A88C8EFF7EB58DF8BE6B769F5330054A
6+
------2E59600AC192FF720C24020D1C9F2220
77
Content-Type: text/plain
88

99
<?xml version="1.0" encoding="utf-8"?>
@@ -37,34 +37,35 @@ Content-Type: text/plain
3737
</domain_access_rules>
3838
</dds>
3939

40-
------A88C8EFF7EB58DF8BE6B769F5330054A
40+
------2E59600AC192FF720C24020D1C9F2220
4141
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
4242
Content-Transfer-Encoding: base64
4343
Content-Disposition: attachment; filename="smime.p7s"
4444

45-
MIIETAYJKoZIhvcNAQcCoIIEPTCCBDkCAQExDzANBglghkgBZQMEAgEFADALBgkq
46-
hkiG9w0BBwGgggIXMIICEzCCAbkCFDLOtK+nDs16QK7x/A3ZsoTWkjo0MAoGCCqG
45+
MIIETQYJKoZIhvcNAQcCoIIEPjCCBDoCAQExDzANBglghkgBZQMEAgEFADALBgkq
46+
hkiG9w0BBwGgggIYMIICFDCCAbkCFHjAZLtrznIa1wXHcSPb4WUwpIeJMAoGCCqG
4747
SM49BAMCMIGLMQswCQYDVQQGEwJFUzELMAkGA1UECAwCTUExFDASBgNVBAcMC1Ry
4848
ZXMgQ2FudG9zMREwDwYDVQQKDAhlUHJvc2ltYTEeMBwGA1UEAwwVZVByb3NpbWEg
4949
TWFpbiBUZXN0IENBMSYwJAYJKoZIhvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1h
50-
LmNvbTAeFw0yMzA2MDIwOTE5MDBaFw0zMzA1MzAwOTE5MDBaMIGLMQswCQYDVQQG
50+
LmNvbTAeFw0yMzEyMjcwODU5MjhaFw0zMzEyMjQwODU5MjhaMIGLMQswCQYDVQQG
5151
EwJFUzELMAkGA1UECAwCTUExFDASBgNVBAcMC1RyZXMgQ2FudG9zMREwDwYDVQQK
5252
DAhlUHJvc2ltYTEeMBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENBMSYwJAYJ
5353
KoZIhvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbTBZMBMGByqGSM49AgEG
54-
CCqGSM49AwEHA0IABCO7Dp5gXZIynjsVkg2+72MYzfet8UbmFV1qR4fbaDf7g4ic
55-
56ypmz80jYXz+Yq7WWxrzZwQb7A+CUhjk9E3mN4wCgYIKoZIzj0EAwIDSAAwRQIh
56-
AJtOH5gtatFD63jKLtzGi4EOw3SK+201k6AVXkNkfuA0AiAaFmHO12hrSgwNwQli
57-
awNUVe4ftXrKB3ZZ9SiFJW4snzGCAfkwggH1AgEBMIGkMIGLMQswCQYDVQQGEwJF
58-
UzELMAkGA1UECAwCTUExFDASBgNVBAcMC1RyZXMgQ2FudG9zMREwDwYDVQQKDAhl
59-
UHJvc2ltYTEeMBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENBMSYwJAYJKoZI
60-
hvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbQIUMs60r6cOzXpArvH8Ddmy
61-
hNaSOjQwDQYJYIZIAWUDBAIBBQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEH
62-
ATAcBgkqhkiG9w0BCQUxDxcNMjMwNjAyMDkxOTAwWjAvBgkqhkiG9w0BCQQxIgQg
63-
qIbZ+sJhz6nFaocUuXIk3FmzrCCLKFNEM6gMln3FAYAweQYJKoZIhvcNAQkPMWww
64-
ajALBglghkgBZQMEASowCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG
65-
9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYI
66-
KoZIhvcNAwICASgwCgYIKoZIzj0EAwIERzBFAiEAyMXGl6HGJE/4SXLnaR6AYtFu
67-
KyKFQlsKPd1SyXsW4pICIBWe+VJf/Hnb3j36gxzHpu2FaCctwE9yk+1iUkwfm6mD
54+
CCqGSM49AwEHA0IABIvcM1UGEFwrWD44VJfQEnPBG7Ws4MYKTaO3IpuVqdmgDdW8
55+
mOq9Mhg5wp5jH9r+h4ECJAV0l0DZaknUcA9aSGcwCgYIKoZIzj0EAwIDSQAwRgIh
56+
AJHSdoa0YO6zpIMt8UlLHIZmm6rRxY+1qAEjv0DuUA5KAiEArLS5gjEJCAnyzOns
57+
2rvkoyoQcr/O/R+LY2HjXExEeFsxggH5MIIB9QIBATCBpDCBizELMAkGA1UEBhMC
58+
RVMxCzAJBgNVBAgMAk1BMRQwEgYDVQQHDAtUcmVzIENhbnRvczERMA8GA1UECgwI
59+
ZVByb3NpbWExHjAcBgNVBAMMFWVQcm9zaW1hIE1haW4gVGVzdCBDQTEmMCQGCSqG
60+
SIb3DQEJARYXcm91dGVydGVzdEBlcHJvc2ltYS5jb20CFHjAZLtrznIa1wXHcSPb
61+
4WUwpIeJMA0GCWCGSAFlAwQCAQUAoIHkMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0B
62+
BwEwHAYJKoZIhvcNAQkFMQ8XDTIzMTIyNzA4NTkyOFowLwYJKoZIhvcNAQkEMSIE
63+
IKiG2frCYc+pxWqHFLlyJNxZs6wgiyhTRDOoDJZ9xQGAMHkGCSqGSIb3DQEJDzFs
64+
MGowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZI
65+
hvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0G
66+
CCqGSIb3DQMCAgEoMAoGCCqGSM49BAMCBEcwRQIgYoznhxZ3NrLE7/+aN7WkcL9R
67+
gVOHBXc58pBFDFcllhQCIQDGZ+LSXC+hYZV4OhJom3O5yoOy1sh3KhW9TN0CQ0FV
68+
Mw==
6869

69-
------A88C8EFF7EB58DF8BE6B769F5330054A--
70+
------2E59600AC192FF720C24020D1C9F2220--
7071

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/local_pub_cert.pem‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
Certificate:
2+
Data:
3+
Version: 1 (0x0)
4+
Serial Number:
5+
20:c8:db:5e:dc:f2:72:70:b0:f8:d0:87:69:a9:ac:37:86:b5:92:11
6+
Signature Algorithm: ecdsa-with-SHA256
7+
Issuer: C=ES, ST=MA, L=Tres Cantos, O=eProsima, CN=eProsima Main Test CA/emailAddress=routertest@eprosima.com
8+
Validity
9+
Not Before: Dec 27 08:59:28 2023 GMT
10+
Not After : Dec 24 08:59:28 2033 GMT
11+
Subject: C=ES, ST=MA, O=eProsima, CN=BackdoorTestLocalPub/emailAddress=routertest@eprosima.com
12+
Subject Public Key Info:
13+
Public Key Algorithm: id-ecPublicKey
14+
Public-Key: (256 bit)
15+
pub:
16+
04:47:b6:53:3e:37:00:07:b5:dc:5d:77:c9:65:cc:
17+
73:8f:f7:fc:1b:d4:c5:e1:d0:fd:c9:33:ec:32:08:
18+
69:c4:ef:59:d8:a4:78:22:26:89:26:97:fd:ef:eb:
19+
17:05:d0:50:f4:0b:8b:60:48:2d:b6:7c:90:bf:b4:
20+
43:3e:95:0d:fd
21+
ASN1 OID: prime256v1
22+
NIST CURVE: P-256
23+
Signature Algorithm: ecdsa-with-SHA256
24+
Signature Value:
25+
30:46:02:21:00:a8:c1:d8:30:51:9c:1a:05:c3:13:d6:72:2b:
26+
bc:57:23:12:c4:2f:2c:94:db:af:e6:6a:b9:3a:09:04:ad:5f:
27+
86:02:21:00:d4:21:d8:db:61:e7:ea:e1:cb:b2:d2:a1:56:dd:
28+
87:6a:d8:f6:00:89:e9:cc:ee:60:41:79:21:42:34:7e:18:97
29+
-----BEGIN CERTIFICATE-----
30+
MIIB/DCCAaECFCDI217c8nJwsPjQh2mprDeGtZIRMAoGCCqGSM49BAMCMIGLMQsw
31+
CQYDVQQGEwJFUzELMAkGA1UECAwCTUExFDASBgNVBAcMC1RyZXMgQ2FudG9zMREw
32+
DwYDVQQKDAhlUHJvc2ltYTEeMBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENB
33+
MSYwJAYJKoZIhvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbTAeFw0yMzEy
34+
MjcwODU5MjhaFw0zMzEyMjQwODU5MjhaMHQxCzAJBgNVBAYTAkVTMQswCQYDVQQI
35+
DAJNQTERMA8GA1UECgwIZVByb3NpbWExHTAbBgNVBAMMFEJhY2tkb29yVGVzdExv
36+
Y2FsUHViMSYwJAYJKoZIhvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbTBZ
37+
MBMGByqGSM49AgEGCCqGSM49AwEHA0IABEe2Uz43AAe13F13yWXMc4/3/BvUxeHQ
38+
/ckz7DIIacTvWdikeCImiSaX/e/rFwXQUPQLi2BILbZ8kL+0Qz6VDf0wCgYIKoZI
39+
zj0EAwIDSQAwRgIhAKjB2DBRnBoFwxPWciu8VyMSxC8slNuv5mq5OgkErV+GAiEA
40+
1CHY22Hn6uHLstKhVt2Hatj2AInpzO5gQXkhQjR+GJc=
41+
-----END CERTIFICATE-----

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/local_pub_key.pem‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgn0fWT7P7Es0BjtNa
3+
d5Zh8ZPLLKwiaANuZkQLOGODXlmhRANCAARHtlM+NwAHtdxdd8llzHOP9/wb1MXh
4+
0P3JM+wyCGnE71nYpHgiJokml/3v6xcF0FD0C4tgSC22fJC/tEM+lQ39
5+
-----END PRIVATE KEY-----

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/local_sub_cert.pem‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
Certificate:
2+
Data:
3+
Version: 1 (0x0)
4+
Serial Number:
5+
20:c8:db:5e:dc:f2:72:70:b0:f8:d0:87:69:a9:ac:37:86:b5:92:12
6+
Signature Algorithm: ecdsa-with-SHA256
7+
Issuer: C=ES, ST=MA, L=Tres Cantos, O=eProsima, CN=eProsima Main Test CA/emailAddress=routertest@eprosima.com
8+
Validity
9+
Not Before: Dec 27 08:59:28 2023 GMT
10+
Not After : Dec 24 08:59:28 2033 GMT
11+
Subject: C=ES, ST=MA, O=eProsima, CN=BackdoorTestLocalSub/emailAddress=routertest@eprosima.com
12+
Subject Public Key Info:
13+
Public Key Algorithm: id-ecPublicKey
14+
Public-Key: (256 bit)
15+
pub:
16+
04:0f:f5:6e:33:ed:96:97:57:5e:a4:6a:b0:1e:eb:
17+
79:b2:e5:8e:e4:e6:7a:42:28:b0:07:66:dd:91:2f:
18+
ff:ad:5e:9a:7d:46:47:c7:61:49:7f:63:e6:f8:48:
19+
c8:07:d5:dd:bc:11:bb:6a:d7:14:94:8b:f5:9f:61:
20+
57:32:34:ec:a2
21+
ASN1 OID: prime256v1
22+
NIST CURVE: P-256
23+
Signature Algorithm: ecdsa-with-SHA256
24+
Signature Value:
25+
30:45:02:20:30:75:9c:70:17:03:9a:84:96:ed:93:13:07:5e:
26+
b1:74:8e:b6:7f:7c:28:19:01:73:37:ec:cf:de:0e:6d:c5:6a:
27+
02:21:00:99:d3:b1:81:ab:b1:ef:b2:73:ae:5b:48:c0:da:9c:
28+
cc:11:c7:c7:65:f6:d4:9c:93:b8:48:79:26:99:f3:d4:61
29+
-----BEGIN CERTIFICATE-----
30+
MIIB+zCCAaECFCDI217c8nJwsPjQh2mprDeGtZISMAoGCCqGSM49BAMCMIGLMQsw
31+
CQYDVQQGEwJFUzELMAkGA1UECAwCTUExFDASBgNVBAcMC1RyZXMgQ2FudG9zMREw
32+
DwYDVQQKDAhlUHJvc2ltYTEeMBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENB
33+
MSYwJAYJKoZIhvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbTAeFw0yMzEy
34+
MjcwODU5MjhaFw0zMzEyMjQwODU5MjhaMHQxCzAJBgNVBAYTAkVTMQswCQYDVQQI
35+
DAJNQTERMA8GA1UECgwIZVByb3NpbWExHTAbBgNVBAMMFEJhY2tkb29yVGVzdExv
36+
Y2FsU3ViMSYwJAYJKoZIhvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbTBZ
37+
MBMGByqGSM49AgEGCCqGSM49AwEHA0IABA/1bjPtlpdXXqRqsB7rebLljuTmekIo
38+
sAdm3ZEv/61emn1GR8dhSX9j5vhIyAfV3bwRu2rXFJSL9Z9hVzI07KIwCgYIKoZI
39+
zj0EAwIDSAAwRQIgMHWccBcDmoSW7ZMTB16xdI62f3woGQFzN+zP3g5txWoCIQCZ
40+
07GBq7HvsnOuW0jA2pzMEcfHZfbUnJO4SHkmmfPUYQ==
41+
-----END CERTIFICATE-----

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/local_sub_key.pem‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9h7KMTn8VEmIv0mm
3+
cRnYp3TeRJwDDxHnZ8de8egX5sihRANCAAQP9W4z7ZaXV16karAe63my5Y7k5npC
4+
KLAHZt2RL/+tXpp9RkfHYUl/Y+b4SMgH1d28Ebtq1xSUi/WfYVcyNOyi
5+
-----END PRIVATE KEY-----

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/localcert.pem‎

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/localkey.pem‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/main_ca_cert.pem‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICFDCCAbkCFHjAZLtrznIa1wXHcSPb4WUwpIeJMAoGCCqGSM49BAMCMIGLMQsw
3+
CQYDVQQGEwJFUzELMAkGA1UECAwCTUExFDASBgNVBAcMC1RyZXMgQ2FudG9zMREw
4+
DwYDVQQKDAhlUHJvc2ltYTEeMBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENB
5+
MSYwJAYJKoZIhvcNAQkBFhdyb3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbTAeFw0yMzEy
6+
MjcwODU5MjhaFw0zMzEyMjQwODU5MjhaMIGLMQswCQYDVQQGEwJFUzELMAkGA1UE
7+
CAwCTUExFDASBgNVBAcMC1RyZXMgQ2FudG9zMREwDwYDVQQKDAhlUHJvc2ltYTEe
8+
MBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENBMSYwJAYJKoZIhvcNAQkBFhdy
9+
b3V0ZXJ0ZXN0QGVwcm9zaW1hLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
10+
BIvcM1UGEFwrWD44VJfQEnPBG7Ws4MYKTaO3IpuVqdmgDdW8mOq9Mhg5wp5jH9r+
11+
h4ECJAV0l0DZaknUcA9aSGcwCgYIKoZIzj0EAwIDSQAwRgIhAJHSdoa0YO6zpIMt
12+
8UlLHIZmm6rRxY+1qAEjv0DuUA5KAiEArLS5gjEJCAnyzOns2rvkoyoQcr/O/R+L
13+
Y2HjXExEeFs=
14+
-----END CERTIFICATE-----

‎ddsrouter_test/compose/test_cases/security/backdoor/certs/maincacert.pem‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

0 commit comments

Comments
 (0)