[24046] Update security tests to use governance-based encryption configuration by emiliocuestaf · Pull Request #6277 · eProsima/Fast-DDS

emiliocuestaf · 2026-01-26T11:22:04Z

Description

The properties rtps.participant.rtps_protection_kind, rtps.endpoint.submessage_protection_kind, and rtps.endpoint.payload_protection_kind are not parsed in the Fast-DDS source code. These properties are set in multiple blackbox security tests, but they have no effect on the actual encryption behavior.

The only valid way to configure RTPS/endpoint protection kinds is through the governance file with the Access Control plugin enabled.

The properties rtps.participant.rtps_protection_kind, rtps.endpoint.submessage_protection_kind, and rtps.endpoint.payload_protection_kind are not parsed in the Fast-DDS source code. These properties are set in multiple blackbox security tests, but they have no effect on the actual encryption behavior.

The only valid way to configure RTPS/endpoint protection kinds is through the governance file with the Access Control plugin enabled.

This PR includes the following features:

Modify the security Blackbox tests so that the protection kinds are correctly set and, hence, tested.
Add parameters to tests so that all combinations between {TRANSPORT, INTRAPROCESS, DATASHARING} and {BEST_EFFORT, RELIABLE} are evaluated along with every security combination
Fix BEST_EFFORT tests that were flaky
Fix performance tests, whose security set-up was also outdated
Test every security setting under larga data too.

@Mergifyio backport 3.4.x 3.3.x 3.2.x

Contributor Checklist

Commit messages follow the project guidelines.
The code follows the style guidelines of this project.
Tests that thoroughly check the new feature have been added/Regression tests checking the bug and its fix have been added; the added tests pass locally
N/A: Any new/modified methods have been properly documented using Doxygen.
N/A: Any new configuration API has an equivalent XML API (with the corresponding XSD extension)
Changes are backport compatible: they do NOT break ABI nor change library core behavior.
Changes are API compatible.
N/A: New feature has been added to the versions.md file (if applicable).
N/A: New feature has been documented/Current behavior is correctly described in the documentation.
Applicable backports have been included in the description.

Reviewer Checklist

The PR has a milestone assigned.
The title and description correctly express the PR's purpose.
Check contributor checklist is correct.
N/A: If this is a critical bug fix, backports to the critical-only supported branches have been requested.
Check CI results: changes do not issue any warning.
Check CI results: failing tests are unrelated with the changes.

mergify · 2026-01-27T00:35:52Z

🧪 CI Insights

Here's what we observed from your CI run for efe835d.

❌ Job Failures

Pipeline	Job	Retries	🔍 CI Insights	📄 Logs
`Fast DDS Windows CI`	`windows-ci / fastdds_test (RelWithDebInfo, examples), v142`	`0`	View	View
	`windows-ci / fastdds_test (RelWithDebInfo, unittest-II), v142`	`0`	View	View
	`windows-ci / fastdds_test (RelWithDebInfo, unittest-II), v143`	`0`	View	View

Signed-off-by: Emilio Cuesta <[email protected]>

…on_kind Signed-off-by: Emilio Cuesta <[email protected]>

cferreiragonz · 2026-05-08T11:07:11Z

New changes:

Added common methods for configuration.
In preparation for [24364 & 24365] Add UBSan workflow and solve its errors #6386 I also configured all three plugins of Security in only Authorization tests (some test might still require to configure missing plugins but I will end this task in [24364 & 24365] Add UBSan workflow and solve its errors #6386, like ValidateAuthenticationHandshakePropertiesParsing).
Updated governance files because of a change of the test name and, thus, the topic name.
Removed DATASHARING from the Test suite.
Tests now only run for both reliability kinds if data_protection_kind or rtps_protection_kind is configured
Tests now only run for INTRAPROCESS if access_control is being tested.

Signed-off-by: Carlos Ferreira González <[email protected]>

emiliocuestaf

Looks good to me (I can't approve this PR). A few comments:

I don't think we need to test larga data in every test
The CI seemed to exhaust all the resources in the Windows machine. This last run worked fine, but I'm a bit worried this behaviour arises again.
It seems we fixed the mac security tests 👌

Signed-off-by: Carlos Ferreira González <[email protected]>

cferreiragonz · 2026-05-14T06:23:05Z

I consider failed tests unrelated. Alternative build is fixed by: #6393

MiguelCompany · 2026-05-14T07:30:48Z

@Mergifyio backport 3.4.x 3.2.x 2.14.x

mergify · 2026-05-14T07:30:58Z

backport 3.4.x 3.2.x 2.14.x

✅ Backports have been created

Details

#6394 [24046] Update security tests to use governance-based encryption configuration (backport #6277) has been created for branch 3.4.x but encountered conflicts

Cherry-pick of a1d550b has failed:

On branch mergify/bp/3.4.x/pr-6277
Your branch is up to date with 'origin/3.4.x'.

You are currently cherry-picking commit a1d550b2.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   test/certs/governance_disable_discovery_disable_access_encrypt.smime
	modified:   test/certs/governance_disable_discovery_disable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_disable_access_none.smime
	modified:   test/certs/governance_disable_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_disable_discovery_disable_access_sign.smime
	new file:   test/certs/governance_disable_discovery_disable_access_sign_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_enable_access_encrypt.smime
	modified:   test/certs/governance_disable_discovery_enable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_enable_access_none.smime
	modified:   test/certs/governance_disable_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_disable_discovery_enable_access_sign.smime
	new file:   test/certs/governance_disable_discovery_enable_access_sign_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_disable_access_encrypt.smime
	modified:   test/certs/governance_enable_discovery_disable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_disable_access_none.smime
	modified:   test/certs/governance_enable_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_enable_discovery_disable_access_sign.smime
	new file:   test/certs/governance_enable_discovery_disable_access_sign_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_enable_access_encrypt.smime
	modified:   test/certs/governance_enable_discovery_enable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_enable_access_none.smime
	modified:   test/certs/governance_enable_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_enable_discovery_enable_access_sign.smime
	new file:   test/certs/governance_enable_discovery_enable_access_sign_dds_sec.xml
	new file:   test/certs/governance_only_auth.smime
	new file:   test/certs/governance_only_auth.xml
	new file:   test/certs/governance_performance_tests.smime
	new file:   test/certs/governance_performance_tests.xml
	new file:   test/certs/governance_sign_discovery_disable_access_encrypt.smime
	new file:   test/certs/governance_sign_discovery_disable_access_encrypt_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_disable_access_none.smime
	new file:   test/certs/governance_sign_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_disable_access_sign.smime
	new file:   test/certs/governance_sign_discovery_disable_access_sign_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_encrypt.smime
	new file:   test/certs/governance_sign_discovery_enable_access_encrypt_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_none.smime
	new file:   test/certs/governance_sign_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_sign.smime
	new file:   test/certs/governance_sign_discovery_enable_access_sign_dds_sec.xml
	modified:   test/certs/permissions.smime
	modified:   test/certs/permissions_dds_sec.xml
	new file:   test/certs/permissions_performance_tests.smime
	new file:   test/certs/permissions_performance_tests.xml
	modified:   test/performance/latency/main_LatencyTest.cpp
	modified:   test/performance/throughput/main_ThroughputTest.cpp
	modified:   test/performance/video/main_VideoTest.cpp
	modified:   test/profiling/main_MemoryTest.cpp

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   test/blackbox/common/BlackboxTestsSecurity.cpp

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

#6395 [24046] Update security tests to use governance-based encryption configuration (backport #6277) has been created for branch 3.2.x but encountered conflicts

Cherry-pick of a1d550b has failed:

On branch mergify/bp/3.2.x/pr-6277
Your branch is up to date with 'origin/3.2.x'.

You are currently cherry-picking commit a1d550b29.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   test/certs/governance_disable_discovery_disable_access_encrypt.smime
	modified:   test/certs/governance_disable_discovery_disable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_disable_access_none.smime
	modified:   test/certs/governance_disable_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_disable_discovery_disable_access_sign.smime
	new file:   test/certs/governance_disable_discovery_disable_access_sign_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_enable_access_encrypt.smime
	modified:   test/certs/governance_disable_discovery_enable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_enable_access_none.smime
	modified:   test/certs/governance_disable_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_disable_discovery_enable_access_sign.smime
	new file:   test/certs/governance_disable_discovery_enable_access_sign_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_disable_access_encrypt.smime
	modified:   test/certs/governance_enable_discovery_disable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_disable_access_none.smime
	modified:   test/certs/governance_enable_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_enable_discovery_disable_access_sign.smime
	new file:   test/certs/governance_enable_discovery_disable_access_sign_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_enable_access_encrypt.smime
	modified:   test/certs/governance_enable_discovery_enable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_enable_access_none.smime
	modified:   test/certs/governance_enable_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_enable_discovery_enable_access_sign.smime
	new file:   test/certs/governance_enable_discovery_enable_access_sign_dds_sec.xml
	new file:   test/certs/governance_only_auth.smime
	new file:   test/certs/governance_only_auth.xml
	new file:   test/certs/governance_performance_tests.smime
	new file:   test/certs/governance_performance_tests.xml
	new file:   test/certs/governance_sign_discovery_disable_access_encrypt.smime
	new file:   test/certs/governance_sign_discovery_disable_access_encrypt_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_disable_access_none.smime
	new file:   test/certs/governance_sign_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_disable_access_sign.smime
	new file:   test/certs/governance_sign_discovery_disable_access_sign_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_encrypt.smime
	new file:   test/certs/governance_sign_discovery_enable_access_encrypt_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_none.smime
	new file:   test/certs/governance_sign_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_sign.smime
	new file:   test/certs/governance_sign_discovery_enable_access_sign_dds_sec.xml
	modified:   test/certs/permissions.smime
	modified:   test/certs/permissions_dds_sec.xml
	new file:   test/certs/permissions_performance_tests.smime
	new file:   test/certs/permissions_performance_tests.xml
	modified:   test/performance/latency/main_LatencyTest.cpp
	modified:   test/performance/throughput/main_ThroughputTest.cpp
	modified:   test/performance/video/main_VideoTest.cpp
	modified:   test/profiling/main_MemoryTest.cpp

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   test/blackbox/common/BlackboxTestsSecurity.cpp

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

#6396 [24046] Update security tests to use governance-based encryption configuration (backport #6277) has been created for branch 2.14.x but encountered conflicts

Cherry-pick of a1d550b has failed:

On branch mergify/bp/2.14.x/pr-6277
Your branch is up to date with 'origin/2.14.x'.

You are currently cherry-picking commit a1d550b29.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   test/certs/governance_disable_discovery_disable_access_encrypt.smime
	modified:   test/certs/governance_disable_discovery_disable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_disable_access_none.smime
	modified:   test/certs/governance_disable_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_disable_discovery_disable_access_sign.smime
	new file:   test/certs/governance_disable_discovery_disable_access_sign_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_enable_access_encrypt.smime
	modified:   test/certs/governance_disable_discovery_enable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_disable_discovery_enable_access_none.smime
	modified:   test/certs/governance_disable_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_disable_discovery_enable_access_sign.smime
	new file:   test/certs/governance_disable_discovery_enable_access_sign_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_disable_access_encrypt.smime
	modified:   test/certs/governance_enable_discovery_disable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_disable_access_none.smime
	modified:   test/certs/governance_enable_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_enable_discovery_disable_access_sign.smime
	new file:   test/certs/governance_enable_discovery_disable_access_sign_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_enable_access_encrypt.smime
	modified:   test/certs/governance_enable_discovery_enable_access_encrypt_dds_sec.xml
	modified:   test/certs/governance_enable_discovery_enable_access_none.smime
	modified:   test/certs/governance_enable_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_enable_discovery_enable_access_sign.smime
	new file:   test/certs/governance_enable_discovery_enable_access_sign_dds_sec.xml
	new file:   test/certs/governance_only_auth.smime
	new file:   test/certs/governance_only_auth.xml
	new file:   test/certs/governance_performance_tests.smime
	new file:   test/certs/governance_performance_tests.xml
	new file:   test/certs/governance_sign_discovery_disable_access_encrypt.smime
	new file:   test/certs/governance_sign_discovery_disable_access_encrypt_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_disable_access_none.smime
	new file:   test/certs/governance_sign_discovery_disable_access_none_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_disable_access_sign.smime
	new file:   test/certs/governance_sign_discovery_disable_access_sign_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_encrypt.smime
	new file:   test/certs/governance_sign_discovery_enable_access_encrypt_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_none.smime
	new file:   test/certs/governance_sign_discovery_enable_access_none_dds_sec.xml
	new file:   test/certs/governance_sign_discovery_enable_access_sign.smime
	new file:   test/certs/governance_sign_discovery_enable_access_sign_dds_sec.xml
	modified:   test/certs/permissions.smime
	modified:   test/certs/permissions_dds_sec.xml
	new file:   test/certs/permissions_performance_tests.smime
	new file:   test/certs/permissions_performance_tests.xml
	modified:   test/performance/latency/main_LatencyTest.cpp
	modified:   test/performance/throughput/main_ThroughputTest.cpp
	modified:   test/profiling/main_MemoryTest.cpp

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   test/blackbox/common/BlackboxTestsSecurity.cpp
	both modified:   test/performance/video/main_VideoTest.cpp

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

emiliocuestaf added this to the v3.5.0 milestone Jan 26, 2026

emiliocuestaf requested a review from richiprosima January 26, 2026 11:31

github-actions Bot added the ci-pending PR which CI is running label Jan 26, 2026

emiliocuestaf force-pushed the bugfix/security-tests branch from e1a3c51 to c6493c1 Compare January 26, 2026 16:29

emiliocuestaf requested review from richiprosima and removed request for richiprosima January 26, 2026 16:31

emiliocuestaf requested review from richiprosima and removed request for richiprosima January 27, 2026 09:37

emiliocuestaf force-pushed the bugfix/security-tests branch from efe835d to 3ced539 Compare February 2, 2026 06:41

rsanchez15 modified the milestones: v3.5.0, v3.5.1 Feb 23, 2026

emiliocuestaf modified the milestones: v3.5.1, v3.6.0 Mar 3, 2026

zesk1999 self-requested a review March 20, 2026 10:23

zesk1999 previously approved these changes Mar 20, 2026

View reviewed changes

emiliocuestaf dismissed zesk1999’s stale review via bb6c126 March 23, 2026 09:09

emiliocuestaf force-pushed the bugfix/security-tests branch from 517886f to bb6c126 Compare March 23, 2026 09:09

emiliocuestaf requested review from richiprosima and removed request for richiprosima March 23, 2026 09:10

zesk1999 self-requested a review March 23, 2026 09:14

zesk1999 previously approved these changes Mar 23, 2026

View reviewed changes

MiguelCompany modified the milestones: v3.6.0, v3.6.1 Mar 25, 2026

MiguelCompany modified the milestones: v3.6.1, v3.6.2 Apr 8, 2026

emiliocuestaf added 4 commits May 8, 2026 09:38

Add reliability as a param to security tests

9d02c7d

Signed-off-by: Emilio Cuesta <[email protected]>

Prepare XMLs to generate smime files for new tests

98f093d

Signed-off-by: Emilio Cuesta <[email protected]>

Adding tests with access_sign in topic name

cf22780

Signed-off-by: Emilio Cuesta <[email protected]>

Add tests for SIGN access in liveliness_protection_kind/rtps_protecti…

ff7eda0

…on_kind Signed-off-by: Emilio Cuesta <[email protected]>

cferreiragonz force-pushed the bugfix/security-tests branch from bb6c126 to 13539d7 Compare May 8, 2026 10:55

cferreiragonz requested review from richiprosima and removed request for richiprosima May 8, 2026 10:55

cferreiragonz requested review from richiprosima and removed request for richiprosima May 8, 2026 11:26

cferreiragonz added 4 commits May 11, 2026 11:00

Refs #24046: Do not run best_effort large data tests

f52b495

Signed-off-by: Carlos Ferreira González <[email protected]>

Refs #24046: Uncrustify

43fc081

Signed-off-by: Carlos Ferreira González <[email protected]>

Refs #24046: Fix Windows build

9df40d1

Signed-off-by: Carlos Ferreira González <[email protected]>

Refs #24046: Enable othercacert in 'fill_access'

02ec5b5

Signed-off-by: Carlos Ferreira González <[email protected]>

cferreiragonz force-pushed the bugfix/security-tests branch from 2a2a18b to 02ec5b5 Compare May 11, 2026 10:05

cferreiragonz requested review from richiprosima and removed request for richiprosima May 11, 2026 10:05

cferreiragonz mentioned this pull request May 12, 2026

[24364 & 24365] Add UBSan workflow and solve its errors #6386

Open

9 tasks

emiliocuestaf commented May 13, 2026

View reviewed changes

Refs #24046: Reduce large data tests

7a44165

Signed-off-by: Carlos Ferreira González <[email protected]>

cferreiragonz requested review from richiprosima and removed request for richiprosima May 13, 2026 08:39

MiguelCompany added ready-to-merge Ready to be merged. CI and changes have been reviewed and approved. and removed ci-pending PR which CI is running labels May 14, 2026

MiguelCompany merged commit a1d550b into master May 14, 2026
29 of 34 checks passed

MiguelCompany deleted the bugfix/security-tests branch May 14, 2026 07:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[24046] Update security tests to use governance-based encryption configuration#6277

[24046] Update security tests to use governance-based encryption configuration#6277
MiguelCompany merged 36 commits into
masterfrom
bugfix/security-tests

emiliocuestaf commented Jan 26, 2026 •

edited by cferreiragonz

Loading

Uh oh!

mergify Bot commented Jan 27, 2026 •

edited

Loading

Uh oh!

cferreiragonz commented May 8, 2026

Uh oh!

emiliocuestaf left a comment

Uh oh!

cferreiragonz commented May 14, 2026

Uh oh!

Uh oh!

MiguelCompany commented May 14, 2026

Uh oh!

mergify Bot commented May 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

emiliocuestaf commented Jan 26, 2026 • edited by cferreiragonz Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Contributor Checklist

Reviewer Checklist

Uh oh!

mergify Bot commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 CI Insights

❌ Job Failures

Uh oh!

cferreiragonz commented May 8, 2026

Uh oh!

emiliocuestaf left a comment

Choose a reason for hiding this comment

Uh oh!

cferreiragonz commented May 14, 2026

Uh oh!

Uh oh!

MiguelCompany commented May 14, 2026

Uh oh!

mergify Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Backports have been created

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

emiliocuestaf commented Jan 26, 2026 •

edited by cferreiragonz

Loading

mergify Bot commented Jan 27, 2026 •

edited

Loading

mergify Bot commented May 14, 2026 •

edited

Loading