From 3502d36c8b3f1c89e409c0b25a7eddb5c75ab8ad Mon Sep 17 00:00:00 2001 From: Aaravanand Date: Sun, 2 Aug 2026 05:48:52 +0000 Subject: [PATCH] Add tests for SROS2 access control policies Signed-off-by: Aaravanand --- test_security/CMakeLists.txt | 52 +++++++++++++++++++ test_security/test/sros_artifacts.cmake | 28 ++++++++++ test_security/test/test_secure_publisher.cpp | 3 +- .../test_secure_publisher_subscriber.py.in | 6 ++- test_security/test/test_secure_subscriber.cpp | 3 +- .../policies/policy_publisher_denied.xml | 24 +++++++++ .../policies/policy_subscriber_denied.xml | 24 +++++++++ 7 files changed, 134 insertions(+), 6 deletions(-) create mode 100644 test_security/test/test_security_files/policies/policy_publisher_denied.xml create mode 100644 test_security/test/test_security_files/policies/policy_subscriber_denied.xml diff --git a/test_security/CMakeLists.txt b/test_security/CMakeLists.txt index b0a08b7e..a5efba88 100644 --- a/test_security/CMakeLists.txt +++ b/test_security/CMakeLists.txt @@ -121,6 +121,8 @@ if(BUILD_TESTING) set(index 0) # configure all non secure communication tests set(SUBSCRIBER_SHOULD_TIMEOUT "false") + set(PUBLISHER_ENCLAVE "/publisher") + set(SUBSCRIBER_ENCLAVE "/subscriber") while(index LESS ${n_non_secure_tests}) # here we define all the variables needed for security template expansion list(GET non_secure_comm_PUBLISHER_ROS_SECURITY_ENABLE_LIST ${index} PUBLISHER_ROS_SECURITY_ENABLE) @@ -163,6 +165,8 @@ if(BUILD_TESTING) set(SUBSCRIBER_SHOULD_TIMEOUT "false") set(PUBLISHER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}") set(SUBSCRIBER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}") + set(PUBLISHER_ENCLAVE "/publisher") + set(SUBSCRIBER_ENCLAVE "/subscriber") # configure all secure communication tests while(index LESS ${n_secure_communication_tests}) # here we define all the variables needed for security template expansion @@ -204,6 +208,8 @@ if(BUILD_TESTING) set(PUBLISHER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}") set(SUBSCRIBER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}") set(SUBSCRIBER_SHOULD_TIMEOUT "true") + set(PUBLISHER_ENCLAVE "/publisher") + set(SUBSCRIBER_ENCLAVE "/subscriber") # configure all not connecting tests while(index LESS ${n_not_connecting_tests}) # here we define all the variables needed for security template expansion @@ -240,6 +246,52 @@ if(BUILD_TESTING) ) endif() endwhile() + + # Test suite for access control policies + set(index 0) + set(PUBLISHER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}") + set(SUBSCRIBER_ROS_SECURITY_KEYSTORE "${KEYSTORE_DIRECTORY_NATIVE_PATH}") + set(SUBSCRIBER_SHOULD_TIMEOUT "true") + set(access_control_PUBLISHER_ENCLAVE_LIST "/publisher_denied;/publisher") + set(access_control_SUBSCRIBER_ENCLAVE_LIST "/subscriber;/subscriber_denied") + list(LENGTH access_control_PUBLISHER_ENCLAVE_LIST n_access_control_tests) + + while(index LESS ${n_access_control_tests}) + set(PUBLISHER_ROS_SECURITY_ENABLE "true") + set(SUBSCRIBER_ROS_SECURITY_ENABLE "true") + set(PUBLISHER_ROS_SECURITY_STRATEGY "Enforce") + set(SUBSCRIBER_ROS_SECURITY_STRATEGY "Enforce") + list(GET access_control_PUBLISHER_ENCLAVE_LIST ${index} PUBLISHER_ENCLAVE) + list(GET access_control_SUBSCRIBER_ENCLAVE_LIST ${index} SUBSCRIBER_ENCLAVE) + + set(test_suffix "__${TEST_MESSAGE_TYPE}${suffix}__access_control_${index}") + configure_file( + test/test_secure_publisher_subscriber.py.in + test_secure_publisher_subscriber${test_suffix}.py.configured + @ONLY + ) + file(GENERATE + OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/test_secure_publisher_subscriber${test_suffix}_$.py" + INPUT "${CMAKE_CURRENT_BINARY_DIR}/test_secure_publisher_subscriber${test_suffix}.py.configured" + ) + math(EXPR index "${index} + 1") + + add_launch_test( + "${CMAKE_CURRENT_BINARY_DIR}/test_secure_publisher_subscriber${test_suffix}_$.py" + TARGET test_secure_publisher_subscriber${test_suffix} + APPEND_LIBRARY_DIRS "${append_library_dirs}" + ENV + PATH="${TEST_PATH}" + TIMEOUT 20 + ) + if(TEST test_secure_publisher_subscriber${test_suffix}) + set_tests_properties( + test_secure_publisher_subscriber${test_suffix} + PROPERTIES DEPENDS "test_secure_publisher_cpp__${rmw_implementation};test_secure_subscriber_cpp__${rmw_implementation}" + FIXTURES_REQUIRED "sros_artifacts" + ) + endif() + endwhile() endforeach() endmacro() diff --git a/test_security/test/sros_artifacts.cmake b/test_security/test/sros_artifacts.cmake index 18753b86..4e956a9d 100644 --- a/test_security/test/sros_artifacts.cmake +++ b/test_security/test/sros_artifacts.cmake @@ -26,6 +26,34 @@ if(NOT ${GENERATE_ARTIFACTS_RESULT} EQUAL 0) message(FATAL_ERROR "Failed to generate security artifacts: ${GENERATE_ARTIFACTS_ERROR}") endif() +# Generate access control artifacts for publisher denied +set(generate_publisher_denied_command ${ROS2_EXECUTABLE} security generate_artifacts + -k ${KEYSTORE_DIRECTORY_NATIVE_PATH} + -e /publisher_denied + -p ${KEYSTORE_DIRECTORY_NATIVE_PATH}/policies/policy_publisher_denied.xml) +execute_process( + COMMAND ${generate_publisher_denied_command} + RESULT_VARIABLE GENERATE_ARTIFACTS_RESULT + ERROR_VARIABLE GENERATE_ARTIFACTS_ERROR +) +if(NOT ${GENERATE_ARTIFACTS_RESULT} EQUAL 0) + message(FATAL_ERROR "Failed to generate publisher denied artifacts: ${GENERATE_ARTIFACTS_ERROR}") +endif() + +# Generate access control artifacts for subscriber denied +set(generate_subscriber_denied_command ${ROS2_EXECUTABLE} security generate_artifacts + -k ${KEYSTORE_DIRECTORY_NATIVE_PATH} + -e /subscriber_denied + -p ${KEYSTORE_DIRECTORY_NATIVE_PATH}/policies/policy_subscriber_denied.xml) +execute_process( + COMMAND ${generate_subscriber_denied_command} + RESULT_VARIABLE GENERATE_ARTIFACTS_RESULT + ERROR_VARIABLE GENERATE_ARTIFACTS_ERROR +) +if(NOT ${GENERATE_ARTIFACTS_RESULT} EQUAL 0) + message(FATAL_ERROR "Failed to generate subscriber denied artifacts: ${GENERATE_ARTIFACTS_ERROR}") +endif() + # deleting key of /publisher_missing_key file(REMOVE "${KEYSTORE_DIRECTORY}/enclaves/publisher_missing_key/key.pem") diff --git a/test_security/test/test_secure_publisher.cpp b/test_security/test/test_secure_publisher.cpp index f7084620..15b18ba0 100644 --- a/test_security/test/test_secure_publisher.cpp +++ b/test_security/test/test_secure_publisher.cpp @@ -74,8 +74,7 @@ int main(int argc, char ** argv) "pass a message type\n"); return 1; } - const char * args[] = {"--ros-args", "--enclave", "/publisher"}; - rclcpp::init(sizeof(args) / sizeof(char *), args); + rclcpp::init(argc, argv); std::string message = argv[1]; std::string namespace_ = argv[2]; std::string node_name = "test_secure_publisher"; diff --git a/test_security/test/test_secure_publisher_subscriber.py.in b/test_security/test/test_secure_publisher_subscriber.py.in index 53cef7f0..c7b33c80 100644 --- a/test_security/test/test_secure_publisher_subscriber.py.in +++ b/test_security/test/test_secure_publisher_subscriber.py.in @@ -22,11 +22,13 @@ def generate_test_description(): launch_description = LaunchDescription() publisher_cmd = [ - '@TEST_PUBLISHER_EXECUTABLE@', '@TEST_MESSAGE_TYPE@', namespace + '@TEST_PUBLISHER_EXECUTABLE@', '@TEST_MESSAGE_TYPE@', namespace, + '--ros-args', '--enclave', '@PUBLISHER_ENCLAVE@' ] subscriber_cmd = [ '@TEST_SUBSCRIBER_EXECUTABLE@', '@TEST_MESSAGE_TYPE@', - '@SUBSCRIBER_SHOULD_TIMEOUT@', namespace + '@SUBSCRIBER_SHOULD_TIMEOUT@', namespace, + '--ros-args', '--enclave', '@SUBSCRIBER_ENCLAVE@' ] publisher_env = dict(os.environ) diff --git a/test_security/test/test_secure_subscriber.cpp b/test_security/test/test_secure_subscriber.cpp index 77e8294c..cadae1a6 100644 --- a/test_security/test/test_secure_subscriber.cpp +++ b/test_security/test/test_secure_subscriber.cpp @@ -124,8 +124,7 @@ int main(int argc, char ** argv) bool should_timeout = ((0 == strcmp(argv[2], "false")) || (0 == strcmp(argv[2], "0"))) ? false : true; - const char * args[] = {"--ros-args", "--enclave", "/subscriber"}; - rclcpp::init(sizeof(args) / sizeof(char *), args); + rclcpp::init(argc, argv); std::shared_ptr node = nullptr; try { node = rclcpp::Node::make_shared(node_name, namespace_); diff --git a/test_security/test/test_security_files/policies/policy_publisher_denied.xml b/test_security/test/test_security_files/policies/policy_publisher_denied.xml new file mode 100644 index 00000000..a504664f --- /dev/null +++ b/test_security/test/test_security_files/policies/policy_publisher_denied.xml @@ -0,0 +1,24 @@ + + + + + + + + chatter + + + /* + + + /* + + + /* + + + + + + diff --git a/test_security/test/test_security_files/policies/policy_subscriber_denied.xml b/test_security/test/test_security_files/policies/policy_subscriber_denied.xml new file mode 100644 index 00000000..2914e672 --- /dev/null +++ b/test_security/test/test_security_files/policies/policy_subscriber_denied.xml @@ -0,0 +1,24 @@ + + + + + + + + chatter + + + /* + + + /* + + + /* + + + + + +