Add support for security logging plugin

rmw_fastrtps_shared_cpp/CMakeLists.txt

@@ -45,6 +45,10 @@ find_package(fastrtps REQUIRED CONFIG)
 find_package(FastRTPS REQUIRED MODULE)
 
 find_package(rmw REQUIRED)
+
+find_package(tinyxml2_vendor REQUIRED)
+find_package(TinyXML2 REQUIRED)  # provided by tinyxml2 upstream, or tinyxml2_vendor
+
 include_directories(include)
 
 add_library(rmw_fastrtps_shared_cpp
@@ -74,6 +78,7 @@ add_library(rmw_fastrtps_shared_cpp
   src/rmw_publisher.cpp
   src/rmw_request.cpp
   src/rmw_response.cpp
+  src/rmw_security.cpp
   src/rmw_service.cpp
   src/rmw_service_names_and_types.cpp
   src/rmw_service_server_is_available.cpp
@@ -111,6 +116,8 @@ ament_export_libraries(rmw_fastrtps_shared_cpp)
 ament_export_dependencies(rcpputils)
 ament_export_dependencies(rcutils)
 ament_export_dependencies(rmw)
+ament_export_dependencies(tinyxml2_vendor)
+ament_export_dependencies(TinyXML2)
 
 if(BUILD_TESTING)
   find_package(ament_lint_auto REQUIRED)

rmw_fastrtps_shared_cpp/include/rmw_fastrtps_shared_cpp/rmw_security.hpp

@@ -0,0 +1,31 @@
+// Copyright 2020 Canonical Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef RMW_FASTRTPS_SHARED_CPP__RMW_SECURITY_HPP_
+#define RMW_FASTRTPS_SHARED_CPP__RMW_SECURITY_HPP_
+
+#include <string>
+
+#include "rmw/security_options.h"
+#include "fastrtps/rtps/attributes/PropertyPolicy.h"
+
+bool apply_security_options(
+  const rmw_security_options_t & security_options,
+  eprosima::fastrtps::rtps::PropertyPolicy & policy);
+
+bool apply_logging_configuration_from_file(
+  const std::string & xml_file_path,
+  eprosima::fastrtps::rtps::PropertyPolicy & policy);
+
+#endif  // RMW_FASTRTPS_SHARED_CPP__RMW_SECURITY_HPP_

rmw_fastrtps_shared_cpp/package.xml

@@ -19,6 +19,7 @@
   <build_depend>rcpputils</build_depend>
   <build_depend>rcutils</build_depend>
   <build_depend>rmw</build_depend>
+  <build_depend>tinyxml2_vendor</build_depend>
   <build_depend>rmw_dds_common</build_depend>
 
   <build_export_depend>fastcdr</build_export_depend>

rmw_fastrtps_shared_cpp/src/participant.cpp

@@ -42,6 +42,7 @@
 #include "rmw_fastrtps_shared_cpp/custom_participant_info.hpp"
 #include "rmw_fastrtps_shared_cpp/participant.hpp"
 #include "rmw_fastrtps_shared_cpp/rmw_common.hpp"
+#include "rmw_fastrtps_shared_cpp/rmw_security.hpp"
 
 using Domain = eprosima::fastrtps::Domain;
 using IPLocator = eprosima::fastrtps::rtps::IPLocator;
@@ -50,43 +51,6 @@ using Participant = eprosima::fastrtps::Participant;
 using ParticipantAttributes = eprosima::fastrtps::ParticipantAttributes;
 using StatefulReader = eprosima::fastrtps::rtps::StatefulReader;
 
-#if HAVE_SECURITY
-static
-bool
-get_security_file_paths(
-  std::array<std::string, 6> & security_files_paths, const char * secure_root)
-{
-  // here assume only 6 files for security
-  const char * file_names[6] = {
-    "identity_ca.cert.pem", "cert.pem", "key.pem",
-    "permissions_ca.cert.pem", "governance.p7s", "permissions.p7s"
-  };
-  size_t num_files = sizeof(file_names) / sizeof(char *);
-
-  std::string file_prefix("file://");
-
-  for (size_t i = 0; i < num_files; i++) {
-    rcutils_allocator_t allocator = rcutils_get_default_allocator();
-    char * file_path = rcutils_join_path(secure_root, file_names[i], allocator);
-
-    if (!file_path) {
-      return false;
-    }
-
-    if (rcutils_is_readable(file_path)) {
-      security_files_paths[i] = file_prefix + std::string(file_path);
-    } else {
-      allocator.deallocate(file_path, allocator.state);
-      return false;
-    }
-
-    allocator.deallocate(file_path, allocator.state);
-  }
-
-  return true;
-}
-#endif
-
 static
 CustomParticipantInfo *
 __create_participant(
@@ -196,52 +160,14 @@ rmw_fastrtps_shared_cpp::create_participant(
     participantAttrs.rtps.builtin.writerHistoryMemoryPolicy =
       eprosima::fastrtps::rtps::PREALLOCATED_WITH_REALLOC_MEMORY_MODE;
   }
-  if (security_options->security_root_path) {
-    // if security_root_path provided, try to find the key and certificate files
-#if HAVE_SECURITY
-    std::array<std::string, 6> security_files_paths;
-    if (get_security_file_paths(security_files_paths, security_options->security_root_path)) {
-      eprosima::fastrtps::rtps::PropertyPolicy property_policy;
-      using Property = eprosima::fastrtps::rtps::Property;
-      property_policy.properties().emplace_back(
-        Property("dds.sec.auth.plugin", "builtin.PKI-DH"));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.auth.builtin.PKI-DH.identity_ca", security_files_paths[0]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.auth.builtin.PKI-DH.identity_certificate", security_files_paths[1]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.auth.builtin.PKI-DH.private_key", security_files_paths[2]));
-      property_policy.properties().emplace_back(
-        Property("dds.sec.crypto.plugin", "builtin.AES-GCM-GMAC"));
-
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.plugin", "builtin.Access-Permissions"));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.builtin.Access-Permissions.permissions_ca", security_files_paths[3]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.builtin.Access-Permissions.governance", security_files_paths[4]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.builtin.Access-Permissions.permissions", security_files_paths[5]));
 
-      participantAttrs.rtps.properties = property_policy;
-    } else if (security_options->enforce_security) {
-      RMW_SET_ERROR_MSG("couldn't find all security files!");
-      return nullptr;
-    }
-#else
-    RMW_SET_ERROR_MSG(
-      "This Fast-RTPS version doesn't have the security libraries\n"
-      "Please compile Fast-RTPS using the -DSECURITY=ON CMake option");
+  eprosima::fastrtps::rtps::PropertyPolicy property_policy;
+  if (apply_security_options(*security_options, property_policy)) {
+    participantAttrs.rtps.properties = property_policy;
+  } else {
     return nullptr;
-#endif
   }
+
   return __create_participant(
     identifier,
     participantAttrs,