From b10501871c56e9e4d892249761ab4c64f6fb0ddb Mon Sep 17 00:00:00 2001 From: Eduardo Ponz Segrelles Date: Fri, 10 Feb 2023 12:26:31 +0100 Subject: [PATCH] Secure discovery server (#437) * Refs #15596. Added XML profile for CLI example. Signed-off-by: Miguel Company * Refs #15596. CLI examples updated. Signed-off-by: Miguel Company * Refs #15596. Added note regarding security configuration. Signed-off-by: Miguel Company * Refs #15596. Introduction on discovery server section. Signed-off-by: Miguel Company * Refs #15596: Add security section to discovery server Signed-off-by: Eduardo Ponz --------- Signed-off-by: Miguel Company Signed-off-by: Eduardo Ponz Co-authored-by: Miguel Company --- code/XMLTester.xml | 68 +++++++++++++++++++++ docs/fastdds/discovery/discovery_server.rst | 30 +++++++++ docs/fastddscli/cli/cli.rst | 36 +++++++++-- 3 files changed, 130 insertions(+), 4 deletions(-) diff --git a/code/XMLTester.xml b/code/XMLTester.xml index fb8c17172..773201047 100644 --- a/code/XMLTester.xml +++ b/code/XMLTester.xml @@ -796,6 +796,74 @@ + + + + 44.53.00.5f.45.50.52.4f.53.49.4d.41 + + + SERVER + + + + +
0.0.0.0
+ 11811 + + + + + + + + + dds.sec.auth.plugin + builtin.PKI-DH + + + + + dds.sec.auth.builtin.PKI-DH.identity_ca + file://maincacert.pem + + + dds.sec.auth.builtin.PKI-DH.identity_certificate + file://appcert.pem + + + dds.sec.auth.builtin.PKI-DH.private_key + file://appkey.pem + + + + + dds.sec.access.plugin + builtin.Access-Permissions + + + + + dds.sec.access.builtin.Access-Permissions.permissions_ca + file://maincacet.pem + + + dds.sec.access.builtin.Access-Permissions.governance + file://governance.smime + + + dds.sec.access.builtin.Access-Permissions.permissions + file://permissions.smime + + + + + dds.sec.crypto.plugin + builtin.AES-GCM-GMAC + + + + + <--> diff --git a/docs/fastdds/discovery/discovery_server.rst b/docs/fastdds/discovery/discovery_server.rst index bbda3fdab..2a3d9453a 100644 --- a/docs/fastdds/discovery/discovery_server.rst +++ b/docs/fastdds/discovery/discovery_server.rst @@ -389,3 +389,33 @@ Client side setup | :lines: 2-3,5-40 | | :append: | +---------------------------------------------------------------------+ + +.. _DS_security: + +Security +^^^^^^^^ + +Configuring :ref:`security` on *servers* and *clients* is done the same way as for any other participant. +This section depicts the limitations imposed by the security enforcement on the communication between +*clients* and *servers*, and which discovery information is propagated by a *server* depending on the security +configuration of the *clients* and *servers* to which it is connected. + +It is important to note that for enabling a secure discovery when using Discovery Server, *Fast DDS* must be compiled +with security support (see :ref:`cmake_options`), and the :ref:`domain_governance_doc` must explicitly encrypt the +discovery. + +As in SDP, when using this feature, the Domain Governance Document of all *clients* and *servers* connecting to a +*server* must match that of the *server*, which implies that all |DomainParticipants| belonging to the same Discovery +Sever network must configure the discovery protection in the same manner. + +Although the *server* mediates the discovery process and creates connections between *clients*, the *clients* themselves +still go through the PKI (Public Key Infrastructure) exchange in order to have a secure communication between them. + +.. important:: + + In order to keep the behavior consistent with the QoS Policies, the *server* does not check the + :ref:`domainparticipant_permissions_doc` of the |DomainParticipants| that it is connecting. + +.. important:: + + Security support for Discovery Server is only supported from Fast DDS v2.10.0 onward. diff --git a/docs/fastddscli/cli/cli.rst b/docs/fastddscli/cli/cli.rst index ebc25b677..49637c722 100644 --- a/docs/fastddscli/cli/cli.rst +++ b/docs/fastddscli/cli/cli.rst @@ -103,6 +103,7 @@ The output is: ### Server is running ### Participant Type: + Security: Server ID: Server GUID prefix: 44.53..5f.45.50.52.4f.53.49.4d.41 Server Addresses: UDPv4:[]: @@ -112,6 +113,10 @@ Once the *server* is instantiated, the *clients* can be configured either progra :ref:`discovery_server`), or using environment variable ``ROS_DISCOVERY_SERVER`` (see :ref:`env_vars_ros_discovery_server`) +.. note:: + The :ref:`security` configuration of the discovery server should be done through XML. + See example below. + .. _cli_discovery_examples: Examples @@ -131,6 +136,7 @@ Examples ### Server is running ### Participant Type: SERVER + Security: NO Server ID: 0 Server GUID prefix: 44.53.00.5f.45.50.52.4f.53.49.4d.41 Server Addresses: UDPv4:[0.0.0.0]:11811 @@ -149,6 +155,7 @@ Examples ### Server is running ### Participant Type: SERVER + Security: NO Server ID: 1 Server GUID prefix: 44.53.01.5f.45.50.52.4f.53.49.4d.41 Server Addresses: UDPv4:[127.0.0.1]:14520 @@ -179,6 +186,7 @@ Examples ### Server is running ### Participant Type SERVER + Security: NO Server ID: 2 Server GUID prefix: 44.53.02.5f.45.50.52.4f.53.49.4d.41 Server Addresses: UDPv4:[192.168.36.34]:8783 @@ -205,6 +213,7 @@ Examples ### Server is running ### Participant Type BACKUP + Security: NO Server ID: 3 Server GUID prefix: 44.53.03.5f.45.50.52.4f.53.49.4d.41 Server Addresses: UDPv4:[172.30.144.1]:12345 @@ -222,10 +231,29 @@ Examples .. code-block:: bash ### Server is running ### - Participant Type: SERVER - Server ID: 0 - Server GUID prefix: 44.53.00.5f.45.50.52.4f.53.49.4d.41 - Server Addresses: UDPv4:[127.0.0.1]:14520 + Participant Type: SERVER + Security: NO + Server ID: 0 + Server GUID prefix: 44.53.00.5f.45.50.52.4f.53.49.4d.41 + Server Addresses: UDPv4:[127.0.0.1]:14520 + +7. Launch a secure server with id 0 (first on ``ROS_DISCOVERY_SERVER``) + listening on all available interfaces on UDP port '11811'. + + .. code-block:: bash + + fastdds discovery -x secure_discovery_server_cli@[PATH_TO_FILE]/DiscoveryServerCLI.xml + + Output: + + .. code-block:: bash + + ### Server is running ### + Participant Type: SERVER + Security: YES + Server ID: 0 + Server GUID prefix: 44.53.00.5f.45.50.52.4f.53.49.4d.41 + Server Addresses: UDPv4:[0.0.0.0]:11811 8. Launch a server with id 0 (first on ``ROS_DISCOVERY_SERVER``) reading specific `profile_name` configuration from XML file.