Add support for security logging plugin

If a `logging.xml` file is included in the security files, enable the
security logging plugin in Fast RTPS using the properties contained in
said file.

Also reorganize existing security logic to be more testable, and add
some tests for it.

Signed-off-by: Kyle Fazzari <[email protected]>

rmw_fastrtps_shared_cpp/CMakeLists.txt

@@ -45,6 +45,10 @@ find_package(fastrtps REQUIRED CONFIG)
 find_package(FastRTPS REQUIRED MODULE)
 
 find_package(rmw REQUIRED)
+
+find_package(tinyxml2_vendor REQUIRED)
+find_package(TinyXML2 REQUIRED)  # provided by tinyxml2 upstream, or tinyxml2_vendor
+
 include_directories(include)
 
 add_library(rmw_fastrtps_shared_cpp
@@ -74,6 +78,7 @@ add_library(rmw_fastrtps_shared_cpp
   src/rmw_publisher.cpp
   src/rmw_request.cpp
   src/rmw_response.cpp
+  src/rmw_security.cpp
   src/rmw_service.cpp
   src/rmw_service_names_and_types.cpp
   src/rmw_service_server_is_available.cpp
@@ -111,6 +116,8 @@ ament_export_libraries(rmw_fastrtps_shared_cpp)
 ament_export_dependencies(rcpputils)
 ament_export_dependencies(rcutils)
 ament_export_dependencies(rmw)
+ament_export_dependencies(tinyxml2_vendor)
+ament_export_dependencies(TinyXML2)
 
 if(BUILD_TESTING)
   find_package(ament_lint_auto REQUIRED)

rmw_fastrtps_shared_cpp/include/rmw_fastrtps_shared_cpp/rmw_security.hpp

@@ -0,0 +1,31 @@
+// Copyright 2020 Canonical Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef RMW_FASTRTPS_SHARED_CPP__RMW_SECURITY_HPP_
+#define RMW_FASTRTPS_SHARED_CPP__RMW_SECURITY_HPP_
+
+#include <string>
+
+#include "rmw/security_options.h"
+#include "fastrtps/rtps/attributes/PropertyPolicy.h"
+
+bool apply_security_options(
+  const rmw_security_options_t & security_options,
+  eprosima::fastrtps::rtps::PropertyPolicy & policy);
+
+bool apply_logging_configuration_from_file(
+  const std::string & xml_file_path,
+  eprosima::fastrtps::rtps::PropertyPolicy & policy);
+
+#endif  // RMW_FASTRTPS_SHARED_CPP__RMW_SECURITY_HPP_

rmw_fastrtps_shared_cpp/package.xml

@@ -19,6 +19,7 @@
   <build_depend>rcpputils</build_depend>
   <build_depend>rcutils</build_depend>
   <build_depend>rmw</build_depend>
+  <build_depend>tinyxml2_vendor</build_depend>
   <build_depend>rmw_dds_common</build_depend>
 
   <build_export_depend>fastcdr</build_export_depend>

rmw_fastrtps_shared_cpp/src/participant.cpp

@@ -42,6 +42,7 @@
 #include "rmw_fastrtps_shared_cpp/custom_participant_info.hpp"
 #include "rmw_fastrtps_shared_cpp/participant.hpp"
 #include "rmw_fastrtps_shared_cpp/rmw_common.hpp"
+#include "rmw_fastrtps_shared_cpp/rmw_security.hpp"
 
 using Domain = eprosima::fastrtps::Domain;
 using IPLocator = eprosima::fastrtps::rtps::IPLocator;
@@ -50,43 +51,6 @@ using Participant = eprosima::fastrtps::Participant;
 using ParticipantAttributes = eprosima::fastrtps::ParticipantAttributes;
 using StatefulReader = eprosima::fastrtps::rtps::StatefulReader;
 
-#if HAVE_SECURITY
-static
-bool
-get_security_file_paths(
-  std::array<std::string, 6> & security_files_paths, const char * secure_root)
-{
-  // here assume only 6 files for security
-  const char * file_names[6] = {
-    "identity_ca.cert.pem", "cert.pem", "key.pem",
-    "permissions_ca.cert.pem", "governance.p7s", "permissions.p7s"
-  };
-  size_t num_files = sizeof(file_names) / sizeof(char *);
-
-  std::string file_prefix("file://");
-
-  for (size_t i = 0; i < num_files; i++) {
-    rcutils_allocator_t allocator = rcutils_get_default_allocator();
-    char * file_path = rcutils_join_path(secure_root, file_names[i], allocator);
-
-    if (!file_path) {
-      return false;
-    }
-
-    if (rcutils_is_readable(file_path)) {
-      security_files_paths[i] = file_prefix + std::string(file_path);
-    } else {
-      allocator.deallocate(file_path, allocator.state);
-      return false;
-    }
-
-    allocator.deallocate(file_path, allocator.state);
-  }
-
-  return true;
-}
-#endif
-
 static
 CustomParticipantInfo *
 __create_participant(
@@ -196,52 +160,14 @@ rmw_fastrtps_shared_cpp::create_participant(
     participantAttrs.rtps.builtin.writerHistoryMemoryPolicy =
       eprosima::fastrtps::rtps::PREALLOCATED_WITH_REALLOC_MEMORY_MODE;
   }
-  if (security_options->security_root_path) {
-    // if security_root_path provided, try to find the key and certificate files
-#if HAVE_SECURITY
-    std::array<std::string, 6> security_files_paths;
-    if (get_security_file_paths(security_files_paths, security_options->security_root_path)) {
-      eprosima::fastrtps::rtps::PropertyPolicy property_policy;
-      using Property = eprosima::fastrtps::rtps::Property;
-      property_policy.properties().emplace_back(
-        Property("dds.sec.auth.plugin", "builtin.PKI-DH"));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.auth.builtin.PKI-DH.identity_ca", security_files_paths[0]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.auth.builtin.PKI-DH.identity_certificate", security_files_paths[1]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.auth.builtin.PKI-DH.private_key", security_files_paths[2]));
-      property_policy.properties().emplace_back(
-        Property("dds.sec.crypto.plugin", "builtin.AES-GCM-GMAC"));
-
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.plugin", "builtin.Access-Permissions"));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.builtin.Access-Permissions.permissions_ca", security_files_paths[3]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.builtin.Access-Permissions.governance", security_files_paths[4]));
-      property_policy.properties().emplace_back(
-        Property(
-          "dds.sec.access.builtin.Access-Permissions.permissions", security_files_paths[5]));
 
-      participantAttrs.rtps.properties = property_policy;
-    } else if (security_options->enforce_security) {
-      RMW_SET_ERROR_MSG("couldn't find all security files!");
-      return nullptr;
-    }
-#else
-    RMW_SET_ERROR_MSG(
-      "This Fast-RTPS version doesn't have the security libraries\n"
-      "Please compile Fast-RTPS using the -DSECURITY=ON CMake option");
+  eprosima::fastrtps::rtps::PropertyPolicy property_policy;
+  if (apply_security_options(*security_options, property_policy)) {
+    participantAttrs.rtps.properties = property_policy;
+  } else {
     return nullptr;
-#endif
   }
+
   return __create_participant(
     identifier,
     participantAttrs,