Can a single writer only be enforced? [13815]

[Nir-Az]

Hi,

I got a question regarding security:
Is there a way to enforce a single writer only? I mean after the first writer is created, if another application tried to create a writer on the same topic it will fail?

Thanks.
Nir

[EduPonz]

Hi @Nir-Az ,

Unfortunately, this is not possible.

For starters, there is no way in which a participant in one process can get to know if the data writer it's about to create is the first one on the topic, or if there is already one or more that are yet to be discovered.

There are several things that could be done to somehow achieve what you want:

1. Using the Access Control Security plugin, you could use the Domain Participant Permissions Document file to configure all but one of your participants to not be allowed to create a data writer in a certain topic.
2. You could do this in your application by ignoring all the data coming from certain writers.
3. The DDS standard describes a QoS Policy Ownership (section 2.2.3.9) that can be set to EXCLUSIVE. In that case, only the data coming from the data writer with the higher STRENGTH is taken into account. Mind that this does not prevent the data to be sent, it is merely discarded in the receiving side. Right now, Fast DDS only supports SHARED ownership.
4. The DDS standard defines a DomainParticipant::ignore_publication (section 2.2.2.2.1.16) method that can be used to ignore all the publications discovered after the first one. Mind that this does not prevent the data to be sent, it is merely discarded in the receiving side. This is yet to be implemented in Fast DDS.

[Nir-Az]

Thanks @EduPonz ,

I will take a look at option # 1 as it is the most relevant solution.
Regarding the ownership QoS, I spent half a day trying to understand why it's not working, I didn't find any hint about it not yet implemented at the documentation of FastDDS, I suggest adding a note about it, maybe also inside the ownership example which is a user implementation..

[EduPonz]

Hi @Nir-Az,

Regarding the ownership QoS, I spent have a day tring to understand why it's not working, I didn't find any hint about it not yet implemented at the documentation of FastDDS, I suggest adding a note about it, maybe also inside the ownership example which is a user implementation

I agree with you that the documentation could make a better work in this case. I've added a tracker and we will explicitly state it soon.

Thanks!

[Nir-Az]

@EduPonz regarding option 1.
I took the DDSSecureHelloWorldExample example and try running it with several changes.

• CMake configure with SECURITY=OFF It worked
• CMake configure with SECURITY=On It worked
• Delete cert folder from the build directory - it worked

Is this implemented?
I was expecting it to fail without the cert folder..

[EduPonz]

Hi @Nir-Az ,

1. Running the example with SECURITY=OFF is expected to work, as the security related properties are handled by the SecurityManager, which is only instantiated when SECURITY=ON. That is, those properties are only taken into account if security is activated.
2. I suspect your test of removing the certs directory was performed with SECURITY=OFF. I just removed it myself and run the example to double check and I got:

eduponz SecureHelloWorldExample $ ./DDSSecureHelloWorldExample publisher
Starting 
2022-01-19 14:45:07.896 [SECURITY Error] OpenSSL library cannot read file certs/maincacert.pem (<some_path>/fastdds/src/cpp/security/artifact_providers/FileProvider.cpp:118) -> Function validate_local_identity
2022-01-19 14:45:07.896 [RTPS_PARTICIPANT Error] Cannot create participant due to security initialization error -> Function createParticipant
2022-01-19 14:45:07.896 [DOMAIN_PARTICIPANT Error] Problem creating RTPSParticipant -> Function enable

So long story short, it is very much implemented 😃

[Nir-Az]

Great to hear :)

I validate it as working.
The issue was missing 7libp11 on cmake

Could NOT find LibP11 (missing: LIBP11_LIBRARY LIBP11_INCLUDE_DIR) 
OpenSSL library 3.0.1 found...

I would ass a CMAKE info message on all cases that security is check and it cannot work.
No indication of the cause not on runtime and not on cmake configure..