Skip to content

Added zenoh_security_configuration_tools package written in cpp#495

Closed
ahcorde wants to merge 4 commits into
rollingfrom
ahcorde/rolling/access_control_cpp
Closed

Added zenoh_security_configuration_tools package written in cpp#495
ahcorde wants to merge 4 commits into
rollingfrom
ahcorde/rolling/access_control_cpp

Conversation

@ahcorde
Copy link
Copy Markdown
Contributor

@ahcorde ahcorde commented Mar 4, 2025

Replace #411 and #480

Generate zenoh config file using policy.xml

1 ) Launch zenohd

ros2 run rmw_zenoh_cpp rmw_zenohd

2 ) Launch the listener

export RMW_IMPLEMENTATION=rmw_zenoh_cpp
ros2 run demo_nodes_cpp listener

3 ) Launch the talker

export RMW_IMPLEMENTATION=rmw_zenoh_cpp
ros2 run demo_nodes_cpp talker

Now run the policy generator

ros2 security generate_policy policy_listener_talker.xml

Finally run the script:

ros2 run zenoh_security_configuration_tools zenoh_security_configuration_tools --policy policy_service.xml --config <path to default session config>/DEFAULT_RMW_ZENOH_SESSION_CONFIG.json5

Try access control

  1. Run the talker with the new config file
export ZENOH_SESSION_CONFIG_URI=talker.json5
ros2 run demo_nodes_cpp talker
[INFO] [1740601932.350808475] [talker]: Publishing: 'Hello World: 1'
[INFO] [1740601933.350487483] [talker]: Publishing: 'Hello World: 2'
  1. Run the listener with the new config file
export ZENOH_SESSION_CONFIG_URI=listener.json5
ros2 run demo_nodes_cpp listener
...
[INFO] [1740602312.492840958] [listener]: I heard: [Hello World: 1]
[INFO] [1740602313.492200366] [listener]: I heard: [Hello World: 2]

You can check that everything is fine remapping the topic name (this should not work):

ros2 run demo_nodes_cpp talker --ros-args -r chatter:=new_topic
ros2 run demo_nodes_cpp listener --ros-args -r chatter:=new_topic
...
# listener should not receive anything

policy files

Just in case you want to try this tools here you can find some examples

policy_talker_listerner.xml ```xml ~/describe_parameters ~/get_parameter_types ~/get_parameters ~/get_type_description ~/list_parameters ~/set_parameters ~/set_parameters_atomically chatter parameter_events parameter_events rosout ~/describe_parameters ~/get_parameter_types ~/get_parameters ~/get_type_description ~/list_parameters ~/set_parameters ~/set_parameters_atomically parameter_events chatter parameter_events rosout ```
ros2 run demo_nodes_cpp talker
ros2 run demo_nodes_cpp listener
Policy_service.xml ```xml ~/describe_parameters ~/get_parameter_types ~/get_parameters ~/get_type_description ~/list_parameters ~/set_parameters ~/set_parameters_atomically add_two_ints parameter_events parameter_events rosout add_two_ints ~/describe_parameters ~/get_parameter_types ~/get_parameters ~/get_type_description ~/list_parameters ~/set_parameters ~/set_parameters_atomically parameter_events parameter_events rosout ```
ros2 run demo_nodes_cpp add_two_ints_client
ros2 run demo_nodes_cpp add_two_ints_server
policy_action.xml ```xml ~/describe_parameters ~/get_parameter_types ~/get_parameters ~/get_type_description ~/list_parameters ~/set_parameters ~/set_parameters_atomically /fibonacci/_action/cancel_goal /fibonacci/_action/get_result /fibonacci/_action/send_goal /fibonacci/_action/feedback /fibonacci/_action/status parameter_events parameter_events rosout /fibonacci/_action/cancel_goal /fibonacci/_action/get_result /fibonacci/_action/send_goal ~/describe_parameters ~/get_parameter_types ~/get_parameters ~/get_type_description ~/list_parameters ~/set_parameters ~/set_parameters_atomically parameter_events /fibonacci/_action/feedback /fibonacci/_action/status parameter_events rosout ```
ros2 run action_tutorials_cpp fibonacci_action_client
ros2 run action_tutorials_cpp fibonacci_action_server

@ahcorde ahcorde requested a review from Yadunund March 4, 2025 21:44
@ahcorde ahcorde self-assigned this Mar 4, 2025
Signed-off-by: Alejandro Hernandez Cordero <[email protected]>
@cgeller
Copy link
Copy Markdown

cgeller commented Mar 24, 2025

Thanks for this valuable feature! I successfully tested the setup above.

However, in my usecase it would be easier to set all access control settings in the ROUTER_CONFIG instead of SESSION_CONFIGS. Would it be possible, to extend the config generator in a way, that it generates a central ROUTER_CONFIG? I attached a minimal config for the example above ..
ROUTER_CONFIG.json

@mjcarroll mjcarroll force-pushed the ahcorde/rolling/access_control_cpp branch from bfdf2b1 to 3411fde Compare April 4, 2025 18:40
* Update policy_parser to use nlohmann_json.hpp

Since we have the dependency now via #583, this is a potential
improvement to the current string concatenation.

Signed-off-by: Michael Carroll <[email protected]>

* Further json changes

Signed-off-by: Michael Carroll <[email protected]>

---------

Signed-off-by: Michael Carroll <[email protected]>
@Yadunund
Copy link
Copy Markdown
Member

Yadunund commented Apr 7, 2025

Changes from here were merged as part of #595.

@Yadunund Yadunund closed this Apr 7, 2025
@Yadunund Yadunund deleted the ahcorde/rolling/access_control_cpp branch April 7, 2025 00:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants