Is DDS-Router v2.0.0 compatible with the ROS2 Humble version ?

[Barry-Xu-2018]

I want to use DDS security with DDS-Router and found that DDS-Router v2.0.0 is the first version to support DDS security.

For the Humble (https://github.com/ros2/ros2/blob/humble-release/ros2.repos)

• Fast-DDS: v2.6.9
• Fast-CDR: v1.0.24
• foonathan_memory_vendor: v1.2.0

For DDS-Router v2.0.0, ddsrouter.repos describes the version of dependencies as the below

• Fast-DDS: v2.11.0
• Fast-CDR: v1.1.0
• foonathan_memory_vendor: v1.3.1

Is it possible to use DDS-Router v2.0.0 with the Humble version and enable Security?

[juanlofer-eprosima]

Hi @Barry-Xu-2018 ,

I would say it is possible but we have not tested that scenario. Do you intend to build a DDS-Router against the Fast-DDS version available in Humble, or build against v2.11.0 (or use an external DDS-Router v2.0.0 build) and hope security works when communicating with nodes created in Humble?

[Barry-Xu-2018]

Hi Juanlofer,

Thank you for your quick response.

I would say it is possible but we have not tested that scenario.

Get it.

Do you intend to build a DDS-Router against the Fast-DDS version available in Humble

I have tried this way. Build DDS-Router v2.0.0 with the Fast-DDS version available in Humble. But when compiling the dependency library ddspipe, which requires at least Fast-DDS v2.8.0.

Starting >>> ddspipe_core
--- stderr: ddspipe_core                           
CMake Error at /root/DDS-Router/install/cmake_utils/share/cmake_utils/cmake/cpp_common/find_external.cmake:34 (find_package):
  Could not find a configuration file for package "fastrtps" that is
  compatible with requested version "2.8".

or build against v2.11.0 (or use an external DDS-Router v2.0.0 build) and hope security works when communicating with nodes created in Humble?

Next, I will try this way.

[fujitatomoya]

@Barry-Xu-2018 @juanlofer-eprosima thanks for sharing the information.

i think the question here we are asking is that

Fast-DDS: v2.6.9 and Fast-CDR: v1.0.24

can work with,

Fast-DDS: v2.11.0 and Fast-CDR: v1.1.0

with or without security. and i hope this is yes.

this is related to ros2/sros2#326

[Barry-Xu-2018]

@juanlofer-eprosima

I have another question on security.

Refer to https://docs.vulcanexus.org/en/latest/rst/tutorials/cloud/secure_router/secure_router.html#configuration-of-ros-2-router, my understanding is that the participant kind must be set to XML to configure security information.

According to the description in https://eprosima-dds-router.readthedocs.io/en/v3.1.0/rst/user_manual/participants/xml.html#use-case, This participant with kind XML does not support RPC. Thus, services and actions of ROS 2 will not work correctly.

That is, if security is used, DDS-router cannot support services and actions of ROS 2 ?
If my understanding is incorrect, please correct me.

[juanlofer-eprosima]

Hi @Barry-Xu-2018, you are totally right. Currently RPC is not supported for XML kind participants, it is in our roadmap to extend it. I believe however it would be fairly straight-forward to prepare a custom DDS-Router version that would support both RPC and security, as the latter is entirely configured through participant properties.

[juanlofer-eprosima]

@Barry-Xu-2018

I'm a bit confused about the concept of RPC here. ROS2 services/actions should be implemented using topic-based communication. This participant with kind XML does not support RPC. Thus services and actions of ROS 2 will not work correctly. "What does RPC refer to in this sentence? DDS has an extension mode to support RPC, but I understand that this RPC isn't referring to DDS-RPC. So how should I interpret RPC here?

You are right, I am not referring to DDS-RPC. As you correctly say services in ROS2 are implemented with two DDS topics, however there is extra information associated to each message (mainly sequence number and writer GUID) that is used to link a specific client request to its corresponding server response, and that is used in fastdds rmw for example to filter out in a client replies that are sent from the server to another client. Hence it was needed to implement an ad-hoc module in the DDS-Router that allows to associate requests received in one router participant, to the "proxy" requests that are sent in other proxy participants, being then able to forward received responses to the router participant that received the original request. Let me know if the explanation is not clear enough.

Can you guide me on how to configure this?

Unfortunately currently there is no way to achieve that. I am just saying I believe (cannot guarantee success) there would be a way of enabling the feature in RTPS router participants (every kind other than XML) by exposing the properties configuration. However we would prefer to extend the RPC module so that it's also supported in XML participants. We may discuss which path to follow given your needs if you wish.

BTW，I confirmed humble + DDS-Router v2.1.0 can work for security mode.

Great!

[fujitatomoya]

@juanlofer-eprosima i see so there needs to be some identification queue mechanism to associate the request message and response message in the DDS router. do you happen to have milestone schedule for both service and action?

[Barry-Xu-2018]

@juanlofer-eprosima

I have another question unrelated to DDS-Router. Do you know the answer?
If I use FastDDS security, whether data sharing is disabled by default ?
After testing, I found once FastDDS security mode is enabled, data sharing is no longer used. I'm not sure if there's something else that needs to be configured.

[juanlofer-eprosima]

i see so there needs to be some identification queue mechanism to associate the request message and response message in the DDS router. do you happen to have milestone schedule for both service and action?

@fujitatomoya No currently it is not in our roadmap, however I suggest we have a meeting to discuss the possibility of including the feature in an upcoming release.

[juanlofer-eprosima]

I have another question unrelated to DDS-Router. Do you know the answer? If I use FastDDS security, whether data sharing is disabled by default ? After testing, I found once FastDDS security mode is enabled, data sharing is no longer used. I'm not sure if there's something else that needs to be configured.

@Barry-Xu-2018 You are right, the security module is not compatible with data sharing, so when the latter is configured as automatic (default) it will not be used, and if set to on and security is enabled, participant creation should fail. Thanks for pointing that out, we realized this information was not present in the documentation and created a PR to clarify the point.

[fujitatomoya]

@juanlofer-eprosima @richiware @pablogs9

I would like to hear your opinion here, for ros2/sros2#326 use case, do you suggest that DDS router can be the best way to bridge? Or you guys suggest any other approach?

[juanlofer-eprosima]

@fujitatomoya

It seems to me that DDS-Router fulfills all specified requirements.

Only authorized device can see the ROS 2 communication to/from robot.

By using an XML participant configured with security, as discussed in this thread. FYI it is also possible to only configure security at the transport layer (TLS) in case that would be enough.

For performance consideration, it would be better to keep the localhost communication in robot without secured authentication nor encryption. (basically it uses localhost in robot system, but some specific nodes to be exposed.)

This could be done for example by enabling localhost-only communication in ROS 2 nodes, and only exposing the interfaces enabling inter-machine communication in the security router participant, in combination with the definition of an allowlist that configures which topics are to be routed. As you see this assumes that the topics that are to be forwarded are only used in the secure ROS 2 nodes, which might not correspond to the scenario. Regarding this point, I wonder whether the secure ROS 2 nodes should also be able to communicate with the other ROS 2 nodes (hence sharing some topics).

Only specific entities are exposed to outside of robot system with access control.

Addressed above.

[fujitatomoya]

thanks, just FYI comments below.

As you see this assumes that the topics that are to be forwarded are only used in the secure ROS 2 nodes

there are nodes in the robot localhost use these topics as well. when the developer comes online, spawn the dds router with only half side is security enabled, and the other half is localhost communication to bridge the ROS 2 topics, services and actions from the robot. and then secured ROS 2 nodes running on developer PC can call services and actions to control the robot in this developer mode.

[Barry-Xu-2018]

Hi @juanlofer-eprosima,

Recently, I tested the connection of service/action without security enabled. I found that they work fine.
DDS-router is v2.1.0.
The contents of YAML configuration file:

##################################
# CONFIGURATION VERSION
version: v4.0
##################################
# PARTICIPANTS
participants:

  - name: ROS_2_Domain_0
    kind: local
    domain: 0

  - name: ROS_2_Domain_1
    kind: local
    domain: 1

In above your comments (#484 (reply in thread)), you said

You are right, I am not referring to DDS-RPC. As you correctly say services in ROS2 are implemented with two DDS topics, however there is extra information associated to each message (mainly sequence number and writer GUID) that is used to link a specific client request to its corresponding server response, and that is used in fastdds rmw for example to filter out in a client replies that are sent from the server to another client. Hence it was needed to implement an ad-hoc module in the DDS-Router that allows to associate requests received in one router participant, to the "proxy" requests that are sent in other proxy participants, being then able to forward received responses to the router participant that received the original request. Let me know if the explanation is not clear enough.

If we need to keep this "association" in DDS-Router, service/action shouldn't be able to work without security,

At the DDS layer, the DDS-router is only responsible for forwarding the content of a Topic from one Domain to the corresponding Topic in another Domain.
At the ROS2 RMW layer, for the same service name, Service Clients are handling the same Topic rr/xxxxxxReply for the response. Each service client can get all responses from topic rr/xxxxxxReply and it determines which response belongs to it based on the Client ID. So I think the DDS-Router just needs to be responsible for forwarding topic messages.

But I cannot explain service/action cannot work with security mode. Security enclave is set to participation.
Could you share your thoughts?

[juanlofer-eprosima]

@Barry-Xu-2018
I think this would answer your comment. I suggest we continue the security-related discussion in that thread.

[Barry-Xu-2018]

@juanlofer-eprosima Okay. Thank you.