Safety Profile

OpenDDS使用ACE作为其平台抽象库，并且在OpenDDS的安全配置文件配置中，必须在ACE中启用以下安全配置文件之一：

当配置safety-profile时，以下功能无效

• DCPSInfoRepo and its associated libraries and tools
• Transport types: tcp, udp, multicast, shared memory
  • The rtps_udp transport type is available (uses UDP unicast or multicast)
• OpenDDS Monitor library and monitoring GUI

在开发安全配置文件时，以下DDS Compliance Profiles被禁用：

•content_subscription

•ownership_kind_exclusive

•object_model_profile

•persistence_profile

OpenDDS Security

configure --security --openssl=/foo --xerces3=/bar

DDS安全规范定义了用于身份验证，访问控制和加密操作的插件API。

只适用于 RTPS Discovery及RTPS-UDP Transport;

两种方式启用Security

1.代码级别 TheServiceParticipant->set_security(true);

2. 配置级别 在[common]中 “DCPSSecurity=1”

DDS Security Configuration Via PropertyQosPolicy

当应用程序创建DomainParticipant对象时，传递给create_participant（）方法的DomainParticipantQos现在包含一个PropertyQosPolicy对象，该对象具有一系列名称/值对。 必须包括以下属性以启用安全性。

示例代码：

// DDS Security artifact file locations

const char auth_ca_file[] = "file:identity_ca_cert.pem";

const char perm_ca_file[] = "file:permissions_ca_cert.pem";

const char id_cert_file[] = "file:test_participant_01_cert.pem";

const char id_key_file[] = "file:test_participant_01_private_key.pem";

const char governance_file[] = "file:governance_signed.p7s";

const char permissions_file[] = "file:permissions_01_signed.p7s";

// DDS Security property names

const char DDSSEC_PROP_IDENTITY_CA[] = "dds.sec.auth.identity_ca";

const char DDSSEC_PROP_IDENTITY_CERT[] = "dds.sec.auth.identity_certificate";

const char DDSSEC_PROP_IDENTITY_PRIVKEY[] = "dds.sec.auth.private_key";

const char DDSSEC_PROP_PERM_CA[] = "dds.sec.access.permissions_ca";

const char DDSSEC_PROP_PERM_GOV_DOC[] = "dds.sec.access.governance";

const char DDSSEC_PROP_PERM_DOC[] = "dds.sec.access.permissions";

void append(DDS::PropertySeq& props, const char* name, const char* value){

const DDS::Property_t prop = {name, value, false /*propagate*/};

const unsigned int len = props.length();

props.length(len + 1);

props[len] = prop;

}

int main(int argc, char* argv[]){

DDS::DomainParticipantFactory_var dpf = TheParticipantFactoryWithArgs(argc, argv);

// Start with the default Participant QoS

DDS::DomainParticipantQos part_qos; dpf->get_default_participant_qos(part_qos);

// Add properties required by DDS Security

DDS::PropertySeq& props = part_qos.property.value;

append(props, DDSSEC_PROP_IDENTITY_CA, auth_ca_file);

append(props, DDSSEC_PROP_IDENTITY_CERT, id_cert_file);

append(props, DDSSEC_PROP_IDENTITY_PRIVKEY, id_key_file);

append(props, DDSSEC_PROP_PERM_CA, perm_ca_file);

append(props, DDSSEC_PROP_PERM_GOV_DOC, governance_file);

append(props, DDSSEC_PROP_PERM_DOC, permissions_file);

// Create the participant

participant = dpf->create_participant(4, // DomainID part_qos, 0, // No listener OpenDDS::DCPS::DEFAULT_STATUS_MASK);

…

Domain Governance XML

domain_rule

topic_rule

Participant permission XML

*当前支持domian，publish，subscribe

*当前不支持relay rule， data tag