ROS 2 Security Working Group, 28 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: ROS 2 Security Working Group (2020-04-28)

Description

Meeting notes: https://wiki.ros.org/ROS2/WorkingGroups/Security

A

So taking them all for a distortion up here.

B

It's marking is recording from this end. Okay,.

A

Alright might still spin it, but okay, let's go get started. Then short agenda is only one thing on the agenda, which is the foxy status window. Mikhail's been busy on so I'm the guilty I go ahead, take it yeah.

C

Sure so, mostly the thing is to be sure, we're all on the same page, and we know what I like the Tigers. We need to extinguish before the festivities, um so I I made this ticket like I, don't know like a month and a half ago, but unfortunately, it's been pretty tough to make any progress and it's so we have a few things. I think all the features we want. It landed. The only things that still like on the fly is cyclone DDS security, plugins, I, think those tin nuts on the master branch.

C

I, don't know. If you you should know anything about that seed. You may know more than me.

A

So I do not know status I did check his car cuz I know Kyle been working on that Ted. Did you have anything on that Jesus? Do you know where he was at? No, no I could follow up with Kyle, okay.

C

So I mean there is not much to do on all side, except that, like once it lands, we should make sure that it works on the raw side, like the tests are still icing and everything so just rename things at tests just to make sure it's usable for foxy, and then the other things will happen.

A

B

Know if you have this get.

C

A ticket open, maybe I, can you share my screen a bit easier.

A

Is that is that a shoot 180.

C

Yes said the one I share my screen just doesn't allow me to show me my window for some reason. So I show me enter your screen and you'll see that I have only two hundred thousand types of you.

C

Can you see my screen now? Yes, okay, so what I wanted to show? You is basically these matrix, it's not a very happy matrix right now, and so that's what I would like to know if anyone can make give a hand this. So basically, most of the reasons we have read bedsides is because the other robotic CI is not up to date, and so we have a lot of fact. There use open SSL version issues and things like that.

C

One of the main issues I have is like because I'm in Europe, basically my entire day like right now, sir I still cannot test changes for the roster CI because they are still running the nitrous and it's ready like 6:00 p.m. here. So I would like to know if anyone would be willing to like catch up again catchable outside of this meeting.

C

If anyone wants so I can show everything that I've been doing and to try to sync these open robotics to get these things going, I know Jacob started be playing looking into it yesterday evening. I just would like to make sure that we can get this done because right now, I have absolutely no certainty that Ezra stew is working for foxy.

C

So I guess I'm talking to people on the American time zone more than European one to know if anyone is interested in Mike following F is open robotics for me,.

A

So it's just second here, let's see when the next ESC meeting is.

A

We just had one last week.

C

And otherwise, I came just like I mean we can. We can go ahead with whatever we have now. One of the thing I'm a bit concerned about is like we kind of like waited on landing, some features or some fixes, because we just couldn't test them, and so I would like to be able to test things and like so.

C

The feature freeze is already past, so it's gonna be a bit tough to test new features, and so like this was that thing that is like on like requires interaction with open robotics, and there is one more thing that I would like to know. If anyone has time to look at otherwise, like I won't have time before next weekend, which is one thing.

C

That's again was an open, robotics plate, but they kind of dropped it a couple of days ago, and the thing was in order to get all their one participant the process they emerged, they disabled some Astros, two features with the plan of updating: do the follow-up work and renaming it for the Fox series and apparently like event that was working on it said that actually will not have time to do this, and so just wanted to know if anyone is also like may have some free cycles this week to look into so the change shouldn't.

C

Be that big, it's really just how we generate the Astros to produce effects so before what we're doing is what we're asking LCL PI to give us the list of node names and types and from there we would just like create one identity per node and add a lot of rules in it, and so we want to like do keep doing the exact same thing, but the policy file format has, and now we also want to group the import process.

C

So it shouldn't be that big of a change but I'm just pretty busy these days, so I may not be able to do it. I don't know if Raffy knees on the call yeah.

A

I, don't see you okay,.

C

Because there would be a person that knows the tears is passed. Okay, so same thing, I! Guess it's just like a cone for anyone interested in looking at that a bit closer and the same I can do a quick walk through I. Just may not be able to like actually implemented thing, and it would be pretty sad to actually have this feature lost in foxy. Just because the to do was not addressed. It said: okay,.

A

So if I understand you, if I captured you right and you're talking about the yesterday specific the ass Rasta to feature that automatically creates the certificate store, the policy files and so on that one Tildy, that's the one that's in the tutorial and so on. Right. That's.

C

That's another verb of that utility and this one is basically allowing you to monitor, running Rus system and just to get the res graph and based on all the information in the roadtrip generator policy file. So that's something that's like pretty convenient as soon as you want to start using security on a bigger system. You don't want to be writing all of this by hand, and so what this feature allows. You is basically audit your running system and like listen to every connection and create for you, a policy side.

C

Saying hey, is this tokyo node needs a publisher on the chato topic, and this listener needs a subscriber on the Chado. Topic is kind of thing. Okay,.

A

You know: is there anybody on the call that has any extra cycles to work on that.

D

Silence: okay,.

A

B

Ahead, so this is Roger strain with Southwest Research representing GBS, see I, don't actually have cycles right now, because we've got a lovely little funding thing. It has to be worked out before I'm allowed to actually charge project time. If that comes through I would love to reach out to you and try to see if I can figure out what needs to be done and if there's a way that I can help out. But that's pending paperwork happening in the background before I could jump in.

C

All right sounds good, so I guess what I do is then I poke the folks from Oakland, robotics, arms and matrix chat, see if embrasures are like very, very busy as well, but just to try to get them to pick up set to do that. They dropped last minute and and if Roger happens to like be able to work on these, that would be awesome and I'm more than happy to work to walk you through it and worst case scenario, I just work late and do it someday yeah.

B

If I get the okay I will let you know asap, that's.

C

Awesome Thanks, yes, I guess for the foxy studies, that was it that was basically always just like I would love us to make sure we have something that works before the release and AB all the way. We have like a couple of any issues, but most of them are like actual small bags. If we could bag fix, even if the API freezes past, so nothing is really intelligent, but that could be also a good opportunity for anyone, like you notice, involved in the project that wants to like get some like more entry-level issues.

C

So Roger, that's the same thing like if you happen to be able to work in the next not this week, but in the next couple weeks and you're looking for things to like approach. What's this dance actually side, this could be some pretty big issues as well sounds.

D

C

And yeah, until the only other thing on the concea agenda item is actually some things that I haven't revisited yet and I don't know if anyone else has and because it was mostly to change. I'll, see a PID for the API freeze, I, think we miss the window so I guess it's gonna sleep for another meeting.

A

Yeah I know I said when I talked with Kyle Joe about that I think our pressures we discussed it I think one or two meetings ago didn't come to a conclusion on it. I think we want to revisit it, but I think that was just after the freeze that we were gonna. You're gonna see what to do about the request.

C

All right and the other thing, the other thing we had an outbreak which guy was to actually visit OCS trust to public API, but does the same thing like I think the link to the document was there. So if anyone wants to comment on it, it's still welcome I. Think so far he's been on me Kai and me, but that's the same thing that this is not a very high priority thing anymore. Now that the api freezes past so will remain. It makes meeting I guess.

C

And I think that's so from my site, so I'm giving back to you see: okay,.

A

Thanks a lot does anybody else have anything particularly about the foxy freeze or any other comments or work in progress, or anything like that that you like to update on.

B

Yeah, so I'm not sure who in here is particularly familiar with the architecture of Ross to launch, but one of the things we're currently working on is the secure tag for Ross to launch, wherein we're gonna use no DL to get a snippet of what a launch executable will be adding to the Ross graph and automatically generating certificates and keys for those particular nodes.

B

Hopefully, pending the future work on policy generation, we can work out policy generation, but right now the minimal Viable Product is just going to be no two certificates and keys, and we have a couple of architecture ideas as far as how to implement that in the existing launch code. But launch is a very large, very undocumented project. So if anyone here is particularly familiar with it, I would be good to run it by, like our proposed implementation, how we're gonna slot it into the existing launch project.

C

It may be I think not many people outside from the people that developed it are very familiar with it, but even that has been working a bit less for us too recently, as well, for the contact thing I think is one of the main authors of the launch and Lara's thing.

C

So that may be a good person to try to set up a meeting with perfect yeah. We have all really, unlike William, made the design but I'm not sure like. There are a few other people that operate from Yogi's.

B

Yeah I was planning on paying them. We have a design doc that I'm gonna put up on the forum soon, once I have a minimal Viable Product to show so, hopefully, when that's ready, I'll ping, the matrix group, so you guys can take a look at it and verify as well, but they will have a minimal Viable Product and an explanation of why we put it where we did and hopefully that will also kind of give people an idea of what launch does so that a future B functionality we want.

B

As far as automating security on the launch end, you guys will understand what's possible and what's not currently.

C

That's awesome, I have one quick question: can you just give us a very quick pitch of the use case like what problem we're trying to solve and I know it's gonna be detailed in the design doc, but maybe don't give us a better understanding. The.

B

Idea is when you're running Ross to launch launch file, you can add a secure tag and the launch sub system will automatically in a set temporary directory, generate a key store. Look up the know, DL files for that particular package that that launch file is contained within and generate the keys for and certificates for. Each node. After evaluating all of the remapping arguments and substitutions that you specify in the launch file.

C

And would be an option? Would you have that option without launching the nodes, or is it like? It will do that enlarge the nodes?

C

B

That's that's one thing that, like.

C

Is surprising to me that I, don't I, don't expect recommending anyone to do that on a deployed system in a sensor like so so person.

A

C

Authority to generate certificates like this certificate authority would most likely never be on a robot, but it won't be pretty convenient if you could like ahead of time, saying: okay, like this certificate authority, that knows what is going to be deployed can just take the entire application set of large files and introspect and generate and sign things. And then this is ready to be deployed on the robot, but without actually launching the nest.

B

C

B

Definitely seems like functionality.

B

So part of the issue is the substitution system, which backs the remapping arguments is baked in the launch code and it's only evaluated when the individual node action in Ross launch is being visited by the launch service. So in the exact moments before the node is actually spun up. That's when the launch service goes through this highly templated series of strings and starts substituting in what the nodes will you know what the names of the nodes and the names of the topics will end up remapping too.

B

So it's a little difficult to do that ahead of time without actually launching the nodes.

C

B

C

I think maybe a good like thing to think of when you, when you have this discussion with people that know more about launch that, like maybe I, feel like several different timings, a in the lifecycle of a robot application. It's the time where you want to generate all these artifacts and the time where you want to launch it on actual hover right.

B

That's maybe maybe.

D

A quick point here and it's more a question to you: two guys who seem to know more about the topic. Are we considering, or at least will we consider situations or use cases where CAS will essentially be active throughout the use case, so that they can enable external participants to interact with the robotic application? Or are we just assuming that the CIA is just gonna, be shut down during production.

B

That's an interesting question, one that I haven't particularly gone into yeah.

A

I know I, know I. You know, I thought about that, a little bit and just from what I've seen so far, ideally I think the way to do that would be with an intermediate CA, which you could kind of make disposal. Potentially, you know, generate the intermediate CA and then generate all the downstream key materials off of it, and then you can throw that that CA away at that intermediate CA way if you need to without throwing away the root CA.

A

The issue with that is I, don't think all the middleware support, even though the spec says the the DDS spec supports CA a hierarchies from the documentation I've seen so far, the intermediate CAS aren't supported. So even though that seems like that would be the ideal route to make it. If you understand Victor with what you're saying make a if you're gonna expose a CA, let's expose an intermediate CA, not the root CA and then, and that way you could revoke it.

A

If you need to, but again I, don't think from what I've seen the middleware doesn't all support that yet right.

D

So you know yeah, your understanding is, this is correct. I mean my my limited understanding of the DDS are TPS and secure extensions and plugins is that, according to to my readings, several CAS are allowed, like you could have a permissions, CA and and also some additional ones, and and potentially even there could be different levels.

D

As you nicely point out, I guess: I guess I'm, just wondering that this discussion related to launch files, and also many of the things Micahel was was kind of like 20 before should probably benefit from us, having some sort of like use cases in mind like just defining kind of like a B and C use cases, and in trying to go and implement towards them. I don't know. Maybe this has happened and I just missed it or or maybe use disagree, and this is not helpful at all.

C

Now I think I think it's a great idea and to answer the C a question: that's something we explore when we originally designed us. Russ I mean we. We had the Assumption as first was a placeholder basically to allow people to experiment, and so we would not expect a root CA to either be shipped on the Roberts. But we always work with yes like if every step of the process was marginal and the fact that the duty aspects says that there is a respect of chain of trust.

C

We should be able to have kind of disposable series like Sigma's putting it that could be like shaped with Robert and I, sign things, extra things as needed and and so yeah I think released in use cases. Now, because all these that causes assumptions were made based on the state of the speck in the state of how understanding multiple years ago.

C

So it would be good to revisit when we want to like develop additional to which, because as Frost who kind of became a single utility and when the original purpose was to have like an example of how the various steps of the project could be done right now, we use the same CA, which is a root CA for the identities here and the permission CA, which I is not what I would expect the plate application to do, and so so I think it'll be good to extort a document together or something and put like use cases together to see.

C

In what case you would want what type of like certificate authority and what type of security I.

A

Think that's a great idea, I think one of the things that I it seems like we've been silent on. Is it actually how to manage those keys? So you know once you generate everything with the CA, you want to protect the CA and they think that that goes. Probably part of that use case is how to take the CA all flowing, how to protect private key materials and so on so yeah.

C

A

C

Part of some things that like came up also when we started to react, you take the key stole just like Oh foxy, actually like just recently when you actually have this private folder, which is a photo that actually has a CAS. That is the one that is not expected to be deployed. So we tried to like at least highlight it in the photo year hierarchy, but our main assumption has been that my key didn't become true.

C

Like so far, it didn't come true that we would have support for proper key storage, because right now we're talking like facts on the fact systems are not protected. So four keys of every node and that's different is something would like when the various DDS implementation supports various GP ends and key storage mechanisms.

A

So, if we're good with that top again we're just about out of time, just to summarize what we covered as far as foxy goes, it seems like we're in good shape, with one exception, which is the S Rasta two features.

A

The one issue that's that's mentioned in the agenda there and yeah making out feel free to shout out on on matrix. If you need more help with that and we talked about the launch bar I, don't think we took any action items away from that, so they pay. You have many other final comments or anything else to add.

A

Okay, so so with that I'll call it and and say I think our next meeting is in two weeks, I think it'd probably be worthwhile to just have a discussion about the foxy freeze and just things led up to it and how you know your workflow and make sure everything went as expected with that just to learn from the freeze.

A

D

If nobody else has anything to.

A

Add say: thank you very much and we'll post a meeting minutes and video recording afterwards.

C

D

Organized on all right thanks, everyone, Mike I, can't thank you very much.