Draft: Apply pluggable security for federated execution.

core/federated/RTI/main.c

@@ -115,6 +115,8 @@ void usage(int argc, const char* argv[]) {
   lf_print("  -a, --auth Turn on HMAC authentication options.\n");
   lf_print("  -t, --tracing Turn on tracing.\n");
   lf_print("  -d, --disable_dnet Turn off the use of DNET signals.\n");
+  lf_print("  -sst, --sst SST config path for RTI.\n");
+  lf_print("  -tls, --tls <cert_path> <key_path>   TLS certificate and private key paths.\n");
 
   lf_print("Command given:");
   for (int i = 0; i < argc; i++) {
@@ -220,7 +222,7 @@ int process_args(int argc, const char* argv[]) {
       rti.base.number_of_scheduling_nodes = (int32_t)num_federates; // FIXME: Loses numbers on 64-bit machines
       lf_print_info("RTI: Number of federates: %d", rti.base.number_of_scheduling_nodes);
     } else if (strcmp(argv[i], "-p") == 0 || strcmp(argv[i], "--port") == 0) {
-#ifdef COMM_TYPE_TCP
+#if defined(COMM_TYPE_TCP) || defined(COMM_TYPE_SST) || defined(COMM_TYPE_TLS)
       if (argc < i + 2) {
         lf_print_error("--port needs a short unsigned integer argument ( > 0 and < %d).", UINT16_MAX);
         usage(argc, argv);
@@ -252,6 +254,42 @@ int process_args(int argc, const char* argv[]) {
       return 0;
 #endif
       rti.authentication_enabled = true;
+    } else if (strcmp(argv[i], "-sst") == 0 || strcmp(argv[i], "--sst") == 0) {
+#ifndef COMM_TYPE_SST
+      lf_print_error("--sst requires the RTI to be built with the --DCOMM_TYPE=SST option.");
+      usage(argc, argv);
+      return 0;
+#else
+      i++;
+      lf_set_sst_config_path(argv[i]);
+#endif
+    } else if (strcmp(argv[i], "-tls") == 0 || strcmp(argv[i], "--tls") == 0) {
+#ifndef COMM_TYPE_TLS
+      lf_print_error("--tls requires the RTI to be built with the -DCOMM_TYPE=TLS option.");
+      usage(argc, argv);
+      return 0;
+#else
+      // Need two arguments: cert path and key path
+      if (argc < i + 3) {
+        lf_print_error("--tls needs two arguments: <certificate_path> <private_key_path>.");
+        usage(argc, argv);
+        return 0;
+      }
+      const char* cert_path = argv[i + 1];
+      const char* key_path = argv[i + 2];
+
+      // Optional: basic sanity check (avoid empty strings)
+      if (cert_path[0] == '\0' || key_path[0] == '\0') {
+        lf_print_error("--tls certificate_path and private_key_path must be non-empty.");
+        usage(argc, argv);
+        return 0;
+      }
+
+      lf_set_tls_configuration(cert_path, key_path);
+      lf_print_debug("RTI: TLS cert path: %s", cert_path);
+      lf_print_debug("RTI: TLS key path : %s", key_path);
+      i += 2;
+#endif
     } else if (strcmp(argv[i], "-t") == 0 || strcmp(argv[i], "--tracing") == 0) {
       rti.base.tracing_enabled = true;
     } else if (strcmp(argv[i], "-d") == 0 || strcmp(argv[i], "--dnet_disabled") == 0) {

core/federated/RTI/rti_remote.c

@@ -650,9 +650,9 @@ void handle_address_query(uint16_t fed_id) {
     // The network abstraction is initialized, but the RTI might still not know the port number. This can happen if the
     // RTI has not yet received a MSG_TYPE_ADDRESS_ADVERTISEMENT message from the remote federate. In such cases, the
     // returned port number might still be -1.
-    server_port = ((socket_priv_t*)remote_fed->net)->server_port;
-    ip_address = (uint32_t*)&((socket_priv_t*)remote_fed->net)->server_ip_addr;
-    server_host_name = ((socket_priv_t*)remote_fed->net)->server_hostname;
+    server_port = get_server_port(remote_fed->net);
+    ip_address = (uint32_t*)get_ip_addr(remote_fed->net);
+    server_host_name = get_server_hostname(remote_fed->net);
   }
 
   encode_int32(server_port, (unsigned char*)&buffer[1]);
@@ -687,7 +687,8 @@ void handle_address_ad(uint16_t federate_id) {
   assert(server_port < 65536);
 
   LF_MUTEX_LOCK(&rti_mutex);
-  ((socket_priv_t*)fed->net)->server_port = server_port;
+  // (((sst_priv_t*)fed->net)->socket_priv)->server_port = server_port;
+  set_server_port(fed->net, server_port);
   LF_MUTEX_UNLOCK(&rti_mutex);
 
   LF_PRINT_LOG("Received address advertisement with port %d from federate %d.", server_port, federate_id);
@@ -1325,7 +1326,7 @@ static int receive_udp_message_and_set_up_clock_sync(net_abstraction_t fed_net,
           // Initialize the UDP_addr field of the federate struct
           fed->UDP_addr.sin_family = AF_INET;
           fed->UDP_addr.sin_port = htons(federate_UDP_port_number);
-          fed->UDP_addr.sin_addr = ((socket_priv_t*)fed_net)->server_ip_addr;
+          fed->UDP_addr.sin_addr = *get_ip_addr(fed_net);
         }
       } else {
         // Disable clock sync after initial round.
@@ -1513,7 +1514,7 @@ int start_rti_server() {
   // Initialize RTI's network abstraction.
   rti_remote->rti_net = initialize_net();
   // Set the user specified port to the network abstraction.
-  ((socket_priv_t*)rti_remote->rti_net)->user_specified_port = rti_remote->user_specified_port;
+  set_my_port(rti_remote->rti_net, rti_remote->user_specified_port);
   // Create the server
   if (create_server(rti_remote->rti_net)) {
     lf_print_error_system_failure("RTI failed to create TCP server: %s.", strerror(errno));

core/federated/federate.c

@@ -723,7 +723,6 @@ static int handle_port_absent_message(net_abstraction_t net, int fed_id) {
  * network abstraction in _fed.net_for_inbound_p2p_connections
  * to -1 and returns, terminating the thread.
  * @param _args The remote federate ID (cast to void*).
- * @param fed_id_ptr A pointer to a uint16_t containing federate ID being listened to.
  *  This procedure frees the memory pointed to before returning.
  */
 static void* listen_to_federates(void* _args) {
@@ -1756,10 +1755,24 @@ void lf_connect_to_federate(uint16_t remote_federate_id) {
   char hostname[INET_ADDRSTRLEN];
   inet_ntop(AF_INET, &host_ip_addr, hostname, INET_ADDRSTRLEN);
 
+#ifdef COMM_TYPE_TCP
   socket_connection_params_t params;
   params.type = TCP;
   params.port = uport;
   params.server_hostname = hostname;
+#elif defined(COMM_TYPE_SST)
+  sst_connection_params_t params;
+  params.socket_params.type = TCP;
+  params.socket_params.port = uport;
+  params.socket_params.server_hostname = hostname;
+  params.target = 1;
+#elif defined(COMM_TYPE_TLS)
+  tls_connection_params_t params;
+  params.socket_params.type = TCP;
+  params.socket_params.port = uport;
+  params.socket_params.server_hostname = hostname;
+#endif
+
   net_abstraction_t net = connect_to_net((net_params_t)&params);
   if (net == NULL) {
     lf_print_error_and_exit("Failed to connect to federate.");
@@ -1837,10 +1850,24 @@ void lf_connect_to_rti(const char* hostname, int port) {
   hostname = federation_metadata.rti_host ? federation_metadata.rti_host : hostname;
   port = federation_metadata.rti_port >= 0 ? federation_metadata.rti_port : port;
 
+#ifdef COMM_TYPE_TCP
   socket_connection_params_t params;
   params.type = TCP;
   params.port = port;
   params.server_hostname = hostname;
+#elif defined(COMM_TYPE_SST)
+  sst_connection_params_t params;
+  params.socket_params.type = TCP;
+  params.socket_params.port = port;
+  params.socket_params.server_hostname = hostname;
+  params.target = 0;
+#elif defined(COMM_TYPE_TLS)
+  tls_connection_params_t params;
+  params.socket_params.type = TCP;
+  params.socket_params.port = port;
+  params.socket_params.server_hostname = hostname;
+#endif
+
   net_abstraction_t net = connect_to_net((net_params_t)&params);
   if (net == NULL) {
     lf_print_error_and_exit("Failed to connect to RTI.");
@@ -1949,14 +1976,13 @@ void lf_create_server(int specified_port) {
   assert(specified_port <= UINT16_MAX && specified_port >= 0);
 
   net_abstraction_t server_net = initialize_net();
-  ((socket_priv_t*)server_net)->port = (uint16_t)specified_port;
-
+  set_my_port(server_net, specified_port);
   if (create_server(server_net)) {
     lf_print_error_system_failure("Failed to create server: %s.", strerror(errno));
   };
   _fed.server_net = server_net;
   // Get the final server port to send to the RTI on an MSG_TYPE_ADDRESS_ADVERTISEMENT message.
-  int32_t server_port = ((socket_priv_t*)server_net)->port;
+  int32_t server_port = get_my_port(server_net);
 
   LF_PRINT_LOG("Server for communicating with other federates started using port %d.", server_port);
 

core/reactor_common.c

@@ -999,6 +999,14 @@ void usage(int argc, const char* argv[]) {
   printf("      The address of the RTI, which can be in the form of user@host:port or ip:port.\n\n");
   printf("  -l\n");
   printf("      Send stdout to individual log files for each federate.\n\n");
+#ifdef COMM_TYPE_SST
+  printf("  -sst, --sst <n>\n");
+  printf("      Path to the SST configuration file.\n\n");
+#endif
+#ifdef COMM_TYPE_TLS
+  printf("  -tls, --tls <certificate_path> <private_key_path>\n");
+  printf("      Paths to the TLS certificate and private key to use.\n\n");
+#endif
 #endif
 #endif
   printf("Command given:\n");
@@ -1211,6 +1219,40 @@ int process_args(int argc, const char* argv[]) {
         return 0;
       }
     }
+#endif
+#ifdef COMM_TYPE_SST
+    else if (strcmp(arg, "-sst") == 0 || strcmp(arg, "--sst") == 0) {
+      if (argc < i + 1) {
+        lf_print_error("--sst needs a string argument.");
+        usage(argc, argv);
+        return 0;
+      }
+      const char* fid = argv[i++];
+      lf_set_sst_config_path(fid);
+    }
+#endif
+#ifdef COMM_TYPE_TLS
+    else if (strcmp(arg, "-tls") == 0 || strcmp(arg, "--tls") == 0) {
+      // Need two arguments: cert path and key path
+      if (argc < i + 2) {
+        lf_print_error("--tls needs two arguments: <certificate_path> <private_key_path>.");
+        usage(argc, argv);
+        return 0;
+      }
+
+      const char* cert_path = argv[i++];
+      const char* key_path = argv[i++];
+
+      if (cert_path[0] == '\0' || key_path[0] == '\0') {
+        lf_print_error("--tls certificate_path and private_key_path must be non-empty.");
+        usage(argc, argv);
+        return 0;
+      }
+
+      lf_set_tls_configuration(cert_path, key_path);
+      lf_print("TLS cert path: %s", cert_path);
+      lf_print("TLS key path : %s", key_path);
+    }
 #endif
     else if (strcmp(arg, "--ros-args") == 0) {
       // FIXME: Ignore ROS arguments for now

logging/api/logging_macros.h

@@ -169,4 +169,4 @@ static const bool _lf_log_level_is_debug = LOG_LEVEL >= LOG_LEVEL_DEBUG;
     }                                                                                                                  \
   } while (0)
 
-#endif // LOGGING_MACROS_H
+#endif // LOGGING_MACROS_H

network/api/lf_sst_support.h

@@ -0,0 +1,25 @@
+#ifndef LF_SST_SUPPORT_H
+#define LF_SST_SUPPORT_H
+
+#include "socket_common.h"
+#include <sst-c-api/c_api.h>
+
+typedef struct sst_priv_t {
+  socket_priv_t* socket_priv;
+  SST_ctx_t* sst_ctx;
+  SST_session_ctx_t* session_ctx;
+  unsigned char buffer[MAX_SECURE_COMM_MSG_LENGTH];
+  size_t buf_filled;
+  size_t buf_off;
+} sst_priv_t;
+
+typedef struct sst_connection_params_t {
+  socket_connection_params_t socket_params;
+
+  // 0 for RTI, 1 for federates.
+  int target;
+} sst_connection_params_t;
+
+void lf_set_sst_config_path(const char* config_path);
+
+#endif /* LF_SST_SUPPORT_H */

network/api/lf_tls_support.h

@@ -0,0 +1,35 @@
+#ifndef LF_TLS_SUPPORT_H
+#define LF_TLS_SUPPORT_H
+
+#include "socket_common.h"
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+
+/**
+ * @brief Structure holding information about TLS-based network abstraction.
+ * @ingroup Network
+ */
+typedef struct tls_priv_t {
+  socket_priv_t* socket_priv;
+  SSL_CTX* ctx;
+  SSL* ssl;
+} tls_priv_t;
+
+/**
+ * @brief Structure for TLS connection parameters.
+ * @ingroup Network
+ */
+typedef struct tls_connection_params_t {
+  /** @brief Common socket parameters. */
+  socket_connection_params_t socket_params;
+} tls_connection_params_t;
+
+/**
+ * @brief Set the path to the certificate and private key for TLS configuration.
+ *
+ * @param cert_path Path to the certificate file.
+ * @param key_path Path to the private key file.
+ */
+void lf_set_tls_configuration(const char* cert_path, const char* key_path);
+
+#endif /* LF_TLS_SUPPORT_H */