Wrong behavior with creating participant

Overview

My governance.xml file is like this:

<?xml version="1.0" encoding="utf-8"?>
<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="omg_shared_ca_domain_governance.xsd">
    <domain_access_rules>
        <domain_rule>
            <domains>
                <id_range>
                    <min>0</min>
                    <max>230</max>
                </id_range>
            </domains>
            <allow_unauthenticated_participants>FALSE</allow_unauthenticated_participants>
            <enable_join_access_control>TRUE</enable_join_access_control>
            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
            <rtps_protection_kind>ENCRYPT</rtps_protection_kind>
            <topic_access_rules>
                <topic_rule>
                    <topic_expression>Topic*</topic_expression>
                    <enable_discovery_protection>TRUE</enable_discovery_protection>
                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
                    <enable_read_access_control>TRUE</enable_read_access_control>
                    <enable_write_access_control>TRUE</enable_write_access_control>
                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
                    <data_protection_kind>ENCRYPT</data_protection_kind>
                </topic_rule>
            </topic_access_rules>
        </domain_rule>
    </domain_access_rules>
</dds>

In the ‘9.4.3 DDS:Access:Permissions plugin behavior’ section of the DDS security specification, there is description of check_create_participant function’s behavior.

They said, the check_create_participant returns TRUE if the Governance specifies enable_read_access_control set to FALSE or enable_writer_access_control set to FALSE, or if the Governance specifies enable_join_access_control set to FALSE.

So, if the Governance specifies enable_read_access_control set to TRUE and enable_writer_access_control set to TRUE and enable_join_access_control set to TRUE, then the check_create_participant return the FALSE.

Expected behavior.

So, based on the reasons described above, I expected that the participant would not be created properly.

Current behavior

However, when I run the code, there is no issue with creating the participant, and it even communicates well.

Environment:

• Eclipse DDS Version: master*
• Operating System: Ubuntu 22.04 amd64

Additional context

This is main.cpp that I executed.

#include "dds/dds.h"
#include "HelloWorldData.h"

#include <iostream>
#include <unistd.h>

void on_data_available(dds_entity_t reader, void* arg);

int main(){
    dds_return_t rc;

    dds_entity_t factory = dds_create_domain(0, NULL);

    dds_qos_t* dp_qos = dds_create_qos();

    dds_qset_prop(dp_qos, "dds.sec.auth.library.path", "dds_security_auth");
    dds_qset_prop(dp_qos, "dds.sec.auth.library.init", "init_authentication");
    dds_qset_prop(dp_qos, "dds.sec.auth.library.finalize", "finalize_authentication");

    dds_qset_prop(dp_qos, "dds.sec.auth.identity_ca", "file://Eclipse_certs/identity_ca_cert.pem");
    dds_qset_prop(dp_qos, "dds.sec.auth.private_key", "file://Eclipse_certs/participant_priv_key.pem");
    dds_qset_prop(dp_qos, "dds.sec.auth.identity_certificate", "file://Eclipse_certs/participant_cert.pem");

    dds_qset_prop(dp_qos, "dds.sec.crypto.library.path", "dds_security_crypto");
    dds_qset_prop(dp_qos, "dds.sec.crypto.library.init", "init_crypto");
    dds_qset_prop(dp_qos, "dds.sec.crypto.library.finalize", "finalize_crypto");

    dds_qset_prop(dp_qos, "dds.sec.access.library.path", "dds_security_ac");
    dds_qset_prop(dp_qos, "dds.sec.access.library.init", "init_access_control");
    dds_qset_prop(dp_qos, "dds.sec.access.library.finalize", "finalize_access_control");
    dds_qset_prop(dp_qos, "dds.sec.access.permissions_ca", "file://Eclipse_certs/permission_ca_cert.pem");
    dds_qset_prop(dp_qos, "dds.sec.access.governance", "file://Eclipse_certs/governance.p7s");
    dds_qset_prop(dp_qos, "dds.sec.access.permissions", "file://Eclipse_certs/permissions.p7s");
    
    dds_entity_t participant1 = dds_create_participant(DDS_DOMAIN_DEFAULT, dp_qos, NULL);
    if( participant1 < 0 ) std::cout << "ERROR: dds_create_participant failed \n";

    dds_entity_t topic = dds_create_topic(participant1, &HelloWorldData_Msg_desc, "Topic", NULL, NULL);
    if( topic < 0 ) std::cout << "ERROR: dds_create_topic failed \n";

    dds_entity_t writer = dds_create_writer(participant1, topic, NULL, NULL);
    if( writer < 0 ) std::cout << "ERROR: dds_create_writer writer failed \n";

    dds_listener_t* listener = dds_create_listener(NULL);
    dds_lset_data_available(listener, on_data_available);
    dds_entity_t reader = dds_create_reader(participant1, topic, NULL, listener);
    if( reader < 0 ) std::cout << "ERROR: dds_create_reader reader failed \n";
    
    sleep(1);

    if( writer ){
        HelloWorldData_Msg msg1;
        msg1.userID = 1;
        msg1.message = "Hello world!";

        rc = dds_write (writer, &msg1);
        if (rc != DDS_RETCODE_OK) std::cout << "ERROR: dds_write writer failed \n";
    }

    sleep(1);

    rc = dds_delete (participant1);
    if (rc != DDS_RETCODE_OK) std::cout << "ERROR: dds_delete failed \n";

    return 0;
}

void on_data_available(dds_entity_t reader, void* arg){
    void * samples[1];
    dds_sample_info_t infos[1];

    samples[0] = HelloWorldData_Msg__alloc ();

    int samples_received = dds_take(reader, samples, infos, 1, 1);
    if ((samples_received > 0) && (infos[0].valid_data)){
        HelloWorldData_Msg * msg = (HelloWorldData_Msg*) samples[0];
        std::cout << " < READER : on_data_available > reader get messeage: " << msg->message << std::endl;
    }

    HelloWorldData_Msg_free (samples[0], DDS_FREE_ALL);
}

Start with main.cpp and the supplied governance.xml, then read section 9.4.3 of the DDS security specification and trace the participant creation call. Reproduce the behavior on Ubuntu 22.04 with the stated Cyclone DDS security configuration; done means the implementation behavior is reconciled with the specification and the participant creation result is corrected or clearly explained.