ros2 / ros2/rclcpp

Throwing exception while creating a service or a subscription on request can cause clients to wait forever

Open
#1,581 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

backlog
Dominant language
C++
Stars
805
Forks
564
Avg merge
1d 17h
Merged PRs (30d)
27

Description

Bug report

Required Info:

  • Operating System: Ubuntu 18.04.5
  • Installation type: From source
  • Version or commit hash: Dashing (e8cf066d)
  • DDS implementation: Fast-RTPS
  • Client library (if applicable): Both rclcpp and rclpy
Steps to reproduce issue
  1. Run turtlesim_node
$ ros2 run turtlesim turtlesim_node
  1. Send request to topic /spawn with any invalid name (e.g., 256 bytes of "A"s)
$ ros2 service call /spawn turtlesim/srv/Spawn "{x: 1.0, y: 1.0, theta: 0.0, name: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}"
  1. The requester (/_ros2cli_requester_turtlesim_Spawn in this case) waits forever as turtlesim_node is terminated throwing rclcpp::exceptions::InvalidTopicNameError.
Expected behavior

Rather than just terminating, Node::create_subscription() and Node::create_service() should handle such exception and return something (e.g., a NULL pointer) so that the caller can properly handle the error.

Actual behavior

In ros2/rclcpp/rclcpp/src/rclcpp/expand_topic_or_service_name.cpp, if the validation of the expanded service name fails, rclcpp::exceptions::InvalidServiceNameError is thrown, terminating the node that tried to create a service. As a result, the requester keeps waiting for the response to its spawn request.

Additional information

I've taken an example of turtlesim for its simplicity, and aware that turtlesim itself could try-catch an exception. However, I suggest rcl handles this issue as a middleware for the following reasons:
(1) as far as I know, this behavior is not documented anywhere,
(2) none of the code included in the ros2 repositories (https://raw.githubusercontent.com/ros2/ros2/dashing/ros2.repos) try-catch those exceptions when creating subscriptions or services,
(3) merely remapping any topic to an invalid name kills the node, leaving chances to be maliciously used by attackers, and
(4) there can be many other systems that are already being affected.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with rclcpp/src/rclcpp/expand_topic_or_service_name.cpp and the Node::create_subscription() and Node::create_service() entry points. Reproduce the invalid /spawn request against turtlesim, then trace how InvalidServiceNameError or InvalidTopicNameError propagates. Done means invalid service or subscription creation is handled without terminating the node or leaving the requester waiting forever.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
api, backend-api-design
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.