7. Known Issues
Note
For an updated list of critical known issues, see the Critical Issues List on the RTI Customer Portal at https://support.rti.com.
7.1. No Support for ECDSA-ECDH with Static OpenSSL Libraries and Certicom Security Builder
If you are using the Certicom® Security Builder® engine, you cannot use the ecdsa-ecdh shared secret algorithm together with static OpenSSL libraries. If you want to use ecdsa-ecdh with Certicom Security Builder, you must use dynamic OpenSSL libraries. Attempting to use ecdsa-ecdh with static OpenSSL libraries and Certicom Security Builder will cause the following errors during participant discovery:
Authentication_compute_sharedsecret:failed to provide remote DP public key
Authentication_process_handshake:key generation fail
Authentication_get_shared_secret:empty secret
PRESParticipant_authorizeRemoteParticipant:!security function get_shared_secret
7.2. No Support for Writing >65kB Unfragmented Samples Using Metadata or RTPS Message Protection
The following use case is not supported:
metadata_protection_kind = SIGN or ENCRYPT or rtps_protection_kind = SIGN or ENCRYPT
message_size_max > 65536. This is possible when using the TCP transport.
The user is writing unfragmented samples of size greater than 65kB but less than message_size_max.
In order to write the large sample, you must set message_size_max to be smaller than the message size, so the sample can be put in fragments smaller than 65 kB.
[RTI Issue ID SEC-768]
7.3. subscription_data and publication_data in check_local_datawriter_match / check_local_datareader_match are not Populated
When calling check_local_datawriter_match / check_local_datareader_match, Connext does not set the subscription_data and publication_data parameters. While this issue has no impact on the DDS Security builtin plugins, it could affect a custom plugin relying on those parameters.
[RTI Issue ID SEC-758]
7.4. relay_only parameter in check_remote_datareader is not Populated
When calling check_remote_datareader, Connext does not set the relay_only parameter. While this issue has no impact on the DDS Security builtin plugins, it could affect a custom plugin relying on this parameter.
[RTI Issue ID SEC-852]
7.5. ‘Allow Rule’ Patterns Incorrectly do not Allow Subset Patterns in QoS
In the Permissions Document, an <allow_rule> that has a pattern partition other than * (e.g., P*) incorrectly does not allow creation of an entity whose PartitionQosPolicy contains a regular expression pattern that is a subset of that <allow_rule> (e.g., P1*). This problem only affects Security Plugins 6.1.0 and above.
The workaround is to change the <allow_rule>’s pattern partition to exactly match the pattern partition in the QoS (e.g., change P* to P1*).
[RTI Issue ID SEC-1242]
7.6. Source and destination overlap in memcpy (called from wc_AesGcmInit) when using the Security Plugins for wolfSSL
Valgrind 3.15.0 (and lower versions) may detect an overlap in the source
and destination memory when calling memcpy from wc_AesGcmInit.
This is an issue in wolfSSL 5.5.1, not in the Security Plugins. The
overlap happens if wolfSSL is compiled with --enable-aesgcm-stream.
For more information, read wolfSSL’s #6413
GitHub issue. This issue doesn’t affect the behavior of the Security
Plugins for wolfSSL.
[RTI Issue ID SEC-2087]