Option of using OpenSSL for authentication between RTI and federates

[Jakio815]

NOTE: Please note that there's an issue with CI tests, mentioned at the bottom of this description.

Overview

This PR is the first step to add security to LF, by including OpenSSL in the C target.

This PR is related to the PR lf-lang/reactor-c#105 and resolves #1146. Both PRs should be merged to work.

The main idea is in #1146, and this PR is an implementation of

• auth: Hmac: This option uses the Key-hashed MAC (HMAC) using the shared secret = federation ID = hex string. Instead of sending this federation ID in plain text, we will use this for a challenge-response using randomly generated nonce for each federate. We may need a longer string, though, for example, 32 bytes for SHA 256.

Approach

target C {
   auth: true 
}

This option includes OpenSSL libraries, and use HMAC authentications between the RTI and the federates. It creates a random nonce and creates a HMAC tag, and they process a 3 way handshake starting from the RTI. The details of the 3-way handshake is in lf-lang/reactor-c#105. The option is currently implemented as a boolean option.

The main protocol is like the following.
1. RTI_HELLO (RTI -> Federate)
2. FED_RESPONSE (Federate -> RTI)
3. RTI_RESPONSE (RTI -> Federate)

For test, build the RTI.

// org.lflang\src\lib\c\reactor-c\core\federated\RTI\
mkdir build && cd build
cmake -DAUTH=ON ../
make
sudo make install

There is a simple test .lf file.

./gradlew runlfc --args test/C/src/federated/SimpleFederatedAuthenticated.lf
./test/C/bin/SimpleFederatedAuthenticated

RTI does not include OpenSSL libraries when -DAUTH=ON is not commanded. It is set OFF on default.
runlfc command also does not include OpenSSL libraries if target C { auth: true } is not coded.

For clarification between lf-lang/reactor-c#105 and this PR, this PR is about,

1. Including OpenSSL libraries optionally in CMake.
2. Code generation part of adding auth options.
3. Example code of a simple example of authentication in test/C/src/federated/SimpleFederatedAuth.lf

PR lf-lang/reactor-c#105 will be the details of the 3-way handshake.

CI Tests

cpp-ros2 tests and serialization tests are not passing. I sent an issue #1483.

[Jakio815]

.

[Jakio815]

Only adding export OPENSSL_ROOT_DIR="/usr/local/opt/openssl" does not work, because it seems that every run opens a new bash.

[Jakio815]

@lhstrh @edwardalee Would you please check out this PR when available? Thanks!

[lhstrh]

Thanks for the reminder, @Jakio815, will put in a review soon.

[edwardalee]

This looks good to me. To accompany this merge, let's update the documentation here:

https://www.lf-lang.org/docs/handbook/target-declaration

Perhaps a new page in the Reference section of the handbook would be a good idea, rather than putting everything in the above file? Then point to that page from the above?

The description in this PR would be an excellent starting point for that page.

[lhstrh]

This looks good to me!