Groot2Publisher: add a constructor that takes the bind address (#1251)

The publisher always bound its two ZeroMQ sockets to tcp://*, so they were
reachable from every network interface. The Groot2 protocol has no
authentication, and a client that can reach the port can not only read the
tree and its blackboards but also insert hooks that replace node results.

Add Groot2Publisher(tree, server_port, bind_address), e.g. "127.0.0.1" to
accept local connections only. The existing constructor delegates to it
with "*", so its behavior and exported symbol are unchanged. Document the
security implications in the class comment.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: facontidavide

include/behaviortree_cpp/loggers/groot2_publisher.h

@@ -15,15 +15,31 @@ namespace BT
  *
  * An inter-process communication mechanism allows the two processes
  * to communicate through a TCP port. The user should provide the
- * port to be used in the constructor.
+ * port to be used in the constructor. The publisher binds two ports:
+ * server_port and server_port + 1.
+ *
+ * SECURITY: the protocol has no authentication. Any client that can reach
+ * these ports can read the tree and its blackboards, and can insert hooks
+ * (breakpoints) that replace the result of a node, changing how the tree
+ * executes. Do not expose them to untrusted networks; use the bind_address
+ * argument to restrict the interface they listen on.
  */
 class Groot2Publisher : public StatusChangeLogger
 {
   using Position = Monitor::Hook::Position;
 
 public:
+  /// Listens on all network interfaces.
   Groot2Publisher(const BT::Tree& tree, unsigned server_port = 1667);
 
+  /**
+   * @param bind_address the interface to listen on, in ZeroMQ tcp syntax:
+   * an IPv4 address ("127.0.0.1" for local connections only), an
+   * interface name ("eth0"), or "*" for all interfaces.
+   */
+  Groot2Publisher(const BT::Tree& tree, unsigned server_port,
+                  const std::string& bind_address);
+
   ~Groot2Publisher() override;
 
   Groot2Publisher(const Groot2Publisher& other) = delete;

src/loggers/groot2_publisher.cpp

@@ -121,6 +121,11 @@ struct Groot2Publisher::PImpl
 };
 
 Groot2Publisher::Groot2Publisher(const BT::Tree& tree, unsigned server_port)
+  : Groot2Publisher(tree, server_port, "*")
+{}
+
+Groot2Publisher::Groot2Publisher(const BT::Tree& tree, unsigned server_port,
+                                 const std::string& bind_address)
   : StatusChangeLogger(), _p(std::make_unique<PImpl>())
 {
   _p->server_port = server_port;
@@ -154,8 +159,9 @@ Groot2Publisher::Groot2Publisher(const BT::Tree& tree, unsigned server_port)
     }
   }
   //-------------------------------
-  _p->server_address = StrCat("tcp://*:", std::to_string(server_port));
-  _p->publisher_address = StrCat("tcp://*:", std::to_string(server_port + 1));
+  _p->server_address = StrCat("tcp://", bind_address, ":", std::to_string(server_port));
+  _p->publisher_address =
+      StrCat("tcp://", bind_address, ":", std::to_string(server_port + 1));
 
   _p->server.bind(_p->server_address.c_str());
   _p->publisher.bind(_p->publisher_address.c_str());

tests/groot2_test_utils.hpp

@@ -20,7 +20,8 @@ struct PublisherAndPort
   unsigned port = 0;
 };
 
-inline PublisherAndPort makePublisher(const BT::Tree& tree)
+inline PublisherAndPort makePublisher(const BT::Tree& tree,
+                                      const std::string& bind_address = "*")
 {
   std::random_device random_device;
   std::uniform_int_distribution<unsigned> port_distribution(20000, 60000);
@@ -32,7 +33,7 @@ inline PublisherAndPort makePublisher(const BT::Tree& tree)
     const unsigned port = port_distribution(random_device) & ~1U;
     try
     {
-      return { std::make_unique<BT::Groot2Publisher>(tree, port), port };
+      return { std::make_unique<BT::Groot2Publisher>(tree, port, bind_address), port };
     }
     catch(const zmq::error_t& error)
     {

tests/gtest_groot2_publisher_integration.cpp

@@ -173,6 +173,37 @@ TEST(Groot2PublisherIntegration, IncompleteHookRequestDoesNotTerminateServer)
   EXPECT_EXIT(incompleteHookScenario(), ::testing::ExitedWithCode(EXIT_SUCCESS), ".*");
 }
 
+TEST(Groot2PublisherIntegration, BindToLoopbackAddress)
+{
+  BT::BehaviorTreeFactory factory;
+  auto tree = factory.createTreeFromText(R"(
+<root BTCPP_format="4">
+  <BehaviorTree ID="MainTree">
+    <AlwaysSuccess/>
+  </BehaviorTree>
+</root>
+)");
+  auto [publisher, port] = Groot2Test::makePublisher(tree, "127.0.0.1");
+  Groot2Test::Client client(port);
+
+  auto reply = client.request(BT::Monitor::RequestType::FULLTREE);
+  ASSERT_EQ(reply.size(), 2);
+  EXPECT_NE(reply[1].to_string().find("MainTree"), std::string::npos);
+}
+
+TEST(Groot2PublisherIntegration, InvalidBindAddressThrows)
+{
+  BT::BehaviorTreeFactory factory;
+  auto tree = factory.createTreeFromText(R"(
+<root BTCPP_format="4">
+  <BehaviorTree ID="MainTree">
+    <AlwaysSuccess/>
+  </BehaviorTree>
+</root>
+)");
+  EXPECT_THROW(BT::Groot2Publisher(tree, 1667, "not-an-interface"), zmq::error_t);
+}
+
 TEST(Groot2PublisherIntegration, BlackboardDump_NoRootWithoutExternalBlackboard)
 {
   BT::BehaviorTreeFactory factory;