zerodds_security_runtime/
lib.rs

1// SPDX-License-Identifier: Apache-2.0
2// Copyright 2026 ZeroDDS Contributors
3
4//! Crate `zerodds-security-runtime`. Safety classification: **SAFE** (pure adapter without its own crypto primitives — delegates to `security-crypto` + `security-rtps`).
5//!
6//! Security runtime: governance-driven plugin lifecycle, peer-capabilities cache,
7//! outbound/inbound verdict engine, built-in data tagging, anti-squatter,
8//! heterogeneous-mesh gateway bridge. Adapter layer between the governance-XML policy
9//! and the secure-submessage wrapper.
10//!
11//! ## Layer position
12//!
13//! Layer 4 — core services. Consumes `zerodds-security` (SPI) +
14//! `zerodds-security-crypto` + `-permissions` + `-pki` + `-rtps` +
15//! `zerodds-rtps` + `zerodds-qos`. Fed by the DCPS runtime via
16//! `Box<dyn ...>` plugins (feature `security`).
17//!
18//! ## Public API (as of 1.0.0-rc.1)
19//!
20//! - [`SecurityGate`] — high-level adapter between governance + crypto + RTPS wrap.
21//! - `engine::*` — `GovernancePolicyEngine` default impl + `PolicyEngine` trait.
22//! - `policy::*` — `PolicyDecision` with suite, receiver MACs, topic class.
23//! - `caps::*` — `PeerCapabilities` + `PeerCapabilitiesCache`.
24//! - `caps_wire::*` — SPDP mapping for peer capabilities (wire codec).
25//! - `peer_class::*` — `<peer_class>` match (CIDR, subject patterns).
26//! - `endpoint::*` — endpoint slot lookup.
27//! - `data_tagging::*` — built-in DataTaggingPlugin (spec §8.7).
28//! - `builtin_topics::*` — DCPSParticipantStatelessMessage + DCPSParticipantVolatileMessageSecure.
29//! - `anti_squatter::*` — spec §8.5.3 anti-squatter logic.
30//! - `gateway_bridge::*` — heterogeneous-mesh gateway bridge (edge ↔ backend).
31//! - `shared::*` — shared inbound/outbound verdict types.
32//!
33//! # Example
34//!
35//! ```no_run
36//! use zerodds_security_crypto::AesGcmCryptoPlugin;
37//! use zerodds_security_permissions::parse_governance_xml;
38//! use zerodds_security_runtime::SecurityGate;
39//!
40//! let governance = parse_governance_xml(GOVERNANCE_XML).unwrap();
41//! let mut crypto = AesGcmCryptoPlugin::new();
42//! let mut gate = SecurityGate::new(0, governance, &mut crypto);
43//!
44//! // Outbound:
45//! let wire = gate.encode_outbound("Chatter", b"hello").unwrap();
46//!
47//! // Inbound (at the peer):
48//! let plain = gate.decode_inbound("Chatter", &wire).unwrap();
49//! # const GOVERNANCE_XML: &str = "";
50//! ```
51
52#![cfg_attr(not(feature = "std"), no_std)]
53#![forbid(unsafe_code)]
54#![warn(missing_docs)]
55
56extern crate alloc;
57
58pub mod anti_squatter;
59pub mod builtin_topics;
60#[cfg(feature = "std")]
61pub mod bundle;
62pub mod caps;
63pub mod caps_wire;
64pub mod data_tagging;
65pub mod endpoint;
66mod engine;
67mod gate;
68pub mod gateway_bridge;
69pub mod peer_class;
70pub mod policy;
71#[cfg(feature = "std")]
72pub mod profile;
73mod shared;
74
75pub use anti_squatter::{BindingDecision, GuidPrefixBytes, IdentityBindingCache};
76#[cfg(feature = "std")]
77pub use bundle::{SecurityBundle, SecurityBundleBuilder};
78pub use caps::{PeerCache, PeerCapabilities, Validity};
79pub use caps_wire::{advertise_security_caps, parse_peer_caps};
80pub use data_tagging::{BuiltinDataTaggingPlugin, TAG_PROPERTY_PREFIX};
81pub use endpoint::{EndpointMatch, EndpointProtection, MatchRejectReason, match_endpoints};
82pub use engine::GovernancePolicyEngine;
83pub use gate::{SecurityGate, SecurityGateError};
84pub use gateway_bridge::{
85    GatewayBridge, GatewayBridgeConfig, GatewayBridgeError, GatewayBridgeResult,
86};
87pub use peer_class::{
88    interface_accepts_class, peer_matches_class, resolve_peer_class, resolve_protection,
89};
90pub use policy::{
91    InboundCtx, InterfaceConfig, IpRange, NetInterface, OutboundCtx, PolicyDecision, PolicyEngine,
92    ProtectionLevel, SuiteHint, classify_interface,
93};
94#[cfg(feature = "std")]
95pub use profile::{SecurityProfile, SecurityProfileConfig, SecurityProfileError, strip_file_url};
96pub use shared::{InboundVerdict, PeerKey, SharedSecurityGate};
97
98// Re-exports from zerodds-security for downstream crates that only
99// depend on `zerodds-security-runtime` (above all `dcps` for the security
100// logger integration).
101pub use zerodds_security::logging::{LogLevel, LoggingPlugin};
zerodds_security_runtime/lib.rs

zerodds_security_runtime/
lib.rs
