zerodds_bridge_security/
lib.rs

1// SPDX-License-Identifier: Apache-2.0
2// Copyright 2026 ZeroDDS Contributors
3
4//! Crate `zerodds-bridge-security`. Safety classification: **STANDARD**.
5//!
6//! Shared security layer for ZeroDDS bridge daemons (ws / mqtt / coap /
7//! amqp / grpc / corba).
8//!
9//! Spec: ZeroDDS Bridge Spec 1.0 §7.1 (TLS), §7.2 (auth modes), §7.3
10//! (topic ACL).
11//!
12//! ## Layer position
13//!
14//! Layer 5 (Bridges) — substrate crate for all six bridge daemons.
15//!
16//! ## Public API (as of 1.0.0-rc.1)
17//!
18//! - [`Acl`], [`AclEntry`], [`AclOp`] — topic ACL with wildcard and
19//!   group matching (§7.3).
20//! - [`AuthMode`], [`AuthSubject`], [`AuthError`] — auth modes
21//!   `none|bearer|jwt|mtls|sasl` (§7.2).
22//! - [`RotatingTlsConfig`], [`build_client_tls_connector`],
23//!   [`parse_server_name`], [`serve_tls_handshake`] — per-connection
24//!   TLS helpers (§7.1).
25//! - [`SecurityConfig`], [`SecurityCtx`], [`SecurityError`],
26//!   [`authenticate`], [`authorize`], [`build_ctx`],
27//!   [`extract_mtls_subject`] — aggregate ctx of auth + ACL + TLS.
28//! - [`TlsConfigError`], [`load_server_config`] — `rustls`
29//!   ServerConfig builder with PEM cert/key loader (§7.1).
30//!
31//! ## Example
32//!
33//! ```rust,no_run
34//! use zerodds_bridge_security::{Acl, AclOp, AuthSubject};
35//!
36//! let subj = AuthSubject::new("alice").with_group("publishers");
37//! let acl = Acl::allow_all();
38//! let _allowed = acl.check(&subj, AclOp::Write, "/topics/trade");
39//! ```
40
41#![forbid(unsafe_code)]
42#![warn(missing_docs)]
43
44// Crypto primitive backend: `ring` (default) or `aws-lc-rs` (FIPS, via `aws-lc`).
45// Swaps the JWT-RS256 verify primitives (`backend::`) and, in lockstep, the
46// rustls TLS provider (`rustls::crypto::ring` ↔ `rustls::crypto::aws_lc_rs`).
47#[cfg(feature = "aws-lc")]
48pub(crate) use aws_lc_rs as backend;
49#[cfg(all(feature = "ring-backend", not(feature = "aws-lc")))]
50pub(crate) use ring as backend;
51#[cfg(not(any(feature = "ring-backend", feature = "aws-lc")))]
52compile_error!("enable exactly one crypto backend: `ring-backend` (default) or `aws-lc`");
53
54/// The rustls [`CryptoProvider`](rustls::crypto::CryptoProvider) for the
55/// selected backend — `ring` by default, `aws_lc_rs` under the `aws-lc` (FIPS)
56/// feature. Pass it to `*_with_provider` builders; the implicit `builder()`
57/// path is ambiguous when both providers are linked.
58#[cfg(not(feature = "aws-lc"))]
59pub fn tls_provider() -> rustls::crypto::CryptoProvider {
60    rustls::crypto::ring::default_provider()
61}
62/// See [`tls_provider`] (ring variant).
63#[cfg(feature = "aws-lc")]
64pub fn tls_provider() -> rustls::crypto::CryptoProvider {
65    rustls::crypto::aws_lc_rs::default_provider()
66}
67
68pub mod acl;
69pub mod auth;
70pub mod connection;
71pub mod ctx;
72pub mod tls;
73
74pub use acl::{Acl, AclEntry, AclOp};
75pub use auth::{AuthError, AuthMode, AuthSubject};
76pub use connection::{
77    RotatingTlsConfig, build_client_tls_connector, parse_server_name, serve_tls_handshake,
78};
79pub use ctx::{
80    SecurityConfig, SecurityCtx, SecurityError, authenticate, authorize, build_ctx,
81    extract_mtls_subject,
82};
83pub use tls::{TlsConfigError, load_server_config};
84
85// Dep-2 (Spec `zerodds-zero-copy-1.0` §Dep-Audit): re-exports of the
86// canonical rustls types, so that bridge crates can switch their own
87// `use rustls::*` imports to `use zerodds_bridge_security::rustls::*`
88// and drop the direct `rustls` dep from their Cargo.toml. Prevents
89// version drift between rustls versions that individual bridges might
90// later upgrade manually.
91//
92// Bridges that only need ServerConfig/ClientConfig/cert/key wire types
93// can, instead of direct rustls deps:
94//
95// ```rust,ignore
96// use zerodds_bridge_security::{rustls, rustls_pki_types, rustls_pemfile};
97// let cfg: rustls::ServerConfig = ...;
98// ```
99//
100// Re-exports are considered stable API of the bridge-security crate;
101// they follow the same version pinning as rustls in
102// [`workspace.dependencies`].
103
104/// Re-export of the `rustls` crate for bridges.
105pub use rustls;
106/// Re-export of the `rustls_pemfile` crate for the PEM loader.
107pub use rustls_pemfile;
108/// Re-export of the `rustls_pki_types` crate for cert/key wire types.
109pub use rustls_pki_types;
zerodds_bridge_security/lib.rs

zerodds_bridge_security/
lib.rs
