fidl_fuchsia_security_keymint/
fidl_fuchsia_security_keymint.rs

1// WARNING: This file is machine generated by fidlgen.
2
3#![warn(clippy::all)]
4#![allow(unused_parens, unused_mut, unused_imports, nonstandard_style)]
5
6use bitflags::bitflags;
7use fidl::client::QueryResponseFut;
8use fidl::encoding::{MessageBufFor, ProxyChannelBox, ResourceDialect};
9use fidl::endpoints::{ControlHandle as _, Responder as _};
10pub use fidl_fuchsia_security_keymint__common::*;
11use futures::future::{self, MaybeDone, TryFutureExt};
12use zx_status;
13
14#[derive(Debug, Copy, Clone, Eq, PartialEq, Ord, PartialOrd, Hash)]
15pub struct SealingKeysMarker;
16
17impl fidl::endpoints::ProtocolMarker for SealingKeysMarker {
18    type Proxy = SealingKeysProxy;
19    type RequestStream = SealingKeysRequestStream;
20    #[cfg(target_os = "fuchsia")]
21    type SynchronousProxy = SealingKeysSynchronousProxy;
22
23    const DEBUG_NAME: &'static str = "fuchsia.security.keymint.SealingKeys";
24}
25impl fidl::endpoints::DiscoverableProtocolMarker for SealingKeysMarker {}
26pub type SealingKeysCreateSealingKeyResult = Result<Vec<u8>, CreateError>;
27pub type SealingKeysSealResult = Result<Vec<u8>, SealError>;
28pub type SealingKeysUnsealResult = Result<Vec<u8>, UnsealError>;
29
30pub trait SealingKeysProxyInterface: Send + Sync {
31    type CreateSealingKeyResponseFut: std::future::Future<Output = Result<SealingKeysCreateSealingKeyResult, fidl::Error>>
32        + Send;
33    fn r#create_sealing_key(&self, key_info: &[u8]) -> Self::CreateSealingKeyResponseFut;
34    type SealResponseFut: std::future::Future<Output = Result<SealingKeysSealResult, fidl::Error>>
35        + Send;
36    fn r#seal(&self, key_info: &[u8], key_blob: &[u8], secret: &[u8]) -> Self::SealResponseFut;
37    type UnsealResponseFut: std::future::Future<Output = Result<SealingKeysUnsealResult, fidl::Error>>
38        + Send;
39    fn r#unseal(
40        &self,
41        key_info: &[u8],
42        key_blob: &[u8],
43        sealed_secret: &[u8],
44    ) -> Self::UnsealResponseFut;
45}
46#[derive(Debug)]
47#[cfg(target_os = "fuchsia")]
48pub struct SealingKeysSynchronousProxy {
49    client: fidl::client::sync::Client,
50}
51
52#[cfg(target_os = "fuchsia")]
53impl fidl::endpoints::SynchronousProxy for SealingKeysSynchronousProxy {
54    type Proxy = SealingKeysProxy;
55    type Protocol = SealingKeysMarker;
56
57    fn from_channel(inner: fidl::Channel) -> Self {
58        Self::new(inner)
59    }
60
61    fn into_channel(self) -> fidl::Channel {
62        self.client.into_channel()
63    }
64
65    fn as_channel(&self) -> &fidl::Channel {
66        self.client.as_channel()
67    }
68}
69
70#[cfg(target_os = "fuchsia")]
71impl SealingKeysSynchronousProxy {
72    pub fn new(channel: fidl::Channel) -> Self {
73        let protocol_name = <SealingKeysMarker as fidl::endpoints::ProtocolMarker>::DEBUG_NAME;
74        Self { client: fidl::client::sync::Client::new(channel, protocol_name) }
75    }
76
77    pub fn into_channel(self) -> fidl::Channel {
78        self.client.into_channel()
79    }
80
81    /// Waits until an event arrives and returns it. It is safe for other
82    /// threads to make concurrent requests while waiting for an event.
83    pub fn wait_for_event(
84        &self,
85        deadline: zx::MonotonicInstant,
86    ) -> Result<SealingKeysEvent, fidl::Error> {
87        SealingKeysEvent::decode(self.client.wait_for_event(deadline)?)
88    }
89
90    /// Generates a new sealing key to seal and unseal secrets.
91    ///
92    /// |key_info| is information to be cryptographically bound to the returned key.
93    ///   * The client will have to supply it in all uses (other than key deletion) of the returned
94    ///     key.
95    ///   * It serves two purposes: (1) internally by the key manager to identify the key owner and
96    ///     (2) as a password to mitigate potential attacks from the key manager and as well as
97    ///     other clients.
98    ///   * It is recommended to include sufficient entropy in it (using it as a password) to
99    ///     mitigage potential attacks from the secure world (the key manager's execution
100    ///     environment) or from other clients.
101    ///   * It is acceptible to pass a constant if deriving and persisting a password is too
102    ///     cumbersome and the client fully trust the secure world and there are not many other
103    ///     clients.
104    ///
105    /// The client is responsible for persisting both |key_info| and the returned |key_blob|.
106    /// The key blob is encrypted with a TEE-private key. It is guaranteed to be unique for each
107    /// call (even with the same key info). It can be stored in unsecure storage.
108    ///
109    /// Returns:
110    ///   * The sealing key if everything worked.
111    ///   * FAILED_CREATE if the key creation failed, e.g., the |key_info| was empty.
112    pub fn r#create_sealing_key(
113        &self,
114        mut key_info: &[u8],
115        ___deadline: zx::MonotonicInstant,
116    ) -> Result<SealingKeysCreateSealingKeyResult, fidl::Error> {
117        let _response = self.client.send_query::<
118            SealingKeysCreateSealingKeyRequest,
119            fidl::encoding::ResultType<SealingKeysCreateSealingKeyResponse, CreateError>,
120        >(
121            (key_info,),
122            0x5a191cbb6a8081bc,
123            fidl::encoding::DynamicFlags::empty(),
124            ___deadline,
125        )?;
126        Ok(_response.map(|x| x.key_blob))
127    }
128
129    /// Seals a secret using a sealing key identified by its info and blob:
130    ///   * The key info has to match the one supplied when generating the sealing key.
131    ///
132    /// Note that the secret may be a key itself. It has no bearing on the seal operation.
133    ///
134    /// Returns:
135    ///   * The sealed secret if everything worked.
136    ///   * FAILED_SEAL if the sealing failed, e.g., sealing key info or blob mismatch.
137    pub fn r#seal(
138        &self,
139        mut key_info: &[u8],
140        mut key_blob: &[u8],
141        mut secret: &[u8],
142        ___deadline: zx::MonotonicInstant,
143    ) -> Result<SealingKeysSealResult, fidl::Error> {
144        let _response = self.client.send_query::<
145            SealingKeysSealRequest,
146            fidl::encoding::ResultType<SealingKeysSealResponse, SealError>,
147        >(
148            (key_info, key_blob, secret,),
149            0x10d41255013918d1,
150            fidl::encoding::DynamicFlags::empty(),
151            ___deadline,
152        )?;
153        Ok(_response.map(|x| x.sealed_secret))
154    }
155
156    /// Unseals a sealed secret using a sealing key identified by its info and blob:
157    ///   * The key info has to match the one supplied when generating the sealing key.
158    ///   * The key blob has to match the one used to seal the secret.
159    ///
160    /// Note that the secret may be a key itself. It has no bearing on the unseal operation.
161    ///
162    /// Returns:
163    ///   * The unsealed secret if everything worked.
164    ///   * FAILED_UNSEAL if the unsealing failed, e.g., sealing key info or blob mismatch.
165    pub fn r#unseal(
166        &self,
167        mut key_info: &[u8],
168        mut key_blob: &[u8],
169        mut sealed_secret: &[u8],
170        ___deadline: zx::MonotonicInstant,
171    ) -> Result<SealingKeysUnsealResult, fidl::Error> {
172        let _response = self.client.send_query::<
173            SealingKeysUnsealRequest,
174            fidl::encoding::ResultType<SealingKeysUnsealResponse, UnsealError>,
175        >(
176            (key_info, key_blob, sealed_secret,),
177            0x7037d75ecb579c83,
178            fidl::encoding::DynamicFlags::empty(),
179            ___deadline,
180        )?;
181        Ok(_response.map(|x| x.unsealed_secret))
182    }
183}
184
185#[cfg(target_os = "fuchsia")]
186impl From<SealingKeysSynchronousProxy> for zx::Handle {
187    fn from(value: SealingKeysSynchronousProxy) -> Self {
188        value.into_channel().into()
189    }
190}
191
192#[cfg(target_os = "fuchsia")]
193impl From<fidl::Channel> for SealingKeysSynchronousProxy {
194    fn from(value: fidl::Channel) -> Self {
195        Self::new(value)
196    }
197}
198
199#[cfg(target_os = "fuchsia")]
200impl fidl::endpoints::FromClient for SealingKeysSynchronousProxy {
201    type Protocol = SealingKeysMarker;
202
203    fn from_client(value: fidl::endpoints::ClientEnd<SealingKeysMarker>) -> Self {
204        Self::new(value.into_channel())
205    }
206}
207
208#[derive(Debug, Clone)]
209pub struct SealingKeysProxy {
210    client: fidl::client::Client<fidl::encoding::DefaultFuchsiaResourceDialect>,
211}
212
213impl fidl::endpoints::Proxy for SealingKeysProxy {
214    type Protocol = SealingKeysMarker;
215
216    fn from_channel(inner: ::fidl::AsyncChannel) -> Self {
217        Self::new(inner)
218    }
219
220    fn into_channel(self) -> Result<::fidl::AsyncChannel, Self> {
221        self.client.into_channel().map_err(|client| Self { client })
222    }
223
224    fn as_channel(&self) -> &::fidl::AsyncChannel {
225        self.client.as_channel()
226    }
227}
228
229impl SealingKeysProxy {
230    /// Create a new Proxy for fuchsia.security.keymint/SealingKeys.
231    pub fn new(channel: ::fidl::AsyncChannel) -> Self {
232        let protocol_name = <SealingKeysMarker as fidl::endpoints::ProtocolMarker>::DEBUG_NAME;
233        Self { client: fidl::client::Client::new(channel, protocol_name) }
234    }
235
236    /// Get a Stream of events from the remote end of the protocol.
237    ///
238    /// # Panics
239    ///
240    /// Panics if the event stream was already taken.
241    pub fn take_event_stream(&self) -> SealingKeysEventStream {
242        SealingKeysEventStream { event_receiver: self.client.take_event_receiver() }
243    }
244
245    /// Generates a new sealing key to seal and unseal secrets.
246    ///
247    /// |key_info| is information to be cryptographically bound to the returned key.
248    ///   * The client will have to supply it in all uses (other than key deletion) of the returned
249    ///     key.
250    ///   * It serves two purposes: (1) internally by the key manager to identify the key owner and
251    ///     (2) as a password to mitigate potential attacks from the key manager and as well as
252    ///     other clients.
253    ///   * It is recommended to include sufficient entropy in it (using it as a password) to
254    ///     mitigage potential attacks from the secure world (the key manager's execution
255    ///     environment) or from other clients.
256    ///   * It is acceptible to pass a constant if deriving and persisting a password is too
257    ///     cumbersome and the client fully trust the secure world and there are not many other
258    ///     clients.
259    ///
260    /// The client is responsible for persisting both |key_info| and the returned |key_blob|.
261    /// The key blob is encrypted with a TEE-private key. It is guaranteed to be unique for each
262    /// call (even with the same key info). It can be stored in unsecure storage.
263    ///
264    /// Returns:
265    ///   * The sealing key if everything worked.
266    ///   * FAILED_CREATE if the key creation failed, e.g., the |key_info| was empty.
267    pub fn r#create_sealing_key(
268        &self,
269        mut key_info: &[u8],
270    ) -> fidl::client::QueryResponseFut<
271        SealingKeysCreateSealingKeyResult,
272        fidl::encoding::DefaultFuchsiaResourceDialect,
273    > {
274        SealingKeysProxyInterface::r#create_sealing_key(self, key_info)
275    }
276
277    /// Seals a secret using a sealing key identified by its info and blob:
278    ///   * The key info has to match the one supplied when generating the sealing key.
279    ///
280    /// Note that the secret may be a key itself. It has no bearing on the seal operation.
281    ///
282    /// Returns:
283    ///   * The sealed secret if everything worked.
284    ///   * FAILED_SEAL if the sealing failed, e.g., sealing key info or blob mismatch.
285    pub fn r#seal(
286        &self,
287        mut key_info: &[u8],
288        mut key_blob: &[u8],
289        mut secret: &[u8],
290    ) -> fidl::client::QueryResponseFut<
291        SealingKeysSealResult,
292        fidl::encoding::DefaultFuchsiaResourceDialect,
293    > {
294        SealingKeysProxyInterface::r#seal(self, key_info, key_blob, secret)
295    }
296
297    /// Unseals a sealed secret using a sealing key identified by its info and blob:
298    ///   * The key info has to match the one supplied when generating the sealing key.
299    ///   * The key blob has to match the one used to seal the secret.
300    ///
301    /// Note that the secret may be a key itself. It has no bearing on the unseal operation.
302    ///
303    /// Returns:
304    ///   * The unsealed secret if everything worked.
305    ///   * FAILED_UNSEAL if the unsealing failed, e.g., sealing key info or blob mismatch.
306    pub fn r#unseal(
307        &self,
308        mut key_info: &[u8],
309        mut key_blob: &[u8],
310        mut sealed_secret: &[u8],
311    ) -> fidl::client::QueryResponseFut<
312        SealingKeysUnsealResult,
313        fidl::encoding::DefaultFuchsiaResourceDialect,
314    > {
315        SealingKeysProxyInterface::r#unseal(self, key_info, key_blob, sealed_secret)
316    }
317}
318
319impl SealingKeysProxyInterface for SealingKeysProxy {
320    type CreateSealingKeyResponseFut = fidl::client::QueryResponseFut<
321        SealingKeysCreateSealingKeyResult,
322        fidl::encoding::DefaultFuchsiaResourceDialect,
323    >;
324    fn r#create_sealing_key(&self, mut key_info: &[u8]) -> Self::CreateSealingKeyResponseFut {
325        fn _decode(
326            mut _buf: Result<<fidl::encoding::DefaultFuchsiaResourceDialect as fidl::encoding::ResourceDialect>::MessageBufEtc, fidl::Error>,
327        ) -> Result<SealingKeysCreateSealingKeyResult, fidl::Error> {
328            let _response = fidl::client::decode_transaction_body::<
329                fidl::encoding::ResultType<SealingKeysCreateSealingKeyResponse, CreateError>,
330                fidl::encoding::DefaultFuchsiaResourceDialect,
331                0x5a191cbb6a8081bc,
332            >(_buf?)?;
333            Ok(_response.map(|x| x.key_blob))
334        }
335        self.client.send_query_and_decode::<
336            SealingKeysCreateSealingKeyRequest,
337            SealingKeysCreateSealingKeyResult,
338        >(
339            (key_info,),
340            0x5a191cbb6a8081bc,
341            fidl::encoding::DynamicFlags::empty(),
342            _decode,
343        )
344    }
345
346    type SealResponseFut = fidl::client::QueryResponseFut<
347        SealingKeysSealResult,
348        fidl::encoding::DefaultFuchsiaResourceDialect,
349    >;
350    fn r#seal(
351        &self,
352        mut key_info: &[u8],
353        mut key_blob: &[u8],
354        mut secret: &[u8],
355    ) -> Self::SealResponseFut {
356        fn _decode(
357            mut _buf: Result<<fidl::encoding::DefaultFuchsiaResourceDialect as fidl::encoding::ResourceDialect>::MessageBufEtc, fidl::Error>,
358        ) -> Result<SealingKeysSealResult, fidl::Error> {
359            let _response = fidl::client::decode_transaction_body::<
360                fidl::encoding::ResultType<SealingKeysSealResponse, SealError>,
361                fidl::encoding::DefaultFuchsiaResourceDialect,
362                0x10d41255013918d1,
363            >(_buf?)?;
364            Ok(_response.map(|x| x.sealed_secret))
365        }
366        self.client.send_query_and_decode::<SealingKeysSealRequest, SealingKeysSealResult>(
367            (key_info, key_blob, secret),
368            0x10d41255013918d1,
369            fidl::encoding::DynamicFlags::empty(),
370            _decode,
371        )
372    }
373
374    type UnsealResponseFut = fidl::client::QueryResponseFut<
375        SealingKeysUnsealResult,
376        fidl::encoding::DefaultFuchsiaResourceDialect,
377    >;
378    fn r#unseal(
379        &self,
380        mut key_info: &[u8],
381        mut key_blob: &[u8],
382        mut sealed_secret: &[u8],
383    ) -> Self::UnsealResponseFut {
384        fn _decode(
385            mut _buf: Result<<fidl::encoding::DefaultFuchsiaResourceDialect as fidl::encoding::ResourceDialect>::MessageBufEtc, fidl::Error>,
386        ) -> Result<SealingKeysUnsealResult, fidl::Error> {
387            let _response = fidl::client::decode_transaction_body::<
388                fidl::encoding::ResultType<SealingKeysUnsealResponse, UnsealError>,
389                fidl::encoding::DefaultFuchsiaResourceDialect,
390                0x7037d75ecb579c83,
391            >(_buf?)?;
392            Ok(_response.map(|x| x.unsealed_secret))
393        }
394        self.client.send_query_and_decode::<SealingKeysUnsealRequest, SealingKeysUnsealResult>(
395            (key_info, key_blob, sealed_secret),
396            0x7037d75ecb579c83,
397            fidl::encoding::DynamicFlags::empty(),
398            _decode,
399        )
400    }
401}
402
403pub struct SealingKeysEventStream {
404    event_receiver: fidl::client::EventReceiver<fidl::encoding::DefaultFuchsiaResourceDialect>,
405}
406
407impl std::marker::Unpin for SealingKeysEventStream {}
408
409impl futures::stream::FusedStream for SealingKeysEventStream {
410    fn is_terminated(&self) -> bool {
411        self.event_receiver.is_terminated()
412    }
413}
414
415impl futures::Stream for SealingKeysEventStream {
416    type Item = Result<SealingKeysEvent, fidl::Error>;
417
418    fn poll_next(
419        mut self: std::pin::Pin<&mut Self>,
420        cx: &mut std::task::Context<'_>,
421    ) -> std::task::Poll<Option<Self::Item>> {
422        match futures::ready!(futures::stream::StreamExt::poll_next_unpin(
423            &mut self.event_receiver,
424            cx
425        )?) {
426            Some(buf) => std::task::Poll::Ready(Some(SealingKeysEvent::decode(buf))),
427            None => std::task::Poll::Ready(None),
428        }
429    }
430}
431
432#[derive(Debug)]
433pub enum SealingKeysEvent {}
434
435impl SealingKeysEvent {
436    /// Decodes a message buffer as a [`SealingKeysEvent`].
437    fn decode(
438        mut buf: <fidl::encoding::DefaultFuchsiaResourceDialect as fidl::encoding::ResourceDialect>::MessageBufEtc,
439    ) -> Result<SealingKeysEvent, fidl::Error> {
440        let (bytes, _handles) = buf.split_mut();
441        let (tx_header, _body_bytes) = fidl::encoding::decode_transaction_header(bytes)?;
442        debug_assert_eq!(tx_header.tx_id, 0);
443        match tx_header.ordinal {
444            _ => Err(fidl::Error::UnknownOrdinal {
445                ordinal: tx_header.ordinal,
446                protocol_name: <SealingKeysMarker as fidl::endpoints::ProtocolMarker>::DEBUG_NAME,
447            }),
448        }
449    }
450}
451
452/// A Stream of incoming requests for fuchsia.security.keymint/SealingKeys.
453pub struct SealingKeysRequestStream {
454    inner: std::sync::Arc<fidl::ServeInner<fidl::encoding::DefaultFuchsiaResourceDialect>>,
455    is_terminated: bool,
456}
457
458impl std::marker::Unpin for SealingKeysRequestStream {}
459
460impl futures::stream::FusedStream for SealingKeysRequestStream {
461    fn is_terminated(&self) -> bool {
462        self.is_terminated
463    }
464}
465
466impl fidl::endpoints::RequestStream for SealingKeysRequestStream {
467    type Protocol = SealingKeysMarker;
468    type ControlHandle = SealingKeysControlHandle;
469
470    fn from_channel(channel: ::fidl::AsyncChannel) -> Self {
471        Self { inner: std::sync::Arc::new(fidl::ServeInner::new(channel)), is_terminated: false }
472    }
473
474    fn control_handle(&self) -> Self::ControlHandle {
475        SealingKeysControlHandle { inner: self.inner.clone() }
476    }
477
478    fn into_inner(
479        self,
480    ) -> (::std::sync::Arc<fidl::ServeInner<fidl::encoding::DefaultFuchsiaResourceDialect>>, bool)
481    {
482        (self.inner, self.is_terminated)
483    }
484
485    fn from_inner(
486        inner: std::sync::Arc<fidl::ServeInner<fidl::encoding::DefaultFuchsiaResourceDialect>>,
487        is_terminated: bool,
488    ) -> Self {
489        Self { inner, is_terminated }
490    }
491}
492
493impl futures::Stream for SealingKeysRequestStream {
494    type Item = Result<SealingKeysRequest, fidl::Error>;
495
496    fn poll_next(
497        mut self: std::pin::Pin<&mut Self>,
498        cx: &mut std::task::Context<'_>,
499    ) -> std::task::Poll<Option<Self::Item>> {
500        let this = &mut *self;
501        if this.inner.check_shutdown(cx) {
502            this.is_terminated = true;
503            return std::task::Poll::Ready(None);
504        }
505        if this.is_terminated {
506            panic!("polled SealingKeysRequestStream after completion");
507        }
508        fidl::encoding::with_tls_decode_buf::<_, fidl::encoding::DefaultFuchsiaResourceDialect>(
509            |bytes, handles| {
510                match this.inner.channel().read_etc(cx, bytes, handles) {
511                    std::task::Poll::Ready(Ok(())) => {}
512                    std::task::Poll::Pending => return std::task::Poll::Pending,
513                    std::task::Poll::Ready(Err(zx_status::Status::PEER_CLOSED)) => {
514                        this.is_terminated = true;
515                        return std::task::Poll::Ready(None);
516                    }
517                    std::task::Poll::Ready(Err(e)) => {
518                        return std::task::Poll::Ready(Some(Err(fidl::Error::ServerRequestRead(
519                            e.into(),
520                        ))))
521                    }
522                }
523
524                // A message has been received from the channel
525                let (header, _body_bytes) = fidl::encoding::decode_transaction_header(bytes)?;
526
527                std::task::Poll::Ready(Some(match header.ordinal {
528                    0x5a191cbb6a8081bc => {
529                        header.validate_request_tx_id(fidl::MethodType::TwoWay)?;
530                        let mut req = fidl::new_empty!(
531                            SealingKeysCreateSealingKeyRequest,
532                            fidl::encoding::DefaultFuchsiaResourceDialect
533                        );
534                        fidl::encoding::Decoder::<fidl::encoding::DefaultFuchsiaResourceDialect>::decode_into::<SealingKeysCreateSealingKeyRequest>(&header, _body_bytes, handles, &mut req)?;
535                        let control_handle = SealingKeysControlHandle { inner: this.inner.clone() };
536                        Ok(SealingKeysRequest::CreateSealingKey {
537                            key_info: req.key_info,
538
539                            responder: SealingKeysCreateSealingKeyResponder {
540                                control_handle: std::mem::ManuallyDrop::new(control_handle),
541                                tx_id: header.tx_id,
542                            },
543                        })
544                    }
545                    0x10d41255013918d1 => {
546                        header.validate_request_tx_id(fidl::MethodType::TwoWay)?;
547                        let mut req = fidl::new_empty!(
548                            SealingKeysSealRequest,
549                            fidl::encoding::DefaultFuchsiaResourceDialect
550                        );
551                        fidl::encoding::Decoder::<fidl::encoding::DefaultFuchsiaResourceDialect>::decode_into::<SealingKeysSealRequest>(&header, _body_bytes, handles, &mut req)?;
552                        let control_handle = SealingKeysControlHandle { inner: this.inner.clone() };
553                        Ok(SealingKeysRequest::Seal {
554                            key_info: req.key_info,
555                            key_blob: req.key_blob,
556                            secret: req.secret,
557
558                            responder: SealingKeysSealResponder {
559                                control_handle: std::mem::ManuallyDrop::new(control_handle),
560                                tx_id: header.tx_id,
561                            },
562                        })
563                    }
564                    0x7037d75ecb579c83 => {
565                        header.validate_request_tx_id(fidl::MethodType::TwoWay)?;
566                        let mut req = fidl::new_empty!(
567                            SealingKeysUnsealRequest,
568                            fidl::encoding::DefaultFuchsiaResourceDialect
569                        );
570                        fidl::encoding::Decoder::<fidl::encoding::DefaultFuchsiaResourceDialect>::decode_into::<SealingKeysUnsealRequest>(&header, _body_bytes, handles, &mut req)?;
571                        let control_handle = SealingKeysControlHandle { inner: this.inner.clone() };
572                        Ok(SealingKeysRequest::Unseal {
573                            key_info: req.key_info,
574                            key_blob: req.key_blob,
575                            sealed_secret: req.sealed_secret,
576
577                            responder: SealingKeysUnsealResponder {
578                                control_handle: std::mem::ManuallyDrop::new(control_handle),
579                                tx_id: header.tx_id,
580                            },
581                        })
582                    }
583                    _ => Err(fidl::Error::UnknownOrdinal {
584                        ordinal: header.ordinal,
585                        protocol_name:
586                            <SealingKeysMarker as fidl::endpoints::ProtocolMarker>::DEBUG_NAME,
587                    }),
588                }))
589            },
590        )
591    }
592}
593
594/// Allows a client to generate sealing keys and then use these keys to seal and unseal secrets.
595/// Sealed secrets are safe for offline storage.
596///
597/// Note that (un)seal is synonymous with (un)wrap, e.g., wrapping an encryption key is the same
598/// as sealing an encryption key.
599#[derive(Debug)]
600pub enum SealingKeysRequest {
601    /// Generates a new sealing key to seal and unseal secrets.
602    ///
603    /// |key_info| is information to be cryptographically bound to the returned key.
604    ///   * The client will have to supply it in all uses (other than key deletion) of the returned
605    ///     key.
606    ///   * It serves two purposes: (1) internally by the key manager to identify the key owner and
607    ///     (2) as a password to mitigate potential attacks from the key manager and as well as
608    ///     other clients.
609    ///   * It is recommended to include sufficient entropy in it (using it as a password) to
610    ///     mitigage potential attacks from the secure world (the key manager's execution
611    ///     environment) or from other clients.
612    ///   * It is acceptible to pass a constant if deriving and persisting a password is too
613    ///     cumbersome and the client fully trust the secure world and there are not many other
614    ///     clients.
615    ///
616    /// The client is responsible for persisting both |key_info| and the returned |key_blob|.
617    /// The key blob is encrypted with a TEE-private key. It is guaranteed to be unique for each
618    /// call (even with the same key info). It can be stored in unsecure storage.
619    ///
620    /// Returns:
621    ///   * The sealing key if everything worked.
622    ///   * FAILED_CREATE if the key creation failed, e.g., the |key_info| was empty.
623    CreateSealingKey { key_info: Vec<u8>, responder: SealingKeysCreateSealingKeyResponder },
624    /// Seals a secret using a sealing key identified by its info and blob:
625    ///   * The key info has to match the one supplied when generating the sealing key.
626    ///
627    /// Note that the secret may be a key itself. It has no bearing on the seal operation.
628    ///
629    /// Returns:
630    ///   * The sealed secret if everything worked.
631    ///   * FAILED_SEAL if the sealing failed, e.g., sealing key info or blob mismatch.
632    Seal {
633        key_info: Vec<u8>,
634        key_blob: Vec<u8>,
635        secret: Vec<u8>,
636        responder: SealingKeysSealResponder,
637    },
638    /// Unseals a sealed secret using a sealing key identified by its info and blob:
639    ///   * The key info has to match the one supplied when generating the sealing key.
640    ///   * The key blob has to match the one used to seal the secret.
641    ///
642    /// Note that the secret may be a key itself. It has no bearing on the unseal operation.
643    ///
644    /// Returns:
645    ///   * The unsealed secret if everything worked.
646    ///   * FAILED_UNSEAL if the unsealing failed, e.g., sealing key info or blob mismatch.
647    Unseal {
648        key_info: Vec<u8>,
649        key_blob: Vec<u8>,
650        sealed_secret: Vec<u8>,
651        responder: SealingKeysUnsealResponder,
652    },
653}
654
655impl SealingKeysRequest {
656    #[allow(irrefutable_let_patterns)]
657    pub fn into_create_sealing_key(
658        self,
659    ) -> Option<(Vec<u8>, SealingKeysCreateSealingKeyResponder)> {
660        if let SealingKeysRequest::CreateSealingKey { key_info, responder } = self {
661            Some((key_info, responder))
662        } else {
663            None
664        }
665    }
666
667    #[allow(irrefutable_let_patterns)]
668    pub fn into_seal(self) -> Option<(Vec<u8>, Vec<u8>, Vec<u8>, SealingKeysSealResponder)> {
669        if let SealingKeysRequest::Seal { key_info, key_blob, secret, responder } = self {
670            Some((key_info, key_blob, secret, responder))
671        } else {
672            None
673        }
674    }
675
676    #[allow(irrefutable_let_patterns)]
677    pub fn into_unseal(self) -> Option<(Vec<u8>, Vec<u8>, Vec<u8>, SealingKeysUnsealResponder)> {
678        if let SealingKeysRequest::Unseal { key_info, key_blob, sealed_secret, responder } = self {
679            Some((key_info, key_blob, sealed_secret, responder))
680        } else {
681            None
682        }
683    }
684
685    /// Name of the method defined in FIDL
686    pub fn method_name(&self) -> &'static str {
687        match *self {
688            SealingKeysRequest::CreateSealingKey { .. } => "create_sealing_key",
689            SealingKeysRequest::Seal { .. } => "seal",
690            SealingKeysRequest::Unseal { .. } => "unseal",
691        }
692    }
693}
694
695#[derive(Debug, Clone)]
696pub struct SealingKeysControlHandle {
697    inner: std::sync::Arc<fidl::ServeInner<fidl::encoding::DefaultFuchsiaResourceDialect>>,
698}
699
700impl fidl::endpoints::ControlHandle for SealingKeysControlHandle {
701    fn shutdown(&self) {
702        self.inner.shutdown()
703    }
704    fn shutdown_with_epitaph(&self, status: zx_status::Status) {
705        self.inner.shutdown_with_epitaph(status)
706    }
707
708    fn is_closed(&self) -> bool {
709        self.inner.channel().is_closed()
710    }
711    fn on_closed(&self) -> fidl::OnSignalsRef<'_> {
712        self.inner.channel().on_closed()
713    }
714
715    #[cfg(target_os = "fuchsia")]
716    fn signal_peer(
717        &self,
718        clear_mask: zx::Signals,
719        set_mask: zx::Signals,
720    ) -> Result<(), zx_status::Status> {
721        use fidl::Peered;
722        self.inner.channel().signal_peer(clear_mask, set_mask)
723    }
724}
725
726impl SealingKeysControlHandle {}
727
728#[must_use = "FIDL methods require a response to be sent"]
729#[derive(Debug)]
730pub struct SealingKeysCreateSealingKeyResponder {
731    control_handle: std::mem::ManuallyDrop<SealingKeysControlHandle>,
732    tx_id: u32,
733}
734
735/// Set the the channel to be shutdown (see [`SealingKeysControlHandle::shutdown`])
736/// if the responder is dropped without sending a response, so that the client
737/// doesn't hang. To prevent this behavior, call `drop_without_shutdown`.
738impl std::ops::Drop for SealingKeysCreateSealingKeyResponder {
739    fn drop(&mut self) {
740        self.control_handle.shutdown();
741        // Safety: drops once, never accessed again
742        unsafe { std::mem::ManuallyDrop::drop(&mut self.control_handle) };
743    }
744}
745
746impl fidl::endpoints::Responder for SealingKeysCreateSealingKeyResponder {
747    type ControlHandle = SealingKeysControlHandle;
748
749    fn control_handle(&self) -> &SealingKeysControlHandle {
750        &self.control_handle
751    }
752
753    fn drop_without_shutdown(mut self) {
754        // Safety: drops once, never accessed again due to mem::forget
755        unsafe { std::mem::ManuallyDrop::drop(&mut self.control_handle) };
756        // Prevent Drop from running (which would shut down the channel)
757        std::mem::forget(self);
758    }
759}
760
761impl SealingKeysCreateSealingKeyResponder {
762    /// Sends a response to the FIDL transaction.
763    ///
764    /// Sets the channel to shutdown if an error occurs.
765    pub fn send(self, mut result: Result<&[u8], CreateError>) -> Result<(), fidl::Error> {
766        let _result = self.send_raw(result);
767        if _result.is_err() {
768            self.control_handle.shutdown();
769        }
770        self.drop_without_shutdown();
771        _result
772    }
773
774    /// Similar to "send" but does not shutdown the channel if an error occurs.
775    pub fn send_no_shutdown_on_err(
776        self,
777        mut result: Result<&[u8], CreateError>,
778    ) -> Result<(), fidl::Error> {
779        let _result = self.send_raw(result);
780        self.drop_without_shutdown();
781        _result
782    }
783
784    fn send_raw(&self, mut result: Result<&[u8], CreateError>) -> Result<(), fidl::Error> {
785        self.control_handle.inner.send::<fidl::encoding::ResultType<
786            SealingKeysCreateSealingKeyResponse,
787            CreateError,
788        >>(
789            result.map(|key_blob| (key_blob,)),
790            self.tx_id,
791            0x5a191cbb6a8081bc,
792            fidl::encoding::DynamicFlags::empty(),
793        )
794    }
795}
796
797#[must_use = "FIDL methods require a response to be sent"]
798#[derive(Debug)]
799pub struct SealingKeysSealResponder {
800    control_handle: std::mem::ManuallyDrop<SealingKeysControlHandle>,
801    tx_id: u32,
802}
803
804/// Set the the channel to be shutdown (see [`SealingKeysControlHandle::shutdown`])
805/// if the responder is dropped without sending a response, so that the client
806/// doesn't hang. To prevent this behavior, call `drop_without_shutdown`.
807impl std::ops::Drop for SealingKeysSealResponder {
808    fn drop(&mut self) {
809        self.control_handle.shutdown();
810        // Safety: drops once, never accessed again
811        unsafe { std::mem::ManuallyDrop::drop(&mut self.control_handle) };
812    }
813}
814
815impl fidl::endpoints::Responder for SealingKeysSealResponder {
816    type ControlHandle = SealingKeysControlHandle;
817
818    fn control_handle(&self) -> &SealingKeysControlHandle {
819        &self.control_handle
820    }
821
822    fn drop_without_shutdown(mut self) {
823        // Safety: drops once, never accessed again due to mem::forget
824        unsafe { std::mem::ManuallyDrop::drop(&mut self.control_handle) };
825        // Prevent Drop from running (which would shut down the channel)
826        std::mem::forget(self);
827    }
828}
829
830impl SealingKeysSealResponder {
831    /// Sends a response to the FIDL transaction.
832    ///
833    /// Sets the channel to shutdown if an error occurs.
834    pub fn send(self, mut result: Result<&[u8], SealError>) -> Result<(), fidl::Error> {
835        let _result = self.send_raw(result);
836        if _result.is_err() {
837            self.control_handle.shutdown();
838        }
839        self.drop_without_shutdown();
840        _result
841    }
842
843    /// Similar to "send" but does not shutdown the channel if an error occurs.
844    pub fn send_no_shutdown_on_err(
845        self,
846        mut result: Result<&[u8], SealError>,
847    ) -> Result<(), fidl::Error> {
848        let _result = self.send_raw(result);
849        self.drop_without_shutdown();
850        _result
851    }
852
853    fn send_raw(&self, mut result: Result<&[u8], SealError>) -> Result<(), fidl::Error> {
854        self.control_handle
855            .inner
856            .send::<fidl::encoding::ResultType<SealingKeysSealResponse, SealError>>(
857                result.map(|sealed_secret| (sealed_secret,)),
858                self.tx_id,
859                0x10d41255013918d1,
860                fidl::encoding::DynamicFlags::empty(),
861            )
862    }
863}
864
865#[must_use = "FIDL methods require a response to be sent"]
866#[derive(Debug)]
867pub struct SealingKeysUnsealResponder {
868    control_handle: std::mem::ManuallyDrop<SealingKeysControlHandle>,
869    tx_id: u32,
870}
871
872/// Set the the channel to be shutdown (see [`SealingKeysControlHandle::shutdown`])
873/// if the responder is dropped without sending a response, so that the client
874/// doesn't hang. To prevent this behavior, call `drop_without_shutdown`.
875impl std::ops::Drop for SealingKeysUnsealResponder {
876    fn drop(&mut self) {
877        self.control_handle.shutdown();
878        // Safety: drops once, never accessed again
879        unsafe { std::mem::ManuallyDrop::drop(&mut self.control_handle) };
880    }
881}
882
883impl fidl::endpoints::Responder for SealingKeysUnsealResponder {
884    type ControlHandle = SealingKeysControlHandle;
885
886    fn control_handle(&self) -> &SealingKeysControlHandle {
887        &self.control_handle
888    }
889
890    fn drop_without_shutdown(mut self) {
891        // Safety: drops once, never accessed again due to mem::forget
892        unsafe { std::mem::ManuallyDrop::drop(&mut self.control_handle) };
893        // Prevent Drop from running (which would shut down the channel)
894        std::mem::forget(self);
895    }
896}
897
898impl SealingKeysUnsealResponder {
899    /// Sends a response to the FIDL transaction.
900    ///
901    /// Sets the channel to shutdown if an error occurs.
902    pub fn send(self, mut result: Result<&[u8], UnsealError>) -> Result<(), fidl::Error> {
903        let _result = self.send_raw(result);
904        if _result.is_err() {
905            self.control_handle.shutdown();
906        }
907        self.drop_without_shutdown();
908        _result
909    }
910
911    /// Similar to "send" but does not shutdown the channel if an error occurs.
912    pub fn send_no_shutdown_on_err(
913        self,
914        mut result: Result<&[u8], UnsealError>,
915    ) -> Result<(), fidl::Error> {
916        let _result = self.send_raw(result);
917        self.drop_without_shutdown();
918        _result
919    }
920
921    fn send_raw(&self, mut result: Result<&[u8], UnsealError>) -> Result<(), fidl::Error> {
922        self.control_handle
923            .inner
924            .send::<fidl::encoding::ResultType<SealingKeysUnsealResponse, UnsealError>>(
925                result.map(|unsealed_secret| (unsealed_secret,)),
926                self.tx_id,
927                0x7037d75ecb579c83,
928                fidl::encoding::DynamicFlags::empty(),
929            )
930    }
931}
932
933mod internal {
934    use super::*;
935}
fidl_fuchsia_security_keymint/fidl_fuchsia_security_keymint.rs

fidl_fuchsia_security_keymint/
fidl_fuchsia_security_keymint.rs
