basil_proto/
lib.rs

1// SPDX-FileCopyrightText: 2026 OpenBasil Contributors
2//
3// SPDX-License-Identifier: Apache-2.0
4
5//! Generated Basil gRPC API contracts.
6//!
7//! `broker` is Basil's own broker API. `spiffe` is generated from the vendored
8//! upstream SPIFFE Workload API proto.
9
10pub mod broker {
11    pub mod v1 {
12        #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
13        tonic::include_proto!("basil.broker.v1");
14    }
15}
16
17pub mod google {
18    pub mod rpc {
19        #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
20        tonic::include_proto!("google.rpc");
21    }
22}
23
24pub mod invocation;
25pub mod types;
26pub use types::{
27    AeadAlgorithm, CatalogEntry, CatalogKind, CiphertextEnvelope, KeyMaterial, KeyType,
28};
29pub mod spiffe {
30    #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
31    include!(concat!(env!("OUT_DIR"), "/_.rs"));
32}
33pub mod envoy {
34    //! Minimal Envoy xDS/SDS v3 contracts used by Basil's SDS adapter.
35
36    pub mod config {
37        pub mod core {
38            pub mod v3 {
39                #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
40                tonic::include_proto!("envoy.config.core.v3");
41            }
42        }
43        pub mod endpoint {
44            pub mod v3 {
45                #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
46                tonic::include_proto!("envoy.config.endpoint.v3");
47            }
48        }
49        pub mod route {
50            pub mod v3 {
51                #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
52                tonic::include_proto!("envoy.config.route.v3");
53            }
54        }
55    }
56
57    pub mod extensions {
58        pub mod transport_sockets {
59            pub mod tls {
60                pub mod v3 {
61                    #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
62                    tonic::include_proto!("envoy.extensions.transport_sockets.tls.v3");
63                }
64            }
65        }
66    }
67
68    pub mod service {
69        pub mod discovery {
70            pub mod v3 {
71                #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
72                tonic::include_proto!("envoy.service.discovery.v3");
73            }
74        }
75        pub mod secret {
76            pub mod v3 {
77                #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
78                tonic::include_proto!("envoy.service.secret.v3");
79            }
80        }
81    }
82}
83pub mod xds {
84    pub mod core {
85        pub mod v3 {
86            #![allow(clippy::all, clippy::nursery, clippy::pedantic)]
87            tonic::include_proto!("xds.core.v3");
88        }
89    }
90}
91
92// Zeroize-on-drop for the secret-bearing wire messages. The broker moves
93// secret/private-key bytes into these protos to send them, and the tonic codec
94// drops the message right after encoding it. These impls wipe that last owned
95// copy instead of leaving cleartext in freed heap (core security review
96// findings 17/19). The codec's transient encode buffer is tonic-owned and out
97// of reach. Note a `Drop` impl forbids moving fields out: consumers take owned
98// bytes with `std::mem::take` on the field.
99
100impl Drop for broker::v1::GetSecretResponse {
101    fn drop(&mut self) {
102        zeroize::Zeroize::zeroize(&mut self.value);
103    }
104}
105
106impl Drop for broker::v1::IssueCertificateResponse {
107    fn drop(&mut self) {
108        zeroize::Zeroize::zeroize(&mut self.private_key_der);
109    }
110}
111
112impl Drop for spiffe::X509svid {
113    fn drop(&mut self) {
114        zeroize::Zeroize::zeroize(&mut self.x509_svid_key);
115    }
116}
117
118impl Drop for envoy::extensions::transport_sockets::tls::v3::TlsCertificate {
119    fn drop(&mut self) {
120        use envoy::config::core::v3::data_source::Specifier;
121        if let Some(source) = self.private_key.as_mut()
122            && let Some(specifier) = source.specifier.as_mut()
123        {
124            match specifier {
125                Specifier::InlineBytes(bytes) => zeroize::Zeroize::zeroize(bytes),
126                Specifier::Filename(text)
127                | Specifier::InlineString(text)
128                | Specifier::EnvironmentVariable(text) => zeroize::Zeroize::zeroize(text),
129            }
130        }
131    }
132}
basil_proto/lib.rs

basil_proto/
lib.rs
