|
| 1 | +/* |
| 2 | + * Copyright 2025 Google LLC |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + * you may not use this file except in compliance with the License. |
| 6 | + * You may obtain a copy of the License at |
| 7 | + * |
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | + * |
| 10 | + * Unless required by applicable law or agreed to in writing, software |
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + * See the License for the specific language governing permissions and |
| 14 | + * limitations under the License. |
| 15 | + */ |
| 16 | + |
| 17 | +use aggregation_config::AggregationConfig; |
| 18 | +use aggregation_config_rust_proto::AggregationConfigProto; |
| 19 | +use ahe_shell::PublicKey; |
| 20 | +use ahe_traits::AheBase; |
| 21 | +use client_traits::SecureAggregationClient; |
| 22 | +use kahe_shell::ShellKahe; |
| 23 | +use kahe_traits::KaheBase; |
| 24 | +use parameters_shell::create_shell_configs; |
| 25 | +use prng_traits::SecurePrng; |
| 26 | +use proto_serialization_traits::{FromProto, ToProto}; |
| 27 | +use protobuf::prelude::*; |
| 28 | +use shell_ciphertexts_rust_proto::ShellAhePublicKey; |
| 29 | +use single_thread_hkdf::SingleThreadHkdfPrng; |
| 30 | +use status::ffi::FfiStatus; |
| 31 | +use status::StatusError; |
| 32 | +use std::collections::HashMap; |
| 33 | +use vahe_shell::ShellVahe; |
| 34 | +use willow_v1_client::WillowV1Client; |
| 35 | + |
| 36 | +/// CXX bridge to call Rust client code from C++. |
| 37 | +/// |
| 38 | +/// SAFETY: all functions in this module are only called from the wrapping C++ library, |
| 39 | +/// ensuring that output pointers are correctly wrapped by a rust::Box, and that pointer arguments |
| 40 | +/// are not null. |
| 41 | +#[cxx::bridge(namespace = "secure_aggregation")] |
| 42 | +pub mod ffi { |
| 43 | + /// One entry in the plaintext map. Obtained by taking slices of the metric names and values |
| 44 | + /// owned by the C++ EncodedData object (hence the lifetime). |
| 45 | + struct DataEntryView<'a> { |
| 46 | + key: &'a [u8], |
| 47 | + values: &'a [u64], |
| 48 | + } |
| 49 | + |
| 50 | + extern "Rust" { |
| 51 | + // cxx: types used as extern Rust types are required to be defined by the same crate that |
| 52 | + // contains the bridge using them |
| 53 | + type WillowShellClient; |
| 54 | + |
| 55 | + pub unsafe fn initialize_client( |
| 56 | + config: UniquePtr<CxxString>, |
| 57 | + out: *mut *mut WillowShellClient, |
| 58 | + out_status_message: *mut UniquePtr<CxxString>, |
| 59 | + ) -> i32; |
| 60 | + |
| 61 | + unsafe fn client_into_box(ptr: *mut WillowShellClient) -> Box<WillowShellClient>; |
| 62 | + |
| 63 | + unsafe fn generate_contribution( |
| 64 | + client: &mut Box<WillowShellClient>, |
| 65 | + data: &[DataEntryView], |
| 66 | + key: UniquePtr<CxxString>, |
| 67 | + nonce: &[u8], |
| 68 | + out: *mut Vec<u8>, |
| 69 | + out_status_message: *mut UniquePtr<CxxString>, |
| 70 | + ) -> i32; |
| 71 | + } |
| 72 | +} |
| 73 | + |
| 74 | +pub struct WillowShellClient(WillowV1Client<ShellKahe, ShellVahe>); |
| 75 | + |
| 76 | +impl WillowShellClient { |
| 77 | + fn new_from_serialized_config( |
| 78 | + config: cxx::UniquePtr<cxx::CxxString>, |
| 79 | + ) -> Result<Self, StatusError> { |
| 80 | + let aggregation_config_proto = |
| 81 | + AggregationConfigProto::parse(config.as_bytes()).map_err(|e| { |
| 82 | + status::internal(format!("Failed to parse AggregationConfigProto: {}", e)) |
| 83 | + })?; |
| 84 | + let aggregation_config = AggregationConfig::from_proto(aggregation_config_proto, ())?; |
| 85 | + let (kahe_config, ahe_config) = create_shell_configs(&aggregation_config)?; |
| 86 | + let context_bytes = aggregation_config.compute_context_bytes()?; |
| 87 | + let kahe = ShellKahe::new(kahe_config, &context_bytes)?; |
| 88 | + let vahe = ShellVahe::new(ahe_config, &context_bytes)?; |
| 89 | + let client_seed = SingleThreadHkdfPrng::generate_seed()?; |
| 90 | + let prng = SingleThreadHkdfPrng::create(&client_seed)?; |
| 91 | + let client = WillowV1Client { kahe, vahe, prng }; |
| 92 | + Ok(WillowShellClient(client)) |
| 93 | + } |
| 94 | + |
| 95 | + fn generate_contribution( |
| 96 | + &mut self, |
| 97 | + data: &[ffi::DataEntryView], |
| 98 | + public_key: cxx::UniquePtr<cxx::CxxString>, |
| 99 | + nonce: &[u8], |
| 100 | + ) -> Result<Vec<u8>, StatusError> { |
| 101 | + let mut plaintext_slice: HashMap<&str, &[u64]> = HashMap::new(); |
| 102 | + for entry in data { |
| 103 | + let key = str::from_utf8(entry.key) |
| 104 | + .map_err(|e| status::internal(format!("Failed to parse key as UTF-8: {}", e)))?; |
| 105 | + plaintext_slice.insert(key, entry.values); |
| 106 | + } |
| 107 | + let public_key_proto = ShellAhePublicKey::parse(public_key.as_bytes()) |
| 108 | + .map_err(|e| status::internal(format!("Failed to parse ShellAhePublicKey: {}", e)))?; |
| 109 | + let public_key_rust = PublicKey::from_proto(public_key_proto, &self.0.vahe)?; |
| 110 | + let message = self.0.create_client_message(&plaintext_slice, &public_key_rust, nonce)?; |
| 111 | + Ok(message |
| 112 | + .to_proto(&self.0)? |
| 113 | + .serialize() |
| 114 | + .map_err(|e| status::internal(format!("Failed to serialize ClientMessage: {}", e)))?) |
| 115 | + } |
| 116 | +} |
| 117 | + |
| 118 | +/// SAFETY: `out` and `out_status_message` must not be null. |
| 119 | +unsafe fn initialize_client( |
| 120 | + config: cxx::UniquePtr<cxx::CxxString>, |
| 121 | + out: *mut *mut WillowShellClient, |
| 122 | + out_status_message: *mut cxx::UniquePtr<cxx::CxxString>, |
| 123 | +) -> i32 { |
| 124 | + match WillowShellClient::new_from_serialized_config(config) { |
| 125 | + Ok(client) => { |
| 126 | + *out = Box::into_raw(Box::new(client)); |
| 127 | + 0 |
| 128 | + } |
| 129 | + Err(status_error) => { |
| 130 | + let ffi_status: FfiStatus = status_error.into(); |
| 131 | + *out_status_message = ffi_status.message; |
| 132 | + ffi_status.code |
| 133 | + } |
| 134 | + } |
| 135 | +} |
| 136 | + |
| 137 | +/// Converts a raw pointer to a Box. Ideally we would use `rust::Box::from_raw` |
| 138 | +/// (https://cxx.rs/binding/box.html) directly from C++, but that causes linker errors. |
| 139 | +/// |
| 140 | +/// SAFETY: `ptr` must have been created by `Box::into_raw`, as in `initialize_client`. |
| 141 | +unsafe fn client_into_box(ptr: *mut WillowShellClient) -> Box<WillowShellClient> { |
| 142 | + Box::from_raw(ptr) |
| 143 | +} |
| 144 | + |
| 145 | +/// SAFETY: `out` and `out_status_message` must not be null. |
| 146 | +unsafe fn generate_contribution( |
| 147 | + client: &mut Box<WillowShellClient>, |
| 148 | + data: &[ffi::DataEntryView], |
| 149 | + public_key: cxx::UniquePtr<cxx::CxxString>, |
| 150 | + nonce: &[u8], |
| 151 | + out: *mut Vec<u8>, |
| 152 | + out_status_message: *mut cxx::UniquePtr<cxx::CxxString>, |
| 153 | +) -> i32 { |
| 154 | + match client.generate_contribution(data, public_key, nonce) { |
| 155 | + Ok(contribution) => { |
| 156 | + *out = contribution; |
| 157 | + 0 |
| 158 | + } |
| 159 | + Err(status_error) => { |
| 160 | + let ffi_status: FfiStatus = status_error.into(); |
| 161 | + *out_status_message = ffi_status.message; |
| 162 | + ffi_status.code |
| 163 | + } |
| 164 | + } |
| 165 | +} |
0 commit comments