chore: Enable the unreachable_pub Rust lint

Author: poljar

Cargo.toml

@@ -27,6 +27,7 @@ unsafe_op_in_unsafe_fn = "deny"
 unused_extern_crates = "deny"
 unused_import_braces = "deny"
 unused_qualifications = "deny"
+unreachable_pub = "deny"
 rust_2018_idioms = "deny"
 
 [lints.clippy]

src/cipher/key.rs

@@ -70,19 +70,19 @@ pub(crate) struct CipherKeys {
 }
 
 impl CipherKeys {
-    pub fn new(message_key: &[u8; 32]) -> Self {
+    pub(crate) fn new(message_key: &[u8; 32]) -> Self {
         let expanded_keys = ExpandedKeys::new(message_key);
 
         Self::from_expanded_keys(expanded_keys)
     }
 
-    pub fn new_megolm(message_key: &[u8; 128]) -> Self {
+    pub(crate) fn new_megolm(message_key: &[u8; 128]) -> Self {
         let expanded_keys = ExpandedKeys::new_megolm(message_key);
 
         Self::from_expanded_keys(expanded_keys)
     }
 
-    pub fn new_pickle(pickle_key: &[u8]) -> Self {
+    pub(crate) fn new_pickle(pickle_key: &[u8]) -> Self {
         let expanded_keys = ExpandedKeys::new_pickle(pickle_key);
 
         Self::from_expanded_keys(expanded_keys)
@@ -100,16 +100,16 @@ impl CipherKeys {
         Self { aes_key, aes_iv, mac_key }
     }
 
-    pub fn aes_key(&self) -> &Aes256Key {
+    pub(crate) fn aes_key(&self) -> &Aes256Key {
         #[allow(deprecated)]
         Aes256Key::from_slice(self.aes_key.as_slice())
     }
 
-    pub const fn mac_key(&self) -> &HmacSha256Key {
+    pub(crate) const fn mac_key(&self) -> &HmacSha256Key {
         &self.mac_key
     }
 
-    pub fn iv(&self) -> &Aes256Iv {
+    pub(crate) fn iv(&self) -> &Aes256Iv {
         #[allow(deprecated)]
         Aes256Iv::from_slice(self.aes_iv.as_slice())
     }

src/cipher/mod.rs

@@ -33,16 +33,20 @@ pub(crate) type HmacSha256 = Hmac<Sha256>;
 
 /// The message authentication code of a ciphertext.
 #[derive(Debug, Clone, PartialEq, Eq)]
+#[allow(unreachable_pub)]
 pub struct Mac(pub(crate) [u8; Self::LENGTH]);
 
 impl Mac {
     /// The expected length of the message authentication code (MAC).
+    #[allow(unreachable_pub)]
     pub const LENGTH: usize = 32;
     /// The expected length of the message authentication code (MAC) if
     /// truncation is applied.
+    #[allow(unreachable_pub)]
     pub const TRUNCATED_LEN: usize = 8;
 
     /// Truncates and converts the [`Mac`] into a byte array.
+    #[allow(unreachable_pub)]
     pub fn truncate(&self) -> [u8; Self::TRUNCATED_LEN] {
         let mut truncated = [0u8; Self::TRUNCATED_LEN];
         truncated.copy_from_slice(&self.0[0..Self::TRUNCATED_LEN]);
@@ -51,6 +55,7 @@ impl Mac {
     }
 
     /// Return the [`Mac`] as a byte slice.
+    #[allow(unreachable_pub)]
     pub fn as_bytes(&self) -> &[u8] {
         self.0.as_ref()
     }
@@ -63,7 +68,7 @@ pub(crate) enum MessageMac {
 }
 
 impl MessageMac {
-    pub fn as_bytes(&self) -> &[u8] {
+    pub(crate) fn as_bytes(&self) -> &[u8] {
         match self {
             MessageMac::Truncated(m) => m.as_ref(),
             MessageMac::Full(m) => m.as_bytes(),
@@ -94,6 +99,7 @@ pub enum DecryptionError {
 }
 
 /// A cipher used for encrypting and decrypting messages.
+#[allow(unreachable_pub)]
 pub struct Cipher {
     keys: CipherKeys,
 }
@@ -107,6 +113,7 @@ impl Cipher {
     ///
     /// This key derivation format is typically used for generating individual
     /// message keys in the Olm double ratchet.
+    #[allow(unreachable_pub)]
     pub fn new(key: &[u8; 32]) -> Self {
         let keys = CipherKeys::new(key);
 
@@ -122,6 +129,7 @@ impl Cipher {
     ///
     /// This key derivation format is typically used for generating individual
     /// message keys in the Megolm ratchet.
+    #[allow(unreachable_pub)]
     pub fn new_megolm(&key: &[u8; 128]) -> Self {
         let keys = CipherKeys::new_megolm(&key);
 
@@ -138,6 +146,7 @@ impl Cipher {
     ///
     /// This key derivation format is typically used for libolm-compatible
     /// encrypted pickle formats.
+    #[allow(unreachable_pub)]
     pub fn new_pickle(key: &[u8]) -> Self {
         let keys = CipherKeys::new_pickle(key);
 
@@ -160,6 +169,7 @@ impl Cipher {
     /// **Warning**: This is a low-level function and does not provide
     /// authentication for the ciphertext. You must call [`Cipher::mac()`]
     /// separately to generate the message authentication code (MAC).
+    #[allow(unreachable_pub)]
     pub fn encrypt(&self, plaintext: &[u8]) -> Vec<u8> {
         let cipher = Aes256CbcEnc::new(self.keys.aes_key(), self.keys.iv());
         cipher.encrypt_padded_vec::<Pkcs7>(plaintext)
@@ -170,6 +180,7 @@ impl Cipher {
     /// **Warning**: This is a low-level function and must be called after the
     /// [`Cipher::encrypt`] method. The ciphertext produced by
     /// [`Cipher::encrypt`] must be passed as the argument to this method.
+    #[allow(unreachable_pub)]
     pub fn mac(&self, message: &[u8]) -> Mac {
         let mut hmac = self.get_hmac();
         hmac.update(message);
@@ -187,6 +198,7 @@ impl Cipher {
     /// **Warning**: This is a low-level function. Before calling this, you must
     /// call [`Cipher::verify_mac()`] or [`Cipher::verify_truncated_mac()`]
     /// to ensure the integrity of the ciphertext.
+    #[allow(unreachable_pub)]
     pub fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, UnpadError> {
         let cipher = Aes256CbcDec::new(self.keys.aes_key(), self.keys.iv());
         cipher.decrypt_padded_vec::<Pkcs7>(ciphertext)
@@ -198,6 +210,7 @@ impl Cipher {
     /// **Warning**: This is a low-level function and must be called before
     /// invoking the [`Cipher::decrypt()`] method.
     #[cfg(all(not(fuzzing), feature = "experimental-session-config"))]
+    #[allow(unreachable_pub)]
     pub fn verify_mac(&self, message: &[u8], tag: &Mac) -> Result<(), MacError> {
         let mut hmac = self.get_hmac();
 
@@ -211,6 +224,7 @@ impl Cipher {
     /// **Warning**: This is a low-level function and must be called before
     /// invoking the [`Cipher::decrypt()`] method.
     #[cfg(not(fuzzing))]
+    #[allow(unreachable_pub)]
     pub fn verify_truncated_mac(&self, message: &[u8], tag: &[u8]) -> Result<(), MacError> {
         let mut hmac = self.get_hmac();
 
@@ -251,6 +265,7 @@ impl Cipher {
     /// message authentication tag to it.
     ///
     /// This follows the encryption method used by the libolm pickle format.
+    #[allow(unreachable_pub)]
     pub fn encrypt_pickle(&self, plaintext: &[u8]) -> Vec<u8> {
         let mut ciphertext = self.encrypt(plaintext);
         let mac = self.mac(&ciphertext);
@@ -267,6 +282,7 @@ impl Cipher {
     /// MAC before decrypting the ciphertext.
     ///
     /// This follows the encryption method used by the libolm pickle format.
+    #[allow(unreachable_pub)]
     pub fn decrypt_pickle(&self, ciphertext: &[u8]) -> Result<Vec<u8>, DecryptionError> {
         if ciphertext.len() < Mac::TRUNCATED_LEN + 1 {
             Err(DecryptionError::MacMissing)

src/megolm/ratchet.rs

@@ -134,11 +134,11 @@ impl<'a> RatchetParts<'a> {
 }
 
 impl Ratchet {
-    pub const RATCHET_LENGTH: usize = 128;
+    pub(super) const RATCHET_LENGTH: usize = 128;
     const RATCHET_PART_COUNT: usize = 4;
     const LAST_RATCHET_INDEX: usize = Self::RATCHET_PART_COUNT - 1;
 
-    pub fn new() -> Self {
+    pub(super) fn new() -> Self {
         let mut rng = rng();
 
         let mut ratchet =
@@ -149,20 +149,20 @@ impl Ratchet {
         ratchet
     }
 
-    pub const fn from_bytes(bytes: Box<[u8; Self::RATCHET_LENGTH]>, counter: u32) -> Self {
+    pub(super) const fn from_bytes(bytes: Box<[u8; Self::RATCHET_LENGTH]>, counter: u32) -> Self {
         Self { inner: RatchetBytes(bytes), counter }
     }
 
-    pub const fn index(&self) -> u32 {
+    pub(super) const fn index(&self) -> u32 {
         self.counter
     }
 
-    pub const fn as_bytes(&self) -> &[u8; Self::RATCHET_LENGTH] {
+    pub(super) const fn as_bytes(&self) -> &[u8; Self::RATCHET_LENGTH] {
         &self.inner.0
     }
 
     #[cfg(test)]
-    pub const fn ratchet_bytes_pointer(&self) -> *const [u8; 128] {
+    pub(super) const fn ratchet_bytes_pointer(&self) -> *const [u8; 128] {
         &*self.inner.0
     }
 
@@ -180,7 +180,7 @@ impl Ratchet {
         RatchetParts { r_0, r_1, r_2, r_3 }
     }
 
-    pub fn advance(&mut self) {
+    pub(super) fn advance(&mut self) {
         let mut mask: u32 = 0x00FFFFFF;
 
         // The index of the "slowest" part of the ratchet that needs to be
@@ -208,7 +208,7 @@ impl Ratchet {
         }
     }
 
-    pub fn advance_to(&mut self, advance_to: u32) {
+    pub(super) fn advance_to(&mut self, advance_to: u32) {
         for j in 0..Self::RATCHET_PART_COUNT {
             let shift = (Self::LAST_RATCHET_INDEX - j) * 8;
             let mask: u32 = !0u32 << shift;

src/olm/account/fallback_keys.rs

@@ -33,23 +33,23 @@ impl FallbackKey {
         Self { key_id, key, published: false }
     }
 
-    pub fn public_key(&self) -> Curve25519PublicKey {
+    pub(super) fn public_key(&self) -> Curve25519PublicKey {
         Curve25519PublicKey::from(&self.key)
     }
 
-    pub const fn secret_key(&self) -> &Curve25519SecretKey {
+    pub(super) const fn secret_key(&self) -> &Curve25519SecretKey {
         &self.key
     }
 
-    pub const fn key_id(&self) -> KeyId {
+    pub(super) const fn key_id(&self) -> KeyId {
         self.key_id
     }
 
-    pub fn mark_as_published(&mut self) {
+    pub(super) fn mark_as_published(&mut self) {
         self.published = true;
     }
 
-    pub const fn published(&self) -> bool {
+    pub(super) const fn published(&self) -> bool {
         self.published
     }
 }
@@ -62,17 +62,17 @@ pub(super) struct FallbackKeys {
 }
 
 impl FallbackKeys {
-    pub const fn new() -> Self {
+    pub(super) const fn new() -> Self {
         Self { key_id: 0, fallback_key: None, previous_fallback_key: None }
     }
 
-    pub fn mark_as_published(&mut self) {
+    pub(super) fn mark_as_published(&mut self) {
         if let Some(f) = self.fallback_key.as_mut() {
             f.mark_as_published()
         }
     }
 
-    pub fn generate_fallback_key(&mut self) -> Option<Curve25519PublicKey> {
+    pub(super) fn generate_fallback_key(&mut self) -> Option<Curve25519PublicKey> {
         let key_id = KeyId(self.key_id);
         self.key_id += 1;
 
@@ -84,7 +84,10 @@ impl FallbackKeys {
         ret
     }
 
-    pub fn get_secret_key(&self, public_key: &Curve25519PublicKey) -> Option<&Curve25519SecretKey> {
+    pub(super) fn get_secret_key(
+        &self,
+        public_key: &Curve25519PublicKey,
+    ) -> Option<&Curve25519SecretKey> {
         self.fallback_key
             .as_ref()
             .filter(|f| f.public_key() == *public_key)
@@ -94,11 +97,11 @@ impl FallbackKeys {
             .map(|f| f.secret_key())
     }
 
-    pub fn forget_previous_fallback_key(&mut self) -> Option<FallbackKey> {
+    pub(super) fn forget_previous_fallback_key(&mut self) -> Option<FallbackKey> {
         self.previous_fallback_key.take()
     }
 
-    pub fn unpublished_fallback_key(&self) -> Option<&FallbackKey> {
+    pub(super) fn unpublished_fallback_key(&self) -> Option<&FallbackKey> {
         self.fallback_key.as_ref().filter(|f| !f.published())
     }
 }

src/olm/account/one_time_keys.rs

@@ -44,7 +44,7 @@ pub struct OneTimeKeyGenerationResult {
 impl OneTimeKeys {
     const MAX_ONE_TIME_KEYS: usize = 100 * PUBLIC_MAX_ONE_TIME_KEYS;
 
-    pub fn new() -> Self {
+    pub(super) fn new() -> Self {
         Self {
             next_key_id: 0,
             unpublished_public_keys: Default::default(),
@@ -53,15 +53,18 @@ impl OneTimeKeys {
         }
     }
 
-    pub fn mark_as_published(&mut self) {
+    pub(super) fn mark_as_published(&mut self) {
         self.unpublished_public_keys.clear();
     }
 
-    pub fn get_secret_key(&self, public_key: &Curve25519PublicKey) -> Option<&Curve25519SecretKey> {
+    pub(super) fn get_secret_key(
+        &self,
+        public_key: &Curve25519PublicKey,
+    ) -> Option<&Curve25519SecretKey> {
         self.key_ids_by_key.get(public_key).and_then(|key_id| self.private_keys.get(key_id))
     }
 
-    pub fn remove_secret_key(
+    pub(super) fn remove_secret_key(
         &mut self,
         public_key: &Curve25519PublicKey,
     ) -> Option<Curve25519SecretKey> {
@@ -127,7 +130,7 @@ impl OneTimeKeys {
         !self.unpublished_public_keys.contains_key(key_id)
     }
 
-    pub fn generate(&mut self, count: usize) -> OneTimeKeyGenerationResult {
+    pub(super) fn generate(&mut self, count: usize) -> OneTimeKeyGenerationResult {
         let mut removed_keys = Vec::new();
         let mut created_keys = Vec::new();