1 /* Copyright (c) (2010-2012,2014-2022) Apple Inc. All rights reserved.
2 *
3 * corecrypto is licensed under Apple Inc.’s Internal Use License Agreement (which
4 * is contained in the License.txt file distributed with corecrypto) and only to
5 * people who accept that license. IMPORTANT: Any license rights granted to you by
6 * Apple Inc. (if any) are limited to internal use within your organization only on
7 * devices and computers you own or control, for the sole purpose of verifying the
8 * security characteristics and correct functioning of the Apple Software. You may
9 * not, directly or indirectly, redistribute the Apple Software or any portions thereof.
10 */
11
12 #ifndef _CORECRYPTO_CC_H_
13 #define _CORECRYPTO_CC_H_
14
15 #include <corecrypto/cc_config.h>
16 #include <corecrypto/cc_impl.h>
17 #include <corecrypto/cc_error.h>
18
19 #include <string.h>
20 #include <stdint.h>
21 #include <stdbool.h>
22 #include <stddef.h>
23 #include <stdarg.h>
24
25 CC_PTRCHECK_CAPABLE_HEADER()
26
27 #if __has_feature(attribute_availability_with_replacement)
28 #if __has_feature(attribute_availability_bridgeos)
29 #ifndef __CC_BRIDGE_OS_DEPRECATED
30 #define __CC_BRIDGEOS_DEPRECATED(_dep, _msg) __attribute__((availability(bridgeos,deprecated=_dep, replacement=_msg)))
31 #endif
32 #endif
33
34 #ifndef __CC_BRIDGEOS_DEPRECATED
35 #define __CC_BRIDGEOS_DEPRECATED(_dep, _msg)
36 #endif
37
38 #define cc_deprecate_with_replacement(replacement_message, ios_version, macos_version, tvos_version, watchos_version, bridgeos_version) \
39 __attribute__((availability(macos,deprecated=macos_version, replacement=replacement_message)))\
40 __attribute__((availability(ios,deprecated=ios_version, replacement=replacement_message)))\
41 __attribute__((availability(watchos,deprecated=watchos_version, replacement=replacement_message)))\
42 __attribute__((availability(tvos,deprecated=tvos_version, replacement=replacement_message)))\
43 __CC_BRIDGEOS_DEPRECATED(bridgeos_version, replacement_message)
44
45 #define cc_unavailable() \
46 __attribute__((availability(macos,unavailable)))\
47 __attribute__((availability(ios,unavailable)))\
48 __attribute__((availability(watchos,unavailable)))\
49 __attribute__((availability(tvos,unavailable)))\
50 __attribute__((availability(bridgeos,unavailable)))
51
52 #if CC_PTRCHECK
53 #define cc_ptrcheck_unavailable() cc_unavailable()
54 #else
55 #define cc_ptrcheck_unavailable()
56 #endif
57
58 #else /* !__has_feature(attribute_availability_with_replacement) */
59
60 #define cc_deprecate_with_replacement(replacement_message, ios_version, macos_version, tvos_version, watchos_version, bridgeos_version)
61 #define cc_unavailable()
62 #define cc_ptrcheck_unavailable()
63
64 #endif /* __has_feature(attribute_availability_with_replacement) */
65
66 /* Provide a general purpose macro concat method. */
67 #define cc_concat_(a, b) a##b
68 #define cc_concat(a, b) cc_concat_(a, b)
69
70 #if defined(_MSC_VER)
71 #define __asm__(x)
72 #endif
73
74 /* Manage asserts here because a few functions in header public files do use asserts */
75 #if CORECRYPTO_DEBUG
76 #define cc_assert(x) assert(x)
77 #else
78 #define cc_assert(x)
79 #endif
80
81 #if CC_KERNEL
82 #include <kern/assert.h>
83 #else
84 #include <assert.h>
85 #endif
86
87 /* Provide a static assert that can be used to create compile-type failures. */
88 #if __has_feature(c_static_assert) || __has_extension(c_static_assert)
89 #define cc_static_assert(e, m) _Static_assert(e, m)
90 #elif !defined(__GNUC__)
91 #define cc_static_assert(e, m) enum { cc_concat(static_assert_, __COUNTER__) = 1 / (int)(!!(e)) }
92 #else
93 #define cc_static_assert(e, m)
94 #endif
95
96 /* Declare a struct element with a guarenteed alignment of _alignment_.
97 The resulting struct can be used to create arrays that are aligned by
98 a certain amount. */
99 #define cc_aligned_struct(_alignment_) \
100 typedef struct { \
101 uint8_t b[_alignment_]; \
102 } CC_ALIGNED(_alignment_)
103
104 #if defined(__BIGGEST_ALIGNMENT__)
105 #define CC_MAX_ALIGNMENT ((size_t)__BIGGEST_ALIGNMENT__)
106 #else
107 #define CC_MAX_ALIGNMENT ((size_t)16)
108 #endif
109
110 /* pads a given size to be a multiple of the biggest alignment for any type */
111 #define cc_pad_align(_size_) ((_size_ + CC_MAX_ALIGNMENT - 1) & (~(CC_MAX_ALIGNMENT - 1)))
112
113 /* number of array elements used in a cc_ctx_decl */
114 #define cc_ctx_n(_type_, _size_) ((_size_ + sizeof(_type_) - 1) / sizeof(_type_))
115
116 // VLA warning opt-outs to help transition away from VLAs.
117 #if defined(__KEIL__)
118 #define CC_IGNORE_VLA_WARNINGS \
119 #pragma push \
120 #pragma diag_suppress 1057
121
122 #define CC_RESTORE_VLA_WARNINGS \
123 #pragma pop
124 #else
125 #define CC_IGNORE_VLA_WARNINGS \
126 _Pragma("GCC diagnostic push") \
127 _Pragma("GCC diagnostic ignored \"-Wvla\"")
128
129 #define CC_RESTORE_VLA_WARNINGS \
130 _Pragma("GCC diagnostic pop")
131 #endif
132
133 /* sizeof of a context declared with cc_ctx_decl */
134 #define cc_ctx_sizeof(_type_, _size_) \
135 CC_IGNORE_VLA_WARNINGS \
136 sizeof(_type_[cc_ctx_n(_type_, _size_)]) \
137 CC_RESTORE_VLA_WARNINGS
138
139 /*
140 1. _alloca cannot be removed because this header file is compiled with both MSVC++ and with clang.
141 2. The _MSC_VER version of cc_ctx_decl() is not compatible with the way *_decl macros as used in CommonCrypto, AppleKeyStore and SecurityFrameworks. To observe the incompatibilities and errors, use below definition. Corecrypto itself, accepts both definitions
142 #define cc_ctx_decl(_type_, _size_, _name_) _type_ _name_ ## _array[cc_ctx_n(_type_, (_size_))]; _type_ *_name_ = _name_ ## _array
143 3. Never use sizeof() operator for the variables declared with cc_ctx_decl(), because it is not be compatible with the _MSC_VER version of cc_ctx_decl().
144 */
145 #if defined(_MSC_VER)
146
147 #include <malloc.h>
148 #define cc_ctx_decl(_type_, _size_, _name_) _type_ * _name_ = (_type_ *) _alloca(sizeof(_type_) * cc_ctx_n(_type_, _size_) )
149
150 #else
151
152 // Enable VLA warnings for internal uses of cc_ctx_decl().
153 #if defined(DISABLE_INTERNAL_VLAS) && DISABLE_INTERNAL_VLAS
154
155 #define cc_ctx_decl(_type_, _size_, _name_) \
156 _type_ _name_ [cc_ctx_n(_type_, _size_)];
157
158 #else
159
160 #define cc_ctx_decl(_type_, _size_, _name_) \
161 CC_IGNORE_VLA_WARNINGS \
162 _type_ _name_ [cc_ctx_n(_type_, _size_)]; \
163 CC_RESTORE_VLA_WARNINGS
164
165 #endif // DISABLE_INTERNAL_VLAS
166
167 #endif // defined(_MSC_VER)
168
169 #define cc_ctx_decl_field(_type_, _size_, _name_) \
170 _type_ _name_ [cc_ctx_n(_type_, _size_)]
171
172 // VLA warning opt-outs to help transition away from VLAs.
173 #define cc_ctx_decl_vla(_type_, _size_, _name_) \
174 CC_IGNORE_VLA_WARNINGS \
175 cc_ctx_decl(_type_, _size_, _name_); \
176 CC_RESTORE_VLA_WARNINGS
177
178 /*!
179 @brief cc_clear(len, dst) zeroizes array dst and it will not be optimized out.
180 @discussion It is used to clear sensitive data, particularly when the are defined in the stack
181 @param len number of bytes to be cleared in dst
182 @param dst input array
183 */
184 CC_NONNULL((2))
185 void cc_clear(size_t len, void *cc_sized_by(len) dst);
186
187 #define cc_copy(_size_, _dst_, _src_) memcpy(_dst_, _src_, _size_)
188
189 CC_INLINE CC_NONNULL((2))
cc_xor(size_t size,void * cc_sized_by (size)r,const void * cc_sized_by (size)s,const void * cc_sized_by (size)t)190 void cc_xor(size_t size, void *cc_sized_by(size) r, const void *cc_sized_by(size) s, const void *cc_sized_by(size) t) {
191 uint8_t *_r=(uint8_t *)r;
192 const uint8_t *_s=(const uint8_t *)s;
193 const uint8_t *_t=(const uint8_t *)t;
194 size_t _size = size;
195 while (_size--) {
196 _r[_size] = _s[_size] ^ _t[_size];
197 }
198 }
199
200 /*!
201 @brief cc_cmp_safe(num, pt1, pt2) compares two array ptr1 and ptr2 of num bytes.
202 @discussion The execution time/cycles is independent of the data and therefore guarantees no leak about the data. However, the execution time depends on num.
203 @param num number of bytes in each array
204 @param ptr1 input array
205 @param ptr2 input array
206 @return returns 0 if the num bytes starting at ptr1 are identical to the num bytes starting at ptr2 and 1 if they are different or if num is 0 (empty arrays).
207 */
208 CC_NONNULL((2, 3))
209 int cc_cmp_safe (size_t num, const void * cc_sized_by(num) ptr1, const void * cc_sized_by(num) ptr2);
210
211 /* Exchange S and T of any value type.
212 NOTE: S and T are evaluated multiple times and MUST NOT be expressions. */
213 #define CC_SWAP(S, T) do { \
214 S ^= T; T ^= S; S ^= T; \
215 } while (0)
216
217 /* Return the maximum value between S and T. */
218 #define CC_MAX(S, T) ({__typeof__(S) _cc_max_s = S; __typeof__(T) _cc_max_t = T; _cc_max_s > _cc_max_t ? _cc_max_s : _cc_max_t;})
219
220 /* Clone of CC_MAX() that evalutes S and T multiple times to allow nesting. */
221 #define CC_MAX_EVAL(S, T) ((S) > (T) ? (S) : (T))
222
223 /* Return the minimum value between S and T. */
224 #define CC_MIN(S, T) ({__typeof__(S) _cc_min_s = S; __typeof__(T) _cc_min_t = T; _cc_min_s <= _cc_min_t ? _cc_min_s : _cc_min_t;})
225
226 /* Clone of CC_MIN() that evalutes S and T multiple times to allow nesting. */
227 #define CC_MIN_EVAL(S, T) ((S) < (T) ? (S) : (T))
228
229 /*
230 When building with "-nostdinc" (i.e. iboot), ptrauth.h is in a non-standard location.
231 This requires a new flag to be used when building iboot: -ibuiltininc which is not
232 yet available.
233 */
234 #if __has_feature(ptrauth_calls) && (CC_KERNEL || CC_USE_L4 || CC_USE_SEPROM)
235 #include <ptrauth.h>
236 #define CC_SPTR(_sn_, _n_) \
237 __ptrauth(ptrauth_key_process_independent_code, 1, ptrauth_string_discriminator("cc_" #_sn_ #_n_)) _n_
238 #else
239 #define CC_SPTR(_sn_, _n_) _n_
240 #endif
241
242 // Similar to the iovec type used in scatter-gather APIs like readv()
243 // and writev().
244 typedef struct cc_iovec {
245 const void *base;
246 size_t nbytes;
247 } cc_iovec_t;
248
249 #endif /* _CORECRYPTO_CC_H_ */
250