1 /* Copyright (c) (2010-2012,2014-2021) Apple Inc. All rights reserved.
2 *
3 * corecrypto is licensed under Apple Inc.’s Internal Use License Agreement (which
4 * is contained in the License.txt file distributed with corecrypto) and only to
5 * people who accept that license. IMPORTANT: Any license rights granted to you by
6 * Apple Inc. (if any) are limited to internal use within your organization only on
7 * devices and computers you own or control, for the sole purpose of verifying the
8 * security characteristics and correct functioning of the Apple Software. You may
9 * not, directly or indirectly, redistribute the Apple Software or any portions thereof.
10 */
11
12 #ifndef _CORECRYPTO_CC_H_
13 #define _CORECRYPTO_CC_H_
14
15 #include <corecrypto/cc_config.h>
16 #include <corecrypto/cc_impl.h>
17 #include <corecrypto/cc_error.h>
18
19 #include <string.h>
20 #include <stdint.h>
21 #include <stdbool.h>
22
23 CC_PTRCHECK_CAPABLE_HEADER()
24
25 #if __has_feature(attribute_availability_with_replacement)
26 #if __has_feature(attribute_availability_bridgeos)
27 #ifndef __CC_BRIDGE_OS_DEPRECATED
28 #define __CC_BRIDGEOS_DEPRECATED(_dep, _msg) __attribute__((availability(bridgeos,deprecated=_dep, replacement=_msg)))
29 #endif
30 #endif
31
32 #ifndef __CC_BRIDGEOS_DEPRECATED
33 #define __CC_BRIDGEOS_DEPRECATED(_dep, _msg)
34 #endif
35
36 #define cc_deprecate_with_replacement(replacement_message, ios_version, macos_version, tvos_version, watchos_version, bridgeos_version) \
37 __attribute__((availability(macos,deprecated=macos_version, replacement=replacement_message)))\
38 __attribute__((availability(ios,deprecated=ios_version, replacement=replacement_message)))\
39 __attribute__((availability(watchos,deprecated=watchos_version, replacement=replacement_message)))\
40 __attribute__((availability(tvos,deprecated=tvos_version, replacement=replacement_message)))\
41 __CC_BRIDGEOS_DEPRECATED(bridgeos_version, replacement_message)
42
43 #define cc_unavailable() \
44 __attribute__((availability(macos,unavailable)))\
45 __attribute__((availability(ios,unavailable)))\
46 __attribute__((availability(watchos,unavailable)))\
47 __attribute__((availability(tvos,unavailable)))\
48 __attribute__((availability(bridgeos,unavailable)))
49
50 #if CC_PTRCHECK
51 #define cc_ptrcheck_unavailable() cc_unavailable()
52 #else
53 #define cc_ptrcheck_unavailable()
54 #endif
55
56 #else /* !__has_feature(attribute_availability_with_replacement) */
57
58 #define cc_deprecate_with_replacement(replacement_message, ios_version, macos_version, tvos_version, watchos_version, bridgeos_version)
59 #define cc_unavailable()
60 #define cc_ptrcheck_unavailable()
61
62 #endif /* __has_feature(attribute_availability_with_replacement) */
63
64 /* Provide a general purpose macro concat method. */
65 #define cc_concat_(a, b) a##b
66 #define cc_concat(a, b) cc_concat_(a, b)
67
68 #if defined(_MSC_VER)
69 #define __asm__(x)
70 #endif
71
72 /* Manage asserts here because a few functions in header public files do use asserts */
73 #if CORECRYPTO_DEBUG
74 #define cc_assert(x) assert(x)
75 #else
76 #define cc_assert(x)
77 #endif
78
79 #if CC_KERNEL
80 #include <kern/assert.h>
81 #else
82 #include <assert.h>
83 #endif
84
85 /* Provide a static assert that can be used to create compile-type failures,
86 except on GCC which does not support the function when "e" comes from a
87 const value. */
88 #ifndef __GNUC__
89 #define cc_static_assert(e, m) enum { cc_concat(static_assert_, __COUNTER__) = 1 / (int)(!!(e)) }
90 #else
91 #define cc_static_assert(e, m)
92 #endif
93
94 /* Declare a struct element with a guarenteed alignment of _alignment_.
95 The resulting struct can be used to create arrays that are aligned by
96 a certain amount. */
97 #define cc_aligned_struct(_alignment_) \
98 typedef struct { \
99 uint8_t b[_alignment_]; \
100 } CC_ALIGNED(_alignment_)
101
102 #if defined(__BIGGEST_ALIGNMENT__)
103 #define CC_MAX_ALIGNMENT ((size_t)__BIGGEST_ALIGNMENT__)
104 #else
105 #define CC_MAX_ALIGNMENT ((size_t)16)
106 #endif
107
108 /* pads a given size to be a multiple of the biggest alignment for any type */
109 #define cc_pad_align(_size_) ((_size_ + CC_MAX_ALIGNMENT - 1) & (~(CC_MAX_ALIGNMENT - 1)))
110
111 /* number of array elements used in a cc_ctx_decl */
112 #define cc_ctx_n(_type_, _size_) ((_size_ + sizeof(_type_) - 1) / sizeof(_type_))
113
114 /* sizeof of a context declared with cc_ctx_decl */
115 #define cc_ctx_sizeof(_type_, _size_) sizeof(_type_[cc_ctx_n(_type_, _size_)])
116
117 // VLA warning opt-outs to help transition away from VLAs.
118 #if defined(__KEIL__)
119 #define CC_IGNORE_VLA_WARNINGS \
120 #pragma push \
121 #pragma diag_suppress 1057
122
123 #define CC_RESTORE_VLA_WARNINGS \
124 #pragma pop
125 #else
126 #define CC_IGNORE_VLA_WARNINGS \
127 _Pragma("GCC diagnostic push") \
128 _Pragma("GCC diagnostic ignored \"-Wvla\"")
129
130 #define CC_RESTORE_VLA_WARNINGS \
131 _Pragma("GCC diagnostic pop")
132 #endif
133
134 /*
135 1. _alloca cannot be removed because this header file is compiled with both MSVC++ and with clang.
136 2. The _MSC_VER version of cc_ctx_decl() is not compatible with the way *_decl macros as used in CommonCrypto, AppleKeyStore and SecurityFrameworks. To observe the incompatibilities and errors, use below definition. Corecrypto itself, accepts both definitions
137 #define cc_ctx_decl(_type_, _size_, _name_) _type_ _name_ ## _array[cc_ctx_n(_type_, (_size_))]; _type_ *_name_ = _name_ ## _array
138 3. Never use sizeof() operator for the variables declared with cc_ctx_decl(), because it is not be compatible with the _MSC_VER version of cc_ctx_decl().
139 */
140 #if defined(_MSC_VER)
141
142 #include <malloc.h>
143 #define cc_ctx_decl(_type_, _size_, _name_) _type_ * _name_ = (_type_ *) _alloca(sizeof(_type_) * cc_ctx_n(_type_, _size_) )
144
145 #else
146
147 // Enable VLA warnings for internal uses of cc_ctx_decl().
148 #if defined(DISABLE_INTERNAL_VLAS) && DISABLE_INTERNAL_VLAS
149
150 #define cc_ctx_decl(_type_, _size_, _name_) \
151 _type_ _name_ [cc_ctx_n(_type_, _size_)];
152
153 #else
154
155 #define cc_ctx_decl(_type_, _size_, _name_) \
156 CC_IGNORE_VLA_WARNINGS \
157 _type_ _name_ [cc_ctx_n(_type_, _size_)]; \
158 CC_RESTORE_VLA_WARNINGS
159
160 #endif // DISABLE_INTERNAL_VLAS
161
162 #endif // defined(_MSC_VER)
163
164 #define cc_ctx_decl_field(_type_, _size_, _name_) \
165 _type_ _name_ [cc_ctx_n(_type_, _size_)]
166
167 // VLA warning opt-outs to help transition away from VLAs.
168 #define cc_ctx_decl_vla(_type_, _size_, _name_) \
169 CC_IGNORE_VLA_WARNINGS \
170 cc_ctx_decl(_type_, _size_, _name_); \
171 CC_RESTORE_VLA_WARNINGS
172
173 /*!
174 @brief cc_clear(len, dst) zeroizes array dst and it will not be optimized out.
175 @discussion It is used to clear sensitive data, particularly when the are defined in the stack
176 @param len number of bytes to be cleared in dst
177 @param dst input array
178 */
179 CC_NONNULL((2))
180 void cc_clear(size_t len, void *cc_sized_by(len) dst);
181
182 // cc_zero is deprecated, please use cc_clear instead.
183 cc_deprecate_with_replacement("cc_clear", 13.0, 10.15, 13.0, 6.0, 4.0)
184 CC_NONNULL_ALL CC_INLINE
cc_zero(size_t len,void * cc_sized_by (len)dst)185 void cc_zero(size_t len, void *cc_sized_by(len) dst)
186 {
187 cc_clear(len, dst);
188 }
189
190 #define cc_copy(_size_, _dst_, _src_) memcpy(_dst_, _src_, _size_)
191
192 CC_INLINE CC_NONNULL((2, 3, 4))
cc_xor(size_t size,void * cc_sized_by (size)r,const void * cc_sized_by (size)s,const void * cc_sized_by (size)t)193 void cc_xor(size_t size, void *cc_sized_by(size) r, const void *cc_sized_by(size) s, const void *cc_sized_by(size) t) {
194 uint8_t *_r=(uint8_t *)r;
195 const uint8_t *_s=(const uint8_t *)s;
196 const uint8_t *_t=(const uint8_t *)t;
197 size_t _size = size;
198 while (_size--) {
199 _r[_size] = _s[_size] ^ _t[_size];
200 }
201 }
202
203 /*!
204 @brief cc_cmp_safe(num, pt1, pt2) compares two array ptr1 and ptr2 of num bytes.
205 @discussion The execution time/cycles is independent of the data and therefore guarantees no leak about the data. However, the execution time depends on num.
206 @param num number of bytes in each array
207 @param ptr1 input array
208 @param ptr2 input array
209 @return returns 0 if the num bytes starting at ptr1 are identical to the num bytes starting at ptr2 and 1 if they are different or if num is 0 (empty arrays).
210 */
211 CC_NONNULL((2, 3))
212 int cc_cmp_safe (size_t num, const void * cc_sized_by(num) ptr1, const void * cc_sized_by(num) ptr2);
213
214 /* Exchange S and T of any value type.
215 NOTE: S and T are evaluated multiple times and MUST NOT be expressions. */
216 #define CC_SWAP(S, T) do { \
217 S ^= T; T ^= S; S ^= T; \
218 } while (0)
219
220 /* Return the maximum value between S and T. */
221 #define CC_MAX(S, T) ({__typeof__(S) _cc_max_s = S; __typeof__(T) _cc_max_t = T; _cc_max_s > _cc_max_t ? _cc_max_s : _cc_max_t;})
222
223 /* Clone of CC_MAX() that evalutes S and T multiple times to allow nesting. */
224 #define CC_MAX_EVAL(S, T) ((S) > (T) ? (S) : (T))
225
226 /* Return the minimum value between S and T. */
227 #define CC_MIN(S, T) ({__typeof__(S) _cc_min_s = S; __typeof__(T) _cc_min_t = T; _cc_min_s <= _cc_min_t ? _cc_min_s : _cc_min_t;})
228
229 /* Clone of CC_MIN() that evalutes S and T multiple times to allow nesting. */
230 #define CC_MIN_EVAL(S, T) ((S) < (T) ? (S) : (T))
231
232 /*
233 When building with "-nostdinc" (i.e. iboot), ptrauth.h is in a non-standard location.
234 This requires a new flag to be used when building iboot: -ibuiltininc which is not
235 yet available.
236 */
237 #if __has_feature(ptrauth_calls) && (CC_KERNEL || CC_USE_L4 || CC_USE_SEPROM)
238 #include <ptrauth.h>
239 #define CC_SPTR(_sn_, _n_) \
240 __ptrauth(ptrauth_key_process_independent_code, 1, ptrauth_string_discriminator("cc_" #_sn_ #_n_)) _n_
241 #else
242 #define CC_SPTR(_sn_, _n_) _n_
243 #endif
244
245 #endif /* _CORECRYPTO_CC_H_ */
246