Secure Coding Standard¶

The strongSwan project adheres to the following recommendations and rules proposed by the CERT C Secure Coding Standard:

• Table of contents
• Secure Coding Standard
  • Preprocessor (PRE)
  • Declarations and Initialization (DCL)
  • Expressions (EXP)
  • Integers (INT)
  • Floating Point (FLP)
  • Arrays (ARR)
  • Characters and Strings (STR)
  • Memory Management (MEM)
  • Input Output (FIO)
  • Environment (ENV)
  • Signals (SIG)
  • Error Handling (ERR)
  • Application Programming Interfaces (API)
  • Concurrency (CON)
  • Miscellaneous (MSC)
  • POSIX (POS)

(This is work under progress. Through inspection of our code the Check Adherence items must be assigned to one of the other three categories first. Then we intend to move recommendations and rules of the Partial Adherence category to Full Adherence by fixing our code in those places where we don't adhere yet)

Preprocessor (PRE)¶

Full Adherence

• PRE03-C. Prefer typedefs to defines for encoding types

• PRE04-C. Do not reuse a standard header file name

• PRE06-C. Enclose header files in an inclusion guard

• PRE09-C. Do not replace secure functions with deprecated or obsolescent functions

Partial Adherence

• PRE00-C. Prefer inline or static functions to function-like macros

• PRE01-C. Use parentheses within macros around parameter names

• PRE02-C. Macro replacement lists should be parenthesized

Check Adherence

• PRE05-C. Understand macro replacement when concatenating tokens or performing stringification

• PRE07-C. Avoid using repeated question marks

• PRE10-C. Wrap multistatement macros in a do-while loop

• PRE11-C. Do not conclude macro definitions with a semicolon

• PRE12-C. Do not define unsafe macros

• PRE30-C. Do not create a universal character name through concatenation

• PRE31-C. Avoid side-effects in arguments to unsafe macros

• PRE32-C. Do not use preprocessor directives inside macro arguments

No Adherence

• PRE08-C. Guarantee that header file names are unique

Declarations and Initialization (DCL)¶

Full Adherence

• DCL01-C. Do not reuse variable names in subscopes

• DCL02-C. Use visually distinct identifiers

• DCL05-C. Use typedefs to improve code readability

• DCL07-C. Include the appropriate type information in function declarators

• DCL12-C. Implement abstract data types using opaque types

• DCL15-C. Declare file-scope objects or functions that do not need external linkage as static

• DCL18-C. Do not begin integer constants with 0 when specifying a decimal value

• DCL31-C. Declare identifiers before using them

• DCL35-C. Call functions with the correct number and type of arguments

• DCL36-C. Do not declare an identifier with conflicting linkage classifications

• DCL38-C. Use the correct syntax when declaring flexible array members

• DCL40-C. Incompatible declarations of the same function or object

Partial Adherence

• DCL06-C. Use meaningful symbolic constants to represent literal values

• DCL19-C. Minimize the scope of variables and functions

• DCL20-C. Always specify void even if a function accepts no arguments

Check Adherence

• DCL08-C. Properly encode relationships in constant definitions

• DCL09-C. Declare functions that return errno with a return type of errno_t

• DCL10-C. Maintain the contract between the writer and caller of variadic functions

• DCL11-C. Understand the type issues associated with variadic functions

• DCL16-C. Use 'L,' not 'l,' to indicate a long value

• DCL17-C. Beware of miscompiled volatile-qualified variables

• DCL21-C. Understand the storage of compound literals

• DCL30-C. Declare objects with appropriate storage durations

• DCL34-C. Use volatile for data that cannot be cached

• DCL37-C. Do not declare or define a reserved identifier

• DCL39-C. Avoid information leak in structure padding

No Adherence

• DCL00-C. Const-qualify immutable objects

• DCL03-C. Use a static assertion to test the value of a constant expression

• DCL04-C. Do not declare more than one variable per declaration

• DCL13-C. Declare function parameters that are pointers to values not changed by the function as const

• DCL32-C. Guarantee that mutually visible identifiers are unique

Expressions (EXP)¶

Full Adherence

• EXP00-C. Use parentheses for precedence of operation

• EXP01-C. Do not take the size of a pointer to determine the size of the pointed-to type

• EXP02-C. Be aware of the short-circuit behavior of the logical AND and OR operators

• EXP03-C. Do not assume the size of a structure is the sum of the sizes of its members

• EXP04-C. Do not perform byte-by-byte comparisons involving a structure

• EXP05-C. Do not cast away a const qualification

• EXP06-C. Operands to the sizeof operator should not contain side effects

• EXP07-C. Do not diminish the benefits of constants by assuming their values in expressions

• EXP08-C. Ensure pointer arithmetic is used correctly

• EXP09-C. Use sizeof to determine the size of a type or variable

• EXP10-C. Do not depend on the order of evaluation of subexpressions or the order in which side effects take place

• EXP12-C. Do not ignore values returned by functions

• EXP13-C. Treat relational and equality operators as if they were nonassociative

• EXP14-C. Beware of integer promotion when performing bitwise operations on integer types smaller than int

• EXP15-C. Do not place a semicolon on the same line as an if, for, or while statement

• EXP16-C. Do not compare function pointers to constant values"

• EXP18-C. Do not perform assignments in selection statements

• EXP19-C. Use braces for the body of an if, for, or while statement

• EXP30-C. Do not depend on order of evaluation between sequence points

• EXP31-C. Avoid side effects in assertions

• EXP33-C. Do not reference uninitialized memory

• EXP34-C. Do not dereference null pointers

• EXP35-C. Do not modify objects with temporary lifetime

• EXP37-C. Call functions with the correct number and type of arguments

• EXP38-C. Do not call offsetof() on bit-field members or invalid types

• EXP40-C. Do not modify constant values

Partial Adherence

• EXP20-C. Perform explicit tests to determine success, true and false, and equality

Check Adherence

• EXP11-C. Do not make assumptions regarding the layout of structures with bit-fields

• EXP17-C. Do not perform bitwise operations in conditional expressions

• EXP32-C. Do not access a volatile object through a non-volatile reference

• EXP36-C. Do not convert pointers into more strictly aligned pointer types

• EXP39-C. Do not access a variable through a pointer of an incompatible type

• EXP41-C. Do not add or subtract a scaled integer to a pointer

No Adherence

• EXP21-C. Place constants on the left of equality comparisons

Integers (INT)¶

Full Adherence

• INT00-C. Understand the data model used by your implementation

• INT01-C. Use rsize_t or size_t for all integer values representing the size of an object

• INT02-C. Understand integer conversion rules

• INT04-C. Enforce limits on integer values originating from untrusted sources

• INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs

• INT09-C. Ensure enumeration constants map to unique values

• INT10-C. Do not assume a positive remainder when using the % operator

• INT11-C. Converting a pointer to integer or integer to pointer

Partial Adherence

• INT06-C. Use strtol() or a related function to convert a string token to an integer

• INT07-C. Use only explicitly signed or unsigned char type for numeric values

Check Adherence

• INT08-C. Verify that all integer values are in range

Floating Point (FLP)¶

Arrays (ARR)¶

Characters and Strings (STR)¶

Memory Management (MEM)¶

Input Output (FIO)¶

Environment (ENV)¶

Signals (SIG)¶

Error Handling (ERR)¶

Application Programming Interfaces (API)¶

Concurrency (CON)¶

Miscellaneous (MSC)¶

POSIX (POS)¶