strongSwan

h1. Secure Coding Standard

The strongSwan project adheres to the following recommendations and rules proposed by the "CERT C Secure Coding Standard":https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Secure+Coding+Standard:

{{>toc}}

(This is work under progress. Through inspection of our code the _Check Adherence_ items must be assigned to one of the other three categories first. Then we intend to move recommendations and rules of the _Partial Adherence_ category to _Full Adherence_ by fixing our code in those places where we don't adhere yet)

h2. Preprocessor (PRE)

_Full Adherence_

* "PRE03-C. Prefer typedefs to defines for encoding types":https://www.securecoding.cert.org/confluence/display/seccode/PRE03-C.+Prefer+typedefs+to+defines+for+encoding+types

* "PRE04-C. Do not reuse a standard header file name":https://www.securecoding.cert.org/confluence/display/seccode/PRE04-C.+Do+not+reuse+a+standard+header+file+name

* "PRE06-C. Enclose header files in an inclusion guard":https://www.securecoding.cert.org/confluence/display/seccode/PRE06-C.+Enclose+header+files+in+an+inclusion+guard

* "PRE09-C. Do not replace secure functions with deprecated or obsolescent functions":https://www.securecoding.cert.org/confluence/display/seccode/PRE09-C.+Do+not+replace+secure+functions+with+deprecated+or+obsolescent+functions

_Partial Adherence_

* "PRE00-C. Prefer inline or static functions to function-like macros ":https://www.securecoding.cert.org/confluence/display/seccode/PRE00-C.+Prefer+inline+or+static+functions+to+function-like+macros

* "PRE01-C. Use parentheses within macros around parameter names":https://www.securecoding.cert.org/confluence/display/seccode/PRE01-C.+Use+parentheses+within+macros+around+parameter+names

* "PRE02-C. Macro replacement lists should be parenthesized":https://www.securecoding.cert.org/confluence/display/seccode/PRE02-C.+Macro+replacement+lists+should+be+parenthesized

_Check Adherence_

* "PRE05-C. Understand macro replacement when concatenating tokens or performing stringification":https://www.securecoding.cert.org/confluence/display/seccode/PRE05-C.+Understand+macro+replacement+when+concatenating+tokens+or+performing+stringification

* "PRE07-C. Avoid using repeated question marks":https://www.securecoding.cert.org/confluence/display/seccode/PRE07-C.+Avoid+using+repeated+question+marks

* "PRE10-C. Wrap multistatement macros in a do-while loop":https://www.securecoding.cert.org/confluence/display/seccode/PRE10-C.+Wrap+multistatement+macros+in+a+do-while+loop

* "PRE11-C. Do not conclude macro definitions with a semicolon ":https://www.securecoding.cert.org/confluence/display/seccode/PRE11-C.+Do+not+conclude+macro+definitions+with+a+semicolon

* "PRE12-C. Do not define unsafe macros":https://www.securecoding.cert.org/confluence/display/seccode/PRE12-C.+Do+not+define+unsafe+macros

* "PRE30-C. Do not create a universal character name through concatenation":https://www.securecoding.cert.org/confluence/display/seccode/PRE30-C.+Do+not+create+a+universal+character+name+through+concatenation

* "PRE31-C. Avoid side-effects in arguments to unsafe macros":https://www.securecoding.cert.org/confluence/display/seccode/PRE31-C.+Avoid+side-effects+in+arguments+to+unsafe+macros

* "PRE32-C. Do not use preprocessor directives inside macro arguments":https://www.securecoding.cert.org/confluence/display/seccode/PRE32-C.+Do+not+use+preprocessor+directives+inside+macro+arguments

_No Adherence_

* "PRE08-C. Guarantee that header file names are unique":https://www.securecoding.cert.org/confluence/display/seccode/PRE08-C.+Guarantee+that+header+file+names+are+unique

h2. Declarations and Initialization (DCL)

_Full Adherence_

* "DCL01-C. Do not reuse variable names in subscopes":https://www.securecoding.cert.org/confluence/display/seccode/DCL01-C.+Do+not+reuse+variable+names+in+subscopes

* "DCL02-C. Use visually distinct identifiers":https://www.securecoding.cert.org/confluence/display/seccode/DCL02-C.+Use+visually+distinct+identifiers

* "DCL05-C. Use typedefs to improve code readability":https://www.securecoding.cert.org/confluence/display/seccode/DCL05-C.+Use+typedefs+to+improve+code+readability

* "DCL07-C. Include the appropriate type information in function declarators":https://www.securecoding.cert.org/confluence/display/seccode/DCL07-C.+Include+the+appropriate+type+information+in+function+declarators

* "DCL12-C. Implement abstract data types using opaque types":https://www.securecoding.cert.org/confluence/display/seccode/DCL12-C.+Implement+abstract+data+types+using+opaque+types

* "DCL15-C. Declare file-scope objects or functions that do not need external linkage as static":https://www.securecoding.cert.org/confluence/display/seccode/DCL15-C.+Declare+file-scope+objects+or+functions+that+do+not+need+external+linkage+as+static

* "DCL18-C. Do not begin integer constants with 0 when specifying a decimal value":https://www.securecoding.cert.org/confluence/display/seccode/DCL18-C.+Do+not+begin+integer+constants+with+0+when+specifying+a+decimal+value

* "DCL31-C. Declare identifiers before using them":https://www.securecoding.cert.org/confluence/display/seccode/DCL31-C.+Declare+identifiers+before+using+them

* "DCL35-C. Call functions with the correct number and type of arguments":https://www.securecoding.cert.org/confluence/display/seccode/DCL35-C.+Call+functions+with+the+correct+number+and+type+of+arguments

* "DCL36-C. Do not declare an identifier with conflicting linkage classifications":https://www.securecoding.cert.org/confluence/display/seccode/DCL36-C.+Do+not+declare+an+identifier+with+conflicting+linkage+classifications

* "DCL38-C. Use the correct syntax when declaring flexible array members":https://www.securecoding.cert.org/confluence/display/seccode/DCL38-C.+Use+the+correct+syntax+when+declaring+flexible+array+members

* "DCL40-C. Incompatible declarations of the same function or object":https://www.securecoding.cert.org/confluence/display/seccode/DCL40-C.+Incompatible+declarations+of+the+same+function+or+object

_Partial Adherence_

* "DCL06-C. Use meaningful symbolic constants to represent literal values":https://www.securecoding.cert.org/confluence/display/seccode/DCL06-C.+Use+meaningful+symbolic+constants+to+represent+literal+values

* "DCL19-C. Minimize the scope of variables and functions":https://www.securecoding.cert.org/confluence/display/seccode/DCL19-C.+Minimize+the+scope+of+variables+and+functions

* "DCL20-C. Always specify void even if a function accepts no arguments":https://www.securecoding.cert.org/confluence/display/seccode/DCL20-C.+Always+specify+void+even+if+a+function+accepts+no+arguments

_Check Adherence_

* "DCL08-C. Properly encode relationships in constant definitions":https://www.securecoding.cert.org/confluence/display/seccode/DCL08-C.+Properly+encode+relationships+in+constant+definitions

* "DCL09-C. Declare functions that return errno with a return type of errno_t":https://www.securecoding.cert.org/confluence/display/seccode/DCL09-C.+Declare+functions+that+return+errno+with+a+return+type+of+errno_t

* "DCL10-C. Maintain the contract between the writer and caller of variadic functions":https://www.securecoding.cert.org/confluence/display/seccode/DCL10-C.+Maintain+the+contract+between+the+writer+and+caller+of+variadic+functions

* "DCL11-C. Understand the type issues associated with variadic functions":https://www.securecoding.cert.org/confluence/display/seccode/DCL11-C.+Understand+the+type+issues+associated+with+variadic+functions

* "DCL16-C. Use 'L,' not 'l,' to indicate a long value":https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=19759250

* "DCL17-C. Beware of miscompiled volatile-qualified variables":https://www.securecoding.cert.org/confluence/display/seccode/DCL17-C.+Beware+of+miscompiled+volatile-qualified+variables

* "DCL21-C. Understand the storage of compound literals":https://www.securecoding.cert.org/confluence/display/seccode/DCL21-C.+Understand+the+storage+of+compound+literals

* "DCL30-C. Declare objects with appropriate storage durations":https://www.securecoding.cert.org/confluence/display/seccode/DCL30-C.+Declare+objects+with+appropriate+storage+durations

* "DCL34-C. Use volatile for data that cannot be cached":https://www.securecoding.cert.org/confluence/display/seccode/DCL34-C.+Use+volatile+for+data+that+cannot+be+cached

* "DCL37-C. Do not declare or define a reserved identifier":https://www.securecoding.cert.org/confluence/display/seccode/DCL37-C.+Do+not+declare+or+define+a+reserved+identifier

* "DCL39-C. Avoid information leak in structure padding":https://www.securecoding.cert.org/confluence/display/seccode/DCL39-C.+Avoid+information+leak+in+structure+padding

_No Adherence_

* "DCL00-C. Const-qualify immutable objects":https://www.securecoding.cert.org/confluence/display/seccode/DCL00-C.+Const-qualify+immutable+objects

* "DCL03-C. Use a static assertion to test the value of a constant expression":https://www.securecoding.cert.org/confluence/display/seccode/DCL03-C.+Use+a+static+assertion+to+test+the+value+of+a+constant+expression

* "DCL04-C. Do not declare more than one variable per declaration":https://www.securecoding.cert.org/confluence/display/seccode/DCL04-C.+Do+not+declare+more+than+one+variable+per+declaration

* "DCL13-C. Declare function parameters that are pointers to values not changed by the function as const ":https://www.securecoding.cert.org/confluence/display/seccode/DCL13-C.+Declare+function+parameters+that+are+pointers+to+values+not+changed+by+the+function+as+const

* "DCL32-C. Guarantee that mutually visible identifiers are unique":https://www.securecoding.cert.org/confluence/display/seccode/DCL32-C.+Guarantee+that+mutually+visible+identifiers+are+unique

h2. Expressions (EXP)

_Full Adherence_

* "EXP00-C. Use parentheses for precedence of operation":https://www.securecoding.cert.org/confluence/display/seccode/EXP00-C.+Use+parentheses+for+precedence+of+operation

* "EXP01-C. Do not take the size of a pointer to determine the size of the pointed-to type":https://www.securecoding.cert.org/confluence/display/seccode/EXP01-C.+Do+not+take+the+size+of+a+pointer+to+determine+the+size+of+the+pointed-to+type

* "EXP02-C. Be aware of the short-circuit behavior of the logical AND and OR operators":https://www.securecoding.cert.org/confluence/display/seccode/EXP02-C.+Be+aware+of+the+short-circuit+behavior+of+the+logical+AND+and+OR+operators

* "EXP03-C. Do not assume the size of a structure is the sum of the sizes of its members":https://www.securecoding.cert.org/confluence/display/seccode/EXP03-C.+Do+not+assume+the+size+of+a+structure+is+the+sum+of+the+sizes+of+its+members

* "EXP04-C. Do not perform byte-by-byte comparisons involving a structure":https://www.securecoding.cert.org/confluence/display/seccode/EXP04-C.+Do+not+perform+byte-by-byte+comparisons+involving+a+structure

* "EXP05-C. Do not cast away a const qualification":https://www.securecoding.cert.org/confluence/display/seccode/EXP04-C.+Do+not+perform+byte-by-byte+comparisons+involving+a+structure

* "EXP06-C. Operands to the sizeof operator should not contain side effects":https://www.securecoding.cert.org/confluence/display/seccode/EXP06-C.+Operands+to+the+sizeof+operator+should+not+contain+side+effects

* "EXP07-C. Do not diminish the benefits of constants by assuming their values in expressions":https://www.securecoding.cert.org/confluence/display/seccode/EXP07-C.+Do+not+diminish+the+benefits+of+constants+by+assuming+their+values+in+expressions

* "EXP08-C. Ensure pointer arithmetic is used correctly":https://www.securecoding.cert.org/confluence/display/seccode/EXP08-C.+Ensure+pointer+arithmetic+is+used+correctly

* "EXP09-C. Use sizeof to determine the size of a type or variable":https://www.securecoding.cert.org/confluence/display/seccode/EXP09-C.+Use+sizeof+to+determine+the+size+of+a+type+or+variable

* "EXP10-C. Do not depend on the order of evaluation of subexpressions or the order in which side effects take place":https://www.securecoding.cert.org/confluence/display/seccode/EXP10-C.+Do+not+depend+on+the+order+of+evaluation+of+subexpressions+or+the+order+in+which+side+effects+take+place

* "EXP12-C. Do not ignore values returned by functions":https://www.securecoding.cert.org/confluence/display/seccode/EXP12-C.+Do+not+ignore+values+returned+by+functions

* "EXP13-C. Treat relational and equality operators as if they were nonassociative":https://www.securecoding.cert.org/confluence/display/seccode/EXP13-C.+Treat+relational+and+equality+operators+as+if+they+were+nonassociative

* "EXP14-C. Beware of integer promotion when performing bitwise operations on integer types smaller than int":https://www.securecoding.cert.org/confluence/display/seccode/EXP14-C.+Beware+of+integer+promotion+when+performing+bitwise+operations+on+integer+types+smaller+than+int

* "EXP15-C. Do not place a semicolon on the same line as an if, for, or while statement":https://www.securecoding.cert.org/confluence/display/seccode/EXP15-C.+Do+not+place+a+semicolon+on+the+same+line+as+an+if%2C+for%2C+or+while+statement

* "EXP16-C. Do not compare function pointers to constant values":https://www.securecoding.cert.org/confluence/display/seccode/EXP16-C.+Do+not+compare+function+pointers+to+constant+values"

* "EXP18-C. Do not perform assignments in selection statements":https://www.securecoding.cert.org/confluence/display/seccode/EXP18-C.+Do+not+perform+assignments+in+selection+statements

* "EXP19-C. Use braces for the body of an if, for, or while statement":https://www.securecoding.cert.org/confluence/display/seccode/EXP19-C.+Use+braces+for+the+body+of+an+if%2C+for%2C+or+while+statement

* "EXP30-C. Do not depend on order of evaluation between sequence points":https://www.securecoding.cert.org/confluence/display/seccode/EXP30-C.+Do+not+depend+on+order+of+evaluation+between+sequence+points

* "EXP31-C. Avoid side effects in assertions":https://www.securecoding.cert.org/confluence/display/seccode/EXP31-C.+Avoid+side+effects+in+assertions

* "EXP33-C. Do not reference uninitialized memory":https://www.securecoding.cert.org/confluence/display/seccode/EXP33-C.+Do+not+reference+uninitialized+memory

* "EXP34-C. Do not dereference null pointers":https://www.securecoding.cert.org/confluence/display/seccode/EXP34-C.+Do+not+dereference+null+pointers

* "EXP35-C. Do not modify objects with temporary lifetime":https://www.securecoding.cert.org/confluence/display/seccode/EXP35-C.+Do+not+modify+objects+with+temporary+lifetime

* "EXP37-C. Call functions with the correct number and type of arguments":https://www.securecoding.cert.org/confluence/display/seccode/EXP37-C.+Call+functions+with+the+correct+number+and+type+of+arguments

* "EXP38-C. Do not call offsetof() on bit-field members or invalid types":https://www.securecoding.cert.org/confluence/display/seccode/EXP38-C.+Do+not+call+offsetof%28%29+on+bit-field+members+or+invalid+types

* "EXP40-C. Do not modify constant values":https://www.securecoding.cert.org/confluence/display/seccode/EXP40-C.+Do+not+modify+constant+values

_Partial Adherence_

* "EXP20-C. Perform explicit tests to determine success, true and false, and equality":https://www.securecoding.cert.org/confluence/display/seccode/EXP20-C.+Perform+explicit+tests+to+determine+success%2C+true+and+false%2C+and+equality

_Check Adherence_

* "EXP11-C. Do not make assumptions regarding the layout of structures with bit-fields":https://www.securecoding.cert.org/confluence/display/seccode/EXP11-C.+Do+not+make+assumptions+regarding+the+layout+of+structures+with+bit-fields

* "EXP17-C. Do not perform bitwise operations in conditional expressions":https://www.securecoding.cert.org/confluence/display/seccode/EXP17-C.+Do+not+perform+bitwise+operations+in+conditional+expressions

* "EXP32-C. Do not access a volatile object through a non-volatile reference":https://www.securecoding.cert.org/confluence/display/seccode/EXP32-C.+Do+not+access+a+volatile+object+through+a+non-volatile+reference

* "EXP36-C. Do not convert pointers into more strictly aligned pointer types":https://www.securecoding.cert.org/confluence/display/seccode/EXP36-C.+Do+not+convert+pointers+into+more+strictly+aligned+pointer+types

* "EXP39-C. Do not access a variable through a pointer of an incompatible type":https://www.securecoding.cert.org/confluence/display/seccode/EXP39-C.+Do+not+access+a+variable+through+a+pointer+of+an+incompatible+type

* "EXP41-C. Do not add or subtract a scaled integer to a pointer":https://www.securecoding.cert.org/confluence/display/seccode/EXP41-C.+Do+not+add+or+subtract+a+scaled+integer+to+a+pointer

_No Adherence_

* "EXP21-C. Place constants on the left of equality comparisons":https://www.securecoding.cert.org/confluence/display/seccode/EXP21-C.+Place+constants+on+the+left+of+equality+comparisons



h2. Integers (INT)

_Full Adherence_

* "INT00-C. Understand the data model used by your implementation(s)":https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=4374

* "INT01-C. Use rsize_t or size_t for all integer values representing the size of an object":https://www.securecoding.cert.org/confluence/display/seccode/INT01-C.+Use+rsize_t+or+size_t+for+all+integer+values+representing+the+size+of+an+object

* "INT02-C. Understand integer conversion rules":https://www.securecoding.cert.org/confluence/display/seccode/INT02-C.+Understand+integer+conversion+rules

* "INT04-C. Enforce limits on integer values originating from untrusted sources":https://www.securecoding.cert.org/confluence/display/seccode/INT04-C.+Enforce+limits+on+integer+values+originating+from+untrusted+sources

h2. Floating Point (FLP)

h2. Arrays (ARR)

h2. Characters and Strings (STR)

h2. Memory Management (MEM)

h2. Input Output (FIO)

h2. Environment (ENV)

h2. Signals (SIG)

h2. Error Handling (ERR)

h2. Application Programming Interfaces (API)

h2. Concurrency (CON)

h2. Miscellaneous (MSC)

h2. POSIX (POS)