Introduced a PRIVATE(member) macro, to make accessing

private structures' members a bit harder.

Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>

include/mbedtls/md.h

@@ -33,6 +33,12 @@
 #include MBEDTLS_CONFIG_FILE
 #endif
 
+#ifndef ALLOW_PRIVATE_ACCESS
+#define MBEDTLS_PRIVATE(member) private_##member
+#else
+#define MBEDTLS_PRIVATE(member) member
+#endif
+
 #define MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE                -0x5080  /**< The selected feature is not available. */
 #define MBEDTLS_ERR_MD_BAD_INPUT_DATA                     -0x5100  /**< Bad input parameters to function. */
 #define MBEDTLS_ERR_MD_ALLOC_FAILED                       -0x5180  /**< Failed to allocate memory. */
@@ -99,7 +105,7 @@ typedef struct mbedtls_md_context_t
     const mbedtls_md_info_t *md_info;
 
     /** The digest-specific context. */
-    void *md_ctx;
+    void *MBEDTLS_PRIVATE(md_ctx);
 
     /** The HMAC part of the context. */
     void *hmac_ctx;

include/psa/crypto_extra.h

@@ -71,7 +71,7 @@ static inline void psa_set_key_enrollment_algorithm(
     psa_key_attributes_t *attributes,
     psa_algorithm_t alg2)
 {
-    attributes->core.policy.alg2 = alg2;
+    attributes->PSA_PRIVATE(core).policy.alg2 = alg2;
 }
 
 /** Retrieve the enrollment algorithm policy from key attributes.
@@ -83,7 +83,7 @@ static inline void psa_set_key_enrollment_algorithm(
 static inline psa_algorithm_t psa_get_key_enrollment_algorithm(
     const psa_key_attributes_t *attributes)
 {
-    return( attributes->core.policy.alg2 );
+    return( attributes->PSA_PRIVATE(core).policy.alg2 );
 }
 
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
@@ -141,7 +141,7 @@ static inline void psa_set_key_slot_number(
     psa_key_attributes_t *attributes,
     psa_key_slot_number_t slot_number )
 {
-    attributes->core.flags |= MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER;
+    attributes->PSA_PRIVATE(core).flags |= MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER;
     attributes->slot_number = slot_number;
 }
 
@@ -154,7 +154,7 @@ static inline void psa_set_key_slot_number(
 static inline void psa_clear_key_slot_number(
     psa_key_attributes_t *attributes )
 {
-    attributes->core.flags &= ~MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER;
+    attributes->PSA_PRIVATE(core).flags &= ~MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER;
 }
 
 /** Register a key that is already present in a secure element.

include/psa/crypto_struct.h

@@ -326,9 +326,17 @@ typedef struct
 
 #define PSA_CORE_KEY_ATTRIBUTES_INIT {PSA_KEY_TYPE_NONE, 0, PSA_KEY_LIFETIME_VOLATILE, MBEDTLS_SVC_KEY_ID_INIT, PSA_KEY_POLICY_INIT, 0}
 
+
+#ifndef ALLOW_PRIVATE_ACCESS
+#define PSA_PRIVATE(member) private_##member
+#else
+#define PSA_PRIVATE(member) member
+#endif
+
+
 struct psa_key_attributes_s
 {
-    psa_core_key_attributes_t core;
+    psa_core_key_attributes_t PSA_PRIVATE(core);
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
     psa_key_slot_number_t slot_number;
 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
@@ -351,13 +359,13 @@ static inline struct psa_key_attributes_s psa_key_attributes_init( void )
 static inline void psa_set_key_id( psa_key_attributes_t *attributes,
                                    mbedtls_svc_key_id_t key )
 {
-    psa_key_lifetime_t lifetime = attributes->core.lifetime;
+    psa_key_lifetime_t lifetime = attributes->PSA_PRIVATE(core).lifetime;
 
-    attributes->core.id = key;
+    attributes->PSA_PRIVATE(core).id = key;
 
     if( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
     {
-        attributes->core.lifetime =
+        attributes->PSA_PRIVATE(core).lifetime =
             PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
                 PSA_KEY_LIFETIME_PERSISTENT,
                 PSA_KEY_LIFETIME_GET_LOCATION( lifetime ) );
@@ -367,59 +375,59 @@ static inline void psa_set_key_id( psa_key_attributes_t *attributes,
 static inline mbedtls_svc_key_id_t psa_get_key_id(
     const psa_key_attributes_t *attributes)
 {
-    return( attributes->core.id );
+    return( attributes->PSA_PRIVATE(core).id );
 }
 
 #ifdef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
 static inline void mbedtls_set_key_owner_id( psa_key_attributes_t *attributes,
                                              mbedtls_key_owner_id_t owner )
 {
-    attributes->core.id.owner = owner;
+    attributes->PSA_PRIVATE(core).id.owner = owner;
 }
 #endif
 
 static inline void psa_set_key_lifetime(psa_key_attributes_t *attributes,
                                         psa_key_lifetime_t lifetime)
 {
-    attributes->core.lifetime = lifetime;
+    attributes->PSA_PRIVATE(core).lifetime = lifetime;
     if( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
     {
 #ifdef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
-        attributes->core.id.key_id = 0;
+        attributes->PSA_PRIVATE(core).id.key_id = 0;
 #else
-        attributes->core.id = 0;
+        attributes->PSA_PRIVATE(core).id = 0;
 #endif
     }
 }
 
 static inline psa_key_lifetime_t psa_get_key_lifetime(
     const psa_key_attributes_t *attributes)
 {
-    return( attributes->core.lifetime );
+    return( attributes->PSA_PRIVATE(core).lifetime );
 }
 
 static inline void psa_set_key_usage_flags(psa_key_attributes_t *attributes,
                                            psa_key_usage_t usage_flags)
 {
-    attributes->core.policy.usage = usage_flags;
+    attributes->PSA_PRIVATE(core).policy.usage = usage_flags;
 }
 
 static inline psa_key_usage_t psa_get_key_usage_flags(
     const psa_key_attributes_t *attributes)
 {
-    return( attributes->core.policy.usage );
+    return( attributes->PSA_PRIVATE(core).policy.usage );
 }
 
 static inline void psa_set_key_algorithm(psa_key_attributes_t *attributes,
                                          psa_algorithm_t alg)
 {
-    attributes->core.policy.alg = alg;
+    attributes->PSA_PRIVATE(core).policy.alg = alg;
 }
 
 static inline psa_algorithm_t psa_get_key_algorithm(
     const psa_key_attributes_t *attributes)
 {
-    return( attributes->core.policy.alg );
+    return( attributes->PSA_PRIVATE(core).policy.alg );
 }
 
 /* This function is declared in crypto_extra.h, which comes after this
@@ -435,7 +443,7 @@ static inline void psa_set_key_type(psa_key_attributes_t *attributes,
     if( attributes->domain_parameters == NULL )
     {
         /* Common case: quick path */
-        attributes->core.type = type;
+        attributes->PSA_PRIVATE(core).type = type;
     }
     else
     {
@@ -450,22 +458,22 @@ static inline void psa_set_key_type(psa_key_attributes_t *attributes,
 static inline psa_key_type_t psa_get_key_type(
     const psa_key_attributes_t *attributes)
 {
-    return( attributes->core.type );
+    return( attributes->PSA_PRIVATE(core).type );
 }
 
 static inline void psa_set_key_bits(psa_key_attributes_t *attributes,
                                     size_t bits)
 {
     if( bits > PSA_MAX_KEY_BITS )
-        attributes->core.bits = PSA_KEY_BITS_TOO_LARGE;
+        attributes->PSA_PRIVATE(core).bits = PSA_KEY_BITS_TOO_LARGE;
     else
-        attributes->core.bits = (psa_key_bits_t) bits;
+        attributes->PSA_PRIVATE(core).bits = (psa_key_bits_t) bits;
 }
 
 static inline size_t psa_get_key_bits(
     const psa_key_attributes_t *attributes)
 {
-    return( attributes->core.bits );
+    return( attributes->PSA_PRIVATE(core).bits );
 }
 
 #ifdef __cplusplus

library/CMakeLists.txt

@@ -113,6 +113,8 @@ set(src_tls
     ssl_tls13_keys.c
 )
 
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DALLOW_PRIVATE_ACCESS")
+
 if(CMAKE_COMPILER_IS_GNUCC)
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wmissing-declarations -Wmissing-prototypes")
 endif(CMAKE_COMPILER_IS_GNUCC)

library/Makefile

@@ -39,6 +39,8 @@ LOCAL_CFLAGS += -fPIC -fpic
 endif
 endif
 
+LOCAL_CFLAGS += -DALLOW_PRIVATE_ACCESS
+
 SOEXT_TLS=so.13
 SOEXT_X509=so.1
 SOEXT_CRYPTO=so.6

programs/Makefile

@@ -92,6 +92,7 @@ APPS = \
 	ssl/ssl_server2$(EXEXT) \
 	test/benchmark$(EXEXT) \
 	test/query_compile_time_config$(EXEXT) \
+	test/private_access_test$(EXEXT) \
 	test/selftest$(EXEXT) \
 	test/udp_proxy$(EXEXT) \
 	test/zeroize$(EXEXT) \
@@ -320,6 +321,10 @@ test/udp_proxy$(EXEXT): test/udp_proxy.c $(DEP)
 	echo "  CC    test/udp_proxy.c"
 	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) test/udp_proxy.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
+test/private_access_test$(EXEXT): test/private_access_test.c $(DEP)
+	echo "  CC    test/private_access_test.c"
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) test/private_access_test.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
+
 test/zeroize$(EXEXT): test/zeroize.c $(DEP)
 	echo "  CC    test/zeroize.c"
 	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) test/zeroize.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@

programs/test/CMakeLists.txt

@@ -9,6 +9,7 @@ endif(USE_PKCS11_HELPER_LIBRARY)
 set(executables_libs
     selftest
     udp_proxy
+    private_access_test
 )
 
 set(executables_mbedcrypto

programs/test/private_access_test.c

@@ -0,0 +1,46 @@
+/*
+ *  Test applicaiton access to private library components (struct members).
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "mbedtls/md.h"
+#include "psa/crypto.h"
+#include "psa/crypto_types.h"
+#include "psa/crypto_struct.h"
+
+int main( void )
+{
+    /* using static inline function */
+    psa_key_attributes_t local_crypto_struct = psa_key_attributes_init();
+    mbedtls_svc_key_id_t id =
+        mbedtls_svc_key_id_make( 0, 0 );
+    psa_set_key_id(&local_crypto_struct, id);
+
+    /* accessing private member using MBEDTLS_PRIVATE() macro */
+    mbedtls_md_context_t md_ctx;
+    mbedtls_md_init( &md_ctx );
+    const char* t = "A";
+    md_ctx.MBEDTLS_PRIVATE(md_ctx) = (void*)t;
+
+    /* accessing private member without MBEDTLS_PRIVATE() macro - compilation wil fail */
+    // md_ctx.md_ctx = t;
+
+    exit( 0 );
+}

scripts/data_files/vs2010-main-template.vcxproj

@@ -82,7 +82,7 @@
     <ClCompile>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>ALLOW_PRIVATE_ACCESS;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <AdditionalIncludeDirectories>
 INCLUDE_DIRECTORIES
       </AdditionalIncludeDirectories>
@@ -97,7 +97,7 @@ INCLUDE_DIRECTORIES
     <ClCompile>
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>ALLOW_PRIVATE_ACCESS;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <AdditionalIncludeDirectories>
 INCLUDE_DIRECTORIES
       </AdditionalIncludeDirectories>
@@ -114,7 +114,7 @@ INCLUDE_DIRECTORIES
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>true</IntrinsicFunctions>
-      <PreprocessorDefinitions>NDEBUG;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>ALLOW_PRIVATE_ACCESS;NDEBUG;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <AdditionalIncludeDirectories>
 INCLUDE_DIRECTORIES
       </AdditionalIncludeDirectories>
@@ -132,7 +132,7 @@ INCLUDE_DIRECTORIES
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>true</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN64;NDEBUG;_WINDOWS;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>ALLOW_PRIVATE_ACCESS;WIN64;NDEBUG;_WINDOWS;_USRDLL;MBEDTLS_EXPORTS;KRML_VERIFIED_UINT128;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <AdditionalIncludeDirectories>
 INCLUDE_DIRECTORIES
       </AdditionalIncludeDirectories>

tests/CMakeLists.txt

@@ -59,6 +59,8 @@ function(add_test_suite suite_name)
     endif()
 endfunction(add_test_suite)
 
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DALLOW_PRIVATE_ACCESS")
+
 if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-unused-function")
 endif(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_CLANG)

tests/Makefile

@@ -37,6 +37,8 @@ ifdef RECORD_PSA_STATUS_COVERAGE_LOG
 LOCAL_CFLAGS += -Werror -DRECORD_PSA_STATUS_COVERAGE_LOG
 endif
 
+LOCAL_CFLAGS += -DALLOW_PRIVATE_ACCESS
+
 # if we're running on Windows, build for Windows
 ifdef WINDOWS
 WINDOWS_BUILD=1

visualc/VS2010/mbedTLS.sln

@@ -208,6 +208,11 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "query_compile_time_config",
 		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
 	EndProjectSection
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "private_access_test", "private_access_test.vcxproj", "{41939CBD-578A-0689-0419-1562C56BE429}"
+	ProjectSection(ProjectDependencies) = postProject
+		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
+	EndProjectSection
+EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "selftest", "selftest.vcxproj", "{7DBC5F77-3DA1-5F73-8421-E693D95FC66A}"
 	ProjectSection(ProjectDependencies) = postProject
 		{46CF2D25-6A36-4189-B59C-E4815388E554} = {46CF2D25-6A36-4189-B59C-E4815388E554}
@@ -602,6 +607,14 @@ Global
 		{D6F58AF2-9D80-562A-E2B0-F743281522B9}.Release|Win32.Build.0 = Release|Win32
 		{D6F58AF2-9D80-562A-E2B0-F743281522B9}.Release|x64.ActiveCfg = Release|x64
 		{D6F58AF2-9D80-562A-E2B0-F743281522B9}.Release|x64.Build.0 = Release|x64
+		{41939CBD-578A-0689-0419-1562C56BE429}.Debug|Win32.ActiveCfg = Debug|Win32
+		{41939CBD-578A-0689-0419-1562C56BE429}.Debug|Win32.Build.0 = Debug|Win32
+		{41939CBD-578A-0689-0419-1562C56BE429}.Debug|x64.ActiveCfg = Debug|x64
+		{41939CBD-578A-0689-0419-1562C56BE429}.Debug|x64.Build.0 = Debug|x64
+		{41939CBD-578A-0689-0419-1562C56BE429}.Release|Win32.ActiveCfg = Release|Win32
+		{41939CBD-578A-0689-0419-1562C56BE429}.Release|Win32.Build.0 = Release|Win32
+		{41939CBD-578A-0689-0419-1562C56BE429}.Release|x64.ActiveCfg = Release|x64
+		{41939CBD-578A-0689-0419-1562C56BE429}.Release|x64.Build.0 = Release|x64
 		{7DBC5F77-3DA1-5F73-8421-E693D95FC66A}.Debug|Win32.ActiveCfg = Debug|Win32
 		{7DBC5F77-3DA1-5F73-8421-E693D95FC66A}.Debug|Win32.Build.0 = Debug|Win32
 		{7DBC5F77-3DA1-5F73-8421-E693D95FC66A}.Debug|x64.ActiveCfg = Debug|x64