1 /**************************************************************************** 2 * * 3 * cryptlib Configuration Settings * 4 * Copyright Peter Gutmann 1992-2014 * 5 * * 6 ****************************************************************************/ 7 8 #ifndef _CONFIG_DEFINED 9 10 #define _CONFIG_DEFINED 11 12 /**************************************************************************** 13 * * 14 * Custom Configuration Profiles * 15 * * 16 ****************************************************************************/ 17 18 /* The following defines can be used to enable specific specific cryptlib 19 profiles that only enable the functionality needed for one particular 20 application: 21 22 #define CONFIG_PROFILE_SMIME 23 #define CONFIG_PROFILE_PGP 24 #define CONFIG_PROFILE_SSL 25 #define CONFIG_PROFILE_SSH 26 27 The configuration is set up in the section "Application Profiles" at the 28 end of this file. Note that this sort of thing would normally be done by 29 the build command (e.g. in a makefile), the following is mostly intended 30 for debugging */ 31 32 #if 0 33 #define CONFIG_NO_CERTIFICATES 34 #define CONFIG_NO_DEVICES 35 #define CONFIG_NO_ENVELOPES 36 #define CONFIG_NO_KEYSETS 37 #define CONFIG_NO_SESSIONS 38 #if defined( _WIN32 ) && defined( _MSC_VER ) && ( _MSC_VER == 1200 ) 39 #define NO_OBSCURE_FEATURES 40 #endif /* Exception for testing rarely-used facilities under VC++ 6.0 */ 41 #endif /* 0 */ 42 43 /* The following configuration options can be used for custom builds of 44 cryptlib to fit constrained environments. Note that these builds 45 severely constrain the options available for cryptlib use, for example 46 removing certificate support and using CONFIG_USE_PSEUDOCERTIFICATES in 47 combination with CONFIG_PROFILE_SSL requires using a pre-encoded SSL/TLS 48 certificate chain with cryptCreateAttachedCert() to create the server's 49 key, since no certificate import or export capabilities are present */ 50 51 #if 0 /* Embedded SSL/TLS server */ 52 #define CONFIG_PROFILE_SSL 53 #define CONFIG_CONSERVE_MEMORY 54 #define CONFIG_NO_KEYSETS 55 #define CONFIG_NO_CERTIFICATES 56 #define CONFIG_NO_DEVICES 57 #define CONFIG_NO_ENVELOPES 58 #define CONFIG_USE_PSEUDOCERTIFICATES 59 #endif /* 0 */ 60 61 #if 0 /* Embedded SSL/TLS server with SCEP */ 62 #define CONFIG_CONSERVE_MEMORY 63 #define CONFIG_NO_CONTEXTS /* Only a few algorithms */ 64 #define USE_AES 65 #define USE_DH 66 #define USE_MD5 67 #define USE_RSA 68 #define USE_PKC 69 #define CONFIG_NO_CERTIFICATES /* Only basic certificates */ 70 #define USE_CERTIFICATES 71 #define USE_CERTLEVEL_STANDARD 72 #define USE_INT_ASN1 73 #define CONFIG_NO_DEVICES 74 #define CONFIG_NO_ENVELOPES /* Only CMS envelopes */ 75 #define USE_ENVELOPES 76 #define USE_CMS 77 #define USE_INT_CMS 78 #define CONFIG_NO_KEYSETS /* Only PKCS #15 keysets */ 79 //#define USE_KEYSETS 80 //#define USE_PKCS15 81 //#define USE_FILES 82 #define CONFIG_NO_SESSIONS /* Only SCEP sessions */ 83 #define USE_SESSIONS 84 #define USE_SSL 85 #define USE_SCEP 86 #endif /* 0 */ 87 88 /* The blanket low-memory configuration option changes other configuration 89 settings as well */ 90 91 #ifdef CONFIG_CONSERVE_MEMORY 92 #ifndef CONFIG_NUM_OBJECTS 93 #define CONFIG_NUM_OBJECTS 128 94 #endif /* CONFIG_NUM_OBJECTS */ 95 #ifndef CONFIG_PKC_ALLOCSIZE 96 #define CONFIG_PKC_ALLOCSIZE 256 97 #endif /* CONFIG_PKC_ALLOCSIZE */ 98 #endif /* CONFIG_CONSERVE_MEMORY */ 99 100 /* Some standard cryptlib settings can be overridden by user-set 101 configuration options */ 102 103 #ifdef CONFIG_PKC_ALLOCSIZE 104 #if CONFIG_PKC_ALLOCSIZE < 128 || CONFIG_PKC_ALLOCSIZE > 512 105 #error CONFIG_PKC_ALLOCSIZE must be between 128 and 512 (1024 to 4096 bits). 106 #endif /* CONFIG_PKC_ALLOCSIZE range check */ 107 #undef CRYPT_MAX_PKCSIZE 108 #define CRYPT_MAX_PKCSIZE CONFIG_PKC_ALLOCSIZE 109 #endif /* CONFIG_PKC_ALLOCSIZE */ 110 111 /**************************************************************************** 112 * * 113 * General Capabilities * 114 * * 115 ****************************************************************************/ 116 117 /* General capabilities that affect further config options */ 118 119 #if defined( __BEOS__ ) || defined( __CHORUS__ ) || \ 120 ( defined( __ECOS__ ) && defined( CYGPKG_NET ) ) || \ 121 defined( __MVS__ ) || defined( __Nucleus__ ) || \ 122 defined( __PALMOS__ ) || defined( __RTEMS__ ) || \ 123 defined( __SYMBIAN32__ ) || defined( __TANDEM_NSK__ ) || \ 124 defined( __TANDEM_OSS__ ) || defined( __UNIX__ ) || \ 125 defined( __VxWorks__ ) || defined( _WIN32 ) || \ 126 defined( _WIN64 ) || defined( _WIN32_WCE ) 127 #define USE_TCP 128 #endif /* Systems with TCP/IP networking available */ 129 130 /* Whether to use the RPC API or not. This provides total isolation of 131 input and output data, at the expense of some additional overhead due 132 to marshalling and unmarshalling */ 133 134 /* #define USE_RPCAPI */ 135 136 /* Whether to use FIPS 140 ACLs or not. Enabling this setting disables 137 all plaintext key loads. Note that this will cause several of the 138 self-tests, which assume that they can load keys directly, to fail */ 139 140 /* #define USE_FIPS140 */ 141 142 /* Whether to build the Java/JNI interface or not */ 143 144 /* #define USE_JAVA */ 145 146 /* Whether to provide descriptive text messages for errors or not. 147 Disabling these can reduce code size, at the expense of making error 148 diagnosis reliant solely on error codes */ 149 150 #ifndef CONFIG_CONSERVE_MEMORY 151 #define USE_ERRMSGS 152 #endif /* Low-memory builds */ 153 154 /* When certificates are disabled in order to reduce code size it may still 155 be necessary to be able to at least send out certificates in things like 156 SSL/TLS handshakes. The following define enables support for pseudo- 157 certificate objects, objects that support just enough of the required 158 certificate functionality to act as storage containers for encoded 159 certificate data that can be attached to messages */ 160 161 #ifdef CONFIG_USE_PSEUDOCERTIFICATES 162 #define USE_PSEUDOCERTIFICATES 163 #endif /* CONFIG_USE_PSEUDOCERTIFICATES */ 164 165 /**************************************************************************** 166 * * 167 * Contexts * 168 * * 169 ****************************************************************************/ 170 171 #ifndef CONFIG_NO_CONTEXTS 172 173 /* The umbrella define USE_PATENTED_ALGORITHMS can be used to drop all 174 patented algorithms (currently no patented algorithms are left), 175 USE_DEPRECATED_ALGORITHMS can be used to drop deprecated (obsolete or 176 weak) algorithms, and USE_OBSCURE_ALGORITHMS can be used to drop little- 177 used algorithms. Technically both DES and MD5 are also deprecated but 178 they're still so widely used that it's not really possible to drop them */ 179 180 #if 0 181 #define USE_DEPRECATED_ALGORITHMS 182 #endif /* 0 */ 183 #ifndef CONFIG_CONSERVE_MEMORY 184 #define USE_PATENTED_ALGORITHMS 185 #define USE_OBSCURE_ALGORITHMS 186 #endif /* Low-memory builds */ 187 188 /* Patented algorithms */ 189 190 #ifdef USE_PATENTED_ALGORITHMS 191 #endif /* Use of patented algorithms */ 192 193 /* Obsolete and/or weak algorithms, disabled by default. There are some 194 algorithms that are never enabled, among them KEA (which never gained any 195 real acceptance, and in any case when it was finally analysed by Kristin 196 Lauter and Anton Mityagin was found to have a variety of problems) and 197 MD2 and MD4 (which are either completely broken or obsolete/never used 198 any more) */ 199 200 #ifdef USE_DEPRECATED_ALGORITHMS 201 #define USE_DES 202 #define USE_RC2 203 #define USE_RC4 204 #endif /* Obsolete and/or weak algorithms */ 205 206 /* Obscure algorithms */ 207 208 #ifdef USE_OBSCURE_ALGORITHMS 209 #define USE_ELGAMAL 210 #define USE_IDEA 211 #endif /* Obscure algorithms */ 212 213 /* Problematic algorithms that can cause issues due to memory/code size (for 214 example AES-GCM uses eight times as much memory as straight AES, and 215 that's for the variant with the small lookup tables, and the ECC 216 algorithms have a sizeable code and memory footprint) or because the 217 cryptosystems are brittle and problematic (the ECC algorithms and GCM 218 again) */ 219 220 #ifdef USE_PROBLEMATIC_ALGORITHMS 221 #define USE_ECDH 222 #define USE_ECDSA 223 #define USE_GCM 224 #endif /* Problematic algorithms */ 225 226 /* Other algorithms. Note that DES/3DES, AES, SHA1 and SHA2 are always 227 enabled as they're either used internally by cryptlib or used by all 228 cryptlib protocols/mechanisms */ 229 230 #define USE_DH 231 #define USE_DSA 232 #define USE_MD5 233 #define USE_RSA 234 235 /* As part of the SHA-1 deprecation in 2016, a number of CAs and sites 236 skipped the obvious SHA-256 and went to SHA-384 or even SHA-512 237 because they wanted hash functions that go to 11 or even 12. In order 238 to support this nonsense we unfortunately have to enable the extended 239 SHA-2's by default */ 240 241 #define USE_SHA2_EXT 242 243 /* General PKC context usage */ 244 245 #if defined( USE_DH ) || defined( USE_DSA ) || defined( USE_ELGAMAL ) || \ 246 defined( USE_RSA ) || defined( USE_ECDH ) || defined( USE_ECDSA ) 247 #define USE_PKC 248 #endif /* PKC types */ 249 250 #endif /* CONFIG_NO_CONTEXTS */ 251 252 /**************************************************************************** 253 * * 254 * Certificates * 255 * * 256 ****************************************************************************/ 257 258 #ifndef CONFIG_NO_CERTIFICATES 259 260 /* The certificate-processing code is so deeply intertwingled (almost all of 261 the code to manipulate certificate attributes is shared, with only a few 262 certificate type-specific routines) that it's quite difficult to separate 263 out individual sections so all that we can provide is the ability to 264 enable/disable general classes of certificate object */ 265 266 #define USE_CERTIFICATES 267 #define USE_CERTREV /* CRL, OCSP */ 268 #define USE_CERTVAL /* RTCS */ 269 #define USE_CERTREQ /* PKCS #10, CRMF */ 270 #define USE_CMSATTR /* CMS attributes */ 271 #define USE_PKIUSER /* pkiUser */ 272 273 /* Another side-effect of the complexity of the certificate-handling code is 274 that it carries around a large amount of code that's required in order to 275 support processing of bizarro attributes that no-one ever uses and whose 276 sole effect is to weaken the overall code by vastly increasing its attack 277 surface. The following defines can be used to control the maximum level 278 of compliance in the certificate-handling code. To enable use at 279 compliance level n it's necessary to have the values for level 0...n-1 280 defined as well, this makes checking in the code cleaner. Compliance 281 levels _OBLIVIOUS, _REDUCED, and _STANDARD are assumed by default, levels 282 _PKIX_PARTIAL and _PKIX_FULL need to be explicitly enabled. _PKIX_PARTIAL 283 enables a few extra attributes and extra checking that are skipped in 284 _STANDARD, in most cases there'll be no noticeable difference between 285 _STANDARD and _PKIX_PARTIAL so unless you specifically need it you can 286 disable it to save space and code complexity. _PKIX_FULL on the other 287 hand enables a large number of additional attributes and checks, 288 including ones that enforce downright bizarre requirements set by the 289 standards. Unless you understand the implications of this (or you need 290 to pass some sort of external compliance test) you shouldn't enable this 291 level of processing since all it does is increase the code size and 292 attack surface, complicate processing, and (if triggered) produce results 293 that can be quite counterintuitive unless you really understand the 294 peculiarities in the standards */ 295 296 #if !defined( USE_CERTLEVEL_PKIX_FULL ) && \ 297 !defined( USE_CERTLEVEL_PKIX_PARTIAL ) && \ 298 !defined( USE_CERTLEVEL_STANDARD ) 299 #define USE_CERTLEVEL_PKIX_PARTIAL /* Default level is PKIX_PARTIAL */ 300 #endif /* PKIX compliance level */ 301 #if defined( USE_CERTLEVEL_PKIX_FULL ) && !defined( USE_CERTLEVEL_PKIX_PARTIAL ) 302 /* USE_CERTLEVEL_PKIX_FULL implies USE_CERTLEVEL_PKIX_PARTIAL */ 303 #define USE_CERTLEVEL_PKIX_PARTIAL 304 #endif /* USE_CERTLEVEL_PKIX_FULL && !USE_CERTLEVEL_PKIX_PARTIAL */ 305 306 /* Certificates can be given to us in base64-encoded form, so we need to 307 enable base64 decoding to deal with them */ 308 309 #define USE_BASE64 310 311 /* Certificates need ASN.1 support */ 312 313 #if defined( USE_CERTIFICATES ) && !defined( USE_INT_ASN1 ) 314 #define USE_INT_ASN1 315 #endif /* USE_CERTIFICATES && !USE_INT_ASN1 */ 316 317 /* If we're using pseudo-certificates then we can't also use full 318 certificates */ 319 320 #if defined( USE_PSEUDOCERTIFICATES ) && defined( USE_CERTIFICATES ) 321 #error Cant use both full certificates and pseudocertificates at the same time 322 #endif /* USE_PSEUDOCERTIFICATES && USE_CERTIFICATES */ 323 324 /* The following are used to control handling of obscure certificate and CMS 325 attributes like qualified certificates, SigG certificates, CMS receipts, 326 security labels, and AuthentiCode, and completely obsolete certificate 327 attributes like the old Thawte and Netscape certificate extensions. These 328 are disabled by default */ 329 330 #if 0 331 #define USE_CERT_OBSCURE 332 #define USE_CMSATTR_OBSCURE 333 #define USE_CERT_OBSOLETE 334 #endif /* 0 */ 335 336 /* Finally, we provide the ability to disable various complex and therefore 337 error-prone mechanisms that aren't likely to see much use. By default 338 these are disabled */ 339 340 #if 0 341 #define USE_CERT_DNSTRING 342 #endif /* 0 */ 343 344 #if ( defined( USE_CERTIFICATES ) || defined( USE_PSEUDOCERTIFICATES ) ) && \ 345 !defined( USE_PKC ) 346 #error Use of certificates requires use of PKC algorithms to be enabled 347 #endif /* USE_CERTIFICATES && !USE_PKC */ 348 349 #endif /* CONFIG_NO_CERTIFICATES */ 350 351 /**************************************************************************** 352 * * 353 * Devices * 354 * * 355 ****************************************************************************/ 356 357 #ifndef CONFIG_NO_DEVICES 358 359 /* Device types. PKCS #11 can also be enabled under Unix by the auto-config 360 mechanism, which sets HAS_PKCS11 if PKCS #11 support is available */ 361 362 #if defined( __WIN32__ ) 363 #define USE_PKCS11 364 #if !defined( NDEBUG ) 365 #define USE_HARDWARE 366 #endif /* Windows debug mode only */ 367 #endif /* __WIN32__ */ 368 #ifdef HAS_PKCS11 369 #define USE_PKCS11 370 #endif /* PKCS #11 under Unix autoconfig */ 371 #if defined( USE_PKCS11 ) || defined( USE_CRYPTOAPI ) 372 #define USE_DEVICES 373 #endif /* Device types */ 374 375 #endif /* CONFIG_NO_DEVICES */ 376 377 /**************************************************************************** 378 * * 379 * Enveloping * 380 * * 381 ****************************************************************************/ 382 383 #ifndef CONFIG_NO_ENVELOPES 384 385 #define USE_CMS 386 #define USE_PGP 387 388 #if defined( USE_CMS ) || defined( USE_PGP ) 389 #define USE_ENVELOPES 390 #endif /* Enveloping types */ 391 392 /* CMS envelopes require CMS data formats and compression support */ 393 394 #if defined( USE_CMS ) && !defined( USE_INT_CMS ) 395 /* CMS enveloping requires CMS data format support */ 396 #define USE_INT_CMS 397 #define USE_COMPRESSION 398 #endif /* USE_CMS */ 399 400 /* PGP envelopes require Elgamal, CAST, and compression support. Note that 401 we don't force USE_IDEA for PGP (even though the patents have expired and 402 it's freely usable) since this should now hopefully be extinct */ 403 404 #if defined( USE_PGP ) 405 #ifndef USE_ELGAMAL 406 /* OpenPGP requires ElGamal */ 407 #define USE_ELGAMAL 408 #endif /* !USE_ELGAMAL */ 409 #ifndef USE_CAST 410 /* Some OpenPGP implementations still (!!) default to CAST5 */ 411 #define USE_CAST 412 #endif /* !USE_CAST */ 413 #ifndef USE_COMPRESSION 414 /* Decoding PGP messages from other implementations requires 415 compression support */ 416 #define USE_COMPRESSION 417 #endif /* !USE_COMPRESSION */ 418 #endif /* OpenPGP-specific algorithms */ 419 420 /* Envelopes require PKC algorithms (they can be done with symmetric 421 algorithms only, but it's rather unikely that anyone will be doing 422 this) */ 423 424 #if defined( USE_ENVELOPES ) && !defined( USE_PKC ) 425 #error Use of envelopes requires use of PKC algorithms to be enabled 426 #endif /* USE_ENVELOPES && !USE_PKC */ 427 428 #endif /* CONFIG_NO_ENVELOPES */ 429 430 /**************************************************************************** 431 * * 432 * Keysets * 433 * * 434 ****************************************************************************/ 435 436 #ifndef CONFIG_NO_KEYSETS 437 438 /* File keysets */ 439 440 /* By uncommenting the following PKCS #12 define or enabling equivalent 441 functionality in any other manner you acknowledge that you are disabling 442 safety features in the code and take full responbility for any 443 consequences arising from this action. You also indemnify the cryptlib 444 authors against all actions, claims, losses, costs, and expenses that 445 may be suffered or incurred and that may have arisen directly or 446 indirectly as a result of any use of cryptlib with this change made. If 447 you receive the code with the safety features already disabled, you must 448 immediately obtain and use an original, unmodified version */ 449 /* #define USE_PKCS12 */ 450 451 #define USE_PKCS15 452 #define USE_PGPKEYS 453 454 #if defined( USE_PKCS15 ) && !defined( USE_INT_CMS ) 455 /* PKCS #15 needs CMS support for iCryptImport/ExportKey() */ 456 #define USE_INT_CMS 457 #endif /* USE_PKCS15 && !USE_INT_CMS */ 458 #if defined( USE_PGPKEYS ) && !defined( USE_CAST ) 459 /* Some OpenPGP implementations still (!!) default to CAST5 */ 460 #define USE_CAST 461 #endif /* USE_PGPKEYS && !USE_CAST */ 462 #ifdef USE_PKCS12 463 /* If we use PKCS #12 then we have to enable RC2 in order to handle 464 Microsoft's continuing use of RC2-40 */ 465 #define USE_RC2 466 #endif /* USE_PKCS12 */ 467 #if ( defined( USE_PKCS15 ) || defined( USE_PGPKEYS ) ) && \ 468 !defined( USE_FILES ) 469 /* PKCS #15/PGP keysets need file I/O support */ 470 #define USE_FILES 471 #endif /* ( USE_PKCS15 || USE_PGPKEYS ) && !USE_FILES */ 472 473 #if defined( USE_PGPKEYS ) || defined( USE_PKCS15 ) 474 #ifndef USE_PKC 475 #error Use of PGP/PKCS #15 keysets requires use of PKC algorithms to be enabled 476 #endif /* USE_PKC */ 477 #endif /* USE_PGPKEYS || USE_PKCS15 */ 478 479 /* Database keysets. ODBC can also be enabled under Unix by the auto-config 480 mechanism, which sets HAS_ODBC if ODBC support is available */ 481 482 #if defined( __WIN32__ ) && !defined( NT_DRIVER ) 483 #if !( defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x550 ) ) 484 #define USE_ODBC 485 #endif /* Old Borland C++ */ 486 #endif /* Windows */ 487 #ifdef HAS_ODBC 488 #define USE_ODBC 489 #endif /* ODBC under Unix autoconfig */ 490 #if defined( USE_ODBC ) || defined( USE_DATABASE ) || \ 491 defined( USE_DATABASE_PLUGIN ) 492 #define USE_DBMS 493 #endif /* RDBMS types */ 494 495 /* If we're using a database keyset then we need to be able to encode binary 496 identifiers as text, which requires the use of base64 encoding */ 497 498 #if defined( USE_DBMS ) 499 #define USE_BASE64 500 #endif /* USE_BASE64 */ 501 502 /* Network keysets. LDAP can also be enabled under Unix by the auto-config 503 mechanism, which sets HAS_LDAP if LDAP support is available. 504 505 Note that LDAP is disabled by default because of its very large attack 506 surface, you should only enable this if it's absolutely essential. Your 507 security guarantee is void when you do this */ 508 509 #if defined( __WIN32__ ) && \ 510 !( defined( NT_DRIVER ) || defined( WIN_DDK ) || \ 511 defined( __BORLANDC__ ) ) && 0 512 #define USE_LDAP 513 #endif /* Windows */ 514 #if defined( HAS_LDAP ) && 0 515 #define USE_LDAP 516 #endif /* LDAP under Unix autoconfig */ 517 #ifdef USE_TCP 518 #define USE_HTTP 519 #endif /* TCP/IP networking */ 520 521 /* General keyset usage */ 522 523 #if defined( USE_DBMS ) || defined( USE_HTTP ) || defined( USE_LDAP ) || \ 524 defined( USE_PGPKEYS ) || defined( USE_PKCS12 ) || defined( USE_PKCS15 ) 525 #define USE_KEYSETS 526 #endif /* Keyset types */ 527 528 #endif /* CONFIG_NO_KEYSETS */ 529 530 /**************************************************************************** 531 * * 532 * Sessions * 533 * * 534 ****************************************************************************/ 535 536 #ifndef CONFIG_NO_SESSIONS 537 538 #define USE_CERTSTORE 539 #define USE_CMP 540 #define USE_RTCS 541 #define USE_OCSP 542 #define USE_SCEP 543 #define USE_SSH 544 #define USE_SSL 545 #define USE_TSP 546 547 #if defined( USE_CERTSTORE ) || defined( USE_CMP ) || defined( USE_RTCS ) || \ 548 defined( USE_OCSP ) || defined( USE_SCEP ) || defined( USE_SSH ) || \ 549 defined( USE_SSL ) || defined( USE_TSP ) 550 #define USE_SESSIONS 551 #endif /* Session types */ 552 553 /* We can't use secure sessions if there's no networking available */ 554 555 #ifndef USE_TCP 556 #error Use of secure sessions requires the use of TCP/IP 557 #endif /* !USE_TCP */ 558 559 /* Make sure that prerequisites are met for sessions that require 560 certificate components. We can only check these if there's no specific 561 session-based profile defined, because a profile for (for example) SSH 562 enables sessions, but only the SSH session and not any others, which 563 means that the dependency checks will produce false positives */ 564 565 #if !defined( CONFIG_PROFILE_SSH ) && !defined( CONFIG_PROFILE_SSL ) 566 #if defined( USE_CERTSTORE ) && !defined( USE_CERTIFICATES ) 567 #error Use of a certificate store requires use of certificates to be enabled 568 #endif /* USE_CERTSTORE && !USE_CERTIFICATES */ 569 #if defined( USE_CMP ) && !defined( USE_CERTREQ ) 570 #error Use of CMP requires use of certificate requests to be enabled 571 #endif /* USE_CMP && !USE_CERTREQ */ 572 #if defined( USE_RTCS ) && !( defined( USE_CERTVAL ) && defined( USE_CMSATTR ) ) 573 /* RTCS needs CRYPT_CERTINFO_CMS_NONCE */ 574 #error Use of RTCS requires use of certificate validation and CMS attributes to be enabled 575 #endif /* USE_RTCS && !( USE_CERTVAL && USE_CMSATTR ) */ 576 #if defined( USE_OCSP ) && !defined( USE_CERTREV ) 577 #error Use of OCSP requires use of certificate revocation to be enabled 578 #endif /* USE_OCSP && !USE_CERTREV */ 579 #if defined( USE_SCEP ) && !( defined( USE_CERTREQ ) && defined( USE_CMSATTR ) ) 580 /* SCEP needs CRYPT_CERTINFO_CHALLENGEPASSWORD for PKCS #10 requests and 581 CRYPT_CERTINFO_SCEP_xyz for CMS attributes */ 582 #error Use of SCEP requires use of certificate requests and CMS attributes to be enabled 583 #endif /* USE_SCEP && !( USE_CERTREQ && USE_CMSATTR ) */ 584 #if defined( USE_SSL ) && !defined( USE_CERTIFICATES ) 585 #error Use of SSL requires use of certificates to be enabled 586 #endif /* USE_SSL && !USE_CERTIFICATES */ 587 #if defined( USE_TSP ) && !defined( USE_CMSATTR ) 588 /* TSP requires CRYPT_CERTINFO_CMS_SIGNINGCERT_ESSCERTID */ 589 #error Use of TSP requires use of CMS attributes to be enabled 590 #endif /* USE_TSP && !USE_CERTIFICATES */ 591 #endif /* !CONFIG_PROFILE_SSH && !CONFIG_PROFILE_SSL */ 592 593 /* General session usage */ 594 595 #if defined( USE_SESSIONS ) && !defined( USE_PKC ) 596 #error Use of secure sessions requires use of PKC algorithms to be enabled 597 #endif /* USE_SESSIONS && !USE_PKC */ 598 599 /* If we're using SCEP then we need to deal with broken servers that require 600 the use of a POST disguised as a GET, for which we need to base64-encode 601 the binary data that we're sending */ 602 603 #if defined( USE_SCEP ) 604 #define USE_BASE64 605 #endif /* USE_SCEP */ 606 607 /* Finally, we provide the ability to disable various complex and therefore 608 error-prone mechanisms that aren't likely to see much use. By default 609 these are disabled */ 610 611 #if 0 612 #define USE_SSH_EXTENDED 613 #endif /* 0 */ 614 615 #endif /* CONFIG_NO_SESSIONS */ 616 617 /**************************************************************************** 618 * * 619 * OS Services and Resources * 620 * * 621 ****************************************************************************/ 622 623 /* Threads */ 624 625 #if defined( __AMX__ ) || defined( __ARINC653__ ) || defined( __BEOS__ ) || \ 626 defined( __CHORUS__ ) || defined( __CMSIS__ ) || defined( __ECOS__ ) || \ 627 defined( __EmbOS__ ) || defined( __FreeRTOS__ ) || defined( __ITRON__ ) || \ 628 defined( __MQX__ ) || defined( __Nucleus__ ) || defined( __OS2__ ) || \ 629 defined( __PALMOS__ ) || defined( __RTEMS__ ) || defined( __SMX__ ) || \ 630 defined( __ThreadX__ ) || defined( __TKernel__ ) || defined( __UCOS__ ) || \ 631 defined( __VDK__ ) || defined( __VxWorks__ ) || defined( __WIN32__ ) || \ 632 defined( __WINCE__ ) || defined( __XMK__ ) 633 #define USE_THREADS 634 #endif /* Non-Unix systems with threads */ 635 636 #ifdef __UNIX__ 637 #if !( ( defined( __QNX__ ) && ( OSVERSION <= 4 ) ) || \ 638 ( defined( sun ) && ( OSVERSION <= 4 ) ) || defined( __TANDEM ) ) 639 #define USE_THREADS 640 #endif 641 #endif /* Unix systems with threads */ 642 643 #ifdef NO_THREADS 644 /* Allow thread use to be overridden by the user if required */ 645 #undef USE_THREADS 646 #endif /* NO_THREADS */ 647 648 /* Widechars */ 649 650 #if defined( __Android__ ) || defined( __BEOS__ ) || defined( __ECOS__ ) || \ 651 defined( __MSDOS32__ ) || defined( __OS2__ ) || defined( __RTEMS__ ) || \ 652 defined( __TI_COMPILER_VERSION__ ) || \ 653 ( ( defined( __WIN32__ ) || defined( __WINCE__ ) ) && \ 654 !( defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x500 ) ) ) || \ 655 defined( __XMK__ ) 656 #define USE_WIDECHARS 657 #endif /* Non-Unix systems with widechars */ 658 659 #ifdef __UNIX__ 660 #if !( ( defined( __APPLE__ ) && OSVERSION < 7 ) || \ 661 defined( __bsdi__ ) || defined( __OpenBSD__ ) || \ 662 ( defined( __SCO_VERSION__ ) && OSVERSION < 5 ) || \ 663 ( defined( sun ) && OSVERSION < 5 ) || \ 664 defined( __SYMBIAN32__ ) ) 665 #define USE_WIDECHARS 666 #endif 667 #endif /* Unix systems with widechars */ 668 669 /* Embedded OSes are a bit of a special case in that they're usually cross- 670 compiled, which means that we can't just pick up the native defines and 671 headers and go with those. To help handle things like conditional 672 includes we define a special symbol used to indicate a non-native cross- 673 compile. Note that this is distinct from specific embedded OSes like 674 WinCE and PalmOS which are treated as OSes in their own right, while all 675 USE_EMBEDDED_OS OSes are a single amorphous blob */ 676 677 #if defined( __AMX__ ) || defined( __Android__ ) || defined( __ARINC653__ ) || \ 678 defined( __CHORUS__ ) || defined( __CMSIS__ ) || defined( __ECOS__ ) || \ 679 defined( __EmbOS__ ) || defined( __FreeRTOS__ ) || defined( __ITRON__ ) || \ 680 defined( __MQX__ ) || defined( __RTEMS__ ) || defined( __ThreadX__ ) || \ 681 defined( __TKernel__ ) || defined( __UCOS__ ) || defined( __VDK__ ) || \ 682 defined( __VxWorks__ ) || defined( __XMK__ ) 683 #define USE_EMBEDDED_OS 684 #endif /* Embedded OSes */ 685 686 /* If it's an embededd OS there probably won't be much in the way of entropy 687 sources available so we enable the use of the random seed file by 688 default */ 689 690 #if defined( USE_EMBEDDED_OS ) && !defined( CONFIG_RANDSEED ) 691 #define CONFIG_RANDSEED 692 #endif /* USE_EMBEDDED_OS && !CONFIG_RANDSEED */ 693 694 /* Networking. DNS SRV is very rarely used and somewhat risky to leave 695 enabled by default because the high level of complexity of DNS packet 696 parsing combined with the primitiveness of some of the APIs (specifically 697 the Unix ones) make it a bit risky to leave enabled by default, so we 698 disabled it by default for attack surface reduction */ 699 700 #if defined( USE_TCP ) && \ 701 ( defined( __WINDOWS__ ) || defined( __UNIX__ ) ) && 0 702 #define USE_DNSSRV 703 #endif /* Windows || Unix */ 704 705 /* If we're on a particularly slow or fast CPU we disable or enable certain 706 processor-intensive operations. In the absence of any easy compile-time 707 metric we define the following: 708 709 Slow: All 16-bit CPUs 710 Fast: All 64-bit CPUs. Windows PCs. 711 712 This isn't perfect, but is a reasonable approximation */ 713 714 #if defined( SYSTEM_16BIT ) 715 #define CONFIG_SLOW_CPU 716 #elif defined( SYSTEM_64BIT ) || defined( __WINDOWS__ ) 717 #define CONFIG_FAST_CPU 718 #endif /* Approximation of CPU speeds */ 719 720 /**************************************************************************** 721 * * 722 * Internal/Low-level Formats * 723 * * 724 ****************************************************************************/ 725 726 /* The CMS data format requires the use of ASN.1 */ 727 728 #if defined( USE_INT_CMS ) && !defined( USE_INT_ASN1 ) 729 #define USE_INT_ASN1 730 #endif /* USE_INT_CMS && !USE_INT_ASN1 */ 731 732 /**************************************************************************** 733 * * 734 * Application Profiles * 735 * * 736 ****************************************************************************/ 737 738 /* The following profiles can be used to enable specific functionality for 739 applications like SSL, SSH, and S/MIME */ 740 741 #if defined( CONFIG_PROFILE_SMIME ) || defined( CONFIG_PROFILE_PGP ) || \ 742 defined( CONFIG_PROFILE_SSH ) || defined( CONFIG_PROFILE_SSL ) 743 744 /* Contexts */ 745 #undef USE_CAST 746 #undef USE_DES 747 #undef USE_ELGAMAL 748 #undef USE_IDEA 749 #undef USE_RC2 750 #undef USE_RC4 751 752 /* Certificates */ 753 #undef USE_CERTREV 754 #undef USE_CERTVAL 755 #undef USE_CERTREQ 756 #undef USE_PKIUSER 757 758 /* Devices */ 759 #undef USE_CRYPTOAPI 760 #undef USE_HARDWARE 761 #undef USE_PKCS11 762 #undef USE_DEVICES 763 764 /* Keysets */ 765 #undef USE_DBMS 766 #undef USE_HTTP 767 #undef USE_LDAP 768 #undef USE_ODBC 769 770 /* Misc */ 771 #undef USE_BASE64 772 773 /* Sessions */ 774 #undef USE_CERTSTORE 775 #undef USE_CMP 776 #undef USE_OCSP 777 #undef USE_RTCS 778 #undef USE_SCEP 779 #undef USE_TSP 780 #undef USE_DNSSRV 781 782 #endif /* Application-specific profiles */ 783 784 #ifdef CONFIG_PROFILE_SSL 785 /* Contexts */ 786 #undef USE_DSA 787 788 /* Certificates */ 789 #undef USE_CMSATTR 790 791 /* Envelopes */ 792 #undef USE_ENVELOPES 793 #undef USE_CMS 794 #undef USE_PGP 795 #undef USE_COMPRESSION 796 797 /* Keysets */ 798 #undef USE_PGPKEYS 799 800 /* Sessions */ 801 #undef USE_SSH 802 803 /* Internal data formats */ 804 #undef USE_INT_CMS 805 806 #endif /* CONFIG_PROFILE_SSL */ 807 808 #ifdef CONFIG_PROFILE_SSH 809 /* Contexts */ 810 #undef USE_DSA 811 812 /* Certificates */ 813 #undef USE_CERTIFICATES 814 #undef USE_CMSATTR 815 816 /* Envelopes */ 817 #undef USE_ENVELOPES 818 #undef USE_CMS 819 #undef USE_PGP 820 #undef USE_COMPRESSION 821 822 /* Keysets */ 823 #undef USE_PGPKEYS 824 825 /* Sessions */ 826 #undef USE_SSL 827 828 /* Internal data formats */ 829 #undef USE_INT_CMS 830 831 #endif /* CONFIG_PROFILE_SSH */ 832 833 #ifdef CONFIG_PROFILE_SMIME 834 835 /* Contexts */ 836 #undef USE_DH 837 #undef USE_DSA 838 839 /* Envelopes */ 840 #undef USE_PGP 841 842 /* Keysets */ 843 #undef USE_PGPKEYS 844 845 /* Sessions */ 846 #undef USE_SSH 847 #undef USE_SSL 848 #undef USE_TCP 849 #undef USE_SESSIONS 850 851 #endif /* CONFIG_PROFILE_SSH */ 852 853 #ifdef CONFIG_PROFILE_PGP 854 855 /* Contexts */ 856 #undef USE_DH 857 #define USE_ELGAMAL /* Re-enable algorithms that nothing else uses */ 858 #define USE_CAST 859 860 /* Certificages */ 861 #undef USE_CERTIFICATES 862 863 /* Envelopes */ 864 #undef USE_CMS 865 866 /* Sessions */ 867 #undef USE_SSH 868 #undef USE_SSL 869 #undef USE_TCP 870 #undef USE_SESSIONS 871 872 /* Internal data formats */ 873 #undef USE_INT_CMS 874 #undef USE_INT_ASN1 875 876 #endif /* CONFIG_PROFILE_SSH */ 877 878 /**************************************************************************** 879 * * 880 * Fixups for Build Dependencies * 881 * * 882 ****************************************************************************/ 883 884 /* Some of the high-level configuration options above retroactively affect 885 the availability of low-level options. For example USE_SESSIONS can't be 886 enabled unless USE_TCP is already defined, but then if USE_SESSIONS 887 isn't defined then there's no need for USE_TCP any more. The following 888 fixups handle situations like this */ 889 890 /* If use of ASN.1 isn't enabled then we can't use the DLP signature 891 algorithms, which need ASN.1 support to write the signature format. 892 Technically this isn't quite true since we could be writing the signature 893 in SSL/TLS or SSH format, but the self-test uses the ASN.1 format, and we 894 assume that a build that includes SSL/TLS or SSH will also include the 895 ASN.1 capabilities for things like private key storage */ 896 897 #ifndef USE_INT_ASN1 898 #ifdef USE_DSA 899 #undef USE_DSA 900 #endif /* USE_DSA */ 901 #ifdef USE_ELGAMAL 902 #undef USE_ELGAMAL 903 #endif /* USE_ELGAMAL */ 904 #ifdef USE_ECDSA 905 #undef USE_ECDSA 906 #endif /* USE_ECDSA */ 907 #endif /* USE_INT_ASN1 */ 908 909 /* If sessions or HTTP keysets aren't being used then there's no need for 910 TCP networking */ 911 912 #if !defined( USE_SESSIONS ) && !( defined( USE_KEYSETS ) && defined( USE_HTTP ) ) 913 #ifdef USE_TCP 914 #undef USE_TCP 915 #endif /* USE_TCP */ 916 #endif /* USE_SESSIONS */ 917 918 /**************************************************************************** 919 * * 920 * Defines for Testing and Custom Builds * 921 * * 922 ****************************************************************************/ 923 924 /* Unsafe or obsolete facilities that are disabled by default, except in the 925 Win32 debug build under VC++ 6.0 or the Win64 debug build under VS 2015. 926 We have to be careful with the preprocessor checks because the high-level 927 feature-checking defines and macros are only available if osspec.h is 928 included, which it won't be at this level */ 929 930 #if defined( _WIN32 ) && !defined( NDEBUG ) && defined( _MSC_VER ) && \ 931 ( ( _MSC_VER == 1200 ) || ( _MSC_VER == 1900 && defined( _M_X64 ) ) ) && \ 932 !defined( NO_OBSCURE_FEATURES ) && \ 933 !( defined( __WINCE__ ) || defined( CONFIG_PROFILE_SMIME ) || \ 934 defined( CONFIG_PROFILE_PGP ) || defined( CONFIG_PROFILE_SSH ) || \ 935 defined( CONFIG_PROFILE_SSL ) ) 936 #define USE_CERT_DNSTRING 937 #define USE_CRYPTOAPI 938 #define USE_ECDH 939 #define USE_ECDSA 940 #define USE_GCM 941 #define USE_SHA2_EXT 942 #define USE_LDAP 943 #define USE_OAEP 944 #define USE_PKCS12 945 #define USE_RC2 /* Needed for PKCS #12 */ 946 #ifdef USE_TCP 947 #define USE_SSL3 948 #define USE_SSH_EXTENDED 949 #define USE_DNSSRV 950 #endif /* USE_TCP */ 951 #define USE_PGP2 952 #endif /* Win32 debug build under VC++ 6.0 */ 953 954 /* If we're using a static analyser then we also enable some additional 955 functionality to allow the analyser to check it */ 956 957 #if ( defined( _MSC_VER ) && defined( _PREFAST_ ) ) || \ 958 ( defined( __clang_analyzer__ ) ) || \ 959 ( defined( USE_ANALYSER ) ) 960 #define USE_CERT_DNSTRING 961 #define USE_DNSSRV 962 #define USE_ECDH 963 #define USE_ECDSA 964 #define USE_GCM 965 #if defined( _PREFAST_ ) || defined( __clang_analyzer__ ) 966 #define USE_LDAP 967 #endif /* Analysers on development machines */ 968 #define USE_OAEP 969 #define USE_PKCS12 970 #define USE_RC2 971 #define USE_SSH_EXTENDED 972 #define USE_DNSSRV 973 #define USE_PGP2 974 #endif /* Static analyser builds */ 975 976 /* If we're using Suite B we have to explicitly enable certain algorithms, 977 including extended forms of SHA-2 */ 978 979 #if defined( CONFIG_SUITEB_TESTS ) && !defined( CONFIG_SUITEB ) 980 #define CONFIG_SUITEB 981 #endif /* CONFIG_SUITEB_TESTS && !CONFIG_SUITEB */ 982 #if defined( CONFIG_SUITEB ) 983 #define USE_ECDH 984 #define USE_ECDSA 985 #define USE_GCM 986 #define USE_SHA2_EXT 987 #endif /* Suite B */ 988 989 /* Rather than making everything even more complex and conditional than it 990 already is, it's easier to undefine the features that we don't want in 991 one place rather than trying to conditionally enable them */ 992 993 #if 0 /* Devices */ 994 #undef USE_PKCS11 995 #undef USE_CRYPTOAPI 996 #endif /* 0 */ 997 #if 0 /* Heavyweight keysets */ 998 #undef USE_HTTP 999 #undef USE_LDAP 1000 #undef USE_ODBC 1001 #undef USE_DBMS 1002 #endif /* 0 */ 1003 #if 0 /* Networking */ 1004 #undef USE_CERTSTORE 1005 #undef USE_TCP 1006 #undef USE_CMP 1007 #undef USE_HTTP 1008 #undef USE_RTCS 1009 #undef USE_OCSP 1010 #undef USE_SCEP 1011 #undef USE_SSH 1012 #undef USE_SSL 1013 #undef USE_TSP 1014 #undef USE_SESSIONS 1015 #endif /* 0 */ 1016 #if 0 /* Verbose error messages */ 1017 #undef USE_ERRMSGS 1018 #endif /* 0 */ 1019 1020 #endif /* _CONFIG_DEFINED */ 1021