SoylentNews

Auditable Macros in C Code

posted by martyb on Saturday December 02 2017, @01:48PM   
from the see-what-we-did-there? dept.

An Anonymous Coward writes:

https://www.cossacklabs.com/blog/macros-in-crypto-c-code.html

Like death and taxes, one thing that you can be sure of is that using C macros in a modern software project will cause a debate. While for some macros remain a convenient and efficient way of achieving particular programming goals, for others they are opaque, introduce the unnecessary risk of coding errors, and reduce readability.

The criticism of macros is particularly acute in the wider security community. Among Cossack Labs' engineers and the core Themis crypto library contributors there are people who previously worked on auditing cryptographic implementations of critical code. Their typical knee-jerk reaction to macros was always "kill it with fire and never use it again". Taking no sides, we would like to assess both pros and cons of using such dangerous things as macros in security code (as we faced the issue when developing Themis) and suggest some techniques for lowering the accompanying risks.

We'll also discuss a custom "for-audit" build target for Themis designed specifically to generate source code that exposes the macros to inspection because we appreciate the need for security software to be subject to detailed source code scrutiny.

---

Original Submission

• Re:Still can't pass __FILE__ and __LINE__ Re:Still can't pass __FILE__ and __LINE__ (Score: 2) by Pino P on Sunday December 03 2017, @05:28PM (1 child)

  by Pino P (4721) on Sunday December 03 2017, @05:28PM (#604721) Journal

  Instead of using macros for the last case, you could use separate files:

  // index1_pv_amd64.c
  static inline size_t index1_pv(size_t n) __attribute__((always_inline))
      {
          if (rpnx_unlikely(n==0)) return 0;
          else
              {
                  size_t i;
                  asm("bsrq %1,%0\n" : "=r"(i) : "r"(n));
                  return i;
              }

  // index1_pv_pure.c
  static inline size_t index1_pv(size_t n) __attribute__((always_inline))
      {
          int i = 0; while ((1 << i)

  Then the x86-64 target would compile and link the _amd64 source files, while other targets would use the pure C file.

  Parent

  Starting Score:	1		point
  Karma-Bonus Modifier		+1
  Total Score:		2

• Re:Still can't pass __FILE__ and __LINE__ (Score: 2) by arcz on Saturday December 09 2017, @05:03PM

  by arcz (4501) on Saturday December 09 2017, @05:03PM (#607716) Journal

  One of the few things I hate more than macros are complex build systems.
  Also that code needed to be inlinable so it had to go in a header. Platform specific headers would be a nightmare.

  Parent