Explicitly export public API

Makefile

@@ -271,6 +271,9 @@ endif
 # strict checks for docs
 #CFLAGS += -Wdocumentation -Wno-error=documentation
 
+# Explicitly list all exports
+CFLAGS += -fvisibility=hidden
+
 # fixing compatibility between x64 0.9.6 and x64 0.10.0
 # https://github.com/cossacklabs/themis/pull/279
 ifeq ($(NO_SCELL_COMPAT),)

Themis.xcodeproj/project.pbxproj

@@ -398,6 +398,8 @@
 		9F4A24C2223A8FA8005CB63A /* smessage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = smessage.h; path = "src/wrappers/themis/Obj-C/objcthemis/smessage.h"; sourceTree = "<group>"; };
 		9F4A24C3223A8FA8005CB63A /* scell_token.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = scell_token.h; path = "src/wrappers/themis/Obj-C/objcthemis/scell_token.h"; sourceTree = "<group>"; };
 		9FBD853C223BFB5E009EAEB3 /* openssl.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = openssl.framework; path = Carthage/Build/iOS/openssl.framework; sourceTree = "<group>"; };
+		9FD4C3522260D41700132A88 /* soter_api.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = soter_api.h; path = src/soter/soter_api.h; sourceTree = "<group>"; };
+		9FD4C3532260D43B00132A88 /* themis_api.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = themis_api.h; path = src/themis/themis_api.h; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -443,6 +445,7 @@
 			children = (
 				9F4A23A6223A742F005CB63A /* ed25519 */,
 				9F4A2383223A740E005CB63A /* openssl */,
+				9FD4C3522260D41700132A88 /* soter_api.h */,
 				9F4A2343223A73B0005CB63A /* soter_asym_cipher.h */,
 				9F4A234B223A73B0005CB63A /* soter_asym_ka.h */,
 				9F4A2350223A73B1005CB63A /* soter_asym_sign.h */,
@@ -589,6 +592,7 @@
 				9F4A242D223A74AF005CB63A /* secure_session.h */,
 				9F4A2431223A74AF005CB63A /* sym_enc_message.c */,
 				9F4A242B223A74AF005CB63A /* sym_enc_message.h */,
+				9FD4C3532260D43B00132A88 /* themis_api.h */,
 				9F4A242F223A74AF005CB63A /* themis_error.h */,
 				9F4A2433223A74AF005CB63A /* themis.h */,
 			);

src/soter/boringssl/soter_asym_cipher.c

@@ -20,6 +20,7 @@
 #include <openssl/rsa.h>
 
 #include "soter/boringssl/soter_engine.h"
+#include "soter/soter_api.h"
 #include "soter/soter_rsa_key.h"
 
 #define OAEP_HASH_SIZE 20
@@ -70,6 +71,7 @@ soter_status_t soter_asym_cipher_import_key(soter_asym_cipher_t* asym_cipher_ctx
 
 /* Padding is ignored. We use OAEP by default. Parameter is to support more paddings in the future
  */
+SOTER_PRIVATE_API
 soter_status_t soter_asym_cipher_init(soter_asym_cipher_t* asym_cipher,
                                       const void* key,
                                       const size_t key_length,
@@ -102,6 +104,7 @@ soter_status_t soter_asym_cipher_init(soter_asym_cipher_t* asym_cipher,
     return SOTER_SUCCESS;
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_asym_cipher_cleanup(soter_asym_cipher_t* asym_cipher)
 {
     if (!asym_cipher) {

src/soter/boringssl/soter_asym_ka.c

@@ -19,6 +19,7 @@
 #include <openssl/ec.h>
 
 #include "soter/boringssl/soter_engine.h"
+#include "soter/soter_api.h"
 #include "soter/soter_ec_key.h"
 
 static int soter_alg_to_curve_nid(soter_asym_ka_alg_t alg)
@@ -31,6 +32,7 @@ static int soter_alg_to_curve_nid(soter_asym_ka_alg_t alg)
     }
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_asym_ka_init(soter_asym_ka_t* asym_ka_ctx, soter_asym_ka_alg_t alg)
 {
     EVP_PKEY* pkey;
@@ -70,6 +72,7 @@ soter_status_t soter_asym_ka_init(soter_asym_ka_t* asym_ka_ctx, soter_asym_ka_al
     return SOTER_SUCCESS;
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_asym_ka_cleanup(soter_asym_ka_t* asym_ka_ctx)
 {
     if (!asym_ka_ctx) {

src/soter/boringssl/soter_hash.c

@@ -19,6 +19,7 @@
 #include <openssl/evp.h>
 
 #include "soter/boringssl/soter_engine.h"
+#include "soter/soter_api.h"
 
 static const EVP_MD* soter_algo_to_evp_md(soter_hash_algo_t algo)
 {
@@ -32,6 +33,7 @@ static const EVP_MD* soter_algo_to_evp_md(soter_hash_algo_t algo)
     }
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_hash_init(soter_hash_ctx_t* hash_ctx, soter_hash_algo_t algo)
 {
     const EVP_MD* md = soter_algo_to_evp_md(algo);

src/soter/ed25519/fe.h

@@ -4,6 +4,8 @@
 /* #include "crypto_int32.h" */
 #include <stdint.h>
 
+#include <soter/soter_api.h>
+
 typedef int32_t crypto_int32;
 typedef int64_t crypto_int64;
 typedef uint32_t crypto_uint32;

src/soter/ed25519/fe_isnonzero.c

@@ -9,6 +9,7 @@ return 0 if f != 0
    |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
 */
 
+SOTER_PRIVATE_API
 int crypto_verify_32(const unsigned char *x,const unsigned char *y)
 {
   unsigned int differentbits = 0;
@@ -48,6 +49,7 @@ int crypto_verify_32(const unsigned char *x,const unsigned char *y)
   return (1 & ((differentbits - 1) >> 8)) - 1;
 }
 
+SOTER_PRIVATE_API
 int fe_isnonzero(const fe f)
 {
   static const unsigned char zero[32] = {0};

src/soter/ed25519/fe_neg.c

@@ -10,6 +10,7 @@ h = -f
    |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
 */
 
+SOTER_PRIVATE_API
 void fe_neg(fe h,const fe f)
 {
   crypto_int32 f0 = f[0];

src/soter/ed25519/fe_tobytes.c

@@ -25,6 +25,7 @@ Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
   so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q.
 */
 
+SOTER_PRIVATE_API
 void fe_tobytes(unsigned char *s,const fe h)
 {
   crypto_int32 h0 = h[0];

src/soter/ed25519/ge.h

@@ -15,6 +15,8 @@ where d = -121665/121666.
   ge_precomp (Duif): (y+x,y-x,2dxy)
 */
 
+#include <soter/soter_api.h>
+
 #include "fe.h"
 
 typedef struct {

src/soter/ed25519/ge_cmp.c

@@ -18,6 +18,7 @@
 #include <string.h>
 #include <stdint.h>
 
+SOTER_PRIVATE_API
 int ge_cmp(const ge_p3 *a, const ge_p3 *b)
 {
 	unsigned char a_comp[ED25519_GE_LENGTH];

src/soter/ed25519/ge_double_scalarmult.c

@@ -43,6 +43,7 @@ and b = b[0]+256*b[1]+...+256^31 b[31].
 B is the Ed25519 base point (x,4/5) with x positive.
 */
 
+SOTER_PRIVATE_API
 void ge_double_scalarmult_vartime(ge_p2 *r,const unsigned char *a,const ge_p3 *A,const unsigned char *b)
 {
   signed char aslide[256];

src/soter/ed25519/ge_frombytes_no_negate.c

@@ -16,6 +16,7 @@
 
 #include "ge_utils.h"
 
+SOTER_PRIVATE_API
 int ge_frombytes_vartime(ge_p3 *h, const unsigned char *s)
 {
 	int res = ge_frombytes_negate_vartime(h, s);

src/soter/ed25519/ge_p2_to_p3.c

@@ -16,6 +16,7 @@
 
 #include "ge_utils.h"
 
+SOTER_PRIVATE_API
 void ge_p2_to_p3(ge_p3 *r, const ge_p2 *p)
 {
 	if (p != (const ge_p2 *)r)

src/soter/ed25519/ge_p3_sub.c

@@ -16,6 +16,7 @@
 
 #include "ge_utils.h"
 
+SOTER_PRIVATE_API
 void ge_p3_sub(ge_p3 *r, const ge_p3 *p, const ge_p3 *q)
 {
 	ge_cached q_cached;

src/soter/ed25519/ge_p3_tobytes.c

@@ -1,5 +1,6 @@
 #include "ge.h"
 
+SOTER_PRIVATE_API
 void ge_p3_tobytes(unsigned char *s,const ge_p3 *h)
 {
   fe recip;

src/soter/ed25519/ge_scalarmult.c

@@ -16,6 +16,7 @@
 
 #include "ge_utils.h"
 
+SOTER_PRIVATE_API
 void ge_scalarmult_blinded(ge_p3 *r, const unsigned char *a, const ge_p3 *A)
 {
 	unsigned char rnd[32];

src/soter/ed25519/ge_scalarmult_base.c

@@ -61,6 +61,7 @@ B is the Ed25519 base point (x,4/5) with x positive.
   a[31] <= 127
 */
 
+SOTER_PRIVATE_API
 void ge_scalarmult_base(ge_p3 *h,const unsigned char *a)
 {
   signed char e[64];

src/soter/ed25519/ge_tobytes.c

@@ -1,5 +1,6 @@
 #include "ge.h"
 
+SOTER_PRIVATE_API
 void ge_tobytes(unsigned char *s,const ge_p2 *h)
 {
   fe recip;

src/soter/ed25519/ge_utils.h

@@ -19,6 +19,8 @@
 #ifndef GE_UTILS_H
 #define GE_UTILS_H
 
+#include <soter/soter_api.h>
+
 #include "ge.h"
 
 #define ED25519_GE_LENGTH 32

src/soter/ed25519/gen_rand_32.c

@@ -17,13 +17,15 @@
 #include "ge_utils.h"
 #include <soter/soter.h>
 
+SOTER_PRIVATE_API
 void clip_random_32(unsigned char *r)
 {
     r[0] &= 248;
     r[31] &= 63;
     r[31] |= 64;
 }
 
+SOTER_PRIVATE_API
 void generate_random_32(unsigned char *r)
 {
 	soter_status_t res = soter_rand(r, ED25519_GE_LENGTH);

src/soter/ed25519/sc.h

@@ -1,6 +1,8 @@
 #ifndef SC_H
 #define SC_H
 
+#include <soter/soter_api.h>
+
 /*
 The set of scalars is \Z/l
 where l = 2^252 + 27742317777372353535851937790883648493.

src/soter/ed25519/sc_muladd.c

@@ -34,6 +34,7 @@ static crypto_uint64 load_4(const unsigned char *in)
   where l = 2^252 + 27742317777372353535851937790883648493.
 */
 
+SOTER_PRIVATE_API
 void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,const unsigned char *c)
 {
   crypto_int64 a0 = 2097151 & load_3(a);

src/soter/ed25519/sc_reduce.c

@@ -33,6 +33,7 @@ static crypto_uint64 load_4(const unsigned char *in)
   Overwrites s in place.
 */
 
+SOTER_PRIVATE_API
 void sc_reduce(unsigned char *s)
 {
   crypto_int64 s0 = 2097151 & load_3(s);

src/soter/openssl/soter_asym_cipher.c

@@ -20,6 +20,7 @@
 #include <openssl/rsa.h>
 
 #include "soter/openssl/soter_engine.h"
+#include "soter/soter_api.h"
 #include "soter/soter_rsa_key.h"
 
 /* We use only SHA1 for now */
@@ -71,6 +72,7 @@ soter_status_t soter_asym_cipher_import_key(soter_asym_cipher_t* asym_cipher_ctx
 
 /* Padding is ignored. We use OAEP by default. Parameter is to support more paddings in the future
  */
+SOTER_PRIVATE_API
 soter_status_t soter_asym_cipher_init(soter_asym_cipher_t* asym_cipher,
                                       const void* key,
                                       const size_t key_length,
@@ -106,6 +108,7 @@ soter_status_t soter_asym_cipher_init(soter_asym_cipher_t* asym_cipher,
     return SOTER_SUCCESS;
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_asym_cipher_cleanup(soter_asym_cipher_t* asym_cipher)
 {
     if (!asym_cipher) {

src/soter/openssl/soter_asym_ka.c

@@ -19,6 +19,7 @@
 #include <openssl/ec.h>
 
 #include "soter/openssl/soter_engine.h"
+#include "soter/soter_api.h"
 #include "soter/soter_ec_key.h"
 
 static int soter_alg_to_curve_nid(soter_asym_ka_alg_t alg)
@@ -31,6 +32,7 @@ static int soter_alg_to_curve_nid(soter_asym_ka_alg_t alg)
     }
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_asym_ka_init(soter_asym_ka_t* asym_ka_ctx, soter_asym_ka_alg_t alg)
 {
     EVP_PKEY* pkey;
@@ -80,6 +82,7 @@ soter_status_t soter_asym_ka_init(soter_asym_ka_t* asym_ka_ctx, soter_asym_ka_al
     return SOTER_SUCCESS;
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_asym_ka_cleanup(soter_asym_ka_t* asym_ka_ctx)
 {
     if (!asym_ka_ctx) {

src/soter/openssl/soter_hash.c

@@ -19,6 +19,7 @@
 #include <openssl/evp.h>
 
 #include "soter/openssl/soter_engine.h"
+#include "soter/soter_api.h"
 
 static const EVP_MD* soter_algo_to_evp_md(soter_hash_algo_t algo)
 {
@@ -32,6 +33,7 @@ static const EVP_MD* soter_algo_to_evp_md(soter_hash_algo_t algo)
     }
 }
 
+SOTER_PRIVATE_API
 soter_status_t soter_hash_init(soter_hash_ctx_t* hash_ctx, soter_hash_algo_t algo)
 {
     const EVP_MD* md = soter_algo_to_evp_md(algo);

src/soter/soter.mk

@@ -42,6 +42,8 @@ FMT_CHECK += $(patsubst %,$(OBJ_PATH)/%.fmt_check, $(SOTER_FMT_SRC))
 
 SOTER_STATIC = $(BIN_PATH)/$(LIBSOTER_A) $(SOTER_ENGINE_DEPS)
 
+$(SOTER_OBJ): CFLAGS += -DSOTER_EXPORT
+
 $(BIN_PATH)/$(LIBSOTER_A): CMD = $(AR) rcs $@ $(filter %.o, $^)
 
 $(BIN_PATH)/$(LIBSOTER_A): $(SOTER_OBJ)

src/soter/soter_api.h

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2019 Cossack Labs Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SOTER_API_H
+#define SOTER_API_H
+
+#if defined(__GNUC__) || defined(__clang__)
+#define SOTER_API __attribute__((visibility("default")))
+#elif defined(_WIN32) || defined(_WIN64) || defined(__CYGWIN__)
+#ifdef SOTER_EXPORT
+#define SOTER_API __declspec(dllexport)
+#else
+#define SOTER_API __declspec(dllimport)
+#endif
+#else
+#define SOTER_API
+#endif
+
+/*
+ * Marks API that needs to be exported for technical reasons, but otherwise
+ * is not intended for user consumption.
+ */
+#define SOTER_PRIVATE_API SOTER_API
+
+#endif /* SOTER_API_H */