#ifdef SQLITE_HAS_CODEC

#include "sqlcipher.h"

#include "crypto.h"

#ifdef SQLCIPHER_TEST

static volatile unsigned int cipher_test_flags = 0;

unsigned int sqlcipher_get_test_flags() {

return cipher_test_flags;

}

void sqlcipher_set_test_flags(unsigned int flags) {

cipher_test_flags = flags;

}

static volatile int cipher_test_rand = 0;

int sqlcipher_get_test_rand() {

return cipher_test_rand;

}

void sqlcipher_set_test_rand(int rand) {

cipher_test_rand = rand;

}

int sqlcipher_get_test_fail() {

int x;

/* if cipher_test_rand is not set to a non-zero value always fail (return true) */

if (cipher_test_rand == 0) return 1;

sqlite3_randomness(sizeof(x), &x);

return ((x % cipher_test_rand) == 0);

}

static volatile unsigned int default_flags = DEFAULT_CIPHER_FLAGS;

static volatile unsigned char hmac_salt_mask = HMAC_SALT_MASK;

static volatile int default_kdf_iter = PBKDF2_ITER;

static volatile int default_page_size = 4096;

static volatile int default_plaintext_header_sz = 0;

static volatile int default_hmac_algorithm = SQLCIPHER_HMAC_SHA512;

static volatile int default_kdf_algorithm = SQLCIPHER_PBKDF2_HMAC_SHA512;

static volatile int sqlcipher_mem_security_on = 0;

static volatile int sqlcipher_mem_executed = 0;

static volatile int sqlcipher_mem_initialized = 0;

static volatile unsigned int sqlcipher_activate_count = 0;

static volatile sqlite3_mem_methods default_mem_methods;

static sqlcipher_provider *default_provider = NULL;

static sqlite3_mutex* sqlcipher_static_mutex[SQLCIPHER_MUTEX_COUNT];

static FILE* sqlcipher_log_file = NULL;

static volatile int sqlcipher_log_logcat = 0;

static volatile unsigned int sqlcipher_log_level = SQLCIPHER_LOG_NONE;

sqlite3_mutex* sqlcipher_mutex(int mutex) {

if(mutex < 0 || mutex >= SQLCIPHER_MUTEX_COUNT) return NULL;

return sqlcipher_static_mutex[mutex];

}

static int sqlcipher_mem_init(void *pAppData) {

return default_mem_methods.xInit(pAppData);

}

static void sqlcipher_mem_shutdown(void *pAppData) {

default_mem_methods.xShutdown(pAppData);

}

static void *sqlcipher_mem_malloc(int n) {

void *ptr = default_mem_methods.xMalloc(n);

if(!sqlcipher_mem_executed) sqlcipher_mem_executed = 1;

if(sqlcipher_mem_security_on) {

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_mem_malloc: calling sqlcipher_mlock(%p,%d)", ptr, n);

sqlcipher_mlock(ptr, n);

}

return ptr;

}

static int sqlcipher_mem_size(void *p) {

return default_mem_methods.xSize(p);

}

static void sqlcipher_mem_free(void *p) {

int sz;

if(!sqlcipher_mem_executed) sqlcipher_mem_executed = 1;

if(sqlcipher_mem_security_on) {

sz = sqlcipher_mem_size(p);

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_mem_free: calling sqlcipher_memset(%p,0,%d) and sqlcipher_munlock(%p, %d)", p, sz, p, sz);

sqlcipher_memset(p, 0, sz);

sqlcipher_munlock(p, sz);

}

default_mem_methods.xFree(p);

}

static void *sqlcipher_mem_realloc(void *p, int n) {

void *new = NULL;

int orig_sz = 0;

if(sqlcipher_mem_security_on) {

orig_sz = sqlcipher_mem_size(p);

if (n==0) {

sqlcipher_mem_free(p);

return NULL;

} else if (!p) {

return sqlcipher_mem_malloc(n);

} else if(n <= orig_sz) {

return p;

} else {

new = sqlcipher_mem_malloc(n);

if(new) {

memcpy(new, p, orig_sz);

sqlcipher_mem_free(p);

}

return new;

}

} else {

return default_mem_methods.xRealloc(p, n);

}

}

static int sqlcipher_mem_roundup(int n) {

return default_mem_methods.xRoundup(n);

}

static sqlite3_mem_methods sqlcipher_mem_methods = {

sqlcipher_mem_malloc,

sqlcipher_mem_free,

sqlcipher_mem_realloc,

sqlcipher_mem_size,

sqlcipher_mem_roundup,

sqlcipher_mem_init,

sqlcipher_mem_shutdown,

0

};

void sqlcipher_init_memmethods() {

if(sqlcipher_mem_initialized) return;

if(sqlite3_config(SQLITE_CONFIG_GETMALLOC, &default_mem_methods) != SQLITE_OK ||

sqlite3_config(SQLITE_CONFIG_MALLOC, &sqlcipher_mem_methods) != SQLITE_OK) {

sqlcipher_mem_security_on = sqlcipher_mem_executed = sqlcipher_mem_initialized = 0;

} else {

sqlcipher_mem_initialized = 1;

}

}

int sqlcipher_register_provider(sqlcipher_provider *p) {

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_register_provider: entering SQLCIPHER_MUTEX_PROVIDER");

sqlite3_mutex_enter(sqlcipher_mutex(SQLCIPHER_MUTEX_PROVIDER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_register_provider: entered SQLCIPHER_MUTEX_PROVIDER");

if(default_provider != NULL && default_provider != p) {

/* only free the current registerd provider if it has been initialized

sqlcipher_free(default_provider, sizeof(sqlcipher_provider));

}

default_provider = p;

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_register_provider: leaving SQLCIPHER_MUTEX_PROVIDER");

sqlite3_mutex_leave(sqlcipher_mutex(SQLCIPHER_MUTEX_PROVIDER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_register_provider: left SQLCIPHER_MUTEX_PROVIDER");

return SQLITE_OK;

}

sqlcipher_provider* sqlcipher_get_provider() {

return default_provider;

}

void sqlcipher_activate() {

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_activate: entering static master mutex");

sqlite3_mutex_enter(sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_MASTER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_activate: entered static master mutex");

/* allocate new mutexes */

if(sqlcipher_activate_count == 0) {

int i;

for(i = 0; i < SQLCIPHER_MUTEX_COUNT; i++) {

sqlcipher_static_mutex[i] = sqlite3_mutex_alloc(SQLITE_MUTEX_FAST);

}

}

/* check to see if there is a provider registered at this point

if(sqlcipher_get_provider() == NULL) {

sqlcipher_provider *p = sqlcipher_malloc(sizeof(sqlcipher_provider));

#if defined (SQLCIPHER_CRYPTO_CC)

extern int sqlcipher_cc_setup(sqlcipher_provider *p);

sqlcipher_cc_setup(p);

#elif defined (SQLCIPHER_CRYPTO_LIBTOMCRYPT)

extern int sqlcipher_ltc_setup(sqlcipher_provider *p);

sqlcipher_ltc_setup(p);

#elif defined (SQLCIPHER_CRYPTO_NSS)

extern int sqlcipher_nss_setup(sqlcipher_provider *p);

sqlcipher_nss_setup(p);

#elif defined (SQLCIPHER_CRYPTO_OPENSSL)

extern int sqlcipher_openssl_setup(sqlcipher_provider *p);

sqlcipher_openssl_setup(p);

#error "NO DEFAULT SQLCIPHER CRYPTO PROVIDER DEFINED"

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_activate: calling sqlcipher_register_provider(%p)", p);

#ifdef SQLCIPHER_EXT

sqlcipher_ext_provider_setup(p);

sqlcipher_register_provider(p);

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_activate: called sqlcipher_register_provider(%p)",p);

}

sqlcipher_activate_count++; /* increment activation count */

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_activate: leaving static master mutex");

sqlite3_mutex_leave(sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_MASTER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_activate: left static master mutex");

}

void sqlcipher_deactivate() {

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: entering static master mutex");

sqlite3_mutex_enter(sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_MASTER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: entered static master mutex");

sqlcipher_activate_count--;

/* if no connections are using sqlcipher, cleanup globals */

if(sqlcipher_activate_count < 1) {

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: entering SQLCIPHER_MUTEX_PROVIDER");

sqlite3_mutex_enter(sqlcipher_mutex(SQLCIPHER_MUTEX_PROVIDER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: entered SQLCIPHER_MUTEX_PROVIDER");

if(default_provider != NULL) {

sqlcipher_free(default_provider, sizeof(sqlcipher_provider));

default_provider = NULL;

}

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: leaving SQLCIPHER_MUTEX_PROVIDER");

sqlite3_mutex_leave(sqlcipher_mutex(SQLCIPHER_MUTEX_PROVIDER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: left SQLCIPHER_MUTEX_PROVIDER");

#ifdef SQLCIPHER_EXT

sqlcipher_ext_provider_destroy();

/* last connection closed, free mutexes */

if(sqlcipher_activate_count == 0) {

int i;

for(i = 0; i < SQLCIPHER_MUTEX_COUNT; i++) {

sqlite3_mutex_free(sqlcipher_static_mutex[i]);

}

}

sqlcipher_activate_count = 0; /* reset activation count */

}

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: leaving static master mutex");

sqlite3_mutex_leave(sqlite3_mutex_alloc(SQLITE_MUTEX_STATIC_MASTER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_deactivate: left static master mutex");

}

void* sqlcipher_memset(void *v, unsigned char value, sqlite_uint64 len) {

sqlite_uint64 i = 0;

volatile unsigned char *a = v;

if (v == NULL) return v;

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_memset: setting %p[0-%llu]=%d)", a, len, value);

for(i = 0; i < len; i++) {

a[i] = value;

}

return v;

}

int sqlcipher_ismemset(const void *v, unsigned char value, sqlite_uint64 len) {

const unsigned char *a = v;

sqlite_uint64 i = 0, result = 0;

for(i = 0; i < len; i++) {

result |= a[i] ^ value;

}

return (result != 0);

}

int sqlcipher_memcmp(const void *v0, const void *v1, int len) {

const unsigned char *a0 = v0, *a1 = v1;

int i = 0, result = 0;

for(i = 0; i < len; i++) {

result |= a0[i] ^ a1[i];

}

return (result != 0);

}

void sqlcipher_mlock(void *ptr, sqlite_uint64 sz) {

#ifndef OMIT_MEMLOCK

#if defined(__unix__) || defined(__APPLE__)

int rc;

unsigned long pagesize = sysconf(_SC_PAGESIZE);

unsigned long offset = (unsigned long) ptr % pagesize;

if(ptr == NULL || sz == 0) return;

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_mem_lock: calling mlock(%p,%lu); _SC_PAGESIZE=%lu", ptr - offset, sz + offset, pagesize);

rc = mlock(ptr - offset, sz + offset);

if(rc!=0) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_mem_lock: mlock(%p,%lu) returned %d errno=%d", ptr - offset, sz + offset, rc, errno);

}

#elif defined(_WIN32)

#if !(defined(WINAPI_FAMILY) && (WINAPI_FAMILY == WINAPI_FAMILY_PHONE_APP || WINAPI_FAMILY == WINAPI_FAMILY_APP))

int rc;

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_mem_lock: calling VirtualLock(%p,%d)", ptr, sz);

rc = VirtualLock(ptr, sz);

if(rc==0) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_mem_lock: VirtualLock(%p,%d) returned %d LastError=%d", ptr, sz, rc, GetLastError());

}

}

void sqlcipher_munlock(void *ptr, sqlite_uint64 sz) {

#ifndef OMIT_MEMLOCK

#if defined(__unix__) || defined(__APPLE__)

int rc;

unsigned long pagesize = sysconf(_SC_PAGESIZE);

unsigned long offset = (unsigned long) ptr % pagesize;

if(ptr == NULL || sz == 0) return;

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_mem_unlock: calling munlock(%p,%lu)", ptr - offset, sz + offset);

rc = munlock(ptr - offset, sz + offset);

if(rc!=0) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_mem_unlock: munlock(%p,%lu) returned %d errno=%d", ptr - offset, sz + offset, rc, errno);

}

#elif defined(_WIN32)

#if !(defined(WINAPI_FAMILY) && (WINAPI_FAMILY == WINAPI_FAMILY_PHONE_APP || WINAPI_FAMILY == WINAPI_FAMILY_APP))

int rc;

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_mem_lock: calling VirtualUnlock(%p,%d)", ptr, sz);

rc = VirtualUnlock(ptr, sz);

if(!rc) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_mem_unlock: VirtualUnlock(%p,%d) returned %d LastError=%d", ptr, sz, rc, GetLastError());

}

}

void sqlcipher_free(void *ptr, sqlite_uint64 sz) {

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_free: calling sqlcipher_memset(%p,0,%llu)", ptr, sz);

sqlcipher_memset(ptr, 0, sz);

sqlcipher_munlock(ptr, sz);

sqlite3_free(ptr);

}

void* sqlcipher_malloc(sqlite_uint64 sz) {

void *ptr;

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_malloc: calling sqlite3Malloc(%llu)", sz);

ptr = sqlite3Malloc(sz);

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_malloc: calling sqlcipher_memset(%p,0,%llu)", ptr, sz);

sqlcipher_memset(ptr, 0, sz);

sqlcipher_mlock(ptr, sz);

return ptr;

}

char* sqlcipher_version() {

#ifdef CIPHER_VERSION_QUALIFIER

char *version = sqlite3_mprintf("%s %s %s", CIPHER_XSTR(CIPHER_VERSION_NUMBER), CIPHER_XSTR(CIPHER_VERSION_QUALIFIER), CIPHER_XSTR(CIPHER_VERSION_BUILD));

char *version = sqlite3_mprintf("%s %s", CIPHER_XSTR(CIPHER_VERSION_NUMBER), CIPHER_XSTR(CIPHER_VERSION_BUILD));

return version;

}

static int sqlcipher_cipher_ctx_init(codec_ctx *ctx, cipher_ctx **iCtx) {

cipher_ctx *c_ctx;

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_cipher_ctx_init: allocating context");

*iCtx = (cipher_ctx *) sqlcipher_malloc(sizeof(cipher_ctx));

c_ctx = *iCtx;

if(c_ctx == NULL) return SQLITE_NOMEM;

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_cipher_ctx_init: allocating key");

c_ctx->key = (unsigned char *) sqlcipher_malloc(ctx->key_sz);

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_cipher_ctx_init: allocating hmac_key");

c_ctx->hmac_key = (unsigned char *) sqlcipher_malloc(ctx->key_sz);

if(c_ctx->key == NULL) return SQLITE_NOMEM;

if(c_ctx->hmac_key == NULL) return SQLITE_NOMEM;

return SQLITE_OK;

}

static void sqlcipher_cipher_ctx_free(codec_ctx* ctx, cipher_ctx **iCtx) {

cipher_ctx *c_ctx = *iCtx;

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "cipher_ctx_free: iCtx=%p", iCtx);

sqlcipher_free(c_ctx->key, ctx->key_sz);

sqlcipher_free(c_ctx->hmac_key, ctx->key_sz);

sqlcipher_free(c_ctx->pass, c_ctx->pass_sz);

sqlcipher_free(c_ctx->keyspec, ctx->keyspec_sz);

sqlcipher_free(c_ctx, sizeof(cipher_ctx));

}

static int sqlcipher_codec_ctx_reserve_setup(codec_ctx *ctx) {

int base_reserve = ctx->iv_sz; /* base reserve size will be IV only */

int reserve = base_reserve;

ctx->hmac_sz = ctx->provider->get_hmac_sz(ctx->provider_ctx, ctx->hmac_algorithm);

if(sqlcipher_codec_ctx_get_use_hmac(ctx))

reserve += ctx->hmac_sz; /* if reserve will include hmac, update that size */

/* calculate the amount of reserve needed in even increments of the cipher block size */

reserve = ((reserve % ctx->block_sz) == 0) ? reserve :

((reserve / ctx->block_sz) + 1) * ctx->block_sz;

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_reserve_setup: base_reserve=%d block_sz=%d md_size=%d reserve=%d",

base_reserve, ctx->block_sz, ctx->hmac_sz, reserve);

ctx->reserve_sz = reserve;

return SQLITE_OK;

}

static int sqlcipher_cipher_ctx_cmp(cipher_ctx *c1, cipher_ctx *c2) {

int are_equal = (

c1->pass_sz == c2->pass_sz

&& (

c1->pass == c2->pass

|| !sqlcipher_memcmp((const unsigned char*)c1->pass,

(const unsigned char*)c2->pass,

c1->pass_sz)

));

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_cipher_ctx_cmp: c1=%p c2=%p sqlcipher_memcmp(c1->pass, c2_pass)=%d are_equal=%d",

c1, c2,

(c1->pass == NULL || c2->pass == NULL) ?

-1 :

sqlcipher_memcmp(

(const unsigned char*)c1->pass,

(const unsigned char*)c2->pass,

c1->pass_sz

),

are_equal

);

return !are_equal; /* return 0 if they are the same, 1 otherwise */

}

static int sqlcipher_cipher_ctx_copy(codec_ctx *ctx, cipher_ctx *target, cipher_ctx *source) {

void *key = target->key;

void *hmac_key = target->hmac_key;

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_cipher_ctx_copy: target=%p, source=%p", target, source);

sqlcipher_free(target->pass, target->pass_sz);

sqlcipher_free(target->keyspec, ctx->keyspec_sz);

memcpy(target, source, sizeof(cipher_ctx));

target->key = key; /* restore pointer to previously allocated key data */

memcpy(target->key, source->key, ctx->key_sz);

target->hmac_key = hmac_key; /* restore pointer to previously allocated hmac key data */

memcpy(target->hmac_key, source->hmac_key, ctx->key_sz);

if(source->pass && source->pass_sz) {

target->pass = sqlcipher_malloc(source->pass_sz);

if(target->pass == NULL) return SQLITE_NOMEM;

memcpy(target->pass, source->pass, source->pass_sz);

}

if(source->keyspec) {

target->keyspec = sqlcipher_malloc(ctx->keyspec_sz);

if(target->keyspec == NULL) return SQLITE_NOMEM;

memcpy(target->keyspec, source->keyspec, ctx->keyspec_sz);

}

return SQLITE_OK;

}

static int sqlcipher_cipher_ctx_set_keyspec(codec_ctx *ctx, cipher_ctx *c_ctx, const unsigned char *key) {

/* free, zero existing pointers and size */

sqlcipher_free(c_ctx->keyspec, ctx->keyspec_sz);

c_ctx->keyspec = NULL;

c_ctx->keyspec = sqlcipher_malloc(ctx->keyspec_sz);

if(c_ctx->keyspec == NULL) return SQLITE_NOMEM;

c_ctx->keyspec[0] = 'x';

c_ctx->keyspec[1] = '\'';

cipher_bin2hex(key, ctx->key_sz, c_ctx->keyspec + 2);

cipher_bin2hex(ctx->kdf_salt, ctx->kdf_salt_sz, c_ctx->keyspec + (ctx->key_sz * 2) + 2);

c_ctx->keyspec[ctx->keyspec_sz - 1] = '\'';

return SQLITE_OK;

}

int sqlcipher_codec_get_store_pass(codec_ctx *ctx) {

return ctx->store_pass;

}

void sqlcipher_codec_set_store_pass(codec_ctx *ctx, int value) {

ctx->store_pass = value;

}

void sqlcipher_codec_get_pass(codec_ctx *ctx, void **zKey, int *nKey) {

*zKey = ctx->read_ctx->pass;

*nKey = ctx->read_ctx->pass_sz;

}

static void sqlcipher_set_derive_key(codec_ctx *ctx, int derive) {

if(ctx->read_ctx != NULL) ctx->read_ctx->derive_key = 1;

if(ctx->write_ctx != NULL) ctx->write_ctx->derive_key = 1;

}

static int sqlcipher_cipher_ctx_set_pass(cipher_ctx *ctx, const void *zKey, int nKey) {

/* free, zero existing pointers and size */

sqlcipher_free(ctx->pass, ctx->pass_sz);

ctx->pass = NULL;

ctx->pass_sz = 0;

if(zKey && nKey) { /* if new password is provided, copy it */

ctx->pass_sz = nKey;

ctx->pass = sqlcipher_malloc(nKey);

if(ctx->pass == NULL) return SQLITE_NOMEM;

memcpy(ctx->pass, zKey, nKey);

}

return SQLITE_OK;

}

int sqlcipher_codec_ctx_set_pass(codec_ctx *ctx, const void *zKey, int nKey, int for_ctx) {

cipher_ctx *c_ctx = for_ctx ? ctx->write_ctx : ctx->read_ctx;

int rc;

if((rc = sqlcipher_cipher_ctx_set_pass(c_ctx, zKey, nKey)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_set_pass: error %d from sqlcipher_cipher_ctx_set_pass", rc);

return rc;

}

c_ctx->derive_key = 1;

if(for_ctx == 2) {

if((rc = sqlcipher_cipher_ctx_copy(ctx, for_ctx ? ctx->read_ctx : ctx->write_ctx, c_ctx)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_set_pass: error %d from sqlcipher_cipher_ctx_copy", rc);

return rc;

}

}

return SQLITE_OK;

}

const char* sqlcipher_codec_ctx_get_cipher(codec_ctx *ctx) {

return ctx->provider->get_cipher(ctx->provider_ctx);

}

void sqlcipher_set_default_kdf_iter(int iter) {

default_kdf_iter = iter;

}

int sqlcipher_get_default_kdf_iter() {

return default_kdf_iter;

}

int sqlcipher_codec_ctx_set_kdf_iter(codec_ctx *ctx, int kdf_iter) {

ctx->kdf_iter = kdf_iter;

sqlcipher_set_derive_key(ctx, 1);

return SQLITE_OK;

}

int sqlcipher_codec_ctx_get_kdf_iter(codec_ctx *ctx) {

return ctx->kdf_iter;

}

int sqlcipher_codec_ctx_set_fast_kdf_iter(codec_ctx *ctx, int fast_kdf_iter) {

ctx->fast_kdf_iter = fast_kdf_iter;

sqlcipher_set_derive_key(ctx, 1);

return SQLITE_OK;

}

int sqlcipher_codec_ctx_get_fast_kdf_iter(codec_ctx *ctx) {

return ctx->fast_kdf_iter;

}

void sqlcipher_set_default_use_hmac(int use) {

if(use) default_flags |= CIPHER_FLAG_HMAC;

else default_flags &= ~CIPHER_FLAG_HMAC;

}

int sqlcipher_get_default_use_hmac() {

return (default_flags & CIPHER_FLAG_HMAC) != 0;

}

void sqlcipher_set_hmac_salt_mask(unsigned char mask) {

hmac_salt_mask = mask;

}

unsigned char sqlcipher_get_hmac_salt_mask() {

return hmac_salt_mask;

}

int sqlcipher_codec_ctx_set_use_hmac(codec_ctx *ctx, int use) {

if(use) {

sqlcipher_codec_ctx_set_flag(ctx, CIPHER_FLAG_HMAC);

} else {

sqlcipher_codec_ctx_unset_flag(ctx, CIPHER_FLAG_HMAC);

}

return sqlcipher_codec_ctx_reserve_setup(ctx);

}

int sqlcipher_codec_ctx_get_use_hmac(codec_ctx *ctx) {

return (ctx->flags & CIPHER_FLAG_HMAC) != 0;

}

int sqlcipher_set_default_plaintext_header_size(int size) {

default_plaintext_header_sz = size;

return SQLITE_OK;

}

int sqlcipher_codec_ctx_set_plaintext_header_size(codec_ctx *ctx, int size) {

if(size >= 0 && (size % ctx->block_sz) == 0 && size < (ctx->page_sz - ctx->reserve_sz)) {

ctx->plaintext_header_sz = size;

return SQLITE_OK;

}

ctx->plaintext_header_sz = -1;

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_set_plaintext_header_size: attempt to set invalid plantext_header_size %d", size);

return SQLITE_ERROR;

}

int sqlcipher_get_default_plaintext_header_size() {

return default_plaintext_header_sz;

}

int sqlcipher_codec_ctx_get_plaintext_header_size(codec_ctx *ctx) {

return ctx->plaintext_header_sz;

}

int sqlcipher_set_default_hmac_algorithm(int algorithm) {

default_hmac_algorithm = algorithm;

return SQLITE_OK;

}

int sqlcipher_codec_ctx_set_hmac_algorithm(codec_ctx *ctx, int algorithm) {

ctx->hmac_algorithm = algorithm;

return sqlcipher_codec_ctx_reserve_setup(ctx);

}

int sqlcipher_get_default_hmac_algorithm() {

return default_hmac_algorithm;

}

int sqlcipher_codec_ctx_get_hmac_algorithm(codec_ctx *ctx) {

return ctx->hmac_algorithm;

}

int sqlcipher_set_default_kdf_algorithm(int algorithm) {

default_kdf_algorithm = algorithm;

return SQLITE_OK;

}

int sqlcipher_codec_ctx_set_kdf_algorithm(codec_ctx *ctx, int algorithm) {

ctx->kdf_algorithm = algorithm;

return SQLITE_OK;

}

int sqlcipher_get_default_kdf_algorithm() {

return default_kdf_algorithm;

}

int sqlcipher_codec_ctx_get_kdf_algorithm(codec_ctx *ctx) {

return ctx->kdf_algorithm;

}

int sqlcipher_codec_ctx_set_flag(codec_ctx *ctx, unsigned int flag) {

ctx->flags |= flag;

return SQLITE_OK;

}

int sqlcipher_codec_ctx_unset_flag(codec_ctx *ctx, unsigned int flag) {

ctx->flags &= ~flag;

return SQLITE_OK;

}

int sqlcipher_codec_ctx_get_flag(codec_ctx *ctx, unsigned int flag) {

return (ctx->flags & flag) != 0;

}

void sqlcipher_codec_ctx_set_error(codec_ctx *ctx, int error) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_set_error: ctx=%p, error=%d", ctx, error);

sqlite3pager_error(ctx->pBt->pBt->pPager, error);

ctx->pBt->pBt->db->errCode = error;

}

int sqlcipher_codec_ctx_get_reservesize(codec_ctx *ctx) {

return ctx->reserve_sz;

}

void* sqlcipher_codec_ctx_get_data(codec_ctx *ctx) {

return ctx->buffer;

}

static int sqlcipher_codec_ctx_init_kdf_salt(codec_ctx *ctx) {

sqlite3_file *fd = sqlite3PagerFile(ctx->pBt->pBt->pPager);

if(!ctx->need_kdf_salt) {

return SQLITE_OK; /* don't reload salt when not needed */

}

/* read salt from header, if present, otherwise generate a new random salt */

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_init_kdf_salt: obtaining salt");

if(fd == NULL || fd->pMethods == 0 || sqlite3OsRead(fd, ctx->kdf_salt, ctx->kdf_salt_sz, 0) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_init_kdf_salt: unable to read salt from file header, generating random");

if(ctx->provider->random(ctx->provider_ctx, ctx->kdf_salt, ctx->kdf_salt_sz) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init_kdf_salt: error retrieving random bytes from provider");

return SQLITE_ERROR;

}

}

ctx->need_kdf_salt = 0;

return SQLITE_OK;

}

int sqlcipher_codec_ctx_set_kdf_salt(codec_ctx *ctx, unsigned char *salt, int size) {

if(size >= ctx->kdf_salt_sz) {

memcpy(ctx->kdf_salt, salt, ctx->kdf_salt_sz);

ctx->need_kdf_salt = 0;

return SQLITE_OK;

}

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_set_kdf_salt: attempt to set salt of incorrect size %d", size);

return SQLITE_ERROR;

}

int sqlcipher_codec_ctx_get_kdf_salt(codec_ctx *ctx, void** salt) {

int rc = SQLITE_OK;

if(ctx->need_kdf_salt) {

if((rc = sqlcipher_codec_ctx_init_kdf_salt(ctx)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_get_kdf_salt: error %d from sqlcipher_codec_ctx_init_kdf_salt", rc);

}

}

*salt = ctx->kdf_salt;

return rc;

}

void sqlcipher_codec_get_keyspec(codec_ctx *ctx, void **zKey, int *nKey) {

*zKey = ctx->read_ctx->keyspec;

*nKey = ctx->keyspec_sz;

}

int sqlcipher_codec_ctx_set_pagesize(codec_ctx *ctx, int size) {

if(!((size != 0) && ((size & (size - 1)) == 0)) || size < 512 || size > 65536) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "cipher_page_size not a power of 2 and between 512 and 65536 inclusive");

return SQLITE_ERROR;

}

/* attempt to free the existing page buffer */

sqlcipher_free(ctx->buffer,ctx->page_sz);

ctx->page_sz = size;

/* pre-allocate a page buffer of PageSize bytes. This will

ctx->buffer = sqlcipher_malloc(size);

if(ctx->buffer == NULL) return SQLITE_NOMEM;

return SQLITE_OK;

}

int sqlcipher_codec_ctx_get_pagesize(codec_ctx *ctx) {

return ctx->page_sz;

}

void sqlcipher_set_default_pagesize(int page_size) {

default_page_size = page_size;

}

int sqlcipher_get_default_pagesize() {

return default_page_size;

}

void sqlcipher_set_mem_security(int on) {

/* memory security can only be enabled, not disabled */

if(on) {

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_set_mem_security: on");

sqlcipher_mem_security_on = on;

}

}

int sqlcipher_get_mem_security() {

/* only report that memory security is enabled if pragma cipher_memory_security is ON and

SQLCipher's allocator/deallocator was run at least one timecurrently used */

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_get_mem_security: sqlcipher_mem_security_on = %d, sqlcipher_mem_executed = %d", sqlcipher_mem_security_on, sqlcipher_mem_executed);

return sqlcipher_mem_security_on && sqlcipher_mem_executed;

}

int sqlcipher_codec_ctx_init(codec_ctx **iCtx, Db *pDb, Pager *pPager, const void *zKey, int nKey) {

int rc;

codec_ctx *ctx;

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_init: allocating context");

*iCtx = sqlcipher_malloc(sizeof(codec_ctx));

ctx = *iCtx;

if(ctx == NULL) return SQLITE_NOMEM;

ctx->pBt = pDb->pBt; /* assign pointer to database btree structure */

/* allocate space for salt data. Then read the first 16 bytes

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_init: allocating kdf_salt");

ctx->kdf_salt_sz = FILE_HEADER_SZ;

ctx->kdf_salt = sqlcipher_malloc(ctx->kdf_salt_sz);

if(ctx->kdf_salt == NULL) return SQLITE_NOMEM;

/* allocate space for separate hmac salt data. We want the

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_init: allocating hmac_kdf_salt");

ctx->hmac_kdf_salt = sqlcipher_malloc(ctx->kdf_salt_sz);

if(ctx->hmac_kdf_salt == NULL) return SQLITE_NOMEM;

/* setup default flags */

ctx->flags = default_flags;

/* defer attempt to read KDF salt until first use */

ctx->need_kdf_salt = 1;

/* setup the crypto provider */

sqlcipher_log(SQLCIPHER_LOG_DEBUG, "sqlcipher_codec_ctx_init: allocating provider");

ctx->provider = (sqlcipher_provider *) sqlcipher_malloc(sizeof(sqlcipher_provider));

if(ctx->provider == NULL) return SQLITE_NOMEM;

/* make a copy of the provider to be used for the duration of the context */

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_codec_ctx_init: entering SQLCIPHER_MUTEX_PROVIDER");

sqlite3_mutex_enter(sqlcipher_mutex(SQLCIPHER_MUTEX_PROVIDER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_codec_ctx_init: entered SQLCIPHER_MUTEX_PROVIDER");

memcpy(ctx->provider, default_provider, sizeof(sqlcipher_provider));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_codec_ctx_init: leaving SQLCIPHER_MUTEX_PROVIDER");

sqlite3_mutex_leave(sqlcipher_mutex(SQLCIPHER_MUTEX_PROVIDER));

sqlcipher_log(SQLCIPHER_LOG_TRACE, "sqlcipher_codec_ctx_init: left SQLCIPHER_MUTEX_PROVIDER");

if((rc = ctx->provider->ctx_init(&ctx->provider_ctx)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d returned from ctx_init", rc);

return rc;

}

ctx->key_sz = ctx->provider->get_key_sz(ctx->provider_ctx);

ctx->iv_sz = ctx->provider->get_iv_sz(ctx->provider_ctx);

ctx->block_sz = ctx->provider->get_block_sz(ctx->provider_ctx);

/* establic the size for a hex-formated key specification, containing the

so oversize by 3 bytes */

ctx->keyspec_sz = ((ctx->key_sz + ctx->kdf_salt_sz) * 2) + 3;

/*

if((rc = sqlcipher_codec_ctx_set_pagesize(ctx, default_page_size)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d returned from sqlcipher_codec_ctx_set_pagesize with %d", rc, default_page_size);

return rc;

}

/* establish settings for the KDF iterations and fast (HMAC) KDF iterations */

if((rc = sqlcipher_codec_ctx_set_kdf_iter(ctx, default_kdf_iter)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d setting default_kdf_iter %d", rc, default_kdf_iter);

return rc;

}

if((rc = sqlcipher_codec_ctx_set_fast_kdf_iter(ctx, FAST_PBKDF2_ITER)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d setting fast_kdf_iter to %d", rc, FAST_PBKDF2_ITER);

return rc;

}

/* set the default HMAC and KDF algorithms which will determine the reserve size */

if((rc = sqlcipher_codec_ctx_set_hmac_algorithm(ctx, default_hmac_algorithm)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d setting sqlcipher_codec_ctx_set_hmac_algorithm with %d", rc, default_hmac_algorithm);

return rc;

}

/* Note that use_hmac is a special case that requires recalculation of page size

if((rc = sqlcipher_codec_ctx_set_use_hmac(ctx, default_flags & CIPHER_FLAG_HMAC)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d setting use_hmac %d", rc, default_flags & CIPHER_FLAG_HMAC);

return rc;

}

if((rc = sqlcipher_codec_ctx_set_kdf_algorithm(ctx, default_kdf_algorithm)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d setting sqlcipher_codec_ctx_set_kdf_algorithm with %d", rc, default_kdf_algorithm);

return rc;

}

/* setup the default plaintext header size */

if((rc = sqlcipher_codec_ctx_set_plaintext_header_size(ctx, default_plaintext_header_sz)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d setting sqlcipher_codec_ctx_set_plaintext_header_size with %d", rc, default_plaintext_header_sz);

return rc;

}

/* initialize the read and write sub-contexts. this must happen after key_sz is established */

if((rc = sqlcipher_cipher_ctx_init(ctx, &ctx->read_ctx)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d initializing read_ctx", rc);

return rc;

}

if((rc = sqlcipher_cipher_ctx_init(ctx, &ctx->write_ctx)) != SQLITE_OK) {

sqlcipher_log(SQLCIPHER_LOG_ERROR, "sqlcipher_codec_ctx_init: error %d initializing write_ctx", rc);