X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=5d408c31e0c6a70aaa5360c9c9ae667785abd001;hb=efdac689c531b78c27e7ec2c9e03af621c104e40;hp=123613817a50af16c7b27c35b8c1fb7264d27f4a;hpb=0e29a93fc2056d254ef650e81d9299a62bfc13b3;p=blhc%2Fblhc.git diff --git a/bin/blhc b/bin/blhc index 1236138..5d408c3 100755 --- a/bin/blhc +++ b/bin/blhc @@ -37,79 +37,111 @@ my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)? # Regex to catch (GCC) compiler warnings. my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/; -# Regex for source files which require preprocessing. -my $source_preprocess_compile_regex = qr/ - # C - c - # Objective-C - | m +# List of source file extensions which require preprocessing. +my @source_preprocess_compile_cpp = ( # C++ - | cc | cp | cxx | cpp | CPP | c\+\+ | C + qw( cc cp cxx cpp CPP c++ C ), # Objective-C++ - | mm | M + qw( mm Mr), +); +my @source_preprocess_compile = ( + # C + qw( c ), + # Objective-C + qw( m ), + # (Objective-)C++ + @source_preprocess_compile_cpp, # Fortran - | F | FOR | fpp | FPP | FTN | F90 | F95 | F03 | F08 - /x; -my $source_preprocess_no_compile_regex = qr/ + qw( F FOR fpp FPP FTN F90 F95 F03 F08 ), +); +my @source_preprocess_no_compile = ( # Assembly - s - /x; -my $source_preprocess_regex = qr/ - $source_preprocess_compile_regex - | $source_preprocess_no_compile_regex - /x; -# Regex for source files which don't require preprocessing. -my $source_no_preprocess_compile_regex = qr/ - # C - i + qw( s ), +); +my @source_preprocess = ( + @source_preprocess_compile, + @source_preprocess_no_compile, +); +# List of source file extensions which don't require preprocessing. +my @source_no_preprocess_compile_cpp = ( # C++ - | ii - # Objective-C - | mi + qw( ii ), # Objective-C++ - | mii + qw( mii ), +); +my @source_no_preprocess_compile = ( + # C + qw( i ), + # (Objective-)C++ + @source_no_preprocess_compile_cpp, + # Objective-C + qw( mi ), # Fortran - | f | for | ftn | f90 | f95 | f03 | f08 - /x; -my $source_no_preprocess_no_compile_regex = qr/ + qw( f for ftn f90 f95 f03 f08 ), +); +my @source_no_preprocess_no_compile = ( # Assembly - S | sx - /x; -my $source_no_preprocess_regex = qr/ - $source_no_preprocess_compile_regex - | $source_no_preprocess_no_compile_regex - /x; -# Regex for header files which require preprocessing. -my $header_preprocess_regex = qr/ + qw( S sx ), +); +my @source_no_preprocess = ( + @source_no_preprocess_compile, + @source_no_preprocess_no_compile, +); +# List of header file extensions which require preprocessing. +my @header_preprocess = ( # C, C++, Objective-C, Objective-C++ - h + qw( h ), # C++ - | hh | H | hp | hxx | hpp | HPP | h\+\+ | tcc - /x; -# Regexps to match files with the given characteristics. -my $file_no_preprocess_regex = qr/ - $cc_regex.+? - \.(?: $source_no_preprocess_regex)\b - /x; -my $file_preprocess_regex = qr/ - $cc_regex.+? - \.(?: $header_preprocess_regex - | $source_preprocess_regex)\b - /x; -my $file_compile_link_regex = qr/ - $cc_regex.+? - \.(?: $source_preprocess_regex - | $source_no_preprocess_regex)\b - /x; -my $file_compile_regex = qr/ - $cc_regex.+? - \.(?: $source_preprocess_compile_regex - | $source_no_preprocess_compile_regex)\b - /x; -my $file_no_compile_regex = qr/ - $cc_regex.+ - \.(?: $source_preprocess_no_compile_regex - | $source_no_preprocess_no_compile_regex)\b + qw( hh H hp hxx hpp HPP h++ tcc ), +); + +# Hashes for fast extensions lookup to check if a file falls in one of these +# categories. +my %extensions_no_preprocess = map { $_ => 1 } ( + @source_no_preprocess, +); +my %extensions_preprocess = map { $_ => 1 } ( + @header_preprocess, + @source_preprocess, +); +my %extensions_compile_link = map { $_ => 1 } ( + @source_preprocess, + @source_no_preprocess, +); +my %extensions_compile = map { $_ => 1 } ( + @source_preprocess_compile, + @source_no_preprocess_compile, +); +my %extensions_no_compile = map { $_ => 1 } ( + @source_preprocess_no_compile, + @source_no_preprocess_no_compile, +); +my %extensions_compile_cpp = map { $_ => 1 } ( + @source_preprocess_compile_cpp, + @source_no_preprocess_compile_cpp, +); +my %extension = map { $_ => 1 } ( + @source_no_preprocess, + @source_no_preprocess_compile, + @source_no_preprocess_compile_cpp, + @source_no_preprocess_no_compile, + @header_preprocess, + @source_preprocess, + @source_preprocess_compile, + @source_preprocess_compile_cpp, + @source_preprocess_no_compile, +); + +# Regexp to match file extensions. +my $file_extension_regex = qr/ + \s + \S+ # Filename without extension. + \. + ([^\\.\s]+) # File extension. + (?=\s|\\) # At end of word. Can't use \b because some files have non + # word characters at the end and because \b matches double + # extensions (like .cpp.o). Works always as all lines are + # terminated with "\n". /x; # Expected (hardening) flags. All flags are used as regexps. @@ -132,6 +164,11 @@ my @cflags_stack = ( my @cflags_pie = ( '-fPIE', ); +my @cxxflags = ( + '-g', + '-O(?:2|3)', +); +# @cxxflags_* is the same as @cflags_*. my @cppflags = (); my @cppflags_fortify = ( '-D_FORTIFY_SOURCE=2', @@ -274,7 +311,7 @@ sub is_non_verbose_build { $file =~ m{/([a-zA-Z0-9._-]+)$}; $file = $1; - if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/) { + if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/o) { # We still have to skip the current line as it doesn't contain any # compiler commands. ${$skip_ref} = 1; @@ -285,6 +322,19 @@ sub is_non_verbose_build { return 1; } +sub extension_found { + my ($extensions_ref, @extensions) = @_; + + my $found = 0; + foreach my $extension (@extensions) { + if (exists $extensions_ref->{$extension}) { + $found = 1; + last; + } + } + return $found; +} + # MAIN @@ -312,7 +362,7 @@ if (not Getopt::Long::GetOptions( 'all' => \$option_all, # Misc. 'color' => \$option_color, - 'arch' => \$option_arch, + 'arch=s' => \$option_arch, 'buildd' => \$option_buildd, )) { require Pod::Usage; @@ -400,17 +450,19 @@ while (my $line = <>) { } # Ignore compiler warnings for now. - next if $line =~ /$warning_regex/; - - # Remove all ANSI color sequences which are sometimes used in non-verbose - # builds. - $line = Term::ANSIColor::colorstrip($line); - # Also strip '\0xf' (delete previous character), used by Elinks' build - # system. - $line =~ s/\x0f//g; - # And "ESC(B" which seems to be used on armhf and hurd (not sure what it - # does). - $line =~ s/\033\(B//g; + next if $line =~ /$warning_regex/o; + + if ($line =~ /\033/) { # esc + # Remove all ANSI color sequences which are sometimes used in + # non-verbose builds. + $line = Term::ANSIColor::colorstrip($line); + # Also strip '\0xf' (delete previous character), used by Elinks' build + # system. + $line =~ s/\x0f//g; + # And "ESC(B" which seems to be used on armhf and hurd (not sure what + # it does). + $line =~ s/\033\(B//g; + } # Check if this line indicates a non verbose build. my $non_verbose = is_non_verbose_build($line); @@ -451,7 +503,7 @@ while (my $line = <>) { } # Ignore lines with no compiler commands. - next if $line !~ /\b$cc_regex(?:\s|\\)/ and not $non_verbose; + next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose; # Ignore false positives. # @@ -462,10 +514,12 @@ while (my $line = <>) { (?:C|c)ompiler[\s.]*:?\s+ $cc_regex (?:\s-std=[a-z0-9:+]+)?\s*$ - /x - or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/ + /xo + or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/o or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: / or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/; + # `make` output. + next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++" # Check if additional hardening options were used. Used to ensure # they are used for the complete build. @@ -507,17 +561,21 @@ if ($option_arch) { # Check the specified hardening options, same order as dpkg-buildflags. if ($harden_pie) { @cflags = (@cflags, @cflags_pie); + @cxxflags = (@cxxflags, @cflags_pie); @ldflags = (@ldflags, @ldflags_pie); } if ($harden_stack) { @cflags = (@cflags, @cflags_stack); + @cxxflags = (@cxxflags, @cflags_stack); } if ($harden_fortify) { @cflags = (@cflags, @cflags_fortify); + @cxxflags = (@cxxflags, @cflags_fortify); @cppflags = (@cppflags, @cppflags_fortify); } if ($harden_format) { @cflags = (@cflags, @cflags_format); + @cxxflags = (@cxxflags, @cflags_format); } if ($harden_relro) { @ldflags = (@ldflags, @ldflags_relro); @@ -538,6 +596,10 @@ for (my $i = 0; $i < scalar @input; $i++) { # Even if it's a verbose build, we might have to skip this line. next if $skip; + # Remove everything until and including the compiler command. Makes checks + # easier and faster. + $line =~ s/^.*?$cc_regex//o; + # Skip unnecessary tests when only preprocessing. my $flag_preprocess = 0; @@ -546,7 +608,7 @@ for (my $i = 0; $i < scalar @input; $i++) { my $link = 0; # Preprocess, compile, assemble. - if ($line =~ /$cc_regex.*?\s(-E|-S|-c)\b/) { + if ($line =~ /\s(-E|-S|-c)\b/) { $preprocess = 1; $flag_preprocess = 1 if $1 eq '-E'; $compile = 1 if $1 eq '-S' or $1 eq '-c'; @@ -555,22 +617,28 @@ for (my $i = 0; $i < scalar @input; $i++) { $link = 1; } + # Get all file extensions on this line. + my @extensions = $line =~ /$file_extension_regex/go; + # Ignore all unknown extensions to speedup the search below. + @extensions = grep { exists $extension{$_} } @extensions; + # These file types don't require preprocessing. - if ($line =~ /$file_no_preprocess_regex/) { + if (extension_found(\%extensions_no_preprocess, @extensions)) { $preprocess = 0; } # These file types require preprocessing. - if ($line =~ /$file_preprocess_regex/) { + if (extension_found(\%extensions_preprocess, @extensions)) { $preprocess = 1; } # If there are source files then it's compiling/linking in one step and we # must check both. We only check for source files here, because header # files cause too many false positives. - if (not $flag_preprocess and $line =~ /$file_compile_link_regex/) { + if (not $flag_preprocess + and extension_found(\%extensions_compile_link, @extensions)) { # Assembly files don't need CFLAGS. - if (not $line =~ /$file_compile_regex/ - and $line =~ /$file_no_compile_regex/) { + if (not extension_found(\%extensions_compile, @extensions) + and extension_found(\%extensions_no_compile, @extensions)) { $compile = 0; # But the rest does. } else { @@ -578,6 +646,15 @@ for (my $i = 0; $i < scalar @input; $i++) { } } + # Assume CXXFLAGS are required when a C++ file is specified in the + # compiler line. + my $compile_cpp = 0; + if ($compile + and extension_found(\%extensions_compile_cpp, @extensions)) { + $compile = 0; + $compile_cpp = 1; + } + # Check hardening flags. my @missing; if ($compile and not all_flags_used($line, \@missing, @cflags) @@ -585,14 +662,22 @@ for (my $i = 0; $i < scalar @input; $i++) { # with -fPIE as well. It's no error if only PIE flags are missing. and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie) # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get (?:CFLAGS|CXXFLAGS)`/) { - error_flags('CFLAGS missing', \@missing, \%flag_renames, $line); + and not $line =~ /`dpkg-buildflags --get CFLAGS`/) { + error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= 1 << 3; + } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) + # Libraries linked with -fPIC don't have to (and can't) be linked + # with -fPIE as well. It's no error if only PIE flags are missing. + and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) { + error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); $exit |= 1 << 3; } if ($preprocess and not all_flags_used($line, \@missing, @cppflags) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) { - error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $line); + error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); $exit |= 1 << 3; } if ($link and not all_flags_used($line, \@missing, @ldflags) @@ -600,7 +685,7 @@ for (my $i = 0; $i < scalar @input; $i++) { and not pic_pie_conflict($line, $harden_pie, \@missing, @ldflags_pie) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { - error_flags('LDFLAGS missing', \@missing, \%flag_renames, $line); + error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); $exit |= 1 << 3; } } @@ -618,14 +703,14 @@ blhc - build log hardening check, checks build logs for missing hardening flags B [options] - --help available options - --version version number and license - --pie force +pie check - --bindnow force +bindbow check --all force +all (+pie, +bindnow) check --arch set architecture (autodetected) + --bindnow force +bindbow check --buildd parser mode for buildds --color use colored output + --pie force +pie check + --help available options + --version version number and license =head1 DESCRIPTION @@ -636,22 +721,6 @@ other important warnings. It's licensed under the GPL 3 or later. =over 8 -=item B<-h -? --help> - -Print available options. - -=item B<--version> - -Print version number and license. - -=item B<--pie> - -Force check for all +pie hardening flags. By default it's auto detected. - -=item B<--bindnow> - -Force check for all +bindnow hardening flags. By default it's auto detected. - =item B<--all> Force check for all +all (+pie, +bindnow) hardening flags. By default it's @@ -663,6 +732,10 @@ Set the specific architecture (e.g. amd64, armel, etc.), automatically disables hardening flags not available on this architecture. Is detected automatically if dpkg-buildpackage is used. +=item B<--bindnow> + +Force check for all +bindnow hardening flags. By default it's auto detected. + =item B<--buildd> Special mode for buildds when automatically parsing log files. The following @@ -681,6 +754,18 @@ detected). Use colored (ANSI) output for warning messages. +=item B<--pie> + +Force check for all +pie hardening flags. By default it's auto detected. + +=item B<-h -? --help> + +Print available options. + +=item B<--version> + +Print version number and license. + =back Auto detection for B<--pie> and B<--bindnow> only works if at least one