X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=f9455868e6996e59c45f50825110ec1f11119cbd;hb=a7795c35f46dfbff0e3a832a48ff288107fcc81d;hp=d8c621bddbfd853a9bec9a552f0e6de8d24106a4;hpb=ec6915157c741c96bfeed5a2a58246d59ccefdb5;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index d8c621b..f945586 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -30,7 +30,9 @@ our $VERSION = '0.01';
 # CONSTANTS/VARIABLES
 
 # Regex to catch compiler commands.
-my $cc_regex = qr/(?:x86_64-linux-gnu-)?(?:(?<!\.)cc|gcc|g\+\+|c\+\+)(?:-[\d.]+)?/;
+my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux|kfreebsd)-gnu(?:eabi|eabihf)?-)?
+                  (?:(?<!\.)cc|gcc|g\+\+|c\+\+)
+                  (?:-[\d.]+)?/x;
 # Regex to catch (GCC) compiler warnings.
 my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
 
@@ -117,7 +119,7 @@ sub any_flags_used {
     my ($line, @flags) = @_;
 
     foreach my $flag (@flags) {
-        return 1 if $line =~ /\s$flag(?:\s|\\|$)/;
+        return 1 if $line =~ /\s$flag(?:\s|\\)/;
     }
 
     return 0;
@@ -127,14 +129,12 @@ sub all_flags_used {
 
     my @missing_flags = ();
     foreach my $flag (@flags) {
-        if ($line !~ /\s$flag(?:\s|\\|$)/) {
+        if ($line !~ /\s$flag(?:\s|\\)/) {
             push @missing_flags, $flag;
         }
     }
 
-    if (scalar @missing_flags == 0) {
-        return 1;
-    }
+    return 1 if scalar @missing_flags == 0;
 
     @{$missing_flags_ref} = @missing_flags;
     return 0;
@@ -166,7 +166,7 @@ sub is_non_verbose_build {
     my ($line, $next_line, $skip_ref) = @_;
 
     if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
-                or $line =~ /^\s*(?:CC|CCLD)\s+(.+?)$/
+                or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD)\]?\s+(.+?)$/
                 or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
                 or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
                 or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
@@ -217,6 +217,7 @@ my $option_help    = 0;
 my $option_version = 0;
 my $option_all     = 0;
 my $option_arch    = undef;
+my $option_buildd  = 0;
 if (not Getopt::Long::GetOptions(
             'help|h|?' => \$option_help,
             'version'  => \$option_version,
@@ -226,6 +227,7 @@ if (not Getopt::Long::GetOptions(
             'all'      => \$option_all,
             # Misc.
             'arch'     => \$option_arch,
+            'buildd'   => \$option_buildd,
         )) {
     require Pod::Usage;
     Pod::Usage::pod2usage(2);
@@ -268,8 +270,28 @@ my $start = 0;
 my $continuation = 0;
 my $complete_line = undef;
 while (my $line = <>) {
-    # We skip over unimportant lines at the beginning to prevent false
-    # positives.
+    # dpkg-buildflags only provides hardening flags since 1.16.1, don't check
+    # for hardening flags in buildd mode if an older dpkg-dev is used. Default
+    # flags (-g -O2) are still checked.
+    #
+    # Packages which were built before 1.16.1 but used their own hardening
+    # flags are not checked.
+    if ($option_buildd and not $start
+            and $line =~ /^Toolchain package versions: /) {
+        require Dpkg::Version;
+        if ($line !~ /dpkg-dev_(\S+)/
+                or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
+            $harden_format  = 0;
+            $harden_fortify = 0;
+            $harden_stack   = 0;
+            $harden_relro   = 0;
+            $harden_bindnow = 0;
+            $harden_pie     = 0;
+        }
+    }
+
+    # We skip over unimportant lines at the beginning of the log to prevent
+    # false positives.
     $start = 1 if $line =~ /^dpkg-buildpackage:/;
     next if not $start;
 
@@ -282,6 +304,16 @@ while (my $line = <>) {
     # Ignore compiler warnings for now.
     next if $line =~ /$warning_regex/;
 
+    # Remove all ANSI color sequences which are sometimes used in non-verbose
+    # builds.
+    $line = Term::ANSIColor::colorstrip($line);
+    # Also strip '\0xf' (delete previous character), used by Elinks' build
+    # system.
+    $line =~ s/\x0f//g;
+    # And "ESC(B" which seems to be used on armhf and hurd (not sure what it
+    # does).
+    $line =~ s/\033\(B//g;
+
     # Check if this line indicates a non verbose build.
     my $non_verbose = is_non_verbose_build($line);
 
@@ -325,6 +357,18 @@ while (my $line = <>) {
             #
             # `./configure` output.
             next if not $non_verbose and $line =~ /^checking /;
+            next if $line =~ /^\s*(?:C\s+)?
+                               (?:C|c)ompiler[\s.]*:\s+
+                               $cc_regex
+                               (?:\s-std=[a-z0-9:+]+)?\s*$
+                             /x
+                    or $line =~ /^\s*(?:- )?(?:CC|CXX)\s*=\s*$cc_regex\s*$/
+                    or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
+                    or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
+            # Debian buildd output.
+            next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/
+                    and $line !~ /\s-./; # option, prevent false negatives
+
 
             push @input, $line;
         }
@@ -399,12 +443,6 @@ for (my $i = 0; $i < scalar @input; $i++) {
     # Even if it's a verbose build, we might have to skip this line.
     next if $skip;
 
-    # Ignore false positives.
-    #
-    # ./configure summary.
-    next if $line =~ /^\s*(?:C|c)ompiler[\s.]*:\s+$cc_regex(?:\s-std=[a-z0-9:+]+)?\s*$/
-            or $line =~ /^\s*- (?:CC|CXX)\s*=\s*$cc_regex\s*$/
-            or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /;
 
     # Is this a compiler or linker command?
     my $compiler = 1;
@@ -416,7 +454,8 @@ for (my $i = 0; $i < scalar @input; $i++) {
                    (?:[/.A-Za-z0-9~_-]+/)?     # path to file
                         [A-Za-z0-9~_-]+        # binary name (no dots!)
                    (?:[0-9.]*\.so[0-9.]*[a-z]? # library (including version)
-                    |\.la)?
+                    |\.la
+                    |\.cgi)?                   # CGI binary
                    (?:\s|\\|$)                 # end of file name
                   }x
             or $line =~ /^libtool: link: /
@@ -473,6 +512,7 @@ B<blhc> [--pie] [--bindnow] [--all]
     --bindnow               force +bindbow check
     --all                   force +all (+pie, +bindnow) check
     --arch                  set architecture (autodetected)
+    --buildd                parser mode for buildds
 
 =head1 DESCRIPTION
 
@@ -510,10 +550,25 @@ Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected
 automatically if dpkg-buildpackage is used.
 
+=item B<--buildd>
+
+Special mode for buildds when automatically parsing log files. The following
+changes are in effect:
+
+=over 2
+
+=item
+
+Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is
+detected).
+
+=back
+
 =back
 
-Auto detection only works if at least one command uses the required hardening
-flag (e.g. -fPIE). Then it's required for all other commands as well.
+Auto detection for B<--pie> and B<--bindnow> only works if at least one
+command uses the required hardening flag (e.g. -fPIE). Then it's required for
+all other commands as well.
 
 =head1 EXIT STATUS