From: Simon Ruderich Date: Tue, 10 Apr 2012 22:23:20 +0000 (+0200) Subject: Add --ignore-flag and --ignore-line options. X-Git-Tag: 0.01~17 X-Git-Url: https://ruderich.org/simon/gitweb/?a=commitdiff_plain;h=a98be1bc5f253c876681cb133896d72d527fff1c;p=blhc%2Fblhc.git Add --ignore-flag and --ignore-line options. --- diff --git a/MANIFEST b/MANIFEST index d6c38b3..4df8ddb 100644 --- a/MANIFEST +++ b/MANIFEST @@ -36,6 +36,8 @@ t/logs/good-bindnow t/logs/good-library t/logs/good-multiline t/logs/good-pie +t/logs/ignore-flag +t/logs/ignore-line t/logs/libtool t/logs/make t/logs/verbose-build diff --git a/bin/blhc b/bin/blhc index 38466e4..87a7988 100755 --- a/bin/blhc +++ b/bin/blhc @@ -426,6 +426,8 @@ my $option_help = 0; my $option_version = 0; my $option_pie = 0; my $option_bindnow = 0; +my @option_ignore_flag = (); +my @option_ignore_line = (); my $option_all = 0; my $option_arch = undef; my $option_buildd = 0; @@ -437,6 +439,9 @@ if (not Getopt::Long::GetOptions( 'pie' => \$option_pie, 'bindnow' => \$option_bindnow, 'all' => \$option_all, + # Ignore. + 'ignore-flag=s' => \@option_ignore_flag, + 'ignore-line=s' => \@option_ignore_line, # Misc. 'color' => \$option_color, 'arch=s' => \$option_arch, @@ -480,16 +485,36 @@ if ($option_all) { $option_bindnow = 1; } +# Strip flags which should be ignored. +if (scalar @option_ignore_flag > 0) { + my %ignores = map { $_ => 1 } @option_ignore_flag; + foreach my $flags (@flag_refs) { + @{$flags} = grep { + # Flag found as string. + not exists $ignores{$_} + # Flag found as string representation of regexp. + and (not defined $flag_renames{$_} + or not exists $ignores{$flag_renames{$_}}) + } @{$flags}; + } +} + # Precompile all flag regexps. any_flags_used(), all_flags_used() get a lot # faster with this. foreach my $flags (@flag_refs_all) { @{$flags} = compile_flag_regexp(\%flag_renames, @{$flags}); } +# Precompile ignore line regexps, also anchor at beginning and end of line. +foreach my $ignore (@option_ignore_line) { + $ignore = qr/^$ignore$/; +} + # Final exit code. my $exit = 0; -FILE: foreach my $file (@ARGV) { +FILE: +foreach my $file (@ARGV) { print "checking '$file'...\n" if scalar @ARGV > 1; open my $fh, '<', $file or die "$!: $file"; @@ -726,9 +751,15 @@ FILE: foreach my $file (@ARGV) { @ldflags = (@ldflags, @def_ldflags_bindnow); } +LINE: for (my $i = 0; $i < scalar @input; $i++) { my $line = $input[$i]; + # Ignore line if requested. + foreach my $ignore (@option_ignore_line) { + next LINE if $line =~ /$ignore/; + } + my $skip = 0; if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { if (not $option_buildd) { @@ -981,6 +1012,23 @@ Don't require Term::ANSIColor. Use colored (ANSI) output for warning messages. +=item B<--ignore-flag> I + +Don't print an error when the specific flag is missing in a compiler line. +I is a string. + +Used to prevent false positives. This option can be specified multiple times. + +=item B<--ignore-line> I + +Ignore lines matching the given Perl regex. I is automatically anchored +at the beginning and end of the line to prevent false negatives. + +B: Not the input lines are checked, but the lines which are displayed in +warnings (which have line continuation resolved). + +Used to prevent false positives. This option can be specified multiple times. + =item B<--pie> Force check for all +pie hardening flags. By default it's auto detected. diff --git a/t/logs/ignore-flag b/t/logs/ignore-flag new file mode 100644 index 0000000..ac24322 --- /dev/null +++ b/t/logs/ignore-flag @@ -0,0 +1,5 @@ +dpkg-buildpackage: source package test + +gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.c +gcc -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.c +gcc -g -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-c.c diff --git a/t/logs/ignore-line b/t/logs/ignore-line new file mode 100644 index 0000000..e1c6c7e --- /dev/null +++ b/t/logs/ignore-line @@ -0,0 +1,10 @@ +dpkg-buildpackage: source package test + + ./prepare-script gcc test-a.c test-b.c test-c.c + +./prepare-script gcc test-a.c +gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.c +./prepare-script gcc test-b.c +gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.c +./prepare-script gcc test-c.c +gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-c.c diff --git a/t/tests.t b/t/tests.t index d9c15c3..e238b1a 100644 --- a/t/tests.t +++ b/t/tests.t @@ -19,7 +19,7 @@ use strict; use warnings; -use Test::More tests => 122; +use Test::More tests => 130; sub is_blhc { @@ -71,6 +71,28 @@ is_blhc 'arch-avr32', '--color', 8, "; +# Ignore missing compiler flags. + +is_blhc 'ignore-flag', '--ignore-flag -g', 8, + 'CFLAGS missing (-O2): gcc -g -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-c.c +'; + +is_blhc 'ignore-flag', '--ignore-flag -g --ignore-flag -O2', 0, + ''; + + +# Ignore certain lines. + +is_blhc 'ignore-line', '--ignore-line "\./prepare-script gcc test-[a-z]\.c"', 8, + 'CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): ./prepare-script gcc test-a.c test-b.c test-c.c +CPPFLAGS missing (-D_FORTIFY_SOURCE=2): ./prepare-script gcc test-a.c test-b.c test-c.c +LDFLAGS missing (-Wl,-z,relro): ./prepare-script gcc test-a.c test-b.c test-c.c +'; + +is_blhc 'ignore-line', '--ignore-line "\./prepare-script gcc test-[a-z]\.c" --ignore-line "\s*\./prepare-script gcc test-[a-z]\.c .+"', 0, + ''; + + # Correct build logs. is_blhc 'good', '', 0,