From 2f53c184be79865a799ee6cc2c4fffd7ddb8e9ba Mon Sep 17 00:00:00 2001 From: Simon Ruderich Date: Mon, 26 Mar 2012 03:18:03 +0200 Subject: [PATCH] Fix indentation. Whitespace only change. --- bin/blhc | 562 +++++++++++++++++++++++++++---------------------------- 1 file changed, 281 insertions(+), 281 deletions(-) diff --git a/bin/blhc b/bin/blhc index 8b21c8f..f8813ef 100755 --- a/bin/blhc +++ b/bin/blhc @@ -394,315 +394,315 @@ if ($option_all) { my $exit = 0; FILE: foreach my $file (@ARGV) { -open my $fh, '<', $file or die "$!: $file"; - -# Hardening options. Not all architectures support all hardening options. -my $harden_format = 1; -my $harden_fortify = 1; -my $harden_stack = 1; -my $harden_relro = 1; -my $harden_bindnow = $option_bindnow; # defaults to 0 -my $harden_pie = $option_pie; # defaults to 0 - -# Input lines, contain only the lines with compiler commands. -my @input = (); - -my $start = 0; -my $continuation = 0; -my $complete_line = undef; -while (my $line = <$fh>) { - # dpkg-buildflags only provides hardening flags since 1.16.1, don't check - # for hardening flags in buildd mode if an older dpkg-dev is used. Default - # flags (-g -O2) are still checked. - # - # Packages which were built before 1.16.1 but used their own hardening - # flags are not checked. - if ($option_buildd and not $start - and $line =~ /^Toolchain package versions: /) { - require Dpkg::Version; - if ($line !~ /dpkg-dev_(\S+)/ - or Dpkg::Version::version_compare($1, '1.16.1') < 0) { - $harden_format = 0; - $harden_fortify = 0; - $harden_stack = 0; - $harden_relro = 0; - $harden_bindnow = 0; - $harden_pie = 0; + open my $fh, '<', $file or die "$!: $file"; + + # Hardening options. Not all architectures support all hardening options. + my $harden_format = 1; + my $harden_fortify = 1; + my $harden_stack = 1; + my $harden_relro = 1; + my $harden_bindnow = $option_bindnow; # defaults to 0 + my $harden_pie = $option_pie; # defaults to 0 + + # Input lines, contain only the lines with compiler commands. + my @input = (); + + my $start = 0; + my $continuation = 0; + my $complete_line = undef; + while (my $line = <$fh>) { + # dpkg-buildflags only provides hardening flags since 1.16.1, don't check + # for hardening flags in buildd mode if an older dpkg-dev is used. Default + # flags (-g -O2) are still checked. + # + # Packages which were built before 1.16.1 but used their own hardening + # flags are not checked. + if ($option_buildd and not $start + and $line =~ /^Toolchain package versions: /) { + require Dpkg::Version; + if ($line !~ /dpkg-dev_(\S+)/ + or Dpkg::Version::version_compare($1, '1.16.1') < 0) { + $harden_format = 0; + $harden_fortify = 0; + $harden_stack = 0; + $harden_relro = 0; + $harden_bindnow = 0; + $harden_pie = 0; + } } - } - # If hardening wrapper is used (wraps calls to gcc and adds hardening - # flags automatically) we can't perform any checks, abort. - if (not $start and $line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { - error_hardening_wrapper(); - $exit |= 1 << 4; - next FILE; - } - - # We skip over unimportant lines at the beginning of the log to prevent - # false positives. - $start = 1 if $line =~ /^dpkg-buildpackage:/; - next if not $start; - # And stop at the end of the build log. Package details (reported by the - # buildd logs) are not important for us. This also prevents false - # positives. - last if $line =~ /^Build finished at \d{8}-\d{4}$/; - - # Detect architecture automatically unless overridden. - if (not $option_arch - and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) { - $option_arch = $1; - } - - # Ignore compiler warnings for now. - next if $line =~ /$warning_regex/o; - - if ($line =~ /\033/) { # esc - # Remove all ANSI color sequences which are sometimes used in - # non-verbose builds. - $line = Term::ANSIColor::colorstrip($line); - # Also strip '\0xf' (delete previous character), used by Elinks' build - # system. - $line =~ s/\x0f//g; - # And "ESC(B" which seems to be used on armhf and hurd (not sure what - # it does). - $line =~ s/\033\(B//g; - } + # If hardening wrapper is used (wraps calls to gcc and adds hardening + # flags automatically) we can't perform any checks, abort. + if (not $start and $line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { + error_hardening_wrapper(); + $exit |= 1 << 4; + next FILE; + } - # Check if this line indicates a non verbose build. - my $non_verbose = is_non_verbose_build($line); - - # One line may contain multiple commands (";"). Treat each one as single - # line. parse_line() is slow, only use it when necessary. - my @line = (not $line =~ /;/) - ? ($line) - : map { - # Ensure newline at the line end - necessary for correct - # parsing later. - $_ =~ s/\s+$//; - $_ .= "\n"; - } Text::ParseWords::parse_line(';', 1, $line); - foreach $line (@line) { - if ($continuation) { - $continuation = 0; - - # Join lines, but leave the "\" in place so it's clear where the - # original line break was. - chomp $complete_line; - $complete_line .= ' ' . $line; + # We skip over unimportant lines at the beginning of the log to prevent + # false positives. + $start = 1 if $line =~ /^dpkg-buildpackage:/; + next if not $start; + # And stop at the end of the build log. Package details (reported by the + # buildd logs) are not important for us. This also prevents false + # positives. + last if $line =~ /^Build finished at \d{8}-\d{4}$/; + + # Detect architecture automatically unless overridden. + if (not $option_arch + and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) { + $option_arch = $1; } - # Line continuation, line ends with "\". - if ($line =~ /\\\s*$/) { - $continuation = 1; - # Start line continuation. - if (not defined $complete_line) { - $complete_line = $line; - } - next; + + # Ignore compiler warnings for now. + next if $line =~ /$warning_regex/o; + + if ($line =~ /\033/) { # esc + # Remove all ANSI color sequences which are sometimes used in + # non-verbose builds. + $line = Term::ANSIColor::colorstrip($line); + # Also strip '\0xf' (delete previous character), used by Elinks' build + # system. + $line =~ s/\x0f//g; + # And "ESC(B" which seems to be used on armhf and hurd (not sure what + # it does). + $line =~ s/\033\(B//g; } - if (not $continuation) { - # Use the complete line if a line continuation occurred. - if (defined $complete_line) { - $line = $complete_line; - $complete_line = undef; + # Check if this line indicates a non verbose build. + my $non_verbose = is_non_verbose_build($line); + + # One line may contain multiple commands (";"). Treat each one as single + # line. parse_line() is slow, only use it when necessary. + my @line = (not $line =~ /;/) + ? ($line) + : map { + # Ensure newline at the line end - necessary for correct + # parsing later. + $_ =~ s/\s+$//; + $_ .= "\n"; + } Text::ParseWords::parse_line(';', 1, $line); + foreach $line (@line) { + if ($continuation) { + $continuation = 0; + + # Join lines, but leave the "\" in place so it's clear where the + # original line break was. + chomp $complete_line; + $complete_line .= ' ' . $line; + } + # Line continuation, line ends with "\". + if ($line =~ /\\\s*$/) { + $continuation = 1; + # Start line continuation. + if (not defined $complete_line) { + $complete_line = $line; + } + next; } - # Ignore lines with no compiler commands. - next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose; - - # Ignore false positives. - # - # `./configure` output. - next if not $non_verbose - and $line =~ /^(?:checking|(?:C|c)onfigure:) /; - next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)? - (?:C|c)ompiler[\s.]*:?\s+ - $cc_regex - (?:\s-std=[a-z0-9:+]+)?\s*$ - /xo - or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/o - or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: / - or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/; - # `make` output. - next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++" - - # Check if additional hardening options were used. Used to ensure - # they are used for the complete build. - $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie); - $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); - - push @input, $line; + if (not $continuation) { + # Use the complete line if a line continuation occurred. + if (defined $complete_line) { + $line = $complete_line; + $complete_line = undef; + } + + # Ignore lines with no compiler commands. + next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose; + + # Ignore false positives. + # + # `./configure` output. + next if not $non_verbose + and $line =~ /^(?:checking|(?:C|c)onfigure:) /; + next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)? + (?:C|c)ompiler[\s.]*:?\s+ + $cc_regex + (?:\s-std=[a-z0-9:+]+)?\s*$ + /xo + or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/o + or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: / + or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/; + # `make` output. + next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++" + + # Check if additional hardening options were used. Used to ensure + # they are used for the complete build. + $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie); + $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); + + push @input, $line; + } } } -} -close $fh; + close $fh; -if (scalar @input == 0) { - print "No compiler commands!\n"; - $exit |= 1; - next FILE; -} + if (scalar @input == 0) { + print "No compiler commands!\n"; + $exit |= 1; + next FILE; + } -# Option or auto detected. -if ($option_arch) { - # The following was partially copied from dpkg-dev 1.16.1.2 - # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), - # copyright Raphaël Hertzog , Kees Cook - # , Canonical, Ltd. licensed under GPL version 2 or - # later. Keep it in sync. + # Option or auto detected. + if ($option_arch) { + # The following was partially copied from dpkg-dev 1.16.1.2 + # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), + # copyright Raphaël Hertzog , Kees Cook + # , Canonical, Ltd. licensed under GPL version 2 or + # later. Keep it in sync. - require Dpkg::Arch; - my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch); + require Dpkg::Arch; + my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch); - # Disable unsupported hardening options. - if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') { - $harden_stack = 0; - } - if ($cpu =~ /^(ia64|hppa|avr32)$/) { - $harden_relro = 0; - $harden_bindnow = 0; + # Disable unsupported hardening options. + if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') { + $harden_stack = 0; + } + if ($cpu =~ /^(ia64|hppa|avr32)$/) { + $harden_relro = 0; + $harden_bindnow = 0; + } } -} - -# Default values. -my @cflags = @def_cflags; -my @cxxflags = @def_cxxflags; -my @cppflags = @def_cppflags; -my @ldflags = @def_ldflags; -# Check the specified hardening options, same order as dpkg-buildflags. -if ($harden_pie) { - @cflags = (@cflags, @def_cflags_pie); - @cxxflags = (@cxxflags, @def_cflags_pie); - @ldflags = (@ldflags, @def_ldflags_pie); -} -if ($harden_stack) { - @cflags = (@cflags, @def_cflags_stack); - @cxxflags = (@cxxflags, @def_cflags_stack); -} -if ($harden_fortify) { - @cflags = (@cflags, @def_cflags_fortify); - @cxxflags = (@cxxflags, @def_cflags_fortify); - @cppflags = (@cppflags, @def_cppflags_fortify); -} -if ($harden_format) { - @cflags = (@cflags, @def_cflags_format); - @cxxflags = (@cxxflags, @def_cflags_format); -} -if ($harden_relro) { - @ldflags = (@ldflags, @def_ldflags_relro); -} -if ($harden_bindnow) { - @ldflags = (@ldflags, @def_ldflags_bindnow); -} -for (my $i = 0; $i < scalar @input; $i++) { - my $line = $input[$i]; - - my $skip = 0; - if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { - error_non_verbose_build($line); - $exit |= 1 << 2; - next; + # Default values. + my @cflags = @def_cflags; + my @cxxflags = @def_cxxflags; + my @cppflags = @def_cppflags; + my @ldflags = @def_ldflags; + # Check the specified hardening options, same order as dpkg-buildflags. + if ($harden_pie) { + @cflags = (@cflags, @def_cflags_pie); + @cxxflags = (@cxxflags, @def_cflags_pie); + @ldflags = (@ldflags, @def_ldflags_pie); } - # Even if it's a verbose build, we might have to skip this line. - next if $skip; - - # Remove everything until and including the compiler command. Makes checks - # easier and faster. - $line =~ s/^.*?$cc_regex//o; - - # Skip unnecessary tests when only preprocessing. - my $flag_preprocess = 0; - - my $preprocess = 0; - my $compile = 0; - my $link = 0; - - # Preprocess, compile, assemble. - if ($line =~ /\s(-E|-S|-c)\b/) { - $preprocess = 1; - $flag_preprocess = 1 if $1 eq '-E'; - $compile = 1 if $1 eq '-S' or $1 eq '-c'; - # Otherwise assume we are linking. - } else { - $link = 1; + if ($harden_stack) { + @cflags = (@cflags, @def_cflags_stack); + @cxxflags = (@cxxflags, @def_cflags_stack); } - - # Get all file extensions on this line. - my @extensions = $line =~ /$file_extension_regex/go; - # Ignore all unknown extensions to speedup the search below. - @extensions = grep { exists $extension{$_} } @extensions; - - # These file types don't require preprocessing. - if (extension_found(\%extensions_no_preprocess, @extensions)) { - $preprocess = 0; + if ($harden_fortify) { + @cflags = (@cflags, @def_cflags_fortify); + @cxxflags = (@cxxflags, @def_cflags_fortify); + @cppflags = (@cppflags, @def_cppflags_fortify); } - # These file types require preprocessing. - if (extension_found(\%extensions_preprocess, @extensions)) { - $preprocess = 1; + if ($harden_format) { + @cflags = (@cflags, @def_cflags_format); + @cxxflags = (@cxxflags, @def_cflags_format); + } + if ($harden_relro) { + @ldflags = (@ldflags, @def_ldflags_relro); + } + if ($harden_bindnow) { + @ldflags = (@ldflags, @def_ldflags_bindnow); } - # If there are source files then it's compiling/linking in one step and we - # must check both. We only check for source files here, because header - # files cause too many false positives. - if (not $flag_preprocess - and extension_found(\%extensions_compile_link, @extensions)) { - # Assembly files don't need CFLAGS. - if (not extension_found(\%extensions_compile, @extensions) - and extension_found(\%extensions_no_compile, @extensions)) { - $compile = 0; - # But the rest does. + for (my $i = 0; $i < scalar @input; $i++) { + my $line = $input[$i]; + + my $skip = 0; + if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { + error_non_verbose_build($line); + $exit |= 1 << 2; + next; + } + # Even if it's a verbose build, we might have to skip this line. + next if $skip; + + # Remove everything until and including the compiler command. Makes checks + # easier and faster. + $line =~ s/^.*?$cc_regex//o; + + # Skip unnecessary tests when only preprocessing. + my $flag_preprocess = 0; + + my $preprocess = 0; + my $compile = 0; + my $link = 0; + + # Preprocess, compile, assemble. + if ($line =~ /\s(-E|-S|-c)\b/) { + $preprocess = 1; + $flag_preprocess = 1 if $1 eq '-E'; + $compile = 1 if $1 eq '-S' or $1 eq '-c'; + # Otherwise assume we are linking. } else { - $compile = 1; + $link = 1; } - } - # Assume CXXFLAGS are required when a C++ file is specified in the - # compiler line. - my $compile_cpp = 0; - if ($compile - and extension_found(\%extensions_compile_cpp, @extensions)) { - $compile = 0; - $compile_cpp = 1; - } + # Get all file extensions on this line. + my @extensions = $line =~ /$file_extension_regex/go; + # Ignore all unknown extensions to speedup the search below. + @extensions = grep { exists $extension{$_} } @extensions; - # Check hardening flags. - my @missing; - if ($compile and not all_flags_used($line, \@missing, @cflags) - # Libraries linked with -fPIC don't have to (and can't) be linked - # with -fPIE as well. It's no error if only PIE flags are missing. - and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) - # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get CFLAGS`/) { - error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; - } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) - # Libraries linked with -fPIC don't have to (and can't) be linked - # with -fPIE as well. It's no error if only PIE flags are missing. - and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) - # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) { - error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; - } - if ($preprocess and not all_flags_used($line, \@missing, @cppflags) - # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) { - error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; - } - if ($link and not all_flags_used($line, \@missing, @ldflags) - # Same here, -fPIC conflicts with -fPIE. - and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie) - # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { - error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; + # These file types don't require preprocessing. + if (extension_found(\%extensions_no_preprocess, @extensions)) { + $preprocess = 0; + } + # These file types require preprocessing. + if (extension_found(\%extensions_preprocess, @extensions)) { + $preprocess = 1; + } + + # If there are source files then it's compiling/linking in one step and we + # must check both. We only check for source files here, because header + # files cause too many false positives. + if (not $flag_preprocess + and extension_found(\%extensions_compile_link, @extensions)) { + # Assembly files don't need CFLAGS. + if (not extension_found(\%extensions_compile, @extensions) + and extension_found(\%extensions_no_compile, @extensions)) { + $compile = 0; + # But the rest does. + } else { + $compile = 1; + } + } + + # Assume CXXFLAGS are required when a C++ file is specified in the + # compiler line. + my $compile_cpp = 0; + if ($compile + and extension_found(\%extensions_compile_cpp, @extensions)) { + $compile = 0; + $compile_cpp = 1; + } + + # Check hardening flags. + my @missing; + if ($compile and not all_flags_used($line, \@missing, @cflags) + # Libraries linked with -fPIC don't have to (and can't) be linked + # with -fPIE as well. It's no error if only PIE flags are missing. + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get CFLAGS`/) { + error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= 1 << 3; + } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) + # Libraries linked with -fPIC don't have to (and can't) be linked + # with -fPIE as well. It's no error if only PIE flags are missing. + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) { + error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= 1 << 3; + } + if ($preprocess and not all_flags_used($line, \@missing, @cppflags) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) { + error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= 1 << 3; + } + if ($link and not all_flags_used($line, \@missing, @ldflags) + # Same here, -fPIC conflicts with -fPIE. + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { + error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= 1 << 3; + } } } -} exit $exit; -- 2.45.2