# CONSTANTS/VARIABLES
# Regex to catch compiler commands.
-my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
- (?<!\.)(?:cc|gcc|g\+\+|c\+\+)
- (?:-[\d.]+)?/x;
+my $cc_regex = qr/
+ (?<!\.)(?:cc|gcc|g\+\+|c\+\+)
+ (?:-[\d.]+)?
+ /x;
+# Full regex which matches the complete compiler name. Used in a few places to
+# prevent false negatives.
+my $cc_regex_full = qr/
+ (?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
+ $cc_regex
+ /x;
# Regex to catch (GCC) compiler warnings.
my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
);
my %extension = map { $_ => 1 } (
@source_no_preprocess,
- @source_no_preprocess_compile,
- @source_no_preprocess_compile_cpp,
- @source_no_preprocess_no_compile,
@header_preprocess,
@source_preprocess,
- @source_preprocess_compile,
- @source_preprocess_compile_cpp,
- @source_preprocess_no_compile,
);
# Regexp to match file extensions.
my $file_extension_regex = qr/
\s
- \S+ # Filename without extension.
+ \S+ # Filename without extension.
\.
- ([^\\.\s]+) # File extension.
- (?=\s|\\) # At end of word. Can't use \b because some files have non
- # word characters at the end and because \b matches double
- # extensions (like .cpp.o). Works always as all lines are
- # terminated with "\n".
+ ([^\\.,;:\s]+) # File extension.
+ (?=\s|\\) # At end of word. Can't use \b because some files have non
+ # word characters at the end and because \b matches double
+ # extensions (like .cpp.o). Works always as all lines are
+ # terminated with "\n".
/x;
# Expected (hardening) flags. All flags are used as regexps.
'-fPIE',
);
my @def_cxxflags = (
- '-g',
- '-O(?:2|3)',
+ @def_cflags,
);
# @def_cxxflags_* is the same as @def_cflags_*.
my @def_cppflags = ();
);
my @def_ldflags = ();
my @def_ldflags_relro = (
- '-Wl,(-z,)?relro',
+ '-Wl,(?:-z,)?relro',
);
my @def_ldflags_bindnow = (
- '-Wl,(-z,)?now',
+ '-Wl,(?:-z,)?now',
);
my @def_ldflags_pie = (
'-fPIE',
'-pie',
);
-# Renaming rules for the output so the regex parts are not visible.
+my @def_ldflags_pic = (
+ '-fPIC',
+ '-fpic',
+ '-shared',
+);
+# Renaming rules for the output so the regex parts are not visible. Also
+# stores string values of flag regexps above, see compile_flag_regexp().
my %flag_renames = (
- '-O(?:2|3)' => '-O2',
- '-Wl,(-z,)?relro' => '-Wl,-z,relro',
- '-Wl,(-z,)?now' => '-Wl,-z,now',
+ '-O(?:2|3)' => '-O2',
+ '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
+ '-Wl,(?:-z,)?now' => '-Wl,-z,now',
+);
+
+my %exit_code = (
+ no_compiler_commands => 1 << 0,
+ # used by POD::Usage => 1 << 1,
+ non_verbose_build => 1 << 2,
+ flags_missing => 1 << 3,
+ hardening_wrapper => 1 << 4,
+ invalid_cmake => 1 << 5,
+);
+
+# Statistics of missing flags and non-verbose build commands. Used for
+# $option_buildd.
+my %statistics = (
+ preprocess => 0,
+ preprocess_missing => 0,
+ compile => 0,
+ compile_missing => 0,
+ compile_cpp => 0,
+ compile_cpp_missing => 0,
+ link => 0,
+ link_missing => 0,
+ commands => 0,
+ commands_nonverbose => 0,
);
# Use colored (ANSI) output?
sub error_flags {
my ($message, $missing_flags_ref, $flag_renames_ref, $line) = @_;
- # Rename flags if requested.
+ # Get string value of qr//-escaped regexps and if requested rename them.
my @missing_flags = map {
- (exists $flag_renames_ref->{$_})
- ? $flag_renames_ref->{$_}
- : $_
- } @{$missing_flags_ref};
+ $flag_renames_ref->{$_}
+ } @{$missing_flags_ref};
my $flags = join ' ', @missing_flags;
printf "%s (%s)%s %s",
error_color(':', 'yellow'),
$line;
}
+sub error_invalid_cmake {
+ my ($version) = @_;
+
+ printf "%s%s %s\n",
+ error_color('INVALID CMAKE', 'red'),
+ error_color(':', 'yellow'),
+ $version;
+}
sub error_hardening_wrapper {
printf "%s%s %s\n",
error_color('HARDENING WRAPPER', 'red'),
my ($line, @flags) = @_;
foreach my $flag (@flags) {
- return 1 if $line =~ /\s$flag(?:\s|\\)/;
+ return 1 if $line =~ /$flag/;
}
return 0;
my @missing_flags = ();
foreach my $flag (@flags) {
- if ($line !~ /\s$flag(?:\s|\\)/) {
+ if (not $line =~ /$flag/) {
push @missing_flags, $flag;
}
}
my ($line, $pie, $missing_flags_ref, @flags_pie) = @_;
return 0 if not $pie;
- return 0 if not any_flags_used($line, ('-fPIC', '-fpic'));
+ return 0 if not any_flags_used($line, @def_ldflags_pic);
my %flags = map { $_ => 1 } @flags_pie;
my ($line, $next_line, $skip_ref) = @_;
if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
- or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
+ or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
return 0;
}
+ # False positives.
+ return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+
my $file = $1;
# On the first pass we only check if this line is verbose or not.
if (defined $file) {
# Get filename, we can't use the complete path as only parts of it are
# used in the real compiler command.
- $file =~ m{/([a-zA-Z0-9._-]+)$};
+ $file =~ m{/([^/\s]+)$};
$file = $1;
if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/o) {
return 1;
}
+sub compile_flag_regexp {
+ my ($flag_renames_ref, @flags) = @_;
+
+ my @result = ();
+ foreach my $flag (@flags) {
+ # Store flag name in replacement string for correct flags in messages
+ # with qr//ed flag regexps.
+ $flag_renames_ref->{qr/\s$flag(?:\s|\\)/}
+ = (exists $flag_renames_ref->{$flag})
+ ? $flag_renames_ref->{$flag}
+ : $flag;
+
+ # Compile flag regexp for faster execution.
+ push @result, qr/\s$flag(?:\s|\\)/;
+ }
+ return @result;
+}
+
sub extension_found {
my ($extensions_ref, @extensions) = @_;
$option_bindnow = 1;
}
+# Precompile all flag regexps. any_flags_used(), all_flags_used() get a lot
+# faster with this.
+@def_cflags = compile_flag_regexp(\%flag_renames, @def_cflags);
+@def_cflags_format = compile_flag_regexp(\%flag_renames, @def_cflags_format);
+@def_cflags_fortify = compile_flag_regexp(\%flag_renames, @def_cflags_fortify);
+@def_cflags_stack = compile_flag_regexp(\%flag_renames, @def_cflags_stack);
+@def_cflags_pie = compile_flag_regexp(\%flag_renames, @def_cflags_pie);
+@def_cxxflags = compile_flag_regexp(\%flag_renames, @def_cxxflags);
+@def_cppflags = compile_flag_regexp(\%flag_renames, @def_cppflags);
+@def_cppflags_fortify = compile_flag_regexp(\%flag_renames, @def_cppflags_fortify);
+@def_ldflags = compile_flag_regexp(\%flag_renames, @def_ldflags);
+@def_ldflags_relro = compile_flag_regexp(\%flag_renames, @def_ldflags_relro);
+@def_ldflags_bindnow = compile_flag_regexp(\%flag_renames, @def_ldflags_bindnow);
+@def_ldflags_pie = compile_flag_regexp(\%flag_renames, @def_ldflags_pie);
+@def_ldflags_pic = compile_flag_regexp(\%flag_renames, @def_ldflags_pic);
+
# Final exit code.
my $exit = 0;
FILE: foreach my $file (@ARGV) {
+ print "checking '$file'...\n" if scalar @ARGV > 1;
+
open my $fh, '<', $file or die "$!: $file";
+ # Architecture of this file.
+ my $arch = $option_arch;
+
# Hardening options. Not all architectures support all hardening options.
my $harden_format = 1;
my $harden_fortify = 1;
# flags are not checked.
if ($option_buildd and $line =~ /^Toolchain package versions: /) {
require Dpkg::Version;
- if ($line !~ /dpkg-dev_(\S+)/
+ if ($line !~ /\bdpkg-dev_(\S+)/
or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
$harden_format = 0;
$harden_fortify = 0;
}
}
+ # The following two versions of CMake in Debian obeyed CPPFLAGS, but
+ # this was later dropped because upstream rejected the patch. Thus
+ # build logs with these versions will have fortify hardening flags
+ # enabled, even though they may be not correctly set and are missing
+ # when build with later CMake versions. Thanks to Aron Xu for letting
+ # me know.
+ if ($line =~ /^Package versions: /
+ and $line =~ /\bcmake_(\S+)/
+ and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) {
+ if (not $option_buildd) {
+ error_invalid_cmake($1);
+ } else {
+ print "W-invalid-cmake-used $1\n";
+ }
+ $exit |= $exit_code{invalid_cmake};
+ }
+
# If hardening wrapper is used (wraps calls to gcc and adds hardening
# flags automatically) we can't perform any checks, abort.
if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
- error_hardening_wrapper();
- $exit |= 1 << 4;
+ if (not $option_buildd) {
+ error_hardening_wrapper();
+ } else {
+ print "I-hardening-wrapper-used\n";
+ }
+ $exit |= $exit_code{hardening_wrapper};
next FILE;
}
last if $line =~ /^Build finished at \d{8}-\d{4}$/;
# Detect architecture automatically unless overridden.
- if (not $option_arch
+ if (not $arch
and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) {
- $option_arch = $1;
+ $arch = $1;
}
# Ignore compiler warnings for now.
}
# Ignore lines with no compiler commands.
- next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose;
+ next if not $non_verbose
+ and not $line =~ /\b$cc_regex(?:\s|\\)/o;
+ # Ignore lines with no filenames with extensions. May miss
+ # some non-verbose builds (e.g. "gcc -o test" [sic!]), but
+ # shouldn't be a problem as the log will most likely contain
+ # other non-verbose commands which are detected.
+ next if not $non_verbose
+ and not $line =~ /$file_extension_regex/o;
# Ignore false positives.
#
# `./configure` output.
next if not $non_verbose
and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
- next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
+ next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?
(?:C|c)ompiler[\s.]*:?\s+
- $cc_regex
- (?:\s-std=[a-z0-9:+]+)?\s*$
- /xo
- or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/o
- or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
- or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
- # `make` output.
- next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++"
+ /xo;
+ next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
# Check if additional hardening options were used. Used to
# ensure they are used for the complete build.
close $fh;
if (scalar @input == 0) {
- print "No compiler commands!\n";
- $exit |= 1;
+ if (not $option_buildd) {
+ print "No compiler commands!\n";
+ } else {
+ print "W-no-compiler-commands\n";
+ }
+ $exit |= $exit_code{no_compiler_commands};
next FILE;
}
+ if ($option_buildd) {
+ $statistics{commands} += scalar @input;
+ }
+
# Option or auto detected.
- if ($option_arch) {
+ if ($arch) {
# The following was partially copied from dpkg-dev 1.16.1.2
# (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
# copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook
# later. Keep it in sync.
require Dpkg::Arch;
- my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch);
+ my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
# Disable unsupported hardening options.
- if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') {
+ if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
$harden_stack = 0;
}
if ($cpu =~ /^(ia64|hppa|avr32)$/) {
my $skip = 0;
if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {
- error_non_verbose_build($line);
- $exit |= 1 << 2;
+ if (not $option_buildd) {
+ error_non_verbose_build($line);
+ } else {
+ $statistics{commands_nonverbose}++;
+ }
+ $exit |= $exit_code{non_verbose_build};
next;
}
# Even if it's a verbose build, we might have to skip this line.
# Remove everything until and including the compiler command. Makes
# checks easier and faster.
$line =~ s/^.*?$cc_regex//o;
+ # "([...] test.c)" is not detected as 'test.c' - fix this by removing
+ # the brace and similar characters.
+ $line =~ s/['")]+$//;
# Skip unnecessary tests when only preprocessing.
my $flag_preprocess = 0;
+ my $dependency = 0;
my $preprocess = 0;
my $compile = 0;
my $link = 0;
$preprocess = 1;
$flag_preprocess = 1 if $1 eq '-E';
$compile = 1 if $1 eq '-S' or $1 eq '-c';
+ # Dependency generation for Makefiles. The other flags (-MF -MG -MP
+ # -MT -MQ) are always used with -M/-MM.
+ } elsif ($line =~ /\s(?:-M|-MM)\b/) {
+ $dependency = 1;
# Otherwise assume we are linking.
} else {
$link = 1;
}
+ # -MD/-MMD also cause dependency generation, but they don't imply -E!
+ if ($line =~ /\s(?:-MD|-MMD)\b/) {
+ $dependency = 0;
+ $flag_preprocess = 0;
+ }
+
+ # Dependency generation for Makefiles, no preprocessing or other flags
+ # needed.
+ next if $dependency;
+
# Get all file extensions on this line.
my @extensions = $line =~ /$file_extension_regex/go;
# Ignore all unknown extensions to speedup the search below.
$compile_cpp = 1;
}
+ if ($option_buildd) {
+ $statistics{preprocess}++ if $preprocess;
+ $statistics{compile}++ if $compile;
+ $statistics{compile_cpp}++ if $compile_cpp;
+ $statistics{link}++ if $link;
+ }
+
# Check hardening flags.
my @missing;
if ($compile and not all_flags_used($line, \@missing, @cflags)
and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
# Assume dpkg-buildflags returns the correct flags.
and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
- error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
+ if (not $option_buildd) {
+ error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ } else {
+ $statistics{compile_missing}++;
+ }
+ $exit |= $exit_code{flags_missing};
} elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
# Libraries linked with -fPIC don't have to (and can't) be
# linked with -fPIE as well. It's no error if only PIE flags
and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
# Assume dpkg-buildflags returns the correct flags.
and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
- error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
+ if (not $option_buildd) {
+ error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ } else {
+ $statistics{compile_cpp_missing}++;
+ }
+ $exit |= $exit_code{flags_missing};
}
if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
# Assume dpkg-buildflags returns the correct flags.
and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {
- error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
+ if (not $option_buildd) {
+ error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ } else {
+ $statistics{preprocess_missing}++;
+ }
+ $exit |= $exit_code{flags_missing};
}
if ($link and not all_flags_used($line, \@missing, @ldflags)
# Same here, -fPIC conflicts with -fPIE.
and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
# Assume dpkg-buildflags returns the correct flags.
and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {
- error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
+ if (not $option_buildd) {
+ error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ } else {
+ $statistics{link_missing}++;
+ }
+ $exit |= $exit_code{flags_missing};
}
}
}
+# Print statistics for buildd mode, only output in this mode.
+if ($option_buildd) {
+ my @warning;
+
+ if ($statistics{preprocess_missing}) {
+ push @warning, sprintf "CPPFLAGS %d (of %d)",
+ $statistics{preprocess_missing},
+ $statistics{preprocess};
+ }
+ if ($statistics{compile_missing}) {
+ push @warning, sprintf "CFLAGS %d (of %d)",
+ $statistics{compile_missing},
+ $statistics{compile};
+ }
+ if ($statistics{compile_cpp_missing}) {
+ push @warning, sprintf "CXXFLAGS %d (of %d)",
+ $statistics{compile_cpp_missing},
+ $statistics{compile_cpp};
+ }
+ if ($statistics{link_missing}) {
+ push @warning, sprintf "LDFLAGS %d (of %d)",
+ $statistics{link_missing},
+ $statistics{link};
+ }
+ if (scalar @warning) {
+ local $" = ', '; # array join string
+ print "W-dpkg-buildflags-missing @warning missing\n";
+ }
+
+ if ($statistics{commands_nonverbose}) {
+ printf "W-compiler-flags-hidden %d (of %d) hidden\n",
+ $statistics{commands_nonverbose},
+ $statistics{commands},
+ }
+}
+
+
exit $exit;
=head1 SYNOPSIS
-B<blhc> [options] <dpkg-buildpackage build log file>..
-
- --all force +all (+pie, +bindnow) check
- --arch set architecture (autodetected)
- --bindnow force +bindbow check
- --buildd parser mode for buildds
- --color use colored output
- --pie force +pie check
- --help available options
- --version version number and license
+B<blhc> [I<options>] I<E<lt>dpkg-buildpackage build log fileE<gt>..>
=head1 DESCRIPTION
Force check for all +all (+pie, +bindnow) hardening flags. By default it's
auto detected.
-=item B<--arch>
+=item B<--arch> I<architecture>
Set the specific architecture (e.g. amd64, armel, etc.), automatically
disables hardening flags not available on this architecture. Is detected
ruderich.org/simon / blhc / blhc.git / blobdiff