X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=835e9e04e344cea2d96ffe44f5a4fc032343eb83;hp=f99460249a9d47e728cbd28368989c364a65ed1e;hb=c2dd74aada8d92258b14727c057e5d02a4c8c7a4;hpb=33cf53c9dffe333db74d89b90e8b1d1bb88d91b9

diff --git a/bin/blhc b/bin/blhc
index f994602..835e9e0 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -22,7 +22,6 @@ use strict;
 use warnings;
 
 use Getopt::Long ();
-use Term::ANSIColor ();
 use Text::ParseWords ();
 
 our $VERSION = '0.01';
@@ -129,26 +128,20 @@ my %extensions_compile_cpp = map { $_ => 1 } (
 );
 my %extension = map { $_ => 1 } (
     @source_no_preprocess,
-    @source_no_preprocess_compile,
-    @source_no_preprocess_compile_cpp,
-    @source_no_preprocess_no_compile,
     @header_preprocess,
     @source_preprocess,
-    @source_preprocess_compile,
-    @source_preprocess_compile_cpp,
-    @source_preprocess_no_compile,
 );
 
 # Regexp to match file extensions.
 my $file_extension_regex = qr/
     \s
-    \S+         # Filename without extension.
+    \S+             # Filename without extension.
     \.
-    ([^\\.\s]+) # File extension.
-    (?=\s|\\)   # At end of word. Can't use \b because some files have non
-                # word characters at the end and because \b matches double
-                # extensions (like .cpp.o). Works always as all lines are
-                # terminated with "\n".
+    ([^\/\\.,;:\s]+)# File extension.
+    (?=\s|\\)       # At end of word. Can't use \b because some files have non
+                    # word characters at the end and because \b matches double
+                    # extensions (like .cpp.o). Works always as all lines are
+                    # terminated with "\n".
     /x;
 
 # Expected (hardening) flags. All flags are used as regexps.
@@ -181,10 +174,10 @@ my @def_cppflags_fortify = (
 );
 my @def_ldflags = ();
 my @def_ldflags_relro = (
-    '-Wl,(-z,)?relro',
+    '-Wl,(?:-z,)?relro',
 );
 my @def_ldflags_bindnow = (
-    '-Wl,(-z,)?now',
+    '-Wl,(?:-z,)?now',
 );
 my @def_ldflags_pie = (
     '-fPIE',
@@ -193,13 +186,43 @@ my @def_ldflags_pie = (
 my @def_ldflags_pic = (
     '-fPIC',
     '-fpic',
+    '-shared',
+);
+# References to all flags checked by the parser.
+my @flag_refs = (
+    \@def_cflags,
+    \@def_cflags_format,
+    \@def_cflags_fortify,
+    \@def_cflags_stack,
+    \@def_cflags_pie,
+    \@def_cxxflags,
+    \@def_cppflags,
+    \@def_cppflags_fortify,
+    \@def_ldflags,
+    \@def_ldflags_relro,
+    \@def_ldflags_bindnow,
+);
+# References to all used flags.
+my @flag_refs_all = (
+    @flag_refs,
+    \@def_ldflags_pie,
+    \@def_ldflags_pic,
 );
 # Renaming rules for the output so the regex parts are not visible. Also
 # stores string values of flag regexps above, see compile_flag_regexp().
 my %flag_renames = (
-    '-O(?:2|3)'       => '-O2',
-    '-Wl,(-z,)?relro' => '-Wl,-z,relro',
-    '-Wl,(-z,)?now'   => '-Wl,-z,now',
+    '-O(?:2|3)'         => '-O2',
+    '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
+    '-Wl,(?:-z,)?now'   => '-Wl,-z,now',
+);
+
+my %exit_code = (
+    no_compiler_commands => 1 << 0,
+    # used by POD::Usage => 1 << 1,
+    non_verbose_build    => 1 << 2,
+    flags_missing        => 1 << 3,
+    hardening_wrapper    => 1 << 4,
+    invalid_cmake        => 1 << 5,
 );
 
 # Statistics of missing flags and non-verbose build commands. Used for
@@ -244,6 +267,14 @@ sub error_non_verbose_build {
            error_color(':', 'yellow'),
            $line;
 }
+sub error_invalid_cmake {
+    my ($version) = @_;
+
+    printf "%s%s %s\n",
+            error_color('INVALID CMAKE', 'red'),
+            error_color(':', 'yellow'),
+            $version;
+}
 sub error_hardening_wrapper {
     printf "%s%s %s\n",
             error_color('HARDENING WRAPPER', 'red'),
@@ -311,13 +342,23 @@ sub is_non_verbose_build {
     my ($line, $next_line, $skip_ref) = @_;
 
     if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
-                or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
+                or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
                 or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
                 or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
                 or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
         return 0;
     }
 
+    # False positives.
+    #
+    # C++ compiler setting.
+    return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+    # "Compiling" with no file name.
+    if ($line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/) {
+        # $file_extension_regex may need spaces around the filename.
+        return 0 if not " $1 " =~ /$file_extension_regex/o;
+    }
+
     my $file = $1;
 
     # On the first pass we only check if this line is verbose or not.
@@ -400,7 +441,8 @@ if (not Getopt::Long::GetOptions(
             'color'    => \$option_color,
             'arch=s'   => \$option_arch,
             'buildd'   => \$option_buildd,
-        )) {
+        )
+        or scalar @ARGV == 0) {
     require Pod::Usage;
     Pod::Usage::pod2usage(2);
 }
@@ -427,6 +469,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     exit 0;
 }
 
+# Don't load Term::ANSIColor in buildd mode because Term::ANSIColor is not
+# installed on Debian's buildds.
+if (not $option_buildd) {
+    require Term::ANSIColor;
+}
+
 if ($option_all) {
     $option_pie     = 1;
     $option_bindnow = 1;
@@ -434,26 +482,21 @@ if ($option_all) {
 
 # Precompile all flag regexps. any_flags_used(), all_flags_used() get a lot
 # faster with this.
-@def_cflags           = compile_flag_regexp(\%flag_renames, @def_cflags);
-@def_cflags_format    = compile_flag_regexp(\%flag_renames, @def_cflags_format);
-@def_cflags_fortify   = compile_flag_regexp(\%flag_renames, @def_cflags_fortify);
-@def_cflags_stack     = compile_flag_regexp(\%flag_renames, @def_cflags_stack);
-@def_cflags_pie       = compile_flag_regexp(\%flag_renames, @def_cflags_pie);
-@def_cxxflags         = compile_flag_regexp(\%flag_renames, @def_cxxflags);
-@def_cppflags         = compile_flag_regexp(\%flag_renames, @def_cppflags);
-@def_cppflags_fortify = compile_flag_regexp(\%flag_renames, @def_cppflags_fortify);
-@def_ldflags          = compile_flag_regexp(\%flag_renames, @def_ldflags);
-@def_ldflags_relro    = compile_flag_regexp(\%flag_renames, @def_ldflags_relro);
-@def_ldflags_bindnow  = compile_flag_regexp(\%flag_renames, @def_ldflags_bindnow);
-@def_ldflags_pie      = compile_flag_regexp(\%flag_renames, @def_ldflags_pie);
-@def_ldflags_pic      = compile_flag_regexp(\%flag_renames, @def_ldflags_pic);
+foreach my $flags (@flag_refs_all) {
+    @{$flags} = compile_flag_regexp(\%flag_renames, @{$flags});
+}
 
 # Final exit code.
 my $exit = 0;
 
 FILE: foreach my $file (@ARGV) {
+    print "checking '$file'...\n" if scalar @ARGV > 1;
+
     open my $fh, '<', $file or die "$!: $file";
 
+    # Architecture of this file.
+    my $arch = $option_arch;
+
     # Hardening options. Not all architectures support all hardening options.
     my $harden_format  = 1;
     my $harden_fortify = 1;
@@ -471,7 +514,7 @@ FILE: foreach my $file (@ARGV) {
         # flags are not checked.
         if ($option_buildd and $line =~ /^Toolchain package versions: /) {
             require Dpkg::Version;
-            if ($line !~ /dpkg-dev_(\S+)/
+            if ($line !~ /\bdpkg-dev_(\S+)/
                     or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
                 $harden_format  = 0;
                 $harden_fortify = 0;
@@ -482,6 +525,23 @@ FILE: foreach my $file (@ARGV) {
             }
         }
 
+        # The following two versions of CMake in Debian obeyed CPPFLAGS, but
+        # this was later dropped because upstream rejected the patch. Thus
+        # build logs with these versions will have fortify hardening flags
+        # enabled, even though they may be not correctly set and are missing
+        # when build with later CMake versions. Thanks to Aron Xu for letting
+        # me know.
+        if ($line =~ /^Package versions: /
+                and $line =~ /\bcmake_(\S+)/
+                and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) {
+            if (not $option_buildd) {
+                error_invalid_cmake($1);
+            } else {
+                print "W-invalid-cmake-used $1\n";
+            }
+            $exit |= $exit_code{invalid_cmake};
+        }
+
         # If hardening wrapper is used (wraps calls to gcc and adds hardening
         # flags automatically) we can't perform any checks, abort.
         if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
@@ -490,7 +550,7 @@ FILE: foreach my $file (@ARGV) {
             } else {
                 print "I-hardening-wrapper-used\n";
             }
-            $exit |= 1 << 4;
+            $exit |= $exit_code{hardening_wrapper};
             next FILE;
         }
 
@@ -511,15 +571,15 @@ FILE: foreach my $file (@ARGV) {
         last if $line =~ /^Build finished at \d{8}-\d{4}$/;
 
         # Detect architecture automatically unless overridden.
-        if (not $option_arch
+        if (not $arch
                 and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) {
-            $option_arch = $1;
+            $arch = $1;
         }
 
         # Ignore compiler warnings for now.
         next if $line =~ /$warning_regex/o;
 
-        if ($line =~ /\033/) { # esc
+        if (not $option_buildd and $line =~ /\033/) { # esc
             # Remove all ANSI color sequences which are sometimes used in
             # non-verbose builds.
             $line = Term::ANSIColor::colorstrip($line);
@@ -571,23 +631,24 @@ FILE: foreach my $file (@ARGV) {
                 }
 
                 # Ignore lines with no compiler commands.
-                next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose;
+                next if not $non_verbose
+                        and not $line =~ /\b$cc_regex(?:\s|\\)/o;
+                # Ignore lines with no filenames with extensions. May miss
+                # some non-verbose builds (e.g. "gcc -o test" [sic!]), but
+                # shouldn't be a problem as the log will most likely contain
+                # other non-verbose commands which are detected.
+                next if not $non_verbose
+                        and not $line =~ /$file_extension_regex/o;
 
                 # Ignore false positives.
                 #
                 # `./configure` output.
                 next if not $non_verbose
                         and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
-                next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
+                next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?
                                    (?:C|c)ompiler[\s.]*:?\s+
-                                   $cc_regex_full
-                                   (?:\s-std=[a-z0-9:+]+)?\s*$
-                                 /xo
-                        or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o
-                        or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
-                        or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
-                # `make` output.
-                next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++"
+                                 /xo;
+                next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
 
                 # Check if additional hardening options were used. Used to
                 # ensure they are used for the complete build.
@@ -602,8 +663,12 @@ FILE: foreach my $file (@ARGV) {
     close $fh;
 
     if (scalar @input == 0) {
-        print "No compiler commands!\n";
-        $exit |= 1;
+        if (not $option_buildd) {
+            print "No compiler commands!\n";
+        } else {
+            print "W-no-compiler-commands\n";
+        }
+        $exit |= $exit_code{no_compiler_commands};
         next FILE;
     }
 
@@ -612,7 +677,7 @@ FILE: foreach my $file (@ARGV) {
     }
 
     # Option or auto detected.
-    if ($option_arch) {
+    if ($arch) {
         # The following was partially copied from dpkg-dev 1.16.1.2
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook
@@ -620,10 +685,10 @@ FILE: foreach my $file (@ARGV) {
         # later. Keep it in sync.
 
         require Dpkg::Arch;
-        my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch);
+        my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
 
         # Disable unsupported hardening options.
-        if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') {
+        if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
             $harden_stack = 0;
         }
         if ($cpu =~ /^(ia64|hppa|avr32)$/) {
@@ -673,7 +738,7 @@ FILE: foreach my $file (@ARGV) {
             } else {
                 $statistics{commands_nonverbose}++;
             }
-            $exit |= 1 << 2;
+            $exit |= $exit_code{non_verbose_build};
             next;
         }
         # Even if it's a verbose build, we might have to skip this line.
@@ -689,6 +754,7 @@ FILE: foreach my $file (@ARGV) {
         # Skip unnecessary tests when only preprocessing.
         my $flag_preprocess = 0;
 
+        my $dependency = 0;
         my $preprocess = 0;
         my $compile    = 0;
         my $link       = 0;
@@ -698,11 +764,25 @@ FILE: foreach my $file (@ARGV) {
             $preprocess      = 1;
             $flag_preprocess = 1 if $1 eq '-E';
             $compile         = 1 if $1 eq '-S' or $1 eq '-c';
+        # Dependency generation for Makefiles. The other flags (-MF -MG -MP
+        # -MT -MQ) are always used with -M/-MM.
+        } elsif ($line =~ /\s(?:-M|-MM)\b/) {
+            $dependency = 1;
         # Otherwise assume we are linking.
         } else {
             $link = 1;
         }
 
+        # -MD/-MMD also cause dependency generation, but they don't imply -E!
+        if ($line =~ /\s(?:-MD|-MMD)\b/) {
+            $dependency      = 0;
+            $flag_preprocess = 0;
+        }
+
+        # Dependency generation for Makefiles, no preprocessing or other flags
+        # needed.
+        next if $dependency;
+
         # Get all file extensions on this line.
         my @extensions = $line =~ /$file_extension_regex/go;
         # Ignore all unknown extensions to speedup the search below.
@@ -762,7 +842,7 @@ FILE: foreach my $file (@ARGV) {
             } else {
                 $statistics{compile_missing}++;
             }
-            $exit |= 1 << 3;
+            $exit |= $exit_code{flags_missing};
         } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
                 # Libraries linked with -fPIC don't have to (and can't) be
                 # linked with -fPIE as well. It's no error if only PIE flags
@@ -775,7 +855,7 @@ FILE: foreach my $file (@ARGV) {
             } else {
                 $statistics{compile_cpp_missing}++;
             }
-            $exit |= 1 << 3;
+            $exit |= $exit_code{flags_missing};
         }
         if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
                 # Assume dpkg-buildflags returns the correct flags.
@@ -785,7 +865,7 @@ FILE: foreach my $file (@ARGV) {
             } else {
                 $statistics{preprocess_missing}++;
             }
-            $exit |= 1 << 3;
+            $exit |= $exit_code{flags_missing};
         }
         if ($link and not all_flags_used($line, \@missing, @ldflags)
                 # Same here, -fPIC conflicts with -fPIE.
@@ -797,7 +877,7 @@ FILE: foreach my $file (@ARGV) {
             } else {
                 $statistics{link_missing}++;
             }
-            $exit |= 1 << 3;
+            $exit |= $exit_code{flags_missing};
         }
     }
 }
@@ -850,7 +930,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags
 
 =head1 SYNOPSIS
 
-B<blhc> [options] <dpkg-buildpackage build log file>..
+B<blhc> [I<options>] I<E<lt>dpkg-buildpackage build log fileE<gt>..>
 
 =head1 DESCRIPTION
 
@@ -866,7 +946,7 @@ other important warnings. It's licensed under the GPL 3 or later.
 Force check for all +all (+pie, +bindnow) hardening flags. By default it's
 auto detected.
 
-=item B<--arch>
+=item B<--arch> I<architecture>
 
 Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected
@@ -885,9 +965,18 @@ changes are in effect:
 
 =item
 
+Print tags instead of normal warnings, see README file for a list of possible
+tags.
+
+=item
+
 Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is
 detected).
 
+=item
+
+Don't require Term::ANSIColor.
+
 =back
 
 =item B<--color>