X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=91a5f4943c29076d61bde0904dffc7aa8d38a74a;hp=71c97cef5bda0e31a5282160557c2e769898e520;hb=53e64de60f08fcb752b1f3ccb41c9e8555be8866;hpb=ac8118289ece66a515f2602928242d9179401fbb diff --git a/bin/blhc b/bin/blhc index 71c97ce..91a5f49 100755 --- a/bin/blhc +++ b/bin/blhc @@ -31,127 +31,194 @@ our $VERSION = '0.01'; # CONSTANTS/VARIABLES # Regex to catch compiler commands. -my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)? - (? 1 } ( + @source_no_preprocess, +); +my %extensions_preprocess = map { $_ => 1 } ( + @header_preprocess, + @source_preprocess, +); +my %extensions_compile_link = map { $_ => 1 } ( + @source_preprocess, + @source_no_preprocess, +); +my %extensions_compile = map { $_ => 1 } ( + @source_preprocess_compile, + @source_no_preprocess_compile, +); +my %extensions_no_compile = map { $_ => 1 } ( + @source_preprocess_no_compile, + @source_no_preprocess_no_compile, +); +my %extensions_compile_cpp = map { $_ => 1 } ( + @source_preprocess_compile_cpp, + @source_no_preprocess_compile_cpp, +); +my %extension = map { $_ => 1 } ( + @source_no_preprocess, + @header_preprocess, + @source_preprocess, +); + +# Regexp to match file extensions. +my $file_extension_regex = qr/ + \s + \S+ # Filename without extension. + \. + ([^\\.,;:\s]+) # File extension. + (?=\s|\\) # At end of word. Can't use \b because some files have non + # word characters at the end and because \b matches double + # extensions (like .cpp.o). Works always as all lines are + # terminated with "\n". /x; # Expected (hardening) flags. All flags are used as regexps. -my @cflags = ( +my @def_cflags = ( '-g', '-O(?:2|3)', ); -my @cflags_format = ( +my @def_cflags_format = ( '-Wformat', '-Wformat-security', '-Werror=format-security', ); -my @cflags_fortify = ( +my @def_cflags_fortify = ( # fortify needs at least -O1, but -O2 is recommended anyway ); -my @cflags_stack = ( +my @def_cflags_stack = ( '-fstack-protector', '--param=ssp-buffer-size=4', ); -my @cflags_pie = ( +my @def_cflags_pie = ( '-fPIE', ); -my @cppflags = (); -my @cppflags_fortify = ( +my @def_cxxflags = ( + @def_cflags, +); +# @def_cxxflags_* is the same as @def_cflags_*. +my @def_cppflags = (); +my @def_cppflags_fortify = ( '-D_FORTIFY_SOURCE=2', ); -my @ldflags = (); -my @ldflags_relro = ( - '-Wl,(-z,)?relro', +my @def_ldflags = (); +my @def_ldflags_relro = ( + '-Wl,(?:-z,)?relro', ); -my @ldflags_bindnow = ( - '-Wl,(-z,)?now', +my @def_ldflags_bindnow = ( + '-Wl,(?:-z,)?now', ); -my @ldflags_pie = ( +my @def_ldflags_pie = ( '-fPIE', '-pie', ); -# Renaming rules for the output so the regex parts are not visible. +my @def_ldflags_pic = ( + '-fPIC', + '-fpic', + '-shared', +); +# Renaming rules for the output so the regex parts are not visible. Also +# stores string values of flag regexps above, see compile_flag_regexp(). my %flag_renames = ( - '-O(?:2|3)' => '-O2', - '-Wl,(-z,)?relro' => '-Wl,-z,relro', - '-Wl,(-z,)?now' => '-Wl,-z,now', + '-O(?:2|3)' => '-O2', + '-Wl,(?:-z,)?relro' => '-Wl,-z,relro', + '-Wl,(?:-z,)?now' => '-Wl,-z,now', +); + +my %exit_code = ( + no_compiler_commands => 1 << 0, + # used by POD::Usage => 1 << 1, + non_verbose_build => 1 << 2, + flags_missing => 1 << 3, + hardening_wrapper => 1 << 4, + invalid_cmake => 1 << 5, +); + +# Statistics of missing flags and non-verbose build commands. Used for +# $option_buildd. +my %statistics = ( + preprocess => 0, + preprocess_missing => 0, + compile => 0, + compile_missing => 0, + compile_cpp => 0, + compile_cpp_missing => 0, + link => 0, + link_missing => 0, + commands => 0, + commands_nonverbose => 0, ); # Use colored (ANSI) output? @@ -163,12 +230,10 @@ my $option_color; sub error_flags { my ($message, $missing_flags_ref, $flag_renames_ref, $line) = @_; - # Rename flags if requested. + # Get string value of qr//-escaped regexps and if requested rename them. my @missing_flags = map { - (exists $flag_renames_ref->{$_}) - ? $flag_renames_ref->{$_} - : $_ - } @{$missing_flags_ref}; + $flag_renames_ref->{$_} + } @{$missing_flags_ref}; my $flags = join ' ', @missing_flags; printf "%s (%s)%s %s", @@ -183,6 +248,14 @@ sub error_non_verbose_build { error_color(':', 'yellow'), $line; } +sub error_invalid_cmake { + my ($version) = @_; + + printf "%s%s %s\n", + error_color('INVALID CMAKE', 'red'), + error_color(':', 'yellow'), + $version; +} sub error_hardening_wrapper { printf "%s%s %s\n", error_color('HARDENING WRAPPER', 'red'), @@ -203,7 +276,7 @@ sub any_flags_used { my ($line, @flags) = @_; foreach my $flag (@flags) { - return 1 if $line =~ /\s$flag(?:\s|\\)/; + return 1 if $line =~ /$flag/; } return 0; @@ -213,7 +286,7 @@ sub all_flags_used { my @missing_flags = (); foreach my $flag (@flags) { - if ($line !~ /\s$flag(?:\s|\\)/) { + if (not $line =~ /$flag/) { push @missing_flags, $flag; } } @@ -229,7 +302,7 @@ sub pic_pie_conflict { my ($line, $pie, $missing_flags_ref, @flags_pie) = @_; return 0 if not $pie; - return 0 if not any_flags_used($line, ('-fPIC', '-fpic')); + return 0 if not any_flags_used($line, @def_ldflags_pic); my %flags = map { $_ => 1 } @flags_pie; @@ -250,13 +323,16 @@ sub is_non_verbose_build { my ($line, $next_line, $skip_ref) = @_; if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/ - or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/ + or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/ or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/ or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/ or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) { return 0; } + # False positives. + return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/; + my $file = $1; # On the first pass we only check if this line is verbose or not. @@ -271,10 +347,10 @@ sub is_non_verbose_build { if (defined $file) { # Get filename, we can't use the complete path as only parts of it are # used in the real compiler command. - $file =~ m{/([a-zA-Z0-9._-]+)$}; + $file =~ m{/([^/\s]+)$}; $file = $1; - if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/) { + if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/o) { # We still have to skip the current line as it doesn't contain any # compiler commands. ${$skip_ref} = 1; @@ -285,20 +361,45 @@ sub is_non_verbose_build { return 1; } +sub compile_flag_regexp { + my ($flag_renames_ref, @flags) = @_; -# MAIN + my @result = (); + foreach my $flag (@flags) { + # Store flag name in replacement string for correct flags in messages + # with qr//ed flag regexps. + $flag_renames_ref->{qr/\s$flag(?:\s|\\)/} + = (exists $flag_renames_ref->{$flag}) + ? $flag_renames_ref->{$flag} + : $flag; + + # Compile flag regexp for faster execution. + push @result, qr/\s$flag(?:\s|\\)/; + } + return @result; +} + +sub extension_found { + my ($extensions_ref, @extensions) = @_; + + my $found = 0; + foreach my $extension (@extensions) { + if (exists $extensions_ref->{$extension}) { + $found = 1; + last; + } + } + return $found; +} -# Hardening options. Not all architectures support all hardening options. -my $harden_format = 1; -my $harden_fortify = 1; -my $harden_stack = 1; -my $harden_relro = 1; -my $harden_bindnow = 0; -my $harden_pie = 0; + +# MAIN # Parse command line arguments. my $option_help = 0; my $option_version = 0; +my $option_pie = 0; +my $option_bindnow = 0; my $option_all = 0; my $option_arch = undef; my $option_buildd = 0; @@ -307,8 +408,8 @@ if (not Getopt::Long::GetOptions( 'help|h|?' => \$option_help, 'version' => \$option_version, # Hardening options. - 'pie' => \$harden_pie, - 'bindnow' => \$harden_bindnow, + 'pie' => \$option_pie, + 'bindnow' => \$option_bindnow, 'all' => \$option_all, # Misc. 'color' => \$option_color, @@ -342,271 +443,459 @@ along with this program. If not, see . } if ($option_all) { - $harden_pie = 1; - $harden_bindnow = 1; + $option_pie = 1; + $option_bindnow = 1; } +# Precompile all flag regexps. any_flags_used(), all_flags_used() get a lot +# faster with this. +@def_cflags = compile_flag_regexp(\%flag_renames, @def_cflags); +@def_cflags_format = compile_flag_regexp(\%flag_renames, @def_cflags_format); +@def_cflags_fortify = compile_flag_regexp(\%flag_renames, @def_cflags_fortify); +@def_cflags_stack = compile_flag_regexp(\%flag_renames, @def_cflags_stack); +@def_cflags_pie = compile_flag_regexp(\%flag_renames, @def_cflags_pie); +@def_cxxflags = compile_flag_regexp(\%flag_renames, @def_cxxflags); +@def_cppflags = compile_flag_regexp(\%flag_renames, @def_cppflags); +@def_cppflags_fortify = compile_flag_regexp(\%flag_renames, @def_cppflags_fortify); +@def_ldflags = compile_flag_regexp(\%flag_renames, @def_ldflags); +@def_ldflags_relro = compile_flag_regexp(\%flag_renames, @def_ldflags_relro); +@def_ldflags_bindnow = compile_flag_regexp(\%flag_renames, @def_ldflags_bindnow); +@def_ldflags_pie = compile_flag_regexp(\%flag_renames, @def_ldflags_pie); +@def_ldflags_pic = compile_flag_regexp(\%flag_renames, @def_ldflags_pic); + # Final exit code. my $exit = 0; -# Input lines, contain only the lines with compiler commands. -my @input = (); - -my $start = 0; -my $continuation = 0; -my $complete_line = undef; -while (my $line = <>) { - # dpkg-buildflags only provides hardening flags since 1.16.1, don't check - # for hardening flags in buildd mode if an older dpkg-dev is used. Default - # flags (-g -O2) are still checked. - # - # Packages which were built before 1.16.1 but used their own hardening - # flags are not checked. - if ($option_buildd and not $start - and $line =~ /^Toolchain package versions: /) { - require Dpkg::Version; - if ($line !~ /dpkg-dev_(\S+)/ - or Dpkg::Version::version_compare($1, '1.16.1') < 0) { - $harden_format = 0; - $harden_fortify = 0; - $harden_stack = 0; - $harden_relro = 0; - $harden_bindnow = 0; - $harden_pie = 0; +FILE: foreach my $file (@ARGV) { + print "checking '$file'...\n" if scalar @ARGV > 1; + + open my $fh, '<', $file or die "$!: $file"; + + # Architecture of this file. + my $arch = $option_arch; + + # Hardening options. Not all architectures support all hardening options. + my $harden_format = 1; + my $harden_fortify = 1; + my $harden_stack = 1; + my $harden_relro = 1; + my $harden_bindnow = $option_bindnow; # defaults to 0 + my $harden_pie = $option_pie; # defaults to 0 + + while (my $line = <$fh>) { + # dpkg-buildflags only provides hardening flags since 1.16.1, don't + # check for hardening flags in buildd mode if an older dpkg-dev is + # used. Default flags (-g -O2) are still checked. + # + # Packages which were built before 1.16.1 but used their own hardening + # flags are not checked. + if ($option_buildd and $line =~ /^Toolchain package versions: /) { + require Dpkg::Version; + if ($line !~ /\bdpkg-dev_(\S+)/ + or Dpkg::Version::version_compare($1, '1.16.1') < 0) { + $harden_format = 0; + $harden_fortify = 0; + $harden_stack = 0; + $harden_relro = 0; + $harden_bindnow = 0; + $harden_pie = 0; + } } - } - # If hardening wrapper is used (wraps calls to gcc and adds hardening - # flags automatically) we can't perform any checks, abort. - if (not $start and $line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { - error_hardening_wrapper(); - $exit |= 1 << 4; - exit $exit; - } + # The following two versions of CMake in Debian obeyed CPPFLAGS, but + # this was later dropped because upstream rejected the patch. Thus + # build logs with these versions will have fortify hardening flags + # enabled, even though they may be not correctly set and are missing + # when build with later CMake versions. Thanks to Aron Xu for letting + # me know. + if ($line =~ /^Package versions: / + and $line =~ /\bcmake_(\S+)/ + and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) { + if (not $option_buildd) { + error_invalid_cmake($1); + } else { + print "W-invalid-cmake-used $1\n"; + } + $exit |= $exit_code{invalid_cmake}; + } + + # If hardening wrapper is used (wraps calls to gcc and adds hardening + # flags automatically) we can't perform any checks, abort. + if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { + if (not $option_buildd) { + error_hardening_wrapper(); + } else { + print "I-hardening-wrapper-used\n"; + } + $exit |= $exit_code{hardening_wrapper}; + next FILE; + } - # We skip over unimportant lines at the beginning of the log to prevent - # false positives. - $start = 1 if $line =~ /^dpkg-buildpackage:/; - next if not $start; - # And stop at the end of the build log. Package details (reported by the - # buildd logs) are not important for us. This also prevents false - # positives. - last if $line =~ /^Build finished at \d{8}-\d{4}$/; - - # Detect architecture automatically unless overridden. - if (not $option_arch - and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) { - $option_arch = $1; + # We skip over unimportant lines at the beginning of the log to + # prevent false positives. + last if $line =~ /^dpkg-buildpackage:/; } - # Ignore compiler warnings for now. - next if $line =~ /$warning_regex/; - - # Remove all ANSI color sequences which are sometimes used in non-verbose - # builds. - $line = Term::ANSIColor::colorstrip($line); - # Also strip '\0xf' (delete previous character), used by Elinks' build - # system. - $line =~ s/\x0f//g; - # And "ESC(B" which seems to be used on armhf and hurd (not sure what it - # does). - $line =~ s/\033\(B//g; - - # Check if this line indicates a non verbose build. - my $non_verbose = is_non_verbose_build($line); - - # One line may contain multiple commands (";"). Treat each one as single - # line. parse_line() is slow, only use it when necessary. - my @line = (not $line =~ /;/) - ? ($line) - : Text::ParseWords::parse_line(';', 1, $line); - foreach $line (@line) { - # Add newline, drop all other whitespace at the end of a line. - $line =~ s/\s+$//; - $line .= "\n"; - - if ($continuation) { - $continuation = 0; - - # Join lines, but leave the "\" in place so it's clear where the - # original line break was. - chomp $complete_line; - $complete_line .= ' ' . $line; + # Input lines, contain only the lines with compiler commands. + my @input = (); + + my $continuation = 0; + my $complete_line = undef; + while (my $line = <$fh>) { + # And stop at the end of the build log. Package details (reported by + # the buildd logs) are not important for us. This also prevents false + # positives. + last if $line =~ /^Build finished at \d{8}-\d{4}$/; + + # Detect architecture automatically unless overridden. + if (not $arch + and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) { + $arch = $1; } - # Line continuation, line ends with "\". - if ($line =~ /\\\s*$/) { - $continuation = 1; - # Start line continuation. - if (not defined $complete_line) { - $complete_line = $line; - } - next; + + # Ignore compiler warnings for now. + next if $line =~ /$warning_regex/o; + + if ($line =~ /\033/) { # esc + # Remove all ANSI color sequences which are sometimes used in + # non-verbose builds. + $line = Term::ANSIColor::colorstrip($line); + # Also strip '\0xf' (delete previous character), used by Elinks' + # build system. + $line =~ s/\x0f//g; + # And "ESC(B" which seems to be used on armhf and hurd (not sure + # what it does). + $line =~ s/\033\(B//g; } - if (not $continuation) { - # Use the complete line if a line continuation occurred. - if (defined $complete_line) { - $line = $complete_line; - $complete_line = undef; + # Check if this line indicates a non verbose build. + my $non_verbose = is_non_verbose_build($line); + + # One line may contain multiple commands (";"). Treat each one as + # single line. parse_line() is slow, only use it when necessary. + my @line = (not $line =~ /;/) + ? ($line) + : map { + # Ensure newline at the line end - necessary for + # correct parsing later. + $_ =~ s/\s+$//; + $_ .= "\n"; + } Text::ParseWords::parse_line(';', 1, $line); + foreach $line (@line) { + if ($continuation) { + $continuation = 0; + + # Join lines, but leave the "\" in place so it's clear where + # the original line break was. + chomp $complete_line; + $complete_line .= ' ' . $line; + } + # Line continuation, line ends with "\". + if ($line =~ /\\\s*$/) { + $continuation = 1; + # Start line continuation. + if (not defined $complete_line) { + $complete_line = $line; + } + next; } - # Ignore lines with no compiler commands. - next if $line !~ /\b$cc_regex(?:\s|\\)/ and not $non_verbose; - - # Ignore false positives. - # - # `./configure` output. - next if not $non_verbose - and $line =~ /^(?:checking|(?:C|c)onfigure:) /; - next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)? - (?:C|c)ompiler[\s.]*:?\s+ - $cc_regex - (?:\s-std=[a-z0-9:+]+)?\s*$ - /x - or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/ - or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: / - or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/; - # `make` output. - next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++" - - # Check if additional hardening options were used. Used to ensure - # they are used for the complete build. - $harden_pie = 1 if any_flags_used($line, @cflags_pie, @ldflags_pie); - $harden_bindnow = 1 if any_flags_used($line, @ldflags_bindnow); - - push @input, $line; + if (not $continuation) { + # Use the complete line if a line continuation occurred. + if (defined $complete_line) { + $line = $complete_line; + $complete_line = undef; + } + + # Ignore lines with no compiler commands. + next if not $non_verbose + and not $line =~ /\b$cc_regex(?:\s|\\)/o; + # Ignore lines with no filenames with extensions. May miss + # some non-verbose builds (e.g. "gcc -o test" [sic!]), but + # shouldn't be a problem as the log will most likely contain + # other non-verbose commands which are detected. + next if not $non_verbose + and not $line =~ /$file_extension_regex/o; + + # Ignore false positives. + # + # `./configure` output. + next if not $non_verbose + and $line =~ /^(?:checking|(?:C|c)onfigure:) /; + next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)? + (?:C|c)ompiler[\s.]*:?\s+ + /xo; + next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o; + + # Check if additional hardening options were used. Used to + # ensure they are used for the complete build. + $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie); + $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); + + push @input, $line; + } } } -} - -if (scalar @input == 0) { - print "No compiler commands!\n"; - $exit |= 1; - exit $exit; -} -# Option or auto detected. -if ($option_arch) { - # The following was partially copied from dpkg-dev 1.16.1.2 - # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), - # copyright Raphaël Hertzog , Kees Cook - # , Canonical, Ltd. licensed under GPL version 2 or - # later. Keep it in sync. + close $fh; - require Dpkg::Arch; - my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch); - - # Disable unsupported hardening options. - if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') { - $harden_stack = 0; + if (scalar @input == 0) { + if (not $option_buildd) { + print "No compiler commands!\n"; + } else { + print "W-no-compiler-commands\n"; + } + $exit |= $exit_code{no_compiler_commands}; + next FILE; } - if ($cpu =~ /^(ia64|hppa|avr32)$/) { - $harden_relro = 0; - $harden_bindnow = 0; + + if ($option_buildd) { + $statistics{commands} += scalar @input; } -} -# Check the specified hardening options, same order as dpkg-buildflags. -if ($harden_pie) { - @cflags = (@cflags, @cflags_pie); - @ldflags = (@ldflags, @ldflags_pie); -} -if ($harden_stack) { - @cflags = (@cflags, @cflags_stack); -} -if ($harden_fortify) { - @cflags = (@cflags, @cflags_fortify); - @cppflags = (@cppflags, @cppflags_fortify); -} -if ($harden_format) { - @cflags = (@cflags, @cflags_format); -} -if ($harden_relro) { - @ldflags = (@ldflags, @ldflags_relro); -} -if ($harden_bindnow) { - @ldflags = (@ldflags, @ldflags_bindnow); -} + # Option or auto detected. + if ($arch) { + # The following was partially copied from dpkg-dev 1.16.1.2 + # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), + # copyright Raphaël Hertzog , Kees Cook + # , Canonical, Ltd. licensed under GPL version 2 or + # later. Keep it in sync. -for (my $i = 0; $i < scalar @input; $i++) { - my $line = $input[$i]; + require Dpkg::Arch; + my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch); - my $skip = 0; - if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { - error_non_verbose_build($line); - $exit |= 1 << 2; - next; - } - # Even if it's a verbose build, we might have to skip this line. - next if $skip; - - # Skip unnecessary tests when only preprocessing. - my $flag_preprocess = 0; - - my $preprocess = 0; - my $compile = 0; - my $link = 0; - - # Preprocess, compile, assemble. - if ($line =~ /$cc_regex.*?\s(-E|-S|-c)\b/) { - $preprocess = 1; - $flag_preprocess = 1 if $1 eq '-E'; - $compile = 1 if $1 eq '-S' or $1 eq '-c'; - # Otherwise assume we are linking. - } else { - $link = 1; + # Disable unsupported hardening options. + if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') { + $harden_stack = 0; + } + if ($cpu =~ /^(ia64|hppa|avr32)$/) { + $harden_relro = 0; + $harden_bindnow = 0; + } } - # These file types don't require preprocessing. - if ($line =~ /$file_no_preprocess_regex/) { - $preprocess = 0; + # Default values. + my @cflags = @def_cflags; + my @cxxflags = @def_cxxflags; + my @cppflags = @def_cppflags; + my @ldflags = @def_ldflags; + # Check the specified hardening options, same order as dpkg-buildflags. + if ($harden_pie) { + @cflags = (@cflags, @def_cflags_pie); + @cxxflags = (@cxxflags, @def_cflags_pie); + @ldflags = (@ldflags, @def_ldflags_pie); + } + if ($harden_stack) { + @cflags = (@cflags, @def_cflags_stack); + @cxxflags = (@cxxflags, @def_cflags_stack); + } + if ($harden_fortify) { + @cflags = (@cflags, @def_cflags_fortify); + @cxxflags = (@cxxflags, @def_cflags_fortify); + @cppflags = (@cppflags, @def_cppflags_fortify); + } + if ($harden_format) { + @cflags = (@cflags, @def_cflags_format); + @cxxflags = (@cxxflags, @def_cflags_format); + } + if ($harden_relro) { + @ldflags = (@ldflags, @def_ldflags_relro); } - # These file types require preprocessing. - if ($line =~ /$file_preprocess_regex/) { - $preprocess = 1; + if ($harden_bindnow) { + @ldflags = (@ldflags, @def_ldflags_bindnow); } - # If there are source files then it's compiling/linking in one step and we - # must check both. We only check for source files here, because header - # files cause too many false positives. - if (not $flag_preprocess and $line =~ /$file_compile_link_regex/) { - # Assembly files don't need CFLAGS. - if (not $line =~ /$file_compile_regex/ - and $line =~ /$file_no_compile_regex/) { - $compile = 0; - # But the rest does. + for (my $i = 0; $i < scalar @input; $i++) { + my $line = $input[$i]; + + my $skip = 0; + if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { + if (not $option_buildd) { + error_non_verbose_build($line); + } else { + $statistics{commands_nonverbose}++; + } + $exit |= $exit_code{non_verbose_build}; + next; + } + # Even if it's a verbose build, we might have to skip this line. + next if $skip; + + # Remove everything until and including the compiler command. Makes + # checks easier and faster. + $line =~ s/^.*?$cc_regex//o; + # "([...] test.c)" is not detected as 'test.c' - fix this by removing + # the brace and similar characters. + $line =~ s/['")]+$//; + + # Skip unnecessary tests when only preprocessing. + my $flag_preprocess = 0; + + my $dependency = 0; + my $preprocess = 0; + my $compile = 0; + my $link = 0; + + # Preprocess, compile, assemble. + if ($line =~ /\s(-E|-S|-c)\b/) { + $preprocess = 1; + $flag_preprocess = 1 if $1 eq '-E'; + $compile = 1 if $1 eq '-S' or $1 eq '-c'; + # Dependency generation for Makefiles. The other flags (-MF -MG -MP + # -MT -MQ) are always used with -M/-MM. + } elsif ($line =~ /\s(?:-M|-MM)\b/) { + $dependency = 1; + # Otherwise assume we are linking. } else { - $compile = 1; + $link = 1; + } + + # -MD/-MMD also cause dependency generation, but they don't imply -E! + if ($line =~ /\s(?:-MD|-MMD)\b/) { + $dependency = 0; + $flag_preprocess = 0; + } + + # Dependency generation for Makefiles, no preprocessing or other flags + # needed. + next if $dependency; + + # Get all file extensions on this line. + my @extensions = $line =~ /$file_extension_regex/go; + # Ignore all unknown extensions to speedup the search below. + @extensions = grep { exists $extension{$_} } @extensions; + + # These file types don't require preprocessing. + if (extension_found(\%extensions_no_preprocess, @extensions)) { + $preprocess = 0; + } + # These file types require preprocessing. + if (extension_found(\%extensions_preprocess, @extensions)) { + $preprocess = 1; + } + + # If there are source files then it's compiling/linking in one step + # and we must check both. We only check for source files here, because + # header files cause too many false positives. + if (not $flag_preprocess + and extension_found(\%extensions_compile_link, @extensions)) { + # Assembly files don't need CFLAGS. + if (not extension_found(\%extensions_compile, @extensions) + and extension_found(\%extensions_no_compile, @extensions)) { + $compile = 0; + # But the rest does. + } else { + $compile = 1; + } + } + + # Assume CXXFLAGS are required when a C++ file is specified in the + # compiler line. + my $compile_cpp = 0; + if ($compile + and extension_found(\%extensions_compile_cpp, @extensions)) { + $compile = 0; + $compile_cpp = 1; + } + + if ($option_buildd) { + $statistics{preprocess}++ if $preprocess; + $statistics{compile}++ if $compile; + $statistics{compile_cpp}++ if $compile_cpp; + $statistics{link}++ if $link; + } + + # Check hardening flags. + my @missing; + if ($compile and not all_flags_used($line, \@missing, @cflags) + # Libraries linked with -fPIC don't have to (and can't) be + # linked with -fPIE as well. It's no error if only PIE flags + # are missing. + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get CFLAGS`/) { + if (not $option_buildd) { + error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{compile_missing}++; + } + $exit |= $exit_code{flags_missing}; + } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) + # Libraries linked with -fPIC don't have to (and can't) be + # linked with -fPIE as well. It's no error if only PIE flags + # are missing. + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) { + if (not $option_buildd) { + error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{compile_cpp_missing}++; + } + $exit |= $exit_code{flags_missing}; + } + if ($preprocess and not all_flags_used($line, \@missing, @cppflags) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) { + if (not $option_buildd) { + error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{preprocess_missing}++; + } + $exit |= $exit_code{flags_missing}; + } + if ($link and not all_flags_used($line, \@missing, @ldflags) + # Same here, -fPIC conflicts with -fPIE. + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie) + # Assume dpkg-buildflags returns the correct flags. + and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { + if (not $option_buildd) { + error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{link_missing}++; + } + $exit |= $exit_code{flags_missing}; } } +} + +# Print statistics for buildd mode, only output in this mode. +if ($option_buildd) { + my @warning; - # Check hardening flags. - my @missing; - if ($compile and not all_flags_used($line, \@missing, @cflags) - # Libraries linked with -fPIC don't have to (and can't) be linked - # with -fPIE as well. It's no error if only PIE flags are missing. - and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie) - # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get (?:CFLAGS|CXXFLAGS)`/) { - error_flags('CFLAGS missing', \@missing, \%flag_renames, $line); - $exit |= 1 << 3; + if ($statistics{preprocess_missing}) { + push @warning, sprintf "CPPFLAGS %d (of %d)", + $statistics{preprocess_missing}, + $statistics{preprocess}; + } + if ($statistics{compile_missing}) { + push @warning, sprintf "CFLAGS %d (of %d)", + $statistics{compile_missing}, + $statistics{compile}; + } + if ($statistics{compile_cpp_missing}) { + push @warning, sprintf "CXXFLAGS %d (of %d)", + $statistics{compile_cpp_missing}, + $statistics{compile_cpp}; } - if ($preprocess and not all_flags_used($line, \@missing, @cppflags) - # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) { - error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $line); - $exit |= 1 << 3; + if ($statistics{link_missing}) { + push @warning, sprintf "LDFLAGS %d (of %d)", + $statistics{link_missing}, + $statistics{link}; } - if ($link and not all_flags_used($line, \@missing, @ldflags) - # Same here, -fPIC conflicts with -fPIE. - and not pic_pie_conflict($line, $harden_pie, \@missing, @ldflags_pie) - # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { - error_flags('LDFLAGS missing', \@missing, \%flag_renames, $line); - $exit |= 1 << 3; + if (scalar @warning) { + local $" = ', '; # array join string + print "W-dpkg-buildflags-missing @warning missing\n"; + } + + if ($statistics{commands_nonverbose}) { + printf "W-compiler-flags-hidden %d (of %d) hidden\n", + $statistics{commands_nonverbose}, + $statistics{commands}, } } + exit $exit; @@ -618,16 +907,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags =head1 SYNOPSIS -B [options] - - --all force +all (+pie, +bindnow) check - --arch set architecture (autodetected) - --bindnow force +bindbow check - --buildd parser mode for buildds - --color use colored output - --pie force +pie check - --help available options - --version version number and license +B [I] Idpkg-buildpackage build log fileE..> =head1 DESCRIPTION @@ -643,7 +923,7 @@ other important warnings. It's licensed under the GPL 3 or later. Force check for all +all (+pie, +bindnow) hardening flags. By default it's auto detected. -=item B<--arch> +=item B<--arch> I Set the specific architecture (e.g. amd64, armel, etc.), automatically disables hardening flags not available on this architecture. Is detected