X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=f7988b5d1e5914a9b414ab504908cf506a19c67a;hp=d804ecdea41338865a799061ad4c5fad01359639;hb=516e39a71f9a8f6e0d01fd13c40e4db0557de8df;hpb=981d562930dc0f7eb76323571ccad3332029371a

diff --git a/bin/blhc b/bin/blhc
index d804ecd..f7988b5 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -31,8 +31,8 @@ our $VERSION = '0.01';
 # CONSTANTS/VARIABLES
 
 # Regex to catch compiler commands.
-my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux|kfreebsd)-gnu(?:eabi|eabihf)?-)?
-                  (?:(?<!\.)cc|gcc|g\+\+|c\+\+)
+my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
+                  (?<!\.)(?:cc|gcc|g\+\+|c\+\+)
                   (?:-[\d.]+)?/x;
 # Regex to catch (GCC) compiler warnings.
 my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
@@ -154,6 +154,9 @@ my %flag_renames = (
     '-Wl,(-z,)?now'   => '-Wl,-z,now',
 );
 
+# Use colored (ANSI) output?
+my $option_color;
+
 
 # FUNCTIONS
 
@@ -180,11 +183,16 @@ sub error_non_verbose_build {
            error_color(':', 'yellow'),
            $line;
 }
+sub error_hardening_wrapper {
+    printf "%s%s %s\n",
+            error_color('HARDENING WRAPPER', 'red'),
+            error_color(':', 'yellow'),
+            'no checks possible, aborting';
+}
 sub error_color {
     my ($message, $color) = @_;
 
-    # Use colors when writing to a terminal.
-    if (-t STDOUT) {
+    if ($option_color) {
         return Term::ANSIColor::colored($message, $color);
     } else {
         return $message;
@@ -294,6 +302,7 @@ my $option_version = 0;
 my $option_all     = 0;
 my $option_arch    = undef;
 my $option_buildd  = 0;
+   $option_color   = 0;
 if (not Getopt::Long::GetOptions(
             'help|h|?' => \$option_help,
             'version'  => \$option_version,
@@ -302,6 +311,7 @@ if (not Getopt::Long::GetOptions(
             'bindnow'  => \$harden_bindnow,
             'all'      => \$option_all,
             # Misc.
+            'color'    => \$option_color,
             'arch'     => \$option_arch,
             'buildd'   => \$option_buildd,
         )) {
@@ -366,6 +376,14 @@ while (my $line = <>) {
         }
     }
 
+    # If hardening wrapper is used (wraps calls to gcc and adds hardening
+    # flags automatically) we can't perform any checks, abort.
+    if (not $start and $line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
+        error_hardening_wrapper();
+        $exit |= 1 << 4;
+        exit $exit;
+    }
+
     # We skip over unimportant lines at the beginning of the log to prevent
     # false positives.
     $start = 1 if $line =~ /^dpkg-buildpackage:/;
@@ -438,7 +456,8 @@ while (my $line = <>) {
             # Ignore false positives.
             #
             # `./configure` output.
-            next if not $non_verbose and $line =~ /^checking /;
+            next if not $non_verbose
+                    and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
             next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
                                (?:C|c)ompiler[\s.]*:?\s+
                                $cc_regex
@@ -447,9 +466,6 @@ while (my $line = <>) {
                     or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/
                     or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
                     or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
-            # Debian buildd output.
-            next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/
-                    and $line !~ /\s-./; # option, prevent false negatives
 
             # Check if additional hardening options were used. Used to ensure
             # they are used for the complete build.
@@ -611,6 +627,7 @@ B<blhc> [--pie] [--bindnow] [--all]
     --all                   force +all (+pie, +bindnow) check
     --arch                  set architecture (autodetected)
     --buildd                parser mode for buildds
+    --color                 use colored output
 
 =head1 DESCRIPTION
 
@@ -662,6 +679,10 @@ detected).
 
 =back
 
+=item B<--color>
+
+Use colored (ANSI) output for warning messages.
+
 =back
 
 Auto detection for B<--pie> and B<--bindnow> only works if at least one
@@ -695,6 +716,10 @@ Non verbose build.
 
 Missing hardening flags.
 
+=item B<16>
+
+Hardening wrapper detected, no tests performed.
+
 =back
 
 =head1 AUTHOR