X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;ds=inline;f=bin%2Fblhc;h=0fbf4c9a2de11c12192b184cdb749a2e36152c25;hb=e9f80391175f1cdaba372f2c8fad2f861e9daaeb;hp=62ddb86a6076f986eb6fdeffec5b84e71b6f8731;hpb=17f9869280cd3b89f8a6a1dd172d03a0871bf786;p=blhc%2Fblhc.git
diff --git a/bin/blhc b/bin/blhc
index 62ddb86..0fbf4c9 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -22,7 +22,6 @@ use strict;
use warnings;
use Getopt::Long ();
-use Term::ANSIColor ();
use Text::ParseWords ();
our $VERSION = '0.01';
@@ -129,26 +128,20 @@ my %extensions_compile_cpp = map { $_ => 1 } (
);
my %extension = map { $_ => 1 } (
@source_no_preprocess,
- @source_no_preprocess_compile,
- @source_no_preprocess_compile_cpp,
- @source_no_preprocess_no_compile,
@header_preprocess,
@source_preprocess,
- @source_preprocess_compile,
- @source_preprocess_compile_cpp,
- @source_preprocess_no_compile,
);
# Regexp to match file extensions.
my $file_extension_regex = qr/
\s
- \S+ # Filename without extension.
+ \S+ # Filename without extension.
\.
- ([^\\.\s]+) # File extension.
- (?=\s|\\) # At end of word. Can't use \b because some files have non
- # word characters at the end and because \b matches double
- # extensions (like .cpp.o). Works always as all lines are
- # terminated with "\n".
+ ([^\/\\.,;:\s]+)# File extension.
+ (?=\s|\\) # At end of word. Can't use \b because some files have non
+ # word characters at the end and because \b matches double
+ # extensions (like .cpp.o). Works always as all lines are
+ # terminated with "\n".
/x;
# Expected (hardening) flags. All flags are used as regexps.
@@ -181,10 +174,10 @@ my @def_cppflags_fortify = (
);
my @def_ldflags = ();
my @def_ldflags_relro = (
- '-Wl,(-z,)?relro',
+ '-Wl,(?:-z,)?relro',
);
my @def_ldflags_bindnow = (
- '-Wl,(-z,)?now',
+ '-Wl,(?:-z,)?now',
);
my @def_ldflags_pie = (
'-fPIE',
@@ -193,13 +186,43 @@ my @def_ldflags_pie = (
my @def_ldflags_pic = (
'-fPIC',
'-fpic',
+ '-shared',
+);
+# References to all flags checked by the parser.
+my @flag_refs = (
+ \@def_cflags,
+ \@def_cflags_format,
+ \@def_cflags_fortify,
+ \@def_cflags_stack,
+ \@def_cflags_pie,
+ \@def_cxxflags,
+ \@def_cppflags,
+ \@def_cppflags_fortify,
+ \@def_ldflags,
+ \@def_ldflags_relro,
+ \@def_ldflags_bindnow,
+);
+# References to all used flags.
+my @flag_refs_all = (
+ @flag_refs,
+ \@def_ldflags_pie,
+ \@def_ldflags_pic,
);
# Renaming rules for the output so the regex parts are not visible. Also
# stores string values of flag regexps above, see compile_flag_regexp().
my %flag_renames = (
- '-O(?:2|3)' => '-O2',
- '-Wl,(-z,)?relro' => '-Wl,-z,relro',
- '-Wl,(-z,)?now' => '-Wl,-z,now',
+ '-O(?:2|3)' => '-O2',
+ '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
+ '-Wl,(?:-z,)?now' => '-Wl,-z,now',
+);
+
+my %exit_code = (
+ no_compiler_commands => 1 << 0,
+ # used by POD::Usage => 1 << 1,
+ non_verbose_build => 1 << 2,
+ flags_missing => 1 << 3,
+ hardening_wrapper => 1 << 4,
+ invalid_cmake => 1 << 5,
);
# Statistics of missing flags and non-verbose build commands. Used for
@@ -244,6 +267,14 @@ sub error_non_verbose_build {
error_color(':', 'yellow'),
$line;
}
+sub error_invalid_cmake {
+ my ($version) = @_;
+
+ printf "%s%s %s\n",
+ error_color('INVALID CMAKE', 'red'),
+ error_color(':', 'yellow'),
+ $version;
+}
sub error_hardening_wrapper {
printf "%s%s %s\n",
error_color('HARDENING WRAPPER', 'red'),
@@ -311,13 +342,23 @@ sub is_non_verbose_build {
my ($line, $next_line, $skip_ref) = @_;
if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
- or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
+ or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
return 0;
}
+ # False positives.
+ #
+ # C++ compiler setting.
+ return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+ # "Compiling" with no file name.
+ if ($line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/) {
+ # $file_extension_regex may need spaces around the filename.
+ return 0 if not " $1 " =~ /$file_extension_regex/o;
+ }
+
my $file = $1;
# On the first pass we only check if this line is verbose or not.
@@ -427,6 +468,12 @@ along with this program. If not, see .
exit 0;
}
+# Don't load Term::ANSIColor in buildd mode because Term::ANSIColor is not
+# installed on Debian's buildds.
+if (not $option_buildd) {
+ require Term::ANSIColor;
+}
+
if ($option_all) {
$option_pie = 1;
$option_bindnow = 1;
@@ -434,26 +481,21 @@ if ($option_all) {
# Precompile all flag regexps. any_flags_used(), all_flags_used() get a lot
# faster with this.
-@def_cflags = compile_flag_regexp(\%flag_renames, @def_cflags);
-@def_cflags_format = compile_flag_regexp(\%flag_renames, @def_cflags_format);
-@def_cflags_fortify = compile_flag_regexp(\%flag_renames, @def_cflags_fortify);
-@def_cflags_stack = compile_flag_regexp(\%flag_renames, @def_cflags_stack);
-@def_cflags_pie = compile_flag_regexp(\%flag_renames, @def_cflags_pie);
-@def_cxxflags = compile_flag_regexp(\%flag_renames, @def_cxxflags);
-@def_cppflags = compile_flag_regexp(\%flag_renames, @def_cppflags);
-@def_cppflags_fortify = compile_flag_regexp(\%flag_renames, @def_cppflags_fortify);
-@def_ldflags = compile_flag_regexp(\%flag_renames, @def_ldflags);
-@def_ldflags_relro = compile_flag_regexp(\%flag_renames, @def_ldflags_relro);
-@def_ldflags_bindnow = compile_flag_regexp(\%flag_renames, @def_ldflags_bindnow);
-@def_ldflags_pie = compile_flag_regexp(\%flag_renames, @def_ldflags_pie);
-@def_ldflags_pic = compile_flag_regexp(\%flag_renames, @def_ldflags_pic);
+foreach my $flags (@flag_refs_all) {
+ @{$flags} = compile_flag_regexp(\%flag_renames, @{$flags});
+}
# Final exit code.
my $exit = 0;
FILE: foreach my $file (@ARGV) {
+ print "checking '$file'...\n" if scalar @ARGV > 1;
+
open my $fh, '<', $file or die "$!: $file";
+ # Architecture of this file.
+ my $arch = $option_arch;
+
# Hardening options. Not all architectures support all hardening options.
my $harden_format = 1;
my $harden_fortify = 1;
@@ -471,7 +513,7 @@ FILE: foreach my $file (@ARGV) {
# flags are not checked.
if ($option_buildd and $line =~ /^Toolchain package versions: /) {
require Dpkg::Version;
- if ($line !~ /dpkg-dev_(\S+)/
+ if ($line !~ /\bdpkg-dev_(\S+)/
or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
$harden_format = 0;
$harden_fortify = 0;
@@ -482,6 +524,23 @@ FILE: foreach my $file (@ARGV) {
}
}
+ # The following two versions of CMake in Debian obeyed CPPFLAGS, but
+ # this was later dropped because upstream rejected the patch. Thus
+ # build logs with these versions will have fortify hardening flags
+ # enabled, even though they may be not correctly set and are missing
+ # when build with later CMake versions. Thanks to Aron Xu for letting
+ # me know.
+ if ($line =~ /^Package versions: /
+ and $line =~ /\bcmake_(\S+)/
+ and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) {
+ if (not $option_buildd) {
+ error_invalid_cmake($1);
+ } else {
+ print "W-invalid-cmake-used $1\n";
+ }
+ $exit |= $exit_code{invalid_cmake};
+ }
+
# If hardening wrapper is used (wraps calls to gcc and adds hardening
# flags automatically) we can't perform any checks, abort.
if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
@@ -490,7 +549,7 @@ FILE: foreach my $file (@ARGV) {
} else {
print "I-hardening-wrapper-used\n";
}
- $exit |= 1 << 4;
+ $exit |= $exit_code{hardening_wrapper};
next FILE;
}
@@ -511,15 +570,15 @@ FILE: foreach my $file (@ARGV) {
last if $line =~ /^Build finished at \d{8}-\d{4}$/;
# Detect architecture automatically unless overridden.
- if (not $option_arch
+ if (not $arch
and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) {
- $option_arch = $1;
+ $arch = $1;
}
# Ignore compiler warnings for now.
next if $line =~ /$warning_regex/o;
- if ($line =~ /\033/) { # esc
+ if (not $option_buildd and $line =~ /\033/) { # esc
# Remove all ANSI color sequences which are sometimes used in
# non-verbose builds.
$line = Term::ANSIColor::colorstrip($line);
@@ -571,23 +630,24 @@ FILE: foreach my $file (@ARGV) {
}
# Ignore lines with no compiler commands.
- next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose;
+ next if not $non_verbose
+ and not $line =~ /\b$cc_regex(?:\s|\\)/o;
+ # Ignore lines with no filenames with extensions. May miss
+ # some non-verbose builds (e.g. "gcc -o test" [sic!]), but
+ # shouldn't be a problem as the log will most likely contain
+ # other non-verbose commands which are detected.
+ next if not $non_verbose
+ and not $line =~ /$file_extension_regex/o;
# Ignore false positives.
#
# `./configure` output.
next if not $non_verbose
and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
- next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
+ next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?
(?:C|c)ompiler[\s.]*:?\s+
- $cc_regex_full
- (?:\s-std=[a-z0-9:+]+)?\s*$
- /xo
- or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o
- or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
- or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
- # `make` output.
- next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++"
+ /xo;
+ next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
# Check if additional hardening options were used. Used to
# ensure they are used for the complete build.
@@ -602,8 +662,12 @@ FILE: foreach my $file (@ARGV) {
close $fh;
if (scalar @input == 0) {
- print "No compiler commands!\n";
- $exit |= 1;
+ if (not $option_buildd) {
+ print "No compiler commands!\n";
+ } else {
+ print "W-no-compiler-commands\n";
+ }
+ $exit |= $exit_code{no_compiler_commands};
next FILE;
}
@@ -612,7 +676,7 @@ FILE: foreach my $file (@ARGV) {
}
# Option or auto detected.
- if ($option_arch) {
+ if ($arch) {
# The following was partially copied from dpkg-dev 1.16.1.2
# (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
# copyright Raphaël Hertzog , Kees Cook
@@ -620,10 +684,10 @@ FILE: foreach my $file (@ARGV) {
# later. Keep it in sync.
require Dpkg::Arch;
- my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch);
+ my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
# Disable unsupported hardening options.
- if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') {
+ if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
$harden_stack = 0;
}
if ($cpu =~ /^(ia64|hppa|avr32)$/) {
@@ -673,7 +737,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{commands_nonverbose}++;
}
- $exit |= 1 << 2;
+ $exit |= $exit_code{non_verbose_build};
next;
}
# Even if it's a verbose build, we might have to skip this line.
@@ -689,6 +753,7 @@ FILE: foreach my $file (@ARGV) {
# Skip unnecessary tests when only preprocessing.
my $flag_preprocess = 0;
+ my $dependency = 0;
my $preprocess = 0;
my $compile = 0;
my $link = 0;
@@ -698,11 +763,25 @@ FILE: foreach my $file (@ARGV) {
$preprocess = 1;
$flag_preprocess = 1 if $1 eq '-E';
$compile = 1 if $1 eq '-S' or $1 eq '-c';
+ # Dependency generation for Makefiles. The other flags (-MF -MG -MP
+ # -MT -MQ) are always used with -M/-MM.
+ } elsif ($line =~ /\s(?:-M|-MM)\b/) {
+ $dependency = 1;
# Otherwise assume we are linking.
} else {
$link = 1;
}
+ # -MD/-MMD also cause dependency generation, but they don't imply -E!
+ if ($line =~ /\s(?:-MD|-MMD)\b/) {
+ $dependency = 0;
+ $flag_preprocess = 0;
+ }
+
+ # Dependency generation for Makefiles, no preprocessing or other flags
+ # needed.
+ next if $dependency;
+
# Get all file extensions on this line.
my @extensions = $line =~ /$file_extension_regex/go;
# Ignore all unknown extensions to speedup the search below.
@@ -762,7 +841,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{compile_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
} elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
# Libraries linked with -fPIC don't have to (and can't) be
# linked with -fPIE as well. It's no error if only PIE flags
@@ -775,7 +854,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{compile_cpp_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
}
if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
# Assume dpkg-buildflags returns the correct flags.
@@ -785,7 +864,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{preprocess_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
}
if ($link and not all_flags_used($line, \@missing, @ldflags)
# Same here, -fPIC conflicts with -fPIE.
@@ -797,7 +876,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{link_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
}
}
}
@@ -850,16 +929,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags
=head1 SYNOPSIS
-B [options] ..
-
- --all force +all (+pie, +bindnow) check
- --arch set architecture (autodetected)
- --bindnow force +bindbow check
- --buildd parser mode for buildds
- --color use colored output
- --pie force +pie check
- --help available options
- --version version number and license
+B [I] Idpkg-buildpackage build log fileE..>
=head1 DESCRIPTION
@@ -875,7 +945,7 @@ other important warnings. It's licensed under the GPL 3 or later.
Force check for all +all (+pie, +bindnow) hardening flags. By default it's
auto detected.
-=item B<--arch>
+=item B<--arch> I
Set the specific architecture (e.g. amd64, armel, etc.), automatically
disables hardening flags not available on this architecture. Is detected
@@ -894,9 +964,18 @@ changes are in effect:
=item
+Print tags instead of normal warnings, see README file for a list of possible
+tags.
+
+=item
+
Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is
detected).
+=item
+
+Don't require Term::ANSIColor.
+
=back
=item B<--color>