X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=5f37c79023690487f34844969c538c39ef51560c;hb=ac520d864fb61ea87c938921440d151d88214719;hp=ee98a895db0924ee88a7762840484f49fe3e0d6c;hpb=4a486ed36d77fd9d0f7ce1d3f5141beb582f930d;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index ee98a89..5f37c79 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -30,7 +30,9 @@ our $VERSION = '0.01';
 # CONSTANTS/VARIABLES
 
 # Regex to catch compiler commands.
-my $cc_regex = qr/(?:x86_64-linux-gnu-)?(?:(?<!\.)cc|gcc|g\+\+|c\+\+)(?:-[\d.]+)?/;
+my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux|kfreebsd)-gnu(?:eabi|eabihf)?-)?
+                  (?:(?<!\.)cc|gcc|g\+\+|c\+\+)
+                  (?:-[\d.]+)?/x;
 # Regex to catch (GCC) compiler warnings.
 my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
 
@@ -117,7 +119,7 @@ sub any_flags_used {
     my ($line, @flags) = @_;
 
     foreach my $flag (@flags) {
-        return 1 if $line =~ /\s$flag(?:\s|\\|$)/;
+        return 1 if $line =~ /\s$flag(?:\s|\\)/;
     }
 
     return 0;
@@ -127,7 +129,7 @@ sub all_flags_used {
 
     my @missing_flags = ();
     foreach my $flag (@flags) {
-        if ($line !~ /\s$flag(?:\s|\\|$)/) {
+        if ($line !~ /\s$flag(?:\s|\\)/) {
             push @missing_flags, $flag;
         }
     }
@@ -166,7 +168,7 @@ sub is_non_verbose_build {
     my ($line, $next_line, $skip_ref) = @_;
 
     if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
-                or $line =~ /^\s*\[?(?:CC|CCLD|LD)\]?\s+(.+?)$/
+                or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD)\]?\s+(.+?)$/
                 or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
                 or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
                 or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
@@ -217,6 +219,7 @@ my $option_help    = 0;
 my $option_version = 0;
 my $option_all     = 0;
 my $option_arch    = undef;
+my $option_buildd  = 0;
 if (not Getopt::Long::GetOptions(
             'help|h|?' => \$option_help,
             'version'  => \$option_version,
@@ -226,6 +229,7 @@ if (not Getopt::Long::GetOptions(
             'all'      => \$option_all,
             # Misc.
             'arch'     => \$option_arch,
+            'buildd'   => \$option_buildd,
         )) {
     require Pod::Usage;
     Pod::Usage::pod2usage(2);
@@ -268,6 +272,26 @@ my $start = 0;
 my $continuation = 0;
 my $complete_line = undef;
 while (my $line = <>) {
+    # dpkg-buildflags only provides hardening flags since 1.16.1, don't check
+    # for hardening flags in buildd mode if an older dpkg-dev is used. Default
+    # flags (-g -O2) are still checked.
+    #
+    # Packages which were built before 1.16.1 but used their own hardening
+    # flags are not checked.
+    if ($option_buildd and not $start
+            and $line =~ /^Toolchain package versions: /) {
+        require Dpkg::Version;
+        if ($line !~ /dpkg-dev_(\S+)/
+                or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
+            $harden_format  = 0;
+            $harden_fortify = 0;
+            $harden_stack   = 0;
+            $harden_relro   = 0;
+            $harden_bindnow = 0;
+            $harden_pie     = 0;
+        }
+    }
+
     # We skip over unimportant lines at the beginning to prevent false
     # positives.
     $start = 1 if $line =~ /^dpkg-buildpackage:/;
@@ -335,10 +359,18 @@ while (my $line = <>) {
             #
             # `./configure` output.
             next if not $non_verbose and $line =~ /^checking /;
-            next if $line =~ /^\s*(?:C )?(?:C|c)ompiler[\s.]*:\s+$cc_regex(?:\s-std=[a-z0-9:+]+)?\s*$/
+            next if $line =~ /^\s*(?:C\s+)?
+                               (?:C|c)ompiler[\s.]*:\s+
+                               $cc_regex
+                               (?:\s-std=[a-z0-9:+]+)?\s*$
+                             /x
                     or $line =~ /^\s*(?:- )?(?:CC|CXX)\s*=\s*$cc_regex\s*$/
                     or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
                     or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
+            # Debian buildd output.
+            next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/
+                    and $line !~ /\s-./; # option, prevent false negatives
+
 
             push @input, $line;
         }
@@ -482,6 +514,7 @@ B<blhc> [--pie] [--bindnow] [--all]
     --bindnow               force +bindbow check
     --all                   force +all (+pie, +bindnow) check
     --arch                  set architecture (autodetected)
+    --buildd                parser mode for buildds
 
 =head1 DESCRIPTION
 
@@ -519,10 +552,25 @@ Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected
 automatically if dpkg-buildpackage is used.
 
+=item B<--buildd>
+
+Special mode for buildds when automatically parsing log files. The following
+changes are in effect:
+
+=over 2
+
+=item
+
+Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is
+detected).
+
+=back
+
 =back
 
-Auto detection only works if at least one command uses the required hardening
-flag (e.g. -fPIE). Then it's required for all other commands as well.
+Auto detection for B<--pie> and B<--bindnow> only works if at least one
+command uses the required hardening flag (e.g. -fPIE). Then it's required for
+all other commands as well.
 
 =head1 EXIT STATUS