Skip to content

Commit

Permalink
Test linking for hardening options
Browse files Browse the repository at this point in the history 
Some options depend on correct library support.
  • Loading branch information
@mkj
mkj committed Apr 26, 2022
1 parent 2e0a16c commit 72d8cae
Show file tree
Hide file tree
Showing 2 changed files with 51 additions and 43 deletions.
40 changes: 24 additions & 16 deletions configure
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3204,15 +3204,16 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: Not setting $TESTFLAGS" >&5
$as_echo "$as_me: Not setting $TESTFLAGS" >&6;}; CFLAGS="$OLDFLAGS"

fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
}

{ $as_echo "$as_me:${as_lineno-$LINENO}: Checking if compiler '$CC' supports -fno-strict-overflow" >&5
Expand All @@ -3232,15 +3233,16 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: Not setting $TESTFLAGS" >&5
$as_echo "$as_me: Not setting $TESTFLAGS" >&6;}; CFLAGS="$OLDFLAGS"

fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
}

# needed for various extensions. define early before autoconf tests
Expand Down Expand Up @@ -3296,15 +3298,16 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: Not setting $TESTFLAGS" >&5
$as_echo "$as_me: Not setting $TESTFLAGS" >&6;}; CFLAGS="$OLDFLAGS"

fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
}

OLDLDFLAGS="$LDFLAGS"
Expand Down Expand Up @@ -3396,7 +3399,7 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
Expand All @@ -3415,19 +3418,21 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: Not setting $TESTFLAGS" >&5
$as_echo "$as_me: Not setting $TESTFLAGS" >&6;}; CFLAGS="$OLDCFLAGS"

fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext


fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
# FORTIFY_SOURCE
{
OLDFLAGS="$CFLAGS"
Expand All @@ -3444,15 +3449,16 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: Not setting $TESTFLAGS" >&5
$as_echo "$as_me: Not setting $TESTFLAGS" >&6;}; CFLAGS="$OLDFLAGS"

fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
}

# Spectre v2 mitigations
Expand All @@ -3471,15 +3477,16 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: Not setting $TESTFLAGS" >&5
$as_echo "$as_me: Not setting $TESTFLAGS" >&6;}; CFLAGS="$OLDFLAGS"

fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
}
{
OLDFLAGS="$CFLAGS"
Expand All @@ -3496,15 +3503,16 @@ main ()
return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
if ac_fn_c_try_link "$LINENO"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: Setting $TESTFLAGS" >&5
$as_echo "$as_me: Setting $TESTFLAGS" >&6;}
else
{ $as_echo "$as_me:${as_lineno-$LINENO}: Not setting $TESTFLAGS" >&5
$as_echo "$as_me: Not setting $TESTFLAGS" >&6;}; CFLAGS="$OLDFLAGS"

fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
}

fi
Expand Down
54 changes: 27 additions & 27 deletions configure.ac
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,15 +23,15 @@ AC_PROG_CC
if test -z "$LD" ; then
LD=$CC
fi
AC_SUBST(LD)
AC_SUBST(LD)

AC_DEFUN(DB_TRYADDCFLAGS,
AC_DEFUN(DB_TRYADDCFLAGS,
[{
OLDFLAGS="$CFLAGS"
TESTFLAGS="$1"
CFLAGS="$CFLAGS $TESTFLAGS"
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
[AC_MSG_NOTICE([Not setting $TESTFLAGS]); CFLAGS="$OLDFLAGS" ]
)
}])
Expand Down Expand Up @@ -82,14 +82,14 @@ if test "$hardenbuild" -eq 1; then
OLDLDFLAGS="$LDFLAGS"
TESTFLAGS="-Wl,-pie"
LDFLAGS="$LDFLAGS $TESTFLAGS"
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
[
LDFLAGS="$OLDLDFLAGS"
TESTFLAGS="-pie"
LDFLAGS="$LDFLAGS $TESTFLAGS"
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
[AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ]
)
]
Expand All @@ -98,23 +98,23 @@ if test "$hardenbuild" -eq 1; then
OLDLDFLAGS="$LDFLAGS"
TESTFLAGS="-Wl,-z,now -Wl,-z,relro"
LDFLAGS="$LDFLAGS $TESTFLAGS"
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
[AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ]
)
fi # non-static
# stack protector. -strong is good but only in gcc 4.9 or later
OLDCFLAGS="$CFLAGS"
TESTFLAGS="-fstack-protector-strong"
CFLAGS="$CFLAGS $TESTFLAGS"
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
[
CFLAGS="$OLDCFLAGS"
TESTFLAGS="-fstack-protector --param=ssp-buffer-size=4"
CFLAGS="$CFLAGS $TESTFLAGS"
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
[AC_MSG_NOTICE([Setting $TESTFLAGS])],
[AC_MSG_NOTICE([Not setting $TESTFLAGS]); CFLAGS="$OLDCFLAGS" ]
)
]
Expand Down Expand Up @@ -174,7 +174,7 @@ case "$host" in
# OpenSSH thinks it's broken. If it isn't, let me know.
AC_DEFINE(BROKEN_GETADDRINFO,1,Broken getaddrinfo)
;;

*-*-hpux*)
LIBS="$LIBS -lsec"
# It's probably broken.
Expand All @@ -191,22 +191,22 @@ AC_CHECK_TOOL(STRIP, strip, :)
AC_CHECK_TOOL(INSTALL, install, :)

dnl Can't use login() or logout() with uclibc
AC_CHECK_DECL(__UCLIBC__,
AC_CHECK_DECL(__UCLIBC__,
[
no_loginfunc_check=1
AC_MSG_NOTICE([Using uClibc - login() and logout() probably don't work, so we won't use them.])
],,)

dnl We test for crypt() specially. On Linux (and others?) it resides in libcrypt
dnl but we don't want link all binaries to -lcrypt, just dropbear server.
dnl OS X doesn't need -lcrypt
dnl OS X doesn't need -lcrypt
AC_CHECK_FUNC(crypt, found_crypt_func=here)
AC_CHECK_LIB(crypt, crypt,
AC_CHECK_LIB(crypt, crypt,
[
CRYPTLIB="-lcrypt"
found_crypt_func=here
])
AC_SUBST(CRYPTLIB)
AC_SUBST(CRYPTLIB)
if test "t$found_crypt_func" = there; then
AC_DEFINE(HAVE_CRYPT, 1, [crypt() function])
fi
Expand Down Expand Up @@ -568,7 +568,7 @@ AC_ARG_ENABLE(bundled-libtom,
)

if test $BUNDLED_LIBTOM = 1 ; then
AC_DEFINE(BUNDLED_LIBTOM,1,Use bundled libtom)
AC_DEFINE(BUNDLED_LIBTOM,1,Use bundled libtom)
fi

AC_SUBST(LIBTOM_LIBS)
Expand Down Expand Up @@ -641,7 +641,7 @@ AC_ARG_ENABLE(pututxline,
AC_ARG_WITH(lastlog,
[ --with-lastlog=FILE|DIR specify lastlog location [common locations]],
[
if test "x$withval" = "xno" ; then
if test "x$withval" = "xno" ; then
AC_DEFINE(DISABLE_LASTLOG)
else
conf_lastlog_location=$withval
Expand Down Expand Up @@ -716,7 +716,7 @@ fi

if test -n "$conf_lastlog_location"; then
AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location", lastlog file location)
fi
fi

dnl utmp detection
AC_MSG_CHECKING([if your system defines UTMP_FILE])
Expand Down Expand Up @@ -746,7 +746,7 @@ if test -z "$conf_utmp_location"; then
fi
if test -n "$conf_utmp_location"; then
AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location", utmp file location)
fi
fi

dnl wtmp detection
AC_MSG_CHECKING([if your system defines WTMP_FILE])
Expand Down Expand Up @@ -778,7 +778,7 @@ if test -z "$conf_wtmp_location"; then
fi
if test -n "$conf_wtmp_location"; then
AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location", wtmp file location)
fi
fi


dnl utmpx detection - I don't know any system so perverse as to require
Expand Down Expand Up @@ -806,7 +806,7 @@ if test -z "$conf_utmpx_location"; then
fi
else
AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location", utmpx file location)
fi
fi

dnl wtmpx detection
AC_MSG_CHECKING([if your system defines WTMPX_FILE])
Expand All @@ -833,7 +833,7 @@ if test -z "$conf_wtmpx_location"; then
fi
else
AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location", wtmpx file location)
fi
fi

# Checks for library functions.
AC_PROG_GCC_TRADITIONAL
Expand Down Expand Up @@ -869,7 +869,7 @@ fi
AC_EXEEXT

if test $BUNDLED_LIBTOM = 1 ; then
(cd $srcdir; find libtomcrypt -type d) | xargs mkdir -pv
(cd $srcdir; find libtomcrypt -type d) | xargs mkdir -pv
LIBTOM_FILES="libtomcrypt/Makefile libtommath/Makefile"
fi

Expand Down

0 comments on commit 72d8cae

Please sign in to comment.