kc3-lang/libressl
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
303b972d | 2015-01-05 20:14:54 | simplify hardening check logic, disable for mingw Rather than doing separate linker/compiler checks, just build a non-empty program with each so that the compiler will actually try to use the hardening features. Reduce redundancy in the macro calls by just setting the flag that was just tested. Also, disable hardening for mingw, since its trying to use a libssp-0.dll file that I can't find right now. The detected hardening flags break mingw builds currently. | |
 |
5be407a4 | 2015-01-02 07:42:15 | move public domain to top, help automatic tools | |
 |
813e7bda | 2015-01-01 15:03:03 | Change comments to remark on script not being needed for clang >= 5.1 | |
|
750cc530 | 2014-12-31 07:17:47 | Fix build failure of "make distcheck" (new scripts/ folder missing) | |
|
701204bf | 2014-12-31 07:06:49 | Fix typo causing output of clang test to read "CLANG" instead of yes/no | |
|
2dc0a6ac | 2014-12-30 15:13:19 | Merge recent upstream changes with compiler hardening Conflicts: configure.ac | |
|
9adc6d64 | 2014-12-27 16:52:25 | Revert "do not double-link libcrypto" This reverts commit c83d468cfd5d3ca60a499b69c0b7c9d0b159d405. It wasn't as superfluous as I thought on all platforms. | |
|
c83d468c | 2014-12-27 16:34:48 | do not double-link libcrypto libssl already has LIBFLAGS for libcrypto, so adding -lcrypto is superfluous. | |
|
23c90228 | 2014-12-27 16:34:02 | enable __STRICT_ALIGNMENT on sparc | |
|
c0a8ddc1 | 2014-12-23 21:47:03 | configure.ac: use executable hardening where available Where available, enable stack smashing protection, fortify source, no-strict-overflow, and read only relocations. Many Linux distributions automatically enable most of these options. They are no brainers. The difference introduced here is in asking for a few more aggressive options. An option to disable the more aggressive options is provided (--disable-hardening). When set, configure will fall back to the default CFLAGS on the system - in many cases that will still be hardened. There is no point in going further than that. Options enabled are: -fstack-protector-strong is a relatively new GCC-4.9 feature that is supposed to give a better balance between performance and protection. -all is considered too aggressive, but was used in Chromium and other security critical systems until -strong became available. Follow their lead and use -strong when possible. clang 6.0 supports -all but not -strong. _FORTIFY_SOURCE replaces certain unsafe C str* and mem* functions with more robust equivalents when the compiler can determine the length of the buffers involved. -fno-strict-overflow instructs GCC to not make optimizations based on the assumption that signed arithmetic will wrap around on overflow (e.g. (short)0x7FFF + 1 == 0). This prevents the optimizer from doing some unexpected things. Further improvements should trap signed overflows and reduce the use of signed to refer to naturally unsigned quantities. I did not set -fPIE (position independent executables). The critical function of Open/LibreSSL is as a library, not an executable. Tested on Ubuntu Linux 14.04.1 LTS, OS X 10.10.1 with "make check". The code added to m4/ is GPLv3 but con Signed-off-by: Jim Barlow <jim@purplerock.ca> |