phantom/bitcoin
1
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-01-10 20:03:34 -03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
bitcoin/contrib
History
fanquake ac21090f20
Merge #18629: scripts: add PE .reloc section check to security-check.py 
3e38023af7 scripts: add PE .reloc section check to security-check.py (fanquake)

Pull request description:

  The `ld` in binutils has historically had a few issues with PE binaries, there's a good summary in this [thread](https://sourceware.org/bugzilla/show_bug.cgi?id=19011).

  One issue in particular was `ld` stripping the `.reloc` section out of PE binaries, even though it's required for functioning ASLR. This was [reported by a Tor developer in 2014](https://sourceware.org/bugzilla/show_bug.cgi?id=17321) and they have been patching their [own binutils](https://gitweb.torproject.org/builders/tor-browser-build.git/tree/projects/binutils) ever since. However their patch only made it into binutils at the [start of this year](https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commit;h=dc9bd8c92af67947db44b3cb428c050259b15cd0). It adds an `--enable-reloc-section` flag, which is turned on by default if you are using `--dynamic-base`. In the mean time this issue has also been worked around by other projects, such as FFmpeg, see [this commit](91b668acd6).

  I have checked our recent supported Windows release binaries, and they do contain a `.reloc` section. From what I understand, we are using all the right compile/linker flags, including `-pie` & `-fPIE`, and have never run into the crashing/entrypoint issues that other projects might have seen.

  One other thing worth noting here, it how Debian/Ubuntu patch the binutils that they distribute, because that's what we end up using in our gitian builds.

  In the binutils-mingw-w64 in Bionic (18.04), which we currently use in gitian, PE hardening options/security flags are enabled by default. See the [changelog](https://changelogs.ubuntu.com/changelogs/pool/universe/b/binutils-mingw-w64/binutils-mingw-w64_8ubuntu1/changelog) and the [relevant commit](452b3013b8).

  However in Focal (20.04), this has now been reversed. PE hardening options are no-longer the default. See the [changelog](https://changelogs.ubuntu.com/changelogs/pool/universe/b/binutils-mingw-w64/binutils-mingw-w64_8.8/changelog) and [relevant commit](7bd8b2fbc2), which cites same .reloc issue mentioned here.

  Given that we explicitly specify/opt-in to everything that we want to use, the defaults aren't necessarily an issue for us. However I think it highlights the importance of continuing to be explicit about what we want, and not falling-back or relying on upstream.

  This was also prompted by the possibility of us doing link time garbage collection, see #18579 & #18605. It seemed some sanity checks would be worthwhile in-case the linker goes haywire while garbage collecting.

  I think Guix is going to bring great benefits when dealing with these kinds of issues. Carl you might have something to say in that regard.

ACKs for top commit:
  dongcarl:
    ACK 3e38023af7

Tree-SHA512: af14d63bdb334bde548dd7de3e0946556b7e2598d817b56eb4e75b3f56c705c26aa85dd9783134c4b6a7aeb7cb4de567eed996e94d533d31511f57ed332287da
2020-04-28 13:32:45 +08:00
..
debian doc: Update license year range to 2020 2019-12-26 23:11:21 +01:00
devtools scripts: add PE .reloc section check to security-check.py 2020-04-23 08:40:24 +08:00
gitian-descriptors Merge #18598: gitian: Add missing automake package to gitian-win-signer.yml 2020-04-16 22:27:46 +02:00
gitian-keys Merge #18619: gitian: add jonatack gpg key fingerprint 2020-04-15 15:38:02 +08:00
guix build: add linker optimization flags to guix 2020-04-12 18:38:00 +08:00
init Merge #16569: Increase init file stop timeout 2019-10-08 11:38:44 +02:00
linearize scripted-diff: Bump copyright headers 2020-04-16 13:33:09 -04:00
macdeploy Merge #18589: Fix naming of macOS SDK and clarify version 2020-04-24 17:22:54 +08:00
qos scripted-diff: Bump copyright of files changed in 2019 2019-12-30 10:42:20 +13:00
seeds scripted-diff: Bump copyright headers 2020-04-16 13:33:09 -04:00
testgen doc: Fix whitespace errs in .md files, bitcoin.conf, Info.plist.in, and find_bdb48.m4 2019-09-17 03:21:22 -04:00
verify-commits scripted-diff: Bump copyright headers 2020-04-16 13:33:09 -04:00
verifybinaries scripted-diff: Bump copyright of files changed in 2019 2019-12-30 10:42:20 +13:00
windeploy Update with new Windows code signing certificate 2020-03-24 12:22:46 -04:00
zmq build: Require python 3.5 2019-03-02 10:40:23 -05:00
bitcoin-cli.bash-completion scripted-diff: Bump copyright of files changed in 2019 2019-12-30 10:42:20 +13:00
bitcoin-qt.pro Add CreateWalletDialog to create wallets from the GUI 2019-09-05 20:36:57 -04:00
bitcoin-tx.bash-completion bash-completion: Adapt for 0.12 and 0.13 2016-07-07 07:52:59 -04:00
bitcoind.bash-completion scripted-diff: Bump copyright of files changed in 2019 2019-12-30 10:42:20 +13:00
filter-lcov.py scripted-diff: Bump copyright headers 2020-04-16 13:33:09 -04:00
gitian-build.py build: use macOS 10.14 SDK 2020-02-03 19:49:46 +08:00
install_db4.sh scripted-diff: Add missed copyright headers 2020-01-04 20:18:28 +02:00
README.md doc: Fix whitespace errs in .md files, bitcoin.conf, Info.plist.in, and find_bdb48.m4 2019-09-17 03:21:22 -04:00
valgrind.supp bump test timeouts so that functional tests run in valgrind 2020-01-25 15:51:35 +08:00

README.md

Repository Tools

Developer tools

Specific tools for developers working on this repository. Additional tools, including the github-merge.py script, are available in the maintainer-tools repository.

Verify-Commits

Tool to verify that every merge commit was signed by a developer using the github-merge.py script.

Linearize

Construct a linear, no-fork, best version of the blockchain.

Qos

A Linux bash script that will set up traffic control (tc) to limit the outgoing bandwidth for connections to the Bitcoin network. This means one can have an always-on bitcoind instance running, and another local bitcoind/bitcoin-qt instance which connects to this node and receives blocks from it.

Seeds

Utility to generate the pnSeed[] array that is compiled into the client.

Build Tools and Keys

Packaging

The Debian subfolder contains the copyright file.

All other packaging related files can be found in the bitcoin-core/packaging repository.

Gitian-descriptors

Files used during the gitian build process. For more information about gitian, see the the Bitcoin Core documentation repository.

Gitian-keys

PGP keys used for signing Bitcoin Core Gitian release results.

MacDeploy

Scripts and notes for Mac builds.

Gitian-build

Script for running full Gitian builds.

Test and Verify Tools

TestGen

Utilities to generate test vectors for the data-driven Bitcoin tests.

Verify Binaries

This script attempts to download and verify the signature file SHA256SUMS.asc from bitcoin.org.