Merge pull request #5120 from kittywhiskers/auxports8

backport: merge bitcoin#19525, #20434, #22244, #20476, #19667, #22320, #18676, #19375, #21991, #20421, partial #23511 (auxiliary backports: part 8)
2024-12-26 04:22:55 +01:00 · 2023-01-18 19:02:55 -06:00 · 2023-01-18 19:02:55 -06:00 · 4966fd1dfb
commit 4966fd1dfb
parent f0009acfae 797dd852b7
15 changed files with 698 additions and 248 deletions
--- a/Makefile.am
+++ b/Makefile.am
@ -55,7 +55,8 @@ DIST_SHARE = \
  $(top_srcdir)/share/rpcauth

 BIN_CHECKS=$(top_srcdir)/contrib/devtools/symbol-check.py \
-           $(top_srcdir)/contrib/devtools/security-check.py
+           $(top_srcdir)/contrib/devtools/security-check.py \
+           $(top_srcdir)/contrib/devtools/pixie.py

 WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/dash.ico \
  $(top_srcdir)/share/pixmaps/nsis-header.bmp \
@ -319,3 +320,11 @@ clean-local: clean-docs
 	rm -rf coverage_percent.txt test_dash.coverage/ total.coverage/ test/tmp/ cache/ $(OSX_APP)
 	rm -rf test/functional/__pycache__ test/functional/test_framework/__pycache__ test/cache share/rpcauth/__pycache__
 	rm -rf osx_volname dist/ dpi36.background.tiff dpi72.background.tiff
+
+test-security-check:
+if TARGET_DARWIN
+	$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_MACHO
+endif
+if TARGET_LINUX
+	$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_ELF
+endif
--- a/configure.ac
+++ b/configure.ac
@ -106,7 +106,6 @@ AC_PATH_PROG([GIT], [git])
 AC_PATH_PROG(CCACHE,ccache)
 AC_PATH_PROG(XGETTEXT,xgettext)
 AC_PATH_PROG(HEXDUMP,hexdump)
-AC_PATH_TOOL(READELF, readelf)
 AC_PATH_TOOL(CPPFILT, c++filt)
 AC_PATH_TOOL(OBJCOPY, objcopy)
 AC_PATH_TOOL(DSYMUTIL, dsymutil)
@ -587,7 +586,7 @@ CXXFLAGS="$TEMP_CXXFLAGS"

 fi

-CPPFLAGS="$CPPFLAGS -DHAVE_BUILD_INFO -D__STDC_FORMAT_MACROS"
+CPPFLAGS="$CPPFLAGS -DHAVE_BUILD_INFO"

 AC_ARG_WITH([utils],
  [AS_HELP_STRING([--with-utils],
@ -912,6 +911,7 @@ if test x$use_hardening != xno; then
  AX_CHECK_LINK_FLAG([[-Wl,--high-entropy-va]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--high-entropy-va"])
  AX_CHECK_LINK_FLAG([[-Wl,-z,relro]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,-z,relro"])
  AX_CHECK_LINK_FLAG([[-Wl,-z,now]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,-z,now"])
+  AX_CHECK_LINK_FLAG([[-Wl,-z,separate-code]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,-z,separate-code"])
  AX_CHECK_LINK_FLAG([[-fPIE -pie]], [PIE_FLAGS="-fPIE"; HARDENED_LDFLAGS="$HARDENED_LDFLAGS -pie"],, [[$CXXFLAG_WERROR]])

  case $host in
@ -994,9 +994,6 @@ AC_LINK_IFELSE([AC_LANG_SOURCE([
  ]
 )

-dnl thread_local is currently disabled when building with glibc back compat.
-dnl Our minimum supported glibc is 2.17, however support for thread_local
-dnl did not arrive in glibc until 2.18.
 if test "x$use_thread_local" = xyes || { test "x$use_thread_local" = xauto && test "x$use_glibc_compat" = xno; }; then
  TEMP_LDFLAGS="$LDFLAGS"
  LDFLAGS="$TEMP_LDFLAGS $PTHREAD_CFLAGS"
@ -1329,9 +1326,9 @@ fi
 if test x$use_boost = xyes; then

 dnl Minimum required Boost version
-define(MINIMUM_REQUIRED_BOOST, 1.47.0)
+define(MINIMUM_REQUIRED_BOOST, 1.64.0)

-dnl Check for boost libs
+dnl Check for Boost libs
 AX_BOOST_BASE([MINIMUM_REQUIRED_BOOST])
 if test x$want_boost = xno; then
    AC_MSG_ERROR([[only libdashconsensus can be built without boost]])
@ -1348,30 +1345,7 @@ if test x$suppress_external_warnings != xno; then
    BOOST_CPPFLAGS=SUPPRESS_WARNINGS($BOOST_CPPFLAGS)
 fi

-dnl Boost 1.56 through 1.62 allow using std::atomic instead of its own atomic
-dnl counter implementations. In 1.63 and later the std::atomic approach is default.
-m4_pattern_allow(DBOOST_AC_USE_STD_ATOMIC) dnl otherwise it's treated like a macro
-BOOST_CPPFLAGS="-DBOOST_SP_USE_STD_ATOMIC -DBOOST_AC_USE_STD_ATOMIC $BOOST_CPPFLAGS"
-
-if test x$use_reduce_exports = xyes; then
-  AC_MSG_CHECKING([for working boost reduced exports])
-  TEMP_CPPFLAGS="$CPPFLAGS"
-  CPPFLAGS="$BOOST_CPPFLAGS $CPPFLAGS"
-  AC_PREPROC_IFELSE([AC_LANG_PROGRAM([[
-      @%:@include <boost/version.hpp>
-    ]], [[
-      #if BOOST_VERSION >= 104900
-      // Everything is okay
-      #else
-      #  error Boost version is too old
-      #endif
-    ]])],[
-      AC_MSG_RESULT(yes)
-    ],[
-    AC_MSG_ERROR([boost versions < 1.49 are known to be broken with reduced exports. Use --disable-reduce-exports.])
-  ])
-  CPPFLAGS="$TEMP_CPPFLAGS"
-fi
+BOOST_LIBS="$BOOST_LDFLAGS $BOOST_SYSTEM_LIB $BOOST_FILESYSTEM_LIB $BOOST_THREAD_LIB"
 fi

 if test x$use_reduce_exports = xyes; then
@ -1385,7 +1359,6 @@ if test x$use_tests = xyes; then
    AC_MSG_ERROR(hexdump is required for tests)
  fi

-
  if test x$use_boost = xyes; then

  AX_BOOST_UNIT_TEST_FRAMEWORK
@ -1411,48 +1384,6 @@ if test x$use_tests = xyes; then
  fi
 fi

-if test x$use_boost = xyes; then
-
-BOOST_LIBS="$BOOST_LDFLAGS $BOOST_FILESYSTEM_LIB $BOOST_THREAD_LIB"
-
-
-dnl If boost (prior to 1.57) was built without c++11, it emulated scoped enums
-dnl using c++98 constructs. Unfortunately, this implementation detail leaked into
-dnl the abi. This was fixed in 1.57.
-
-dnl When building against that installed version using c++11, the headers pick up
-dnl on the native c++11 scoped enum support and enable it, however it will fail to
-dnl link. This can be worked around by disabling c++11 scoped enums if linking will
-dnl fail.
-dnl BOOST_NO_SCOPED_ENUMS was changed to BOOST_NO_CXX11_SCOPED_ENUMS in 1.51.
-
-TEMP_LIBS="$LIBS"
-LIBS="$BOOST_LIBS $LIBS"
-TEMP_CPPFLAGS="$CPPFLAGS"
-CPPFLAGS="$CPPFLAGS $BOOST_CPPFLAGS"
-AC_MSG_CHECKING([for mismatched boost c++11 scoped enums])
-AC_LINK_IFELSE([AC_LANG_PROGRAM([[
-  #include <boost/config.hpp>
-  #include <boost/version.hpp>
-  #if !defined(BOOST_NO_SCOPED_ENUMS) && !defined(BOOST_NO_CXX11_SCOPED_ENUMS) && BOOST_VERSION < 105700
-  #define BOOST_NO_SCOPED_ENUMS
-  #define BOOST_NO_CXX11_SCOPED_ENUMS
-  #define CHECK
-  #endif
-  #include <boost/filesystem.hpp>
-  ]],[[
-  #if defined(CHECK)
-    boost::filesystem::copy_file("foo", "bar");
-  #else
-    choke;
-  #endif
-  ]])],
-  [AC_MSG_RESULT(mismatched); BOOST_CPPFLAGS="$BOOST_CPPFLAGS -DBOOST_NO_SCOPED_ENUMS -DBOOST_NO_CXX11_SCOPED_ENUMS"], [AC_MSG_RESULT(ok)])
-LIBS="$TEMP_LIBS"
-CPPFLAGS="$TEMP_CPPFLAGS"
-
-fi
-
 if test x$use_pkgconfig = xyes; then
  : dnl
  m4_ifdef(
@ -1462,9 +1393,9 @@ if test x$use_pkgconfig = xyes; then
        BITCOIN_QT_CHECK([PKG_CHECK_MODULES([QR], [libqrencode], [have_qrencode=yes], [have_qrencode=no])])
      fi
      if test x$build_bitcoin_cli$build_bitcoind$bitcoin_enable_qt$use_tests != xnononono; then
-        PKG_CHECK_MODULES([EVENT], [libevent],, [AC_MSG_ERROR(libevent not found.)])
+        PKG_CHECK_MODULES([EVENT], [libevent >= 2.0.21], [use_libevent=yes], [AC_MSG_ERROR(libevent version 2.0.21 or greater not found.)])
        if test x$TARGET_OS != xwindows; then
-          PKG_CHECK_MODULES([EVENT_PTHREADS], [libevent_pthreads],, [AC_MSG_ERROR(libevent_pthreads not found.)])
+          PKG_CHECK_MODULES([EVENT_PTHREADS], [libevent_pthreads >= 2.0.21],, [AC_MSG_ERROR(libevent_pthreads version 2.0.21 or greater not found.)])
        fi
      fi

@ -1712,6 +1643,7 @@ fi

 AM_CONDITIONAL([TARGET_DARWIN], [test x$TARGET_OS = xdarwin])
 AM_CONDITIONAL([BUILD_DARWIN], [test x$BUILD_OS = xdarwin])
+AM_CONDITIONAL([TARGET_LINUX], [test x$TARGET_OS = xlinux])
 AM_CONDITIONAL([TARGET_WINDOWS], [test x$TARGET_OS = xwindows])
 AM_CONDITIONAL([ENABLE_WALLET],[test x$enable_wallet = xyes])
 AM_CONDITIONAL([ENABLE_TESTS],[test x$BUILD_TEST = xyes])
@ -1804,6 +1736,8 @@ AC_SUBST(HAVE_GMTIME_R)
 AC_CONFIG_FILES([Makefile src/Makefile doc/man/Makefile share/setup.nsi share/qt/Info.plist test/config.ini])
 AC_CONFIG_FILES([contrib/devtools/split-debug.sh],[chmod +x contrib/devtools/split-debug.sh])
 AM_COND_IF([HAVE_DOXYGEN], [AC_CONFIG_FILES([doc/Doxyfile])])
+AC_CONFIG_LINKS([contrib/devtools/symbol-check.py:contrib/devtools/symbol-check.py])
+AC_CONFIG_LINKS([contrib/devtools/test-symbol-check.py:contrib/devtools/test-symbol-check.py])
 AC_CONFIG_LINKS([contrib/filter-lcov.py:contrib/filter-lcov.py])
 AC_CONFIG_LINKS([test/functional/test_runner.py:test/functional/test_runner.py])
 AC_CONFIG_LINKS([test/util/bitcoin-util-test.py:test/util/bitcoin-util-test.py])
--- a/contrib/devtools/pixie.py
+++ b/contrib/devtools/pixie.py
@ -0,0 +1,323 @@
+#!/usr/bin/env python3
+# Copyright (c) 2020 Wladimir J. van der Laan
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+'''
+Compact, self-contained ELF implementation for bitcoin-core security checks.
+'''
+import struct
+import types
+from typing import Dict, List, Optional, Union, Tuple
+
+# you can find all these values in elf.h
+EI_NIDENT = 16
+
+# Byte indices in e_ident
+EI_CLASS = 4 # ELFCLASSxx
+EI_DATA = 5  # ELFDATAxxxx
+
+ELFCLASS32 = 1 # 32-bit
+ELFCLASS64 = 2 # 64-bit
+
+ELFDATA2LSB = 1 # little endian
+ELFDATA2MSB = 2 # big endian
+
+# relevant values for e_machine
+EM_386 = 3
+EM_PPC64 = 21
+EM_ARM = 40
+EM_AARCH64 = 183
+EM_X86_64 = 62
+EM_RISCV = 243
+
+# relevant values for e_type
+ET_DYN = 3
+
+# relevant values for sh_type
+SHT_PROGBITS = 1
+SHT_STRTAB = 3
+SHT_DYNAMIC = 6
+SHT_DYNSYM = 11
+SHT_GNU_verneed = 0x6ffffffe
+SHT_GNU_versym = 0x6fffffff
+
+# relevant values for p_type
+PT_LOAD = 1
+PT_GNU_STACK = 0x6474e551
+PT_GNU_RELRO = 0x6474e552
+
+# relevant values for p_flags
+PF_X = (1 << 0)
+PF_W = (1 << 1)
+PF_R = (1 << 2)
+
+# relevant values for d_tag
+DT_NEEDED = 1
+DT_FLAGS = 30
+
+# relevant values of `d_un.d_val' in the DT_FLAGS entry
+DF_BIND_NOW = 0x00000008
+
+# relevant d_tags with string payload
+STRING_TAGS = {DT_NEEDED}
+
+# rrlevant values for ST_BIND subfield of st_info (symbol binding)
+STB_LOCAL = 0
+
+class ELFRecord(types.SimpleNamespace):
+    '''Unified parsing for ELF records.'''
+    def __init__(self, data: bytes, offset: int, eh: 'ELFHeader', total_size: Optional[int]) -> None:
+        hdr_struct = self.STRUCT[eh.ei_class][0][eh.ei_data]
+        if total_size is not None and hdr_struct.size > total_size:
+            raise ValueError(f'{self.__class__.__name__} header size too small ({total_size} < {hdr_struct.size})')
+        for field, value in zip(self.STRUCT[eh.ei_class][1], hdr_struct.unpack(data[offset:offset + hdr_struct.size])):
+            setattr(self, field, value)
+
+def BiStruct(chars: str) -> Dict[int, struct.Struct]:
+    '''Compile a struct parser for both endians.'''
+    return {
+        ELFDATA2LSB: struct.Struct('<' + chars),
+        ELFDATA2MSB: struct.Struct('>' + chars),
+    }
+
+class ELFHeader(ELFRecord):
+    FIELDS = ['e_type', 'e_machine', 'e_version', 'e_entry', 'e_phoff', 'e_shoff', 'e_flags', 'e_ehsize', 'e_phentsize', 'e_phnum', 'e_shentsize', 'e_shnum', 'e_shstrndx']
+    STRUCT = {
+        ELFCLASS32: (BiStruct('HHIIIIIHHHHHH'), FIELDS),
+        ELFCLASS64: (BiStruct('HHIQQQIHHHHHH'), FIELDS),
+    }
+
+    def __init__(self, data: bytes, offset: int) -> None:
+        self.e_ident = data[offset:offset + EI_NIDENT]
+        if self.e_ident[0:4] != b'\x7fELF':
+            raise ValueError('invalid ELF magic')
+        self.ei_class = self.e_ident[EI_CLASS]
+        self.ei_data = self.e_ident[EI_DATA]
+
+        super().__init__(data, offset + EI_NIDENT, self, None)
+
+    def __repr__(self) -> str:
+        return f'Header(e_ident={self.e_ident!r}, e_type={self.e_type}, e_machine={self.e_machine}, e_version={self.e_version}, e_entry={self.e_entry}, e_phoff={self.e_phoff}, e_shoff={self.e_shoff}, e_flags={self.e_flags}, e_ehsize={self.e_ehsize}, e_phentsize={self.e_phentsize}, e_phnum={self.e_phnum}, e_shentsize={self.e_shentsize}, e_shnum={self.e_shnum}, e_shstrndx={self.e_shstrndx})'
+
+class Section(ELFRecord):
+    name: Optional[bytes] = None
+    FIELDS = ['sh_name', 'sh_type', 'sh_flags', 'sh_addr', 'sh_offset', 'sh_size', 'sh_link', 'sh_info', 'sh_addralign', 'sh_entsize']
+    STRUCT = {
+        ELFCLASS32: (BiStruct('IIIIIIIIII'), FIELDS),
+        ELFCLASS64: (BiStruct('IIQQQQIIQQ'), FIELDS),
+    }
+
+    def __init__(self, data: bytes, offset: int, eh: ELFHeader) -> None:
+        super().__init__(data, offset, eh, eh.e_shentsize)
+        self._data = data
+
+    def __repr__(self) -> str:
+        return f'Section(sh_name={self.sh_name}({self.name!r}), sh_type=0x{self.sh_type:x}, sh_flags={self.sh_flags}, sh_addr=0x{self.sh_addr:x}, sh_offset=0x{self.sh_offset:x}, sh_size={self.sh_size}, sh_link={self.sh_link}, sh_info={self.sh_info}, sh_addralign={self.sh_addralign}, sh_entsize={self.sh_entsize})'
+
+    def contents(self) -> bytes:
+        '''Return section contents.'''
+        return self._data[self.sh_offset:self.sh_offset + self.sh_size]
+
+class ProgramHeader(ELFRecord):
+    STRUCT = {
+        # different ELF classes have the same fields, but in a different order to optimize space versus alignment
+        ELFCLASS32: (BiStruct('IIIIIIII'), ['p_type', 'p_offset', 'p_vaddr', 'p_paddr', 'p_filesz', 'p_memsz', 'p_flags', 'p_align']),
+        ELFCLASS64: (BiStruct('IIQQQQQQ'), ['p_type', 'p_flags', 'p_offset', 'p_vaddr', 'p_paddr', 'p_filesz', 'p_memsz', 'p_align']),
+    }
+
+    def __init__(self, data: bytes, offset: int, eh: ELFHeader) -> None:
+        super().__init__(data, offset, eh, eh.e_phentsize)
+
+    def __repr__(self) -> str:
+        return f'ProgramHeader(p_type={self.p_type}, p_offset={self.p_offset}, p_vaddr={self.p_vaddr}, p_paddr={self.p_paddr}, p_filesz={self.p_filesz}, p_memsz={self.p_memsz}, p_flags={self.p_flags}, p_align={self.p_align})'
+
+class Symbol(ELFRecord):
+    STRUCT = {
+        # different ELF classes have the same fields, but in a different order to optimize space versus alignment
+        ELFCLASS32: (BiStruct('IIIBBH'), ['st_name', 'st_value', 'st_size', 'st_info', 'st_other', 'st_shndx']),
+        ELFCLASS64: (BiStruct('IBBHQQ'), ['st_name', 'st_info', 'st_other', 'st_shndx', 'st_value', 'st_size']),
+    }
+
+    def __init__(self, data: bytes, offset: int, eh: ELFHeader, symtab: Section, strings: bytes, version: Optional[bytes]) -> None:
+        super().__init__(data, offset, eh, symtab.sh_entsize)
+        self.name = _lookup_string(strings, self.st_name)
+        self.version = version
+
+    def __repr__(self) -> str:
+        return f'Symbol(st_name={self.st_name}({self.name!r}), st_value={self.st_value}, st_size={self.st_size}, st_info={self.st_info}, st_other={self.st_other}, st_shndx={self.st_shndx}, version={self.version!r})'
+
+    @property
+    def is_import(self) -> bool:
+        '''Returns whether the symbol is an imported symbol.'''
+        return self.st_bind != STB_LOCAL and self.st_shndx == 0
+
+    @property
+    def is_export(self) -> bool:
+        '''Returns whether the symbol is an exported symbol.'''
+        return self.st_bind != STB_LOCAL and self.st_shndx != 0
+
+    @property
+    def st_bind(self) -> int:
+        '''Returns STB_*.'''
+        return self.st_info >> 4
+
+class Verneed(ELFRecord):
+    DEF = (BiStruct('HHIII'), ['vn_version', 'vn_cnt', 'vn_file', 'vn_aux', 'vn_next'])
+    STRUCT = { ELFCLASS32: DEF, ELFCLASS64: DEF }
+
+    def __init__(self, data: bytes, offset: int, eh: ELFHeader) -> None:
+        super().__init__(data, offset, eh, None)
+
+    def __repr__(self) -> str:
+        return f'Verneed(vn_version={self.vn_version}, vn_cnt={self.vn_cnt}, vn_file={self.vn_file}, vn_aux={self.vn_aux}, vn_next={self.vn_next})'
+
+class Vernaux(ELFRecord):
+    DEF = (BiStruct('IHHII'), ['vna_hash', 'vna_flags', 'vna_other', 'vna_name', 'vna_next'])
+    STRUCT = { ELFCLASS32: DEF, ELFCLASS64: DEF }
+
+    def __init__(self, data: bytes, offset: int, eh: ELFHeader, strings: bytes) -> None:
+        super().__init__(data, offset, eh, None)
+        self.name = _lookup_string(strings, self.vna_name)
+
+    def __repr__(self) -> str:
+        return f'Veraux(vna_hash={self.vna_hash}, vna_flags={self.vna_flags}, vna_other={self.vna_other}, vna_name={self.vna_name}({self.name!r}), vna_next={self.vna_next})'
+
+class DynTag(ELFRecord):
+    STRUCT = {
+        ELFCLASS32: (BiStruct('II'), ['d_tag', 'd_val']),
+        ELFCLASS64: (BiStruct('QQ'), ['d_tag', 'd_val']),
+    }
+
+    def __init__(self, data: bytes, offset: int, eh: ELFHeader, section: Section) -> None:
+        super().__init__(data, offset, eh, section.sh_entsize)
+
+    def __repr__(self) -> str:
+        return f'DynTag(d_tag={self.d_tag}, d_val={self.d_val})'
+
+def _lookup_string(data: bytes, index: int) -> bytes:
+    '''Look up string by offset in ELF string table.'''
+    endx = data.find(b'\x00', index)
+    assert endx != -1
+    return data[index:endx]
+
+VERSYM_S = BiStruct('H') # .gnu_version section has a single 16-bit integer per symbol in the linked section
+def _parse_symbol_table(section: Section, strings: bytes, eh: ELFHeader, versym: bytes, verneed: Dict[int, bytes]) -> List[Symbol]:
+    '''Parse symbol table, return a list of symbols.'''
+    data = section.contents()
+    symbols = []
+    versym_iter = (verneed.get(v[0]) for v in VERSYM_S[eh.ei_data].iter_unpack(versym))
+    for ofs, version in zip(range(0, len(data), section.sh_entsize), versym_iter):
+        symbols.append(Symbol(data, ofs, eh, section, strings, version))
+    return symbols
+
+def _parse_verneed(section: Section, strings: bytes, eh: ELFHeader) -> Dict[int, bytes]:
+    '''Parse .gnu.version_r section, return a dictionary of {versym: 'GLIBC_...'}.'''
+    data = section.contents()
+    ofs = 0
+    result = {}
+    while True:
+        verneed = Verneed(data, ofs, eh)
+        aofs = ofs + verneed.vn_aux
+        while True:
+            vernaux = Vernaux(data, aofs, eh, strings)
+            result[vernaux.vna_other] = vernaux.name
+            if not vernaux.vna_next:
+                break
+            aofs += vernaux.vna_next
+
+        if not verneed.vn_next:
+            break
+        ofs += verneed.vn_next
+
+    return result
+
+def _parse_dyn_tags(section: Section, strings: bytes, eh: ELFHeader) -> List[Tuple[int, Union[bytes, int]]]:
+    '''Parse dynamic tags. Return array of tuples.'''
+    data = section.contents()
+    ofs = 0
+    result = []
+    for ofs in range(0, len(data), section.sh_entsize):
+        tag = DynTag(data, ofs, eh, section)
+        val = _lookup_string(strings, tag.d_val) if tag.d_tag in STRING_TAGS else tag.d_val
+        result.append((tag.d_tag, val))
+
+    return result
+
+class ELFFile:
+    sections: List[Section]
+    program_headers: List[ProgramHeader]
+    dyn_symbols: List[Symbol]
+    dyn_tags: List[Tuple[int, Union[bytes, int]]]
+
+    def __init__(self, data: bytes) -> None:
+        self.data = data
+        self.hdr = ELFHeader(self.data, 0)
+        self._load_sections()
+        self._load_program_headers()
+        self._load_dyn_symbols()
+        self._load_dyn_tags()
+        self._section_to_segment_mapping()
+
+    def _load_sections(self) -> None:
+        self.sections = []
+        for idx in range(self.hdr.e_shnum):
+            offset = self.hdr.e_shoff + idx * self.hdr.e_shentsize
+            self.sections.append(Section(self.data, offset, self.hdr))
+
+        shstr = self.sections[self.hdr.e_shstrndx].contents()
+        for section in self.sections:
+            section.name = _lookup_string(shstr, section.sh_name)
+
+    def _load_program_headers(self) -> None:
+        self.program_headers = []
+        for idx in range(self.hdr.e_phnum):
+            offset = self.hdr.e_phoff + idx * self.hdr.e_phentsize
+            self.program_headers.append(ProgramHeader(self.data, offset, self.hdr))
+
+    def _load_dyn_symbols(self) -> None:
+        # first, load 'verneed' section
+        verneed = None
+        for section in self.sections:
+            if section.sh_type == SHT_GNU_verneed:
+                strtab = self.sections[section.sh_link].contents() # associated string table
+                assert verneed is None # only one section of this kind please
+                verneed = _parse_verneed(section, strtab, self.hdr)
+        assert verneed is not None
+
+        # then, correlate GNU versym sections with dynamic symbol sections
+        versym = {}
+        for section in self.sections:
+            if section.sh_type == SHT_GNU_versym:
+                versym[section.sh_link] = section
+
+        # finally, load dynsym sections
+        self.dyn_symbols = []
+        for idx, section in enumerate(self.sections):
+            if section.sh_type == SHT_DYNSYM: # find dynamic symbol tables
+                strtab_data = self.sections[section.sh_link].contents() # associated string table
+                versym_data = versym[idx].contents() # associated symbol version table
+                self.dyn_symbols += _parse_symbol_table(section, strtab_data, self.hdr, versym_data, verneed)
+
+    def _load_dyn_tags(self) -> None:
+        self.dyn_tags = []
+        for idx, section in enumerate(self.sections):
+            if section.sh_type == SHT_DYNAMIC: # find dynamic tag tables
+                strtab = self.sections[section.sh_link].contents() # associated string table
+                self.dyn_tags += _parse_dyn_tags(section, strtab, self.hdr)
+
+    def _section_to_segment_mapping(self) -> None:
+        for ph in self.program_headers:
+            ph.sections = []
+            for section in self.sections:
+                if ph.p_vaddr <= section.sh_addr < (ph.p_vaddr + ph.p_memsz):
+                    ph.sections.append(section)
+
+    def query_dyn_tags(self, tag_in: int) -> List[Union[int, bytes]]:
+        '''Return the values of all dyn tags with the specified tag.'''
+        return [val for (tag, val) in self.dyn_tags if tag == tag_in]
+
+
+def load(filename: str) -> ELFFile:
+    with open(filename, 'rb') as f:
+        data = f.read()
+    return ELFFile(data)
--- a/contrib/devtools/security-check.py
+++ b/contrib/devtools/security-check.py
@ -6,15 +6,15 @@
 Perform basic security checks on a series of executables.
 Exit status will be 0 if successful, and the program will be silent.
 Otherwise the exit status will be 1 and it will log which executables failed which checks.
-Needs `readelf` (for ELF), `objdump` (for PE) and `otool` (for MACHO).
+Needs `objdump` (for PE) and `otool` (for MACHO).
 '''
 import subprocess
 import sys
 import os
-
 from typing import List, Optional

-READELF_CMD = os.getenv('READELF', '/usr/bin/readelf')
+import pixie
+
 OBJDUMP_CMD = os.getenv('OBJDUMP', '/usr/bin/objdump')
 OTOOL_CMD = os.getenv('OTOOL', '/usr/bin/otool')

@ -26,52 +26,20 @@ def check_ELF_PIE(executable) -> bool:
    '''
    Check for position independent executable (PIE), allowing for address space randomization.
    '''
-    stdout = run_command([READELF_CMD, '-h', '-W', executable])
-
-    ok = False
-    for line in stdout.splitlines():
-        tokens = line.split()
-        if len(line)>=2 and tokens[0] == 'Type:' and tokens[1] == 'DYN':
-            ok = True
-    return ok
-
-def get_ELF_program_headers(executable):
-    '''Return type and flags for ELF program headers'''
-    stdout = run_command([READELF_CMD, '-l', '-W', executable])
-
-    in_headers = False
-    count = 0
-    headers = []
-    for line in stdout.splitlines():
-        if line.startswith('Program Headers:'):
-            in_headers = True
-        if line == '':
-            in_headers = False
-        if in_headers:
-            if count == 1: # header line
-                ofs_typ = line.find('Type')
-                ofs_offset = line.find('Offset')
-                ofs_flags = line.find('Flg')
-                ofs_align = line.find('Align')
-                if ofs_typ == -1 or ofs_offset == -1 or ofs_flags == -1 or ofs_align  == -1:
-                    raise ValueError('Cannot parse elfread -lW output')
-            elif count > 1:
-                typ = line[ofs_typ:ofs_offset].rstrip()
-                flags = line[ofs_flags:ofs_align].rstrip()
-                headers.append((typ, flags))
-            count += 1
-    return headers
+    elf = pixie.load(executable)
+    return elf.hdr.e_type == pixie.ET_DYN

 def check_ELF_NX(executable) -> bool:
    '''
    Check that no sections are writable and executable (including the stack)
    '''
+    elf = pixie.load(executable)
    have_wx = False
    have_gnu_stack = False
-    for (typ, flags) in get_ELF_program_headers(executable):
-        if typ == 'GNU_STACK':
+    for ph in elf.program_headers:
+        if ph.p_type == pixie.PT_GNU_STACK:
            have_gnu_stack = True
-        if 'W' in flags and 'E' in flags: # section is both writable and executable
+        if (ph.p_flags & pixie.PF_W) != 0 and (ph.p_flags & pixie.PF_X) != 0: # section is both writable and executable
            have_wx = True
    return have_gnu_stack and not have_wx

@ -81,38 +49,100 @@ def check_ELF_RELRO(executable) -> bool:
    GNU_RELRO program header must exist
    Dynamic section must have BIND_NOW flag
    '''
+    elf = pixie.load(executable)
    have_gnu_relro = False
-    for (typ, flags) in get_ELF_program_headers(executable):
-        # Note: not checking flags == 'R': here as linkers set the permission differently
+    for ph in elf.program_headers:
+        # Note: not checking p_flags == PF_R: here as linkers set the permission differently
        # This does not affect security: the permission flags of the GNU_RELRO program
        # header are ignored, the PT_LOAD header determines the effective permissions.
        # However, the dynamic linker need to write to this area so these are RW.
        # Glibc itself takes care of mprotecting this area R after relocations are finished.
        # See also https://marc.info/?l=binutils&m=1498883354122353
-        if typ == 'GNU_RELRO':
+        if ph.p_type == pixie.PT_GNU_RELRO:
            have_gnu_relro = True

    have_bindnow = False
-    stdout = run_command([READELF_CMD, '-d', '-W', executable])
-
-    for line in stdout.splitlines():
-        tokens = line.split()
-        if len(tokens)>1 and tokens[1] == '(BIND_NOW)' or (len(tokens)>2 and tokens[1] == '(FLAGS)' and 'BIND_NOW' in tokens[2:]):
+    for flags in elf.query_dyn_tags(pixie.DT_FLAGS):
+        assert isinstance(flags, int)
+        if flags & pixie.DF_BIND_NOW:
            have_bindnow = True
+
    return have_gnu_relro and have_bindnow

 def check_ELF_Canary(executable) -> bool:
    '''
    Check for use of stack canary
    '''
-    stdout = run_command([READELF_CMD, '--dyn-syms', '-W', executable])
-
+    elf = pixie.load(executable)
    ok = False
-    for line in stdout.splitlines():
-        if '__stack_chk_fail' in line:
+    for symbol in elf.dyn_symbols:
+        if symbol.name == b'__stack_chk_fail':
            ok = True
    return ok

+def check_ELF_separate_code(executable):
+    '''
+    Check that sections are appropriately separated in virtual memory,
+    based on their permissions. This checks for missing -Wl,-z,separate-code
+    and potentially other problems.
+    '''
+    elf = pixie.load(executable)
+    R = pixie.PF_R
+    W = pixie.PF_W
+    E = pixie.PF_X
+    EXPECTED_FLAGS = {
+        # Read + execute
+        b'.init': R | E,
+        b'.plt': R | E,
+        b'.plt.got': R | E,
+        b'.plt.sec': R | E,
+        b'.text': R | E,
+        b'.fini': R | E,
+        # Read-only data
+        b'.interp': R,
+        b'.note.gnu.property': R,
+        b'.note.gnu.build-id': R,
+        b'.note.ABI-tag': R,
+        b'.gnu.hash': R,
+        b'.dynsym': R,
+        b'.dynstr': R,
+        b'.gnu.version': R,
+        b'.gnu.version_r': R,
+        b'.rela.dyn': R,
+        b'.rela.plt': R,
+        b'.rodata': R,
+        b'.eh_frame_hdr': R,
+        b'.eh_frame': R,
+        b'.qtmetadata': R,
+        b'.gcc_except_table': R,
+        b'.stapsdt.base': R,
+        # Writable data
+        b'.init_array': R | W,
+        b'.fini_array': R | W,
+        b'.dynamic': R | W,
+        b'.got': R | W,
+        b'.data': R | W,
+        b'.bss': R | W,
+    }
+    if elf.hdr.e_machine == pixie.EM_PPC64:
+        # .plt is RW on ppc64 even with separate-code
+        EXPECTED_FLAGS[b'.plt'] = R | W
+    # For all LOAD program headers get mapping to the list of sections,
+    # and for each section, remember the flags of the associated program header.
+    flags_per_section = {}
+    for ph in elf.program_headers:
+        if ph.p_type == pixie.PT_LOAD:
+            for section in ph.sections:
+                assert(section.name not in flags_per_section)
+                flags_per_section[section.name] = ph.p_flags
+    # Spot-check ELF LOAD program header flags per section
+    # If these sections exist, check them against the expected R/W/E flags
+    for (section, flags) in flags_per_section.items():
+        if section in EXPECTED_FLAGS:
+            if EXPECTED_FLAGS[section] != flags:
+                return False
+    return True
+
 def get_PE_dll_characteristics(executable) -> int:
    '''Get PE DllCharacteristics bits'''
    stdout = run_command([OBJDUMP_CMD, '-x',  executable])
@ -157,7 +187,7 @@ def check_PE_NX(executable) -> bool:
 def get_MACHO_executable_flags(executable) -> List[str]:
    stdout = run_command([OTOOL_CMD, '-vh', executable])

-    flags = []
+    flags: List[str] = []
    for line in stdout.splitlines():
        tokens = line.split()
        # filter first two header lines
@ -225,7 +255,8 @@ CHECKS = {
    ('PIE', check_ELF_PIE),
    ('NX', check_ELF_NX),
    ('RELRO', check_ELF_RELRO),
-    ('Canary', check_ELF_Canary)
+    ('Canary', check_ELF_Canary),
+    ('separate_code', check_ELF_separate_code),
 ],
 'PE': [
    ('DYNAMIC_BASE', check_PE_DYNAMIC_BASE),
--- a/contrib/devtools/symbol-check.py
+++ b/contrib/devtools/symbol-check.py
@ -12,35 +12,39 @@ Example usage:
    find ../gitian-builder/build -type f -executable | xargs python3 contrib/devtools/symbol-check.py
 '''
 import subprocess
-import re
 import sys
 import os
-from typing import List, Optional, Tuple
+from typing import List, Optional

-# Debian 8 (Jessie) EOL: 2020. https://wiki.debian.org/DebianReleases#Production_Releases
+import pixie
+
+# Debian 9 (Stretch) EOL: 2022. https://wiki.debian.org/DebianReleases#Production_Releases
 #
-# - g++ version 4.9.2 (https://packages.debian.org/search?suite=jessie&arch=any&searchon=names&keywords=g%2B%2B)
-# - libc version 2.19 (https://packages.debian.org/search?suite=jessie&arch=any&searchon=names&keywords=libc6)
+# - g++ version 6.3.0 (https://packages.debian.org/search?suite=stretch&arch=any&searchon=names&keywords=g%2B%2B)
+# - libc version 2.24 (https://packages.debian.org/search?suite=stretch&arch=any&searchon=names&keywords=libc6)
 #
-# Ubuntu 16.04 (Xenial) EOL: 2024. https://wiki.ubuntu.com/Releases
+# Ubuntu 16.04 (Xenial) EOL: 2026. https://wiki.ubuntu.com/Releases
 #
-# - g++ version 5.3.1 (https://packages.ubuntu.com/search?keywords=g%2B%2B&searchon=names&suite=xenial&section=all)
-# - libc version 2.23.0 (https://packages.ubuntu.com/search?keywords=libc6&searchon=names&suite=xenial&section=all)
+# - g++ version 5.3.1
+# - libc version 2.23
 #
-# CentOS 7 EOL: 2024. https://wiki.centos.org/FAQ/General
+# CentOS Stream 8 EOL: 2024. https://wiki.centos.org/About/Product
 #
-# - g++ version 4.8.5 (http://mirror.centos.org/centos/7/os/x86_64/Packages/)
-# - libc version 2.17 (http://mirror.centos.org/centos/7/os/x86_64/Packages/)
-#
-# Taking the minimum of these as our target.
-#
-# According to GNU ABI document (https://gcc.gnu.org/onlinedocs/libstdc++/manual/abi.html) this corresponds to:
-#   GCC 4.8.5: GCC_4.8.0
-#   (glibc)    GLIBC_2_17
+# - g++ version 8.5.0 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
+# - libc version 2.28 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
 #
+# See https://gcc.gnu.org/onlinedocs/libstdc++/manual/abi.html for more info.
+
 MAX_VERSIONS = {
 'GCC':       (4,8,0),
-'GLIBC':     (2,17),
+'GLIBC': {
+    pixie.EM_386:    (2,18),
+    pixie.EM_X86_64: (2,18),
+    pixie.EM_ARM:    (2,18),
+    pixie.EM_AARCH64:(2,18),
+    pixie.EM_PPC64:  (2,18),
+    pixie.EM_RISCV:  (2,27),
+},
 'LIBATOMIC': (1,0),
 'V':         (0,5,0),  # xkb (bitcoin-qt only)
 }
@ -52,7 +56,6 @@ IGNORE_EXPORTS = {
 '_edata', '_end', '__end__', '_init', '__bss_start', '__bss_start__', '_bss_end__', '__bss_end__', '_fini', '_IO_stdin_used', 'stdin', 'stdout', 'stderr',
 'environ', '_environ', '__environ',
 }
-READELF_CMD = os.getenv('READELF', '/usr/bin/readelf')
 CPPFILT_CMD = os.getenv('CPPFILT', '/usr/bin/c++filt')
 OTOOL_CMD = os.getenv('OTOOL', '/usr/bin/otool')

@ -69,6 +72,8 @@ ELF_ALLOWED_LIBRARIES = {
 'ld-linux.so.2', # 32-bit dynamic linker
 'ld-linux-aarch64.so.1', # 64-bit ARM dynamic linker
 'ld-linux-armhf.so.3', # 32-bit ARM dynamic linker
+'ld64.so.1', # POWER64 ABIv1 dynamic linker
+'ld64.so.2', # POWER64 ABIv2 dynamic linker
 'ld-linux-riscv64-lp64d.so.1', # 64-bit RISC-V dynamic linker
 # dash-qt only
 'libxcb.so.1', # part of X11
@ -78,13 +83,6 @@ ELF_ALLOWED_LIBRARIES = {
 'libfreetype.so.6', # font parsing
 'libdl.so.2' # programming interface to dynamic linker
 }
-ARCH_MIN_GLIBC_VER = {
-'80386':  (2,1),
-'X86-64': (2,2,5),
-'ARM':    (2,4),
-'AArch64':(2,17),
-'RISC-V': (2,27)
-}

 MACHO_ALLOWED_LIBRARIES = {
 # bitcoind and bitcoin-qt
@ -128,29 +126,6 @@ class CPPFilt(object):
        self.proc.stdout.close()
        self.proc.wait()

-def read_symbols(executable, imports=True) -> List[Tuple[str, str, str]]:
-    '''
-    Parse an ELF executable and return a list of (symbol,version, arch) tuples
-    for dynamic, imported symbols.
-    '''
-    p = subprocess.Popen([READELF_CMD, '--dyn-syms', '-W', '-h', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
-    (stdout, stderr) = p.communicate()
-    if p.returncode:
-        raise IOError('Could not read symbols for {}: {}'.format(executable, stderr.strip()))
-    syms = []
-    for line in stdout.splitlines():
-        line = line.split()
-        if 'Machine:' in line:
-            arch = line[-1]
-        if len(line)>7 and re.match('[0-9]+:$', line[0]):
-            (sym, _, version) = line[7].partition('@')
-            is_import = line[6] == 'UND'
-            if version.startswith('@'):
-                version = version[1:]
-            if is_import == imports:
-                syms.append((sym, version, arch))
-    return syms
-
 def check_version(max_versions, version, arch) -> bool:
    if '_' in version:
        (lib, _, ver) = version.rpartition('_')
@ -160,38 +135,35 @@ def check_version(max_versions, version, arch) -> bool:
    ver = tuple([int(x) for x in ver.split('.')])
    if not lib in max_versions:
        return False
-    return ver <= max_versions[lib] or lib == 'GLIBC' and ver <= ARCH_MIN_GLIBC_VER[arch]
-
-def elf_read_libraries(filename) -> List[str]:
-    p = subprocess.Popen([READELF_CMD, '-d', '-W', filename], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
-    (stdout, stderr) = p.communicate()
-    if p.returncode:
-        raise IOError('Error opening file')
-    libraries = []
-    for line in stdout.splitlines():
-        tokens = line.split()
-        if len(tokens)>2 and tokens[1] == '(NEEDED)':
-            match = re.match(r'^Shared library: \[(.*)\]$', ' '.join(tokens[2:]))
-            if match:
-                libraries.append(match.group(1))
-            else:
-                raise ValueError('Unparseable (NEEDED) specification')
-    return libraries
+    if isinstance(max_versions[lib], tuple):
+        return ver <= max_versions[lib]
+    else:
+        return ver <= max_versions[lib][arch]

 def check_imported_symbols(filename) -> bool:
+    elf = pixie.load(filename)
    cppfilt = CPPFilt()
    ok = True
-    for sym, version, arch in read_symbols(filename, True):
-        if version and not check_version(MAX_VERSIONS, version, arch):
+
+    for symbol in elf.dyn_symbols:
+        if not symbol.is_import:
+            continue
+        sym = symbol.name.decode()
+        version = symbol.version.decode() if symbol.version is not None else None
+        if version and not check_version(MAX_VERSIONS, version, elf.hdr.e_machine):
            print('{}: symbol {} from unsupported version {}'.format(filename, cppfilt(sym), version))
            ok = False
    return ok

 def check_exported_symbols(filename) -> bool:
+    elf = pixie.load(filename)
    cppfilt = CPPFilt()
    ok = True
-    for sym,version,arch in read_symbols(filename, False):
-        if arch == 'RISC-V' or sym in IGNORE_EXPORTS:
+    for symbol in elf.dyn_symbols:
+        if not symbol.is_export:
+            continue
+        sym = symbol.name.decode()
+        if elf.hdr.e_machine == pixie.EM_RISCV or sym in IGNORE_EXPORTS:
            continue
        print('{}: export of symbol {} not allowed'.format(filename, cppfilt(sym)))
        ok = False
@ -199,9 +171,11 @@ def check_exported_symbols(filename) -> bool:

 def check_ELF_libraries(filename) -> bool:
    ok = True
-    for library_name in elf_read_libraries(filename):
-        if library_name not in ELF_ALLOWED_LIBRARIES:
-            print('{}: NEEDED library {} is not allowed'.format(filename, library_name))
+    elf = pixie.load(filename)
+    for library_name in elf.query_dyn_tags(pixie.DT_NEEDED):
+        assert(isinstance(library_name, bytes))
+        if library_name.decode() not in ELF_ALLOWED_LIBRARIES:
+            print('{}: NEEDED library {} is not allowed'.format(filename, library_name.decode()))
            ok = False
    return ok

--- a/contrib/devtools/test-security-check.py
+++ b/contrib/devtools/test-security-check.py
@ -32,15 +32,17 @@ class TestSecurityChecks(unittest.TestCase):
        cc = 'gcc'
        write_testcode(source)

-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
                (1, executable+': failed PIE NX RELRO Canary'))
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
                (1, executable+': failed PIE RELRO Canary'))
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
                (1, executable+': failed PIE RELRO'))
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
                (1, executable+': failed RELRO'))
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
+                (1, executable+': failed separate_code'))
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
                (0, ''))

    def test_PE(self):
--- a/contrib/devtools/test-symbol-check.py
+++ b/contrib/devtools/test-symbol-check.py
@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+# Copyright (c) 2020 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+'''
+Test script for symbol-check.py
+'''
+import subprocess
+import unittest
+
+def call_symbol_check(cc, source, executable, options):
+    subprocess.run([cc,source,'-o',executable] + options, check=True)
+    p = subprocess.run(['./contrib/devtools/symbol-check.py',executable], stdout=subprocess.PIPE, universal_newlines=True)
+    return (p.returncode, p.stdout.rstrip())
+
+def get_machine(cc):
+    p = subprocess.run([cc,'-dumpmachine'], stdout=subprocess.PIPE, universal_newlines=True)
+    return p.stdout.rstrip()
+
+class TestSymbolChecks(unittest.TestCase):
+    def test_ELF(self):
+        source = 'test1.c'
+        executable = 'test1'
+        cc = 'gcc'
+
+        # there's no way to do this test for RISC-V at the moment; bionic's libc is 2.27
+        # and we allow all symbols from 2.27.
+        if 'riscv' in get_machine(cc):
+            self.skipTest("test not available for RISC-V")
+
+        # memfd_create was introduced in GLIBC 2.27, so is newer than the upper limit of
+        # all but RISC-V but still available on bionic
+        with open(source, 'w', encoding="utf8") as f:
+            f.write('''
+                #define _GNU_SOURCE
+                #include <sys/mman.h>
+
+                int memfd_create(const char *name, unsigned int flags);
+
+                int main()
+                {
+                    memfd_create("test", 0);
+                    return 0;
+                }
+        ''')
+
+        self.assertEqual(call_symbol_check(cc, source, executable, []),
+                (1, executable + ': symbol memfd_create from unsupported version GLIBC_2.27\n' +
+                    executable + ': failed IMPORTED_SYMBOLS'))
+
+        # -lutil is part of the libc6 package so a safe bet that it's installed
+        # it's also out of context enough that it's unlikely to ever become a real dependency
+        source = 'test2.c'
+        executable = 'test2'
+        with open(source, 'w', encoding="utf8") as f:
+            f.write('''
+                #include <utmp.h>
+
+                int main()
+                {
+                    login(0);
+                    return 0;
+                }
+        ''')
+
+        self.assertEqual(call_symbol_check(cc, source, executable, ['-lutil']),
+                (1, executable + ': NEEDED library libutil.so.1 is not allowed\n' +
+                    executable + ': failed LIBRARY_DEPENDENCIES'))
+
+        # finally, check a conforming file that simply uses a math function
+        source = 'test3.c'
+        executable = 'test3'
+        with open(source, 'w', encoding="utf8") as f:
+            f.write('''
+                #include <math.h>
+
+                int main()
+                {
+                    return (int)pow(2.0, 4.0);
+                }
+        ''')
+
+        self.assertEqual(call_symbol_check(cc, source, executable, ['-lm']),
+                (0, ''))
+
+    def test_MACHO(self):
+        source = 'test1.c'
+        executable = 'test1'
+        cc = 'clang'
+
+        with open(source, 'w', encoding="utf8") as f:
+            f.write('''
+                #include <expat.h>
+
+                int main()
+                {
+                    XML_ExpatVersion();
+                    return 0;
+                }
+
+        ''')
+
+        self.assertEqual(call_symbol_check(cc, source, executable, ['-lexpat']),
+            (1, 'libexpat.1.dylib is not in ALLOWED_LIBRARIES!\n' +
+                executable + ': failed DYNAMIC_LIBRARIES'))
+
+        source = 'test2.c'
+        executable = 'test2'
+        with open(source, 'w', encoding="utf8") as f:
+            f.write('''
+                #include <CoreGraphics/CoreGraphics.h>
+
+                int main()
+                {
+                    CGMainDisplayID();
+                    return 0;
+                }
+        ''')
+
+        self.assertEqual(call_symbol_check(cc, source, executable, ['-framework', 'CoreGraphics']),
+                (0, ''))
+
+if __name__ == '__main__':
+    unittest.main()
+
--- a/depends/packages/libevent.mk
+++ b/depends/packages/libevent.mk
@ -3,17 +3,23 @@ $(package)_version=2.1.11-stable
 $(package)_download_path=https://github.com/libevent/libevent/archive/
 $(package)_file_name=release-$($(package)_version).tar.gz
 $(package)_sha256_hash=229393ab2bf0dc94694f21836846b424f3532585bac3468738b7bf752c03901e
+$(package)_patches=0001-fix-windows-getaddrinfo.patch

 define $(package)_preprocess_cmds
+   patch -p1 < $($(package)_patch_dir)/0001-fix-windows-getaddrinfo.patch && \
  ./autogen.sh
 endef

+# When building for Windows, we set _WIN32_WINNT to target the same Windows
+# version as we do in configure. Due to quirks in libevents build system, this
+# is also required to enable support for ipv6. See #19375.
 define $(package)_set_vars
  $(package)_config_opts=--disable-shared --disable-openssl --disable-libevent-regress --disable-samples
  $(package)_config_opts += --disable-dependency-tracking --enable-option-checking
  $(package)_config_opts_release=--disable-debug-mode
  $(package)_config_opts_linux=--with-pic
  $(package)_config_opts_android=--with-pic
+  $(package)_cppflags_mingw32=-D_WIN32_WINNT=0x0601
 endef

 define $(package)_config_cmds
--- a/depends/packages/miniupnpc.mk
+++ b/depends/packages/miniupnpc.mk
@ -1,21 +1,22 @@
 package=miniupnpc
-$(package)_version=2.0.20180203
+$(package)_version=2.2.2
 $(package)_download_path=https://miniupnp.tuxfamily.org/files/
 $(package)_file_name=$(package)-$($(package)_version).tar.gz
-$(package)_sha256_hash=90dda8c7563ca6cd4a83e23b3c66dbbea89603a1675bfdb852897c2c9cc220b7
-$(package)_patches=dont_use_wingen.patch
+$(package)_sha256_hash=888fb0976ba61518276fe1eda988589c700a3f2a69d71089260d75562afd3687
+$(package)_patches=dont_leak_info.patch respect_mingw_cflags.patch

+# Next time this package is updated, ensure that _WIN32_WINNT is still properly set.
+# See discussion in https://github.com/bitcoin/bitcoin/pull/25964.
 define $(package)_set_vars
 $(package)_build_opts=CC="$($(package)_cc)"
 $(package)_build_opts_darwin=LIBTOOL="$($(package)_libtool)"
-$(package)_build_opts_mingw32=-f Makefile.mingw
+$(package)_build_opts_mingw32=-f Makefile.mingw CFLAGS="$($(package)_cflags) -D_WIN32_WINNT=0x0601"
 $(package)_build_env+=CFLAGS="$($(package)_cflags) $($(package)_cppflags)" AR="$($(package)_ar)"
 endef

 define $(package)_preprocess_cmds
-  mkdir dll && \
-  sed -e 's|MINIUPNPC_VERSION_STRING \"version\"|MINIUPNPC_VERSION_STRING \"$($(package)_version)\"|' -e 's|OS/version|$(host)|' miniupnpcstrings.h.in > miniupnpcstrings.h && \
-  patch -p1 < $($(package)_patch_dir)/dont_use_wingen.patch
+  patch -p1 < $($(package)_patch_dir)/dont_leak_info.patch && \
+  patch -p1 < $($(package)_patch_dir)/respect_mingw_cflags.patch
 endef

 define $(package)_build_cmds
--- a/depends/patches/libevent/0001-fix-windows-getaddrinfo.patch
+++ b/depends/patches/libevent/0001-fix-windows-getaddrinfo.patch
@ -0,0 +1,15 @@
+diff -ur libevent-2.1.8-stable.orig/configure.ac libevent-2.1.8-stable/configure.ac
+--- libevent-2.1.8-stable.orig/configure.ac	2017-01-29 17:51:00.000000000 +0000
+++ libevent-2.1.8-stable/configure.ac	2020-03-07 01:11:16.311335005 +0000
+@@ -389,6 +389,10 @@
+ 		#ifdef HAVE_NETDB_H
+ 		#include <netdb.h>
+ 		#endif
+#ifdef _WIN32
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#endif
+ 	    ]],
+ 	    [[
+ 		getaddrinfo;
+Only in libevent-2.1.8-stable: configure.ac~
--- a/depends/patches/miniupnpc/dont_leak_info.patch
+++ b/depends/patches/miniupnpc/dont_leak_info.patch
@ -0,0 +1,32 @@
+commit 8815452257437ba36607d0e2381c01142d1c7bb0
+Author: fanquake <fanquake@gmail.com>
+Date:   Thu Nov 19 10:51:19 2020 +0800
+
+    Don't leak OS and miniupnpc version info in User-Agent
+
+diff --git a//minisoap.c b/minisoap.c
+index 7860667..775580b 100644
+--- a/minisoap.c
+++ b/minisoap.c
+@@ -90,7 +90,7 @@ int soapPostSubmit(SOCKET fd,
+ 	headerssize = snprintf(headerbuf, sizeof(headerbuf),
+                        "POST %s HTTP/%s\r\n"
+ 	                   "Host: %s%s\r\n"
+-					   "User-Agent: " OS_STRING ", " UPNP_VERSION_STRING ", MiniUPnPc/" MINIUPNPC_VERSION_STRING "\r\n"
+					   "User-Agent: " UPNP_VERSION_STRING "\r\n"
+ 	                   "Content-Length: %d\r\n"
+ 					   "Content-Type: text/xml\r\n"
+ 					   "SOAPAction: \"%s\"\r\n"
+diff --git a/miniwget.c b/miniwget.c
+index d5b7970..05aeb9c 100644
+--- a/miniwget.c
+++ b/miniwget.c
+@@ -444,7 +444,7 @@ miniwget3(const char * host,
+                  "GET %s HTTP/%s\r\n"
+ 			     "Host: %s:%d\r\n"
+ 				 "Connection: Close\r\n"
+-				 "User-Agent: " OS_STRING ", " UPNP_VERSION_STRING ", MiniUPnPc/" MINIUPNPC_VERSION_STRING "\r\n"
+				 "User-Agent: " UPNP_VERSION_STRING "\r\n"
+ 
+ 				 "\r\n",
+ 			   path, httpversion, host, port);
--- a/depends/patches/miniupnpc/dont_use_wingen.patch
+++ b/depends/patches/miniupnpc/dont_use_wingen.patch
@ -1,26 +0,0 @@
-commit e8077044df239bcf0d9e9980b0e1afb9f1f5c446
-Author: fanquake <fanquake@gmail.com>
-Date:   Tue Aug 18 20:50:19 2020 +0800
-
-    Don't use wingenminiupnpcstrings when generating miniupnpcstrings.h
-
-    The wingenminiupnpcstrings tool is used on Windows to generate version
-    information. This information is irrelevant for us, and trying to use
-    wingenminiupnpcstrings would cause builds to fail, so just don't use it.
-
-    We should be able to drop this once we are using 2.1 or later. See
-    upstream commit: 9663c55c61408fdcc39a82987d2243f816b22932.
-
-diff --git a/Makefile.mingw b/Makefile.mingw
-index 574720e..fcc17bb 100644
--- a/Makefile.mingw
-+++ b/Makefile.mingw
-@@ -74,7 +74,7 @@ wingenminiupnpcstrings:	wingenminiupnpcstrings.o
-
- wingenminiupnpcstrings.o:	wingenminiupnpcstrings.c
-
-miniupnpcstrings.h: miniupnpcstrings.h.in wingenminiupnpcstrings
-+miniupnpcstrings.h: miniupnpcstrings.h.in
- 	wingenminiupnpcstrings $< $@
-
- minixml.o:	minixml.c minixml.h
--- a/depends/patches/miniupnpc/respect_mingw_cflags.patch
+++ b/depends/patches/miniupnpc/respect_mingw_cflags.patch
@ -0,0 +1,23 @@
+commit fec515a7ac9991a0ee91068fda046b54b191155e
+Author: fanquake <fanquake@gmail.com>
+Date:   Wed Jul 27 15:52:37 2022 +0100
+
+    build: respect CFLAGS in makefile.mingw
+    
+    Similar to the other Makefile.
+
+    Cherry-pick of https://github.com/miniupnp/miniupnp/pull/619.
+
+diff --git a/Makefile.mingw b/Makefile.mingw
+index 2bff7bd..88430d2 100644
+--- a/Makefile.mingw
+++ b/Makefile.mingw
+@@ -19,7 +19,7 @@ else
+ RM = rm -f
+ endif
+ #CFLAGS = -Wall -g -DDEBUG -D_WIN32_WINNT=0X501
+-CFLAGS = -Wall -W -Wstrict-prototypes -Os -DNDEBUG -D_WIN32_WINNT=0X501
+CFLAGS ?= -Wall -W -Wstrict-prototypes -Os -DNDEBUG -D_WIN32_WINNT=0X501
+ LDLIBS = -lws2_32 -liphlpapi
+ # -lwsock32
+ # -liphlpapi is needed for GetBestRoute() and GetIpAddrTable()
--- a/doc/dependencies.md
+++ b/doc/dependencies.md
@ -6,19 +6,20 @@ These are the dependencies currently used by Dash Core. You can find instruction
 | Dependency | Version used | Minimum required | CVEs | Shared | [Bundled Qt library](https://doc.qt.io/qt-5/configure-options.html#third-party-libraries) |
 | --- | --- | --- | --- | --- | --- |
 | Berkeley DB | [4.8.30](https://www.oracle.com/technetwork/database/database-technologies/berkeleydb/downloads/index.html) | 4.8.x | No |  |  |
-| Boost | [1.73.0](https://www.boost.org/users/download/) | [1.47.0](https://github.com/bitcoin/bitcoin/pull/8920) | No |  |  |
+| Boost | [1.73.0](https://www.boost.org/users/download/) | [1.64.0](https://github.com/bitcoin/bitcoin/pull/22320) | No |  |  |
 | Clang<sup>[ \* ](#note1)</sup> |  | [5.0+](https://releases.llvm.org/download.html) (C++17 support) |  |  |  |
 | D-Bus | [1.10.18](https://cgit.freedesktop.org/dbus/dbus/tree/NEWS?h=dbus-1.10) |  | No | Yes |  |
 | Expat | [2.2.7](https://libexpat.github.io/) |  | No | Yes |  |
 | fontconfig | [2.12.1](https://www.freedesktop.org/software/fontconfig/release/) |  | No | Yes |  |
 | FreeType | [2.7.1](https://download.savannah.gnu.org/releases/freetype) |  | No |  | [Yes](https://github.com/dashpay/dash/blob/develop/depends/packages/qt.mk) (Android only) |
 | GCC |  | [7+](https://gcc.gnu.org/) (C++17 support) |  |  |  |
+| glibc | | [2.18](https://www.gnu.org/software/libc/) |  |  |  |  |
 | HarfBuzz-NG |  |  |  |  | [Yes](https://github.com/dashpay/dash/blob/develop/depends/packages/qt.mk) |
-| libevent | [2.1.11-stable](https://github.com/libevent/libevent/releases) | No |  |  |
+| libevent | [2.1.11-stable](https://github.com/libevent/libevent/releases) | [2.0.21](https://github.com/bitcoin/bitcoin/pull/18676) | No |  |  |
 | libnatpmp | git commit [4536032...](https://github.com/miniupnp/libnatpmp/tree/4536032ae32268a45c073a4d5e91bbab4534773a) |  | No |  |  |
 | libpng |  |  |  |  | [Yes](https://github.com/dashpay/dash/blob/develop/depends/packages/qt.mk) |
 | librsvg | |  |  |  |  |
-| MiniUPnPc | [2.0.20180203](https://miniupnp.tuxfamily.org/files) |  | No |  |  |
+| MiniUPnPc | [2.2.2](https://miniupnp.tuxfamily.org/files) |  | No |  |  |
 | PCRE |  |  |  |  | [Yes](https://github.com/dashpay/dash/blob/develop/depends/packages/qt.mk) |
 | Python (tests) |  | [3.5](https://www.python.org/downloads) |  |  |  |
 | qrencode | [3.4.4](https://fukuchi.org/works/qrencode) |  | No |  |  |
--- a/src/Makefile.am
+++ b/src/Makefile.am
@ -928,13 +928,13 @@ endif

 if GLIBC_BACK_COMPAT
 	@echo "Checking glibc back compat..."
-	$(AM_V_at) READELF=$(READELF) CPPFILT=$(CPPFILT) $(PYTHON) $(top_srcdir)/contrib/devtools/symbol-check.py $(bin_PROGRAMS)
+	$(AM_V_at) CPPFILT=$(CPPFILT) $(PYTHON) $(top_srcdir)/contrib/devtools/symbol-check.py $(bin_PROGRAMS)
 endif

 check-security: $(bin_PROGRAMS)
 if HARDEN
 	@echo "Checking binary security..."
-	$(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) OTOOL=$(OTOOL) $(PYTHON) $(top_srcdir)/contrib/devtools/security-check.py $(bin_PROGRAMS)
+	$(AM_V_at) OBJDUMP=$(OBJDUMP) OTOOL=$(OTOOL) $(PYTHON) $(top_srcdir)/contrib/devtools/security-check.py $(bin_PROGRAMS)
 endif