sikkienl/dash
1
0
Fork 0
mirror of https://github.com/dashpay/dash.git synced 2024-12-24 19:42:46 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
f7a94b58d4
dash/contrib
History
fanquake f7a94b58d4
Merge #18629: scripts: add PE .reloc section check to security-check.py 
3e38023af724a76972d39cbccfb0bba4c54a0323 scripts: add PE .reloc section check to security-check.py (fanquake)

Pull request description:

  The `ld` in binutils has historically had a few issues with PE binaries, there's a good summary in this [thread](https://sourceware.org/bugzilla/show_bug.cgi?id=19011).

  One issue in particular was `ld` stripping the `.reloc` section out of PE binaries, even though it's required for functioning ASLR. This was [reported by a Tor developer in 2014](https://sourceware.org/bugzilla/show_bug.cgi?id=17321) and they have been patching their [own binutils](https://gitweb.torproject.org/builders/tor-browser-build.git/tree/projects/binutils) ever since. However their patch only made it into binutils at the [start of this year](https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commit;h=dc9bd8c92af67947db44b3cb428c050259b15cd0). It adds an `--enable-reloc-section` flag, which is turned on by default if you are using `--dynamic-base`. In the mean time this issue has also been worked around by other projects, such as FFmpeg, see [this commit](91b668acd6).

  I have checked our recent supported Windows release binaries, and they do contain a `.reloc` section. From what I understand, we are using all the right compile/linker flags, including `-pie` & `-fPIE`, and have never run into the crashing/entrypoint issues that other projects might have seen.

  One other thing worth noting here, it how Debian/Ubuntu patch the binutils that they distribute, because that's what we end up using in our gitian builds.

  In the binutils-mingw-w64 in Bionic (18.04), which we currently use in gitian, PE hardening options/security flags are enabled by default. See the [changelog](https://changelogs.ubuntu.com/changelogs/pool/universe/b/binutils-mingw-w64/binutils-mingw-w64_8ubuntu1/changelog) and the [relevant commit](452b3013b8).

  However in Focal (20.04), this has now been reversed. PE hardening options are no-longer the default. See the [changelog](https://changelogs.ubuntu.com/changelogs/pool/universe/b/binutils-mingw-w64/binutils-mingw-w64_8.8/changelog) and [relevant commit](7bd8b2fbc2), which cites same .reloc issue mentioned here.

  Given that we explicitly specify/opt-in to everything that we want to use, the defaults aren't necessarily an issue for us. However I think it highlights the importance of continuing to be explicit about what we want, and not falling-back or relying on upstream.

  This was also prompted by the possibility of us doing link time garbage collection, see #18579 & #18605. It seemed some sanity checks would be worthwhile in-case the linker goes haywire while garbage collecting.

  I think Guix is going to bring great benefits when dealing with these kinds of issues. Carl you might have something to say in that regard.

ACKs for top commit:
  dongcarl:
    ACK 3e38023af724a76972d39cbccfb0bba4c54a0323

Tree-SHA512: af14d63bdb334bde548dd7de3e0946556b7e2598d817b56eb4e75b3f56c705c26aa85dd9783134c4b6a7aeb7cb4de567eed996e94d533d31511f57ed332287da
2022-06-18 22:14:03 -07:00
..
auto_gdb Fix python dead code warnings 2021-10-05 20:34:01 +03:00
containers ci: fix docker context (#4816) 2022-04-28 11:35:50 -05:00
debian merge #17165: Remove BIP70 support (#4023) 2022-04-25 12:01:47 +03:00
devtools Merge #18629: scripts: add PE .reloc section check to security-check.py 2022-06-18 22:14:03 -07:00
gitian-descriptors Merge #17787: scripts: add MACHO PIE check to security-check.py 2022-06-08 12:36:52 +07:00
gitian-keys contrib: Added thephez.pgp (#3750) 2020-09-30 15:30:55 +03:00
init Merge #16569: Increase init file stop timeout 2022-04-02 16:30:52 +05:30
linearize Merge #15257: Scripts and tools: Bump flake8 to 3.7.8 2021-10-05 20:34:01 +03:00
macdeploy Merge bitcoin/bitcoin#23598: contrib: Specify wb mode when creating mac sdk 2022-04-03 18:48:15 -05:00
qos Partial Merge #14831: Scripts and tools: Use #!/usr/bin/env bash instead of #!/bin/bash. 2021-08-15 11:08:08 -04:00
seeds Merge #15840: Contrib scripts: Filter IPv6 by ASN 2021-11-18 12:12:55 -05:00
testgen Merge #16812: doc: Fix whitespace errs in .md files, bitcoin.conf, and Info.plist.in 2022-01-20 13:09:17 -05:00
verify-commits partial merge #16327: scripts and tools: Update ShellCheck linter 2021-12-03 18:13:01 +03:00
verifybinaries partial merge #16327: scripts and tools: Update ShellCheck linter 2021-12-03 18:13:01 +03:00
windeploy partial merge #16327: scripts and tools: Update ShellCheck linter 2021-12-03 18:13:01 +03:00
zmq Merge bitcoin#14060: ZMQ: add options to configure outbound message high water mark, aka SNDHWM (#4360) 2021-09-08 12:39:06 -04:00
dash-cli.bash-completion Merge #17282: contrib: remove accounts from bash completion 2022-05-31 12:06:32 -04:00
dash-qt.pro merge bitcoin#15450: Create wallet menu option 2022-04-06 13:49:58 +05:30
dash-tx.bash-completion
dashd.bash-completion merge #17165: Remove BIP70 support (#4023) 2022-04-25 12:01:47 +03:00
filter-lcov.py Merge #17691: doc: Add missed copyright headers 2022-04-02 09:19:20 +05:30
gitian-build.py Merge #17691: doc: Add missed copyright headers 2022-04-02 09:19:20 +05:30
README.md Merge #16812: doc: Fix whitespace errs in .md files, bitcoin.conf, and Info.plist.in 2022-01-20 13:09:17 -05:00
valgrind.supp

README.md

Repository Tools

Developer tools

Specific tools for developers working on this repository. Contains the script github-merge.py for merging GitHub pull requests securely and signing them using GPG.

Verify-Commits

Tool to verify that every merge commit was signed by a developer using the above github-merge.py script.

Linearize

Construct a linear, no-fork, best version of the blockchain.

Qos

A Linux bash script that will set up traffic control (tc) to limit the outgoing bandwidth for connections to the Dash network. This means one can have an always-on dashd instance running, and another local dashd/dash-qt instance which connects to this node and receives blocks from it.

Seeds

Utility to generate the pnSeed[] array that is compiled into the client.

Build Tools and Keys

Debian

Contains files used to package dashd/dash-qt for Debian-based Linux systems. If you compile dashd/dash-qt yourself, there are some useful files here.

Gitian-descriptors

Notes on getting Gitian builds up and running using KVM.

Gitian-keys

PGP keys used for signing Dash Core Gitian release results.

MacDeploy

Scripts and notes for Mac builds.

Gitian-build

Script for running full Gitian builds.

Test and Verify Tools

TestGen

Utilities to generate test vectors for the data-driven Dash tests.

Verify Binaries

This script attempts to download and verify the signature file SHA256SUMS.asc from bitcoin.org.