47 Commits (fac816544317cee6553d60cb0f5f24f6f9ec98de)

Author	SHA1	Message	Date
fanquake	b9898aeeaa	scripts: make security checks architecture independent ... This paves the way for using and checking for architecture dependent flags like -fcf-protection on x86_64 Linux and -mbranch-protection on 64 bit ARM.	3 years ago
Hennadii Stepanov	f47dda2c58	scripted-diff: Bump copyright headers ... -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: fa0074e2d8 * 2019: aaaaad6ac9	3 years ago
fanquake	feee308401	scripts: match on exe type over str in security-check.py	3 years ago
fanquake	f31d4bd214	scripts: test for PE control flow instrumentation	3 years ago
josibake	a46f71bb70	lint: enable mypy checking for missing imports ... Achieve this by adding some ignore, and making data/ importable. Co-authored-by: João Barbosa <joao.paulo.barbosa@gmail.com>	3 years ago
fanquake	00b85d0b13	scripts: only parse the binary once in security-check.py	3 years ago
fanquake	cad40a5b16	scripts: use LIEF for ELF checks in security-check.py	3 years ago
fanquake	42b589d18f	scripts: test for MACHO control flow instrumentation	4 years ago
fanquake	955140b326	contrib: consolidate PIE and NX security checks	4 years ago
fanquake	0f5d77c8e4	contrib: add PE PIE check to security checks	4 years ago
fanquake	8e1f40dd9a	contrib: use LIEF for PE security checks	4 years ago
fanquake	a25b2e965c	contrib: use LIEF for macOS security checks	4 years ago
fanquake	7e7eae7aa8	contrib: use f strings in security-check.py	4 years ago
Luke Dashjr	a0a771843f	contrib: Changes to checks for PowerPC64 ... Changes from #14066.	4 years ago
Wladimir J. van der Laan	634f6ec4eb	contrib: Parse ELF directly for symbol and security checks ... Instead of the ever-messier text parsing of the output of the readelf tool (which is clearly meant for human consumption not to be machine parseable), parse the ELF binaries directly. Add a small dependency-less ELF parser specific to the checks. This is slightly more secure, too, because it removes potential ambiguity due to misparsing and changes in the output format of `elfread`. It also allows for stricter and more specific ELF format checks in the future. This removes the build-time dependency for `readelf`. It passes the test-security-check for me locally, though I haven't checked on all platforms.	4 years ago
Tyler Chambers	b6121edf70	swapped "is" for "==" in literal comparison ... update lint-python.sh to include check F632	4 years ago
Wladimir J. van der Laan	65d0f1a533	devtools: Add security check for separate_code ... Check that sections are appropriately separated in virtual memory, based on their (expected) permissions. This checks for missing -Wl,-z,separate-code and potentially other problems. Co-authored-by: fanquake <fanquake@gmail.com>	4 years ago
fanquake	eacedfb023	scripts: add additional type annotations to security-check.py	5 years ago
fanquake	83d063e954	scripts: add run_command to security-check.py ... Deduplicate all the subprocess code as mentioned in 18713.	5 years ago
fanquake	13f606b4f9	scripts: remove NONFATAL from security-check.py	5 years ago
fanquake	061acf62a1	scripts: no-longer check for 32 bit windows in security-check.py	5 years ago
fanquake	3e38023af7	scripts: add PE .reloc section check to security-check.py	5 years ago
fanquake	7b99c7454c	scripts: add MACHO Canary check to security-check.py	5 years ago
fanquake	5ca90f8b59	scripts: add MACHO lazy bindings check to security-check.py	5 years ago
fanquake	edaca2dd12	scripts: add MACHO NX check to security-check.py	5 years ago
MarcoFalke	e09c701e01	scripted-diff: Bump copyright of files changed in 2020 ... -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT-	5 years ago
fanquake	7c9e821c4e	scripts: add MACHO NOUNDEFS check to security-check.py	5 years ago
fanquake	4ca92dc6d3	scripts: add MACHO PIE check to security-check.py	5 years ago
Craig Younkins	af1ed206f8	Fix broken Gmane URLs	6 years ago
Wladimir J. van der Laan	78dae8cacc	Merge #13780: 0.17: Pre-branch maintenance ... 3fc20632a3 qt: Set BLOCK_CHAIN_SIZE = 220 (DrahtBot) 2b6a2f4a28 Regenerate manpages (DrahtBot) eb7daf4d60 Update copyright headers to 2018 (DrahtBot) Pull request description: Some trivial maintenance to avoid having to do it again after the 0.17 branch off. (The scripts to do this are in `./contrib/`) Tree-SHA512: 16b2af45e0351b1c691c5311d48025dc6828079e98c2aa2e600dc5910ee8aa01858ca6c356538150dc46fe14c8819ed8ec8e4ec9a0f682b9950dd41bc50518fa	6 years ago
DrahtBot	eb7daf4d60	Update copyright headers to 2018	6 years ago
Chun Kuan Lee	1e60713a68	contrib: Fix test-security-check fail in Ubuntu 18.04	6 years ago
Conrado Gouvea	37d363dd4a	Tools: fix BIND_NOW check in security-check.py ... Previously, the BIND_NOW check would work only if it was the first value in FLAGS.	6 years ago
John Bampton	0d31ef4762	Enable W191 and W291 flake8 checks. ... Remove trailing whitespace from Python files. Convert tabs to spaces.	7 years ago
John Newbery	5de2b18c67	[contrib] fixup security-check.py Python3 support	7 years ago
John Newbery	bc6fdf2d15	Change all python files to use Python3	7 years ago
Akira Takizawa	595a7bab23	Increment MIT Licence copyright header year on files modified in 2017	7 years ago
practicalswift	25cd520fc4	Use sys.exit(...) instead of exit(...): exit(...) should not be used in programs	7 years ago
Wladimir J. van der Laan	4e1567acff	Merge #8249: Enable (and check for) 64-bit ASLR on Windows ... 62c2915 build: supply `-Wl,--high-entropy-va` (Wladimir J. van der Laan) 9a75d29 devtools: Check for high-entropy ASLR in 64-bit PE executables (Wladimir J. van der Laan)	8 years ago
Wladimir J. van der Laan	9a75d29b6f	devtools: Check for high-entropy ASLR in 64-bit PE executables ... check_PE_PIE only checked for DYNAMIC_BASE, this is not enough for (secure) ASLR on 64-bit.	8 years ago
isle2983	4677b197f7	[copyright] add MIT License copyright header to remaining Python files	8 years ago
Matthew King	7b01ce254c	Favour python over python2 as per PR #7723	8 years ago
Matthew King	873e81f89b	Use portable #! in python scripts (/usr/bin/env)	8 years ago
Wladimir J. van der Laan	18f05c765c	build: python 3 compatibility ... Ubuntu 16.04 "xenial xerus" does not come with Python 2.x by default. It is possible to install a python-2.7 package, but this has its own problem: no `python` or `python2` symlink (see #7717). This fixes the following scripts to work with python 3: - `make check` (bctest,py, bitcoin-util-test.py) - `make translate` (extract_strings_qt.py) - `make symbols-check` (symbol-check.py) - `make security-check` (security-check.py) Explicitly call the python commands using $(PYTHON) instead of relying on the interpreter line at the top of the scripts.	9 years ago
Cory Fields	cd27bf51e0	release: fix parsing of BIND_NOW with older readelf	9 years ago
calebogden	0331aa350c	Fixing typos on security-check.py and torcontrol.cpp	9 years ago
Wladimir J. van der Laan	579b863cd7	devtools: Add security-check.py ... Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).	9 years ago