Turn on the Debian build hardening wrapper.

diff --git a/patches/11-double-bounce.patch b/patches/11-double-bounce.patch
index 79ea4abb3072215f8d4e76e30b1e4cdc866f7fdf..8bb4166114d35841ed0c0d304bb6a7c66ee1636c 100644 (file)
--- a/patches/11-double-bounce.patch
+++ b/patches/11-double-bounce.patch
@@ -145,11 +145,11 @@ helper installed by the package.
 +                      exit(1);
 +              } else if (WIFSIGNALED(stat)) {
 +                      syslog(LOG_ERR, "%s: double-bounce deferred: child process %ld died from signal %d; child process output: %s",
-+                             it->queueid, child, WTERMSIG(stat), buf);
++                             it->queueid, (long)child, WTERMSIG(stat), buf);
 +                      exit(1);
 +              } else if (!WIFEXITED(stat)) {
 +                      syslog(LOG_ERR, "%s: double-bounce deferred: child process %ld got an unexpected waitpid code of %d; child process output: %s",
-+                             it->queueid, child, stat, buf);
++                             it->queueid, (long)child, stat, buf);
 +                      exit(1);
 +              } else if (WEXITSTATUS(stat) != 0) {
 +                      syslog(LOG_ERR, "%s: double-bounce deferred: child process %ld exited with code %d; child process output: %s",

diff --git a/patches/13-hardening.patch b/patches/13-hardening.patch
new file mode 100644 (file)
index 0000000..ed2957b
--- /dev/null
+++ b/patches/13-hardening.patch
@@ -0,0 +1,99 @@
+Appease the Debian hardening wrapper:
+- check the result of fgets()
+- loop the network writes until the whole thing is sent
+- check one more write() result
+
+--- a/conf.c
++++ b/conf.c
+@@ -106,7 +106,8 @@
+               return (-1);
+ 
+       while (!feof(v)) {
+-              fgets(line, sizeof(line), v);
++              if (fgets(line, sizeof(line), v) == NULL)
++                      break;
+               /* We hit a comment */
+               if (strchr(line, '#'))
+                       *strchr(line, '#') = 0;
+@@ -162,7 +163,8 @@
+               return (1);
+ 
+       while (!feof(a)) {
+-              fgets(line, sizeof(line), a);
++              if (fgets(line, sizeof(line), a) == NULL)
++                      break;
+               /* We hit a comment */
+               if (strchr(line, '#'))
+                       *strchr(line, '#') = 0;
+@@ -199,7 +201,8 @@
+       config->features = 0;
+ 
+       while (!feof(conf)) {
+-              fgets(line, sizeof(line), conf);
++              if (fgets(line, sizeof(line), conf) == NULL)
++                      break;
+               /* We hit a comment */
+               if (strchr(line, '#'))
+                       *strchr(line, '#') = 0;
+--- a/net.c
++++ b/net.c
+@@ -73,23 +73,39 @@
+ {
+       va_list va;
+       char cmd[4096];
+-      ssize_t len = 0;
++      size_t len, pos;
++      int s;
++      ssize_t n;
+ 
+       va_start(va, fmt);
+-      vsprintf(cmd, fmt, va);
++      s = vsnprintf(cmd, sizeof(cmd) - 2, fmt, va);
++      va_end(va);
++      if (s == sizeof(cmd) - 2 || s < 0)
++              errx(1, "Internal error: oversized command string");
++      /* We *know* there are at least two more bytes available */
++      strcat(cmd, "\r\n");
++      len = strlen(cmd);
+ 
+       if (((config->features & SECURETRANS) != 0) &&
+           ((config->features & NOSSL) == 0)) {
+-              len = SSL_write(config->ssl, (const char*)cmd, strlen(cmd));
+-              SSL_write(config->ssl, "\r\n", 2);
++              while ((s = SSL_write(config->ssl, (const char*)cmd, len)) <= 0) {
++                      s = SSL_get_error(config->ssl, s);
++                      if (s != SSL_ERROR_WANT_READ &&
++                          s != SSL_ERROR_WANT_WRITE)
++                              return (-1);
++              }
+       }
+       else {
+-              len = write(fd, cmd, strlen(cmd));
+-              write(fd, "\r\n", 2);
++              pos = 0;
++              while (pos < len) {
++                      n = write(fd, cmd + pos, len - pos);
++                      if (n < 0)
++                              return (-1);
++                      pos += n;
++              }
+       }
+-      va_end(va);
+ 
+-      return (len+2);
++      return (len);
+ }
+ 
+ int
+--- a/dma.c
++++ b/dma.c
+@@ -608,7 +608,8 @@
+                       break;
+               if (line[0] == '\n')
+                       break;
+-              write(bounceq.mailfd, line, strlen(line));
++              if (write(bounceq.mailfd, line, strlen(line)) != strlen(line))
++                      goto fail;
+       }
+       if (fsync(bounceq.mailfd) != 0)
+               goto fail;

diff --git a/patches/series b/patches/series
index 564737eeab1b460557acdfee37eb57acd1ecc3d6..2bba0a097052711f5c488ae859114135ef3f580a 100644 (file)
--- a/patches/series
+++ b/patches/series
@@ -10,3 +10,4 @@
 10-liblockfile.patch
 11-double-bounce.patch
 12-man-q-argument.patch
+13-hardening.patch

diff --git a/rules b/rules
index 4f5afbdc487911897328673af68b2bbb063c2348..7d0ca36c12a1739ee53965f78ab7e69d582d8800 100755 (executable)
--- a/rules
+++ b/rules
@@ -15,6 +15,11 @@ endif
 ifneq (,$(filter nostrip,$(DEB_BUILD_OPTIONS)))
        export STRIPFLAG=
 endif
+ifeq (,$(filter nohardening,$(DEB_BUILD_OPTIONS)))
+export DEB_BUILD_HARDENING=1
+else
+export DEB_BUILD_HARDENING=0
+endif
 
 export CFLAGS