Add the same hardening options to dnsdist.

PIE, full read-only relocation, stack and buffer overflow protections
are present for pdns, add them to dnsdist as well.

diff --git a/pdns/dnsdistdist/Makefile.am b/pdns/dnsdistdist/Makefile.am
index eba8d7af0842e0b2d1a61664174f9d080026328c..75c9b3b5520accf4496927abf2b6464d98134703 100644 (file)
--- a/pdns/dnsdistdist/Makefile.am
+++ b/pdns/dnsdistdist/Makefile.am
@@ -59,6 +59,7 @@ dnsdist_SOURCES = \
 
 dnsdist_LDFLAGS = \
        $(AM_LDFLAGS) \
+       $(PROGRAM_LDFLAGS) \
        -pthread 
 
 dnsdist_LDADD = \

diff --git a/pdns/dnsdistdist/configure.ac b/pdns/dnsdistdist/configure.ac
index dd297380483eec15d2cb403cdba8727e5119ceb5..93b3b262a9737477e47c30c7f87b30cd18dea6f7 100644 (file)
--- a/pdns/dnsdistdist/configure.ac
+++ b/pdns/dnsdistdist/configure.ac
@@ -17,6 +17,31 @@ DNSDIST_LUA
 AX_CXX_COMPILE_STDCXX_11(ext,mandatory)
 AC_DEFINE([HAVE_MBEDTLS2], [1], [Defined if mbed TLS version 2.x.x is used])
 
+AC_MSG_CHECKING([whether we will enable compiler security checks])
+AC_ARG_ENABLE([hardening],
+  [AS_HELP_STRING([--disable-hardening],[disable compiler security checks @<:@default=no@:>@])],
+  [enable_hardening=$enableval],
+  [enable_hardening=yes]
+)
+AC_MSG_RESULT([$enable_hardening])
+
+AS_IF([test "x$enable_hardening" != "xno"], [
+  AC_CC_PIE
+  AC_CC_STACK_PROTECTOR
+  AC_CC_PARAM_SSP_BUFFER_SIZE([4])
+  AC_CC_D_FORTIFY_SOURCE
+  AC_LD_RELRO
+])
+
+LDFLAGS="$RELRO_LDFLAGS $LDFLAGS"
+
+AS_IF([test "x$static" != "xyes"], [
+  CFLAGS="$PIE_CFLAGS $CFLAGS"
+  CXXFLAGS="$PIE_CFLAGS $CXXFLAGS"
+  PROGRAM_LDFLAGS="$PIE_LDFLAGS $PROGRAM_LDFLAGS"
+])
+AC_SUBST([PROGRAM_LDFLAGS])
+
 AC_CONFIG_FILES([Makefile
        ext/yahttp/Makefile
        ext/yahttp/yahttp/Makefile])

diff --git a/pdns/dnsdistdist/m4/pdns_d_fortify_source.m4 b/pdns/dnsdistdist/m4/pdns_d_fortify_source.m4
new file mode 120000 (symlink)
index 0000000..8aa713e
--- /dev/null
+++ b/pdns/dnsdistdist/m4/pdns_d_fortify_source.m4
@@ -0,0 +1 @@
+../../../m4/pdns_d_fortify_source.m4
\ No newline at end of file

diff --git a/pdns/dnsdistdist/m4/pdns_param_ssp_buffer_size.m4 b/pdns/dnsdistdist/m4/pdns_param_ssp_buffer_size.m4
new file mode 120000 (symlink)
index 0000000..4058fe2
--- /dev/null
+++ b/pdns/dnsdistdist/m4/pdns_param_ssp_buffer_size.m4
@@ -0,0 +1 @@
+../../../m4/pdns_param_ssp_buffer_size.m4
\ No newline at end of file

diff --git a/pdns/dnsdistdist/m4/pdns_pie.m4 b/pdns/dnsdistdist/m4/pdns_pie.m4
new file mode 120000 (symlink)
index 0000000..18120c0
--- /dev/null
+++ b/pdns/dnsdistdist/m4/pdns_pie.m4
@@ -0,0 +1 @@
+../../../m4/pdns_pie.m4
\ No newline at end of file

diff --git a/pdns/dnsdistdist/m4/pdns_relro.m4 b/pdns/dnsdistdist/m4/pdns_relro.m4
new file mode 120000 (symlink)
index 0000000..1f591df
--- /dev/null
+++ b/pdns/dnsdistdist/m4/pdns_relro.m4
@@ -0,0 +1 @@
+../../../m4/pdns_relro.m4
\ No newline at end of file

diff --git a/pdns/dnsdistdist/m4/pdns_stack_protector.m4 b/pdns/dnsdistdist/m4/pdns_stack_protector.m4
new file mode 120000 (symlink)
index 0000000..ba05f66
--- /dev/null
+++ b/pdns/dnsdistdist/m4/pdns_stack_protector.m4
@@ -0,0 +1 @@
+../../../m4/pdns_stack_protector.m4
\ No newline at end of file

diff --git a/pdns/dnsdistdist/m4/warnings.m4 b/pdns/dnsdistdist/m4/warnings.m4
new file mode 120000 (symlink)
index 0000000..ec2d33f
--- /dev/null
+++ b/pdns/dnsdistdist/m4/warnings.m4
@@ -0,0 +1 @@
+../../../m4/warnings.m4
\ No newline at end of file