Hi.
Both GCC and clang are adding mitigations for Spectre variant 2 although
neither have yet made a release and neither are on by default.
After trolling through and building release candidate branches for both
I believe this is what is required for the ssh programs (although all
the dependent libraries will also need to be built with mitigations, and
I suspect libcrypto is a more likely target).
Anyway we've got to start somewhere and this builds and passes regress on
x86_64 with gcc 7.2.1 20171218 and clang 6.0 branch. Happy to get
feedback about other compilers.
diff --git a/configure.ac b/configure.ac
index c14f484b..89e6975c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -163,6 +163,10 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
if test "x$use_toolchain_hardening" = "x1"; then
+ OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc
+ OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc
+ OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
+ OSSH_CHECK_CFLAG_LINK([-z retpolineplt]) # clang
OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
--
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860 37F4 9357 ECEF 11EA A6FA (new)
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
