xmppipe/Makefile

.PHONY: all static clean test

PROG=xmppipe
RM=rm

UNAME_SYS := $(shell uname -s)
ifeq ($(UNAME_SYS), Linux)
	CFLAGS ?= -D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \
			  -Wformat -Werror=format-security \
			  -pie -fPIE \
			  -fno-strict-aliasing
	XMPPIPE_SANDBOX ?= seccomp
	XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= 0
	LDFLAGS ?= -Wl,-z,relro,-z,now -Wl,-z,noexecstack
else ifeq ($(UNAME_SYS), FreeBSD)
	CFLAGS ?= -DHAVE_STRTONUM \
			  -D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \
			  -Wformat -Werror=format-security \
			  -pie -fPIE \
			  -fno-strict-aliasing
	XMPPIPE_SANDBOX ?= capsicum
	LDFLAGS ?= -Wl,-z,relro,-z,now -Wl,-z,noexecstack
else ifeq ($(UNAME_SYS), OpenBSD)
	CFLAGS ?= -DHAVE_STRTONUM \
			  -D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \
			  -Wformat -Werror=format-security \
			  -pie -fPIE \
			  -fno-strict-aliasing
	XMPPIPE_SANDBOX ?= pledge
	LDFLAGS ?= -Wl,-z,relro,-z,now -Wl,-z,noexecstack
else ifeq ($(UNAME_SYS), SunOS)
else ifeq ($(UNAME_SYS), Darwin)
	CFLAGS ?= -D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \
			  -Wformat -Werror=format-security \
			  -pie -fPIE \
			  -fno-strict-aliasing
endif

XMPPIPE_SANDBOX ?= rlimit
XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= -1

XMPPIPE_CFLAGS ?= -g -Wall
CFLAGS += $(XMPPIPE_CFLAGS) \
		  -fwrapv \
		  -DXMPPIPE_SANDBOX=\"$(XMPPIPE_SANDBOX)\" \
		  -DXMPPIPE_SANDBOX_$(XMPPIPE_SANDBOX) \
		  -DXMPPIPE_SANDBOX_RLIMIT_NOFILE=$(XMPPIPE_SANDBOX_RLIMIT_NOFILE)

LDFLAGS += $(XMPPIPE_LDFLAGS)

all: $(PROG)

$(PROG):
	$(CC) $(CFLAGS) -o xmppipe src/*.c $(LDFLAGS) -lstrophe

static:
	$(CC) $(CFLAGS) \
		-no-pie -fno-PIE \
		$(XMPPIPE_CFLAGS) \
	 	-o xmppipe src/*.c -Wl,--no-as-needed \
		$(LDFLAGS) -ldl -lz -lresolv \
		-l:libstrophe.a \
		-l:libssl.a -l:libcrypto.a \
		-l:libexpat.a

clean:
	-@$(RM) $(PROG)

test: $(PROG)
	-@PATH=.:$$PATH bats test
makefile: add target for test 2017-02-17 14:57:32 +00:00			`.PHONY: all static clean test`

makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`PROG=xmppipe`
Forward stdin over XMPP 2015-05-11 19:19:35 +00:00			`RM=rm`

Compile on BSDs Use uuid_create(3) and uuid_to_string(3) to create the message id on BSDs. Only tested on FreeBSD but should work on OpenBSD and NetBSD. Add untested support for compiling on Solaris and Mac OS X: * SmartOS has libuuid installed by default with rsyslog via pkgsrc * Mac OS X has libuuid as part of libSystem: http://lists.apple.com/archives/unix-porting/2009/Aug/msg00006.html 2015-07-01 13:12:16 +00:00			`UNAME_SYS := $(shell uname -s)`
			`ifeq ($(UNAME_SYS), Linux)`
Use -fstack-protector-strong 2017-11-02 14:19:19 +00:00			`CFLAGS ?= -D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \`
			`-Wformat -Werror=format-security \`
Enable PIE 2018-12-30 12:57:52 +00:00			`-pie -fPIE \`
makefile: fix static target 2017-04-23 13:55:09 +00:00			`-fno-strict-aliasing`
sandbox: use the lowercase name for configuration 2017-08-25 14:47:57 +00:00			`XMPPIPE_SANDBOX ?= seccomp`
sandbox: set number of allowed fd's The number of file descriptors enforced by setrlimit() can now be set at compile time using a flag. The flag defaults to 0 on Linux and -1 everywhere else: XMPPIPE_SANDBOX=XMPPIPE_SANDBOX_RLIMIT \ XMPPIPE_SANDBOX_RLIMIT_NOFILE=-1 \ make The meaning of the XMPPIPE_SANDBOX_RLIMIT_NOFILE is: * -1 : set rlim_cur/rlim_max to the lowest allocated file desciptor * >=0: set rlim_cur/rlim_max to this number On some platforms, setting rlim_cur below the value of the highest allocated fd may interfere with polling. See commit a34d5766c57d for details. 2017-02-01 15:25:38 +00:00			`XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= 0`
Enable PIE 2018-12-30 12:57:52 +00:00			`LDFLAGS ?= -Wl,-z,relro,-z,now -Wl,-z,noexecstack`
sandbox: enable capabilities sandbox on FreeBSD 2017-02-04 14:00:49 +00:00			`else ifeq ($(UNAME_SYS), FreeBSD)`
Use native strtonum(3) on BSDs 2017-05-18 13:55:45 +00:00			`CFLAGS ?= -DHAVE_STRTONUM \`
Use -fstack-protector-strong 2017-11-02 14:19:19 +00:00			`-D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \`
			`-Wformat -Werror=format-security \`
Enable PIE 2018-12-30 12:57:52 +00:00			`-pie -fPIE \`
makefile: fix static target 2017-04-23 13:55:09 +00:00			`-fno-strict-aliasing`
sandbox: use the lowercase name for configuration 2017-08-25 14:47:57 +00:00			`XMPPIPE_SANDBOX ?= capsicum`
Enable PIE 2018-12-30 12:57:52 +00:00			`LDFLAGS ?= -Wl,-z,relro,-z,now -Wl,-z,noexecstack`
sandbox: stdio mode using pledge(2) on OpenBSD 2017-01-30 15:17:54 +00:00			`else ifeq ($(UNAME_SYS), OpenBSD)`
Use native strtonum(3) on BSDs 2017-05-18 13:55:45 +00:00			`CFLAGS ?= -DHAVE_STRTONUM \`
Use -fstack-protector-strong 2017-11-02 14:19:19 +00:00			`-D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \`
			`-Wformat -Werror=format-security \`
Enable PIE 2018-12-30 12:57:52 +00:00			`-pie -fPIE \`
makefile: fix static target 2017-04-23 13:55:09 +00:00			`-fno-strict-aliasing`
sandbox: use the lowercase name for configuration 2017-08-25 14:47:57 +00:00			`XMPPIPE_SANDBOX ?= pledge`
Enable PIE 2018-12-30 12:57:52 +00:00			`LDFLAGS ?= -Wl,-z,relro,-z,now -Wl,-z,noexecstack`
Compile on BSDs Use uuid_create(3) and uuid_to_string(3) to create the message id on BSDs. Only tested on FreeBSD but should work on OpenBSD and NetBSD. Add untested support for compiling on Solaris and Mac OS X: * SmartOS has libuuid installed by default with rsyslog via pkgsrc * Mac OS X has libuuid as part of libSystem: http://lists.apple.com/archives/unix-porting/2009/Aug/msg00006.html 2015-07-01 13:12:16 +00:00			`else ifeq ($(UNAME_SYS), SunOS)`
			`else ifeq ($(UNAME_SYS), Darwin)`
macosx: fix compile errors 2018-04-13 11:32:46 +00:00			`CFLAGS ?= -D_FORTIFY_SOURCE=2 -O2 -fstack-protector-strong \`
			`-Wformat -Werror=format-security \`
Enable PIE 2018-12-30 12:57:52 +00:00			`-pie -fPIE \`
macosx: fix compile errors 2018-04-13 11:32:46 +00:00			`-fno-strict-aliasing`
Compile on BSDs Use uuid_create(3) and uuid_to_string(3) to create the message id on BSDs. Only tested on FreeBSD but should work on OpenBSD and NetBSD. Add untested support for compiling on Solaris and Mac OS X: * SmartOS has libuuid installed by default with rsyslog via pkgsrc * Mac OS X has libuuid as part of libSystem: http://lists.apple.com/archives/unix-porting/2009/Aug/msg00006.html 2015-07-01 13:12:16 +00:00			`endif`

sandbox: use the lowercase name for configuration 2017-08-25 14:47:57 +00:00			`XMPPIPE_SANDBOX ?= rlimit`
sandbox: set number of allowed fd's The number of file descriptors enforced by setrlimit() can now be set at compile time using a flag. The flag defaults to 0 on Linux and -1 everywhere else: XMPPIPE_SANDBOX=XMPPIPE_SANDBOX_RLIMIT \ XMPPIPE_SANDBOX_RLIMIT_NOFILE=-1 \ make The meaning of the XMPPIPE_SANDBOX_RLIMIT_NOFILE is: * -1 : set rlim_cur/rlim_max to the lowest allocated file desciptor * >=0: set rlim_cur/rlim_max to this number On some platforms, setting rlim_cur below the value of the highest allocated fd may interfere with polling. See commit a34d5766c57d for details. 2017-02-01 15:25:38 +00:00			`XMPPIPE_SANDBOX_RLIMIT_NOFILE ?= -1`
makefile: env vars to pass extra build flags 2017-04-26 11:23:55 +00:00
			`XMPPIPE_CFLAGS ?= -g -Wall`
			`CFLAGS += $(XMPPIPE_CFLAGS) \`
makefile: define behaviour for signed ints 2017-10-26 14:56:51 +00:00			`-fwrapv \`
sandbox: use the lowercase name for configuration 2017-08-25 14:47:57 +00:00			`-DXMPPIPE_SANDBOX=\"$(XMPPIPE_SANDBOX)\" \`
			`-DXMPPIPE_SANDBOX_$(XMPPIPE_SANDBOX) \`
Display enforced sandbox in verbose mode 2017-02-03 14:47:12 +00:00			`-DXMPPIPE_SANDBOX_RLIMIT_NOFILE=$(XMPPIPE_SANDBOX_RLIMIT_NOFILE)`
Initial support for sandboxing Prepare for sandboxing the xmppipe process by adding a function called after all file descriptors are allocated. The intent of the sandbox is to limit the xmppipe process to the role of a component in a shell pipeline: reading from stdin, reading/writing to the XMPP socket and writing to stdout. Any activity not involved with using stdio should force the process to exit. The sandbox function will vary based on the capabilities of the platform. The default sandbox function does nothing. Limitations of the sandbox: Probably the biggest risk is in session establishment: * the TLS handshake * the XML parsing The sandbox is enforced after the TLS connection is established, i.e., after the file descriptor for the XMPP session is allocated and so has no effect on the TLS handshake or the initial XMPP handshake. Possibly an initial sandbox could be setup for the connection phase followed by a stricter sandbox for the stdio phase. 2017-01-29 14:13:18 +00:00
makefile: pass custom LDFLAGS to static build 2017-12-07 14:57:43 +00:00			`LDFLAGS += $(XMPPIPE_LDFLAGS)`
makefile: env vars to pass extra build flags 2017-04-26 11:23:55 +00:00
makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`all: $(PROG)`

			`$(PROG):`
makefile: env vars to pass extra build flags 2017-04-26 11:23:55 +00:00			`$(CC) $(CFLAGS) -o xmppipe src/*.c $(LDFLAGS) -lstrophe`
makefile: static target, link against libresolv libresolv is required for base64 encoding. 2015-05-25 14:20:04 +00:00
			`static:`
makefile: fix static builds 2019-01-09 15:20:23 +00:00			`$(CC) $(CFLAGS) \`
			`-no-pie -fno-PIE \`
			`$(XMPPIPE_CFLAGS) \`
			`-o xmppipe src/*.c -Wl,--no-as-needed \`
makefile: pass custom LDFLAGS to static build 2017-12-07 14:57:43 +00:00			`$(LDFLAGS) -ldl -lz -lresolv \`
makefile: fix static target 2017-10-31 14:09:01 +00:00			`-l:libstrophe.a \`
			`-l:libssl.a -l:libcrypto.a \`
			`-l:libexpat.a`
Forward stdin over XMPP 2015-05-11 19:19:35 +00:00
			`clean:`
makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`-@$(RM) $(PROG)`
makefile: add target for test 2017-02-17 14:57:32 +00:00
makefile: ensure compile before tests 2017-04-16 19:24:01 +00:00			`test: $(PROG)`
test: base64 encode/decode 2017-02-18 14:56:22 +00:00			`-@PATH=.:$$PATH bats test`