push sheeet

pkgs/test/cc-wrapper/atomics.cc

@@ -0,0 +1,8 @@
+#include <atomic>
+#include <cstdint>
+
+int main()
+{
+  std::atomic_int x = {0};
+  return !std::atomic_is_lock_free(&x);
+}

pkgs/test/cc-wrapper/cc-main.c

@@ -0,0 +1,7 @@
+#include <stdio.h>
+
+int main(int argc, char **argv)
+{
+  fprintf(stderr, "ok\n");
+  return 0;
+}

pkgs/test/cc-wrapper/cflags-main.c

@@ -0,0 +1,10 @@
+#include <stdio.h>
+#include <foo.h>
+
+int main(int argc, char **argv)
+{
+  if (foo() != 42)
+    return 1;
+  fprintf(stderr, "ok\n");
+  return 0;
+}

pkgs/test/cc-wrapper/core-foundation-main.c

@@ -0,0 +1,7 @@
+#include <CoreFoundation/CoreFoundation.h>
+
+int main(int argc, char** argv)
+{
+  CFShow(CFSTR("ok"));
+  return 0;
+}

pkgs/test/cc-wrapper/cxx-main.cc

@@ -0,0 +1,7 @@
+#include <iostream>
+
+int main(int argc, char **argv)
+{
+  std::cerr << "ok" << std::endl;
+  return 0;
+}

pkgs/test/cc-wrapper/default.nix

@@ -0,0 +1,157 @@
+{
+  lib,
+  stdenv,
+  glibc,
+  buildPackages,
+}:
+
+let
+  # Sanitizers are not supported on Darwin.
+  # Sanitizer headers aren't available in older libc++ stdenvs due to a bug
+  sanitizersWorking =
+    (stdenv.buildPlatform == stdenv.hostPlatform)
+    && !stdenv.hostPlatform.isDarwin
+    && !stdenv.hostPlatform.isMusl
+    && (
+      (stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc.name) "5.0.0")
+      || (stdenv.cc.isGNU && stdenv.hostPlatform.isLinux)
+    );
+  staticLibc = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "-L ${glibc.static}/lib";
+  emulator = stdenv.hostPlatform.emulator buildPackages;
+  isCxx = stdenv.cc.libcxx != null;
+  libcxxStdenvSuffix = lib.optionalString isCxx "-libcxx";
+  CC = "PATH= ${lib.getExe' stdenv.cc "${stdenv.cc.targetPrefix}cc"}";
+  CXX = "PATH= ${lib.getExe' stdenv.cc "${stdenv.cc.targetPrefix}c++"}";
+  READELF = "PATH= ${lib.getExe' stdenv.cc "${stdenv.cc.targetPrefix}readelf"}";
+in
+stdenv.mkDerivation {
+  pname = "cc-wrapper-test-${stdenv.cc.cc.pname}${libcxxStdenvSuffix}";
+  version = stdenv.cc.version;
+
+  buildCommand = ''
+    echo "Testing: ${stdenv.cc.name}" >&2
+    echo "With libc: ${stdenv.cc.libc.name}" >&2
+    set -o pipefail
+
+    NIX_DEBUG=1 ${CC} -v
+    NIX_DEBUG=1 ${CXX} -v
+
+    echo "checking whether compiler builds valid C binaries... " >&2
+    ${CC} -o cc-check ${./cc-main.c}
+    ${emulator} ./cc-check
+
+    echo "checking whether compiler builds valid C++ binaries... " >&2
+    ${CXX} -o cxx-check ${./cxx-main.cc}
+    ${emulator} ./cxx-check
+
+    # test for https://github.com/NixOS/nixpkgs/issues/214524#issuecomment-1431745905
+    # .../include/cxxabi.h:20:10: fatal error: '__cxxabi_config.h' file not found
+    # in libcxxStdenv
+    echo "checking whether cxxabi.h can be included... " >&2
+    ${CXX} -o include-cxxabi ${./include-cxxabi.cc}
+    ${emulator} ./include-cxxabi
+
+    # cxx doesn't have libatomic.so
+    ${lib.optionalString (!isCxx) ''
+      # https://github.com/NixOS/nixpkgs/issues/91285
+      echo "checking whether libatomic.so can be linked... " >&2
+      ${CXX} -shared -o atomics.so ${./atomics.cc} -latomic ${
+        lib.optionalString (stdenv.cc.isClang && lib.versionOlder stdenv.cc.version "6.0.0") "-std=c++17"
+      }
+      ${READELF} -d ./atomics.so | grep libatomic.so && echo "ok" >&2 || echo "failed" >&2
+    ''}
+
+    # Test that linking libc++ works, and statically.
+    ${lib.optionalString isCxx ''
+      echo "checking whether can link with libc++... " >&2
+      NIX_DEBUG=1 ${CXX} ${./cxx-main.cc} -c -o cxx-main.o
+      NIX_DEBUG=1 ${CC} cxx-main.o -lc++ -o cxx-main
+      NIX_DEBUG=1 ${CC} cxx-main.o ${lib.getLib stdenv.cc.libcxx}/lib/libc++.a -o cxx-main-static
+      ${emulator} ./cxx-main
+      ${emulator} ./cxx-main-static
+      rm cxx-main{,-static,.o}
+    ''}
+
+    ${lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.cc.isClang) ''
+      echo "checking whether compiler can build with CoreFoundation.framework... " >&2
+      mkdir -p foo/lib
+      ${CC} -framework CoreFoundation -o core-foundation-check ${./core-foundation-main.c}
+      ${emulator} ./core-foundation-check
+    ''}
+
+
+    ${lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+      echo "checking whether compiler builds valid static C binaries... " >&2
+      ${CC} ${staticLibc} -static -o cc-static ${./cc-main.c}
+      ${emulator} ./cc-static
+      ${lib.optionalString (stdenv.cc.isGNU && lib.versionAtLeast (lib.getVersion stdenv.cc.name) "8.0.0")
+        ''
+          echo "checking whether compiler builds valid static pie C binaries... " >&2
+          ${CC} ${staticLibc} -static-pie -o cc-static-pie ${./cc-main.c}
+          ${emulator} ./cc-static-pie
+        ''
+      }
+    ''}
+
+    ${
+      # See: https://github.com/llvm/llvm-project/commit/ed1d07282cc9d8e4c25d585e03e5c8a1b6f63a74
+      # `gcc` does not support this so we gate the test on `clang`
+      lib.optionalString stdenv.cc.isClang ''
+        echo "checking whether cc-wrapper accepts -- followed by positional (file) args..." >&2
+        mkdir -p positional
+
+        # Make sure `--` is not parsed as a "non flag arg"; we should get an
+        # input file error here and *not* a linker error.
+        { ! ${CC} --; } |& grep -q "no input files"
+
+        # And that positional file args _must_ be files (this is just testing
+        # that we remembered to put the `--` back in the args to the compiler):
+        { ! ${CC} -c -- -o foo ${./foo.c}; } \
+          |& grep -q "no such file or directory: '-o'"
+
+        # Now check that we accept single and multiple positional file args:
+        ${CC} -c -DVALUE=42 -o positional/foo.o -- ${./foo.c}
+        ${CC} -o positional/main -- positional/foo.o ${./ldflags-main.c}
+        ${emulator} ./positional/main
+      ''
+    }
+
+    echo "checking whether compiler uses NIX_CFLAGS_COMPILE... " >&2
+    mkdir -p foo/include
+    cp ${./foo.c} foo/include/foo.h
+    NIX_CFLAGS_COMPILE="-Ifoo/include -DVALUE=42" ${CC} -o cflags-check ${./cflags-main.c}
+    ${emulator} ./cflags-check
+
+    echo "checking whether compiler uses NIX_LDFLAGS... " >&2
+    mkdir -p foo/lib
+    ${CC} -shared \
+      ${lib.optionalString stdenv.hostPlatform.isDarwin "-Wl,-install_name,@rpath/libfoo.dylib"} \
+      -DVALUE=42 \
+      -o foo/lib/libfoo${stdenv.hostPlatform.extensions.sharedLibrary} \
+      ${./foo.c}
+
+    NIX_LDFLAGS="-L$NIX_BUILD_TOP/foo/lib -rpath $NIX_BUILD_TOP/foo/lib" ${CC} -lfoo -o ldflags-check ${./ldflags-main.c}
+    ${emulator} ./ldflags-check
+
+    echo "Check whether -nostdinc and -nostdinc++ is handled correctly" >&2
+    mkdir -p std-include
+    cp ${./stdio.h} std-include/stdio.h
+    NIX_DEBUG=1 ${CC} -I std-include -nostdinc -o nostdinc-main ${./nostdinc-main.c}
+    ${emulator} ./nostdinc-main
+    ${CXX} -I std-include -nostdinc++ -o nostdinc-main++ ${./nostdinc-main.c}
+    ${emulator} ./nostdinc-main++
+
+    ${lib.optionalString sanitizersWorking ''
+      echo "checking whether sanitizers are fully functional... ">&2
+      ${CC} -o sanitizers -fsanitize=address,undefined ${./sanitizers.c}
+      ASAN_OPTIONS=use_sigaltstack=0 ${emulator} ./sanitizers
+    ''}
+
+    echo "Check whether CC and LD with NIX_X_USE_RESPONSE_FILE hardcodes all required binaries..." >&2
+    NIX_CC_USE_RESPONSE_FILE=1 NIX_LD_USE_RESPONSE_FILE=1 ${CC} -v
+
+    touch $out
+  '';
+
+  meta.platforms = lib.platforms.all;
+}

pkgs/test/cc-wrapper/flex-arrays-fortify-example.c

@@ -0,0 +1,33 @@
+/* an example that should be protected by FORTIFY_SOURCE=2 but
+ * only if the appropriate -fstrict-flex-arrays= argument is used
+ * for the corresponding value used for BUFFER_DEF_SIZE
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct buffer_with_header {
+    char header[1];
+    char buffer[BUFFER_DEF_SIZE];
+};
+
+int main(int argc, char *argv[]) {
+    /* use volatile pointer to prevent compiler
+     * using the outer allocation length with a
+     * fortified strcpy, which would throw off
+     * the function-name-sniffing fortify-detecting
+     * approaches
+     */
+    struct buffer_with_header *volatile b = \
+      (struct buffer_with_header *)malloc(sizeof(struct buffer_with_header)+1);
+
+    /* if there are no arguments, skip the write to allow
+     * builds with BUFFER_DEF_SIZE=0 to have a case where
+     * the program passes even with strict protection.
+     */
+    if (argc > 1) {
+        strcpy(b->buffer, argv[1]);
+        puts(b->buffer);
+    }
+    return 0;
+}

pkgs/test/cc-wrapper/foo.c

@@ -0,0 +1,4 @@
+unsigned int foo(void)
+{
+  return VALUE;
+}

pkgs/test/cc-wrapper/fortify1-example.c

@@ -0,0 +1,16 @@
+/* an example that should be protected by FORTIFY_SOURCE=1 */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+
+int main(int argc, char *argv[]) {
+    /* allocate on the heap so we're likely to get an
+     * over-allocation and can be more sure that a
+     * failure is because of fortify protection rather
+     * than a genuine segfault */
+    char* buffer = malloc(sizeof(char) * 7);
+    strcpy(buffer, argv[1]);
+    puts(buffer);
+    return 0;
+}

pkgs/test/cc-wrapper/fortify2-example.c

@@ -0,0 +1,16 @@
+/* an example that should be protected by FORTIFY_SOURCE=2 but
+ * not FORTIFY_SOURCE=1 */
+#include <stdio.h>
+#include <string.h>
+
+struct buffer_with_pad {
+    char buffer[7];
+    char pad[25];
+};
+
+int main(int argc, char *argv[]) {
+    struct buffer_with_pad b;
+    strcpy(b.buffer, argv[1]);
+    puts(b.buffer);
+    return 0;
+}

pkgs/test/cc-wrapper/fortify3-example.c

@@ -0,0 +1,13 @@
+/* an example that should be protected by FORTIFY_SOURCE=3 but
+ * not FORTIFY_SOURCE=2 */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+
+int main(int argc, char *argv[]) {
+    char* buffer = malloc(atoi(argv[2]));
+    strcpy(buffer, argv[1]);
+    puts(buffer);
+    return 0;
+}

pkgs/test/cc-wrapper/include-cxxabi.cc

@@ -0,0 +1,8 @@
+#include <cxxabi.h>
+#include <iostream>
+
+int main(int argc, char **argv)
+{
+  std::cerr << "ok" << std::endl;
+  return 0;
+}

pkgs/test/cc-wrapper/ldflags-main.c

@@ -0,0 +1,12 @@
+#include <stdio.h>
+
+extern unsigned int foo(void);
+
+int main(int argc, char **argv)
+{
+  if (foo() != 42) {
+    return 1;
+  }
+  fprintf(stderr, "ok\n");
+  return 0;
+}

pkgs/test/cc-wrapper/multilib.nix

@@ -0,0 +1,37 @@
+{ lib, stdenv }:
+
+stdenv.mkDerivation {
+  name = "cc-multilib-test";
+
+  # XXX: "depend" on cc-wrapper test?
+
+  # TODO: Have tests report pointer size or something; ensure they are what we asked for
+  buildCommand = ''
+    NIX_DEBUG=1 $CC -v
+    NIX_DEBUG=1 $CXX -v
+
+    printf "checking whether compiler builds valid C binaries...\n " >&2
+    $CC -o cc-check ${./cc-main.c}
+    ./cc-check
+
+    printf "checking whether compiler builds valid 32bit C binaries...\n " >&2
+    $CC -m32 -o c32-check ${./cc-main.c}
+    ./c32-check
+
+    printf "checking whether compiler builds valid 64bit C binaries...\n " >&2
+    $CC -m64 -o c64-check ${./cc-main.c}
+    ./c64-check
+
+    printf "checking whether compiler builds valid 32bit C++ binaries...\n " >&2
+    $CXX -m32 -o cxx32-check ${./cxx-main.cc}
+    ./cxx32-check
+
+    printf "checking whether compiler builds valid 64bit C++ binaries...\n " >&2
+    $CXX -m64 -o cxx64-check ${./cxx-main.cc}
+    ./cxx64-check
+
+    touch $out
+  '';
+
+  meta.platforms = lib.platforms.x86_64;
+}

pkgs/test/cc-wrapper/nostdinc-main.c

@@ -0,0 +1,8 @@
+// This one should not come from libc because of -nostdinc
+#include <stdio.h>
+
+int main(int argc, char *argv[]) {
+  // provided by our own stdio.h
+  foo();
+  return 0;
+}

pkgs/test/cc-wrapper/sanitizers.c

@@ -0,0 +1,8 @@
+#include <sanitizer/asan_interface.h>
+#include <stdio.h>
+
+int main(int argc, char **argv)
+{
+  fprintf(stderr, "ok\n");
+  return 0;
+}

pkgs/test/cc-wrapper/stdio.h

@@ -0,0 +1 @@
+static void foo(void) {}