build fails on mingw64 with "undefined reference to `__stack_chk_fail'"

[kinichiro]

Hi,
It seems that current head build fails on mingw64, error messages are like this.

...
  CCLD     libcrypto.la
whrlpool\\.libs\\libcrypto_la-wp_block.o: In function `whirlpool_block':C:\mingw64\msys\home\xyz\libressl-2.1.2d\crypto/whrlpool/wp_block.c:634: undefined reference to `__stack_chk_fail'
whrlpool\\.libs\\libcrypto_la-wp_block.o:wp_block.c:(.rdata$.refptr.__stack_chk_guard[.refptr.__stack_chk_guard]+0x0): undefined reference to `__stack_chk_guard'
...

I think this comes from PL #53 that added -fstack-protector-all .

With ./configure --disable-hardening , I could build, though, is there any way to work with -fstack-protector-all on mingw64 ?

Thanks.

[busterb]

I don't think there is a way to enable it on mingw64, though it would be worth opening an issue for what hardening we can do for mingw. Something like this might be a start:

https://trac.torproject.org/projects/tor/attachment/ticket/2358/0001-Enable-ASLR-and-permanent-DEP-for-Windows-executable.patch

For this particular issue, I think we need to change the check from a compile test to a link test. This thread discusses a similar problem and how to detect it at configuration time:

http://marc.info/?l=flac-dev&m=141183608215125&w=2

[busterb]

@jbarlow83 , would you be able to take a look at this?

[jbarlow83]

@busterb Yes, I can.

I get a different error when running ./autogen.sh to try to set up mingw on a Windows 7 box.

pulling upstream openbsd source
./update.sh: line 17: git: command not found
libcrypto version 30:3:0
libssl version 30:0:0
libtls version 1:0:0
Added OID dsa
objects.txt:41:Undefined identifier X9_62_id_fieldType
mv: cannot stat `[...]/Documents/src/libressl/openbsd/src/lib/libss
l/src/crypto/objects/obj_mac.h': No such file or directory

The failure is at line 76-78 in ./update.sh, where a perl script is invoked to generate some headers. perl is installed in the mingw-msys environment.

@kinichiro what mingw "distribution" were you using?

[busterb]

I actually have time to look at it now.

I'm reproducing this on Ubuntu 14.04 with the mingw-w64 package installed. The configure line should look like this: CC=i686-w64-mingw32-gcc ./configure --host=i686-w64-mingw32

If you are building on Windows, I recommend installing mingw-w64 inside of cygwin and doing the same configuration, since you can more easily install perl and such.

[busterb]

Or just do make dist from linux and copy the tarball to windows to avoid the pre-configure steps.

[busterb]

I'm committing a fix that disables this directly for mingw, simplifies a lot of the other check logic, and gets us building again.

Interesting to note, link-time checks don't seem to work for the latest Mingw because it actually has a libssp-0.dll that it tries to link with during the compile checks! We can figure out what to do with that later.

[busterb]

please check 303b972

I will open a new ticket for enabling windows/mingw hardening flags. That there is a libssp dll is kind of interesting.

[busterb]

4b7e781 and 872ecfd too - sorry about that.

[kinichiro]

@jbarlow83
I'm using MinGW-w64 on Windows7.
MinGW-w64 : http://mingw-w64.sourceforge.net/index.php

@busterb
Thanks, I'll check your update later.

[kinichiro]

It works fine.
I could see -fstack-protector-all was removed from CFLAGS and build succeed.
I checked this with mingw64 on Windows7.
Thanks.