Moved checkpoints out of main, to prep for using them to help prevent DoS attacks

[novacoin.git] / src / makefile.unix

diff --git a/src/makefile.unix b/src/makefile.unix
index 4c92797..a2cbc7c 100644 (file)
--- a/src/makefile.unix
+++ b/src/makefile.unix
@@ -30,30 +30,85 @@ endif
 
 LIBS+= \
  -Wl,-Bdynamic \
-   -l gthread-2.0 \
    -l z \
    -l dl \
    -l pthread
 
 
+# Hardening
+# Make some classes of vulnerabilities unexploitable in case one is discovered.
+#
+    # This is a workaround for Ubuntu bug #691722, the default -fstack-protector causes
+    # -fstack-protector-all to be ignored unless -fno-stack-protector is used first.
+    # see: https://bugs.launchpad.net/ubuntu/+source/gcc-4.5/+bug/691722
+    HARDENING=-fno-stack-protector
+
+    # Stack Canaries
+    # Put numbers at the beginning of each stack frame and check that they are the same.
+    # If a stack buffer if overflowed, it writes over the canary number and then on return
+    # when that number is checked, it won't be the same and the program will exit with
+    # a "Stack smashing detected" error instead of being exploited.
+    HARDENING+=-fstack-protector-all -Wstack-protector
+
+    # Make some important things such as the global offset table read only as soon as
+    # the dynamic linker is finished building it. This will prevent overwriting of addresses
+    # which would later be jumped to.
+    HARDENING+=-Wl,-z,relro -Wl,-z,now
+
+    # Build position independent code to take advantage of Address Space Layout Randomization
+    # offered by some kernels.
+    # see doc/build-unix.txt for more information.
+    ifdef PIE
+        HARDENING+=-fPIE -pie
+    endif
+
+    # -D_FORTIFY_SOURCE=2 does some checking for potentially exploitable code patterns in
+    # the source such overflowing a statically defined buffer.
+    HARDENING+=-D_FORTIFY_SOURCE=2
+#
+
+
 DEBUGFLAGS=-g -D__WXDEBUG__
-CXXFLAGS=-O2 -Wno-invalid-offsetof -Wformat $(DEBUGFLAGS) $(DEFS)
-HEADERS=headers.h strlcpy.h serialize.h uint256.h util.h key.h bignum.h base58.h \
-    script.h db.h net.h irc.h keystore.h main.h wallet.h rpc.h uibase.h ui.h noui.h \
-    init.h crypter.h
+CXXFLAGS=-O2 -Wno-invalid-offsetof -Wformat $(DEBUGFLAGS) $(DEFS) $(HARDENING)
+HEADERS = \
+    base58.h \
+    bignum.h \
+    checkpoints.h \
+    crypter.h \
+    db.h \
+    headers.h \
+    init.h \
+    irc.h \
+    key.h \
+    keystore.h \
+    main.h \
+    net.h \
+    noui.h \
+    protocol.h \
+    rpc.h \
+    script.h \
+    serialize.h \
+    strlcpy.h \
+    ui.h \
+    uibase.h \
+    uint256.h \
+    util.h \
+    wallet.h
 
 OBJS= \
-    obj/util.o \
-    obj/script.o \
+    obj/checkpoints.o \
+    obj/crypter.o \
     obj/db.o \
-    obj/net.o \
+    obj/init.o \
     obj/irc.o \
     obj/keystore.o \
     obj/main.o \
-    obj/wallet.o \
+    obj/net.o \
+    obj/protocol.o \
     obj/rpc.o \
-    obj/init.o \
-    obj/crypter.o \
+    obj/script.o \
+    obj/util.o \
+    obj/wallet.o \
     cryptopp/obj/sha.o \
     cryptopp/obj/cpu.o
 
@@ -77,8 +132,8 @@ obj/nogui/%.o: %.cpp $(HEADERS)
 bitcoind: $(OBJS:obj/%=obj/nogui/%)
        $(CXX) $(CXXFLAGS) -o $@ $^ $(LIBS)
 
-obj/test/%.o: test/%.cpp $(HEADERS)
-       $(CXX) -c $(CXXFLAGS) -o $@ $<
+obj/test/test_bitcoin.o: $(wildcard test/*.cpp) $(HEADERS)
+       $(CXX) -c $(CFLAGS) -o $@ test/test_bitcoin.cpp
 
 test_bitcoin: obj/test/test_bitcoin.o $(filter-out obj/nogui/init.o,$(OBJS:obj/%=obj/nogui/%))
        $(CXX) $(CXXFLAGS) -o $@ $(LIBPATHS) $^ -Wl,-Bstatic -lboost_unit_test_framework $(LIBS)