Merge pull request #180 from microsoft/yashkhatri/bugfixes

1.6.9-2 release
2022-06-13 11:37:08 +05:30 · 2022-06-13 11:37:08 +05:30 · ce0c085cf5
--- a/build/Makefile.gcc3
+++ b/build/Makefile.gcc3
@ -12,6 +12,10 @@
 # Define flags. (These will be submitted to all commands that use the preprocesor)
 DEFINES=-DPF_DISTRO_$(PF_DISTRO) -DPF_MAJOR=$(PF_MAJOR) -DOS_MINOR=$(PF_MINOR) -D$(ARCH) -DPF_WIDTH=$(PF_WIDTH)

+ifeq ($(ENABLE_SCX_SECURITY_HARDENING), 1)
+	DEFINES +=  -z noexecstack -Wl,-z,relro -Wl,-z,now -Wformat -Wformat-security -Werror=format-security -pie -D_FORTIFY_SOURCE=2
+endif
+
 ifeq ($(TRAVIS_CI), 1)
 	DEFINES += -DTRAVIS
 endif
@ -25,8 +29,8 @@ endif
 CXX_WARN_STRICT_FLAGS=-pedantic
 C_WARN_STRICT_FLAGS=-pedantic

-CXX_WARN_FLAGS=-Wall  -fno-nonansi-builtins  -Woverloaded-virtual -Wformat -Wformat-security   -Wfloat-equal -Wcast-align -Wconversion  -Wswitch-enum -Wundef -Wshadow -Wwrite-strings -Wredundant-decls -Werror $(CXX_WARN_STRICT_FLAGS)
-C_WARN_FLAGS=-Wall -fno-nonansi-builtins  -Woverloaded-virtual -Wformat -Wformat-security   -Wfloat-equal -Wcast-align -Wswitch-enum -Wundef -Wshadow -Wwrite-strings -Wredundant-decls -Werror $(C_WARN_STRICT_FLAGS)
+CXX_WARN_FLAGS=-Wall  -fno-nonansi-builtins  -Woverloaded-virtual -Wformat -Wformat-security   -Wfloat-equal -Wcast-align -Wconversion  -Wswitch-enum -Wundef -Wshadow -Wwrite-strings -Wredundant-decls $(CXX_WARN_STRICT_FLAGS)
+C_WARN_FLAGS=-Wall -fno-nonansi-builtins  -Woverloaded-virtual -Wformat -Wformat-security   -Wfloat-equal -Wcast-align -Wswitch-enum -Wundef -Wshadow -Wwrite-strings -Wredundant-decls $(C_WARN_STRICT_FLAGS)

 NEED_MINUS_CAST_QUAL=0
 NEED_MINUS_ERROR_CAST_QUAL=0
@ -88,8 +92,9 @@ else
 	DEFINES += -DNDEBUG
 endif 

-# CXX Debug flags for release builds
+#  C and CXX Debug flags for release builds
 ifeq ($(BUILD_TYPE),Release)
+	CFLAGS += -Os
 	CXXFLAGS += -Os -fno-enforce-eh-specs
 endif 

--- a/build/Makefile.kits
+++ b/build/Makefile.kits
@ -18,6 +18,14 @@ PACKAGE_FILENAME=package_filename
 STRIPPED=stripped
 IS_OPENSSL_100=$(shell openssl version | grep 1.0 | wc -l)

+ifeq ($(ENABLE_SCX_SECURITY_HARDENING),1)
+     SECURITY_FLAG=.s
+else
+     SECURITY_FLAG=
+endif
+
+EXCLUDE_SECURITY_FLAG=.s
+
 ifeq ($(PF_ARCH),x64)
    IS_OPENSSL_110=$(shell openssl version | grep 1.1 | wc -l)
 endif
@ -76,7 +84,7 @@ else
    endif
  endif

-  OUTPUT_PACKAGE_PREFIX=$(SCX_PREFIX)-$(SCX_BUILDVERSION_MAJOR).$(SCX_BUILDVERSION_MINOR).$(SCX_BUILDVERSION_PATCH)-$(SCX_BUILDVERSION_BUILDNR).universal.$(PF_ARCH)
+  OUTPUT_PACKAGE_PREFIX=$(SCX_PREFIX)-$(SCX_BUILDVERSION_MAJOR).$(SCX_BUILDVERSION_MINOR).$(SCX_BUILDVERSION_PATCH)-$(SCX_BUILDVERSION_BUILDNR).universal$(SECURITY_FLAG).$(PF_ARCH)
  OUTPUT_PACKAGE_SPECIFICATION_FIRST=--OUTPUTFILE=$(OUTPUT_PACKAGE_PREFIX)
  OUTPUT_PACKAGE_SPECIFICATION_SECOND=--OUTPUTFILE=$(OUTPUT_PACKAGE_PREFIX)
 endif
@ -486,16 +494,23 @@ ifneq ($(COMBINED_PACKAGES),1)
    ifneq ($(PF_ARCH),ppc)
 	# Copy omi kit depending on openssl version
      ifeq ($(IS_OPENSSL_110),1)
-	cp `find $(OMIKITS_DIR) -name omi-*ssl_110.ulinux.$(PF_ARCH).$(PACKAGE_SUFFIX)` $(INTERMEDIATE_DIR)/
+	cp `find $(OMIKITS_DIR) -name omi-*ssl_110.ulinux$(SECURITY_FLAG).$(PF_ARCH).$(PACKAGE_SUFFIX)` $(INTERMEDIATE_DIR)/
      else
        ifeq ($(IS_OPENSSL_100),1)
-	  cp `find $(OMIKITS_DIR) -name omi-*ssl_100.ulinux.$(PF_ARCH).$(PACKAGE_SUFFIX)` $(INTERMEDIATE_DIR)/
+	  cp `find $(OMIKITS_DIR) -name omi-*ssl_100.ulinux$(SECURITY_FLAG).$(PF_ARCH).$(PACKAGE_SUFFIX)` $(INTERMEDIATE_DIR)/
        endif
      endif
    endif
  endif
+  ifeq ($(PF),Linux)
+    ifeq ($(ENABLE_SCX_SECURITY_HARDENING),1)
+	cd $(INTERMEDIATE_DIR); echo `ls omi-*$(SECURITY_FLAG).$(PF_ARCH).$(PACKAGE_SUFFIX)` > omi_package_filename
+    else
+	cd $(INTERMEDIATE_DIR); echo `ls omi-*.$(PF_ARCH).$(PACKAGE_SUFFIX)|grep -v "$(EXCLUDE_SECURITY_FLAG).$(PF_ARCH)"` > omi_package_filename
+    endif
+  else
 	cd $(INTERMEDIATE_DIR); echo `ls omi-*.$(PACKAGE_SUFFIX)` > omi_package_filename
-
+  endif
  # Handle Redhat on PPC
  ifeq ($(PF_ARCH),ppc)
    ifeq ($(DISTRO_TYPE),Linux)
@ -530,9 +545,16 @@ else # ifneq ($(COMBINED_PACKAGES),1)
 	# (Copying for combined packages)
        ifeq ($(DISABLE_LISTENER),0)
 	  # Grab the OMI bits
-	  cd $(INTERMEDIATE_DIR); cp $(OMIKITS_DIR)/omi-*ssl_100*$(PF_ARCH).{rpm,deb} 100
-          ifeq ($(PF_ARCH),x64)
-	     cd $(INTERMEDIATE_DIR); cp $(OMIKITS_DIR)/omi-*ssl_110*$(PF_ARCH).{rpm,deb} 110
+          ifeq ($(ENABLE_SCX_SECURITY_HARDENING),1)
+	    cd $(INTERMEDIATE_DIR); cp $(OMIKITS_DIR)/omi-*ssl_100*$(SECURITY_FLAG).$(PF_ARCH).{rpm,deb} 100
+            ifeq ($(PF_ARCH),x64)
+	       cd $(INTERMEDIATE_DIR); cp $(OMIKITS_DIR)/omi-*ssl_110*$(SECURITY_FLAG).$(PF_ARCH).{rpm,deb} 110
+            endif
+          else
+	    cd $(INTERMEDIATE_DIR); cp `ls $(OMIKITS_DIR)/omi-*ssl_100*.$(PF_ARCH).{rpm,deb}|grep -v "$(EXCLUDE_SECURITY_FLAG).$(PF_ARCH)"` 100
+            ifeq ($(PF_ARCH),x64)
+	        cd $(INTERMEDIATE_DIR); cp `ls $(OMIKITS_DIR)/omi-*ssl_110*.$(PF_ARCH).{rpm,deb}|grep -v "$(EXCLUDE_SECURITY_FLAG).$(PF_ARCH)"` 110
+            endif
          endif

          # Remove ssl_098, ssl_100 and ssl_110 from omi filename
--- a/build/configure
+++ b/build/configure
@ -9,7 +9,7 @@ enable_purify_agent=""
 enable_purify_server=""
 enable_bullseye=""
 combined_packages=0
-
+enable_scx_security_hardening=0
 enable_ulinux_qual=""
 omi_configure_quals="--enable-microsoft"

@ -31,7 +31,7 @@ perform_ulinux_build()
    fi

    enable_ulinux_qual="--enable-ulinux"
-    omi_configure_quals="$omi_configure_quals $enable_ulinux_qual"
+    omi_configure_quals="$omi_configure_quals $enable_ulinux_qual $enable_security_hardening"
    combined_packages=1
 }

@ -81,6 +81,11 @@ do
      enable_purify_server="--enable-purify-server"
      ;;

+    --enable-security-hardening)
+      enable_security_hardening="--enable-security-hardening"
+      enable_scx_security_hardening=1
+      ;;
+
    --enable-system-build)
      if [ `uname -s` = "Linux" -a `uname -m` != "ppc64le" ]; then
          perform_ulinux_build
@ -122,6 +127,7 @@ OPTIONS:
    --enable-local-omi          Allow local OMI commands to be issued (not for use when building a kit)
    --enable-purify-agent       Allow agent to be run with purify (memory leak detection)
    --enable-purify-server      Allow server to be run with purify (memory leak detection)
+    --enable-security-hardening Enable security flags for compiling.
    --enable-system-build       Enable qualifiers necessary for a system build
    --enable-ulinux             Build universal RPM/DEB kits

@ -129,9 +135,9 @@ EOF
    exit 0
 fi

-(cd $scxpal_dir/build/ && chmod ug+x ./configure; ./configure $enable_debug $enable_bullseye $enable_ulinux_qual)
+(cd $scxpal_dir/build/ && chmod ug+x ./configure; ./configure $enable_debug $enable_bullseye $enable_ulinux_qual $enable_security_hardening)

-omi_configure_quals="${enable_debug} ${enable_purify_agent} ${enable_purify_server} ${omi_configure_quals}"
+omi_configure_quals="${enable_debug} ${enable_purify_agent} ${enable_purify_server} ${omi_configure_quals} ${enable_security_hardening}"

 ##==============================================================================
 ##
@ -220,7 +226,7 @@ OPENSSL100_LIBDIR=$openssl100_libdir
 OPENSSL110_CFLAGS=$openssl110_cflags
 OPENSSL110_LIBS=$openssl110_libs
 OPENSSL110_LIBDIR=$openssl110_libdir
-
+ENABLE_SCX_SECURITY_HARDENING=$enable_scx_security_hardening
 TRAVIS_CI=$travis_ci
 EOF

--- a/source/code/providers/SCX_DiskDriveStatisticalInformation_Class_Provider.cpp
+++ b/source/code/providers/SCX_DiskDriveStatisticalInformation_Class_Provider.cpp
@ -178,8 +178,8 @@ void SCX_DiskDriveStatisticalInformation_Class_Provider::EnumerateInstances(
        size_t instancePos=(size_t)-1;

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_DiskDrive_Class_Provider.cpp
+++ b/source/code/providers/SCX_DiskDrive_Class_Provider.cpp
@ -196,8 +196,8 @@ void SCX_DiskDrive_Class_Provider::EnumerateInstances(
        size_t instancePos=(size_t)-1;

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_EthernetPortStatistics_Class_Provider.cpp
+++ b/source/code/providers/SCX_EthernetPortStatistics_Class_Provider.cpp
@ -134,8 +134,8 @@ void SCX_EthernetPortStatistics_Class_Provider::EnumerateInstances(
        size_t instancePos=(size_t)-1;

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_FileSystemStatisticalInformation_Class_Provider.cpp
+++ b/source/code/providers/SCX_FileSystemStatisticalInformation_Class_Provider.cpp
@ -105,10 +105,11 @@ static void EnumerateOneInstance(
            inst.UsedMegabytes_value(data1);
            unsigned char freeSpace = 100;
            unsigned char usedSpace = 0;
-            if (0 < data1+data2)
+            scxulong totalData = data1 + data2;
+            if (0 < totalData)
            {
-                freeSpace = (unsigned char) SCXCoreLib::GetPercentage(0, data2, 0, data3);
-                usedSpace = (unsigned char) SCXCoreLib::GetPercentage(0, data1, 0, data3);
+                freeSpace = (unsigned char) SCXCoreLib::GetPercentage(0, data2, 0, totalData);
+                usedSpace = (unsigned char) SCXCoreLib::GetPercentage(0, data1, 0, totalData);
            }
            inst.PercentFreeSpace_value(freeSpace);
            inst.PercentUsedSpace_value(usedSpace);
@ -208,8 +209,8 @@ void SCX_FileSystemStatisticalInformation_Class_Provider::EnumerateInstances(
        size_t instancePos=(size_t)-1;

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_FileSystem_Class_Provider.cpp
+++ b/source/code/providers/SCX_FileSystem_Class_Provider.cpp
@ -210,8 +210,8 @@ void SCX_FileSystem_Class_Provider::EnumerateInstances(
        size_t instancePos=(size_t)-1;

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_IPProtocolEndpoint_Class_Provider.cpp
+++ b/source/code/providers/SCX_IPProtocolEndpoint_Class_Provider.cpp
@ -163,8 +163,8 @@ void SCX_IPProtocolEndpoint_Class_Provider::EnumerateInstances(
        size_t instancePos=(size_t)-1;

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_LANEndpoint_Class_Provider.cpp
+++ b/source/code/providers/SCX_LANEndpoint_Class_Provider.cpp
@ -135,8 +135,8 @@ void SCX_LANEndpoint_Class_Provider::EnumerateInstances(
        size_t instancePos=(size_t)-1;

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_UnixProcessStatisticalInformation_Class_Provider.cpp
+++ b/source/code/providers/SCX_UnixProcessStatisticalInformation_Class_Provider.cpp
@ -251,8 +251,8 @@ void SCX_UnixProcessStatisticalInformation_Class_Provider::EnumerateInstances(
        string processID="";

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/source/code/providers/SCX_UnixProcess_Class_Provider.cpp
+++ b/source/code/providers/SCX_UnixProcess_Class_Provider.cpp
@ -276,8 +276,8 @@ void SCX_UnixProcess_Class_Provider::EnumerateInstances(
 	string processID="";

        if(filter) {
-            char* exprStr[QLENGTH]={'\0'};
-            char* qtypeStr[QLENGTH]={'\0'};
+            char* exprStr[QLENGTH]={NULL};
+            char* qtypeStr[QLENGTH]={NULL};

            const MI_Char** expr=(const MI_Char**)&exprStr;
            const MI_Char** qtype=(const MI_Char**)&qtypeStr;
--- a/test/code/providers/appserver_provider/weblogicappserverenumeration_test.cpp
+++ b/test/code/providers/appserver_provider/weblogicappserverenumeration_test.cpp
@ -299,9 +299,9 @@ protected:
        *xmlcontent << "      </sec:password-validator>" << endl;
        *xmlcontent << "    </realm>" << endl;
        *xmlcontent << "    <default-realm>myrealm</default-realm>" << endl;
-        *xmlcontent << "    <credential-encrypted>{AES}ukCl5R/HDunoQwvIelAh5RX2I3zdmYFyrOGhXXa58ViNkM7JwYElmg8PzGwsiPPpVzMIpA95L0EL+sEGOkr3GEjAixsVy4XbRZD09wH+jxkH/6JeOoRIgIfYy364gHHC</credential-encrypted>" << endl;
+        *xmlcontent << "    <credential-encrypted></credential-encrypted>" << endl;
        *xmlcontent << "    <node-manager-username>weblogic</node-manager-username>" << endl;
-        *xmlcontent << "    <node-manager-password-encrypted>{AES}PnV58TDPVejTkKti4bUbES0JCzwOfBDnEcdnwsM9Z48=</node-manager-password-encrypted>" << endl;
+        *xmlcontent << "    <node-manager-password-encrypted></node-manager-password-encrypted>" << endl;
        *xmlcontent << "  </security-configuration>" << endl;
        *xmlcontent << "  <server>" << endl;
        *xmlcontent << "    <name>AdminServer</name>" << endl;
@ -320,7 +320,7 @@ protected:
        *xmlcontent << "  </server>" << endl;
        *xmlcontent << "  <embedded-ldap>" << endl;
        *xmlcontent << "    <name>base_domain</name>" << endl;
-        *xmlcontent << "    <credential-encrypted>{AES}RVX+Cadq8XJ5EvV7/1Ta2qGZrJlxve6t5CEa2A9euGUkYOMDTAwAqytymqDBS00Q</credential-encrypted>" << endl;
+        *xmlcontent << "    <credential-encrypted></credential-encrypted>" << endl;
        *xmlcontent << "  </embedded-ldap>" << endl;
        *xmlcontent << "  <configuration-version>10.3.0.0</configuration-version>" << endl;
        *xmlcontent << "  <machine xsi:type=\"unix-machineType\">" << endl;
@ -454,9 +454,9 @@ protected:
        *xmlcontent << "      </sec:password-validator>" << endl;
        *xmlcontent << "    </realm>" << endl;
        *xmlcontent << "    <default-realm>myrealm</default-realm>" << endl;
-        *xmlcontent << "    <credential-encrypted>{AES}ukCl5R/HDunoQwvIelAh5RX2I3zdmYFyrOGhXXa58ViNkM7JwYElmg8PzGwsiPPpVzMIpA95L0EL+sEGOkr3GEjAixsVy4XbRZD09wH+jxkH/6JeOoRIgIfYy364gHHC</credential-encrypted>" << endl;
+        *xmlcontent << "    <credential-encrypted></credential-encrypted>" << endl;
        *xmlcontent << "    <node-manager-username>weblogic</node-manager-username>" << endl;
-        *xmlcontent << "    <node-manager-password-encrypted>{AES}PnV58TDPVejTkKti4bUbES0JCzwOfBDnEcdnwsM9Z48=</node-manager-password-encrypted>" << endl;
+        *xmlcontent << "    <node-manager-password-encrypted></node-manager-password-encrypted>" << endl;
        *xmlcontent << "  </security-configuration>" << endl;
        *xmlcontent << "  <server>" << endl;
        *xmlcontent << "    <name>AdminServer</name>" << endl;
@ -482,7 +482,7 @@ protected:
        *xmlcontent << "  </server>" << endl;
        *xmlcontent << "  <embedded-ldap>" << endl;
        *xmlcontent << "    <name>base_domain</name>" << endl;
-        *xmlcontent << "    <credential-encrypted>{AES}RVX+Cadq8XJ5EvV7/1Ta2qGZrJlxve6t5CEa2A9euGUkYOMDTAwAqytymqDBS00Q</credential-encrypted>" << endl;
+        *xmlcontent << "    <credential-encrypted></credential-encrypted>" << endl;
        *xmlcontent << "  </embedded-ldap>" << endl;
        *xmlcontent << "  <configuration-version>10.3.2.0</configuration-version>" << endl;
        *xmlcontent << "  <machine xsi:type=\"unix-machineType\">" << endl;