#!/bin/bash

# Copyright (c) 2017-2026 Red Hat.
#
# This is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published
# by the Free Software Foundation; either version 3, or (at your
# option) any later version.
#
# It is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

TEST_NAME=hardening-fail
. $srcdir/common.sh

PLUGIN_OPTS="-fplugin-arg-annobin-no-attach -fplugin-arg-annobin-verbose"

OPTS="-c -O2 -D_FORTIFY_SOURCE=2 -fPIE -Wall -fstack-protector-strong -D_GLIBCXX_ASSERTIONS -fstack-clash-protection"

start_test

export COLLECT_GCC_OPTIONS=

$GCC -fplugin=$PLUGIN $PLUGIN_OPTS $OPTS $srcdir/hello.c -U_FORTIFY_SOURCE
$GCC -fplugin=$PLUGIN $PLUGIN_OPTS $OPTS $srcdir/hello2.c -U_GLIBCXX_ASSERTIONS
$GCC -fplugin=$PLUGIN $PLUGIN_OPTS $OPTS $srcdir/hello3.c -fno-stack-protector -fshort-enums
$GCC -fplugin=$PLUGIN $PLUGIN_OPTS $OPTS $srcdir/hello_lib.c -O1
$GCC hello.o hello2.o hello3.o hello_lib.o -o $EXE -Wl,-z,norelro > $G_OUT 2>&1
if [ $? != 0 ];
then
    echo " $TEST_NAME: SKIP: unable to compile & link test sources"
    cat $G_OUT
    end_test
    exit $EXIT_TEST_SKIPPED
fi

A_COMMAND="$ANNOCHECK --suppress-version-warnings $EXE"
$A_COMMAND > $A_OUT

# Note - detecting -U_FORTIFY_SOURCE in annocheck is impossible.
# We have to rely upon the gcc plugin to generate a warning instead.

grep -q -e "FAIL: glibcxx-assertions" $A_OUT
if [ $? != 0 ];
then
    echo " $TEST_NAME: FAIL: annocheck did not FAIL for object compiled with -U_GLIBCXX_ASSERTIONS"
    echo " $TEST_NAME: annocheck command: $A_COMMAND"
    echo " $TEST_NAME: annocheck output:"
    cat $A_OUT
    end_test
    exit $EXIT_TEST_FAILED
fi

echo " $TEST_NAME: PASS: annocheck reported a FAIL for an object compiled with -U_GLIBCXX_ASSERTIONS"

grep -q -e "FAIL: short-enums" $A_OUT
if [ $? != 0 ];
then
    echo " $TEST_NAME: FAIL: annocheck did not FAIL for object compiled with -fshort-enums"
    echo " $TEST_NAME: annocheck command: $A_COMMAND"
    echo " $TEST_NAME: annocheck output:"
    cat $A_OUT
    end_test
    exit $EXIT_TEST_FAILED
fi

echo " $TEST_NAME: PASS: annocheck reported a FAIL for an object compiled with -fshort-enums"

grep -q -e "FAIL: stack-prot" $A_OUT
if [ $? != 0 ];
then
    echo " $TEST_NAME: FAIL: annocheck did not FAIL for object compiled with -fno-stack-protector"
    echo " $TEST_NAME: annocheck command: $A_COMMAND"
    echo " $TEST_NAME: annocheck output:"
    cat $A_OUT
    end_test
    exit $EXIT_TEST_FAILED
fi

echo " $TEST_NAME: PASS: annocheck reported a FAIL for an object compiled with -fno-stack-protector"

grep -q -e "FAIL: optimization" $A_OUT
if [ $? != 0 ];
then
    echo " $TEST_NAME: FAIL: annocheck did not FAIL for object compiled with -O1"
    echo " $TEST_NAME: annocheck command: $A_COMMAND"
    echo " $TEST_NAME: annocheck output:"
    cat $A_OUT
    end_test
    exit $EXIT_TEST_FAILED
fi

echo " $TEST_NAME: PASS: annocheck reported a FAIL for an object compiled with -O1"

end_test

# FIXME: Add regexps to check for other expected failure messages
