[tor-bugs] #5131 [Obfsproxy]: auditing obfsproxy

[Tor Bug Tracker & Wiki]

#5131: auditing obfsproxy
-------------------------+--------------------------------------------------
 Reporter:  ioerror      |          Owner:  asn         
     Type:  enhancement  |         Status:  needs_review
 Priority:  normal       |      Milestone:              
Component:  Obfsproxy    |        Version:              
 Keywords:  security     |         Parent:              
   Points:               |   Actualpoints:              
-------------------------+--------------------------------------------------

Comment(by nickm):

 No-strict-aliasing and no-strict-overflow aren't strictly speaking
 "hardening" options so much as "let's turn off some surprising features
 that will break not-strictly-conformant-code".  I'm fine having them in
 our options, but I'm not sure whether they'd get accepted by other
 projects if you want them to use this.

 There's been a bug with -fno-strict-overflow in at least some older GCC
 versions.  We should probably check for it at configure time-- old gccs
 seem to stick around forever.  There's a little test program at
 http://lists.debian.org/debian-gcc/2009/07/msg00168.html .

 -fwrapv is absolutely right for use on Tor and obfsproxy, but has nothing
 to do with compiler hardening as far as I can tell.  Am I missing
 something there?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5131#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online