Insert random noops to increase security against ROP attacks (clang)

[rinon]

Summary

A pass that adds random noops to X86 binaries to introduce diversity with the goal of increasing security against most return-oriented programming attacks.

Command line options:

-noop-insertion // Enable noop insertion.
-noop-insertion-percentage=X // X% of assembly instructions will have a noop prepended (default: 50%, requires -noop-insertion)
-max-noops-per-instruction=X // Randomly generate X noops per instruction. ie. roll the dice X times with probability set above (default: 1). This doesn't guarantee X noop instructions.

In addition, the following 'quick switch' in clang enables basic diversity using default settings (currently: noop insertion and schedule randomization; it is intended to be extended in the future).

-fdiversify

This is the clang part of the patch.
llvm part: D3392

[jfb]

include/clang/Driver/CC1Options.td

171

Why is this a cc1 option?

It also seems like it should be in Group<m_x86_Features_Group> since it's not available on other architectures? Although see my comment on the LLVM side, I think you can make this non-x86 specific.

[rinon]

Commandeered to update in step with D3392.

[rinon]

• Added current version of multicompiler changes for clang.
• Removed unnecessary include.
• Remove unused field.
• Refine construction of salt string.
• Removed RNG salting from clang.
• Remove stray reference to RNG header
• Remove schedule randomization option
• Rebase onto latest LLVM master

[rinon]

Sorry about the cfe-commits de/re-subscription, not sure what happened. Arc misbehaved on me.

[rinon]

• Whitespace
• Fix -noop-insertion backend option name

[rinon]

• More whitespace fixes

[rinon]

include/clang/Driver/CC1Options.td

198

I think this should be a CC1 option to simplify the "public" interface to just -fdiversify. However, I'm completely open to switching this to a frontend option instead.

[jfb]

Can you update the description to use "noop" instead of "nop"? I don't really care either way, but it should be consistent with the code.

It also looks like this patch only passes -noop-insertion to LLVM, not the other 2?

I recommend seeking an LGTM from a person more familiar with clang that I am. This looks OK to my untrained eye, but I'd not at all familiar with clang's code base.

[rinon]

Ping. Anyone more familiar with clang who can take a quick look at
this patch? Just a couple flags getting passed through to the backend.

Thanks,
Stephen

[jfb]

No comments yet, I'm going to assume this is good to go and commit it soon.

[jfb]

r225910

include/clang/Driver/CC1Options.td

   HelpText<"Turn off Type Based Alias Analysis">;
 def no_struct_path_tbaa : Flag<["-"], "no-struct-path-tbaa">,
   HelpText<"Turn off struct-path aware Type Based Alias Analysis">;
+def nop_insertion : Flag<["-"], "nop-insertion">,
+  HelpText<"Randomly insert NOPs">;
 def masm_verbose : Flag<["-"], "masm-verbose">,
   HelpText<"Generate verbose assembly output">;
 def mcode_model : Separate<["-"], "mcode-model">,

include/clang/Driver/Options.td

 def fdiagnostics_show_template_tree : Flag<["-"], "fdiagnostics-show-template-tree">,
     Group<f_Group>, Flags<[CC1Option]>,
     HelpText<"Print a template comparison tree for differing templates">;
+def fdiversify : Flag<["-"], "fdiversify">, Group<f_clang_Group>;
 def fdollars_in_identifiers : Flag<["-"], "fdollars-in-identifiers">, Group<f_Group>,
   HelpText<"Allow '$' in identifiers">, Flags<[CC1Option]>;
 def fdwarf2_cfi_asm : Flag<["-"], "fdwarf2-cfi-asm">, Group<f_Group>;

include/clang/Frontend/CodeGenOptions.def

 CODEGENOPT(SanitizeRecover, 1, 1) ///< Attempt to recover from sanitizer checks
                                   ///< by continuing execution when possible
 
+CODEGENOPT(NOPInsertion, 1, 0) ///< Randomly add NOPs
+
 #undef CODEGENOPT
 #undef ENUM_CODEGENOPT
 #undef VALUE_CODEGENOPT

lib/CodeGen/BackendUtil.cpp

   Options.DisableTailCalls = CodeGenOpts.DisableTailCalls;
   Options.TrapFuncName = CodeGenOpts.TrapFuncName;
   Options.PositionIndependentExecutable = LangOpts.PIELevel != 0;
+  Options.NOPInsertion = CodeGenOpts.NOPInsertion;
 
   TargetMachine *TM = TheTarget->createTargetMachine(Triple, TargetOpts.CPU,
                                                      FeaturesStr, Options,

lib/Driver/Tools.cpp

     CmdArgs.push_back(Args.MakeArgString("-rng-seed=" + seed));
   }
 
+  if (Args.hasArg(options::OPT_fdiversify)) {
+    CmdArgs.push_back("-nop-insertion");
+  }
+
   if (Arg *A = Args.getLastArg(options::OPT_mrestrict_it,
                                options::OPT_mno_restrict_it)) {
     if (A->getOption().matches(options::OPT_mrestrict_it)) {

lib/Frontend/CompilerInvocation.cpp

   Opts.SSPBufferSize =
       getLastArgIntValue(Args, OPT_stack_protector_buffer_size, 8, Diags);
   Opts.StackRealignment = Args.hasArg(OPT_mstackrealign);
+  Opts.NOPInsertion = Args.hasArg(OPT_nop_insertion);
 
   if (Arg *A = Args.getLastArg(OPT_mstack_alignment)) {
     StringRef Val = A->getValue();