X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=meson.build;h=43ae9744ce599fa5604f4413aaac04ec1469c007;hb=bc4df95a48857aa4ab65fb47eabd48c48d650ca0;hp=14580158dc6f1a685b1c9159753618ef0d98ff78;hpb=33f0918cde36accb606271c379bc8e75973e9d59;p=tinc

diff --git a/meson.build b/meson.build
index 14580158..43ae9744 100644
--- a/meson.build
+++ b/meson.build
@@ -50,6 +50,34 @@ endif
 cc_flags = [cc_defs]
 ld_flags = []
 
+if cc_name != 'msvc'
+  cc_flags += [
+    '-Qunused-arguments',
+    '-Wbad-function-cast',
+    '-Wduplicated-branches',
+    '-Wduplicated-cond',
+    '-Wformat-overflow=2',
+    '-Wformat-truncation=1', # 2 prints too much noise
+    '-Wformat=2',
+    '-Wlogical-op',
+    '-Wmissing-declarations',
+    '-Wmissing-noreturn',
+    '-Wmissing-prototypes',
+    '-Wno-embedded-directive',
+    '-Wold-style-definition',
+    '-Wredundant-decls',
+    '-Wreturn-type',
+    '-Wstrict-prototypes',
+    '-Wswitch-enum',
+    '-Wtrampolines', # may require executable stack which is disabled
+    '-Wvla', # VLAs are not supported by MSVC
+    '-Wwrite-strings',
+    '-fdiagnostics-show-option',
+    '-fno-strict-overflow',
+    '-fstrict-aliasing',
+  ]
+endif
+
 if opt_static.auto()
   static = os_name == 'windows'
 else
@@ -74,26 +102,15 @@ if opt_harden
   else
     cc_flags += [
       '-D_FORTIFY_SOURCE=2',
-      '-fwrapv',
-      '-fno-strict-overflow',
-      '-Wreturn-type',
-      '-Wold-style-definition',
-      '-Wmissing-declarations',
-      '-Wmissing-prototypes',
-      '-Wstrict-prototypes',
-      '-Wredundant-decls',
-      '-Wbad-function-cast',
-      '-Wwrite-strings',
-      '-fdiagnostics-show-option',
-      '-fstrict-aliasing',
-      '-Wmissing-noreturn',
+      '-fcf-protection=full',
+      '-fstack-protector-strong',
     ]
-    if cc_name == 'clang'
-      cc_flags += '-Qunused-arguments'
-    endif
-    ld_flags += ['-Wl,-z,relro', '-Wl,-z,now']
+    ld_flags += ['-Wl,-z,relro', '-Wl,-z,now', '-Wl,-z,noexecstack']
     if os_name == 'windows'
       ld_flags += ['-Wl,--dynamicbase', '-Wl,--nxcompat']
+    else
+      # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458
+      cc_flags += '-fstack-clash-protection'
     endif
   endif
 endif
@@ -138,12 +155,13 @@ if os_name == 'linux' and not opt_systemd.disabled()
   subdir('systemd')
 endif
 
-prog_reformat = find_program('astyle', native: true, required: false)
-if prog_reformat.found()
-  run_target('reformat', command: [
-    prog_reformat,
-    '--options=@SOURCE_ROOT@/.astylerc', '--recursive',
-    '@SOURCE_ROOT@/*.c', '@SOURCE_ROOT@/*.h',
-  ])
-endif
+run_target('reformat', command: [
+  python,
+  '@SOURCE_ROOT@/lint.py',
+  '--fix',
+])
 
+run_target('lint', command: [
+  python,
+  '@SOURCE_ROOT@/lint.py',
+])