add Spectre variant 2 mitigations

[Darren Tucker]

Hi.

Both GCC and clang are adding mitigations for Spectre variant 2 although
neither have yet made a release and neither are on by default.

After trolling through and building release candidate branches for both
I believe this is what is required for the ssh programs (although all
the dependent libraries will also need to be built with mitigations, and
I suspect libcrypto is a more likely target).

Anyway we've got to start somewhere and this builds and passes regress on
x86_64 with gcc 7.2.1 20171218 and clang 6.0 branch.  Happy to get
feedback about other compilers.

diff --git a/configure.ac b/configure.ac
index c14f484b..89e6975c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -163,6 +163,10 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 	OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
 	OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
     if test "x$use_toolchain_hardening" = "x1"; then
+	OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc
+	OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc
+	OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
+	OSSH_CHECK_CFLAG_LINK([-z retpolineplt]) # clang
 	OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
 	OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
 	OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.