ASLR and NX support on windows

[schlenk]

Currently the .pyd files created via cffi do not enable ASLR and NX security features on windows (like most python extensions and python 2. itself due to the outdated VS2008 toolchain used, which didn't have those as default yet).
A good side effect of ASLR is reduced memory usage if a DLL is loaded a lot of times into different processes and would be rebased from a collision otherwise (as the build doesn't use a non standard baseaddress either currently).

The .pyd files should be built with /DYNAMICBASE and /NXCOMPAT linker flags.

[reaperhulk]

Do the py3 builds do this? They use the VS2010 toolchain. What tool do you use to introspect the pyd to learn this information?

[schlenk]

You can find out either with process explorer (if you enable the ASLR column), or with the following:

dumpbin.exe /headers x.dll

Like the following Python code does:

DUMPBIN = 'dumpbin.exe'
# c:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\BIN/dumpbin.exe for example

def process_file(root, filename):
    fullpath = os.path.join(root, filename)

    have_aslr = False
    have_nx = False
    result = subprocess.check_output([DUMPBIN, "/headers", fullpath])
    for line in result.split('\n'):
         if 'Dynamic base' in line:
            have_aslr = True
         elif 'NX compatible' in line:
            have_nx = True
    return (fullpath, have_aslr, have_nx)

One can patch the flags manually via EDITBIN.EXE, but it would be better to do it out of the box and the editbin stuff doesn't work for .exe (not a problem here).
(see https://msdn.microsoft.com/de-de/library/d25ddyfc.aspx)

Not sure if the python3 builds do it, Python 3.4 added ASLR support to the standard Python buildchain (http://bugs.python.org/issue16632).

[schlenk]

Checked the WHL files for 2.7, 3.3 and 3.4 on pypi:

• 2.7: No NX/DEP or ASLR
• 3.3: ASLR and NX/DEP enabled
• 3.4: ASLR and NX/DEP enabled

So it is as expected, the default compiler behaviour changes between VS2008 and VS2010 strikes. This is a Python 2.x only issue.

[tiran]

Yes, I enabled the features three years ago for 3.3 and newer:

http://bugs.python.org/issue16632

[reaperhulk]

@tiran any reason why we shouldn't add the flags for the 2.6 and 2.7 builds?

[reaperhulk]

@schlenk I tried to do this in #2034 but the resulting pyd files still don't have the flags. Any tips?

[schlenk]

@reaperhulk Your approach in #2034 worked for me (even with only the extra_link_flags, no extra_compile_flags needed). But you did only add the flags to the _openssl.pyd file, you probably want the same extra_link_flags for the other .pyd's too.