embed default sanitizer flags in executables

Replicating CI failures requires the developer to piece together the
sanitizer flags by hand, reducing ergonomics.

Fix this problem by embedding the relevant settings to the executables.
Symbol resolution still needs manual intervention by setting the env
variable `*SAN_SYMBOLIZER_PATH`. However, this doesn't affect any behavior.

diff --git a/.gitattributes b/.gitattributes
index 8df340caefc09c5e1d83422d0608a6e9b8334d2f..e2a0641fbfa633a43b74a2a3193f41c98ca7930c 100644 (file)
--- a/.gitattributes
+++ b/.gitattributes
@@ -12,7 +12,6 @@
 .gitlab-ci.yml                  export-ignore
 .pylintrc                       export-ignore
 .readthedocs.yaml               export-ignore
-.tsan-suppress                  export-ignore
 .uncrustify.cfg                 export-ignore
 dangerfile.py                   export-ignore
 /.github/**                     export-ignore

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index bf7afac45c0e85dab3b35612a520c566a33bb5e7..3b8e02c465e16df3a33cab8edea8e1293d19d8ae 100644 (file)
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -31,19 +31,9 @@ variables:
 
   CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls
 
-  UBASAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=address,undefined -Didn=enabled -Djemalloc=disabled -Dtracing=disabled"
-  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
-
-  # Pass run-time flags to AddressSanitizer to get core dumps on error.
-  ASAN_OPTIONS: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1:detect_odr_violation=0
-  ASAN_SYMBOLIZER_PATH: "${LLVM_SYMBOLIZER}"
-
-  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 atexit_sleep_ms=1000 history_size=7 log_exe_name=true log_path=tsan"
-  TSAN_SUPPRESSIONS: "suppressions=${CI_PROJECT_DIR}/.tsan-suppress"
-  TSAN_OPTIONS_DEBIAN: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=${LLVM_SYMBOLIZER}"
-  TSAN_OPTIONS_FEDORA: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-
-  UBSAN_OPTIONS: "halt_on_error=1:abort_on_error=1:disable_coredump=0"
+  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled -Dnamed-lto=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
+  TSAN_SYMBOLIZER_PATH_DEBIAN: "${LLVM_SYMBOLIZER}"
+  TSAN_SYMBOLIZER_PATH_FEDORA: "/usr/bin/llvm-symbolizer"
 
   WITHOUT_LIBEDIT: "-Dline=disabled"
   WITH_LIBEDIT: "-Dline=enabled"
@@ -449,6 +439,9 @@ stages:
     #- test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
     - test -z "${CROSS_COMPILATION}" || file build/lib/dns/gen | grep -F -q "ELF 64-bit LSB"
     #- test -z "${CROSS_COMPILATION}" || ( ! git ls-files -z --others --exclude lib/dns/gen | xargs -0 file | grep "ELF 64-bit LSB" )
+    - *find_python
+    # Check that embedded sanitizer flags are in sync with the `meson.build` file.
+    - $PYTHON ${CI_PROJECT_DIR}/ci/sanitizer_default_check.py build
     - build/named -V
     - *fips_feature_test
   needs: []
@@ -1572,8 +1565,6 @@ gcc:asan:
   <<: *build_job
 
 system:gcc:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *fedora_43_amd64_image
   <<: *system_test_job
   needs:
@@ -1596,8 +1587,6 @@ clang:asan:
   <<: *build_job
 
 system:clang:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *base_image
   <<: *system_test_job
   <<: *extra_system_tests_triggering_rules
@@ -1626,7 +1615,6 @@ gcc:tsan:
 
 system:gcc:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
   <<: *tsan_fedora_43_amd64_image
   <<: *system_test_tsan_job
   <<: *extra_system_tests_triggering_rules
@@ -1636,7 +1624,7 @@ system:gcc:tsan:
 
 unit:gcc:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_FEDORA}"
   <<: *tsan_fedora_43_amd64_image
   <<: *unit_test_tsan_job
   <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
@@ -1651,12 +1639,12 @@ clang:tsan:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
     LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false -Dnamed-lto=disabled --native-file ci/clang-trixie.ini"
+    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false --native-file ci/clang-trixie.ini"
   <<: *build_job
 
 system:clang:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   <<: *tsan_debian_trixie_amd64_image
   <<: *system_test_tsan_job
   needs:
@@ -1665,7 +1653,7 @@ system:clang:tsan:
 
 unit:clang:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   <<: *tsan_debian_trixie_amd64_image
   <<: *unit_test_tsan_job
   needs:
@@ -2278,9 +2266,9 @@ respdiff:tsan:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
     LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Dnamed-lto=disabled -Db_lundef=false"
+    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   script:
     - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
     - cd ../.. && ninja -C build clean >/dev/null 2>&1

diff --git a/.tsan-suppress b/.tsan-suppress
deleted file mode 100644 (file)
index c12884d..0000000
--- a/.tsan-suppress
+++ /dev/null
@@ -1,9 +0,0 @@
-# Uninstrumented libraries
-called_from_lib:libfstrm.so
-race:dummyrpz
-
-# FreeBSD false-positive, see GL#5267
-race:libexec/rtld-elf/rtld_malloc.c
-
-# FreeBSD false-positive, see GL#5266
-deadlock:add_trace_entry

diff --git a/ci/sanitizer_default_check.py b/ci/sanitizer_default_check.py
new file mode 100755 (executable)
index 0000000..9a72a00
--- /dev/null
+++ b/ci/sanitizer_default_check.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+from pathlib import Path
+
+import argparse
+import json
+import subprocess
+import sys
+
+ASAN = False
+UBSAN = False
+TSAN = False
+
+args = argparse.ArgumentParser()
+args.add_argument("build")
+args = args.parse_args()
+
+build = Path(args.build)
+
+# https://mesonbuild.com/IDE-integration.html#build-options
+#
+# e.g. { "name": "b_sanitize", "value": ["address", "undefined"], ... }
+#
+with (build / "meson-info" / "intro-buildoptions.json").open() as f:
+    options = json.load(f)
+
+    for opt in options:
+        if opt["name"] == "b_sanitize":
+            ASAN = "address" in opt["value"]
+            UBSAN = "undefined" in opt["value"]
+            TSAN = "thread" in opt["value"]
+            break
+
+if not (ASAN or UBSAN or TSAN):
+    print("no sanitizer check necessary")
+    sys.exit(0)
+
+with (build / "meson-info" / "intro-targets.json").open() as f:
+    targets = json.load(f)
+
+    for target in targets:
+        if target["type"] == "executable" and Path(target["filename"][0]).exists():
+            nm = subprocess.run(
+                ["nm", target["filename"][0]],
+                stdin=None,
+                stdout=subprocess.PIPE,
+                timeout=1,
+                check=True,
+                shell=False,
+            )
+
+            if ASAN and b"__asan_default_options" not in nm.stdout:
+                print(f"Default ASAN options missing for executable '{target['name']}'")
+                sys.exit(1)
+
+            if UBSAN and b"__ubsan_default_options" not in nm.stdout:
+                print(
+                    f"Default UBSAN options missing for executable '{target['name']}'"
+                )
+                sys.exit(1)
+
+            if TSAN and b"__tsan_default_options" not in nm.stdout:
+                print(f"Default TSAN options missing for executable '{target['name']}'")
+                sys.exit(1)
+
+print("all relevant sanitizer defaults are set")

diff --git a/doc/misc/meson.build b/doc/misc/meson.build
index c27e129eb0068bcc75a1fdc519985b1c495db240..17c6b1a75af79ddadbb1adc7aa64a12dae19fd11 100644 (file)
--- a/doc/misc/meson.build
+++ b/doc/misc/meson.build
@@ -15,6 +15,7 @@ cfg_test = executable(
     'cfg_test',
     files('cfg_test.c'),
     install: false,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libisccfg_dep,

diff --git a/lib/dns/meson.build b/lib/dns/meson.build
index 96168d5e368cc633a8983a0df8ac655457081bf7..61b64bbfa4459dbc32a80dd8dd1be0e674d80e85 100644 (file)
--- a/lib/dns/meson.build
+++ b/lib/dns/meson.build
@@ -23,6 +23,7 @@ dns_gen_headers = []
 dns_header_gen = executable(
     'gen',
     files('gen.c'),
+    sources: default_sanitize_options,
     install: false,
     native: true,
 )

diff --git a/meson.build b/meson.build
index 91d492435642cf43e6cc02deeaf3e390a4024e8a..81e608cfbd56448401fcc4ec9ac6ef31d57fdc09 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -246,6 +246,22 @@ sys_defines = [
 
 add_project_arguments(sys_defines, language: 'c')
 
+### Sanitizer
+asan_options = 'abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1:detect_odr_violation=0'
+tsan_options = 'disable_coredump=0:second_deadlock_stack=1:atexit_sleep_ms=1000:history_size=7:log_exe_name=true:log_path=tsan'
+ubsan_options = 'halt_on_error=1:abort_on_error=1:disable_coredump=0'
+
+# Refer to sanitize.c.in for the justification
+config_sanitize = configuration_data()
+
+config_sanitize.set10('BIND_ASAN_ENABLED', 'address' in sanitizer)
+config_sanitize.set10('BIND_LSAN_ENABLED', 'leak' in sanitizer)
+config_sanitize.set10('BIND_TSAN_ENABLED', 'thread' in sanitizer)
+config_sanitize.set10('BIND_UBSAN_ENABLED', 'undefined' in sanitizer)
+config_sanitize.set('BIND_ASAN_OPTIONS', asan_options)
+config_sanitize.set('BIND_TSAN_OPTIONS', tsan_options)
+config_sanitize.set('BIND_UBSAN_OPTIONS', ubsan_options)
+
 ### Environment
 
 env = environment(
@@ -256,6 +272,15 @@ env = environment(
     },
 )
 
+# Meson defines these variables in unit tests when not set
+test_env = environment(
+    {
+        'ASAN_OPTIONS': asan_options,
+        'TSAN_OPTIONS': tsan_options,
+        'UBSAN_OPTIONS': ubsan_options,
+    },
+)
+
 ### Configuration
 config = configuration_data()
 
@@ -1093,6 +1118,12 @@ bind_keys = custom_target(
     ],
 )
 
+default_sanitize_options = configure_file(
+    input: files('sanitize.c.in'),
+    output: 'sanitize.c',
+    configuration: config_sanitize,
+)
+
 # Headers
 dns_inc = include_directories('lib' / 'dns' / 'include')
 isc_inc = include_directories('lib' / 'isc' / 'include')
@@ -1313,6 +1344,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
     ],
@@ -1324,7 +1356,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: true,
     install: true,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: [
         libisc_dep,
         libisccfg_dep,
@@ -1338,6 +1370,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1353,6 +1386,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1366,6 +1400,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1379,6 +1414,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1392,6 +1428,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1405,6 +1442,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1418,6 +1456,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1431,6 +1470,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1444,6 +1484,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1457,6 +1498,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1470,6 +1512,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1484,6 +1527,7 @@ if config.has('HAVE_DNSTAP')
         export_dynamic: true,
         implicit_include_directories: true,
         install: true,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
@@ -1499,6 +1543,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1514,6 +1559,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1527,7 +1573,7 @@ executable(
     implicit_include_directories: true,
     include_directories: [bin_inc],
     install: true,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: [
         libisc_dep,
         libdns_dep,
@@ -1541,6 +1587,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libdns_dep,
@@ -1561,6 +1608,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1573,6 +1621,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1585,6 +1634,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1599,6 +1649,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1653,7 +1704,7 @@ executable(
     include_directories: [named_inc, bin_inc],
     install: true,
     install_dir: sbindir,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: named_deps
     + [
         openssl_dep,
@@ -1677,6 +1728,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1689,6 +1741,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1705,6 +1758,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1724,6 +1778,7 @@ executable(
     include_directories: confgen_inc_p,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1737,6 +1792,7 @@ executable(
     implicit_include_directories: false,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1753,6 +1809,7 @@ executable(
     include_directories: confgen_inc_p,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1823,6 +1880,7 @@ foreach name, sources : fuzz_binaries
         install: false,
         c_args: ['-Wno-vla'],
         link_args: fuzz_link_args,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
@@ -1847,6 +1905,7 @@ foreach name, sources : system_test_binaries
         export_dynamic: true,
         implicit_include_directories: false,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,

diff --git a/sanitize.c.in b/sanitize.c.in
new file mode 100644 (file)
index 0000000..8b5a9fc
--- /dev/null
+++ b/sanitize.c.in
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * We do not use `__SANITIZE_XXXX__` or `__has_feature` for the following
+ * reasons:
+ *
+ * - `__SANITIZE_UNDEFINED__` doesn't exist at all (currently GCC 15 & clang 21)
+ * - Other `__SANITIZE_XXXX__` macros don't exist in clang <23 [1]
+ * - `__has_feature` doesn't exist in GCC <14 [2]
+ *
+ * [1]: https://github.com/llvm/llvm-project/pull/153888
+ * [2]: https://gcc.gnu.org/gcc-14/changes.html#c-family
+ */
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wmissing-prototypes"
+
+#if @BIND_ASAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__asan_default_options(void) {
+       return "@BIND_ASAN_OPTIONS@";
+}
+#endif
+
+/* ASAN will usually also enable LSAN */
+#if @BIND_ASAN_ENABLED@ || @BIND_LSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__lsan_default_suppressions(void) {
+    return
+        /* These are known leaks in libp11 */
+        "leak:BN_MONT_CTX_new\n"
+        "leak:C_LoadModule\n"
+        "leak:ctx_new\n"
+        "leak:ctx_try_load_object\n"
+        "leak:dlfcn_name_converter\n"
+        "leak:EC_GROUP_set_seed\n"
+        "leak:CRYPTO_strdup\n"
+        "leak:CRYPTO_zalloc\n"
+        "leak:pkcs11_check_token\n"
+        "leak:pkcs11_CTX_new\n"
+        "leak:pkcs11_enumerate_slots\n"
+        "leak:pkcs11_getattr_alloc\n"
+        "leak:pkcs11_init_key\n"
+        "leak:pkcs11_strdup\n"
+        "leak:xmlGetGlobalState\n"
+        "leak:xmlNewGlobalState\n"
+        "leak:__xmlDefaultBufferSize\n";
+}
+#endif
+
+#if @BIND_TSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__tsan_default_options(void) {
+       return "@BIND_TSAN_OPTIONS@";
+}
+
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__tsan_default_suppressions(void) {
+       return
+               /* Uninstrumented libraries */
+               "called_from_lib:libfstrm.so\n"
+               "race:dummyrpz\n"
+               /* FreeBSD false-positive, see GL#5267 */
+               "race:libexec/rtld-elf/rtld_malloc.c\n"
+               /* FreeBSD false-positive, see GL#5266 */
+               "deadlock:add_trace_entry";
+}
+#endif
+
+#if @BIND_UBSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__ubsan_default_options(void) {
+       return "@BIND_UBSAN_OPTIONS@";
+}
+#endif
+
+#pragma GCC diagnostic pop

diff --git a/suppr-lsan.txt b/suppr-lsan.txt
deleted file mode 100644 (file)
index ac08aa9..0000000
--- a/suppr-lsan.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# These are known leaks in libp11.
-leak:BN_MONT_CTX_new
-leak:C_LoadModule
-leak:ctx_new
-leak:ctx_try_load_object
-leak:dlfcn_name_converter
-leak:EC_GROUP_set_seed
-leak:CRYPTO_strdup
-leak:CRYPTO_zalloc
-leak:pkcs11_check_token
-leak:pkcs11_CTX_new
-leak:pkcs11_enumerate_slots
-leak:pkcs11_getattr_alloc
-leak:pkcs11_init_key
-leak:pkcs11_strdup
-leak:xmlGetGlobalState
-leak:xmlNewGlobalState
-leak:__xmlDefaultBufferSize

diff --git a/tests/bench/meson.build b/tests/bench/meson.build
index b16b529ada94d3d48638b75fb84b3e9a4ef047fb..ec1bf9dee96589db62e186c397216dcf3be485db 100644 (file)
--- a/tests/bench/meson.build
+++ b/tests/bench/meson.build
@@ -24,6 +24,7 @@ foreach bench : [
         files(fs.replace_suffix(bench, '.c')),
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -42,6 +43,7 @@ executable(
     export_dynamic: true,
     include_directories: '..' / '..' / 'fuzz',
     install: false,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libdns_dep,

diff --git a/tests/dns/meson.build b/tests/dns/meson.build
index 72b675471934a239ba964e7df102cde22dd857e8..ba166f5a72bfa792024a07c96d7a01046f559c06 100644 (file)
--- a/tests/dns/meson.build
+++ b/tests/dns/meson.build
@@ -77,6 +77,7 @@ foreach unit : dns_tests
                 meson.project_source_root() / 'bin' / 'tests' / 'system' / 'geoip2' / 'data',
             ),
         ],
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -95,6 +96,7 @@ foreach unit : dns_tests
         unit,
         test_bin,
         depends: master_data,
+        env: test_env,
         suite: ['dns', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),

diff --git a/tests/isc/meson.build b/tests/isc/meson.build
index 5aa7ecafeed4e35a9fcd42eaea3a1f45f39786b6..0029ae6130e9a7a6a971a6cca9ecfe2e2ee32ac2 100644 (file)
--- a/tests/isc/meson.build
+++ b/tests/isc/meson.build
@@ -77,6 +77,7 @@ foreach unit : isc_test
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libtest_dep,
@@ -101,9 +102,9 @@ foreach unit : isc_test
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: suites,
         timeout: timeout,
         workdir: meson.current_source_dir(),
-        env: env,
     )
 endforeach

diff --git a/tests/isccfg/meson.build b/tests/isccfg/meson.build
index ece606e0a0b54f420132365094cc695543ae8eae..0055f42f43b7e6870fe2de3f48b0c92fc72dd207 100644 (file)
--- a/tests/isccfg/meson.build
+++ b/tests/isccfg/meson.build
@@ -20,6 +20,7 @@ foreach unit : [
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libisccfg_dep,
@@ -32,6 +33,7 @@ foreach unit : [
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: ['isccfg', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),

diff --git a/tests/ns/meson.build b/tests/ns/meson.build
index dc14986280e4a07a8187379a1ed1147f3b1169de..75c5260223583e1db7b6f64906c72eb9b6e85555 100644 (file)
--- a/tests/ns/meson.build
+++ b/tests/ns/meson.build
@@ -20,6 +20,7 @@ foreach unit : [
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -36,6 +37,7 @@ foreach unit : [
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: ['ns', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),