+++ /dev/null
-#!/bin/bash
-
-# SC2156 (warning): Injecting filenames is fragile and insecure. Use parameters.
-# shellcheck disable=SC2156
-
-set -eu
-
-script_path="$(dirname "$(readlink -f "${0}")")"
-cd "${script_path}/.."
-
-# Use a wrapper function to allow "return 1" instead of "exit 1" which may have
-# unforeseen consequences in case this script is sourced.
-install_kea() {
- # ccache
- export CCACHE_DIR=/cache
- export PATH="/usr/lib/ccache:$PATH"
- export KEA_BUILD_DIR="${KEA_BUILD_DIR-/builds/isc-projects/kea}"
-
- cxxflags='-gdwarf-4'
- export CXX='g++'
- export CXXFLAGS="${cxxflags}"
- export LDFLAGS="${cxxflags}"
- if ! meson setup build --prefix "${OUT}" -D b_lundef=false -D "b_sanitize=${SANITIZER}" -D fuzz=enabled -D tests=enabled; then
- printf 'meson setup failed. Here is meson-log.txt:\n'
- cat build/meson-logs/meson-log.txt
- return 1
- fi
- meson compile -C build
- meson install -C build
-
- echo "${OUT}/lib" | sudo tee -a /etc/ld.so.conf.d/kea.conf
- echo "${OUT}/lib/x86_64-linux-gnu" | sudo tee -a /etc/ld.so.conf.d/kea.conf
- ldconfig
- sudo ldconfig
-
- # Copy internal libraries.
- find "${OUT}/lib/" -name 'libkea-*.so*'
- find "${OUT}/lib/" -name 'libkea-*.so*' -exec sh -c "cp {} ${KEA_BUILD_DIR}" ';'
- find "${OUT}/lib/" -name 'libkea-*.so*' -exec sh -c "cp {} ${OUT}" ';'
- find "${OUT}/lib/" -name 'libkea-*.so*' -exec sh -c "cp {} /lib/x86_64-linux-gnu/" ';'
-
- # Copy the binaries.
- for fuzzer in fuzz_config_kea_dhcp4 fuzz_http_endpoint_kea_dhcp4 fuzz_packets_kea_dhcp4 fuzz_unix_socket_kea_dhcp4 \
- fuzz_config_kea_dhcp6 fuzz_http_endpoint_kea_dhcp6 fuzz_packets_kea_dhcp6 fuzz_unix_socket_kea_dhcp6 \
- ; do
- cp "${OUT}/sbin/${fuzzer}" "${OUT}/${fuzzer}"
-
- # Display some information for debugging.
- ldd "${OUT}/${fuzzer}"
- readelf -d "${OUT}/${fuzzer}" | grep -Ei 'R.*PATH' || true
-
- # Copy all required libraries, although we want to specifically target external libraries.
- for i in $(ldd "${OUT}/${fuzzer}" | cut -f 2 | cut -d ' ' -f 3); do
- cp "${i}" "${KEA_BUILD_DIR}"
- cp "${i}" "${OUT}"
- done
- done
-}
-
-install_kea
+++ /dev/null
-#!/bin/sh
-
-# Change to parent directory, so that the script can be called from anywhere.
-parent_path=$(cd "$(dirname "${0}")" && pwd)
-cd "${parent_path}" || exit 1
-
-mkdir -p build/out
-mkdir -p build/work
-
-cd .. || exit 2
-
-docker build -t kea-fuzzing -f .clusterfuzzlite/Dockerfile .
-
-docker_run() {
- docker run \
- --interactive \
- --privileged \
- --platform linux/amd64 \
- --rm \
- --shm-size=2g \
- -e ARCHITECTURE=x86_64 \
- -e CIFUZZ=true \
- -e FUZZING_ARGS='-rss_limit_mb=8192' \
- -e FUZZING_ENGINE=libfuzzer \
- -e FUZZING_LANGUAGE=c++ \
- -e KEA_BUILD_DIR=/src \
- -e SANITIZER=address \
- -v "${parent_path}/build/out:/out" \
- -v "${parent_path}/build/work:/work" \
- kea-fuzzing \
- "${@}"
-}
-
-docker_run
-
-docker_run compile
CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/kea
- # Fuzzing
- CFL_ARTIFACTS_DIR: '/tmp/cfl-artifacts'
- CFL_CACHE_DIR: '/ccache/cfl-cache'
- CFL_IMAGE: 'gcr.io/oss-fuzz-base/clusterfuzzlite-run-fuzzers'
- CFL_PLATFORM: gitlab
- FUZZ_SECONDS: 600 # 10 min (ClusterFuzzLite defaults)
- FUZZING_ARGS: '-rss_limit_mb=8192'
- LD_LIBRARY_PATH: "/opt/kea/lib:/usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu:/builds/isc-projects/kea"
- PARALLEL_FUZZING: true
- CCACHE_BASEDIR: "${CI_PROJECT_DIR}"
- CCACHE_DIR: "${CI_PROJECT_DIR}/ccache"
-
# SAST
SECURE_ANALYZERS_PREFIX: "registry.gitlab.com/gitlab-org/security-products/analyzers"
# Leave only bandit, flawfinder, semgrep.
stages:
- test
- - fuzz
.base_rules_for_test_jobs: &rules_for_test_stage
rules:
- pylint --jobs "$(nproc || gnproc || echo 1)" --rcfile ./.gitlab/ci/pylint.rc --enable all ${PYTHON_SCRIPTS} || true
-############################## Fuzzing ##############################
-
-# Fuzz code changes. Fuzzes all merge requests.
-fuzz:
- image:
- name: "${CFL_IMAGE}"
- entrypoint: ['']
- stage: fuzz
- tags:
- - docker-fuzz
- needs: []
- parallel:
- matrix:
- - SANITIZER: [address, undefined]
- variables:
- MODE: "code-change"
- rules:
- # Prevent duplicate pipelines.
- - if: $CI_OPEN_MERGE_REQUESTS && $CI_COMMIT_BRANCH == null
- when: never
- # Not used anymore. Change "when" to "manual" to make it appear in MRs again.
- - when: never
- allow_failure: true
- before_script:
- # Get GitLab's container id.
- - export CFL_CONTAINER_ID=`docker ps -q -f "label=com.gitlab.gitlab-runner.job.id=$CI_JOB_ID" -f "label=com.gitlab.gitlab-runner.type=build"`
- script:
- # local cfl-cache to mounted volume
- - if ! test -L cfl-cache; then ln -s /cfl-cache cfl-cache; fi
- # Will build and run the fuzzers.
- - python3 "/opt/oss-fuzz/infra/cifuzz/cifuzz_combined_entrypoint.py"
- artifacts:
- # Upload artifacts when a crash makes the job fail.
- when: always
- expire_in: 30 days
- paths:
- - "${CFL_ARTIFACTS_DIR}"
-
-# Batch fuzzing enables continuous, regular fuzzing on your latest HEAD
-# and allows a corpus of inputs to build up over time, which greatly improves
-# the effectiveness of fuzzing. Batch fuzzing should be run on a schedule.
-fuzz-batch:
- image:
- name: "${CFL_IMAGE}"
- entrypoint: ['']
- stage: fuzz
- needs: []
- tags:
- - docker-fuzz
- variables:
- FUZZ_SECONDS: 86400 # 24 hours
- rules:
- - if: $MODE == "batch"
- before_script:
- - export CFL_CONTAINER_ID=`docker ps -q -f "label=com.gitlab.gitlab-runner.job.id=$CI_JOB_ID" -f "label=com.gitlab.gitlab-runner.type=build"`
- script:
- - python3 "/opt/oss-fuzz/infra/cifuzz/cifuzz_combined_entrypoint.py"
- artifacts:
- when: always
- expire_in: 30 days
- paths:
- - "${CFL_ARTIFACTS_DIR}"
-
-# Corpus pruning is a helper function that minimizes the corpuses by
-# removing corpus files (testcases) that do not increase the fuzzer’s
-# code coverage.
-fuzz-prune:
- image:
- name: "${CFL_IMAGE}"
- entrypoint: ['']
- stage: fuzz
- needs: []
- tags:
- - docker-fuzz
- rules:
- - if: $MODE == "prune"
- before_script:
- - export CFL_CONTAINER_ID=`docker ps -q -f "label=com.gitlab.gitlab-runner.job.id=$CI_JOB_ID" -f "label=com.gitlab.gitlab-runner.type=build"`
- script:
- - python3 "/opt/oss-fuzz/infra/cifuzz/cifuzz_combined_entrypoint.py"
- artifacts:
- when: always
- expire_in: 30 days
- paths:
- - "${CFL_ARTIFACTS_DIR}"
-
-# Continuous builds are used when a crash is found during MR fuzzing to determine
-# whether the crash was newly introduced. If the crash was not newly introduced,
-# MR fuzzing will not report it. This means that there will be fewer unrelated
-# failures when running code change fuzzing.
-fuzz-build:
- image:
- name: "${CFL_IMAGE}"
- entrypoint: ['']
- stage: fuzz
- needs: []
- tags:
- - docker-fuzz
- rules:
- - when: never
- before_script:
- - export CFL_CONTAINER_ID=`docker ps -q -f "label=com.gitlab.gitlab-runner.job.id=$CI_JOB_ID" -f "label=com.gitlab.gitlab-runner.type=build"`
- script:
- - python3 "/opt/oss-fuzz/infra/cifuzz/cifuzz_combined_entrypoint.py"
- artifacts:
- when: always
- expire_in: 30 days
- paths:
- - "${CFL_ARTIFACTS_DIR}"
-
-# scheduled job - generates periodic coverage reports
-fuzz-coverage:
- image:
- name: "${CFL_IMAGE}"
- entrypoint: ['']
- stage: fuzz
- needs: []
- tags:
- - docker-fuzz
- variables:
- SANITIZER: "coverage"
- rules:
- - if: $MODE == "coverage"
- before_script:
- - export CFL_CONTAINER_ID=`cut -c9- < /proc/1/cpuset`
- script:
- - python3 "/opt/oss-fuzz/infra/cifuzz/cifuzz_combined_entrypoint.py"
- after_script:
- - shasum /opt/kea/sbin/*
- - shasum /tmp/not-out/*/*
- - shasum ${OUT}/*/*
- artifacts:
- when: always
- expire_in: 30 days
- paths:
- - "${CFL_ARTIFACTS_DIR}"
-
-
############################### SAST ################################
# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/sast/
#
projects / thirdparty / kea.git / commitdiff
