[gnutls-devel] GnuTLS | New CI runner with clang combined ubsan+asan (!1151)

[Development of GNU's TLS library]

Nikos Mavrogiannopoulos commented on a discussion on .gitlab-ci.yml: https://gitlab.com/gnutls/gnutls/merge_requests/1151#note_276109767

> +  - ./bootstrap
> +  - export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1:suppressions=$(pwd)/devel/ubsan.supp
> +  - export LSAN_OPTIONS=suppressions=$(pwd)/devel/lsan.supp
> +  - export ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer
> +  - export CC=clang
> +  - export CXX=clang++
> +
> +# This makes several tests fail, needs discussion if helpful
> +#  - export CFLAGS="-std=c99 -O1 -g -Werror -fno-omit-frame-pointer -fsanitize=undefined,integer,nullability,bool,alignment,null,enum,address,leak,nonnull-attribute  -fno-sanitize-recover=all -fsanitize-recover=unsigned-integer-overflow -fsanitize-address-use-after-scope"
> +
> +# This is from OSS-Fuzz (20.12.2019)
> +  - export CFLAGS="-std=c99 -O1 -g -Werror -fno-omit-frame-pointer -fsanitize=array-bounds,bool,builtin,enum,float-divide-by-zero,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unsigned-integer-overflow,unreachable,vla-bound,vptr,address,leak,alignment -fno-sanitize-recover=all -fsanitize-recover=unsigned-integer-overflow -fsanitize-address-use-after-scope"
> +
> +  - export CXXFLAGS="$CFLAGS"
> +
> +# --disable-tls13-interop because tests/suite/testcompat-tls13-openssl.sh fails with clang sanitizers 

Not sure it helps we may want something like that:
```
diff --git a/tests/suite/testcompat-tls13-openssl.sh b/tests/suite/testcompat-tls13-openssl.sh
index 6d17941b8e..bf71af6177 100755
--- a/tests/suite/testcompat-tls13-openssl.sh
+++ b/tests/suite/testcompat-tls13-openssl.sh
@@ -59,7 +59,7 @@ SERV=openssl
 OPENSSL_CLI="$SERV"
 
 if test -z "$OUTPUT";then
-OUTPUT=/dev/null
+OUTPUT=testcompat-tls13-openssl.verbose.$$.log
 fi
 
 >${OUTPUT}
@@ -234,7 +234,7 @@ run_client_suite() {
 	echo_cmd "${PREFIX}Checking TLS 1.3 with resumption with early data..."
 	testdir=`create_testdir tls13-openssl-resumption`
 	eval "${GETPORT}"
-	launch_bare_server $$ s_server -quiet -accept "${PORT}" -keyform pem -certform pem ${OPENSSL_DH_PARAMS_OPT} -key "${RSA_KEY}" -cert "${RSA_CERT}" -CAfile "${CA_CERT}" -early_data
+	launch_bare_server $$ s_server -debug -msg -accept "${PORT}" -keyform pem -certform pem ${OPENSSL_DH_PARAMS_OPT} -key "${RSA_KEY}" -cert "${RSA_CERT}" -CAfile "${CA_CERT}" -early_data
 	PID=$!
 	wait_server ${PID}
 
```

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/merge_requests/1151#note_276109767
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20200123/fb727ccc/attachment.html>