mirror of
https://github.com/Cacti/spine.git
synced 2026-10-30 00:26:53 +09:00
86a062dd09
## Summary Consolidates the connector/build work from #613 and the broader test-infrastructure work extracted from #597 into one review: - discover MariaDB Connector/C first while retaining MySQL and Percona-compatible support - test MariaDB and MySQL Connector/C with strict GCC and Clang builds on Ubuntu 24.04 - add a real macOS 15 build and unit-test lane with portable Autotools platform detection - run unit tests under ASan/UBSan and ThreadSanitizer - enforce the measured 7% global coverage baseline and 70% changed-line coverage - add libFuzzer coverage for output parsing alongside the existing hostname parser - exercise the SNMPv3 integration suite against MariaDB and MySQL 8.4 - add cppcheck, shellcheck, DCO verification, CODEOWNERS, distcheck, and Linux-capability checks while retaining the repository-managed default CodeQL setup - expose a stable `CI / required` aggregate check for branch protection - pin runners and third-party actions and keep workflow permissions read-only by default ## Correctness fixes found by the new gates - reject truncated capability strings and poller-output SQL tuples instead of publishing partial data - make `bootstrap` fail closed and select `libtoolize`/`glibtoolize` portably - use Autoconf's canonical host for Darwin detection instead of an empty native-build alias - remove stale initialization/name-shadow findings and make read-only interfaces const-correct - make the ICMP parser test portable across Linux and BSD header names ## Verification - strict GCC and Clang builds: 4/4 unit targets passed - ASan/UBSan: 4/4 passed - ThreadSanitizer: 4/4 passed - macOS Clang/Homebrew build: 4/4 passed - MariaDB integration: passed - MySQL 8.4 integration: passed - both libFuzzer targets: passed sustained local runs - coverage: 7.2% global and 84% on changed lines - cppcheck, shellcheck, actionlint, DCO verification, and `git diff --check`: passed locally ## Post-merge repository settings After these workflows exist on `develop`, an administrator should require `CI / required`, Fuzz, Integration, Rocky Linux, and the repository-managed CodeQL/code-scanning result in the active ruleset; enable code-owner approval; and require the branch to be current (or use a merge queue). Enabling those settings before this PR merges would create required checks that the base branch cannot yet emit. Consolidates and supersedes #613. Closes #612. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Signed-off-by: TheWitness <thewitness@cacti.net> Signed-off-by: TheWitness <copilot@users.noreply.github.com> Co-authored-by: TheWitness <thewitness@cacti.net> Co-authored-by: TheWitness <copilot@users.noreply.github.com>
64 lines
2.2 KiB
Makefile
64 lines
2.2 KiB
Makefile
# libFuzzer targets for spine.
|
|
#
|
|
# The sources are compiled directly rather than reusing the objects from the
|
|
# top-level build, so the instrumentation is consistent across every
|
|
# translation unit. Without that libFuzzer has no coverage signal and the
|
|
# run is worthless.
|
|
#
|
|
# make -- build the targets
|
|
# make run -- build, then fuzz each target for $(FUZZ_SECONDS)
|
|
# make clean
|
|
|
|
# CC is often exported by the parent build; use a dedicated variable so the
|
|
# fuzzer is always built with a clang that supports -fsanitize=fuzzer.
|
|
FUZZ_CC ?= clang
|
|
FUZZ_SECONDS ?= 60
|
|
FUZZ_TIMEOUT ?= 5
|
|
FUZZ_RSS_MB ?= 2048
|
|
SPINE_ROOT := ../..
|
|
BINDIR := bin
|
|
|
|
SANITIZERS := -fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer -fno-lto
|
|
|
|
# net-snmp-config reports the distro's own build flags, which include -flto and
|
|
# hardening options that clash with the sanitizer build. Keep only the includes.
|
|
NETSNMP_CFLAGS := $(filter -I% -D%, $(shell net-snmp-config --base-cflags 2>/dev/null))
|
|
NETSNMP_LIBS := $(filter -l% -L%, $(shell net-snmp-config --libs 2>/dev/null))
|
|
DB_CONFIG ?= $(shell command -v mariadb_config 2>/dev/null || command -v mysql_config 2>/dev/null)
|
|
|
|
SPINE_SRC := $(addprefix $(SPINE_ROOT)/, \
|
|
ping.c util.c sql.c snmp.c src/core/locks.c poller.c nft_popen.c php.c \
|
|
src/core/keywords.c error.c)
|
|
|
|
FUZZ_CFLAGS := $(SANITIZERS) -g -O1 -DHAVE_CONFIG_H \
|
|
-I$(SPINE_ROOT) -I$(SPINE_ROOT)/src/core -I$(SPINE_ROOT)/config \
|
|
$(NETSNMP_CFLAGS) \
|
|
$(shell $(DB_CONFIG) --include 2>/dev/null)
|
|
|
|
FUZZ_LDLIBS := $(NETSNMP_LIBS) $(filter -l% -L%, $(shell $(DB_CONFIG) --libs 2>/dev/null))
|
|
|
|
TARGETS := $(BINDIR)/fuzz_namebyhost $(BINDIR)/fuzz_output_parser $(BINDIR)/fuzz_icmp_reply
|
|
|
|
.PHONY: all run clean
|
|
|
|
all: $(TARGETS)
|
|
|
|
$(BINDIR):
|
|
mkdir -p $(BINDIR)
|
|
|
|
$(BINDIR)/fuzz_%: fuzz_%.c stubs.c $(SPINE_SRC) | $(BINDIR)
|
|
$(FUZZ_CC) $(FUZZ_CFLAGS) $^ -o $@ $(FUZZ_LDLIBS)
|
|
|
|
run: $(TARGETS)
|
|
@rc=0; for t in $(TARGETS); do \
|
|
name=$$(basename $$t); \
|
|
echo "== $$name ($(FUZZ_SECONDS)s)"; \
|
|
mkdir -p corpus/$$name; \
|
|
$$t corpus/$$name -max_total_time=$(FUZZ_SECONDS) \
|
|
-timeout=$(FUZZ_TIMEOUT) -rss_limit_mb=$(FUZZ_RSS_MB) \
|
|
-print_final_stats=1 || rc=1; \
|
|
done; exit $$rc
|
|
|
|
clean:
|
|
rm -rf $(BINDIR)
|