mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
228 lines
8.5 KiB
YAML
228 lines
8.5 KiB
YAML
name: Scan-build
|
|
|
|
on:
|
|
push:
|
|
paths-ignore:
|
|
- "doc/**"
|
|
- "etc/schema.json"
|
|
pull_request:
|
|
paths-ignore:
|
|
- "doc/**"
|
|
- "etc/schema.json"
|
|
|
|
permissions: read-all
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
scan-build:
|
|
name: Scan-build
|
|
runs-on: ubuntu-latest
|
|
container: ubuntu:26.04
|
|
steps:
|
|
- name: Cache scan-build
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
|
|
with:
|
|
path: ~/.cargo
|
|
key: scan-build
|
|
|
|
- name: Install system packages
|
|
run: |
|
|
apt update
|
|
apt -y install \
|
|
libpcre2-dev \
|
|
build-essential \
|
|
autoconf \
|
|
automake \
|
|
cargo \
|
|
cbindgen \
|
|
clang-22 \
|
|
clang-tools-22 \
|
|
dpdk-dev \
|
|
git \
|
|
libtool \
|
|
libpcap-dev \
|
|
libnet1-dev \
|
|
libyaml-0-2 \
|
|
libyaml-dev \
|
|
libcap-ng-dev \
|
|
libcap-ng0 \
|
|
libmagic-dev \
|
|
libnetfilter-log-dev \
|
|
libnetfilter-queue-dev \
|
|
libnetfilter-queue1 \
|
|
libnfnetlink-dev \
|
|
libnfnetlink0 \
|
|
libnuma-dev \
|
|
libhiredis-dev \
|
|
libhyperscan-dev \
|
|
libjansson-dev \
|
|
libevent-dev \
|
|
libevent-pthreads-2.1-7 \
|
|
liblz4-dev \
|
|
llvm-22-dev \
|
|
make \
|
|
python3-yaml \
|
|
rustc \
|
|
software-properties-common \
|
|
zlib1g \
|
|
zlib1g-dev
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
|
|
- run: git config --global --add safe.directory /__w/suricata/suricata
|
|
- run: ./scripts/bundle.sh
|
|
- run: ./autogen.sh
|
|
- run: scan-build-22 ./configure --enable-warnings --enable-dpdk --enable-nfqueue --enable-nflog
|
|
env:
|
|
CC: clang-22
|
|
# disable security.insecureAPI.DeprecatedOrUnsafeBufferHandling explicitly as
|
|
# this will require significant effort to address.
|
|
# disable optin.core.EnumCastOutOfRange as it trips up capng's enum values as
|
|
# flags handling.
|
|
- run: |
|
|
scan-build-22 --status-bugs --exclude "$(pwd)/rust/" \
|
|
-o scan-build-report/ \
|
|
-enable-checker core.BitwiseShift \
|
|
-enable-checker core.CallAndMessage \
|
|
-enable-checker core.DivideZero \
|
|
-enable-checker core.FixedAddressDereference \
|
|
-enable-checker core.NonNullParamChecker \
|
|
-enable-checker core.NullDereference \
|
|
-enable-checker core.NullPointerArithm \
|
|
-enable-checker core.StackAddressEscape \
|
|
-enable-checker core.UndefinedBinaryOperatorResult \
|
|
-enable-checker core.VLASize \
|
|
-enable-checker core.uninitialized.ArraySubscript \
|
|
-enable-checker core.uninitialized.Assign \
|
|
-enable-checker core.uninitialized.Branch \
|
|
-enable-checker core.uninitialized.CapturedBlockVariable \
|
|
-enable-checker core.uninitialized.NewArraySize \
|
|
-enable-checker core.uninitialized.UndefReturn \
|
|
\
|
|
-enable-checker deadcode.DeadStores \
|
|
\
|
|
-enable-checker nullability.NullableReturnedFromNonnull \
|
|
-enable-checker nullability.NullablePassedToNonnull \
|
|
-enable-checker nullability.NullableDereferenced \
|
|
-enable-checker nullability.NullReturnedFromNonnull \
|
|
\
|
|
-enable-checker optin.performance.GCDAntipattern \
|
|
-disable-checker optin.core.EnumCastOutOfRange \
|
|
-enable-checker optin.performance.Padding \
|
|
-enable-checker optin.portability.UnixAPI \
|
|
-enable-checker optin.taint.GenericTaint \
|
|
-enable-checker optin.taint.TaintedAlloc \
|
|
-enable-checker optin.taint.TaintedDiv \
|
|
\
|
|
-enable-checker security.ArrayBound \
|
|
-enable-checker security.FloatLoopCounter \
|
|
-enable-checker security.MmapWriteExec \
|
|
-enable-checker security.PointerSub \
|
|
-enable-checker security.PutenvStackArray \
|
|
-enable-checker security.SetgidSetuidOrder \
|
|
-enable-checker security.VAList \
|
|
-enable-checker security.cert.env.InvalidPtr \
|
|
\
|
|
-enable-checker security.insecureAPI.UncheckedReturn \
|
|
-enable-checker security.insecureAPI.bcmp \
|
|
-enable-checker security.insecureAPI.bcopy \
|
|
-enable-checker security.insecureAPI.bzero \
|
|
-enable-checker security.insecureAPI.decodeValueOfObjCType \
|
|
-enable-checker security.insecureAPI.getpw \
|
|
-enable-checker security.insecureAPI.gets \
|
|
-enable-checker security.insecureAPI.mkstemp \
|
|
-enable-checker security.insecureAPI.mktemp \
|
|
-enable-checker security.insecureAPI.rand \
|
|
-enable-checker security.insecureAPI.strcpy \
|
|
-enable-checker security.insecureAPI.vfork \
|
|
\
|
|
-disable-checker security.insecureAPI.DeprecatedOrUnsafeBufferHandling \
|
|
\
|
|
-enable-checker unix.API \
|
|
-enable-checker unix.BlockInCriticalSection \
|
|
-enable-checker unix.Chroot \
|
|
-enable-checker unix.Errno \
|
|
-enable-checker unix.Malloc \
|
|
-enable-checker unix.MallocSizeof \
|
|
-enable-checker unix.MismatchedDeallocator \
|
|
-enable-checker unix.StdCLibraryFunctions \
|
|
-enable-checker unix.Stream \
|
|
-enable-checker unix.Vfork \
|
|
-enable-checker unix.cstring.BadSizeArg \
|
|
-enable-checker unix.cstring.NotNullTerminated \
|
|
-enable-checker unix.cstring.NullArg \
|
|
\
|
|
-analyzer-config optin.taint.TaintPropagation:Config="$(pwd)/qa/sb-taint-config.yaml" \
|
|
\
|
|
make
|
|
env:
|
|
CC: clang-22
|
|
- name: 'Upload Scan Build Results'
|
|
uses: actions/upload-artifact@v7.0.1
|
|
if: always()
|
|
with:
|
|
name: scan-build-results
|
|
path: scan-build-report/
|
|
retention-days: 5
|
|
gcc-analyzer:
|
|
name: GCC analyzer
|
|
runs-on: ubuntu-latest
|
|
container: ubuntu:26.04
|
|
steps:
|
|
- name: Cache scan-build
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
|
|
with:
|
|
path: ~/.cargo
|
|
key: scan-build
|
|
|
|
- name: Install system packages
|
|
run: |
|
|
apt update
|
|
apt -y install \
|
|
libpcre2-dev \
|
|
build-essential \
|
|
autoconf \
|
|
automake \
|
|
cargo \
|
|
cbindgen \
|
|
dpdk-dev \
|
|
gcc-16 \
|
|
git \
|
|
libtool \
|
|
libpcap-dev \
|
|
libnet1-dev \
|
|
libyaml-0-2 \
|
|
libyaml-dev \
|
|
libcap-ng-dev \
|
|
libcap-ng0 \
|
|
libmagic-dev \
|
|
libnetfilter-log-dev \
|
|
libnetfilter-queue-dev \
|
|
libnetfilter-queue1 \
|
|
libnfnetlink-dev \
|
|
libnfnetlink0 \
|
|
libnuma-dev \
|
|
libhiredis-dev \
|
|
libhyperscan-dev \
|
|
libjansson-dev \
|
|
libevent-dev \
|
|
libevent-pthreads-2.1-7 \
|
|
liblz4-dev \
|
|
make \
|
|
python3-yaml \
|
|
rustc \
|
|
software-properties-common \
|
|
zlib1g \
|
|
zlib1g-dev
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
|
- run: git config --global --add safe.directory /__w/suricata/suricata
|
|
- run: ./scripts/bundle.sh
|
|
- run: ./autogen.sh
|
|
- run: ./configure --enable-warnings --enable-dpdk --enable-nfqueue --enable-nflog --enable-debug-validation
|
|
env:
|
|
CC: gcc-16
|
|
CFLAGS: "-fanalyzer -Werror"
|
|
SURICATA_LUA_SYS_CFLAGS: ""
|
|
- run: make
|