From cfdab423fb5eca5e2cd38103ebcd64452d66a4f0 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 9 Nov 2018 15:24:29 +0100 Subject: [PATCH 01/11] travis: Build on Ubuntu Xenial (16.04) --- .travis.yml | 5 +---- scripts/test.sh | 22 +++++++--------------- 2 files changed, 8 insertions(+), 19 deletions(-) diff --git a/.travis.yml b/.travis.yml index e9be72df9..3cf29319b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,7 +1,7 @@ language: c sudo: required -dist: trusty +dist: xenial # don't build tags separately if: tag IS blank @@ -75,8 +75,5 @@ matrix: env: TEST=apidoc - compiler: gcc env: TEST=win64 MONOLITHIC=yes - # this does not work on 14.04 due to a missing @4 decoration for - # TryAcquireSRWLockExclusive in MinGW 3.1.0 - compiler: gcc env: TEST=win32 MONOLITHIC=yes - dist: precise diff --git a/scripts/test.sh b/scripts/test.sh index 77c94249d..f79d2d9fb 100755 --- a/scripts/test.sh +++ b/scripts/test.sh @@ -98,11 +98,9 @@ all|coverage|sonarcloud) --disable-kernel-pfroute --disable-keychain --disable-lock-profiler --disable-padlock --disable-fuzzing --disable-osx-attr --disable-tkm --disable-uci - --disable-systemd --disable-soup --disable-unwind-backtraces + --disable-soup --disable-unwind-backtraces --disable-svc --disable-dbghelp-backtraces --disable-socket-win --disable-kernel-wfp --disable-kernel-iph --disable-winhttp" - # Ubuntu 14.04 does not provide libnm - CONFIG="$CONFIG --disable-nm" # not enabled on the build server CONFIG="$CONFIG --disable-af-alg" if test "$TEST" != "coverage"; then @@ -113,8 +111,8 @@ all|coverage|sonarcloud) fi DEPS="$DEPS libcurl4-gnutls-dev libsoup2.4-dev libunbound-dev libldns-dev libmysqlclient-dev libsqlite3-dev clearsilver-dev libfcgi-dev - libpcsclite-dev libpam0g-dev binutils-dev libunwind8-dev - libjson0-dev iptables-dev python-pip libtspi-dev" + libpcsclite-dev libpam0g-dev binutils-dev libunwind8-dev libnm-dev + libjson0-dev iptables-dev python-pip libtspi-dev libsystemd-dev" PYDEPS="pytest" if test "$1" = "deps"; then build_botan @@ -130,7 +128,8 @@ win*) --enable-updown --enable-ext-auth --enable-libipsec --enable-tnccs-20 --enable-imc-attestation --enable-imv-attestation --enable-imc-os --enable-imv-os --enable-tnc-imv --enable-tnc-imc - --enable-pki --enable-swanctl --enable-socket-win" + --enable-pki --enable-swanctl --enable-socket-win + --enable-kernel-iph --enable-kernel-wfp --enable-winhttp" # no make check for Windows binaries unless we run on a windows host if test "$APPVEYOR" != "True"; then TARGET= @@ -144,20 +143,13 @@ win*) DEPS="gcc-mingw-w64-base" case "$TEST" in win64) - # headers on 12.04 are too old, so we only build the plugins here - CONFIG="--host=x86_64-w64-mingw32 $CONFIG --enable-dbghelp-backtraces - --enable-kernel-iph --enable-kernel-wfp --enable-winhttp" + CONFIG="--host=x86_64-w64-mingw32 $CONFIG --enable-dbghelp-backtraces" DEPS="gcc-mingw-w64-x86-64 binutils-mingw-w64-x86-64 mingw-w64-x86-64-dev $DEPS" CC="x86_64-w64-mingw32-gcc" - # apply patch to MinGW headers - if test "$APPVEYOR" != "True" -a -z "$1"; then - sudo patch -f -p 4 -d /usr/share/mingw-w64/include < src/libcharon/plugins/kernel_wfp/mingw-w64-4.8.1.diff - fi ;; win32) CONFIG="--host=i686-w64-mingw32 $CONFIG" - # currently only works on 12.04, so use mingw-w64-dev instead of mingw-w64-i686-dev - DEPS="gcc-mingw-w64-i686 binutils-mingw-w64-i686 mingw-w64-dev $DEPS" + DEPS="gcc-mingw-w64-i686 binutils-mingw-w64-i686 mingw-w64-i686-dev $DEPS" CC="i686-w64-mingw32-gcc" ;; esac From 75853dbe4b8965a3f5c3f5fbe812305400930b43 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Nov 2018 15:48:30 +0100 Subject: [PATCH 02/11] travis: Add sleep in after_failure This makes sure we get the complete output, which isn't always the case otherwise (there is an unresolved bug for this in the Travis issue tracker). --- .travis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.travis.yml b/.travis.yml index 3cf29319b..904f1a910 100644 --- a/.travis.yml +++ b/.travis.yml @@ -29,6 +29,7 @@ after_success: after_failure: - cat config.log + - sleep 1 env: global: From 248f34918fe51ff0f3cbf482dbc011c2d1c0e92f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 9 Nov 2018 16:14:23 +0100 Subject: [PATCH 03/11] travis: Don't build TSS2 as root This might prevent ccache from overwriting files in later builds. --- scripts/test.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/test.sh b/scripts/test.sh index f79d2d9fb..8f573cef3 100755 --- a/scripts/test.sh +++ b/scripts/test.sh @@ -49,7 +49,8 @@ build_tss2() curl -L $TSS2_SRC | tar xz -C $TRAVIS_BUILD_DIR/.. && cd $TSS2_DIR && ./configure && - sudo make -j4 install >/dev/null && + make -j4 >/dev/null && + sudo make install >/dev/null && sudo ldconfig || exit $? cd - } From fa4599d16018bdf9e47e9fea390d7d56a162f828 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 9 Nov 2018 16:04:54 +0100 Subject: [PATCH 04/11] gcrypt: Don't use thread callbacks for newer versions of libgcrypt According to gcrypt.h these callbacks are not used anymore since version 1.6 and with clang these actually cause deprecation warnings that let the build on travis (-Werror) fail. --- src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c index 45fba242b..6946e4576 100644 --- a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c +++ b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c @@ -43,10 +43,12 @@ struct private_gcrypt_plugin_t { gcrypt_plugin_t public; }; +#if GCRYPT_VERSION_NUMBER < 0x010600 /** * Define gcrypt multi-threading callbacks as gcry_threads_pthread */ GCRY_THREAD_OPTION_PTHREAD_IMPL; +#endif METHOD(plugin_t, get_name, char*, private_gcrypt_plugin_t *this) @@ -163,7 +165,9 @@ plugin_t *gcrypt_plugin_create() { private_gcrypt_plugin_t *this; +#if GCRYPT_VERSION_NUMBER < 0x010600 gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread); +#endif if (!gcry_check_version(GCRYPT_VERSION)) { From cab4b3a34132ac799c293bdfdfb26dcfada87c77 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 9 Nov 2018 16:13:46 +0100 Subject: [PATCH 05/11] Doxyfile: Remove obsolete XML options --- Doxyfile.in | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/Doxyfile.in b/Doxyfile.in index 6c59d86c9..a1f3f8819 100644 --- a/Doxyfile.in +++ b/Doxyfile.in @@ -1789,18 +1789,6 @@ GENERATE_XML = NO XML_OUTPUT = xml -# The XML_SCHEMA tag can be used to specify a XML schema, which can be used by a -# validating XML parser to check the syntax of the XML files. -# This tag requires that the tag GENERATE_XML is set to YES. - -XML_SCHEMA = - -# The XML_DTD tag can be used to specify a XML DTD, which can be used by a -# validating XML parser to check the syntax of the XML files. -# This tag requires that the tag GENERATE_XML is set to YES. - -XML_DTD = - # If the XML_PROGRAMLISTING tag is set to YES doxygen will dump the program # listings (including syntax highlighting and cross-referencing information) to # the XML output. Note that enabling this will significantly increase the size From d8d756e3067942fb7ab46589b2277b568068b222 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 9 Nov 2018 16:48:40 +0100 Subject: [PATCH 06/11] Fix make distcheck if systemd is installed The automatically determined path for systemd units is an absolute system path that doesn't respect $(prefix). That's a problem for make distcheck, which is usually ran as regular user and it's not expected to have any impact on the system (it does a local install in a subdir). To avoid these issues we override the configure flags used by make distcheck and set the path to one relative to the specified prefix. --- Makefile.am | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Makefile.am b/Makefile.am index 54b822050..958edc6fe 100644 --- a/Makefile.am +++ b/Makefile.am @@ -24,6 +24,11 @@ config_includedir = $(ipseclibdir)/include nodist_config_include_HEADERS = config.h endif +# we can't (and shouldn't) install/uninstall system files during make distcheck, +# so override the autodetected path for systemd units +AM_DISTCHECK_CONFIGURE_FLAGS = \ + --with-systemdsystemunitdir='$$(prefix)/lib/systemd/system' + # we leave config files behind intentionally so prevent distcheck from complaining distuninstallcheck_listfiles = find . -type f \! -name '*.conf' \! -name '*.secrets' -print From 187ab29849761b2513688109f73b7f20e83970b1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Nov 2018 12:08:43 +0100 Subject: [PATCH 07/11] travis: Use two threads to analyze C code with SonarQube On Nov 12, the scanner was updated and now takes a lot more time (about 3 times as much). Using two threads reduces it a bit (by about 25%). Using even more threads doesn't help or even increases the time again. --- scripts/test.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/test.sh b/scripts/test.sh index 8f573cef3..893dcb649 100755 --- a/scripts/test.sh +++ b/scripts/test.sh @@ -284,6 +284,7 @@ sonarcloud) -Dsonar.projectKey=strongswan \ -Dsonar.projectVersion=$(git describe)+${TRAVIS_BUILD_NUMBER} \ -Dsonar.sources=. \ + -Dsonar.cfamily.threads=2 \ -Dsonar.cfamily.build-wrapper-output=bw-output || exit $? ;; *) From ff977331632cb25a7d6e35563a4d9d2907c261d5 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Nov 2018 16:42:44 +0100 Subject: [PATCH 08/11] travis: Start with sonarcloud job first Also change the condition, the environment variable is apparently still around when the decision to run it is made. --- .travis.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.travis.yml b/.travis.yml index 904f1a910..5dbeb44c6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -55,17 +55,17 @@ env: matrix: include: - - compiler: clang - os: osx - env: TEST=osx - compiler: gcc env: TEST=sonarcloud - if: env(SONAR_TOKEN) IS present + if: type = push git: depth: false addons: sonarcloud: organization: "strongswan" + - compiler: clang + os: osx + env: TEST=osx - compiler: gcc env: TEST=coverage - compiler: clang From fb4103051e4f49e8f037f5c0b8f099a5eea25b97 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Nov 2018 16:46:10 +0100 Subject: [PATCH 09/11] travis: Simplify explicitly included jobs The first value for the compiler array (gcc) is inherited. --- .travis.yml | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/.travis.yml b/.travis.yml index 5dbeb44c6..66cdfa3a4 100644 --- a/.travis.yml +++ b/.travis.yml @@ -55,26 +55,20 @@ env: matrix: include: - - compiler: gcc - env: TEST=sonarcloud + - env: TEST=sonarcloud if: type = push git: depth: false addons: sonarcloud: organization: "strongswan" - - compiler: clang + - env: TEST=osx + compiler: clang os: osx - env: TEST=osx - - compiler: gcc - env: TEST=coverage - - compiler: clang - env: TEST=fuzzing MONOLITHIC=yes - - compiler: gcc - env: TEST=dist - - compiler: gcc - env: TEST=apidoc - - compiler: gcc - env: TEST=win64 MONOLITHIC=yes - - compiler: gcc - env: TEST=win32 MONOLITHIC=yes + - env: TEST=coverage + - env: TEST=fuzzing MONOLITHIC=yes + compiler: clang + - env: TEST=dist + - env: TEST=apidoc + - env: TEST=win64 MONOLITHIC=yes + - env: TEST=win32 MONOLITHIC=yes From b76a1cf284b9c134b0a32d887a1d791b111aae5a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Nov 2018 18:31:21 +0100 Subject: [PATCH 10/11] travis: Use manual matrix expansion to improve overall run time The sonarcloud build runs a long time now (the win32/64 builds are also a lot slower on xenial), which increases the overall time a build takes because we can't run these before regular matrix jobs run. So we do a manual matrix expansion to control the order of jobs (slower first). This also removes the TEST=default build with GCC as that's basically what TEST=dist does (except for forcing the printf implementation) --- .travis.yml | 67 ++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 46 insertions(+), 21 deletions(-) diff --git a/.travis.yml b/.travis.yml index 66cdfa3a4..98804f2c6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -6,9 +6,7 @@ dist: xenial # don't build tags separately if: tag IS blank -compiler: - - gcc - - clang +compiler: gcc cache: ccache @@ -36,22 +34,6 @@ env: - TESTS_REDUCED_KEYLENGTHS=yes - LEAK_DETECTIVE=no - MONOLITHIC=no - matrix: - - TEST=all - - TEST=all MONOLITHIC=yes - - TEST=all LEAK_DETECTIVE=yes - - TEST=default - - TEST=default MONOLITHIC=yes - - TEST=default LEAK_DETECTIVE=yes - - TEST=botan - - TEST=botan LEAK_DETECTIVE=yes - - TEST=openssl - - TEST=openssl LEAK_DETECTIVE=yes - - TEST=gcrypt - - TEST=gcrypt LEAK_DETECTIVE=yes - # we can't test Vstr as negative int args are not properly passed to CBs - - TEST=printf-builtin - - TEST=printf-builtin LEAK_DETECTIVE=yes matrix: include: @@ -65,10 +47,53 @@ matrix: - env: TEST=osx compiler: clang os: osx + - env: TEST=all + - env: TEST=all + compiler: clang + - env: TEST=all MONOLITHIC=yes + - env: TEST=all MONOLITHIC=yes + compiler: clang + - env: TEST=all LEAK_DETECTIVE=yes + - env: TEST=all LEAK_DETECTIVE=yes + compiler: clang - env: TEST=coverage - env: TEST=fuzzing MONOLITHIC=yes compiler: clang - - env: TEST=dist - - env: TEST=apidoc - env: TEST=win64 MONOLITHIC=yes - env: TEST=win32 MONOLITHIC=yes + - env: TEST=dist + # "default" with GCC is already tested with "dist" above + - env: TEST=default + compiler: clang + - env: TEST=default MONOLITHIC=yes + - env: TEST=default MONOLITHIC=yes + compiler: clang + - env: TEST=default LEAK_DETECTIVE=yes + - env: TEST=default LEAK_DETECTIVE=yes + compiler: clang + # we can't test Vstr as negative int args are not properly passed to CBs + - env: TEST=printf-builtin + - env: TEST=printf-builtin + compiler: clang + - env: TEST=printf-builtin LEAK_DETECTIVE=yes + - env: TEST=printf-builtin LEAK_DETECTIVE=yes + compiler: clang + - env: TEST=botan + - env: TEST=botan + compiler: clang + - env: TEST=botan LEAK_DETECTIVE=yes + - env: TEST=botan LEAK_DETECTIVE=yes + compiler: clang + - env: TEST=openssl + - env: TEST=openssl + compiler: clang + - env: TEST=openssl LEAK_DETECTIVE=yes + - env: TEST=openssl LEAK_DETECTIVE=yes + compiler: clang + - env: TEST=gcrypt + - env: TEST=gcrypt + compiler: clang + - env: TEST=gcrypt LEAK_DETECTIVE=yes + - env: TEST=gcrypt LEAK_DETECTIVE=yes + compiler: clang + - env: TEST=apidoc From 8a4f110243e61c001611095227b1260bd81f7d39 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 13 Nov 2018 18:59:38 +0100 Subject: [PATCH 11/11] travis: Use ccache for MinGW builds --- scripts/test.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/test.sh b/scripts/test.sh index 893dcb649..1998f2178 100755 --- a/scripts/test.sh +++ b/scripts/test.sh @@ -134,6 +134,7 @@ win*) # no make check for Windows binaries unless we run on a windows host if test "$APPVEYOR" != "True"; then TARGET= + CCACHE=ccache else CONFIG="$CONFIG --enable-openssl" CFLAGS="$CFLAGS -I/c/OpenSSL-$TEST/include" @@ -146,12 +147,12 @@ win*) win64) CONFIG="--host=x86_64-w64-mingw32 $CONFIG --enable-dbghelp-backtraces" DEPS="gcc-mingw-w64-x86-64 binutils-mingw-w64-x86-64 mingw-w64-x86-64-dev $DEPS" - CC="x86_64-w64-mingw32-gcc" + CC="$CCACHE x86_64-w64-mingw32-gcc" ;; win32) CONFIG="--host=i686-w64-mingw32 $CONFIG" DEPS="gcc-mingw-w64-i686 binutils-mingw-w64-i686 mingw-w64-i686-dev $DEPS" - CC="i686-w64-mingw32-gcc" + CC="$CCACHE i686-w64-mingw32-gcc" ;; esac ;;