Skip to content

C
cwe_checker
Unverified Commit f923e869 by Thomas Barabosch Committed by GitHub
Options

Travis ci (#10) 

This builds cwe_checker and runs the test suite on Travis CI.
parent 002a375d
Showing with 79 additions and 98 deletions
.travis.yml 0 → 100644
dist: xenial
language: python
python: 3.6
services:
- docker
install:
- sudo apt-get update
- sudo apt-get install -y execstack
- docker
before_script:
- ./.travis_prepare.sh
script:
- ./.travis_run_tests.sh
notifications:
email:
- firmware-security@fkie.fraunhofer.de
.travis_prepare.sh 0 → 100755
#!/bin/bash
#!/bin/bash
cd test/artificial_samples/
./install_cross_compilers.sh
make
cd ../..
docker build -t cwe-checker .
.travis_run_tests.sh 0 → 100755
#!/bin/bash
pytest
Dockerfile
# based on https://github.com/BinaryAnalysisPlatform/bap/blob/master/docker/Dockerfile FROM tbarabosch/cwe_checker_travis_docker_image:latest
FROM phusion/baseimage:0.11
RUN apt-get -y update \
&& install_clean sudo \
&& useradd -m bap \
&& echo "bap:bap" | chpasswd \
&& adduser bap sudo \
&& sed -i.bkp -e 's/%sudo\s\+ALL=(ALL\(:ALL\)\?)\s\+ALL/%sudo ALL=NOPASSWD:ALL/g' /etc/sudoers
USER bap
WORKDIR /home/bap
ENV PATH="/home/bap/.opam/4.05.0/bin/:${PATH}"
COPY . /home/bap/cwe_checker/ COPY . /home/bap/cwe_checker/
RUN sudo apt-get -y update \ RUN sudo chown -R bap:bap /home/bap/cwe_checker \
&& sudo install_clean \
binutils-multiarch \
build-essential \
clang \
curl \
git \
libgmp-dev \
libx11-dev \
libzip-dev \
llvm-6.0-dev \
m4 \
pkg-config \
software-properties-common \
unzip \
wget \
zlib1g-dev \
&& wget https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh \
&& yes /usr/local/bin | sudo sh install.sh \
# install Bap
&& opam init --auto-setup --comp=4.05.0 --disable-sandboxing --yes \
&& git clone -b testing --depth 1 https://github.com/BinaryAnalysisPlatform/opam-repository.git \
&& opam repo add bap opam-repository \
&& opam update \
&& opam install depext --yes \
&& OPAMJOBS=1 opam depext --install bap --yes \
# install CWE_Checker and dependencies
&& OPAMJOBS=1 opam install yojson alcotest --yes \
&& sudo chown -R bap:bap /home/bap/cwe_checker \
&& cd /home/bap/cwe_checker/src \ && cd /home/bap/cwe_checker/src \
&& bapbuild -r -Is checkers,utils -pkgs yojson,unix cwe_checker.plugin \ && bapbuild -r -Is checkers,utils -pkgs yojson,unix cwe_checker.plugin \
&& bapbundle install cwe_checker.plugin \ && bapbundle install cwe_checker.plugin
&& sudo apt-get remove -y \
build-essential \
clang \
curl \
gcc \
g++ \
git \
libgmp-dev \
libx11-dev \
libzip-dev \
llvm-6.0-dev \
unzip \
wget \
zlib1g-dev \
&& sudo apt-get -y autoremove \
&& sudo apt-get -y clean \
&& rm -rf /home/bap/.opam/4.05.0/.opam-switch/sources
WORKDIR /home/bap/cwe_checker/src WORKDIR /home/bap/cwe_checker/src
......
README.md
# cwe_checker # # cwe_checker #
[![Codacy Badge](https://api.codacy.com/project/badge/Grade/9dbf158110de427d893b40ba397b94bc)](https://www.codacy.com/app/weidenba/cwe_checker?utm_source=github.com&utm_medium=referral&utm_content=fkie-cad/cwe_checker&utm_campaign=Badge_Grade) [![Codacy Badge](https://api.codacy.com/project/badge/Grade/9dbf158110de427d893b40ba397b94bc)](https://www.codacy.com/app/weidenba/cwe_checker?utm_source=github.com&utm_medium=referral&utm_content=fkie-cad/cwe_checker&utm_campaign=Badge_Grade)
![Docker-Status](https://img.shields.io/docker/build/fkiecad/cwe_checker.svg) [![Build Status](https://travis-ci.com/fkie-cad/cwe_checker.svg?branch=master)](https://travis-ci.com/fkie-cad/cwe_checker)
![Docker-Pulls](https://img.shields.io/docker/pulls/fkiecad/cwe_checker.svg) ![Docker-Pulls](https://img.shields.io/docker/pulls/fkiecad/cwe_checker.svg)
## What is cwe_checker? ## ## What is cwe_checker? ##
*cwe_checker* detects common bug classes such as use of dangerous functions and simple integer overflows. These bug classes are formally known as [Common Weakness Enumerations](https://cwe.mitre.org/) (CWEs). Its main goal is to aid analysts to quickly find vulnerable code paths. *cwe_checker* detects common bug classes such as use of dangerous functions and simple integer overflows. These bug classes are formally known as [Common Weakness Enumerations](https://cwe.mitre.org/) (CWEs). Its main goal is to aid analysts to quickly find vulnerable code paths.
...@@ -35,11 +35,11 @@ The following arguments should convince you to give *cwe_checker* a try: ...@@ -35,11 +35,11 @@ The following arguments should convince you to give *cwe_checker* a try:
- view results annotated in IDA Pro - view results annotated in IDA Pro
- *cwe_checker* can be integrated as a plugin into [FACT](https://github.com/fkie-cad/FACT_core) - *cwe_checker* can be integrated as a plugin into [FACT](https://github.com/fkie-cad/FACT_core)
## How to install cwe_checker? ## ## How to install cwe_checker? ##
There are three ways to install cwe_checker. The recommended way is to get cwe_checker from the Ocaml package manager Opam. You can install cwe_checker via the package [fkie-cad-cwe-checker](https://opam.ocaml.org/packages/fkie-cad-cwe-checker/) (`opam install fkie-cad-cwe-checker`). There are several ways to install cwe_checker. The recommended way is to get cwe_checker from the Ocaml package manager Opam. You can install cwe_checker via the package [fkie-cad-cwe-checker](https://opam.ocaml.org/packages/fkie-cad-cwe-checker/) (`opam install fkie-cad-cwe-checker`). This gives you a stable version of cwe_checker.
The second way is to utilize the installation script `install.sh`, which is just a wrapper around Docker. Make sure to have the latest version of Docker. Another option is to pull the latest Docker container from [dockerhub](https://hub.docker.com/r/fkiecad/cwe_checker) (`docker pull fkiecad/cwe_checker`).
The three way is to build it using the provided `Makefile`. In this case you must ensure that all dependencies are fulfilled: The last two ways are preferrable if you plan to develop cwe_checker. First, utilize the installation script `install.sh`, which is just a wrapper around Docker. Make sure to have the latest version of Docker. Second, build it using the provided `Makefile`. In this case you must ensure that all dependencies are fulfilled:
- Ocaml 4.05.0 - Ocaml 4.05.0
- Opam 2.0.2 - Opam 2.0.2
- BAP 1.5 (and its dependencies) - BAP 1.5 (and its dependencies)
......
test/acceptance/cwe_checker_testlib.py
import os
import subprocess import subprocess
def build_bap_cmd(filename, target, arch): def build_bap_cmd(filename, target, arch):
cmd = 'bap test/artificial_samples/build/cwe_%s_%s.out --pass=callsites,cwe-checker --cwe-checker-partial=CWE%s --cwe-checker-config=src/config.json' % (filename, arch, target) if 'travis' in os.environ['USER']:
abs_path = os.path.abspath('test/artificial_samples/build/cwe_%s_%s.out' % (filename, arch))
cmd = 'docker run --rm -v %s:/tmp/input cwe-checker:latest bap /tmp/input --pass=cwe-checker --cwe-checker-partial=CWE%s --cwe-checker-config=/home/bap/cwe_checker/src/config.json' % (abs_path, target)
else:
cmd = 'bap test/artificial_samples/build/cwe_%s_%s.out --pass=cwe-checker --cwe-checker-partial=CWE%s --cwe-checker-config=src/config.json' % (filename, arch, target)
return cmd.split() return cmd.split()
def execute_and_check_occurence(filename, target, arch, string): def execute_and_check_occurence(filename, target, arch, string):
......
test/artificial_samples/install_cross_compilers.sh 0 → 100755
#!/bin/bash
echo "Installing cross compiler for ARM architecture."
sudo apt install -y gcc-multilib-arm-linux-gnueabi g++-arm-linux-gnueabi
echo "Installing cross compiler for MIPS architecture."
sudo apt install -y gcc-multilib-mips-linux-gnu g++-5-mips-linux-gnu
echo "Installing cross compiler for PPC architecture."
sudo apt install -y gcc-multilib-powerpc-linux-gnu g++-5-powerpc-linux-gnu
echo "Installing dependencies for x86 compilation"
sudo docker pull dockcross/linux-x86
sudo docker run --rm dockcross/linux-x86 > ./dockcross-linux-x86
chmod +x ./dockcross-linux-x86
echo "Done."
test/artificial_samples/install_cross_compilers_ubuntu_18.04.sh deleted 100755 → 0
#!/bin/bash
echo "Installing cross compiler for ARM architecture."
sudo docker pull dockcross/linux-arm64
sudo docker run -rm dockcross/linux-arm64 > ./dockcross-linux-arm64
chmod +x ./dockcross-linux-arm64
echo "Installing cross compiler for MIPS architecture."
sudo docker pull dockcross/linux-mips
sudo docker run -rm dockcross/linux-mips > ./dockcross-linux-mips
chmod +x ./dockcross-linux-mips
echo "Installing cross compiler for PPC architecture."
sudo docker pull dockcross/linux-ppc64le
sudo docker run -rm dockcross/linux-ppc64le > ./dockcross-linux-ppc64le
chmod +x ./dockcross-linux-ppc64le
echo "Installing dockcross image for x86 C++ cross-compiler"
sudo docker pull dockcross/linux-x86
sudo docker run -rm dockcross/linux-x86 > ./dockcross-linux-x86
chmod +x ./dockcross-linux-x86
echo "Done."
test/artificial_samples/makefile
CC_x64=gcc CC_x64=gcc
CC_X86=./dockcross-linux-x86 gcc CC_X86=./dockcross-linux-x86 gcc
CC_ARM=./dockcross-linux-arm64 arm-linux-gnueabi-gcc-7 CC_ARM=arm-linux-gnueabi-gcc
CC_MIPS=./dockcross-linux-mips mips-linux-gnu-gcc-7 CC_MIPS=mips-linux-gnu-gcc
CC_PPC=./dockcross-linux-ppc64le powerpc-linux-gnu-gcc-7 CC_PPC=powerpc-linux-gnu-gcc
CPP_x64=g++ CPP_x64=g++
CPP_X86=./dockcross-linux-x86 g++ CPP_X86=./dockcross-linux-x86 g++
CPP_ARM=./dockcross-linux-arm64 arm-linux-gnueabi-g++-7 CPP_ARM=arm-linux-gnueabi-g++-5
CPP_MIPS=./dockcross-linux-mips mips-linux-gnu-g++-7 CPP_MIPS=mips-linux-gnu-g++-5
CPP_PPC=./dockcross-linux-ppc64le powerpc-linux-gnu-g++-7 CPP_PPC=powerpc-linux-gnu-g++-5
CFLAGS_X64=-O0 -g -fno-stack-protector CFLAGS_X64=-O0 -g -fno-stack-protector -std=c11
CFLAGS_X86=-O0 -g -m32 -fno-stack-protector CFLAGS_X86=-O0 -g -m32 -fno-stack-protector -std=c11
CFLAGS_ARM=-O0 -g -fno-stack-protector CFLAGS_ARM=-O0 -g -fno-stack-protector -std=c11
CFLAGS_MIPS=-O0 -g -fno-stack-protector CFLAGS_MIPS=-O0 -g -fno-stack-protector -std=c11
CFLAGS_PPC=-O0 -g -fno-stack-protector CFLAGS_PPC=-O0 -g -fno-stack-protector -std=c11
CPPFLAGS_X64=-O0 -g -fno-stack-protector
CPPFLAGS_X86=-O0 -g -m32 -fno-stack-protector
CPPFLAGS_ARM=-O0 -g -fno-stack-protector
CPPFLAGS_MIPS=-O0 -g -fno-stack-protector
CPPFLAGS_PPC=-O0 -g -fno-stack-protector
define compile_x64 define compile_x64
@echo "Compiling x64 target:" $(1) @echo "Compiling x64 target:" $(1)
...@@ -24,7 +30,7 @@ endef ...@@ -24,7 +30,7 @@ endef
define compile_x64_cpp define compile_x64_cpp
@echo "Compiling x64 target:" $(1) @echo "Compiling x64 target:" $(1)
$(CPP_x64) $(CFLAGS_X64) -o build/$(1)_x64.out $(1).cpp $(CPP_x64) $(CPPFLAGS_X64) -o build/$(1)_x64.out $(1).cpp
execstack -s build/$(1)_x64.out execstack -s build/$(1)_x64.out
endef endef
...@@ -36,7 +42,7 @@ endef ...@@ -36,7 +42,7 @@ endef
define compile_x86_cpp define compile_x86_cpp
@echo "Compiling x86 target:" $(1) @echo "Compiling x86 target:" $(1)
$(CPP_X86) $(CFLAGS_X86) -o build/$(1)_x86.out $(1).cpp $(CPP_X86) $(CPPFLAGS_X86) -o build/$(1)_x86.out $(1).cpp
execstack -s build/$(1)_x86.out execstack -s build/$(1)_x86.out
endef endef
...@@ -48,7 +54,7 @@ endef ...@@ -48,7 +54,7 @@ endef
define compile_mips_cpp define compile_mips_cpp
@echo "Compiling mips target:" $(1) @echo "Compiling mips target:" $(1)
$(CPP_MIPS) $(CFLAGS_MIPS) -o build/$(1)_mips.out $(1).cpp $(CPP_MIPS) $(CPPFLAGS_MIPS) -o build/$(1)_mips.out $(1).cpp
execstack -s build/$(1)_mips.out execstack -s build/$(1)_mips.out
endef endef
...@@ -60,7 +66,7 @@ endef ...@@ -60,7 +66,7 @@ endef
define compile_arm_cpp define compile_arm_cpp
@echo "Compiling arm target:" $(1) @echo "Compiling arm target:" $(1)
$(CPP_ARM) $(CFLAGS_ARM) -o build/$(1)_arm.out $(1).cpp $(CPP_ARM) $(CPPFLAGS_ARM) -o build/$(1)_arm.out $(1).cpp
execstack -s build/$(1)_arm.out execstack -s build/$(1)_arm.out
endef endef
...@@ -72,7 +78,7 @@ endef ...@@ -72,7 +78,7 @@ endef
define compile_ppc_cpp define compile_ppc_cpp
@echo "Compiling ppc target:" $(1) @echo "Compiling ppc target:" $(1)
$(CPP_PPC) $(CFLAGS_PPC) -o build/$(1)_ppc.out $(1).cpp $(CPP_PPC) $(CPPFLAGS_PPC) -o build/$(1)_ppc.out $(1).cpp
execstack -s build/$(1)_ppc.out execstack -s build/$(1)_ppc.out
endef endef
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment