Skip to content

add cbor to the fuzzer, and fix a few issues it found #8540

add cbor to the fuzzer, and fix a few issues it found

add cbor to the fuzzer, and fix a few issues it found #8540

Workflow file for this run

name: CI DEB
on:
push:
branches-ignore:
- coverity_scan
- run-fuzzer**
- debug-fuzzer-**
schedule:
- cron: '0 20 * * *'
env:
DEBIAN_FRONTEND: noninteractive
jobs:
#
# We don't want to consume many workers on each push so we only build the
# full suite of distros during the scheduled or ci-debug run and just the
# "bleeding-edge" distro on each push.
#
# This job builds the matrix based on the event that trigger this run which
# the next job consumes.
#
set-matrix:
name: Setup build matrix
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
steps:
- id: set-matrix
name: Setup the matrix
run: |
if [ "$GITHUB_EVENT_NAME" = "schedule" -o "$GITHUB_REF" = "refs/heads/ci-debug" ]; then
M=$(cat <<EOF
{
"env": [
{ "NAME": "ubuntu-22.04", "OS": "ubuntu:22.04" },
{ "NAME": "ubuntu-24.04", "OS": "ubuntu:24.04" },
{ "NAME": "debian-12", "OS": "debian:bookworm" },
{ "NAME": "debian-sid", "OS": "debian:sid" }
]
}
EOF
)
else
M=$(cat <<EOF
{
"env": [
{ "NAME": "debian-12", "OS": "debian:bookworm" }
]
}
EOF
)
fi
echo matrix=$M >> $GITHUB_OUTPUT
deb-build:
needs:
- set-matrix
strategy:
matrix: ${{ fromJson(needs.set-matrix.outputs.matrix) }}
fail-fast: false
runs-on: ubuntu-latest
container:
image: ${{ matrix.env.OS }}
env:
HOSTAPD_BUILD_DIR: /tmp/eapol_test.ci
HOSTAPD_GIT_TAG: hostap_2_11
name: "DEB build"
steps:
- name: Package manager performance and stability improvements
run: |
if [ -f "/etc/apt/sources.list" ]; then
sed -i 's/deb.debian.org/debian-archive.trafficmanager.net/' /etc/apt/sources.list
sed -i 's/archive.ubuntu.com/azure.archive.ubuntu.com/' /etc/apt/sources.list
fi
echo 'Acquire::Retries "10";' > /etc/apt/apt.conf.d/80-retries
echo 'force-unsafe-io' > /etc/dpkg/dpkg.cfg.d/02speedup
echo 'man-db man-db/auto-update boolean false' | debconf-set-selections
apt-get update
#
# Required so that the checkout action uses git protocol rather than the GitHub REST API.
# make rpm requires the FR directory to be a git repository.
#
- name: Install recent git
run: |
apt-get install -y --no-install-recommends git-core ca-certificates
- name: Install build tools
run: |
apt-get install -y --no-install-recommends make gcc libc6-dev equivs file curl gnupg2 lsb-release
- name: NetworkRADIUS signing key
run: curl -sS https://packages.inkbridgenetworks.com/pgp/packages%40networkradius.com | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=yes apt-key add -
- name: Set up NetworkRADIUS extras repository
run: |
DIST=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
RELEASE=$(lsb_release -cs)
if [ "$RELEASE" = "n/a" ]; then
RELEASE=$(cat /etc/debian_version | awk -F \/ '{ print $(NF) }')
fi
[ "$RELEASE" != "trixie" ] || RELEASE=sid
echo "deb http://packages.networkradius.com/extras/${DIST}/${RELEASE} ${RELEASE} main" \
> /etc/apt/sources.list.d/networkradius-extras.list
- name: Update apt repository lists
run: apt-get update
- uses: actions/checkout@v4
with:
path: freeradius
- name: Install build dependencies
run: |
apt-get install -y --no-install-recommends build-essential devscripts quilt fakeroot
debian/rules debian/control
mk-build-deps -irt"apt-get -y" debian/control
working-directory: freeradius
- name: Build DEBs
run: |
make deb
working-directory: freeradius
- name: Collect DEBs
run: |
mkdir debs
mv *.deb debs
- name: Restore eapol_test build directory from cache
uses: actions/cache@v4
id: hostapd-cache
with:
path: ${{ env.HOSTAPD_BUILD_DIR }}
key: hostapd-${{ matrix.env.NAME }}-${{ env.HOSTAPD_GIT_TAG }}-v1
# Build eapol_test using a minimal make environment to avoid configuring
- name: Build eapol_test
run: |
apt-get install -y libnl-3-dev libnl-genl-3-dev
scripts/ci/eapol_test-build.sh
mv scripts/ci/eapol_test/eapol_test ../debs
working-directory: freeradius
- name: Store DEBs
uses: actions/upload-artifact@v4
with:
name: debs-${{ matrix.env.NAME }}
path: debs
retention-days: 1
#
# If the CI has failed and the branch is ci-debug then start a tmate
# session. SSH rendezvous point is emited continuously in the job output.
#
- name: "Debug: Package dependancies for tmate"
run: |
apt-get install -y --no-install-recommends xz-utils
if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
- name: "Debug: Start tmate"
uses: mxschmitt/action-tmate@v3
with:
limit-access-to-actor: true
sudo: false
if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
#
# Perform "post-install" testing of the FR packages that we have just built
# in a clean environment consisting of only the base OS and package
# dependancies
#
deb-test:
needs:
- set-matrix
- deb-build
strategy:
matrix: ${{ fromJson(needs.set-matrix.outputs.matrix) }}
fail-fast: false
runs-on: ubuntu-latest
container:
image: ${{ matrix.env.OS }}
name: "DEB install test"
steps:
- name: Load DEBs
uses: actions/download-artifact@v4
with:
name: debs-${{ matrix.env.NAME }}
- name: Package manager performance and stability improvements
run: |
if [ -f "/etc/apt/sources.list" ]; then
sed -i 's/deb.debian.org/debian-archive.trafficmanager.net/' /etc/apt/sources.list
sed -i 's/archive.ubuntu.com/azure.archive.ubuntu.com/' /etc/apt/sources.list
fi
echo 'Acquire::Retries "10";' > /etc/apt/apt.conf.d/80-retries
echo 'force-unsafe-io' > /etc/dpkg/dpkg.cfg.d/02speedup
echo 'man-db man-db/auto-update boolean false' | debconf-set-selections
apt-get update
# procps for pkill, curl+gnupg2 for apt-key, ca-certificates for curl
- name: Install system utilities
run: |
apt-get install -y --no-install-recommends procps curl gnupg2 ca-certificates lsb-release
- name: NetworkRADIUS signing key
run: curl -sS https://packages.inkbridgenetworks.com/pgp/packages%40networkradius.com | APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=yes apt-key add -
- name: Set up NetworkRADIUS extras repository
run: |
DIST=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
RELEASE=$(lsb_release -cs)
if [ "$RELEASE" = "n/a" ]; then
RELEASE=$(cat /etc/debian_version | awk -F \/ '{ print $(NF) }')
fi
[ "$RELEASE" != "trixie" ] || RELEASE=sid
echo "deb http://packages.networkradius.com/extras/${DIST}/${RELEASE} ${RELEASE} main" \
> /etc/apt/sources.list.d/networkradius-extras.list
- name: Update apt repository lists
run: apt-get update
- name: Install DEBs
run: |
find . -maxdepth 1 -name '*.deb' | xargs apt-get install -y --no-install-recommends
- name: Config test
run: |
freeradius -XC
#
# We now perform some post-install tests that depend on the availability
# of the source tree
#
- name: Install pre-built eapol_test
run: |
apt-get install -y libssl1.? libdbus-1-? libnl-3-200 libnl-genl-3-200
mv eapol_test /usr/local/bin
chmod +x /usr/local/bin/eapol_test
- uses: actions/checkout@v4
with:
path: freeradius
- name: Run the post-install test target
run: |
make -C raddb/certs
touch Make.inc
mkdir -p build/tests/eapol_test
echo "EAPOL_TEST=" $(which eapol_test) > build/tests/eapol_test/eapol_test.mk
make -f scripts/ci/package-test.mk package-test
working-directory: freeradius
- name: Upload radius logs on failure
if: ${{ failure() }}
uses: actions/upload-artifact@v4
with:
name: radius-logs-${{ matrix.env.NAME }}
path: |
/var/log/freeradius
freeradius/build/tests/eapol_test
retention-days: 30
#
# See above comments for tmate
#
- name: "Debug: Package dependancies for tmate"
run: |
apt-get install -y --no-install-recommends xz-utils
if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
- name: "Debug: Start tmate"
uses: mxschmitt/action-tmate@v3
with:
limit-access-to-actor: true
sudo: false
if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}