Repository navigation
Conversation
Add an `openssl.asan` presubmit CI job that runs the compat layer tests under AddressSanitizer. Unfortunately, ASAN's dlopen() interceptor does not work with the RTLD_DEEPBIND flag that was being used to prevent OpenSSL's internal symbols from resolving to the compat layer's identically-named wrappers. To get around this, the compat layer is now compiled with -fvisibility=hidden. This excludes its symbols from .dynsym entirely, eliminating the need to use RTLD_DEEPBIND and so gives ASAN full coverage of the dlopened OpenSSL libraries. Also added two new tests: a symbol visibility check confirming that compat layer symbols are not dynamically visible (preventing the subtle misresolution bugs that RTLD_DEEPBIND was originally introduced to solve), and a LeakSanitizer canary that verifies leak detection is active. Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
Member
|
would be good to see the ci running somewhere to get an idea of what is being added |
Signed-off-by: Ted Poole <tpoole@redhat.com>
jwendell
reviewed
Nov 3, 2026
| build_openssl_presubmit | ||
| ;; | ||
|
|
||
| openssl.asan) |
Member
There was a problem hiding this comment.
remove this as well. Let's make this pr only touching the openssl bits
Member
|
@tedjpoole since you're re-using this pr, could you please also change title/description to reflect last changes? |
Signed-off-by: Ted Poole <tpoole@redhat.com>
Contributor
Author
|
Replaced by #48972 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an
openssl.asanpresubmit CI job that runs the compat layer tests under AddressSanitizer.Also removed the use of the
RTLD_DEEPBINDflag when loading the OpenSSL shared libraries, because ASAN's dlopen() interceptor does not work with it. Instead, the compatibility layer is now compiled with the-fvisibility=hiddenflag, which excludes its symbols from .dynsym entirely, eliminating the need to useRTLD_DEEPBINDand so gives ASAN full coverage of the OpenSSL shared libraries.Also added two new tests: a symbol visibility check confirming that compat layer symbols are not dynamically visible (preventing the subtle misresolution bugs that RTLD_DEEPBIND was originally introduced to solve), and a LeakSanitizer canary that verifies leak detection is active.