Add sanitizer CI job

.builder/actions/build_samples.py

@@ -71,6 +71,8 @@ def run(self, env):
                           '-DCMAKE_BUILD_TYPE=RelWithDebInfo'])
             # append extra cmake configs
             steps[-1].extend(cmd_args.cmake_extra)
+            if sys.platform == "linux" or sys.platform == "linux2":
+                steps[-1].extend(env.config['cmake_args'])
             steps.append(['cmake',
                           '--build', build_path,
                           '--config', 'RelWithDebInfo'])
@@ -84,6 +86,8 @@ def run(self, env):
                           '-DCMAKE_BUILD_TYPE=RelWithDebInfo'])
             # append extra cmake configs
             steps[-1].extend(cmd_args.cmake_extra)
+            if sys.platform == "linux" or sys.platform == "linux2":
+                steps[-1].extend(env.config['cmake_args'])
             steps.append(['cmake',
                           '--build', build_path,
                           '--config', 'RelWithDebInfo'])
@@ -97,6 +101,8 @@ def run(self, env):
                           '-DCMAKE_BUILD_TYPE=RelWithDebInfo'])
             # append extra cmake configs
             steps[-1].extend(cmd_args.cmake_extra)
+            if sys.platform == "linux" or sys.platform == "linux2":
+                steps[-1].extend(env.config['cmake_args'])
             steps.append(['cmake',
                           '--build', build_path,
                           '--config', 'RelWithDebInfo'])
@@ -108,6 +114,8 @@ def run(self, env):
                           f'-H{sample_path}',
                           f'-DCMAKE_PREFIX_PATH={env.install_dir}',
                           '-DCMAKE_BUILD_TYPE=RelWithDebInfo'])
+            if sys.platform == "linux" or sys.platform == "linux2":
+                steps[-1].extend(env.config['cmake_args'])
             steps.append(['cmake',
                           '--build', build_path,
                           '--config', 'RelWithDebInfo'])

.github/workflows/ci.yml

@@ -747,3 +747,234 @@ jobs:
       - name: Check for edits to code-generated files
         run: |
           ./utils/check_codegen_edits.py
+
+  clang-sanitizers:
+    runs-on: ubuntu-22.04 # latest
+    continue-on-error: true  # TODO temporary for debugging purpose
+    strategy:
+      fail-fast: false  # TODO temporary for debugging purpose
+      matrix:
+        sanitizer-variants: ["tsan", "asan"]
+    permissions:
+      id-token: write # This is required for requesting the JWT
+    steps:
+      - name: Build ${{ env.PACKAGE_NAME }} + consumers
+        run: |
+          echo "Downloading source"
+          git clone --recursive https://github.com/aws/aws-iot-device-sdk-cpp-v2.git --branch ${{ env.HEAD_REF || github.ref_name }}
+          echo "Running builder"
+          python -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder.pyz')"
+          python builder.pyz build -p ${{ env.PACKAGE_NAME }} --variant ${{ matrix.sanitizer-variants }}
+      - name: Running samples in CI setup
+        run: |
+          python3 -m pip install boto3
+          sudo apt-get update -y
+          sudo apt-get install softhsm -y
+          softhsm2-util --version
+      - name: configure AWS credentials (Fleet provisioning)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_FLEET_PROVISIONING_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run Fleet Provisioning service client test for MQTT311
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt3_fleet_provisioning_cfg.json --thing-name-prefix Fleet_Thing_
+      - name: run Fleet Provisioning service client test for MQTT5
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt5_fleet_provisioning_cfg.json --thing-name-prefix Fleet_Thing_
+      - name: run Fleet Provisioning with CSR service client test for MQTT311
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt3_fleet_provisioning_with_csr_cfg.json --thing-name-prefix Fleet_Thing_
+      - name: run Fleet Provisioning with CSR service client test for MQTT5
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_fleet_provisioning.py --config-file test_cases/mqtt5_fleet_provisioning_with_csr_cfg.json --thing-name-prefix Fleet_Thing_
+      - name: configure AWS credentials (Jobs)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_JOBS_SERVICE_CLIENT_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run mqtt3 Jobs serviceTests
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_jobs_execution.py --config-file ${{ env.CI_SERVICE_TESTS_CFG_FOLDER }}/mqtt3_jobs_cfg.json
+      - name: run mqtt5 Jobs serviceTests
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_jobs_execution.py --config-file ${{ env.CI_SERVICE_TESTS_CFG_FOLDER }}/mqtt5_jobs_cfg.json
+      - name: configure AWS credentials (Shadow)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_SHADOW_SERVICE_CLIENT_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run Shadow service client test for MQTT5
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt5_shadow_cfg.json
+      - name: run Shadow service client test for MQTT311
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt3_shadow_cfg.json
+      - name: run Named Shadow service client test for MQTT311
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt3_named_shadow_cfg.json
+      - name: run Named Shadow service client test for MQTT5
+        if: always()
+        working-directory: ./aws-iot-device-sdk-cpp-v2/servicetests
+        run: |
+          export PYTHONPATH=${{ github.workspace }}/aws-iot-device-sdk-cpp-v2/utils
+          python3 ./test_cases/test_shadow_update.py --config-file test_cases/mqtt5_named_shadow_cfg.json
+      - name: configure AWS credentials (Connect and PubSub)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_PUBSUB_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run Basic Connect sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_basic_connect_cfg.json
+      - name: run Websocket Connect sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_websocket_connect_cfg.json
+      - name: run MQTT3 PubSub sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_pubsub_cfg.json
+      - name: run PKCS11 Connect sample
+        if: always()
+        run: |
+          mkdir -p /tmp/tokens
+          export SOFTHSM2_CONF=/tmp/softhsm2.conf
+          echo "directories.tokendir = /tmp/tokens" > /tmp/softhsm2.conf
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_pkcs11_connect_cfg.json
+      - name: configure AWS credentials (MQTT5)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_MQTT5_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run MQTT5 PubSub sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_pubsub_cfg.json
+      - name: run MQTT5 Shared Subscription sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_mqtt5_shared_subscription_cfg.json
+      - name: configure AWS credentials (Jobs)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_JOBS_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run Jobs sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_jobs_cfg.json
+      - name: run Mqtt5 Jobs sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_jobs_mqtt5_cfg.json
+      - name: configure AWS credentials (Cognito)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_COGNITO_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run CognitoConnect sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_cognito_connect_cfg.json
+      - name: configure AWS credentials (Custom Authorizer)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_CUSTOM_AUTHORIZER_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run CustomAuthorizerConnect sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_custom_authorizer_connect_cfg.json
+      - name: configure AWS credentials (Shadow)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_SHADOW_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run Shadow sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_shadow_cfg.json
+      - name: run Mqtt5 Shadow sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_shadow_mqtt5_cfg.json
+      - name: configure AWS credentials (Fleet provisioning)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_FLEET_PROVISIONING_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run Fleet Provisioning sample
+        if: always()
+        run: |
+          echo "Generating UUID for IoT thing"
+          Sample_UUID=$(python3  -c "import uuid; print (uuid.uuid4())")
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_fleet_provisioning_cfg.json --input_uuid ${Sample_UUID}
+          python3 ${{ env.CI_UTILS_FOLDER }}/delete_iot_thing_ci.py --thing_name "Fleet_Thing_${Sample_UUID}" --region "us-east-1"
+      - name: run Mqtt5 Fleet Provisioning sample
+        if: always()
+        run: |
+          echo "Generating UUID for IoT thing"
+          Sample_UUID=$(python3  -c "import uuid; print (uuid.uuid4())")
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_fleet_provisioning_mqtt5_cfg.json --input_uuid ${Sample_UUID}
+          python3 ${{ env.CI_UTILS_FOLDER }}/delete_iot_thing_ci.py --thing_name "Fleet_Thing_${Sample_UUID}" --region "us-east-1"
+      - name: configure AWS credentials (Secure tunneling)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_SECURE_TUNNEL }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      # Secure Tunneling has special requirements, so it uses a different Python file
+      - name: run Secure Tunneling sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_secure_tunnel_ci.py --sample_file "./aws-iot-device-sdk-cpp-v2/build/samples/secure_tunneling/secure_tunnel/secure-tunnel" --sample_region ${{ env.AWS_DEFAULT_REGION }}
+      - name: configure AWS credentials (X509)
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.CI_X509_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+      - name: run X509 sample
+        if: always()
+        run: |
+          python3 ${{ env.CI_UTILS_FOLDER }}/run_sample_ci.py --file ${{ env.CI_SAMPLES_CFG_FOLDER }}/ci_run_x509_connect_cfg.json
+      # TODO Add GG tests.

CMakeLists.txt

@@ -98,6 +98,8 @@ else()
     include(AwsFindPackage)
 endif()
 
+include(AwsSanitizers)
+
 aws_use_package(aws-crt-cpp)
 
 add_subdirectory(jobs)

builder.json

@@ -29,6 +29,18 @@
           "build"
         ]
     },
+    "tsan": {
+      "cmake_args": [
+        "-DENABLE_SANITIZERS=ON",
+        "-DSANITIZERS=thread"
+      ]
+    },
+    "asan": {
+      "cmake_args": [
+        "-DENABLE_SANITIZERS=ON",
+        "-DSANITIZERS=address,undefined"
+      ]
+    },
     "build_gg_samples_only": {
         "!build_steps": [
           "build",

devicedefender/CMakeLists.txt

@@ -102,7 +102,9 @@ if (BUILD_DEPS)
     endif()
 endif()
 
-target_link_libraries(IotDeviceDefender-cpp IotDeviceCommon-cpp)
+aws_add_sanitizers(IotDeviceDefender-cpp)
+
+target_link_libraries(IotDeviceDefender-cpp PUBLIC IotDeviceCommon-cpp)
 
 install(FILES ${AWS_IOTDEVICEDEFENDER_HEADERS} DESTINATION "include/aws/iotdevicedefender/" COMPONENT Development)
 

devicedefender/tests/CMakeLists.txt

@@ -19,4 +19,5 @@ if (UNIX AND NOT APPLE)
     add_net_test_case(Mqtt5DeviceDefenderCustomMetricSuccess)
     add_net_test_case(Mqtt5DeviceDefenderCustomMetricFail)
     generate_cpp_test_driver(${TEST_BINARY_NAME})
+    aws_add_sanitizers(${TEST_BINARY_NAME})
 endif()

discovery/CMakeLists.txt

@@ -101,7 +101,8 @@ if (BUILD_DEPS)
 	endif()
 endif()
 
-target_link_libraries(Discovery-cpp ${DEP_AWS_LIBS})
+aws_add_sanitizers(Discovery-cpp)
+target_link_libraries(Discovery-cpp PUBLIC ${DEP_AWS_LIBS})
 
 install(FILES ${AWS_DISCOVERY_HEADERS} DESTINATION "include/aws/discovery/" COMPONENT Development)
 

eventstream_rpc/CMakeLists.txt

@@ -99,8 +99,8 @@ if (NOT IS_SUBDIRECTORY_INCLUDE)
     aws_use_package(aws-crt-cpp)
 endif()
 
-
-target_link_libraries(EventstreamRpc-cpp ${DEP_AWS_LIBS})
+aws_add_sanitizers(EventstreamRpc-cpp)
+target_link_libraries(EventstreamRpc-cpp PUBLIC ${DEP_AWS_LIBS})
 
 install(FILES ${AWS_EVENTSTREAMRPC_HEADERS} DESTINATION "include/aws/eventstreamrpc/" COMPONENT Development)
 

eventstream_rpc/tests/CMakeLists.txt

@@ -47,6 +47,7 @@ add_test_case(OperateWhileDisconnected)
 #add_test_case(EchoOperation)
 #add_test_case(StressTestClient)
 generate_cpp_test_driver(${TEST_BINARY_NAME})
+aws_add_sanitizers(${TEST_BINARY_NAME})
 target_include_directories(${TEST_BINARY_NAME} PUBLIC
     $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
     $<INSTALL_INTERFACE:include>)

greengrass_ipc/CMakeLists.txt

@@ -47,7 +47,7 @@ if (WIN32)
 endif()
 
 add_library(GreengrassIpc-cpp ${AWS_GREENGRASSIPC_CPP_SRC})
-target_link_libraries(GreengrassIpc-cpp EventstreamRpc-cpp)
+target_link_libraries(GreengrassIpc-cpp PUBLIC EventstreamRpc-cpp)
 
 set_target_properties(GreengrassIpc-cpp PROPERTIES LINKER_LANGUAGE CXX)
 
@@ -107,8 +107,8 @@ if (NOT IS_SUBDIRECTORY_INCLUDE)
     aws_use_package(aws-crt-cpp)
 endif()
 
-
-target_link_libraries(GreengrassIpc-cpp ${DEP_AWS_LIBS})
+aws_add_sanitizers(GreengrassIpc-cpp)
+target_link_libraries(GreengrassIpc-cpp PUBLIC ${DEP_AWS_LIBS})
 
 install(FILES ${AWS_GREENGRASSIPC_HEADERS} DESTINATION "include/aws/greengrass/" COMPONENT Development)
 

identity/CMakeLists.txt

@@ -103,7 +103,8 @@ if (BUILD_DEPS)
     endif()
 endif()
 
-target_link_libraries(IotIdentity-cpp ${DEP_AWS_LIBS})
+aws_add_sanitizers(IotIdentity-cpp)
+target_link_libraries(IotIdentity-cpp PUBLIC ${DEP_AWS_LIBS})
 
 install(FILES ${AWS_IOTIDENTITY_HEADERS} DESTINATION "include/aws/iotidentity/" COMPONENT Development)
 

iotdevicecommon/CMakeLists.txt

@@ -104,7 +104,9 @@ if (BUILD_DEPS)
 	aws_use_package(aws-c-iot)
 endif()
 
-target_link_libraries(IotDeviceCommon-cpp ${DEP_AWS_LIBS})
+aws_add_sanitizers(IotDeviceCommon-cpp)
+
+target_link_libraries(IotDeviceCommon-cpp PUBLIC ${DEP_AWS_LIBS})
 
 install(FILES ${AWS_IOTDEVICECOMMON_HEADERS} DESTINATION "include/aws/iotdevicecommon/" COMPONENT Development)
 

jobs/CMakeLists.txt

@@ -103,7 +103,9 @@ if (BUILD_DEPS)
     endif()
 endif()
 
-target_link_libraries(IotJobs-cpp ${DEP_AWS_LIBS})
+aws_add_sanitizers(IotJobs-cpp)
+
+target_link_libraries(IotJobs-cpp PUBLIC ${DEP_AWS_LIBS})
 
 install(FILES ${AWS_IOTJOBS_HEADERS} DESTINATION "include/aws/iotjobs/" COMPONENT Development)