Merge branch 'tmp-werror' into 'master'

Introduce a -Werror build

See merge request openconnect/ocserv!148

.gitlab-ci.yml

@@ -206,7 +206,7 @@ Coverity:
   - tar xfz /tmp/coverity_tool.tgz
   - git submodule update --init
   - autoreconf -fvi
-  - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests --with-werror
+  - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests
   - cov-analysis-linux64-*/bin/cov-build --dir cov-int make -j$JOBS
   - tar cfz cov-int.tar.gz cov-int
   - curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
@@ -231,7 +231,7 @@ Fedora:
   - chmod -R o-w tests/data/raddb
   - git submodule update --init
   - autoreconf -fvi
-  - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests --with-werror --enable-code-coverage --enable-kerberos-tests --enable-oidc-auth
+  - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests --enable-code-coverage --enable-kerberos-tests --enable-oidc-auth
   - make -j$JOBS
   - make check -j$JOBS COVERAGE=1
   - make files-update
@@ -324,9 +324,10 @@ ubsan/Fedora:
   - chmod -R o-w tests/data/raddb
   - git submodule update --init
   - autoreconf -fvi
-  - CFLAGS="-fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2" ./configure --without-docker-tests
+  - export UBCFLAGS="-Wall -Wextra -fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2 -Werror"
+  - CFLAGS="$UBCFLAGS" ./configure --without-docker-tests
   - make -j$JOBS
-  - make check -j$JOBS
+  - make check -j$JOBS CFLAGS="$UBCFLAGS -Wno-unused-function -Wno-unused-parameter"
   tags:
   - shared
   - linux

configure.ac

@@ -323,8 +323,16 @@ fi
 
 gl_INIT
 
+AC_CHECK_HEADERS([net/if_tun.h linux/if_tun.h netinet/in_systm.h crypt.h], [], [], [])
+
+if test "$ac_cv_header_crypt_h" = yes;then
+	crypt_header="crypt.h"
+else
+	crypt_header="unistd.h"
+fi
+
 AC_LIB_HAVE_LINKFLAGS(crypt,, [#define _XOPEN_SOURCE
-#include <unistd.h>], [crypt(0,0);])
+#include <${crypt_header}>], [crypt(0,0);])
 
 AC_ARG_WITH(utmp,
   AS_HELP_STRING([--without-utmp], [do not use libutil for utmp support]),
@@ -358,8 +366,6 @@ AC_CHECK_MEMBER([struct sockaddr.sa_len],
 #include <sys/socket.h>
 ])
 
-AC_CHECK_HEADERS([net/if_tun.h linux/if_tun.h netinet/in_systm.h crypt.h], [], [], [])
-
 AC_CHECK_FUNCS([setproctitle vasprintf clock_gettime isatty pselect ppoll getpeereid sigaltstack])
 AC_CHECK_FUNCS([strlcpy posix_memalign malloc_trim strsep])
 

src/main-ban.c

@@ -255,6 +255,8 @@ unsigned check_if_banned(main_server_st *s, struct sockaddr_storage *addr, sockl
 	if (db == NULL || GETCONFIG(s)->max_ban_score == 0)
 		return 0;
 
+	(void)(txt);
+
 	in_size = SA_IN_SIZE(addr_size);
 	if (in_size != 4 && in_size != 16) {
 	    	mslog(s, NULL, LOG_ERR, "unknown address type for %s", human_addr2((struct sockaddr*)addr, addr_size, txt, sizeof(txt), 0));

src/str.c

@@ -174,7 +174,8 @@ int str_replace_str(str_st *str, const str_rep_tab *tab)
 	unsigned length;
 	char *final;
 	unsigned final_len;
-	int ret, pos;
+	int ret;
+	size_t pos;
 
 	p = str->data;
 	pos = 0;

src/tlslib.c

@@ -430,6 +430,8 @@ static void tls_audit_log_func(gnutls_session_t session, const char *str)
 {
 	worker_st * ws;
 
+	(void)(ws);
+
 	if (session == NULL)
 		syslog(LOG_AUTH, "warning: %s", str);
 	else {
@@ -568,6 +570,8 @@ static void certificate_check(main_server_st *s, const char *vhostname, gnutls_p
 	const char *cert_name = "unnamed";
 	time_t t;
 
+	(void)cert_name;
+
 	ret = gnutls_x509_crt_init(&crt);
 	GNUTLS_FATAL_ERR(ret);
 

src/vpn.h

@@ -268,7 +268,7 @@ struct cfg_st {
 	unsigned rekey_method; /* REKEY_METHOD_ */
 
 	time_t min_reauth_time;	/* after a failed auth, how soon one can reauthenticate -> in seconds */
-	int max_ban_score;	/* the score allowed before a user is banned (see vpn.h) */
+	unsigned max_ban_score;	/* the score allowed before a user is banned (see vpn.h) */
 	int ban_reset_time;
 
 	unsigned ban_points_wrong_password;

src/worker-privs.c

@@ -40,6 +40,9 @@
 # endif
 #endif
 
+/* On certain cases gnulib defines gettimeofday as macro; avoid that */
+#undef gettimeofday
+
 int disable_system_calls(struct worker_st *ws)
 {
 	int ret;

src/worker-proxyproto.c

@@ -70,7 +70,7 @@ typedef struct pp2_tlv_ssl {
 	uint32_t verify;
 } _ATTR_PACKED pp2_tlv_ssl;
 
-static void parse_ssl_tlvs(struct worker_st *ws, uint8_t *data, int data_size)
+static void parse_ssl_tlvs(struct worker_st *ws, uint8_t *data, size_t data_size)
 {
 	pp2_tlv tlv;
 
@@ -272,7 +272,7 @@ static int parse_proxy_proto_header_v1(struct worker_st *ws, char *line)
 int parse_proxy_proto_header(struct worker_st *ws, int fd)
 {
 	proxy_hdr_v2 hdr;
-	int data_size;
+	size_t data_size;
 	uint8_t cmd, family, proto;
 	uint8_t ver;
 	uint8_t *p;

tests/generate_oidc_test_data.c

@@ -266,7 +266,8 @@ int main(int argc, char **argv)
 	if (!getcwd(working_directory, sizeof(working_directory))) {
 		return 1;
 	}
-	strncat(working_directory, "/data", sizeof(working_directory));
+	strncat(working_directory, "/data", sizeof(working_directory)-1);
+	working_directory[sizeof(working_directory)-1] = 0;
 
 	cjose_jwk_t *key = create_key("My Fake Key");
 

tests/ipv6-prefix.c

@@ -23,18 +23,17 @@
 #include "../src/ip-util.h"
 #include "../src/ip-util.c"
 
-static char* my_ipv6_prefix_to_mask(const char *str, unsigned prefix)
+static char* my_ipv6_prefix_to_mask(char str[MAX_IP_STR], unsigned prefix)
 {
 	struct in6_addr in;
-	static char out[64];
 
 	if (ipv6_prefix_to_mask(&in, prefix) == 0)
 		return NULL;
 
-	if (inet_ntop(AF_INET6, &in, out, sizeof(out)) == NULL)
+	if (inet_ntop(AF_INET6, &in, str, MAX_IP_STR) == NULL)
 		return NULL;
 
-	return out;
+	return str;
 }
 
 int main()