scan-build: support taint filtering

Support scan-build's taint filtering logic. Adds a yaml config to mark
a dedicated debug validation function as filtering a taint.

Use to suppress warnings in reference, threshold and classification file
handling.

Ticket: #3153.

.github/workflows/scan-build.yml

@@ -153,6 +153,8 @@ jobs:
                 -enable-checker unix.cstring.NotNullTerminated \
                 -enable-checker unix.cstring.NullArg \
                 \
+                -analyzer-config optin.taint.TaintPropagation:Config="$(pwd)/qa/sb-taint-config.yaml" \
+                \
                 make
         env:
           CC: clang-22

qa/sb-taint-config.yaml

@@ -0,0 +1,12 @@
+# taint yaml for scan-build, to be loaded as
+# `-analyzer-config optin.taint.TaintPropagation:Config=../qa/sb-taint-config.yaml`
+#
+# See further:
+# https://rocm.docs.amd.com/projects/llvm-project/en/latest/LLVM/clang/html/analyzer/user-docs/TaintAnalysisConfiguration.html
+# https://clang.llvm.org/docs/analyzer/checkers.html#optin-taint-generictaint
+#
+# Generic no-op to signal to scan-build a taint source as sanitized
+# (i.e. not to be propagated)
+Filters:
+  - Name: ScanBuildMarkSanitized
+    Args: [0]

src/suricata-common.h

@@ -45,6 +45,11 @@ extern "C"
 /* clang analyzer acts as DEBUG_VALIDATION in some places, so
  * force this so #ifdef DEBUG_VALIDATION code gets included */
 #define DEBUG_VALIDATION 1
+
+    /* function prototype to be used to filter taints. To be used
+     * through the DEBUG_VALIDATE_MARK_SANITIZED macro. The scan-build
+     * taint config will then consider this in the taint analysis. */
+    void ScanBuildMarkSanitized(const void *);
 #endif
 
 #if defined(__has_feature)

src/util-classification-config.c

@@ -136,6 +136,7 @@ static FILE *SCClassConfInitContextAndLocalResources(DetectEngineCtx *de_ctx, FI
         }
     }
 
+    DEBUG_VALIDATE_MARK_SANITIZED(fd);
     return fd;
 }
 

src/util-reference-config.c

@@ -126,6 +126,7 @@ static FILE *SCRConfInitContextAndLocalResources(DetectEngineCtx *de_ctx, FILE *
         }
     }
 
+    DEBUG_VALIDATE_MARK_SANITIZED(fd);
     return fd;
 }
 

src/util-threshold-config.c

@@ -187,6 +187,7 @@ int SCThresholdConfInitContext(DetectEngineCtx *de_ctx)
     }
 #endif
 
+    DEBUG_VALIDATE_MARK_SANITIZED(fd);
     if (SCThresholdConfParseFile(de_ctx, fd) < 0) {
         SCLogWarning("Error loading threshold configuration from %s", filename);
         SCThresholdConfDeInitContext(de_ctx, fd);

src/util-validate.h

@@ -94,6 +94,13 @@
 
 #define DEBUG_VALIDATE_BUG_ON(exp) BUG_ON((exp))
 
+#if defined(__clang_analyzer__)
+/* provide guidance to scan-build about taints. */
+#define DEBUG_VALIDATE_MARK_SANITIZED(ptr) ScanBuildMarkSanitized((ptr))
+#else
+#define DEBUG_VALIDATE_MARK_SANITIZED(ptr)
+#endif
+
 #else /* DEBUG_VALIDATE */
 
 #define DEBUG_ASSERT_FLOW_LOCKED(f)
@@ -101,6 +108,8 @@
 #define DEBUG_VALIDATE_PACKET(p)
 #define DEBUG_VALIDATE_BUG_ON(exp)
 
+#define DEBUG_VALIDATE_MARK_SANITIZED(ptr)
+
 #endif /* DEBUG_VALIDATE */
 
 #endif /* SURICATA_UTIL_VALIDATE_H */