Source Code Analysis Laboratory (SCALe) for Energy ... - CERT

Figure 3: Source Code Analysis Labboratory
The SCALe laboratory environmeent
consists of two servers running VMware ESX hypervvisors.
These are supported by a large stoorage
area network (SAN) with redundant storage and baackup
capabilities. The two ESX serverss
support a collection of virtual machines (VMs) that cann
be configured
to support analysis in variious
environments, such as Windows XP and Linux. A VVMware
vCenter Server provides control oover
the virtual environment.
The VMs are connected by a segmmented-off
network and to a file server running Samba and
NFS.
The Windows VMs can be remotely
accessed from within the CERT network by using Reemote
Desktop Protocol (RDP) and the LLinux
VMs by using Secure Shell (SSH). The machines are oth-
erwise disconnected from the inteernet.
Source code being analyzed is coppied
onto the file server, where it is available to all the annalysis
VMs. Analyzers and other tools aare
installed through a similar process or by using vCenteer.
2.3 Conformance Testing Proocess
Figure 4 illustrates the SCALe coonformance
testing process. The client provides the softwware
con-
taining the code for analysis. Thiss
software must build properly in its build environment, ssuch
as
Microsoft Windows/Visual Studioo
or Linux/GCC. It may produce compiler warnings but may not
produce fatal errors. If the target operational environment is different than the build envirronment,
the target environment must be fuully
specified, including all implementation-defined behaaviors.
CMU/SEI-2010-TTR-021
| 10