Server version of Hercules

.clang-format

@@ -0,0 +1,6 @@
+---
+BasedOnStyle: Google
+UseTab: Always
+IndentWidth: 4
+TabWidth: 4
+...

.clangd

@@ -0,0 +1,2 @@
+Diagnostics:
+    Suppress: atomic_op_needs_atomic

.fpm

@@ -0,0 +1,6 @@
+-s dir
+--name hercules-server
+--description "Hercules file transfer server"
+--url "https://github.com/netsec-ethz/hercules"
+--maintainer "Network Security Group, ETH Zuerich"
+-C pkgroot

.gitignore

@@ -1,4 +1,12 @@
 bpf_prgm/*.ll
 bpf_prgm/*.o
-hercules
+hercules-server
+hercules-monitor
+*.o
+*.d
+monitor/monitor
 mockules/mockules
+pkgroot
+*.deb
+*.rpm
+*.tar

.gitmodules

@@ -1,4 +1,7 @@
-[submodule "bpf"]
-	path = bpf
-	url = https://github.com/libbpf/libbpf/
+[submodule "xdp-tools"]
+	path = xdp-tools
+	url = https://github.com/xdp-project/xdp-tools.git
+[submodule "tomlc99"]
+	path = tomlc99
+	url = https://github.com/cktan/tomlc99.git
 	ignore = untracked

Dockerfile

@@ -1,4 +1,4 @@
-# ubuntu/focal with go-1.21.6
+# ubuntu/focal with go-1.22.8
 # copy pasted from
 # https://github.com/docker-library/golang/blob/master/1.21/bullseye/Dockerfile
 # but with a different base image (ubuntu:focal instead of debian:bullseye)
@@ -7,6 +7,10 @@ FROM ubuntu:focal
 ARG UID=1001
 ARG GID=1001
 
+# to avoid interactive timezone query
+ENV TZ Europe/Zürich
+ENV DEBIAN_FRONTEND noninteractive
+
 # install cgo-related dependencies
 RUN set -eux; \
 	apt-get update; \
@@ -25,54 +29,34 @@ RUN set -eux; \
 		gpg \
 		gpg-agent \
 		dirmngr \
-		clang \
+		clang-12 \
 		llvm \
 		libelf-dev \
 		libpcap-dev \
 		gcc-multilib \
 		build-essential \
+        ruby \
+        rpm \
+        m4 \
 	; \
 	rm -rf /var/lib/apt/lists/*
 
 ENV PATH /usr/local/go/bin:$PATH
 
-ENV GOLANG_VERSION 1.21.6
+RUN ln -s /usr/bin/clang-12 /usr/bin/clang
+
+RUN gem install dotenv -v 2.8.1
+RUN gem install fpm
+
+ENV GOLANG_VERSION 1.22.8
 
 RUN set -eux; \
 	arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
 	url=; \
 	case "$arch" in \
 		'amd64') \
-			url='https://dl.google.com/go/go1.21.6.linux-amd64.tar.gz'; \
-			sha256='3f934f40ac360b9c01f616a9aa1796d227d8b0328bf64cb045c7b8c4ee9caea4'; \
-			;; \
-		'armhf') \
-			url='https://dl.google.com/go/go1.21.6.linux-armv6l.tar.gz'; \
-			sha256='6a8eda6cc6a799ff25e74ce0c13fdc1a76c0983a0bb07c789a2a3454bf6ec9b2'; \
-			;; \
-		'arm64') \
-			url='https://dl.google.com/go/go1.21.6.linux-arm64.tar.gz'; \
-			sha256='e2e8aa88e1b5170a0d495d7d9c766af2b2b6c6925a8f8956d834ad6b4cacbd9a'; \
-			;; \
-		'i386') \
-			url='https://dl.google.com/go/go1.21.6.linux-386.tar.gz'; \
-			sha256='05d09041b5a1193c14e4b2db3f7fcc649b236c567f5eb93305c537851b72dd95'; \
-			;; \
-		'mips64el') \
-			url='https://dl.google.com/go/go1.21.6.linux-mips64le.tar.gz'; \
-			sha256='eb309a611dfec52b98805e05bafbe769d3d5966aef05f17ec617c89ee5a9e484'; \
-			;; \
-		'ppc64el') \
-			url='https://dl.google.com/go/go1.21.6.linux-ppc64le.tar.gz'; \
-			sha256='e872b1e9a3f2f08fd4554615a32ca9123a4ba877ab6d19d36abc3424f86bc07f'; \
-			;; \
-		'riscv64') \
-			url='https://dl.google.com/go/go1.21.6.linux-riscv64.tar.gz'; \
-			sha256='86a2fe6597af4b37d98bca632f109034b624786a8d9c1504d340661355ed31f7'; \
-			;; \
-		's390x') \
-			url='https://dl.google.com/go/go1.21.6.linux-s390x.tar.gz'; \
-			sha256='92894d0f732d3379bc414ffdd617eaadad47e1d72610e10d69a1156db03fc052'; \
+			url='https://go.dev/dl/go1.22.8.linux-amd64.tar.gz'; \
+			sha256='5f467d29fc67c7ae6468cb6ad5b047a274bae8180cac5e0b7ddbfeba3e47e18f'; \
 			;; \
 		*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
 	esac; \
@@ -100,6 +84,8 @@ RUN set -eux; \
 # https://github.com/docker-library/golang/issues/472
 ENV GOTOOLCHAIN=local
 
+RUN git config --global --add safe.directory "*"
+
 RUN groupadd --gid $GID --non-unique buildboy
 RUN useradd buildboy --create-home --shell /bin/bash --non-unique --uid $UID --gid $GID
 USER buildboy

Makefile

@@ -1,56 +1,198 @@
-.PHONY: builder builder_image install clean
+TARGET_SERVER := hercules-server
+TARGET_MONITOR := hercules-monitor
+TARGET_HCP := hcp/hcp
 
-all: hercules mockules
+CC := gcc
+CFLAGS = -O3 -g3 -std=gnu11 -D_GNU_SOURCE -Itomlc99 -Ixdp-tools/lib/libbpf/include/uapi -Ixdp-tools/headers
+# CFLAGS += -DNDEBUG
+CFLAGS += -Wall -Wextra
+
+## Options:
+# Print rx/tx session stats
+CFLAGS += -DPRINT_STATS
+# Enforce checking the source SCION/UDP address/port of received packets
+# CFLAGS += -DCHECK_SRC_ADDRESS
+# Randomise the UDP underlay port (no restriction on the range of used ports).
+# Enabling this currently breaks SCMP packet parsing
+# CFLAGS += -DRANDOMIZE_UNDERLAY_SRC
+# Ignore SCMP error messages, just keep sending
+# CFLAGS += -DIGNORE_SCMP
+
+## for debugging:
+# ASAN_FLAG := -fsanitize=address
+# CFLAGS += -g3 -DDEBUG $(ASAN_FLAG)
+#
+# CFLAGS += -DDEBUG_PRINT_PKTS # print received/sent packets (lots of noise!)
+
+
+LDFLAGS = -g3 -l:libxdp.a -l:libbpf.a -Ltomlc99 -lm -lelf -latomic -pthread -lz -ltoml -z noexecstack $(ASAN_FLAG)
+DEPFLAGS := -MP -MD
+
+SRCS := $(wildcard *.c)
+OBJS := $(SRCS:.c=.o)
+DEPS := $(OBJS:.o=.d)
+MONITORFILES := $(wildcard monitor/*)
+HCPFILES := $(filter-out $(TARGET_HCP),$(wildcard hcp/*))
+
+VERSION := $(shell (ref=$$(git describe --tags --long --dirty 2>/dev/null) && echo $$(git rev-parse --abbrev-ref HEAD)-$$ref) ||\
+					echo $$(git rev-parse --abbrev-ref HEAD)-untagged-$$(git describe --tags --dirty --always))
+CFLAGS += -DHERCULES_VERSION="\"$(VERSION)\""
+
+PREFIX ?= /usr/local
+
+.PHONY: all install
+
+all: $(TARGET_MONITOR) $(TARGET_SERVER) $(TARGET_HCP)
 
 install: all
-ifndef DESTDIR
-	$(error DESTDIR is not set)
-endif
-	cp hercules mockules/mockules $(DESTDIR)
+	install -d $(DESTDIR)$(PREFIX)/bin/
+	install $(TARGET_MONITOR) $(DESTDIR)$(PREFIX)/bin/
+	install $(TARGET_SERVER) $(DESTDIR)$(PREFIX)/bin/
+	install $(TARGET_HCP) $(DESTDIR)$(PREFIX)/bin/
 
-hercules: builder hercules.h hercules.go hercules.c bpf_prgm/redirect_userspace.o bpf_prgm/pass.o bpf/src/libbpf.a
+	install -d $(DESTDIR)$(PREFIX)/etc/
+	install hercules.conf $(DESTDIR)$(PREFIX)/etc/
+
+	install -d $(DESTDIR)$(PREFIX)/share/doc/hercules/
+	install hercules.conf.sample $(DESTDIR)$(PREFIX)/share/doc/hercules/
+
+	install -d $(DESTDIR)$(PREFIX)/lib/systemd/system/
+	install dist/hercules-monitor.service $(DESTDIR)$(PREFIX)/lib/systemd/system/
+	install dist/hercules-server.service $(DESTDIR)$(PREFIX)/lib/systemd/system/
+
+	install -d $(DESTDIR)$(PREFIX)/share/man/man1/
+	install doc/hercules-server.1 $(DESTDIR)$(PREFIX)/share/man/man1/
+	install doc/hercules-monitor.1 $(DESTDIR)$(PREFIX)/share/man/man1/
+	install hcp/hcp.1 $(DESTDIR)$(PREFIX)/share/man/man1/
+	install -d $(DESTDIR)$(PREFIX)/share/man/man5/
+	install doc/hercules.conf.5 $(DESTDIR)$(PREFIX)/share/man/man5/
+	install -d $(DESTDIR)$(PREFIX)/share/man/man7/
+	install doc/hercules.7 $(DESTDIR)$(PREFIX)/share/man/man7/
+
+# Hack to allow building both in docker and natively:
+# Prefixing the target with docker_ should use the builder image.
+# e.g., make docker_all
+docker_%: builder
+	docker exec hercules-builder $(MAKE) $*
+
+# List all headers as dependency because we include a header file via cgo (which in turn may include other headers)
+$(TARGET_MONITOR): $(MONITORFILES) $(wildcard *.h)
+	cd monitor && go build -o "../$@" -ldflags "-X main.startupVersion=${VERSION}"
+
+$(TARGET_SERVER): $(OBJS) bpf_prgm/redirect_userspace.o tomlc99/libtoml.a
 	@# update modification dates in assembly, so that the new version gets loaded
-	@sed -i -e "s/\(load bpf_prgm_pass\)\( \)\?\([0-9a-f]\{32\}\)\?/\1 $$(md5sum bpf_prgm/pass.c | head -c 32)/g" bpf_prgms.s
 	@sed -i -e "s/\(load bpf_prgm_redirect_userspace\)\( \)\?\([0-9a-f]\{32\}\)\?/\1 $$(md5sum bpf_prgm/redirect_userspace.c | head -c 32)/g" bpf_prgms.s
-	@taggedRef=$$(git describe --tags --long --dirty 2>/dev/null) && startupVersion=$$(git rev-parse --abbrev-ref HEAD)"-$${taggedRef}" || \
-		startupVersion=$$(git rev-parse --abbrev-ref HEAD)"-untagged-"$$(git describe --tags --dirty --always); \
-	docker exec hercules-builder go build -ldflags "-X main.startupVersion=$${startupVersion}"
+	$(CC) -o $@ $(OBJS) bpf_prgms.s $(LDFLAGS)
+
+$(TARGET_HCP): $(HCPFILES) $(wildcard *.h)
+	cd hcp && go build -ldflags "-X main.startupVersion=${VERSION}"
+
+hcp: $(TARGET_HCP)
 
-bpf_prgm/%.ll: bpf_prgm/%.c builder
-	docker exec hercules-builder clang -S -target bpf -D __BPF_TRACING__ -I. -Wall -O2 -emit-llvm -c -g -o $@ $<
+%.o: %.c
+	$(CC) $(DEPFLAGS) $(CFLAGS) -c $< -o $@
 
-bpf_prgm/%.o: bpf_prgm/%.ll builder
-	docker exec hercules-builder llc -march=bpf -filetype=obj -o $@ $<
+bpf_prgm/%.ll: bpf_prgm/%.c
+	clang -S -target bpf -D __BPF_TRACING__ -I. -Wall -O2 -emit-llvm -c -g -o $@ $<
+
+bpf_prgm/%.o: bpf_prgm/%.ll
+	llc -march=bpf -filetype=obj -o $@ $<
 
 # explicitly list intermediates for dependency resolution
-bpf_prgm/pass.ll:
 bpf_prgm/redirect_userspace.ll:
 
-bpf/src/libbpf.a: builder
-	@if [ ! -d bpf/src ]; then \
-		echo "Error: Need libbpf submodule"; \
+.PHONY: libxdp
+libxdp:
+	@if [ ! -d xdp-tools/lib ]; then \
+		echo "Error: Need libxdp submodule"; \
 		echo "May need to run git submodule update --init"; \
 		exit 1; \
 	else \
-		docker exec -w /`basename $(PWD)`/bpf/src hercules-builder $(MAKE) all OBJDIR=.; \
-		mkdir -p build; \
-		docker exec -w /`basename $(PWD)`/bpf/src hercules-builder $(MAKE) install_headers DESTDIR=build OBJDIR=.; \
+		cd xdp-tools && ./configure && \
+		cd lib && make && \
+		cd libxdp && make install && \
+		cd ../libbpf/src && make install; \
 	fi
 
-mockules: builder mockules/main.go mockules/network.go
-	docker exec -w /`basename $(PWD)`/mockules hercules-builder go build
+tomlc99/libtoml.a:
+	@if [ ! -d tomlc99 ]; then \
+		echo "Error: Need libtoml submodule"; \
+		echo "May need to run git submodule update --init"; \
+		exit 1; \
+	else \
+		cd tomlc99 && $(MAKE) all; \
+	fi
 
+
+.PHONY: builder builder_image
+
+# mockules: builder mockules/main.go mockules/network.go
+# 	docker exec -w /`basename $(PWD)`/mockules hercules-builder go build
+
+# docker stuff
 builder: builder_image
 	@docker container ls -a --format={{.Names}} | grep hercules-builder -q || \
 		docker run -t --entrypoint cat --name hercules-builder -v $(PWD):/`basename $(PWD)` -w /`basename $(PWD)` -d hercules-builder
 	@docker container ls --format={{.Names}} | grep hercules-builder -q || \
 		docker start hercules-builder
+	@docker exec hercules-builder ls /usr/local/include/xdp >/dev/null 2>&1 || docker exec -u0 hercules-builder make libxdp
 
 builder_image:
 	@docker images | grep hercules-builder -q || \
 		docker build -t hercules-builder --build-arg UID=$(shell id -u) --build-arg GID=$(shell id -g) .
 
-clean:
+
+MANFILES := $(wildcard doc/*.[157]) hcp/hcp.1
+MDFILES := $(addsuffix .md,$(MANFILES))
+
+%.md: $(basename %)
+# Show linter output for all warning levels, but continue if it's not severe
+	mandoc -T lint -Wall $< || true
+	mandoc -T markdown -W warning,stop $< > $@
+
+docs: $(MDFILES)
+
+# Packages
+# Relies on the fpm tool to build packages.
+# More arguments to fpm are specified in the file .fpm
+# The package is called hercules-server, because there is already
+# one named hercules in Ubuntu's default repos.
+PKG_VERSION ?= $(shell git describe --tags 2>/dev/null)
+
+.PHONY: packages pkg_deb pkg_rpm pkg_tar
+packages: pkg_deb pkg_rpm pkg_tar
+pkg_deb:
+	@$(if $(PKG_VERSION),,$(error PKG_VERSION not set and no git tag!))
+	@echo Packaging version $(PKG_VERSION)
+	mkdir pkgroot
+	DESTDIR=pkgroot $(MAKE) install
+	fpm -t deb --version $(PKG_VERSION)
+	rm -rf pkgroot
+pkg_rpm:
+	@$(if $(PKG_VERSION),,$(error PKG_VERSION not set and no git tag!))
+	@echo Packaging version $(PKG_VERSION)
+	mkdir pkgroot
+	DESTDIR=pkgroot $(MAKE) install
+	fpm -t rpm --version $(PKG_VERSION)
+	rm -rf pkgroot
+pkg_tar:
+	@$(if $(PKG_VERSION),,$(error PKG_VERSION not set and no git tag!))
+	@echo Packaging version $(PKG_VERSION)
+	mkdir pkgroot
+	DESTDIR=pkgroot $(MAKE) install
+	fpm -t tar --version $(PKG_VERSION)
+	rm -rf pkgroot
+
+.PHONY: clean clean-small
+# Clean files only, but don't remove the docker container.
+clean-small:
+	rm -rf $(TARGET_MONITOR) $(TARGET_SERVER) $(TARGET_HCP) $(OBJS) $(DEPS)
+	rm -rf pkgroot *.deb *.rpm *.tar
+
+clean: clean-small
 	rm -f hercules mockules/mockules
 	docker container rm -f hercules-builder || true
 	docker rmi hercules-builder || true
+
+
+-include $(DEPS)