Skip to content

Commit f53c00b

Browse files
jmwamplemfallone
jmwample
and
mfallone
authored
Update install process and Containerization (#149)
* initial update, images building - doc updates and docker-compose next * small fixes * stages of build w/ makefile to allow for smaller images for independent pieces * remove pfring from sim target * docker-compose files and start scripts * env var for registrar config * use pf_ringcfg to load drivers in on-reboot.sh * readme and run instructions * remove reference to tapdance in comment * we do not commit Cargo.lock because it is a rust lib, not a bin * Fixes for containerization - copy to /opt/conjure/ paths - misc bugfixes * fixed linux headers dep, fixed path for zbalance systemd file (others seem fine) * added ability to build pfring from source with older versions and fixed some wiring things * cahnged the application zmq private key to default to the station private key via env var * variable oversight * add systemd service so docker can be used to run conjure from boot * systemd service for containerized conjure * docker-umentation --------- Co-authored-by: mfallone <[email protected]>
1 parent a44bbe4 commit f53c00b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+1042
-556
lines changed

‎Makefile‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,28 @@ conjure-sim: detect.c loadkey.c rust_util.c rust libtapdance
3636
registration-server:
3737
cd ./cmd/registration-server/ && make
3838

39-
# Note this copies in the whole current directory as context and results in
40-
# overly large context. should not be used to build release/production images.
41-
custom-build:
42-
docker build --build-arg CUSTOM_BUILD=1 -f docker/Dockerfile .
39+
PARAMS := det app reg zbalance sim
40+
target := unk
41+
# makefile arguments take preference, if one is not provided we check the environment variable.
42+
# If that is also missing then we use "latest" and install pfring from pkg in the docker build.
43+
ifndef pfring_ver
44+
ifdef PFRING_VER
45+
pfring_ver := ${PFRING_VER}
46+
else
47+
pfring_ver := latest
48+
endif
49+
endif
50+
51+
container:
52+
ifeq (unk,$(target))
53+
DOCKER_BUILDKIT=1 docker build -t conjure -t pf-$(pfring_ver) -f docker/Dockerfile --build-arg pfring_ver=$(pfring_ver) .
54+
# @printf "DOCKER_BUILDKIT=1 docker build -t conjure -f docker/Dockerfile --build-arg pfring_ver=$(pfring_ver) .\n"
55+
else ifneq (,$(findstring $(target), $(PARAMS)))
56+
DOCKER_BUILDKIT=1 docker build --target conjure_$(target) -t conjure_$(target) -t pf-$(pfring_ver) -f docker/Dockerfile --build-arg pfring_ver=$(pfring_ver) .
57+
# @printf "DOCKER_BUILDKIT=1 docker build --target conjure_$(target) -t conjure_$(target) -f docker/Dockerfile --build-arg pfring_ver=$(pfring_ver) .\n"
58+
else
59+
@printf "unrecognized container target $(target) - please use one of [ $(PARAMS) ]\n"
60+
endif
4361

4462

4563
backup-config:

‎application/config.toml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,10 @@ socket_name = "zmq-proxy"
1010

1111
# Absolute path to private key to use when authenticating with servers.
1212
# Can be either privkey or privkey || pubkey; only first 32 bytes will
13-
# be used.
14-
privkey_path = "/opt/conjure/sysconfig/privkey"
13+
# be used. If this is blank then the environment variable CJ_PRIVKEY
14+
# which is defined in conjure.conf will be used (if that fails to parse
15+
# the station will shutdown).
16+
privkey_path = ""
1517

1618
# Time in milliseconds to wait between sending heartbeats.
1719
# Heartbeats are only sent when other traffic doesn't come through;
@@ -75,7 +77,7 @@ covert_blocklist_subnets = [
7577

7678
# Automatically add all addresses and subnets associated with local devices to
7779
# the blocklist.
78-
covert_blocklist_public_addrs = false
80+
covert_blocklist_public_addrs = true
7981

8082
# Override the blocklist providing a more restrictive allowlist. Any addresses
8183
# not explicitly included in an allowlisted subnet will be considered

‎application/lib/config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ func ParseConfig() (*Config, error) {
2323
var envPath = os.Getenv("CJ_STATION_CONFIG")
2424
_, err := toml.DecodeFile(envPath, &c)
2525
if err != nil {
26-
return nil, fmt.Errorf("failed to load config(%s): %v", envPath, err)
26+
return nil, fmt.Errorf("failed to load config (%s): %v", envPath, err)
2727
}
2828

2929
c.ParseBlocklists()

‎application/lib/zmq_proxy.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,12 @@ func (zi *ZMQIngester) PrintAndReset(logger *log.Logger) {
145145
// location of the config file with the CJ_PROXY_CONFIG environment variable.
146146
func (zi *ZMQIngester) proxyZMQ() {
147147

148-
privkey, err := os.ReadFile(zi.PrivateKeyPath)
148+
privkeyPath := zi.PrivateKeyPath
149+
if privkeyPath == "" {
150+
privkeyPath = os.Getenv("CJ_PRIVKEY")
151+
}
152+
153+
privkey, err := os.ReadFile(privkeyPath)
149154
if err != nil {
150155
zi.logger.Fatalln("failed to load private key:", err)
151156
}

‎cmd/registration-server/main.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -145,15 +145,19 @@ func main() {
145145
var configPath string
146146
var apiOnly, dnsOnly bool
147147

148-
flag.StringVar(&configPath, "config", "", "configuration file path")
148+
flag.StringVar(&configPath, "config", "", "configuration file path, alternative to CJ_REGISTRAR_CONFIG env var")
149149
flag.BoolVar(&apiOnly, "api-only", false, "run only the API registrar")
150150
flag.BoolVar(&dnsOnly, "dns-only", false, "run only the DNS registrar")
151151
flag.Parse()
152152

153153
if configPath == "" {
154-
fmt.Fprintf(os.Stderr, "-config is a required flag")
155-
flag.Usage()
156-
os.Exit(2)
154+
configPath = os.Getenv("CJ_REGISTRAR_CONFIG")
155+
156+
if configPath == "" {
157+
fmt.Fprintf(os.Stderr, "configuration path is a required flag")
158+
flag.Usage()
159+
os.Exit(2)
160+
}
157161
}
158162

159163
logFormatter := &log.TextFormatter{

‎docker/Dockerfile‎

Lines changed: 152 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -1,104 +1,152 @@
1-
#FROM ubuntu:20.04 as build_base
2-
FROM ubuntu:20.04 as build_base_go
3-
# PATH="/opt/PF_RING/userland/examples_zc:$PATH"
4-
ARG GO_VERSION=1.15.2
5-
ARG CUSTOM_BUILD
6-
ARG BRANCH=master
7-
ENV PATH="/usr/local/go/bin:/root/.cargo/bin:${PATH}" \
8-
GOPATH="/root/go" \
9-
GOROOT="/usr/local/go"
10-
11-
# Install dependencies: including rust and go
12-
RUN apt-get update && \
13-
DEBIAN_FRONTEND="noninteractive" apt-get -y -q install wget git make gcc bison flex protobuf-compiler curl libssl-dev pkg-config libgmp3-dev libzmq3-dev && \
14-
apt-get clean all && \
15-
wget -q https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz && \
16-
tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz && \
17-
curl https://sh.rustup.rs -sSf -o install_rust.sh; sh install_rust.sh -y && \
18-
cargo install protobuf-codegen
19-
20-
# Install PFRING to get libraries
21-
RUN apt-get install -y -q software-properties-common wget && \
22-
add-apt-repository universe && \
23-
wget https://packages.ntop.org/apt-stable/20.04/all/apt-ntop-stable.deb && \
24-
apt install ./apt-ntop-stable.deb && \
25-
apt-get clean all && \
26-
apt-get update && \
27-
apt-get install -y -q pfring && \
28-
apt-get clean all
29-
30-
31-
# Copy docker context dir. This is used as a source if CUSTOM_BUILD is enabled
32-
COPY . /tmp/conjure
33-
34-
# Get Conjure or copy a directory Dockerfile is in. Switched by CUSTOM_BUILD var
35-
RUN go get -d github.com/refraction-networking/conjure/... ; \
36-
bash -c 'if [[ ! -z "$CUSTOM_BUILD" ]] ; then \
37-
rm -rf ${GOPATH}/src/github.com/refraction-networking/conjure; cp -r /tmp/conjure ${GOPATH}/src/github.com/refraction-networking/conjure ; \
38-
fi'
39-
40-
# Checkout needed branch if not builing using CUSTOM_BUILD
41-
RUN bash -c 'if [[ -z "CUSTOM_BUILD" ]] ; then \
42-
cd /root/go/src/github.com/refraction-networking/conjure && \
43-
git checkout ${BRANCH}; \
44-
fi'
45-
46-
# Compile
47-
RUN cd /root/go/src/github.com/refraction-networking/conjure && \
48-
go get ./... || true && \
49-
make
50-
51-
# Copy results
52-
RUN cp -r /root/go/src/github.com/refraction-networking/conjure /opt/conjure
53-
54-
55-
56-
FROM ubuntu:20.04 as zbalance
57-
ENV CJ_IFACE=lo \
58-
CJ_CLUSTER_ID=98 \
59-
CJ_CORECOUNT=1 \
60-
CJ_COREBASE=0 \
61-
ZBALANCE_HASH_MODE=1
62-
#COPY --from=build_base /opt/PF_RING /opt/PF_RING
63-
64-
RUN apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get -y -q install libelf1
65-
66-
COPY --from=build_base_go /usr/bin/zbalance_ipc /usr/bin/zbalance_ipc
67-
COPY ./docker/zbalance-entrypoint.sh /entrypoint.sh
68-
ENTRYPOINT ["bash", "/entrypoint.sh"]
69-
70-
71-
72-
73-
FROM ubuntu:20.04 as detector
74-
ENV CJ_CLUSTER_ID=98 \
75-
CJ_CORECOUNT=1 \
76-
CJ_COREBASE=0 \
77-
CJ_SKIP_CORE=-1 \
78-
CJ_QUEUE_OFFSET=0 \
79-
CJ_LOG_INTERVAL=5 \
80-
CJ_PRIVKEY=/opt/conjure/keys/privkey \
81-
CJ_STATION_CONFIG=/opt/conjure/application/config.toml \
82-
CJ_IP4_ADDR=127.0.0.1 \
83-
CJ_IP6_ADDR=[::1]
84-
#COPY --from=build_base_go /opt/conjure/dark-decoy /opt/conjure/dark-decoy
85-
COPY --from=build_base_go /opt/conjure/conjure /opt/conjure/conjure
86-
COPY --from=build_base_go /opt/conjure/application/config.toml /opt/conjure/application/config.toml
87-
COPY ./docker/detector-entrypoint.sh /entrypoint.sh
88-
COPY --from=build_base_go /usr/local/lib/libpcap.so /usr/local/lib/libpcap.so
89-
90-
RUN apt-get update && apt-get -y -q install libzmq3-dev iproute2 iptables && apt-get clean all
91-
ENTRYPOINT [ "/entrypoint.sh"]
92-
93-
94-
95-
96-
FROM ubuntu:20.04 as application
97-
ENV CJ_STATION_CONFIG=/opt/conjure/application/config.toml \
98-
PHANTOM_SUBNET_LOCATION=/opt/conjure/sysconfig/phantom_subnets.toml
99-
COPY --from=build_base_go /opt/conjure/application/application /opt/conjure/application/application
100-
RUN apt-get update && apt-get -y -q install libzmq3-dev && apt-get clean all
101-
COPY --from=build_base_go /opt/conjure/application/config.toml ${CJ_STATION_CONFIG}
102-
COPY --from=build_base_go /opt/conjure/application/lib/test/phantom_subnets.toml ${PHANTOM_SUBNET_LOCATION}
103-
#COPY ./docker/application-entrypoint.sh /entrypoint.sh
104-
ENTRYPOINT [ "/opt/conjure/application/application"]
1+
# syntax=docker/dockerfile:1.3-labs
2+
3+
FROM ubuntu:20.04 AS base_pfring
4+
ARG UNAME=conjure
5+
ARG UID=1000
6+
ARG GID=1000
7+
RUN groupadd -g $GID -o $UNAME
8+
RUN useradd -m -u $UID -g $GID -o -s /bin/bash $UNAME
9+
10+
RUN apt-get update && apt-get install -yq sudo apt-utils software-properties-common
11+
12+
# install pf_ring deps
13+
14+
COPY scripts/install_pfring.sh /
15+
ARG pfring_ver="latest"
16+
RUN /usr/bin/sudo pfring_ver="${pfring_ver}" /install_pfring.sh
17+
18+
# ------------------------------------------------------------------------------
19+
# Development image
20+
#
21+
# Builds a common image that has all dependencies required to build and run
22+
# any piece of the station. Ideally we want to redo this as little as possible.
23+
# ------------------------------------------------------------------------------
24+
FROM base_pfring AS dev_img
25+
26+
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
27+
COPY prereqs_once.sh /opt/conjure/
28+
29+
WORKDIR /opt/conjure
30+
ENV is_docker_build YES
31+
RUN /usr/bin/sudo ./prereqs_once.sh
32+
33+
WORKDIR /opt/conjure
34+
35+
COPY Makefile *.c *.h /opt/conjure/
36+
COPY libtapdance/ /opt/conjure/libtapdance
37+
RUN make libtd
38+
39+
# run cargo build to allow for dependencies to cached
40+
RUN PATH="$HOME/.cargo/bin:$PATH" cargo init --lib .
41+
COPY Cargo.toml build.rs /opt/conjure/
42+
RUN --mount=type=cache,target=/usr/local/cargo/registry PATH="$HOME/.cargo/bin:$PATH" cargo build --release
43+
44+
COPY src/ /opt/conjure/src
45+
46+
# A bit of magic here!
47+
# * We're mounting that cache again to use during the build, otherwise it's not present and we'll have to download those again - bad!
48+
# * EOF syntax is neat but not without its drawbacks. We need to `set -e`, otherwise a failing command is going to continue on
49+
# * Rust here is a bit fiddly, so we'll touch the files (even though we copied over them) to force a new build
50+
RUN --mount=type=cache,target=/usr/local/cargo/registry <<EOF
51+
set -e
52+
# update timestamps to force a new build
53+
touch /opt/conjure/src/lib.rs
54+
PATH="$HOME/.cargo/bin:$PATH" make rust
55+
EOF
56+
57+
RUN PATH="$HOME/.cargo/bin:$PATH" make conjure-sim && mv conjure conjure-sim
58+
RUN PATH="$HOME/.cargo/bin:$PATH" make conjure
59+
60+
COPY go.* /opt/conjure/
61+
COPY cmd/ /opt/conjure/cmd
62+
COPY application/ /opt/conjure/application
63+
COPY pkg/ /opt/conjure/pkg
64+
65+
RUN PATH="$HOME/.go/bin/:$PATH" make app
66+
RUN PATH="$HOME/.go/bin/:$PATH" make registration-server
67+
68+
# Add default configs and launch scripts
69+
COPY sysconfig/ /opt/conjure/sysconfig
70+
COPY scripts/ /opt/conjure/bin
71+
72+
# add application as default entrypoint for dev reasons.
73+
ENTRYPOINT /opt/conjure/application/application
74+
75+
76+
# ------------------------------------------------------------------------------
77+
# Production image zbalance only
78+
# ------------------------------------------------------------------------------
79+
FROM base_pfring as conjure_zbalance
80+
# Add default configs and launch scripts
81+
COPY sysconfig/ /opt/conjure/sysconfig
82+
COPY scripts/ /opt/conjure/bin
83+
84+
ENTRYPOINT /opt/conjure/bin/start_zbalance_ipc.sh
85+
86+
87+
# ------------------------------------------------------------------------------
88+
# Production image detector only (kind of, requires pfring)
89+
# ------------------------------------------------------------------------------
90+
FROM base_pfring as conjure_det
91+
# Add default configs and launch scripts
92+
COPY sysconfig/ /opt/conjure/sysconfig
93+
COPY scripts/ /opt/conjure/bin
94+
95+
RUN apt update && apt install -yq libzmq3-dev
96+
COPY --from=dev_img /opt/conjure/conjure /opt/conjure/bin/
97+
98+
99+
# ------------------------------------------------------------------------------
100+
# Production image application only
101+
# ------------------------------------------------------------------------------
102+
FROM ubuntu:20.04 as conjure_app
103+
# Add default configs and launch scripts
104+
COPY sysconfig/ /opt/conjure/sysconfig
105+
COPY scripts/ /opt/conjure/bin
106+
COPY application/ /opt/conjure/application
107+
108+
RUN apt update && apt install -yq libzmq3-dev
109+
COPY --from=dev_img /opt/conjure/application/application /opt/conjure/bin/
110+
111+
112+
# ------------------------------------------------------------------------------
113+
# Production image registration server only
114+
# ------------------------------------------------------------------------------
115+
FROM ubuntu:20.04 as conjure_reg
116+
# Add default configs and launch scripts
117+
COPY sysconfig/ /opt/conjure/sysconfig
118+
COPY scripts/ /opt/conjure/bin
119+
120+
RUN apt update && apt install -yq libzmq3-dev
121+
COPY --from=dev_img /opt/conjure/cmd/registration-server/registration-server /opt/conjure/bin/
122+
123+
124+
# ------------------------------------------------------------------------------
125+
# Simulation image (no pfring required)
126+
# ------------------------------------------------------------------------------
127+
FROM ubuntu:20.04 as conjure_sim
128+
# Add default configs and launch scripts
129+
COPY sysconfig/ /opt/conjure/sysconfig
130+
COPY scripts/ /opt/conjure/bin
131+
132+
RUN apt update && apt install -yq libzmq3-dev
133+
COPY --from=dev_img /opt/conjure/conjure-sim /opt/conjure/bin/conjure
134+
COPY --from=dev_img /opt/conjure/cmd/registration-server/registration-server /opt/conjure/bin/
135+
COPY --from=dev_img /opt/conjure/conjure /opt/conjure/bin/
136+
137+
138+
# ------------------------------------------------------------------------------
139+
# Production image all (default)
140+
# ------------------------------------------------------------------------------
141+
FROM base_pfring as conjure
142+
# Add default configs and launch scripts
143+
COPY sysconfig/ /opt/conjure/sysconfig
144+
COPY scripts/ /opt/conjure/bin
145+
COPY application/ /opt/conjure/application
146+
147+
RUN apt update && apt install -yq libzmq3-dev
148+
COPY --from=dev_img /opt/conjure/application/application /opt/conjure/bin/
149+
COPY --from=dev_img /opt/conjure/cmd/registration-server/registration-server /opt/conjure/bin/
150+
COPY --from=dev_img /opt/conjure/conjure /opt/conjure/bin/
151+
152+
# ENTRYPOINT /bin/bash

0 commit comments

Comments
 (0)