meson.build

# SPDX-FileCopyrightText: Copyright (C) 2024-2025 Marek Küthe <m.k@mk16.de>
#
# SPDX-License-Identifier: GPL-3.0-or-later

project(
    'crazytrace',
    'cpp',
    version: '1.0.7',
    license: 'GPL-3.0-or-later',
    default_options: [
        'buildtype=release',
        'optimization=2',
        'warning_level=3',
        'werror=true',
        'cpp_std=gnu++23',
        'b_asneeded=true',
        'b_lto=true',
        'b_ndebug=if-release',
        'b_pie=true'
    ],
    meson_version: '>=1.3.2'
)

cpp_compiler = meson.get_compiler('cpp')

main_file = files('src/main.cpp')
sources = files(
    'src/capability_managment.cpp',
    'src/configuration.cpp',
    'src/crazytrace.cpp',
    'src/landlock.cpp',
    'src/loglevel.cpp',
    'src/posix_wrapper.cpp',
    'src/postup_commands.cpp',
    'src/nodecontainer.cpp',
    'src/nodeinfo.cpp',
    'src/nodereply.cpp',
    'src/noderequest.cpp',
    'src/randomgenerator.cpp',
    'src/seccomp.cpp'
)
headers = files(
    'src/capability_managment.hpp',
    'src/capsicum.hpp',
    'src/configuration.hpp',
    'src/crazytrace.hpp',
    'src/deviceclient.hpp',
    'src/ip_ranges.hpp',
    'src/landlock.hpp',
    'src/loglevel.hpp',
    'src/posix_wrapper.hpp',
    'src/postup_commands.hpp',
    'src/nodecontainer.hpp',
    'src/nodeinfo.hpp',
    'src/nodereply.hpp',
    'src/noderequest.hpp',
    'src/randomgenerator.hpp',
    'src/seccomp.hpp'
)
tests_sources = files(
    'tests/loglevel_test.cpp',
    'tests/nodecontainer_test.cpp',
    'tests/nodeinfo_test.cpp',
    'tests/nodeinfo_children_test.cpp',
    'tests/nodereply_test.cpp',
    'tests/noderequest_test.cpp',
    'tests/randomgenerator_test.cpp'
)
markdown_files = files(
    'BUILDING.md',
    'CHANGELOG.md',
    'CONTRIBUTING.md',
    'README.md',
    'SECURITY.md'
)
all_sources = main_file + sources + headers + tests_sources

if get_option('native')
    native_flags = ['-march=native', '-mtune=native']

    add_project_arguments(cpp_compiler.get_supported_arguments(native_flags), language: 'cpp')
endif

# see https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
hardening_compiler_flags = [
    '-Wformat=2', # Strict printf/scanf format checks
    '-Wconversion', # Warnings for potentially lossy implicit conversions
    '-Wsign-conversion',
    '-Wtrampolines', # Warn about stack trampolines (conflicts with non‑executable stack)
    '-Wbidi-chars=any', # Enable warnings for possibly misleading Unicode bidirectional control characters
    '-fstrict-flex-arrays=3', # Flexible arrays can only be declared with [].
    '-fcf-protection=full', # Prevent certain attacks by enabling additional protection against unexpected control flow jumps. Minimal performance loss, as often implemented on the hardware side.
    '-mbranch-protection=standard'
]
add_project_arguments(cpp_compiler.get_supported_arguments(hardening_compiler_flags), language: 'cpp')

hardening_linker_flags = [
    '-Wl,-z,noexecstack', # Mark the stack in memory as non-executable
    '-Wl,-z,nodlopen', # Prevent loading this code via dlopen()
    '-Wl,-z,relro', # Make relocation data read‑only after startup
    '-Wl,-z,now' # Force the resolution of symbols from dynamic libraries at program startup
]
add_project_link_arguments(cpp_compiler.get_supported_link_arguments(hardening_linker_flags), language: 'cpp')

if get_option('debug')
    # see https://sourceware.org/bugzilla/show_bug.cgi?id=27375
    add_project_arguments(cpp_compiler.get_supported_arguments(['-gdwarf-4']), language: 'cpp')
endif

if host_machine.system() == 'freebsd'
    # see https://github.com/exult/exult/commit/202264bcf37d4edc8eafdaf53e1a910c8cf181a7
    add_project_arguments('-isystem/usr/local/include', language: 'cpp')
endif

cpp_compiler.has_header('unistd.h', required: true)
cpp_compiler.has_function('dup', prefix: '#include <unistd.h>', required: true)

if get_option('enable_setugid')
    cpp_compiler.has_function('setuid', prefix: '#include <unistd.h>', required: true)
    cpp_compiler.has_function('setgid', prefix: '#include <unistd.h>', required: true)
    cpp_compiler.has_type('struct passwd', prefix: '#include <pwd.h>', required: true)
    cpp_compiler.has_type('struct group', prefix: '#include <grp.h>', required: true)
    add_project_arguments('-DHAVE_SETUGID', language: 'cpp')
endif

libtuntappp_dep = dependency('libtuntap++', required: false, include_type: 'system')
if not libtuntappp_dep.found()
    libtuntappp_dep = cpp_compiler.find_library('libtuntap++', has_headers: ['tuntap++.hh'], required: false)
    if not libtuntappp_dep.found()
        libtuntappp_dep = cpp_compiler.find_library('tuntap++', has_headers: ['tuntap++.hh'], required: true)
    endif
endif

libtuntap_dep = dependency('libtuntap', required: false, include_type: 'system')
if not libtuntap_dep.found()
    libtuntap_dep = cpp_compiler.find_library('libtuntap', has_headers: ['tuntap.h'], required: false)
    if not libtuntap_dep.found()
        libtuntap_dep = cpp_compiler.find_library('tuntap', has_headers: ['tuntap.h'], required: true)
    endif
endif

# Workaround for https://github.com/boostorg/process/issues/494#issuecomment-3392312248
boost_dep = dependency('boost', modules: ['log', 'process', 'filesystem'], required: false, include_type: 'system')
if not boost_dep.found()
    boost_dep = dependency('boost', modules: ['log'], include_type: 'system')
    add_project_arguments('-DBOOST_PROCESS_V1', language: 'cpp')
endif

libcapng_dep = dependency('libcap-ng', required: false)
if libcapng_dep.found()
    add_project_arguments('-DHAVE_LIBCAPNG', language: 'cpp')
endif

seccomp_dep = dependency('libseccomp', required: false)
if seccomp_dep.found() and cpp_compiler.has_header('sys/syscall.h')
    add_project_arguments('-DHAVE_SECCOMP', language: 'cpp')
endif

if cpp_compiler.has_header('linux/landlock.h')
    add_project_arguments('-DHAVE_LANDLOCK', language: 'cpp')

    landlock_functions = [
        'landlock_create_ruleset',
        'landlock_add_rule',
        'landlock_restrict_self',
    ]

    foreach function : landlock_functions
        if not cpp_compiler.has_function(function, prefix: '#include <linux/landlock.h>')
            cpp_compiler.has_header('unistd.h', required: true)
            cpp_compiler.has_function('syscall', prefix: '#include <unistd.h>', required: true)
            cpp_compiler.has_header('sys/syscall.h', required: true)
            syscall_number_macro = 'SYS_' + function
            cpp_compiler.compiles('#include <sys/syscall.h>\nint number = ' + syscall_number_macro + ';', name: syscall_number_macro + ' number is available')

            macro = 'NO_' + function.to_upper()
            add_project_arguments('-D' + macro, language: 'cpp')
        endif
    endforeach

    # see also https://lore.kernel.org/landlock/20251119212707.71275873@ciel/T/
    cpp_compiler.compiles(
        '''
            #include <linux/landlock.h>
            struct landlock_ruleset_attr attr = {
                .handled_access_fs = 0,
                .handled_access_net = 0,
                .scoped = 0
            };
        ''',
        name: 'Landlock supports scoped access control'
    )

    cpp_compiler.compiles(
        '''
            #include <linux/landlock.h>
            struct landlock_path_beneath_attr attr = {
                .allowed_access = 0,
                .parent_fd = 0
            };
        ''',
        name: 'Landlock has landlock_path_beneath_attr'
    )

    cpp_compiler.compiles(
        '''
            #include <linux/landlock.h>
            struct landlock_net_port_attr attr = {
                .allowed_access = 0,
                .port = 0
            };
        ''',
        name: 'Landlock has landlock_net_port_attr'
    )

    landlock_macros = [
        'LANDLOCK_RULE_PATH_BENEATH',
        'LANDLOCK_RULE_NET_PORT',

        'LANDLOCK_CREATE_RULESET_VERSION',

        'LANDLOCK_ACCESS_FS_EXECUTE',
        'LANDLOCK_ACCESS_FS_WRITE_FILE',
        'LANDLOCK_ACCESS_FS_READ_FILE',
        'LANDLOCK_ACCESS_FS_TRUNCATE',
        'LANDLOCK_ACCESS_FS_READ_DIR',
        'LANDLOCK_ACCESS_FS_REMOVE_DIR',
        'LANDLOCK_ACCESS_FS_REMOVE_FILE',
        'LANDLOCK_ACCESS_FS_MAKE_CHAR',
        'LANDLOCK_ACCESS_FS_MAKE_DIR',
        'LANDLOCK_ACCESS_FS_MAKE_REG',
        'LANDLOCK_ACCESS_FS_MAKE_SOCK',
        'LANDLOCK_ACCESS_FS_MAKE_FIFO',
        'LANDLOCK_ACCESS_FS_MAKE_BLOCK',
        'LANDLOCK_ACCESS_FS_MAKE_SYM',
        'LANDLOCK_ACCESS_FS_REFER',
        'LANDLOCK_ACCESS_FS_IOCTL_DEV',

        'LANDLOCK_ACCESS_NET_BIND_TCP',
        'LANDLOCK_ACCESS_NET_CONNECT_TCP',

        'LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET',
        'LANDLOCK_SCOPE_SIGNAL'
    ]

    foreach macro : landlock_macros
        cpp_compiler.compiles('#include <linux/landlock.h>\nint number = ' + macro + ';', name: macro + ' number is available')
    endforeach

    if cpp_compiler.compiles('#include <linux/landlock.h>\nint number = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON;', name: 'LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON number is available')
        add_project_arguments('-DHAVE_LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON', language: 'cpp')
    endif
endif

if cpp_compiler.has_header('capsicum_helpers.h') and cpp_compiler.has_header('sys/capsicum.h')
    add_project_arguments('-DHAVE_CAPSICUM', language: 'cpp')
endif

threads_dep = declare_dependency()
if host_machine.system() == 'freebsd'
    # see https://github.com/exult/exult/issues/436
    #     https://github.com/exult/exult/blob/38e8b8d140102ea9ec3632f618af7e73a43955df/configure.ac
    threads_dep = dependency('threads')
endif

libtins_dep = dependency('libtins', include_type: 'system')
yamlcpp_dep = dependency('yaml-cpp', include_type: 'system')
gtest_dep = dependency('gtest', main: true, required: false, include_type: 'system')

cppcheck = find_program('cppcheck', required: false)
if cppcheck.found()
    run_target('cppcheck', command: [
        cppcheck,
        # Do not check external libraries
        '--suppress=*:*/tins/*',
        '--suppress=*:*/boost/*',
        '--suppress=*:*/gtest/*',

        # Problems with detecting system libraries
        '--suppress=missingIncludeSystem',
        '--suppress=unmatchedSuppression',
        '--suppress=functionStatic',

        '--enable=warning,style,information,missingInclude',
        '--error-exitcode=1',
        '--check-level=exhaustive',
        '--inline-suppr',
        '--project=' + join_paths(meson.current_build_dir(), 'compile_commands.json')
    ])
endif

infer = find_program('infer', required: false)
if infer.found()
    run_target('infer', command: [
        infer,
        '--compilation-database',
        join_paths(meson.current_build_dir(), 'compile_commands.json'),
        '--fail-on-issue'
    ])
endif

flawfinder = find_program('flawfinder', required: false)
if flawfinder.found()
    run_target('flawfinder', command: [
        flawfinder,
        '--error-level=0',
        all_sources
    ])
endif

lizard = find_program('lizard', required: false)
if lizard.found()
    run_target('lizard', command: [
        lizard,
        '--CCN', '25',
        '--length', '400',
        '--arguments', '10',
        all_sources
    ])
endif

mdl = find_program('mdl', required: false)
if mdl.found()
    run_target('mdl', command: [
        mdl,
        markdown_files
    ])
endif

reuse = find_program('reuse', required: false)
if reuse.found()
    run_target('reuse-annotate', command: [
        reuse,
        'annotate',
        '--copyright', 'Marek Küthe <m.k@mk16.de>',
        '--license', 'GPL-3.0-or-later',
        '--year', '2025',
        '--copyright-prefix', 'spdx-string-c',
        '--merge-copyrights',
        '--recursive',
        '--skip-unrecognised',
        meson.current_source_dir()
    ])
    run_target('reuse-download', command: [
        reuse,
        'download',
        '--all'
    ])
    run_target('reuse-lint', command: [
        reuse,
        'lint'
    ])
endif

if get_option('install_systemd_unit')
    install_data(
        'systemd/crazytrace@.service',
        install_dir: 'lib/systemd/system'
    )
endif

if get_option('install_rc_script')
    install_data(
        'rc/crazytrace',
        install_dir: 'etc/rc.d'
    )
endif

if get_option('install_apparmor_profile')
    install_data(
        'apparmor/usr.bin.crazytrace',
        install_dir: '/etc/apparmor.d'
    )
endif

if get_option('install_documentation')
    documentation_files = [
        'BUILDING.md',
        'CHANGELOG.md',
        'CONTRIBUTING.md',
        'README.md',
        'SECURITY.md',
        'LICENSE.txt'
    ]

    foreach file : documentation_files
        install_data(
            file,
            install_dir: 'share/doc/crazytrace'
        )
    endforeach
endif

deps = [libtuntappp_dep, libtuntap_dep, boost_dep, libtins_dep, yamlcpp_dep, libcapng_dep, seccomp_dep, threads_dep]

if gtest_dep.found()
    gtest = executable('gtest', sources + tests_sources, dependencies: [gtest_dep] + deps, include_directories: ['src/'])
    test('gtest', gtest)
endif

executable(
    'crazytrace',
    sources + main_file,
    dependencies: deps,
    install : true
)