02 / install

Build it. Attach it. Leave it idle.

clang compiles the XDP object, bpftool emits the skeleton, gcc links the daemon. Tests use SKB / bpf_prog_test_run and do not need a real NIC.

Requirements

Linux 5.8+ with BTF (/sys/kernel/btf/vmlinux)
clang, llvm, libbpf, bpftool, libelf, zlib
CAP_BPF + CAP_NET_ADMIN (root is fine)

Ubuntu 24.04

shell

sudo apt install clang llvm libbpf-dev libelf-dev zlib1g-dev \
    linux-tools-generic make gcc
git clone https://github.com/lynch1981/VoidGate.git
cd VoidGate
make
sudo ./tests/test_xdp

make test also runs tests/test_policy and tests/test_netns.sh (veth flood, needs root). If a BPF change compiles but test_xdp cannot load the object, the verifier rejected it — fix the program, do not weaken the test.

Run

shell

sudo ./voidgate -c configs/voidgate.conf -i eth0
sudo ./voidgatectl status

Edit interface to the VM’s public NIC. Do not point this at a shared management-only interface you cannot afford to XDP-attach. The idle path is XDP_PASS, but attach still requires driver or SKB XDP.

Attach mode

xdp_mode = auto tries native (XDP_FLAGS_DRV_MODE) then falls back to SKB. You can pin native or skb in the config. Tests do not require a vendor driver.

systemd

make install drops the binaries in /usr/local/sbin, the config in /etc/voidgate/voidgate.conf, and the unit in /lib/systemd/system/voidgate.service.

systemd/voidgate.service

[Unit]
Description=voidGate XDP DDoS gate
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/sbin/voidgate -c /etc/voidgate/voidgate.conf
Restart=on-failure
RestartSec=2
AmbientCapabilities=CAP_BPF CAP_NET_ADMIN CAP_PERFMON
CapabilityBoundingSet=CAP_BPF CAP_NET_ADMIN CAP_PERFMON CAP_DAC_OVERRIDE
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target

Layout

tree

src/bpf/voidgate.bpf.c   XDP program
src/bpf/voidgate.h       shared map / packet structs
src/voidgate.c           daemon
src/voidgatectl.c        unix-socket client
src/policy.c             IDLE / ACTIVE policy
src/maps.c               libbpf attach + LPM helpers
configs/voidgate.conf    key=value
systemd/voidgate.service

Generated, do not edit or commit: src/bpf/voidgate.skel.h, *.o, binaries.