Project

General

Profile

Actions

Bug #6088

open

xdp/ebpf: updated shipped bpf files to be supported by libbpf v1.0 and higher

Added by Andreas Herz over 1 year ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The newer versions of libbpf (v1.0 and higher) do require updates on the shipped ebpf files like bypass_filter, xdp_filter etc.

In 6.0.12 they will error out like this:

25/5/2023 -- 09:00:52 - <Notice> - This is Suricata version 6.0.12 RELEASE running in SYSTEM mode
libbpf: elf: legacy map definitions in 'maps' section are not supported by libbpf v1.0+
25/5/2023 -- 09:00:52 - <Error> - [ERRCODE: SC_ERR_INVALID_VALUE(130)] - Unable to load eBPF objects in 'xdp_lb.bpf': Operation not supported
25/5/2023 -- 09:00:52 - <Warning> - [ERRCODE: SC_ERR_INVALID_VALUE(130)] - Error when loading eBPF filter file

So does 7.0.0-rc1:

i: suricata: This is Suricata version 7.0.0-rc1 RELEASE running in SYSTEM mode
libbpf: elf: legacy map definitions in 'maps' section are not supported by libbpf v1.0+
E: ebpf: Unable to load eBPF objects in 'bypass_filter.bpf': Operation not supported
W: af-packet: enp4s0: failed to load eBPF filter file
Actions #1

Updated by Lukas Sismis over 1 year ago

  • Subject changed from xpd/ebpf: updated shipped bpf files to be supported by libbpf v1.0 and higher to xdp/ebpf: updated shipped bpf files to be supported by libbpf v1.0 and higher
Actions

Also available in: Atom PDF