Suricata

I have to specify --disable-af-xdp to be able to build.

@Gianni Tedesco any chance you or @Richard McConnell can have a look at this?

Victor Julien wrote in #note-1:

I have to specify --disable-af-xdp to be able to build.

@Gianni Tedesco any chance you or @Richard McConnell can have a look at this?

@Victor Julien are you still experiencing this issue? I have created a new VM from the 24.10 iso, installed all required dependancies i.e. sudo apt install -y libxdp-dev and ran the above commands in the same order you suggested:
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.10
Release: 24.10
Codename: oracular

./src/suricata -V
This is Suricata version 8.0.0-dev (fbfeea752 2025-03-09)

Unless there's something I'm doing wrong?

Richard McConnell wrote in #note-3:

Victor Julien wrote in #note-1:

I have to specify --disable-af-xdp to be able to build.

@Gianni Tedesco any chance you or @Richard McConnell can have a look at this?

@Victor Julien are you still experiencing this issue? I have created a new VM from the 24.10 iso, installed all required dependancies i.e. sudo apt install -y libxdp-dev and ran the above commands in the same order you suggested:
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.10
Release: 24.10
Codename: oracular

./src/suricata -V
This is Suricata version 8.0.0-dev (fbfeea752 2025-03-09)

Unless there's something I'm doing wrong?

Here's the Configuration, too:

Suricata Configuration:
  AF_PACKET support:                       yes
  AF_XDP support:                          yes
  DPDK support:                            yes
  eBPF support:                            no
  XDP support:                             no
  PF_RING support:                         no
  NFQueue support:                         no
  NFLOG support:                           no
  IPFW support:                            no
  Netmap support:                          no 
  DAG enabled:                             no
  Napatech enabled:                        no
  WinDivert enabled:                       no

  Unix socket enabled:                     yes
  Detection enabled:                       yes

  Libmagic support:                        no
  libjansson support:                      yes
  hiredis support:                         no
  hiredis async with libevent:             no
  PCRE jit:                                yes
  GeoIP2 support:                          no
  JA3 support:                             yes
  JA4 support:                             yes
  Non-bundled htp:                         no
  Hyperscan support:                       yes
  Libnet support:                          no
  liblz4 support:                          no
  Landlock support:                        yes
  Systemd support:                         yes

  Rust strict mode:                        no
  Rust compiler path:                      /home/rmcconnell/.cargo/bin/rustc
  Rust compiler version:                   rustc 1.85.0 (4d91de4e4 2025-02-17)
  Cargo path:                              /home/rmcconnell/.cargo/bin/cargo
  Cargo version:                           cargo 1.85.0 (d73d2caf9 2024-12-31)

  Python support:                          yes
  Python path:                             /usr/bin/python3
  Install suricatactl:                     yes
  Install suricatasc:                      yes
  Install suricata-update:                 no, not bundled

  Profiling enabled:                       no
  Profiling locks enabled:                 no
  Profiling rules enabled:                 no

  Plugin support (experimental):           yes
  DPDK Bond PMD:                           yes

Development settings:
  Coccinelle / spatch:                     no
  Unit tests enabled:                      no
  Debug output enabled:                    no
  Debug validation enabled:                no
  Fuzz targets enabled:                    no

Generic build parameters:
  Installation prefix:                     /usr
  Configuration directory:                 /etc/suricata/
  Log directory:                           /var/log/suricata/

  --prefix                                 /usr
  --sysconfdir                             /etc
  --localstatedir                          /var
  --datarootdir                            /usr/share

  Host:                                    x86_64-pc-linux-gnu
  Compiler:                                clang-19 (exec name) / clang (real)
  GCC Protect enabled:                     no
  GCC march native enabled:                yes
  GCC Profile enabled:                     no
  Position Independent Executable enabled: no
  CFLAGS                                   -ggdb -O2 -fno-omit-frame-pointer -fPIC -DOS_LINUX -std=c11 -march=native -I/usr/include/dpdk -I/usr/include/dpdk/../x86_64-linux-gnu/dpdk -include rte_config.h -march=corei7 -mrtm -I/usr/include/x86_64-linux-gnu -I/usr/include/libnl3 -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include  -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist -I../rust/gen
  PCAP_CFLAGS                               -I/usr/include

Yes still seeing this on a fully updated install

source-af-xdp.c:500:9: error: call to undeclared function 'bpf_get_link_xdp_id'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
  500 |     if (bpf_get_link_xdp_id(ptv->ifindex, &ptv->prog_id, ptv->xsk.cfg.xdp_flags)) {
      |         ^
  CC       source-nflog.o
1 error generated.
make[2]: *** [Makefile:3343: source-af-xdp.o] Error 1
make[2]: *** Waiting for unfinished jobs....
make[2]: Leaving directory '/home/victor/dev/suricata/src'
make[1]: *** [Makefile:2571: all] Error 2
make[1]: Leaving directory '/home/victor/dev/suricata/src'
make: *** [Makefile:508: all-recursive] Error 1
victor@z420:~/dev/suricata$ sudo dpkg --list '*xdp*'
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                      Version            Architecture Description
+++-=========================-==================-============-==============================================================
ii  librte-net-af-xdp24:amd64 23.11.2-0ubuntu1.1 amd64        Data Plane Development Kit (librte-net-af-xdp runtime library)
ii  libxdp-dev:amd64          1.4.2-1ubuntu4     amd64        library and utilities for use with XDP - development files
ii  libxdp1:amd64             1.4.2-1ubuntu4     amd64        library and utilities for use with XDP - shared library
victor@z420:~/dev/suricata$ sudo dpkg --list '*bpf*'
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name               Version                 Architecture Description
+++-==================-=======================-============-=======================================================
ii  bpfcc-tools        0.30.0+ds-1ubuntu4      all          tools for BPF Compiler Collection (BCC)
un  bpftool            <none>                  <none>       (no description available)
ii  bpftrace           0.21.2-1ubuntu1.1       amd64        high-level tracing language for Linux eBPF
ii  libbpf-dev:amd64   1:1.4.5-1               amd64        eBPF helper library (development files)
ii  libbpf1:amd64      1:1.4.5-1               amd64        eBPF helper library (shared library)
ii  libbpfcc:amd64     0.30.0+ds-1ubuntu4      amd64        shared library for BPF Compiler Collection (BCC)
ii  libpfm4:amd64      4.13.0+git32-g0d4ed0e-1 amd64        Library to program the performance monitoring events
ii  librte-bpf24:amd64 23.11.2-0ubuntu1.1      amd64        Data Plane Development Kit (librte-bpf runtime library)
ii  python3-bpfcc      0.30.0+ds-1ubuntu4      all          Python 3 wrappers for BPF Compiler Collection (BCC)

In source-af-xdp.c we have:

    /* Has the eBPF program successfully bound? */
#ifdef HAVE_BPF_XDP_QUERY_ID
    if (bpf_xdp_query_id(ptv->ifindex, ptv->xsk.cfg.xdp_flags, &ptv->prog_id)) {
        SCLogError("Failed to attach eBPF program to interface: %s", ptv->livedev->dev);
        SCReturnInt(TM_ECODE_FAILED);
    }
#else
    if (bpf_get_link_xdp_id(ptv->ifindex, &ptv->prog_id, ptv->xsk.cfg.xdp_flags)) {
        SCLogError("Failed to attach eBPF program to interface: %s", ptv->livedev->dev);
        SCReturnInt(TM_ECODE_FAILED);
    }
#endif

On my fresh 24.10 install, HAVE_BPF_XDP_QUERY_ID is set, and this builds fine. It doesn't appear to be getting set on yours. bpf_get_link_xpd_id was deprecated and removed in libbpf 1.0. Could this be an artifact of an upgrade?