Suricata 6.0.9 no XDP support with libbpf-1.x

1

Hello team,

trying to build suricata 6.0.9 with either

  • libbpf v1.0 or
  • libbpf v1.0.1

results in only eBPF but no XDP support:

“checking for bpf_set_link_xdp_fd in -lbpf… no”
eBPF support: yes
XDP support: no

Downgrading to libbpf v0.8.1 it’s successfully compiling with both eBPF and XDP support.

“checking for bpf_set_link_xdp_fd in -lbpf… yes”
eBPF support: yes
XDP support: yes

Any ideas?

Thanks in advance,
jiivas

2

Looks like @satta did a fix for this in 7? Maybe that can be backported Sascha?

3

Yes, this is likely related to ebpf: update deprecated API calls by satta · Pull Request #7870 · OISF/suricata · GitHub which I created for Suricata 7. Easily backported, see branch GitHub - satta/suricata at backport-libbpf1-fix. I can open a PR against master-6.0.x if you want.

@jiivas can you maybe try my branch above and see if that fixes things for you?