Suricata 7.x XDP libbpf 1.x support

Developers
1

Hello team,

I’m unable to load the example xdp filters provided by the suricata 7 release:

  • xdp_filter.c
  • xdp_lb.c

The suricata log shows the following error:
“Error: ebpf: Unable to load eBPF objects in ‘/usr/libexec/suricata/ebpf/xdp_lb.bpf’: Operation not supported”

Trying to load the filter via the xdp utilities provides some additional info:
“legacy map definitions in ‘maps’ section are not supported by libbpf v1.0+”

After a quick search I found the following:

Both the xdp_filter.c and xdp_lb.c are still using the old syntax.

EDIT:

Bests,
Jiivas

2

Hi,

yes those files need updates, feel free to provide patches via Github if you would like to work on it.