Unsuccessful AF_XDP Suricata 7.0.0-rc1 compile

Help
1

Hi,

I got the following strange error when compiling suricata-7.0.0-rc1 on Debian 12 (kernel version 6.1.0).

source-af-xdp.c:495:9: error: implicit declaration of function 'bpf_get_link_xdp_id' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
    if (bpf_get_link_xdp_id(ptv->ifindex, &ptv->prog_id, ptv->xsk.cfg.xdp_flags)) {
        ^
1 error generated.
make[2]: *** [Makefile:3477: source-af-xdp.o] Error 1

I believe bpf_get_link_xdp_id is defined in bpf/libbpf.h. THe config log shows everything is fine. So what might go wrong?

...
configure:20323: checking bpf/libbpf.h usability
configure:20323: clang -c -g -O2 -fPIC -std=c11 -march=native  -I/usr/local/include  conftest.c >&5
configure:20323: $? = 0
configure:20323: result: yes
configure:20323: checking bpf/libbpf.h presence
configure:20323: clang -E  -I/usr/local/include  conftest.c
configure:20323: $? = 0
configure:20323: result: yes
configure:20323: checking for bpf/libbpf.h
configure:20323: result: yes
...

Thanks!

2

OK I think it’s because the latest version of libbpf has removed this API…

https://patchwork.dpdk.org/project/dpdk/patch/20220628121821.1326012-1-ciara.loftus@intel.com/

Nope. Changed into bpf_get_link_xdp_info and got the same problem. Something else is wrong with my libbpf…?

3

“bpf_xdp_query_id” Seems to be the updated API call. That worked for me and enabled me to compile the source.

4

I can confirm this also works for me!

5

Opened a tracker here - Bug #5924: AF_XDP compile error - Suricata - Open Information Security Foundation

6

We have to support both for a while. When I updated this a while ago some builds failed, so we need the ./configure check.