[Oisf-users] Libbpf errors on Make for Suricata from Git

[Jeremy A. Grove]

Hi All! 

I am venturing into the land of XDP and eBPF. 

I am following the instructions from [ https://suricata.readthedocs.io/en/suricata-5.0.0-beta1/capture-hardware/ebpf-xdp.html | https://suricata.readthedocs.io/en/suricata-5.0.0-beta1/capture-hardware/ebpf-xdp.html ] . 

I receive errors from the make command for Suricata. 

util-ebpf.c:359:13: error: implicit declaration of function 'bpf_program__set_ifindex' is invalid in C99 [-Werror,-Wimplicit-function-declaration] 
bpf_program__set_ifindex(bpfprog, ifindex); 
^ 
util-ebpf.c:359:13: warning: this function declaration is not a prototype [-Wstrict-prototypes] 
util-ebpf.c:362:13: error: implicit declaration of function 'bpf_map__set_ifindex' is invalid in C99 [-Werror,-Wimplicit-function-declaration] 
bpf_map__set_ifindex(map, ifindex); 
^ 
util-ebpf.c:362:13: note: did you mean 'bpf_map__set_priv'? 
/usr/local/include/bpf/libbpf.h:244:5: note: 'bpf_map__set_priv' declared here 
int bpf_map__set_priv(struct bpf_map *map, void *priv, 
^ 
util-ebpf.c:362:13: warning: this function declaration is not a prototype [-Wstrict-prototypes] 
bpf_map__set_ifindex(map, ifindex); ^ 

I have found where someone had this error before and it was due to them having more than one libbpf.h. I do not believe this is the case for myself. 

I installed libbpf per the above instructions as well and Suricata sees it correctly per ldd. 

deb10-image suricata # ldd /usr/bin/suricata | grep libbpf 
libbpf.so => /usr/local/lib64/libbpf.so (0x00007f8c9b5f9000) 

deb10-image suricata # ls -alh /usr/local/lib64/libbpf.so 
-rwxr-xr-x 1 root staff 108K Aug 28 16:29 /usr/local/lib64/libbpf.so 

Any ideas as to why I am receiving this error? 


Jeremy Grove, SSCP 
Security Engineer 
Quadrant Information Security 


Learn more= about our managed SIEM [ https://a.quadrantsec.com/3D%22https://quadrantsec.com/SaganMSSP%22 | people + product ] 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190828/dbbe8736/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2131 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190828/dbbe8736/attachment.bin>