[Oisf-users] Suricata and XDP

[Nelson, Cooper]

Well, got a more useful error message this time! 

24329] 18/6/2019 -- 15:39:49 - (util-ebpf.c:400) <Error> (EBPFLoadFile) -- [ERRCODE: SC_ERR_INVALID_VALUE(130)] - Unable to load eBPF object: Kernel verifier blocks program loading (-4007)
[24329] 18/6/2019 -- 15:39:49 - (runmode-af-packet.c:417) <Warning> (ParseAFPConfig) -- [ERRCODE: SC_ERR_INVALID_VALUE(130)] - Error when loading eBPF lb file

I rebuilt the latest libbpf from the 5.1.4 kernel sources recently.

I used to always see the previous XDP errors when suri exited, I don't see them any more at least.

-Coop

-----Original Message-----
From: Eric Leblond <eric at regit.org> 
Sent: Tuesday, June 18, 2019 3:27 PM
To: Nelson, Cooper <cnelson at ucsd.edu>; Peter Manev <petermanev at gmail.com>
Cc: oisf-users at lists.openinfosecfoundation.org
Subject: Re: [Oisf-users] Suricata and XDP

Hi,

The eBPF and XDP support have been completely updated in latest master (merge request accepted today). Is it possible for you to retry with latest code ? It may fix things by side-effect. ?

BR,