[Oisf-users] Suricata and XDP

[Peter Manev]

> On 19 Jun 2019, at 02:39, Nelson, Cooper <cnelson at ucsd.edu> wrote:
> 
> Well, got a more useful error message this time! 
> 
> 24329] 18/6/2019 -- 15:39:49 - (util-ebpf.c:400) <Error> (EBPFLoadFile) -- [ERRCODE: SC_ERR_INVALID_VALUE(130)] - Unable to load eBPF object: Kernel verifier blocks program loading (-4007)
> [24329] 18/6/2019 -- 15:39:49 - (runmode-af-packet.c:417) <Warning> (ParseAFPConfig) -- [ERRCODE: SC_ERR_INVALID_VALUE(130)] - Error when loading eBPF lb file
> 
> I rebuilt the latest libbpf from the 5.1.4 kernel sources recently.
> 
> I used to always see the previous XDP errors when suri exited, I don't see them any more at least.
> 

What OS/set up is this on?


> -Coop
> 
> -----Original Message-----
> From: Eric Leblond <eric at regit.org> 
> Sent: Tuesday, June 18, 2019 3:27 PM
> To: Nelson, Cooper <cnelson at ucsd.edu>; Peter Manev <petermanev at gmail.com>
> Cc: oisf-users at lists.openinfosecfoundation.org
> Subject: Re: [Oisf-users] Suricata and XDP
> 
> Hi,
> 
> The eBPF and XDP support have been completely updated in latest master (merge request accepted today). Is it possible for you to retry with latest code ? It may fix things by side-effect. ?
> 
> BR,
>