Hello,
I am in the process of building a new version of suricata, and IDS program
that watches network traffic. It has a new module that uses eBPF for high speed
network packet categorization. When building, it uses the following command:
/usr/bin/clang -Wall -Iinclude -O2 \
-I/usr/include/x86_64-linux-gnu/ \
-D__KERNEL__ -D__ASM_SYSREG_H \
-target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll
It eventually includes /usr/include/features.h which in turn includes
/usr/include/gnu/stubs.h. That file has this code:
#if !defined __x86_64__
# include <gnu/stubs-32.h>
#endif
I don't think __x86_64__ is defined as the program is aimed at eBPF in the
kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow this to
resolve. However, I think that the assumption of not having __x86_64__
defined means we are targeting i686 is wrong. What should I do? Do we not
support eBPF programs on Fedora?
Thanks,
-Steve
Show replies by thread