ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
# OpenSnitch - 2023
|
|
|
|
|
#
|
|
|
|
|
# On Debian based distros we need the following 2 directories.
|
|
|
|
|
# Otherwise, just use the kernel headers from the kernel sources.
|
|
|
|
|
#
|
|
|
|
|
KERNEL_DIR ?= /lib/modules/$(shell uname -r)/source
|
|
|
|
|
KERNEL_HEADERS ?= /usr/src/linux-headers-$(shell uname -r)/
|
2021-04-05 09:28:16 +00:00
|
|
|
CLANG ?= clang
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
LLC ?= llc
|
|
|
|
|
LLVM_STRIP ?= llvm-strip -g
|
2023-07-07 13:28:58 +03:00
|
|
|
ARCH ?= $(shell uname -m)
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
|
|
|
|
|
# as in /usr/src/linux-headers-*/arch/
|
|
|
|
|
# TODO: extract correctly the archs, and add more if needed.
|
|
|
|
|
ifeq ($(ARCH),x86_64)
|
|
|
|
|
ARCH := x86
|
|
|
|
|
else ifeq ($(ARCH),i686)
|
|
|
|
|
ARCH := x86
|
|
|
|
|
else ifeq ($(ARCH),armv7l)
|
|
|
|
|
ARCH := arm
|
|
|
|
|
else ifeq ($(ARCH),aarch64)
|
|
|
|
|
ARCH := arm64
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
ifeq ($(ARCH),arm)
|
|
|
|
|
# on previous archs, it fails with "SMP not supported on pre-ARMv6"
|
|
|
|
|
EXTRA_FLAGS = "-D__LINUX_ARM_ARCH__=7"
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
BIN := opensnitch.o opensnitch-procs.o opensnitch-dns.o
|
|
|
|
|
CLANG_FLAGS = -I. \
|
2023-05-28 15:24:33 +02:00
|
|
|
-I$(KERNEL_HEADERS)/arch/$(ARCH)/include/generated/ \
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
-I$(KERNEL_HEADERS)/include \
|
|
|
|
|
-include $(KERNEL_DIR)/include/linux/kconfig.h \
|
|
|
|
|
-I$(KERNEL_DIR)/include \
|
|
|
|
|
-I$(KERNEL_DIR)/include/uapi \
|
|
|
|
|
-I$(KERNEL_DIR)/include/generated/uapi \
|
|
|
|
|
-I$(KERNEL_DIR)/arch/$(ARCH)/include \
|
|
|
|
|
-I$(KERNEL_DIR)/arch/$(ARCH)/include/generated \
|
|
|
|
|
-I$(KERNEL_DIR)/arch/$(ARCH)/include/uapi \
|
|
|
|
|
-I$(KERNEL_DIR)/arch/$(ARCH)/include/generated/uapi \
|
|
|
|
|
-I$(KERNEL_DIR)/tools/testing/selftests/bpf/ \
|
|
|
|
|
-D__KERNEL__ -D__BPF_TRACING__ -Wno-unused-value -Wno-pointer-sign \
|
|
|
|
|
-D__TARGET_ARCH_$(ARCH) -Wno-compare-distinct-pointer-types \
|
|
|
|
|
$(EXTRA_FLAGS) \
|
|
|
|
|
-Wno-gnu-variable-sized-type-not-at-end \
|
|
|
|
|
-Wno-address-of-packed-member -Wno-tautological-compare \
|
|
|
|
|
-Wno-unknown-warning-option \
|
|
|
|
|
-g -O2 -emit-llvm
|
|
|
|
|
|
|
|
|
|
all: $(BIN)
|
|
|
|
|
|
|
|
|
|
%.o: %.c
|
2023-07-07 13:28:58 +03:00
|
|
|
$(CLANG) $(CLANG_FLAGS) -c $< -o $@.partial
|
|
|
|
|
$(LLC) -march=bpf -mcpu=generic -filetype=obj -o $@ $@.partial
|
|
|
|
|
rm -f $@.partial
|
|
|
|
|
|
2021-04-05 09:28:16 +00:00
|
|
|
clean:
|
2023-07-07 13:28:58 +03:00
|
|
|
rm -f *.o *.partial
|
