ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
Compilation requires getting kernel sources for now.
|
2022-11-18 21:50:42 +01:00
|
|
|
|
|
|
|
|
There's a helper script to automate this process:
|
|
|
|
|
https://github.com/evilsocket/opensnitch/blob/master/utils/packaging/build_modules.sh
|
|
|
|
|
|
|
|
|
|
The basic steps to compile the modules are:
|
|
|
|
|
|
|
|
|
|
sudo apt install clang llvm libelf-dev libzip-dev flex bison libssl-dev bc rsync python3
|
|
|
|
|
cd opensnitch
|
|
|
|
|
wget https://github.com/torvalds/linux/archive/v5.8.tar.gz
|
|
|
|
|
tar -xf v5.8.tar.gz
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
cp ebpf_prog/opensnitch*.c ebpf_prog/common* ebpf_prog/Makefile linux-5.8/samples/bpf/
|
|
|
|
|
cp -r ebpf_prog/bpf_headers/ linux-5.8/samples/bpf/
|
2022-11-18 21:50:42 +01:00
|
|
|
cd linux-5.8 && yes "" | make oldconfig && make prepare && make headers_install # (1 min)
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
cd samples/bpf && make KERNEL_DIR=../../linux-5.8/
|
|
|
|
|
objdump -h opensnitch.o # you should see many sections, number 1 should be called kprobe/tcp_v4_connect
|
|
|
|
|
llvm-strip -g opensnitch*.o # remove debug info
|
|
|
|
|
sudo cp opensnitch*.o /usr/lib/opensnitchd/ebpf/ # or /etc/opensnitchd for < v1.6.x
|
2022-11-18 21:50:42 +01:00
|
|
|
cd ../../../daemon
|
|
|
|
|
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
Since v1.6.0, opensnitchd expects to find the opensnitch*.o modules under:
|
2022-11-18 21:50:42 +01:00
|
|
|
/usr/local/lib/opensnitchd/ebpf/
|
|
|
|
|
/usr/lib/opensnitchd/ebpf/
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
/etc/opensnitchd/ # deprecated, only on < v1.5.x
|
2022-11-18 21:50:42 +01:00
|
|
|
|
|
|
|
|
start opensnitchd with:
|
|
|
|
|
|
|
|
|
|
opensnitchd -rules-path /etc/opensnitchd/rules -process-monitor-method ebpf
|
2021-04-21 20:49:31 +02:00
|
|
|
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
---
|
|
|
|
|
|
|
|
|
|
### Compiling for Fedora (and others rpm based systems)
|
|
|
|
|
|
|
|
|
|
You need to install the kernel-devel, clang and llvm packages.
|
|
|
|
|
|
|
|
|
|
Then: `cd ebpf_prog/ ; make KERNEL_DIR=/usr/src/kernels/$(uname -r)/`
|
|
|
|
|
|
|
|
|
|
(or just pass the kernel version you want)
|
|
|
|
|
|
|
|
|
|
### Notes
|
|
|
|
|
|
2021-04-21 20:49:31 +02:00
|
|
|
The kernel where you intend to run it must have some options activated:
|
|
|
|
|
|
2022-11-18 21:50:42 +01:00
|
|
|
$ grep BPF /boot/config-$(uname -r)
|
|
|
|
|
CONFIG_CGROUP_BPF=y
|
|
|
|
|
CONFIG_BPF=y
|
|
|
|
|
CONFIG_BPF_SYSCALL=y
|
|
|
|
|
CONFIG_BPF_EVENTS=y
|
|
|
|
|
CONFIG_KPROBES=y
|
|
|
|
|
CONFIG_KPROBE_EVENTS=y
|
|
|
|
|
|
|
|
|
|
For the opensnitch-procs.o module to work, this option must be enabled:
|
|
|
|
|
|
|
|
|
|
$ grep FTRACE_SYSCALLS /boot/config-$(uname -r)
|
|
|
|
|
CONFIG_FTRACE_SYSCALLS=y
|
2022-06-27 14:42:54 +02:00
|
|
|
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
(https://github.com/iovisor/bcc/blob/master/docs/kernel_config.md)
|
|
|
|
|
|
|
|
|
|
Also, in some distributions debugfs is not mounted automatically.
|
|
|
|
|
Since v1.6.0 we try to mount it automatically. If you're running
|
|
|
|
|
a lower version so you'll need to mount it manually:
|
2022-06-27 14:42:54 +02:00
|
|
|
|
2022-11-18 21:50:42 +01:00
|
|
|
$ sudo mount -t debugfs none /sys/kernel/debug
|
2022-06-27 14:42:54 +02:00
|
|
|
|
|
|
|
|
In order to make it permanent add it to /etc/fstab:
|
|
|
|
|
|
|
|
|
|
debugfs /sys/kernel/debug debugfs defaults 0 0
|
ebpf: new way of compiling the modules
- Don't rename libbpf's bpf_map_def struct, and distribute the needed bpf
headers.
The bpf_map_def struct has been deprecated for quite some time now,
and it was been removed on >= 6.2 anyway.
We still need it, because we use gobpf.
- Improved compilation behaviour:
- We don't require the kernel sources anymore. We can just use the
kernel headers from the distribution.
- There's no need to copy the sources to the kernel tree, the modules
can be compiled from the ebpf_prog/ dir.
- Compiling against kernels 6.x seems to solve the problem we had with
VPNs, where connections were not intercepted with modules compiled
against 5.8, on kernels >= 5.19.
The modules has been tested on kernels 4.17, 5.4, 5.10, 5.15, 6.1 and
6.2 (kernel connections included).
Closes: #939
2023-05-17 01:20:53 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
opensnitch-procs.o and opensnitch-dns.o are only compatible with kernels >= 5.5,
|
|
|
|
|
bpf_probe_read_user*() were added on that kernel on:
|
|
|
|
|
https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md#helpers
|
