Compiling on Ubuntu 18 && ebpf_kprobe_attach_error

[rubenhak]

Hi,

I'm new to the library. Trying to compile on Ubuntu 18.04. Getting the error:

$ make
g++ -c -std=c++11 -g -Wall -I/usr/include/json-c -DHAVE_JSONC -I/usr/include/x86_64-linux-gnu -DHAVE_LIBCURL ebpf_flow.cpp -o ebpf_flow.o
In file included from /usr/include/bcc/BPF.h:25:0,
                 from ebpf_flow.cpp:32:
/usr/include/bcc/BPFTable.h:320:54: error: field ‘trace’ has incomplete type ‘bpf_stack_build_id [127]’
   struct bpf_stack_build_id trace[BPF_MAX_STACK_DEPTH];
                                                      ^
In file included from /usr/include/bcc/BPFTable.h:30:0,
                 from /usr/include/bcc/BPF.h:25,
                 from ebpf_flow.cpp:32:
/usr/include/bcc/bcc_syms.h:76:38: note: forward declaration of ‘struct bpf_stack_build_id’
                               struct bpf_stack_build_id *trace,
                                      ^~~~~~~~~~~~~~~~~~
Makefile:35: recipe for target 'libebpfflow.a' failed
make: *** [libebpfflow.a] Error 1

Running on Ubuntu 18:

$ uname -a
Linux osboxes 5.0.0-23-generic #24~18.04.1-Ubuntu SMP Mon Jul 29 16:12:28 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.3 LTS
Release:	18.04
Codename:	bionic

BCC version:

$ apt list --installed | grep bcc
bcc/bionic,now 0.16.17-3.3 amd64 [installed]
bcc-tools/stable,stable,now 0.10.0-1 all [installed]
libbcc/stable,stable,now 0.10.0-1 all [installed,automatic]
libbcc-examples/stable,now 0.10.0-1 amd64 [installed]
libcc1-0/bionic-updates,bionic-security,now 8.3.0-6ubuntu1~18.04.1 amd64 [installed,automatic]
python-bcc/stable,stable,now 0.10.0-1 all [installed,automatic]

Installed BCC following instructions at https://github.com/iovisor/bcc/blob/master/INSTALL.md#ubuntu---binary

sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

Found a similar closed issue at IOVisor: iovisor/bcc#2159. Solution there was to add include path to -I /usr/include/bcc/compat to g++.

I added include path to Makefile, and it then compiles. Though I'm getting following error when running ebpflowexport. (I added extra printfs in attachEBPFKernelProbe)

$ sudo ./ebpflowexport -tio
Welcome to ebpflowexport v.1.0.200130
(C) 2018-19 ntop.org
Initializing eBPF [Legacy API]...
[attachEBPFKernelProbe]: tcp_v4_connect/trace_connect_entry...
[attachEBPFKernelProbe]: tcp_v4_connect/trace_connect_v4_return...
ERROR: tcp_v4_connect/trace_connect_v4_return: -1
Unable to initialize libebpfflow: ebpf_kprobe_attach_error
eBPF terminated

Thanks,
Ruben

[lucaderi]

Sorry for the late reply. I have compiled the code out of the box (no fix as you did) and it works.

deri@ubuntu18 206> sudo ./ebpflowexport -t -i -o -v
Welcome to ebpflowexport v.1.0.210831
(C) 2018-21 ntop.org
Initializing eBPF [Legacy API]...
eBPF initializated successfully
1630432886.588776 [ens3][Rcvd][IPv4/TCP][pid/tid: 979/979 [/usr/sbin/sshd], uid/gid: 0/0][father pid/tid: 1/0 [/lib/systemd/systemd], uid/gid: 0/0][addr: 192.168.122.1:58692 <-> 192.168.122.96:22][ACCEPT]

deri@ubuntu18 207> lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.04.5 LTS
Release: 18.04
Codename: bionic