Ubuntu Compiling Issue

[cli0]

Hello, I am having issues with compiling dnswatch on Ubuntu 22.04.

I installed every requirement in the README but when I run make I get the following error:

cli0@Tardis:/home/WorkSpace/dnswatch/dns/dnswatch$ make
bpftool btf dump file /sys/kernel/btf/vmlinux format c > bpf/vmlinux.h
clang -g -O2 -Wall -fpie -fno-stack-protector -I /usr/include/bpf -target bpf -D__TARGET_ARCH_x86 -I bpf  -c bpf/dnswatch.bpf.c -o snoop/out/dnswatch_bpf_probe_core.o
bpf/dnswatch.bpf.c:151:21: warning: unused variable 'inet' [-Wunused-variable]
  struct inet_sock* inet = (struct inet_sock*)sk;
                    ^
bpf/dnswatch.bpf.c:176:21: warning: unused variable 'inet' [-Wunused-variable]
  struct inet_sock* inet = (struct inet_sock*)sk;
                    ^
2 warnings generated.
CGO_LDFLAGS="-lbpf" CGO_CFLAGS="-I /usr/include/bpf  -I /usr/include/pcap" go build .
# github.com/aquasecurity/libbpfgo
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:30:9: could not determine kind of name for C.LIBBPF_MAJOR_VERSION
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:35:9: could not determine kind of name for C.LIBBPF_MINOR_VERSION
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:276:55: could not determine kind of name for C.LIBBPF_STRICT_AUTO_RLIMIT_MEMLOCK
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:277:55: could not determine kind of name for C.LIBBPF_STRICT_MAP_DEFINITIONS
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:275:55: could not determine kind of name for C.LIBBPF_STRICT_NO_OBJECT_LIST
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:274:55: could not determine kind of name for C.LIBBPF_STRICT_SEC_NAME
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:707:9: could not determine kind of name for C.bpf_map__lookup_elem
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:516:15: could not determine kind of name for C.bpf_map_create
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:978:7: could not determine kind of name for C.bpf_object__next_map
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:1001:7: could not determine kind of name for C.bpf_object__next_program
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:1285:21: could not determine kind of name for C.bpf_program__type
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:1983:16: could not determine kind of name for C.libbpf_probe_bpf_map_type
/home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:1991:16: could not determine kind of name for C.libbpf_probe_bpf_prog_type
cgo: 
gcc errors for preamble:
In file included from /home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:5:
./libbpfgo.h: In function 'init_perf_buf':
./libbpfgo.h:69:10: error: 'struct perf_buffer_opts' has no member named 'sz'
   69 |   pb_opts.sz = sizeof(struct perf_buffer_opts);
      |          ^
./libbpfgo.h:71:8: error: too many arguments to function 'perf_buffer__new'
   71 |   pb = perf_buffer__new(map_fd, page_cnt, perfCallback, perfLostCallback,
      |        ^~~~~~~~~~~~~~~~
In file included from ./libbpfgo.h:16,
                 from /home/cli0/go/pkg/mod/github.com/aquasecurity/libbpfgo@v0.4.6-libbpf-1.1.0/libbpfgo.go:5:
/usr/include/bpf/libbpf.h:682:1: note: declared here
  682 | perf_buffer__new(int map_fd, size_t page_cnt,
      | ^~~~~~~~~~~~~~~~

make: *** [Makefile:11: build] Error 2

I don't know where to go from here, the error message doesn't help.
Any suggestions would be very appreciated.

[abulimov]

dnswatch requires libbpf 1.1.0 (as is stated in the readme, and evident from libbpfgo@v0.4.6-libbpf-1.1.0 version) , and Ubuntu 22.04 ships with version 0.5.

Can you verify that what you have installed is indeed libbpf 1.1.0 or later?

[cli0]

Hello,
sorry for replying so late. You were right, libbpf 1.1.0 was missing, I had another version installed. I fixed that and installed the right library but now I got a follow up error.

$ make
bpftool btf dump file /sys/kernel/btf/vmlinux format c > bpf/vmlinux.h
clang -g -O2 -Wall -fpie -fno-stack-protector -I /usr/include/bpf -target bpf -D__TARGET_ARCH_x86 -I bpf  -c bpf/dnswatch.bpf.c -o snoop/out/dnswatch_bpf_probe_core.o
bpf/dnswatch.bpf.c:44:16: error: use of undeclared identifier 'BPF_MAP_TYPE_RINGBUF'
  __uint(type, BPF_MAP_TYPE_RINGBUF);
               ^
bpf/dnswatch.bpf.c:167:25: warning: incompatible pointer types passing 'unsigned long long *' to parameter of type 'struct pt_regs *' [-Wincompatible-pointer-types]
  return sendmsg_solver(ctx, 0, dport, sport);
                        ^~~
bpf/dnswatch.bpf.c:108:32: note: passing argument to parameter 'ctx' here
sendmsg_solver(struct pt_regs* ctx, char fn_id, u16 dport, u16 sport) {
                               ^
bpf/dnswatch.bpf.c:184:25: warning: incompatible pointer types passing 'unsigned long long *' to parameter of type 'struct pt_regs *' [-Wincompatible-pointer-types]
  return sendmsg_solver(ctx, 1, dport, sport);
                        ^~~
bpf/dnswatch.bpf.c:108:32: note: passing argument to parameter 'ctx' here
sendmsg_solver(struct pt_regs* ctx, char fn_id, u16 dport, u16 sport) {
                               ^
bpf/dnswatch.bpf.c:194:25: warning: incompatible pointer types passing 'unsigned long long *' to parameter of type 'struct pt_regs *' [-Wincompatible-pointer-types]
  return sendmsg_solver(ctx, 2, dport, dport);
                        ^~~
bpf/dnswatch.bpf.c:108:32: note: passing argument to parameter 'ctx' here
sendmsg_solver(struct pt_regs* ctx, char fn_id, u16 dport, u16 sport) {
                               ^
3 warnings and 1 error generated.
make: *** [Makefile:9: snoop/out/dnswatch_bpf_probe_core.o] Fehler 1

This one is tripping me up as well. If you have any idea how to navigate this, it would be very helpful. Looks like the code is missing a variable declaration...

[deathowl]

on a fresh VM i installed the deps and built dnswatch succesfully

root@scw-elated-fermi:~/dns/dnswatch# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.04
DISTRIB_CODENAME=jammy
DISTRIB_DESCRIPTION="Ubuntu 22.04.3 LTS"
root@scw-elated-fermi:~/dns/dnswatch# make clean
rm -f snoop/out/dnswatch_bpf_probe_core.o
rm -f bpf/vmlinux.h
root@scw-elated-fermi:~/dns/dnswatch# make
bpftool btf dump file /sys/kernel/btf/vmlinux format c > bpf/vmlinux.h
clang -g -O2 -Wall -fpie -fno-stack-protector -I /usr/include/bpf -target bpf -D__TARGET_ARCH_x86 -I bpf  -c bpf/dnswatch.bpf.c -o snoop/out/dnswatch_bpf_probe_core.o
bpf/dnswatch.bpf.c:96:25: warning: incompatible pointer types passing 'unsigned long long *' to parameter of type 'struct pt_regs *' [-Wincompatible-pointer-types]
  return sendmsg_solver(ctx, 0, dport, sport);
                        ^~~
bpf/dnswatch.bpf.c:48:32: note: passing argument to parameter 'ctx' here
sendmsg_solver(struct pt_regs* ctx, char fn_id, u16 dport, u16 sport) {
                               ^
bpf/dnswatch.bpf.c:113:25: warning: incompatible pointer types passing 'unsigned long long *' to parameter of type 'struct pt_regs *' [-Wincompatible-pointer-types]
  return sendmsg_solver(ctx, 1, dport, sport);
                        ^~~
bpf/dnswatch.bpf.c:48:32: note: passing argument to parameter 'ctx' here
sendmsg_solver(struct pt_regs* ctx, char fn_id, u16 dport, u16 sport) {
                               ^
bpf/dnswatch.bpf.c:123:25: warning: incompatible pointer types passing 'unsigned long long *' to parameter of type 'struct pt_regs *' [-Wincompatible-pointer-types]
  return sendmsg_solver(ctx, 2, dport, dport);
                        ^~~
bpf/dnswatch.bpf.c:48:32: note: passing argument to parameter 'ctx' here
sendmsg_solver(struct pt_regs* ctx, char fn_id, u16 dport, u16 sport) {
                               ^
bpf/dnswatch.bpf.c:118:14: warning: variable 'sport' set but not used [-Wunused-but-set-variable]
  u16 dport, sport;
             ^
4 warnings generated.
CGO_LDFLAGS="-lbpf" CGO_CFLAGS="-I /usr/include/bpf  -I /usr/include/pcap" go build .
root@scw-elated-fermi:~/dns/dnswatch# ./dnswatch snoop
INFO[0000] PID     PNAME           TYPE  QNAME                                                                            RCODE