Giters

gamemann / XDP-Firewall

A firewall that utilizes the Linux kernel's XDP hook. The XDP hook allows for very fast network processing on Linux systems. This is great for dropping malicious traffic from a (D)DoS attack. IPv6 is supported with this firewall! I hope this helps network engineers/programmers interested in utilizing XDP!

Home Page:https://deaconn.net/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Build error

g00g1 opened this issue · comments

commented

I have followed guidance from README but encountered the following error while executing make:
error: <unknown>:0:0: in function xdp_prog_main i32 (ptr): A call to built-in function '__stack_chk_fail' is not supported.

I have also tried to apply fix from #30 (cd libbpf && git checkout 7fc4d50), but that didn't solve the issue.

UPD: The host is AMD Ryzen 5 3600, Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller, gentoo-kernel-6.1.24 built from own config.txt

commented

Finally I have looked up the solution for this issue. For your further inspection I have attached the patches below.

diff --git a/Makefile b/Makefile
index 8c5465d..7172400 100644
--- a/Makefile
+++ b/Makefile
@@ -24,6 +24,7 @@ XDPPROGOBJ = xdpfw_kern.o
 
 OBJS = $(BUILDDIR)/$(CONFIGOBJ) $(BUILDDIR)/$(CMDLINEOBJ)
 
+CFLAGS += -fno-stack-protector
 LDFLAGS += -lconfig -lelf -lz
 INCS = -I $(LIBBPFSRC)
 
@@ -33,7 +34,7 @@ xdpfw: utils libbpf $(OBJS)
        $(CC) $(LDFLAGS) $(INCS) -o $(BUILDDIR)/$(XDPFWOUT) $(LIBBPFOBJS) $(OBJS) $(SRCDIR)/$(XDPFWSRC)
 xdpfw_filter:
        mkdir -p $(BUILDDIR)/
-       $(CC) $(INCS) -D__BPF__ -O2 -emit-llvm -c -o $(BUILDDIR)/$(XDPPROGBC) $(SRCDIR)/$(XDPPROGSRC)
+       $(CC) $(CFLAGS) $(INCS) -D__BPF__ -O2 -emit-llvm -c -o $(BUILDDIR)/$(XDPPROGBC) $(SRCDIR)/$(XDPPROGSRC)
        llc -march=bpf -filetype=obj -o $(BUILDDIR)/$(XDPPROGOBJ) $(BUILDDIR)/$(XDPPROGBC)
 utils:
        mkdir -p $(BUILDDIR)/
@@ -52,4 +53,4 @@ install:
        cp $(BUILDDIR)/$(XDPFWOUT) /usr/bin/$(XDPFWOUT)
        cp -n other/xdpfw.service /etc/systemd/system/
 .PHONY: libbpf all
-.DEFAULT: all
\ No newline at end of file
+.DEFAULT: all
diff --git a/libbpf b/libbpf
--- a/libbpf
+++ b/libbpf
@@ -1 +1 @@
-Subproject commit 7fc4d5025b22da2fd1a3f767b2973b7f28d21758
+Subproject commit 7fc4d5025b22da2fd1a3f767b2973b7f28d21758-dirty

diff --git a/src/Makefile b/src/Makefile
index bc25aba..12f72e2 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -17,7 +17,7 @@ endif
 
 SHARED_CFLAGS += -fPIC -fvisibility=hidden -DSHARED
 
-CFLAGS ?= -g -O2 -Werror -Wall
+CFLAGS ?= -g -O2 -Werror -Wall -fno-stack-protector
 ALL_CFLAGS += $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 ALL_LDFLAGS += $(LDFLAGS)
 ifdef NO_PKG_CONFIG
commented

Hey, thank you for the information and the patches!

I haven't tried installing this firewall on a Gentoo Linux server yet. That is going to be my next project and I'll keep this issue open until I do so. From what I can see, you added the -fno-stack-protector flag. I just wanted to confirm, in the last patch are you adding this to LibBPF's Makefile?

commented

I would like to highlight an important thing - it seems like this issue arises only if toolchain hardening is enabled, and in my case I have both "hardened" USE-flag enabled and default/linux/amd64/17.1/no-multilib/hardened profile selected. Thus, in most of the setups (like distros in stock configuration) there won't have such an issue.

in the last patch are you adding this to LibBPF's Makefile?

Yes.

commented

I see now!

Thank you for the information and I updated the README with a section regarding this here. I mentioned this issue and you in the README since you were the one that discovered the issue and provided a fix.

If you want your name or this issue omitted from the README, please let me know!

commented

I'm going to close this issue as well since information was added to the README. Thank you again for the info!