Failed to compile BPF Module

[atharva-simulauib]

Hi,

I am trying to install this tool but I am facing the same errors as in #22. Except I am not using a VrtuualBox. I am running Ubuntu 22.04.5 LTS, and I followed the installation instructions as given in the readme file. Specifically, after cloning the git repo I created a virtual environment (because this was suggested as a fix in the discussion thread for #22). Then I run ubuntu-setup.sh with sudo. I also run pip install -r requirements.txt. I am able to start mongosh and run the commands to start a database, and also setting DB_URL and and DB_name, without facing any errors. But, when I try to run the monitoring tool. with sudo -E cryptomon.i I get the following error:

Available network interfaces:
1: lo
2: enp0s31f6
3: wlp2s0
Select an interface by number: 2
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:5:
In file included from include/linux/compiler_types.h:148:
include/linux/compiler-clang.h:45:9: warning: '__HAVE_BUILTIN_BSWAP32__' macro redefined
      [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP32__
        ^
<command line>:4:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP32__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:5:
In file included from include/linux/compiler_types.h:148:
include/linux/compiler-clang.h:46:9: warning: '__HAVE_BUILTIN_BSWAP64__' macro redefined
      [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP64__
        ^
<command line>:5:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP64__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:5:
In file included from include/linux/compiler_types.h:148:
include/linux/compiler-clang.h:47:9: warning: '__HAVE_BUILTIN_BSWAP16__' macro redefined
      [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP16__
        ^
<command line>:3:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP16__ 1
        ^
In file included from /virtual/main.c:5:
include/linux/bpf.h:341:10: error: invalid application of 'sizeof' to an incomplete type
      'struct bpf_timer'
                return sizeof(struct bpf_timer);
                       ^     ~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:341:24: note: forward declaration of 'struct bpf_timer'
                return sizeof(struct bpf_timer);
                                     ^
include/linux/bpf.h:347:10: error: invalid application of 'sizeof' to an incomplete type
      'struct bpf_list_head'
                return sizeof(struct bpf_list_head);
                       ^     ~~~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:347:24: note: forward declaration of 'struct bpf_list_head'
                return sizeof(struct bpf_list_head);
                                     ^
include/linux/bpf.h:349:10: error: invalid application of 'sizeof' to an incomplete type
      'struct bpf_list_node'
                return sizeof(struct bpf_list_node);
                       ^     ~~~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:349:24: note: forward declaration of 'struct bpf_list_node'
                return sizeof(struct bpf_list_node);
                                     ^
include/linux/bpf.h:351:10: error: invalid application of 'sizeof' to an incomplete type
      'struct bpf_rb_root'
                return sizeof(struct bpf_rb_root);
                       ^     ~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:351:24: note: forward declaration of 'struct bpf_rb_root'
                return sizeof(struct bpf_rb_root);
                                     ^
include/linux/bpf.h:353:10: error: invalid application of 'sizeof' to an incomplete type
      'struct bpf_rb_node'
                return sizeof(struct bpf_rb_node);
                       ^     ~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:353:24: note: forward declaration of 'struct bpf_rb_node'
                return sizeof(struct bpf_rb_node);
                                     ^
include/linux/bpf.h:355:10: error: invalid application of 'sizeof' to an incomplete type
      'struct bpf_refcount'
                return sizeof(struct bpf_refcount);
                       ^     ~~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:355:24: note: forward declaration of 'struct bpf_refcount'
                return sizeof(struct bpf_refcount);
                                     ^
include/linux/bpf.h:368:10: error: invalid application of '__alignof' to an incomplete type
      'struct bpf_timer'
                return __alignof__(struct bpf_timer);
                       ^          ~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:368:29: note: forward declaration of 'struct bpf_timer'
                return __alignof__(struct bpf_timer);
                                          ^
include/linux/bpf.h:374:10: error: invalid application of '__alignof' to an incomplete type
      'struct bpf_list_head'
                return __alignof__(struct bpf_list_head);
                       ^          ~~~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:374:29: note: forward declaration of 'struct bpf_list_head'
                return __alignof__(struct bpf_list_head);
                                          ^
include/linux/bpf.h:376:10: error: invalid application of '__alignof' to an incomplete type
      'struct bpf_list_node'
                return __alignof__(struct bpf_list_node);
                       ^          ~~~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:376:29: note: forward declaration of 'struct bpf_list_node'
                return __alignof__(struct bpf_list_node);
                                          ^
include/linux/bpf.h:378:10: error: invalid application of '__alignof' to an incomplete type
      'struct bpf_rb_root'
                return __alignof__(struct bpf_rb_root);
                       ^          ~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:378:29: note: forward declaration of 'struct bpf_rb_root'
                return __alignof__(struct bpf_rb_root);
                                          ^
include/linux/bpf.h:380:10: error: invalid application of '__alignof' to an incomplete type
      'struct bpf_rb_node'
                return __alignof__(struct bpf_rb_node);
                       ^          ~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:380:29: note: forward declaration of 'struct bpf_rb_node'
                return __alignof__(struct bpf_rb_node);
                                          ^
include/linux/bpf.h:382:10: error: invalid application of '__alignof' to an incomplete type
      'struct bpf_refcount'
                return __alignof__(struct bpf_refcount);
                       ^          ~~~~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:382:29: note: forward declaration of 'struct bpf_refcount'
                return __alignof__(struct bpf_refcount);
                                          ^
include/linux/bpf.h:945:50: error: use of undeclared identifier 'BPF_PSEUDO_FUNC'
        return bpf_is_ldimm64(insn) && insn->src_reg == BPF_PSEUDO_FUNC;
                                                        ^
include/linux/bpf.h:2309:30: error: field has incomplete type 'enum bpf_cgroup_iter_order'
                enum bpf_cgroup_iter_order order;
                                           ^
include/linux/bpf.h:2309:8: note: forward declaration of 'enum bpf_cgroup_iter_order'
                enum bpf_cgroup_iter_order order;
                     ^
include/linux/bpf.h:2536:59: warning: declaration of 'struct bpf_core_relo' will not be visible outside
      of this function [-Wvisibility]
int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
                                                          ^
4 warnings and 14 errors generated.
Traceback (most recent call last):
  File "/home/work/pqc/CryptoMon/./cryptomon.py", line 86, in <module>
    cm = CryptoMon(iface=args.interface,
  File "/home/work/pqc/CryptoMon/cryptomon/__init__.py", line 44, in __init__
    self.b = BPF(text=bpf_code)
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 364, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>
(pqc) work@work-Probook-640-G2:~/pqc/CryptoMon$```



I believe I have followed all the installation and setup instructions, as mentioned above. I would really appreciate if you could help me with this issue- Thanks in advance!

[atharva-simulauib]

Hi, thanks a lot for updates on the issue, I will look into the Copilot details and can try with the fixes. Just wanted to mention a couple of things I found that might be relevant to the kernel headers issue:

1. line 6 of ubuntu-setup.sh does not install linux-tools-5.15.0-41-generic (it does not exist for Ubuntu 22 as per this) but linux-tools for the running kernels are installed at line 33 so this may not be a problem.
2. There are differences in kernel versions for Ubuntu Server vs Desktop image. Server defaults to GA kernel (5.x) but desktop OS automatically upgrades to 6.x

This is mainly because I observed in past discussions others were testing CryptoMon on Ubuntu server so wanted to mention this in case it may help portability across platforms.

[unprovable]

Can you try with 24.04, please?

[unprovable]

If this works under 24.04 (which it should; I tested recently on a clean build, no issues) then the PR #9 will be pushed to main. M.

[atharva-simulauib]

@unprovable have you tried on both server and desktop ubuntu 24? Or should that not matter (despite the kernel version differences as I mentioned)

[unprovable]

I think I was running LTS server for 24.04. Hope that helps!

EDIT - I would consider trying the Desktop version first, as the latter kernel version should iron out a few potential issues.

[atharva-simulauib]

Thanks, I just tried it with Ubuntu 24.04 Desktop version and it did not work. Same error (Failed to compile BPF module, but the header files included in first few lines of error log are different)
Also version 12 of clang, llvm and clang-format was not available for ubuntu 24 so had to manually install latest versions (v18).
I am trying to see if it can be fixed.

[atharva-simulauib]

Some more thoughts and questions:

1. Is it essential to be in "monitoring mode" to use CryptoMon, even if I am interested in traffic to and from the device where Cryptomon is running?
2. Articles like this are commenting that CryptoMon will generate CBOM from cryptography discovered on the network? Although I am not sure if that is the output we get?

Let me know, Thanks!

[unprovable]

Sorry for delay - busy time. So there re: point 2; not sure where they get that from. CryptoMon just logs the crypto it finds in use passively. RE: point 1; yes, you have to run the listener in monitor mode somewhere, as that's how network monitoring works :)

Did you resolve the issue on 24.04? Can you provide more details?

[atharva-simulauib]

Hi, sorry for my late reply
Thanks for clarifying regarding CBOM format!
I did try with Ubuntu 24.04 Desktop version and it did not work. Some of the installation issues I have mentioned in the previous comments. But I was not listening in monitor mode, but as you mention if that is somehow required for BPF to compile properly, that might be the root cause as well. If that is the case, then the issue can be closed (since it works on your machine with monitoring mode)

Regarding the installation issues, if you think they are relevant (for portability) then ubuntu-setup.sh can be fixed. Just copy pasting what I mentioned earlier:

1. Version 12 of clang, llvm and clang-format was not available for ubuntu 24 so had to manually install latest versions (v18).
2. line 6 of ubuntu-setup.sh does not install linux-tools-5.15.0-41-generic (it does not exist for Ubuntu 22 as per this) but linux-tools for the running kernels are installed at line 33 so this may not be a problem.
3. There are differences in kernel versions for Ubuntu Server vs Desktop image. Server defaults to GA kernel (5.x) but desktop OS automatically upgrades to 6.x

Thanks and I will be in touch in case there are any updates