user/kit.c:395:40: error: ‘XDP_FLAGS_REPLACE’ undeclared (first use in this function)

[pythonmandev]

Can not compile it in the ubuntu 20.04.

root@192-168-99-242:~/TripleCross/src# uname -a ; lsb_release -a
Linux 192-168-99-242 5.4.0-121-generic #137-Ubuntu SMP Wed Jun 15 13:33:07 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.4 LTS
Release: 20.04
Codename: focal

root@192-168-99-242:~/TripleCross/src# make
MKDIR .output
MKDIR .output/libbpf
LIB libbpf.a
MKDIR /root/TripleCross/src/.output//libbpf/staticobjs
CC /root/TripleCross/src/.output//libbpf/staticobjs/bpf.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/btf.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/libbpf.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/libbpf_errno.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/netlink.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/nlattr.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/str_error.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/libbpf_probes.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/bpf_prog_linfo.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/xsk.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/btf_dump.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/hashmap.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/ringbuf.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/strset.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/linker.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/gen_loader.o
CC /root/TripleCross/src/.output//libbpf/staticobjs/relo_core.o
AR /root/TripleCross/src/.output//libbpf/libbpf.a
INSTALL bpf.h libbpf.h btf.h libbpf_common.h libbpf_legacy.h xsk.h bpf_helpers.h bpf_helper_defs.h bpf_tracing.h bpf_endian.h bpf_core_read.h skel_internal.h libbpf_version.h
INSTALL /root/TripleCross/src/.output//libbpf/libbpf.pc
INSTALL /root/TripleCross/src/.output//libbpf/libbpf.a
BPF .output/kit.bpf.o
GEN-SKEL .output/kit.skel.h
libbpf: elf: skipping unrecognized data section(17) .rodata.str1.1
CC .output/kit.o
user/kit.c: In function ‘main’:
user/kit.c:395:40: error: ‘XDP_FLAGS_REPLACE’ undeclared (first use in this function)
395 | module_config_attr.xdp_module.flags = XDP_FLAGS_REPLACE;
| ^~~~~~~~~~~~~~~~~
user/kit.c:395:40: note: each undeclared identifier is reported only once for each function it appears in
make: *** [Makefile:97: .output/kit.o] Error 1
rm .output/kit.bpf.o

[h3xduck]

Hi, this rootkit was developed and tested under Ubuntu 21.04, so it looks like your older kernel (5.4) lacks the definition of this flag.

I can offer you some hints if you must use that environment tho. We use XDP_FLAGS_REPLACE for attaching an XDP program replacing the older one automatically, so you may replace that flag by XDP_FLAGS_SKB and detach the XDP program yourself. That might let you compile, but note that as I described in this other thread there are some other issues you will run into before fully porting the rootkit to another Linux version.

Anyway I just updated the README to reflect the build requirements, so thank you.