Docker image created successfully but compilation error reported

[tongyuanww]

The Docker image has been successfully created. The following is the information displayed：docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
tls-traffic-analyzer latest 0e79c8df13a6 10 days ago 3.05GB
I encountered an error while running the container. The following is the error message. I hope someone can answer it for me
/virtual/main.c:84:145: error: expected expression
struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
^
/virtual/main.c:84:627: error: expected '}'
struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
It appears to be a syntax error, but the file/virtual/main. c cannot be found
Traceback (most recent call last):
File "/usr/lib/python3.10/multiprocessing/process.py", line 314, in _bootstrap
self.run()
File "/usr/lib/python3.10/multiprocessing/process.py", line 108, in run
self._target(*self._args, **self._kwargs)
File "/app/src/dumper/handshake_detector.py", line 75, in run
bpf = setup_bpf(self.interface)
File "/app/src/dumper/bpf.py", line 40, in setup_bpf
bpf = BPF(src_file="src/dumper/handshake_detector.c", debug=False)
File "/usr/lib/python3/dist-packages/bcc/init.py", line 479, in init
raise Exception("Failed to compile BPF module %s" % (src_file or ""))
Exception: Failed to compile BPF module b'src/dumper/handshake_detector.c'
This is the final error message

[snowroll]

+1

[drzraf]

Same error (no Docker involved), Linux 6.8.0, Python bcc 0.29.1 (python3-bpfcc)

2024-10-18 16:48:32,131 MainProcess           network.py:__init__       INFO Traffic dumps will be saved to dumps/


/virtual/main.c:84:145: error: expected expression
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                 ^
/virtual/main.c:84:627: error: expected '}'
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ^
/virtual/main.c:84:143: note: to match this '{'
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                               ^
/virtual/main.c:84:21: error: initializing 'struct inet_sock *' with an expression of incompatible type 'typeof(struct sock)' (aka 'struct sock')
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                     ^      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/virtual/main.c:84:638: error: extraneous ')' before ';'
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ^
/virtual/main.c:84:641: error: use of undeclared identifier '_val'
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 ^
/virtual/main.c:84:648: error: expected identifier or '('
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ^
/virtual/main.c:84:652: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ^
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            int
/virtual/main.c:84:658: error: extraneous closing brace ('}')
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ^
/virtual/main.c:84:659: error: expected identifier or '('
   84 |   struct inet_sock *inet = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)net_sk); _val; })); _val; })); _val; })); _val; })); _val; })(skp);
      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ^
/virtual/main.c:85:25: error: statement expression not allowed at file scope
   85 |   u32 daddr = bpf_ntohl(({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&sa_in->sin_addr.s_addr); _val; }));
      |                         ^
/virtual/main.c:86:25: error: statement expression not allowed at file scope
   86 |   u32 saddr = bpf_ntohl(({ typeof(__be32) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&inet->inet_saddr); _val; }));  // FIXME: equal to 0?
      |                         ^
/virtual/main.c:87:25: error: statement expression not allowed at file scope
   87 |   u16 sport = bpf_ntohs(({ typeof(__be16) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&inet->inet_sport); _val; }));
      |                         ^
/virtual/main.c:90:3: error: unknown type name 'tuple'
   90 |   tuple.saddr = saddr;
      |   ^
/virtual/main.c:90:8: error: expected identifier or '('
   90 |   tuple.saddr = saddr;
      |        ^
/virtual/main.c:91:3: error: unknown type name 'tuple'
   91 |   tuple.sport = sport;
      |   ^
/virtual/main.c:91:8: error: expected identifier or '('
   91 |   tuple.sport = sport;
      |        ^
/virtual/main.c:92:3: error: unknown type name 'tuple'
   92 |   tuple.daddr = daddr;
      |   ^
/virtual/main.c:92:8: error: expected identifier or '('
   92 |   tuple.daddr = daddr;
      |        ^
/virtual/main.c:93:3: error: unknown type name 'tuple'
   93 |   tuple.dport = dport; 
      |   ^
fatal error: too many errors emitted, stopping now [-ferror-limit=]
20 errors generated.
Process MemoryDumper:
Traceback (most recent call last):
  File "/usr/lib/python3.12/multiprocessing/process.py", line 314, in _bootstrap
    self.run()
  File "/usr/lib/python3.12/multiprocessing/process.py", line 108, in run
    self._target(*self._args, **self._kwargs)
  File "/x-ray-tls/src/dumper/handshake_detector.py", line 75, in run
    bpf = setup_bpf(self.interface)
          ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/x-ray-tls/src/dumper/bpf.py", line 40, in setup_bpf
    bpf = BPF(src_file="src/dumper/handshake_detector.c", debug=True)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 479, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module b'src/dumper/handshake_detector.c'

[fl42]

Hello,
Is your OS ubuntu 20.04?
As of now, only Ubuntu 20.04 is supported as host OS.

[drzraf]

24.04

What is actually distribution-specific? Kernel or specific user-space version?

[dontepanlin]

Same error on Ubuntu 20.04.5 LTS. Linux kernel version 5.4.0-139-generic

[kStor2poche]

This seems to be caused by a weird macro expansion that is not handled correctly within its context in the bpf code.

Though I am not sure of the exact source of this issue (tought at first it was a BCC bug on versions >= 0.29.1 but people saying that it happens with ubuntu 20.04.5 LTS hinder that hypothesis) I have resolved the issue in my fork while porting to 24.04 (see my patched file at lines 69-74).

If you are interested in a port to ubuntu 24.04, there is a PR pending with the corresponding branch there.