Merge pull request #1817 from sarthurdev/bookworm

debian: T5003: Upgrade base system to Debian 12 "Bookworm"

12 files changed, 72 insertions, 65 deletions

diff --git a/data/templates/chrony/override.conf.j2 b/data/templates/chrony/override.conf.j2
index 9eaea7608..0ab8f0824 100644
--- a/data/templates/chrony/override.conf.j2
+++ b/data/templates/chrony/override.conf.j2
@@ -5,6 +5,7 @@ ConditionPathExists={{ config_file }}
 After=vyos-router.service
 
 [Service]
+User=root
 EnvironmentFile=
 ExecStart=
 ExecStart={{ vrf_command }}/usr/sbin/chronyd -F 1 -f {{ config_file }}
@@ -13,5 +14,5 @@ PIDFile={{ config_file | replace('.conf', '.pid') }}
 Restart=always
 RestartSec=10
 # Required for VRF support
-ProtectControlGroups=No
-
+ProcSubset=all
+ProtectControlGroups=no
diff --git a/data/templates/dynamic-dns/ddclient.conf.j2 b/data/templates/dynamic-dns/ddclient.conf.j2
index 3c2d17cbb..c2c9b1dd6 100644
--- a/data/templates/dynamic-dns/ddclient.conf.j2
+++ b/data/templates/dynamic-dns/ddclient.conf.j2
@@ -10,7 +10,7 @@ ssl=yes
 {%             set web_skip = ", web-skip='" ~ iface_config.use_web.skip ~ "'" if iface_config.use_web.skip is vyos_defined else '' %}
 use=web, web='{{ iface_config.use_web.url }}'{{ web_skip }}
 {%         else %}
-{{ 'usev6=if' if iface_config.ipv6_enable is vyos_defined else 'use=if' }}, if={{ iface }}
+{{ 'usev6=ifv6' if iface_config.ipv6_enable is vyos_defined else 'use=if' }}, if={{ iface }}
 {%         endif %}
 
 {%         if iface_config.rfc2136 is vyos_defined %}
diff --git a/debian/control b/debian/control
index 2b940a412..fb29697d4 100644
--- a/debian/control
+++ b/debian/control
@@ -8,6 +8,7 @@ Build-Depends:
   fakeroot,
   gcc-multilib [amd64],
   clang [amd64],
+  iproute2,
   llvm [amd64],
   libbpf-dev [amd64],
   libelf-dev (>= 0.2) [amd64],
@@ -45,7 +46,6 @@ Depends:
   conserver-client,
   conserver-server,
   console-data,
-  crda,
   cron,
   curl,
   dbus,
@@ -79,7 +79,7 @@ Depends:
   lcdproc,
   lcdproc-extra-drivers,
   libatomic1,
-  libbpf0 [amd64],
+  libbpf1 [amd64],
   libcharon-extra-plugins (>=5.9),
   libcharon-extauth-plugins (>=5.9),
   libndp-tools,
diff --git a/smoketest/bin/vyos-smoketest b/smoketest/bin/vyos-smoketest
index cb039db42..135388afe 100755
--- a/smoketest/bin/vyos-smoketest
+++ b/smoketest/bin/vyos-smoketest
@@ -26,7 +26,7 @@ for root, dirs, files in os.walk('/usr/libexec/vyos/tests/smoke'):
         test_file = os.path.join(root, name)
         mode = os.stat(test_file).st_mode
 
-        if mode & S_IXOTH:
+        if name.startswith("test_") and mode & S_IXOTH:
             print('Running Testcase: ' + test_file)
             process = Popen([test_file], stdout=PIPE)
             (output, err) = process.communicate()
diff --git a/smoketest/scripts/cli/test_load_balancing_wan.py b/smoketest/scripts/cli/test_load_balancing_wan.py
index 33c69c595..0e1806f66 100755
--- a/smoketest/scripts/cli/test_load_balancing_wan.py
+++ b/smoketest/scripts/cli/test_load_balancing_wan.py
@@ -143,15 +143,15 @@ class TestLoadBalancingWan(VyOSUnitTestSHIM.TestCase):
         container_iface3 = 'ceth2'
         mangle_isp1 = """table ip mangle {
 	chain ISP_veth1 {
-		counter ct mark set 0xc9 
-		counter meta mark set 0xc9 
+		counter ct mark set 0xc9
+		counter meta mark set 0xc9
 		counter accept
 	}
 }"""
         mangle_isp2 = """table ip mangle {
 	chain ISP_veth2 {
-		counter ct mark set 0xca 
-		counter meta mark set 0xca 
+		counter ct mark set 0xca
+		counter meta mark set 0xca
 		counter accept
 	}
 }"""
@@ -163,7 +163,7 @@ class TestLoadBalancingWan(VyOSUnitTestSHIM.TestCase):
 }"""
         mangle_wanloadbalance_pre = """table ip mangle {
 	chain WANLOADBALANCE_PRE {
-		iifname "veth3" ip saddr 198.51.100.0/24 ct state new  counter jump ISP_veth1
+		iifname "veth3" ip saddr 198.51.100.0/24 ct state new meta random & 2147483647 < 1073741824 counter jump ISP_veth1
 		iifname "veth3" ip saddr 198.51.100.0/24 ct state new counter jump ISP_veth2
 		iifname "veth3" ip saddr 198.51.100.0/24 counter meta mark set ct mark
 	}
@@ -177,7 +177,6 @@ class TestLoadBalancingWan(VyOSUnitTestSHIM.TestCase):
         nat_vyos_pre_snat_hook = """table ip nat {
 	chain VYOS_PRE_SNAT_HOOK {
 		type nat hook postrouting priority srcnat - 1; policy accept;
-		counter jump WANLOADBALANCE
 		return
 	}
 }"""
diff --git a/smoketest/scripts/cli/test_service_dns_dynamic.py b/smoketest/scripts/cli/test_service_dns_dynamic.py
index 90d10d40b..57705e26f 100755
--- a/smoketest/scripts/cli/test_service_dns_dynamic.py
+++ b/smoketest/scripts/cli/test_service_dns_dynamic.py
@@ -155,7 +155,7 @@ class TestServiceDDNS(VyOSUnitTestSHIM.TestCase):
         self.assertEqual(login, user)
         self.assertEqual(pwd, f"'{password}'")
         self.assertEqual(server, srv)
-        self.assertEqual(usev6, f"if, if={interface}")
+        self.assertEqual(usev6, f"ifv6, if={interface}")
 
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/src/etc/systemd/system/ddclient.service.d/override.conf b/src/etc/systemd/system/ddclient.service.d/override.conf
index d9c9963b0..09d929d39 100644
--- a/src/etc/systemd/system/ddclient.service.d/override.conf
+++ b/src/etc/systemd/system/ddclient.service.d/override.conf
@@ -8,4 +8,4 @@ WorkingDirectory=/run/ddclient
 PIDFile=
 PIDFile=/run/ddclient/ddclient.pid
 ExecStart=
-ExecStart=/usr/sbin/ddclient -cache /run/ddclient/ddclient.cache -pid /run/ddclient/ddclient.pid -file /run/ddclient/ddclient.conf
+ExecStart=/usr/bin/ddclient -cache /run/ddclient/ddclient.cache -pid /run/ddclient/ddclient.pid -file /run/ddclient/ddclient.conf
diff --git a/src/tests/test_configverify.py b/src/tests/test_configverify.py
index ad7e053db..6fb43ece2 100644
--- a/src/tests/test_configverify.py
+++ b/src/tests/test_configverify.py
@@ -27,11 +27,6 @@ class TestDictSearch(TestCase):
     def test_dh_key_none(self):
         self.assertFalse(verify_diffie_hellman_length('/tmp/non_existing_file', '1024'))
 
-    def test_dh_key_256(self):
-        key_len = '256'
-        cmd(f'openssl dhparam -out {dh_file} {key_len}')
-        self.assertTrue(verify_diffie_hellman_length(dh_file, key_len))
-
     def test_dh_key_512(self):
         key_len = '512'
         cmd(f'openssl dhparam -out {dh_file} {key_len}')
diff --git a/src/xdp/common/common_libbpf.c b/src/xdp/common/common_libbpf.c
index 5788ecd9e..443ca4c66 100644
--- a/src/xdp/common/common_libbpf.c
+++ b/src/xdp/common/common_libbpf.c
@@ -24,10 +24,6 @@ static inline bool IS_ERR_OR_NULL(const void *ptr)
 int bpf_prog_load_xattr_maps(const struct bpf_prog_load_attr_maps *attr,
 			     struct bpf_object **pobj, int *prog_fd)
 {
-	struct bpf_object_open_attr open_attr = {
-		.file		= attr->file,
-		.prog_type	= attr->prog_type,
-	};
 	struct bpf_program *prog, *first_prog = NULL;
 	enum bpf_attach_type expected_attach_type;
 	enum bpf_prog_type prog_type;
@@ -41,10 +37,13 @@ int bpf_prog_load_xattr_maps(const struct bpf_prog_load_attr_maps *attr,
 	if (!attr->file)
 		return -EINVAL;
 
+	obj = bpf_object__open_file(attr->file, NULL);
 
-	obj = bpf_object__open_xattr(&open_attr);
-	if (IS_ERR_OR_NULL(obj))
-		return -ENOENT;
+	if (libbpf_get_error(obj))
+		return -EINVAL;
+
+	prog = bpf_object__next_program(obj, NULL);
+	bpf_program__set_type(prog, attr->prog_type);
 
 	bpf_object__for_each_program(prog, obj) {
 		/*
@@ -82,7 +81,7 @@ int bpf_prog_load_xattr_maps(const struct bpf_prog_load_attr_maps *attr,
 	bpf_map__for_each(map, obj) {
 		const char* mapname = bpf_map__name(map);
 
-		if (!bpf_map__is_offload_neutral(map))
+		if (bpf_map__type(map) != BPF_MAP_TYPE_PERF_EVENT_ARRAY)
 			bpf_map__set_ifindex(map, attr->ifindex);
                         /* Was: map->map_ifindex = attr->ifindex; */
 
diff --git a/src/xdp/common/common_user_bpf_xdp.c b/src/xdp/common/common_user_bpf_xdp.c
index faf7f4f91..524f08c9d 100644
--- a/src/xdp/common/common_user_bpf_xdp.c
+++ b/src/xdp/common/common_user_bpf_xdp.c
@@ -21,7 +21,7 @@ int xdp_link_attach(int ifindex, __u32 xdp_flags, int prog_fd)
 	int err;
 
 	/* libbpf provide the XDP net_device link-level hook attach helper */
-	err = bpf_set_link_xdp_fd(ifindex, prog_fd, xdp_flags);
+	err = bpf_xdp_attach(ifindex, prog_fd, xdp_flags, NULL);
 	if (err == -EEXIST && !(xdp_flags & XDP_FLAGS_UPDATE_IF_NOEXIST)) {
 		/* Force mode didn't work, probably because a program of the
 		 * opposite type is loaded. Let's unload that and try loading
@@ -32,9 +32,9 @@ int xdp_link_attach(int ifindex, __u32 xdp_flags, int prog_fd)
 
 		xdp_flags &= ~XDP_FLAGS_MODES;
 		xdp_flags |= (old_flags & XDP_FLAGS_SKB_MODE) ? XDP_FLAGS_DRV_MODE : XDP_FLAGS_SKB_MODE;
-		err = bpf_set_link_xdp_fd(ifindex, -1, xdp_flags);
+		err = bpf_xdp_detach(ifindex, xdp_flags, NULL);
 		if (!err)
-			err = bpf_set_link_xdp_fd(ifindex, prog_fd, old_flags);
+			err = bpf_xdp_attach(ifindex, prog_fd, old_flags, NULL);
 	}
 	if (err < 0) {
 		fprintf(stderr, "ERR: "
@@ -65,7 +65,7 @@ int xdp_link_detach(int ifindex, __u32 xdp_flags, __u32 expected_prog_id)
 	__u32 curr_prog_id;
 	int err;
 
-	err = bpf_get_link_xdp_id(ifindex, &curr_prog_id, xdp_flags);
+	err = bpf_xdp_query_id(ifindex,  xdp_flags, &curr_prog_id);
 	if (err) {
 		fprintf(stderr, "ERR: get link xdp id failed (err=%d): %s\n",
 			-err, strerror(-err));
@@ -86,7 +86,7 @@ int xdp_link_detach(int ifindex, __u32 xdp_flags, __u32 expected_prog_id)
 		return EXIT_FAIL;
 	}
 
-	if ((err = bpf_set_link_xdp_fd(ifindex, -1, xdp_flags)) < 0) {
+	if ((err = bpf_xdp_detach(ifindex, xdp_flags, NULL)) < 0) {
 		fprintf(stderr, "ERR: %s() link set xdp failed (err=%d): %s\n",
 			__func__, err, strerror(-err));
 		return EXIT_FAIL_XDP;
@@ -109,22 +109,28 @@ struct bpf_object *load_bpf_object_file(const char *filename, int ifindex)
 	 * hardware offloading XDP programs (note this sets libbpf
 	 * bpf_program->prog_ifindex and foreach bpf_map->map_ifindex).
 	 */
-	struct bpf_prog_load_attr prog_load_attr = {
-		.prog_type = BPF_PROG_TYPE_XDP,
-		.ifindex   = ifindex,
-	};
-	prog_load_attr.file = filename;
+	struct bpf_program *prog;
+	obj = bpf_object__open_file(filename, NULL);
+
+	if (libbpf_get_error(obj))
+		return NULL;
+
+	prog = bpf_object__next_program(obj, NULL);
+	bpf_program__set_type(prog, BPF_PROG_TYPE_XDP);
+	bpf_program__set_ifindex(prog, ifindex);
 
 	/* Use libbpf for extracting BPF byte-code from BPF-ELF object, and
 	 * loading this into the kernel via bpf-syscall
 	 */
-	err = bpf_prog_load_xattr(&prog_load_attr, &obj, &first_prog_fd);
+	err = bpf_object__load(obj);
 	if (err) {
 		fprintf(stderr, "ERR: loading BPF-OBJ file(%s) (%d): %s\n",
 			filename, err, strerror(-err));
 		return NULL;
 	}
 
+	first_prog_fd = bpf_program__fd(prog);
+
 	/* Notice how a pointer to a libbpf bpf_object is returned */
 	return obj;
 }
@@ -136,12 +142,15 @@ static struct bpf_object *open_bpf_object(const char *file, int ifindex)
 	struct bpf_map *map;
 	struct bpf_program *prog, *first_prog = NULL;
 
-	struct bpf_object_open_attr open_attr = {
-		.file = file,
-		.prog_type = BPF_PROG_TYPE_XDP,
-	};
+	obj = bpf_object__open_file(file, NULL);
 
-	obj = bpf_object__open_xattr(&open_attr);
+	if (libbpf_get_error(obj))
+		return NULL;
+
+	prog = bpf_object__next_program(obj, NULL);
+	bpf_program__set_type(prog, BPF_PROG_TYPE_XDP);
+
+	err = bpf_object__load(obj);
 	if (IS_ERR_OR_NULL(obj)) {
 		err = -PTR_ERR(obj);
 		fprintf(stderr, "ERR: opening BPF-OBJ file(%s) (%d): %s\n",
@@ -157,7 +166,7 @@ static struct bpf_object *open_bpf_object(const char *file, int ifindex)
 	}
 
 	bpf_object__for_each_map(map, obj) {
-		if (!bpf_map__is_offload_neutral(map))
+		if (bpf_map__type(map) != BPF_MAP_TYPE_PERF_EVENT_ARRAY)
 			bpf_map__set_ifindex(map, ifindex);
 	}
 
@@ -264,10 +273,10 @@ struct bpf_object *load_bpf_and_xdp_attach(struct config *cfg)
 
 	if (cfg->progsec[0])
 		/* Find a matching BPF prog section name */
-		bpf_prog = bpf_object__find_program_by_title(bpf_obj, cfg->progsec);
+		bpf_prog = bpf_object__find_program_by_name(bpf_obj, cfg->progsec);
 	else
 		/* Find the first program */
-		bpf_prog = bpf_program__next(NULL, bpf_obj);
+		bpf_prog = bpf_object__next_program(bpf_obj, NULL);
 
 	if (!bpf_prog) {
 		fprintf(stderr, "ERR: couldn't find a program in ELF section '%s'\n", cfg->progsec);
diff --git a/src/xdp/common/xdp_stats_kern.h b/src/xdp/common/xdp_stats_kern.h
index 4e08551a0..c061a149d 100644
--- a/src/xdp/common/xdp_stats_kern.h
+++ b/src/xdp/common/xdp_stats_kern.h
@@ -13,12 +13,12 @@
 #endif
 
 /* Keeps stats per (enum) xdp_action */
-struct bpf_map_def SEC("maps") xdp_stats_map = {
-	.type        = BPF_MAP_TYPE_PERCPU_ARRAY,
-	.key_size    = sizeof(__u32),
-	.value_size  = sizeof(struct datarec),
-	.max_entries = XDP_ACTION_MAX,
-};
+struct {
+	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
+	__type(key, __u32);
+	__type(value, struct datarec);
+	__uint(max_entries, XDP_ACTION_MAX);
+} xdp_stats_map SEC(".maps");
 
 static __always_inline
 __u32 xdp_stats_record_action(struct xdp_md *ctx, __u32 action)
diff --git a/src/xdp/xdp_prog_kern.c b/src/xdp/xdp_prog_kern.c
index a1eb395af..59308325d 100644
--- a/src/xdp/xdp_prog_kern.c
+++ b/src/xdp/xdp_prog_kern.c
@@ -16,19 +16,19 @@
 #define memcpy(dest, src, n) __builtin_memcpy((dest), (src), (n))
 #endif
 
-struct bpf_map_def SEC("maps") tx_port = {
-	.type = BPF_MAP_TYPE_DEVMAP,
-	.key_size = sizeof(int),
-	.value_size = sizeof(int),
-	.max_entries = 256,
-};
-
-struct bpf_map_def SEC("maps") redirect_params = {
-	.type = BPF_MAP_TYPE_HASH,
-	.key_size = ETH_ALEN,
-	.value_size = ETH_ALEN,
-	.max_entries = 1,
-};
+struct {
+	__uint(type, BPF_MAP_TYPE_DEVMAP);
+	__type(key, int);
+	__type(value, int);
+	__uint(max_entries, 256);
+} tx_port SEC(".maps");
+
+struct {
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__type(key, ETH_ALEN);
+	__type(value, ETH_ALEN);
+	__uint(max_entries, 1);
+} redirect_params SEC(".maps");
 
 static __always_inline __u16 csum_fold_helper(__u32 csum)
 {
@@ -208,8 +208,12 @@ out:
 	return xdp_stats_record_action(ctx, action);
 }
 
+#ifndef AF_INET
 #define AF_INET 2
+#endif
+#ifndef AF_INET6
 #define AF_INET6 10
+#endif
 #define IPV6_FLOWINFO_MASK bpf_htonl(0x0FFFFFFF)
 
 /* from include/net/ip.h */