Enable clat (464XLAT)

Add libbpf-dev to be able to load and interact with loaded bpf program.

Add gcc-bpf and bpftool with minimum required versions to support
required features, and set explicitly the bpf compiler (network manager
often prefers clang otherwise if available).

Not adding any constraints on linux (where bpf is supported), as all the
network-manager packages are already linux-any, so will not built on
non-linux.

Note: The compiled clat.bpf.o file content is incorporated into
clat.skel.h during the build (as a static byte array), and is loaded
from memory at runtime, not from any on disk file.

For now also silence mostly a false positive of blhc reporting missing
hardening flags. This is hopefully only temporary, and can be improved
in the future.

Fixes: ef758928d5c20c8af9f4ebf93059e5f22c9f9fec

3 files changed, 23 insertions, 2 deletions

diff --git a/debian/changelog b/debian/changelog
index 7c45ec4a..5234c9c5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+network-manager (1.58.0-3) UNRELEASED; urgency=medium
+
+  * Enable CLAT (464XLAT) support, compile bpf program with gcc-bpf,
+    and do stripping with bpftool. The CLAT usage in version 1.58
+    remains disabled at runtime by default.
+
+ -- Witold Baryluk <witold.baryluk@gmail.com>  Sat, 15 Aug 2026 13:48:07 +0000
+
 network-manager (1.58.0-2) unstable; urgency=medium
 
   * Upload to unstable
diff --git a/debian/control b/debian/control
index 1b6a3588..63c317ef 100644
--- a/debian/control
+++ b/debian/control
@@ -25,7 +25,7 @@ Build-Depends: debhelper-compat (= 14),
                gtk-doc-tools,
                libglib2.0-doc,
                libmm-glib-dev (>=  0.7.991),
-               libndp-dev,
+               libndp-dev (>= 1.9),
                libreadline-dev,
                libnewt-dev (>= 0.52.15),
                libteam-dev (>= 1.9),
@@ -40,6 +40,9 @@ Build-Depends: debhelper-compat (= 14),
                python3-dbus <!nocheck>,
                python3-pexpect <!nocheck>,
                iproute2 <!nocheck>,
+               libbpf-dev (>= 1.3.0),
+               gcc-bpf (>= 13.1.0),
+               bpftool (>= 5.13),
 Standards-Version: 4.7.4
 Vcs-Git: https://salsa.debian.org/utopia-team/network-manager.git
 Vcs-Browser: https://salsa.debian.org/utopia-team/network-manager
diff --git a/debian/rules b/debian/rules
index 4fa89c9a..76a5728a 100755
--- a/debian/rules
+++ b/debian/rules
@@ -54,10 +54,20 @@ override_dh_auto_configure:
 		-Dovs=true \
 		-Dqt=false \
 		-Debpf=false \
-		-Dclat=false \
+		-Dclat=true \
+		-Dbpf-compiler=gcc \
 		-Dnbft=false \
 		-Dofono=true
 
+execute_before_dh_auto_build:
+	# Current blhc complains about various hardening options not passed to
+	# bpf-gcc. But bpf-gcc does not support some of them (-fstack-protector
+	# and -fcf-protection=full for example). Also it complains about missing
+	# -g, where in fact bpf-gcc is called with -gbpf, but blhc does not
+	# recognize it.
+	# See https://bugs.debian.org/1144478 for more details.
+	@echo 'blhc: ignore-line-regexp: \[[0-9]+/[0-9]+\] /usr/bin/bpf-gcc .+'
+
 execute_after_dh_auto_install:
 	# Those initrd specific services are not actually used by dracut and
 	# conflict with the main services, so remove them for now.