Enable clat (464XLAT)

Add libbpf-dev to be able to load and interact with loaded bpf program.

Add gcc-bpf and bpftool with minimum required versions to support
required features, and set explicitly the bpf compiler (network manager
often prefers clang otherwise if available).

Not adding any constraints on linux (where bpf is supported), as all the
network-manager packages are already linux-any, so will not built on
non-linux.

Note: The compiled clat.bpf.o file content is incorporated into
clat.skel.h during the build (as a static byte array), and is loaded
from memory at runtime, not from any on disk file.

For now also silence mostly a false positive of blhc reporting missing
hardening flags. This is hopefully only temporary, and can be improved
in the future.

Fixes: ef758928d5c20c8af9f4ebf93059e5f22c9f9fec

1 files changed, 11 insertions, 1 deletions

diff --git a/debian/rules b/debian/rules
index 4fa89c9a..76a5728a 100755
--- a/debian/rules
+++ b/debian/rules
@@ -54,10 +54,20 @@ override_dh_auto_configure:
 		-Dovs=true \
 		-Dqt=false \
 		-Debpf=false \
-		-Dclat=false \
+		-Dclat=true \
+		-Dbpf-compiler=gcc \
 		-Dnbft=false \
 		-Dofono=true
 
+execute_before_dh_auto_build:
+	# Current blhc complains about various hardening options not passed to
+	# bpf-gcc. But bpf-gcc does not support some of them (-fstack-protector
+	# and -fcf-protection=full for example). Also it complains about missing
+	# -g, where in fact bpf-gcc is called with -gbpf, but blhc does not
+	# recognize it.
+	# See https://bugs.debian.org/1144478 for more details.
+	@echo 'blhc: ignore-line-regexp: \[[0-9]+/[0-9]+\] /usr/bin/bpf-gcc .+'
+
 execute_after_dh_auto_install:
 	# Those initrd specific services are not actually used by dracut and
 	# conflict with the main services, so remove them for now.