ebpf: update deprecated API calls

This fixes build errors when libbpf 1.0 is used. It removes previously
deprecated API functions that were still in use in Suricata's eBPF
code.

configure.ac

@@ -1820,11 +1820,18 @@
             AC_DEFINE([HAVE_PACKET_EBPF],[1],[Recent ebpf fanout support is available]),
             [],
             [[#include <linux/if_packet.h>]])
-        AC_CHECK_LIB(bpf, bpf_set_link_xdp_fd,have_xdp="yes")
+        # Check for XDP specific function.
+        AC_CHECK_LIB(bpf,bpf_xdp_attach,have_xdp="yes")
         if test "$have_xdp" = "yes"; then
             AC_DEFINE([HAVE_PACKET_XDP],[1],[XDP support is available])
+        else
+            # Check for legacy XDP function.
+            AC_CHECK_LIB(bpf,bpf_set_link_xdp_fd,have_xdp="yes")
+            if test "$have_xdp" = "yes"; then
+                AC_DEFINE([HAVE_PACKET_XDP],[1],[XDP support is available])
+            fi
         fi
-        AC_CHECK_FUNCS(bpf_program__section_name)
+        AC_CHECK_FUNCS([bpf_program__section_name bpf_xdp_attach bpf_program__set_type])
     fi;
 
   # Check for DAG support.

src/util-ebpf.c

@@ -372,9 +372,19 @@ int EBPFLoadFile(const char *iface, const char *path, const char * section,
 #endif
         if (!strcmp(title, section)) {
             if (config->flags & EBPF_SOCKET_FILTER) {
+#ifdef HAVE_BPF_PROGRAM__SET_TYPE
+                bpf_program__set_type(bpfprog, BPF_PROG_TYPE_SOCKET_FILTER);
+#else
+                /* Fall back to legacy API */
                 bpf_program__set_socket_filter(bpfprog);
+#endif
             } else {
+#ifdef HAVE_BPF_PROGRAM__SET_TYPE
+                bpf_program__set_type(bpfprog, BPF_PROG_TYPE_XDP);
+#else
+                /* Fall back to legacy API */
                 bpf_program__set_xdp(bpfprog);
+#endif
             }
             found = true;
             break;
@@ -488,7 +498,12 @@ int EBPFSetupXDP(const char *iface, int fd, uint8_t flags)
                 "Unknown interface '%s'", iface);
         return -1;
     }
+#ifdef HAVE_BPF_XDP_ATTACH
+    int err = bpf_xdp_attach(ifindex, fd, flags, NULL);
+#else
+    /* Fall back to legacy API */
     int err = bpf_set_link_xdp_fd(ifindex, fd, flags);
+#endif
     if (err != 0) {
         char buf[129];
         libbpf_strerror(err, buf, sizeof(buf));