Kernel Configuration and Patches

The examples and concepts of this book were drawn from two distinct kernel lines. The stable kernel series as of the initiation of this book was the Linux 2.2 kernel series. All of the references to the 2.2 kernel series in this book refer to this series and most specifically to kernel 2.2.12. I do not use any kernels in the 2.2 series after 2.2.12 in any of my 2.2 systems. The current stable kernel series is the 2.4 kernel. The 2.4 series kernel used to check and generate most of the examples and concepts in this book was 2.4.0. All of the patches and changes to the kernel as described in the following section are applicable to any of the 2.3/2.4 pre development kernels and apply cleanly to the 2.4.0 stable kernel release.

Kernel 2.2.12

The 2.2.12 series kernel was used for all references to the 2.2 series kernel in the book. The patch listing for this kernel is rather minimal. It consists only of the DiffServ patch, ds-8. This patch is available on the CD as well as on the Web site at http://www.policyrouting.org/PolicyRoutingBook/.

Within the ds-8 patch is the 2.2 kernel patch as well as a patch for the IPROUTE2 utility suite. You can safely ignore the patch for the IPROUTE2 suite because all it does is change a configuration entry in the Config file. This is noted in the Config file for IPROUTE2 itself.

To install the kernel patch you must have a clean 2.2.12 kernel source tree. Change to the source directory ( /usr/src ) and untar the patch file into that directory. Then simply make sure you are in the root of the source tree ( /usr/src/linux ) and apply the patch with patch -p1 < /usr/src/ds/patches/kernel.patch and you will be able to configure and make the kernel. If you are not comfortable with this procedure, note that a prepatched kernel is available on the CD and the Web site.

Kernel 2.4

This section of this appendix uses the 2.4.0 kernel as the reference platform. For this kernel you will need to have applied the PakSecured IA32 kernel patch as available on the CD and Web site. A prepatched version of the latest 2.4 series kernel is also available on the Web site. Note that general PakSecured patches are versioned for different processor platforms. Be sure that you use the relevant patch. The version of PakSecured on the CD is for Intel 32-bit platforms only. If you would like the other architecture versions, please visit the PakSecured Web site at http://www.paksecured.com. PakSecured is under full GPL.

Once your 2.2.12 or 2.4.0 kernel is patched you can then configure and compile the kernel. The configuration listing for the kernel is quite long. A premade config file that covers all of the networking protocol configurations that you will need is available in the prepatched kernel, on the CD, and on the Web site. It does not have any network cards or other hardware defined that you may need for your system. For configuring these items and for kernel configuration and compilation in general, please read the Kernel HOWTO. It is available through the Linux Documentation Project, a mirror of which may be found at http://ldp.pakuni.net. The complete archive of the LDP as of January 1, 2001 is also included on the CD.

IPROUTE2

Once you have compiled and installed your kernel, you then need to compile the IPROUTE2 utility for use with the DiffServ extensions. First obtain the latest source code for IPROUTE2. As of this writing the latest release was iproute2-2.2.4-now-ss001007.tar.gz. To compile the utility for use with the DiffServ extensions, you need to change a line in the Config file located at the root of the source directory. Open the /usr/src/iproute2/Config file and change TC_CONFIG_DIFFSERV=n to TC_CONFIG_DIFFSERV=y. Then compile the utility suite with make. Note that IPROUTE2 does not have an install routine. You must manually place the binaries in the appropriate locations. Also note that RPMs such as from Red Hat or SuSE do not have the utility compiled appropriately for many of the advanced uses. You are better off either compiling your own or using the binaries provided in PakSecured. The PakSecured binaries are in the /sbin directory.

You now have a patched kernel and the necessary ip utility for running through all of the examples in the book. For the NAT and tagging examples you will need the patched NetFilter utility for Kernel 2.4. The ipchains utility for Kernel 2.2 is standard and you can either compile it or use an RPM.

Top