Ubuntu Precise Kernel patching and packaging
This guide documents the patching and packaging process of an official Ubuntu kernel including custom patches for SAref support. The base kernel version is from Ubuntu Lucid 10.04 LTS. Prerequisites
Install the "build" dependencies
apt-get install fakeroot build-essential crash kexec-tools makedumpfile kernelwedge libncurses5 libncurses5-dev libelf-dev asciidoc binutils-dev git
Install the "kernel and/or kernel module" build dependencies
For the kernel compilation :
apt-get build-dep --no-install-recommends linux-image-$(uname -r)
For the IPsec deb package :
apt-get install module-assistant
Get the kernel sources
export BUILD_ROOT="/vol/kernel-ubuntu-saref/ubuntu-precise" mkdir -p $BUILD_ROOT && cd $BUILD_ROOT
Only run this for the first time
git clone git://kernel.ubuntu.com/ubuntu/ubuntu-precise.git .
Otherwise just update the tree
git reset --hard git clean -xdf git checkout master
If building a SAref kernel only (no OCF)
git branch -D saref
or if building a SAref+OCF kernel
git branch -D saref+ocf
note: If this is your first time preparing (after git cloning the tree in the steps above), it is not necessary to run the git branch delete "-D" command. Especially for those new to git, if you do delete in such a scenario, it is normal to expect an error message such as, respectively:
error: branch 'saref' not found. error: branch 'saref+ocf' not found.
Regardless if you chose saref only or saref+ocf, continue with these git pull and fetch commands:
git pull git fetch -t
Get the latest official Ubuntu kernel
Branch using the latest stable version published by Ubuntu (to see available one look in debian.master/changelog) into a SAref branch. The tag to branch from is usually latest entry in debian.master/changelog that is not UNRELEASED. This must be 3.2.0-XX.XX to be an official Ubuntu Kernel kernel. If building a SAref kernel only (no OCF)
git checkout Ubuntu-3.2.0-33.52 -b saref
or if building a SAref+OCF kernel
git checkout Ubuntu-3.2.0-33.52 -b saref+ocf
Optain SAref patches from OpenSwan FTP
cd /tmp/ wget ftp://ftp.openswan.org/openswan/patches/3.2.0/0001-SAREF-add-support-for-SA-selection-through-sendmsg.patch wget ftp://ftp.openswan.org/openswan/patches/3.2.0/0002-SAREF-implement-IP_IPSEC_BINDREF.patch
The above 2 patches should be included in OpenSwan 2.6.39 and later. Apply first patch
cd $BUILD_ROOT patch -p1 < /tmp/0001-SAREF-add-support-for-SA-selection-through-sendmsg.patch
Commit changes
git commit -a -m "SAref patch 0001 applied"
Apply second patch
patch -p1 < /tmp/0002-SAREF-implement-IP_IPSEC_BINDREF.patch
Commit changes
git commit -a -m "SAref patch 0002 applied"
Edit the file net/Makefile to include KLIPS
sed -i '/^obj-$(CONFIG_XFRM).*xfrm\/$/ net/Makefile aobj-$(CONFIG_KLIPS)\t\t+= ipsec\/'
Commit changes
git commit -a -m "Fix net/Makefile to include KLIPS"
Enable CONFIG_KLIPS
cat << EOF | tee -a debian.master/config/config.common.ubuntu >> debian.master/config/config.common.ports CONFIG_KLIPS=m CONFIG_KLIPS_IPIP=y CONFIG_KLIPS_AH=y CONFIG_KLIPS_AUTH_HMAC_MD5=y CONFIG_KLIPS_AUTH_HMAC_SHA1=y CONFIG_KLIPS_ESP=y CONFIG_KLIPS_ALG=y CONFIG_KLIPS_ENC_3DES=y CONFIG_KLIPS_ENC_AES=y CONFIG_KLIPS_ENC_CRYPTOAPI=n CONFIG_KLIPS_IPCOMP=y CONFIG_KLIPS_DEBUG=y CONFIG_KLIPS_IF_MAX=64 CONFIG_INET_IPSEC_SAREF=y EOF
Commit changes
git commit -a -m "Enable module support for KLIPS"
Obtain the OCF patch (optional and untested on Precise)
Apply first OCF patch
wget -O ocf-linux-20110720.tar.gz http://sourceforge.net/projects/ocf-linux/files/ocf-linux/20110720/ocf-linux-20110720.tar.gz/download tar zxvf ocf-linux-20110720.tar.gz patch -p1 -s < ocf-linux-20110720/patches/linux-2.6.33-ocf.patch cp -a ocf-linux-20110720/ocf crypto/
Commit changes
git add crypto/ocf/ git commit -a -m "OCF patch applied"
Enable CONFIG_OCF_OCF
cd $BUILD_ROOT cat << EOF | tee -a debian.master/config/config.common.ubuntu >> debian.master/config/config.common.ports CONFIG_OCF_OCF=y EOF
Commit changes
git commit -a -m "Enable builtin support for OCF"
Enable CONFIG_KLIPS_OCF
cat << EOF | tee -a debian.master/config/config.common.ubuntu >> debian.master/config/config.common.ports CONFIG_KLIPS_OCF=y EOF
Commit changes
git commit -a -m "Enable OCF support in KLIPS"
Enable CRYPTOAPI
sed -i 's/^CONFIG_KLIPS_ENC_CRYPTOAPI=.*/CONFIG_KLIPS_ENC_CRYPTOAPI=y/' debian.master/config/config.common.ubuntu debian.master/config/config.common.ports
Commit changes
git commit -a -m "Enable CRYPTOAPI support in KLIPS"
Enable some OCF driver modules :
cat << EOF | tee -a debian.master/config/config.common.ubuntu >> debian.master/config/config.common.ports CONFIG_OCF_RANDOMHARVEST=y CONFIG_OCF_FIPS=y CONFIG_OCF_CRYPTODEV=m CONFIG_OCF_CRYPTOSOFT=m CONFIG_OCF_SAFE=m CONFIG_OCF_IXP4XX=n CONFIG_OCF_IXP4XX_SHA1_MD5=n CONFIG_OCF_HIFN=n CONFIG_OCF_HIFNHIPP=n CONFIG_OCF_TALITOS=n CONFIG_OCF_EP80579=m CONFIG_OCF_CRYPTOCTEON=n CONFIG_OCF_KIRKWOOD=n CONFIG_OCF_C7108=n CONFIG_OCF_UBSEC_SSB=n CONFIG_OCF_OCFNULL=m CONFIG_OCF_BENCH=m EOF
Note: CONFIG_OCF_C7108, CONFIG_OCF_IXP4XX, CONFIG_OCF_KIRKWOOD, CONFIG_OCF_HIFN, CONFIG_OCF_TALITOS and CONFIG_OCF_CRYPTOCTEON are known to fail to build. Commit changes
git commit -a -m "Enable some OCF driver modules"
Check for eventual misconfiguration : Note : Check debian.master/config/config.common.ubuntu and debian.master/config/config.common.ports to identify eventual duplicates. Watch out for cryptoapi as it must be =y for OCF and =n otherwise.
for f in debian.master/config/config.common.ubuntu debian.master/config/config.common.ports ; do cut -d= -f1 $f | grep -v "^#$" | sort | uniq -d ; done
Update the changelog by editing debian.master/changelog to look like this :
linux (3.2.0-33.52saref1) precise; urgency=low * SAref patches 0001 and 0002 applied * Modularized KLIPS -- Simon Deziel <
[email protected]> Tue, 20 Nov 2012 14:19:00 -0500
or like this for OCF enabled builds :
linux (3.2.0-33.52ocf+saref1) precise; urgency=low * * * * * SAref patches 0001 and 0002 applied Modularized KLIPS OCF patches applied Enable OCF support in KLIPS Enable some OCF drivers
-- Simon Deziel <[email protected]> Tue, 20 Nov 2012 14:19:00 -0500
Note: when the version number is appended with "saref1" (or "ocf+saref1") this make sure that our kernel will supersedes the official Ubuntu kernel with the same version number. Commit changes
git commit -m "Update changelog to supersedes official Ubuntu kernel" debian.master/changelog
Compile the kernel
Start a screen as the following steps will take time
screen -S kernel-build
Compile the kernel (for amd64)
fakeroot debian/rules clean
skipabi=true skipmodule=true fakeroot debian/rules binary-indep skipabi=true skipmodule=true fakeroot debian/rules binary-perarch time skipabi=true skipmodule=true fakeroot debian/rules binary-generic
Note: According to https://wiki.ubuntu.com/KernelTeam/KernelMaintenance#Overriding %20module%20check%20failures skipmodule=true will only skip check for missing modules Compile the kernel (for i386)
fakeroot debian/rules clean skipabi=true skipmodule=true fakeroot debian/rules binary-indep skipabi=true skipmodule=true fakeroot debian/rules binary-perarch time skipabi=true skipmodule=true fakeroot debian/rules binary-generic-pae
Note: It is also possible to build for "binary-generic" (no PAE support) but this provides a less secure kernel. Ubuntu 32bit PAE kernels provide an emulation of the NX bit for greater security. Some VIA CPUs and Pentium M are known to lack this feature.
Install the kernel
On amd64 systems
cd .. dpkg -i linux-headers-3.2.0-33_3.2.0-33.52saref1_all.deb linux-headers-3.2.0-33generic_3.2.0-33.52saref1_amd64.deb linux-image-3.2.0-33-generic_3.2.033.52saref1_amd64.deb
On i386 systems
cd ..
dpkg -i linux-headers-3.2.0-33_3.2.0-33.52saref1_all.deb linux-headers-3.2.0-33generic-pae_3.2.0-33.52saref1_i386.deb linux-image-3.2.0-33-generi-paec_3.2.033.52saref1_i386.deb
Test the new kernel by rebooting into it.
Build the IPsec module deb package (aka "kmod" package)
TODO: review and refresh if needed. important note: optionally, instead of building the "kmod" package individually, installing the dkms-module will build the kmod module automatically on your behalf (which is useful in the event the pre-made deb binary package from Xelerance for the version of Openswan you needs is not readily available on the Xelerance FTP server). Quoting LetoTo:
(dkms-module package is a method for shipping/recompiling kernel modules that work on custom kernels, as opposed to kmod- packages)
Linux kernels patched to accommodate SAref or SAref+OCF are " custom kernels ". The advantage of dkms packages is that they can be installed on other (not just patched) kernels (as long as there is a compile environment with the requisite tools for compiling), whereas the kmods built on a customize kernel are specific to that customized kernel and not transportable to other kernels. To build the dkms-package see this page in the Wiki: Building_and_installing_DebianUbuntu_packages_from_source
or proceed with building the IPsec module deb "kmod" package ... Get the openswan-modules-source from the FTP :
export RELEASE="2.6.33" export DEBIAN_VER=$(echo $RELEASE | sed -e "s/\([0-9]\{1,3\}\)\.\([0-9]\ {1,3\}\)\.\([0-9]\{1,3\}\)\(.*\)/\1.\2.\3~\4/" -e "s/~$//") cd /tmp && wget ftp://ftp.openswan.org/openswan/binaries/ubuntu/openswanmodules-source_${DEBIAN_VER}-1xelerance1_all.deb dpkg -i /tmp/openswan-modules-source_${DEBIAN_VER}-1xelerance1_all.deb
Build the kmod package :
module-assistant prepare module-assistant build openswan
The resulting package will be under /usr/src. Install it and insert the ipsec to test it :
dpkg -i /usr/src/openswan-modules-2.6.32-25-server_2.6.30~rc11xelerance1+2.6.32-25.44saref1_all.deb modprobe ipsec && modinfo ipsec
Building and installing Debian / Ubuntu packages from source
This guide describes the steps required to build Openswan debs on a Ubuntu Lucid system.
Prerequisites
Install the build dependencies (for Ubuntu Openswan package)
apt-get install devscripts apt-get build-dep --no-install-recommends openswan apt-get install libgmp3-dev libssl-dev
Get the Openswan sources
export RELEASE="2.6.38rc2" export DEBIAN_VER=$(echo $RELEASE | sed -e "s/\([0-9]\{1,3\}\)\.\([0-9]\ {1,3\}\)\.\([0-9]\{1,3\}\)\(.*\)/\1.\2.\3~\4/" -e "s/~$//") export REMOTE_PATH=$(echo $RELEASE | awk '{ if ($1 ~ "rc") print "testing"; else if ($1 ~ "dr") print "development";}') export OPENSWAN_DIR="/tmp/openswan-debs" mkdir -p $OPENSWAN_DIR ; cd $OPENSWAN_DIR wget http://ftp.openswan.org/openswan/$REMOTE_PATH/openswan$RELEASE.tar.gz{,.asc} gpg --verify openswan-$RELEASE.tar.gz.asc && tar -xf openswan-$RELEASE.tar.gz mv openswan{-$RELEASE,_$DEBIAN_VER.orig}.tar.gz cd openswan-$RELEASE
Set custom build variables (optional)
Example :
cat << EOF >> Makefile.inc.local HAVE_STATSD=true USE_SAREF_KERNEL=true USE_MAST=true $(echo $RELEASE | awk '{ if ($1 ~ "(rc|dr)") printf "%s", "USE_LEAK_DETECTIVE=true"; }') EOF
For OCF support for IKE (optional) :
echo "HAVE_OCF=true" >> Makefile.inc.local
Apply a patch to enable OCF in the ipsec module :
patch -p1 < enable-ocf-ipsec.patch
Edit the changelog
Automatically :
sed -i '/\* Update to / a\ - SAref support enabled\n enabled\n - STATSD support enabled' debian/changelog - MAST support
or for OCF builds :
sed -i '/\* Update to / a\ - SAref support enabled\n - MAST support enabled\n - STATSD support enabled\n - OCF support for IKE enabled' debian/changelog
or manually :
vim debian/changelog
If building with OCF support enabled edit debian/changelog to look like this :
openswan (1:2.6.32~rc9+ocf-1xelerance1) lucid; urgency=low * Update to 2.6.32~rc9 - SAref support enabled - MAST support enabled - STATSD support enabled - OCF support for IKE enabled The real changelog is in /usr/share/doc/openswan/changelog.gz This package is NOT an official Debian/Ubuntu package. Please do not file any Debian/Ubuntu bug reports for this package but contact <[email protected]> or <[email protected]> if you have a problem. -- Simon Deziel <[email protected]> Local variables: mode: debian-changelog End: Mon, 09 Aug 2010 11:29:42 +0200
Update the changelog and NEWS timestamp :
sed -i "1,/^ -- / s/^\( -- .* <.*> \) .*$/\1 $(date -R)/" debian/ {changelog,NEWS}
Build the binary debs
debuild -i -us -uc -b
Build the source debs (optional: to upload to a PPA)
debuild -S -sa
Install the debs
cd $OPENSWAN_DIR dpkg -i openswan_2.6.32~rc3-1xelerance1_amd64.deb openswan-modulesdkms_2.6.32~rc3-1xelerance1_amd64.deb openswan-modules-source_2.6.32~rc31xelerance1_all.deb enable-ocf-ipsec.patch - Enable OCF support in ipsec.ko (3,21 )Simon Deziel, 03.03.2011 18:14
