linux-2.6.79-pre4-ac8

Building and Installing Openswan

# uname -a

Linux bofh.xtdnet.nl 2.6.8-1.520 #1 Sat Aug 14 05:57:37 EDT 2004 i686 i686 i386 GNU/Linux

So, if KLIPS is available as a binary package for your (Pentium-III) kernel from the Fedora Core 2 distribution listed in the above uname command, then the package would be available at:

ftp://ftp.openswan.org/openswan/binaries/Fedora/FC2/RPMS/2.6.8-1.520/openswan- klips-2.2.0_2.6.8.520-0.i686.rpm

If there are no binary packages available, you will have to compile your own. But don't worry, we might be able to use rpm for that too.

Building KLIPS from Source

Before applying any kernel patches, it is important to confirm that your current Linux distribution is capable of compiling a standard kernel. Often people report errors on the Openswan mailing lists that are really errors of their Linux system. Common problems include having a gcc compiler that cannot build any kernel. Or having updated the gcc compiler after building the kernel, so that the kernel and the modules are built with a different compiler. Or certain packages needed for building are not installed. Or because people are trying to compile that was released five minutes ago.

However, the most common compile failure is due to missing header files for the GNU Math Precision library (gmp.h). These are often located in a package named gmp-dev or gmp-devel, and not installed by default on most distributions.

Therefore, if you are going to compile your own kernel with KLIPS, it is recommended to first build a regular custom kernel. When this build has been successful, KLIPS or NAT-T can be patched into the kernel, and the kernel can then be rebuilt. Very few people seem to be willing to wait for two kernel compiles, but I would like to stress the following advice:

If your KLIPS compile failed, first try to build a unpatched kernel before asking for support on the mailing lists or on the IRC channel!

Kernel Prerequisites

For Openswan to work properly, some functionality in the Linux kernel needs to be present. Most of the functionality, like basic TCP/IP networking, will surely be part of any distribution kernel. Some other features may be left out, especially if the kernel is designed for a small embedded system, where every byte counts. For example, Red Hat makes an effort to try to compile support for everything into the kernel, and tries to make most of that a kernel module, so that it is only loaded into the kernel when needed, such as for some specific piece of hardware. An example of the other extreme is Openwrt, a mini-Linux distribution that is an alternative firmware for Linksys Access Points. Since some of these APs only have 8 MB of flash memory, the kernel has been stripped clean, and only functionality that is absolutely essential is included. But not all these vendors have IPsec in mind, so what they might consider a waste of precious flash space, might be a necessity for a kernel that needs to support IPsec.

64