deadcasuals's Journal: Patching the kernel with Debian

So at work recently, I've been setting up a bunch of FreeS/WAN boxes to establish some network to network VPN's. Freeswan requires a kernel patch to operate and patching the kernel has never been one of my favorite things to do... :) First, you loose the ability to update your kernel automatically via apt. It's also more work to do on a bunch of machines when you're trying to keep them all at the same baseline. Well, Debian once again makes this process very easy. Here's a rundown on how to compile a custom freeswan kernel and create nice .deb files that you can install easily on other systems.

1) Download the latest kernel source from kernel.org

2) Unpack it under /usr/src/linux

3) run the following commands:

# apt-get install kernel-package kernel-patch-freeswan
# cd /usr/src/linux
# export PATCH_THE_KERNEL=YES
# make-kpkg --config=menuconfig --revision=vpn1.0 configure

4) At a minimum, you need the following kernel config options selected:

    CONFIG_IPSEC
    CONFIG_IPSEC_IPIP
    CONFIG_IPSEC_AH
    CONFIG_IPSEC_ESP

5) Finally, run:

# make-kpkg binary-arch

This process will take you through all of the make menuconfig, make dep, make clean, make bzImage stuff that you normally do (and I can never remember which order those commands go in either!) and it leaves you with two shiny new .deb files that are your new kernel. Simply dpkg -i them and you're set. dpkg even updates your bootloader config automatically. Pretty slick!

When you apt-get the kernel-patch-freeswan package, it actually puts the patch in /usr/src/kernel-patches. When you export PATCH_THE_KERNEL=YES, it tells make-kpkg to look in the /usr/src/kernel-patches/apply directory for a list of kernel patches to apply.