Debian - HFSC + IMQ (Manchester - 25.12.2011)
Author: Rafal Rajs (ElessaR) (email: elessar1@poczta.wp.pl)
Introduction
Welcome everybody,
Recently I have updated my IMQ/HFSC based traffic shaping solution to the recent Debian testing distribution and Linux Kernel 3.1. I thought it will be a good idea to publish my findings, so it should be any help for anybody interested in the subject. In this small article I will focus mainly on the installation stage of the initial solution, as the configuration stage remained the same as in the original document.
Again I will using IMQ and HFSC.
Installation
First, we need to get proper patches:
1. Patch IMQ for kernel 3.1
solaris# wget http://www.linuximq.net/patchs/patch-imqmq-3.1.diff.bz2
2. Patch IMQ for IPTABLES 1.4.12
solaris# wget http://www.linuximq.net/patchs/iptables-1.4.12-IMQ-test4.diff
3. Kernel config from the debian kernel-image-3.1.0
http://ftp.uk.debian.org/debian/pool/main/l/linux-2.6/linux-image-3.1.0-1-486_3.1.5-1_i386.deb
Preparing KERNEL
solaris# cd /usr/src
solaris# wget http://www.linuximq.net/patchs/patch-imqmq-3.1.diff.bz2
solaris# wget http://www.linuximq.net/patchs/iptables-1.4.12-IMQ-test4.diff
solaris# bunzip2 patch-imqmq-3.1.diff.bz2
solaris# apt-get install linux-source
solaris# tar -jxf linux-source-3.1.tar.bz2
solaris# rm linux
solaris# ln -s linux-source-3.1 linux
Unpack the kernel image package into the temporary folder, so we can use its config:
solaris# cd /usr/src
solaris# dpkg -x linux-image-3.1.0-1-486_3.1.5-1_i386.deb ./bbb
Patch IMQ:
solaris# cd linux
solaris# patch -p1 < ../patch-imqmq-3.1.diff
Copy Debian package kernel config:
solaris# cp ../bbb/boot/config-3.1.0-1-486 ./.config
solaris# make menuconfig
Make sure, you have the following settings set:
# Networking --> Networking options --> Network packet filtering framework (Netfilter) ---> Core Netfilter Configuration --->
IMQ target support (NEW)
# Device Drivers ---> Network device support ---> IMQ (intermediate queueing device) support (NEW)
# (2) Number of IMQ devices
# IMQ behavior (PRE/POSTROUTING)(IMQ AB) below:
Choosing this option will make IMQ hook like this:
PREROUTING: After NAT
POSTROUTING: Before NAT
Preparing IPTABLES
solaris# cd /usr/src
solaris# apt-get source iptables
solaris# cd iptables-1.4.12
solaris# dch -v dch -v 1.4.12-99.imq (add notes about the changes)
Make sure you have required packages installed:
solaris# apt-get install autoconf automake libtool libnfnetlink-dev
Patch IMQ
solaris# patch -p1 < ../iptables-1.4.12-IMQ-test4.diff
CONNLIMIT and IPP2P
There is no need to use patch-o-matic anymore. It has been replaced by the xtables-addons package. You can install it easily by executing the command:
solaris# apt-get install xtables-addons-common
The package doesn't require patching iptables or kernel. It builds additional iptables functionality by creating kernel modules. That's why even a restart is not required after installation.
You will get the IPP2P module using this package. CONNLIMIT is already built-in in the current kernel.
Compiling KERNEL
In order to use make-kpkg tool from the kernel-package to build kernel image package, you need to modify the following file:
/usr/share/kernel-package/ruleset/targets/common.mk
Unfortunately, the current version is not fully compatible with newest kernels. Also you can choose alternative way of generating a kernel image package. You can find details
here.
After introducing the changes described in the following patch (you can use a text editor to introduce these changes as I did), you can proceed to build the kernel.
--- kernel/ruleset/targets/common.mk-orig 2011-08-17 18:24:16.048922011 +0300
+++ kernel/ruleset/targets/common.mk 2011-08-17 20:08:26.623916939 +0300
@@ -323,8 +323,13 @@ ifeq ($(DEB_HOST_ARCH_OS), linux)
endif
endif
ifneq ($(strip $(shell grep -E ^[^\#]*CONFIG_LGUEST $(CONFIG_FILE))),)
+ if [ -e Documentation/lguest ]; then \
$(MAKE) $(do_parallel) $(EXTRAV_ARG) $(FLAV_ARG) ARCH=$(KERNEL_ARCH) \
- $(CROSS_ARG) -C Documentation/lguest
+ $(CROSS_ARG) -C Documentation/lguest; \
+ elif [ -e Documentation/virtual/lguest ]; then \
+ $(MAKE) $(do_parallel) $(EXTRAV_ARG) $(FLAV_ARG) ARCH=$(KERNEL_ARCH) \
+ $(CROSS_ARG) -C Documentation/virtual/lguest; \
+ fi
endif
else
ifeq ($(DEB_HOST_ARCH_OS), kfreebsd)
solaris# make-kpkg --append_to_version -686.imq.by.elessar --revision=01 debian
solaris# dch (add notes about the changes)
solaris# make-kpkg --initrd --append_to_version -686.imq.by.elessar --revision=01 kernel_image kernel_headers
Compiling IPTABLES
solaris# dpkg-buildpackage -us -uc -nc
(We use [-nc] option in the building package command, in order to keep the IMQ modification in the source code)
Package Verification
In order to verify whether the IMQ module is present in your package, use the following command:
solaris# dpkg -c iptables_1.4.12-99.imq_i386.deb | grep -i IMQ
End
It looks that the procedure got simpler. This is a good sign. I've performed basic tests to confirm that this updated installation works.
If you have any comments, let me know, please.
best regards
Rafal Rajs
