IPv6 & Linux - HowTo - Part 2

Basic Software

Contents

• Linux distribution
• Kernel with IPv6 support

Needed software packages

• Linux distribution
• Kernel (perhaps)

Linux distribution

Why?

Version:

• e.g. Red Hat 6.2, 7.1, 7.2, 7.3 don't forget to apply all available updates to close all known local and remote security holes!
• I'll prefer at the moment Red Hat Linux 7.3

Installation, changes and configuration (example for RHL 6.2):

• Install the distribution
• Red Hat 6.2-Installation: choose option: "Server"
• Run network setup to configure a working IPv4 network
• Additional installation of software under Linux with linuxconf or by hand with rpm -ihv packetname
• Before removing given packets, inform yourself about the content of the packet
• Contents: rpm -qi packetname
• List of files: rpm -ql packetname

Here are list of all packages I have installed on my hosts (perhaps it's useful for you):

• rpm-rh6v0-server.txt (without for installing IPv6 needed packages) - long time ago...

• Several adaptations:
• Edit /etc/lilo.conf
• Change vga=normal to vga=extended for screen terminals with 50 lines, after next reboot you see more of the kernel messages at once (only, if "General|Video mode selection support" is enabled during kernel configuration).
• Run lilo to put the changes of lilo.conf in the boot record

IPv6 ready kernel

Why?

For beginners:

ToDo

• The USAGI project provides you with precompiled stable packages and patches in stable or also snapshots for several distributions and the vanilla kernel here: ftp://ftp.linux-ipv6.org/pub/usagi/
• RHL compatible kernel packages provided by USAGI:  ftp://ftp.linux-ipv6.org/pub/usagi/stable/package/redhat/RPMS/

Version and filename of the packet:

• Red Hat's 2.2.19-6.2.16
• rebuilded with ndisc-patch and IPv6 enabled

• Red Hat's 2.4.18-4 and 2.4.18-5.49
• From Red Hat Linux 7.3 and rawhide directory

Because of security issues, you should update immediately

• to 2.2.19+ and also apply the patches to solve the local root exploit issue "ptrace" and the local DoS issue "recursive links"
• to 2.4.12+ immediately or 2.4.9-13 from Red Hat Linux

Also I recommend to apply

• on 2.2.x kernels: the related Openwall security patch
• on 2.4.x kernels: the related grsecurity security patch

Additional Information:

The current standard kernel sources of 2.2.19- and 2.4.3- have bugs relating to automatic network configuration if an interface is shut down and started up again (problem known as does not re-join all-node multicast address on network devices after down and up again). USAGI-Patch will help in this case, too.

In 2.2.19- and 2.4.3- there is also a bug in ndisc.c, you will find patches here: ftp://ftp.bieringer.de/pub/linux/IPv6/kernel/
In 2.4.4+ there is another bug in ndisc.c, you will find patches here: ftp://ftp.bieringer.de/pub/linux/IPv6/kernel/
In 2.4.19- there is a bug in the IPv6 netfilter logging code, you will find a patch here: ftp://ftp.bieringer.de/pub/linux/IPv6/kernel/

Contents:

Unpacking, configuration

• RedHat 6.2
• Install kernel source package
• rpm -ihv path-to-rpm-packages/kernel-source-version.rpm
• Goto kernel source directory
• cd /usr/src/linux
• Copy original config file (relating to your used CPU type)
• cp configs/kernel-version-cputype .config .config
• Apply patches...
• Configure the kernel for IPv6
• make config or make menuconfig
• Enable following options

Kernel options		Selection
Networking options	The IPv6 protocol	module (if cause problems, then use yes)
	IPv6: enable EUI-64 token format	yes (2.4.4-, removed 2.4.5+)
	IPv6: disable provider based address	yes (2.4.4-, removed 2.4.5+)

• Update Makefile with version number (otherwise you're running into a module version conflict), e.g.
• Change: EXTRAVERSION = -5.0

to: EXTRAVERSION = -5.0-IPv6
• Others
• Move into the source directory:
• cd /usr/src
• Remove the symbolic link to the old kernel sources:
• rm linux
• Unpack the new kernel source:
• tar xzf your-path/linux-version -C /usr/src
• If you have an older kernel source like described upper, you can apply now patches:
• gzip -cd your-path/patch-2.y.x.gz | patch -p0
• Rename the new created source directory for better distinction:
• mv linux linux-version
• Now create a softlink, necessary for compatibility afterwards:
• ln -s linux-version linux
• Move into the kernel source directory:
• cd linux
• Apply patches...
• Configure the kernel for IPv6
• make config or make menuconfig
Don't forget to set other options depending on your system, too!



Kernel options		Selection
Code maturity level options	Prompt for development and/or incomplete code/drivers	yes
Loadable module support	Enable loadable module support	no (fewer problems, but at the moment, I get no problems running as much as possible of the kernel as modules)
	[if modules are enabed]  Set version information on all symbols for modules	yes (you should select this to prevent module mismatch, see also EXTRAVERSION later in the Makefile)
	[if modules are enabed]  Kernel module loader	yes (normally kerneld is no longer used)
Cosole drivers	Video mode selection support	yes (so you can use the 50 line modus at the console, see lilo.conf options [vga=extended]  for details)
Networking options	Packet socket	yes or module  (important for tcpdump!)
	Unix domain sockets	yes (won't mostly work as module!)
	Kernel/User netlink socket	yes (needed by ip)
	Routing messages	yes (needed by ip)
	TCP/IP networking	yes
	The IPv6 protocol	module (if causing problems, then use yes)
	IPv6: enable EUI-64 token format	yes (2.4.4-, removed 2.4.5+)
	IPv6: disable provider based address	yes (2.4.4-, removed 2.4.5+)
File systems	/proc filesystem support	yes
Kernel hacking	Magic sysrq key	yes (very useful at hang-ups, read sysrq.txt for details)

• Make a backup of the kernel config:
• cp .config ../config-version-counter
• You can also create a new subversion (I prefer this now) with editing the Makefile
• vi Makefile
• Change/add EXTRAVERSION, i.e.

EXTRAVERSION = -IPv6
• Now compile the kernel:
• make dep; make clean; make {zImage | bzImage} <; make modules>

You can also use my utility coke for that.
Hint: Use bzImage, if kernel built would be too big
• If you get any errors during compilation, look at your kernel config and try some other options. Sometimes newer kernels are a little strange... It is also possible that it's better to build a non-modular kernel.
• Copy and name the kernel:
• cp arch/i386/boot/{zImage | bzImage} /boot/vmlinuz-version
• If you have build a kernel with modules you should install them now and build also the initial RAM disk:
• make modules_install
• mkinitrd /boot/initrd-version-release-IPv6.img version-release-IPv6
• Edit /etc/lilo.conf or run liloconfig
• Add a new kernel entry for i.e. /boot/vmlinuz-ip6.
• Choose e.g. a proper label like label=lilo-ipv6
• Do not set this new image/label as default, if you have no phyiscal access to this host
Beware of removing the old (and running) kernel. Sometimes a hangup during booting the IPv6 kernel (e.g. you forgot an important option to select...) can cause many trouble if you haven't a second (running) kernel to boot!
• Don't forget to add/edit an entry in /etc/lilo.msg. [optional]
• Create/overwrite the link to the new kernel:
• ln -sf /boot/vmlinuz-version /boot/vmlinuz-ip6
• Run lilo to put the changes of lilo.conf in the boot record
• Reboot the system and select the new IPv6 kernel (good luck):
• reboot
• Additional hint gotten from Eddi <squalo at azzurra dot org>] :
• You are also able to select a only-on-next-boot-kernel (recommended for hosts with no direct physical access), e.g.
• lilo -R linux-ipv6
• reboot
• If in this case after reboot this kernel fails, only a reset trigger (watchdog card or a "remote controlable" person with capability to press the reset button) is needed, afterwards the defined default kernel is booting again.
• If reboot was succesfully, the default kernel can be changed.