Install from Sources

Instructions below describe compilation from sources on Ubuntu 24.04, which is the preferred build and execution environment for the moment. With small changes, the instruction can be applied to other GNU/Linux distributions.

Build requirements
1 apt-get install make flex bison gcc g++ libboost-all-dev libssl-dev bc fakeroot dwarves libelf-dev lz4

Compiling the patched Kernel

Install build dependencies

The easiest way to install all the build dependencies for the Linux kernel is to use information from sources repository.

Make sure that the line deb-src is present and uncommented in /etc/apt/sources.list
1 deb-src http://archive.ubuntu.com/ubuntu noble main restricted

Then all the build dependencies can be simply installed:
1 apt-get update
2 apt-get build-dep linux

Obtain kernel sources

Get Linux kernel with Tempesta-Tech patches.

Version 0.9 (current master):
1 git clone https://github.com/tempesta-tech/linux-6.12.12-tfw.git

Release version 0.8:
1 git clone https://github.com/tempesta-tech/linux-5.10.35-tfw.git

Or apply version 0.9 the patch set to 6.12.12 kernel sources or release 0.8 the patch set to 5.10.35 kernel sources.

Configure Kernel

Before build Linux Kernel must be configured. Recommended way is to reuse current kernel’s configuration with Tempesta FW-specific changes.

Ensure that the kernel tree is absolutely clean:
1 cd linux-6.12.12-tfw # or linux-5.10.35-tfw
2 make clean && make mrproper

Copy current kernel’s configuration:
1 cp /boot/config-$(uname -r) .config

Use a text editor for the copied .config:

to comment the following lines if set to "y" before proceeding:

  • CONFIG_SYSTEM_TRUSTED_KEYRING
  • CONFIG_SYSTEM_TRUSTED_KEYS
  • CONFIG_SYSTEM_REVOCATION_LIST
  • CONFIG_SYSTEM_REVOCATION_KEYS
  • all CONFIG_DEFAULT_SECURITY_* lines

Why: Vanilla kernels don’t include files like debian/canonical-certs.pem. Leaving these options enabled causes build errors or interactive prompts during module signing.

to manually set all these options to "y":

  • CONFIG_SLUB
  • CONFIG_HUGETLB_PAGE
  • CONFIG_SECURITY
  • CONFIG_SECURITY_NETWORK
  • CONFIG_SECURITY_TEMPESTA
  • CONFIG_DEFAULT_SECURITY_TEMPESTA
  • "tempesta" listed first in CONFIG_LSM, e.g.
1 CONFIG_LSM="tempesta,lockdown..."

For Linux kernel 5.10.35 and above the following config options should be set "y":

  • CONFIG_SOCK_CGROUP_DATA
  • CONFIG_NET
  • CONFIG_CGROUPS
  • CONFIG_CGROUP_NET_PRIO

Also, it is better to choose CONFIG_UNWINDER_ORC instead of CONFIG_UNWINDER_FRAME_POINTER and unset CONFIG_FRAME_POINTER, for greater efficiency of some cryptographic functions (it is impossible to use %rbp register for calculations if CONFIG_FRAME_POINTER or CONFIG_UNWINDER_FRAME_POINTER is set).

For integration of HTTP tables and WebShield with iptables and nftables the following config options should be set as well (Tempesta works without these options):

  • CONFIG_NF_TABLES_IPV4
  • CONFIG_NF_TABLES_IPV6
  • CONFIG_NF_TABLES
  • CONFIG_NF_TABLES_INET

Failover configuration

For high availability setup you need to make the kernel to reboot on any issue preventing it from normal operation.

Set following kernel options:
01 CONFIG_WATCHDOG=y
02 CONFIG_SOFTLOCKUP_DETECTOR=y
03 CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
04 CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=1
05 CONFIG_HARDLOCKUP_DETECTOR_PERF=y
06 CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
07 CONFIG_HARDLOCKUP_DETECTOR=y
08 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
09 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC_VALUE=1
10 CONFIG_DETECT_HUNG_TASK=y

and set sysctl values in /etc/sysctl.conf:
1 kernel.panic=1
2 kernel.panic_on_oops=1
3 kernel.panic_on_rcu_stall=1
4 vm.panic_on_oom=1

These settings will reboot the machine on any hung, software crash, or out of memory event.

Compile and install Kernel

Traditional way is to compile the kernel and manually install modules and kernel image:
1 make -j$(nproc)
2 make modules_install
3 make install

Compiling Tempesta FW

Install build dependencies

Install build dependencies by calling the next command:
1 apt-get install build-essential libboost-dev libboost-program-options-dev cmake ninja-build libfmt-dev libspdlog-dev pkgconf

Obtain sources

Get version 0.9 (current master) Tempesta FW from Github repository:
1 git clone https://github.com/tempesta-tech/tempesta
2 cd tempesta

or release version 0.8:
1 git clone --branch release-0.8 https://github.com/tempesta-tech/tempesta.git
2 cd tempesta

Compile Tempesta FW

Tempesta FW is an out-of-tree kernel module. It is recommended to reboot into Tempesta’s patched kernel and install kernel headers before building the module. Simply run make to prepare the module:
1 make clean
2 make

It is also possible to build the module against target kernel sources directory:
1 make clean
2 make KERNEL=<path-to-kernel>

Regular expressions support

Tempesta FW supports regular expressions for HTTP tables and location matching. To enable regular expression support, install the regex compiler package:

sudo apt install linux-regex

Make sure the Tempesta FW APT repository is added before running the installation command. Alternatively, you can build the compiler manually from this repository.

Troubleshooting 5.10.35 kernel

During the lifecycle of Ubuntu, utility pahole was updated from version 1.22 to version 1.25. Using the updated version leads to kernel build error with the message:

load BTF from vmlinux: Invalid argument.

To avoid it:

check version

pahole --version

and if it needed, downgrade it

apt install pahole=1.22-8.