QoS: require libcap before enabling netfilter MARK support

As it is not possible to get or set a netfilter mark without libcap, this
patch will disable netfilter marking at compilation time if libcap is not
available (in a similar way to Linux transparent proxying).

diff --git a/configure.ac b/configure.ac
index 8eb1bcf17482e4cfe6a8f723b760a2cf1f6dbeec..d274d7ca99f65420cc07047b8ad13c2a6c7a359c 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1354,6 +1354,7 @@ AC_MSG_NOTICE([Linux Netfilter support requested: ${enable_linux_netfilter:=auto
 
 
 dnl Look for libnetfilter_conntrack options (needed for QOS netfilter marking)
+dnl squid_opt_netfilterconntrack is set only when option is explicity specified
 AC_ARG_WITH(netfilter-conntrack,
   AS_HELP_STRING([--without-netfilter-conntrack],
                  [Do not use Netfilter conntrack libraries for packet marking.
@@ -1361,7 +1362,7 @@ AC_ARG_WITH(netfilter-conntrack,
                   using --with-netfilter-conntrack=PATH. Default: auto-detect.]), [
 case "$with_netfilter_conntrack" in
   yes|no)
-    : # Nothing special to do here
+    squid_opt_netfilterconntrack=$with_netfilter_conntrack
     ;;
   *)
     if test ! -d "$withval" ; then
@@ -1371,6 +1372,7 @@ case "$with_netfilter_conntrack" in
     LDFLAGS="-L$squid_opt_netfilterconntrackpath/lib $LDFLAGS"
     CPPFLAGS="-I$squid_opt_netfilterconntrackpath/include $CPPFLAGS"
     with_netfilter_conntrack=yes
+    squid_opt_netfilterconntrack=yes
   esac
 ])
 AC_MSG_NOTICE([Linux Netfilter Conntrack support requested: ${with_netfilter_conntrack:=auto}])
@@ -1391,7 +1393,6 @@ if test "x$with_netfilter_conntrack" != "xno"; then
     with_netfilter_conntrack=yes
   fi
 fi
-AC_MSG_NOTICE([Linux Netfilter Conntrack support enabled: ${with_netfilter_conntrack} ${squid_opt_netfilterconntrackpath}])
 
 
 dnl Enable Large file support
@@ -2145,21 +2146,6 @@ SQUID_DEFINE_BOOL(X_ACCELERATOR_VARY,${enable_x_accelerator_vary:=no},
 AC_MSG_NOTICE([X-Accelerator-Vary support enabled: $enable_x_accelerator_vary])
 
 
-AC_ARG_ENABLE(zph-qos,
-  AS_HELP_STRING([--enable-zph-qos],[Enable ZPH QOS support]), [
-SQUID_YESNO([$enableval],
-            [unrecognized argument to --enable-zph-qos: $enableval])
-])
-SQUID_DEFINE_BOOL(USE_QOS_TOS,${enable_zph_qos:=yes},
-          [Enable Zero Penalty Hit QOS. When set, Squid will alter the
-           TOS field of HIT responses to help policing network traffic])
-AC_MSG_NOTICE([ZPH QOS enabled: $enable_zph_qos])
-if test x"$enable_zph_qos" = "xyes" ; then
-        AC_MSG_NOTICE([QOS netfilter mark preservation enabled: $with_netfilter_conntrack])
-        SQUID_DEFINE_BOOL(USE_LIBNETFILTERCONNTRACK,${with_netfilter_conntrack:=no},
-                      [Enable support for QOS netfilter mark preservation])
-fi
-
 if $CPPUNITCONFIG --help >/dev/null; then
   squid_cv_cppunit_version="`$CPPUNITCONFIG --version`"
   AC_MSG_NOTICE([using system installed cppunit version $squid_cv_cppunit_version])
@@ -3233,6 +3219,33 @@ if test "x$enable_linux_netfilter" = "xyes" -a "x$with_libcap" != "xyes" ; then
     # AC_DEFINEd later
 fi
 
+if test "x$squid_opt_netfilterconntrack" = "xyes" -a "x$with_libcap" != "xyes" ; then
+    AC_MSG_ERROR([Linux netfilter conntrack requires libcap support (libcap or libcap2)])
+fi
+if test "x$with_netfilter_conntrack" = "xyes" -a "x$with_libcap" != "xyes" ; then
+    AC_MSG_WARN([Missing needed capabilities (libcap or libcap2) for netfilter mark support])
+    AC_MSG_WARN([Linux netfilter marking support WILL NOT be enabled])
+    with_netfilter_conntrack=no
+fi
+AC_MSG_NOTICE([Linux Netfilter Conntrack support enabled: ${with_netfilter_conntrack} ${squid_opt_netfilterconntrackpath}])
+
+
+AC_ARG_ENABLE(zph-qos,
+  AS_HELP_STRING([--enable-zph-qos],[Enable ZPH QOS support]), [
+SQUID_YESNO([$enableval],
+            [unrecognized argument to --enable-zph-qos: $enableval])
+])
+SQUID_DEFINE_BOOL(USE_QOS_TOS,${enable_zph_qos:=yes},
+          [Enable Zero Penalty Hit QOS. When set, Squid will alter the
+           TOS field of HIT responses to help policing network traffic])
+AC_MSG_NOTICE([ZPH QOS enabled: $enable_zph_qos])
+if test x"$enable_zph_qos" = "xyes" ; then
+        AC_MSG_NOTICE([QOS netfilter mark preservation enabled: $with_netfilter_conntrack])
+        SQUID_DEFINE_BOOL(USE_LIBNETFILTERCONNTRACK,${with_netfilter_conntrack:=no},
+                      [Enable support for QOS netfilter mark preservation])
+fi
+
+
 AC_CHECK_LIB(regex, regexec, [REGEXLIB="-lregex"],[REGEXLIB=''])
 AC_ARG_ENABLE(gnuregex,
   AS_HELP_STRING([--enable-gnuregex],

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 10368edb020d47a53c77ac00e0b1b2b5293350e1..236ad5af9bd879fa691d35a313d4d28fa93e8bf8 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -1453,7 +1453,7 @@ free_acl_tos(acl_tos ** head)
     }
 }
 
-#if defined(SO_MARK)
+#if SO_MARK && USE_LIBCAP
 
 CBDATA_TYPE(acl_nfmark);
 

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 1fad47dffb8eca04f55cc9ba60ea9862193572cc..0eedb739445bbe91f82f23a49ca463cb0e65754d 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1623,7 +1623,7 @@ DOC_END
 
 NAME: tcp_outgoing_mark
 TYPE: acl_nfmark
-IFDEF: SO_MARK
+IFDEF: SO_MARK&&USE_LIBCAP
 DEFAULT: none
 LOC: Ip::Qos::TheConfig.nfmarkToServer
 DOC_START
@@ -1643,7 +1643,7 @@ DOC_END
 
 NAME: clientside_mark
 TYPE: acl_nfmark
-IFDEF: SO_MARK
+IFDEF: SO_MARK&&USE_LIBCAP
 DEFAULT: none
 LOC: Ip::Qos::TheConfig.nfmarkToClient
 DOC_START

diff --git a/src/cf_gen_defines b/src/cf_gen_defines
index 78fc510b96ce339a9fddbb250a06a1bfb1b53629..6d78e3151485a2707388358e3b33fd64d0b7dd98 100644 (file)
--- a/src/cf_gen_defines
+++ b/src/cf_gen_defines
@@ -30,7 +30,7 @@ BEGIN {
        define["USE_WCCPv2"]="--enable-wccpv2"
        define["USE_QOS_TOS"]="--enable-zph-qos"
        define["_SQUID_MSWIN_"]="MS Windows"
-       define["SO_MARK"]="Packet MARK (Linux)"
+       define["SO_MARK&&USE_LIBCAP"]="Packet MARK (Linux)"
 }
 /^IFDEF:/ {
        if (define[$2] != "")

diff --git a/src/forward.cc b/src/forward.cc
index 9523abb6943b217a2877a9c2fee9e5b9096df53f..44295c2bc7e4c79097e6bcdb5019507023325f81 100644 (file)
--- a/src/forward.cc
+++ b/src/forward.cc
@@ -919,7 +919,7 @@ FwdState::connectStart()
 
     tos_t tos = GetTosToServer(request);
 
-#if SO_MARK
+#if SO_MARK && USE_LIBCAP
     nfmark_t mark = GetNfmarkToServer(request);
     debugs(17, 3, "fwdConnectStart: got outgoing addr " << outgoing << ", tos " << int(tos)
            << ", netfilter mark " << mark);
@@ -1031,7 +1031,7 @@ FwdState::dispatch()
             tos_t tos = GetTosToServer(request);
             Ip::Qos::setSockTos(server_fd, tos);
         }
-#if SO_MARK
+#if SO_MARK && USE_LIBCAP
         if (Ip::Qos::TheConfig.isAclNfmarkActive()) {
             nfmark_t mark = GetNfmarkToServer(request);
             Ip::Qos::setSockNfmark(server_fd, mark);

diff --git a/src/ip/Qos.cci b/src/ip/Qos.cci
index d964617c56096610a267cabf80563d87ed5d27d9..11b5f362ba3c42a447ef119ed074c403025dd5bf 100644 (file)
--- a/src/ip/Qos.cci
+++ b/src/ip/Qos.cci
@@ -17,14 +17,17 @@ Ip::Qos::setSockTos(int fd, tos_t tos)
 int
 Ip::Qos::setSockNfmark(int fd, nfmark_t mark)
 {
-#if SO_MARK
+#if SO_MARK && USE_LIBCAP
     int x = setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(nfmark_t));
     if (x < 0)
         debugs(50, 2, "setSockNfmark: setsockopt(SO_MARK) on FD " << fd << ": " << xstrerror());
     return x;
-#else
+#elif USE_LIBCAP
     debugs(50, DBG_IMPORTANT, "WARNING: setsockopt(SO_MARK) not supported on this platform");
     return -1;
+#else
+    debugs(50, DBG_IMPORTANT, "WARNING: Netfilter marking disabled (netfilter marking requires build with LIBCAP)");
+    return -1;
 #endif
 }
 

diff --git a/src/ip/QosConfig.cc b/src/ip/QosConfig.cc
index e827c295afb18c8f99a7a52ba4f2becd670ca5fd..dc4522d6c077988344a78c94361c6a3821a41bd6 100644 (file)
--- a/src/ip/QosConfig.cc
+++ b/src/ip/QosConfig.cc
@@ -221,7 +221,7 @@ Ip::Qos::Config::parseConfigLine()
         // Work out TOS or mark. Default to TOS for backwards compatibility
         if (!(mark || tos)) {
             if (strncmp(token, "mark",4) == 0) {
-#if SO_MARK
+#if SO_MARK && USE_LIBCAP
                 mark = true;
                 // Assume preserve is true. We don't set at initialisation as this affects isHitNfmarkActive()
 #if USE_LIBNETFILTERCONNTRACK
@@ -231,11 +231,15 @@ Ip::Qos::Config::parseConfigLine()
                 debugs(3, DBG_IMPORTANT, "WARNING: Squid not compiled with Netfilter conntrack library. "
                        << "Netfilter mark preservation not available.");
 #endif // USE_LIBNETFILTERCONNTRACK
-#else // SO_MARK
+#elif SO_MARK // SO_MARK && USE_LIBCAP
                 debugs(3, DBG_CRITICAL, "ERROR: Invalid parameter 'mark' in qos_flows option. "
-                       << "Linux Netfilter marking not available.");
+                       << "Linux Netfilter marking not available without LIBCAP support.");
                 self_destruct();
-#endif // SO_MARK
+#else // SO_MARK && USE_LIBCAP
+                debugs(3, DBG_CRITICAL, "ERROR: Invalid parameter 'mark' in qos_flows option. "
+                       << "Linux Netfilter marking not available on this platform.");
+                self_destruct();
+#endif // SO_MARK && USE_LIBCAP
             } else if (strncmp(token, "tos",3) == 0) {
                 preserveMissTos = true;
                 tos = true;