Move TPROXY v2 method of setting the outgoing address to IPIntercept class

diff --git a/src/IPInterception.cc b/src/IPInterception.cc
index a027089799700515722759612986d0c584e2f6ef..0c5445aa07f792e2fd98333f102a7624b7ce18ff 100644 (file)
--- a/src/IPInterception.cc
+++ b/src/IPInterception.cc
@@ -37,7 +37,9 @@
 #include "IPInterception.h"
 #include "SquidTime.h"
 
+
 #if IPF_TRANSPARENT
+
 #if HAVE_SYS_IOCTL_H
 #include <sys/ioctl.h>
 #endif
@@ -71,7 +73,8 @@
 #elif HAVE_NETINET_IP_NAT_H
 #include <netinet/ip_nat.h>
 #endif
-#endif
+
+#endif /* IPF_TRANSPARENT required headers */
 
 #if PF_TRANSPARENT
 #include <sys/types.h>
@@ -81,12 +84,20 @@
 #include <net/if.h>
 #include <netinet/in.h>
 #include <net/pfvar.h>
-#endif
+#endif /* PF_TRANSPARENT required headers */
 
 #if LINUX_NETFILTER
 #include <linux/netfilter_ipv4.h>
 #endif
 
+#if LINUX_TPROXY2
+#ifdef HAVE_LINUX_NETFILTER_IPV4_IP_TPROXY_H
+#include <linux/netfilter_ipv4/ip_tproxy.h>
+#else
+#error " TPROXY v2 Header file missing: linux/netfilter_ipv4/ip_tproxy.h. Perhapse you meant to use TPROXY v4 ? "
+#endif
+#endif
+
 
 // single global instance for access by other components.
 IPIntercept IPInterceptor;
@@ -343,3 +354,37 @@ IPIntercept::NatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAdd
 #endif
 
 }
+
+#if LINUX_TPROXY2
+IPIntercept::SetTproxy2OutgoingAddr(int fd, const IPAddress &src)
+{
+    IPAddress addr;
+    struct in_tproxy itp;
+
+    src.GetInAddr(itp.v.addr.faddr);
+    itp.v.addr.fport = 0;
+
+    /* If these syscalls fail then we just fallback to connecting
+     * normally by simply ignoring the errors...
+     */
+    itp.op = TPROXY_ASSIGN;
+
+    addr = (struct in_addr)itp.v.addr.faddr;
+    addr.SetPort(itp.v.addr.fport);
+
+    if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) {
+        debugs(20, 1, "tproxy ip=" << addr << " ERROR ASSIGN");
+        return -1;
+    } else {
+        itp.op = TPROXY_FLAGS;
+        itp.v.flags = ITP_CONNECT;
+
+        if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) {
+            debugs(20, 1, "tproxy ip=" << addr << " ERROR CONNECT");
+            return -1;
+        }
+    }
+
+    return 0;
+}
+#endif

diff --git a/src/IPInterception.h b/src/IPInterception.h
index 1f9d0aafb22a977dabfb314489685225ce74c846..ad7dae5caa6f8830a6beb20bcf6963a53b710650 100644 (file)
--- a/src/IPInterception.h
+++ b/src/IPInterception.h
@@ -46,6 +46,12 @@ class IPIntercept
 {
 public:
     int NatLookup(int fd, const IPAddress &me, const IPAddress &peer, IPAddress &dst);
+
+#if LINUX_TPROXY2
+    // only relevant to TPROXY v2 connections.
+    // which require the address be set specifically post-connect.
+    int SetTproxy2OutgoingAddr(int fd, const IPAddress &src);
+#endif
 }
 
 #if !defined(IP_TRANSPARENT)

diff --git a/src/forward.cc b/src/forward.cc
index c86356b2eb27f2d999b691c07f614184edcf5774..da75d7f7ab073c653ea1e189335b57bcb73ffcbe 100644 (file)
--- a/src/forward.cc
+++ b/src/forward.cc
@@ -49,13 +49,8 @@
 #include "SquidTime.h"
 #include "Store.h"
 
-#if LINUX_TPROXY2
-#ifdef HAVE_LINUX_NETFILTER_IPV4_IP_TPROXY_H
-#include <linux/netfilter_ipv4/ip_tproxy.h>
-#else
-#error " TPROXY v2 Header file missing: linux/netfilter_ipv4/ip_tproxy.h. Perhapse you meant to use TPROXY v4 ? "
-#endif
-#endif
+/* for IPInterceptor API */
+#include "IPInterception.h"
 
 static PSC fwdStartCompleteWrapper;
 static PF fwdServerClosedWrapper;
@@ -775,10 +770,6 @@ FwdState::connectStart()
     const char *domain = NULL;
     int ctimeout;
     int ftimeout = Config.Timeout.forward - (squid_curtime - start_t);
-#if LINUX_TPROXY2
-
-    struct in_tproxy itp;
-#endif
 
     IPAddress outgoing;
     unsigned short tos;
@@ -894,36 +885,14 @@ FwdState::connectStart()
 
 #if LINUX_TPROXY2
         if (request->flags.tproxy) {
-            IPAddress addr;
-
-            src.GetInAddr(itp.v.addr.faddr);
-            itp.v.addr.fport = 0;
-
-            /* If these syscalls fail then we just fallback to connecting
-             * normally by simply ignoring the errors...
-             */
-            itp.op = TPROXY_ASSIGN;
-
-            addr = (struct in_addr)itp.v.addr.faddr;
-            addr.SetPort(itp.v.addr.fport);
-
-            if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) {
-                debugs(20, 1, "tproxy ip=" << addr << " ERROR ASSIGN");
-
+            // try to set the outgoing address using TPROXY v2
+            // if it fails we abort any further TPROXY actions on this connection
+            if(IPInterceptor.SetTPROXY2OutgoingAddr(int fd, const IPAddress &src) == -1) {
                 request->flags.tproxy = 0;
-            } else {
-                itp.op = TPROXY_FLAGS;
-                itp.v.flags = ITP_CONNECT;
-
-                if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) {
-                    debugs(20, 1, "tproxy ip=" << addr << " ERROR CONNECT");
-
-                    request->flags.tproxy = 0;
-                }
             }
         }
-
 #endif
+
         hierarchyNote(&request->hier, fs->code, request->GetHost());
     }