squid and kernel options

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

squid and kernel options

Vieri
Hi,

My distro's Squid package checks for the presence of several kernel config options. In particular, it checks for these:

NF_CONNTRACK
NETFILTER_XT_MATCH_SOCKET
NETFILTER_XT_TARGET_TPROXY

However, in recent kernels such as 4.12.12, it seems that the following option is not available anymore:

NETFILTER_XT_MATCH_SOCKET

How does Squid use this kernel config option, and how can I be affected by its absence?

Thanks,

Vieri


_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|

Re: squid and kernel options

Eliezer Croitoru
Hey Vieri,

I think it's specific to your distro since... it exists in the netfilter sources as you can see at:
https://github.com/torvalds/linux/blob/4ac4d584886a4f47f8ff3bca0f32ff9a2987d3e5/net/netfilter/xt_socket.c

Squid doesn't use it directly but the iptables rules for tproxy to work requires this module to be available.
It is used to identify which connections are local socket and not incoming connections and if these are local sockets these will not be hijacked by tproxy and will be treated like a local connection.
Without this you cannot use tproxy.
To test if it exists you need to run the next command:
$ iptables -t mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1

And see what happens.
If it works, then you have the module on your OS and it should be fine.

Eliezer

----
http://ngtech.co.il/lmgtfy/
Linux System Administrator
Mobile: +972-5-28704261
Email: [hidden email]


From: squid-users [mailto:[hidden email]] On Behalf Of Vieri
Sent: Monday, October 2, 2017 22:54
To: [hidden email]
Subject: [squid-users] squid and kernel options

Hi,

My distro's Squid package checks for the presence of several kernel config options. In particular, it checks for these:

NF_CONNTRACK
NETFILTER_XT_MATCH_SOCKET
NETFILTER_XT_TARGET_TPROXY

However, in recent kernels such as 4.12.12, it seems that the following option is not available anymore:

NETFILTER_XT_MATCH_SOCKET

How does Squid use this kernel config option, and how can I be affected by its absence?

Thanks,

Vieri


_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|

Re: squid and kernel options

Vieri


________________________________
From: Eliezer Croitoru <[hidden email]>
> To test if it exists you need to run the next command:
> $ iptables -t mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1


Thanks!
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users