[squid-users] squid and kernel options

[Eliezer Croitoru]

Hey Vieri,

I think it's specific to your distro since... it exists in the netfilter sources as you can see at:
https://github.com/torvalds/linux/blob/4ac4d584886a4f47f8ff3bca0f32ff9a2987d3e5/net/netfilter/xt_socket.c

Squid doesn't use it directly but the iptables rules for tproxy to work requires this module to be available.
It is used to identify which connections are local socket and not incoming connections and if these are local sockets these will not be hijacked by tproxy and will be treated like a local connection.
Without this you cannot use tproxy.
To test if it exists you need to run the next command:
$ iptables -t mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1

And see what happens.
If it works, then you have the module on your OS and it should be fine.

Eliezer

----
http://ngtech.co.il/lmgtfy/
Linux System Administrator
Mobile: +972-5-28704261
Email: eliezer at ngtech.co.il


From: squid-users [mailto:squid-users-bounces at lists.squid-cache.org] On Behalf Of Vieri
Sent: Monday, October 2, 2017 22:54
To: squid-users at lists.squid-cache.org
Subject: [squid-users] squid and kernel options

Hi,

My distro's Squid package checks for the presence of several kernel config options. In particular, it checks for these:

NF_CONNTRACK 
NETFILTER_XT_MATCH_SOCKET 
NETFILTER_XT_TARGET_TPROXY

However, in recent kernels such as 4.12.12, it seems that the following option is not available anymore:

NETFILTER_XT_MATCH_SOCKET

How does Squid use this kernel config option, and how can I be affected by its absence?

Thanks,

Vieri