This patch adds Netfilter mark support and overhauls existing QOS features. Netfilter mark support is added to all existing TOS functionality including qos_flows, clientside_tos and tcp_outgoing_tos. Netfilter QOS marking requires the libnetfilter_conntrack library. Netfilter marking for clientside_tos and tcp_outgoing_tos requires no additional libraries. === modified file 'CREDITS' --- CREDITS 2010-08-13 10:17:20 +0000 +++ CREDITS 2010-09-18 09:04:41 +0000 @@ -342,6 +342,28 @@ ============================================================================== +lib/xstrto.cc: + +/* + * (C) 2000-2006 by the netfilter coreteam : + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +============================================================================== + lib/getopt.c: /* === modified file 'configure.in' --- configure.in 2010-09-10 15:41:41 +0000 +++ configure.in 2010-09-19 08:14:52 +0000 @@ -1309,6 +1309,38 @@ AC_MSG_NOTICE([Linux Netfilter support requested: ${enable_linux_netfilter:=auto}]) #will be AC_DEFINEd later, after checking for appropriate infrastructure + +dnl Look for libnetfilter_conntrack options (needed for QOS netfilter marking) +AC_ARG_WITH(netfilter-conntrack, + AS_HELP_STRING([--without-netfilter-conntrack], + [Do not use Netfilter conntrack libraries for packet marking. + A path to alternative library location may be specified by + using --with-netfilter=PATH. Default: auto-detect.]), [ + case "$withval" in + yes|no) with_netfilter_conntrack=$withval ;; + *) squid_opt_netfilterconntrackpath=$withval + with_netfilter_conntrack=yes ;; + esac], [ + with_netfilter_conntrack=yes +]) +if test x"$with_netfilter_conntrack" = "xyes"; then + if test "x$squid_opt_netfilterconntrackpath" != "x"; then + if ! test -d "$squid_opt_netfilterconntrackpath"; then + AC_MSG_ERROR([--with-netfilter-conntrack path '$squid_opt_netfilterconntrackpath' does not exist]) + fi + LDFLAGS="-L$squid_opt_netfilterconntrackpath/lib $LDFLAGS" + CPPFLAGS="-I$squid_opt_netfilterconntrackpath/include $CPPFLAGS" + fi + AC_SEARCH_LIBS([nfct_query], [netfilter_conntrack],, + with_netfilter_conntrack=no + if test x"$withval" = "xyes"; then + AC_MSG_ERROR([--with-netfilter-conntrack specified but libnetfilter-conntrack libraries not found]) + fi ) + AC_CHECK_HEADERS([libnetfilter_conntrack/libnetfilter_conntrack.h \ + libnetfilter_conntrack/libnetfilter_conntrack_tcp.h],,with_netfilter_conntrack=no) +fi + + dnl Enable Large file support buildmodel="" squid_opt_enable_large_files=no @@ -2039,10 +2071,15 @@ SQUID_YESNO([$enableval], [unrecognized argument to --enable-zph-qos: $enableval]) ]) -SQUID_DEFINE_BOOL(USE_ZPH_QOS,${enable_zph_qos:=no}, +SQUID_DEFINE_BOOL(USE_QOS_TOS,${enable_zph_qos:=yes}, [Enable Zero Penalty Hit QOS. When set, Squid will alter the TOS field of HIT responses to help policing network traffic]) AC_MSG_NOTICE([ZPH QOS enabled: $enable_zph_qos]) +if test x"$enable_zph_qos" = "xyes" ; then + AC_MSG_NOTICE([QOS netfilter mark preservation enabled: $with_netfilter_conntrack]) + SQUID_DEFINE_BOOL(USE_LIBNETFILTERCONNTRACK,${with_netfilter_conntrack:=no}, + [Enable support for QOS netfilter mark preservation]) +fi if $CPPUNITCONFIG --help >/dev/null; then squid_cv_cppunit_version="`$CPPUNITCONFIG --version`" @@ -2133,6 +2170,7 @@ lber.h \ ldap.h \ libc.h \ + limits \ limits.h \ linux/posix_types.h \ linux/types.h \ @@ -2164,6 +2202,7 @@ signal.h \ sstream \ stdarg.h \ + stdbool.h \ stddef.h \ stdexcept \ stdio.h \ === modified file 'doc/release-notes/release-3.2.sgml' --- doc/release-notes/release-3.2.sgml 2010-09-18 12:55:12 +0000 +++ doc/release-notes/release-3.2.sgml 2010-09-19 12:36:02 +0000 @@ -378,6 +378,11 @@

htcp-* options collapsed into htcp= taking an optional comma-separated list of flags. The old form is deprecated but still accepted. + clientside_mark +

New configuration parameter clientside_mark +

Allows packets leaving Squid on the client side to be marked with a Netfilter mark value in the same way as the existing clientside_tos feature. +

This feature is only available for Netfilter environments. + deny_info

Support URL format tags. For dynamically generated URL in denial redirect. @@ -403,6 +408,23 @@

Please check and update your squid.conf to use the text none for no limit instead of the old 0 (zero).

All users upgrading need to be aware that from Squid-3.3 setting this option to 0 (zero) will mean zero bytes of memory get pooled. + qos_flows +

New options mark and tos and miss +

tos retains the original QOS functionality of the IP header TOS field. +

mark offers the same functionality, but with a netfilter mark value. +

These options should be placed immediately after qos_flows. +

The tos value is optional in order to maintain backwards compatability. +

The preserve-miss functionality is available with the mark option and requires no kernel patching. It does, however, require libnetfilter_conntrack. This will be included by default if available (see the --with-netfilter-conntrack configure option for more details). +

miss sets a value for a cache miss. It is available for both the tos and mark options and takes precedence over the preserve-miss feature. + + tcp_outgoing_mark +

New configuration parameter tcp_outgoing_mark +

Allows packets leaving Squid on the server side to be marked with a Netfilter mark value in the same way as the existing tcp_outgoing_tos feature. +

This feature is only available for Netfilter environments. + + tcp_outgoing_tos +

This parameter is now compatible with persistent server connections. + windows_ipaddrchangemonitor

Now only available to be set in Windows builds. @@ -489,6 +511,9 @@ to have any effect on existing builds other than fixing some mysterious lack of core dumps. The old /var/cache location was often non-writable which blocked core dumps creation. + --with-netfiler-conntrack +

Includes the libnetfilter_conntrack library, required for the new qos_flows option mark. + Changes to existing options