[MEDIUM] support fully transparent proxy on Linux (USE_LINUX_TPROXY)
Using some Linux kernel patches, it is possible to redirect non-local
traffic to local sockets when IP forwarding is enabled. In order to
enable this option, we introduce the "transparent" option keyword on
the "bind" command line. It will make the socket reachable by remote
sources even if the destination address does not belong to the machine.
diff --git a/src/proto_tcp.c b/src/proto_tcp.c
index 2da34db..78d9367 100644
--- a/src/proto_tcp.c
+++ b/src/proto_tcp.c
@@ -154,6 +154,13 @@
*/
setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, (char *) &one, sizeof(one));
#endif
+#ifdef CONFIG_HAP_LINUX_TPROXY
+ if ((listener->options & LI_O_FOREIGN)
+ && (setsockopt(fd, SOL_IP, IP_TRANSPARENT, (char *) &one, sizeof(one)) == -1)) {
+ msg = "cannot make listening socket transparent";
+ err |= ERR_ALERT;
+ }
+#endif
if (bind(fd, (struct sockaddr *)&listener->addr, listener->proto->sock_addrlen) == -1) {
err |= ERR_RETRYABLE | ERR_ALERT;
msg = "cannot bind socket";