Re: Accessing packet marking functions

[Andrew Beverley <andy@andybev.com>]

> >> >Can somebody point me in the right direction for the correct way of
> >> >setting and accessing the mark value of a packet? The TOS feature in
> >> >Squid uses setsockopt(). Is there an equivalent for mark? Should I be
> >> >using libnetfilter_queue?
> >> 
> >> setsockopt(fd, SOL_SOCKET, SO_MARK, ...)
> >
> >I am getting the error "Operation not permitted" when trying to do this.
> >Is this because the packet is not in a state where it can be marked, or
> >am I doing something stupid? My code is:
> >
> >int nfmark = 255;
> >setsockopt(fd, SOL_SOCKET, SO_MARK, (int *) &nfmark, sizeof(int));

> 1. Do away with the pointless casts.
> 2. Needs root privileges.

Thanks, that works now when running as root (with pointless casts
removed).

The problem is that Squid normally runs as a non-privileged user (I had
to remove the root checks from the code to get it to run as root). Is
there any way to mark packets when not root? Or is the only way to make
this work to run a small part of Squid as root?

Thanks,

Andy