disable firetunnel at config time (#2793)

6 files changed, 66 insertions, 3 deletions

diff --git a/configure b/configure
index 6102a470e..60ec90adf 100755
--- a/configure
+++ b/configure
@@ -642,6 +642,7 @@ HAVE_GLOBALCFG
 HAVE_CHROOT
 HAVE_SECCOMP
 HAVE_PRIVATE_HOME
+HAVE_FIRETUNNEL
 HAVE_OVERLAYFS
 EXTRA_LDFLAGS
 EXTRA_CFLAGS
@@ -706,6 +707,7 @@ ac_user_opts='
 enable_option_checking
 enable_apparmor
 enable_overlayfs
+enable_firetunnel
 enable_private_home
 enable_seccomp
 enable_chroot
@@ -1357,6 +1359,7 @@ Optional Features:
   --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
   --enable-apparmor       enable apparmor
   --disable-overlayfs     disable overlayfs
+  --disable-firetunnel    disable firetunnel
   --disable-private-home  disable private home feature
   --disable-seccomp       disable seccomp
   --disable-chroot        disable chroot
@@ -3433,6 +3436,19 @@ if test "x$enable_overlayfs" != "xno"; then :
 
 fi
 
+HAVE_FIRETUNNEL=""
+# Check whether --enable-firetunnel was given.
+if test "${enable_firetunnel+set}" = set; then :
+  enableval=$enable_firetunnel;
+fi
+
+if test "x$enable_firetunnel" != "xno"; then :
+
+        HAVE_FIRETUNNEL="-DHAVE_FIRETUNNEL"
+
+
+fi
+
 HAVE_PRIVATEHOME=""
 # Check whether --enable-private-home was given.
 if test "${enable_private_home+set}" = set; then :
@@ -5280,6 +5296,7 @@ echo "   whitelisting: $HAVE_WHITELIST"
 echo "   private home support: $HAVE_PRIVATE_HOME"
 echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   overlayfs support: $HAVE_OVERLAYFS"
+echo "   firetunnel support: $HAVE_FIRETUNNEL"
 echo "   busybox workaround: $BUSYBOX_WORKAROUND"
 echo "   Spectre compiler patch: $HAVE_SPECTRE"
 echo "   EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
diff --git a/configure.ac b/configure.ac
index c3ca7d912..675c8fd65 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,3 +1,12 @@
+#
+# Note:
+#
+# If for any reason autoconf fails, run "autoreconf -i --install " and try again.
+# We rely soley on autoconf, without automake. Apparently, in this case
+# the macros from m4 directory are not picked up by default by automake.
+# "autoreconf -i --install" seems to fix the problem.
+#
+
 AC_PREREQ([2.68])
 AC_INIT(firejail, 0.9.61, netblue30@yahoo.com, , https://firejail.wordpress.com)
 AC_CONFIG_SRCDIR([src/firejail/main.c])
@@ -39,6 +48,14 @@ AS_IF([test "x$enable_overlayfs" != "xno"], [
         AC_SUBST(HAVE_OVERLAYFS)
 ])
 
+HAVE_FIRETUNNEL=""
+AC_ARG_ENABLE([firetunnel],
+    AS_HELP_STRING([--disable-firetunnel], [disable firetunnel]))
+AS_IF([test "x$enable_firetunnel" != "xno"], [
+        HAVE_FIRETUNNEL="-DHAVE_FIRETUNNEL"
+        AC_SUBST(HAVE_FIRETUNNEL)
+])
+
 HAVE_PRIVATEHOME=""
 AC_ARG_ENABLE([private-home],
     AS_HELP_STRING([--disable-private-home], [disable private home feature]))
@@ -186,6 +203,7 @@ echo "   whitelisting: $HAVE_WHITELIST"
 echo "   private home support: $HAVE_PRIVATE_HOME"
 echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   overlayfs support: $HAVE_OVERLAYFS"
+echo "   firetunnel support: $HAVE_FIRETUNNEL"
 echo "   busybox workaround: $BUSYBOX_WORKAROUND"
 echo "   Spectre compiler patch: $HAVE_SPECTRE"
 echo "   EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
diff --git a/src/common.mk.in b/src/common.mk.in
index b9af977ae..1b6ad91a5 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -20,6 +20,7 @@ HAVE_WHITELIST=@HAVE_WHITELIST@
 HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
 HAVE_APPARMOR=@HAVE_APPARMOR@
 HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
+HAVE_FIRETUNNEL=@HAVE_FIRETUNNEL@
 HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
 HAVE_GCOV=@HAVE_GCOV@
 
@@ -28,7 +29,7 @@ C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
 
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_FIRETUNNEL) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
 EXTRA_CFLAGS +=@EXTRA_CFLAGS@
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 7ca72bf30..b11d795a9 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -278,6 +278,14 @@ void print_compiletime_support(void) {
 #endif
                 );
 
+        printf("\t- firetunnel support is %s\n",
+#ifdef HAVE_FIRETUNNEL
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
         printf("\t- networking support is %s\n",
 #ifdef HAVE_NETWORK
                 "enabled"
diff --git a/src/firejail/main.c b/src/firejail/main.c
index c50ed4dc4..2403cafa1 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1498,6 +1498,7 @@ int main(int argc, char **argv) {
                                 exit_err_feature("overlayfs");
                 }
 #endif
+#ifdef HAVE_FIRETUNNEL
                 else if (strcmp(argv[i], "--tunnel") == 0) {
                         // try to connect to the default client side of the tunnel
                         // if this fails, try the default server side of the tunnel
@@ -1523,7 +1524,7 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                 }
-
+#endif
                 else if (strncmp(argv[i], "--profile=", 10) == 0) {
                         // multiple profile files are allowed!
 
diff --git a/test/compile/compile.sh b/test/compile/compile.sh
index adacab616..e662b4d30 100755
--- a/test/compile/compile.sh
+++ b/test/compile/compile.sh
@@ -3,7 +3,7 @@
 arr[1]="TEST 1: standard compilation"
 arr[2]="TEST 2: compile seccomp disabled"
 arr[3]="TEST 3: compile chroot disabled"
-arr[4]="deprecated: TEST 4: compile bind disabled"
+arr[4]="TEST 4: compile firetunnel disabled"
 arr[5]="TEST 5: compile user namespace disabled"
 arr[6]="TEST 6: compile network disabled"
 arr[7]="TEST 7: compile X11 disabled"
@@ -108,6 +108,24 @@ cp output-make om3
 rm output-configure output-make
 
 #*****************************************************************
+# TEST 4
+#*****************************************************************
+# - disable firetunnel configuration
+#*****************************************************************
+print_title "${arr[4]}"
+# seccomp
+cd firejail
+make distclean
+./configure --prefix=/usr --disable-firetunnel  --enable-fatal-warnings 2>&1 | tee ../output-configure
+make -j4 2>&1 | tee ../output-make
+cd ..
+grep Warning output-configure output-make > ./report-test4
+grep Error output-configure output-make >> ./report-test4
+cp output-configure oc4
+cp output-make om4
+rm output-configure output-make
+
+#*****************************************************************
 # TEST 5
 #*****************************************************************
 # - disable user namespace configuration