Maintenance: update --with-cap detection (#1718)

diff --git a/configure.ac b/configure.ac
index 6d75c0e8520f15927bc52e3159c1bf5d82387113..6202dfafdf3aa36ecce0d2a70ff8b0725266cc23 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -2019,20 +2019,13 @@ AC_FUNC_ALLOCA
 SQUID_AUTO_LIB(cap,[Linux capabilities],[LIBCAP])
 SQUID_CHECK_LIB_WORKS(cap,[
   SQUID_STATE_SAVE(squid_libcap_state)
-  CXXFLAGS="$LIBCAP_CFLAGS $CXXFLAGS"
-  LDFLAGS="$LIBCAP_PATH $LDFLAGS"
-  PKG_CHECK_MODULES([LIBCAP],[libcap >= 2.09],[],[
-    # cap_clear_flag is the most recent libcap function we require
-    AC_CHECK_LIB([cap],[cap_clear_flag],[LIBCAP_LIBS="$LIBCAP_LIBS -lcap"])
-  ])
+  PKG_CHECK_MODULES([LIBCAP],[libcap >= 2.09],[:],[:])
+  CPPFLAGS="$LIBCAP_CFLAGS $CPPFLAGS"
+  LIBS="$LIBCAP_PATH $LIBCAP_LIBS $LIBS"
   SQUID_CHECK_FUNCTIONAL_LIBCAP2
   AC_MSG_NOTICE([libcap headers are ok: $squid_cv_sys_capability_works])
   AS_IF([test "x$squid_cv_sys_capability_works" = "xno"],[LIBCAP_LIBS=""])
   SQUID_STATE_ROLLBACK(squid_libcap_state)
-
-  AS_IF([test "x$LIBCAP_LIBS" != "x"],[
-    AC_DEFINE(USE_LIBCAP,1,[Linux capabilities library support])
-  ])
 ])
 
 dnl Check for needed libraries

diff --git a/squid.dox b/squid.dox
index f76f80294564bc6272dbc47bc8e6d8b638fc7d05..6f6fce508f6662a7b3b1f0021f62d4ae7935004d 100644 (file)
--- a/squid.dox
+++ b/squid.dox
@@ -2066,6 +2066,7 @@ INCLUDE_FILE_PATTERNS  =
 PREDEFINED             = __cplusplus \
                          FOLLOW_X_FORWARDED_FOR \
                          FORW_VIA_DB \
+                         HAVE_LIBCAP \
                          HAVE_LIBGNUTLS \
                          ICAP_CLIENT \
                          HAVE_LIBHEIMDAL_KRB5 \
@@ -2090,7 +2091,6 @@ PREDEFINED             = __cplusplus \
                          USE_IDENT \
                          USE_IPV6 \
                          USE_KQUEUE \
-                         USE_LIBCAP \
                          USE_LOADABLE_MODULES \
                          USE_OPENSSL \
                          USE_POLL \

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 3bc6c1871d4256307ecff1343b465c6190f96f36..f8f8757ccc82bb1f8dbbdab832b8340c7addb8af 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -1676,7 +1676,7 @@ free_acl_tos(acl_tos ** head)
     *head = nullptr;
 }
 
-#if SO_MARK && USE_LIBCAP
+#if HAVE_LIBCAP && SO_MARK
 
 static void
 dump_acl_nfmark(StoreEntry * entry, const char *name, acl_nfmark * head)
@@ -1719,7 +1719,7 @@ free_acl_nfmark(acl_nfmark ** head)
     delete *head;
     *head = nullptr;
 }
-#endif /* SO_MARK */
+#endif /* HAVE_LIBCAP && SO_MARK */
 
 static void
 dump_acl_b_size_t(StoreEntry * entry, const char *name, AclSizeLimit * head)

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 51bb2d5a85896b797bb66fde2a2e435f6d428e21..15fe637ec080dfe1b47a3ccc7b4ede2321219cc7 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -2714,7 +2714,7 @@ DOC_END
 
 NAME: tcp_outgoing_mark
 TYPE: acl_nfmark
-IFDEF: SO_MARK&&USE_LIBCAP
+IFDEF: HAVE_LIBCAP&&SO_MARK
 DEFAULT: none
 LOC: Ip::Qos::TheConfig.nfmarkToServer
 DOC_START
@@ -2736,7 +2736,7 @@ DOC_END
 
 NAME: mark_client_packet clientside_mark
 TYPE: acl_nfmark
-IFDEF: SO_MARK&&USE_LIBCAP
+IFDEF: HAVE_LIBCAP&&SO_MARK
 DEFAULT: none
 LOC: Ip::Qos::TheConfig.nfmarkToClient
 DOC_START
@@ -2762,7 +2762,7 @@ DOC_END
 
 NAME: mark_client_connection
 TYPE: acl_nfmark
-IFDEF: SO_MARK&&USE_LIBCAP
+IFDEF: HAVE_LIBCAP&&SO_MARK
 DEFAULT: none
 LOC: Ip::Qos::TheConfig.nfConnmarkToClient
 DOC_START

diff --git a/src/cf_gen_defines b/src/cf_gen_defines
index 283c3e6ecc65e01d033083baa9f2b3e048cfa2d1..46a8dbd2c1bdbabb1f8423c69de8fda7b2c70f86 100644 (file)
--- a/src/cf_gen_defines
+++ b/src/cf_gen_defines
@@ -26,10 +26,10 @@ BEGIN {
        define["FOLLOW_X_FORWARDED_FOR&&USE_DELAY_POOLS"]="--enable-follow-x-forwarded-for and --enable-delay-pools"
        define["HAVE_AUTH_MODULE_BASIC"]="--enable-auth-basic"
        define["HAVE_AUTH_MODULE_DIGEST"]="--enable-auth-digest"
+       define["HAVE_LIBCAP&&SO_MARK"]="--with-cap and Packet MARK (Linux)"
        define["HAVE_LIBGNUTLS||USE_OPENSSL"]="--with-gnutls or --with-openssl"
        define["HAVE_MSTATS&&HAVE_GNUMALLOC_H"]="GNU Malloc with mstats()"
        define["ICAP_CLIENT"]="--enable-icap-client"
-       define["SO_MARK&&USE_LIBCAP"]="Packet MARK (Linux)"
        define["SQUID_SNMP"]="--enable-snmp"
        define["USE_ADAPTATION"]="--enable-ecap or --enable-icap-client"
        define["USE_AUTH"]="--enable-auth"

diff --git a/src/icmp/pinger.cc b/src/icmp/pinger.cc
index 951c1773320803cfb4ac1bf7cb03ca810c076c87..6d0952e2b97b2fa8d6ec53f2c25e2d7166c36b97 100644 (file)
--- a/src/icmp/pinger.cc
+++ b/src/icmp/pinger.cc
@@ -164,7 +164,7 @@ main(int, char **)
         exit(EXIT_FAILURE);
     }
 
-#if USE_LIBCAP
+#if HAVE_LIBCAP
     // Drop remaining capabilities (if installed as non-setuid setcap cap_net_raw=ep).
     // If pinger binary was installed setuid root, setuid() above already dropped all
     // capabilities, and this is no-op.

diff --git a/src/ip/QosConfig.cc b/src/ip/QosConfig.cc
index ad32975f6b8d3c9b84ebbcea72f17716cb727fbe..aede0c613b1bf4ef01d063fb40482da1e2a77a9a 100644 (file)
--- a/src/ip/QosConfig.cc
+++ b/src/ip/QosConfig.cc
@@ -315,7 +315,7 @@ Ip::Qos::Config::parseConfigLine()
         // Work out TOS or mark. Default to TOS for backwards compatibility
         if (!(mark || tos)) {
             if (strncmp(token, "mark",4) == 0) {
-#if SO_MARK && USE_LIBCAP
+#if HAVE_LIBCAP && SO_MARK
                 mark = true;
                 // Assume preserve is true. We don't set at initialisation as this affects isHitNfmarkActive()
 #if USE_LIBNETFILTERCONNTRACK
@@ -325,13 +325,11 @@ Ip::Qos::Config::parseConfigLine()
                 debugs(3, DBG_IMPORTANT, "WARNING: Squid not compiled with Netfilter conntrack library. "
                        << "Netfilter mark preservation not available.");
 #endif // USE_LIBNETFILTERCONNTRACK
-#elif SO_MARK // SO_MARK && USE_LIBCAP
-                throw TextException(ToSBuf("Invalid parameter 'mark' in qos_flows option. ",
-                                           "Linux Netfilter marking not available on this platform."), Here());
-#else // SO_MARK && USE_LIBCAP
+
+#else // HAVE_LIBCAP && SO_MARK
                 throw TextException(ToSBuf("Invalid parameter 'mark' in qos_flows option. ",
                                            "Linux Netfilter marking not available on this platform."), Here());
-#endif // SO_MARK && USE_LIBCAP
+#endif
             } else if (strncmp(token, "tos",3) == 0) {
                 preserveMissTos = true;
                 tos = true;
@@ -563,7 +561,7 @@ Ip::Qos::setSockTos(const Comm::ConnectionPointer &conn, tos_t tos)
 int
 Ip::Qos::setSockNfmark(const int fd, nfmark_t mark)
 {
-#if SO_MARK && USE_LIBCAP
+#if HAVE_LIBCAP && SO_MARK
     debugs(50, 3, "for FD " << fd << " to " << mark);
     const int x = setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(nfmark_t));
     if (x < 0) {
@@ -571,7 +569,7 @@ Ip::Qos::setSockNfmark(const int fd, nfmark_t mark)
         debugs(50, 2, "setsockopt(SO_MARK) on " << fd << ": " << xstrerr(xerrno));
     }
     return x;
-#elif USE_LIBCAP
+#elif HAVE_LIBCAP
     (void)mark;
     (void)fd;
     debugs(50, DBG_IMPORTANT, "WARNING: setsockopt(SO_MARK) not supported on this platform");
@@ -579,7 +577,7 @@ Ip::Qos::setSockNfmark(const int fd, nfmark_t mark)
 #else
     (void)mark;
     (void)fd;
-    debugs(50, DBG_IMPORTANT, "WARNING: Netfilter marking disabled (netfilter marking requires build with LIBCAP)");
+    debugs(50, DBG_IMPORTANT, "WARNING: Netfilter marking disabled (requires build --with-cap)");
     return -1;
 #endif
 }

diff --git a/src/tools.cc b/src/tools.cc
index 2c1e340c6b8663e36eabaadacbf2a9ef4dd3a63f..ae3eb0a5d8379520937febf2159b6f566a193154 100644 (file)
--- a/src/tools.cc
+++ b/src/tools.cc
@@ -1121,8 +1121,7 @@ strwordquote(MemBuf * mb, const char *str)
 void
 keepCapabilities(void)
 {
-#if USE_LIBCAP && HAVE_PRCTL && defined(PR_SET_KEEPCAPS)
-
+#if HAVE_LIBCAP && HAVE_PRCTL && defined(PR_SET_KEEPCAPS)
     if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
         Ip::Interceptor.StopTransparency("capability setting has failed.");
     }
@@ -1132,8 +1131,7 @@ keepCapabilities(void)
 static void
 restoreCapabilities(bool keep)
 {
-    /* NP: keep these two if-endif separate. Non-Linux work perfectly well without Linux syscap support. */
-#if USE_LIBCAP
+#if HAVE_LIBCAP
     cap_t caps;
     if (keep)
         caps = cap_get_proc();
@@ -1169,11 +1167,13 @@ restoreCapabilities(bool keep)
         cap_free(caps);
     }
 #elif _SQUID_LINUX_
-    (void)keep;
+    /* Linux requires syscap support from libcap. */
     Ip::Interceptor.StopTransparency("Missing needed capability support.");
+    (void)keep;
 #else
+    /* Non-Linux transparent proxy works with or without libcap support. */
     (void)keep;
-#endif /* HAVE_SYS_CAPABILITY_H */
+#endif
 }
 
 pid_t