configure.ac

   1 #
   2 # Copyright (c) 1999-2004 Damien Miller
   3 #
   4 # Permission to use, copy, modify, and distribute this software for any
   5 # purpose with or without fee is hereby granted, provided that the above
   6 # copyright notice and this permission notice appear in all copies.
   7 #
   8 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15
  16 AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
  17 AC_REVISION($Revision: 1.583 $)
  18 AC_CONFIG_SRCDIR([ssh.c])
  19 AC_LANG([C])
  20
  21 AC_CONFIG_HEADER([config.h])
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PROG_MKDIR_P
  33 AC_CHECK_TOOLS([AR], [ar])
  34 AC_PATH_PROG([CAT], [cat])
  35 AC_PATH_PROG([KILL], [kill])
  36 AC_PATH_PROG([SED], [sed])
  37 AC_PATH_PROG([ENT], [ent])
  38 AC_SUBST([ENT])
  39 AC_PATH_PROG([TEST_MINUS_S_SH], [bash])
  40 AC_PATH_PROG([TEST_MINUS_S_SH], [ksh])
  41 AC_PATH_PROG([TEST_MINUS_S_SH], [sh])
  42 AC_PATH_PROG([SH], [sh])
  43 AC_PATH_PROG([GROFF], [groff])
  44 AC_PATH_PROG([NROFF], [nroff])
  45 AC_PATH_PROG([MANDOC], [mandoc])
  46 AC_SUBST([TEST_SHELL], [sh])
  47
  48 dnl select manpage formatter
  49 if test "x$MANDOC" != "x" ; then
  50         MANFMT="$MANDOC"
  51 elif test "x$NROFF" != "x" ; then
  52         MANFMT="$NROFF -mandoc"
  53 elif test "x$GROFF" != "x" ; then
  54         MANFMT="$GROFF -mandoc -Tascii"
  55 else
  56         AC_MSG_WARN([no manpage formatted found])
  57         MANFMT="false"
  58 fi
  59 AC_SUBST([MANFMT])
  60
  61 dnl for buildpkg.sh
  62 AC_PATH_PROG([PATH_GROUPADD_PROG], [groupadd], [groupadd],
  63         [/usr/sbin${PATH_SEPARATOR}/etc])
  64 AC_PATH_PROG([PATH_USERADD_PROG], [useradd], [useradd],
  65         [/usr/sbin${PATH_SEPARATOR}/etc])
  66 AC_CHECK_PROG([MAKE_PACKAGE_SUPPORTED], [pkgmk], [yes], [no])
  67 if test -x /sbin/sh; then
  68         AC_SUBST([STARTUP_SCRIPT_SHELL], [/sbin/sh])
  69 else
  70         AC_SUBST([STARTUP_SCRIPT_SHELL], [/bin/sh])
  71 fi
  72
  73 # System features
  74 AC_SYS_LARGEFILE
  75
  76 if test -z "$AR" ; then
  77         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  78 fi
  79
  80 AC_PATH_PROG([PATH_PASSWD_PROG], [passwd])
  81 if test ! -z "$PATH_PASSWD_PROG" ; then
  82         AC_DEFINE_UNQUOTED([_PATH_PASSWD_PROG], ["$PATH_PASSWD_PROG"],
  83                 [Full path of your "passwd" program])
  84 fi
  85
  86 if test -z "$LD" ; then
  87         LD=$CC
  88 fi
  89 AC_SUBST([LD])
  90
  91 AC_C_INLINE
  92
  93 AC_CHECK_DECL([LLONG_MAX], [have_llong_max=1], , [#include <limits.h>])
  94 AC_CHECK_DECL([SYSTR_POLICY_KILL], [have_systr_policy_kill=1], , [
  95         #include <sys/types.h>
  96         #include <sys/param.h>
  97         #include <dev/systrace.h>
  98 ])
  99 AC_CHECK_DECL([RLIMIT_NPROC],
 100     [AC_DEFINE([HAVE_RLIMIT_NPROC], [], [sys/resource.h has RLIMIT_NPROC])], , [
 101         #include <sys/types.h>
 102         #include <sys/resource.h>
 103 ])
 104 AC_CHECK_DECL([PR_SET_NO_NEW_PRIVS], [have_linux_no_new_privs=1], , [
 105         #include <sys/types.h>
 106         #include <linux/prctl.h>
 107 ])
 108
 109 openssl=yes
 110 AC_ARG_WITH([openssl],
 111         [  --without-openssl       Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL** ],
 112         [  if test "x$withval" = "xno" ; then
 113                 openssl=no
 114            fi
 115         ]
 116 )
 117 AC_MSG_CHECKING([whether OpenSSL will be used for cryptography])
 118 if test "x$openssl" = "xyes" ; then
 119         AC_MSG_RESULT([yes])
 120         AC_DEFINE_UNQUOTED([WITH_OPENSSL], [1], [use libcrypto for cryptography])
 121 else
 122         AC_MSG_RESULT([no])
 123 fi
 124
 125 use_stack_protector=1
 126 use_toolchain_hardening=1
 127 AC_ARG_WITH([stackprotect],
 128     [  --without-stackprotect  Don't use compiler's stack protection], [
 129     if test "x$withval" = "xno"; then
 130         use_stack_protector=0
 131     fi ])
 132 AC_ARG_WITH([hardening],
 133     [  --without-hardening     Don't use toolchain hardening flags], [
 134     if test "x$withval" = "xno"; then
 135         use_toolchain_hardening=0
 136     fi ])
 137
 138 # We use -Werror for the tests only so that we catch warnings like "this is
 139 # on by default" for things like -fPIE.
 140 AC_MSG_CHECKING([if $CC supports -Werror])
 141 saved_CFLAGS="$CFLAGS"
 142 CFLAGS="$CFLAGS -Werror"
 143 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[int main(void) { return 0; }]])],
 144         [ AC_MSG_RESULT([yes])
 145           WERROR="-Werror"],
 146         [ AC_MSG_RESULT([no])
 147           WERROR="" ]
 148 )
 149 CFLAGS="$saved_CFLAGS"
 150
 151 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 152         OSSH_CHECK_CFLAG_COMPILE([-pipe])
 153         OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments])
 154         OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option])
 155         OSSH_CHECK_CFLAG_COMPILE([-Wall])
 156         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-arith])
 157         OSSH_CHECK_CFLAG_COMPILE([-Wuninitialized])
 158         OSSH_CHECK_CFLAG_COMPILE([-Wsign-compare])
 159         OSSH_CHECK_CFLAG_COMPILE([-Wformat-security])
 160         OSSH_CHECK_CFLAG_COMPILE([-Wsizeof-pointer-memaccess])
 161         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-sign], [-Wno-pointer-sign])
 162         OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
 163         OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
 164     if test "x$use_toolchain_hardening" = "x1"; then
 165         OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc
 166         OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc
 167         OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
 168         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])
 169         OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
 170         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
 171         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
 172         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,noexecstack])
 173         # NB. -ftrapv expects certain support functions to be present in
 174         # the compiler library (libgcc or similar) to detect integer operations
 175         # that can overflow. We must check that the result of enabling it
 176         # actually links. The test program compiled/linked includes a number
 177         # of integer operations that should exercise this.
 178         OSSH_CHECK_CFLAG_LINK([-ftrapv])
 179     fi
 180         AC_MSG_CHECKING([gcc version])
 181         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 182         case $GCC_VER in
 183                 1.*) no_attrib_nonnull=1 ;;
 184                 2.8* | 2.9*)
 185                      no_attrib_nonnull=1
 186                      ;;
 187                 2.*) no_attrib_nonnull=1 ;;
 188                 *) ;;
 189         esac
 190         AC_MSG_RESULT([$GCC_VER])
 191
 192         AC_MSG_CHECKING([if $CC accepts -fno-builtin-memset])
 193         saved_CFLAGS="$CFLAGS"
 194         CFLAGS="$CFLAGS -fno-builtin-memset"
 195         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <string.h> ]],
 196                         [[ char b[10]; memset(b, 0, sizeof(b)); ]])],
 197                 [ AC_MSG_RESULT([yes]) ],
 198                 [ AC_MSG_RESULT([no])
 199                   CFLAGS="$saved_CFLAGS" ]
 200         )
 201
 202         # -fstack-protector-all doesn't always work for some GCC versions
 203         # and/or platforms, so we test if we can.  If it's not supported
 204         # on a given platform gcc will emit a warning so we use -Werror.
 205         if test "x$use_stack_protector" = "x1"; then
 206             for t in -fstack-protector-strong -fstack-protector-all \
 207                     -fstack-protector; do
 208                 AC_MSG_CHECKING([if $CC supports $t])
 209                 saved_CFLAGS="$CFLAGS"
 210                 saved_LDFLAGS="$LDFLAGS"
 211                 CFLAGS="$CFLAGS $t -Werror"
 212                 LDFLAGS="$LDFLAGS $t -Werror"
 213                 AC_LINK_IFELSE(
 214                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 215                         [[
 216         char x[256];
 217         snprintf(x, sizeof(x), "XXX");
 218                          ]])],
 219                     [ AC_MSG_RESULT([yes])
 220                       CFLAGS="$saved_CFLAGS $t"
 221                       LDFLAGS="$saved_LDFLAGS $t"
 222                       AC_MSG_CHECKING([if $t works])
 223                       AC_RUN_IFELSE(
 224                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 225                         [[
 226         char x[256];
 227         snprintf(x, sizeof(x), "XXX");
 228                         ]])],
 229                         [ AC_MSG_RESULT([yes])
 230                           break ],
 231                         [ AC_MSG_RESULT([no]) ],
 232                         [ AC_MSG_WARN([cross compiling: cannot test])
 233                           break ]
 234                       )
 235                     ],
 236                     [ AC_MSG_RESULT([no]) ]
 237                 )
 238                 CFLAGS="$saved_CFLAGS"
 239                 LDFLAGS="$saved_LDFLAGS"
 240             done
 241         fi
 242
 243         if test -z "$have_llong_max"; then
 244                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 245                 unset ac_cv_have_decl_LLONG_MAX
 246                 saved_CFLAGS="$CFLAGS"
 247                 CFLAGS="$CFLAGS -std=gnu99"
 248                 AC_CHECK_DECL([LLONG_MAX],
 249                     [have_llong_max=1],
 250                     [CFLAGS="$saved_CFLAGS"],
 251                     [#include <limits.h>]
 252                 )
 253         fi
 254 fi
 255
 256 AC_MSG_CHECKING([if compiler allows __attribute__ on return types])
 257 AC_COMPILE_IFELSE(
 258     [AC_LANG_PROGRAM([[
 259 #include <stdlib.h>
 260 __attribute__((__unused__)) static void foo(void){return;}]],
 261     [[ exit(0); ]])],
 262     [ AC_MSG_RESULT([yes]) ],
 263     [ AC_MSG_RESULT([no])
 264       AC_DEFINE(NO_ATTRIBUTE_ON_RETURN_TYPE, 1,
 265          [compiler does not accept __attribute__ on return types]) ]
 266 )
 267
 268 AC_MSG_CHECKING([if compiler allows __attribute__ prototype args])
 269 AC_COMPILE_IFELSE(
 270     [AC_LANG_PROGRAM([[
 271 #include <stdlib.h>
 272 typedef void foo(const char *, ...) __attribute__((format(printf, 1, 2)));]],
 273     [[ exit(0); ]])],
 274     [ AC_MSG_RESULT([yes]) ],
 275     [ AC_MSG_RESULT([no])
 276       AC_DEFINE(NO_ATTRIBUTE_ON_PROTOTYPE_ARGS, 1,
 277          [compiler does not accept __attribute__ on protoype args]) ]
 278 )
 279
 280 if test "x$no_attrib_nonnull" != "x1" ; then
 281         AC_DEFINE([HAVE_ATTRIBUTE__NONNULL__], [1], [Have attribute nonnull])
 282 fi
 283
 284 AC_ARG_WITH([rpath],
 285         [  --without-rpath         Disable auto-added -R linker paths],
 286         [
 287                 if test "x$withval" = "xno" ; then
 288                         need_dash_r=""
 289                 fi
 290                 if test "x$withval" = "xyes" ; then
 291                         need_dash_r=1
 292                 fi
 293         ]
 294 )
 295
 296 # Allow user to specify flags
 297 AC_ARG_WITH([cflags],
 298         [  --with-cflags           Specify additional flags to pass to compiler],
 299         [
 300                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 301                     test "x${withval}" != "xyes"; then
 302                         CFLAGS="$CFLAGS $withval"
 303                 fi
 304         ]
 305 )
 306
 307 AC_ARG_WITH([cflags-after],
 308         [  --with-cflags-after     Specify additional flags to pass to compiler after configure],
 309         [
 310                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 311                     test "x${withval}" != "xyes"; then
 312                         CFLAGS_AFTER="$withval"
 313                 fi
 314         ]
 315 )
 316 AC_ARG_WITH([cppflags],
 317         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 318         [
 319                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 320                     test "x${withval}" != "xyes"; then
 321                         CPPFLAGS="$CPPFLAGS $withval"
 322                 fi
 323         ]
 324 )
 325 AC_ARG_WITH([ldflags],
 326         [  --with-ldflags          Specify additional flags to pass to linker],
 327         [
 328                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 329                     test "x${withval}" != "xyes"; then
 330                         LDFLAGS="$LDFLAGS $withval"
 331                 fi
 332         ]
 333 )
 334 AC_ARG_WITH([ldflags-after],
 335         [  --with-ldflags-after    Specify additional flags to pass to linker after configure],
 336         [
 337                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 338                     test "x${withval}" != "xyes"; then
 339                         LDFLAGS_AFTER="$withval"
 340                 fi
 341         ]
 342 )
 343 AC_ARG_WITH([libs],
 344         [  --with-libs             Specify additional libraries to link with],
 345         [
 346                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 347                     test "x${withval}" != "xyes"; then
 348                         LIBS="$LIBS $withval"
 349                 fi
 350         ]
 351 )
 352 AC_ARG_WITH([Werror],
 353         [  --with-Werror           Build main code with -Werror],
 354         [
 355                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 356                         werror_flags="-Werror"
 357                         if test "x${withval}" != "xyes"; then
 358                                 werror_flags="$withval"
 359                         fi
 360                 fi
 361         ]
 362 )
 363
 364 AC_CHECK_HEADERS([ \
 365         blf.h \
 366         bstring.h \
 367         crypt.h \
 368         crypto/sha2.h \
 369         dirent.h \
 370         endian.h \
 371         elf.h \
 372         err.h \
 373         features.h \
 374         fcntl.h \
 375         floatingpoint.h \
 376         getopt.h \
 377         glob.h \
 378         ia.h \
 379         iaf.h \
 380         ifaddrs.h \
 381         inttypes.h \
 382         langinfo.h \
 383         limits.h \
 384         locale.h \
 385         login.h \
 386         maillock.h \
 387         ndir.h \
 388         net/if_tun.h \
 389         netdb.h \
 390         netgroup.h \
 391         pam/pam_appl.h \
 392         paths.h \
 393         poll.h \
 394         pty.h \
 395         readpassphrase.h \
 396         rpc/types.h \
 397         security/pam_appl.h \
 398         sha2.h \
 399         shadow.h \
 400         stddef.h \
 401         stdint.h \
 402         string.h \
 403         strings.h \
 404         sys/bitypes.h \
 405         sys/bsdtty.h \
 406         sys/cdefs.h \
 407         sys/dir.h \
 408         sys/file.h \
 409         sys/mman.h \
 410         sys/label.h \
 411         sys/ndir.h \
 412         sys/poll.h \
 413         sys/prctl.h \
 414         sys/pstat.h \
 415         sys/ptrace.h \
 416         sys/select.h \
 417         sys/stat.h \
 418         sys/stream.h \
 419         sys/stropts.h \
 420         sys/strtio.h \
 421         sys/statvfs.h \
 422         sys/sysmacros.h \
 423         sys/time.h \
 424         sys/timers.h \
 425         sys/vfs.h \
 426         time.h \
 427         tmpdir.h \
 428         ttyent.h \
 429         ucred.h \
 430         unistd.h \
 431         usersec.h \
 432         util.h \
 433         utime.h \
 434         utmp.h \
 435         utmpx.h \
 436         vis.h \
 437         wchar.h \
 438 ])
 439
 440 # On some platforms (eg SunOS4) sys/audit.h requires sys/[time|types|label.h]
 441 # to be included first.
 442 AC_CHECK_HEADERS([sys/audit.h], [], [], [
 443 #ifdef HAVE_SYS_TIME_H
 444 # include <sys/time.h>
 445 #endif
 446 #ifdef HAVE_SYS_TYPES_H
 447 # include <sys/types.h>
 448 #endif
 449 #ifdef HAVE_SYS_LABEL_H
 450 # include <sys/label.h>
 451 #endif
 452 ])
 453
 454 # sys/capsicum.h requires sys/types.h
 455 AC_CHECK_HEADERS([sys/capsicum.h], [], [], [
 456 #ifdef HAVE_SYS_TYPES_H
 457 # include <sys/types.h>
 458 #endif
 459 ])
 460
 461 # net/route.h requires sys/socket.h and sys/types.h.
 462 # sys/sysctl.h also requires sys/param.h
 463 AC_CHECK_HEADERS([net/route.h sys/sysctl.h], [], [], [
 464 #ifdef HAVE_SYS_TYPES_H
 465 # include <sys/types.h>
 466 #endif
 467 #include <sys/param.h>
 468 #include <sys/socket.h>
 469 ])
 470
 471 # lastlog.h requires sys/time.h to be included first on Solaris
 472 AC_CHECK_HEADERS([lastlog.h], [], [], [
 473 #ifdef HAVE_SYS_TIME_H
 474 # include <sys/time.h>
 475 #endif
 476 ])
 477
 478 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 479 AC_CHECK_HEADERS([sys/ptms.h], [], [], [
 480 #ifdef HAVE_SYS_STREAM_H
 481 # include <sys/stream.h>
 482 #endif
 483 ])
 484
 485 # login_cap.h requires sys/types.h on NetBSD
 486 AC_CHECK_HEADERS([login_cap.h], [], [], [
 487 #include <sys/types.h>
 488 ])
 489
 490 # older BSDs need sys/param.h before sys/mount.h
 491 AC_CHECK_HEADERS([sys/mount.h], [], [], [
 492 #include <sys/param.h>
 493 ])
 494
 495 # Android requires sys/socket.h to be included before sys/un.h
 496 AC_CHECK_HEADERS([sys/un.h], [], [], [
 497 #include <sys/types.h>
 498 #include <sys/socket.h>
 499 ])
 500
 501 # Messages for features tested for in target-specific section
 502 SIA_MSG="no"
 503 SPC_MSG="no"
 504 SP_MSG="no"
 505 SPP_MSG="no"
 506
 507 # Support for Solaris/Illumos privileges (this test is used by both
 508 # the --with-solaris-privs option and --with-sandbox=solaris).
 509 SOLARIS_PRIVS="no"
 510
 511 # Check for some target-specific stuff
 512 case "$host" in
 513 *-*-aix*)
 514         # Some versions of VAC won't allow macro redefinitions at
 515         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 516         # particularly with older versions of vac or xlc.
 517         # It also throws errors about null macro argments, but these are
 518         # not fatal.
 519         AC_MSG_CHECKING([if compiler allows macro redefinitions])
 520         AC_COMPILE_IFELSE(
 521             [AC_LANG_PROGRAM([[
 522 #define testmacro foo
 523 #define testmacro bar]],
 524             [[ exit(0); ]])],
 525             [ AC_MSG_RESULT([yes]) ],
 526             [ AC_MSG_RESULT([no])
 527               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 528               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 529               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 530               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 531             ]
 532         )
 533
 534         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 535         if (test -z "$blibpath"); then
 536                 blibpath="/usr/lib:/lib"
 537         fi
 538         saved_LDFLAGS="$LDFLAGS"
 539         if test "$GCC" = "yes"; then
 540                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 541         else
 542                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 543         fi
 544         for tryflags in $flags ;do
 545                 if (test -z "$blibflags"); then
 546                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 547                         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
 548                         [blibflags=$tryflags], [])
 549                 fi
 550         done
 551         if (test -z "$blibflags"); then
 552                 AC_MSG_RESULT([not found])
 553                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 554         else
 555                 AC_MSG_RESULT([$blibflags])
 556         fi
 557         LDFLAGS="$saved_LDFLAGS"
 558         dnl Check for authenticate.  Might be in libs.a on older AIXes
 559         AC_CHECK_FUNC([authenticate], [AC_DEFINE([WITH_AIXAUTHENTICATE], [1],
 560                 [Define if you want to enable AIX4's authenticate function])],
 561                 [AC_CHECK_LIB([s], [authenticate],
 562                         [ AC_DEFINE([WITH_AIXAUTHENTICATE])
 563                                 LIBS="$LIBS -ls"
 564                         ])
 565                 ])
 566         dnl Check for various auth function declarations in headers.
 567         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 568             passwdexpired, setauthdb], , , [#include <usersec.h>])
 569         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 570         AC_CHECK_DECLS([loginfailed],
 571             [AC_MSG_CHECKING([if loginfailed takes 4 arguments])
 572             AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <usersec.h> ]],
 573                 [[ (void)loginfailed("user","host","tty",0); ]])],
 574                 [AC_MSG_RESULT([yes])
 575                 AC_DEFINE([AIX_LOGINFAILED_4ARG], [1],
 576                         [Define if your AIX loginfailed() function
 577                         takes 4 arguments (AIX >= 5.2)])], [AC_MSG_RESULT([no])
 578             ])],
 579             [],
 580             [#include <usersec.h>]
 581         )
 582         AC_CHECK_FUNCS([getgrset setauthdb])
 583         AC_CHECK_DECL([F_CLOSEM],
 584             AC_DEFINE([HAVE_FCNTL_CLOSEM], [1], [Use F_CLOSEM fcntl for closefrom]),
 585             [],
 586             [ #include <limits.h>
 587               #include <fcntl.h> ]
 588         )
 589         check_for_aix_broken_getaddrinfo=1
 590         AC_DEFINE([BROKEN_REALPATH], [1], [Define if you have a broken realpath.])
 591         AC_DEFINE([SETEUID_BREAKS_SETUID], [1],
 592             [Define if your platform breaks doing a seteuid before a setuid])
 593         AC_DEFINE([BROKEN_SETREUID], [1], [Define if your setreuid() is broken])
 594         AC_DEFINE([BROKEN_SETREGID], [1], [Define if your setregid() is broken])
 595         dnl AIX handles lastlog as part of its login message
 596         AC_DEFINE([DISABLE_LASTLOG], [1], [Define if you don't want to use lastlog])
 597         AC_DEFINE([LOGIN_NEEDS_UTMPX], [1],
 598                 [Some systems need a utmpx entry for /bin/login to work])
 599         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 600                 [Define to a Set Process Title type if your system is
 601                 supported by bsd-setproctitle.c])
 602         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 603             [AIX 5.2 and 5.3 (and presumably newer) require this])
 604         AC_DEFINE([PTY_ZEROREAD], [1], [read(1) can return 0 for a non-closed fd])
 605         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 606         AC_DEFINE([BROKEN_STRNDUP], 1, [strndup broken, see APAR IY61211])
 607         AC_DEFINE([BROKEN_STRNLEN], 1, [strnlen broken, see APAR IY62551])
 608         ;;
 609 *-*-android*)
 610         AC_DEFINE([DISABLE_UTMP], [1], [Define if you don't want to use utmp])
 611         AC_DEFINE([DISABLE_WTMP], [1], [Define if you don't want to use wtmp])
 612         ;;
 613 *-*-cygwin*)
 614         check_for_libcrypt_later=1
 615         LIBS="$LIBS /usr/lib/textreadmode.o"
 616         AC_DEFINE([HAVE_CYGWIN], [1], [Define if you are on Cygwin])
 617         AC_DEFINE([USE_PIPES], [1], [Use PIPES instead of a socketpair()])
 618         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
 619                 [Define to disable UID restoration test])
 620         AC_DEFINE([DISABLE_SHADOW], [1],
 621                 [Define if you want to disable shadow passwords])
 622         AC_DEFINE([NO_X11_UNIX_SOCKETS], [1],
 623                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 624         AC_DEFINE([DISABLE_FD_PASSING], [1],
 625                 [Define if your platform needs to skip post auth
 626                 file descriptor passing])
 627         AC_DEFINE([SSH_IOBUFSZ], [65535], [Windows is sensitive to read buffer size])
 628         AC_DEFINE([FILESYSTEM_NO_BACKSLASH], [1], [File names may not contain backslash characters])
 629         # Cygwin defines optargs, optargs as declspec(dllimport) for historical
 630         # reasons which cause compile warnings, so we disable those warnings.
 631         OSSH_CHECK_CFLAG_COMPILE([-Wno-attributes])
 632         ;;
 633 *-*-dgux*)
 634         AC_DEFINE([IP_TOS_IS_BROKEN], [1],
 635                 [Define if your system choked on IP TOS setting])
 636         AC_DEFINE([SETEUID_BREAKS_SETUID])
 637         AC_DEFINE([BROKEN_SETREUID])
 638         AC_DEFINE([BROKEN_SETREGID])
 639         ;;
 640 *-*-darwin*)
 641         use_pie=auto
 642         AC_MSG_CHECKING([if we have working getaddrinfo])
 643         AC_RUN_IFELSE([AC_LANG_SOURCE([[ #include <mach-o/dyld.h>
 644 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 645                 exit(0);
 646         else
 647                 exit(1);
 648 }
 649                         ]])],
 650         [AC_MSG_RESULT([working])],
 651         [AC_MSG_RESULT([buggy])
 652         AC_DEFINE([BROKEN_GETADDRINFO], [1],
 653                 [getaddrinfo is broken (if present)])
 654         ],
 655         [AC_MSG_RESULT([assume it is working])])
 656         AC_DEFINE([SETEUID_BREAKS_SETUID])
 657         AC_DEFINE([BROKEN_SETREUID])
 658         AC_DEFINE([BROKEN_SETREGID])
 659         AC_DEFINE([BROKEN_GLOB], [1], [OS X glob does not do what we expect])
 660         AC_DEFINE_UNQUOTED([BIND_8_COMPAT], [1],
 661                 [Define if your resolver libs need this for getrrsetbyname])
 662         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 663         AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 664             [Use tunnel device compatibility to OpenBSD])
 665         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 666             [Prepend the address family to IP tunnel traffic])
 667         m4_pattern_allow([AU_IPv])
 668         AC_CHECK_DECL([AU_IPv4], [],
 669             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 670             [#include <bsm/audit.h>]
 671         AC_DEFINE([LASTLOG_WRITE_PUTUTXLINE], [1],
 672             [Define if pututxline updates lastlog too])
 673         )
 674         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 675                 [Define to a Set Process Title type if your system is
 676                 supported by bsd-setproctitle.c])
 677         AC_CHECK_FUNCS([sandbox_init])
 678         AC_CHECK_HEADERS([sandbox.h])
 679         AC_CHECK_LIB([sandbox], [sandbox_apply], [
 680             SSHDLIBS="$SSHDLIBS -lsandbox"
 681         ])
 682         ;;
 683 *-*-dragonfly*)
 684         SSHDLIBS="$SSHDLIBS -lcrypt"
 685         TEST_MALLOC_OPTIONS="AFGJPRX"
 686         ;;
 687 *-*-haiku*)
 688         LIBS="$LIBS -lbsd "
 689         AC_CHECK_LIB([network], [socket])
 690         AC_DEFINE([HAVE_U_INT64_T])
 691         MANTYPE=man
 692         ;;
 693 *-*-hpux*)
 694         # first we define all of the options common to all HP-UX releases
 695         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 696         IPADDR_IN_DISPLAY=yes
 697         AC_DEFINE([USE_PIPES])
 698         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 699         AC_DEFINE([LOCKED_PASSWD_STRING], ["*"],
 700                 [String used in /etc/passwd to denote locked account])
 701         AC_DEFINE([SPT_TYPE], [SPT_PSTAT])
 702         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 703         maildir="/var/mail"
 704         LIBS="$LIBS -lsec"
 705         AC_CHECK_LIB([xnet], [t_error], ,
 706             [AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***])])
 707
 708         # next, we define all of the options specific to major releases
 709         case "$host" in
 710         *-*-hpux10*)
 711                 if test -z "$GCC"; then
 712                         CFLAGS="$CFLAGS -Ae"
 713                 fi
 714                 ;;
 715         *-*-hpux11*)
 716                 AC_DEFINE([PAM_SUN_CODEBASE], [1],
 717                         [Define if you are using Solaris-derived PAM which
 718                         passes pam_messages to the conversation function
 719                         with an extra level of indirection])
 720                 AC_DEFINE([DISABLE_UTMP], [1],
 721                         [Define if you don't want to use utmp])
 722                 AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 723                 check_for_hpux_broken_getaddrinfo=1
 724                 check_for_conflicting_getspnam=1
 725                 ;;
 726         esac
 727
 728         # lastly, we define options specific to minor releases
 729         case "$host" in
 730         *-*-hpux10.26)
 731                 AC_DEFINE([HAVE_SECUREWARE], [1],
 732                         [Define if you have SecureWare-based
 733                         protected password database])
 734                 disable_ptmx_check=yes
 735                 LIBS="$LIBS -lsecpw"
 736                 ;;
 737         esac
 738         ;;
 739 *-*-irix5*)
 740         PATH="$PATH:/usr/etc"
 741         AC_DEFINE([BROKEN_INET_NTOA], [1],
 742                 [Define if you system's inet_ntoa is busted
 743                 (e.g. Irix gcc issue)])
 744         AC_DEFINE([SETEUID_BREAKS_SETUID])
 745         AC_DEFINE([BROKEN_SETREUID])
 746         AC_DEFINE([BROKEN_SETREGID])
 747         AC_DEFINE([WITH_ABBREV_NO_TTY], [1],
 748                 [Define if you shouldn't strip 'tty' from your
 749                 ttyname in [uw]tmp])
 750         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 751         ;;
 752 *-*-irix6*)
 753         PATH="$PATH:/usr/etc"
 754         AC_DEFINE([WITH_IRIX_ARRAY], [1],
 755                 [Define if you have/want arrays
 756                 (cluster-wide session managment, not C arrays)])
 757         AC_DEFINE([WITH_IRIX_PROJECT], [1],
 758                 [Define if you want IRIX project management])
 759         AC_DEFINE([WITH_IRIX_AUDIT], [1],
 760                 [Define if you want IRIX audit trails])
 761         AC_CHECK_FUNC([jlimit_startjob], [AC_DEFINE([WITH_IRIX_JOBS], [1],
 762                 [Define if you want IRIX kernel jobs])])
 763         AC_DEFINE([BROKEN_INET_NTOA])
 764         AC_DEFINE([SETEUID_BREAKS_SETUID])
 765         AC_DEFINE([BROKEN_SETREUID])
 766         AC_DEFINE([BROKEN_SETREGID])
 767         AC_DEFINE([BROKEN_UPDWTMPX], [1], [updwtmpx is broken (if present)])
 768         AC_DEFINE([WITH_ABBREV_NO_TTY])
 769         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 770         ;;
 771 *-*-k*bsd*-gnu | *-*-kopensolaris*-gnu)
 772         check_for_libcrypt_later=1
 773         AC_DEFINE([PAM_TTY_KLUDGE])
 774         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"])
 775         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 776         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 777         AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 778         ;;
 779 *-*-linux*)
 780         no_dev_ptmx=1
 781         use_pie=auto
 782         check_for_libcrypt_later=1
 783         check_for_openpty_ctty_bug=1
 784         dnl Target SUSv3/POSIX.1-2001 plus BSD specifics.
 785         dnl _DEFAULT_SOURCE is the new name for _BSD_SOURCE
 786         CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE"
 787         AC_DEFINE([PAM_TTY_KLUDGE], [1],
 788                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 789         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"],
 790                 [String used in /etc/passwd to denote locked account])
 791         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 792         AC_DEFINE([LINK_OPNOTSUPP_ERRNO], [EPERM],
 793                 [Define to whatever link() returns for "not supported"
 794                 if it doesn't return EOPNOTSUPP.])
 795         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 796         AC_DEFINE([USE_BTMP])
 797         AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])
 798         inet6_default_4in6=yes
 799         case `uname -r` in
 800         1.*|2.0.*)
 801                 AC_DEFINE([BROKEN_CMSG_TYPE], [1],
 802                         [Define if cmsg_type is not passed correctly])
 803                 ;;
 804         esac
 805         # tun(4) forwarding compat code
 806         AC_CHECK_HEADERS([linux/if_tun.h])
 807         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 808                 AC_DEFINE([SSH_TUN_LINUX], [1],
 809                     [Open tunnel devices the Linux tun/tap way])
 810                 AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 811                     [Use tunnel device compatibility to OpenBSD])
 812                 AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 813                     [Prepend the address family to IP tunnel traffic])
 814         fi
 815         AC_CHECK_HEADER([linux/if.h],
 816             AC_DEFINE([SYS_RDOMAIN_LINUX], [1],
 817                 [Support routing domains using Linux VRF]), [], [
 818 #ifdef HAVE_SYS_TYPES_H
 819 # include <sys/types.H>
 820 #endif
 821             ])
 822         AC_CHECK_HEADERS([linux/seccomp.h linux/filter.h linux/audit.h], [],
 823             [], [#include <linux/types.h>])
 824         # Obtain MIPS ABI
 825         case "$host" in
 826         mips*)
 827                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 828 #if _MIPS_SIM != _ABIO32
 829 #error
 830 #endif
 831                         ]])],[mips_abi="o32"],[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 832 #if _MIPS_SIM != _ABIN32
 833 #error
 834 #endif
 835                                 ]])],[mips_abi="n32"],[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 836 #if _MIPS_SIM != _ABI64
 837 #error
 838 #endif
 839                                         ]])],[mips_abi="n64"],[AC_MSG_ERROR([unknown MIPS ABI])
 840                                 ])
 841                         ])
 842                 ])
 843                 ;;
 844         esac
 845         AC_MSG_CHECKING([for seccomp architecture])
 846         seccomp_audit_arch=
 847         case "$host" in
 848         x86_64-*)
 849                 seccomp_audit_arch=AUDIT_ARCH_X86_64
 850                 ;;
 851         i*86-*)
 852                 seccomp_audit_arch=AUDIT_ARCH_I386
 853                 ;;
 854         arm*-*)
 855                 seccomp_audit_arch=AUDIT_ARCH_ARM
 856                 ;;
 857         aarch64*-*)
 858                 seccomp_audit_arch=AUDIT_ARCH_AARCH64
 859                 ;;
 860         s390x-*)
 861                 seccomp_audit_arch=AUDIT_ARCH_S390X
 862                 ;;
 863         s390-*)
 864                 seccomp_audit_arch=AUDIT_ARCH_S390
 865                 ;;
 866         powerpc64-*)
 867                 seccomp_audit_arch=AUDIT_ARCH_PPC64
 868                 ;;
 869         powerpc64le-*)
 870                 seccomp_audit_arch=AUDIT_ARCH_PPC64LE
 871                 ;;
 872         mips-*)
 873                 seccomp_audit_arch=AUDIT_ARCH_MIPS
 874                 ;;
 875         mipsel-*)
 876                 seccomp_audit_arch=AUDIT_ARCH_MIPSEL
 877                 ;;
 878         mips64-*)
 879                 case "$mips_abi" in
 880                 "n32")
 881                         seccomp_audit_arch=AUDIT_ARCH_MIPS64N32
 882                         ;;
 883                 "n64")
 884                         seccomp_audit_arch=AUDIT_ARCH_MIPS64
 885                         ;;
 886                 esac
 887                 ;;
 888         mips64el-*)
 889                 case "$mips_abi" in
 890                 "n32")
 891                         seccomp_audit_arch=AUDIT_ARCH_MIPSEL64N32
 892                         ;;
 893                 "n64")
 894                         seccomp_audit_arch=AUDIT_ARCH_MIPSEL64
 895                         ;;
 896                 esac
 897                 ;;
 898         esac
 899         if test "x$seccomp_audit_arch" != "x" ; then
 900                 AC_MSG_RESULT(["$seccomp_audit_arch"])
 901                 AC_DEFINE_UNQUOTED([SECCOMP_AUDIT_ARCH], [$seccomp_audit_arch],
 902                     [Specify the system call convention in use])
 903         else
 904                 AC_MSG_RESULT([architecture not supported])
 905         fi
 906         ;;
 907 mips-sony-bsd|mips-sony-newsos4)
 908         AC_DEFINE([NEED_SETPGRP], [1], [Need setpgrp to acquire controlling tty])
 909         SONY=1
 910         ;;
 911 *-*-netbsd*)
 912         check_for_libcrypt_before=1
 913         if test "x$withval" != "xno" ; then
 914                 need_dash_r=1
 915         fi
 916         CPPFLAGS="$CPPFLAGS -D_OPENBSD_SOURCE"
 917         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 918         AC_CHECK_HEADER([net/if_tap.h], ,
 919             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 920         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 921             [Prepend the address family to IP tunnel traffic])
 922         TEST_MALLOC_OPTIONS="AJRX"
 923         AC_DEFINE([BROKEN_READ_COMPARISON], [1],
 924             [NetBSD read function is sometimes redirected, breaking atomicio comparisons against it])
 925         ;;
 926 *-*-freebsd*)
 927         check_for_libcrypt_later=1
 928         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["*LOCKED*"], [Account locked with pw(1)])
 929         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 930         AC_CHECK_HEADER([net/if_tap.h], ,
 931             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 932         AC_DEFINE([BROKEN_GLOB], [1], [FreeBSD glob does not do what we need])
 933         TEST_MALLOC_OPTIONS="AJRX"
 934         # Preauth crypto occasionally uses file descriptors for crypto offload
 935         # and will crash if they cannot be opened.
 936         AC_DEFINE([SANDBOX_SKIP_RLIMIT_NOFILE], [1],
 937             [define if setrlimit RLIMIT_NOFILE breaks things])
 938         ;;
 939 *-*-bsdi*)
 940         AC_DEFINE([SETEUID_BREAKS_SETUID])
 941         AC_DEFINE([BROKEN_SETREUID])
 942         AC_DEFINE([BROKEN_SETREGID])
 943         ;;
 944 *-next-*)
 945         conf_lastlog_location="/usr/adm/lastlog"
 946         conf_utmp_location=/etc/utmp
 947         conf_wtmp_location=/usr/adm/wtmp
 948         maildir=/usr/spool/mail
 949         AC_DEFINE([HAVE_NEXT], [1], [Define if you are on NeXT])
 950         AC_DEFINE([BROKEN_REALPATH])
 951         AC_DEFINE([USE_PIPES])
 952         AC_DEFINE([BROKEN_SAVED_UIDS], [1], [Needed for NeXT])
 953         ;;
 954 *-*-openbsd*)
 955         use_pie=auto
 956         AC_DEFINE([HAVE_ATTRIBUTE__SENTINEL__], [1], [OpenBSD's gcc has sentinel])
 957         AC_DEFINE([HAVE_ATTRIBUTE__BOUNDED__], [1], [OpenBSD's gcc has bounded])
 958         AC_DEFINE([SSH_TUN_OPENBSD], [1], [Open tunnel devices the OpenBSD way])
 959         AC_DEFINE([SYSLOG_R_SAFE_IN_SIGHAND], [1],
 960             [syslog_r function is safe to use in in a signal handler])
 961         TEST_MALLOC_OPTIONS="AFGJPRX"
 962         ;;
 963 *-*-solaris*)
 964         if test "x$withval" != "xno" ; then
 965                 need_dash_r=1
 966         fi
 967         AC_DEFINE([PAM_SUN_CODEBASE])
 968         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 969         AC_DEFINE([PAM_TTY_KLUDGE])
 970         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 971                 [Define if pam_chauthtok wants real uid set
 972                 to the unpriv'ed user])
 973         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 974         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 975         AC_DEFINE([SSHD_ACQUIRES_CTTY], [1],
 976                 [Define if sshd somehow reacquires a controlling TTY
 977                 after setsid()])
 978         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd
 979                 in case the name is longer than 8 chars])
 980         AC_DEFINE([BROKEN_TCGETATTR_ICANON], [1], [tcgetattr with ICANON may hang])
 981         external_path_file=/etc/default/login
 982         # hardwire lastlog location (can't detect it on some versions)
 983         conf_lastlog_location="/var/adm/lastlog"
 984         AC_MSG_CHECKING([for obsolete utmp and wtmp in solaris2.x])
 985         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 986         if test "$sol2ver" -ge 8; then
 987                 AC_MSG_RESULT([yes])
 988                 AC_DEFINE([DISABLE_UTMP])
 989                 AC_DEFINE([DISABLE_WTMP], [1],
 990                         [Define if you don't want to use wtmp])
 991         else
 992                 AC_MSG_RESULT([no])
 993         fi
 994         AC_CHECK_FUNCS([setpflags])
 995         AC_CHECK_FUNCS([setppriv])
 996         AC_CHECK_FUNCS([priv_basicset])
 997         AC_CHECK_HEADERS([priv.h])
 998         AC_ARG_WITH([solaris-contracts],
 999                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
1000                 [
1001                 AC_CHECK_LIB([contract], [ct_tmpl_activate],
1002                         [ AC_DEFINE([USE_SOLARIS_PROCESS_CONTRACTS], [1],
1003                                 [Define if you have Solaris process contracts])
1004                           LIBS="$LIBS -lcontract"
1005                           SPC_MSG="yes" ], )
1006                 ],
1007         )
1008         AC_ARG_WITH([solaris-projects],
1009                 [  --with-solaris-projects Enable Solaris projects (experimental)],
1010                 [
1011                 AC_CHECK_LIB([project], [setproject],
1012                         [ AC_DEFINE([USE_SOLARIS_PROJECTS], [1],
1013                                 [Define if you have Solaris projects])
1014                         LIBS="$LIBS -lproject"
1015                         SP_MSG="yes" ], )
1016                 ],
1017         )
1018         AC_ARG_WITH([solaris-privs],
1019                 [  --with-solaris-privs    Enable Solaris/Illumos privileges (experimental)],
1020                 [
1021                 AC_MSG_CHECKING([for Solaris/Illumos privilege support])
1022                 if test "x$ac_cv_func_setppriv" = "xyes" -a \
1023                         "x$ac_cv_header_priv_h" = "xyes" ; then
1024                         SOLARIS_PRIVS=yes
1025                         AC_MSG_RESULT([found])
1026                         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
1027                                 [Define to disable UID restoration test])
1028                         AC_DEFINE([USE_SOLARIS_PRIVS], [1],
1029                                 [Define if you have Solaris privileges])
1030                         SPP_MSG="yes"
1031                 else
1032                         AC_MSG_RESULT([not found])
1033                         AC_MSG_ERROR([*** must have support for Solaris privileges to use --with-solaris-privs])
1034                 fi
1035                 ],
1036         )
1037         TEST_SHELL=$SHELL       # let configure find us a capable shell
1038         ;;
1039 *-*-sunos4*)
1040         CPPFLAGS="$CPPFLAGS -DSUNOS4"
1041         AC_CHECK_FUNCS([getpwanam])
1042         AC_DEFINE([PAM_SUN_CODEBASE])
1043         conf_utmp_location=/etc/utmp
1044         conf_wtmp_location=/var/adm/wtmp
1045         conf_lastlog_location=/var/adm/lastlog
1046         AC_DEFINE([USE_PIPES])
1047         AC_DEFINE([DISABLE_UTMPX], [1], [no utmpx])
1048         ;;
1049 *-ncr-sysv*)
1050         LIBS="$LIBS -lc89"
1051         AC_DEFINE([USE_PIPES])
1052         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1053         AC_DEFINE([SETEUID_BREAKS_SETUID])
1054         AC_DEFINE([BROKEN_SETREUID])
1055         AC_DEFINE([BROKEN_SETREGID])
1056         ;;
1057 *-sni-sysv*)
1058         # /usr/ucblib MUST NOT be searched on ReliantUNIX
1059         AC_CHECK_LIB([dl], [dlsym], ,)
1060         # -lresolv needs to be at the end of LIBS or DNS lookups break
1061         AC_CHECK_LIB([resolv], [res_query], [ LIBS="$LIBS -lresolv" ])
1062         IPADDR_IN_DISPLAY=yes
1063         AC_DEFINE([USE_PIPES])
1064         AC_DEFINE([IP_TOS_IS_BROKEN])
1065         AC_DEFINE([SETEUID_BREAKS_SETUID])
1066         AC_DEFINE([BROKEN_SETREUID])
1067         AC_DEFINE([BROKEN_SETREGID])
1068         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1069         external_path_file=/etc/default/login
1070         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
1071         # Attention: always take care to bind libsocket and libnsl before libc,
1072         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
1073         ;;
1074 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
1075 *-*-sysv4.2*)
1076         AC_DEFINE([USE_PIPES])
1077         AC_DEFINE([SETEUID_BREAKS_SETUID])
1078         AC_DEFINE([BROKEN_SETREUID])
1079         AC_DEFINE([BROKEN_SETREGID])
1080         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd])
1081         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
1082         TEST_SHELL=$SHELL       # let configure find us a capable shell
1083         ;;
1084 # UnixWare 7.x, OpenUNIX 8
1085 *-*-sysv5*)
1086         CPPFLAGS="$CPPFLAGS -Dvsnprintf=_xvsnprintf -Dsnprintf=_xsnprintf"
1087         AC_DEFINE([UNIXWARE_LONG_PASSWORDS], [1], [Support passwords > 8 chars])
1088         AC_DEFINE([USE_PIPES])
1089         AC_DEFINE([SETEUID_BREAKS_SETUID])
1090         AC_DEFINE([BROKEN_GETADDRINFO])
1091         AC_DEFINE([BROKEN_SETREUID])
1092         AC_DEFINE([BROKEN_SETREGID])
1093         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1094         AC_DEFINE([BROKEN_TCGETATTR_ICANON])
1095         TEST_SHELL=$SHELL       # let configure find us a capable shell
1096         check_for_libcrypt_later=1
1097         case "$host" in
1098         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
1099                 maildir=/var/spool/mail
1100                 AC_DEFINE([BROKEN_UPDWTMPX])
1101                 AC_CHECK_LIB([prot], [getluid], [ LIBS="$LIBS -lprot"
1102                         AC_CHECK_FUNCS([getluid setluid], , , [-lprot])
1103                         ], , )
1104                 ;;
1105         *)      AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
1106                 ;;
1107         esac
1108         ;;
1109 *-*-sysv*)
1110         ;;
1111 # SCO UNIX and OEM versions of SCO UNIX
1112 *-*-sco3.2v4*)
1113         AC_MSG_ERROR("This Platform is no longer supported.")
1114         ;;
1115 # SCO OpenServer 5.x
1116 *-*-sco3.2v5*)
1117         if test -z "$GCC"; then
1118                 CFLAGS="$CFLAGS -belf"
1119         fi
1120         LIBS="$LIBS -lprot -lx -ltinfo -lm"
1121         no_dev_ptmx=1
1122         AC_DEFINE([USE_PIPES])
1123         AC_DEFINE([HAVE_SECUREWARE])
1124         AC_DEFINE([DISABLE_SHADOW])
1125         AC_DEFINE([DISABLE_FD_PASSING])
1126         AC_DEFINE([SETEUID_BREAKS_SETUID])
1127         AC_DEFINE([BROKEN_GETADDRINFO])
1128         AC_DEFINE([BROKEN_SETREUID])
1129         AC_DEFINE([BROKEN_SETREGID])
1130         AC_DEFINE([WITH_ABBREV_NO_TTY])
1131         AC_DEFINE([BROKEN_UPDWTMPX])
1132         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1133         AC_CHECK_FUNCS([getluid setluid])
1134         MANTYPE=man
1135         TEST_SHELL=$SHELL       # let configure find us a capable shell
1136         SKIP_DISABLE_LASTLOG_DEFINE=yes
1137         ;;
1138 *-dec-osf*)
1139         AC_MSG_CHECKING([for Digital Unix SIA])
1140         no_osfsia=""
1141         AC_ARG_WITH([osfsia],
1142                 [  --with-osfsia           Enable Digital Unix SIA],
1143                 [
1144                         if test "x$withval" = "xno" ; then
1145                                 AC_MSG_RESULT([disabled])
1146                                 no_osfsia=1
1147                         fi
1148                 ],
1149         )
1150         if test -z "$no_osfsia" ; then
1151                 if test -f /etc/sia/matrix.conf; then
1152                         AC_MSG_RESULT([yes])
1153                         AC_DEFINE([HAVE_OSF_SIA], [1],
1154                                 [Define if you have Digital Unix Security
1155                                 Integration Architecture])
1156                         AC_DEFINE([DISABLE_LOGIN], [1],
1157                                 [Define if you don't want to use your
1158                                 system's login() call])
1159                         AC_DEFINE([DISABLE_FD_PASSING])
1160                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
1161                         SIA_MSG="yes"
1162                 else
1163                         AC_MSG_RESULT([no])
1164                         AC_DEFINE([LOCKED_PASSWD_SUBSTR], ["Nologin"],
1165                           [String used in /etc/passwd to denote locked account])
1166                 fi
1167         fi
1168         AC_DEFINE([BROKEN_GETADDRINFO])
1169         AC_DEFINE([SETEUID_BREAKS_SETUID])
1170         AC_DEFINE([BROKEN_SETREUID])
1171         AC_DEFINE([BROKEN_SETREGID])
1172         AC_DEFINE([BROKEN_READV_COMPARISON], [1], [Can't do comparisons on readv])
1173         ;;
1174
1175 *-*-nto-qnx*)
1176         AC_DEFINE([USE_PIPES])
1177         AC_DEFINE([NO_X11_UNIX_SOCKETS])
1178         AC_DEFINE([DISABLE_LASTLOG])
1179         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1180         AC_DEFINE([BROKEN_SHADOW_EXPIRE], [1], [QNX shadow support is broken])
1181         enable_etc_default_login=no     # has incompatible /etc/default/login
1182         case "$host" in
1183         *-*-nto-qnx6*)
1184                 AC_DEFINE([DISABLE_FD_PASSING])
1185                 ;;
1186         esac
1187         ;;
1188
1189 *-*-ultrix*)
1190         AC_DEFINE([BROKEN_GETGROUPS], [1], [getgroups(0,NULL) will return -1])
1191         AC_DEFINE([NEED_SETPGRP])
1192         AC_DEFINE([HAVE_SYS_SYSLOG_H], [1], [Force use of sys/syslog.h on Ultrix])
1193         ;;
1194
1195 *-*-lynxos)
1196         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
1197         AC_DEFINE([BROKEN_SETVBUF], [1],
1198             [LynxOS has broken setvbuf() implementation])
1199         ;;
1200 esac
1201
1202 AC_MSG_CHECKING([compiler and flags for sanity])
1203 AC_RUN_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]], [[ exit(0); ]])],
1204         [       AC_MSG_RESULT([yes]) ],
1205         [
1206                 AC_MSG_RESULT([no])
1207                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
1208         ],
1209         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
1210 )
1211
1212 dnl Checks for header files.
1213 # Checks for libraries.
1214 AC_CHECK_FUNC([setsockopt], , [AC_CHECK_LIB([socket], [setsockopt])])
1215
1216 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
1217 AC_CHECK_FUNCS([dirname], [AC_CHECK_HEADERS([libgen.h])] , [
1218         AC_CHECK_LIB([gen], [dirname], [
1219                 AC_CACHE_CHECK([for broken dirname],
1220                         ac_cv_have_broken_dirname, [
1221                         save_LIBS="$LIBS"
1222                         LIBS="$LIBS -lgen"
1223                         AC_RUN_IFELSE(
1224                                 [AC_LANG_SOURCE([[
1225 #include <libgen.h>
1226 #include <string.h>
1227
1228 int main(int argc, char **argv) {
1229     char *s, buf[32];
1230
1231     strncpy(buf,"/etc", 32);
1232     s = dirname(buf);
1233     if (!s || strncmp(s, "/", 32) != 0) {
1234         exit(1);
1235     } else {
1236         exit(0);
1237     }
1238 }
1239                                 ]])],
1240                                 [ ac_cv_have_broken_dirname="no" ],
1241                                 [ ac_cv_have_broken_dirname="yes" ],
1242                                 [ ac_cv_have_broken_dirname="no" ],
1243                         )
1244                         LIBS="$save_LIBS"
1245                 ])
1246                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
1247                         LIBS="$LIBS -lgen"
1248                         AC_DEFINE([HAVE_DIRNAME])
1249                         AC_CHECK_HEADERS([libgen.h])
1250                 fi
1251         ])
1252 ])
1253
1254 AC_CHECK_FUNC([getspnam], ,
1255         [AC_CHECK_LIB([gen], [getspnam], [LIBS="$LIBS -lgen"])])
1256 AC_SEARCH_LIBS([basename], [gen], [AC_DEFINE([HAVE_BASENAME], [1],
1257         [Define if you have the basename function.])])
1258
1259 dnl zlib is required
1260 AC_ARG_WITH([zlib],
1261         [  --with-zlib=PATH        Use zlib in PATH],
1262         [ if test "x$withval" = "xno" ; then
1263                 AC_MSG_ERROR([*** zlib is required ***])
1264           elif test "x$withval" != "xyes"; then
1265                 if test -d "$withval/lib"; then
1266                         if test -n "${need_dash_r}"; then
1267                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1268                         else
1269                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1270                         fi
1271                 else
1272                         if test -n "${need_dash_r}"; then
1273                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1274                         else
1275                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1276                         fi
1277                 fi
1278                 if test -d "$withval/include"; then
1279                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1280                 else
1281                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1282                 fi
1283         fi ]
1284 )
1285
1286 AC_CHECK_HEADER([zlib.h], ,[AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***])])
1287 AC_CHECK_LIB([z], [deflate], ,
1288         [
1289                 saved_CPPFLAGS="$CPPFLAGS"
1290                 saved_LDFLAGS="$LDFLAGS"
1291                 save_LIBS="$LIBS"
1292                 dnl Check default zlib install dir
1293                 if test -n "${need_dash_r}"; then
1294                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
1295                 else
1296                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
1297                 fi
1298                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
1299                 LIBS="$LIBS -lz"
1300                 AC_TRY_LINK_FUNC([deflate], [AC_DEFINE([HAVE_LIBZ])],
1301                         [
1302                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1303                         ]
1304                 )
1305         ]
1306 )
1307
1308 AC_ARG_WITH([zlib-version-check],
1309         [  --without-zlib-version-check Disable zlib version check],
1310         [  if test "x$withval" = "xno" ; then
1311                 zlib_check_nonfatal=1
1312            fi
1313         ]
1314 )
1315
1316 AC_MSG_CHECKING([for possibly buggy zlib])
1317 AC_RUN_IFELSE([AC_LANG_PROGRAM([[
1318 #include <stdio.h>
1319 #include <stdlib.h>
1320 #include <zlib.h>
1321         ]],
1322         [[
1323         int a=0, b=0, c=0, d=0, n, v;
1324         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1325         if (n != 3 && n != 4)
1326                 exit(1);
1327         v = a*1000000 + b*10000 + c*100 + d;
1328         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1329
1330         /* 1.1.4 is OK */
1331         if (a == 1 && b == 1 && c >= 4)
1332                 exit(0);
1333
1334         /* 1.2.3 and up are OK */
1335         if (v >= 1020300)
1336                 exit(0);
1337
1338         exit(2);
1339         ]])],
1340         AC_MSG_RESULT([no]),
1341         [ AC_MSG_RESULT([yes])
1342           if test -z "$zlib_check_nonfatal" ; then
1343                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1344 Your reported zlib version has known security problems.  It's possible your
1345 vendor has fixed these problems without changing the version number.  If you
1346 are sure this is the case, you can disable the check by running
1347 "./configure --without-zlib-version-check".
1348 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1349 See http://www.gzip.org/zlib/ for details.])
1350           else
1351                 AC_MSG_WARN([zlib version may have security problems])
1352           fi
1353         ],
1354         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1355 )
1356
1357 dnl UnixWare 2.x
1358 AC_CHECK_FUNC([strcasecmp],
1359         [], [ AC_CHECK_LIB([resolv], [strcasecmp], [LIBS="$LIBS -lresolv"]) ]
1360 )
1361 AC_CHECK_FUNCS([utimes],
1362         [], [ AC_CHECK_LIB([c89], [utimes], [AC_DEFINE([HAVE_UTIMES])
1363                                         LIBS="$LIBS -lc89"]) ]
1364 )
1365
1366 dnl    Checks for libutil functions
1367 AC_CHECK_HEADERS([bsd/libutil.h libutil.h])
1368 AC_SEARCH_LIBS([fmt_scaled], [util bsd])
1369 AC_SEARCH_LIBS([scan_scaled], [util bsd])
1370 AC_SEARCH_LIBS([login], [util bsd])
1371 AC_SEARCH_LIBS([logout], [util bsd])
1372 AC_SEARCH_LIBS([logwtmp], [util bsd])
1373 AC_SEARCH_LIBS([openpty], [util bsd])
1374 AC_SEARCH_LIBS([updwtmp], [util bsd])
1375 AC_CHECK_FUNCS([fmt_scaled scan_scaled login logout openpty updwtmp logwtmp])
1376
1377 # On some platforms, inet_ntop and gethostbyname may be found in libresolv
1378 # or libnsl.
1379 AC_SEARCH_LIBS([inet_ntop], [resolv nsl])
1380 AC_SEARCH_LIBS([gethostbyname], [resolv nsl])
1381
1382 # "Particular Function Checks"
1383 # see https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Particular-Functions.html
1384 AC_FUNC_STRFTIME
1385 AC_FUNC_MALLOC
1386 AC_FUNC_REALLOC
1387 # autoconf doesn't have AC_FUNC_CALLOC so fake it if malloc returns NULL;
1388 AC_MSG_CHECKING([if calloc(0, N) returns non-null])
1389 AC_RUN_IFELSE(
1390         [AC_LANG_PROGRAM(
1391                 [[ #include <stdlib.h> ]],
1392                 [[ void *p = calloc(0, 1); exit(p == NULL); ]]
1393         )],
1394         [ func_calloc_0_nonnull=yes ],
1395         [ func_calloc_0_nonnull=no ],
1396         [ AC_MSG_WARN([cross compiling: assuming same as malloc])
1397           func_calloc_0_nonnull="$ac_cv_func_malloc_0_nonnull"]
1398 )
1399 AC_MSG_RESULT([$func_calloc_0_nonnull])
1400
1401 if test "x$func_calloc_0_nonnull" == "xyes"; then
1402         AC_DEFINE(HAVE_CALLOC, 1, [calloc(0, x) returns non-null])
1403 else
1404         AC_DEFINE(HAVE_CALLOC, 0, [calloc(0, x) returns NULL])
1405         AC_DEFINE(calloc, rpl_calloc,
1406             [Define to rpl_calloc if the replacement function should be used.])
1407 fi
1408
1409 # Check for ALTDIRFUNC glob() extension
1410 AC_MSG_CHECKING([for GLOB_ALTDIRFUNC support])
1411 AC_EGREP_CPP([FOUNDIT],
1412         [
1413                 #include <glob.h>
1414                 #ifdef GLOB_ALTDIRFUNC
1415                 FOUNDIT
1416                 #endif
1417         ],
1418         [
1419                 AC_DEFINE([GLOB_HAS_ALTDIRFUNC], [1],
1420                         [Define if your system glob() function has
1421                         the GLOB_ALTDIRFUNC extension])
1422                 AC_MSG_RESULT([yes])
1423         ],
1424         [
1425                 AC_MSG_RESULT([no])
1426         ]
1427 )
1428
1429 # Check for g.gl_matchc glob() extension
1430 AC_MSG_CHECKING([for gl_matchc field in glob_t])
1431 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]],
1432         [[ glob_t g; g.gl_matchc = 1; ]])],
1433         [
1434                 AC_DEFINE([GLOB_HAS_GL_MATCHC], [1],
1435                         [Define if your system glob() function has
1436                         gl_matchc options in glob_t])
1437                 AC_MSG_RESULT([yes])
1438         ], [
1439                 AC_MSG_RESULT([no])
1440 ])
1441
1442 # Check for g.gl_statv glob() extension
1443 AC_MSG_CHECKING([for gl_statv and GLOB_KEEPSTAT extensions for glob])
1444 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]], [[
1445 #ifndef GLOB_KEEPSTAT
1446 #error "glob does not support GLOB_KEEPSTAT extension"
1447 #endif
1448 glob_t g;
1449 g.gl_statv = NULL;
1450 ]])],
1451         [
1452                 AC_DEFINE([GLOB_HAS_GL_STATV], [1],
1453                         [Define if your system glob() function has
1454                         gl_statv options in glob_t])
1455                 AC_MSG_RESULT([yes])
1456         ], [
1457                 AC_MSG_RESULT([no])
1458
1459 ])
1460
1461 AC_CHECK_DECLS([GLOB_NOMATCH], , , [#include <glob.h>])
1462
1463 AC_CHECK_DECL([VIS_ALL], ,
1464     AC_DEFINE(BROKEN_STRNVIS, 1, [missing VIS_ALL]), [#include <vis.h>])
1465
1466 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1467 AC_RUN_IFELSE(
1468         [AC_LANG_PROGRAM([[
1469 #include <sys/types.h>
1470 #include <dirent.h>]],
1471         [[
1472         struct dirent d;
1473         exit(sizeof(d.d_name)<=sizeof(char));
1474         ]])],
1475         [AC_MSG_RESULT([yes])],
1476         [
1477                 AC_MSG_RESULT([no])
1478                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME], [1],
1479                         [Define if your struct dirent expects you to
1480                         allocate extra space for d_name])
1481         ],
1482         [
1483                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1484                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME])
1485         ]
1486 )
1487
1488 AC_MSG_CHECKING([for /proc/pid/fd directory])
1489 if test -d "/proc/$$/fd" ; then
1490         AC_DEFINE([HAVE_PROC_PID], [1], [Define if you have /proc/$pid/fd])
1491         AC_MSG_RESULT([yes])
1492 else
1493         AC_MSG_RESULT([no])
1494 fi
1495
1496 # Check whether user wants S/Key support
1497 SKEY_MSG="no"
1498 AC_ARG_WITH([skey],
1499         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1500         [
1501                 if test "x$withval" != "xno" ; then
1502
1503                         if test "x$withval" != "xyes" ; then
1504                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1505                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1506                         fi
1507
1508                         AC_DEFINE([SKEY], [1], [Define if you want S/Key support])
1509                         LIBS="-lskey $LIBS"
1510                         SKEY_MSG="yes"
1511
1512                         AC_MSG_CHECKING([for s/key support])
1513                         AC_LINK_IFELSE(
1514                                 [AC_LANG_PROGRAM([[
1515 #include <stdio.h>
1516 #include <skey.h>
1517                                 ]], [[
1518         char *ff = skey_keyinfo(""); ff="";
1519         exit(0);
1520                                 ]])],
1521                                 [AC_MSG_RESULT([yes])],
1522                                 [
1523                                         AC_MSG_RESULT([no])
1524                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1525                                 ])
1526                         AC_MSG_CHECKING([if skeychallenge takes 4 arguments])
1527                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
1528 #include <stdio.h>
1529 #include <skey.h>
1530                                 ]], [[
1531         (void)skeychallenge(NULL,"name","",0);
1532                                 ]])],
1533                         [
1534                                 AC_MSG_RESULT([yes])
1535                                 AC_DEFINE([SKEYCHALLENGE_4ARG], [1],
1536                                         [Define if your skeychallenge()
1537                                         function takes 4 arguments (NetBSD)])],
1538                         [
1539                                 AC_MSG_RESULT([no])
1540                         ])
1541                 fi
1542         ]
1543 )
1544
1545 # Check whether user wants to use ldns
1546 LDNS_MSG="no"
1547 AC_ARG_WITH(ldns,
1548         [  --with-ldns[[=PATH]]      Use ldns for DNSSEC support (optionally in PATH)],
1549         [
1550         ldns=""
1551         if test "x$withval" = "xyes" ; then
1552                 AC_PATH_TOOL([LDNSCONFIG], [ldns-config], [no])
1553                 if test "x$LDNSCONFIG" = "xno"; then
1554                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1555                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1556                         LIBS="-lldns $LIBS"
1557                         ldns=yes
1558                 else
1559                         LIBS="$LIBS `$LDNSCONFIG --libs`"
1560                         CPPFLAGS="$CPPFLAGS `$LDNSCONFIG --cflags`"
1561                         ldns=yes
1562                 fi
1563         elif test "x$withval" != "xno" ; then
1564                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1565                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1566                         LIBS="-lldns $LIBS"
1567                         ldns=yes
1568         fi
1569
1570         # Verify that it works.
1571         if test "x$ldns" = "xyes" ; then
1572                 AC_DEFINE(HAVE_LDNS, 1, [Define if you want ldns support])
1573                 LDNS_MSG="yes"
1574                 AC_MSG_CHECKING([for ldns support])
1575                 AC_LINK_IFELSE(
1576                         [AC_LANG_SOURCE([[
1577 #include <stdio.h>
1578 #include <stdlib.h>
1579 #include <stdint.h>
1580 #include <ldns/ldns.h>
1581 int main() { ldns_status status = ldns_verify_trusted(NULL, NULL, NULL, NULL); status=LDNS_STATUS_OK; exit(0); }
1582                         ]])
1583                 ],
1584                         [AC_MSG_RESULT(yes)],
1585                                 [
1586                                         AC_MSG_RESULT(no)
1587                                         AC_MSG_ERROR([** Incomplete or missing ldns libraries.])
1588                                 ])
1589         fi
1590 ])
1591
1592 # Check whether user wants libedit support
1593 LIBEDIT_MSG="no"
1594 AC_ARG_WITH([libedit],
1595         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1596         [ if test "x$withval" != "xno" ; then
1597                 if test "x$withval" = "xyes" ; then
1598                         AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
1599                         if test "x$PKGCONFIG" != "xno"; then
1600                                 AC_MSG_CHECKING([if $PKGCONFIG knows about libedit])
1601                                 if "$PKGCONFIG" libedit; then
1602                                         AC_MSG_RESULT([yes])
1603                                         use_pkgconfig_for_libedit=yes
1604                                 else
1605                                         AC_MSG_RESULT([no])
1606                                 fi
1607                         fi
1608                 else
1609                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1610                         if test -n "${need_dash_r}"; then
1611                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1612                         else
1613                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1614                         fi
1615                 fi
1616                 if test "x$use_pkgconfig_for_libedit" = "xyes"; then
1617                         LIBEDIT=`$PKGCONFIG --libs libedit`
1618                         CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
1619                 else
1620                         LIBEDIT="-ledit -lcurses"
1621                 fi
1622                 OTHERLIBS=`echo $LIBEDIT | sed 's/-ledit//'`
1623                 AC_CHECK_LIB([edit], [el_init],
1624                         [ AC_DEFINE([USE_LIBEDIT], [1], [Use libedit for sftp])
1625                           LIBEDIT_MSG="yes"
1626                           AC_SUBST([LIBEDIT])
1627                         ],
1628                         [ AC_MSG_ERROR([libedit not found]) ],
1629                         [ $OTHERLIBS ]
1630                 )
1631                 AC_MSG_CHECKING([if libedit version is compatible])
1632                 AC_COMPILE_IFELSE(
1633                     [AC_LANG_PROGRAM([[ #include <histedit.h> ]],
1634                     [[
1635         int i = H_SETSIZE;
1636         el_init("", NULL, NULL, NULL);
1637         exit(0);
1638                     ]])],
1639                     [ AC_MSG_RESULT([yes]) ],
1640                     [ AC_MSG_RESULT([no])
1641                       AC_MSG_ERROR([libedit version is not compatible]) ]
1642                 )
1643         fi ]
1644 )
1645
1646 AUDIT_MODULE=none
1647 AC_ARG_WITH([audit],
1648         [  --with-audit=module     Enable audit support (modules=debug,bsm,linux)],
1649         [
1650           AC_MSG_CHECKING([for supported audit module])
1651           case "$withval" in
1652           bsm)
1653                 AC_MSG_RESULT([bsm])
1654                 AUDIT_MODULE=bsm
1655                 dnl    Checks for headers, libs and functions
1656                 AC_CHECK_HEADERS([bsm/audit.h], [],
1657                     [AC_MSG_ERROR([BSM enabled and bsm/audit.h not found])],
1658                     [
1659 #ifdef HAVE_TIME_H
1660 # include <time.h>
1661 #endif
1662                     ]
1663 )
1664                 AC_CHECK_LIB([bsm], [getaudit], [],
1665                     [AC_MSG_ERROR([BSM enabled and required library not found])])
1666                 AC_CHECK_FUNCS([getaudit], [],
1667                     [AC_MSG_ERROR([BSM enabled and required function not found])])
1668                 # These are optional
1669                 AC_CHECK_FUNCS([getaudit_addr aug_get_machine])
1670                 AC_DEFINE([USE_BSM_AUDIT], [1], [Use BSM audit module])
1671                 if test "$sol2ver" -ge 11; then
1672                         SSHDLIBS="$SSHDLIBS -lscf"
1673                         AC_DEFINE([BROKEN_BSM_API], [1],
1674                                 [The system has incomplete BSM API])
1675                 fi
1676                 ;;
1677           linux)
1678                 AC_MSG_RESULT([linux])
1679                 AUDIT_MODULE=linux
1680                 dnl    Checks for headers, libs and functions
1681                 AC_CHECK_HEADERS([libaudit.h])
1682                 SSHDLIBS="$SSHDLIBS -laudit"
1683                 AC_DEFINE([USE_LINUX_AUDIT], [1], [Use Linux audit module])
1684                 ;;
1685           debug)
1686                 AUDIT_MODULE=debug
1687                 AC_MSG_RESULT([debug])
1688                 AC_DEFINE([SSH_AUDIT_EVENTS], [1], [Use audit debugging module])
1689                 ;;
1690           no)
1691                 AC_MSG_RESULT([no])
1692                 ;;
1693           *)
1694                 AC_MSG_ERROR([Unknown audit module $withval])
1695                 ;;
1696         esac ]
1697 )
1698
1699 AC_ARG_WITH([pie],
1700     [  --with-pie              Build Position Independent Executables if possible], [
1701         if test "x$withval" = "xno"; then
1702                 use_pie=no
1703         fi
1704         if test "x$withval" = "xyes"; then
1705                 use_pie=yes
1706         fi
1707     ]
1708 )
1709 if test "x$use_pie" = "x"; then
1710         use_pie=no
1711 fi
1712 if test "x$use_toolchain_hardening" != "x1" && test "x$use_pie" = "xauto"; then
1713         # Turn off automatic PIE when toolchain hardening is off.
1714         use_pie=no
1715 fi
1716 if test "x$use_pie" = "xauto"; then
1717         # Automatic PIE requires gcc >= 4.x
1718         AC_MSG_CHECKING([for gcc >= 4.x])
1719         AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
1720 #if !defined(__GNUC__) || __GNUC__ < 4
1721 #error gcc is too old
1722 #endif
1723 ]])],
1724         [ AC_MSG_RESULT([yes]) ],
1725         [ AC_MSG_RESULT([no])
1726           use_pie=no ]
1727 )
1728 fi
1729 if test "x$use_pie" != "xno"; then
1730         SAVED_CFLAGS="$CFLAGS"
1731         SAVED_LDFLAGS="$LDFLAGS"
1732         OSSH_CHECK_CFLAG_COMPILE([-fPIE])
1733         OSSH_CHECK_LDFLAG_LINK([-pie])
1734         # We use both -fPIE and -pie or neither.
1735         AC_MSG_CHECKING([whether both -fPIE and -pie are supported])
1736         if echo "x $CFLAGS"  | grep ' -fPIE' >/dev/null 2>&1 && \
1737            echo "x $LDFLAGS" | grep ' -pie'  >/dev/null 2>&1 ; then
1738                 AC_MSG_RESULT([yes])
1739         else
1740                 AC_MSG_RESULT([no])
1741                 CFLAGS="$SAVED_CFLAGS"
1742                 LDFLAGS="$SAVED_LDFLAGS"
1743         fi
1744 fi
1745
1746 dnl    Checks for library functions. Please keep in alphabetical order
1747 AC_CHECK_FUNCS([ \
1748         Blowfish_initstate \
1749         Blowfish_expandstate \
1750         Blowfish_expand0state \
1751         Blowfish_stream2word \
1752         asprintf \
1753         b64_ntop \
1754         __b64_ntop \
1755         b64_pton \
1756         __b64_pton \
1757         bcopy \
1758         bcrypt_pbkdf \
1759         bindresvport_sa \
1760         blf_enc \
1761         bzero \
1762         cap_rights_limit \
1763         clock \
1764         closefrom \
1765         dirfd \
1766         endgrent \
1767         err \
1768         errx \
1769         explicit_bzero \
1770         fchmod \
1771         fchown \
1772         flock \
1773         freeaddrinfo \
1774         freezero \
1775         fstatfs \
1776         fstatvfs \
1777         futimes \
1778         getaddrinfo \
1779         getcwd \
1780         getgrouplist \
1781         getnameinfo \
1782         getopt \
1783         getpagesize \
1784         getpeereid \
1785         getpeerucred \
1786         getpgid \
1787         _getpty \
1788         getrlimit \
1789         getsid \
1790         getttyent \
1791         glob \
1792         group_from_gid \
1793         inet_aton \
1794         inet_ntoa \
1795         inet_ntop \
1796         innetgr \
1797         llabs \
1798         login_getcapbool \
1799         md5_crypt \
1800         memmove \
1801         memset_s \
1802         mkdtemp \
1803         ngetaddrinfo \
1804         nsleep \
1805         ogetaddrinfo \
1806         openlog_r \
1807         pledge \
1808         poll \
1809         prctl \
1810         pstat \
1811         raise \
1812         readpassphrase \
1813         reallocarray \
1814         recvmsg \
1815         recallocarray \
1816         rresvport_af \
1817         sendmsg \
1818         setdtablesize \
1819         setegid \
1820         setenv \
1821         seteuid \
1822         setgroupent \
1823         setgroups \
1824         setlinebuf \
1825         setlogin \
1826         setpassent\
1827         setpcred \
1828         setproctitle \
1829         setregid \
1830         setreuid \
1831         setrlimit \
1832         setsid \
1833         setvbuf \
1834         sigaction \
1835         sigvec \
1836         snprintf \
1837         socketpair \
1838         statfs \
1839         statvfs \
1840         strcasestr \
1841         strdup \
1842         strerror \
1843         strlcat \
1844         strlcpy \
1845         strmode \
1846         strndup \
1847         strnlen \
1848         strnvis \
1849         strptime \
1850         strsignal \
1851         strtonum \
1852         strtoll \
1853         strtoul \
1854         strtoull \
1855         swap32 \
1856         sysconf \
1857         tcgetpgrp \
1858         timingsafe_bcmp \
1859         truncate \
1860         unsetenv \
1861         updwtmpx \
1862         user_from_uid \
1863         usleep \
1864         vasprintf \
1865         vsnprintf \
1866         waitpid \
1867         warn \
1868 ])
1869
1870 AC_CHECK_DECLS([bzero])
1871
1872 dnl Wide character support.
1873 AC_CHECK_FUNCS([mblen mbtowc nl_langinfo wcwidth])
1874
1875 TEST_SSH_UTF8=${TEST_SSH_UTF8:=yes}
1876 AC_MSG_CHECKING([for utf8 locale support])
1877 AC_RUN_IFELSE(
1878         [AC_LANG_PROGRAM([[
1879 #include <locale.h>
1880 #include <stdlib.h>
1881         ]], [[
1882         char *loc = setlocale(LC_CTYPE, "en_US.UTF-8");
1883         if (loc != NULL)
1884                 exit(0);
1885         exit(1);
1886         ]])],
1887         AC_MSG_RESULT(yes),
1888         [AC_MSG_RESULT(no)
1889          TEST_SSH_UTF8=no],
1890         AC_MSG_WARN([cross compiling: assuming yes])
1891 )
1892
1893 AC_LINK_IFELSE(
1894         [AC_LANG_PROGRAM(
1895            [[ #include <ctype.h> ]],
1896            [[ return (isblank('a')); ]])],
1897         [AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])
1898 ])
1899
1900 disable_pkcs11=
1901 AC_ARG_ENABLE([pkcs11],
1902         [  --disable-pkcs11        disable PKCS#11 support code [no]],
1903         [
1904                 if test "x$enableval" = "xno" ; then
1905                         disable_pkcs11=1
1906                 fi
1907         ]
1908 )
1909
1910 # PKCS11 depends on OpenSSL.
1911 if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then
1912         # PKCS#11 support requires dlopen() and co
1913         AC_SEARCH_LIBS([dlopen], [dl],
1914             AC_CHECK_DECL([RTLD_NOW],
1915                 AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support]),
1916                 [], [#include <dlfcn.h>]
1917             )
1918         )
1919 fi
1920
1921 # IRIX has a const char return value for gai_strerror()
1922 AC_CHECK_FUNCS([gai_strerror], [
1923         AC_DEFINE([HAVE_GAI_STRERROR])
1924         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
1925 #include <sys/types.h>
1926 #include <sys/socket.h>
1927 #include <netdb.h>
1928
1929 const char *gai_strerror(int);
1930                         ]], [[
1931         char *str;
1932         str = gai_strerror(0);
1933                         ]])], [
1934                 AC_DEFINE([HAVE_CONST_GAI_STRERROR_PROTO], [1],
1935                 [Define if gai_strerror() returns const char *])], [])])
1936
1937 AC_SEARCH_LIBS([nanosleep], [rt posix4], [AC_DEFINE([HAVE_NANOSLEEP], [1],
1938         [Some systems put nanosleep outside of libc])])
1939
1940 AC_SEARCH_LIBS([clock_gettime], [rt],
1941         [AC_DEFINE([HAVE_CLOCK_GETTIME], [1], [Have clock_gettime])])
1942
1943 dnl Make sure prototypes are defined for these before using them.
1944 AC_CHECK_DECL([strsep],
1945         [AC_CHECK_FUNCS([strsep])],
1946         [],
1947         [
1948 #ifdef HAVE_STRING_H
1949 # include <string.h>
1950 #endif
1951         ])
1952
1953 dnl tcsendbreak might be a macro
1954 AC_CHECK_DECL([tcsendbreak],
1955         [AC_DEFINE([HAVE_TCSENDBREAK])],
1956         [AC_CHECK_FUNCS([tcsendbreak])],
1957         [#include <termios.h>]
1958 )
1959
1960 AC_CHECK_DECLS([h_errno], , ,[#include <netdb.h>])
1961
1962 AC_CHECK_DECLS([SHUT_RD], , ,
1963         [
1964 #include <sys/types.h>
1965 #include <sys/socket.h>
1966         ])
1967
1968 AC_CHECK_DECLS([O_NONBLOCK], , ,
1969         [
1970 #include <sys/types.h>
1971 #ifdef HAVE_SYS_STAT_H
1972 # include <sys/stat.h>
1973 #endif
1974 #ifdef HAVE_FCNTL_H
1975 # include <fcntl.h>
1976 #endif
1977         ])
1978
1979 AC_CHECK_DECLS([readv, writev], , , [
1980 #include <sys/types.h>
1981 #include <sys/uio.h>
1982 #include <unistd.h>
1983         ])
1984
1985 AC_CHECK_DECLS([MAXSYMLINKS], , , [
1986 #include <sys/param.h>
1987         ])
1988
1989 AC_CHECK_DECLS([offsetof], , , [
1990 #include <stddef.h>
1991         ])
1992
1993 # extra bits for select(2)
1994 AC_CHECK_DECLS([howmany, NFDBITS], [], [], [[
1995 #include <sys/param.h>
1996 #include <sys/types.h>
1997 #ifdef HAVE_SYS_SYSMACROS_H
1998 #include <sys/sysmacros.h>
1999 #endif
2000 #ifdef HAVE_SYS_SELECT_H
2001 #include <sys/select.h>
2002 #endif
2003 #ifdef HAVE_SYS_TIME_H
2004 #include <sys/time.h>
2005 #endif
2006 #ifdef HAVE_UNISTD_H
2007 #include <unistd.h>
2008 #endif
2009         ]])
2010 AC_CHECK_TYPES([fd_mask], [], [], [[
2011 #include <sys/param.h>
2012 #include <sys/types.h>
2013 #ifdef HAVE_SYS_SELECT_H
2014 #include <sys/select.h>
2015 #endif
2016 #ifdef HAVE_SYS_TIME_H
2017 #include <sys/time.h>
2018 #endif
2019 #ifdef HAVE_UNISTD_H
2020 #include <unistd.h>
2021 #endif
2022         ]])
2023
2024 AC_CHECK_FUNCS([setresuid], [
2025         dnl Some platorms have setresuid that isn't implemented, test for this
2026         AC_MSG_CHECKING([if setresuid seems to work])
2027         AC_RUN_IFELSE(
2028                 [AC_LANG_PROGRAM([[
2029 #include <stdlib.h>
2030 #include <errno.h>
2031                 ]], [[
2032         errno=0;
2033         setresuid(0,0,0);
2034         if (errno==ENOSYS)
2035                 exit(1);
2036         else
2037                 exit(0);
2038                 ]])],
2039                 [AC_MSG_RESULT([yes])],
2040                 [AC_DEFINE([BROKEN_SETRESUID], [1],
2041                         [Define if your setresuid() is broken])
2042                  AC_MSG_RESULT([not implemented])],
2043                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2044         )
2045 ])
2046
2047 AC_CHECK_FUNCS([setresgid], [
2048         dnl Some platorms have setresgid that isn't implemented, test for this
2049         AC_MSG_CHECKING([if setresgid seems to work])
2050         AC_RUN_IFELSE(
2051                 [AC_LANG_PROGRAM([[
2052 #include <stdlib.h>
2053 #include <errno.h>
2054                 ]], [[
2055         errno=0;
2056         setresgid(0,0,0);
2057         if (errno==ENOSYS)
2058                 exit(1);
2059         else
2060                 exit(0);
2061                 ]])],
2062                 [AC_MSG_RESULT([yes])],
2063                 [AC_DEFINE([BROKEN_SETRESGID], [1],
2064                         [Define if your setresgid() is broken])
2065                  AC_MSG_RESULT([not implemented])],
2066                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2067         )
2068 ])
2069
2070 AC_CHECK_FUNCS([realpath], [
2071         dnl the sftp v3 spec says SSH_FXP_REALPATH will "canonicalize any given
2072         dnl path name", however some implementations of realpath (and some
2073         dnl versions of the POSIX spec) do not work on non-existent files,
2074         dnl so we use the OpenBSD implementation on those platforms.
2075         AC_MSG_CHECKING([if realpath works with non-existent files])
2076         AC_RUN_IFELSE(
2077                 [AC_LANG_PROGRAM([[
2078 #include <limits.h>
2079 #include <stdlib.h>
2080 #include <errno.h>
2081                 ]], [[
2082                 char buf[PATH_MAX];
2083                 if (realpath("/opensshnonexistentfilename1234", buf) == NULL)
2084                         if (errno == ENOENT)
2085                                 exit(1);
2086                 exit(0);
2087                 ]])],
2088                 [AC_MSG_RESULT([yes])],
2089                 [AC_DEFINE([BROKEN_REALPATH], [1],
2090                         [realpath does not work with nonexistent files])
2091                  AC_MSG_RESULT([no])],
2092                 [AC_MSG_WARN([cross compiling: assuming working])]
2093         )
2094 ])
2095
2096 AC_MSG_CHECKING([for working fflush(NULL)])
2097 AC_RUN_IFELSE(
2098         [AC_LANG_PROGRAM([[#include <stdio.h>]], [[fflush(NULL); exit(0);]])],
2099         AC_MSG_RESULT([yes]),
2100         [AC_MSG_RESULT([no])
2101          AC_DEFINE([FFLUSH_NULL_BUG], [1],
2102             [define if fflush(NULL) does not work])],
2103         AC_MSG_WARN([cross compiling: assuming working])
2104 )
2105
2106 dnl    Checks for time functions
2107 AC_CHECK_FUNCS([gettimeofday time])
2108 dnl    Checks for utmp functions
2109 AC_CHECK_FUNCS([endutent getutent getutid getutline pututline setutent])
2110 AC_CHECK_FUNCS([utmpname])
2111 dnl    Checks for utmpx functions
2112 AC_CHECK_FUNCS([endutxent getutxent getutxid getutxline getutxuser pututxline])
2113 AC_CHECK_FUNCS([setutxdb setutxent utmpxname])
2114 dnl    Checks for lastlog functions
2115 AC_CHECK_FUNCS([getlastlogxbyname])
2116
2117 AC_CHECK_FUNC([daemon],
2118         [AC_DEFINE([HAVE_DAEMON], [1], [Define if your libraries define daemon()])],
2119         [AC_CHECK_LIB([bsd], [daemon],
2120                 [LIBS="$LIBS -lbsd"; AC_DEFINE([HAVE_DAEMON])])]
2121 )
2122
2123 AC_CHECK_FUNC([getpagesize],
2124         [AC_DEFINE([HAVE_GETPAGESIZE], [1],
2125                 [Define if your libraries define getpagesize()])],
2126         [AC_CHECK_LIB([ucb], [getpagesize],
2127                 [LIBS="$LIBS -lucb"; AC_DEFINE([HAVE_GETPAGESIZE])])]
2128 )
2129
2130 # Check for broken snprintf
2131 if test "x$ac_cv_func_snprintf" = "xyes" ; then
2132         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
2133         AC_RUN_IFELSE(
2134                 [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
2135                 [[
2136         char b[5];
2137         snprintf(b,5,"123456789");
2138         exit(b[4]!='\0');
2139                 ]])],
2140                 [AC_MSG_RESULT([yes])],
2141                 [
2142                         AC_MSG_RESULT([no])
2143                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2144                                 [Define if your snprintf is busted])
2145                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
2146                 ],
2147                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
2148         )
2149 fi
2150
2151 # We depend on vsnprintf returning the right thing on overflow: the
2152 # number of characters it tried to create (as per SUSv3)
2153 if test "x$ac_cv_func_vsnprintf" = "xyes" ; then
2154         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
2155         AC_RUN_IFELSE(
2156                 [AC_LANG_PROGRAM([[
2157 #include <sys/types.h>
2158 #include <stdio.h>
2159 #include <stdarg.h>
2160
2161 int x_snprintf(char *str, size_t count, const char *fmt, ...)
2162 {
2163         size_t ret;
2164         va_list ap;
2165
2166         va_start(ap, fmt);
2167         ret = vsnprintf(str, count, fmt, ap);
2168         va_end(ap);
2169         return ret;
2170 }
2171                 ]], [[
2172 char x[1];
2173 if (x_snprintf(x, 1, "%s %d", "hello", 12345) != 11)
2174         return 1;
2175 if (x_snprintf(NULL, 0, "%s %d", "hello", 12345) != 11)
2176         return 1;
2177 return 0;
2178                 ]])],
2179                 [AC_MSG_RESULT([yes])],
2180                 [
2181                         AC_MSG_RESULT([no])
2182                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2183                                 [Define if your snprintf is busted])
2184                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
2185                 ],
2186                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
2187         )
2188 fi
2189
2190 # On systems where [v]snprintf is broken, but is declared in stdio,
2191 # check that the fmt argument is const char * or just char *.
2192 # This is only useful for when BROKEN_SNPRINTF
2193 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
2194 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2195 #include <stdio.h>
2196 int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
2197                 ]], [[
2198         snprintf(0, 0, 0);
2199                 ]])],
2200    [AC_MSG_RESULT([yes])
2201     AC_DEFINE([SNPRINTF_CONST], [const],
2202               [Define as const if snprintf() can declare const char *fmt])],
2203    [AC_MSG_RESULT([no])
2204     AC_DEFINE([SNPRINTF_CONST], [/* not const */])])
2205
2206 # Check for missing getpeereid (or equiv) support
2207 NO_PEERCHECK=""
2208 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
2209         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
2210         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2211 #include <sys/types.h>
2212 #include <sys/socket.h>]], [[int i = SO_PEERCRED;]])],
2213                 [ AC_MSG_RESULT([yes])
2214                   AC_DEFINE([HAVE_SO_PEERCRED], [1], [Have PEERCRED socket option])
2215                 ], [AC_MSG_RESULT([no])
2216                 NO_PEERCHECK=1
2217         ])
2218 fi
2219
2220 dnl see whether mkstemp() requires XXXXXX
2221 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
2222 AC_MSG_CHECKING([for (overly) strict mkstemp])
2223 AC_RUN_IFELSE(
2224         [AC_LANG_PROGRAM([[
2225 #include <stdlib.h>
2226         ]], [[
2227         char template[]="conftest.mkstemp-test";
2228         if (mkstemp(template) == -1)
2229                 exit(1);
2230         unlink(template);
2231         exit(0);
2232         ]])],
2233         [
2234                 AC_MSG_RESULT([no])
2235         ],
2236         [
2237                 AC_MSG_RESULT([yes])
2238                 AC_DEFINE([HAVE_STRICT_MKSTEMP], [1], [Silly mkstemp()])
2239         ],
2240         [
2241                 AC_MSG_RESULT([yes])
2242                 AC_DEFINE([HAVE_STRICT_MKSTEMP])
2243         ]
2244 )
2245 fi
2246
2247 dnl make sure that openpty does not reacquire controlling terminal
2248 if test ! -z "$check_for_openpty_ctty_bug"; then
2249         AC_MSG_CHECKING([if openpty correctly handles controlling tty])
2250         AC_RUN_IFELSE(
2251                 [AC_LANG_PROGRAM([[
2252 #include <stdio.h>
2253 #include <sys/fcntl.h>
2254 #include <sys/types.h>
2255 #include <sys/wait.h>
2256                 ]], [[
2257         pid_t pid;
2258         int fd, ptyfd, ttyfd, status;
2259
2260         pid = fork();
2261         if (pid < 0) {          /* failed */
2262                 exit(1);
2263         } else if (pid > 0) {   /* parent */
2264                 waitpid(pid, &status, 0);
2265                 if (WIFEXITED(status))
2266                         exit(WEXITSTATUS(status));
2267                 else
2268                         exit(2);
2269         } else {                /* child */
2270                 close(0); close(1); close(2);
2271                 setsid();
2272                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
2273                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
2274                 if (fd >= 0)
2275                         exit(3);        /* Acquired ctty: broken */
2276                 else
2277                         exit(0);        /* Did not acquire ctty: OK */
2278         }
2279                 ]])],
2280                 [
2281                         AC_MSG_RESULT([yes])
2282                 ],
2283                 [
2284                         AC_MSG_RESULT([no])
2285                         AC_DEFINE([SSHD_ACQUIRES_CTTY])
2286                 ],
2287                 [
2288                         AC_MSG_RESULT([cross-compiling, assuming yes])
2289                 ]
2290         )
2291 fi
2292
2293 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2294     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
2295         AC_MSG_CHECKING([if getaddrinfo seems to work])
2296         AC_RUN_IFELSE(
2297                 [AC_LANG_PROGRAM([[
2298 #include <stdio.h>
2299 #include <sys/socket.h>
2300 #include <netdb.h>
2301 #include <errno.h>
2302 #include <netinet/in.h>
2303
2304 #define TEST_PORT "2222"
2305                 ]], [[
2306         int err, sock;
2307         struct addrinfo *gai_ai, *ai, hints;
2308         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2309
2310         memset(&hints, 0, sizeof(hints));
2311         hints.ai_family = PF_UNSPEC;
2312         hints.ai_socktype = SOCK_STREAM;
2313         hints.ai_flags = AI_PASSIVE;
2314
2315         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2316         if (err != 0) {
2317                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2318                 exit(1);
2319         }
2320
2321         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2322                 if (ai->ai_family != AF_INET6)
2323                         continue;
2324
2325                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2326                     sizeof(ntop), strport, sizeof(strport),
2327                     NI_NUMERICHOST|NI_NUMERICSERV);
2328
2329                 if (err != 0) {
2330                         if (err == EAI_SYSTEM)
2331                                 perror("getnameinfo EAI_SYSTEM");
2332                         else
2333                                 fprintf(stderr, "getnameinfo failed: %s\n",
2334                                     gai_strerror(err));
2335                         exit(2);
2336                 }
2337
2338                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
2339                 if (sock < 0)
2340                         perror("socket");
2341                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2342                         if (errno == EBADF)
2343                                 exit(3);
2344                 }
2345         }
2346         exit(0);
2347                 ]])],
2348                 [
2349                         AC_MSG_RESULT([yes])
2350                 ],
2351                 [
2352                         AC_MSG_RESULT([no])
2353                         AC_DEFINE([BROKEN_GETADDRINFO])
2354                 ],
2355                 [
2356                         AC_MSG_RESULT([cross-compiling, assuming yes])
2357                 ]
2358         )
2359 fi
2360
2361 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2362     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
2363         AC_MSG_CHECKING([if getaddrinfo seems to work])
2364         AC_RUN_IFELSE(
2365                 [AC_LANG_PROGRAM([[
2366 #include <stdio.h>
2367 #include <sys/socket.h>
2368 #include <netdb.h>
2369 #include <errno.h>
2370 #include <netinet/in.h>
2371
2372 #define TEST_PORT "2222"
2373                 ]], [[
2374         int err, sock;
2375         struct addrinfo *gai_ai, *ai, hints;
2376         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2377
2378         memset(&hints, 0, sizeof(hints));
2379         hints.ai_family = PF_UNSPEC;
2380         hints.ai_socktype = SOCK_STREAM;
2381         hints.ai_flags = AI_PASSIVE;
2382
2383         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2384         if (err != 0) {
2385                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2386                 exit(1);
2387         }
2388
2389         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2390                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2391                         continue;
2392
2393                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2394                     sizeof(ntop), strport, sizeof(strport),
2395                     NI_NUMERICHOST|NI_NUMERICSERV);
2396
2397                 if (ai->ai_family == AF_INET && err != 0) {
2398                         perror("getnameinfo");
2399                         exit(2);
2400                 }
2401         }
2402         exit(0);
2403                 ]])],
2404                 [
2405                         AC_MSG_RESULT([yes])
2406                         AC_DEFINE([AIX_GETNAMEINFO_HACK], [1],
2407                                 [Define if you have a getaddrinfo that fails
2408                                 for the all-zeros IPv6 address])
2409                 ],
2410                 [
2411                         AC_MSG_RESULT([no])
2412                         AC_DEFINE([BROKEN_GETADDRINFO])
2413                 ],
2414                 [
2415                         AC_MSG_RESULT([cross-compiling, assuming no])
2416                 ]
2417         )
2418 fi
2419
2420 if test "x$ac_cv_func_getaddrinfo" = "xyes"; then
2421         AC_CHECK_DECLS(AI_NUMERICSERV, , ,
2422             [#include <sys/types.h>
2423              #include <sys/socket.h>
2424              #include <netdb.h>])
2425 fi
2426
2427 if test "x$check_for_conflicting_getspnam" = "x1"; then
2428         AC_MSG_CHECKING([for conflicting getspnam in shadow.h])
2429         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <shadow.h> ]],
2430                 [[ exit(0); ]])],
2431                 [
2432                         AC_MSG_RESULT([no])
2433                 ],
2434                 [
2435                         AC_MSG_RESULT([yes])
2436                         AC_DEFINE([GETSPNAM_CONFLICTING_DEFS], [1],
2437                             [Conflicting defs for getspnam])
2438                 ]
2439         )
2440 fi
2441
2442 dnl NetBSD added an strnvis and unfortunately made it incompatible with the
2443 dnl existing one in OpenBSD and Linux's libbsd (the former having existed
2444 dnl for over ten years). Despite this incompatibility being reported during
2445 dnl development (see http://gnats.netbsd.org/44977) they still shipped it.
2446 dnl Even more unfortunately FreeBSD and later MacOS picked up this incompatible
2447 dnl implementation.  Try to detect this mess, and assume the only safe option
2448 dnl if we're cross compiling.
2449 dnl
2450 dnl OpenBSD, 2001: strnvis(char *dst, const char *src, size_t dlen, int flag);
2451 dnl NetBSD: 2012,  strnvis(char *dst, size_t dlen, const char *src, int flag);
2452 if test "x$ac_cv_func_strnvis" = "xyes"; then
2453         AC_MSG_CHECKING([for working strnvis])
2454         AC_RUN_IFELSE(
2455                 [AC_LANG_PROGRAM([[
2456 #include <signal.h>
2457 #include <stdlib.h>
2458 #include <string.h>
2459 #include <vis.h>
2460 static void sighandler(int sig) { _exit(1); }
2461                 ]], [[
2462         char dst[16];
2463
2464         signal(SIGSEGV, sighandler);
2465         if (strnvis(dst, "src", 4, 0) && strcmp(dst, "src") == 0)
2466                 exit(0);
2467         exit(1)
2468                 ]])],
2469                 [AC_MSG_RESULT([yes])],
2470                 [AC_MSG_RESULT([no])
2471                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis detected broken])],
2472                 [AC_MSG_WARN([cross compiling: assuming broken])
2473                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis assumed broken])]
2474         )
2475 fi
2476
2477 AC_CHECK_FUNCS([getpgrp],[
2478         AC_MSG_CHECKING([if getpgrp accepts zero args])
2479         AC_COMPILE_IFELSE(
2480                 [AC_LANG_PROGRAM([[$ac_includes_default]], [[ getpgrp(); ]])],
2481                 [ AC_MSG_RESULT([yes])
2482                   AC_DEFINE([GETPGRP_VOID], [1], [getpgrp takes zero args])],
2483                 [ AC_MSG_RESULT([no])
2484                   AC_DEFINE([GETPGRP_VOID], [0], [getpgrp takes one arg])]
2485         )
2486 ])
2487
2488 # Search for OpenSSL
2489 saved_CPPFLAGS="$CPPFLAGS"
2490 saved_LDFLAGS="$LDFLAGS"
2491 AC_ARG_WITH([ssl-dir],
2492         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
2493         [
2494                 if test "x$openssl" = "xno" ; then
2495                         AC_MSG_ERROR([cannot use --with-ssl-dir when OpenSSL disabled])
2496                 fi
2497                 if test "x$withval" != "xno" ; then
2498                         case "$withval" in
2499                                 # Relative paths
2500                                 ./*|../*)       withval="`pwd`/$withval"
2501                         esac
2502                         if test -d "$withval/lib"; then
2503                                 if test -n "${need_dash_r}"; then
2504                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
2505                                 else
2506                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
2507                                 fi
2508                         elif test -d "$withval/lib64"; then
2509                                 if test -n "${need_dash_r}"; then
2510                                         LDFLAGS="-L${withval}/lib64 -R${withval}/lib64 ${LDFLAGS}"
2511                                 else
2512                                         LDFLAGS="-L${withval}/lib64 ${LDFLAGS}"
2513                                 fi
2514                         else
2515                                 if test -n "${need_dash_r}"; then
2516                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
2517                                 else
2518                                         LDFLAGS="-L${withval} ${LDFLAGS}"
2519                                 fi
2520                         fi
2521                         if test -d "$withval/include"; then
2522                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
2523                         else
2524                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
2525                         fi
2526                 fi
2527         ]
2528 )
2529
2530 AC_ARG_WITH([openssl-header-check],
2531         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2532         [
2533                 if test "x$withval" = "xno" ; then
2534                         openssl_check_nonfatal=1
2535                 fi
2536         ]
2537 )
2538
2539 openssl_engine=no
2540 AC_ARG_WITH([ssl-engine],
2541         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2542         [
2543                 if test "x$withval" != "xno" ; then
2544                         if test "x$openssl" = "xno" ; then
2545                                 AC_MSG_ERROR([cannot use --with-ssl-engine when OpenSSL disabled])
2546                         fi
2547                         openssl_engine=yes
2548                 fi
2549         ]
2550 )
2551
2552 if test "x$openssl" = "xyes" ; then
2553         LIBS="-lcrypto $LIBS"
2554         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL], [1],
2555                 [Define if your ssl headers are included
2556                 with #include <openssl/header.h>])],
2557                 [
2558                         dnl Check default openssl install dir
2559                         if test -n "${need_dash_r}"; then
2560                                 LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
2561                         else
2562                                 LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
2563                         fi
2564                         CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
2565                         AC_CHECK_HEADER([openssl/opensslv.h], ,
2566                             [AC_MSG_ERROR([*** OpenSSL headers missing - please install first or check config.log ***])])
2567                         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL])],
2568                                 [
2569                                         AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2570                                 ]
2571                         )
2572                 ]
2573         )
2574
2575         # Determine OpenSSL header version
2576         AC_MSG_CHECKING([OpenSSL header version])
2577         AC_RUN_IFELSE(
2578                 [AC_LANG_PROGRAM([[
2579         #include <stdlib.h>
2580         #include <stdio.h>
2581         #include <string.h>
2582         #include <openssl/opensslv.h>
2583         #define DATA "conftest.sslincver"
2584                 ]], [[
2585                 FILE *fd;
2586                 int rc;
2587
2588                 fd = fopen(DATA,"w");
2589                 if(fd == NULL)
2590                         exit(1);
2591
2592                 if ((rc = fprintf(fd, "%08lx (%s)\n",
2593                     (unsigned long)OPENSSL_VERSION_NUMBER,
2594                      OPENSSL_VERSION_TEXT)) < 0)
2595                         exit(1);
2596
2597                 exit(0);
2598                 ]])],
2599                 [
2600                         ssl_header_ver=`cat conftest.sslincver`
2601                         AC_MSG_RESULT([$ssl_header_ver])
2602                 ],
2603                 [
2604                         AC_MSG_RESULT([not found])
2605                         AC_MSG_ERROR([OpenSSL version header not found.])
2606                 ],
2607                 [
2608                         AC_MSG_WARN([cross compiling: not checking])
2609                 ]
2610         )
2611
2612         # Determine OpenSSL library version
2613         AC_MSG_CHECKING([OpenSSL library version])
2614         AC_RUN_IFELSE(
2615                 [AC_LANG_PROGRAM([[
2616         #include <stdio.h>
2617         #include <string.h>
2618         #include <openssl/opensslv.h>
2619         #include <openssl/crypto.h>
2620         #define DATA "conftest.ssllibver"
2621                 ]], [[
2622                 FILE *fd;
2623                 int rc;
2624
2625                 fd = fopen(DATA,"w");
2626                 if(fd == NULL)
2627                         exit(1);
2628
2629                 if ((rc = fprintf(fd, "%08lx (%s)\n", (unsigned long)SSLeay(),
2630                     SSLeay_version(SSLEAY_VERSION))) < 0)
2631                         exit(1);
2632
2633                 exit(0);
2634                 ]])],
2635                 [
2636                         ssl_library_ver=`cat conftest.ssllibver`
2637                         # Check version is supported.
2638                         case "$ssl_library_ver" in
2639                                 10000*|0*)
2640                                         AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")])
2641                                         ;;
2642                                 100*)   ;; # 1.0.x
2643                                 200*)   ;; # LibreSSL
2644                                 *)
2645                                         AC_MSG_ERROR([OpenSSL >= 1.1.0 is not yet supported (have "$ssl_library_ver")])
2646                                         ;;
2647                         esac
2648                         AC_MSG_RESULT([$ssl_library_ver])
2649                 ],
2650                 [
2651                         AC_MSG_RESULT([not found])
2652                         AC_MSG_ERROR([OpenSSL library not found.])
2653                 ],
2654                 [
2655                         AC_MSG_WARN([cross compiling: not checking])
2656                 ]
2657         )
2658
2659         # Sanity check OpenSSL headers
2660         AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2661         AC_RUN_IFELSE(
2662                 [AC_LANG_PROGRAM([[
2663         #include <string.h>
2664         #include <openssl/opensslv.h>
2665         #include <openssl/crypto.h>
2666                 ]], [[
2667                 exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
2668                 ]])],
2669                 [
2670                         AC_MSG_RESULT([yes])
2671                 ],
2672                 [
2673                         AC_MSG_RESULT([no])
2674                         if test "x$openssl_check_nonfatal" = "x"; then
2675                                 AC_MSG_ERROR([Your OpenSSL headers do not match your
2676         library. Check config.log for details.
2677         If you are sure your installation is consistent, you can disable the check
2678         by running "./configure --without-openssl-header-check".
2679         Also see contrib/findssl.sh for help identifying header/library mismatches.
2680         ])
2681                         else
2682                                 AC_MSG_WARN([Your OpenSSL headers do not match your
2683         library. Check config.log for details.
2684         Also see contrib/findssl.sh for help identifying header/library mismatches.])
2685                         fi
2686                 ],
2687                 [
2688                         AC_MSG_WARN([cross compiling: not checking])
2689                 ]
2690         )
2691
2692         AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2693         AC_LINK_IFELSE(
2694                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2695                 [[ SSLeay_add_all_algorithms(); ]])],
2696                 [
2697                         AC_MSG_RESULT([yes])
2698                 ],
2699                 [
2700                         AC_MSG_RESULT([no])
2701                         saved_LIBS="$LIBS"
2702                         LIBS="$LIBS -ldl"
2703                         AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2704                         AC_LINK_IFELSE(
2705                                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2706                                 [[ SSLeay_add_all_algorithms(); ]])],
2707                                 [
2708                                         AC_MSG_RESULT([yes])
2709                                 ],
2710                                 [
2711                                         AC_MSG_RESULT([no])
2712                                         LIBS="$saved_LIBS"
2713                                 ]
2714                         )
2715                 ]
2716         )
2717
2718         AC_CHECK_FUNCS([ \
2719                 BN_is_prime_ex \
2720                 DSA_generate_parameters_ex \
2721                 EVP_DigestInit_ex \
2722                 EVP_DigestFinal_ex \
2723                 EVP_MD_CTX_init \
2724                 EVP_MD_CTX_cleanup \
2725                 EVP_MD_CTX_copy_ex \
2726                 HMAC_CTX_init \
2727                 RSA_generate_key_ex \
2728                 RSA_get_default_method \
2729         ])
2730
2731         if test "x$openssl_engine" = "xyes" ; then
2732                 AC_MSG_CHECKING([for OpenSSL ENGINE support])
2733                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2734         #include <openssl/engine.h>
2735                         ]], [[
2736                                 ENGINE_load_builtin_engines();
2737                                 ENGINE_register_all_complete();
2738                         ]])],
2739                         [ AC_MSG_RESULT([yes])
2740                           AC_DEFINE([USE_OPENSSL_ENGINE], [1],
2741                              [Enable OpenSSL engine support])
2742                         ], [ AC_MSG_ERROR([OpenSSL ENGINE support not found])
2743                 ])
2744         fi
2745
2746         # Check for OpenSSL without EVP_aes_{192,256}_cbc
2747         AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2748         AC_LINK_IFELSE(
2749                 [AC_LANG_PROGRAM([[
2750         #include <string.h>
2751         #include <openssl/evp.h>
2752                 ]], [[
2753                 exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
2754                 ]])],
2755                 [
2756                         AC_MSG_RESULT([no])
2757                 ],
2758                 [
2759                         AC_MSG_RESULT([yes])
2760                         AC_DEFINE([OPENSSL_LOBOTOMISED_AES], [1],
2761                             [libcrypto is missing AES 192 and 256 bit functions])
2762                 ]
2763         )
2764
2765         # Check for OpenSSL with EVP_aes_*ctr
2766         AC_MSG_CHECKING([whether OpenSSL has AES CTR via EVP])
2767         AC_LINK_IFELSE(
2768                 [AC_LANG_PROGRAM([[
2769         #include <string.h>
2770         #include <openssl/evp.h>
2771                 ]], [[
2772                 exit(EVP_aes_128_ctr() == NULL ||
2773                     EVP_aes_192_cbc() == NULL ||
2774                     EVP_aes_256_cbc() == NULL);
2775                 ]])],
2776                 [
2777                         AC_MSG_RESULT([yes])
2778                         AC_DEFINE([OPENSSL_HAVE_EVPCTR], [1],
2779                             [libcrypto has EVP AES CTR])
2780                 ],
2781                 [
2782                         AC_MSG_RESULT([no])
2783                 ]
2784         )
2785
2786         # Check for OpenSSL with EVP_aes_*gcm
2787         AC_MSG_CHECKING([whether OpenSSL has AES GCM via EVP])
2788         AC_LINK_IFELSE(
2789                 [AC_LANG_PROGRAM([[
2790         #include <string.h>
2791         #include <openssl/evp.h>
2792                 ]], [[
2793                 exit(EVP_aes_128_gcm() == NULL ||
2794                     EVP_aes_256_gcm() == NULL ||
2795                     EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
2796                     EVP_CTRL_GCM_IV_GEN == 0 ||
2797                     EVP_CTRL_GCM_SET_TAG == 0 ||
2798                     EVP_CTRL_GCM_GET_TAG == 0 ||
2799                     EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
2800                 ]])],
2801                 [
2802                         AC_MSG_RESULT([yes])
2803                         AC_DEFINE([OPENSSL_HAVE_EVPGCM], [1],
2804                             [libcrypto has EVP AES GCM])
2805                 ],
2806                 [
2807                         AC_MSG_RESULT([no])
2808                         unsupported_algorithms="$unsupported_cipers \
2809                            aes128-gcm@openssh.com \
2810                            aes256-gcm@openssh.com"
2811                 ]
2812         )
2813
2814         AC_SEARCH_LIBS([EVP_CIPHER_CTX_ctrl], [crypto],
2815                 [AC_DEFINE([HAVE_EVP_CIPHER_CTX_CTRL], [1],
2816                     [Define if libcrypto has EVP_CIPHER_CTX_ctrl])])
2817
2818         AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
2819         AC_LINK_IFELSE(
2820                 [AC_LANG_PROGRAM([[
2821         #include <string.h>
2822         #include <openssl/evp.h>
2823                 ]], [[
2824                 if(EVP_DigestUpdate(NULL, NULL,0))
2825                         exit(0);
2826                 ]])],
2827                 [
2828                         AC_MSG_RESULT([yes])
2829                 ],
2830                 [
2831                         AC_MSG_RESULT([no])
2832                         AC_DEFINE([OPENSSL_EVP_DIGESTUPDATE_VOID], [1],
2833                             [Define if EVP_DigestUpdate returns void])
2834                 ]
2835         )
2836
2837         # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2838         # because the system crypt() is more featureful.
2839         if test "x$check_for_libcrypt_before" = "x1"; then
2840                 AC_CHECK_LIB([crypt], [crypt])
2841         fi
2842
2843         # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2844         # version in OpenSSL.
2845         if test "x$check_for_libcrypt_later" = "x1"; then
2846                 AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
2847         fi
2848         AC_CHECK_FUNCS([crypt DES_crypt])
2849
2850         # Search for SHA256 support in libc and/or OpenSSL
2851         AC_CHECK_FUNCS([SHA256_Update EVP_sha256], ,
2852             [unsupported_algorithms="$unsupported_algorithms \
2853                 hmac-sha2-256 \
2854                 hmac-sha2-512 \
2855                 diffie-hellman-group-exchange-sha256 \
2856                 hmac-sha2-256-etm@openssh.com \
2857                 hmac-sha2-512-etm@openssh.com"
2858              ]
2859         )
2860         # Search for RIPE-MD support in OpenSSL
2861         AC_CHECK_FUNCS([EVP_ripemd160], ,
2862             [unsupported_algorithms="$unsupported_algorithms \
2863                 hmac-ripemd160 \
2864                 hmac-ripemd160@openssh.com \
2865                 hmac-ripemd160-etm@openssh.com"
2866              ]
2867         )
2868
2869         # Check complete ECC support in OpenSSL
2870         AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1])
2871         AC_LINK_IFELSE(
2872                 [AC_LANG_PROGRAM([[
2873         #include <openssl/ec.h>
2874         #include <openssl/ecdh.h>
2875         #include <openssl/ecdsa.h>
2876         #include <openssl/evp.h>
2877         #include <openssl/objects.h>
2878         #include <openssl/opensslv.h>
2879                 ]], [[
2880                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
2881                 const EVP_MD *m = EVP_sha256(); /* We need this too */
2882                 ]])],
2883                 [ AC_MSG_RESULT([yes])
2884                   enable_nistp256=1 ],
2885                 [ AC_MSG_RESULT([no]) ]
2886         )
2887
2888         AC_MSG_CHECKING([whether OpenSSL has NID_secp384r1])
2889         AC_LINK_IFELSE(
2890                 [AC_LANG_PROGRAM([[
2891         #include <openssl/ec.h>
2892         #include <openssl/ecdh.h>
2893         #include <openssl/ecdsa.h>
2894         #include <openssl/evp.h>
2895         #include <openssl/objects.h>
2896         #include <openssl/opensslv.h>
2897                 ]], [[
2898                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
2899                 const EVP_MD *m = EVP_sha384(); /* We need this too */
2900                 ]])],
2901                 [ AC_MSG_RESULT([yes])
2902                   enable_nistp384=1 ],
2903                 [ AC_MSG_RESULT([no]) ]
2904         )
2905
2906         AC_MSG_CHECKING([whether OpenSSL has NID_secp521r1])
2907         AC_LINK_IFELSE(
2908                 [AC_LANG_PROGRAM([[
2909         #include <openssl/ec.h>
2910         #include <openssl/ecdh.h>
2911         #include <openssl/ecdsa.h>
2912         #include <openssl/evp.h>
2913         #include <openssl/objects.h>
2914         #include <openssl/opensslv.h>
2915                 ]], [[
2916                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2917                 const EVP_MD *m = EVP_sha512(); /* We need this too */
2918                 ]])],
2919                 [ AC_MSG_RESULT([yes])
2920                   AC_MSG_CHECKING([if OpenSSL's NID_secp521r1 is functional])
2921                   AC_RUN_IFELSE(
2922                         [AC_LANG_PROGRAM([[
2923         #include <openssl/ec.h>
2924         #include <openssl/ecdh.h>
2925         #include <openssl/ecdsa.h>
2926         #include <openssl/evp.h>
2927         #include <openssl/objects.h>
2928         #include <openssl/opensslv.h>
2929                         ]],[[
2930                         EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2931                         const EVP_MD *m = EVP_sha512(); /* We need this too */
2932                         exit(e == NULL || m == NULL);
2933                         ]])],
2934                         [ AC_MSG_RESULT([yes])
2935                           enable_nistp521=1 ],
2936                         [ AC_MSG_RESULT([no]) ],
2937                         [ AC_MSG_WARN([cross-compiling: assuming yes])
2938                           enable_nistp521=1 ]
2939                   )],
2940                 AC_MSG_RESULT([no])
2941         )
2942
2943         COMMENT_OUT_ECC="#no ecc#"
2944         TEST_SSH_ECC=no
2945
2946         if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
2947             test x$enable_nistp521 = x1; then
2948                 AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC])
2949         fi
2950         if test x$enable_nistp256 = x1; then
2951                 AC_DEFINE([OPENSSL_HAS_NISTP256], [1],
2952                     [libcrypto has NID_X9_62_prime256v1])
2953                 TEST_SSH_ECC=yes
2954                 COMMENT_OUT_ECC=""
2955         else
2956                 unsupported_algorithms="$unsupported_algorithms \
2957                         ecdsa-sha2-nistp256 \
2958                         ecdh-sha2-nistp256 \
2959                         ecdsa-sha2-nistp256-cert-v01@openssh.com"
2960         fi
2961         if test x$enable_nistp384 = x1; then
2962                 AC_DEFINE([OPENSSL_HAS_NISTP384], [1], [libcrypto has NID_secp384r1])
2963                 TEST_SSH_ECC=yes
2964                 COMMENT_OUT_ECC=""
2965         else
2966                 unsupported_algorithms="$unsupported_algorithms \
2967                         ecdsa-sha2-nistp384 \
2968                         ecdh-sha2-nistp384 \
2969                         ecdsa-sha2-nistp384-cert-v01@openssh.com"
2970         fi
2971         if test x$enable_nistp521 = x1; then
2972                 AC_DEFINE([OPENSSL_HAS_NISTP521], [1], [libcrypto has NID_secp521r1])
2973                 TEST_SSH_ECC=yes
2974                 COMMENT_OUT_ECC=""
2975         else
2976                 unsupported_algorithms="$unsupported_algorithms \
2977                         ecdh-sha2-nistp521 \
2978                         ecdsa-sha2-nistp521 \
2979                         ecdsa-sha2-nistp521-cert-v01@openssh.com"
2980         fi
2981
2982         AC_SUBST([TEST_SSH_ECC])
2983         AC_SUBST([COMMENT_OUT_ECC])
2984 else
2985         AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
2986         AC_CHECK_FUNCS([crypt])
2987 fi
2988
2989 AC_CHECK_FUNCS([ \
2990         arc4random \
2991         arc4random_buf \
2992         arc4random_stir \
2993         arc4random_uniform \
2994 ])
2995
2996 saved_LIBS="$LIBS"
2997 AC_CHECK_LIB([iaf], [ia_openinfo], [
2998         LIBS="$LIBS -liaf"
2999         AC_CHECK_FUNCS([set_id], [SSHDLIBS="$SSHDLIBS -liaf"
3000                                 AC_DEFINE([HAVE_LIBIAF], [1],
3001                         [Define if system has libiaf that supports set_id])
3002                                 ])
3003 ])
3004 LIBS="$saved_LIBS"
3005
3006 ### Configure cryptographic random number support
3007
3008 # Check wheter OpenSSL seeds itself
3009 if test "x$openssl" = "xyes" ; then
3010         AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
3011         AC_RUN_IFELSE(
3012                 [AC_LANG_PROGRAM([[
3013         #include <string.h>
3014         #include <openssl/rand.h>
3015                 ]], [[
3016                 exit(RAND_status() == 1 ? 0 : 1);
3017                 ]])],
3018                 [
3019                         OPENSSL_SEEDS_ITSELF=yes
3020                         AC_MSG_RESULT([yes])
3021                 ],
3022                 [
3023                         AC_MSG_RESULT([no])
3024                 ],
3025                 [
3026                         AC_MSG_WARN([cross compiling: assuming yes])
3027                         # This is safe, since we will fatal() at runtime if
3028                         # OpenSSL is not seeded correctly.
3029                         OPENSSL_SEEDS_ITSELF=yes
3030                 ]
3031         )
3032 fi
3033
3034 # PRNGD TCP socket
3035 AC_ARG_WITH([prngd-port],
3036         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
3037         [
3038                 case "$withval" in
3039                 no)
3040                         withval=""
3041                         ;;
3042                 [[0-9]]*)
3043                         ;;
3044                 *)
3045                         AC_MSG_ERROR([You must specify a numeric port number for --with-prngd-port])
3046                         ;;
3047                 esac
3048                 if test ! -z "$withval" ; then
3049                         PRNGD_PORT="$withval"
3050                         AC_DEFINE_UNQUOTED([PRNGD_PORT], [$PRNGD_PORT],
3051                                 [Port number of PRNGD/EGD random number socket])
3052                 fi
3053         ]
3054 )
3055
3056 # PRNGD Unix domain socket
3057 AC_ARG_WITH([prngd-socket],
3058         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
3059         [
3060                 case "$withval" in
3061                 yes)
3062                         withval="/var/run/egd-pool"
3063                         ;;
3064                 no)
3065                         withval=""
3066                         ;;
3067                 /*)
3068                         ;;
3069                 *)
3070                         AC_MSG_ERROR([You must specify an absolute path to the entropy socket])
3071                         ;;
3072                 esac
3073
3074                 if test ! -z "$withval" ; then
3075                         if test ! -z "$PRNGD_PORT" ; then
3076                                 AC_MSG_ERROR([You may not specify both a PRNGD/EGD port and socket])
3077                         fi
3078                         if test ! -r "$withval" ; then
3079                                 AC_MSG_WARN([Entropy socket is not readable])
3080                         fi
3081                         PRNGD_SOCKET="$withval"
3082                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"],
3083                                 [Location of PRNGD/EGD random number socket])
3084                 fi
3085         ],
3086         [
3087                 # Check for existing socket only if we don't have a random device already
3088                 if test "x$OPENSSL_SEEDS_ITSELF" != "xyes" ; then
3089                         AC_MSG_CHECKING([for PRNGD/EGD socket])
3090                         # Insert other locations here
3091                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
3092                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
3093                                         PRNGD_SOCKET="$sock"
3094                                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"])
3095                                         break;
3096                                 fi
3097                         done
3098                         if test ! -z "$PRNGD_SOCKET" ; then
3099                                 AC_MSG_RESULT([$PRNGD_SOCKET])
3100                         else
3101                                 AC_MSG_RESULT([not found])
3102                         fi
3103                 fi
3104         ]
3105 )
3106
3107 # Which randomness source do we use?
3108 if test ! -z "$PRNGD_PORT" ; then
3109         RAND_MSG="PRNGd port $PRNGD_PORT"
3110 elif test ! -z "$PRNGD_SOCKET" ; then
3111         RAND_MSG="PRNGd socket $PRNGD_SOCKET"
3112 elif test ! -z "$OPENSSL_SEEDS_ITSELF" ; then
3113         AC_DEFINE([OPENSSL_PRNG_ONLY], [1],
3114                 [Define if you want the OpenSSL internally seeded PRNG only])
3115         RAND_MSG="OpenSSL internal ONLY"
3116 elif test "x$openssl" = "xno" ; then
3117         AC_MSG_WARN([OpenSSH will use /dev/urandom as a source of random numbers. It will fail if this device is not supported or accessible])
3118 else
3119         AC_MSG_ERROR([OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options])
3120 fi
3121
3122 # Check for PAM libs
3123 PAM_MSG="no"
3124 AC_ARG_WITH([pam],
3125         [  --with-pam              Enable PAM support ],
3126         [
3127                 if test "x$withval" != "xno" ; then
3128                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
3129                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
3130                                 AC_MSG_ERROR([PAM headers not found])
3131                         fi
3132
3133                         saved_LIBS="$LIBS"
3134                         AC_CHECK_LIB([dl], [dlopen], , )
3135                         AC_CHECK_LIB([pam], [pam_set_item], , [AC_MSG_ERROR([*** libpam missing])])
3136                         AC_CHECK_FUNCS([pam_getenvlist])
3137                         AC_CHECK_FUNCS([pam_putenv])
3138                         LIBS="$saved_LIBS"
3139
3140                         PAM_MSG="yes"
3141
3142                         SSHDLIBS="$SSHDLIBS -lpam"
3143                         AC_DEFINE([USE_PAM], [1],
3144                                 [Define if you want to enable PAM support])
3145
3146                         if test $ac_cv_lib_dl_dlopen = yes; then
3147                                 case "$LIBS" in
3148                                 *-ldl*)
3149                                         # libdl already in LIBS
3150                                         ;;
3151                                 *)
3152                                         SSHDLIBS="$SSHDLIBS -ldl"
3153                                         ;;
3154                                 esac
3155                         fi
3156                 fi
3157         ]
3158 )
3159
3160 AC_ARG_WITH([pam-service],
3161         [  --with-pam-service=name Specify PAM service name ],
3162         [
3163                 if test "x$withval" != "xno" && \
3164                    test "x$withval" != "xyes" ; then
3165                         AC_DEFINE_UNQUOTED([SSHD_PAM_SERVICE],
3166                                 ["$withval"], [sshd PAM service name])
3167                 fi
3168         ]
3169 )
3170
3171 # Check for older PAM
3172 if test "x$PAM_MSG" = "xyes" ; then
3173         # Check PAM strerror arguments (old PAM)
3174         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
3175         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3176 #include <stdlib.h>
3177 #if defined(HAVE_SECURITY_PAM_APPL_H)
3178 #include <security/pam_appl.h>
3179 #elif defined (HAVE_PAM_PAM_APPL_H)
3180 #include <pam/pam_appl.h>
3181 #endif
3182                 ]], [[
3183 (void)pam_strerror((pam_handle_t *)NULL, -1);
3184                 ]])], [AC_MSG_RESULT([no])], [
3185                         AC_DEFINE([HAVE_OLD_PAM], [1],
3186                                 [Define if you have an old version of PAM
3187                                 which takes only one argument to pam_strerror])
3188                         AC_MSG_RESULT([yes])
3189                         PAM_MSG="yes (old library)"
3190
3191         ])
3192 fi
3193
3194 case "$host" in
3195 *-*-cygwin*)
3196         SSH_PRIVSEP_USER=CYGWIN_SSH_PRIVSEP_USER
3197         ;;
3198 *)
3199         SSH_PRIVSEP_USER=sshd
3200         ;;
3201 esac
3202 AC_ARG_WITH([privsep-user],
3203         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
3204         [
3205                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3206                     test "x${withval}" != "xyes"; then
3207                         SSH_PRIVSEP_USER=$withval
3208                 fi
3209         ]
3210 )
3211 if test "x$SSH_PRIVSEP_USER" = "xCYGWIN_SSH_PRIVSEP_USER" ; then
3212         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], [CYGWIN_SSH_PRIVSEP_USER],
3213                 [Cygwin function to fetch non-privileged user for privilege separation])
3214 else
3215         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], ["$SSH_PRIVSEP_USER"],
3216                 [non-privileged user for privilege separation])
3217 fi
3218 AC_SUBST([SSH_PRIVSEP_USER])
3219
3220 if test "x$have_linux_no_new_privs" = "x1" ; then
3221 AC_CHECK_DECL([SECCOMP_MODE_FILTER], [have_seccomp_filter=1], , [
3222         #include <sys/types.h>
3223         #include <linux/seccomp.h>
3224 ])
3225 fi
3226 if test "x$have_seccomp_filter" = "x1" ; then
3227 AC_MSG_CHECKING([kernel for seccomp_filter support])
3228 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
3229                 #include <errno.h>
3230                 #include <elf.h>
3231                 #include <linux/audit.h>
3232                 #include <linux/seccomp.h>
3233                 #include <stdlib.h>
3234                 #include <sys/prctl.h>
3235         ]],
3236         [[ int i = $seccomp_audit_arch;
3237            errno = 0;
3238            prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
3239            exit(errno == EFAULT ? 0 : 1); ]])],
3240         [ AC_MSG_RESULT([yes]) ], [
3241                 AC_MSG_RESULT([no])
3242                 # Disable seccomp filter as a target
3243                 have_seccomp_filter=0
3244         ]
3245 )
3246 fi
3247
3248 # Decide which sandbox style to use
3249 sandbox_arg=""
3250 AC_ARG_WITH([sandbox],
3251         [  --with-sandbox=style    Specify privilege separation sandbox (no, capsicum, darwin, rlimit, seccomp_filter, systrace, pledge)],
3252         [
3253                 if test "x$withval" = "xyes" ; then
3254                         sandbox_arg=""
3255                 else
3256                         sandbox_arg="$withval"
3257                 fi
3258         ]
3259 )
3260
3261 # Some platforms (seems to be the ones that have a kernel poll(2)-type
3262 # function with which they implement select(2)) use an extra file descriptor
3263 # when calling select(2), which means we can't use the rlimit sandbox.
3264 AC_MSG_CHECKING([if select works with descriptor rlimit])
3265 AC_RUN_IFELSE(
3266         [AC_LANG_PROGRAM([[
3267 #include <sys/types.h>
3268 #ifdef HAVE_SYS_TIME_H
3269 # include <sys/time.h>
3270 #endif
3271 #include <sys/resource.h>
3272 #ifdef HAVE_SYS_SELECT_H
3273 # include <sys/select.h>
3274 #endif
3275 #include <errno.h>
3276 #include <fcntl.h>
3277 #include <stdlib.h>
3278         ]],[[
3279         struct rlimit rl_zero;
3280         int fd, r;
3281         fd_set fds;
3282         struct timeval tv;
3283
3284         fd = open("/dev/null", O_RDONLY);
3285         FD_ZERO(&fds);
3286         FD_SET(fd, &fds);
3287         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3288         setrlimit(RLIMIT_FSIZE, &rl_zero);
3289         setrlimit(RLIMIT_NOFILE, &rl_zero);
3290         tv.tv_sec = 1;
3291         tv.tv_usec = 0;
3292         r = select(fd+1, &fds, NULL, NULL, &tv);
3293         exit (r == -1 ? 1 : 0);
3294         ]])],
3295         [AC_MSG_RESULT([yes])
3296          select_works_with_rlimit=yes],
3297         [AC_MSG_RESULT([no])
3298          select_works_with_rlimit=no],
3299         [AC_MSG_WARN([cross compiling: assuming yes])
3300          select_works_with_rlimit=yes]
3301 )
3302
3303 AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works])
3304 AC_RUN_IFELSE(
3305         [AC_LANG_PROGRAM([[
3306 #include <sys/types.h>
3307 #ifdef HAVE_SYS_TIME_H
3308 # include <sys/time.h>
3309 #endif
3310 #include <sys/resource.h>
3311 #include <errno.h>
3312 #include <stdlib.h>
3313         ]],[[
3314         struct rlimit rl_zero;
3315         int fd, r;
3316         fd_set fds;
3317
3318         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3319         r = setrlimit(RLIMIT_NOFILE, &rl_zero);
3320         exit (r == -1 ? 1 : 0);
3321         ]])],
3322         [AC_MSG_RESULT([yes])
3323          rlimit_nofile_zero_works=yes],
3324         [AC_MSG_RESULT([no])
3325          rlimit_nofile_zero_works=no],
3326         [AC_MSG_WARN([cross compiling: assuming yes])
3327          rlimit_nofile_zero_works=yes]
3328 )
3329
3330 AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
3331 AC_RUN_IFELSE(
3332         [AC_LANG_PROGRAM([[
3333 #include <sys/types.h>
3334 #include <sys/resource.h>
3335 #include <stdlib.h>
3336         ]],[[
3337                 struct rlimit rl_zero;
3338
3339                 rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3340                 exit(setrlimit(RLIMIT_FSIZE, &rl_zero) != 0);
3341         ]])],
3342         [AC_MSG_RESULT([yes])],
3343         [AC_MSG_RESULT([no])
3344          AC_DEFINE(SANDBOX_SKIP_RLIMIT_FSIZE, 1,
3345             [setrlimit RLIMIT_FSIZE works])],
3346         [AC_MSG_WARN([cross compiling: assuming yes])]
3347 )
3348
3349 if test "x$sandbox_arg" = "xpledge" || \
3350    ( test -z "$sandbox_arg" && test "x$ac_cv_func_pledge" = "xyes" ) ; then
3351         test "x$ac_cv_func_pledge" != "xyes" && \
3352                 AC_MSG_ERROR([pledge sandbox requires pledge(2) support])
3353         SANDBOX_STYLE="pledge"
3354         AC_DEFINE([SANDBOX_PLEDGE], [1], [Sandbox using pledge(2)])
3355 elif test "x$sandbox_arg" = "xsystrace" || \
3356    ( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
3357         test "x$have_systr_policy_kill" != "x1" && \
3358                 AC_MSG_ERROR([systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support])
3359         SANDBOX_STYLE="systrace"
3360         AC_DEFINE([SANDBOX_SYSTRACE], [1], [Sandbox using systrace(4)])
3361 elif test "x$sandbox_arg" = "xdarwin" || \
3362      ( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \
3363        test "x$ac_cv_header_sandbox_h" = "xyes") ; then
3364         test "x$ac_cv_func_sandbox_init" != "xyes" -o \
3365              "x$ac_cv_header_sandbox_h" != "xyes" && \
3366                 AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h and sandbox_init function])
3367         SANDBOX_STYLE="darwin"
3368         AC_DEFINE([SANDBOX_DARWIN], [1], [Sandbox using Darwin sandbox_init(3)])
3369 elif test "x$sandbox_arg" = "xseccomp_filter" || \
3370      ( test -z "$sandbox_arg" && \
3371        test "x$have_seccomp_filter" = "x1" && \
3372        test "x$ac_cv_header_elf_h" = "xyes" && \
3373        test "x$ac_cv_header_linux_audit_h" = "xyes" && \
3374        test "x$ac_cv_header_linux_filter_h" = "xyes" && \
3375        test "x$seccomp_audit_arch" != "x" && \
3376        test "x$have_linux_no_new_privs" = "x1" && \
3377        test "x$ac_cv_func_prctl" = "xyes" ) ; then
3378         test "x$seccomp_audit_arch" = "x" && \
3379                 AC_MSG_ERROR([seccomp_filter sandbox not supported on $host])
3380         test "x$have_linux_no_new_privs" != "x1" && \
3381                 AC_MSG_ERROR([seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS])
3382         test "x$have_seccomp_filter" != "x1" && \
3383                 AC_MSG_ERROR([seccomp_filter sandbox requires seccomp headers])
3384         test "x$ac_cv_func_prctl" != "xyes" && \
3385                 AC_MSG_ERROR([seccomp_filter sandbox requires prctl function])
3386         SANDBOX_STYLE="seccomp_filter"
3387         AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
3388 elif test "x$sandbox_arg" = "xcapsicum" || \
3389      ( test -z "$sandbox_arg" && \
3390        test "x$ac_cv_header_sys_capsicum_h" = "xyes" && \
3391        test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
3392        test "x$ac_cv_header_sys_capsicum_h" != "xyes" && \
3393                 AC_MSG_ERROR([capsicum sandbox requires sys/capsicum.h header])
3394        test "x$ac_cv_func_cap_rights_limit" != "xyes" && \
3395                 AC_MSG_ERROR([capsicum sandbox requires cap_rights_limit function])
3396        SANDBOX_STYLE="capsicum"
3397        AC_DEFINE([SANDBOX_CAPSICUM], [1], [Sandbox using capsicum])
3398 elif test "x$sandbox_arg" = "xrlimit" || \
3399      ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
3400        test "x$select_works_with_rlimit" = "xyes" && \
3401        test "x$rlimit_nofile_zero_works" = "xyes" ) ; then
3402         test "x$ac_cv_func_setrlimit" != "xyes" && \
3403                 AC_MSG_ERROR([rlimit sandbox requires setrlimit function])
3404         test "x$select_works_with_rlimit" != "xyes" && \
3405                 AC_MSG_ERROR([rlimit sandbox requires select to work with rlimit])
3406         SANDBOX_STYLE="rlimit"
3407         AC_DEFINE([SANDBOX_RLIMIT], [1], [Sandbox using setrlimit(2)])
3408 elif test "x$sandbox_arg" = "xsolaris" || \
3409    ( test -z "$sandbox_arg" && test "x$SOLARIS_PRIVS" = "xyes" ) ; then
3410         SANDBOX_STYLE="solaris"
3411         AC_DEFINE([SANDBOX_SOLARIS], [1], [Sandbox using Solaris/Illumos privileges])
3412 elif test -z "$sandbox_arg" || test "x$sandbox_arg" = "xno" || \
3413      test "x$sandbox_arg" = "xnone" || test "x$sandbox_arg" = "xnull" ; then
3414         SANDBOX_STYLE="none"
3415         AC_DEFINE([SANDBOX_NULL], [1], [no privsep sandboxing])
3416 else
3417         AC_MSG_ERROR([unsupported --with-sandbox])
3418 fi
3419
3420 # Cheap hack to ensure NEWS-OS libraries are arranged right.
3421 if test ! -z "$SONY" ; then
3422   LIBS="$LIBS -liberty";
3423 fi
3424
3425 # Check for  long long datatypes
3426 AC_CHECK_TYPES([long long, unsigned long long, long double])
3427
3428 # Check datatype sizes
3429 AC_CHECK_SIZEOF([short int], [2])
3430 AC_CHECK_SIZEOF([int], [4])
3431 AC_CHECK_SIZEOF([long int], [4])
3432 AC_CHECK_SIZEOF([long long int], [8])
3433
3434 # Sanity check long long for some platforms (AIX)
3435 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
3436         ac_cv_sizeof_long_long_int=0
3437 fi
3438
3439 # compute LLONG_MIN and LLONG_MAX if we don't know them.
3440 if test -z "$have_llong_max"; then
3441         AC_MSG_CHECKING([for max value of long long])
3442         AC_RUN_IFELSE(
3443                 [AC_LANG_PROGRAM([[
3444 #include <stdio.h>
3445 /* Why is this so damn hard? */
3446 #ifdef __GNUC__
3447 # undef __GNUC__
3448 #endif
3449 #define __USE_ISOC99
3450 #include <limits.h>
3451 #define DATA "conftest.llminmax"
3452 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
3453
3454 /*
3455  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
3456  * we do this the hard way.
3457  */
3458 static int
3459 fprint_ll(FILE *f, long long n)
3460 {
3461         unsigned int i;
3462         int l[sizeof(long long) * 8];
3463
3464         if (n < 0)
3465                 if (fprintf(f, "-") < 0)
3466                         return -1;
3467         for (i = 0; n != 0; i++) {
3468                 l[i] = my_abs(n % 10);
3469                 n /= 10;
3470         }
3471         do {
3472                 if (fprintf(f, "%d", l[--i]) < 0)
3473                         return -1;
3474         } while (i != 0);
3475         if (fprintf(f, " ") < 0)
3476                 return -1;
3477         return 0;
3478 }
3479                 ]], [[
3480         FILE *f;
3481         long long i, llmin, llmax = 0;
3482
3483         if((f = fopen(DATA,"w")) == NULL)
3484                 exit(1);
3485
3486 #if defined(LLONG_MIN) && defined(LLONG_MAX)
3487         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
3488         llmin = LLONG_MIN;
3489         llmax = LLONG_MAX;
3490 #else
3491         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
3492         /* This will work on one's complement and two's complement */
3493         for (i = 1; i > llmax; i <<= 1, i++)
3494                 llmax = i;
3495         llmin = llmax + 1LL;    /* wrap */
3496 #endif
3497
3498         /* Sanity check */
3499         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
3500             || llmax - 1 > llmax || llmin == llmax || llmin == 0
3501             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
3502                 fprintf(f, "unknown unknown\n");
3503                 exit(2);
3504         }
3505
3506         if (fprint_ll(f, llmin) < 0)
3507                 exit(3);
3508         if (fprint_ll(f, llmax) < 0)
3509                 exit(4);
3510         if (fclose(f) < 0)
3511                 exit(5);
3512         exit(0);
3513                 ]])],
3514                 [
3515                         llong_min=`$AWK '{print $1}' conftest.llminmax`
3516                         llong_max=`$AWK '{print $2}' conftest.llminmax`
3517
3518                         AC_MSG_RESULT([$llong_max])
3519                         AC_DEFINE_UNQUOTED([LLONG_MAX], [${llong_max}LL],
3520                             [max value of long long calculated by configure])
3521                         AC_MSG_CHECKING([for min value of long long])
3522                         AC_MSG_RESULT([$llong_min])
3523                         AC_DEFINE_UNQUOTED([LLONG_MIN], [${llong_min}LL],
3524                             [min value of long long calculated by configure])
3525                 ],
3526                 [
3527                         AC_MSG_RESULT([not found])
3528                 ],
3529                 [
3530                         AC_MSG_WARN([cross compiling: not checking])
3531                 ]
3532         )
3533 fi
3534
3535
3536 # More checks for data types
3537 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
3538         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3539         [[ u_int a; a = 1;]])],
3540         [ ac_cv_have_u_int="yes" ], [ ac_cv_have_u_int="no"
3541         ])
3542 ])
3543 if test "x$ac_cv_have_u_int" = "xyes" ; then
3544         AC_DEFINE([HAVE_U_INT], [1], [define if you have u_int data type])
3545         have_u_int=1
3546 fi
3547
3548 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
3549         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3550         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3551         [ ac_cv_have_intxx_t="yes" ], [ ac_cv_have_intxx_t="no"
3552         ])
3553 ])
3554 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
3555         AC_DEFINE([HAVE_INTXX_T], [1], [define if you have intxx_t data type])
3556         have_intxx_t=1
3557 fi
3558
3559 if (test -z "$have_intxx_t" && \
3560            test "x$ac_cv_header_stdint_h" = "xyes")
3561 then
3562     AC_MSG_CHECKING([for intXX_t types in stdint.h])
3563         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3564         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3565                 [
3566                         AC_DEFINE([HAVE_INTXX_T])
3567                         AC_MSG_RESULT([yes])
3568                 ], [ AC_MSG_RESULT([no])
3569         ])
3570 fi
3571
3572 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
3573         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3574 #include <sys/types.h>
3575 #ifdef HAVE_STDINT_H
3576 # include <stdint.h>
3577 #endif
3578 #include <sys/socket.h>
3579 #ifdef HAVE_SYS_BITYPES_H
3580 # include <sys/bitypes.h>
3581 #endif
3582                 ]], [[
3583 int64_t a; a = 1;
3584                 ]])],
3585         [ ac_cv_have_int64_t="yes" ], [ ac_cv_have_int64_t="no"
3586         ])
3587 ])
3588 if test "x$ac_cv_have_int64_t" = "xyes" ; then
3589         AC_DEFINE([HAVE_INT64_T], [1], [define if you have int64_t data type])
3590 fi
3591
3592 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
3593         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3594         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3595         [ ac_cv_have_u_intxx_t="yes" ], [ ac_cv_have_u_intxx_t="no"
3596         ])
3597 ])
3598 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
3599         AC_DEFINE([HAVE_U_INTXX_T], [1], [define if you have u_intxx_t data type])
3600         have_u_intxx_t=1
3601 fi
3602
3603 if test -z "$have_u_intxx_t" ; then
3604     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
3605         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/socket.h> ]],
3606         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3607                 [
3608                         AC_DEFINE([HAVE_U_INTXX_T])
3609                         AC_MSG_RESULT([yes])
3610                 ], [ AC_MSG_RESULT([no])
3611         ])
3612 fi
3613
3614 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
3615         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3616         [[ u_int64_t a; a = 1;]])],
3617         [ ac_cv_have_u_int64_t="yes" ], [ ac_cv_have_u_int64_t="no"
3618         ])
3619 ])
3620 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
3621         AC_DEFINE([HAVE_U_INT64_T], [1], [define if you have u_int64_t data type])
3622         have_u_int64_t=1
3623 fi
3624
3625 if (test -z "$have_u_int64_t" && \
3626            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3627 then
3628     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
3629         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/bitypes.h> ]],
3630         [[ u_int64_t a; a = 1]])],
3631                 [
3632                         AC_DEFINE([HAVE_U_INT64_T])
3633                         AC_MSG_RESULT([yes])
3634                 ], [ AC_MSG_RESULT([no])
3635         ])
3636 fi
3637
3638 if test -z "$have_u_intxx_t" ; then
3639         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
3640                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3641 #include <sys/types.h>
3642                         ]], [[
3643         uint8_t a;
3644         uint16_t b;
3645         uint32_t c;
3646         a = b = c = 1;
3647                         ]])],
3648                 [ ac_cv_have_uintxx_t="yes" ], [ ac_cv_have_uintxx_t="no"
3649                 ])
3650         ])
3651         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
3652                 AC_DEFINE([HAVE_UINTXX_T], [1],
3653                         [define if you have uintxx_t data type])
3654         fi
3655 fi
3656
3657 if (test -z "$have_uintxx_t" && \
3658            test "x$ac_cv_header_stdint_h" = "xyes")
3659 then
3660     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
3661         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3662         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3663                 [
3664                         AC_DEFINE([HAVE_UINTXX_T])
3665                         AC_MSG_RESULT([yes])
3666                 ], [ AC_MSG_RESULT([no])
3667         ])
3668 fi
3669
3670 if (test -z "$have_uintxx_t" && \
3671            test "x$ac_cv_header_inttypes_h" = "xyes")
3672 then
3673     AC_MSG_CHECKING([for uintXX_t types in inttypes.h])
3674         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <inttypes.h> ]],
3675         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3676                 [
3677                         AC_DEFINE([HAVE_UINTXX_T])
3678                         AC_MSG_RESULT([yes])
3679                 ], [ AC_MSG_RESULT([no])
3680         ])
3681 fi
3682
3683 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
3684            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3685 then
3686         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
3687         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3688 #include <sys/bitypes.h>
3689                 ]], [[
3690                         int8_t a; int16_t b; int32_t c;
3691                         u_int8_t e; u_int16_t f; u_int32_t g;
3692                         a = b = c = e = f = g = 1;
3693                 ]])],
3694                 [
3695                         AC_DEFINE([HAVE_U_INTXX_T])
3696                         AC_DEFINE([HAVE_INTXX_T])
3697                         AC_MSG_RESULT([yes])
3698                 ], [AC_MSG_RESULT([no])
3699         ])
3700 fi
3701
3702
3703 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
3704         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3705         [[ u_char foo; foo = 125; ]])],
3706         [ ac_cv_have_u_char="yes" ], [ ac_cv_have_u_char="no"
3707         ])
3708 ])
3709 if test "x$ac_cv_have_u_char" = "xyes" ; then
3710         AC_DEFINE([HAVE_U_CHAR], [1], [define if you have u_char data type])
3711 fi
3712
3713 AC_CHECK_TYPES([intmax_t, uintmax_t], , , [
3714 #include <sys/types.h>
3715 #include <stdint.h>
3716 ])
3717
3718 TYPE_SOCKLEN_T
3719
3720 AC_CHECK_TYPES([sig_atomic_t], , , [#include <signal.h>])
3721 AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t], , , [
3722 #include <sys/types.h>
3723 #ifdef HAVE_SYS_BITYPES_H
3724 #include <sys/bitypes.h>
3725 #endif
3726 #ifdef HAVE_SYS_STATFS_H
3727 #include <sys/statfs.h>
3728 #endif
3729 #ifdef HAVE_SYS_STATVFS_H
3730 #include <sys/statvfs.h>
3731 #endif
3732 ])
3733
3734 AC_CHECK_MEMBERS([struct statfs.f_flags], [], [], [[
3735 #include <sys/types.h>
3736 #ifdef HAVE_SYS_BITYPES_H
3737 #include <sys/bitypes.h>
3738 #endif
3739 #ifdef HAVE_SYS_STATFS_H
3740 #include <sys/statfs.h>
3741 #endif
3742 #ifdef HAVE_SYS_STATVFS_H
3743 #include <sys/statvfs.h>
3744 #endif
3745 #ifdef HAVE_SYS_VFS_H
3746 #include <sys/vfs.h>
3747 #endif
3748 ]])
3749
3750
3751 AC_CHECK_TYPES([in_addr_t, in_port_t], , ,
3752 [#include <sys/types.h>
3753 #include <netinet/in.h>])
3754
3755 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
3756         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3757         [[ size_t foo; foo = 1235; ]])],
3758         [ ac_cv_have_size_t="yes" ], [ ac_cv_have_size_t="no"
3759         ])
3760 ])
3761 if test "x$ac_cv_have_size_t" = "xyes" ; then
3762         AC_DEFINE([HAVE_SIZE_T], [1], [define if you have size_t data type])
3763 fi
3764
3765 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
3766         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3767         [[ ssize_t foo; foo = 1235; ]])],
3768         [ ac_cv_have_ssize_t="yes" ], [ ac_cv_have_ssize_t="no"
3769         ])
3770 ])
3771 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
3772         AC_DEFINE([HAVE_SSIZE_T], [1], [define if you have ssize_t data type])
3773 fi
3774
3775 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
3776         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <time.h> ]],
3777         [[ clock_t foo; foo = 1235; ]])],
3778         [ ac_cv_have_clock_t="yes" ], [ ac_cv_have_clock_t="no"
3779         ])
3780 ])
3781 if test "x$ac_cv_have_clock_t" = "xyes" ; then
3782         AC_DEFINE([HAVE_CLOCK_T], [1], [define if you have clock_t data type])
3783 fi
3784
3785 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
3786         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3787 #include <sys/types.h>
3788 #include <sys/socket.h>
3789                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3790         [ ac_cv_have_sa_family_t="yes" ],
3791         [ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3792 #include <sys/types.h>
3793 #include <sys/socket.h>
3794 #include <netinet/in.h>
3795                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3796                 [ ac_cv_have_sa_family_t="yes" ],
3797                 [ ac_cv_have_sa_family_t="no" ]
3798         )
3799         ])
3800 ])
3801 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
3802         AC_DEFINE([HAVE_SA_FAMILY_T], [1],
3803                 [define if you have sa_family_t data type])
3804 fi
3805
3806 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
3807         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3808         [[ pid_t foo; foo = 1235; ]])],
3809         [ ac_cv_have_pid_t="yes" ], [ ac_cv_have_pid_t="no"
3810         ])
3811 ])
3812 if test "x$ac_cv_have_pid_t" = "xyes" ; then
3813         AC_DEFINE([HAVE_PID_T], [1], [define if you have pid_t data type])
3814 fi
3815
3816 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
3817         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3818         [[ mode_t foo; foo = 1235; ]])],
3819         [ ac_cv_have_mode_t="yes" ], [ ac_cv_have_mode_t="no"
3820         ])
3821 ])
3822 if test "x$ac_cv_have_mode_t" = "xyes" ; then
3823         AC_DEFINE([HAVE_MODE_T], [1], [define if you have mode_t data type])
3824 fi
3825
3826
3827 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
3828         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3829 #include <sys/types.h>
3830 #include <sys/socket.h>
3831                 ]], [[ struct sockaddr_storage s; ]])],
3832         [ ac_cv_have_struct_sockaddr_storage="yes" ],
3833         [ ac_cv_have_struct_sockaddr_storage="no"
3834         ])
3835 ])
3836 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
3837         AC_DEFINE([HAVE_STRUCT_SOCKADDR_STORAGE], [1],
3838                 [define if you have struct sockaddr_storage data type])
3839 fi
3840
3841 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
3842         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3843 #include <sys/types.h>
3844 #include <netinet/in.h>
3845                 ]], [[ struct sockaddr_in6 s; s.sin6_family = 0; ]])],
3846         [ ac_cv_have_struct_sockaddr_in6="yes" ],
3847         [ ac_cv_have_struct_sockaddr_in6="no"
3848         ])
3849 ])
3850 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
3851         AC_DEFINE([HAVE_STRUCT_SOCKADDR_IN6], [1],
3852                 [define if you have struct sockaddr_in6 data type])
3853 fi
3854
3855 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
3856         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3857 #include <sys/types.h>
3858 #include <netinet/in.h>
3859                 ]], [[ struct in6_addr s; s.s6_addr[0] = 0; ]])],
3860         [ ac_cv_have_struct_in6_addr="yes" ],
3861         [ ac_cv_have_struct_in6_addr="no"
3862         ])
3863 ])
3864 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
3865         AC_DEFINE([HAVE_STRUCT_IN6_ADDR], [1],
3866                 [define if you have struct in6_addr data type])
3867
3868 dnl Now check for sin6_scope_id
3869         AC_CHECK_MEMBERS([struct sockaddr_in6.sin6_scope_id], , ,
3870                 [
3871 #ifdef HAVE_SYS_TYPES_H
3872 #include <sys/types.h>
3873 #endif
3874 #include <netinet/in.h>
3875                 ])
3876 fi
3877
3878 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
3879         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3880 #include <sys/types.h>
3881 #include <sys/socket.h>
3882 #include <netdb.h>
3883                 ]], [[ struct addrinfo s; s.ai_flags = AI_PASSIVE; ]])],
3884         [ ac_cv_have_struct_addrinfo="yes" ],
3885         [ ac_cv_have_struct_addrinfo="no"
3886         ])
3887 ])
3888 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
3889         AC_DEFINE([HAVE_STRUCT_ADDRINFO], [1],
3890                 [define if you have struct addrinfo data type])
3891 fi
3892
3893 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
3894         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/time.h> ]],
3895         [[ struct timeval tv; tv.tv_sec = 1;]])],
3896         [ ac_cv_have_struct_timeval="yes" ],
3897         [ ac_cv_have_struct_timeval="no"
3898         ])
3899 ])
3900 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
3901         AC_DEFINE([HAVE_STRUCT_TIMEVAL], [1], [define if you have struct timeval])
3902         have_struct_timeval=1
3903 fi
3904
3905 AC_CHECK_TYPES([struct timespec])
3906
3907 # We need int64_t or else certian parts of the compile will fail.
3908 if test "x$ac_cv_have_int64_t" = "xno" && \
3909         test "x$ac_cv_sizeof_long_int" != "x8" && \
3910         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
3911         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
3912         echo "an alternative compiler (I.E., GCC) before continuing."
3913         echo ""
3914         exit 1;
3915 else
3916 dnl test snprintf (broken on SCO w/gcc)
3917         AC_RUN_IFELSE(
3918                 [AC_LANG_SOURCE([[
3919 #include <stdio.h>
3920 #include <string.h>
3921 #ifdef HAVE_SNPRINTF
3922 main()
3923 {
3924         char buf[50];
3925         char expected_out[50];
3926         int mazsize = 50 ;
3927 #if (SIZEOF_LONG_INT == 8)
3928         long int num = 0x7fffffffffffffff;
3929 #else
3930         long long num = 0x7fffffffffffffffll;
3931 #endif
3932         strcpy(expected_out, "9223372036854775807");
3933         snprintf(buf, mazsize, "%lld", num);
3934         if(strcmp(buf, expected_out) != 0)
3935                 exit(1);
3936         exit(0);
3937 }
3938 #else
3939 main() { exit(0); }
3940 #endif
3941                 ]])], [ true ], [ AC_DEFINE([BROKEN_SNPRINTF]) ],
3942                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3943         )
3944 fi
3945
3946 dnl Checks for structure members
3947 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmp.h], [HAVE_HOST_IN_UTMP])
3948 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmpx.h], [HAVE_HOST_IN_UTMPX])
3949 OSSH_CHECK_HEADER_FOR_FIELD([syslen], [utmpx.h], [HAVE_SYSLEN_IN_UTMPX])
3950 OSSH_CHECK_HEADER_FOR_FIELD([ut_pid], [utmp.h], [HAVE_PID_IN_UTMP])
3951 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmp.h], [HAVE_TYPE_IN_UTMP])
3952 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmpx.h], [HAVE_TYPE_IN_UTMPX])
3953 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmp.h], [HAVE_TV_IN_UTMP])
3954 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmp.h], [HAVE_ID_IN_UTMP])
3955 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmpx.h], [HAVE_ID_IN_UTMPX])
3956 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmp.h], [HAVE_ADDR_IN_UTMP])
3957 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmpx.h], [HAVE_ADDR_IN_UTMPX])
3958 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmp.h], [HAVE_ADDR_V6_IN_UTMP])
3959 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmpx.h], [HAVE_ADDR_V6_IN_UTMPX])
3960 OSSH_CHECK_HEADER_FOR_FIELD([ut_exit], [utmp.h], [HAVE_EXIT_IN_UTMP])
3961 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmp.h], [HAVE_TIME_IN_UTMP])
3962 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmpx.h], [HAVE_TIME_IN_UTMPX])
3963 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmpx.h], [HAVE_TV_IN_UTMPX])
3964
3965 AC_CHECK_MEMBERS([struct stat.st_blksize])
3966 AC_CHECK_MEMBERS([struct stat.st_mtim])
3967 AC_CHECK_MEMBERS([struct stat.st_mtime])
3968 AC_CHECK_MEMBERS([struct passwd.pw_gecos, struct passwd.pw_class,
3969 struct passwd.pw_change, struct passwd.pw_expire],
3970 [], [], [[
3971 #include <sys/types.h>
3972 #include <pwd.h>
3973 ]])
3974
3975 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE([__res_state], [state],
3976         [Define if we don't have struct __res_state in resolv.h])],
3977 [[
3978 #include <stdio.h>
3979 #if HAVE_SYS_TYPES_H
3980 # include <sys/types.h>
3981 #endif
3982 #include <netinet/in.h>
3983 #include <arpa/nameser.h>
3984 #include <resolv.h>
3985 ]])
3986
3987 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
3988                 ac_cv_have_ss_family_in_struct_ss, [
3989         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3990 #include <sys/types.h>
3991 #include <sys/socket.h>
3992                 ]], [[ struct sockaddr_storage s; s.ss_family = 1; ]])],
3993         [ ac_cv_have_ss_family_in_struct_ss="yes" ],
3994         [ ac_cv_have_ss_family_in_struct_ss="no" ])
3995 ])
3996 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3997         AC_DEFINE([HAVE_SS_FAMILY_IN_SS], [1], [Fields in struct sockaddr_storage])
3998 fi
3999
4000 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
4001                 ac_cv_have___ss_family_in_struct_ss, [
4002         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4003 #include <sys/types.h>
4004 #include <sys/socket.h>
4005                 ]], [[ struct sockaddr_storage s; s.__ss_family = 1; ]])],
4006         [ ac_cv_have___ss_family_in_struct_ss="yes" ],
4007         [ ac_cv_have___ss_family_in_struct_ss="no"
4008         ])
4009 ])
4010 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
4011         AC_DEFINE([HAVE___SS_FAMILY_IN_SS], [1],
4012                 [Fields in struct sockaddr_storage])
4013 fi
4014
4015 dnl make sure we're using the real structure members and not defines
4016 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
4017                 ac_cv_have_accrights_in_msghdr, [
4018         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4019 #include <sys/types.h>
4020 #include <sys/socket.h>
4021 #include <sys/uio.h>
4022                 ]], [[
4023 #ifdef msg_accrights
4024 #error "msg_accrights is a macro"
4025 exit(1);
4026 #endif
4027 struct msghdr m;
4028 m.msg_accrights = 0;
4029 exit(0);
4030                 ]])],
4031                 [ ac_cv_have_accrights_in_msghdr="yes" ],
4032                 [ ac_cv_have_accrights_in_msghdr="no" ]
4033         )
4034 ])
4035 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
4036         AC_DEFINE([HAVE_ACCRIGHTS_IN_MSGHDR], [1],
4037                 [Define if your system uses access rights style
4038                 file descriptor passing])
4039 fi
4040
4041 AC_MSG_CHECKING([if struct statvfs.f_fsid is integral type])
4042 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4043 #include <sys/param.h>
4044 #include <sys/stat.h>
4045 #ifdef HAVE_SYS_TIME_H
4046 # include <sys/time.h>
4047 #endif
4048 #ifdef HAVE_SYS_MOUNT_H
4049 #include <sys/mount.h>
4050 #endif
4051 #ifdef HAVE_SYS_STATVFS_H
4052 #include <sys/statvfs.h>
4053 #endif
4054         ]], [[ struct statvfs s; s.f_fsid = 0; ]])],
4055         [ AC_MSG_RESULT([yes]) ],
4056         [ AC_MSG_RESULT([no])
4057
4058         AC_MSG_CHECKING([if fsid_t has member val])
4059         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4060 #include <sys/types.h>
4061 #include <sys/statvfs.h>
4062         ]], [[ fsid_t t; t.val[0] = 0; ]])],
4063         [ AC_MSG_RESULT([yes])
4064           AC_DEFINE([FSID_HAS_VAL], [1], [fsid_t has member val]) ],
4065         [ AC_MSG_RESULT([no]) ])
4066
4067         AC_MSG_CHECKING([if f_fsid has member __val])
4068         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4069 #include <sys/types.h>
4070 #include <sys/statvfs.h>
4071         ]], [[ fsid_t t; t.__val[0] = 0; ]])],
4072         [ AC_MSG_RESULT([yes])
4073           AC_DEFINE([FSID_HAS___VAL], [1], [fsid_t has member __val]) ],
4074         [ AC_MSG_RESULT([no]) ])
4075 ])
4076
4077 AC_CACHE_CHECK([for msg_control field in struct msghdr],
4078                 ac_cv_have_control_in_msghdr, [
4079         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4080 #include <sys/types.h>
4081 #include <sys/socket.h>
4082 #include <sys/uio.h>
4083                 ]], [[
4084 #ifdef msg_control
4085 #error "msg_control is a macro"
4086 exit(1);
4087 #endif
4088 struct msghdr m;
4089 m.msg_control = 0;
4090 exit(0);
4091                 ]])],
4092                 [ ac_cv_have_control_in_msghdr="yes" ],
4093                 [ ac_cv_have_control_in_msghdr="no" ]
4094         )
4095 ])
4096 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
4097         AC_DEFINE([HAVE_CONTROL_IN_MSGHDR], [1],
4098                 [Define if your system uses ancillary data style
4099                 file descriptor passing])
4100 fi
4101
4102 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
4103         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4104                 [[ extern char *__progname; printf("%s", __progname); ]])],
4105         [ ac_cv_libc_defines___progname="yes" ],
4106         [ ac_cv_libc_defines___progname="no"
4107         ])
4108 ])
4109 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
4110         AC_DEFINE([HAVE___PROGNAME], [1], [Define if libc defines __progname])
4111 fi
4112
4113 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
4114         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4115                 [[ printf("%s", __FUNCTION__); ]])],
4116         [ ac_cv_cc_implements___FUNCTION__="yes" ],
4117         [ ac_cv_cc_implements___FUNCTION__="no"
4118         ])
4119 ])
4120 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
4121         AC_DEFINE([HAVE___FUNCTION__], [1],
4122                 [Define if compiler implements __FUNCTION__])
4123 fi
4124
4125 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
4126         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4127                 [[ printf("%s", __func__); ]])],
4128         [ ac_cv_cc_implements___func__="yes" ],
4129         [ ac_cv_cc_implements___func__="no"
4130         ])
4131 ])
4132 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
4133         AC_DEFINE([HAVE___func__], [1], [Define if compiler implements __func__])
4134 fi
4135
4136 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
4137         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4138 #include <stdarg.h>
4139 va_list x,y;
4140                 ]], [[ va_copy(x,y); ]])],
4141         [ ac_cv_have_va_copy="yes" ],
4142         [ ac_cv_have_va_copy="no"
4143         ])
4144 ])
4145 if test "x$ac_cv_have_va_copy" = "xyes" ; then
4146         AC_DEFINE([HAVE_VA_COPY], [1], [Define if va_copy exists])
4147 fi
4148
4149 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
4150         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4151 #include <stdarg.h>
4152 va_list x,y;
4153                 ]], [[ __va_copy(x,y); ]])],
4154         [ ac_cv_have___va_copy="yes" ], [ ac_cv_have___va_copy="no"
4155         ])
4156 ])
4157 if test "x$ac_cv_have___va_copy" = "xyes" ; then
4158         AC_DEFINE([HAVE___VA_COPY], [1], [Define if __va_copy exists])
4159 fi
4160
4161 AC_CACHE_CHECK([whether getopt has optreset support],
4162                 ac_cv_have_getopt_optreset, [
4163         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <getopt.h> ]],
4164                 [[ extern int optreset; optreset = 0; ]])],
4165         [ ac_cv_have_getopt_optreset="yes" ],
4166         [ ac_cv_have_getopt_optreset="no"
4167         ])
4168 ])
4169 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
4170         AC_DEFINE([HAVE_GETOPT_OPTRESET], [1],
4171                 [Define if your getopt(3) defines and uses optreset])
4172 fi
4173
4174 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
4175         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4176 [[ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);]])],
4177         [ ac_cv_libc_defines_sys_errlist="yes" ],
4178         [ ac_cv_libc_defines_sys_errlist="no"
4179         ])
4180 ])
4181 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
4182         AC_DEFINE([HAVE_SYS_ERRLIST], [1],
4183                 [Define if your system defines sys_errlist[]])
4184 fi
4185
4186
4187 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
4188         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4189 [[ extern int sys_nerr; printf("%i", sys_nerr);]])],
4190         [ ac_cv_libc_defines_sys_nerr="yes" ],
4191         [ ac_cv_libc_defines_sys_nerr="no"
4192         ])
4193 ])
4194 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
4195         AC_DEFINE([HAVE_SYS_NERR], [1], [Define if your system defines sys_nerr])
4196 fi
4197
4198 # Check libraries needed by DNS fingerprint support
4199 AC_SEARCH_LIBS([getrrsetbyname], [resolv],
4200         [AC_DEFINE([HAVE_GETRRSETBYNAME], [1],
4201                 [Define if getrrsetbyname() exists])],
4202         [
4203                 # Needed by our getrrsetbyname()
4204                 AC_SEARCH_LIBS([res_query], [resolv])
4205                 AC_SEARCH_LIBS([dn_expand], [resolv])
4206                 AC_MSG_CHECKING([if res_query will link])
4207                 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4208 #include <sys/types.h>
4209 #include <netinet/in.h>
4210 #include <arpa/nameser.h>
4211 #include <netdb.h>
4212 #include <resolv.h>
4213                                 ]], [[
4214         res_query (0, 0, 0, 0, 0);
4215                                 ]])],
4216                     AC_MSG_RESULT([yes]),
4217                    [AC_MSG_RESULT([no])
4218                     saved_LIBS="$LIBS"
4219                     LIBS="$LIBS -lresolv"
4220                     AC_MSG_CHECKING([for res_query in -lresolv])
4221                     AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4222 #include <sys/types.h>
4223 #include <netinet/in.h>
4224 #include <arpa/nameser.h>
4225 #include <netdb.h>
4226 #include <resolv.h>
4227                                 ]], [[
4228         res_query (0, 0, 0, 0, 0);
4229                                 ]])],
4230                         [AC_MSG_RESULT([yes])],
4231                         [LIBS="$saved_LIBS"
4232                          AC_MSG_RESULT([no])])
4233                     ])
4234                 AC_CHECK_FUNCS([_getshort _getlong])
4235                 AC_CHECK_DECLS([_getshort, _getlong], , ,
4236                     [#include <sys/types.h>
4237                     #include <arpa/nameser.h>])
4238                 AC_CHECK_MEMBER([HEADER.ad],
4239                         [AC_DEFINE([HAVE_HEADER_AD], [1],
4240                             [Define if HEADER.ad exists in arpa/nameser.h])], ,
4241                         [#include <arpa/nameser.h>])
4242         ])
4243
4244 AC_MSG_CHECKING([if struct __res_state _res is an extern])
4245 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4246 #include <stdio.h>
4247 #if HAVE_SYS_TYPES_H
4248 # include <sys/types.h>
4249 #endif
4250 #include <netinet/in.h>
4251 #include <arpa/nameser.h>
4252 #include <resolv.h>
4253 extern struct __res_state _res;
4254                 ]], [[
4255 struct __res_state *volatile p = &_res;  /* force resolution of _res */
4256 return 0;
4257                 ]],)],
4258                 [AC_MSG_RESULT([yes])
4259                  AC_DEFINE([HAVE__RES_EXTERN], [1],
4260                     [Define if you have struct __res_state _res as an extern])
4261                 ],
4262                 [ AC_MSG_RESULT([no]) ]
4263 )
4264
4265 # Check whether user wants SELinux support
4266 SELINUX_MSG="no"
4267 LIBSELINUX=""
4268 AC_ARG_WITH([selinux],
4269         [  --with-selinux          Enable SELinux support],
4270         [ if test "x$withval" != "xno" ; then
4271                 save_LIBS="$LIBS"
4272                 AC_DEFINE([WITH_SELINUX], [1],
4273                         [Define if you want SELinux support.])
4274                 SELINUX_MSG="yes"
4275                 AC_CHECK_HEADER([selinux/selinux.h], ,
4276                         AC_MSG_ERROR([SELinux support requires selinux.h header]))
4277                 AC_CHECK_LIB([selinux], [setexeccon],
4278                         [ LIBSELINUX="-lselinux"
4279                           LIBS="$LIBS -lselinux"
4280                         ],
4281                         AC_MSG_ERROR([SELinux support requires libselinux library]))
4282                 SSHLIBS="$SSHLIBS $LIBSELINUX"
4283                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
4284                 AC_CHECK_FUNCS([getseuserbyname get_default_context_with_level])
4285                 LIBS="$save_LIBS"
4286         fi ]
4287 )
4288 AC_SUBST([SSHLIBS])
4289 AC_SUBST([SSHDLIBS])
4290
4291 # Check whether user wants Kerberos 5 support
4292 KRB5_MSG="no"
4293 AC_ARG_WITH([kerberos5],
4294         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
4295         [ if test "x$withval" != "xno" ; then
4296                 if test "x$withval" = "xyes" ; then
4297                         KRB5ROOT="/usr/local"
4298                 else
4299                         KRB5ROOT=${withval}
4300                 fi
4301
4302                 AC_DEFINE([KRB5], [1], [Define if you want Kerberos 5 support])
4303                 KRB5_MSG="yes"
4304
4305                 AC_PATH_TOOL([KRB5CONF], [krb5-config],
4306                              [$KRB5ROOT/bin/krb5-config],
4307                              [$KRB5ROOT/bin:$PATH])
4308                 if test -x $KRB5CONF ; then
4309                         K5CFLAGS="`$KRB5CONF --cflags`"
4310                         K5LIBS="`$KRB5CONF --libs`"
4311                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
4312
4313                         AC_MSG_CHECKING([for gssapi support])
4314                         if $KRB5CONF | grep gssapi >/dev/null ; then
4315                                 AC_MSG_RESULT([yes])
4316                                 AC_DEFINE([GSSAPI], [1],
4317                                         [Define this if you want GSSAPI
4318                                         support in the version 2 protocol])
4319                                 GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
4320                                 GSSLIBS="`$KRB5CONF --libs gssapi`"
4321                                 CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
4322                         else
4323                                 AC_MSG_RESULT([no])
4324                         fi
4325                         AC_MSG_CHECKING([whether we are using Heimdal])
4326                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4327                                 ]], [[ char *tmp = heimdal_version; ]])],
4328                                 [ AC_MSG_RESULT([yes])
4329                                 AC_DEFINE([HEIMDAL], [1],
4330                                 [Define this if you are using the Heimdal
4331                                 version of Kerberos V5]) ],
4332                                 [AC_MSG_RESULT([no])
4333                         ])
4334                 else
4335                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
4336                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
4337                         AC_MSG_CHECKING([whether we are using Heimdal])
4338                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4339                                 ]], [[ char *tmp = heimdal_version; ]])],
4340                                         [ AC_MSG_RESULT([yes])
4341                                          AC_DEFINE([HEIMDAL])
4342                                          K5LIBS="-lkrb5"
4343                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
4344                                          AC_CHECK_LIB([roken], [net_write],
4345                                            [K5LIBS="$K5LIBS -lroken"])
4346                                          AC_CHECK_LIB([des], [des_cbc_encrypt],
4347                                            [K5LIBS="$K5LIBS -ldes"])
4348                                        ], [ AC_MSG_RESULT([no])
4349                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
4350                         ])
4351                         AC_SEARCH_LIBS([dn_expand], [resolv])
4352
4353                         AC_CHECK_LIB([gssapi_krb5], [gss_init_sec_context],
4354                                 [ AC_DEFINE([GSSAPI])
4355                                   GSSLIBS="-lgssapi_krb5" ],
4356                                 [ AC_CHECK_LIB([gssapi], [gss_init_sec_context],
4357                                         [ AC_DEFINE([GSSAPI])
4358                                           GSSLIBS="-lgssapi" ],
4359                                         [ AC_CHECK_LIB([gss], [gss_init_sec_context],
4360                                                 [ AC_DEFINE([GSSAPI])
4361                                                   GSSLIBS="-lgss" ],
4362                                                 AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]))
4363                                         ])
4364                                 ])
4365
4366                         AC_CHECK_HEADER([gssapi.h], ,
4367                                 [ unset ac_cv_header_gssapi_h
4368                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4369                                   AC_CHECK_HEADERS([gssapi.h], ,
4370                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
4371                                   )
4372                                 ]
4373                         )
4374
4375                         oldCPP="$CPPFLAGS"
4376                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4377                         AC_CHECK_HEADER([gssapi_krb5.h], ,
4378                                         [ CPPFLAGS="$oldCPP" ])
4379
4380                 fi
4381                 if test ! -z "$need_dash_r" ; then
4382                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
4383                 fi
4384                 if test ! -z "$blibpath" ; then
4385                         blibpath="$blibpath:${KRB5ROOT}/lib"
4386                 fi
4387
4388                 AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
4389                 AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
4390                 AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
4391
4392                 AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
4393                         [Define this if you want to use libkafs' AFS support])])
4394
4395                 AC_CHECK_DECLS([GSS_C_NT_HOSTBASED_SERVICE], [], [], [[
4396 #ifdef HAVE_GSSAPI_H
4397 # include <gssapi.h>
4398 #elif defined(HAVE_GSSAPI_GSSAPI_H)
4399 # include <gssapi/gssapi.h>
4400 #endif
4401
4402 #ifdef HAVE_GSSAPI_GENERIC_H
4403 # include <gssapi_generic.h>
4404 #elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
4405 # include <gssapi/gssapi_generic.h>
4406 #endif
4407                 ]])
4408                 saved_LIBS="$LIBS"
4409                 LIBS="$LIBS $K5LIBS"
4410                 AC_CHECK_FUNCS([krb5_cc_new_unique krb5_get_error_message krb5_free_error_message])
4411                 LIBS="$saved_LIBS"
4412
4413         fi
4414         ]
4415 )
4416 AC_SUBST([GSSLIBS])
4417 AC_SUBST([K5LIBS])
4418
4419 # Looking for programs, paths and files
4420
4421 PRIVSEP_PATH=/var/empty
4422 AC_ARG_WITH([privsep-path],
4423         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
4424         [
4425                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4426                     test "x${withval}" != "xyes"; then
4427                         PRIVSEP_PATH=$withval
4428                 fi
4429         ]
4430 )
4431 AC_SUBST([PRIVSEP_PATH])
4432
4433 AC_ARG_WITH([xauth],
4434         [  --with-xauth=PATH       Specify path to xauth program ],
4435         [
4436                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4437                     test "x${withval}" != "xyes"; then
4438                         xauth_path=$withval
4439                 fi
4440         ],
4441         [
4442                 TestPath="$PATH"
4443                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
4444                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
4445                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
4446                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
4447                 AC_PATH_PROG([xauth_path], [xauth], , [$TestPath])
4448                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
4449                         xauth_path="/usr/openwin/bin/xauth"
4450                 fi
4451         ]
4452 )
4453
4454 STRIP_OPT=-s
4455 AC_ARG_ENABLE([strip],
4456         [  --disable-strip         Disable calling strip(1) on install],
4457         [
4458                 if test "x$enableval" = "xno" ; then
4459                         STRIP_OPT=
4460                 fi
4461         ]
4462 )
4463 AC_SUBST([STRIP_OPT])
4464
4465 if test -z "$xauth_path" ; then
4466         XAUTH_PATH="undefined"
4467         AC_SUBST([XAUTH_PATH])
4468 else
4469         AC_DEFINE_UNQUOTED([XAUTH_PATH], ["$xauth_path"],
4470                 [Define if xauth is found in your path])
4471         XAUTH_PATH=$xauth_path
4472         AC_SUBST([XAUTH_PATH])
4473 fi
4474
4475 dnl # --with-maildir=/path/to/mail gets top priority.
4476 dnl # if maildir is set in the platform case statement above we use that.
4477 dnl # Otherwise we run a program to get the dir from system headers.
4478 dnl # We first look for _PATH_MAILDIR then MAILDIR then _PATH_MAIL
4479 dnl # If we find _PATH_MAILDIR we do nothing because that is what
4480 dnl # session.c expects anyway. Otherwise we set to the value found
4481 dnl # stripping any trailing slash. If for some strage reason our program
4482 dnl # does not find what it needs, we default to /var/spool/mail.
4483 # Check for mail directory
4484 AC_ARG_WITH([maildir],
4485     [  --with-maildir=/path/to/mail    Specify your system mail directory],
4486     [
4487         if test "X$withval" != X  &&  test "x$withval" != xno  &&  \
4488             test "x${withval}" != xyes; then
4489                 AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$withval"],
4490             [Set this to your mail directory if you do not have _PATH_MAILDIR])
4491             fi
4492      ],[
4493         if test "X$maildir" != "X"; then
4494             AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4495         else
4496             AC_MSG_CHECKING([Discovering system mail directory])
4497             AC_RUN_IFELSE(
4498                 [AC_LANG_PROGRAM([[
4499 #include <stdio.h>
4500 #include <string.h>
4501 #ifdef HAVE_PATHS_H
4502 #include <paths.h>
4503 #endif
4504 #ifdef HAVE_MAILLOCK_H
4505 #include <maillock.h>
4506 #endif
4507 #define DATA "conftest.maildir"
4508         ]], [[
4509         FILE *fd;
4510         int rc;
4511
4512         fd = fopen(DATA,"w");
4513         if(fd == NULL)
4514                 exit(1);
4515
4516 #if defined (_PATH_MAILDIR)
4517         if ((rc = fprintf(fd ,"_PATH_MAILDIR:%s\n", _PATH_MAILDIR)) <0)
4518                 exit(1);
4519 #elif defined (MAILDIR)
4520         if ((rc = fprintf(fd ,"MAILDIR:%s\n", MAILDIR)) <0)
4521                 exit(1);
4522 #elif defined (_PATH_MAIL)
4523         if ((rc = fprintf(fd ,"_PATH_MAIL:%s\n", _PATH_MAIL)) <0)
4524                 exit(1);
4525 #else
4526         exit (2);
4527 #endif
4528
4529         exit(0);
4530                 ]])],
4531                 [
4532                     maildir_what=`awk -F: '{print $1}' conftest.maildir`
4533                     maildir=`awk -F: '{print $2}' conftest.maildir \
4534                         | sed 's|/$||'`
4535                     AC_MSG_RESULT([Using: $maildir from $maildir_what])
4536                     if test "x$maildir_what" != "x_PATH_MAILDIR"; then
4537                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4538                     fi
4539                 ],
4540                 [
4541                     if test "X$ac_status" = "X2";then
4542 # our test program didn't find it. Default to /var/spool/mail
4543                         AC_MSG_RESULT([Using: default value of /var/spool/mail])
4544                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["/var/spool/mail"])
4545                      else
4546                         AC_MSG_RESULT([*** not found ***])
4547                      fi
4548                 ],
4549                 [
4550                         AC_MSG_WARN([cross compiling: use --with-maildir=/path/to/mail])
4551                 ]
4552             )
4553         fi
4554     ]
4555 ) # maildir
4556
4557 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
4558         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
4559         disable_ptmx_check=yes
4560 fi
4561 if test -z "$no_dev_ptmx" ; then
4562         if test "x$disable_ptmx_check" != "xyes" ; then
4563                 AC_CHECK_FILE(["/dev/ptmx"],
4564                         [
4565                                 AC_DEFINE_UNQUOTED([HAVE_DEV_PTMX], [1],
4566                                         [Define if you have /dev/ptmx])
4567                                 have_dev_ptmx=1
4568                         ]
4569                 )
4570         fi
4571 fi
4572
4573 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
4574         AC_CHECK_FILE(["/dev/ptc"],
4575                 [
4576                         AC_DEFINE_UNQUOTED([HAVE_DEV_PTS_AND_PTC], [1],
4577                                 [Define if you have /dev/ptc])
4578                         have_dev_ptc=1
4579                 ]
4580         )
4581 else
4582         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
4583 fi
4584
4585 # Options from here on. Some of these are preset by platform above
4586 AC_ARG_WITH([mantype],
4587         [  --with-mantype=man|cat|doc  Set man page type],
4588         [
4589                 case "$withval" in
4590                 man|cat|doc)
4591                         MANTYPE=$withval
4592                         ;;
4593                 *)
4594                         AC_MSG_ERROR([invalid man type: $withval])
4595                         ;;
4596                 esac
4597         ]
4598 )
4599 if test -z "$MANTYPE"; then
4600         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
4601         AC_PATH_PROGS([NROFF], [nroff awf], [/bin/false], [$TestPath])
4602         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
4603                 MANTYPE=doc
4604         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
4605                 MANTYPE=man
4606         else
4607                 MANTYPE=cat
4608         fi
4609 fi
4610 AC_SUBST([MANTYPE])
4611 if test "$MANTYPE" = "doc"; then
4612         mansubdir=man;
4613 else
4614         mansubdir=$MANTYPE;
4615 fi
4616 AC_SUBST([mansubdir])
4617
4618 # Check whether to enable MD5 passwords
4619 MD5_MSG="no"
4620 AC_ARG_WITH([md5-passwords],
4621         [  --with-md5-passwords    Enable use of MD5 passwords],
4622         [
4623                 if test "x$withval" != "xno" ; then
4624                         AC_DEFINE([HAVE_MD5_PASSWORDS], [1],
4625                                 [Define if you want to allow MD5 passwords])
4626                         MD5_MSG="yes"
4627                 fi
4628         ]
4629 )
4630
4631 # Whether to disable shadow password support
4632 AC_ARG_WITH([shadow],
4633         [  --without-shadow        Disable shadow password support],
4634         [
4635                 if test "x$withval" = "xno" ; then
4636                         AC_DEFINE([DISABLE_SHADOW])
4637                         disable_shadow=yes
4638                 fi
4639         ]
4640 )
4641
4642 if test -z "$disable_shadow" ; then
4643         AC_MSG_CHECKING([if the systems has expire shadow information])
4644         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4645 #include <sys/types.h>
4646 #include <shadow.h>
4647 struct spwd sp;
4648                 ]], [[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ]])],
4649                 [ sp_expire_available=yes ], [
4650         ])
4651
4652         if test "x$sp_expire_available" = "xyes" ; then
4653                 AC_MSG_RESULT([yes])
4654                 AC_DEFINE([HAS_SHADOW_EXPIRE], [1],
4655                     [Define if you want to use shadow password expire field])
4656         else
4657                 AC_MSG_RESULT([no])
4658         fi
4659 fi
4660
4661 # Use ip address instead of hostname in $DISPLAY
4662 if test ! -z "$IPADDR_IN_DISPLAY" ; then
4663         DISPLAY_HACK_MSG="yes"
4664         AC_DEFINE([IPADDR_IN_DISPLAY], [1],
4665                 [Define if you need to use IP address
4666                 instead of hostname in $DISPLAY])
4667 else
4668         DISPLAY_HACK_MSG="no"
4669         AC_ARG_WITH([ipaddr-display],
4670                 [  --with-ipaddr-display   Use ip address instead of hostname in $DISPLAY],
4671                 [
4672                         if test "x$withval" != "xno" ; then
4673                                 AC_DEFINE([IPADDR_IN_DISPLAY])
4674                                 DISPLAY_HACK_MSG="yes"
4675                         fi
4676                 ]
4677         )
4678 fi
4679
4680 # check for /etc/default/login and use it if present.
4681 AC_ARG_ENABLE([etc-default-login],
4682         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
4683         [ if test "x$enableval" = "xno"; then
4684                 AC_MSG_NOTICE([/etc/default/login handling disabled])
4685                 etc_default_login=no
4686           else
4687                 etc_default_login=yes
4688           fi ],
4689         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
4690           then
4691                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
4692                 etc_default_login=no
4693           else
4694                 etc_default_login=yes
4695           fi ]
4696 )
4697
4698 if test "x$etc_default_login" != "xno"; then
4699         AC_CHECK_FILE(["/etc/default/login"],
4700             [ external_path_file=/etc/default/login ])
4701         if test "x$external_path_file" = "x/etc/default/login"; then
4702                 AC_DEFINE([HAVE_ETC_DEFAULT_LOGIN], [1],
4703                         [Define if your system has /etc/default/login])
4704         fi
4705 fi
4706
4707 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
4708 if test $ac_cv_func_login_getcapbool = "yes" && \
4709         test $ac_cv_header_login_cap_h = "yes" ; then
4710         external_path_file=/etc/login.conf
4711 fi
4712
4713 # Whether to mess with the default path
4714 SERVER_PATH_MSG="(default)"
4715 AC_ARG_WITH([default-path],
4716         [  --with-default-path=    Specify default $PATH environment for server],
4717         [
4718                 if test "x$external_path_file" = "x/etc/login.conf" ; then
4719                         AC_MSG_WARN([
4720 --with-default-path=PATH has no effect on this system.
4721 Edit /etc/login.conf instead.])
4722                 elif test "x$withval" != "xno" ; then
4723                         if test ! -z "$external_path_file" ; then
4724                                 AC_MSG_WARN([
4725 --with-default-path=PATH will only be used if PATH is not defined in
4726 $external_path_file .])
4727                         fi
4728                         user_path="$withval"
4729                         SERVER_PATH_MSG="$withval"
4730                 fi
4731         ],
4732         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
4733                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
4734         else
4735                 if test ! -z "$external_path_file" ; then
4736                         AC_MSG_WARN([
4737 If PATH is defined in $external_path_file, ensure the path to scp is included,
4738 otherwise scp will not work.])
4739                 fi
4740                 AC_RUN_IFELSE(
4741                         [AC_LANG_PROGRAM([[
4742 /* find out what STDPATH is */
4743 #include <stdio.h>
4744 #ifdef HAVE_PATHS_H
4745 # include <paths.h>
4746 #endif
4747 #ifndef _PATH_STDPATH
4748 # ifdef _PATH_USERPATH  /* Irix */
4749 #  define _PATH_STDPATH _PATH_USERPATH
4750 # else
4751 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
4752 # endif
4753 #endif
4754 #include <sys/types.h>
4755 #include <sys/stat.h>
4756 #include <fcntl.h>
4757 #define DATA "conftest.stdpath"
4758                         ]], [[
4759         FILE *fd;
4760         int rc;
4761
4762         fd = fopen(DATA,"w");
4763         if(fd == NULL)
4764                 exit(1);
4765
4766         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
4767                 exit(1);
4768
4769         exit(0);
4770                 ]])],
4771                 [ user_path=`cat conftest.stdpath` ],
4772                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
4773                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
4774         )
4775 # make sure $bindir is in USER_PATH so scp will work
4776                 t_bindir="${bindir}"
4777                 while echo "${t_bindir}" | egrep '\$\{|NONE/' >/dev/null 2>&1; do
4778                         t_bindir=`eval echo ${t_bindir}`
4779                         case $t_bindir in
4780                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
4781                         esac
4782                         case $t_bindir in
4783                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
4784                         esac
4785                 done
4786                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
4787                 if test $? -ne 0  ; then
4788                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
4789                         if test $? -ne 0  ; then
4790                                 user_path=$user_path:$t_bindir
4791                                 AC_MSG_RESULT([Adding $t_bindir to USER_PATH so scp will work])
4792                         fi
4793                 fi
4794         fi ]
4795 )
4796 if test "x$external_path_file" != "x/etc/login.conf" ; then
4797         AC_DEFINE_UNQUOTED([USER_PATH], ["$user_path"], [Specify default $PATH])
4798         AC_SUBST([user_path])
4799 fi
4800
4801 # Set superuser path separately to user path
4802 AC_ARG_WITH([superuser-path],
4803         [  --with-superuser-path=  Specify different path for super-user],
4804         [
4805                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4806                     test "x${withval}" != "xyes"; then
4807                         AC_DEFINE_UNQUOTED([SUPERUSER_PATH], ["$withval"],
4808                                 [Define if you want a different $PATH
4809                                 for the superuser])
4810                         superuser_path=$withval
4811                 fi
4812         ]
4813 )
4814
4815
4816 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
4817 IPV4_IN6_HACK_MSG="no"
4818 AC_ARG_WITH(4in6,
4819         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
4820         [
4821                 if test "x$withval" != "xno" ; then
4822                         AC_MSG_RESULT([yes])
4823                         AC_DEFINE([IPV4_IN_IPV6], [1],
4824                                 [Detect IPv4 in IPv6 mapped addresses
4825                                 and treat as IPv4])
4826                         IPV4_IN6_HACK_MSG="yes"
4827                 else
4828                         AC_MSG_RESULT([no])
4829                 fi
4830         ], [
4831                 if test "x$inet6_default_4in6" = "xyes"; then
4832                         AC_MSG_RESULT([yes (default)])
4833                         AC_DEFINE([IPV4_IN_IPV6])
4834                         IPV4_IN6_HACK_MSG="yes"
4835                 else
4836                         AC_MSG_RESULT([no (default)])
4837                 fi
4838         ]
4839 )
4840
4841 # Whether to enable BSD auth support
4842 BSD_AUTH_MSG=no
4843 AC_ARG_WITH([bsd-auth],
4844         [  --with-bsd-auth         Enable BSD auth support],
4845         [
4846                 if test "x$withval" != "xno" ; then
4847                         AC_DEFINE([BSD_AUTH], [1],
4848                                 [Define if you have BSD auth support])
4849                         BSD_AUTH_MSG=yes
4850                 fi
4851         ]
4852 )
4853
4854 # Where to place sshd.pid
4855 piddir=/var/run
4856 # make sure the directory exists
4857 if test ! -d $piddir ; then
4858         piddir=`eval echo ${sysconfdir}`
4859         case $piddir in
4860                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
4861         esac
4862 fi
4863
4864 AC_ARG_WITH([pid-dir],
4865         [  --with-pid-dir=PATH     Specify location of sshd.pid file],
4866         [
4867                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4868                     test "x${withval}" != "xyes"; then
4869                         piddir=$withval
4870                         if test ! -d $piddir ; then
4871                         AC_MSG_WARN([** no $piddir directory on this system **])
4872                         fi
4873                 fi
4874         ]
4875 )
4876
4877 AC_DEFINE_UNQUOTED([_PATH_SSH_PIDDIR], ["$piddir"],
4878         [Specify location of ssh.pid])
4879 AC_SUBST([piddir])
4880
4881 dnl allow user to disable some login recording features
4882 AC_ARG_ENABLE([lastlog],
4883         [  --disable-lastlog       disable use of lastlog even if detected [no]],
4884         [
4885                 if test "x$enableval" = "xno" ; then
4886                         AC_DEFINE([DISABLE_LASTLOG])
4887                 fi
4888         ]
4889 )
4890 AC_ARG_ENABLE([utmp],
4891         [  --disable-utmp          disable use of utmp even if detected [no]],
4892         [
4893                 if test "x$enableval" = "xno" ; then
4894                         AC_DEFINE([DISABLE_UTMP])
4895                 fi
4896         ]
4897 )
4898 AC_ARG_ENABLE([utmpx],
4899         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4900         [
4901                 if test "x$enableval" = "xno" ; then
4902                         AC_DEFINE([DISABLE_UTMPX], [1],
4903                                 [Define if you don't want to use utmpx])
4904                 fi
4905         ]
4906 )
4907 AC_ARG_ENABLE([wtmp],
4908         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4909         [
4910                 if test "x$enableval" = "xno" ; then
4911                         AC_DEFINE([DISABLE_WTMP])
4912                 fi
4913         ]
4914 )
4915 AC_ARG_ENABLE([wtmpx],
4916         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4917         [
4918                 if test "x$enableval" = "xno" ; then
4919                         AC_DEFINE([DISABLE_WTMPX], [1],
4920                                 [Define if you don't want to use wtmpx])
4921                 fi
4922         ]
4923 )
4924 AC_ARG_ENABLE([libutil],
4925         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4926         [
4927                 if test "x$enableval" = "xno" ; then
4928                         AC_DEFINE([DISABLE_LOGIN])
4929                 fi
4930         ]
4931 )
4932 AC_ARG_ENABLE([pututline],
4933         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4934         [
4935                 if test "x$enableval" = "xno" ; then
4936                         AC_DEFINE([DISABLE_PUTUTLINE], [1],
4937                                 [Define if you don't want to use pututline()
4938                                 etc. to write [uw]tmp])
4939                 fi
4940         ]
4941 )
4942 AC_ARG_ENABLE([pututxline],
4943         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4944         [
4945                 if test "x$enableval" = "xno" ; then
4946                         AC_DEFINE([DISABLE_PUTUTXLINE], [1],
4947                                 [Define if you don't want to use pututxline()
4948                                 etc. to write [uw]tmpx])
4949                 fi
4950         ]
4951 )
4952 AC_ARG_WITH([lastlog],
4953   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4954         [
4955                 if test "x$withval" = "xno" ; then
4956                         AC_DEFINE([DISABLE_LASTLOG])
4957                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4958                         conf_lastlog_location=$withval
4959                 fi
4960         ]
4961 )
4962
4963 dnl lastlog, [uw]tmpx? detection
4964 dnl  NOTE: set the paths in the platform section to avoid the
4965 dnl   need for command-line parameters
4966 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4967
4968 dnl lastlog detection
4969 dnl  NOTE: the code itself will detect if lastlog is a directory
4970 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4971 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4972 #include <sys/types.h>
4973 #include <utmp.h>
4974 #ifdef HAVE_LASTLOG_H
4975 #  include <lastlog.h>
4976 #endif
4977 #ifdef HAVE_PATHS_H
4978 #  include <paths.h>
4979 #endif
4980 #ifdef HAVE_LOGIN_H
4981 # include <login.h>
4982 #endif
4983         ]], [[ char *lastlog = LASTLOG_FILE; ]])],
4984                 [ AC_MSG_RESULT([yes]) ],
4985                 [
4986                 AC_MSG_RESULT([no])
4987                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4988                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4989 #include <sys/types.h>
4990 #include <utmp.h>
4991 #ifdef HAVE_LASTLOG_H
4992 #  include <lastlog.h>
4993 #endif
4994 #ifdef HAVE_PATHS_H
4995 #  include <paths.h>
4996 #endif
4997                 ]], [[ char *lastlog = _PATH_LASTLOG; ]])],
4998                 [ AC_MSG_RESULT([yes]) ],
4999                 [
5000                         AC_MSG_RESULT([no])
5001                         system_lastlog_path=no
5002                 ])
5003 ])
5004
5005 if test -z "$conf_lastlog_location"; then
5006         if test x"$system_lastlog_path" = x"no" ; then
5007                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
5008                                 if (test -d "$f" || test -f "$f") ; then
5009                                         conf_lastlog_location=$f
5010                                 fi
5011                 done
5012                 if test -z "$conf_lastlog_location"; then
5013                         AC_MSG_WARN([** Cannot find lastlog **])
5014                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
5015                 fi
5016         fi
5017 fi
5018
5019 if test -n "$conf_lastlog_location"; then
5020         AC_DEFINE_UNQUOTED([CONF_LASTLOG_FILE], ["$conf_lastlog_location"],
5021                 [Define if you want to specify the path to your lastlog file])
5022 fi
5023
5024 dnl utmp detection
5025 AC_MSG_CHECKING([if your system defines UTMP_FILE])
5026 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5027 #include <sys/types.h>
5028 #include <utmp.h>
5029 #ifdef HAVE_PATHS_H
5030 #  include <paths.h>
5031 #endif
5032         ]], [[ char *utmp = UTMP_FILE; ]])],
5033         [ AC_MSG_RESULT([yes]) ],
5034         [ AC_MSG_RESULT([no])
5035           system_utmp_path=no
5036 ])
5037 if test -z "$conf_utmp_location"; then
5038         if test x"$system_utmp_path" = x"no" ; then
5039                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
5040                         if test -f $f ; then
5041                                 conf_utmp_location=$f
5042                         fi
5043                 done
5044                 if test -z "$conf_utmp_location"; then
5045                         AC_DEFINE([DISABLE_UTMP])
5046                 fi
5047         fi
5048 fi
5049 if test -n "$conf_utmp_location"; then
5050         AC_DEFINE_UNQUOTED([CONF_UTMP_FILE], ["$conf_utmp_location"],
5051                 [Define if you want to specify the path to your utmp file])
5052 fi
5053
5054 dnl wtmp detection
5055 AC_MSG_CHECKING([if your system defines WTMP_FILE])
5056 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5057 #include <sys/types.h>
5058 #include <utmp.h>
5059 #ifdef HAVE_PATHS_H
5060 #  include <paths.h>
5061 #endif
5062         ]], [[ char *wtmp = WTMP_FILE; ]])],
5063         [ AC_MSG_RESULT([yes]) ],
5064         [ AC_MSG_RESULT([no])
5065           system_wtmp_path=no
5066 ])
5067 if test -z "$conf_wtmp_location"; then
5068         if test x"$system_wtmp_path" = x"no" ; then
5069                 for f in /usr/adm/wtmp /var/log/wtmp; do
5070                         if test -f $f ; then
5071                                 conf_wtmp_location=$f
5072                         fi
5073                 done
5074                 if test -z "$conf_wtmp_location"; then
5075                         AC_DEFINE([DISABLE_WTMP])
5076                 fi
5077         fi
5078 fi
5079 if test -n "$conf_wtmp_location"; then
5080         AC_DEFINE_UNQUOTED([CONF_WTMP_FILE], ["$conf_wtmp_location"],
5081                 [Define if you want to specify the path to your wtmp file])
5082 fi
5083
5084 dnl wtmpx detection
5085 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
5086 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5087 #include <sys/types.h>
5088 #include <utmp.h>
5089 #ifdef HAVE_UTMPX_H
5090 #include <utmpx.h>
5091 #endif
5092 #ifdef HAVE_PATHS_H
5093 #  include <paths.h>
5094 #endif
5095         ]], [[ char *wtmpx = WTMPX_FILE; ]])],
5096         [ AC_MSG_RESULT([yes]) ],
5097         [ AC_MSG_RESULT([no])
5098           system_wtmpx_path=no
5099 ])
5100 if test -z "$conf_wtmpx_location"; then
5101         if test x"$system_wtmpx_path" = x"no" ; then
5102                 AC_DEFINE([DISABLE_WTMPX])
5103         fi
5104 else
5105         AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"],
5106                 [Define if you want to specify the path to your wtmpx file])
5107 fi
5108
5109
5110 if test ! -z "$blibpath" ; then
5111         LDFLAGS="$LDFLAGS $blibflags$blibpath"
5112         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
5113 fi
5114
5115 AC_CHECK_MEMBER([struct lastlog.ll_line], [], [
5116     if test x$SKIP_DISABLE_LASTLOG_DEFINE != "xyes" ; then
5117         AC_DEFINE([DISABLE_LASTLOG])
5118     fi
5119         ], [
5120 #ifdef HAVE_SYS_TYPES_H
5121 #include <sys/types.h>
5122 #endif
5123 #ifdef HAVE_UTMP_H
5124 #include <utmp.h>
5125 #endif
5126 #ifdef HAVE_UTMPX_H
5127 #include <utmpx.h>
5128 #endif
5129 #ifdef HAVE_LASTLOG_H
5130 #include <lastlog.h>
5131 #endif
5132         ])
5133
5134 AC_CHECK_MEMBER([struct utmp.ut_line], [], [
5135         AC_DEFINE([DISABLE_UTMP])
5136         AC_DEFINE([DISABLE_WTMP])
5137         ], [
5138 #ifdef HAVE_SYS_TYPES_H
5139 #include <sys/types.h>
5140 #endif
5141 #ifdef HAVE_UTMP_H
5142 #include <utmp.h>
5143 #endif
5144 #ifdef HAVE_UTMPX_H
5145 #include <utmpx.h>
5146 #endif
5147 #ifdef HAVE_LASTLOG_H
5148 #include <lastlog.h>
5149 #endif
5150         ])
5151
5152 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
5153 dnl Add now.
5154 CFLAGS="$CFLAGS $werror_flags"
5155
5156 if test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
5157         TEST_SSH_IPV6=no
5158 else
5159         TEST_SSH_IPV6=yes
5160 fi
5161 AC_CHECK_DECL([BROKEN_GETADDRINFO],  [TEST_SSH_IPV6=no])
5162 AC_SUBST([TEST_SSH_IPV6], [$TEST_SSH_IPV6])
5163 AC_SUBST([TEST_SSH_UTF8], [$TEST_SSH_UTF8])
5164 AC_SUBST([TEST_MALLOC_OPTIONS], [$TEST_MALLOC_OPTIONS])
5165 AC_SUBST([UNSUPPORTED_ALGORITHMS], [$unsupported_algorithms])
5166 AC_SUBST([DEPEND], [$(cat $srcdir/.depend)])
5167
5168 CFLAGS="${CFLAGS} ${CFLAGS_AFTER}"
5169 LDFLAGS="${LDFLAGS} ${LDFLAGS_AFTER}"
5170
5171 AC_EXEEXT
5172 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
5173         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
5174         survey.sh])
5175 AC_OUTPUT
5176
5177 # Print summary of options
5178
5179 # Someone please show me a better way :)
5180 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
5181 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
5182 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
5183 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
5184 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
5185 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
5186 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
5187 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
5188 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
5189 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
5190
5191 echo ""
5192 echo "OpenSSH has been configured with the following options:"
5193 echo "                     User binaries: $B"
5194 echo "                   System binaries: $C"
5195 echo "               Configuration files: $D"
5196 echo "                   Askpass program: $E"
5197 echo "                      Manual pages: $F"
5198 echo "                          PID file: $G"
5199 echo "  Privilege separation chroot path: $H"
5200 if test "x$external_path_file" = "x/etc/login.conf" ; then
5201 echo "   At runtime, sshd will use the path defined in $external_path_file"
5202 echo "   Make sure the path to scp is present, otherwise scp will not work"
5203 else
5204 echo "            sshd default user PATH: $I"
5205         if test ! -z "$external_path_file"; then
5206 echo "   (If PATH is set in $external_path_file it will be used instead. If"
5207 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
5208         fi
5209 fi
5210 if test ! -z "$superuser_path" ; then
5211 echo "          sshd superuser user PATH: $J"
5212 fi
5213 echo "                    Manpage format: $MANTYPE"
5214 echo "                       PAM support: $PAM_MSG"
5215 echo "                   OSF SIA support: $SIA_MSG"
5216 echo "                 KerberosV support: $KRB5_MSG"
5217 echo "                   SELinux support: $SELINUX_MSG"
5218 echo "                     S/KEY support: $SKEY_MSG"
5219 echo "              MD5 password support: $MD5_MSG"
5220 echo "                   libedit support: $LIBEDIT_MSG"
5221 echo "                   libldns support: $LDNS_MSG"
5222 echo "  Solaris process contract support: $SPC_MSG"
5223 echo "           Solaris project support: $SP_MSG"
5224 echo "         Solaris privilege support: $SPP_MSG"
5225 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
5226 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
5227 echo "                  BSD Auth support: $BSD_AUTH_MSG"
5228 echo "              Random number source: $RAND_MSG"
5229 echo "             Privsep sandbox style: $SANDBOX_STYLE"
5230
5231 echo ""
5232
5233 echo "              Host: ${host}"
5234 echo "          Compiler: ${CC}"
5235 echo "    Compiler flags: ${CFLAGS}"
5236 echo "Preprocessor flags: ${CPPFLAGS}"
5237 echo "      Linker flags: ${LDFLAGS}"
5238 echo "         Libraries: ${LIBS}"
5239 if test ! -z "${SSHDLIBS}"; then
5240 echo "         +for sshd: ${SSHDLIBS}"
5241 fi
5242 if test ! -z "${SSHLIBS}"; then
5243 echo "          +for ssh: ${SSHLIBS}"
5244 fi
5245
5246 echo ""
5247
5248 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
5249         echo "SVR4 style packages are supported with \"make package\""
5250         echo ""
5251 fi
5252
5253 if test "x$PAM_MSG" = "xyes" ; then
5254         echo "PAM is enabled. You may need to install a PAM control file "
5255         echo "for sshd, otherwise password authentication may fail. "
5256         echo "Example PAM control files can be found in the contrib/ "
5257         echo "subdirectory"
5258         echo ""
5259 fi
5260
5261 if test ! -z "$NO_PEERCHECK" ; then
5262         echo "WARNING: the operating system that you are using does not"
5263         echo "appear to support getpeereid(), getpeerucred() or the"
5264         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
5265         echo "enforce security checks to prevent unauthorised connections to"
5266         echo "ssh-agent. Their absence increases the risk that a malicious"
5267         echo "user can connect to your agent."
5268         echo ""
5269 fi
5270
5271 if test "$AUDIT_MODULE" = "bsm" ; then
5272         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
5273         echo "See the Solaris section in README.platform for details."
5274 fi