configure.ac

   1 #
   2 # Copyright (c) 1999-2004 Damien Miller
   3 #
   4 # Permission to use, copy, modify, and distribute this software for any
   5 # purpose with or without fee is hereby granted, provided that the above
   6 # copyright notice and this permission notice appear in all copies.
   7 #
   8 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15
  16 AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
  17 AC_REVISION($Revision: 1.583 $)
  18 AC_CONFIG_SRCDIR([ssh.c])
  19 AC_LANG([C])
  20
  21 AC_CONFIG_HEADER([config.h])
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PROG_MKDIR_P
  33 AC_CHECK_TOOLS([AR], [ar])
  34 AC_PATH_PROG([CAT], [cat])
  35 AC_PATH_PROG([KILL], [kill])
  36 AC_PATH_PROG([SED], [sed])
  37 AC_PATH_PROG([ENT], [ent])
  38 AC_SUBST([ENT])
  39 AC_PATH_PROG([TEST_MINUS_S_SH], [bash])
  40 AC_PATH_PROG([TEST_MINUS_S_SH], [ksh])
  41 AC_PATH_PROG([TEST_MINUS_S_SH], [sh])
  42 AC_PATH_PROG([SH], [sh])
  43 AC_PATH_PROG([GROFF], [groff])
  44 AC_PATH_PROG([NROFF], [nroff])
  45 AC_PATH_PROG([MANDOC], [mandoc])
  46 AC_SUBST([TEST_SHELL], [sh])
  47
  48 dnl select manpage formatter
  49 if test "x$MANDOC" != "x" ; then
  50         MANFMT="$MANDOC"
  51 elif test "x$NROFF" != "x" ; then
  52         MANFMT="$NROFF -mandoc"
  53 elif test "x$GROFF" != "x" ; then
  54         MANFMT="$GROFF -mandoc -Tascii"
  55 else
  56         AC_MSG_WARN([no manpage formatted found])
  57         MANFMT="false"
  58 fi
  59 AC_SUBST([MANFMT])
  60
  61 dnl for buildpkg.sh
  62 AC_PATH_PROG([PATH_GROUPADD_PROG], [groupadd], [groupadd],
  63         [/usr/sbin${PATH_SEPARATOR}/etc])
  64 AC_PATH_PROG([PATH_USERADD_PROG], [useradd], [useradd],
  65         [/usr/sbin${PATH_SEPARATOR}/etc])
  66 AC_CHECK_PROG([MAKE_PACKAGE_SUPPORTED], [pkgmk], [yes], [no])
  67 if test -x /sbin/sh; then
  68         AC_SUBST([STARTUP_SCRIPT_SHELL], [/sbin/sh])
  69 else
  70         AC_SUBST([STARTUP_SCRIPT_SHELL], [/bin/sh])
  71 fi
  72
  73 # System features
  74 AC_SYS_LARGEFILE
  75
  76 if test -z "$AR" ; then
  77         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  78 fi
  79
  80 AC_PATH_PROG([PATH_PASSWD_PROG], [passwd])
  81 if test ! -z "$PATH_PASSWD_PROG" ; then
  82         AC_DEFINE_UNQUOTED([_PATH_PASSWD_PROG], ["$PATH_PASSWD_PROG"],
  83                 [Full path of your "passwd" program])
  84 fi
  85
  86 dnl Since autoconf doesn't support it very well,  we no longer allow users to
  87 dnl override LD, however keeping the hook here for now in case there's a use
  88 dnl use case we overlooked and someone needs to re-enable it.  Unless a good
  89 dnl reason is found we'll be removing this in future.
  90 LD="$CC"
  91 AC_SUBST([LD])
  92
  93 AC_C_INLINE
  94
  95 AC_CHECK_DECL([LLONG_MAX], [have_llong_max=1], , [#include <limits.h>])
  96 AC_CHECK_DECL([SYSTR_POLICY_KILL], [have_systr_policy_kill=1], , [
  97         #include <sys/types.h>
  98         #include <sys/param.h>
  99         #include <dev/systrace.h>
 100 ])
 101 AC_CHECK_DECL([RLIMIT_NPROC],
 102     [AC_DEFINE([HAVE_RLIMIT_NPROC], [], [sys/resource.h has RLIMIT_NPROC])], , [
 103         #include <sys/types.h>
 104         #include <sys/resource.h>
 105 ])
 106 AC_CHECK_DECL([PR_SET_NO_NEW_PRIVS], [have_linux_no_new_privs=1], , [
 107         #include <sys/types.h>
 108         #include <linux/prctl.h>
 109 ])
 110
 111 openssl=yes
 112 AC_ARG_WITH([openssl],
 113         [  --without-openssl       Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL** ],
 114         [  if test "x$withval" = "xno" ; then
 115                 openssl=no
 116            fi
 117         ]
 118 )
 119 AC_MSG_CHECKING([whether OpenSSL will be used for cryptography])
 120 if test "x$openssl" = "xyes" ; then
 121         AC_MSG_RESULT([yes])
 122         AC_DEFINE_UNQUOTED([WITH_OPENSSL], [1], [use libcrypto for cryptography])
 123 else
 124         AC_MSG_RESULT([no])
 125 fi
 126
 127 use_stack_protector=1
 128 use_toolchain_hardening=1
 129 AC_ARG_WITH([stackprotect],
 130     [  --without-stackprotect  Don't use compiler's stack protection], [
 131     if test "x$withval" = "xno"; then
 132         use_stack_protector=0
 133     fi ])
 134 AC_ARG_WITH([hardening],
 135     [  --without-hardening     Don't use toolchain hardening flags], [
 136     if test "x$withval" = "xno"; then
 137         use_toolchain_hardening=0
 138     fi ])
 139
 140 # We use -Werror for the tests only so that we catch warnings like "this is
 141 # on by default" for things like -fPIE.
 142 AC_MSG_CHECKING([if $CC supports -Werror])
 143 saved_CFLAGS="$CFLAGS"
 144 CFLAGS="$CFLAGS -Werror"
 145 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[int main(void) { return 0; }]])],
 146         [ AC_MSG_RESULT([yes])
 147           WERROR="-Werror"],
 148         [ AC_MSG_RESULT([no])
 149           WERROR="" ]
 150 )
 151 CFLAGS="$saved_CFLAGS"
 152
 153 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 154         OSSH_CHECK_CFLAG_COMPILE([-pipe])
 155         OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments])
 156         OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option])
 157         OSSH_CHECK_CFLAG_COMPILE([-Wall])
 158         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-arith])
 159         OSSH_CHECK_CFLAG_COMPILE([-Wuninitialized])
 160         OSSH_CHECK_CFLAG_COMPILE([-Wsign-compare])
 161         OSSH_CHECK_CFLAG_COMPILE([-Wformat-security])
 162         OSSH_CHECK_CFLAG_COMPILE([-Wsizeof-pointer-memaccess])
 163         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-sign], [-Wno-pointer-sign])
 164         OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
 165         OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
 166     if test "x$use_toolchain_hardening" = "x1"; then
 167         # Cygwin GCC 7.x allows thunking on the CLI, but produces non-working
 168         # code.  Unfortunately you only notice this at link time.
 169         case "$host" in
 170         *-*-cygwin*) ;;
 171         *)
 172             OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc
 173             OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc
 174             ;;
 175         esac
 176         OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
 177         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])
 178         OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
 179         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
 180         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
 181         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,noexecstack])
 182         # NB. -ftrapv expects certain support functions to be present in
 183         # the compiler library (libgcc or similar) to detect integer operations
 184         # that can overflow. We must check that the result of enabling it
 185         # actually links. The test program compiled/linked includes a number
 186         # of integer operations that should exercise this.
 187         OSSH_CHECK_CFLAG_LINK([-ftrapv])
 188     fi
 189         AC_MSG_CHECKING([gcc version])
 190         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 191         case $GCC_VER in
 192                 1.*) no_attrib_nonnull=1 ;;
 193                 2.8* | 2.9*)
 194                      no_attrib_nonnull=1
 195                      ;;
 196                 2.*) no_attrib_nonnull=1 ;;
 197                 *) ;;
 198         esac
 199         AC_MSG_RESULT([$GCC_VER])
 200
 201         AC_MSG_CHECKING([if $CC accepts -fno-builtin-memset])
 202         saved_CFLAGS="$CFLAGS"
 203         CFLAGS="$CFLAGS -fno-builtin-memset"
 204         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <string.h> ]],
 205                         [[ char b[10]; memset(b, 0, sizeof(b)); ]])],
 206                 [ AC_MSG_RESULT([yes]) ],
 207                 [ AC_MSG_RESULT([no])
 208                   CFLAGS="$saved_CFLAGS" ]
 209         )
 210
 211         # -fstack-protector-all doesn't always work for some GCC versions
 212         # and/or platforms, so we test if we can.  If it's not supported
 213         # on a given platform gcc will emit a warning so we use -Werror.
 214         if test "x$use_stack_protector" = "x1"; then
 215             for t in -fstack-protector-strong -fstack-protector-all \
 216                     -fstack-protector; do
 217                 AC_MSG_CHECKING([if $CC supports $t])
 218                 saved_CFLAGS="$CFLAGS"
 219                 saved_LDFLAGS="$LDFLAGS"
 220                 CFLAGS="$CFLAGS $t -Werror"
 221                 LDFLAGS="$LDFLAGS $t -Werror"
 222                 AC_LINK_IFELSE(
 223                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 224                         [[
 225         char x[256];
 226         snprintf(x, sizeof(x), "XXX");
 227                          ]])],
 228                     [ AC_MSG_RESULT([yes])
 229                       CFLAGS="$saved_CFLAGS $t"
 230                       LDFLAGS="$saved_LDFLAGS $t"
 231                       AC_MSG_CHECKING([if $t works])
 232                       AC_RUN_IFELSE(
 233                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 234                         [[
 235         char x[256];
 236         snprintf(x, sizeof(x), "XXX");
 237                         ]])],
 238                         [ AC_MSG_RESULT([yes])
 239                           break ],
 240                         [ AC_MSG_RESULT([no]) ],
 241                         [ AC_MSG_WARN([cross compiling: cannot test])
 242                           break ]
 243                       )
 244                     ],
 245                     [ AC_MSG_RESULT([no]) ]
 246                 )
 247                 CFLAGS="$saved_CFLAGS"
 248                 LDFLAGS="$saved_LDFLAGS"
 249             done
 250         fi
 251
 252         if test -z "$have_llong_max"; then
 253                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 254                 unset ac_cv_have_decl_LLONG_MAX
 255                 saved_CFLAGS="$CFLAGS"
 256                 CFLAGS="$CFLAGS -std=gnu99"
 257                 AC_CHECK_DECL([LLONG_MAX],
 258                     [have_llong_max=1],
 259                     [CFLAGS="$saved_CFLAGS"],
 260                     [#include <limits.h>]
 261                 )
 262         fi
 263 fi
 264
 265 AC_MSG_CHECKING([if compiler allows __attribute__ on return types])
 266 AC_COMPILE_IFELSE(
 267     [AC_LANG_PROGRAM([[
 268 #include <stdlib.h>
 269 __attribute__((__unused__)) static void foo(void){return;}]],
 270     [[ exit(0); ]])],
 271     [ AC_MSG_RESULT([yes]) ],
 272     [ AC_MSG_RESULT([no])
 273       AC_DEFINE(NO_ATTRIBUTE_ON_RETURN_TYPE, 1,
 274          [compiler does not accept __attribute__ on return types]) ]
 275 )
 276
 277 AC_MSG_CHECKING([if compiler allows __attribute__ prototype args])
 278 AC_COMPILE_IFELSE(
 279     [AC_LANG_PROGRAM([[
 280 #include <stdlib.h>
 281 typedef void foo(const char *, ...) __attribute__((format(printf, 1, 2)));]],
 282     [[ exit(0); ]])],
 283     [ AC_MSG_RESULT([yes]) ],
 284     [ AC_MSG_RESULT([no])
 285       AC_DEFINE(NO_ATTRIBUTE_ON_PROTOTYPE_ARGS, 1,
 286          [compiler does not accept __attribute__ on prototype args]) ]
 287 )
 288
 289 if test "x$no_attrib_nonnull" != "x1" ; then
 290         AC_DEFINE([HAVE_ATTRIBUTE__NONNULL__], [1], [Have attribute nonnull])
 291 fi
 292
 293 AC_ARG_WITH([rpath],
 294         [  --without-rpath         Disable auto-added -R linker paths],
 295         [
 296                 if test "x$withval" = "xno" ; then
 297                         need_dash_r=""
 298                 fi
 299                 if test "x$withval" = "xyes" ; then
 300                         need_dash_r=1
 301                 fi
 302         ]
 303 )
 304
 305 # Allow user to specify flags
 306 AC_ARG_WITH([cflags],
 307         [  --with-cflags           Specify additional flags to pass to compiler],
 308         [
 309                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 310                     test "x${withval}" != "xyes"; then
 311                         CFLAGS="$CFLAGS $withval"
 312                 fi
 313         ]
 314 )
 315
 316 AC_ARG_WITH([cflags-after],
 317         [  --with-cflags-after     Specify additional flags to pass to compiler after configure],
 318         [
 319                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 320                     test "x${withval}" != "xyes"; then
 321                         CFLAGS_AFTER="$withval"
 322                 fi
 323         ]
 324 )
 325 AC_ARG_WITH([cppflags],
 326         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 327         [
 328                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 329                     test "x${withval}" != "xyes"; then
 330                         CPPFLAGS="$CPPFLAGS $withval"
 331                 fi
 332         ]
 333 )
 334 AC_ARG_WITH([ldflags],
 335         [  --with-ldflags          Specify additional flags to pass to linker],
 336         [
 337                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 338                     test "x${withval}" != "xyes"; then
 339                         LDFLAGS="$LDFLAGS $withval"
 340                 fi
 341         ]
 342 )
 343 AC_ARG_WITH([ldflags-after],
 344         [  --with-ldflags-after    Specify additional flags to pass to linker after configure],
 345         [
 346                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 347                     test "x${withval}" != "xyes"; then
 348                         LDFLAGS_AFTER="$withval"
 349                 fi
 350         ]
 351 )
 352 AC_ARG_WITH([libs],
 353         [  --with-libs             Specify additional libraries to link with],
 354         [
 355                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 356                     test "x${withval}" != "xyes"; then
 357                         LIBS="$LIBS $withval"
 358                 fi
 359         ]
 360 )
 361 AC_ARG_WITH([Werror],
 362         [  --with-Werror           Build main code with -Werror],
 363         [
 364                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 365                         werror_flags="-Werror"
 366                         if test "x${withval}" != "xyes"; then
 367                                 werror_flags="$withval"
 368                         fi
 369                 fi
 370         ]
 371 )
 372
 373 AC_CHECK_HEADERS([ \
 374         blf.h \
 375         bstring.h \
 376         crypt.h \
 377         crypto/sha2.h \
 378         dirent.h \
 379         endian.h \
 380         elf.h \
 381         err.h \
 382         features.h \
 383         fcntl.h \
 384         floatingpoint.h \
 385         getopt.h \
 386         glob.h \
 387         ia.h \
 388         iaf.h \
 389         ifaddrs.h \
 390         inttypes.h \
 391         langinfo.h \
 392         limits.h \
 393         locale.h \
 394         login.h \
 395         maillock.h \
 396         ndir.h \
 397         net/if_tun.h \
 398         netdb.h \
 399         netgroup.h \
 400         pam/pam_appl.h \
 401         paths.h \
 402         poll.h \
 403         pty.h \
 404         readpassphrase.h \
 405         rpc/types.h \
 406         security/pam_appl.h \
 407         sha2.h \
 408         shadow.h \
 409         stddef.h \
 410         stdint.h \
 411         string.h \
 412         strings.h \
 413         sys/bitypes.h \
 414         sys/bsdtty.h \
 415         sys/cdefs.h \
 416         sys/dir.h \
 417         sys/file.h \
 418         sys/mman.h \
 419         sys/label.h \
 420         sys/ndir.h \
 421         sys/poll.h \
 422         sys/prctl.h \
 423         sys/pstat.h \
 424         sys/ptrace.h \
 425         sys/random.h \
 426         sys/select.h \
 427         sys/stat.h \
 428         sys/stream.h \
 429         sys/stropts.h \
 430         sys/strtio.h \
 431         sys/statvfs.h \
 432         sys/sysmacros.h \
 433         sys/time.h \
 434         sys/timers.h \
 435         sys/vfs.h \
 436         time.h \
 437         tmpdir.h \
 438         ttyent.h \
 439         ucred.h \
 440         unistd.h \
 441         usersec.h \
 442         util.h \
 443         utime.h \
 444         utmp.h \
 445         utmpx.h \
 446         vis.h \
 447         wchar.h \
 448 ])
 449
 450 # On some platforms (eg SunOS4) sys/audit.h requires sys/[time|types|label.h]
 451 # to be included first.
 452 AC_CHECK_HEADERS([sys/audit.h], [], [], [
 453 #ifdef HAVE_SYS_TIME_H
 454 # include <sys/time.h>
 455 #endif
 456 #ifdef HAVE_SYS_TYPES_H
 457 # include <sys/types.h>
 458 #endif
 459 #ifdef HAVE_SYS_LABEL_H
 460 # include <sys/label.h>
 461 #endif
 462 ])
 463
 464 # sys/capsicum.h requires sys/types.h
 465 AC_CHECK_HEADERS([sys/capsicum.h], [], [], [
 466 #ifdef HAVE_SYS_TYPES_H
 467 # include <sys/types.h>
 468 #endif
 469 ])
 470
 471 # net/route.h requires sys/socket.h and sys/types.h.
 472 # sys/sysctl.h also requires sys/param.h
 473 AC_CHECK_HEADERS([net/route.h sys/sysctl.h], [], [], [
 474 #ifdef HAVE_SYS_TYPES_H
 475 # include <sys/types.h>
 476 #endif
 477 #include <sys/param.h>
 478 #include <sys/socket.h>
 479 ])
 480
 481 # lastlog.h requires sys/time.h to be included first on Solaris
 482 AC_CHECK_HEADERS([lastlog.h], [], [], [
 483 #ifdef HAVE_SYS_TIME_H
 484 # include <sys/time.h>
 485 #endif
 486 ])
 487
 488 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 489 AC_CHECK_HEADERS([sys/ptms.h], [], [], [
 490 #ifdef HAVE_SYS_STREAM_H
 491 # include <sys/stream.h>
 492 #endif
 493 ])
 494
 495 # login_cap.h requires sys/types.h on NetBSD
 496 AC_CHECK_HEADERS([login_cap.h], [], [], [
 497 #include <sys/types.h>
 498 ])
 499
 500 # older BSDs need sys/param.h before sys/mount.h
 501 AC_CHECK_HEADERS([sys/mount.h], [], [], [
 502 #include <sys/param.h>
 503 ])
 504
 505 # Android requires sys/socket.h to be included before sys/un.h
 506 AC_CHECK_HEADERS([sys/un.h], [], [], [
 507 #include <sys/types.h>
 508 #include <sys/socket.h>
 509 ])
 510
 511 # Messages for features tested for in target-specific section
 512 SIA_MSG="no"
 513 SPC_MSG="no"
 514 SP_MSG="no"
 515 SPP_MSG="no"
 516
 517 # Support for Solaris/Illumos privileges (this test is used by both
 518 # the --with-solaris-privs option and --with-sandbox=solaris).
 519 SOLARIS_PRIVS="no"
 520
 521 # Check for some target-specific stuff
 522 case "$host" in
 523 *-*-aix*)
 524         # Some versions of VAC won't allow macro redefinitions at
 525         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 526         # particularly with older versions of vac or xlc.
 527         # It also throws errors about null macro arguments, but these are
 528         # not fatal.
 529         AC_MSG_CHECKING([if compiler allows macro redefinitions])
 530         AC_COMPILE_IFELSE(
 531             [AC_LANG_PROGRAM([[
 532 #define testmacro foo
 533 #define testmacro bar]],
 534             [[ exit(0); ]])],
 535             [ AC_MSG_RESULT([yes]) ],
 536             [ AC_MSG_RESULT([no])
 537               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 538               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 539               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 540             ]
 541         )
 542
 543         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 544         if (test -z "$blibpath"); then
 545                 blibpath="/usr/lib:/lib"
 546         fi
 547         saved_LDFLAGS="$LDFLAGS"
 548         if test "$GCC" = "yes"; then
 549                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 550         else
 551                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 552         fi
 553         for tryflags in $flags ;do
 554                 if (test -z "$blibflags"); then
 555                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 556                         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
 557                         [blibflags=$tryflags], [])
 558                 fi
 559         done
 560         if (test -z "$blibflags"); then
 561                 AC_MSG_RESULT([not found])
 562                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 563         else
 564                 AC_MSG_RESULT([$blibflags])
 565         fi
 566         LDFLAGS="$saved_LDFLAGS"
 567         dnl Check for authenticate.  Might be in libs.a on older AIXes
 568         AC_CHECK_FUNC([authenticate], [AC_DEFINE([WITH_AIXAUTHENTICATE], [1],
 569                 [Define if you want to enable AIX4's authenticate function])],
 570                 [AC_CHECK_LIB([s], [authenticate],
 571                         [ AC_DEFINE([WITH_AIXAUTHENTICATE])
 572                                 LIBS="$LIBS -ls"
 573                         ])
 574                 ])
 575         dnl Check for various auth function declarations in headers.
 576         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 577             passwdexpired, setauthdb], , , [#include <usersec.h>])
 578         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 579         AC_CHECK_DECLS([loginfailed],
 580             [AC_MSG_CHECKING([if loginfailed takes 4 arguments])
 581             AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <usersec.h> ]],
 582                 [[ (void)loginfailed("user","host","tty",0); ]])],
 583                 [AC_MSG_RESULT([yes])
 584                 AC_DEFINE([AIX_LOGINFAILED_4ARG], [1],
 585                         [Define if your AIX loginfailed() function
 586                         takes 4 arguments (AIX >= 5.2)])], [AC_MSG_RESULT([no])
 587             ])],
 588             [],
 589             [#include <usersec.h>]
 590         )
 591         AC_CHECK_FUNCS([getgrset setauthdb])
 592         AC_CHECK_DECL([F_CLOSEM],
 593             AC_DEFINE([HAVE_FCNTL_CLOSEM], [1], [Use F_CLOSEM fcntl for closefrom]),
 594             [],
 595             [ #include <limits.h>
 596               #include <fcntl.h> ]
 597         )
 598         check_for_aix_broken_getaddrinfo=1
 599         AC_DEFINE([BROKEN_REALPATH], [1], [Define if you have a broken realpath.])
 600         AC_DEFINE([SETEUID_BREAKS_SETUID], [1],
 601             [Define if your platform breaks doing a seteuid before a setuid])
 602         AC_DEFINE([BROKEN_SETREUID], [1], [Define if your setreuid() is broken])
 603         AC_DEFINE([BROKEN_SETREGID], [1], [Define if your setregid() is broken])
 604         dnl AIX handles lastlog as part of its login message
 605         AC_DEFINE([DISABLE_LASTLOG], [1], [Define if you don't want to use lastlog])
 606         AC_DEFINE([LOGIN_NEEDS_UTMPX], [1],
 607                 [Some systems need a utmpx entry for /bin/login to work])
 608         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 609                 [Define to a Set Process Title type if your system is
 610                 supported by bsd-setproctitle.c])
 611         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 612             [AIX 5.2 and 5.3 (and presumably newer) require this])
 613         AC_DEFINE([PTY_ZEROREAD], [1], [read(1) can return 0 for a non-closed fd])
 614         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 615         AC_DEFINE([BROKEN_STRNDUP], 1, [strndup broken, see APAR IY61211])
 616         AC_DEFINE([BROKEN_STRNLEN], 1, [strnlen broken, see APAR IY62551])
 617         ;;
 618 *-*-android*)
 619         AC_DEFINE([DISABLE_UTMP], [1], [Define if you don't want to use utmp])
 620         AC_DEFINE([DISABLE_WTMP], [1], [Define if you don't want to use wtmp])
 621         ;;
 622 *-*-cygwin*)
 623         check_for_libcrypt_later=1
 624         LIBS="$LIBS /usr/lib/textreadmode.o"
 625         AC_DEFINE([HAVE_CYGWIN], [1], [Define if you are on Cygwin])
 626         AC_DEFINE([USE_PIPES], [1], [Use PIPES instead of a socketpair()])
 627         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
 628                 [Define to disable UID restoration test])
 629         AC_DEFINE([DISABLE_SHADOW], [1],
 630                 [Define if you want to disable shadow passwords])
 631         AC_DEFINE([NO_X11_UNIX_SOCKETS], [1],
 632                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 633         AC_DEFINE([DISABLE_FD_PASSING], [1],
 634                 [Define if your platform needs to skip post auth
 635                 file descriptor passing])
 636         AC_DEFINE([SSH_IOBUFSZ], [65535], [Windows is sensitive to read buffer size])
 637         AC_DEFINE([FILESYSTEM_NO_BACKSLASH], [1], [File names may not contain backslash characters])
 638         # Cygwin defines optargs, optargs as declspec(dllimport) for historical
 639         # reasons which cause compile warnings, so we disable those warnings.
 640         OSSH_CHECK_CFLAG_COMPILE([-Wno-attributes])
 641         ;;
 642 *-*-dgux*)
 643         AC_DEFINE([IP_TOS_IS_BROKEN], [1],
 644                 [Define if your system choked on IP TOS setting])
 645         AC_DEFINE([SETEUID_BREAKS_SETUID])
 646         AC_DEFINE([BROKEN_SETREUID])
 647         AC_DEFINE([BROKEN_SETREGID])
 648         ;;
 649 *-*-darwin*)
 650         use_pie=auto
 651         AC_MSG_CHECKING([if we have working getaddrinfo])
 652         AC_RUN_IFELSE([AC_LANG_SOURCE([[ #include <mach-o/dyld.h>
 653 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 654                 exit(0);
 655         else
 656                 exit(1);
 657 }
 658                         ]])],
 659         [AC_MSG_RESULT([working])],
 660         [AC_MSG_RESULT([buggy])
 661         AC_DEFINE([BROKEN_GETADDRINFO], [1],
 662                 [getaddrinfo is broken (if present)])
 663         ],
 664         [AC_MSG_RESULT([assume it is working])])
 665         AC_DEFINE([SETEUID_BREAKS_SETUID])
 666         AC_DEFINE([BROKEN_SETREUID])
 667         AC_DEFINE([BROKEN_SETREGID])
 668         AC_DEFINE([BROKEN_GLOB], [1], [OS X glob does not do what we expect])
 669         AC_DEFINE_UNQUOTED([BIND_8_COMPAT], [1],
 670                 [Define if your resolver libs need this for getrrsetbyname])
 671         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 672         AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 673             [Use tunnel device compatibility to OpenBSD])
 674         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 675             [Prepend the address family to IP tunnel traffic])
 676         m4_pattern_allow([AU_IPv])
 677         AC_CHECK_DECL([AU_IPv4], [],
 678             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 679             [#include <bsm/audit.h>]
 680         AC_DEFINE([LASTLOG_WRITE_PUTUTXLINE], [1],
 681             [Define if pututxline updates lastlog too])
 682         )
 683         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 684                 [Define to a Set Process Title type if your system is
 685                 supported by bsd-setproctitle.c])
 686         AC_CHECK_FUNCS([sandbox_init])
 687         AC_CHECK_HEADERS([sandbox.h])
 688         AC_CHECK_LIB([sandbox], [sandbox_apply], [
 689             SSHDLIBS="$SSHDLIBS -lsandbox"
 690         ])
 691         ;;
 692 *-*-dragonfly*)
 693         SSHDLIBS="$SSHDLIBS -lcrypt"
 694         TEST_MALLOC_OPTIONS="AFGJPRX"
 695         ;;
 696 *-*-haiku*)
 697         LIBS="$LIBS -lbsd "
 698         AC_CHECK_LIB([network], [socket])
 699         AC_DEFINE([HAVE_U_INT64_T])
 700         MANTYPE=man
 701         ;;
 702 *-*-hpux*)
 703         # first we define all of the options common to all HP-UX releases
 704         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 705         IPADDR_IN_DISPLAY=yes
 706         AC_DEFINE([USE_PIPES])
 707         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 708         AC_DEFINE([LOCKED_PASSWD_STRING], ["*"],
 709                 [String used in /etc/passwd to denote locked account])
 710         AC_DEFINE([SPT_TYPE], [SPT_PSTAT])
 711         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 712         maildir="/var/mail"
 713         LIBS="$LIBS -lsec"
 714         AC_CHECK_LIB([xnet], [t_error], ,
 715             [AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***])])
 716
 717         # next, we define all of the options specific to major releases
 718         case "$host" in
 719         *-*-hpux10*)
 720                 if test -z "$GCC"; then
 721                         CFLAGS="$CFLAGS -Ae"
 722                 fi
 723                 ;;
 724         *-*-hpux11*)
 725                 AC_DEFINE([PAM_SUN_CODEBASE], [1],
 726                         [Define if you are using Solaris-derived PAM which
 727                         passes pam_messages to the conversation function
 728                         with an extra level of indirection])
 729                 AC_DEFINE([DISABLE_UTMP], [1],
 730                         [Define if you don't want to use utmp])
 731                 AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 732                 check_for_hpux_broken_getaddrinfo=1
 733                 check_for_conflicting_getspnam=1
 734                 ;;
 735         esac
 736
 737         # lastly, we define options specific to minor releases
 738         case "$host" in
 739         *-*-hpux10.26)
 740                 AC_DEFINE([HAVE_SECUREWARE], [1],
 741                         [Define if you have SecureWare-based
 742                         protected password database])
 743                 disable_ptmx_check=yes
 744                 LIBS="$LIBS -lsecpw"
 745                 ;;
 746         esac
 747         ;;
 748 *-*-irix5*)
 749         PATH="$PATH:/usr/etc"
 750         AC_DEFINE([BROKEN_INET_NTOA], [1],
 751                 [Define if you system's inet_ntoa is busted
 752                 (e.g. Irix gcc issue)])
 753         AC_DEFINE([SETEUID_BREAKS_SETUID])
 754         AC_DEFINE([BROKEN_SETREUID])
 755         AC_DEFINE([BROKEN_SETREGID])
 756         AC_DEFINE([WITH_ABBREV_NO_TTY], [1],
 757                 [Define if you shouldn't strip 'tty' from your
 758                 ttyname in [uw]tmp])
 759         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 760         ;;
 761 *-*-irix6*)
 762         PATH="$PATH:/usr/etc"
 763         AC_DEFINE([WITH_IRIX_ARRAY], [1],
 764                 [Define if you have/want arrays
 765                 (cluster-wide session management, not C arrays)])
 766         AC_DEFINE([WITH_IRIX_PROJECT], [1],
 767                 [Define if you want IRIX project management])
 768         AC_DEFINE([WITH_IRIX_AUDIT], [1],
 769                 [Define if you want IRIX audit trails])
 770         AC_CHECK_FUNC([jlimit_startjob], [AC_DEFINE([WITH_IRIX_JOBS], [1],
 771                 [Define if you want IRIX kernel jobs])])
 772         AC_DEFINE([BROKEN_INET_NTOA])
 773         AC_DEFINE([SETEUID_BREAKS_SETUID])
 774         AC_DEFINE([BROKEN_SETREUID])
 775         AC_DEFINE([BROKEN_SETREGID])
 776         AC_DEFINE([BROKEN_UPDWTMPX], [1], [updwtmpx is broken (if present)])
 777         AC_DEFINE([WITH_ABBREV_NO_TTY])
 778         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 779         ;;
 780 *-*-k*bsd*-gnu | *-*-kopensolaris*-gnu)
 781         check_for_libcrypt_later=1
 782         AC_DEFINE([PAM_TTY_KLUDGE])
 783         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"])
 784         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 785         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 786         AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 787         ;;
 788 *-*-linux*)
 789         no_dev_ptmx=1
 790         use_pie=auto
 791         check_for_libcrypt_later=1
 792         check_for_openpty_ctty_bug=1
 793         dnl Target SUSv3/POSIX.1-2001 plus BSD specifics.
 794         dnl _DEFAULT_SOURCE is the new name for _BSD_SOURCE
 795         CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE"
 796         AC_DEFINE([PAM_TTY_KLUDGE], [1],
 797                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 798         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"],
 799                 [String used in /etc/passwd to denote locked account])
 800         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 801         AC_DEFINE([LINK_OPNOTSUPP_ERRNO], [EPERM],
 802                 [Define to whatever link() returns for "not supported"
 803                 if it doesn't return EOPNOTSUPP.])
 804         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 805         AC_DEFINE([USE_BTMP])
 806         AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])
 807         inet6_default_4in6=yes
 808         case `uname -r` in
 809         1.*|2.0.*)
 810                 AC_DEFINE([BROKEN_CMSG_TYPE], [1],
 811                         [Define if cmsg_type is not passed correctly])
 812                 ;;
 813         esac
 814         # tun(4) forwarding compat code
 815         AC_CHECK_HEADERS([linux/if_tun.h])
 816         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 817                 AC_DEFINE([SSH_TUN_LINUX], [1],
 818                     [Open tunnel devices the Linux tun/tap way])
 819                 AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 820                     [Use tunnel device compatibility to OpenBSD])
 821                 AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 822                     [Prepend the address family to IP tunnel traffic])
 823         fi
 824         AC_CHECK_HEADER([linux/if.h],
 825             AC_DEFINE([SYS_RDOMAIN_LINUX], [1],
 826                 [Support routing domains using Linux VRF]), [], [
 827 #ifdef HAVE_SYS_TYPES_H
 828 # include <sys/types.H>
 829 #endif
 830             ])
 831         AC_CHECK_HEADERS([linux/seccomp.h linux/filter.h linux/audit.h], [],
 832             [], [#include <linux/types.h>])
 833         # Obtain MIPS ABI
 834         case "$host" in
 835         mips*)
 836                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 837 #if _MIPS_SIM != _ABIO32
 838 #error
 839 #endif
 840                         ]])],[mips_abi="o32"],[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 841 #if _MIPS_SIM != _ABIN32
 842 #error
 843 #endif
 844                                 ]])],[mips_abi="n32"],[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 845 #if _MIPS_SIM != _ABI64
 846 #error
 847 #endif
 848                                         ]])],[mips_abi="n64"],[AC_MSG_ERROR([unknown MIPS ABI])
 849                                 ])
 850                         ])
 851                 ])
 852                 ;;
 853         esac
 854         AC_MSG_CHECKING([for seccomp architecture])
 855         seccomp_audit_arch=
 856         case "$host" in
 857         x86_64-*)
 858                 seccomp_audit_arch=AUDIT_ARCH_X86_64
 859                 ;;
 860         i*86-*)
 861                 seccomp_audit_arch=AUDIT_ARCH_I386
 862                 ;;
 863         arm*-*)
 864                 seccomp_audit_arch=AUDIT_ARCH_ARM
 865                 ;;
 866         aarch64*-*)
 867                 seccomp_audit_arch=AUDIT_ARCH_AARCH64
 868                 ;;
 869         s390x-*)
 870                 seccomp_audit_arch=AUDIT_ARCH_S390X
 871                 ;;
 872         s390-*)
 873                 seccomp_audit_arch=AUDIT_ARCH_S390
 874                 ;;
 875         powerpc64-*)
 876                 seccomp_audit_arch=AUDIT_ARCH_PPC64
 877                 ;;
 878         powerpc64le-*)
 879                 seccomp_audit_arch=AUDIT_ARCH_PPC64LE
 880                 ;;
 881         mips-*)
 882                 seccomp_audit_arch=AUDIT_ARCH_MIPS
 883                 ;;
 884         mipsel-*)
 885                 seccomp_audit_arch=AUDIT_ARCH_MIPSEL
 886                 ;;
 887         mips64-*)
 888                 case "$mips_abi" in
 889                 "n32")
 890                         seccomp_audit_arch=AUDIT_ARCH_MIPS64N32
 891                         ;;
 892                 "n64")
 893                         seccomp_audit_arch=AUDIT_ARCH_MIPS64
 894                         ;;
 895                 esac
 896                 ;;
 897         mips64el-*)
 898                 case "$mips_abi" in
 899                 "n32")
 900                         seccomp_audit_arch=AUDIT_ARCH_MIPSEL64N32
 901                         ;;
 902                 "n64")
 903                         seccomp_audit_arch=AUDIT_ARCH_MIPSEL64
 904                         ;;
 905                 esac
 906                 ;;
 907         esac
 908         if test "x$seccomp_audit_arch" != "x" ; then
 909                 AC_MSG_RESULT(["$seccomp_audit_arch"])
 910                 AC_DEFINE_UNQUOTED([SECCOMP_AUDIT_ARCH], [$seccomp_audit_arch],
 911                     [Specify the system call convention in use])
 912         else
 913                 AC_MSG_RESULT([architecture not supported])
 914         fi
 915         ;;
 916 mips-sony-bsd|mips-sony-newsos4)
 917         AC_DEFINE([NEED_SETPGRP], [1], [Need setpgrp to acquire controlling tty])
 918         SONY=1
 919         ;;
 920 *-*-netbsd*)
 921         check_for_libcrypt_before=1
 922         if test "x$withval" != "xno" ; then
 923                 need_dash_r=1
 924         fi
 925         CPPFLAGS="$CPPFLAGS -D_OPENBSD_SOURCE"
 926         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 927         AC_CHECK_HEADER([net/if_tap.h], ,
 928             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 929         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 930             [Prepend the address family to IP tunnel traffic])
 931         TEST_MALLOC_OPTIONS="AJRX"
 932         AC_DEFINE([BROKEN_READ_COMPARISON], [1],
 933             [NetBSD read function is sometimes redirected, breaking atomicio comparisons against it])
 934         ;;
 935 *-*-freebsd*)
 936         check_for_libcrypt_later=1
 937         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["*LOCKED*"], [Account locked with pw(1)])
 938         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 939         AC_CHECK_HEADER([net/if_tap.h], ,
 940             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 941         AC_DEFINE([BROKEN_GLOB], [1], [FreeBSD glob does not do what we need])
 942         TEST_MALLOC_OPTIONS="AJRX"
 943         # Preauth crypto occasionally uses file descriptors for crypto offload
 944         # and will crash if they cannot be opened.
 945         AC_DEFINE([SANDBOX_SKIP_RLIMIT_NOFILE], [1],
 946             [define if setrlimit RLIMIT_NOFILE breaks things])
 947         ;;
 948 *-*-bsdi*)
 949         AC_DEFINE([SETEUID_BREAKS_SETUID])
 950         AC_DEFINE([BROKEN_SETREUID])
 951         AC_DEFINE([BROKEN_SETREGID])
 952         ;;
 953 *-next-*)
 954         conf_lastlog_location="/usr/adm/lastlog"
 955         conf_utmp_location=/etc/utmp
 956         conf_wtmp_location=/usr/adm/wtmp
 957         maildir=/usr/spool/mail
 958         AC_DEFINE([HAVE_NEXT], [1], [Define if you are on NeXT])
 959         AC_DEFINE([BROKEN_REALPATH])
 960         AC_DEFINE([USE_PIPES])
 961         AC_DEFINE([BROKEN_SAVED_UIDS], [1], [Needed for NeXT])
 962         ;;
 963 *-*-openbsd*)
 964         use_pie=auto
 965         AC_DEFINE([HAVE_ATTRIBUTE__SENTINEL__], [1], [OpenBSD's gcc has sentinel])
 966         AC_DEFINE([HAVE_ATTRIBUTE__BOUNDED__], [1], [OpenBSD's gcc has bounded])
 967         AC_DEFINE([SSH_TUN_OPENBSD], [1], [Open tunnel devices the OpenBSD way])
 968         AC_DEFINE([SYSLOG_R_SAFE_IN_SIGHAND], [1],
 969             [syslog_r function is safe to use in in a signal handler])
 970         TEST_MALLOC_OPTIONS="AFGJPRX"
 971         ;;
 972 *-*-solaris*)
 973         if test "x$withval" != "xno" ; then
 974                 need_dash_r=1
 975         fi
 976         AC_DEFINE([PAM_SUN_CODEBASE])
 977         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 978         AC_DEFINE([PAM_TTY_KLUDGE])
 979         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 980                 [Define if pam_chauthtok wants real uid set
 981                 to the unpriv'ed user])
 982         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 983         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 984         AC_DEFINE([SSHD_ACQUIRES_CTTY], [1],
 985                 [Define if sshd somehow reacquires a controlling TTY
 986                 after setsid()])
 987         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd
 988                 in case the name is longer than 8 chars])
 989         AC_DEFINE([BROKEN_TCGETATTR_ICANON], [1], [tcgetattr with ICANON may hang])
 990         external_path_file=/etc/default/login
 991         # hardwire lastlog location (can't detect it on some versions)
 992         conf_lastlog_location="/var/adm/lastlog"
 993         AC_MSG_CHECKING([for obsolete utmp and wtmp in solaris2.x])
 994         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 995         if test "$sol2ver" -ge 8; then
 996                 AC_MSG_RESULT([yes])
 997                 AC_DEFINE([DISABLE_UTMP])
 998                 AC_DEFINE([DISABLE_WTMP], [1],
 999                         [Define if you don't want to use wtmp])
1000         else
1001                 AC_MSG_RESULT([no])
1002         fi
1003         AC_CHECK_FUNCS([setpflags])
1004         AC_CHECK_FUNCS([setppriv])
1005         AC_CHECK_FUNCS([priv_basicset])
1006         AC_CHECK_HEADERS([priv.h])
1007         AC_ARG_WITH([solaris-contracts],
1008                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
1009                 [
1010                 AC_CHECK_LIB([contract], [ct_tmpl_activate],
1011                         [ AC_DEFINE([USE_SOLARIS_PROCESS_CONTRACTS], [1],
1012                                 [Define if you have Solaris process contracts])
1013                           LIBS="$LIBS -lcontract"
1014                           SPC_MSG="yes" ], )
1015                 ],
1016         )
1017         AC_ARG_WITH([solaris-projects],
1018                 [  --with-solaris-projects Enable Solaris projects (experimental)],
1019                 [
1020                 AC_CHECK_LIB([project], [setproject],
1021                         [ AC_DEFINE([USE_SOLARIS_PROJECTS], [1],
1022                                 [Define if you have Solaris projects])
1023                         LIBS="$LIBS -lproject"
1024                         SP_MSG="yes" ], )
1025                 ],
1026         )
1027         AC_ARG_WITH([solaris-privs],
1028                 [  --with-solaris-privs    Enable Solaris/Illumos privileges (experimental)],
1029                 [
1030                 AC_MSG_CHECKING([for Solaris/Illumos privilege support])
1031                 if test "x$ac_cv_func_setppriv" = "xyes" -a \
1032                         "x$ac_cv_header_priv_h" = "xyes" ; then
1033                         SOLARIS_PRIVS=yes
1034                         AC_MSG_RESULT([found])
1035                         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
1036                                 [Define to disable UID restoration test])
1037                         AC_DEFINE([USE_SOLARIS_PRIVS], [1],
1038                                 [Define if you have Solaris privileges])
1039                         SPP_MSG="yes"
1040                 else
1041                         AC_MSG_RESULT([not found])
1042                         AC_MSG_ERROR([*** must have support for Solaris privileges to use --with-solaris-privs])
1043                 fi
1044                 ],
1045         )
1046         TEST_SHELL=$SHELL       # let configure find us a capable shell
1047         ;;
1048 *-*-sunos4*)
1049         CPPFLAGS="$CPPFLAGS -DSUNOS4"
1050         AC_CHECK_FUNCS([getpwanam])
1051         AC_DEFINE([PAM_SUN_CODEBASE])
1052         conf_utmp_location=/etc/utmp
1053         conf_wtmp_location=/var/adm/wtmp
1054         conf_lastlog_location=/var/adm/lastlog
1055         AC_DEFINE([USE_PIPES])
1056         AC_DEFINE([DISABLE_UTMPX], [1], [no utmpx])
1057         ;;
1058 *-ncr-sysv*)
1059         LIBS="$LIBS -lc89"
1060         AC_DEFINE([USE_PIPES])
1061         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1062         AC_DEFINE([SETEUID_BREAKS_SETUID])
1063         AC_DEFINE([BROKEN_SETREUID])
1064         AC_DEFINE([BROKEN_SETREGID])
1065         ;;
1066 *-sni-sysv*)
1067         # /usr/ucblib MUST NOT be searched on ReliantUNIX
1068         AC_CHECK_LIB([dl], [dlsym], ,)
1069         # -lresolv needs to be at the end of LIBS or DNS lookups break
1070         AC_CHECK_LIB([resolv], [res_query], [ LIBS="$LIBS -lresolv" ])
1071         IPADDR_IN_DISPLAY=yes
1072         AC_DEFINE([USE_PIPES])
1073         AC_DEFINE([IP_TOS_IS_BROKEN])
1074         AC_DEFINE([SETEUID_BREAKS_SETUID])
1075         AC_DEFINE([BROKEN_SETREUID])
1076         AC_DEFINE([BROKEN_SETREGID])
1077         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1078         external_path_file=/etc/default/login
1079         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
1080         # Attention: always take care to bind libsocket and libnsl before libc,
1081         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
1082         ;;
1083 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
1084 *-*-sysv4.2*)
1085         AC_DEFINE([USE_PIPES])
1086         AC_DEFINE([SETEUID_BREAKS_SETUID])
1087         AC_DEFINE([BROKEN_SETREUID])
1088         AC_DEFINE([BROKEN_SETREGID])
1089         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd])
1090         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
1091         TEST_SHELL=$SHELL       # let configure find us a capable shell
1092         ;;
1093 # UnixWare 7.x, OpenUNIX 8
1094 *-*-sysv5*)
1095         CPPFLAGS="$CPPFLAGS -Dvsnprintf=_xvsnprintf -Dsnprintf=_xsnprintf"
1096         AC_DEFINE([UNIXWARE_LONG_PASSWORDS], [1], [Support passwords > 8 chars])
1097         AC_DEFINE([USE_PIPES])
1098         AC_DEFINE([SETEUID_BREAKS_SETUID])
1099         AC_DEFINE([BROKEN_GETADDRINFO])
1100         AC_DEFINE([BROKEN_SETREUID])
1101         AC_DEFINE([BROKEN_SETREGID])
1102         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1103         AC_DEFINE([BROKEN_TCGETATTR_ICANON])
1104         TEST_SHELL=$SHELL       # let configure find us a capable shell
1105         check_for_libcrypt_later=1
1106         case "$host" in
1107         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
1108                 maildir=/var/spool/mail
1109                 AC_DEFINE([BROKEN_UPDWTMPX])
1110                 AC_CHECK_LIB([prot], [getluid], [ LIBS="$LIBS -lprot"
1111                         AC_CHECK_FUNCS([getluid setluid], , , [-lprot])
1112                         ], , )
1113                 ;;
1114         *)      AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
1115                 ;;
1116         esac
1117         ;;
1118 *-*-sysv*)
1119         ;;
1120 # SCO UNIX and OEM versions of SCO UNIX
1121 *-*-sco3.2v4*)
1122         AC_MSG_ERROR("This Platform is no longer supported.")
1123         ;;
1124 # SCO OpenServer 5.x
1125 *-*-sco3.2v5*)
1126         if test -z "$GCC"; then
1127                 CFLAGS="$CFLAGS -belf"
1128         fi
1129         LIBS="$LIBS -lprot -lx -ltinfo -lm"
1130         no_dev_ptmx=1
1131         AC_DEFINE([USE_PIPES])
1132         AC_DEFINE([HAVE_SECUREWARE])
1133         AC_DEFINE([DISABLE_SHADOW])
1134         AC_DEFINE([DISABLE_FD_PASSING])
1135         AC_DEFINE([SETEUID_BREAKS_SETUID])
1136         AC_DEFINE([BROKEN_GETADDRINFO])
1137         AC_DEFINE([BROKEN_SETREUID])
1138         AC_DEFINE([BROKEN_SETREGID])
1139         AC_DEFINE([WITH_ABBREV_NO_TTY])
1140         AC_DEFINE([BROKEN_UPDWTMPX])
1141         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1142         AC_CHECK_FUNCS([getluid setluid])
1143         MANTYPE=man
1144         TEST_SHELL=$SHELL       # let configure find us a capable shell
1145         SKIP_DISABLE_LASTLOG_DEFINE=yes
1146         ;;
1147 *-dec-osf*)
1148         AC_MSG_CHECKING([for Digital Unix SIA])
1149         no_osfsia=""
1150         AC_ARG_WITH([osfsia],
1151                 [  --with-osfsia           Enable Digital Unix SIA],
1152                 [
1153                         if test "x$withval" = "xno" ; then
1154                                 AC_MSG_RESULT([disabled])
1155                                 no_osfsia=1
1156                         fi
1157                 ],
1158         )
1159         if test -z "$no_osfsia" ; then
1160                 if test -f /etc/sia/matrix.conf; then
1161                         AC_MSG_RESULT([yes])
1162                         AC_DEFINE([HAVE_OSF_SIA], [1],
1163                                 [Define if you have Digital Unix Security
1164                                 Integration Architecture])
1165                         AC_DEFINE([DISABLE_LOGIN], [1],
1166                                 [Define if you don't want to use your
1167                                 system's login() call])
1168                         AC_DEFINE([DISABLE_FD_PASSING])
1169                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
1170                         SIA_MSG="yes"
1171                 else
1172                         AC_MSG_RESULT([no])
1173                         AC_DEFINE([LOCKED_PASSWD_SUBSTR], ["Nologin"],
1174                           [String used in /etc/passwd to denote locked account])
1175                 fi
1176         fi
1177         AC_DEFINE([BROKEN_GETADDRINFO])
1178         AC_DEFINE([SETEUID_BREAKS_SETUID])
1179         AC_DEFINE([BROKEN_SETREUID])
1180         AC_DEFINE([BROKEN_SETREGID])
1181         AC_DEFINE([BROKEN_READV_COMPARISON], [1], [Can't do comparisons on readv])
1182         ;;
1183
1184 *-*-nto-qnx*)
1185         AC_DEFINE([USE_PIPES])
1186         AC_DEFINE([NO_X11_UNIX_SOCKETS])
1187         AC_DEFINE([DISABLE_LASTLOG])
1188         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1189         AC_DEFINE([BROKEN_SHADOW_EXPIRE], [1], [QNX shadow support is broken])
1190         enable_etc_default_login=no     # has incompatible /etc/default/login
1191         case "$host" in
1192         *-*-nto-qnx6*)
1193                 AC_DEFINE([DISABLE_FD_PASSING])
1194                 ;;
1195         esac
1196         ;;
1197
1198 *-*-ultrix*)
1199         AC_DEFINE([BROKEN_GETGROUPS], [1], [getgroups(0,NULL) will return -1])
1200         AC_DEFINE([NEED_SETPGRP])
1201         AC_DEFINE([HAVE_SYS_SYSLOG_H], [1], [Force use of sys/syslog.h on Ultrix])
1202         ;;
1203
1204 *-*-lynxos)
1205         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
1206         AC_DEFINE([BROKEN_SETVBUF], [1],
1207             [LynxOS has broken setvbuf() implementation])
1208         ;;
1209 esac
1210
1211 AC_MSG_CHECKING([compiler and flags for sanity])
1212 AC_RUN_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]], [[ exit(0); ]])],
1213         [       AC_MSG_RESULT([yes]) ],
1214         [
1215                 AC_MSG_RESULT([no])
1216                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
1217         ],
1218         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
1219 )
1220
1221 dnl Checks for header files.
1222 # Checks for libraries.
1223 AC_CHECK_FUNC([setsockopt], , [AC_CHECK_LIB([socket], [setsockopt])])
1224
1225 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
1226 AC_CHECK_FUNCS([dirname], [AC_CHECK_HEADERS([libgen.h])] , [
1227         AC_CHECK_LIB([gen], [dirname], [
1228                 AC_CACHE_CHECK([for broken dirname],
1229                         ac_cv_have_broken_dirname, [
1230                         save_LIBS="$LIBS"
1231                         LIBS="$LIBS -lgen"
1232                         AC_RUN_IFELSE(
1233                                 [AC_LANG_SOURCE([[
1234 #include <libgen.h>
1235 #include <string.h>
1236
1237 int main(int argc, char **argv) {
1238     char *s, buf[32];
1239
1240     strncpy(buf,"/etc", 32);
1241     s = dirname(buf);
1242     if (!s || strncmp(s, "/", 32) != 0) {
1243         exit(1);
1244     } else {
1245         exit(0);
1246     }
1247 }
1248                                 ]])],
1249                                 [ ac_cv_have_broken_dirname="no" ],
1250                                 [ ac_cv_have_broken_dirname="yes" ],
1251                                 [ ac_cv_have_broken_dirname="no" ],
1252                         )
1253                         LIBS="$save_LIBS"
1254                 ])
1255                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
1256                         LIBS="$LIBS -lgen"
1257                         AC_DEFINE([HAVE_DIRNAME])
1258                         AC_CHECK_HEADERS([libgen.h])
1259                 fi
1260         ])
1261 ])
1262
1263 AC_CHECK_FUNC([getspnam], ,
1264         [AC_CHECK_LIB([gen], [getspnam], [LIBS="$LIBS -lgen"])])
1265 AC_SEARCH_LIBS([basename], [gen], [AC_DEFINE([HAVE_BASENAME], [1],
1266         [Define if you have the basename function.])])
1267
1268 dnl zlib is required
1269 AC_ARG_WITH([zlib],
1270         [  --with-zlib=PATH        Use zlib in PATH],
1271         [ if test "x$withval" = "xno" ; then
1272                 AC_MSG_ERROR([*** zlib is required ***])
1273           elif test "x$withval" != "xyes"; then
1274                 if test -d "$withval/lib"; then
1275                         if test -n "${need_dash_r}"; then
1276                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1277                         else
1278                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1279                         fi
1280                 else
1281                         if test -n "${need_dash_r}"; then
1282                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1283                         else
1284                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1285                         fi
1286                 fi
1287                 if test -d "$withval/include"; then
1288                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1289                 else
1290                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1291                 fi
1292         fi ]
1293 )
1294
1295 AC_CHECK_HEADER([zlib.h], ,[AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***])])
1296 AC_CHECK_LIB([z], [deflate], ,
1297         [
1298                 saved_CPPFLAGS="$CPPFLAGS"
1299                 saved_LDFLAGS="$LDFLAGS"
1300                 save_LIBS="$LIBS"
1301                 dnl Check default zlib install dir
1302                 if test -n "${need_dash_r}"; then
1303                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
1304                 else
1305                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
1306                 fi
1307                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
1308                 LIBS="$LIBS -lz"
1309                 AC_TRY_LINK_FUNC([deflate], [AC_DEFINE([HAVE_LIBZ])],
1310                         [
1311                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1312                         ]
1313                 )
1314         ]
1315 )
1316
1317 AC_ARG_WITH([zlib-version-check],
1318         [  --without-zlib-version-check Disable zlib version check],
1319         [  if test "x$withval" = "xno" ; then
1320                 zlib_check_nonfatal=1
1321            fi
1322         ]
1323 )
1324
1325 AC_MSG_CHECKING([for possibly buggy zlib])
1326 AC_RUN_IFELSE([AC_LANG_PROGRAM([[
1327 #include <stdio.h>
1328 #include <stdlib.h>
1329 #include <zlib.h>
1330         ]],
1331         [[
1332         int a=0, b=0, c=0, d=0, n, v;
1333         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1334         if (n != 3 && n != 4)
1335                 exit(1);
1336         v = a*1000000 + b*10000 + c*100 + d;
1337         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1338
1339         /* 1.1.4 is OK */
1340         if (a == 1 && b == 1 && c >= 4)
1341                 exit(0);
1342
1343         /* 1.2.3 and up are OK */
1344         if (v >= 1020300)
1345                 exit(0);
1346
1347         exit(2);
1348         ]])],
1349         AC_MSG_RESULT([no]),
1350         [ AC_MSG_RESULT([yes])
1351           if test -z "$zlib_check_nonfatal" ; then
1352                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1353 Your reported zlib version has known security problems.  It's possible your
1354 vendor has fixed these problems without changing the version number.  If you
1355 are sure this is the case, you can disable the check by running
1356 "./configure --without-zlib-version-check".
1357 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1358 See http://www.gzip.org/zlib/ for details.])
1359           else
1360                 AC_MSG_WARN([zlib version may have security problems])
1361           fi
1362         ],
1363         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1364 )
1365
1366 dnl UnixWare 2.x
1367 AC_CHECK_FUNC([strcasecmp],
1368         [], [ AC_CHECK_LIB([resolv], [strcasecmp], [LIBS="$LIBS -lresolv"]) ]
1369 )
1370 AC_CHECK_FUNCS([utimes],
1371         [], [ AC_CHECK_LIB([c89], [utimes], [AC_DEFINE([HAVE_UTIMES])
1372                                         LIBS="$LIBS -lc89"]) ]
1373 )
1374
1375 dnl    Checks for libutil functions
1376 AC_CHECK_HEADERS([bsd/libutil.h libutil.h])
1377 AC_SEARCH_LIBS([fmt_scaled], [util bsd])
1378 AC_SEARCH_LIBS([scan_scaled], [util bsd])
1379 AC_SEARCH_LIBS([login], [util bsd])
1380 AC_SEARCH_LIBS([logout], [util bsd])
1381 AC_SEARCH_LIBS([logwtmp], [util bsd])
1382 AC_SEARCH_LIBS([openpty], [util bsd])
1383 AC_SEARCH_LIBS([updwtmp], [util bsd])
1384 AC_CHECK_FUNCS([fmt_scaled scan_scaled login logout openpty updwtmp logwtmp])
1385
1386 # On some platforms, inet_ntop and gethostbyname may be found in libresolv
1387 # or libnsl.
1388 AC_SEARCH_LIBS([inet_ntop], [resolv nsl])
1389 AC_SEARCH_LIBS([gethostbyname], [resolv nsl])
1390
1391 # "Particular Function Checks"
1392 # see https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Particular-Functions.html
1393 AC_FUNC_STRFTIME
1394 AC_FUNC_MALLOC
1395 AC_FUNC_REALLOC
1396 # autoconf doesn't have AC_FUNC_CALLOC so fake it if malloc returns NULL;
1397 AC_MSG_CHECKING([if calloc(0, N) returns non-null])
1398 AC_RUN_IFELSE(
1399         [AC_LANG_PROGRAM(
1400                 [[ #include <stdlib.h> ]],
1401                 [[ void *p = calloc(0, 1); exit(p == NULL); ]]
1402         )],
1403         [ func_calloc_0_nonnull=yes ],
1404         [ func_calloc_0_nonnull=no ],
1405         [ AC_MSG_WARN([cross compiling: assuming same as malloc])
1406           func_calloc_0_nonnull="$ac_cv_func_malloc_0_nonnull"]
1407 )
1408 AC_MSG_RESULT([$func_calloc_0_nonnull])
1409
1410 if test "x$func_calloc_0_nonnull" = "xyes"; then
1411         AC_DEFINE(HAVE_CALLOC, 1, [calloc(0, x) returns non-null])
1412 else
1413         AC_DEFINE(HAVE_CALLOC, 0, [calloc(0, x) returns NULL])
1414         AC_DEFINE(calloc, rpl_calloc,
1415             [Define to rpl_calloc if the replacement function should be used.])
1416 fi
1417
1418 # Check for ALTDIRFUNC glob() extension
1419 AC_MSG_CHECKING([for GLOB_ALTDIRFUNC support])
1420 AC_EGREP_CPP([FOUNDIT],
1421         [
1422                 #include <glob.h>
1423                 #ifdef GLOB_ALTDIRFUNC
1424                 FOUNDIT
1425                 #endif
1426         ],
1427         [
1428                 AC_DEFINE([GLOB_HAS_ALTDIRFUNC], [1],
1429                         [Define if your system glob() function has
1430                         the GLOB_ALTDIRFUNC extension])
1431                 AC_MSG_RESULT([yes])
1432         ],
1433         [
1434                 AC_MSG_RESULT([no])
1435         ]
1436 )
1437
1438 # Check for g.gl_matchc glob() extension
1439 AC_MSG_CHECKING([for gl_matchc field in glob_t])
1440 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]],
1441         [[ glob_t g; g.gl_matchc = 1; ]])],
1442         [
1443                 AC_DEFINE([GLOB_HAS_GL_MATCHC], [1],
1444                         [Define if your system glob() function has
1445                         gl_matchc options in glob_t])
1446                 AC_MSG_RESULT([yes])
1447         ], [
1448                 AC_MSG_RESULT([no])
1449 ])
1450
1451 # Check for g.gl_statv glob() extension
1452 AC_MSG_CHECKING([for gl_statv and GLOB_KEEPSTAT extensions for glob])
1453 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]], [[
1454 #ifndef GLOB_KEEPSTAT
1455 #error "glob does not support GLOB_KEEPSTAT extension"
1456 #endif
1457 glob_t g;
1458 g.gl_statv = NULL;
1459 ]])],
1460         [
1461                 AC_DEFINE([GLOB_HAS_GL_STATV], [1],
1462                         [Define if your system glob() function has
1463                         gl_statv options in glob_t])
1464                 AC_MSG_RESULT([yes])
1465         ], [
1466                 AC_MSG_RESULT([no])
1467
1468 ])
1469
1470 AC_CHECK_DECLS([GLOB_NOMATCH], , , [#include <glob.h>])
1471
1472 AC_CHECK_DECL([VIS_ALL], ,
1473     AC_DEFINE(BROKEN_STRNVIS, 1, [missing VIS_ALL]), [#include <vis.h>])
1474
1475 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1476 AC_RUN_IFELSE(
1477         [AC_LANG_PROGRAM([[
1478 #include <sys/types.h>
1479 #include <dirent.h>]],
1480         [[
1481         struct dirent d;
1482         exit(sizeof(d.d_name)<=sizeof(char));
1483         ]])],
1484         [AC_MSG_RESULT([yes])],
1485         [
1486                 AC_MSG_RESULT([no])
1487                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME], [1],
1488                         [Define if your struct dirent expects you to
1489                         allocate extra space for d_name])
1490         ],
1491         [
1492                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1493                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME])
1494         ]
1495 )
1496
1497 AC_MSG_CHECKING([for /proc/pid/fd directory])
1498 if test -d "/proc/$$/fd" ; then
1499         AC_DEFINE([HAVE_PROC_PID], [1], [Define if you have /proc/$pid/fd])
1500         AC_MSG_RESULT([yes])
1501 else
1502         AC_MSG_RESULT([no])
1503 fi
1504
1505 # Check whether user wants to use ldns
1506 LDNS_MSG="no"
1507 AC_ARG_WITH(ldns,
1508         [  --with-ldns[[=PATH]]      Use ldns for DNSSEC support (optionally in PATH)],
1509         [
1510         ldns=""
1511         if test "x$withval" = "xyes" ; then
1512                 AC_PATH_TOOL([LDNSCONFIG], [ldns-config], [no])
1513                 if test "x$LDNSCONFIG" = "xno"; then
1514                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1515                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1516                         LIBS="-lldns $LIBS"
1517                         ldns=yes
1518                 else
1519                         LIBS="$LIBS `$LDNSCONFIG --libs`"
1520                         CPPFLAGS="$CPPFLAGS `$LDNSCONFIG --cflags`"
1521                         ldns=yes
1522                 fi
1523         elif test "x$withval" != "xno" ; then
1524                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1525                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1526                         LIBS="-lldns $LIBS"
1527                         ldns=yes
1528         fi
1529
1530         # Verify that it works.
1531         if test "x$ldns" = "xyes" ; then
1532                 AC_DEFINE(HAVE_LDNS, 1, [Define if you want ldns support])
1533                 LDNS_MSG="yes"
1534                 AC_MSG_CHECKING([for ldns support])
1535                 AC_LINK_IFELSE(
1536                         [AC_LANG_SOURCE([[
1537 #include <stdio.h>
1538 #include <stdlib.h>
1539 #include <stdint.h>
1540 #include <ldns/ldns.h>
1541 int main() { ldns_status status = ldns_verify_trusted(NULL, NULL, NULL, NULL); status=LDNS_STATUS_OK; exit(0); }
1542                         ]])
1543                 ],
1544                         [AC_MSG_RESULT(yes)],
1545                                 [
1546                                         AC_MSG_RESULT(no)
1547                                         AC_MSG_ERROR([** Incomplete or missing ldns libraries.])
1548                                 ])
1549         fi
1550 ])
1551
1552 # Check whether user wants libedit support
1553 LIBEDIT_MSG="no"
1554 AC_ARG_WITH([libedit],
1555         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1556         [ if test "x$withval" != "xno" ; then
1557                 if test "x$withval" = "xyes" ; then
1558                         AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
1559                         if test "x$PKGCONFIG" != "xno"; then
1560                                 AC_MSG_CHECKING([if $PKGCONFIG knows about libedit])
1561                                 if "$PKGCONFIG" libedit; then
1562                                         AC_MSG_RESULT([yes])
1563                                         use_pkgconfig_for_libedit=yes
1564                                 else
1565                                         AC_MSG_RESULT([no])
1566                                 fi
1567                         fi
1568                 else
1569                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1570                         if test -n "${need_dash_r}"; then
1571                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1572                         else
1573                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1574                         fi
1575                 fi
1576                 if test "x$use_pkgconfig_for_libedit" = "xyes"; then
1577                         LIBEDIT=`$PKGCONFIG --libs libedit`
1578                         CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
1579                 else
1580                         LIBEDIT="-ledit -lcurses"
1581                 fi
1582                 OTHERLIBS=`echo $LIBEDIT | sed 's/-ledit//'`
1583                 AC_CHECK_LIB([edit], [el_init],
1584                         [ AC_DEFINE([USE_LIBEDIT], [1], [Use libedit for sftp])
1585                           LIBEDIT_MSG="yes"
1586                           AC_SUBST([LIBEDIT])
1587                         ],
1588                         [ AC_MSG_ERROR([libedit not found]) ],
1589                         [ $OTHERLIBS ]
1590                 )
1591                 AC_MSG_CHECKING([if libedit version is compatible])
1592                 AC_COMPILE_IFELSE(
1593                     [AC_LANG_PROGRAM([[ #include <histedit.h> ]],
1594                     [[
1595         int i = H_SETSIZE;
1596         el_init("", NULL, NULL, NULL);
1597         exit(0);
1598                     ]])],
1599                     [ AC_MSG_RESULT([yes]) ],
1600                     [ AC_MSG_RESULT([no])
1601                       AC_MSG_ERROR([libedit version is not compatible]) ]
1602                 )
1603         fi ]
1604 )
1605
1606 AUDIT_MODULE=none
1607 AC_ARG_WITH([audit],
1608         [  --with-audit=module     Enable audit support (modules=debug,bsm,linux)],
1609         [
1610           AC_MSG_CHECKING([for supported audit module])
1611           case "$withval" in
1612           bsm)
1613                 AC_MSG_RESULT([bsm])
1614                 AUDIT_MODULE=bsm
1615                 dnl    Checks for headers, libs and functions
1616                 AC_CHECK_HEADERS([bsm/audit.h], [],
1617                     [AC_MSG_ERROR([BSM enabled and bsm/audit.h not found])],
1618                     [
1619 #ifdef HAVE_TIME_H
1620 # include <time.h>
1621 #endif
1622                     ]
1623 )
1624                 AC_CHECK_LIB([bsm], [getaudit], [],
1625                     [AC_MSG_ERROR([BSM enabled and required library not found])])
1626                 AC_CHECK_FUNCS([getaudit], [],
1627                     [AC_MSG_ERROR([BSM enabled and required function not found])])
1628                 # These are optional
1629                 AC_CHECK_FUNCS([getaudit_addr aug_get_machine])
1630                 AC_DEFINE([USE_BSM_AUDIT], [1], [Use BSM audit module])
1631                 if test "$sol2ver" -ge 11; then
1632                         SSHDLIBS="$SSHDLIBS -lscf"
1633                         AC_DEFINE([BROKEN_BSM_API], [1],
1634                                 [The system has incomplete BSM API])
1635                 fi
1636                 ;;
1637           linux)
1638                 AC_MSG_RESULT([linux])
1639                 AUDIT_MODULE=linux
1640                 dnl    Checks for headers, libs and functions
1641                 AC_CHECK_HEADERS([libaudit.h])
1642                 SSHDLIBS="$SSHDLIBS -laudit"
1643                 AC_DEFINE([USE_LINUX_AUDIT], [1], [Use Linux audit module])
1644                 ;;
1645           debug)
1646                 AUDIT_MODULE=debug
1647                 AC_MSG_RESULT([debug])
1648                 AC_DEFINE([SSH_AUDIT_EVENTS], [1], [Use audit debugging module])
1649                 ;;
1650           no)
1651                 AC_MSG_RESULT([no])
1652                 ;;
1653           *)
1654                 AC_MSG_ERROR([Unknown audit module $withval])
1655                 ;;
1656         esac ]
1657 )
1658
1659 AC_ARG_WITH([pie],
1660     [  --with-pie              Build Position Independent Executables if possible], [
1661         if test "x$withval" = "xno"; then
1662                 use_pie=no
1663         fi
1664         if test "x$withval" = "xyes"; then
1665                 use_pie=yes
1666         fi
1667     ]
1668 )
1669 if test "x$use_pie" = "x"; then
1670         use_pie=no
1671 fi
1672 if test "x$use_toolchain_hardening" != "x1" && test "x$use_pie" = "xauto"; then
1673         # Turn off automatic PIE when toolchain hardening is off.
1674         use_pie=no
1675 fi
1676 if test "x$use_pie" = "xauto"; then
1677         # Automatic PIE requires gcc >= 4.x
1678         AC_MSG_CHECKING([for gcc >= 4.x])
1679         AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
1680 #if !defined(__GNUC__) || __GNUC__ < 4
1681 #error gcc is too old
1682 #endif
1683 ]])],
1684         [ AC_MSG_RESULT([yes]) ],
1685         [ AC_MSG_RESULT([no])
1686           use_pie=no ]
1687 )
1688 fi
1689 if test "x$use_pie" != "xno"; then
1690         SAVED_CFLAGS="$CFLAGS"
1691         SAVED_LDFLAGS="$LDFLAGS"
1692         OSSH_CHECK_CFLAG_COMPILE([-fPIE])
1693         OSSH_CHECK_LDFLAG_LINK([-pie])
1694         # We use both -fPIE and -pie or neither.
1695         AC_MSG_CHECKING([whether both -fPIE and -pie are supported])
1696         if echo "x $CFLAGS"  | grep ' -fPIE' >/dev/null 2>&1 && \
1697            echo "x $LDFLAGS" | grep ' -pie'  >/dev/null 2>&1 ; then
1698                 AC_MSG_RESULT([yes])
1699         else
1700                 AC_MSG_RESULT([no])
1701                 CFLAGS="$SAVED_CFLAGS"
1702                 LDFLAGS="$SAVED_LDFLAGS"
1703         fi
1704 fi
1705
1706 dnl    Checks for library functions. Please keep in alphabetical order
1707 AC_CHECK_FUNCS([ \
1708         Blowfish_initstate \
1709         Blowfish_expandstate \
1710         Blowfish_expand0state \
1711         Blowfish_stream2word \
1712         asprintf \
1713         b64_ntop \
1714         __b64_ntop \
1715         b64_pton \
1716         __b64_pton \
1717         bcopy \
1718         bcrypt_pbkdf \
1719         bindresvport_sa \
1720         blf_enc \
1721         bzero \
1722         cap_rights_limit \
1723         clock \
1724         closefrom \
1725         dirfd \
1726         endgrent \
1727         err \
1728         errx \
1729         explicit_bzero \
1730         fchmod \
1731         fchown \
1732         flock \
1733         freeaddrinfo \
1734         freezero \
1735         fstatfs \
1736         fstatvfs \
1737         futimes \
1738         getaddrinfo \
1739         getcwd \
1740         getgrouplist \
1741         getline \
1742         getnameinfo \
1743         getopt \
1744         getpagesize \
1745         getpeereid \
1746         getpeerucred \
1747         getpgid \
1748         _getpty \
1749         getrlimit \
1750         getrandom \
1751         getsid \
1752         getttyent \
1753         glob \
1754         group_from_gid \
1755         inet_aton \
1756         inet_ntoa \
1757         inet_ntop \
1758         innetgr \
1759         llabs \
1760         login_getcapbool \
1761         md5_crypt \
1762         memmove \
1763         memset_s \
1764         mkdtemp \
1765         ngetaddrinfo \
1766         nsleep \
1767         ogetaddrinfo \
1768         openlog_r \
1769         pledge \
1770         poll \
1771         prctl \
1772         pstat \
1773         raise \
1774         readpassphrase \
1775         reallocarray \
1776         recvmsg \
1777         recallocarray \
1778         rresvport_af \
1779         sendmsg \
1780         setdtablesize \
1781         setegid \
1782         setenv \
1783         seteuid \
1784         setgroupent \
1785         setgroups \
1786         setlinebuf \
1787         setlogin \
1788         setpassent\
1789         setpcred \
1790         setproctitle \
1791         setregid \
1792         setreuid \
1793         setrlimit \
1794         setsid \
1795         setvbuf \
1796         sigaction \
1797         sigvec \
1798         snprintf \
1799         socketpair \
1800         statfs \
1801         statvfs \
1802         strcasestr \
1803         strdup \
1804         strerror \
1805         strlcat \
1806         strlcpy \
1807         strmode \
1808         strndup \
1809         strnlen \
1810         strnvis \
1811         strptime \
1812         strsignal \
1813         strtonum \
1814         strtoll \
1815         strtoul \
1816         strtoull \
1817         swap32 \
1818         sysconf \
1819         tcgetpgrp \
1820         timingsafe_bcmp \
1821         truncate \
1822         unsetenv \
1823         updwtmpx \
1824         user_from_uid \
1825         usleep \
1826         vasprintf \
1827         vsnprintf \
1828         waitpid \
1829         warn \
1830 ])
1831
1832 AC_CHECK_DECLS([bzero])
1833
1834 dnl Wide character support.
1835 AC_CHECK_FUNCS([mblen mbtowc nl_langinfo wcwidth])
1836
1837 TEST_SSH_UTF8=${TEST_SSH_UTF8:=yes}
1838 AC_MSG_CHECKING([for utf8 locale support])
1839 AC_RUN_IFELSE(
1840         [AC_LANG_PROGRAM([[
1841 #include <locale.h>
1842 #include <stdlib.h>
1843         ]], [[
1844         char *loc = setlocale(LC_CTYPE, "en_US.UTF-8");
1845         if (loc != NULL)
1846                 exit(0);
1847         exit(1);
1848         ]])],
1849         AC_MSG_RESULT(yes),
1850         [AC_MSG_RESULT(no)
1851          TEST_SSH_UTF8=no],
1852         AC_MSG_WARN([cross compiling: assuming yes])
1853 )
1854
1855 AC_LINK_IFELSE(
1856         [AC_LANG_PROGRAM(
1857            [[ #include <ctype.h> ]],
1858            [[ return (isblank('a')); ]])],
1859         [AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])
1860 ])
1861
1862 disable_pkcs11=
1863 AC_ARG_ENABLE([pkcs11],
1864         [  --disable-pkcs11        disable PKCS#11 support code [no]],
1865         [
1866                 if test "x$enableval" = "xno" ; then
1867                         disable_pkcs11=1
1868                 fi
1869         ]
1870 )
1871
1872 # PKCS11 depends on OpenSSL.
1873 if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then
1874         # PKCS#11 support requires dlopen() and co
1875         AC_SEARCH_LIBS([dlopen], [dl],
1876             AC_CHECK_DECL([RTLD_NOW],
1877                 AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support]),
1878                 [], [#include <dlfcn.h>]
1879             )
1880         )
1881 fi
1882
1883 # IRIX has a const char return value for gai_strerror()
1884 AC_CHECK_FUNCS([gai_strerror], [
1885         AC_DEFINE([HAVE_GAI_STRERROR])
1886         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
1887 #include <sys/types.h>
1888 #include <sys/socket.h>
1889 #include <netdb.h>
1890
1891 const char *gai_strerror(int);
1892                         ]], [[
1893         char *str;
1894         str = gai_strerror(0);
1895                         ]])], [
1896                 AC_DEFINE([HAVE_CONST_GAI_STRERROR_PROTO], [1],
1897                 [Define if gai_strerror() returns const char *])], [])])
1898
1899 AC_SEARCH_LIBS([nanosleep], [rt posix4], [AC_DEFINE([HAVE_NANOSLEEP], [1],
1900         [Some systems put nanosleep outside of libc])])
1901
1902 AC_SEARCH_LIBS([clock_gettime], [rt],
1903         [AC_DEFINE([HAVE_CLOCK_GETTIME], [1], [Have clock_gettime])])
1904
1905 dnl Make sure prototypes are defined for these before using them.
1906 AC_CHECK_DECL([strsep],
1907         [AC_CHECK_FUNCS([strsep])],
1908         [],
1909         [
1910 #ifdef HAVE_STRING_H
1911 # include <string.h>
1912 #endif
1913         ])
1914
1915 dnl tcsendbreak might be a macro
1916 AC_CHECK_DECL([tcsendbreak],
1917         [AC_DEFINE([HAVE_TCSENDBREAK])],
1918         [AC_CHECK_FUNCS([tcsendbreak])],
1919         [#include <termios.h>]
1920 )
1921
1922 AC_CHECK_DECLS([h_errno], , ,[#include <netdb.h>])
1923
1924 AC_CHECK_DECLS([SHUT_RD], , ,
1925         [
1926 #include <sys/types.h>
1927 #include <sys/socket.h>
1928         ])
1929
1930 AC_CHECK_DECLS([O_NONBLOCK], , ,
1931         [
1932 #include <sys/types.h>
1933 #ifdef HAVE_SYS_STAT_H
1934 # include <sys/stat.h>
1935 #endif
1936 #ifdef HAVE_FCNTL_H
1937 # include <fcntl.h>
1938 #endif
1939         ])
1940
1941 AC_CHECK_DECLS([readv, writev], , , [
1942 #include <sys/types.h>
1943 #include <sys/uio.h>
1944 #include <unistd.h>
1945         ])
1946
1947 AC_CHECK_DECLS([MAXSYMLINKS], , , [
1948 #include <sys/param.h>
1949         ])
1950
1951 AC_CHECK_DECLS([offsetof], , , [
1952 #include <stddef.h>
1953         ])
1954
1955 # extra bits for select(2)
1956 AC_CHECK_DECLS([howmany, NFDBITS], [], [], [[
1957 #include <sys/param.h>
1958 #include <sys/types.h>
1959 #ifdef HAVE_SYS_SYSMACROS_H
1960 #include <sys/sysmacros.h>
1961 #endif
1962 #ifdef HAVE_SYS_SELECT_H
1963 #include <sys/select.h>
1964 #endif
1965 #ifdef HAVE_SYS_TIME_H
1966 #include <sys/time.h>
1967 #endif
1968 #ifdef HAVE_UNISTD_H
1969 #include <unistd.h>
1970 #endif
1971         ]])
1972 AC_CHECK_TYPES([fd_mask], [], [], [[
1973 #include <sys/param.h>
1974 #include <sys/types.h>
1975 #ifdef HAVE_SYS_SELECT_H
1976 #include <sys/select.h>
1977 #endif
1978 #ifdef HAVE_SYS_TIME_H
1979 #include <sys/time.h>
1980 #endif
1981 #ifdef HAVE_UNISTD_H
1982 #include <unistd.h>
1983 #endif
1984         ]])
1985
1986 AC_CHECK_FUNCS([setresuid], [
1987         dnl Some platorms have setresuid that isn't implemented, test for this
1988         AC_MSG_CHECKING([if setresuid seems to work])
1989         AC_RUN_IFELSE(
1990                 [AC_LANG_PROGRAM([[
1991 #include <stdlib.h>
1992 #include <errno.h>
1993                 ]], [[
1994         errno=0;
1995         setresuid(0,0,0);
1996         if (errno==ENOSYS)
1997                 exit(1);
1998         else
1999                 exit(0);
2000                 ]])],
2001                 [AC_MSG_RESULT([yes])],
2002                 [AC_DEFINE([BROKEN_SETRESUID], [1],
2003                         [Define if your setresuid() is broken])
2004                  AC_MSG_RESULT([not implemented])],
2005                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2006         )
2007 ])
2008
2009 AC_CHECK_FUNCS([setresgid], [
2010         dnl Some platorms have setresgid that isn't implemented, test for this
2011         AC_MSG_CHECKING([if setresgid seems to work])
2012         AC_RUN_IFELSE(
2013                 [AC_LANG_PROGRAM([[
2014 #include <stdlib.h>
2015 #include <errno.h>
2016                 ]], [[
2017         errno=0;
2018         setresgid(0,0,0);
2019         if (errno==ENOSYS)
2020                 exit(1);
2021         else
2022                 exit(0);
2023                 ]])],
2024                 [AC_MSG_RESULT([yes])],
2025                 [AC_DEFINE([BROKEN_SETRESGID], [1],
2026                         [Define if your setresgid() is broken])
2027                  AC_MSG_RESULT([not implemented])],
2028                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2029         )
2030 ])
2031
2032 AC_CHECK_FUNCS([realpath], [
2033         dnl the sftp v3 spec says SSH_FXP_REALPATH will "canonicalize any given
2034         dnl path name", however some implementations of realpath (and some
2035         dnl versions of the POSIX spec) do not work on non-existent files,
2036         dnl so we use the OpenBSD implementation on those platforms.
2037         AC_MSG_CHECKING([if realpath works with non-existent files])
2038         AC_RUN_IFELSE(
2039                 [AC_LANG_PROGRAM([[
2040 #include <limits.h>
2041 #include <stdlib.h>
2042 #include <errno.h>
2043                 ]], [[
2044                 char buf[PATH_MAX];
2045                 if (realpath("/opensshnonexistentfilename1234", buf) == NULL)
2046                         if (errno == ENOENT)
2047                                 exit(1);
2048                 exit(0);
2049                 ]])],
2050                 [AC_MSG_RESULT([yes])],
2051                 [AC_DEFINE([BROKEN_REALPATH], [1],
2052                         [realpath does not work with nonexistent files])
2053                  AC_MSG_RESULT([no])],
2054                 [AC_MSG_WARN([cross compiling: assuming working])]
2055         )
2056 ])
2057
2058 AC_MSG_CHECKING([for working fflush(NULL)])
2059 AC_RUN_IFELSE(
2060         [AC_LANG_PROGRAM([[#include <stdio.h>]], [[fflush(NULL); exit(0);]])],
2061         AC_MSG_RESULT([yes]),
2062         [AC_MSG_RESULT([no])
2063          AC_DEFINE([FFLUSH_NULL_BUG], [1],
2064             [define if fflush(NULL) does not work])],
2065         AC_MSG_WARN([cross compiling: assuming working])
2066 )
2067
2068 dnl    Checks for time functions
2069 AC_CHECK_FUNCS([gettimeofday time])
2070 dnl    Checks for utmp functions
2071 AC_CHECK_FUNCS([endutent getutent getutid getutline pututline setutent])
2072 AC_CHECK_FUNCS([utmpname])
2073 dnl    Checks for utmpx functions
2074 AC_CHECK_FUNCS([endutxent getutxent getutxid getutxline getutxuser pututxline])
2075 AC_CHECK_FUNCS([setutxdb setutxent utmpxname])
2076 dnl    Checks for lastlog functions
2077 AC_CHECK_FUNCS([getlastlogxbyname])
2078
2079 AC_CHECK_FUNC([daemon],
2080         [AC_DEFINE([HAVE_DAEMON], [1], [Define if your libraries define daemon()])],
2081         [AC_CHECK_LIB([bsd], [daemon],
2082                 [LIBS="$LIBS -lbsd"; AC_DEFINE([HAVE_DAEMON])])]
2083 )
2084
2085 AC_CHECK_FUNC([getpagesize],
2086         [AC_DEFINE([HAVE_GETPAGESIZE], [1],
2087                 [Define if your libraries define getpagesize()])],
2088         [AC_CHECK_LIB([ucb], [getpagesize],
2089                 [LIBS="$LIBS -lucb"; AC_DEFINE([HAVE_GETPAGESIZE])])]
2090 )
2091
2092 # Check for broken snprintf
2093 if test "x$ac_cv_func_snprintf" = "xyes" ; then
2094         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
2095         AC_RUN_IFELSE(
2096                 [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
2097                 [[
2098         char b[5];
2099         snprintf(b,5,"123456789");
2100         exit(b[4]!='\0');
2101                 ]])],
2102                 [AC_MSG_RESULT([yes])],
2103                 [
2104                         AC_MSG_RESULT([no])
2105                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2106                                 [Define if your snprintf is busted])
2107                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
2108                 ],
2109                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
2110         )
2111 fi
2112
2113 # We depend on vsnprintf returning the right thing on overflow: the
2114 # number of characters it tried to create (as per SUSv3)
2115 if test "x$ac_cv_func_vsnprintf" = "xyes" ; then
2116         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
2117         AC_RUN_IFELSE(
2118                 [AC_LANG_PROGRAM([[
2119 #include <sys/types.h>
2120 #include <stdio.h>
2121 #include <stdarg.h>
2122
2123 int x_snprintf(char *str, size_t count, const char *fmt, ...)
2124 {
2125         size_t ret;
2126         va_list ap;
2127
2128         va_start(ap, fmt);
2129         ret = vsnprintf(str, count, fmt, ap);
2130         va_end(ap);
2131         return ret;
2132 }
2133                 ]], [[
2134 char x[1];
2135 if (x_snprintf(x, 1, "%s %d", "hello", 12345) != 11)
2136         return 1;
2137 if (x_snprintf(NULL, 0, "%s %d", "hello", 12345) != 11)
2138         return 1;
2139 return 0;
2140                 ]])],
2141                 [AC_MSG_RESULT([yes])],
2142                 [
2143                         AC_MSG_RESULT([no])
2144                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2145                                 [Define if your snprintf is busted])
2146                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
2147                 ],
2148                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
2149         )
2150 fi
2151
2152 # On systems where [v]snprintf is broken, but is declared in stdio,
2153 # check that the fmt argument is const char * or just char *.
2154 # This is only useful for when BROKEN_SNPRINTF
2155 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
2156 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2157 #include <stdio.h>
2158 int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
2159                 ]], [[
2160         snprintf(0, 0, 0);
2161                 ]])],
2162    [AC_MSG_RESULT([yes])
2163     AC_DEFINE([SNPRINTF_CONST], [const],
2164               [Define as const if snprintf() can declare const char *fmt])],
2165    [AC_MSG_RESULT([no])
2166     AC_DEFINE([SNPRINTF_CONST], [/* not const */])])
2167
2168 # Check for missing getpeereid (or equiv) support
2169 NO_PEERCHECK=""
2170 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
2171         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
2172         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2173 #include <sys/types.h>
2174 #include <sys/socket.h>]], [[int i = SO_PEERCRED;]])],
2175                 [ AC_MSG_RESULT([yes])
2176                   AC_DEFINE([HAVE_SO_PEERCRED], [1], [Have PEERCRED socket option])
2177                 ], [AC_MSG_RESULT([no])
2178                 NO_PEERCHECK=1
2179         ])
2180 fi
2181
2182 dnl see whether mkstemp() requires XXXXXX
2183 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
2184 AC_MSG_CHECKING([for (overly) strict mkstemp])
2185 AC_RUN_IFELSE(
2186         [AC_LANG_PROGRAM([[
2187 #include <stdlib.h>
2188         ]], [[
2189         char template[]="conftest.mkstemp-test";
2190         if (mkstemp(template) == -1)
2191                 exit(1);
2192         unlink(template);
2193         exit(0);
2194         ]])],
2195         [
2196                 AC_MSG_RESULT([no])
2197         ],
2198         [
2199                 AC_MSG_RESULT([yes])
2200                 AC_DEFINE([HAVE_STRICT_MKSTEMP], [1], [Silly mkstemp()])
2201         ],
2202         [
2203                 AC_MSG_RESULT([yes])
2204                 AC_DEFINE([HAVE_STRICT_MKSTEMP])
2205         ]
2206 )
2207 fi
2208
2209 dnl make sure that openpty does not reacquire controlling terminal
2210 if test ! -z "$check_for_openpty_ctty_bug"; then
2211         AC_MSG_CHECKING([if openpty correctly handles controlling tty])
2212         AC_RUN_IFELSE(
2213                 [AC_LANG_PROGRAM([[
2214 #include <stdio.h>
2215 #include <sys/fcntl.h>
2216 #include <sys/types.h>
2217 #include <sys/wait.h>
2218                 ]], [[
2219         pid_t pid;
2220         int fd, ptyfd, ttyfd, status;
2221
2222         pid = fork();
2223         if (pid < 0) {          /* failed */
2224                 exit(1);
2225         } else if (pid > 0) {   /* parent */
2226                 waitpid(pid, &status, 0);
2227                 if (WIFEXITED(status))
2228                         exit(WEXITSTATUS(status));
2229                 else
2230                         exit(2);
2231         } else {                /* child */
2232                 close(0); close(1); close(2);
2233                 setsid();
2234                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
2235                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
2236                 if (fd >= 0)
2237                         exit(3);        /* Acquired ctty: broken */
2238                 else
2239                         exit(0);        /* Did not acquire ctty: OK */
2240         }
2241                 ]])],
2242                 [
2243                         AC_MSG_RESULT([yes])
2244                 ],
2245                 [
2246                         AC_MSG_RESULT([no])
2247                         AC_DEFINE([SSHD_ACQUIRES_CTTY])
2248                 ],
2249                 [
2250                         AC_MSG_RESULT([cross-compiling, assuming yes])
2251                 ]
2252         )
2253 fi
2254
2255 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2256     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
2257         AC_MSG_CHECKING([if getaddrinfo seems to work])
2258         AC_RUN_IFELSE(
2259                 [AC_LANG_PROGRAM([[
2260 #include <stdio.h>
2261 #include <sys/socket.h>
2262 #include <netdb.h>
2263 #include <errno.h>
2264 #include <netinet/in.h>
2265
2266 #define TEST_PORT "2222"
2267                 ]], [[
2268         int err, sock;
2269         struct addrinfo *gai_ai, *ai, hints;
2270         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2271
2272         memset(&hints, 0, sizeof(hints));
2273         hints.ai_family = PF_UNSPEC;
2274         hints.ai_socktype = SOCK_STREAM;
2275         hints.ai_flags = AI_PASSIVE;
2276
2277         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2278         if (err != 0) {
2279                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2280                 exit(1);
2281         }
2282
2283         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2284                 if (ai->ai_family != AF_INET6)
2285                         continue;
2286
2287                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2288                     sizeof(ntop), strport, sizeof(strport),
2289                     NI_NUMERICHOST|NI_NUMERICSERV);
2290
2291                 if (err != 0) {
2292                         if (err == EAI_SYSTEM)
2293                                 perror("getnameinfo EAI_SYSTEM");
2294                         else
2295                                 fprintf(stderr, "getnameinfo failed: %s\n",
2296                                     gai_strerror(err));
2297                         exit(2);
2298                 }
2299
2300                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
2301                 if (sock < 0)
2302                         perror("socket");
2303                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2304                         if (errno == EBADF)
2305                                 exit(3);
2306                 }
2307         }
2308         exit(0);
2309                 ]])],
2310                 [
2311                         AC_MSG_RESULT([yes])
2312                 ],
2313                 [
2314                         AC_MSG_RESULT([no])
2315                         AC_DEFINE([BROKEN_GETADDRINFO])
2316                 ],
2317                 [
2318                         AC_MSG_RESULT([cross-compiling, assuming yes])
2319                 ]
2320         )
2321 fi
2322
2323 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2324     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
2325         AC_MSG_CHECKING([if getaddrinfo seems to work])
2326         AC_RUN_IFELSE(
2327                 [AC_LANG_PROGRAM([[
2328 #include <stdio.h>
2329 #include <sys/socket.h>
2330 #include <netdb.h>
2331 #include <errno.h>
2332 #include <netinet/in.h>
2333
2334 #define TEST_PORT "2222"
2335                 ]], [[
2336         int err, sock;
2337         struct addrinfo *gai_ai, *ai, hints;
2338         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2339
2340         memset(&hints, 0, sizeof(hints));
2341         hints.ai_family = PF_UNSPEC;
2342         hints.ai_socktype = SOCK_STREAM;
2343         hints.ai_flags = AI_PASSIVE;
2344
2345         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2346         if (err != 0) {
2347                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2348                 exit(1);
2349         }
2350
2351         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2352                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2353                         continue;
2354
2355                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2356                     sizeof(ntop), strport, sizeof(strport),
2357                     NI_NUMERICHOST|NI_NUMERICSERV);
2358
2359                 if (ai->ai_family == AF_INET && err != 0) {
2360                         perror("getnameinfo");
2361                         exit(2);
2362                 }
2363         }
2364         exit(0);
2365                 ]])],
2366                 [
2367                         AC_MSG_RESULT([yes])
2368                         AC_DEFINE([AIX_GETNAMEINFO_HACK], [1],
2369                                 [Define if you have a getaddrinfo that fails
2370                                 for the all-zeros IPv6 address])
2371                 ],
2372                 [
2373                         AC_MSG_RESULT([no])
2374                         AC_DEFINE([BROKEN_GETADDRINFO])
2375                 ],
2376                 [
2377                         AC_MSG_RESULT([cross-compiling, assuming no])
2378                 ]
2379         )
2380 fi
2381
2382 if test "x$ac_cv_func_getaddrinfo" = "xyes"; then
2383         AC_CHECK_DECLS(AI_NUMERICSERV, , ,
2384             [#include <sys/types.h>
2385              #include <sys/socket.h>
2386              #include <netdb.h>])
2387 fi
2388
2389 if test "x$check_for_conflicting_getspnam" = "x1"; then
2390         AC_MSG_CHECKING([for conflicting getspnam in shadow.h])
2391         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <shadow.h> ]],
2392                 [[ exit(0); ]])],
2393                 [
2394                         AC_MSG_RESULT([no])
2395                 ],
2396                 [
2397                         AC_MSG_RESULT([yes])
2398                         AC_DEFINE([GETSPNAM_CONFLICTING_DEFS], [1],
2399                             [Conflicting defs for getspnam])
2400                 ]
2401         )
2402 fi
2403
2404 dnl NetBSD added an strnvis and unfortunately made it incompatible with the
2405 dnl existing one in OpenBSD and Linux's libbsd (the former having existed
2406 dnl for over ten years). Despite this incompatibility being reported during
2407 dnl development (see http://gnats.netbsd.org/44977) they still shipped it.
2408 dnl Even more unfortunately FreeBSD and later MacOS picked up this incompatible
2409 dnl implementation.  Try to detect this mess, and assume the only safe option
2410 dnl if we're cross compiling.
2411 dnl
2412 dnl OpenBSD, 2001: strnvis(char *dst, const char *src, size_t dlen, int flag);
2413 dnl NetBSD: 2012,  strnvis(char *dst, size_t dlen, const char *src, int flag);
2414 if test "x$ac_cv_func_strnvis" = "xyes"; then
2415         AC_MSG_CHECKING([for working strnvis])
2416         AC_RUN_IFELSE(
2417                 [AC_LANG_PROGRAM([[
2418 #include <signal.h>
2419 #include <stdlib.h>
2420 #include <string.h>
2421 #include <vis.h>
2422 static void sighandler(int sig) { _exit(1); }
2423                 ]], [[
2424         char dst[16];
2425
2426         signal(SIGSEGV, sighandler);
2427         if (strnvis(dst, "src", 4, 0) && strcmp(dst, "src") == 0)
2428                 exit(0);
2429         exit(1)
2430                 ]])],
2431                 [AC_MSG_RESULT([yes])],
2432                 [AC_MSG_RESULT([no])
2433                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis detected broken])],
2434                 [AC_MSG_WARN([cross compiling: assuming broken])
2435                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis assumed broken])]
2436         )
2437 fi
2438
2439 AC_CHECK_FUNCS([getpgrp],[
2440         AC_MSG_CHECKING([if getpgrp accepts zero args])
2441         AC_COMPILE_IFELSE(
2442                 [AC_LANG_PROGRAM([[$ac_includes_default]], [[ getpgrp(); ]])],
2443                 [ AC_MSG_RESULT([yes])
2444                   AC_DEFINE([GETPGRP_VOID], [1], [getpgrp takes zero args])],
2445                 [ AC_MSG_RESULT([no])
2446                   AC_DEFINE([GETPGRP_VOID], [0], [getpgrp takes one arg])]
2447         )
2448 ])
2449
2450 # Search for OpenSSL
2451 saved_CPPFLAGS="$CPPFLAGS"
2452 saved_LDFLAGS="$LDFLAGS"
2453 AC_ARG_WITH([ssl-dir],
2454         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
2455         [
2456                 if test "x$openssl" = "xno" ; then
2457                         AC_MSG_ERROR([cannot use --with-ssl-dir when OpenSSL disabled])
2458                 fi
2459                 if test "x$withval" != "xno" ; then
2460                         case "$withval" in
2461                                 # Relative paths
2462                                 ./*|../*)       withval="`pwd`/$withval"
2463                         esac
2464                         if test -d "$withval/lib"; then
2465                                 if test -n "${need_dash_r}"; then
2466                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
2467                                 else
2468                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
2469                                 fi
2470                         elif test -d "$withval/lib64"; then
2471                                 if test -n "${need_dash_r}"; then
2472                                         LDFLAGS="-L${withval}/lib64 -R${withval}/lib64 ${LDFLAGS}"
2473                                 else
2474                                         LDFLAGS="-L${withval}/lib64 ${LDFLAGS}"
2475                                 fi
2476                         else
2477                                 if test -n "${need_dash_r}"; then
2478                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
2479                                 else
2480                                         LDFLAGS="-L${withval} ${LDFLAGS}"
2481                                 fi
2482                         fi
2483                         if test -d "$withval/include"; then
2484                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
2485                         else
2486                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
2487                         fi
2488                 fi
2489         ]
2490 )
2491
2492 AC_ARG_WITH([openssl-header-check],
2493         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2494         [
2495                 if test "x$withval" = "xno" ; then
2496                         openssl_check_nonfatal=1
2497                 fi
2498         ]
2499 )
2500
2501 openssl_engine=no
2502 AC_ARG_WITH([ssl-engine],
2503         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2504         [
2505                 if test "x$withval" != "xno" ; then
2506                         if test "x$openssl" = "xno" ; then
2507                                 AC_MSG_ERROR([cannot use --with-ssl-engine when OpenSSL disabled])
2508                         fi
2509                         openssl_engine=yes
2510                 fi
2511         ]
2512 )
2513
2514 if test "x$openssl" = "xyes" ; then
2515         LIBS="-lcrypto $LIBS"
2516         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL], [1],
2517                 [Define if your ssl headers are included
2518                 with #include <openssl/header.h>])],
2519                 [
2520                         dnl Check default openssl install dir
2521                         if test -n "${need_dash_r}"; then
2522                                 LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
2523                         else
2524                                 LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
2525                         fi
2526                         CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
2527                         AC_CHECK_HEADER([openssl/opensslv.h], ,
2528                             [AC_MSG_ERROR([*** OpenSSL headers missing - please install first or check config.log ***])])
2529                         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL])],
2530                                 [
2531                                         AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2532                                 ]
2533                         )
2534                 ]
2535         )
2536
2537         # Determine OpenSSL header version
2538         AC_MSG_CHECKING([OpenSSL header version])
2539         AC_RUN_IFELSE(
2540                 [AC_LANG_PROGRAM([[
2541         #include <stdlib.h>
2542         #include <stdio.h>
2543         #include <string.h>
2544         #include <openssl/opensslv.h>
2545         #define DATA "conftest.sslincver"
2546                 ]], [[
2547                 FILE *fd;
2548                 int rc;
2549
2550                 fd = fopen(DATA,"w");
2551                 if(fd == NULL)
2552                         exit(1);
2553
2554                 if ((rc = fprintf(fd, "%08lx (%s)\n",
2555                     (unsigned long)OPENSSL_VERSION_NUMBER,
2556                      OPENSSL_VERSION_TEXT)) < 0)
2557                         exit(1);
2558
2559                 exit(0);
2560                 ]])],
2561                 [
2562                         ssl_header_ver=`cat conftest.sslincver`
2563                         AC_MSG_RESULT([$ssl_header_ver])
2564                 ],
2565                 [
2566                         AC_MSG_RESULT([not found])
2567                         AC_MSG_ERROR([OpenSSL version header not found.])
2568                 ],
2569                 [
2570                         AC_MSG_WARN([cross compiling: not checking])
2571                 ]
2572         )
2573
2574         # Determine OpenSSL library version
2575         AC_MSG_CHECKING([OpenSSL library version])
2576         AC_RUN_IFELSE(
2577                 [AC_LANG_PROGRAM([[
2578         #include <stdio.h>
2579         #include <string.h>
2580         #include <openssl/opensslv.h>
2581         #include <openssl/crypto.h>
2582         #define DATA "conftest.ssllibver"
2583                 ]], [[
2584                 FILE *fd;
2585                 int rc;
2586
2587                 fd = fopen(DATA,"w");
2588                 if(fd == NULL)
2589                         exit(1);
2590
2591                 if ((rc = fprintf(fd, "%08lx (%s)\n", (unsigned long)SSLeay(),
2592                     SSLeay_version(SSLEAY_VERSION))) < 0)
2593                         exit(1);
2594
2595                 exit(0);
2596                 ]])],
2597                 [
2598                         ssl_library_ver=`cat conftest.ssllibver`
2599                         # Check version is supported.
2600                         case "$ssl_library_ver" in
2601                                 10000*|0*)
2602                                         AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")])
2603                                         ;;
2604                                 100*)   ;; # 1.0.x
2605                                 200*)   ;; # LibreSSL
2606                                 *)
2607                                         AC_MSG_ERROR([OpenSSL >= 1.1.0 is not yet supported (have "$ssl_library_ver")])
2608                                         ;;
2609                         esac
2610                         AC_MSG_RESULT([$ssl_library_ver])
2611                 ],
2612                 [
2613                         AC_MSG_RESULT([not found])
2614                         AC_MSG_ERROR([OpenSSL library not found.])
2615                 ],
2616                 [
2617                         AC_MSG_WARN([cross compiling: not checking])
2618                 ]
2619         )
2620
2621         # Sanity check OpenSSL headers
2622         AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2623         AC_RUN_IFELSE(
2624                 [AC_LANG_PROGRAM([[
2625         #include <string.h>
2626         #include <openssl/opensslv.h>
2627         #include <openssl/crypto.h>
2628                 ]], [[
2629                 exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
2630                 ]])],
2631                 [
2632                         AC_MSG_RESULT([yes])
2633                 ],
2634                 [
2635                         AC_MSG_RESULT([no])
2636                         if test "x$openssl_check_nonfatal" = "x"; then
2637                                 AC_MSG_ERROR([Your OpenSSL headers do not match your
2638         library. Check config.log for details.
2639         If you are sure your installation is consistent, you can disable the check
2640         by running "./configure --without-openssl-header-check".
2641         Also see contrib/findssl.sh for help identifying header/library mismatches.
2642         ])
2643                         else
2644                                 AC_MSG_WARN([Your OpenSSL headers do not match your
2645         library. Check config.log for details.
2646         Also see contrib/findssl.sh for help identifying header/library mismatches.])
2647                         fi
2648                 ],
2649                 [
2650                         AC_MSG_WARN([cross compiling: not checking])
2651                 ]
2652         )
2653
2654         AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2655         AC_LINK_IFELSE(
2656                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2657                 [[ SSLeay_add_all_algorithms(); ]])],
2658                 [
2659                         AC_MSG_RESULT([yes])
2660                 ],
2661                 [
2662                         AC_MSG_RESULT([no])
2663                         saved_LIBS="$LIBS"
2664                         LIBS="$LIBS -ldl"
2665                         AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2666                         AC_LINK_IFELSE(
2667                                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2668                                 [[ SSLeay_add_all_algorithms(); ]])],
2669                                 [
2670                                         AC_MSG_RESULT([yes])
2671                                 ],
2672                                 [
2673                                         AC_MSG_RESULT([no])
2674                                         LIBS="$saved_LIBS"
2675                                 ]
2676                         )
2677                 ]
2678         )
2679
2680         AC_CHECK_FUNCS([ \
2681                 BN_is_prime_ex \
2682                 DSA_generate_parameters_ex \
2683                 EVP_DigestInit_ex \
2684                 EVP_DigestFinal_ex \
2685                 EVP_MD_CTX_init \
2686                 EVP_MD_CTX_cleanup \
2687                 EVP_MD_CTX_copy_ex \
2688                 HMAC_CTX_init \
2689                 RSA_generate_key_ex \
2690                 RSA_get_default_method \
2691         ])
2692
2693         if test "x$openssl_engine" = "xyes" ; then
2694                 AC_MSG_CHECKING([for OpenSSL ENGINE support])
2695                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2696         #include <openssl/engine.h>
2697                         ]], [[
2698                                 ENGINE_load_builtin_engines();
2699                                 ENGINE_register_all_complete();
2700                         ]])],
2701                         [ AC_MSG_RESULT([yes])
2702                           AC_DEFINE([USE_OPENSSL_ENGINE], [1],
2703                              [Enable OpenSSL engine support])
2704                         ], [ AC_MSG_ERROR([OpenSSL ENGINE support not found])
2705                 ])
2706         fi
2707
2708         # Check for OpenSSL without EVP_aes_{192,256}_cbc
2709         AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2710         AC_LINK_IFELSE(
2711                 [AC_LANG_PROGRAM([[
2712         #include <string.h>
2713         #include <openssl/evp.h>
2714                 ]], [[
2715                 exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
2716                 ]])],
2717                 [
2718                         AC_MSG_RESULT([no])
2719                 ],
2720                 [
2721                         AC_MSG_RESULT([yes])
2722                         AC_DEFINE([OPENSSL_LOBOTOMISED_AES], [1],
2723                             [libcrypto is missing AES 192 and 256 bit functions])
2724                 ]
2725         )
2726
2727         # Check for OpenSSL with EVP_aes_*ctr
2728         AC_MSG_CHECKING([whether OpenSSL has AES CTR via EVP])
2729         AC_LINK_IFELSE(
2730                 [AC_LANG_PROGRAM([[
2731         #include <string.h>
2732         #include <openssl/evp.h>
2733                 ]], [[
2734                 exit(EVP_aes_128_ctr() == NULL ||
2735                     EVP_aes_192_cbc() == NULL ||
2736                     EVP_aes_256_cbc() == NULL);
2737                 ]])],
2738                 [
2739                         AC_MSG_RESULT([yes])
2740                         AC_DEFINE([OPENSSL_HAVE_EVPCTR], [1],
2741                             [libcrypto has EVP AES CTR])
2742                 ],
2743                 [
2744                         AC_MSG_RESULT([no])
2745                 ]
2746         )
2747
2748         # Check for OpenSSL with EVP_aes_*gcm
2749         AC_MSG_CHECKING([whether OpenSSL has AES GCM via EVP])
2750         AC_LINK_IFELSE(
2751                 [AC_LANG_PROGRAM([[
2752         #include <string.h>
2753         #include <openssl/evp.h>
2754                 ]], [[
2755                 exit(EVP_aes_128_gcm() == NULL ||
2756                     EVP_aes_256_gcm() == NULL ||
2757                     EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
2758                     EVP_CTRL_GCM_IV_GEN == 0 ||
2759                     EVP_CTRL_GCM_SET_TAG == 0 ||
2760                     EVP_CTRL_GCM_GET_TAG == 0 ||
2761                     EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
2762                 ]])],
2763                 [
2764                         AC_MSG_RESULT([yes])
2765                         AC_DEFINE([OPENSSL_HAVE_EVPGCM], [1],
2766                             [libcrypto has EVP AES GCM])
2767                 ],
2768                 [
2769                         AC_MSG_RESULT([no])
2770                         unsupported_algorithms="$unsupported_cipers \
2771                            aes128-gcm@openssh.com \
2772                            aes256-gcm@openssh.com"
2773                 ]
2774         )
2775
2776         AC_SEARCH_LIBS([EVP_CIPHER_CTX_ctrl], [crypto],
2777                 [AC_DEFINE([HAVE_EVP_CIPHER_CTX_CTRL], [1],
2778                     [Define if libcrypto has EVP_CIPHER_CTX_ctrl])])
2779
2780         AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
2781         AC_LINK_IFELSE(
2782                 [AC_LANG_PROGRAM([[
2783         #include <string.h>
2784         #include <openssl/evp.h>
2785                 ]], [[
2786                 if(EVP_DigestUpdate(NULL, NULL,0))
2787                         exit(0);
2788                 ]])],
2789                 [
2790                         AC_MSG_RESULT([yes])
2791                 ],
2792                 [
2793                         AC_MSG_RESULT([no])
2794                         AC_DEFINE([OPENSSL_EVP_DIGESTUPDATE_VOID], [1],
2795                             [Define if EVP_DigestUpdate returns void])
2796                 ]
2797         )
2798
2799         # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2800         # because the system crypt() is more featureful.
2801         if test "x$check_for_libcrypt_before" = "x1"; then
2802                 AC_CHECK_LIB([crypt], [crypt])
2803         fi
2804
2805         # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2806         # version in OpenSSL.
2807         if test "x$check_for_libcrypt_later" = "x1"; then
2808                 AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
2809         fi
2810         AC_CHECK_FUNCS([crypt DES_crypt])
2811
2812         # Search for SHA256 support in libc and/or OpenSSL
2813         AC_CHECK_FUNCS([SHA256_Update EVP_sha256], ,
2814             [unsupported_algorithms="$unsupported_algorithms \
2815                 hmac-sha2-256 \
2816                 hmac-sha2-512 \
2817                 diffie-hellman-group-exchange-sha256 \
2818                 hmac-sha2-256-etm@openssh.com \
2819                 hmac-sha2-512-etm@openssh.com"
2820              ]
2821         )
2822         # Search for RIPE-MD support in OpenSSL
2823         AC_CHECK_FUNCS([EVP_ripemd160], ,
2824             [unsupported_algorithms="$unsupported_algorithms \
2825                 hmac-ripemd160 \
2826                 hmac-ripemd160@openssh.com \
2827                 hmac-ripemd160-etm@openssh.com"
2828              ]
2829         )
2830
2831         # Check complete ECC support in OpenSSL
2832         AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1])
2833         AC_LINK_IFELSE(
2834                 [AC_LANG_PROGRAM([[
2835         #include <openssl/ec.h>
2836         #include <openssl/ecdh.h>
2837         #include <openssl/ecdsa.h>
2838         #include <openssl/evp.h>
2839         #include <openssl/objects.h>
2840         #include <openssl/opensslv.h>
2841                 ]], [[
2842                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
2843                 const EVP_MD *m = EVP_sha256(); /* We need this too */
2844                 ]])],
2845                 [ AC_MSG_RESULT([yes])
2846                   enable_nistp256=1 ],
2847                 [ AC_MSG_RESULT([no]) ]
2848         )
2849
2850         AC_MSG_CHECKING([whether OpenSSL has NID_secp384r1])
2851         AC_LINK_IFELSE(
2852                 [AC_LANG_PROGRAM([[
2853         #include <openssl/ec.h>
2854         #include <openssl/ecdh.h>
2855         #include <openssl/ecdsa.h>
2856         #include <openssl/evp.h>
2857         #include <openssl/objects.h>
2858         #include <openssl/opensslv.h>
2859                 ]], [[
2860                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
2861                 const EVP_MD *m = EVP_sha384(); /* We need this too */
2862                 ]])],
2863                 [ AC_MSG_RESULT([yes])
2864                   enable_nistp384=1 ],
2865                 [ AC_MSG_RESULT([no]) ]
2866         )
2867
2868         AC_MSG_CHECKING([whether OpenSSL has NID_secp521r1])
2869         AC_LINK_IFELSE(
2870                 [AC_LANG_PROGRAM([[
2871         #include <openssl/ec.h>
2872         #include <openssl/ecdh.h>
2873         #include <openssl/ecdsa.h>
2874         #include <openssl/evp.h>
2875         #include <openssl/objects.h>
2876         #include <openssl/opensslv.h>
2877                 ]], [[
2878                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2879                 const EVP_MD *m = EVP_sha512(); /* We need this too */
2880                 ]])],
2881                 [ AC_MSG_RESULT([yes])
2882                   AC_MSG_CHECKING([if OpenSSL's NID_secp521r1 is functional])
2883                   AC_RUN_IFELSE(
2884                         [AC_LANG_PROGRAM([[
2885         #include <openssl/ec.h>
2886         #include <openssl/ecdh.h>
2887         #include <openssl/ecdsa.h>
2888         #include <openssl/evp.h>
2889         #include <openssl/objects.h>
2890         #include <openssl/opensslv.h>
2891                         ]],[[
2892                         EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2893                         const EVP_MD *m = EVP_sha512(); /* We need this too */
2894                         exit(e == NULL || m == NULL);
2895                         ]])],
2896                         [ AC_MSG_RESULT([yes])
2897                           enable_nistp521=1 ],
2898                         [ AC_MSG_RESULT([no]) ],
2899                         [ AC_MSG_WARN([cross-compiling: assuming yes])
2900                           enable_nistp521=1 ]
2901                   )],
2902                 AC_MSG_RESULT([no])
2903         )
2904
2905         COMMENT_OUT_ECC="#no ecc#"
2906         TEST_SSH_ECC=no
2907
2908         if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
2909             test x$enable_nistp521 = x1; then
2910                 AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC])
2911         fi
2912         if test x$enable_nistp256 = x1; then
2913                 AC_DEFINE([OPENSSL_HAS_NISTP256], [1],
2914                     [libcrypto has NID_X9_62_prime256v1])
2915                 TEST_SSH_ECC=yes
2916                 COMMENT_OUT_ECC=""
2917         else
2918                 unsupported_algorithms="$unsupported_algorithms \
2919                         ecdsa-sha2-nistp256 \
2920                         ecdh-sha2-nistp256 \
2921                         ecdsa-sha2-nistp256-cert-v01@openssh.com"
2922         fi
2923         if test x$enable_nistp384 = x1; then
2924                 AC_DEFINE([OPENSSL_HAS_NISTP384], [1], [libcrypto has NID_secp384r1])
2925                 TEST_SSH_ECC=yes
2926                 COMMENT_OUT_ECC=""
2927         else
2928                 unsupported_algorithms="$unsupported_algorithms \
2929                         ecdsa-sha2-nistp384 \
2930                         ecdh-sha2-nistp384 \
2931                         ecdsa-sha2-nistp384-cert-v01@openssh.com"
2932         fi
2933         if test x$enable_nistp521 = x1; then
2934                 AC_DEFINE([OPENSSL_HAS_NISTP521], [1], [libcrypto has NID_secp521r1])
2935                 TEST_SSH_ECC=yes
2936                 COMMENT_OUT_ECC=""
2937         else
2938                 unsupported_algorithms="$unsupported_algorithms \
2939                         ecdh-sha2-nistp521 \
2940                         ecdsa-sha2-nistp521 \
2941                         ecdsa-sha2-nistp521-cert-v01@openssh.com"
2942         fi
2943
2944         AC_SUBST([TEST_SSH_ECC])
2945         AC_SUBST([COMMENT_OUT_ECC])
2946 else
2947         AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
2948         AC_CHECK_FUNCS([crypt])
2949 fi
2950
2951 AC_CHECK_FUNCS([ \
2952         arc4random \
2953         arc4random_buf \
2954         arc4random_stir \
2955         arc4random_uniform \
2956 ])
2957
2958 saved_LIBS="$LIBS"
2959 AC_CHECK_LIB([iaf], [ia_openinfo], [
2960         LIBS="$LIBS -liaf"
2961         AC_CHECK_FUNCS([set_id], [SSHDLIBS="$SSHDLIBS -liaf"
2962                                 AC_DEFINE([HAVE_LIBIAF], [1],
2963                         [Define if system has libiaf that supports set_id])
2964                                 ])
2965 ])
2966 LIBS="$saved_LIBS"
2967
2968 ### Configure cryptographic random number support
2969
2970 # Check whether OpenSSL seeds itself
2971 if test "x$openssl" = "xyes" ; then
2972         AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2973         AC_RUN_IFELSE(
2974                 [AC_LANG_PROGRAM([[
2975         #include <string.h>
2976         #include <openssl/rand.h>
2977                 ]], [[
2978                 exit(RAND_status() == 1 ? 0 : 1);
2979                 ]])],
2980                 [
2981                         OPENSSL_SEEDS_ITSELF=yes
2982                         AC_MSG_RESULT([yes])
2983                 ],
2984                 [
2985                         AC_MSG_RESULT([no])
2986                 ],
2987                 [
2988                         AC_MSG_WARN([cross compiling: assuming yes])
2989                         # This is safe, since we will fatal() at runtime if
2990                         # OpenSSL is not seeded correctly.
2991                         OPENSSL_SEEDS_ITSELF=yes
2992                 ]
2993         )
2994 fi
2995
2996 # PRNGD TCP socket
2997 AC_ARG_WITH([prngd-port],
2998         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2999         [
3000                 case "$withval" in
3001                 no)
3002                         withval=""
3003                         ;;
3004                 [[0-9]]*)
3005                         ;;
3006                 *)
3007                         AC_MSG_ERROR([You must specify a numeric port number for --with-prngd-port])
3008                         ;;
3009                 esac
3010                 if test ! -z "$withval" ; then
3011                         PRNGD_PORT="$withval"
3012                         AC_DEFINE_UNQUOTED([PRNGD_PORT], [$PRNGD_PORT],
3013                                 [Port number of PRNGD/EGD random number socket])
3014                 fi
3015         ]
3016 )
3017
3018 # PRNGD Unix domain socket
3019 AC_ARG_WITH([prngd-socket],
3020         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
3021         [
3022                 case "$withval" in
3023                 yes)
3024                         withval="/var/run/egd-pool"
3025                         ;;
3026                 no)
3027                         withval=""
3028                         ;;
3029                 /*)
3030                         ;;
3031                 *)
3032                         AC_MSG_ERROR([You must specify an absolute path to the entropy socket])
3033                         ;;
3034                 esac
3035
3036                 if test ! -z "$withval" ; then
3037                         if test ! -z "$PRNGD_PORT" ; then
3038                                 AC_MSG_ERROR([You may not specify both a PRNGD/EGD port and socket])
3039                         fi
3040                         if test ! -r "$withval" ; then
3041                                 AC_MSG_WARN([Entropy socket is not readable])
3042                         fi
3043                         PRNGD_SOCKET="$withval"
3044                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"],
3045                                 [Location of PRNGD/EGD random number socket])
3046                 fi
3047         ],
3048         [
3049                 # Check for existing socket only if we don't have a random device already
3050                 if test "x$OPENSSL_SEEDS_ITSELF" != "xyes" ; then
3051                         AC_MSG_CHECKING([for PRNGD/EGD socket])
3052                         # Insert other locations here
3053                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
3054                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
3055                                         PRNGD_SOCKET="$sock"
3056                                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"])
3057                                         break;
3058                                 fi
3059                         done
3060                         if test ! -z "$PRNGD_SOCKET" ; then
3061                                 AC_MSG_RESULT([$PRNGD_SOCKET])
3062                         else
3063                                 AC_MSG_RESULT([not found])
3064                         fi
3065                 fi
3066         ]
3067 )
3068
3069 # Which randomness source do we use?
3070 if test ! -z "$PRNGD_PORT" ; then
3071         RAND_MSG="PRNGd port $PRNGD_PORT"
3072 elif test ! -z "$PRNGD_SOCKET" ; then
3073         RAND_MSG="PRNGd socket $PRNGD_SOCKET"
3074 elif test ! -z "$OPENSSL_SEEDS_ITSELF" ; then
3075         AC_DEFINE([OPENSSL_PRNG_ONLY], [1],
3076                 [Define if you want the OpenSSL internally seeded PRNG only])
3077         RAND_MSG="OpenSSL internal ONLY"
3078 elif test "x$openssl" = "xno" ; then
3079         AC_MSG_WARN([OpenSSH will use /dev/urandom as a source of random numbers. It will fail if this device is not supported or accessible])
3080 else
3081         AC_MSG_ERROR([OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options])
3082 fi
3083
3084 # Check for PAM libs
3085 PAM_MSG="no"
3086 AC_ARG_WITH([pam],
3087         [  --with-pam              Enable PAM support ],
3088         [
3089                 if test "x$withval" != "xno" ; then
3090                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
3091                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
3092                                 AC_MSG_ERROR([PAM headers not found])
3093                         fi
3094
3095                         saved_LIBS="$LIBS"
3096                         AC_CHECK_LIB([dl], [dlopen], , )
3097                         AC_CHECK_LIB([pam], [pam_set_item], , [AC_MSG_ERROR([*** libpam missing])])
3098                         AC_CHECK_FUNCS([pam_getenvlist])
3099                         AC_CHECK_FUNCS([pam_putenv])
3100                         LIBS="$saved_LIBS"
3101
3102                         PAM_MSG="yes"
3103
3104                         SSHDLIBS="$SSHDLIBS -lpam"
3105                         AC_DEFINE([USE_PAM], [1],
3106                                 [Define if you want to enable PAM support])
3107
3108                         if test $ac_cv_lib_dl_dlopen = yes; then
3109                                 case "$LIBS" in
3110                                 *-ldl*)
3111                                         # libdl already in LIBS
3112                                         ;;
3113                                 *)
3114                                         SSHDLIBS="$SSHDLIBS -ldl"
3115                                         ;;
3116                                 esac
3117                         fi
3118                 fi
3119         ]
3120 )
3121
3122 AC_ARG_WITH([pam-service],
3123         [  --with-pam-service=name Specify PAM service name ],
3124         [
3125                 if test "x$withval" != "xno" && \
3126                    test "x$withval" != "xyes" ; then
3127                         AC_DEFINE_UNQUOTED([SSHD_PAM_SERVICE],
3128                                 ["$withval"], [sshd PAM service name])
3129                 fi
3130         ]
3131 )
3132
3133 # Check for older PAM
3134 if test "x$PAM_MSG" = "xyes" ; then
3135         # Check PAM strerror arguments (old PAM)
3136         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
3137         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3138 #include <stdlib.h>
3139 #if defined(HAVE_SECURITY_PAM_APPL_H)
3140 #include <security/pam_appl.h>
3141 #elif defined (HAVE_PAM_PAM_APPL_H)
3142 #include <pam/pam_appl.h>
3143 #endif
3144                 ]], [[
3145 (void)pam_strerror((pam_handle_t *)NULL, -1);
3146                 ]])], [AC_MSG_RESULT([no])], [
3147                         AC_DEFINE([HAVE_OLD_PAM], [1],
3148                                 [Define if you have an old version of PAM
3149                                 which takes only one argument to pam_strerror])
3150                         AC_MSG_RESULT([yes])
3151                         PAM_MSG="yes (old library)"
3152
3153         ])
3154 fi
3155
3156 case "$host" in
3157 *-*-cygwin*)
3158         SSH_PRIVSEP_USER=CYGWIN_SSH_PRIVSEP_USER
3159         ;;
3160 *)
3161         SSH_PRIVSEP_USER=sshd
3162         ;;
3163 esac
3164 AC_ARG_WITH([privsep-user],
3165         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
3166         [
3167                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3168                     test "x${withval}" != "xyes"; then
3169                         SSH_PRIVSEP_USER=$withval
3170                 fi
3171         ]
3172 )
3173 if test "x$SSH_PRIVSEP_USER" = "xCYGWIN_SSH_PRIVSEP_USER" ; then
3174         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], [CYGWIN_SSH_PRIVSEP_USER],
3175                 [Cygwin function to fetch non-privileged user for privilege separation])
3176 else
3177         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], ["$SSH_PRIVSEP_USER"],
3178                 [non-privileged user for privilege separation])
3179 fi
3180 AC_SUBST([SSH_PRIVSEP_USER])
3181
3182 if test "x$have_linux_no_new_privs" = "x1" ; then
3183 AC_CHECK_DECL([SECCOMP_MODE_FILTER], [have_seccomp_filter=1], , [
3184         #include <sys/types.h>
3185         #include <linux/seccomp.h>
3186 ])
3187 fi
3188 if test "x$have_seccomp_filter" = "x1" ; then
3189 AC_MSG_CHECKING([kernel for seccomp_filter support])
3190 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
3191                 #include <errno.h>
3192                 #include <elf.h>
3193                 #include <linux/audit.h>
3194                 #include <linux/seccomp.h>
3195                 #include <stdlib.h>
3196                 #include <sys/prctl.h>
3197         ]],
3198         [[ int i = $seccomp_audit_arch;
3199            errno = 0;
3200            prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
3201            exit(errno == EFAULT ? 0 : 1); ]])],
3202         [ AC_MSG_RESULT([yes]) ], [
3203                 AC_MSG_RESULT([no])
3204                 # Disable seccomp filter as a target
3205                 have_seccomp_filter=0
3206         ]
3207 )
3208 fi
3209
3210 # Decide which sandbox style to use
3211 sandbox_arg=""
3212 AC_ARG_WITH([sandbox],
3213         [  --with-sandbox=style    Specify privilege separation sandbox (no, capsicum, darwin, rlimit, seccomp_filter, systrace, pledge)],
3214         [
3215                 if test "x$withval" = "xyes" ; then
3216                         sandbox_arg=""
3217                 else
3218                         sandbox_arg="$withval"
3219                 fi
3220         ]
3221 )
3222
3223 # Some platforms (seems to be the ones that have a kernel poll(2)-type
3224 # function with which they implement select(2)) use an extra file descriptor
3225 # when calling select(2), which means we can't use the rlimit sandbox.
3226 AC_MSG_CHECKING([if select works with descriptor rlimit])
3227 AC_RUN_IFELSE(
3228         [AC_LANG_PROGRAM([[
3229 #include <sys/types.h>
3230 #ifdef HAVE_SYS_TIME_H
3231 # include <sys/time.h>
3232 #endif
3233 #include <sys/resource.h>
3234 #ifdef HAVE_SYS_SELECT_H
3235 # include <sys/select.h>
3236 #endif
3237 #include <errno.h>
3238 #include <fcntl.h>
3239 #include <stdlib.h>
3240         ]],[[
3241         struct rlimit rl_zero;
3242         int fd, r;
3243         fd_set fds;
3244         struct timeval tv;
3245
3246         fd = open("/dev/null", O_RDONLY);
3247         FD_ZERO(&fds);
3248         FD_SET(fd, &fds);
3249         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3250         setrlimit(RLIMIT_FSIZE, &rl_zero);
3251         setrlimit(RLIMIT_NOFILE, &rl_zero);
3252         tv.tv_sec = 1;
3253         tv.tv_usec = 0;
3254         r = select(fd+1, &fds, NULL, NULL, &tv);
3255         exit (r == -1 ? 1 : 0);
3256         ]])],
3257         [AC_MSG_RESULT([yes])
3258          select_works_with_rlimit=yes],
3259         [AC_MSG_RESULT([no])
3260          select_works_with_rlimit=no],
3261         [AC_MSG_WARN([cross compiling: assuming yes])
3262          select_works_with_rlimit=yes]
3263 )
3264
3265 AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works])
3266 AC_RUN_IFELSE(
3267         [AC_LANG_PROGRAM([[
3268 #include <sys/types.h>
3269 #ifdef HAVE_SYS_TIME_H
3270 # include <sys/time.h>
3271 #endif
3272 #include <sys/resource.h>
3273 #include <errno.h>
3274 #include <stdlib.h>
3275         ]],[[
3276         struct rlimit rl_zero;
3277         int fd, r;
3278         fd_set fds;
3279
3280         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3281         r = setrlimit(RLIMIT_NOFILE, &rl_zero);
3282         exit (r == -1 ? 1 : 0);
3283         ]])],
3284         [AC_MSG_RESULT([yes])
3285          rlimit_nofile_zero_works=yes],
3286         [AC_MSG_RESULT([no])
3287          rlimit_nofile_zero_works=no],
3288         [AC_MSG_WARN([cross compiling: assuming yes])
3289          rlimit_nofile_zero_works=yes]
3290 )
3291
3292 AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
3293 AC_RUN_IFELSE(
3294         [AC_LANG_PROGRAM([[
3295 #include <sys/types.h>
3296 #include <sys/resource.h>
3297 #include <stdlib.h>
3298         ]],[[
3299                 struct rlimit rl_zero;
3300
3301                 rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3302                 exit(setrlimit(RLIMIT_FSIZE, &rl_zero) != 0);
3303         ]])],
3304         [AC_MSG_RESULT([yes])],
3305         [AC_MSG_RESULT([no])
3306          AC_DEFINE(SANDBOX_SKIP_RLIMIT_FSIZE, 1,
3307             [setrlimit RLIMIT_FSIZE works])],
3308         [AC_MSG_WARN([cross compiling: assuming yes])]
3309 )
3310
3311 if test "x$sandbox_arg" = "xpledge" || \
3312    ( test -z "$sandbox_arg" && test "x$ac_cv_func_pledge" = "xyes" ) ; then
3313         test "x$ac_cv_func_pledge" != "xyes" && \
3314                 AC_MSG_ERROR([pledge sandbox requires pledge(2) support])
3315         SANDBOX_STYLE="pledge"
3316         AC_DEFINE([SANDBOX_PLEDGE], [1], [Sandbox using pledge(2)])
3317 elif test "x$sandbox_arg" = "xsystrace" || \
3318    ( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
3319         test "x$have_systr_policy_kill" != "x1" && \
3320                 AC_MSG_ERROR([systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support])
3321         SANDBOX_STYLE="systrace"
3322         AC_DEFINE([SANDBOX_SYSTRACE], [1], [Sandbox using systrace(4)])
3323 elif test "x$sandbox_arg" = "xdarwin" || \
3324      ( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \
3325        test "x$ac_cv_header_sandbox_h" = "xyes") ; then
3326         test "x$ac_cv_func_sandbox_init" != "xyes" -o \
3327              "x$ac_cv_header_sandbox_h" != "xyes" && \
3328                 AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h and sandbox_init function])
3329         SANDBOX_STYLE="darwin"
3330         AC_DEFINE([SANDBOX_DARWIN], [1], [Sandbox using Darwin sandbox_init(3)])
3331 elif test "x$sandbox_arg" = "xseccomp_filter" || \
3332      ( test -z "$sandbox_arg" && \
3333        test "x$have_seccomp_filter" = "x1" && \
3334        test "x$ac_cv_header_elf_h" = "xyes" && \
3335        test "x$ac_cv_header_linux_audit_h" = "xyes" && \
3336        test "x$ac_cv_header_linux_filter_h" = "xyes" && \
3337        test "x$seccomp_audit_arch" != "x" && \
3338        test "x$have_linux_no_new_privs" = "x1" && \
3339        test "x$ac_cv_func_prctl" = "xyes" ) ; then
3340         test "x$seccomp_audit_arch" = "x" && \
3341                 AC_MSG_ERROR([seccomp_filter sandbox not supported on $host])
3342         test "x$have_linux_no_new_privs" != "x1" && \
3343                 AC_MSG_ERROR([seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS])
3344         test "x$have_seccomp_filter" != "x1" && \
3345                 AC_MSG_ERROR([seccomp_filter sandbox requires seccomp headers])
3346         test "x$ac_cv_func_prctl" != "xyes" && \
3347                 AC_MSG_ERROR([seccomp_filter sandbox requires prctl function])
3348         SANDBOX_STYLE="seccomp_filter"
3349         AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
3350 elif test "x$sandbox_arg" = "xcapsicum" || \
3351      ( test -z "$sandbox_arg" && \
3352        test "x$ac_cv_header_sys_capsicum_h" = "xyes" && \
3353        test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
3354        test "x$ac_cv_header_sys_capsicum_h" != "xyes" && \
3355                 AC_MSG_ERROR([capsicum sandbox requires sys/capsicum.h header])
3356        test "x$ac_cv_func_cap_rights_limit" != "xyes" && \
3357                 AC_MSG_ERROR([capsicum sandbox requires cap_rights_limit function])
3358        SANDBOX_STYLE="capsicum"
3359        AC_DEFINE([SANDBOX_CAPSICUM], [1], [Sandbox using capsicum])
3360 elif test "x$sandbox_arg" = "xrlimit" || \
3361      ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
3362        test "x$select_works_with_rlimit" = "xyes" && \
3363        test "x$rlimit_nofile_zero_works" = "xyes" ) ; then
3364         test "x$ac_cv_func_setrlimit" != "xyes" && \
3365                 AC_MSG_ERROR([rlimit sandbox requires setrlimit function])
3366         test "x$select_works_with_rlimit" != "xyes" && \
3367                 AC_MSG_ERROR([rlimit sandbox requires select to work with rlimit])
3368         SANDBOX_STYLE="rlimit"
3369         AC_DEFINE([SANDBOX_RLIMIT], [1], [Sandbox using setrlimit(2)])
3370 elif test "x$sandbox_arg" = "xsolaris" || \
3371    ( test -z "$sandbox_arg" && test "x$SOLARIS_PRIVS" = "xyes" ) ; then
3372         SANDBOX_STYLE="solaris"
3373         AC_DEFINE([SANDBOX_SOLARIS], [1], [Sandbox using Solaris/Illumos privileges])
3374 elif test -z "$sandbox_arg" || test "x$sandbox_arg" = "xno" || \
3375      test "x$sandbox_arg" = "xnone" || test "x$sandbox_arg" = "xnull" ; then
3376         SANDBOX_STYLE="none"
3377         AC_DEFINE([SANDBOX_NULL], [1], [no privsep sandboxing])
3378 else
3379         AC_MSG_ERROR([unsupported --with-sandbox])
3380 fi
3381
3382 # Cheap hack to ensure NEWS-OS libraries are arranged right.
3383 if test ! -z "$SONY" ; then
3384   LIBS="$LIBS -liberty";
3385 fi
3386
3387 # Check for  long long datatypes
3388 AC_CHECK_TYPES([long long, unsigned long long, long double])
3389
3390 # Check datatype sizes
3391 AC_CHECK_SIZEOF([short int], [2])
3392 AC_CHECK_SIZEOF([int], [4])
3393 AC_CHECK_SIZEOF([long int], [4])
3394 AC_CHECK_SIZEOF([long long int], [8])
3395
3396 # Sanity check long long for some platforms (AIX)
3397 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
3398         ac_cv_sizeof_long_long_int=0
3399 fi
3400
3401 # compute LLONG_MIN and LLONG_MAX if we don't know them.
3402 if test -z "$have_llong_max"; then
3403         AC_MSG_CHECKING([for max value of long long])
3404         AC_RUN_IFELSE(
3405                 [AC_LANG_PROGRAM([[
3406 #include <stdio.h>
3407 /* Why is this so damn hard? */
3408 #ifdef __GNUC__
3409 # undef __GNUC__
3410 #endif
3411 #define __USE_ISOC99
3412 #include <limits.h>
3413 #define DATA "conftest.llminmax"
3414 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
3415
3416 /*
3417  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
3418  * we do this the hard way.
3419  */
3420 static int
3421 fprint_ll(FILE *f, long long n)
3422 {
3423         unsigned int i;
3424         int l[sizeof(long long) * 8];
3425
3426         if (n < 0)
3427                 if (fprintf(f, "-") < 0)
3428                         return -1;
3429         for (i = 0; n != 0; i++) {
3430                 l[i] = my_abs(n % 10);
3431                 n /= 10;
3432         }
3433         do {
3434                 if (fprintf(f, "%d", l[--i]) < 0)
3435                         return -1;
3436         } while (i != 0);
3437         if (fprintf(f, " ") < 0)
3438                 return -1;
3439         return 0;
3440 }
3441                 ]], [[
3442         FILE *f;
3443         long long i, llmin, llmax = 0;
3444
3445         if((f = fopen(DATA,"w")) == NULL)
3446                 exit(1);
3447
3448 #if defined(LLONG_MIN) && defined(LLONG_MAX)
3449         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
3450         llmin = LLONG_MIN;
3451         llmax = LLONG_MAX;
3452 #else
3453         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
3454         /* This will work on one's complement and two's complement */
3455         for (i = 1; i > llmax; i <<= 1, i++)
3456                 llmax = i;
3457         llmin = llmax + 1LL;    /* wrap */
3458 #endif
3459
3460         /* Sanity check */
3461         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
3462             || llmax - 1 > llmax || llmin == llmax || llmin == 0
3463             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
3464                 fprintf(f, "unknown unknown\n");
3465                 exit(2);
3466         }
3467
3468         if (fprint_ll(f, llmin) < 0)
3469                 exit(3);
3470         if (fprint_ll(f, llmax) < 0)
3471                 exit(4);
3472         if (fclose(f) < 0)
3473                 exit(5);
3474         exit(0);
3475                 ]])],
3476                 [
3477                         llong_min=`$AWK '{print $1}' conftest.llminmax`
3478                         llong_max=`$AWK '{print $2}' conftest.llminmax`
3479
3480                         AC_MSG_RESULT([$llong_max])
3481                         AC_DEFINE_UNQUOTED([LLONG_MAX], [${llong_max}LL],
3482                             [max value of long long calculated by configure])
3483                         AC_MSG_CHECKING([for min value of long long])
3484                         AC_MSG_RESULT([$llong_min])
3485                         AC_DEFINE_UNQUOTED([LLONG_MIN], [${llong_min}LL],
3486                             [min value of long long calculated by configure])
3487                 ],
3488                 [
3489                         AC_MSG_RESULT([not found])
3490                 ],
3491                 [
3492                         AC_MSG_WARN([cross compiling: not checking])
3493                 ]
3494         )
3495 fi
3496
3497
3498 # More checks for data types
3499 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
3500         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3501         [[ u_int a; a = 1;]])],
3502         [ ac_cv_have_u_int="yes" ], [ ac_cv_have_u_int="no"
3503         ])
3504 ])
3505 if test "x$ac_cv_have_u_int" = "xyes" ; then
3506         AC_DEFINE([HAVE_U_INT], [1], [define if you have u_int data type])
3507         have_u_int=1
3508 fi
3509
3510 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
3511         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3512         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3513         [ ac_cv_have_intxx_t="yes" ], [ ac_cv_have_intxx_t="no"
3514         ])
3515 ])
3516 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
3517         AC_DEFINE([HAVE_INTXX_T], [1], [define if you have intxx_t data type])
3518         have_intxx_t=1
3519 fi
3520
3521 if (test -z "$have_intxx_t" && \
3522            test "x$ac_cv_header_stdint_h" = "xyes")
3523 then
3524     AC_MSG_CHECKING([for intXX_t types in stdint.h])
3525         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3526         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3527                 [
3528                         AC_DEFINE([HAVE_INTXX_T])
3529                         AC_MSG_RESULT([yes])
3530                 ], [ AC_MSG_RESULT([no])
3531         ])
3532 fi
3533
3534 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
3535         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3536 #include <sys/types.h>
3537 #ifdef HAVE_STDINT_H
3538 # include <stdint.h>
3539 #endif
3540 #include <sys/socket.h>
3541 #ifdef HAVE_SYS_BITYPES_H
3542 # include <sys/bitypes.h>
3543 #endif
3544                 ]], [[
3545 int64_t a; a = 1;
3546                 ]])],
3547         [ ac_cv_have_int64_t="yes" ], [ ac_cv_have_int64_t="no"
3548         ])
3549 ])
3550 if test "x$ac_cv_have_int64_t" = "xyes" ; then
3551         AC_DEFINE([HAVE_INT64_T], [1], [define if you have int64_t data type])
3552 fi
3553
3554 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
3555         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3556         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3557         [ ac_cv_have_u_intxx_t="yes" ], [ ac_cv_have_u_intxx_t="no"
3558         ])
3559 ])
3560 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
3561         AC_DEFINE([HAVE_U_INTXX_T], [1], [define if you have u_intxx_t data type])
3562         have_u_intxx_t=1
3563 fi
3564
3565 if test -z "$have_u_intxx_t" ; then
3566     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
3567         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/socket.h> ]],
3568         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3569                 [
3570                         AC_DEFINE([HAVE_U_INTXX_T])
3571                         AC_MSG_RESULT([yes])
3572                 ], [ AC_MSG_RESULT([no])
3573         ])
3574 fi
3575
3576 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
3577         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3578         [[ u_int64_t a; a = 1;]])],
3579         [ ac_cv_have_u_int64_t="yes" ], [ ac_cv_have_u_int64_t="no"
3580         ])
3581 ])
3582 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
3583         AC_DEFINE([HAVE_U_INT64_T], [1], [define if you have u_int64_t data type])
3584         have_u_int64_t=1
3585 fi
3586
3587 if (test -z "$have_u_int64_t" && \
3588            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3589 then
3590     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
3591         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/bitypes.h> ]],
3592         [[ u_int64_t a; a = 1]])],
3593                 [
3594                         AC_DEFINE([HAVE_U_INT64_T])
3595                         AC_MSG_RESULT([yes])
3596                 ], [ AC_MSG_RESULT([no])
3597         ])
3598 fi
3599
3600 if test -z "$have_u_intxx_t" ; then
3601         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
3602                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3603 #include <sys/types.h>
3604                         ]], [[
3605         uint8_t a;
3606         uint16_t b;
3607         uint32_t c;
3608         a = b = c = 1;
3609                         ]])],
3610                 [ ac_cv_have_uintxx_t="yes" ], [ ac_cv_have_uintxx_t="no"
3611                 ])
3612         ])
3613         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
3614                 AC_DEFINE([HAVE_UINTXX_T], [1],
3615                         [define if you have uintxx_t data type])
3616         fi
3617 fi
3618
3619 if (test -z "$have_uintxx_t" && \
3620            test "x$ac_cv_header_stdint_h" = "xyes")
3621 then
3622     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
3623         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3624         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3625                 [
3626                         AC_DEFINE([HAVE_UINTXX_T])
3627                         AC_MSG_RESULT([yes])
3628                 ], [ AC_MSG_RESULT([no])
3629         ])
3630 fi
3631
3632 if (test -z "$have_uintxx_t" && \
3633            test "x$ac_cv_header_inttypes_h" = "xyes")
3634 then
3635     AC_MSG_CHECKING([for uintXX_t types in inttypes.h])
3636         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <inttypes.h> ]],
3637         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3638                 [
3639                         AC_DEFINE([HAVE_UINTXX_T])
3640                         AC_MSG_RESULT([yes])
3641                 ], [ AC_MSG_RESULT([no])
3642         ])
3643 fi
3644
3645 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
3646            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3647 then
3648         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
3649         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3650 #include <sys/bitypes.h>
3651                 ]], [[
3652                         int8_t a; int16_t b; int32_t c;
3653                         u_int8_t e; u_int16_t f; u_int32_t g;
3654                         a = b = c = e = f = g = 1;
3655                 ]])],
3656                 [
3657                         AC_DEFINE([HAVE_U_INTXX_T])
3658                         AC_DEFINE([HAVE_INTXX_T])
3659                         AC_MSG_RESULT([yes])
3660                 ], [AC_MSG_RESULT([no])
3661         ])
3662 fi
3663
3664
3665 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
3666         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3667         [[ u_char foo; foo = 125; ]])],
3668         [ ac_cv_have_u_char="yes" ], [ ac_cv_have_u_char="no"
3669         ])
3670 ])
3671 if test "x$ac_cv_have_u_char" = "xyes" ; then
3672         AC_DEFINE([HAVE_U_CHAR], [1], [define if you have u_char data type])
3673 fi
3674
3675 AC_CHECK_TYPES([intmax_t, uintmax_t], , , [
3676 #include <sys/types.h>
3677 #include <stdint.h>
3678 ])
3679
3680 TYPE_SOCKLEN_T
3681
3682 AC_CHECK_TYPES([sig_atomic_t], , , [#include <signal.h>])
3683 AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t], , , [
3684 #include <sys/types.h>
3685 #ifdef HAVE_SYS_BITYPES_H
3686 #include <sys/bitypes.h>
3687 #endif
3688 #ifdef HAVE_SYS_STATFS_H
3689 #include <sys/statfs.h>
3690 #endif
3691 #ifdef HAVE_SYS_STATVFS_H
3692 #include <sys/statvfs.h>
3693 #endif
3694 ])
3695
3696 AC_CHECK_MEMBERS([struct statfs.f_flags], [], [], [[
3697 #include <sys/types.h>
3698 #ifdef HAVE_SYS_BITYPES_H
3699 #include <sys/bitypes.h>
3700 #endif
3701 #ifdef HAVE_SYS_STATFS_H
3702 #include <sys/statfs.h>
3703 #endif
3704 #ifdef HAVE_SYS_STATVFS_H
3705 #include <sys/statvfs.h>
3706 #endif
3707 #ifdef HAVE_SYS_VFS_H
3708 #include <sys/vfs.h>
3709 #endif
3710 ]])
3711
3712
3713 AC_CHECK_TYPES([in_addr_t, in_port_t], , ,
3714 [#include <sys/types.h>
3715 #include <netinet/in.h>])
3716
3717 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
3718         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3719         [[ size_t foo; foo = 1235; ]])],
3720         [ ac_cv_have_size_t="yes" ], [ ac_cv_have_size_t="no"
3721         ])
3722 ])
3723 if test "x$ac_cv_have_size_t" = "xyes" ; then
3724         AC_DEFINE([HAVE_SIZE_T], [1], [define if you have size_t data type])
3725 fi
3726
3727 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
3728         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3729         [[ ssize_t foo; foo = 1235; ]])],
3730         [ ac_cv_have_ssize_t="yes" ], [ ac_cv_have_ssize_t="no"
3731         ])
3732 ])
3733 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
3734         AC_DEFINE([HAVE_SSIZE_T], [1], [define if you have ssize_t data type])
3735 fi
3736
3737 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
3738         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <time.h> ]],
3739         [[ clock_t foo; foo = 1235; ]])],
3740         [ ac_cv_have_clock_t="yes" ], [ ac_cv_have_clock_t="no"
3741         ])
3742 ])
3743 if test "x$ac_cv_have_clock_t" = "xyes" ; then
3744         AC_DEFINE([HAVE_CLOCK_T], [1], [define if you have clock_t data type])
3745 fi
3746
3747 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
3748         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3749 #include <sys/types.h>
3750 #include <sys/socket.h>
3751                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3752         [ ac_cv_have_sa_family_t="yes" ],
3753         [ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3754 #include <sys/types.h>
3755 #include <sys/socket.h>
3756 #include <netinet/in.h>
3757                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3758                 [ ac_cv_have_sa_family_t="yes" ],
3759                 [ ac_cv_have_sa_family_t="no" ]
3760         )
3761         ])
3762 ])
3763 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
3764         AC_DEFINE([HAVE_SA_FAMILY_T], [1],
3765                 [define if you have sa_family_t data type])
3766 fi
3767
3768 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
3769         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3770         [[ pid_t foo; foo = 1235; ]])],
3771         [ ac_cv_have_pid_t="yes" ], [ ac_cv_have_pid_t="no"
3772         ])
3773 ])
3774 if test "x$ac_cv_have_pid_t" = "xyes" ; then
3775         AC_DEFINE([HAVE_PID_T], [1], [define if you have pid_t data type])
3776 fi
3777
3778 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
3779         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3780         [[ mode_t foo; foo = 1235; ]])],
3781         [ ac_cv_have_mode_t="yes" ], [ ac_cv_have_mode_t="no"
3782         ])
3783 ])
3784 if test "x$ac_cv_have_mode_t" = "xyes" ; then
3785         AC_DEFINE([HAVE_MODE_T], [1], [define if you have mode_t data type])
3786 fi
3787
3788
3789 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
3790         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3791 #include <sys/types.h>
3792 #include <sys/socket.h>
3793                 ]], [[ struct sockaddr_storage s; ]])],
3794         [ ac_cv_have_struct_sockaddr_storage="yes" ],
3795         [ ac_cv_have_struct_sockaddr_storage="no"
3796         ])
3797 ])
3798 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
3799         AC_DEFINE([HAVE_STRUCT_SOCKADDR_STORAGE], [1],
3800                 [define if you have struct sockaddr_storage data type])
3801 fi
3802
3803 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
3804         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3805 #include <sys/types.h>
3806 #include <netinet/in.h>
3807                 ]], [[ struct sockaddr_in6 s; s.sin6_family = 0; ]])],
3808         [ ac_cv_have_struct_sockaddr_in6="yes" ],
3809         [ ac_cv_have_struct_sockaddr_in6="no"
3810         ])
3811 ])
3812 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
3813         AC_DEFINE([HAVE_STRUCT_SOCKADDR_IN6], [1],
3814                 [define if you have struct sockaddr_in6 data type])
3815 fi
3816
3817 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
3818         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3819 #include <sys/types.h>
3820 #include <netinet/in.h>
3821                 ]], [[ struct in6_addr s; s.s6_addr[0] = 0; ]])],
3822         [ ac_cv_have_struct_in6_addr="yes" ],
3823         [ ac_cv_have_struct_in6_addr="no"
3824         ])
3825 ])
3826 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
3827         AC_DEFINE([HAVE_STRUCT_IN6_ADDR], [1],
3828                 [define if you have struct in6_addr data type])
3829
3830 dnl Now check for sin6_scope_id
3831         AC_CHECK_MEMBERS([struct sockaddr_in6.sin6_scope_id], , ,
3832                 [
3833 #ifdef HAVE_SYS_TYPES_H
3834 #include <sys/types.h>
3835 #endif
3836 #include <netinet/in.h>
3837                 ])
3838 fi
3839
3840 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
3841         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3842 #include <sys/types.h>
3843 #include <sys/socket.h>
3844 #include <netdb.h>
3845                 ]], [[ struct addrinfo s; s.ai_flags = AI_PASSIVE; ]])],
3846         [ ac_cv_have_struct_addrinfo="yes" ],
3847         [ ac_cv_have_struct_addrinfo="no"
3848         ])
3849 ])
3850 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
3851         AC_DEFINE([HAVE_STRUCT_ADDRINFO], [1],
3852                 [define if you have struct addrinfo data type])
3853 fi
3854
3855 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
3856         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/time.h> ]],
3857         [[ struct timeval tv; tv.tv_sec = 1;]])],
3858         [ ac_cv_have_struct_timeval="yes" ],
3859         [ ac_cv_have_struct_timeval="no"
3860         ])
3861 ])
3862 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
3863         AC_DEFINE([HAVE_STRUCT_TIMEVAL], [1], [define if you have struct timeval])
3864         have_struct_timeval=1
3865 fi
3866
3867 AC_CHECK_TYPES([struct timespec])
3868
3869 # We need int64_t or else certain parts of the compile will fail.
3870 if test "x$ac_cv_have_int64_t" = "xno" && \
3871         test "x$ac_cv_sizeof_long_int" != "x8" && \
3872         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
3873         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
3874         echo "an alternative compiler (I.E., GCC) before continuing."
3875         echo ""
3876         exit 1;
3877 else
3878 dnl test snprintf (broken on SCO w/gcc)
3879         AC_RUN_IFELSE(
3880                 [AC_LANG_SOURCE([[
3881 #include <stdio.h>
3882 #include <string.h>
3883 #ifdef HAVE_SNPRINTF
3884 main()
3885 {
3886         char buf[50];
3887         char expected_out[50];
3888         int mazsize = 50 ;
3889 #if (SIZEOF_LONG_INT == 8)
3890         long int num = 0x7fffffffffffffff;
3891 #else
3892         long long num = 0x7fffffffffffffffll;
3893 #endif
3894         strcpy(expected_out, "9223372036854775807");
3895         snprintf(buf, mazsize, "%lld", num);
3896         if(strcmp(buf, expected_out) != 0)
3897                 exit(1);
3898         exit(0);
3899 }
3900 #else
3901 main() { exit(0); }
3902 #endif
3903                 ]])], [ true ], [ AC_DEFINE([BROKEN_SNPRINTF]) ],
3904                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3905         )
3906 fi
3907
3908 dnl Checks for structure members
3909 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmp.h], [HAVE_HOST_IN_UTMP])
3910 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmpx.h], [HAVE_HOST_IN_UTMPX])
3911 OSSH_CHECK_HEADER_FOR_FIELD([syslen], [utmpx.h], [HAVE_SYSLEN_IN_UTMPX])
3912 OSSH_CHECK_HEADER_FOR_FIELD([ut_pid], [utmp.h], [HAVE_PID_IN_UTMP])
3913 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmp.h], [HAVE_TYPE_IN_UTMP])
3914 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmpx.h], [HAVE_TYPE_IN_UTMPX])
3915 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmp.h], [HAVE_TV_IN_UTMP])
3916 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmp.h], [HAVE_ID_IN_UTMP])
3917 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmpx.h], [HAVE_ID_IN_UTMPX])
3918 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmp.h], [HAVE_ADDR_IN_UTMP])
3919 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmpx.h], [HAVE_ADDR_IN_UTMPX])
3920 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmp.h], [HAVE_ADDR_V6_IN_UTMP])
3921 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmpx.h], [HAVE_ADDR_V6_IN_UTMPX])
3922 OSSH_CHECK_HEADER_FOR_FIELD([ut_exit], [utmp.h], [HAVE_EXIT_IN_UTMP])
3923 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmp.h], [HAVE_TIME_IN_UTMP])
3924 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmpx.h], [HAVE_TIME_IN_UTMPX])
3925 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmpx.h], [HAVE_TV_IN_UTMPX])
3926
3927 AC_CHECK_MEMBERS([struct stat.st_blksize])
3928 AC_CHECK_MEMBERS([struct stat.st_mtim])
3929 AC_CHECK_MEMBERS([struct stat.st_mtime])
3930 AC_CHECK_MEMBERS([struct passwd.pw_gecos, struct passwd.pw_class,
3931 struct passwd.pw_change, struct passwd.pw_expire],
3932 [], [], [[
3933 #include <sys/types.h>
3934 #include <pwd.h>
3935 ]])
3936
3937 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE([__res_state], [state],
3938         [Define if we don't have struct __res_state in resolv.h])],
3939 [[
3940 #include <stdio.h>
3941 #if HAVE_SYS_TYPES_H
3942 # include <sys/types.h>
3943 #endif
3944 #include <netinet/in.h>
3945 #include <arpa/nameser.h>
3946 #include <resolv.h>
3947 ]])
3948
3949 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
3950                 ac_cv_have_ss_family_in_struct_ss, [
3951         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3952 #include <sys/types.h>
3953 #include <sys/socket.h>
3954                 ]], [[ struct sockaddr_storage s; s.ss_family = 1; ]])],
3955         [ ac_cv_have_ss_family_in_struct_ss="yes" ],
3956         [ ac_cv_have_ss_family_in_struct_ss="no" ])
3957 ])
3958 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3959         AC_DEFINE([HAVE_SS_FAMILY_IN_SS], [1], [Fields in struct sockaddr_storage])
3960 fi
3961
3962 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
3963                 ac_cv_have___ss_family_in_struct_ss, [
3964         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3965 #include <sys/types.h>
3966 #include <sys/socket.h>
3967                 ]], [[ struct sockaddr_storage s; s.__ss_family = 1; ]])],
3968         [ ac_cv_have___ss_family_in_struct_ss="yes" ],
3969         [ ac_cv_have___ss_family_in_struct_ss="no"
3970         ])
3971 ])
3972 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
3973         AC_DEFINE([HAVE___SS_FAMILY_IN_SS], [1],
3974                 [Fields in struct sockaddr_storage])
3975 fi
3976
3977 dnl make sure we're using the real structure members and not defines
3978 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3979                 ac_cv_have_accrights_in_msghdr, [
3980         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3981 #include <sys/types.h>
3982 #include <sys/socket.h>
3983 #include <sys/uio.h>
3984                 ]], [[
3985 #ifdef msg_accrights
3986 #error "msg_accrights is a macro"
3987 exit(1);
3988 #endif
3989 struct msghdr m;
3990 m.msg_accrights = 0;
3991 exit(0);
3992                 ]])],
3993                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3994                 [ ac_cv_have_accrights_in_msghdr="no" ]
3995         )
3996 ])
3997 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3998         AC_DEFINE([HAVE_ACCRIGHTS_IN_MSGHDR], [1],
3999                 [Define if your system uses access rights style
4000                 file descriptor passing])
4001 fi
4002
4003 AC_MSG_CHECKING([if struct statvfs.f_fsid is integral type])
4004 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4005 #include <sys/param.h>
4006 #include <sys/stat.h>
4007 #ifdef HAVE_SYS_TIME_H
4008 # include <sys/time.h>
4009 #endif
4010 #ifdef HAVE_SYS_MOUNT_H
4011 #include <sys/mount.h>
4012 #endif
4013 #ifdef HAVE_SYS_STATVFS_H
4014 #include <sys/statvfs.h>
4015 #endif
4016         ]], [[ struct statvfs s; s.f_fsid = 0; ]])],
4017         [ AC_MSG_RESULT([yes]) ],
4018         [ AC_MSG_RESULT([no])
4019
4020         AC_MSG_CHECKING([if fsid_t has member val])
4021         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4022 #include <sys/types.h>
4023 #include <sys/statvfs.h>
4024         ]], [[ fsid_t t; t.val[0] = 0; ]])],
4025         [ AC_MSG_RESULT([yes])
4026           AC_DEFINE([FSID_HAS_VAL], [1], [fsid_t has member val]) ],
4027         [ AC_MSG_RESULT([no]) ])
4028
4029         AC_MSG_CHECKING([if f_fsid has member __val])
4030         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4031 #include <sys/types.h>
4032 #include <sys/statvfs.h>
4033         ]], [[ fsid_t t; t.__val[0] = 0; ]])],
4034         [ AC_MSG_RESULT([yes])
4035           AC_DEFINE([FSID_HAS___VAL], [1], [fsid_t has member __val]) ],
4036         [ AC_MSG_RESULT([no]) ])
4037 ])
4038
4039 AC_CACHE_CHECK([for msg_control field in struct msghdr],
4040                 ac_cv_have_control_in_msghdr, [
4041         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4042 #include <sys/types.h>
4043 #include <sys/socket.h>
4044 #include <sys/uio.h>
4045                 ]], [[
4046 #ifdef msg_control
4047 #error "msg_control is a macro"
4048 exit(1);
4049 #endif
4050 struct msghdr m;
4051 m.msg_control = 0;
4052 exit(0);
4053                 ]])],
4054                 [ ac_cv_have_control_in_msghdr="yes" ],
4055                 [ ac_cv_have_control_in_msghdr="no" ]
4056         )
4057 ])
4058 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
4059         AC_DEFINE([HAVE_CONTROL_IN_MSGHDR], [1],
4060                 [Define if your system uses ancillary data style
4061                 file descriptor passing])
4062 fi
4063
4064 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
4065         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4066                 [[ extern char *__progname; printf("%s", __progname); ]])],
4067         [ ac_cv_libc_defines___progname="yes" ],
4068         [ ac_cv_libc_defines___progname="no"
4069         ])
4070 ])
4071 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
4072         AC_DEFINE([HAVE___PROGNAME], [1], [Define if libc defines __progname])
4073 fi
4074
4075 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
4076         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4077                 [[ printf("%s", __FUNCTION__); ]])],
4078         [ ac_cv_cc_implements___FUNCTION__="yes" ],
4079         [ ac_cv_cc_implements___FUNCTION__="no"
4080         ])
4081 ])
4082 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
4083         AC_DEFINE([HAVE___FUNCTION__], [1],
4084                 [Define if compiler implements __FUNCTION__])
4085 fi
4086
4087 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
4088         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4089                 [[ printf("%s", __func__); ]])],
4090         [ ac_cv_cc_implements___func__="yes" ],
4091         [ ac_cv_cc_implements___func__="no"
4092         ])
4093 ])
4094 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
4095         AC_DEFINE([HAVE___func__], [1], [Define if compiler implements __func__])
4096 fi
4097
4098 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
4099         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4100 #include <stdarg.h>
4101 va_list x,y;
4102                 ]], [[ va_copy(x,y); ]])],
4103         [ ac_cv_have_va_copy="yes" ],
4104         [ ac_cv_have_va_copy="no"
4105         ])
4106 ])
4107 if test "x$ac_cv_have_va_copy" = "xyes" ; then
4108         AC_DEFINE([HAVE_VA_COPY], [1], [Define if va_copy exists])
4109 fi
4110
4111 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
4112         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4113 #include <stdarg.h>
4114 va_list x,y;
4115                 ]], [[ __va_copy(x,y); ]])],
4116         [ ac_cv_have___va_copy="yes" ], [ ac_cv_have___va_copy="no"
4117         ])
4118 ])
4119 if test "x$ac_cv_have___va_copy" = "xyes" ; then
4120         AC_DEFINE([HAVE___VA_COPY], [1], [Define if __va_copy exists])
4121 fi
4122
4123 AC_CACHE_CHECK([whether getopt has optreset support],
4124                 ac_cv_have_getopt_optreset, [
4125         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <getopt.h> ]],
4126                 [[ extern int optreset; optreset = 0; ]])],
4127         [ ac_cv_have_getopt_optreset="yes" ],
4128         [ ac_cv_have_getopt_optreset="no"
4129         ])
4130 ])
4131 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
4132         AC_DEFINE([HAVE_GETOPT_OPTRESET], [1],
4133                 [Define if your getopt(3) defines and uses optreset])
4134 fi
4135
4136 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
4137         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4138 [[ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);]])],
4139         [ ac_cv_libc_defines_sys_errlist="yes" ],
4140         [ ac_cv_libc_defines_sys_errlist="no"
4141         ])
4142 ])
4143 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
4144         AC_DEFINE([HAVE_SYS_ERRLIST], [1],
4145                 [Define if your system defines sys_errlist[]])
4146 fi
4147
4148
4149 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
4150         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4151 [[ extern int sys_nerr; printf("%i", sys_nerr);]])],
4152         [ ac_cv_libc_defines_sys_nerr="yes" ],
4153         [ ac_cv_libc_defines_sys_nerr="no"
4154         ])
4155 ])
4156 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
4157         AC_DEFINE([HAVE_SYS_NERR], [1], [Define if your system defines sys_nerr])
4158 fi
4159
4160 # Check libraries needed by DNS fingerprint support
4161 AC_SEARCH_LIBS([getrrsetbyname], [resolv],
4162         [AC_DEFINE([HAVE_GETRRSETBYNAME], [1],
4163                 [Define if getrrsetbyname() exists])],
4164         [
4165                 # Needed by our getrrsetbyname()
4166                 AC_SEARCH_LIBS([res_query], [resolv])
4167                 AC_SEARCH_LIBS([dn_expand], [resolv])
4168                 AC_MSG_CHECKING([if res_query will link])
4169                 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4170 #include <sys/types.h>
4171 #include <netinet/in.h>
4172 #include <arpa/nameser.h>
4173 #include <netdb.h>
4174 #include <resolv.h>
4175                                 ]], [[
4176         res_query (0, 0, 0, 0, 0);
4177                                 ]])],
4178                     AC_MSG_RESULT([yes]),
4179                    [AC_MSG_RESULT([no])
4180                     saved_LIBS="$LIBS"
4181                     LIBS="$LIBS -lresolv"
4182                     AC_MSG_CHECKING([for res_query in -lresolv])
4183                     AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4184 #include <sys/types.h>
4185 #include <netinet/in.h>
4186 #include <arpa/nameser.h>
4187 #include <netdb.h>
4188 #include <resolv.h>
4189                                 ]], [[
4190         res_query (0, 0, 0, 0, 0);
4191                                 ]])],
4192                         [AC_MSG_RESULT([yes])],
4193                         [LIBS="$saved_LIBS"
4194                          AC_MSG_RESULT([no])])
4195                     ])
4196                 AC_CHECK_FUNCS([_getshort _getlong])
4197                 AC_CHECK_DECLS([_getshort, _getlong], , ,
4198                     [#include <sys/types.h>
4199                     #include <arpa/nameser.h>])
4200                 AC_CHECK_MEMBER([HEADER.ad],
4201                         [AC_DEFINE([HAVE_HEADER_AD], [1],
4202                             [Define if HEADER.ad exists in arpa/nameser.h])], ,
4203                         [#include <arpa/nameser.h>])
4204         ])
4205
4206 AC_MSG_CHECKING([if struct __res_state _res is an extern])
4207 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4208 #include <stdio.h>
4209 #if HAVE_SYS_TYPES_H
4210 # include <sys/types.h>
4211 #endif
4212 #include <netinet/in.h>
4213 #include <arpa/nameser.h>
4214 #include <resolv.h>
4215 extern struct __res_state _res;
4216                 ]], [[
4217 struct __res_state *volatile p = &_res;  /* force resolution of _res */
4218 return 0;
4219                 ]],)],
4220                 [AC_MSG_RESULT([yes])
4221                  AC_DEFINE([HAVE__RES_EXTERN], [1],
4222                     [Define if you have struct __res_state _res as an extern])
4223                 ],
4224                 [ AC_MSG_RESULT([no]) ]
4225 )
4226
4227 # Check whether user wants SELinux support
4228 SELINUX_MSG="no"
4229 LIBSELINUX=""
4230 AC_ARG_WITH([selinux],
4231         [  --with-selinux          Enable SELinux support],
4232         [ if test "x$withval" != "xno" ; then
4233                 save_LIBS="$LIBS"
4234                 AC_DEFINE([WITH_SELINUX], [1],
4235                         [Define if you want SELinux support.])
4236                 SELINUX_MSG="yes"
4237                 AC_CHECK_HEADER([selinux/selinux.h], ,
4238                         AC_MSG_ERROR([SELinux support requires selinux.h header]))
4239                 AC_CHECK_LIB([selinux], [setexeccon],
4240                         [ LIBSELINUX="-lselinux"
4241                           LIBS="$LIBS -lselinux"
4242                         ],
4243                         AC_MSG_ERROR([SELinux support requires libselinux library]))
4244                 SSHLIBS="$SSHLIBS $LIBSELINUX"
4245                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
4246                 AC_CHECK_FUNCS([getseuserbyname get_default_context_with_level])
4247                 LIBS="$save_LIBS"
4248         fi ]
4249 )
4250 AC_SUBST([SSHLIBS])
4251 AC_SUBST([SSHDLIBS])
4252
4253 # Check whether user wants Kerberos 5 support
4254 KRB5_MSG="no"
4255 AC_ARG_WITH([kerberos5],
4256         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
4257         [ if test "x$withval" != "xno" ; then
4258                 if test "x$withval" = "xyes" ; then
4259                         KRB5ROOT="/usr/local"
4260                 else
4261                         KRB5ROOT=${withval}
4262                 fi
4263
4264                 AC_DEFINE([KRB5], [1], [Define if you want Kerberos 5 support])
4265                 KRB5_MSG="yes"
4266
4267                 AC_PATH_TOOL([KRB5CONF], [krb5-config],
4268                              [$KRB5ROOT/bin/krb5-config],
4269                              [$KRB5ROOT/bin:$PATH])
4270                 if test -x $KRB5CONF ; then
4271                         K5CFLAGS="`$KRB5CONF --cflags`"
4272                         K5LIBS="`$KRB5CONF --libs`"
4273                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
4274
4275                         AC_MSG_CHECKING([for gssapi support])
4276                         if $KRB5CONF | grep gssapi >/dev/null ; then
4277                                 AC_MSG_RESULT([yes])
4278                                 AC_DEFINE([GSSAPI], [1],
4279                                         [Define this if you want GSSAPI
4280                                         support in the version 2 protocol])
4281                                 GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
4282                                 GSSLIBS="`$KRB5CONF --libs gssapi`"
4283                                 CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
4284                         else
4285                                 AC_MSG_RESULT([no])
4286                         fi
4287                         AC_MSG_CHECKING([whether we are using Heimdal])
4288                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4289                                 ]], [[ char *tmp = heimdal_version; ]])],
4290                                 [ AC_MSG_RESULT([yes])
4291                                 AC_DEFINE([HEIMDAL], [1],
4292                                 [Define this if you are using the Heimdal
4293                                 version of Kerberos V5]) ],
4294                                 [AC_MSG_RESULT([no])
4295                         ])
4296                 else
4297                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
4298                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
4299                         AC_MSG_CHECKING([whether we are using Heimdal])
4300                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4301                                 ]], [[ char *tmp = heimdal_version; ]])],
4302                                         [ AC_MSG_RESULT([yes])
4303                                          AC_DEFINE([HEIMDAL])
4304                                          K5LIBS="-lkrb5"
4305                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
4306                                          AC_CHECK_LIB([roken], [net_write],
4307                                            [K5LIBS="$K5LIBS -lroken"])
4308                                          AC_CHECK_LIB([des], [des_cbc_encrypt],
4309                                            [K5LIBS="$K5LIBS -ldes"])
4310                                        ], [ AC_MSG_RESULT([no])
4311                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
4312                         ])
4313                         AC_SEARCH_LIBS([dn_expand], [resolv])
4314
4315                         AC_CHECK_LIB([gssapi_krb5], [gss_init_sec_context],
4316                                 [ AC_DEFINE([GSSAPI])
4317                                   GSSLIBS="-lgssapi_krb5" ],
4318                                 [ AC_CHECK_LIB([gssapi], [gss_init_sec_context],
4319                                         [ AC_DEFINE([GSSAPI])
4320                                           GSSLIBS="-lgssapi" ],
4321                                         [ AC_CHECK_LIB([gss], [gss_init_sec_context],
4322                                                 [ AC_DEFINE([GSSAPI])
4323                                                   GSSLIBS="-lgss" ],
4324                                                 AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]))
4325                                         ])
4326                                 ])
4327
4328                         AC_CHECK_HEADER([gssapi.h], ,
4329                                 [ unset ac_cv_header_gssapi_h
4330                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4331                                   AC_CHECK_HEADERS([gssapi.h], ,
4332                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
4333                                   )
4334                                 ]
4335                         )
4336
4337                         oldCPP="$CPPFLAGS"
4338                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4339                         AC_CHECK_HEADER([gssapi_krb5.h], ,
4340                                         [ CPPFLAGS="$oldCPP" ])
4341
4342                 fi
4343                 if test ! -z "$need_dash_r" ; then
4344                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
4345                 fi
4346                 if test ! -z "$blibpath" ; then
4347                         blibpath="$blibpath:${KRB5ROOT}/lib"
4348                 fi
4349
4350                 AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
4351                 AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
4352                 AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
4353
4354                 AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
4355                         [Define this if you want to use libkafs' AFS support])])
4356
4357                 AC_CHECK_DECLS([GSS_C_NT_HOSTBASED_SERVICE], [], [], [[
4358 #ifdef HAVE_GSSAPI_H
4359 # include <gssapi.h>
4360 #elif defined(HAVE_GSSAPI_GSSAPI_H)
4361 # include <gssapi/gssapi.h>
4362 #endif
4363
4364 #ifdef HAVE_GSSAPI_GENERIC_H
4365 # include <gssapi_generic.h>
4366 #elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
4367 # include <gssapi/gssapi_generic.h>
4368 #endif
4369                 ]])
4370                 saved_LIBS="$LIBS"
4371                 LIBS="$LIBS $K5LIBS"
4372                 AC_CHECK_FUNCS([krb5_cc_new_unique krb5_get_error_message krb5_free_error_message])
4373                 LIBS="$saved_LIBS"
4374
4375         fi
4376         ]
4377 )
4378 AC_SUBST([GSSLIBS])
4379 AC_SUBST([K5LIBS])
4380
4381 # Looking for programs, paths and files
4382
4383 PRIVSEP_PATH=/var/empty
4384 AC_ARG_WITH([privsep-path],
4385         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
4386         [
4387                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4388                     test "x${withval}" != "xyes"; then
4389                         PRIVSEP_PATH=$withval
4390                 fi
4391         ]
4392 )
4393 AC_SUBST([PRIVSEP_PATH])
4394
4395 AC_ARG_WITH([xauth],
4396         [  --with-xauth=PATH       Specify path to xauth program ],
4397         [
4398                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4399                     test "x${withval}" != "xyes"; then
4400                         xauth_path=$withval
4401                 fi
4402         ],
4403         [
4404                 TestPath="$PATH"
4405                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
4406                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
4407                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
4408                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
4409                 AC_PATH_PROG([xauth_path], [xauth], , [$TestPath])
4410                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
4411                         xauth_path="/usr/openwin/bin/xauth"
4412                 fi
4413         ]
4414 )
4415
4416 STRIP_OPT=-s
4417 AC_ARG_ENABLE([strip],
4418         [  --disable-strip         Disable calling strip(1) on install],
4419         [
4420                 if test "x$enableval" = "xno" ; then
4421                         STRIP_OPT=
4422                 fi
4423         ]
4424 )
4425 AC_SUBST([STRIP_OPT])
4426
4427 if test -z "$xauth_path" ; then
4428         XAUTH_PATH="undefined"
4429         AC_SUBST([XAUTH_PATH])
4430 else
4431         AC_DEFINE_UNQUOTED([XAUTH_PATH], ["$xauth_path"],
4432                 [Define if xauth is found in your path])
4433         XAUTH_PATH=$xauth_path
4434         AC_SUBST([XAUTH_PATH])
4435 fi
4436
4437 dnl # --with-maildir=/path/to/mail gets top priority.
4438 dnl # if maildir is set in the platform case statement above we use that.
4439 dnl # Otherwise we run a program to get the dir from system headers.
4440 dnl # We first look for _PATH_MAILDIR then MAILDIR then _PATH_MAIL
4441 dnl # If we find _PATH_MAILDIR we do nothing because that is what
4442 dnl # session.c expects anyway. Otherwise we set to the value found
4443 dnl # stripping any trailing slash. If for some strage reason our program
4444 dnl # does not find what it needs, we default to /var/spool/mail.
4445 # Check for mail directory
4446 AC_ARG_WITH([maildir],
4447     [  --with-maildir=/path/to/mail    Specify your system mail directory],
4448     [
4449         if test "X$withval" != X  &&  test "x$withval" != xno  &&  \
4450             test "x${withval}" != xyes; then
4451                 AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$withval"],
4452             [Set this to your mail directory if you do not have _PATH_MAILDIR])
4453             fi
4454      ],[
4455         if test "X$maildir" != "X"; then
4456             AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4457         else
4458             AC_MSG_CHECKING([Discovering system mail directory])
4459             AC_RUN_IFELSE(
4460                 [AC_LANG_PROGRAM([[
4461 #include <stdio.h>
4462 #include <string.h>
4463 #ifdef HAVE_PATHS_H
4464 #include <paths.h>
4465 #endif
4466 #ifdef HAVE_MAILLOCK_H
4467 #include <maillock.h>
4468 #endif
4469 #define DATA "conftest.maildir"
4470         ]], [[
4471         FILE *fd;
4472         int rc;
4473
4474         fd = fopen(DATA,"w");
4475         if(fd == NULL)
4476                 exit(1);
4477
4478 #if defined (_PATH_MAILDIR)
4479         if ((rc = fprintf(fd ,"_PATH_MAILDIR:%s\n", _PATH_MAILDIR)) <0)
4480                 exit(1);
4481 #elif defined (MAILDIR)
4482         if ((rc = fprintf(fd ,"MAILDIR:%s\n", MAILDIR)) <0)
4483                 exit(1);
4484 #elif defined (_PATH_MAIL)
4485         if ((rc = fprintf(fd ,"_PATH_MAIL:%s\n", _PATH_MAIL)) <0)
4486                 exit(1);
4487 #else
4488         exit (2);
4489 #endif
4490
4491         exit(0);
4492                 ]])],
4493                 [
4494                     maildir_what=`awk -F: '{print $1}' conftest.maildir`
4495                     maildir=`awk -F: '{print $2}' conftest.maildir \
4496                         | sed 's|/$||'`
4497                     AC_MSG_RESULT([Using: $maildir from $maildir_what])
4498                     if test "x$maildir_what" != "x_PATH_MAILDIR"; then
4499                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4500                     fi
4501                 ],
4502                 [
4503                     if test "X$ac_status" = "X2";then
4504 # our test program didn't find it. Default to /var/spool/mail
4505                         AC_MSG_RESULT([Using: default value of /var/spool/mail])
4506                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["/var/spool/mail"])
4507                      else
4508                         AC_MSG_RESULT([*** not found ***])
4509                      fi
4510                 ],
4511                 [
4512                         AC_MSG_WARN([cross compiling: use --with-maildir=/path/to/mail])
4513                 ]
4514             )
4515         fi
4516     ]
4517 ) # maildir
4518
4519 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
4520         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
4521         disable_ptmx_check=yes
4522 fi
4523 if test -z "$no_dev_ptmx" ; then
4524         if test "x$disable_ptmx_check" != "xyes" ; then
4525                 AC_CHECK_FILE(["/dev/ptmx"],
4526                         [
4527                                 AC_DEFINE_UNQUOTED([HAVE_DEV_PTMX], [1],
4528                                         [Define if you have /dev/ptmx])
4529                                 have_dev_ptmx=1
4530                         ]
4531                 )
4532         fi
4533 fi
4534
4535 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
4536         AC_CHECK_FILE(["/dev/ptc"],
4537                 [
4538                         AC_DEFINE_UNQUOTED([HAVE_DEV_PTS_AND_PTC], [1],
4539                                 [Define if you have /dev/ptc])
4540                         have_dev_ptc=1
4541                 ]
4542         )
4543 else
4544         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
4545 fi
4546
4547 # Options from here on. Some of these are preset by platform above
4548 AC_ARG_WITH([mantype],
4549         [  --with-mantype=man|cat|doc  Set man page type],
4550         [
4551                 case "$withval" in
4552                 man|cat|doc)
4553                         MANTYPE=$withval
4554                         ;;
4555                 *)
4556                         AC_MSG_ERROR([invalid man type: $withval])
4557                         ;;
4558                 esac
4559         ]
4560 )
4561 if test -z "$MANTYPE"; then
4562         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
4563         AC_PATH_PROGS([NROFF], [nroff awf], [/bin/false], [$TestPath])
4564         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
4565                 MANTYPE=doc
4566         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
4567                 MANTYPE=man
4568         else
4569                 MANTYPE=cat
4570         fi
4571 fi
4572 AC_SUBST([MANTYPE])
4573 if test "$MANTYPE" = "doc"; then
4574         mansubdir=man;
4575 else
4576         mansubdir=$MANTYPE;
4577 fi
4578 AC_SUBST([mansubdir])
4579
4580 # Check whether to enable MD5 passwords
4581 MD5_MSG="no"
4582 AC_ARG_WITH([md5-passwords],
4583         [  --with-md5-passwords    Enable use of MD5 passwords],
4584         [
4585                 if test "x$withval" != "xno" ; then
4586                         AC_DEFINE([HAVE_MD5_PASSWORDS], [1],
4587                                 [Define if you want to allow MD5 passwords])
4588                         MD5_MSG="yes"
4589                 fi
4590         ]
4591 )
4592
4593 # Whether to disable shadow password support
4594 AC_ARG_WITH([shadow],
4595         [  --without-shadow        Disable shadow password support],
4596         [
4597                 if test "x$withval" = "xno" ; then
4598                         AC_DEFINE([DISABLE_SHADOW])
4599                         disable_shadow=yes
4600                 fi
4601         ]
4602 )
4603
4604 if test -z "$disable_shadow" ; then
4605         AC_MSG_CHECKING([if the systems has expire shadow information])
4606         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4607 #include <sys/types.h>
4608 #include <shadow.h>
4609 struct spwd sp;
4610                 ]], [[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ]])],
4611                 [ sp_expire_available=yes ], [
4612         ])
4613
4614         if test "x$sp_expire_available" = "xyes" ; then
4615                 AC_MSG_RESULT([yes])
4616                 AC_DEFINE([HAS_SHADOW_EXPIRE], [1],
4617                     [Define if you want to use shadow password expire field])
4618         else
4619                 AC_MSG_RESULT([no])
4620         fi
4621 fi
4622
4623 # Use ip address instead of hostname in $DISPLAY
4624 if test ! -z "$IPADDR_IN_DISPLAY" ; then
4625         DISPLAY_HACK_MSG="yes"
4626         AC_DEFINE([IPADDR_IN_DISPLAY], [1],
4627                 [Define if you need to use IP address
4628                 instead of hostname in $DISPLAY])
4629 else
4630         DISPLAY_HACK_MSG="no"
4631         AC_ARG_WITH([ipaddr-display],
4632                 [  --with-ipaddr-display   Use ip address instead of hostname in $DISPLAY],
4633                 [
4634                         if test "x$withval" != "xno" ; then
4635                                 AC_DEFINE([IPADDR_IN_DISPLAY])
4636                                 DISPLAY_HACK_MSG="yes"
4637                         fi
4638                 ]
4639         )
4640 fi
4641
4642 # check for /etc/default/login and use it if present.
4643 AC_ARG_ENABLE([etc-default-login],
4644         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
4645         [ if test "x$enableval" = "xno"; then
4646                 AC_MSG_NOTICE([/etc/default/login handling disabled])
4647                 etc_default_login=no
4648           else
4649                 etc_default_login=yes
4650           fi ],
4651         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
4652           then
4653                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
4654                 etc_default_login=no
4655           else
4656                 etc_default_login=yes
4657           fi ]
4658 )
4659
4660 if test "x$etc_default_login" != "xno"; then
4661         AC_CHECK_FILE(["/etc/default/login"],
4662             [ external_path_file=/etc/default/login ])
4663         if test "x$external_path_file" = "x/etc/default/login"; then
4664                 AC_DEFINE([HAVE_ETC_DEFAULT_LOGIN], [1],
4665                         [Define if your system has /etc/default/login])
4666         fi
4667 fi
4668
4669 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
4670 if test $ac_cv_func_login_getcapbool = "yes" && \
4671         test $ac_cv_header_login_cap_h = "yes" ; then
4672         external_path_file=/etc/login.conf
4673 fi
4674
4675 # Whether to mess with the default path
4676 SERVER_PATH_MSG="(default)"
4677 AC_ARG_WITH([default-path],
4678         [  --with-default-path=    Specify default $PATH environment for server],
4679         [
4680                 if test "x$external_path_file" = "x/etc/login.conf" ; then
4681                         AC_MSG_WARN([
4682 --with-default-path=PATH has no effect on this system.
4683 Edit /etc/login.conf instead.])
4684                 elif test "x$withval" != "xno" ; then
4685                         if test ! -z "$external_path_file" ; then
4686                                 AC_MSG_WARN([
4687 --with-default-path=PATH will only be used if PATH is not defined in
4688 $external_path_file .])
4689                         fi
4690                         user_path="$withval"
4691                         SERVER_PATH_MSG="$withval"
4692                 fi
4693         ],
4694         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
4695                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
4696         else
4697                 if test ! -z "$external_path_file" ; then
4698                         AC_MSG_WARN([
4699 If PATH is defined in $external_path_file, ensure the path to scp is included,
4700 otherwise scp will not work.])
4701                 fi
4702                 AC_RUN_IFELSE(
4703                         [AC_LANG_PROGRAM([[
4704 /* find out what STDPATH is */
4705 #include <stdio.h>
4706 #ifdef HAVE_PATHS_H
4707 # include <paths.h>
4708 #endif
4709 #ifndef _PATH_STDPATH
4710 # ifdef _PATH_USERPATH  /* Irix */
4711 #  define _PATH_STDPATH _PATH_USERPATH
4712 # else
4713 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
4714 # endif
4715 #endif
4716 #include <sys/types.h>
4717 #include <sys/stat.h>
4718 #include <fcntl.h>
4719 #define DATA "conftest.stdpath"
4720                         ]], [[
4721         FILE *fd;
4722         int rc;
4723
4724         fd = fopen(DATA,"w");
4725         if(fd == NULL)
4726                 exit(1);
4727
4728         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
4729                 exit(1);
4730
4731         exit(0);
4732                 ]])],
4733                 [ user_path=`cat conftest.stdpath` ],
4734                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
4735                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
4736         )
4737 # make sure $bindir is in USER_PATH so scp will work
4738                 t_bindir="${bindir}"
4739                 while echo "${t_bindir}" | egrep '\$\{|NONE/' >/dev/null 2>&1; do
4740                         t_bindir=`eval echo ${t_bindir}`
4741                         case $t_bindir in
4742                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
4743                         esac
4744                         case $t_bindir in
4745                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
4746                         esac
4747                 done
4748                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
4749                 if test $? -ne 0  ; then
4750                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
4751                         if test $? -ne 0  ; then
4752                                 user_path=$user_path:$t_bindir
4753                                 AC_MSG_RESULT([Adding $t_bindir to USER_PATH so scp will work])
4754                         fi
4755                 fi
4756         fi ]
4757 )
4758 if test "x$external_path_file" != "x/etc/login.conf" ; then
4759         AC_DEFINE_UNQUOTED([USER_PATH], ["$user_path"], [Specify default $PATH])
4760         AC_SUBST([user_path])
4761 fi
4762
4763 # Set superuser path separately to user path
4764 AC_ARG_WITH([superuser-path],
4765         [  --with-superuser-path=  Specify different path for super-user],
4766         [
4767                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4768                     test "x${withval}" != "xyes"; then
4769                         AC_DEFINE_UNQUOTED([SUPERUSER_PATH], ["$withval"],
4770                                 [Define if you want a different $PATH
4771                                 for the superuser])
4772                         superuser_path=$withval
4773                 fi
4774         ]
4775 )
4776
4777
4778 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
4779 IPV4_IN6_HACK_MSG="no"
4780 AC_ARG_WITH(4in6,
4781         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
4782         [
4783                 if test "x$withval" != "xno" ; then
4784                         AC_MSG_RESULT([yes])
4785                         AC_DEFINE([IPV4_IN_IPV6], [1],
4786                                 [Detect IPv4 in IPv6 mapped addresses
4787                                 and treat as IPv4])
4788                         IPV4_IN6_HACK_MSG="yes"
4789                 else
4790                         AC_MSG_RESULT([no])
4791                 fi
4792         ], [
4793                 if test "x$inet6_default_4in6" = "xyes"; then
4794                         AC_MSG_RESULT([yes (default)])
4795                         AC_DEFINE([IPV4_IN_IPV6])
4796                         IPV4_IN6_HACK_MSG="yes"
4797                 else
4798                         AC_MSG_RESULT([no (default)])
4799                 fi
4800         ]
4801 )
4802
4803 # Whether to enable BSD auth support
4804 BSD_AUTH_MSG=no
4805 AC_ARG_WITH([bsd-auth],
4806         [  --with-bsd-auth         Enable BSD auth support],
4807         [
4808                 if test "x$withval" != "xno" ; then
4809                         AC_DEFINE([BSD_AUTH], [1],
4810                                 [Define if you have BSD auth support])
4811                         BSD_AUTH_MSG=yes
4812                 fi
4813         ]
4814 )
4815
4816 # Where to place sshd.pid
4817 piddir=/var/run
4818 # make sure the directory exists
4819 if test ! -d $piddir ; then
4820         piddir=`eval echo ${sysconfdir}`
4821         case $piddir in
4822                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
4823         esac
4824 fi
4825
4826 AC_ARG_WITH([pid-dir],
4827         [  --with-pid-dir=PATH     Specify location of sshd.pid file],
4828         [
4829                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4830                     test "x${withval}" != "xyes"; then
4831                         piddir=$withval
4832                         if test ! -d $piddir ; then
4833                         AC_MSG_WARN([** no $piddir directory on this system **])
4834                         fi
4835                 fi
4836         ]
4837 )
4838
4839 AC_DEFINE_UNQUOTED([_PATH_SSH_PIDDIR], ["$piddir"],
4840         [Specify location of ssh.pid])
4841 AC_SUBST([piddir])
4842
4843 dnl allow user to disable some login recording features
4844 AC_ARG_ENABLE([lastlog],
4845         [  --disable-lastlog       disable use of lastlog even if detected [no]],
4846         [
4847                 if test "x$enableval" = "xno" ; then
4848                         AC_DEFINE([DISABLE_LASTLOG])
4849                 fi
4850         ]
4851 )
4852 AC_ARG_ENABLE([utmp],
4853         [  --disable-utmp          disable use of utmp even if detected [no]],
4854         [
4855                 if test "x$enableval" = "xno" ; then
4856                         AC_DEFINE([DISABLE_UTMP])
4857                 fi
4858         ]
4859 )
4860 AC_ARG_ENABLE([utmpx],
4861         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4862         [
4863                 if test "x$enableval" = "xno" ; then
4864                         AC_DEFINE([DISABLE_UTMPX], [1],
4865                                 [Define if you don't want to use utmpx])
4866                 fi
4867         ]
4868 )
4869 AC_ARG_ENABLE([wtmp],
4870         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4871         [
4872                 if test "x$enableval" = "xno" ; then
4873                         AC_DEFINE([DISABLE_WTMP])
4874                 fi
4875         ]
4876 )
4877 AC_ARG_ENABLE([wtmpx],
4878         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4879         [
4880                 if test "x$enableval" = "xno" ; then
4881                         AC_DEFINE([DISABLE_WTMPX], [1],
4882                                 [Define if you don't want to use wtmpx])
4883                 fi
4884         ]
4885 )
4886 AC_ARG_ENABLE([libutil],
4887         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4888         [
4889                 if test "x$enableval" = "xno" ; then
4890                         AC_DEFINE([DISABLE_LOGIN])
4891                 fi
4892         ]
4893 )
4894 AC_ARG_ENABLE([pututline],
4895         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4896         [
4897                 if test "x$enableval" = "xno" ; then
4898                         AC_DEFINE([DISABLE_PUTUTLINE], [1],
4899                                 [Define if you don't want to use pututline()
4900                                 etc. to write [uw]tmp])
4901                 fi
4902         ]
4903 )
4904 AC_ARG_ENABLE([pututxline],
4905         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4906         [
4907                 if test "x$enableval" = "xno" ; then
4908                         AC_DEFINE([DISABLE_PUTUTXLINE], [1],
4909                                 [Define if you don't want to use pututxline()
4910                                 etc. to write [uw]tmpx])
4911                 fi
4912         ]
4913 )
4914 AC_ARG_WITH([lastlog],
4915   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4916         [
4917                 if test "x$withval" = "xno" ; then
4918                         AC_DEFINE([DISABLE_LASTLOG])
4919                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4920                         conf_lastlog_location=$withval
4921                 fi
4922         ]
4923 )
4924
4925 dnl lastlog, [uw]tmpx? detection
4926 dnl  NOTE: set the paths in the platform section to avoid the
4927 dnl   need for command-line parameters
4928 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4929
4930 dnl lastlog detection
4931 dnl  NOTE: the code itself will detect if lastlog is a directory
4932 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4933 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4934 #include <sys/types.h>
4935 #include <utmp.h>
4936 #ifdef HAVE_LASTLOG_H
4937 #  include <lastlog.h>
4938 #endif
4939 #ifdef HAVE_PATHS_H
4940 #  include <paths.h>
4941 #endif
4942 #ifdef HAVE_LOGIN_H
4943 # include <login.h>
4944 #endif
4945         ]], [[ char *lastlog = LASTLOG_FILE; ]])],
4946                 [ AC_MSG_RESULT([yes]) ],
4947                 [
4948                 AC_MSG_RESULT([no])
4949                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4950                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4951 #include <sys/types.h>
4952 #include <utmp.h>
4953 #ifdef HAVE_LASTLOG_H
4954 #  include <lastlog.h>
4955 #endif
4956 #ifdef HAVE_PATHS_H
4957 #  include <paths.h>
4958 #endif
4959                 ]], [[ char *lastlog = _PATH_LASTLOG; ]])],
4960                 [ AC_MSG_RESULT([yes]) ],
4961                 [
4962                         AC_MSG_RESULT([no])
4963                         system_lastlog_path=no
4964                 ])
4965 ])
4966
4967 if test -z "$conf_lastlog_location"; then
4968         if test x"$system_lastlog_path" = x"no" ; then
4969                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
4970                                 if (test -d "$f" || test -f "$f") ; then
4971                                         conf_lastlog_location=$f
4972                                 fi
4973                 done
4974                 if test -z "$conf_lastlog_location"; then
4975                         AC_MSG_WARN([** Cannot find lastlog **])
4976                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4977                 fi
4978         fi
4979 fi
4980
4981 if test -n "$conf_lastlog_location"; then
4982         AC_DEFINE_UNQUOTED([CONF_LASTLOG_FILE], ["$conf_lastlog_location"],
4983                 [Define if you want to specify the path to your lastlog file])
4984 fi
4985
4986 dnl utmp detection
4987 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4988 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4989 #include <sys/types.h>
4990 #include <utmp.h>
4991 #ifdef HAVE_PATHS_H
4992 #  include <paths.h>
4993 #endif
4994         ]], [[ char *utmp = UTMP_FILE; ]])],
4995         [ AC_MSG_RESULT([yes]) ],
4996         [ AC_MSG_RESULT([no])
4997           system_utmp_path=no
4998 ])
4999 if test -z "$conf_utmp_location"; then
5000         if test x"$system_utmp_path" = x"no" ; then
5001                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
5002                         if test -f $f ; then
5003                                 conf_utmp_location=$f
5004                         fi
5005                 done
5006                 if test -z "$conf_utmp_location"; then
5007                         AC_DEFINE([DISABLE_UTMP])
5008                 fi
5009         fi
5010 fi
5011 if test -n "$conf_utmp_location"; then
5012         AC_DEFINE_UNQUOTED([CONF_UTMP_FILE], ["$conf_utmp_location"],
5013                 [Define if you want to specify the path to your utmp file])
5014 fi
5015
5016 dnl wtmp detection
5017 AC_MSG_CHECKING([if your system defines WTMP_FILE])
5018 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5019 #include <sys/types.h>
5020 #include <utmp.h>
5021 #ifdef HAVE_PATHS_H
5022 #  include <paths.h>
5023 #endif
5024         ]], [[ char *wtmp = WTMP_FILE; ]])],
5025         [ AC_MSG_RESULT([yes]) ],
5026         [ AC_MSG_RESULT([no])
5027           system_wtmp_path=no
5028 ])
5029 if test -z "$conf_wtmp_location"; then
5030         if test x"$system_wtmp_path" = x"no" ; then
5031                 for f in /usr/adm/wtmp /var/log/wtmp; do
5032                         if test -f $f ; then
5033                                 conf_wtmp_location=$f
5034                         fi
5035                 done
5036                 if test -z "$conf_wtmp_location"; then
5037                         AC_DEFINE([DISABLE_WTMP])
5038                 fi
5039         fi
5040 fi
5041 if test -n "$conf_wtmp_location"; then
5042         AC_DEFINE_UNQUOTED([CONF_WTMP_FILE], ["$conf_wtmp_location"],
5043                 [Define if you want to specify the path to your wtmp file])
5044 fi
5045
5046 dnl wtmpx detection
5047 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
5048 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5049 #include <sys/types.h>
5050 #include <utmp.h>
5051 #ifdef HAVE_UTMPX_H
5052 #include <utmpx.h>
5053 #endif
5054 #ifdef HAVE_PATHS_H
5055 #  include <paths.h>
5056 #endif
5057         ]], [[ char *wtmpx = WTMPX_FILE; ]])],
5058         [ AC_MSG_RESULT([yes]) ],
5059         [ AC_MSG_RESULT([no])
5060           system_wtmpx_path=no
5061 ])
5062 if test -z "$conf_wtmpx_location"; then
5063         if test x"$system_wtmpx_path" = x"no" ; then
5064                 AC_DEFINE([DISABLE_WTMPX])
5065         fi
5066 else
5067         AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"],
5068                 [Define if you want to specify the path to your wtmpx file])
5069 fi
5070
5071
5072 if test ! -z "$blibpath" ; then
5073         LDFLAGS="$LDFLAGS $blibflags$blibpath"
5074         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
5075 fi
5076
5077 AC_CHECK_MEMBER([struct lastlog.ll_line], [], [
5078     if test x$SKIP_DISABLE_LASTLOG_DEFINE != "xyes" ; then
5079         AC_DEFINE([DISABLE_LASTLOG])
5080     fi
5081         ], [
5082 #ifdef HAVE_SYS_TYPES_H
5083 #include <sys/types.h>
5084 #endif
5085 #ifdef HAVE_UTMP_H
5086 #include <utmp.h>
5087 #endif
5088 #ifdef HAVE_UTMPX_H
5089 #include <utmpx.h>
5090 #endif
5091 #ifdef HAVE_LASTLOG_H
5092 #include <lastlog.h>
5093 #endif
5094         ])
5095
5096 AC_CHECK_MEMBER([struct utmp.ut_line], [], [
5097         AC_DEFINE([DISABLE_UTMP])
5098         AC_DEFINE([DISABLE_WTMP])
5099         ], [
5100 #ifdef HAVE_SYS_TYPES_H
5101 #include <sys/types.h>
5102 #endif
5103 #ifdef HAVE_UTMP_H
5104 #include <utmp.h>
5105 #endif
5106 #ifdef HAVE_UTMPX_H
5107 #include <utmpx.h>
5108 #endif
5109 #ifdef HAVE_LASTLOG_H
5110 #include <lastlog.h>
5111 #endif
5112         ])
5113
5114 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
5115 dnl Add now.
5116 CFLAGS="$CFLAGS $werror_flags"
5117
5118 if test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
5119         TEST_SSH_IPV6=no
5120 else
5121         TEST_SSH_IPV6=yes
5122 fi
5123 AC_CHECK_DECL([BROKEN_GETADDRINFO],  [TEST_SSH_IPV6=no])
5124 AC_SUBST([TEST_SSH_IPV6], [$TEST_SSH_IPV6])
5125 AC_SUBST([TEST_SSH_UTF8], [$TEST_SSH_UTF8])
5126 AC_SUBST([TEST_MALLOC_OPTIONS], [$TEST_MALLOC_OPTIONS])
5127 AC_SUBST([UNSUPPORTED_ALGORITHMS], [$unsupported_algorithms])
5128 AC_SUBST([DEPEND], [$(cat $srcdir/.depend)])
5129
5130 CFLAGS="${CFLAGS} ${CFLAGS_AFTER}"
5131 LDFLAGS="${LDFLAGS} ${LDFLAGS_AFTER}"
5132
5133 AC_EXEEXT
5134 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
5135         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
5136         survey.sh])
5137 AC_OUTPUT
5138
5139 # Print summary of options
5140
5141 # Someone please show me a better way :)
5142 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
5143 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
5144 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
5145 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
5146 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
5147 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
5148 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
5149 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
5150 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
5151 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
5152
5153 echo ""
5154 echo "OpenSSH has been configured with the following options:"
5155 echo "                     User binaries: $B"
5156 echo "                   System binaries: $C"
5157 echo "               Configuration files: $D"
5158 echo "                   Askpass program: $E"
5159 echo "                      Manual pages: $F"
5160 echo "                          PID file: $G"
5161 echo "  Privilege separation chroot path: $H"
5162 if test "x$external_path_file" = "x/etc/login.conf" ; then
5163 echo "   At runtime, sshd will use the path defined in $external_path_file"
5164 echo "   Make sure the path to scp is present, otherwise scp will not work"
5165 else
5166 echo "            sshd default user PATH: $I"
5167         if test ! -z "$external_path_file"; then
5168 echo "   (If PATH is set in $external_path_file it will be used instead. If"
5169 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
5170         fi
5171 fi
5172 if test ! -z "$superuser_path" ; then
5173 echo "          sshd superuser user PATH: $J"
5174 fi
5175 echo "                    Manpage format: $MANTYPE"
5176 echo "                       PAM support: $PAM_MSG"
5177 echo "                   OSF SIA support: $SIA_MSG"
5178 echo "                 KerberosV support: $KRB5_MSG"
5179 echo "                   SELinux support: $SELINUX_MSG"
5180 echo "              MD5 password support: $MD5_MSG"
5181 echo "                   libedit support: $LIBEDIT_MSG"
5182 echo "                   libldns support: $LDNS_MSG"
5183 echo "  Solaris process contract support: $SPC_MSG"
5184 echo "           Solaris project support: $SP_MSG"
5185 echo "         Solaris privilege support: $SPP_MSG"
5186 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
5187 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
5188 echo "                  BSD Auth support: $BSD_AUTH_MSG"
5189 echo "              Random number source: $RAND_MSG"
5190 echo "             Privsep sandbox style: $SANDBOX_STYLE"
5191
5192 echo ""
5193
5194 echo "              Host: ${host}"
5195 echo "          Compiler: ${CC}"
5196 echo "    Compiler flags: ${CFLAGS}"
5197 echo "Preprocessor flags: ${CPPFLAGS}"
5198 echo "      Linker flags: ${LDFLAGS}"
5199 echo "         Libraries: ${LIBS}"
5200 if test ! -z "${SSHDLIBS}"; then
5201 echo "         +for sshd: ${SSHDLIBS}"
5202 fi
5203 if test ! -z "${SSHLIBS}"; then
5204 echo "          +for ssh: ${SSHLIBS}"
5205 fi
5206
5207 echo ""
5208
5209 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
5210         echo "SVR4 style packages are supported with \"make package\""
5211         echo ""
5212 fi
5213
5214 if test "x$PAM_MSG" = "xyes" ; then
5215         echo "PAM is enabled. You may need to install a PAM control file "
5216         echo "for sshd, otherwise password authentication may fail. "
5217         echo "Example PAM control files can be found in the contrib/ "
5218         echo "subdirectory"
5219         echo ""
5220 fi
5221
5222 if test ! -z "$NO_PEERCHECK" ; then
5223         echo "WARNING: the operating system that you are using does not"
5224         echo "appear to support getpeereid(), getpeerucred() or the"
5225         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
5226         echo "enforce security checks to prevent unauthorised connections to"
5227         echo "ssh-agent. Their absence increases the risk that a malicious"
5228         echo "user can connect to your agent."
5229         echo ""
5230 fi
5231
5232 if test "$AUDIT_MODULE" = "bsm" ; then
5233         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
5234         echo "See the Solaris section in README.platform for details."
5235 fi