crypto/openssh/configure.ac

   1 #
   2 # Copyright (c) 1999-2004 Damien Miller
   3 #
   4 # Permission to use, copy, modify, and distribute this software for any
   5 # purpose with or without fee is hereby granted, provided that the above
   6 # copyright notice and this permission notice appear in all copies.
   7 #
   8 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15
  16 AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
  17 AC_REVISION($Revision: 1.583 $)
  18 AC_CONFIG_SRCDIR([ssh.c])
  19 AC_LANG([C])
  20
  21 AC_CONFIG_HEADER([config.h])
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PROG_MKDIR_P
  33 AC_CHECK_TOOLS([AR], [ar])
  34 AC_PATH_PROG([CAT], [cat])
  35 AC_PATH_PROG([KILL], [kill])
  36 AC_PATH_PROG([SED], [sed])
  37 AC_PATH_PROG([ENT], [ent])
  38 AC_SUBST([ENT])
  39 AC_PATH_PROG([TEST_MINUS_S_SH], [bash])
  40 AC_PATH_PROG([TEST_MINUS_S_SH], [ksh])
  41 AC_PATH_PROG([TEST_MINUS_S_SH], [sh])
  42 AC_PATH_PROG([SH], [sh])
  43 AC_PATH_PROG([GROFF], [groff])
  44 AC_PATH_PROG([NROFF], [nroff])
  45 AC_PATH_PROG([MANDOC], [mandoc])
  46 AC_SUBST([TEST_SHELL], [sh])
  47
  48 dnl select manpage formatter
  49 if test "x$MANDOC" != "x" ; then
  50         MANFMT="$MANDOC"
  51 elif test "x$NROFF" != "x" ; then
  52         MANFMT="$NROFF -mandoc"
  53 elif test "x$GROFF" != "x" ; then
  54         MANFMT="$GROFF -mandoc -Tascii"
  55 else
  56         AC_MSG_WARN([no manpage formatted found])
  57         MANFMT="false"
  58 fi
  59 AC_SUBST([MANFMT])
  60
  61 dnl for buildpkg.sh
  62 AC_PATH_PROG([PATH_GROUPADD_PROG], [groupadd], [groupadd],
  63         [/usr/sbin${PATH_SEPARATOR}/etc])
  64 AC_PATH_PROG([PATH_USERADD_PROG], [useradd], [useradd],
  65         [/usr/sbin${PATH_SEPARATOR}/etc])
  66 AC_CHECK_PROG([MAKE_PACKAGE_SUPPORTED], [pkgmk], [yes], [no])
  67 if test -x /sbin/sh; then
  68         AC_SUBST([STARTUP_SCRIPT_SHELL], [/sbin/sh])
  69 else
  70         AC_SUBST([STARTUP_SCRIPT_SHELL], [/bin/sh])
  71 fi
  72
  73 # System features
  74 AC_SYS_LARGEFILE
  75
  76 if test -z "$AR" ; then
  77         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  78 fi
  79
  80 AC_PATH_PROG([PATH_PASSWD_PROG], [passwd])
  81 if test ! -z "$PATH_PASSWD_PROG" ; then
  82         AC_DEFINE_UNQUOTED([_PATH_PASSWD_PROG], ["$PATH_PASSWD_PROG"],
  83                 [Full path of your "passwd" program])
  84 fi
  85
  86 dnl Since autoconf doesn't support it very well,  we no longer allow users to
  87 dnl override LD, however keeping the hook here for now in case there's a use
  88 dnl use case we overlooked and someone needs to re-enable it.  Unless a good
  89 dnl reason is found we'll be removing this in future.
  90 LD="$CC"
  91 AC_SUBST([LD])
  92
  93 AC_C_INLINE
  94
  95 AC_CHECK_DECL([LLONG_MAX], [have_llong_max=1], , [#include <limits.h>])
  96 AC_CHECK_DECL([SYSTR_POLICY_KILL], [have_systr_policy_kill=1], , [
  97         #include <sys/types.h>
  98         #include <sys/param.h>
  99         #include <dev/systrace.h>
 100 ])
 101 AC_CHECK_DECL([RLIMIT_NPROC],
 102     [AC_DEFINE([HAVE_RLIMIT_NPROC], [], [sys/resource.h has RLIMIT_NPROC])], , [
 103         #include <sys/types.h>
 104         #include <sys/resource.h>
 105 ])
 106 AC_CHECK_DECL([PR_SET_NO_NEW_PRIVS], [have_linux_no_new_privs=1], , [
 107         #include <sys/types.h>
 108         #include <linux/prctl.h>
 109 ])
 110
 111 openssl=yes
 112 AC_ARG_WITH([openssl],
 113         [  --without-openssl       Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL** ],
 114         [  if test "x$withval" = "xno" ; then
 115                 openssl=no
 116            fi
 117         ]
 118 )
 119 AC_MSG_CHECKING([whether OpenSSL will be used for cryptography])
 120 if test "x$openssl" = "xyes" ; then
 121         AC_MSG_RESULT([yes])
 122         AC_DEFINE_UNQUOTED([WITH_OPENSSL], [1], [use libcrypto for cryptography])
 123 else
 124         AC_MSG_RESULT([no])
 125 fi
 126
 127 use_stack_protector=1
 128 use_toolchain_hardening=1
 129 AC_ARG_WITH([stackprotect],
 130     [  --without-stackprotect  Don't use compiler's stack protection], [
 131     if test "x$withval" = "xno"; then
 132         use_stack_protector=0
 133     fi ])
 134 AC_ARG_WITH([hardening],
 135     [  --without-hardening     Don't use toolchain hardening flags], [
 136     if test "x$withval" = "xno"; then
 137         use_toolchain_hardening=0
 138     fi ])
 139
 140 # We use -Werror for the tests only so that we catch warnings like "this is
 141 # on by default" for things like -fPIE.
 142 AC_MSG_CHECKING([if $CC supports -Werror])
 143 saved_CFLAGS="$CFLAGS"
 144 CFLAGS="$CFLAGS -Werror"
 145 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[int main(void) { return 0; }]])],
 146         [ AC_MSG_RESULT([yes])
 147           WERROR="-Werror"],
 148         [ AC_MSG_RESULT([no])
 149           WERROR="" ]
 150 )
 151 CFLAGS="$saved_CFLAGS"
 152
 153 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 154         OSSH_CHECK_CFLAG_COMPILE([-pipe])
 155         OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments])
 156         OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option])
 157         OSSH_CHECK_CFLAG_COMPILE([-Wall])
 158         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-arith])
 159         OSSH_CHECK_CFLAG_COMPILE([-Wuninitialized])
 160         OSSH_CHECK_CFLAG_COMPILE([-Wsign-compare])
 161         OSSH_CHECK_CFLAG_COMPILE([-Wformat-security])
 162         OSSH_CHECK_CFLAG_COMPILE([-Wsizeof-pointer-memaccess])
 163         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-sign], [-Wno-pointer-sign])
 164         OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
 165         OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
 166     if test "x$use_toolchain_hardening" = "x1"; then
 167         # Cygwin GCC 7.x allows thunking on the CLI, but produces non-working
 168         # code.  Unfortunately you only notice this at link time.
 169         case "$host" in
 170         *-*-cygwin*) ;;
 171         *)
 172             OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc
 173             OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc
 174             ;;
 175         esac
 176         OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
 177         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])
 178         OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
 179         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
 180         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
 181         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,noexecstack])
 182         # NB. -ftrapv expects certain support functions to be present in
 183         # the compiler library (libgcc or similar) to detect integer operations
 184         # that can overflow. We must check that the result of enabling it
 185         # actually links. The test program compiled/linked includes a number
 186         # of integer operations that should exercise this.
 187         OSSH_CHECK_CFLAG_LINK([-ftrapv])
 188     fi
 189         AC_MSG_CHECKING([gcc version])
 190         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 191         case $GCC_VER in
 192                 1.*) no_attrib_nonnull=1 ;;
 193                 2.8* | 2.9*)
 194                      no_attrib_nonnull=1
 195                      ;;
 196                 2.*) no_attrib_nonnull=1 ;;
 197                 *) ;;
 198         esac
 199         AC_MSG_RESULT([$GCC_VER])
 200
 201         AC_MSG_CHECKING([if $CC accepts -fno-builtin-memset])
 202         saved_CFLAGS="$CFLAGS"
 203         CFLAGS="$CFLAGS -fno-builtin-memset"
 204         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <string.h> ]],
 205                         [[ char b[10]; memset(b, 0, sizeof(b)); ]])],
 206                 [ AC_MSG_RESULT([yes]) ],
 207                 [ AC_MSG_RESULT([no])
 208                   CFLAGS="$saved_CFLAGS" ]
 209         )
 210
 211         # -fstack-protector-all doesn't always work for some GCC versions
 212         # and/or platforms, so we test if we can.  If it's not supported
 213         # on a given platform gcc will emit a warning so we use -Werror.
 214         if test "x$use_stack_protector" = "x1"; then
 215             for t in -fstack-protector-strong -fstack-protector-all \
 216                     -fstack-protector; do
 217                 AC_MSG_CHECKING([if $CC supports $t])
 218                 saved_CFLAGS="$CFLAGS"
 219                 saved_LDFLAGS="$LDFLAGS"
 220                 CFLAGS="$CFLAGS $t -Werror"
 221                 LDFLAGS="$LDFLAGS $t -Werror"
 222                 AC_LINK_IFELSE(
 223                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 224                         [[
 225         char x[256];
 226         snprintf(x, sizeof(x), "XXX");
 227                          ]])],
 228                     [ AC_MSG_RESULT([yes])
 229                       CFLAGS="$saved_CFLAGS $t"
 230                       LDFLAGS="$saved_LDFLAGS $t"
 231                       AC_MSG_CHECKING([if $t works])
 232                       AC_RUN_IFELSE(
 233                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 234                         [[
 235         char x[256];
 236         snprintf(x, sizeof(x), "XXX");
 237                         ]])],
 238                         [ AC_MSG_RESULT([yes])
 239                           break ],
 240                         [ AC_MSG_RESULT([no]) ],
 241                         [ AC_MSG_WARN([cross compiling: cannot test])
 242                           break ]
 243                       )
 244                     ],
 245                     [ AC_MSG_RESULT([no]) ]
 246                 )
 247                 CFLAGS="$saved_CFLAGS"
 248                 LDFLAGS="$saved_LDFLAGS"
 249             done
 250         fi
 251
 252         if test -z "$have_llong_max"; then
 253                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 254                 unset ac_cv_have_decl_LLONG_MAX
 255                 saved_CFLAGS="$CFLAGS"
 256                 CFLAGS="$CFLAGS -std=gnu99"
 257                 AC_CHECK_DECL([LLONG_MAX],
 258                     [have_llong_max=1],
 259                     [CFLAGS="$saved_CFLAGS"],
 260                     [#include <limits.h>]
 261                 )
 262         fi
 263 fi
 264
 265 AC_MSG_CHECKING([if compiler allows __attribute__ on return types])
 266 AC_COMPILE_IFELSE(
 267     [AC_LANG_PROGRAM([[
 268 #include <stdlib.h>
 269 __attribute__((__unused__)) static void foo(void){return;}]],
 270     [[ exit(0); ]])],
 271     [ AC_MSG_RESULT([yes]) ],
 272     [ AC_MSG_RESULT([no])
 273       AC_DEFINE(NO_ATTRIBUTE_ON_RETURN_TYPE, 1,
 274          [compiler does not accept __attribute__ on return types]) ]
 275 )
 276
 277 AC_MSG_CHECKING([if compiler allows __attribute__ prototype args])
 278 AC_COMPILE_IFELSE(
 279     [AC_LANG_PROGRAM([[
 280 #include <stdlib.h>
 281 typedef void foo(const char *, ...) __attribute__((format(printf, 1, 2)));]],
 282     [[ exit(0); ]])],
 283     [ AC_MSG_RESULT([yes]) ],
 284     [ AC_MSG_RESULT([no])
 285       AC_DEFINE(NO_ATTRIBUTE_ON_PROTOTYPE_ARGS, 1,
 286          [compiler does not accept __attribute__ on prototype args]) ]
 287 )
 288
 289 if test "x$no_attrib_nonnull" != "x1" ; then
 290         AC_DEFINE([HAVE_ATTRIBUTE__NONNULL__], [1], [Have attribute nonnull])
 291 fi
 292
 293 AC_ARG_WITH([rpath],
 294         [  --without-rpath         Disable auto-added -R linker paths],
 295         [
 296                 if test "x$withval" = "xno" ; then
 297                         need_dash_r=""
 298                 fi
 299                 if test "x$withval" = "xyes" ; then
 300                         need_dash_r=1
 301                 fi
 302         ]
 303 )
 304
 305 # Allow user to specify flags
 306 AC_ARG_WITH([cflags],
 307         [  --with-cflags           Specify additional flags to pass to compiler],
 308         [
 309                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 310                     test "x${withval}" != "xyes"; then
 311                         CFLAGS="$CFLAGS $withval"
 312                 fi
 313         ]
 314 )
 315
 316 AC_ARG_WITH([cflags-after],
 317         [  --with-cflags-after     Specify additional flags to pass to compiler after configure],
 318         [
 319                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 320                     test "x${withval}" != "xyes"; then
 321                         CFLAGS_AFTER="$withval"
 322                 fi
 323         ]
 324 )
 325 AC_ARG_WITH([cppflags],
 326         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 327         [
 328                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 329                     test "x${withval}" != "xyes"; then
 330                         CPPFLAGS="$CPPFLAGS $withval"
 331                 fi
 332         ]
 333 )
 334 AC_ARG_WITH([ldflags],
 335         [  --with-ldflags          Specify additional flags to pass to linker],
 336         [
 337                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 338                     test "x${withval}" != "xyes"; then
 339                         LDFLAGS="$LDFLAGS $withval"
 340                 fi
 341         ]
 342 )
 343 AC_ARG_WITH([ldflags-after],
 344         [  --with-ldflags-after    Specify additional flags to pass to linker after configure],
 345         [
 346                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 347                     test "x${withval}" != "xyes"; then
 348                         LDFLAGS_AFTER="$withval"
 349                 fi
 350         ]
 351 )
 352 AC_ARG_WITH([libs],
 353         [  --with-libs             Specify additional libraries to link with],
 354         [
 355                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 356                     test "x${withval}" != "xyes"; then
 357                         LIBS="$LIBS $withval"
 358                 fi
 359         ]
 360 )
 361 AC_ARG_WITH([Werror],
 362         [  --with-Werror           Build main code with -Werror],
 363         [
 364                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 365                         werror_flags="-Werror"
 366                         if test "x${withval}" != "xyes"; then
 367                                 werror_flags="$withval"
 368                         fi
 369                 fi
 370         ]
 371 )
 372
 373 AC_CHECK_HEADERS([ \
 374         blf.h \
 375         bstring.h \
 376         crypt.h \
 377         crypto/sha2.h \
 378         dirent.h \
 379         endian.h \
 380         elf.h \
 381         err.h \
 382         features.h \
 383         fcntl.h \
 384         floatingpoint.h \
 385         getopt.h \
 386         glob.h \
 387         ia.h \
 388         iaf.h \
 389         ifaddrs.h \
 390         inttypes.h \
 391         langinfo.h \
 392         limits.h \
 393         locale.h \
 394         login.h \
 395         maillock.h \
 396         ndir.h \
 397         net/if_tun.h \
 398         netdb.h \
 399         netgroup.h \
 400         pam/pam_appl.h \
 401         paths.h \
 402         poll.h \
 403         pty.h \
 404         readpassphrase.h \
 405         rpc/types.h \
 406         security/pam_appl.h \
 407         sha2.h \
 408         shadow.h \
 409         stddef.h \
 410         stdint.h \
 411         string.h \
 412         strings.h \
 413         sys/bitypes.h \
 414         sys/bsdtty.h \
 415         sys/cdefs.h \
 416         sys/dir.h \
 417         sys/file.h \
 418         sys/mman.h \
 419         sys/label.h \
 420         sys/ndir.h \
 421         sys/poll.h \
 422         sys/prctl.h \
 423         sys/pstat.h \
 424         sys/ptrace.h \
 425         sys/random.h \
 426         sys/select.h \
 427         sys/stat.h \
 428         sys/stream.h \
 429         sys/stropts.h \
 430         sys/strtio.h \
 431         sys/statvfs.h \
 432         sys/sysmacros.h \
 433         sys/time.h \
 434         sys/timers.h \
 435         sys/vfs.h \
 436         time.h \
 437         tmpdir.h \
 438         ttyent.h \
 439         ucred.h \
 440         unistd.h \
 441         usersec.h \
 442         util.h \
 443         utime.h \
 444         utmp.h \
 445         utmpx.h \
 446         vis.h \
 447         wchar.h \
 448 ])
 449
 450 # On some platforms (eg SunOS4) sys/audit.h requires sys/[time|types|label.h]
 451 # to be included first.
 452 AC_CHECK_HEADERS([sys/audit.h], [], [], [
 453 #ifdef HAVE_SYS_TIME_H
 454 # include <sys/time.h>
 455 #endif
 456 #ifdef HAVE_SYS_TYPES_H
 457 # include <sys/types.h>
 458 #endif
 459 #ifdef HAVE_SYS_LABEL_H
 460 # include <sys/label.h>
 461 #endif
 462 ])
 463
 464 # sys/capsicum.h requires sys/types.h
 465 AC_CHECK_HEADERS([sys/capsicum.h], [], [], [
 466 #ifdef HAVE_SYS_TYPES_H
 467 # include <sys/types.h>
 468 #endif
 469 ])
 470
 471 # net/route.h requires sys/socket.h and sys/types.h.
 472 # sys/sysctl.h also requires sys/param.h
 473 AC_CHECK_HEADERS([net/route.h sys/sysctl.h], [], [], [
 474 #ifdef HAVE_SYS_TYPES_H
 475 # include <sys/types.h>
 476 #endif
 477 #include <sys/param.h>
 478 #include <sys/socket.h>
 479 ])
 480
 481 # lastlog.h requires sys/time.h to be included first on Solaris
 482 AC_CHECK_HEADERS([lastlog.h], [], [], [
 483 #ifdef HAVE_SYS_TIME_H
 484 # include <sys/time.h>
 485 #endif
 486 ])
 487
 488 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 489 AC_CHECK_HEADERS([sys/ptms.h], [], [], [
 490 #ifdef HAVE_SYS_STREAM_H
 491 # include <sys/stream.h>
 492 #endif
 493 ])
 494
 495 # login_cap.h requires sys/types.h on NetBSD
 496 AC_CHECK_HEADERS([login_cap.h], [], [], [
 497 #include <sys/types.h>
 498 ])
 499
 500 # older BSDs need sys/param.h before sys/mount.h
 501 AC_CHECK_HEADERS([sys/mount.h], [], [], [
 502 #include <sys/param.h>
 503 ])
 504
 505 # Android requires sys/socket.h to be included before sys/un.h
 506 AC_CHECK_HEADERS([sys/un.h], [], [], [
 507 #include <sys/types.h>
 508 #include <sys/socket.h>
 509 ])
 510
 511 # Messages for features tested for in target-specific section
 512 SIA_MSG="no"
 513 SPC_MSG="no"
 514 SP_MSG="no"
 515 SPP_MSG="no"
 516
 517 # Support for Solaris/Illumos privileges (this test is used by both
 518 # the --with-solaris-privs option and --with-sandbox=solaris).
 519 SOLARIS_PRIVS="no"
 520
 521 # Check for some target-specific stuff
 522 case "$host" in
 523 *-*-aix*)
 524         # Some versions of VAC won't allow macro redefinitions at
 525         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 526         # particularly with older versions of vac or xlc.
 527         # It also throws errors about null macro arguments, but these are
 528         # not fatal.
 529         AC_MSG_CHECKING([if compiler allows macro redefinitions])
 530         AC_COMPILE_IFELSE(
 531             [AC_LANG_PROGRAM([[
 532 #define testmacro foo
 533 #define testmacro bar]],
 534             [[ exit(0); ]])],
 535             [ AC_MSG_RESULT([yes]) ],
 536             [ AC_MSG_RESULT([no])
 537               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 538               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 539               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 540             ]
 541         )
 542
 543         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 544         if (test -z "$blibpath"); then
 545                 blibpath="/usr/lib:/lib"
 546         fi
 547         saved_LDFLAGS="$LDFLAGS"
 548         if test "$GCC" = "yes"; then
 549                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 550         else
 551                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 552         fi
 553         for tryflags in $flags ;do
 554                 if (test -z "$blibflags"); then
 555                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 556                         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
 557                         [blibflags=$tryflags], [])
 558                 fi
 559         done
 560         if (test -z "$blibflags"); then
 561                 AC_MSG_RESULT([not found])
 562                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 563         else
 564                 AC_MSG_RESULT([$blibflags])
 565         fi
 566         LDFLAGS="$saved_LDFLAGS"
 567         dnl Check for authenticate.  Might be in libs.a on older AIXes
 568         AC_CHECK_FUNC([authenticate], [AC_DEFINE([WITH_AIXAUTHENTICATE], [1],
 569                 [Define if you want to enable AIX4's authenticate function])],
 570                 [AC_CHECK_LIB([s], [authenticate],
 571                         [ AC_DEFINE([WITH_AIXAUTHENTICATE])
 572                                 LIBS="$LIBS -ls"
 573                         ])
 574                 ])
 575         dnl Check for various auth function declarations in headers.
 576         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 577             passwdexpired, setauthdb], , , [#include <usersec.h>])
 578         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 579         AC_CHECK_DECLS([loginfailed],
 580             [AC_MSG_CHECKING([if loginfailed takes 4 arguments])
 581             AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <usersec.h> ]],
 582                 [[ (void)loginfailed("user","host","tty",0); ]])],
 583                 [AC_MSG_RESULT([yes])
 584                 AC_DEFINE([AIX_LOGINFAILED_4ARG], [1],
 585                         [Define if your AIX loginfailed() function
 586                         takes 4 arguments (AIX >= 5.2)])], [AC_MSG_RESULT([no])
 587             ])],
 588             [],
 589             [#include <usersec.h>]
 590         )
 591         AC_CHECK_FUNCS([getgrset setauthdb])
 592         AC_CHECK_DECL([F_CLOSEM],
 593             AC_DEFINE([HAVE_FCNTL_CLOSEM], [1], [Use F_CLOSEM fcntl for closefrom]),
 594             [],
 595             [ #include <limits.h>
 596               #include <fcntl.h> ]
 597         )
 598         check_for_aix_broken_getaddrinfo=1
 599         AC_DEFINE([BROKEN_REALPATH], [1], [Define if you have a broken realpath.])
 600         AC_DEFINE([SETEUID_BREAKS_SETUID], [1],
 601             [Define if your platform breaks doing a seteuid before a setuid])
 602         AC_DEFINE([BROKEN_SETREUID], [1], [Define if your setreuid() is broken])
 603         AC_DEFINE([BROKEN_SETREGID], [1], [Define if your setregid() is broken])
 604         dnl AIX handles lastlog as part of its login message
 605         AC_DEFINE([DISABLE_LASTLOG], [1], [Define if you don't want to use lastlog])
 606         AC_DEFINE([LOGIN_NEEDS_UTMPX], [1],
 607                 [Some systems need a utmpx entry for /bin/login to work])
 608         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 609                 [Define to a Set Process Title type if your system is
 610                 supported by bsd-setproctitle.c])
 611         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 612             [AIX 5.2 and 5.3 (and presumably newer) require this])
 613         AC_DEFINE([PTY_ZEROREAD], [1], [read(1) can return 0 for a non-closed fd])
 614         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 615         AC_DEFINE([BROKEN_STRNDUP], 1, [strndup broken, see APAR IY61211])
 616         AC_DEFINE([BROKEN_STRNLEN], 1, [strnlen broken, see APAR IY62551])
 617         ;;
 618 *-*-android*)
 619         AC_DEFINE([DISABLE_UTMP], [1], [Define if you don't want to use utmp])
 620         AC_DEFINE([DISABLE_WTMP], [1], [Define if you don't want to use wtmp])
 621         ;;
 622 *-*-cygwin*)
 623         check_for_libcrypt_later=1
 624         LIBS="$LIBS /usr/lib/textreadmode.o"
 625         AC_DEFINE([HAVE_CYGWIN], [1], [Define if you are on Cygwin])
 626         AC_DEFINE([USE_PIPES], [1], [Use PIPES instead of a socketpair()])
 627         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
 628                 [Define to disable UID restoration test])
 629         AC_DEFINE([DISABLE_SHADOW], [1],
 630                 [Define if you want to disable shadow passwords])
 631         AC_DEFINE([NO_X11_UNIX_SOCKETS], [1],
 632                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 633         AC_DEFINE([DISABLE_FD_PASSING], [1],
 634                 [Define if your platform needs to skip post auth
 635                 file descriptor passing])
 636         AC_DEFINE([SSH_IOBUFSZ], [65535], [Windows is sensitive to read buffer size])
 637         AC_DEFINE([FILESYSTEM_NO_BACKSLASH], [1], [File names may not contain backslash characters])
 638         # Cygwin defines optargs, optargs as declspec(dllimport) for historical
 639         # reasons which cause compile warnings, so we disable those warnings.
 640         OSSH_CHECK_CFLAG_COMPILE([-Wno-attributes])
 641         ;;
 642 *-*-dgux*)
 643         AC_DEFINE([IP_TOS_IS_BROKEN], [1],
 644                 [Define if your system choked on IP TOS setting])
 645         AC_DEFINE([SETEUID_BREAKS_SETUID])
 646         AC_DEFINE([BROKEN_SETREUID])
 647         AC_DEFINE([BROKEN_SETREGID])
 648         ;;
 649 *-*-darwin*)
 650         use_pie=auto
 651         AC_MSG_CHECKING([if we have working getaddrinfo])
 652         AC_RUN_IFELSE([AC_LANG_SOURCE([[ #include <mach-o/dyld.h>
 653 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 654                 exit(0);
 655         else
 656                 exit(1);
 657 }
 658                         ]])],
 659         [AC_MSG_RESULT([working])],
 660         [AC_MSG_RESULT([buggy])
 661         AC_DEFINE([BROKEN_GETADDRINFO], [1],
 662                 [getaddrinfo is broken (if present)])
 663         ],
 664         [AC_MSG_RESULT([assume it is working])])
 665         AC_DEFINE([SETEUID_BREAKS_SETUID])
 666         AC_DEFINE([BROKEN_SETREUID])
 667         AC_DEFINE([BROKEN_SETREGID])
 668         AC_DEFINE([BROKEN_GLOB], [1], [OS X glob does not do what we expect])
 669         AC_DEFINE_UNQUOTED([BIND_8_COMPAT], [1],
 670                 [Define if your resolver libs need this for getrrsetbyname])
 671         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 672         AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 673             [Use tunnel device compatibility to OpenBSD])
 674         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 675             [Prepend the address family to IP tunnel traffic])
 676         m4_pattern_allow([AU_IPv])
 677         AC_CHECK_DECL([AU_IPv4], [],
 678             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 679             [#include <bsm/audit.h>]
 680         AC_DEFINE([LASTLOG_WRITE_PUTUTXLINE], [1],
 681             [Define if pututxline updates lastlog too])
 682         )
 683         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 684                 [Define to a Set Process Title type if your system is
 685                 supported by bsd-setproctitle.c])
 686         AC_CHECK_FUNCS([sandbox_init])
 687         AC_CHECK_HEADERS([sandbox.h])
 688         AC_CHECK_LIB([sandbox], [sandbox_apply], [
 689             SSHDLIBS="$SSHDLIBS -lsandbox"
 690         ])
 691         ;;
 692 *-*-dragonfly*)
 693         SSHDLIBS="$SSHDLIBS -lcrypt"
 694         TEST_MALLOC_OPTIONS="AFGJPRX"
 695         ;;
 696 *-*-haiku*)
 697         LIBS="$LIBS -lbsd "
 698         AC_CHECK_LIB([network], [socket])
 699         AC_DEFINE([HAVE_U_INT64_T])
 700         MANTYPE=man
 701         ;;
 702 *-*-hpux*)
 703         # first we define all of the options common to all HP-UX releases
 704         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 705         IPADDR_IN_DISPLAY=yes
 706         AC_DEFINE([USE_PIPES])
 707         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 708         AC_DEFINE([LOCKED_PASSWD_STRING], ["*"],
 709                 [String used in /etc/passwd to denote locked account])
 710         AC_DEFINE([SPT_TYPE], [SPT_PSTAT])
 711         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 712         maildir="/var/mail"
 713         LIBS="$LIBS -lsec"
 714         AC_CHECK_LIB([xnet], [t_error], ,
 715             [AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***])])
 716
 717         # next, we define all of the options specific to major releases
 718         case "$host" in
 719         *-*-hpux10*)
 720                 if test -z "$GCC"; then
 721                         CFLAGS="$CFLAGS -Ae"
 722                 fi
 723                 ;;
 724         *-*-hpux11*)
 725                 AC_DEFINE([PAM_SUN_CODEBASE], [1],
 726                         [Define if you are using Solaris-derived PAM which
 727                         passes pam_messages to the conversation function
 728                         with an extra level of indirection])
 729                 AC_DEFINE([DISABLE_UTMP], [1],
 730                         [Define if you don't want to use utmp])
 731                 AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 732                 check_for_hpux_broken_getaddrinfo=1
 733                 check_for_conflicting_getspnam=1
 734                 ;;
 735         esac
 736
 737         # lastly, we define options specific to minor releases
 738         case "$host" in
 739         *-*-hpux10.26)
 740                 AC_DEFINE([HAVE_SECUREWARE], [1],
 741                         [Define if you have SecureWare-based
 742                         protected password database])
 743                 disable_ptmx_check=yes
 744                 LIBS="$LIBS -lsecpw"
 745                 ;;
 746         esac
 747         ;;
 748 *-*-irix5*)
 749         PATH="$PATH:/usr/etc"
 750         AC_DEFINE([BROKEN_INET_NTOA], [1],
 751                 [Define if you system's inet_ntoa is busted
 752                 (e.g. Irix gcc issue)])
 753         AC_DEFINE([SETEUID_BREAKS_SETUID])
 754         AC_DEFINE([BROKEN_SETREUID])
 755         AC_DEFINE([BROKEN_SETREGID])
 756         AC_DEFINE([WITH_ABBREV_NO_TTY], [1],
 757                 [Define if you shouldn't strip 'tty' from your
 758                 ttyname in [uw]tmp])
 759         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 760         ;;
 761 *-*-irix6*)
 762         PATH="$PATH:/usr/etc"
 763         AC_DEFINE([WITH_IRIX_ARRAY], [1],
 764                 [Define if you have/want arrays
 765                 (cluster-wide session management, not C arrays)])
 766         AC_DEFINE([WITH_IRIX_PROJECT], [1],
 767                 [Define if you want IRIX project management])
 768         AC_DEFINE([WITH_IRIX_AUDIT], [1],
 769                 [Define if you want IRIX audit trails])
 770         AC_CHECK_FUNC([jlimit_startjob], [AC_DEFINE([WITH_IRIX_JOBS], [1],
 771                 [Define if you want IRIX kernel jobs])])
 772         AC_DEFINE([BROKEN_INET_NTOA])
 773         AC_DEFINE([SETEUID_BREAKS_SETUID])
 774         AC_DEFINE([BROKEN_SETREUID])
 775         AC_DEFINE([BROKEN_SETREGID])
 776         AC_DEFINE([BROKEN_UPDWTMPX], [1], [updwtmpx is broken (if present)])
 777         AC_DEFINE([WITH_ABBREV_NO_TTY])
 778         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 779         ;;
 780 *-*-k*bsd*-gnu | *-*-kopensolaris*-gnu)
 781         check_for_libcrypt_later=1
 782         AC_DEFINE([PAM_TTY_KLUDGE])
 783         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"])
 784         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 785         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 786         AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 787         ;;
 788 *-*-linux*)
 789         no_dev_ptmx=1
 790         use_pie=auto
 791         check_for_libcrypt_later=1
 792         check_for_openpty_ctty_bug=1
 793         dnl Target SUSv3/POSIX.1-2001 plus BSD specifics.
 794         dnl _DEFAULT_SOURCE is the new name for _BSD_SOURCE
 795         CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE"
 796         AC_DEFINE([PAM_TTY_KLUDGE], [1],
 797                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 798         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"],
 799                 [String used in /etc/passwd to denote locked account])
 800         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 801         AC_DEFINE([LINK_OPNOTSUPP_ERRNO], [EPERM],
 802                 [Define to whatever link() returns for "not supported"
 803                 if it doesn't return EOPNOTSUPP.])
 804         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 805         AC_DEFINE([USE_BTMP])
 806         AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])
 807         inet6_default_4in6=yes
 808         case `uname -r` in
 809         1.*|2.0.*)
 810                 AC_DEFINE([BROKEN_CMSG_TYPE], [1],
 811                         [Define if cmsg_type is not passed correctly])
 812                 ;;
 813         esac
 814         # tun(4) forwarding compat code
 815         AC_CHECK_HEADERS([linux/if_tun.h])
 816         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 817                 AC_DEFINE([SSH_TUN_LINUX], [1],
 818                     [Open tunnel devices the Linux tun/tap way])
 819                 AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 820                     [Use tunnel device compatibility to OpenBSD])
 821                 AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 822                     [Prepend the address family to IP tunnel traffic])
 823         fi
 824         AC_CHECK_HEADER([linux/if.h],
 825             AC_DEFINE([SYS_RDOMAIN_LINUX], [1],
 826                 [Support routing domains using Linux VRF]), [], [
 827 #ifdef HAVE_SYS_TYPES_H
 828 # include <sys/types.H>
 829 #endif
 830             ])
 831         AC_CHECK_HEADERS([linux/seccomp.h linux/filter.h linux/audit.h], [],
 832             [], [#include <linux/types.h>])
 833         # Obtain MIPS ABI
 834         case "$host" in
 835         mips*)
 836                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 837 #if _MIPS_SIM != _ABIO32
 838 #error
 839 #endif
 840                         ]])],[mips_abi="o32"],[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 841 #if _MIPS_SIM != _ABIN32
 842 #error
 843 #endif
 844                                 ]])],[mips_abi="n32"],[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 845 #if _MIPS_SIM != _ABI64
 846 #error
 847 #endif
 848                                         ]])],[mips_abi="n64"],[AC_MSG_ERROR([unknown MIPS ABI])
 849                                 ])
 850                         ])
 851                 ])
 852                 ;;
 853         esac
 854         AC_MSG_CHECKING([for seccomp architecture])
 855         seccomp_audit_arch=
 856         case "$host" in
 857         x86_64-*)
 858                 seccomp_audit_arch=AUDIT_ARCH_X86_64
 859                 ;;
 860         i*86-*)
 861                 seccomp_audit_arch=AUDIT_ARCH_I386
 862                 ;;
 863         arm*-*)
 864                 seccomp_audit_arch=AUDIT_ARCH_ARM
 865                 ;;
 866         aarch64*-*)
 867                 seccomp_audit_arch=AUDIT_ARCH_AARCH64
 868                 ;;
 869         s390x-*)
 870                 seccomp_audit_arch=AUDIT_ARCH_S390X
 871                 ;;
 872         s390-*)
 873                 seccomp_audit_arch=AUDIT_ARCH_S390
 874                 ;;
 875         powerpc64-*)
 876                 seccomp_audit_arch=AUDIT_ARCH_PPC64
 877                 ;;
 878         powerpc64le-*)
 879                 seccomp_audit_arch=AUDIT_ARCH_PPC64LE
 880                 ;;
 881         mips-*)
 882                 seccomp_audit_arch=AUDIT_ARCH_MIPS
 883                 ;;
 884         mipsel-*)
 885                 seccomp_audit_arch=AUDIT_ARCH_MIPSEL
 886                 ;;
 887         mips64-*)
 888                 case "$mips_abi" in
 889                 "n32")
 890                         seccomp_audit_arch=AUDIT_ARCH_MIPS64N32
 891                         ;;
 892                 "n64")
 893                         seccomp_audit_arch=AUDIT_ARCH_MIPS64
 894                         ;;
 895                 esac
 896                 ;;
 897         mips64el-*)
 898                 case "$mips_abi" in
 899                 "n32")
 900                         seccomp_audit_arch=AUDIT_ARCH_MIPSEL64N32
 901                         ;;
 902                 "n64")
 903                         seccomp_audit_arch=AUDIT_ARCH_MIPSEL64
 904                         ;;
 905                 esac
 906                 ;;
 907         esac
 908         if test "x$seccomp_audit_arch" != "x" ; then
 909                 AC_MSG_RESULT(["$seccomp_audit_arch"])
 910                 AC_DEFINE_UNQUOTED([SECCOMP_AUDIT_ARCH], [$seccomp_audit_arch],
 911                     [Specify the system call convention in use])
 912         else
 913                 AC_MSG_RESULT([architecture not supported])
 914         fi
 915         ;;
 916 mips-sony-bsd|mips-sony-newsos4)
 917         AC_DEFINE([NEED_SETPGRP], [1], [Need setpgrp to acquire controlling tty])
 918         SONY=1
 919         ;;
 920 *-*-netbsd*)
 921         check_for_libcrypt_before=1
 922         if test "x$withval" != "xno" ; then
 923                 need_dash_r=1
 924         fi
 925         CPPFLAGS="$CPPFLAGS -D_OPENBSD_SOURCE"
 926         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 927         AC_CHECK_HEADER([net/if_tap.h], ,
 928             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 929         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 930             [Prepend the address family to IP tunnel traffic])
 931         TEST_MALLOC_OPTIONS="AJRX"
 932         AC_DEFINE([BROKEN_READ_COMPARISON], [1],
 933             [NetBSD read function is sometimes redirected, breaking atomicio comparisons against it])
 934         ;;
 935 *-*-freebsd*)
 936         check_for_libcrypt_later=1
 937         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["*LOCKED*"], [Account locked with pw(1)])
 938         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 939         AC_CHECK_HEADER([net/if_tap.h], ,
 940             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 941         AC_DEFINE([BROKEN_GLOB], [1], [FreeBSD glob does not do what we need])
 942         TEST_MALLOC_OPTIONS="AJRX"
 943         # Preauth crypto occasionally uses file descriptors for crypto offload
 944         # and will crash if they cannot be opened.
 945         AC_DEFINE([SANDBOX_SKIP_RLIMIT_NOFILE], [1],
 946             [define if setrlimit RLIMIT_NOFILE breaks things])
 947         ;;
 948 *-*-bsdi*)
 949         AC_DEFINE([SETEUID_BREAKS_SETUID])
 950         AC_DEFINE([BROKEN_SETREUID])
 951         AC_DEFINE([BROKEN_SETREGID])
 952         ;;
 953 *-next-*)
 954         conf_lastlog_location="/usr/adm/lastlog"
 955         conf_utmp_location=/etc/utmp
 956         conf_wtmp_location=/usr/adm/wtmp
 957         maildir=/usr/spool/mail
 958         AC_DEFINE([HAVE_NEXT], [1], [Define if you are on NeXT])
 959         AC_DEFINE([BROKEN_REALPATH])
 960         AC_DEFINE([USE_PIPES])
 961         AC_DEFINE([BROKEN_SAVED_UIDS], [1], [Needed for NeXT])
 962         ;;
 963 *-*-openbsd*)
 964         use_pie=auto
 965         AC_DEFINE([HAVE_ATTRIBUTE__SENTINEL__], [1], [OpenBSD's gcc has sentinel])
 966         AC_DEFINE([HAVE_ATTRIBUTE__BOUNDED__], [1], [OpenBSD's gcc has bounded])
 967         AC_DEFINE([SSH_TUN_OPENBSD], [1], [Open tunnel devices the OpenBSD way])
 968         AC_DEFINE([SYSLOG_R_SAFE_IN_SIGHAND], [1],
 969             [syslog_r function is safe to use in in a signal handler])
 970         TEST_MALLOC_OPTIONS="AFGJPRX"
 971         ;;
 972 *-*-solaris*)
 973         if test "x$withval" != "xno" ; then
 974                 need_dash_r=1
 975         fi
 976         AC_DEFINE([PAM_SUN_CODEBASE])
 977         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 978         AC_DEFINE([PAM_TTY_KLUDGE])
 979         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 980                 [Define if pam_chauthtok wants real uid set
 981                 to the unpriv'ed user])
 982         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 983         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 984         AC_DEFINE([SSHD_ACQUIRES_CTTY], [1],
 985                 [Define if sshd somehow reacquires a controlling TTY
 986                 after setsid()])
 987         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd
 988                 in case the name is longer than 8 chars])
 989         AC_DEFINE([BROKEN_TCGETATTR_ICANON], [1], [tcgetattr with ICANON may hang])
 990         external_path_file=/etc/default/login
 991         # hardwire lastlog location (can't detect it on some versions)
 992         conf_lastlog_location="/var/adm/lastlog"
 993         AC_MSG_CHECKING([for obsolete utmp and wtmp in solaris2.x])
 994         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 995         if test "$sol2ver" -ge 8; then
 996                 AC_MSG_RESULT([yes])
 997                 AC_DEFINE([DISABLE_UTMP])
 998                 AC_DEFINE([DISABLE_WTMP], [1],
 999                         [Define if you don't want to use wtmp])
1000         else
1001                 AC_MSG_RESULT([no])
1002         fi
1003         AC_CHECK_FUNCS([setpflags])
1004         AC_CHECK_FUNCS([setppriv])
1005         AC_CHECK_FUNCS([priv_basicset])
1006         AC_CHECK_HEADERS([priv.h])
1007         AC_ARG_WITH([solaris-contracts],
1008                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
1009                 [
1010                 AC_CHECK_LIB([contract], [ct_tmpl_activate],
1011                         [ AC_DEFINE([USE_SOLARIS_PROCESS_CONTRACTS], [1],
1012                                 [Define if you have Solaris process contracts])
1013                           LIBS="$LIBS -lcontract"
1014                           SPC_MSG="yes" ], )
1015                 ],
1016         )
1017         AC_ARG_WITH([solaris-projects],
1018                 [  --with-solaris-projects Enable Solaris projects (experimental)],
1019                 [
1020                 AC_CHECK_LIB([project], [setproject],
1021                         [ AC_DEFINE([USE_SOLARIS_PROJECTS], [1],
1022                                 [Define if you have Solaris projects])
1023                         LIBS="$LIBS -lproject"
1024                         SP_MSG="yes" ], )
1025                 ],
1026         )
1027         AC_ARG_WITH([solaris-privs],
1028                 [  --with-solaris-privs    Enable Solaris/Illumos privileges (experimental)],
1029                 [
1030                 AC_MSG_CHECKING([for Solaris/Illumos privilege support])
1031                 if test "x$ac_cv_func_setppriv" = "xyes" -a \
1032                         "x$ac_cv_header_priv_h" = "xyes" ; then
1033                         SOLARIS_PRIVS=yes
1034                         AC_MSG_RESULT([found])
1035                         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
1036                                 [Define to disable UID restoration test])
1037                         AC_DEFINE([USE_SOLARIS_PRIVS], [1],
1038                                 [Define if you have Solaris privileges])
1039                         SPP_MSG="yes"
1040                 else
1041                         AC_MSG_RESULT([not found])
1042                         AC_MSG_ERROR([*** must have support for Solaris privileges to use --with-solaris-privs])
1043                 fi
1044                 ],
1045         )
1046         TEST_SHELL=$SHELL       # let configure find us a capable shell
1047         ;;
1048 *-*-sunos4*)
1049         CPPFLAGS="$CPPFLAGS -DSUNOS4"
1050         AC_CHECK_FUNCS([getpwanam])
1051         AC_DEFINE([PAM_SUN_CODEBASE])
1052         conf_utmp_location=/etc/utmp
1053         conf_wtmp_location=/var/adm/wtmp
1054         conf_lastlog_location=/var/adm/lastlog
1055         AC_DEFINE([USE_PIPES])
1056         AC_DEFINE([DISABLE_UTMPX], [1], [no utmpx])
1057         ;;
1058 *-ncr-sysv*)
1059         LIBS="$LIBS -lc89"
1060         AC_DEFINE([USE_PIPES])
1061         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1062         AC_DEFINE([SETEUID_BREAKS_SETUID])
1063         AC_DEFINE([BROKEN_SETREUID])
1064         AC_DEFINE([BROKEN_SETREGID])
1065         ;;
1066 *-sni-sysv*)
1067         # /usr/ucblib MUST NOT be searched on ReliantUNIX
1068         AC_CHECK_LIB([dl], [dlsym], ,)
1069         # -lresolv needs to be at the end of LIBS or DNS lookups break
1070         AC_CHECK_LIB([resolv], [res_query], [ LIBS="$LIBS -lresolv" ])
1071         IPADDR_IN_DISPLAY=yes
1072         AC_DEFINE([USE_PIPES])
1073         AC_DEFINE([IP_TOS_IS_BROKEN])
1074         AC_DEFINE([SETEUID_BREAKS_SETUID])
1075         AC_DEFINE([BROKEN_SETREUID])
1076         AC_DEFINE([BROKEN_SETREGID])
1077         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1078         external_path_file=/etc/default/login
1079         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
1080         # Attention: always take care to bind libsocket and libnsl before libc,
1081         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
1082         ;;
1083 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
1084 *-*-sysv4.2*)
1085         AC_DEFINE([USE_PIPES])
1086         AC_DEFINE([SETEUID_BREAKS_SETUID])
1087         AC_DEFINE([BROKEN_SETREUID])
1088         AC_DEFINE([BROKEN_SETREGID])
1089         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd])
1090         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
1091         TEST_SHELL=$SHELL       # let configure find us a capable shell
1092         ;;
1093 # UnixWare 7.x, OpenUNIX 8
1094 *-*-sysv5*)
1095         CPPFLAGS="$CPPFLAGS -Dvsnprintf=_xvsnprintf -Dsnprintf=_xsnprintf"
1096         AC_DEFINE([UNIXWARE_LONG_PASSWORDS], [1], [Support passwords > 8 chars])
1097         AC_DEFINE([USE_PIPES])
1098         AC_DEFINE([SETEUID_BREAKS_SETUID])
1099         AC_DEFINE([BROKEN_GETADDRINFO])
1100         AC_DEFINE([BROKEN_SETREUID])
1101         AC_DEFINE([BROKEN_SETREGID])
1102         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1103         AC_DEFINE([BROKEN_TCGETATTR_ICANON])
1104         TEST_SHELL=$SHELL       # let configure find us a capable shell
1105         check_for_libcrypt_later=1
1106         case "$host" in
1107         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
1108                 maildir=/var/spool/mail
1109                 AC_DEFINE([BROKEN_UPDWTMPX])
1110                 AC_CHECK_LIB([prot], [getluid], [ LIBS="$LIBS -lprot"
1111                         AC_CHECK_FUNCS([getluid setluid], , , [-lprot])
1112                         ], , )
1113                 ;;
1114         *)      AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
1115                 ;;
1116         esac
1117         ;;
1118 *-*-sysv*)
1119         ;;
1120 # SCO UNIX and OEM versions of SCO UNIX
1121 *-*-sco3.2v4*)
1122         AC_MSG_ERROR("This Platform is no longer supported.")
1123         ;;
1124 # SCO OpenServer 5.x
1125 *-*-sco3.2v5*)
1126         if test -z "$GCC"; then
1127                 CFLAGS="$CFLAGS -belf"
1128         fi
1129         LIBS="$LIBS -lprot -lx -ltinfo -lm"
1130         no_dev_ptmx=1
1131         AC_DEFINE([USE_PIPES])
1132         AC_DEFINE([HAVE_SECUREWARE])
1133         AC_DEFINE([DISABLE_SHADOW])
1134         AC_DEFINE([DISABLE_FD_PASSING])
1135         AC_DEFINE([SETEUID_BREAKS_SETUID])
1136         AC_DEFINE([BROKEN_GETADDRINFO])
1137         AC_DEFINE([BROKEN_SETREUID])
1138         AC_DEFINE([BROKEN_SETREGID])
1139         AC_DEFINE([WITH_ABBREV_NO_TTY])
1140         AC_DEFINE([BROKEN_UPDWTMPX])
1141         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1142         AC_CHECK_FUNCS([getluid setluid])
1143         MANTYPE=man
1144         TEST_SHELL=$SHELL       # let configure find us a capable shell
1145         SKIP_DISABLE_LASTLOG_DEFINE=yes
1146         ;;
1147 *-dec-osf*)
1148         AC_MSG_CHECKING([for Digital Unix SIA])
1149         no_osfsia=""
1150         AC_ARG_WITH([osfsia],
1151                 [  --with-osfsia           Enable Digital Unix SIA],
1152                 [
1153                         if test "x$withval" = "xno" ; then
1154                                 AC_MSG_RESULT([disabled])
1155                                 no_osfsia=1
1156                         fi
1157                 ],
1158         )
1159         if test -z "$no_osfsia" ; then
1160                 if test -f /etc/sia/matrix.conf; then
1161                         AC_MSG_RESULT([yes])
1162                         AC_DEFINE([HAVE_OSF_SIA], [1],
1163                                 [Define if you have Digital Unix Security
1164                                 Integration Architecture])
1165                         AC_DEFINE([DISABLE_LOGIN], [1],
1166                                 [Define if you don't want to use your
1167                                 system's login() call])
1168                         AC_DEFINE([DISABLE_FD_PASSING])
1169                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
1170                         SIA_MSG="yes"
1171                 else
1172                         AC_MSG_RESULT([no])
1173                         AC_DEFINE([LOCKED_PASSWD_SUBSTR], ["Nologin"],
1174                           [String used in /etc/passwd to denote locked account])
1175                 fi
1176         fi
1177         AC_DEFINE([BROKEN_GETADDRINFO])
1178         AC_DEFINE([SETEUID_BREAKS_SETUID])
1179         AC_DEFINE([BROKEN_SETREUID])
1180         AC_DEFINE([BROKEN_SETREGID])
1181         AC_DEFINE([BROKEN_READV_COMPARISON], [1], [Can't do comparisons on readv])
1182         ;;
1183
1184 *-*-nto-qnx*)
1185         AC_DEFINE([USE_PIPES])
1186         AC_DEFINE([NO_X11_UNIX_SOCKETS])
1187         AC_DEFINE([DISABLE_LASTLOG])
1188         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1189         AC_DEFINE([BROKEN_SHADOW_EXPIRE], [1], [QNX shadow support is broken])
1190         enable_etc_default_login=no     # has incompatible /etc/default/login
1191         case "$host" in
1192         *-*-nto-qnx6*)
1193                 AC_DEFINE([DISABLE_FD_PASSING])
1194                 ;;
1195         esac
1196         ;;
1197
1198 *-*-ultrix*)
1199         AC_DEFINE([BROKEN_GETGROUPS], [1], [getgroups(0,NULL) will return -1])
1200         AC_DEFINE([NEED_SETPGRP])
1201         AC_DEFINE([HAVE_SYS_SYSLOG_H], [1], [Force use of sys/syslog.h on Ultrix])
1202         ;;
1203
1204 *-*-lynxos)
1205         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
1206         AC_DEFINE([BROKEN_SETVBUF], [1],
1207             [LynxOS has broken setvbuf() implementation])
1208         ;;
1209 esac
1210
1211 AC_MSG_CHECKING([compiler and flags for sanity])
1212 AC_RUN_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]], [[ exit(0); ]])],
1213         [       AC_MSG_RESULT([yes]) ],
1214         [
1215                 AC_MSG_RESULT([no])
1216                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
1217         ],
1218         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
1219 )
1220
1221 dnl Checks for header files.
1222 # Checks for libraries.
1223 AC_CHECK_FUNC([setsockopt], , [AC_CHECK_LIB([socket], [setsockopt])])
1224
1225 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
1226 AC_CHECK_FUNCS([dirname], [AC_CHECK_HEADERS([libgen.h])] , [
1227         AC_CHECK_LIB([gen], [dirname], [
1228                 AC_CACHE_CHECK([for broken dirname],
1229                         ac_cv_have_broken_dirname, [
1230                         save_LIBS="$LIBS"
1231                         LIBS="$LIBS -lgen"
1232                         AC_RUN_IFELSE(
1233                                 [AC_LANG_SOURCE([[
1234 #include <libgen.h>
1235 #include <string.h>
1236
1237 int main(int argc, char **argv) {
1238     char *s, buf[32];
1239
1240     strncpy(buf,"/etc", 32);
1241     s = dirname(buf);
1242     if (!s || strncmp(s, "/", 32) != 0) {
1243         exit(1);
1244     } else {
1245         exit(0);
1246     }
1247 }
1248                                 ]])],
1249                                 [ ac_cv_have_broken_dirname="no" ],
1250                                 [ ac_cv_have_broken_dirname="yes" ],
1251                                 [ ac_cv_have_broken_dirname="no" ],
1252                         )
1253                         LIBS="$save_LIBS"
1254                 ])
1255                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
1256                         LIBS="$LIBS -lgen"
1257                         AC_DEFINE([HAVE_DIRNAME])
1258                         AC_CHECK_HEADERS([libgen.h])
1259                 fi
1260         ])
1261 ])
1262
1263 AC_CHECK_FUNC([getspnam], ,
1264         [AC_CHECK_LIB([gen], [getspnam], [LIBS="$LIBS -lgen"])])
1265 AC_SEARCH_LIBS([basename], [gen], [AC_DEFINE([HAVE_BASENAME], [1],
1266         [Define if you have the basename function.])])
1267
1268 dnl zlib is required
1269 AC_ARG_WITH([zlib],
1270         [  --with-zlib=PATH        Use zlib in PATH],
1271         [ if test "x$withval" = "xno" ; then
1272                 AC_MSG_ERROR([*** zlib is required ***])
1273           elif test "x$withval" != "xyes"; then
1274                 if test -d "$withval/lib"; then
1275                         if test -n "${need_dash_r}"; then
1276                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1277                         else
1278                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1279                         fi
1280                 else
1281                         if test -n "${need_dash_r}"; then
1282                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1283                         else
1284                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1285                         fi
1286                 fi
1287                 if test -d "$withval/include"; then
1288                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1289                 else
1290                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1291                 fi
1292         fi ]
1293 )
1294
1295 AC_CHECK_HEADER([zlib.h], ,[AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***])])
1296 AC_CHECK_LIB([z], [deflate], ,
1297         [
1298                 saved_CPPFLAGS="$CPPFLAGS"
1299                 saved_LDFLAGS="$LDFLAGS"
1300                 save_LIBS="$LIBS"
1301                 dnl Check default zlib install dir
1302                 if test -n "${need_dash_r}"; then
1303                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
1304                 else
1305                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
1306                 fi
1307                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
1308                 LIBS="$LIBS -lz"
1309                 AC_TRY_LINK_FUNC([deflate], [AC_DEFINE([HAVE_LIBZ])],
1310                         [
1311                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1312                         ]
1313                 )
1314         ]
1315 )
1316
1317 AC_ARG_WITH([zlib-version-check],
1318         [  --without-zlib-version-check Disable zlib version check],
1319         [  if test "x$withval" = "xno" ; then
1320                 zlib_check_nonfatal=1
1321            fi
1322         ]
1323 )
1324
1325 AC_MSG_CHECKING([for possibly buggy zlib])
1326 AC_RUN_IFELSE([AC_LANG_PROGRAM([[
1327 #include <stdio.h>
1328 #include <stdlib.h>
1329 #include <zlib.h>
1330         ]],
1331         [[
1332         int a=0, b=0, c=0, d=0, n, v;
1333         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1334         if (n != 3 && n != 4)
1335                 exit(1);
1336         v = a*1000000 + b*10000 + c*100 + d;
1337         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1338
1339         /* 1.1.4 is OK */
1340         if (a == 1 && b == 1 && c >= 4)
1341                 exit(0);
1342
1343         /* 1.2.3 and up are OK */
1344         if (v >= 1020300)
1345                 exit(0);
1346
1347         exit(2);
1348         ]])],
1349         AC_MSG_RESULT([no]),
1350         [ AC_MSG_RESULT([yes])
1351           if test -z "$zlib_check_nonfatal" ; then
1352                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1353 Your reported zlib version has known security problems.  It's possible your
1354 vendor has fixed these problems without changing the version number.  If you
1355 are sure this is the case, you can disable the check by running
1356 "./configure --without-zlib-version-check".
1357 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1358 See http://www.gzip.org/zlib/ for details.])
1359           else
1360                 AC_MSG_WARN([zlib version may have security problems])
1361           fi
1362         ],
1363         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1364 )
1365
1366 dnl UnixWare 2.x
1367 AC_CHECK_FUNC([strcasecmp],
1368         [], [ AC_CHECK_LIB([resolv], [strcasecmp], [LIBS="$LIBS -lresolv"]) ]
1369 )
1370 AC_CHECK_FUNCS([utimes],
1371         [], [ AC_CHECK_LIB([c89], [utimes], [AC_DEFINE([HAVE_UTIMES])
1372                                         LIBS="$LIBS -lc89"]) ]
1373 )
1374
1375 dnl    Checks for libutil functions
1376 AC_CHECK_HEADERS([bsd/libutil.h libutil.h])
1377 AC_SEARCH_LIBS([fmt_scaled], [util bsd])
1378 AC_SEARCH_LIBS([scan_scaled], [util bsd])
1379 AC_SEARCH_LIBS([login], [util bsd])
1380 AC_SEARCH_LIBS([logout], [util bsd])
1381 AC_SEARCH_LIBS([logwtmp], [util bsd])
1382 AC_SEARCH_LIBS([openpty], [util bsd])
1383 AC_SEARCH_LIBS([updwtmp], [util bsd])
1384 AC_CHECK_FUNCS([fmt_scaled scan_scaled login logout openpty updwtmp logwtmp])
1385
1386 # On some platforms, inet_ntop and gethostbyname may be found in libresolv
1387 # or libnsl.
1388 AC_SEARCH_LIBS([inet_ntop], [resolv nsl])
1389 AC_SEARCH_LIBS([gethostbyname], [resolv nsl])
1390
1391 # "Particular Function Checks"
1392 # see https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Particular-Functions.html
1393 AC_FUNC_STRFTIME
1394 AC_FUNC_MALLOC
1395 AC_FUNC_REALLOC
1396 # autoconf doesn't have AC_FUNC_CALLOC so fake it if malloc returns NULL;
1397 AC_MSG_CHECKING([if calloc(0, N) returns non-null])
1398 AC_RUN_IFELSE(
1399         [AC_LANG_PROGRAM(
1400                 [[ #include <stdlib.h> ]],
1401                 [[ void *p = calloc(0, 1); exit(p == NULL); ]]
1402         )],
1403         [ func_calloc_0_nonnull=yes ],
1404         [ func_calloc_0_nonnull=no ],
1405         [ AC_MSG_WARN([cross compiling: assuming same as malloc])
1406           func_calloc_0_nonnull="$ac_cv_func_malloc_0_nonnull"]
1407 )
1408 AC_MSG_RESULT([$func_calloc_0_nonnull])
1409
1410 if test "x$func_calloc_0_nonnull" = "xyes"; then
1411         AC_DEFINE(HAVE_CALLOC, 1, [calloc(0, x) returns non-null])
1412 else
1413         AC_DEFINE(HAVE_CALLOC, 0, [calloc(0, x) returns NULL])
1414         AC_DEFINE(calloc, rpl_calloc,
1415             [Define to rpl_calloc if the replacement function should be used.])
1416 fi
1417
1418 # Check for ALTDIRFUNC glob() extension
1419 AC_MSG_CHECKING([for GLOB_ALTDIRFUNC support])
1420 AC_EGREP_CPP([FOUNDIT],
1421         [
1422                 #include <glob.h>
1423                 #ifdef GLOB_ALTDIRFUNC
1424                 FOUNDIT
1425                 #endif
1426         ],
1427         [
1428                 AC_DEFINE([GLOB_HAS_ALTDIRFUNC], [1],
1429                         [Define if your system glob() function has
1430                         the GLOB_ALTDIRFUNC extension])
1431                 AC_MSG_RESULT([yes])
1432         ],
1433         [
1434                 AC_MSG_RESULT([no])
1435         ]
1436 )
1437
1438 # Check for g.gl_matchc glob() extension
1439 AC_MSG_CHECKING([for gl_matchc field in glob_t])
1440 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]],
1441         [[ glob_t g; g.gl_matchc = 1; ]])],
1442         [
1443                 AC_DEFINE([GLOB_HAS_GL_MATCHC], [1],
1444                         [Define if your system glob() function has
1445                         gl_matchc options in glob_t])
1446                 AC_MSG_RESULT([yes])
1447         ], [
1448                 AC_MSG_RESULT([no])
1449 ])
1450
1451 # Check for g.gl_statv glob() extension
1452 AC_MSG_CHECKING([for gl_statv and GLOB_KEEPSTAT extensions for glob])
1453 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]], [[
1454 #ifndef GLOB_KEEPSTAT
1455 #error "glob does not support GLOB_KEEPSTAT extension"
1456 #endif
1457 glob_t g;
1458 g.gl_statv = NULL;
1459 ]])],
1460         [
1461                 AC_DEFINE([GLOB_HAS_GL_STATV], [1],
1462                         [Define if your system glob() function has
1463                         gl_statv options in glob_t])
1464                 AC_MSG_RESULT([yes])
1465         ], [
1466                 AC_MSG_RESULT([no])
1467
1468 ])
1469
1470 AC_CHECK_DECLS([GLOB_NOMATCH], , , [#include <glob.h>])
1471
1472 AC_CHECK_DECL([VIS_ALL], ,
1473     AC_DEFINE(BROKEN_STRNVIS, 1, [missing VIS_ALL]), [#include <vis.h>])
1474
1475 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1476 AC_RUN_IFELSE(
1477         [AC_LANG_PROGRAM([[
1478 #include <sys/types.h>
1479 #include <dirent.h>]],
1480         [[
1481         struct dirent d;
1482         exit(sizeof(d.d_name)<=sizeof(char));
1483         ]])],
1484         [AC_MSG_RESULT([yes])],
1485         [
1486                 AC_MSG_RESULT([no])
1487                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME], [1],
1488                         [Define if your struct dirent expects you to
1489                         allocate extra space for d_name])
1490         ],
1491         [
1492                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1493                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME])
1494         ]
1495 )
1496
1497 AC_MSG_CHECKING([for /proc/pid/fd directory])
1498 if test -d "/proc/$$/fd" ; then
1499         AC_DEFINE([HAVE_PROC_PID], [1], [Define if you have /proc/$pid/fd])
1500         AC_MSG_RESULT([yes])
1501 else
1502         AC_MSG_RESULT([no])
1503 fi
1504
1505 # Check whether user wants TCP wrappers support
1506 TCPW_MSG="no"
1507 AC_ARG_WITH([tcp-wrappers],
1508         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1509         [
1510                 if test "x$withval" != "xno" ; then
1511                         saved_LIBS="$LIBS"
1512                         saved_LDFLAGS="$LDFLAGS"
1513                         saved_CPPFLAGS="$CPPFLAGS"
1514                         if test -n "${withval}" && \
1515                             test "x${withval}" != "xyes"; then
1516                                 if test -d "${withval}/lib"; then
1517                                         if test -n "${need_dash_r}"; then
1518                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1519                                         else
1520                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1521                                         fi
1522                                 else
1523                                         if test -n "${need_dash_r}"; then
1524                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1525                                         else
1526                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1527                                         fi
1528                                 fi
1529                                 if test -d "${withval}/include"; then
1530                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1531                                 else
1532                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1533                                 fi
1534                         fi
1535                         LIBS="-lwrap $LIBS"
1536                         AC_MSG_CHECKING([for libwrap])
1537                         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
1538 #include <sys/types.h>
1539 #include <sys/socket.h>
1540 #include <netinet/in.h>
1541 #include <tcpd.h>
1542 int deny_severity = 0, allow_severity = 0;
1543                                 ]], [[
1544         hosts_access(0);
1545                                 ]])], [
1546                                         AC_MSG_RESULT([yes])
1547                                         AC_DEFINE([LIBWRAP], [1],
1548                                                 [Define if you want
1549                                                 TCP Wrappers support])
1550                                         SSHDLIBS="$SSHDLIBS -lwrap"
1551                                         TCPW_MSG="yes"
1552                                 ], [
1553                                         AC_MSG_ERROR([*** libwrap missing])
1554                         ])
1555                         LIBS="$saved_LIBS"
1556                 fi
1557         ]
1558 )
1559
1560 # Check whether user wants to use ldns
1561 LDNS_MSG="no"
1562 AC_ARG_WITH(ldns,
1563         [  --with-ldns[[=PATH]]      Use ldns for DNSSEC support (optionally in PATH)],
1564         [
1565         ldns=""
1566         if test "x$withval" = "xyes" ; then
1567                 AC_PATH_TOOL([LDNSCONFIG], [ldns-config], [no])
1568                 if test "x$LDNSCONFIG" = "xno"; then
1569                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1570                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1571                         LIBS="-lldns $LIBS"
1572                         ldns=yes
1573                 else
1574                         LIBS="$LIBS `$LDNSCONFIG --libs`"
1575                         CPPFLAGS="$CPPFLAGS `$LDNSCONFIG --cflags`"
1576                         ldns=yes
1577                 fi
1578         elif test "x$withval" != "xno" ; then
1579                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1580                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1581                         LIBS="-lldns $LIBS"
1582                         ldns=yes
1583         fi
1584
1585         # Verify that it works.
1586         if test "x$ldns" = "xyes" ; then
1587                 AC_DEFINE(HAVE_LDNS, 1, [Define if you want ldns support])
1588                 LDNS_MSG="yes"
1589                 AC_MSG_CHECKING([for ldns support])
1590                 AC_LINK_IFELSE(
1591                         [AC_LANG_SOURCE([[
1592 #include <stdio.h>
1593 #include <stdlib.h>
1594 #include <stdint.h>
1595 #include <ldns/ldns.h>
1596 int main() { ldns_status status = ldns_verify_trusted(NULL, NULL, NULL, NULL); status=LDNS_STATUS_OK; exit(0); }
1597                         ]])
1598                 ],
1599                         [AC_MSG_RESULT(yes)],
1600                                 [
1601                                         AC_MSG_RESULT(no)
1602                                         AC_MSG_ERROR([** Incomplete or missing ldns libraries.])
1603                                 ])
1604         fi
1605 ])
1606
1607 # Check whether user wants libedit support
1608 LIBEDIT_MSG="no"
1609 AC_ARG_WITH([libedit],
1610         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1611         [ if test "x$withval" != "xno" ; then
1612                 if test "x$withval" = "xyes" ; then
1613                         AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
1614                         if test "x$PKGCONFIG" != "xno"; then
1615                                 AC_MSG_CHECKING([if $PKGCONFIG knows about libedit])
1616                                 if "$PKGCONFIG" libedit; then
1617                                         AC_MSG_RESULT([yes])
1618                                         use_pkgconfig_for_libedit=yes
1619                                 else
1620                                         AC_MSG_RESULT([no])
1621                                 fi
1622                         fi
1623                 else
1624                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1625                         if test -n "${need_dash_r}"; then
1626                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1627                         else
1628                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1629                         fi
1630                 fi
1631                 if test "x$use_pkgconfig_for_libedit" = "xyes"; then
1632                         LIBEDIT=`$PKGCONFIG --libs libedit`
1633                         CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
1634                 else
1635                         LIBEDIT="-ledit -lcurses"
1636                 fi
1637                 OTHERLIBS=`echo $LIBEDIT | sed 's/-ledit//'`
1638                 AC_CHECK_LIB([edit], [el_init],
1639                         [ AC_DEFINE([USE_LIBEDIT], [1], [Use libedit for sftp])
1640                           LIBEDIT_MSG="yes"
1641                           AC_SUBST([LIBEDIT])
1642                         ],
1643                         [ AC_MSG_ERROR([libedit not found]) ],
1644                         [ $OTHERLIBS ]
1645                 )
1646                 AC_MSG_CHECKING([if libedit version is compatible])
1647                 AC_COMPILE_IFELSE(
1648                     [AC_LANG_PROGRAM([[ #include <histedit.h> ]],
1649                     [[
1650         int i = H_SETSIZE;
1651         el_init("", NULL, NULL, NULL);
1652         exit(0);
1653                     ]])],
1654                     [ AC_MSG_RESULT([yes]) ],
1655                     [ AC_MSG_RESULT([no])
1656                       AC_MSG_ERROR([libedit version is not compatible]) ]
1657                 )
1658         fi ]
1659 )
1660
1661 AUDIT_MODULE=none
1662 AC_ARG_WITH([audit],
1663         [  --with-audit=module     Enable audit support (modules=debug,bsm,linux)],
1664         [
1665           AC_MSG_CHECKING([for supported audit module])
1666           case "$withval" in
1667           bsm)
1668                 AC_MSG_RESULT([bsm])
1669                 AUDIT_MODULE=bsm
1670                 dnl    Checks for headers, libs and functions
1671                 AC_CHECK_HEADERS([bsm/audit.h], [],
1672                     [AC_MSG_ERROR([BSM enabled and bsm/audit.h not found])],
1673                     [
1674 #ifdef HAVE_TIME_H
1675 # include <time.h>
1676 #endif
1677                     ]
1678 )
1679                 AC_CHECK_LIB([bsm], [getaudit], [],
1680                     [AC_MSG_ERROR([BSM enabled and required library not found])])
1681                 AC_CHECK_FUNCS([getaudit], [],
1682                     [AC_MSG_ERROR([BSM enabled and required function not found])])
1683                 # These are optional
1684                 AC_CHECK_FUNCS([getaudit_addr aug_get_machine])
1685                 AC_DEFINE([USE_BSM_AUDIT], [1], [Use BSM audit module])
1686                 if test "$sol2ver" -ge 11; then
1687                         SSHDLIBS="$SSHDLIBS -lscf"
1688                         AC_DEFINE([BROKEN_BSM_API], [1],
1689                                 [The system has incomplete BSM API])
1690                 fi
1691                 ;;
1692           linux)
1693                 AC_MSG_RESULT([linux])
1694                 AUDIT_MODULE=linux
1695                 dnl    Checks for headers, libs and functions
1696                 AC_CHECK_HEADERS([libaudit.h])
1697                 SSHDLIBS="$SSHDLIBS -laudit"
1698                 AC_DEFINE([USE_LINUX_AUDIT], [1], [Use Linux audit module])
1699                 ;;
1700           debug)
1701                 AUDIT_MODULE=debug
1702                 AC_MSG_RESULT([debug])
1703                 AC_DEFINE([SSH_AUDIT_EVENTS], [1], [Use audit debugging module])
1704                 ;;
1705           no)
1706                 AC_MSG_RESULT([no])
1707                 ;;
1708           *)
1709                 AC_MSG_ERROR([Unknown audit module $withval])
1710                 ;;
1711         esac ]
1712 )
1713
1714 AC_ARG_WITH([pie],
1715     [  --with-pie              Build Position Independent Executables if possible], [
1716         if test "x$withval" = "xno"; then
1717                 use_pie=no
1718         fi
1719         if test "x$withval" = "xyes"; then
1720                 use_pie=yes
1721         fi
1722     ]
1723 )
1724 if test "x$use_pie" = "x"; then
1725         use_pie=no
1726 fi
1727 if test "x$use_toolchain_hardening" != "x1" && test "x$use_pie" = "xauto"; then
1728         # Turn off automatic PIE when toolchain hardening is off.
1729         use_pie=no
1730 fi
1731 if test "x$use_pie" = "xauto"; then
1732         # Automatic PIE requires gcc >= 4.x
1733         AC_MSG_CHECKING([for gcc >= 4.x])
1734         AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
1735 #if !defined(__GNUC__) || __GNUC__ < 4
1736 #error gcc is too old
1737 #endif
1738 ]])],
1739         [ AC_MSG_RESULT([yes]) ],
1740         [ AC_MSG_RESULT([no])
1741           use_pie=no ]
1742 )
1743 fi
1744 if test "x$use_pie" != "xno"; then
1745         SAVED_CFLAGS="$CFLAGS"
1746         SAVED_LDFLAGS="$LDFLAGS"
1747         OSSH_CHECK_CFLAG_COMPILE([-fPIE])
1748         OSSH_CHECK_LDFLAG_LINK([-pie])
1749         # We use both -fPIE and -pie or neither.
1750         AC_MSG_CHECKING([whether both -fPIE and -pie are supported])
1751         if echo "x $CFLAGS"  | grep ' -fPIE' >/dev/null 2>&1 && \
1752            echo "x $LDFLAGS" | grep ' -pie'  >/dev/null 2>&1 ; then
1753                 AC_MSG_RESULT([yes])
1754         else
1755                 AC_MSG_RESULT([no])
1756                 CFLAGS="$SAVED_CFLAGS"
1757                 LDFLAGS="$SAVED_LDFLAGS"
1758         fi
1759 fi
1760
1761 dnl    Checks for library functions. Please keep in alphabetical order
1762 AC_CHECK_FUNCS([ \
1763         Blowfish_initstate \
1764         Blowfish_expandstate \
1765         Blowfish_expand0state \
1766         Blowfish_stream2word \
1767         asprintf \
1768         b64_ntop \
1769         __b64_ntop \
1770         b64_pton \
1771         __b64_pton \
1772         bcopy \
1773         bcrypt_pbkdf \
1774         bindresvport_sa \
1775         blf_enc \
1776         bzero \
1777         cap_rights_limit \
1778         clock \
1779         closefrom \
1780         dirfd \
1781         endgrent \
1782         err \
1783         errx \
1784         explicit_bzero \
1785         fchmod \
1786         fchown \
1787         flock \
1788         freeaddrinfo \
1789         freezero \
1790         fstatfs \
1791         fstatvfs \
1792         futimes \
1793         getaddrinfo \
1794         getcwd \
1795         getgrouplist \
1796         getline \
1797         getnameinfo \
1798         getopt \
1799         getpagesize \
1800         getpeereid \
1801         getpeerucred \
1802         getpgid \
1803         _getpty \
1804         getrlimit \
1805         getrandom \
1806         getsid \
1807         getttyent \
1808         glob \
1809         group_from_gid \
1810         inet_aton \
1811         inet_ntoa \
1812         inet_ntop \
1813         innetgr \
1814         llabs \
1815         login_getcapbool \
1816         md5_crypt \
1817         memmove \
1818         memset_s \
1819         mkdtemp \
1820         ngetaddrinfo \
1821         nsleep \
1822         ogetaddrinfo \
1823         openlog_r \
1824         pledge \
1825         poll \
1826         prctl \
1827         pstat \
1828         raise \
1829         readpassphrase \
1830         reallocarray \
1831         recvmsg \
1832         recallocarray \
1833         rresvport_af \
1834         sendmsg \
1835         setdtablesize \
1836         setegid \
1837         setenv \
1838         seteuid \
1839         setgroupent \
1840         setgroups \
1841         setlinebuf \
1842         setlogin \
1843         setpassent\
1844         setpcred \
1845         setproctitle \
1846         setregid \
1847         setreuid \
1848         setrlimit \
1849         setsid \
1850         setvbuf \
1851         sigaction \
1852         sigvec \
1853         snprintf \
1854         socketpair \
1855         statfs \
1856         statvfs \
1857         strcasestr \
1858         strdup \
1859         strerror \
1860         strlcat \
1861         strlcpy \
1862         strmode \
1863         strndup \
1864         strnlen \
1865         strnvis \
1866         strptime \
1867         strsignal \
1868         strtonum \
1869         strtoll \
1870         strtoul \
1871         strtoull \
1872         swap32 \
1873         sysconf \
1874         tcgetpgrp \
1875         timingsafe_bcmp \
1876         truncate \
1877         unsetenv \
1878         updwtmpx \
1879         user_from_uid \
1880         usleep \
1881         vasprintf \
1882         vsnprintf \
1883         waitpid \
1884         warn \
1885 ])
1886
1887 AC_CHECK_DECLS([bzero])
1888
1889 dnl Wide character support.
1890 AC_CHECK_FUNCS([mblen mbtowc nl_langinfo wcwidth])
1891
1892 TEST_SSH_UTF8=${TEST_SSH_UTF8:=yes}
1893 AC_MSG_CHECKING([for utf8 locale support])
1894 AC_RUN_IFELSE(
1895         [AC_LANG_PROGRAM([[
1896 #include <locale.h>
1897 #include <stdlib.h>
1898         ]], [[
1899         char *loc = setlocale(LC_CTYPE, "en_US.UTF-8");
1900         if (loc != NULL)
1901                 exit(0);
1902         exit(1);
1903         ]])],
1904         AC_MSG_RESULT(yes),
1905         [AC_MSG_RESULT(no)
1906          TEST_SSH_UTF8=no],
1907         AC_MSG_WARN([cross compiling: assuming yes])
1908 )
1909
1910 AC_LINK_IFELSE(
1911         [AC_LANG_PROGRAM(
1912            [[ #include <ctype.h> ]],
1913            [[ return (isblank('a')); ]])],
1914         [AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])
1915 ])
1916
1917 disable_pkcs11=
1918 AC_ARG_ENABLE([pkcs11],
1919         [  --disable-pkcs11        disable PKCS#11 support code [no]],
1920         [
1921                 if test "x$enableval" = "xno" ; then
1922                         disable_pkcs11=1
1923                 fi
1924         ]
1925 )
1926
1927 # PKCS11 depends on OpenSSL.
1928 if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then
1929         # PKCS#11 support requires dlopen() and co
1930         AC_SEARCH_LIBS([dlopen], [dl],
1931             AC_CHECK_DECL([RTLD_NOW],
1932                 AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support]),
1933                 [], [#include <dlfcn.h>]
1934             )
1935         )
1936 fi
1937
1938 # IRIX has a const char return value for gai_strerror()
1939 AC_CHECK_FUNCS([gai_strerror], [
1940         AC_DEFINE([HAVE_GAI_STRERROR])
1941         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
1942 #include <sys/types.h>
1943 #include <sys/socket.h>
1944 #include <netdb.h>
1945
1946 const char *gai_strerror(int);
1947                         ]], [[
1948         char *str;
1949         str = gai_strerror(0);
1950                         ]])], [
1951                 AC_DEFINE([HAVE_CONST_GAI_STRERROR_PROTO], [1],
1952                 [Define if gai_strerror() returns const char *])], [])])
1953
1954 AC_SEARCH_LIBS([nanosleep], [rt posix4], [AC_DEFINE([HAVE_NANOSLEEP], [1],
1955         [Some systems put nanosleep outside of libc])])
1956
1957 AC_SEARCH_LIBS([clock_gettime], [rt],
1958         [AC_DEFINE([HAVE_CLOCK_GETTIME], [1], [Have clock_gettime])])
1959
1960 dnl Make sure prototypes are defined for these before using them.
1961 AC_CHECK_DECL([strsep],
1962         [AC_CHECK_FUNCS([strsep])],
1963         [],
1964         [
1965 #ifdef HAVE_STRING_H
1966 # include <string.h>
1967 #endif
1968         ])
1969
1970 dnl tcsendbreak might be a macro
1971 AC_CHECK_DECL([tcsendbreak],
1972         [AC_DEFINE([HAVE_TCSENDBREAK])],
1973         [AC_CHECK_FUNCS([tcsendbreak])],
1974         [#include <termios.h>]
1975 )
1976
1977 AC_CHECK_DECLS([h_errno], , ,[#include <netdb.h>])
1978
1979 AC_CHECK_DECLS([SHUT_RD], , ,
1980         [
1981 #include <sys/types.h>
1982 #include <sys/socket.h>
1983         ])
1984
1985 AC_CHECK_DECLS([O_NONBLOCK], , ,
1986         [
1987 #include <sys/types.h>
1988 #ifdef HAVE_SYS_STAT_H
1989 # include <sys/stat.h>
1990 #endif
1991 #ifdef HAVE_FCNTL_H
1992 # include <fcntl.h>
1993 #endif
1994         ])
1995
1996 AC_CHECK_DECLS([readv, writev], , , [
1997 #include <sys/types.h>
1998 #include <sys/uio.h>
1999 #include <unistd.h>
2000         ])
2001
2002 AC_CHECK_DECLS([MAXSYMLINKS], , , [
2003 #include <sys/param.h>
2004         ])
2005
2006 AC_CHECK_DECLS([offsetof], , , [
2007 #include <stddef.h>
2008         ])
2009
2010 # extra bits for select(2)
2011 AC_CHECK_DECLS([howmany, NFDBITS], [], [], [[
2012 #include <sys/param.h>
2013 #include <sys/types.h>
2014 #ifdef HAVE_SYS_SYSMACROS_H
2015 #include <sys/sysmacros.h>
2016 #endif
2017 #ifdef HAVE_SYS_SELECT_H
2018 #include <sys/select.h>
2019 #endif
2020 #ifdef HAVE_SYS_TIME_H
2021 #include <sys/time.h>
2022 #endif
2023 #ifdef HAVE_UNISTD_H
2024 #include <unistd.h>
2025 #endif
2026         ]])
2027 AC_CHECK_TYPES([fd_mask], [], [], [[
2028 #include <sys/param.h>
2029 #include <sys/types.h>
2030 #ifdef HAVE_SYS_SELECT_H
2031 #include <sys/select.h>
2032 #endif
2033 #ifdef HAVE_SYS_TIME_H
2034 #include <sys/time.h>
2035 #endif
2036 #ifdef HAVE_UNISTD_H
2037 #include <unistd.h>
2038 #endif
2039         ]])
2040
2041 AC_CHECK_FUNCS([setresuid], [
2042         dnl Some platorms have setresuid that isn't implemented, test for this
2043         AC_MSG_CHECKING([if setresuid seems to work])
2044         AC_RUN_IFELSE(
2045                 [AC_LANG_PROGRAM([[
2046 #include <stdlib.h>
2047 #include <errno.h>
2048                 ]], [[
2049         errno=0;
2050         setresuid(0,0,0);
2051         if (errno==ENOSYS)
2052                 exit(1);
2053         else
2054                 exit(0);
2055                 ]])],
2056                 [AC_MSG_RESULT([yes])],
2057                 [AC_DEFINE([BROKEN_SETRESUID], [1],
2058                         [Define if your setresuid() is broken])
2059                  AC_MSG_RESULT([not implemented])],
2060                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2061         )
2062 ])
2063
2064 AC_CHECK_FUNCS([setresgid], [
2065         dnl Some platorms have setresgid that isn't implemented, test for this
2066         AC_MSG_CHECKING([if setresgid seems to work])
2067         AC_RUN_IFELSE(
2068                 [AC_LANG_PROGRAM([[
2069 #include <stdlib.h>
2070 #include <errno.h>
2071                 ]], [[
2072         errno=0;
2073         setresgid(0,0,0);
2074         if (errno==ENOSYS)
2075                 exit(1);
2076         else
2077                 exit(0);
2078                 ]])],
2079                 [AC_MSG_RESULT([yes])],
2080                 [AC_DEFINE([BROKEN_SETRESGID], [1],
2081                         [Define if your setresgid() is broken])
2082                  AC_MSG_RESULT([not implemented])],
2083                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2084         )
2085 ])
2086
2087 AC_CHECK_FUNCS([realpath], [
2088         dnl the sftp v3 spec says SSH_FXP_REALPATH will "canonicalize any given
2089         dnl path name", however some implementations of realpath (and some
2090         dnl versions of the POSIX spec) do not work on non-existent files,
2091         dnl so we use the OpenBSD implementation on those platforms.
2092         AC_MSG_CHECKING([if realpath works with non-existent files])
2093         AC_RUN_IFELSE(
2094                 [AC_LANG_PROGRAM([[
2095 #include <limits.h>
2096 #include <stdlib.h>
2097 #include <errno.h>
2098                 ]], [[
2099                 char buf[PATH_MAX];
2100                 if (realpath("/opensshnonexistentfilename1234", buf) == NULL)
2101                         if (errno == ENOENT)
2102                                 exit(1);
2103                 exit(0);
2104                 ]])],
2105                 [AC_MSG_RESULT([yes])],
2106                 [AC_DEFINE([BROKEN_REALPATH], [1],
2107                         [realpath does not work with nonexistent files])
2108                  AC_MSG_RESULT([no])],
2109                 [AC_MSG_WARN([cross compiling: assuming working])]
2110         )
2111 ])
2112
2113 AC_MSG_CHECKING([for working fflush(NULL)])
2114 AC_RUN_IFELSE(
2115         [AC_LANG_PROGRAM([[#include <stdio.h>]], [[fflush(NULL); exit(0);]])],
2116         AC_MSG_RESULT([yes]),
2117         [AC_MSG_RESULT([no])
2118          AC_DEFINE([FFLUSH_NULL_BUG], [1],
2119             [define if fflush(NULL) does not work])],
2120         AC_MSG_WARN([cross compiling: assuming working])
2121 )
2122
2123 dnl    Checks for time functions
2124 AC_CHECK_FUNCS([gettimeofday time])
2125 dnl    Checks for utmp functions
2126 AC_CHECK_FUNCS([endutent getutent getutid getutline pututline setutent])
2127 AC_CHECK_FUNCS([utmpname])
2128 dnl    Checks for utmpx functions
2129 AC_CHECK_FUNCS([endutxent getutxent getutxid getutxline getutxuser pututxline])
2130 AC_CHECK_FUNCS([setutxdb setutxent utmpxname])
2131 dnl    Checks for lastlog functions
2132 AC_CHECK_FUNCS([getlastlogxbyname])
2133
2134 AC_CHECK_FUNC([daemon],
2135         [AC_DEFINE([HAVE_DAEMON], [1], [Define if your libraries define daemon()])],
2136         [AC_CHECK_LIB([bsd], [daemon],
2137                 [LIBS="$LIBS -lbsd"; AC_DEFINE([HAVE_DAEMON])])]
2138 )
2139
2140 AC_CHECK_FUNC([getpagesize],
2141         [AC_DEFINE([HAVE_GETPAGESIZE], [1],
2142                 [Define if your libraries define getpagesize()])],
2143         [AC_CHECK_LIB([ucb], [getpagesize],
2144                 [LIBS="$LIBS -lucb"; AC_DEFINE([HAVE_GETPAGESIZE])])]
2145 )
2146
2147 # Check for broken snprintf
2148 if test "x$ac_cv_func_snprintf" = "xyes" ; then
2149         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
2150         AC_RUN_IFELSE(
2151                 [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
2152                 [[
2153         char b[5];
2154         snprintf(b,5,"123456789");
2155         exit(b[4]!='\0');
2156                 ]])],
2157                 [AC_MSG_RESULT([yes])],
2158                 [
2159                         AC_MSG_RESULT([no])
2160                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2161                                 [Define if your snprintf is busted])
2162                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
2163                 ],
2164                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
2165         )
2166 fi
2167
2168 # We depend on vsnprintf returning the right thing on overflow: the
2169 # number of characters it tried to create (as per SUSv3)
2170 if test "x$ac_cv_func_vsnprintf" = "xyes" ; then
2171         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
2172         AC_RUN_IFELSE(
2173                 [AC_LANG_PROGRAM([[
2174 #include <sys/types.h>
2175 #include <stdio.h>
2176 #include <stdarg.h>
2177
2178 int x_snprintf(char *str, size_t count, const char *fmt, ...)
2179 {
2180         size_t ret;
2181         va_list ap;
2182
2183         va_start(ap, fmt);
2184         ret = vsnprintf(str, count, fmt, ap);
2185         va_end(ap);
2186         return ret;
2187 }
2188                 ]], [[
2189 char x[1];
2190 if (x_snprintf(x, 1, "%s %d", "hello", 12345) != 11)
2191         return 1;
2192 if (x_snprintf(NULL, 0, "%s %d", "hello", 12345) != 11)
2193         return 1;
2194 return 0;
2195                 ]])],
2196                 [AC_MSG_RESULT([yes])],
2197                 [
2198                         AC_MSG_RESULT([no])
2199                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2200                                 [Define if your snprintf is busted])
2201                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
2202                 ],
2203                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
2204         )
2205 fi
2206
2207 # On systems where [v]snprintf is broken, but is declared in stdio,
2208 # check that the fmt argument is const char * or just char *.
2209 # This is only useful for when BROKEN_SNPRINTF
2210 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
2211 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2212 #include <stdio.h>
2213 int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
2214                 ]], [[
2215         snprintf(0, 0, 0);
2216                 ]])],
2217    [AC_MSG_RESULT([yes])
2218     AC_DEFINE([SNPRINTF_CONST], [const],
2219               [Define as const if snprintf() can declare const char *fmt])],
2220    [AC_MSG_RESULT([no])
2221     AC_DEFINE([SNPRINTF_CONST], [/* not const */])])
2222
2223 # Check for missing getpeereid (or equiv) support
2224 NO_PEERCHECK=""
2225 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
2226         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
2227         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2228 #include <sys/types.h>
2229 #include <sys/socket.h>]], [[int i = SO_PEERCRED;]])],
2230                 [ AC_MSG_RESULT([yes])
2231                   AC_DEFINE([HAVE_SO_PEERCRED], [1], [Have PEERCRED socket option])
2232                 ], [AC_MSG_RESULT([no])
2233                 NO_PEERCHECK=1
2234         ])
2235 fi
2236
2237 dnl see whether mkstemp() requires XXXXXX
2238 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
2239 AC_MSG_CHECKING([for (overly) strict mkstemp])
2240 AC_RUN_IFELSE(
2241         [AC_LANG_PROGRAM([[
2242 #include <stdlib.h>
2243         ]], [[
2244         char template[]="conftest.mkstemp-test";
2245         if (mkstemp(template) == -1)
2246                 exit(1);
2247         unlink(template);
2248         exit(0);
2249         ]])],
2250         [
2251                 AC_MSG_RESULT([no])
2252         ],
2253         [
2254                 AC_MSG_RESULT([yes])
2255                 AC_DEFINE([HAVE_STRICT_MKSTEMP], [1], [Silly mkstemp()])
2256         ],
2257         [
2258                 AC_MSG_RESULT([yes])
2259                 AC_DEFINE([HAVE_STRICT_MKSTEMP])
2260         ]
2261 )
2262 fi
2263
2264 dnl make sure that openpty does not reacquire controlling terminal
2265 if test ! -z "$check_for_openpty_ctty_bug"; then
2266         AC_MSG_CHECKING([if openpty correctly handles controlling tty])
2267         AC_RUN_IFELSE(
2268                 [AC_LANG_PROGRAM([[
2269 #include <stdio.h>
2270 #include <sys/fcntl.h>
2271 #include <sys/types.h>
2272 #include <sys/wait.h>
2273                 ]], [[
2274         pid_t pid;
2275         int fd, ptyfd, ttyfd, status;
2276
2277         pid = fork();
2278         if (pid < 0) {          /* failed */
2279                 exit(1);
2280         } else if (pid > 0) {   /* parent */
2281                 waitpid(pid, &status, 0);
2282                 if (WIFEXITED(status))
2283                         exit(WEXITSTATUS(status));
2284                 else
2285                         exit(2);
2286         } else {                /* child */
2287                 close(0); close(1); close(2);
2288                 setsid();
2289                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
2290                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
2291                 if (fd >= 0)
2292                         exit(3);        /* Acquired ctty: broken */
2293                 else
2294                         exit(0);        /* Did not acquire ctty: OK */
2295         }
2296                 ]])],
2297                 [
2298                         AC_MSG_RESULT([yes])
2299                 ],
2300                 [
2301                         AC_MSG_RESULT([no])
2302                         AC_DEFINE([SSHD_ACQUIRES_CTTY])
2303                 ],
2304                 [
2305                         AC_MSG_RESULT([cross-compiling, assuming yes])
2306                 ]
2307         )
2308 fi
2309
2310 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2311     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
2312         AC_MSG_CHECKING([if getaddrinfo seems to work])
2313         AC_RUN_IFELSE(
2314                 [AC_LANG_PROGRAM([[
2315 #include <stdio.h>
2316 #include <sys/socket.h>
2317 #include <netdb.h>
2318 #include <errno.h>
2319 #include <netinet/in.h>
2320
2321 #define TEST_PORT "2222"
2322                 ]], [[
2323         int err, sock;
2324         struct addrinfo *gai_ai, *ai, hints;
2325         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2326
2327         memset(&hints, 0, sizeof(hints));
2328         hints.ai_family = PF_UNSPEC;
2329         hints.ai_socktype = SOCK_STREAM;
2330         hints.ai_flags = AI_PASSIVE;
2331
2332         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2333         if (err != 0) {
2334                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2335                 exit(1);
2336         }
2337
2338         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2339                 if (ai->ai_family != AF_INET6)
2340                         continue;
2341
2342                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2343                     sizeof(ntop), strport, sizeof(strport),
2344                     NI_NUMERICHOST|NI_NUMERICSERV);
2345
2346                 if (err != 0) {
2347                         if (err == EAI_SYSTEM)
2348                                 perror("getnameinfo EAI_SYSTEM");
2349                         else
2350                                 fprintf(stderr, "getnameinfo failed: %s\n",
2351                                     gai_strerror(err));
2352                         exit(2);
2353                 }
2354
2355                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
2356                 if (sock < 0)
2357                         perror("socket");
2358                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2359                         if (errno == EBADF)
2360                                 exit(3);
2361                 }
2362         }
2363         exit(0);
2364                 ]])],
2365                 [
2366                         AC_MSG_RESULT([yes])
2367                 ],
2368                 [
2369                         AC_MSG_RESULT([no])
2370                         AC_DEFINE([BROKEN_GETADDRINFO])
2371                 ],
2372                 [
2373                         AC_MSG_RESULT([cross-compiling, assuming yes])
2374                 ]
2375         )
2376 fi
2377
2378 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2379     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
2380         AC_MSG_CHECKING([if getaddrinfo seems to work])
2381         AC_RUN_IFELSE(
2382                 [AC_LANG_PROGRAM([[
2383 #include <stdio.h>
2384 #include <sys/socket.h>
2385 #include <netdb.h>
2386 #include <errno.h>
2387 #include <netinet/in.h>
2388
2389 #define TEST_PORT "2222"
2390                 ]], [[
2391         int err, sock;
2392         struct addrinfo *gai_ai, *ai, hints;
2393         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2394
2395         memset(&hints, 0, sizeof(hints));
2396         hints.ai_family = PF_UNSPEC;
2397         hints.ai_socktype = SOCK_STREAM;
2398         hints.ai_flags = AI_PASSIVE;
2399
2400         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2401         if (err != 0) {
2402                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2403                 exit(1);
2404         }
2405
2406         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2407                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2408                         continue;
2409
2410                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2411                     sizeof(ntop), strport, sizeof(strport),
2412                     NI_NUMERICHOST|NI_NUMERICSERV);
2413
2414                 if (ai->ai_family == AF_INET && err != 0) {
2415                         perror("getnameinfo");
2416                         exit(2);
2417                 }
2418         }
2419         exit(0);
2420                 ]])],
2421                 [
2422                         AC_MSG_RESULT([yes])
2423                         AC_DEFINE([AIX_GETNAMEINFO_HACK], [1],
2424                                 [Define if you have a getaddrinfo that fails
2425                                 for the all-zeros IPv6 address])
2426                 ],
2427                 [
2428                         AC_MSG_RESULT([no])
2429                         AC_DEFINE([BROKEN_GETADDRINFO])
2430                 ],
2431                 [
2432                         AC_MSG_RESULT([cross-compiling, assuming no])
2433                 ]
2434         )
2435 fi
2436
2437 if test "x$ac_cv_func_getaddrinfo" = "xyes"; then
2438         AC_CHECK_DECLS(AI_NUMERICSERV, , ,
2439             [#include <sys/types.h>
2440              #include <sys/socket.h>
2441              #include <netdb.h>])
2442 fi
2443
2444 if test "x$check_for_conflicting_getspnam" = "x1"; then
2445         AC_MSG_CHECKING([for conflicting getspnam in shadow.h])
2446         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <shadow.h> ]],
2447                 [[ exit(0); ]])],
2448                 [
2449                         AC_MSG_RESULT([no])
2450                 ],
2451                 [
2452                         AC_MSG_RESULT([yes])
2453                         AC_DEFINE([GETSPNAM_CONFLICTING_DEFS], [1],
2454                             [Conflicting defs for getspnam])
2455                 ]
2456         )
2457 fi
2458
2459 dnl NetBSD added an strnvis and unfortunately made it incompatible with the
2460 dnl existing one in OpenBSD and Linux's libbsd (the former having existed
2461 dnl for over ten years). Despite this incompatibility being reported during
2462 dnl development (see http://gnats.netbsd.org/44977) they still shipped it.
2463 dnl Even more unfortunately FreeBSD and later MacOS picked up this incompatible
2464 dnl implementation.  Try to detect this mess, and assume the only safe option
2465 dnl if we're cross compiling.
2466 dnl
2467 dnl OpenBSD, 2001: strnvis(char *dst, const char *src, size_t dlen, int flag);
2468 dnl NetBSD: 2012,  strnvis(char *dst, size_t dlen, const char *src, int flag);
2469 if test "x$ac_cv_func_strnvis" = "xyes"; then
2470         AC_MSG_CHECKING([for working strnvis])
2471         AC_RUN_IFELSE(
2472                 [AC_LANG_PROGRAM([[
2473 #include <signal.h>
2474 #include <stdlib.h>
2475 #include <string.h>
2476 #include <vis.h>
2477 static void sighandler(int sig) { _exit(1); }
2478                 ]], [[
2479         char dst[16];
2480
2481         signal(SIGSEGV, sighandler);
2482         if (strnvis(dst, "src", 4, 0) && strcmp(dst, "src") == 0)
2483                 exit(0);
2484         exit(1)
2485                 ]])],
2486                 [AC_MSG_RESULT([yes])],
2487                 [AC_MSG_RESULT([no])
2488                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis detected broken])],
2489                 [AC_MSG_WARN([cross compiling: assuming broken])
2490                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis assumed broken])]
2491         )
2492 fi
2493
2494 AC_CHECK_FUNCS([getpgrp],[
2495         AC_MSG_CHECKING([if getpgrp accepts zero args])
2496         AC_COMPILE_IFELSE(
2497                 [AC_LANG_PROGRAM([[$ac_includes_default]], [[ getpgrp(); ]])],
2498                 [ AC_MSG_RESULT([yes])
2499                   AC_DEFINE([GETPGRP_VOID], [1], [getpgrp takes zero args])],
2500                 [ AC_MSG_RESULT([no])
2501                   AC_DEFINE([GETPGRP_VOID], [0], [getpgrp takes one arg])]
2502         )
2503 ])
2504
2505 # Search for OpenSSL
2506 saved_CPPFLAGS="$CPPFLAGS"
2507 saved_LDFLAGS="$LDFLAGS"
2508 AC_ARG_WITH([ssl-dir],
2509         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
2510         [
2511                 if test "x$openssl" = "xno" ; then
2512                         AC_MSG_ERROR([cannot use --with-ssl-dir when OpenSSL disabled])
2513                 fi
2514                 if test "x$withval" != "xno" ; then
2515                         case "$withval" in
2516                                 # Relative paths
2517                                 ./*|../*)       withval="`pwd`/$withval"
2518                         esac
2519                         if test -d "$withval/lib"; then
2520                                 if test -n "${need_dash_r}"; then
2521                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
2522                                 else
2523                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
2524                                 fi
2525                         elif test -d "$withval/lib64"; then
2526                                 if test -n "${need_dash_r}"; then
2527                                         LDFLAGS="-L${withval}/lib64 -R${withval}/lib64 ${LDFLAGS}"
2528                                 else
2529                                         LDFLAGS="-L${withval}/lib64 ${LDFLAGS}"
2530                                 fi
2531                         else
2532                                 if test -n "${need_dash_r}"; then
2533                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
2534                                 else
2535                                         LDFLAGS="-L${withval} ${LDFLAGS}"
2536                                 fi
2537                         fi
2538                         if test -d "$withval/include"; then
2539                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
2540                         else
2541                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
2542                         fi
2543                 fi
2544         ]
2545 )
2546
2547 AC_ARG_WITH([openssl-header-check],
2548         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2549         [
2550                 if test "x$withval" = "xno" ; then
2551                         openssl_check_nonfatal=1
2552                 fi
2553         ]
2554 )
2555
2556 openssl_engine=no
2557 AC_ARG_WITH([ssl-engine],
2558         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2559         [
2560                 if test "x$withval" != "xno" ; then
2561                         if test "x$openssl" = "xno" ; then
2562                                 AC_MSG_ERROR([cannot use --with-ssl-engine when OpenSSL disabled])
2563                         fi
2564                         openssl_engine=yes
2565                 fi
2566         ]
2567 )
2568
2569 if test "x$openssl" = "xyes" ; then
2570         LIBS="-lcrypto $LIBS"
2571         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL], [1],
2572                 [Define if your ssl headers are included
2573                 with #include <openssl/header.h>])],
2574                 [
2575                         dnl Check default openssl install dir
2576                         if test -n "${need_dash_r}"; then
2577                                 LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
2578                         else
2579                                 LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
2580                         fi
2581                         CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
2582                         AC_CHECK_HEADER([openssl/opensslv.h], ,
2583                             [AC_MSG_ERROR([*** OpenSSL headers missing - please install first or check config.log ***])])
2584                         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL])],
2585                                 [
2586                                         AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2587                                 ]
2588                         )
2589                 ]
2590         )
2591
2592         # Determine OpenSSL header version
2593         AC_MSG_CHECKING([OpenSSL header version])
2594         AC_RUN_IFELSE(
2595                 [AC_LANG_PROGRAM([[
2596         #include <stdlib.h>
2597         #include <stdio.h>
2598         #include <string.h>
2599         #include <openssl/opensslv.h>
2600         #define DATA "conftest.sslincver"
2601                 ]], [[
2602                 FILE *fd;
2603                 int rc;
2604
2605                 fd = fopen(DATA,"w");
2606                 if(fd == NULL)
2607                         exit(1);
2608
2609                 if ((rc = fprintf(fd, "%08lx (%s)\n",
2610                     (unsigned long)OPENSSL_VERSION_NUMBER,
2611                      OPENSSL_VERSION_TEXT)) < 0)
2612                         exit(1);
2613
2614                 exit(0);
2615                 ]])],
2616                 [
2617                         ssl_header_ver=`cat conftest.sslincver`
2618                         AC_MSG_RESULT([$ssl_header_ver])
2619                 ],
2620                 [
2621                         AC_MSG_RESULT([not found])
2622                         AC_MSG_ERROR([OpenSSL version header not found.])
2623                 ],
2624                 [
2625                         AC_MSG_WARN([cross compiling: not checking])
2626                 ]
2627         )
2628
2629         # Determine OpenSSL library version
2630         AC_MSG_CHECKING([OpenSSL library version])
2631         AC_RUN_IFELSE(
2632                 [AC_LANG_PROGRAM([[
2633         #include <stdio.h>
2634         #include <string.h>
2635         #include <openssl/opensslv.h>
2636         #include <openssl/crypto.h>
2637         #define DATA "conftest.ssllibver"
2638                 ]], [[
2639                 FILE *fd;
2640                 int rc;
2641
2642                 fd = fopen(DATA,"w");
2643                 if(fd == NULL)
2644                         exit(1);
2645
2646                 if ((rc = fprintf(fd, "%08lx (%s)\n", (unsigned long)SSLeay(),
2647                     SSLeay_version(SSLEAY_VERSION))) < 0)
2648                         exit(1);
2649
2650                 exit(0);
2651                 ]])],
2652                 [
2653                         ssl_library_ver=`cat conftest.ssllibver`
2654                         # Check version is supported.
2655                         case "$ssl_library_ver" in
2656                                 10000*|0*)
2657                                         AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")])
2658                                         ;;
2659                                 100*)   ;; # 1.0.x
2660                                 200*)   ;; # LibreSSL
2661                                 *)
2662                                         AC_MSG_ERROR([OpenSSL >= 1.1.0 is not yet supported (have "$ssl_library_ver")])
2663                                         ;;
2664                         esac
2665                         AC_MSG_RESULT([$ssl_library_ver])
2666                 ],
2667                 [
2668                         AC_MSG_RESULT([not found])
2669                         AC_MSG_ERROR([OpenSSL library not found.])
2670                 ],
2671                 [
2672                         AC_MSG_WARN([cross compiling: not checking])
2673                 ]
2674         )
2675
2676         # Sanity check OpenSSL headers
2677         AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2678         AC_RUN_IFELSE(
2679                 [AC_LANG_PROGRAM([[
2680         #include <string.h>
2681         #include <openssl/opensslv.h>
2682         #include <openssl/crypto.h>
2683                 ]], [[
2684                 exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
2685                 ]])],
2686                 [
2687                         AC_MSG_RESULT([yes])
2688                 ],
2689                 [
2690                         AC_MSG_RESULT([no])
2691                         if test "x$openssl_check_nonfatal" = "x"; then
2692                                 AC_MSG_ERROR([Your OpenSSL headers do not match your
2693         library. Check config.log for details.
2694         If you are sure your installation is consistent, you can disable the check
2695         by running "./configure --without-openssl-header-check".
2696         Also see contrib/findssl.sh for help identifying header/library mismatches.
2697         ])
2698                         else
2699                                 AC_MSG_WARN([Your OpenSSL headers do not match your
2700         library. Check config.log for details.
2701         Also see contrib/findssl.sh for help identifying header/library mismatches.])
2702                         fi
2703                 ],
2704                 [
2705                         AC_MSG_WARN([cross compiling: not checking])
2706                 ]
2707         )
2708
2709         AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2710         AC_LINK_IFELSE(
2711                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2712                 [[ SSLeay_add_all_algorithms(); ]])],
2713                 [
2714                         AC_MSG_RESULT([yes])
2715                 ],
2716                 [
2717                         AC_MSG_RESULT([no])
2718                         saved_LIBS="$LIBS"
2719                         LIBS="$LIBS -ldl"
2720                         AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2721                         AC_LINK_IFELSE(
2722                                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2723                                 [[ SSLeay_add_all_algorithms(); ]])],
2724                                 [
2725                                         AC_MSG_RESULT([yes])
2726                                 ],
2727                                 [
2728                                         AC_MSG_RESULT([no])
2729                                         LIBS="$saved_LIBS"
2730                                 ]
2731                         )
2732                 ]
2733         )
2734
2735         AC_CHECK_FUNCS([ \
2736                 BN_is_prime_ex \
2737                 DSA_generate_parameters_ex \
2738                 EVP_DigestInit_ex \
2739                 EVP_DigestFinal_ex \
2740                 EVP_MD_CTX_init \
2741                 EVP_MD_CTX_cleanup \
2742                 EVP_MD_CTX_copy_ex \
2743                 HMAC_CTX_init \
2744                 RSA_generate_key_ex \
2745                 RSA_get_default_method \
2746         ])
2747
2748         if test "x$openssl_engine" = "xyes" ; then
2749                 AC_MSG_CHECKING([for OpenSSL ENGINE support])
2750                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2751         #include <openssl/engine.h>
2752                         ]], [[
2753                                 ENGINE_load_builtin_engines();
2754                                 ENGINE_register_all_complete();
2755                         ]])],
2756                         [ AC_MSG_RESULT([yes])
2757                           AC_DEFINE([USE_OPENSSL_ENGINE], [1],
2758                              [Enable OpenSSL engine support])
2759                         ], [ AC_MSG_ERROR([OpenSSL ENGINE support not found])
2760                 ])
2761         fi
2762
2763         # Check for OpenSSL without EVP_aes_{192,256}_cbc
2764         AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2765         AC_LINK_IFELSE(
2766                 [AC_LANG_PROGRAM([[
2767         #include <string.h>
2768         #include <openssl/evp.h>
2769                 ]], [[
2770                 exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
2771                 ]])],
2772                 [
2773                         AC_MSG_RESULT([no])
2774                 ],
2775                 [
2776                         AC_MSG_RESULT([yes])
2777                         AC_DEFINE([OPENSSL_LOBOTOMISED_AES], [1],
2778                             [libcrypto is missing AES 192 and 256 bit functions])
2779                 ]
2780         )
2781
2782         # Check for OpenSSL with EVP_aes_*ctr
2783         AC_MSG_CHECKING([whether OpenSSL has AES CTR via EVP])
2784         AC_LINK_IFELSE(
2785                 [AC_LANG_PROGRAM([[
2786         #include <string.h>
2787         #include <openssl/evp.h>
2788                 ]], [[
2789                 exit(EVP_aes_128_ctr() == NULL ||
2790                     EVP_aes_192_cbc() == NULL ||
2791                     EVP_aes_256_cbc() == NULL);
2792                 ]])],
2793                 [
2794                         AC_MSG_RESULT([yes])
2795                         AC_DEFINE([OPENSSL_HAVE_EVPCTR], [1],
2796                             [libcrypto has EVP AES CTR])
2797                 ],
2798                 [
2799                         AC_MSG_RESULT([no])
2800                 ]
2801         )
2802
2803         # Check for OpenSSL with EVP_aes_*gcm
2804         AC_MSG_CHECKING([whether OpenSSL has AES GCM via EVP])
2805         AC_LINK_IFELSE(
2806                 [AC_LANG_PROGRAM([[
2807         #include <string.h>
2808         #include <openssl/evp.h>
2809                 ]], [[
2810                 exit(EVP_aes_128_gcm() == NULL ||
2811                     EVP_aes_256_gcm() == NULL ||
2812                     EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
2813                     EVP_CTRL_GCM_IV_GEN == 0 ||
2814                     EVP_CTRL_GCM_SET_TAG == 0 ||
2815                     EVP_CTRL_GCM_GET_TAG == 0 ||
2816                     EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
2817                 ]])],
2818                 [
2819                         AC_MSG_RESULT([yes])
2820                         AC_DEFINE([OPENSSL_HAVE_EVPGCM], [1],
2821                             [libcrypto has EVP AES GCM])
2822                 ],
2823                 [
2824                         AC_MSG_RESULT([no])
2825                         unsupported_algorithms="$unsupported_cipers \
2826                            aes128-gcm@openssh.com \
2827                            aes256-gcm@openssh.com"
2828                 ]
2829         )
2830
2831         AC_SEARCH_LIBS([EVP_CIPHER_CTX_ctrl], [crypto],
2832                 [AC_DEFINE([HAVE_EVP_CIPHER_CTX_CTRL], [1],
2833                     [Define if libcrypto has EVP_CIPHER_CTX_ctrl])])
2834
2835         AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
2836         AC_LINK_IFELSE(
2837                 [AC_LANG_PROGRAM([[
2838         #include <string.h>
2839         #include <openssl/evp.h>
2840                 ]], [[
2841                 if(EVP_DigestUpdate(NULL, NULL,0))
2842                         exit(0);
2843                 ]])],
2844                 [
2845                         AC_MSG_RESULT([yes])
2846                 ],
2847                 [
2848                         AC_MSG_RESULT([no])
2849                         AC_DEFINE([OPENSSL_EVP_DIGESTUPDATE_VOID], [1],
2850                             [Define if EVP_DigestUpdate returns void])
2851                 ]
2852         )
2853
2854         # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2855         # because the system crypt() is more featureful.
2856         if test "x$check_for_libcrypt_before" = "x1"; then
2857                 AC_CHECK_LIB([crypt], [crypt])
2858         fi
2859
2860         # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2861         # version in OpenSSL.
2862         if test "x$check_for_libcrypt_later" = "x1"; then
2863                 AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
2864         fi
2865         AC_CHECK_FUNCS([crypt DES_crypt])
2866
2867         # Search for SHA256 support in libc and/or OpenSSL
2868         AC_CHECK_FUNCS([SHA256_Update EVP_sha256], ,
2869             [unsupported_algorithms="$unsupported_algorithms \
2870                 hmac-sha2-256 \
2871                 hmac-sha2-512 \
2872                 diffie-hellman-group-exchange-sha256 \
2873                 hmac-sha2-256-etm@openssh.com \
2874                 hmac-sha2-512-etm@openssh.com"
2875              ]
2876         )
2877         # Search for RIPE-MD support in OpenSSL
2878         AC_CHECK_FUNCS([EVP_ripemd160], ,
2879             [unsupported_algorithms="$unsupported_algorithms \
2880                 hmac-ripemd160 \
2881                 hmac-ripemd160@openssh.com \
2882                 hmac-ripemd160-etm@openssh.com"
2883              ]
2884         )
2885
2886         # Check complete ECC support in OpenSSL
2887         AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1])
2888         AC_LINK_IFELSE(
2889                 [AC_LANG_PROGRAM([[
2890         #include <openssl/ec.h>
2891         #include <openssl/ecdh.h>
2892         #include <openssl/ecdsa.h>
2893         #include <openssl/evp.h>
2894         #include <openssl/objects.h>
2895         #include <openssl/opensslv.h>
2896                 ]], [[
2897                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
2898                 const EVP_MD *m = EVP_sha256(); /* We need this too */
2899                 ]])],
2900                 [ AC_MSG_RESULT([yes])
2901                   enable_nistp256=1 ],
2902                 [ AC_MSG_RESULT([no]) ]
2903         )
2904
2905         AC_MSG_CHECKING([whether OpenSSL has NID_secp384r1])
2906         AC_LINK_IFELSE(
2907                 [AC_LANG_PROGRAM([[
2908         #include <openssl/ec.h>
2909         #include <openssl/ecdh.h>
2910         #include <openssl/ecdsa.h>
2911         #include <openssl/evp.h>
2912         #include <openssl/objects.h>
2913         #include <openssl/opensslv.h>
2914                 ]], [[
2915                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
2916                 const EVP_MD *m = EVP_sha384(); /* We need this too */
2917                 ]])],
2918                 [ AC_MSG_RESULT([yes])
2919                   enable_nistp384=1 ],
2920                 [ AC_MSG_RESULT([no]) ]
2921         )
2922
2923         AC_MSG_CHECKING([whether OpenSSL has NID_secp521r1])
2924         AC_LINK_IFELSE(
2925                 [AC_LANG_PROGRAM([[
2926         #include <openssl/ec.h>
2927         #include <openssl/ecdh.h>
2928         #include <openssl/ecdsa.h>
2929         #include <openssl/evp.h>
2930         #include <openssl/objects.h>
2931         #include <openssl/opensslv.h>
2932                 ]], [[
2933                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2934                 const EVP_MD *m = EVP_sha512(); /* We need this too */
2935                 ]])],
2936                 [ AC_MSG_RESULT([yes])
2937                   AC_MSG_CHECKING([if OpenSSL's NID_secp521r1 is functional])
2938                   AC_RUN_IFELSE(
2939                         [AC_LANG_PROGRAM([[
2940         #include <openssl/ec.h>
2941         #include <openssl/ecdh.h>
2942         #include <openssl/ecdsa.h>
2943         #include <openssl/evp.h>
2944         #include <openssl/objects.h>
2945         #include <openssl/opensslv.h>
2946                         ]],[[
2947                         EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2948                         const EVP_MD *m = EVP_sha512(); /* We need this too */
2949                         exit(e == NULL || m == NULL);
2950                         ]])],
2951                         [ AC_MSG_RESULT([yes])
2952                           enable_nistp521=1 ],
2953                         [ AC_MSG_RESULT([no]) ],
2954                         [ AC_MSG_WARN([cross-compiling: assuming yes])
2955                           enable_nistp521=1 ]
2956                   )],
2957                 AC_MSG_RESULT([no])
2958         )
2959
2960         COMMENT_OUT_ECC="#no ecc#"
2961         TEST_SSH_ECC=no
2962
2963         if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
2964             test x$enable_nistp521 = x1; then
2965                 AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC])
2966         fi
2967         if test x$enable_nistp256 = x1; then
2968                 AC_DEFINE([OPENSSL_HAS_NISTP256], [1],
2969                     [libcrypto has NID_X9_62_prime256v1])
2970                 TEST_SSH_ECC=yes
2971                 COMMENT_OUT_ECC=""
2972         else
2973                 unsupported_algorithms="$unsupported_algorithms \
2974                         ecdsa-sha2-nistp256 \
2975                         ecdh-sha2-nistp256 \
2976                         ecdsa-sha2-nistp256-cert-v01@openssh.com"
2977         fi
2978         if test x$enable_nistp384 = x1; then
2979                 AC_DEFINE([OPENSSL_HAS_NISTP384], [1], [libcrypto has NID_secp384r1])
2980                 TEST_SSH_ECC=yes
2981                 COMMENT_OUT_ECC=""
2982         else
2983                 unsupported_algorithms="$unsupported_algorithms \
2984                         ecdsa-sha2-nistp384 \
2985                         ecdh-sha2-nistp384 \
2986                         ecdsa-sha2-nistp384-cert-v01@openssh.com"
2987         fi
2988         if test x$enable_nistp521 = x1; then
2989                 AC_DEFINE([OPENSSL_HAS_NISTP521], [1], [libcrypto has NID_secp521r1])
2990                 TEST_SSH_ECC=yes
2991                 COMMENT_OUT_ECC=""
2992         else
2993                 unsupported_algorithms="$unsupported_algorithms \
2994                         ecdh-sha2-nistp521 \
2995                         ecdsa-sha2-nistp521 \
2996                         ecdsa-sha2-nistp521-cert-v01@openssh.com"
2997         fi
2998
2999         AC_SUBST([TEST_SSH_ECC])
3000         AC_SUBST([COMMENT_OUT_ECC])
3001 else
3002         AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
3003         AC_CHECK_FUNCS([crypt])
3004 fi
3005
3006 AC_CHECK_FUNCS([ \
3007         arc4random \
3008         arc4random_buf \
3009         arc4random_stir \
3010         arc4random_uniform \
3011 ])
3012
3013 saved_LIBS="$LIBS"
3014 AC_CHECK_LIB([iaf], [ia_openinfo], [
3015         LIBS="$LIBS -liaf"
3016         AC_CHECK_FUNCS([set_id], [SSHDLIBS="$SSHDLIBS -liaf"
3017                                 AC_DEFINE([HAVE_LIBIAF], [1],
3018                         [Define if system has libiaf that supports set_id])
3019                                 ])
3020 ])
3021 LIBS="$saved_LIBS"
3022
3023 ### Configure cryptographic random number support
3024
3025 # Check whether OpenSSL seeds itself
3026 if test "x$openssl" = "xyes" ; then
3027         AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
3028         AC_RUN_IFELSE(
3029                 [AC_LANG_PROGRAM([[
3030         #include <string.h>
3031         #include <openssl/rand.h>
3032                 ]], [[
3033                 exit(RAND_status() == 1 ? 0 : 1);
3034                 ]])],
3035                 [
3036                         OPENSSL_SEEDS_ITSELF=yes
3037                         AC_MSG_RESULT([yes])
3038                 ],
3039                 [
3040                         AC_MSG_RESULT([no])
3041                 ],
3042                 [
3043                         AC_MSG_WARN([cross compiling: assuming yes])
3044                         # This is safe, since we will fatal() at runtime if
3045                         # OpenSSL is not seeded correctly.
3046                         OPENSSL_SEEDS_ITSELF=yes
3047                 ]
3048         )
3049 fi
3050
3051 # PRNGD TCP socket
3052 AC_ARG_WITH([prngd-port],
3053         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
3054         [
3055                 case "$withval" in
3056                 no)
3057                         withval=""
3058                         ;;
3059                 [[0-9]]*)
3060                         ;;
3061                 *)
3062                         AC_MSG_ERROR([You must specify a numeric port number for --with-prngd-port])
3063                         ;;
3064                 esac
3065                 if test ! -z "$withval" ; then
3066                         PRNGD_PORT="$withval"
3067                         AC_DEFINE_UNQUOTED([PRNGD_PORT], [$PRNGD_PORT],
3068                                 [Port number of PRNGD/EGD random number socket])
3069                 fi
3070         ]
3071 )
3072
3073 # PRNGD Unix domain socket
3074 AC_ARG_WITH([prngd-socket],
3075         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
3076         [
3077                 case "$withval" in
3078                 yes)
3079                         withval="/var/run/egd-pool"
3080                         ;;
3081                 no)
3082                         withval=""
3083                         ;;
3084                 /*)
3085                         ;;
3086                 *)
3087                         AC_MSG_ERROR([You must specify an absolute path to the entropy socket])
3088                         ;;
3089                 esac
3090
3091                 if test ! -z "$withval" ; then
3092                         if test ! -z "$PRNGD_PORT" ; then
3093                                 AC_MSG_ERROR([You may not specify both a PRNGD/EGD port and socket])
3094                         fi
3095                         if test ! -r "$withval" ; then
3096                                 AC_MSG_WARN([Entropy socket is not readable])
3097                         fi
3098                         PRNGD_SOCKET="$withval"
3099                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"],
3100                                 [Location of PRNGD/EGD random number socket])
3101                 fi
3102         ],
3103         [
3104                 # Check for existing socket only if we don't have a random device already
3105                 if test "x$OPENSSL_SEEDS_ITSELF" != "xyes" ; then
3106                         AC_MSG_CHECKING([for PRNGD/EGD socket])
3107                         # Insert other locations here
3108                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
3109                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
3110                                         PRNGD_SOCKET="$sock"
3111                                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"])
3112                                         break;
3113                                 fi
3114                         done
3115                         if test ! -z "$PRNGD_SOCKET" ; then
3116                                 AC_MSG_RESULT([$PRNGD_SOCKET])
3117                         else
3118                                 AC_MSG_RESULT([not found])
3119                         fi
3120                 fi
3121         ]
3122 )
3123
3124 # Which randomness source do we use?
3125 if test ! -z "$PRNGD_PORT" ; then
3126         RAND_MSG="PRNGd port $PRNGD_PORT"
3127 elif test ! -z "$PRNGD_SOCKET" ; then
3128         RAND_MSG="PRNGd socket $PRNGD_SOCKET"
3129 elif test ! -z "$OPENSSL_SEEDS_ITSELF" ; then
3130         AC_DEFINE([OPENSSL_PRNG_ONLY], [1],
3131                 [Define if you want the OpenSSL internally seeded PRNG only])
3132         RAND_MSG="OpenSSL internal ONLY"
3133 elif test "x$openssl" = "xno" ; then
3134         AC_MSG_WARN([OpenSSH will use /dev/urandom as a source of random numbers. It will fail if this device is not supported or accessible])
3135 else
3136         AC_MSG_ERROR([OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options])
3137 fi
3138
3139 # Check for PAM libs
3140 PAM_MSG="no"
3141 AC_ARG_WITH([pam],
3142         [  --with-pam              Enable PAM support ],
3143         [
3144                 if test "x$withval" != "xno" ; then
3145                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
3146                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
3147                                 AC_MSG_ERROR([PAM headers not found])
3148                         fi
3149
3150                         saved_LIBS="$LIBS"
3151                         AC_CHECK_LIB([dl], [dlopen], , )
3152                         AC_CHECK_LIB([pam], [pam_set_item], , [AC_MSG_ERROR([*** libpam missing])])
3153                         AC_CHECK_FUNCS([pam_getenvlist])
3154                         AC_CHECK_FUNCS([pam_putenv])
3155                         LIBS="$saved_LIBS"
3156
3157                         PAM_MSG="yes"
3158
3159                         SSHDLIBS="$SSHDLIBS -lpam"
3160                         AC_DEFINE([USE_PAM], [1],
3161                                 [Define if you want to enable PAM support])
3162
3163                         if test $ac_cv_lib_dl_dlopen = yes; then
3164                                 case "$LIBS" in
3165                                 *-ldl*)
3166                                         # libdl already in LIBS
3167                                         ;;
3168                                 *)
3169                                         SSHDLIBS="$SSHDLIBS -ldl"
3170                                         ;;
3171                                 esac
3172                         fi
3173                 fi
3174         ]
3175 )
3176
3177 AC_ARG_WITH([pam-service],
3178         [  --with-pam-service=name Specify PAM service name ],
3179         [
3180                 if test "x$withval" != "xno" && \
3181                    test "x$withval" != "xyes" ; then
3182                         AC_DEFINE_UNQUOTED([SSHD_PAM_SERVICE],
3183                                 ["$withval"], [sshd PAM service name])
3184                 fi
3185         ]
3186 )
3187
3188 # Check for older PAM
3189 if test "x$PAM_MSG" = "xyes" ; then
3190         # Check PAM strerror arguments (old PAM)
3191         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
3192         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3193 #include <stdlib.h>
3194 #if defined(HAVE_SECURITY_PAM_APPL_H)
3195 #include <security/pam_appl.h>
3196 #elif defined (HAVE_PAM_PAM_APPL_H)
3197 #include <pam/pam_appl.h>
3198 #endif
3199                 ]], [[
3200 (void)pam_strerror((pam_handle_t *)NULL, -1);
3201                 ]])], [AC_MSG_RESULT([no])], [
3202                         AC_DEFINE([HAVE_OLD_PAM], [1],
3203                                 [Define if you have an old version of PAM
3204                                 which takes only one argument to pam_strerror])
3205                         AC_MSG_RESULT([yes])
3206                         PAM_MSG="yes (old library)"
3207
3208         ])
3209 fi
3210
3211 case "$host" in
3212 *-*-cygwin*)
3213         SSH_PRIVSEP_USER=CYGWIN_SSH_PRIVSEP_USER
3214         ;;
3215 *)
3216         SSH_PRIVSEP_USER=sshd
3217         ;;
3218 esac
3219 AC_ARG_WITH([privsep-user],
3220         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
3221         [
3222                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3223                     test "x${withval}" != "xyes"; then
3224                         SSH_PRIVSEP_USER=$withval
3225                 fi
3226         ]
3227 )
3228 if test "x$SSH_PRIVSEP_USER" = "xCYGWIN_SSH_PRIVSEP_USER" ; then
3229         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], [CYGWIN_SSH_PRIVSEP_USER],
3230                 [Cygwin function to fetch non-privileged user for privilege separation])
3231 else
3232         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], ["$SSH_PRIVSEP_USER"],
3233                 [non-privileged user for privilege separation])
3234 fi
3235 AC_SUBST([SSH_PRIVSEP_USER])
3236
3237 if test "x$have_linux_no_new_privs" = "x1" ; then
3238 AC_CHECK_DECL([SECCOMP_MODE_FILTER], [have_seccomp_filter=1], , [
3239         #include <sys/types.h>
3240         #include <linux/seccomp.h>
3241 ])
3242 fi
3243 if test "x$have_seccomp_filter" = "x1" ; then
3244 AC_MSG_CHECKING([kernel for seccomp_filter support])
3245 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
3246                 #include <errno.h>
3247                 #include <elf.h>
3248                 #include <linux/audit.h>
3249                 #include <linux/seccomp.h>
3250                 #include <stdlib.h>
3251                 #include <sys/prctl.h>
3252         ]],
3253         [[ int i = $seccomp_audit_arch;
3254            errno = 0;
3255            prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
3256            exit(errno == EFAULT ? 0 : 1); ]])],
3257         [ AC_MSG_RESULT([yes]) ], [
3258                 AC_MSG_RESULT([no])
3259                 # Disable seccomp filter as a target
3260                 have_seccomp_filter=0
3261         ]
3262 )
3263 fi
3264
3265 # Decide which sandbox style to use
3266 sandbox_arg=""
3267 AC_ARG_WITH([sandbox],
3268         [  --with-sandbox=style    Specify privilege separation sandbox (no, capsicum, darwin, rlimit, seccomp_filter, systrace, pledge)],
3269         [
3270                 if test "x$withval" = "xyes" ; then
3271                         sandbox_arg=""
3272                 else
3273                         sandbox_arg="$withval"
3274                 fi
3275         ]
3276 )
3277
3278 # Some platforms (seems to be the ones that have a kernel poll(2)-type
3279 # function with which they implement select(2)) use an extra file descriptor
3280 # when calling select(2), which means we can't use the rlimit sandbox.
3281 AC_MSG_CHECKING([if select works with descriptor rlimit])
3282 AC_RUN_IFELSE(
3283         [AC_LANG_PROGRAM([[
3284 #include <sys/types.h>
3285 #ifdef HAVE_SYS_TIME_H
3286 # include <sys/time.h>
3287 #endif
3288 #include <sys/resource.h>
3289 #ifdef HAVE_SYS_SELECT_H
3290 # include <sys/select.h>
3291 #endif
3292 #include <errno.h>
3293 #include <fcntl.h>
3294 #include <stdlib.h>
3295         ]],[[
3296         struct rlimit rl_zero;
3297         int fd, r;
3298         fd_set fds;
3299         struct timeval tv;
3300
3301         fd = open("/dev/null", O_RDONLY);
3302         FD_ZERO(&fds);
3303         FD_SET(fd, &fds);
3304         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3305         setrlimit(RLIMIT_FSIZE, &rl_zero);
3306         setrlimit(RLIMIT_NOFILE, &rl_zero);
3307         tv.tv_sec = 1;
3308         tv.tv_usec = 0;
3309         r = select(fd+1, &fds, NULL, NULL, &tv);
3310         exit (r == -1 ? 1 : 0);
3311         ]])],
3312         [AC_MSG_RESULT([yes])
3313          select_works_with_rlimit=yes],
3314         [AC_MSG_RESULT([no])
3315          select_works_with_rlimit=no],
3316         [AC_MSG_WARN([cross compiling: assuming yes])
3317          select_works_with_rlimit=yes]
3318 )
3319
3320 AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works])
3321 AC_RUN_IFELSE(
3322         [AC_LANG_PROGRAM([[
3323 #include <sys/types.h>
3324 #ifdef HAVE_SYS_TIME_H
3325 # include <sys/time.h>
3326 #endif
3327 #include <sys/resource.h>
3328 #include <errno.h>
3329 #include <stdlib.h>
3330         ]],[[
3331         struct rlimit rl_zero;
3332         int fd, r;
3333         fd_set fds;
3334
3335         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3336         r = setrlimit(RLIMIT_NOFILE, &rl_zero);
3337         exit (r == -1 ? 1 : 0);
3338         ]])],
3339         [AC_MSG_RESULT([yes])
3340          rlimit_nofile_zero_works=yes],
3341         [AC_MSG_RESULT([no])
3342          rlimit_nofile_zero_works=no],
3343         [AC_MSG_WARN([cross compiling: assuming yes])
3344          rlimit_nofile_zero_works=yes]
3345 )
3346
3347 AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
3348 AC_RUN_IFELSE(
3349         [AC_LANG_PROGRAM([[
3350 #include <sys/types.h>
3351 #include <sys/resource.h>
3352 #include <stdlib.h>
3353         ]],[[
3354                 struct rlimit rl_zero;
3355
3356                 rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3357                 exit(setrlimit(RLIMIT_FSIZE, &rl_zero) != 0);
3358         ]])],
3359         [AC_MSG_RESULT([yes])],
3360         [AC_MSG_RESULT([no])
3361          AC_DEFINE(SANDBOX_SKIP_RLIMIT_FSIZE, 1,
3362             [setrlimit RLIMIT_FSIZE works])],
3363         [AC_MSG_WARN([cross compiling: assuming yes])]
3364 )
3365
3366 if test "x$sandbox_arg" = "xpledge" || \
3367    ( test -z "$sandbox_arg" && test "x$ac_cv_func_pledge" = "xyes" ) ; then
3368         test "x$ac_cv_func_pledge" != "xyes" && \
3369                 AC_MSG_ERROR([pledge sandbox requires pledge(2) support])
3370         SANDBOX_STYLE="pledge"
3371         AC_DEFINE([SANDBOX_PLEDGE], [1], [Sandbox using pledge(2)])
3372 elif test "x$sandbox_arg" = "xsystrace" || \
3373    ( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
3374         test "x$have_systr_policy_kill" != "x1" && \
3375                 AC_MSG_ERROR([systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support])
3376         SANDBOX_STYLE="systrace"
3377         AC_DEFINE([SANDBOX_SYSTRACE], [1], [Sandbox using systrace(4)])
3378 elif test "x$sandbox_arg" = "xdarwin" || \
3379      ( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \
3380        test "x$ac_cv_header_sandbox_h" = "xyes") ; then
3381         test "x$ac_cv_func_sandbox_init" != "xyes" -o \
3382              "x$ac_cv_header_sandbox_h" != "xyes" && \
3383                 AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h and sandbox_init function])
3384         SANDBOX_STYLE="darwin"
3385         AC_DEFINE([SANDBOX_DARWIN], [1], [Sandbox using Darwin sandbox_init(3)])
3386 elif test "x$sandbox_arg" = "xseccomp_filter" || \
3387      ( test -z "$sandbox_arg" && \
3388        test "x$have_seccomp_filter" = "x1" && \
3389        test "x$ac_cv_header_elf_h" = "xyes" && \
3390        test "x$ac_cv_header_linux_audit_h" = "xyes" && \
3391        test "x$ac_cv_header_linux_filter_h" = "xyes" && \
3392        test "x$seccomp_audit_arch" != "x" && \
3393        test "x$have_linux_no_new_privs" = "x1" && \
3394        test "x$ac_cv_func_prctl" = "xyes" ) ; then
3395         test "x$seccomp_audit_arch" = "x" && \
3396                 AC_MSG_ERROR([seccomp_filter sandbox not supported on $host])
3397         test "x$have_linux_no_new_privs" != "x1" && \
3398                 AC_MSG_ERROR([seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS])
3399         test "x$have_seccomp_filter" != "x1" && \
3400                 AC_MSG_ERROR([seccomp_filter sandbox requires seccomp headers])
3401         test "x$ac_cv_func_prctl" != "xyes" && \
3402                 AC_MSG_ERROR([seccomp_filter sandbox requires prctl function])
3403         SANDBOX_STYLE="seccomp_filter"
3404         AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
3405 elif test "x$sandbox_arg" = "xcapsicum" || \
3406      ( test -z "$sandbox_arg" && \
3407        test "x$ac_cv_header_sys_capsicum_h" = "xyes" && \
3408        test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
3409        test "x$ac_cv_header_sys_capsicum_h" != "xyes" && \
3410                 AC_MSG_ERROR([capsicum sandbox requires sys/capsicum.h header])
3411        test "x$ac_cv_func_cap_rights_limit" != "xyes" && \
3412                 AC_MSG_ERROR([capsicum sandbox requires cap_rights_limit function])
3413        SANDBOX_STYLE="capsicum"
3414        AC_DEFINE([SANDBOX_CAPSICUM], [1], [Sandbox using capsicum])
3415 elif test "x$sandbox_arg" = "xrlimit" || \
3416      ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
3417        test "x$select_works_with_rlimit" = "xyes" && \
3418        test "x$rlimit_nofile_zero_works" = "xyes" ) ; then
3419         test "x$ac_cv_func_setrlimit" != "xyes" && \
3420                 AC_MSG_ERROR([rlimit sandbox requires setrlimit function])
3421         test "x$select_works_with_rlimit" != "xyes" && \
3422                 AC_MSG_ERROR([rlimit sandbox requires select to work with rlimit])
3423         SANDBOX_STYLE="rlimit"
3424         AC_DEFINE([SANDBOX_RLIMIT], [1], [Sandbox using setrlimit(2)])
3425 elif test "x$sandbox_arg" = "xsolaris" || \
3426    ( test -z "$sandbox_arg" && test "x$SOLARIS_PRIVS" = "xyes" ) ; then
3427         SANDBOX_STYLE="solaris"
3428         AC_DEFINE([SANDBOX_SOLARIS], [1], [Sandbox using Solaris/Illumos privileges])
3429 elif test -z "$sandbox_arg" || test "x$sandbox_arg" = "xno" || \
3430      test "x$sandbox_arg" = "xnone" || test "x$sandbox_arg" = "xnull" ; then
3431         SANDBOX_STYLE="none"
3432         AC_DEFINE([SANDBOX_NULL], [1], [no privsep sandboxing])
3433 else
3434         AC_MSG_ERROR([unsupported --with-sandbox])
3435 fi
3436
3437 # Cheap hack to ensure NEWS-OS libraries are arranged right.
3438 if test ! -z "$SONY" ; then
3439   LIBS="$LIBS -liberty";
3440 fi
3441
3442 # Check for  long long datatypes
3443 AC_CHECK_TYPES([long long, unsigned long long, long double])
3444
3445 # Check datatype sizes
3446 AC_CHECK_SIZEOF([short int], [2])
3447 AC_CHECK_SIZEOF([int], [4])
3448 AC_CHECK_SIZEOF([long int], [4])
3449 AC_CHECK_SIZEOF([long long int], [8])
3450
3451 # Sanity check long long for some platforms (AIX)
3452 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
3453         ac_cv_sizeof_long_long_int=0
3454 fi
3455
3456 # compute LLONG_MIN and LLONG_MAX if we don't know them.
3457 if test -z "$have_llong_max"; then
3458         AC_MSG_CHECKING([for max value of long long])
3459         AC_RUN_IFELSE(
3460                 [AC_LANG_PROGRAM([[
3461 #include <stdio.h>
3462 /* Why is this so damn hard? */
3463 #ifdef __GNUC__
3464 # undef __GNUC__
3465 #endif
3466 #define __USE_ISOC99
3467 #include <limits.h>
3468 #define DATA "conftest.llminmax"
3469 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
3470
3471 /*
3472  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
3473  * we do this the hard way.
3474  */
3475 static int
3476 fprint_ll(FILE *f, long long n)
3477 {
3478         unsigned int i;
3479         int l[sizeof(long long) * 8];
3480
3481         if (n < 0)
3482                 if (fprintf(f, "-") < 0)
3483                         return -1;
3484         for (i = 0; n != 0; i++) {
3485                 l[i] = my_abs(n % 10);
3486                 n /= 10;
3487         }
3488         do {
3489                 if (fprintf(f, "%d", l[--i]) < 0)
3490                         return -1;
3491         } while (i != 0);
3492         if (fprintf(f, " ") < 0)
3493                 return -1;
3494         return 0;
3495 }
3496                 ]], [[
3497         FILE *f;
3498         long long i, llmin, llmax = 0;
3499
3500         if((f = fopen(DATA,"w")) == NULL)
3501                 exit(1);
3502
3503 #if defined(LLONG_MIN) && defined(LLONG_MAX)
3504         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
3505         llmin = LLONG_MIN;
3506         llmax = LLONG_MAX;
3507 #else
3508         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
3509         /* This will work on one's complement and two's complement */
3510         for (i = 1; i > llmax; i <<= 1, i++)
3511                 llmax = i;
3512         llmin = llmax + 1LL;    /* wrap */
3513 #endif
3514
3515         /* Sanity check */
3516         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
3517             || llmax - 1 > llmax || llmin == llmax || llmin == 0
3518             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
3519                 fprintf(f, "unknown unknown\n");
3520                 exit(2);
3521         }
3522
3523         if (fprint_ll(f, llmin) < 0)
3524                 exit(3);
3525         if (fprint_ll(f, llmax) < 0)
3526                 exit(4);
3527         if (fclose(f) < 0)
3528                 exit(5);
3529         exit(0);
3530                 ]])],
3531                 [
3532                         llong_min=`$AWK '{print $1}' conftest.llminmax`
3533                         llong_max=`$AWK '{print $2}' conftest.llminmax`
3534
3535                         AC_MSG_RESULT([$llong_max])
3536                         AC_DEFINE_UNQUOTED([LLONG_MAX], [${llong_max}LL],
3537                             [max value of long long calculated by configure])
3538                         AC_MSG_CHECKING([for min value of long long])
3539                         AC_MSG_RESULT([$llong_min])
3540                         AC_DEFINE_UNQUOTED([LLONG_MIN], [${llong_min}LL],
3541                             [min value of long long calculated by configure])
3542                 ],
3543                 [
3544                         AC_MSG_RESULT([not found])
3545                 ],
3546                 [
3547                         AC_MSG_WARN([cross compiling: not checking])
3548                 ]
3549         )
3550 fi
3551
3552
3553 # More checks for data types
3554 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
3555         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3556         [[ u_int a; a = 1;]])],
3557         [ ac_cv_have_u_int="yes" ], [ ac_cv_have_u_int="no"
3558         ])
3559 ])
3560 if test "x$ac_cv_have_u_int" = "xyes" ; then
3561         AC_DEFINE([HAVE_U_INT], [1], [define if you have u_int data type])
3562         have_u_int=1
3563 fi
3564
3565 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
3566         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3567         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3568         [ ac_cv_have_intxx_t="yes" ], [ ac_cv_have_intxx_t="no"
3569         ])
3570 ])
3571 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
3572         AC_DEFINE([HAVE_INTXX_T], [1], [define if you have intxx_t data type])
3573         have_intxx_t=1
3574 fi
3575
3576 if (test -z "$have_intxx_t" && \
3577            test "x$ac_cv_header_stdint_h" = "xyes")
3578 then
3579     AC_MSG_CHECKING([for intXX_t types in stdint.h])
3580         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3581         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3582                 [
3583                         AC_DEFINE([HAVE_INTXX_T])
3584                         AC_MSG_RESULT([yes])
3585                 ], [ AC_MSG_RESULT([no])
3586         ])
3587 fi
3588
3589 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
3590         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3591 #include <sys/types.h>
3592 #ifdef HAVE_STDINT_H
3593 # include <stdint.h>
3594 #endif
3595 #include <sys/socket.h>
3596 #ifdef HAVE_SYS_BITYPES_H
3597 # include <sys/bitypes.h>
3598 #endif
3599                 ]], [[
3600 int64_t a; a = 1;
3601                 ]])],
3602         [ ac_cv_have_int64_t="yes" ], [ ac_cv_have_int64_t="no"
3603         ])
3604 ])
3605 if test "x$ac_cv_have_int64_t" = "xyes" ; then
3606         AC_DEFINE([HAVE_INT64_T], [1], [define if you have int64_t data type])
3607 fi
3608
3609 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
3610         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3611         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3612         [ ac_cv_have_u_intxx_t="yes" ], [ ac_cv_have_u_intxx_t="no"
3613         ])
3614 ])
3615 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
3616         AC_DEFINE([HAVE_U_INTXX_T], [1], [define if you have u_intxx_t data type])
3617         have_u_intxx_t=1
3618 fi
3619
3620 if test -z "$have_u_intxx_t" ; then
3621     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
3622         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/socket.h> ]],
3623         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3624                 [
3625                         AC_DEFINE([HAVE_U_INTXX_T])
3626                         AC_MSG_RESULT([yes])
3627                 ], [ AC_MSG_RESULT([no])
3628         ])
3629 fi
3630
3631 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
3632         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3633         [[ u_int64_t a; a = 1;]])],
3634         [ ac_cv_have_u_int64_t="yes" ], [ ac_cv_have_u_int64_t="no"
3635         ])
3636 ])
3637 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
3638         AC_DEFINE([HAVE_U_INT64_T], [1], [define if you have u_int64_t data type])
3639         have_u_int64_t=1
3640 fi
3641
3642 if (test -z "$have_u_int64_t" && \
3643            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3644 then
3645     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
3646         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/bitypes.h> ]],
3647         [[ u_int64_t a; a = 1]])],
3648                 [
3649                         AC_DEFINE([HAVE_U_INT64_T])
3650                         AC_MSG_RESULT([yes])
3651                 ], [ AC_MSG_RESULT([no])
3652         ])
3653 fi
3654
3655 if test -z "$have_u_intxx_t" ; then
3656         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
3657                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3658 #include <sys/types.h>
3659                         ]], [[
3660         uint8_t a;
3661         uint16_t b;
3662         uint32_t c;
3663         a = b = c = 1;
3664                         ]])],
3665                 [ ac_cv_have_uintxx_t="yes" ], [ ac_cv_have_uintxx_t="no"
3666                 ])
3667         ])
3668         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
3669                 AC_DEFINE([HAVE_UINTXX_T], [1],
3670                         [define if you have uintxx_t data type])
3671         fi
3672 fi
3673
3674 if (test -z "$have_uintxx_t" && \
3675            test "x$ac_cv_header_stdint_h" = "xyes")
3676 then
3677     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
3678         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3679         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3680                 [
3681                         AC_DEFINE([HAVE_UINTXX_T])
3682                         AC_MSG_RESULT([yes])
3683                 ], [ AC_MSG_RESULT([no])
3684         ])
3685 fi
3686
3687 if (test -z "$have_uintxx_t" && \
3688            test "x$ac_cv_header_inttypes_h" = "xyes")
3689 then
3690     AC_MSG_CHECKING([for uintXX_t types in inttypes.h])
3691         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <inttypes.h> ]],
3692         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3693                 [
3694                         AC_DEFINE([HAVE_UINTXX_T])
3695                         AC_MSG_RESULT([yes])
3696                 ], [ AC_MSG_RESULT([no])
3697         ])
3698 fi
3699
3700 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
3701            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3702 then
3703         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
3704         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3705 #include <sys/bitypes.h>
3706                 ]], [[
3707                         int8_t a; int16_t b; int32_t c;
3708                         u_int8_t e; u_int16_t f; u_int32_t g;
3709                         a = b = c = e = f = g = 1;
3710                 ]])],
3711                 [
3712                         AC_DEFINE([HAVE_U_INTXX_T])
3713                         AC_DEFINE([HAVE_INTXX_T])
3714                         AC_MSG_RESULT([yes])
3715                 ], [AC_MSG_RESULT([no])
3716         ])
3717 fi
3718
3719
3720 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
3721         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3722         [[ u_char foo; foo = 125; ]])],
3723         [ ac_cv_have_u_char="yes" ], [ ac_cv_have_u_char="no"
3724         ])
3725 ])
3726 if test "x$ac_cv_have_u_char" = "xyes" ; then
3727         AC_DEFINE([HAVE_U_CHAR], [1], [define if you have u_char data type])
3728 fi
3729
3730 AC_CHECK_TYPES([intmax_t, uintmax_t], , , [
3731 #include <sys/types.h>
3732 #include <stdint.h>
3733 ])
3734
3735 TYPE_SOCKLEN_T
3736
3737 AC_CHECK_TYPES([sig_atomic_t], , , [#include <signal.h>])
3738 AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t], , , [
3739 #include <sys/types.h>
3740 #ifdef HAVE_SYS_BITYPES_H
3741 #include <sys/bitypes.h>
3742 #endif
3743 #ifdef HAVE_SYS_STATFS_H
3744 #include <sys/statfs.h>
3745 #endif
3746 #ifdef HAVE_SYS_STATVFS_H
3747 #include <sys/statvfs.h>
3748 #endif
3749 ])
3750
3751 AC_CHECK_MEMBERS([struct statfs.f_flags], [], [], [[
3752 #include <sys/types.h>
3753 #ifdef HAVE_SYS_BITYPES_H
3754 #include <sys/bitypes.h>
3755 #endif
3756 #ifdef HAVE_SYS_STATFS_H
3757 #include <sys/statfs.h>
3758 #endif
3759 #ifdef HAVE_SYS_STATVFS_H
3760 #include <sys/statvfs.h>
3761 #endif
3762 #ifdef HAVE_SYS_VFS_H
3763 #include <sys/vfs.h>
3764 #endif
3765 ]])
3766
3767
3768 AC_CHECK_TYPES([in_addr_t, in_port_t], , ,
3769 [#include <sys/types.h>
3770 #include <netinet/in.h>])
3771
3772 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
3773         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3774         [[ size_t foo; foo = 1235; ]])],
3775         [ ac_cv_have_size_t="yes" ], [ ac_cv_have_size_t="no"
3776         ])
3777 ])
3778 if test "x$ac_cv_have_size_t" = "xyes" ; then
3779         AC_DEFINE([HAVE_SIZE_T], [1], [define if you have size_t data type])
3780 fi
3781
3782 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
3783         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3784         [[ ssize_t foo; foo = 1235; ]])],
3785         [ ac_cv_have_ssize_t="yes" ], [ ac_cv_have_ssize_t="no"
3786         ])
3787 ])
3788 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
3789         AC_DEFINE([HAVE_SSIZE_T], [1], [define if you have ssize_t data type])
3790 fi
3791
3792 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
3793         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <time.h> ]],
3794         [[ clock_t foo; foo = 1235; ]])],
3795         [ ac_cv_have_clock_t="yes" ], [ ac_cv_have_clock_t="no"
3796         ])
3797 ])
3798 if test "x$ac_cv_have_clock_t" = "xyes" ; then
3799         AC_DEFINE([HAVE_CLOCK_T], [1], [define if you have clock_t data type])
3800 fi
3801
3802 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
3803         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3804 #include <sys/types.h>
3805 #include <sys/socket.h>
3806                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3807         [ ac_cv_have_sa_family_t="yes" ],
3808         [ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3809 #include <sys/types.h>
3810 #include <sys/socket.h>
3811 #include <netinet/in.h>
3812                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3813                 [ ac_cv_have_sa_family_t="yes" ],
3814                 [ ac_cv_have_sa_family_t="no" ]
3815         )
3816         ])
3817 ])
3818 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
3819         AC_DEFINE([HAVE_SA_FAMILY_T], [1],
3820                 [define if you have sa_family_t data type])
3821 fi
3822
3823 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
3824         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3825         [[ pid_t foo; foo = 1235; ]])],
3826         [ ac_cv_have_pid_t="yes" ], [ ac_cv_have_pid_t="no"
3827         ])
3828 ])
3829 if test "x$ac_cv_have_pid_t" = "xyes" ; then
3830         AC_DEFINE([HAVE_PID_T], [1], [define if you have pid_t data type])
3831 fi
3832
3833 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
3834         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3835         [[ mode_t foo; foo = 1235; ]])],
3836         [ ac_cv_have_mode_t="yes" ], [ ac_cv_have_mode_t="no"
3837         ])
3838 ])
3839 if test "x$ac_cv_have_mode_t" = "xyes" ; then
3840         AC_DEFINE([HAVE_MODE_T], [1], [define if you have mode_t data type])
3841 fi
3842
3843
3844 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
3845         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3846 #include <sys/types.h>
3847 #include <sys/socket.h>
3848                 ]], [[ struct sockaddr_storage s; ]])],
3849         [ ac_cv_have_struct_sockaddr_storage="yes" ],
3850         [ ac_cv_have_struct_sockaddr_storage="no"
3851         ])
3852 ])
3853 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
3854         AC_DEFINE([HAVE_STRUCT_SOCKADDR_STORAGE], [1],
3855                 [define if you have struct sockaddr_storage data type])
3856 fi
3857
3858 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
3859         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3860 #include <sys/types.h>
3861 #include <netinet/in.h>
3862                 ]], [[ struct sockaddr_in6 s; s.sin6_family = 0; ]])],
3863         [ ac_cv_have_struct_sockaddr_in6="yes" ],
3864         [ ac_cv_have_struct_sockaddr_in6="no"
3865         ])
3866 ])
3867 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
3868         AC_DEFINE([HAVE_STRUCT_SOCKADDR_IN6], [1],
3869                 [define if you have struct sockaddr_in6 data type])
3870 fi
3871
3872 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
3873         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3874 #include <sys/types.h>
3875 #include <netinet/in.h>
3876                 ]], [[ struct in6_addr s; s.s6_addr[0] = 0; ]])],
3877         [ ac_cv_have_struct_in6_addr="yes" ],
3878         [ ac_cv_have_struct_in6_addr="no"
3879         ])
3880 ])
3881 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
3882         AC_DEFINE([HAVE_STRUCT_IN6_ADDR], [1],
3883                 [define if you have struct in6_addr data type])
3884
3885 dnl Now check for sin6_scope_id
3886         AC_CHECK_MEMBERS([struct sockaddr_in6.sin6_scope_id], , ,
3887                 [
3888 #ifdef HAVE_SYS_TYPES_H
3889 #include <sys/types.h>
3890 #endif
3891 #include <netinet/in.h>
3892                 ])
3893 fi
3894
3895 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
3896         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3897 #include <sys/types.h>
3898 #include <sys/socket.h>
3899 #include <netdb.h>
3900                 ]], [[ struct addrinfo s; s.ai_flags = AI_PASSIVE; ]])],
3901         [ ac_cv_have_struct_addrinfo="yes" ],
3902         [ ac_cv_have_struct_addrinfo="no"
3903         ])
3904 ])
3905 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
3906         AC_DEFINE([HAVE_STRUCT_ADDRINFO], [1],
3907                 [define if you have struct addrinfo data type])
3908 fi
3909
3910 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
3911         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/time.h> ]],
3912         [[ struct timeval tv; tv.tv_sec = 1;]])],
3913         [ ac_cv_have_struct_timeval="yes" ],
3914         [ ac_cv_have_struct_timeval="no"
3915         ])
3916 ])
3917 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
3918         AC_DEFINE([HAVE_STRUCT_TIMEVAL], [1], [define if you have struct timeval])
3919         have_struct_timeval=1
3920 fi
3921
3922 AC_CHECK_TYPES([struct timespec])
3923
3924 # We need int64_t or else certain parts of the compile will fail.
3925 if test "x$ac_cv_have_int64_t" = "xno" && \
3926         test "x$ac_cv_sizeof_long_int" != "x8" && \
3927         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
3928         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
3929         echo "an alternative compiler (I.E., GCC) before continuing."
3930         echo ""
3931         exit 1;
3932 else
3933 dnl test snprintf (broken on SCO w/gcc)
3934         AC_RUN_IFELSE(
3935                 [AC_LANG_SOURCE([[
3936 #include <stdio.h>
3937 #include <string.h>
3938 #ifdef HAVE_SNPRINTF
3939 main()
3940 {
3941         char buf[50];
3942         char expected_out[50];
3943         int mazsize = 50 ;
3944 #if (SIZEOF_LONG_INT == 8)
3945         long int num = 0x7fffffffffffffff;
3946 #else
3947         long long num = 0x7fffffffffffffffll;
3948 #endif
3949         strcpy(expected_out, "9223372036854775807");
3950         snprintf(buf, mazsize, "%lld", num);
3951         if(strcmp(buf, expected_out) != 0)
3952                 exit(1);
3953         exit(0);
3954 }
3955 #else
3956 main() { exit(0); }
3957 #endif
3958                 ]])], [ true ], [ AC_DEFINE([BROKEN_SNPRINTF]) ],
3959                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3960         )
3961 fi
3962
3963 dnl Checks for structure members
3964 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmp.h], [HAVE_HOST_IN_UTMP])
3965 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmpx.h], [HAVE_HOST_IN_UTMPX])
3966 OSSH_CHECK_HEADER_FOR_FIELD([syslen], [utmpx.h], [HAVE_SYSLEN_IN_UTMPX])
3967 OSSH_CHECK_HEADER_FOR_FIELD([ut_pid], [utmp.h], [HAVE_PID_IN_UTMP])
3968 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmp.h], [HAVE_TYPE_IN_UTMP])
3969 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmpx.h], [HAVE_TYPE_IN_UTMPX])
3970 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmp.h], [HAVE_TV_IN_UTMP])
3971 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmp.h], [HAVE_ID_IN_UTMP])
3972 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmpx.h], [HAVE_ID_IN_UTMPX])
3973 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmp.h], [HAVE_ADDR_IN_UTMP])
3974 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmpx.h], [HAVE_ADDR_IN_UTMPX])
3975 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmp.h], [HAVE_ADDR_V6_IN_UTMP])
3976 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmpx.h], [HAVE_ADDR_V6_IN_UTMPX])
3977 OSSH_CHECK_HEADER_FOR_FIELD([ut_exit], [utmp.h], [HAVE_EXIT_IN_UTMP])
3978 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmp.h], [HAVE_TIME_IN_UTMP])
3979 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmpx.h], [HAVE_TIME_IN_UTMPX])
3980 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmpx.h], [HAVE_TV_IN_UTMPX])
3981
3982 AC_CHECK_MEMBERS([struct stat.st_blksize])
3983 AC_CHECK_MEMBERS([struct stat.st_mtim])
3984 AC_CHECK_MEMBERS([struct stat.st_mtime])
3985 AC_CHECK_MEMBERS([struct passwd.pw_gecos, struct passwd.pw_class,
3986 struct passwd.pw_change, struct passwd.pw_expire],
3987 [], [], [[
3988 #include <sys/types.h>
3989 #include <pwd.h>
3990 ]])
3991
3992 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE([__res_state], [state],
3993         [Define if we don't have struct __res_state in resolv.h])],
3994 [[
3995 #include <stdio.h>
3996 #if HAVE_SYS_TYPES_H
3997 # include <sys/types.h>
3998 #endif
3999 #include <netinet/in.h>
4000 #include <arpa/nameser.h>
4001 #include <resolv.h>
4002 ]])
4003
4004 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
4005                 ac_cv_have_ss_family_in_struct_ss, [
4006         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4007 #include <sys/types.h>
4008 #include <sys/socket.h>
4009                 ]], [[ struct sockaddr_storage s; s.ss_family = 1; ]])],
4010         [ ac_cv_have_ss_family_in_struct_ss="yes" ],
4011         [ ac_cv_have_ss_family_in_struct_ss="no" ])
4012 ])
4013 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
4014         AC_DEFINE([HAVE_SS_FAMILY_IN_SS], [1], [Fields in struct sockaddr_storage])
4015 fi
4016
4017 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
4018                 ac_cv_have___ss_family_in_struct_ss, [
4019         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4020 #include <sys/types.h>
4021 #include <sys/socket.h>
4022                 ]], [[ struct sockaddr_storage s; s.__ss_family = 1; ]])],
4023         [ ac_cv_have___ss_family_in_struct_ss="yes" ],
4024         [ ac_cv_have___ss_family_in_struct_ss="no"
4025         ])
4026 ])
4027 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
4028         AC_DEFINE([HAVE___SS_FAMILY_IN_SS], [1],
4029                 [Fields in struct sockaddr_storage])
4030 fi
4031
4032 dnl make sure we're using the real structure members and not defines
4033 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
4034                 ac_cv_have_accrights_in_msghdr, [
4035         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4036 #include <sys/types.h>
4037 #include <sys/socket.h>
4038 #include <sys/uio.h>
4039                 ]], [[
4040 #ifdef msg_accrights
4041 #error "msg_accrights is a macro"
4042 exit(1);
4043 #endif
4044 struct msghdr m;
4045 m.msg_accrights = 0;
4046 exit(0);
4047                 ]])],
4048                 [ ac_cv_have_accrights_in_msghdr="yes" ],
4049                 [ ac_cv_have_accrights_in_msghdr="no" ]
4050         )
4051 ])
4052 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
4053         AC_DEFINE([HAVE_ACCRIGHTS_IN_MSGHDR], [1],
4054                 [Define if your system uses access rights style
4055                 file descriptor passing])
4056 fi
4057
4058 AC_MSG_CHECKING([if struct statvfs.f_fsid is integral type])
4059 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4060 #include <sys/param.h>
4061 #include <sys/stat.h>
4062 #ifdef HAVE_SYS_TIME_H
4063 # include <sys/time.h>
4064 #endif
4065 #ifdef HAVE_SYS_MOUNT_H
4066 #include <sys/mount.h>
4067 #endif
4068 #ifdef HAVE_SYS_STATVFS_H
4069 #include <sys/statvfs.h>
4070 #endif
4071         ]], [[ struct statvfs s; s.f_fsid = 0; ]])],
4072         [ AC_MSG_RESULT([yes]) ],
4073         [ AC_MSG_RESULT([no])
4074
4075         AC_MSG_CHECKING([if fsid_t has member val])
4076         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4077 #include <sys/types.h>
4078 #include <sys/statvfs.h>
4079         ]], [[ fsid_t t; t.val[0] = 0; ]])],
4080         [ AC_MSG_RESULT([yes])
4081           AC_DEFINE([FSID_HAS_VAL], [1], [fsid_t has member val]) ],
4082         [ AC_MSG_RESULT([no]) ])
4083
4084         AC_MSG_CHECKING([if f_fsid has member __val])
4085         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4086 #include <sys/types.h>
4087 #include <sys/statvfs.h>
4088         ]], [[ fsid_t t; t.__val[0] = 0; ]])],
4089         [ AC_MSG_RESULT([yes])
4090           AC_DEFINE([FSID_HAS___VAL], [1], [fsid_t has member __val]) ],
4091         [ AC_MSG_RESULT([no]) ])
4092 ])
4093
4094 AC_CACHE_CHECK([for msg_control field in struct msghdr],
4095                 ac_cv_have_control_in_msghdr, [
4096         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4097 #include <sys/types.h>
4098 #include <sys/socket.h>
4099 #include <sys/uio.h>
4100                 ]], [[
4101 #ifdef msg_control
4102 #error "msg_control is a macro"
4103 exit(1);
4104 #endif
4105 struct msghdr m;
4106 m.msg_control = 0;
4107 exit(0);
4108                 ]])],
4109                 [ ac_cv_have_control_in_msghdr="yes" ],
4110                 [ ac_cv_have_control_in_msghdr="no" ]
4111         )
4112 ])
4113 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
4114         AC_DEFINE([HAVE_CONTROL_IN_MSGHDR], [1],
4115                 [Define if your system uses ancillary data style
4116                 file descriptor passing])
4117 fi
4118
4119 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
4120         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4121                 [[ extern char *__progname; printf("%s", __progname); ]])],
4122         [ ac_cv_libc_defines___progname="yes" ],
4123         [ ac_cv_libc_defines___progname="no"
4124         ])
4125 ])
4126 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
4127         AC_DEFINE([HAVE___PROGNAME], [1], [Define if libc defines __progname])
4128 fi
4129
4130 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
4131         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4132                 [[ printf("%s", __FUNCTION__); ]])],
4133         [ ac_cv_cc_implements___FUNCTION__="yes" ],
4134         [ ac_cv_cc_implements___FUNCTION__="no"
4135         ])
4136 ])
4137 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
4138         AC_DEFINE([HAVE___FUNCTION__], [1],
4139                 [Define if compiler implements __FUNCTION__])
4140 fi
4141
4142 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
4143         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4144                 [[ printf("%s", __func__); ]])],
4145         [ ac_cv_cc_implements___func__="yes" ],
4146         [ ac_cv_cc_implements___func__="no"
4147         ])
4148 ])
4149 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
4150         AC_DEFINE([HAVE___func__], [1], [Define if compiler implements __func__])
4151 fi
4152
4153 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
4154         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4155 #include <stdarg.h>
4156 va_list x,y;
4157                 ]], [[ va_copy(x,y); ]])],
4158         [ ac_cv_have_va_copy="yes" ],
4159         [ ac_cv_have_va_copy="no"
4160         ])
4161 ])
4162 if test "x$ac_cv_have_va_copy" = "xyes" ; then
4163         AC_DEFINE([HAVE_VA_COPY], [1], [Define if va_copy exists])
4164 fi
4165
4166 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
4167         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4168 #include <stdarg.h>
4169 va_list x,y;
4170                 ]], [[ __va_copy(x,y); ]])],
4171         [ ac_cv_have___va_copy="yes" ], [ ac_cv_have___va_copy="no"
4172         ])
4173 ])
4174 if test "x$ac_cv_have___va_copy" = "xyes" ; then
4175         AC_DEFINE([HAVE___VA_COPY], [1], [Define if __va_copy exists])
4176 fi
4177
4178 AC_CACHE_CHECK([whether getopt has optreset support],
4179                 ac_cv_have_getopt_optreset, [
4180         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <getopt.h> ]],
4181                 [[ extern int optreset; optreset = 0; ]])],
4182         [ ac_cv_have_getopt_optreset="yes" ],
4183         [ ac_cv_have_getopt_optreset="no"
4184         ])
4185 ])
4186 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
4187         AC_DEFINE([HAVE_GETOPT_OPTRESET], [1],
4188                 [Define if your getopt(3) defines and uses optreset])
4189 fi
4190
4191 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
4192         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4193 [[ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);]])],
4194         [ ac_cv_libc_defines_sys_errlist="yes" ],
4195         [ ac_cv_libc_defines_sys_errlist="no"
4196         ])
4197 ])
4198 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
4199         AC_DEFINE([HAVE_SYS_ERRLIST], [1],
4200                 [Define if your system defines sys_errlist[]])
4201 fi
4202
4203
4204 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
4205         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4206 [[ extern int sys_nerr; printf("%i", sys_nerr);]])],
4207         [ ac_cv_libc_defines_sys_nerr="yes" ],
4208         [ ac_cv_libc_defines_sys_nerr="no"
4209         ])
4210 ])
4211 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
4212         AC_DEFINE([HAVE_SYS_NERR], [1], [Define if your system defines sys_nerr])
4213 fi
4214
4215 # Check libraries needed by DNS fingerprint support
4216 AC_SEARCH_LIBS([getrrsetbyname], [resolv],
4217         [AC_DEFINE([HAVE_GETRRSETBYNAME], [1],
4218                 [Define if getrrsetbyname() exists])],
4219         [
4220                 # Needed by our getrrsetbyname()
4221                 AC_SEARCH_LIBS([res_query], [resolv])
4222                 AC_SEARCH_LIBS([dn_expand], [resolv])
4223                 AC_MSG_CHECKING([if res_query will link])
4224                 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4225 #include <sys/types.h>
4226 #include <netinet/in.h>
4227 #include <arpa/nameser.h>
4228 #include <netdb.h>
4229 #include <resolv.h>
4230                                 ]], [[
4231         res_query (0, 0, 0, 0, 0);
4232                                 ]])],
4233                     AC_MSG_RESULT([yes]),
4234                    [AC_MSG_RESULT([no])
4235                     saved_LIBS="$LIBS"
4236                     LIBS="$LIBS -lresolv"
4237                     AC_MSG_CHECKING([for res_query in -lresolv])
4238                     AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4239 #include <sys/types.h>
4240 #include <netinet/in.h>
4241 #include <arpa/nameser.h>
4242 #include <netdb.h>
4243 #include <resolv.h>
4244                                 ]], [[
4245         res_query (0, 0, 0, 0, 0);
4246                                 ]])],
4247                         [AC_MSG_RESULT([yes])],
4248                         [LIBS="$saved_LIBS"
4249                          AC_MSG_RESULT([no])])
4250                     ])
4251                 AC_CHECK_FUNCS([_getshort _getlong])
4252                 AC_CHECK_DECLS([_getshort, _getlong], , ,
4253                     [#include <sys/types.h>
4254                     #include <arpa/nameser.h>])
4255                 AC_CHECK_MEMBER([HEADER.ad],
4256                         [AC_DEFINE([HAVE_HEADER_AD], [1],
4257                             [Define if HEADER.ad exists in arpa/nameser.h])], ,
4258                         [#include <arpa/nameser.h>])
4259         ])
4260
4261 AC_MSG_CHECKING([if struct __res_state _res is an extern])
4262 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4263 #include <stdio.h>
4264 #if HAVE_SYS_TYPES_H
4265 # include <sys/types.h>
4266 #endif
4267 #include <netinet/in.h>
4268 #include <arpa/nameser.h>
4269 #include <resolv.h>
4270 extern struct __res_state _res;
4271                 ]], [[
4272 struct __res_state *volatile p = &_res;  /* force resolution of _res */
4273 return 0;
4274                 ]],)],
4275                 [AC_MSG_RESULT([yes])
4276                  AC_DEFINE([HAVE__RES_EXTERN], [1],
4277                     [Define if you have struct __res_state _res as an extern])
4278                 ],
4279                 [ AC_MSG_RESULT([no]) ]
4280 )
4281
4282 # Check whether user wants SELinux support
4283 SELINUX_MSG="no"
4284 LIBSELINUX=""
4285 AC_ARG_WITH([selinux],
4286         [  --with-selinux          Enable SELinux support],
4287         [ if test "x$withval" != "xno" ; then
4288                 save_LIBS="$LIBS"
4289                 AC_DEFINE([WITH_SELINUX], [1],
4290                         [Define if you want SELinux support.])
4291                 SELINUX_MSG="yes"
4292                 AC_CHECK_HEADER([selinux/selinux.h], ,
4293                         AC_MSG_ERROR([SELinux support requires selinux.h header]))
4294                 AC_CHECK_LIB([selinux], [setexeccon],
4295                         [ LIBSELINUX="-lselinux"
4296                           LIBS="$LIBS -lselinux"
4297                         ],
4298                         AC_MSG_ERROR([SELinux support requires libselinux library]))
4299                 SSHLIBS="$SSHLIBS $LIBSELINUX"
4300                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
4301                 AC_CHECK_FUNCS([getseuserbyname get_default_context_with_level])
4302                 LIBS="$save_LIBS"
4303         fi ]
4304 )
4305 AC_SUBST([SSHLIBS])
4306 AC_SUBST([SSHDLIBS])
4307
4308 # Check whether user wants Kerberos 5 support
4309 KRB5_MSG="no"
4310 AC_ARG_WITH([kerberos5],
4311         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
4312         [ if test "x$withval" != "xno" ; then
4313                 if test "x$withval" = "xyes" ; then
4314                         KRB5ROOT="/usr/local"
4315                 else
4316                         KRB5ROOT=${withval}
4317                 fi
4318
4319                 AC_DEFINE([KRB5], [1], [Define if you want Kerberos 5 support])
4320                 KRB5_MSG="yes"
4321
4322                 AC_PATH_TOOL([KRB5CONF], [krb5-config],
4323                              [$KRB5ROOT/bin/krb5-config],
4324                              [$KRB5ROOT/bin:$PATH])
4325                 if test -x $KRB5CONF ; then
4326                         K5CFLAGS="`$KRB5CONF --cflags`"
4327                         K5LIBS="`$KRB5CONF --libs`"
4328                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
4329
4330                         AC_MSG_CHECKING([for gssapi support])
4331                         if $KRB5CONF | grep gssapi >/dev/null ; then
4332                                 AC_MSG_RESULT([yes])
4333                                 AC_DEFINE([GSSAPI], [1],
4334                                         [Define this if you want GSSAPI
4335                                         support in the version 2 protocol])
4336                                 GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
4337                                 GSSLIBS="`$KRB5CONF --libs gssapi`"
4338                                 CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
4339                         else
4340                                 AC_MSG_RESULT([no])
4341                         fi
4342                         AC_MSG_CHECKING([whether we are using Heimdal])
4343                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4344                                 ]], [[ char *tmp = heimdal_version; ]])],
4345                                 [ AC_MSG_RESULT([yes])
4346                                 AC_DEFINE([HEIMDAL], [1],
4347                                 [Define this if you are using the Heimdal
4348                                 version of Kerberos V5]) ],
4349                                 [AC_MSG_RESULT([no])
4350                         ])
4351                 else
4352                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
4353                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
4354                         AC_MSG_CHECKING([whether we are using Heimdal])
4355                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4356                                 ]], [[ char *tmp = heimdal_version; ]])],
4357                                         [ AC_MSG_RESULT([yes])
4358                                          AC_DEFINE([HEIMDAL])
4359                                          K5LIBS="-lkrb5"
4360                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
4361                                          AC_CHECK_LIB([roken], [net_write],
4362                                            [K5LIBS="$K5LIBS -lroken"])
4363                                          AC_CHECK_LIB([des], [des_cbc_encrypt],
4364                                            [K5LIBS="$K5LIBS -ldes"])
4365                                        ], [ AC_MSG_RESULT([no])
4366                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
4367                         ])
4368                         AC_SEARCH_LIBS([dn_expand], [resolv])
4369
4370                         AC_CHECK_LIB([gssapi_krb5], [gss_init_sec_context],
4371                                 [ AC_DEFINE([GSSAPI])
4372                                   GSSLIBS="-lgssapi_krb5" ],
4373                                 [ AC_CHECK_LIB([gssapi], [gss_init_sec_context],
4374                                         [ AC_DEFINE([GSSAPI])
4375                                           GSSLIBS="-lgssapi" ],
4376                                         [ AC_CHECK_LIB([gss], [gss_init_sec_context],
4377                                                 [ AC_DEFINE([GSSAPI])
4378                                                   GSSLIBS="-lgss" ],
4379                                                 AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]))
4380                                         ])
4381                                 ])
4382
4383                         AC_CHECK_HEADER([gssapi.h], ,
4384                                 [ unset ac_cv_header_gssapi_h
4385                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4386                                   AC_CHECK_HEADERS([gssapi.h], ,
4387                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
4388                                   )
4389                                 ]
4390                         )
4391
4392                         oldCPP="$CPPFLAGS"
4393                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4394                         AC_CHECK_HEADER([gssapi_krb5.h], ,
4395                                         [ CPPFLAGS="$oldCPP" ])
4396
4397                 fi
4398                 if test ! -z "$need_dash_r" ; then
4399                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
4400                 fi
4401                 if test ! -z "$blibpath" ; then
4402                         blibpath="$blibpath:${KRB5ROOT}/lib"
4403                 fi
4404
4405                 AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
4406                 AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
4407                 AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
4408
4409                 AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
4410                         [Define this if you want to use libkafs' AFS support])])
4411
4412                 AC_CHECK_DECLS([GSS_C_NT_HOSTBASED_SERVICE], [], [], [[
4413 #ifdef HAVE_GSSAPI_H
4414 # include <gssapi.h>
4415 #elif defined(HAVE_GSSAPI_GSSAPI_H)
4416 # include <gssapi/gssapi.h>
4417 #endif
4418
4419 #ifdef HAVE_GSSAPI_GENERIC_H
4420 # include <gssapi_generic.h>
4421 #elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
4422 # include <gssapi/gssapi_generic.h>
4423 #endif
4424                 ]])
4425                 saved_LIBS="$LIBS"
4426                 LIBS="$LIBS $K5LIBS"
4427                 AC_CHECK_FUNCS([krb5_cc_new_unique krb5_get_error_message krb5_free_error_message])
4428                 LIBS="$saved_LIBS"
4429
4430         fi
4431         ]
4432 )
4433 AC_SUBST([GSSLIBS])
4434 AC_SUBST([K5LIBS])
4435
4436 # Looking for programs, paths and files
4437
4438 PRIVSEP_PATH=/var/empty
4439 AC_ARG_WITH([privsep-path],
4440         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
4441         [
4442                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4443                     test "x${withval}" != "xyes"; then
4444                         PRIVSEP_PATH=$withval
4445                 fi
4446         ]
4447 )
4448 AC_SUBST([PRIVSEP_PATH])
4449
4450 AC_ARG_WITH([xauth],
4451         [  --with-xauth=PATH       Specify path to xauth program ],
4452         [
4453                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4454                     test "x${withval}" != "xyes"; then
4455                         xauth_path=$withval
4456                 fi
4457         ],
4458         [
4459                 TestPath="$PATH"
4460                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
4461                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
4462                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
4463                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
4464                 AC_PATH_PROG([xauth_path], [xauth], , [$TestPath])
4465                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
4466                         xauth_path="/usr/openwin/bin/xauth"
4467                 fi
4468         ]
4469 )
4470
4471 STRIP_OPT=-s
4472 AC_ARG_ENABLE([strip],
4473         [  --disable-strip         Disable calling strip(1) on install],
4474         [
4475                 if test "x$enableval" = "xno" ; then
4476                         STRIP_OPT=
4477                 fi
4478         ]
4479 )
4480 AC_SUBST([STRIP_OPT])
4481
4482 if test -z "$xauth_path" ; then
4483         XAUTH_PATH="undefined"
4484         AC_SUBST([XAUTH_PATH])
4485 else
4486         AC_DEFINE_UNQUOTED([XAUTH_PATH], ["$xauth_path"],
4487                 [Define if xauth is found in your path])
4488         XAUTH_PATH=$xauth_path
4489         AC_SUBST([XAUTH_PATH])
4490 fi
4491
4492 dnl # --with-maildir=/path/to/mail gets top priority.
4493 dnl # if maildir is set in the platform case statement above we use that.
4494 dnl # Otherwise we run a program to get the dir from system headers.
4495 dnl # We first look for _PATH_MAILDIR then MAILDIR then _PATH_MAIL
4496 dnl # If we find _PATH_MAILDIR we do nothing because that is what
4497 dnl # session.c expects anyway. Otherwise we set to the value found
4498 dnl # stripping any trailing slash. If for some strage reason our program
4499 dnl # does not find what it needs, we default to /var/spool/mail.
4500 # Check for mail directory
4501 AC_ARG_WITH([maildir],
4502     [  --with-maildir=/path/to/mail    Specify your system mail directory],
4503     [
4504         if test "X$withval" != X  &&  test "x$withval" != xno  &&  \
4505             test "x${withval}" != xyes; then
4506                 AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$withval"],
4507             [Set this to your mail directory if you do not have _PATH_MAILDIR])
4508             fi
4509      ],[
4510         if test "X$maildir" != "X"; then
4511             AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4512         else
4513             AC_MSG_CHECKING([Discovering system mail directory])
4514             AC_RUN_IFELSE(
4515                 [AC_LANG_PROGRAM([[
4516 #include <stdio.h>
4517 #include <string.h>
4518 #ifdef HAVE_PATHS_H
4519 #include <paths.h>
4520 #endif
4521 #ifdef HAVE_MAILLOCK_H
4522 #include <maillock.h>
4523 #endif
4524 #define DATA "conftest.maildir"
4525         ]], [[
4526         FILE *fd;
4527         int rc;
4528
4529         fd = fopen(DATA,"w");
4530         if(fd == NULL)
4531                 exit(1);
4532
4533 #if defined (_PATH_MAILDIR)
4534         if ((rc = fprintf(fd ,"_PATH_MAILDIR:%s\n", _PATH_MAILDIR)) <0)
4535                 exit(1);
4536 #elif defined (MAILDIR)
4537         if ((rc = fprintf(fd ,"MAILDIR:%s\n", MAILDIR)) <0)
4538                 exit(1);
4539 #elif defined (_PATH_MAIL)
4540         if ((rc = fprintf(fd ,"_PATH_MAIL:%s\n", _PATH_MAIL)) <0)
4541                 exit(1);
4542 #else
4543         exit (2);
4544 #endif
4545
4546         exit(0);
4547                 ]])],
4548                 [
4549                     maildir_what=`awk -F: '{print $1}' conftest.maildir`
4550                     maildir=`awk -F: '{print $2}' conftest.maildir \
4551                         | sed 's|/$||'`
4552                     AC_MSG_RESULT([Using: $maildir from $maildir_what])
4553                     if test "x$maildir_what" != "x_PATH_MAILDIR"; then
4554                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4555                     fi
4556                 ],
4557                 [
4558                     if test "X$ac_status" = "X2";then
4559 # our test program didn't find it. Default to /var/spool/mail
4560                         AC_MSG_RESULT([Using: default value of /var/spool/mail])
4561                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["/var/spool/mail"])
4562                      else
4563                         AC_MSG_RESULT([*** not found ***])
4564                      fi
4565                 ],
4566                 [
4567                         AC_MSG_WARN([cross compiling: use --with-maildir=/path/to/mail])
4568                 ]
4569             )
4570         fi
4571     ]
4572 ) # maildir
4573
4574 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
4575         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
4576         disable_ptmx_check=yes
4577 fi
4578 if test -z "$no_dev_ptmx" ; then
4579         if test "x$disable_ptmx_check" != "xyes" ; then
4580                 AC_CHECK_FILE(["/dev/ptmx"],
4581                         [
4582                                 AC_DEFINE_UNQUOTED([HAVE_DEV_PTMX], [1],
4583                                         [Define if you have /dev/ptmx])
4584                                 have_dev_ptmx=1
4585                         ]
4586                 )
4587         fi
4588 fi
4589
4590 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
4591         AC_CHECK_FILE(["/dev/ptc"],
4592                 [
4593                         AC_DEFINE_UNQUOTED([HAVE_DEV_PTS_AND_PTC], [1],
4594                                 [Define if you have /dev/ptc])
4595                         have_dev_ptc=1
4596                 ]
4597         )
4598 else
4599         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
4600 fi
4601
4602 # Options from here on. Some of these are preset by platform above
4603 AC_ARG_WITH([mantype],
4604         [  --with-mantype=man|cat|doc  Set man page type],
4605         [
4606                 case "$withval" in
4607                 man|cat|doc)
4608                         MANTYPE=$withval
4609                         ;;
4610                 *)
4611                         AC_MSG_ERROR([invalid man type: $withval])
4612                         ;;
4613                 esac
4614         ]
4615 )
4616 if test -z "$MANTYPE"; then
4617         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
4618         AC_PATH_PROGS([NROFF], [nroff awf], [/bin/false], [$TestPath])
4619         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
4620                 MANTYPE=doc
4621         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
4622                 MANTYPE=man
4623         else
4624                 MANTYPE=cat
4625         fi
4626 fi
4627 AC_SUBST([MANTYPE])
4628 if test "$MANTYPE" = "doc"; then
4629         mansubdir=man;
4630 else
4631         mansubdir=$MANTYPE;
4632 fi
4633 AC_SUBST([mansubdir])
4634
4635 # Check whether to enable MD5 passwords
4636 MD5_MSG="no"
4637 AC_ARG_WITH([md5-passwords],
4638         [  --with-md5-passwords    Enable use of MD5 passwords],
4639         [
4640                 if test "x$withval" != "xno" ; then
4641                         AC_DEFINE([HAVE_MD5_PASSWORDS], [1],
4642                                 [Define if you want to allow MD5 passwords])
4643                         MD5_MSG="yes"
4644                 fi
4645         ]
4646 )
4647
4648 # Whether to disable shadow password support
4649 AC_ARG_WITH([shadow],
4650         [  --without-shadow        Disable shadow password support],
4651         [
4652                 if test "x$withval" = "xno" ; then
4653                         AC_DEFINE([DISABLE_SHADOW])
4654                         disable_shadow=yes
4655                 fi
4656         ]
4657 )
4658
4659 if test -z "$disable_shadow" ; then
4660         AC_MSG_CHECKING([if the systems has expire shadow information])
4661         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4662 #include <sys/types.h>
4663 #include <shadow.h>
4664 struct spwd sp;
4665                 ]], [[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ]])],
4666                 [ sp_expire_available=yes ], [
4667         ])
4668
4669         if test "x$sp_expire_available" = "xyes" ; then
4670                 AC_MSG_RESULT([yes])
4671                 AC_DEFINE([HAS_SHADOW_EXPIRE], [1],
4672                     [Define if you want to use shadow password expire field])
4673         else
4674                 AC_MSG_RESULT([no])
4675         fi
4676 fi
4677
4678 # Use ip address instead of hostname in $DISPLAY
4679 if test ! -z "$IPADDR_IN_DISPLAY" ; then
4680         DISPLAY_HACK_MSG="yes"
4681         AC_DEFINE([IPADDR_IN_DISPLAY], [1],
4682                 [Define if you need to use IP address
4683                 instead of hostname in $DISPLAY])
4684 else
4685         DISPLAY_HACK_MSG="no"
4686         AC_ARG_WITH([ipaddr-display],
4687                 [  --with-ipaddr-display   Use ip address instead of hostname in $DISPLAY],
4688                 [
4689                         if test "x$withval" != "xno" ; then
4690                                 AC_DEFINE([IPADDR_IN_DISPLAY])
4691                                 DISPLAY_HACK_MSG="yes"
4692                         fi
4693                 ]
4694         )
4695 fi
4696
4697 # check for /etc/default/login and use it if present.
4698 AC_ARG_ENABLE([etc-default-login],
4699         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
4700         [ if test "x$enableval" = "xno"; then
4701                 AC_MSG_NOTICE([/etc/default/login handling disabled])
4702                 etc_default_login=no
4703           else
4704                 etc_default_login=yes
4705           fi ],
4706         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
4707           then
4708                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
4709                 etc_default_login=no
4710           else
4711                 etc_default_login=yes
4712           fi ]
4713 )
4714
4715 if test "x$etc_default_login" != "xno"; then
4716         AC_CHECK_FILE(["/etc/default/login"],
4717             [ external_path_file=/etc/default/login ])
4718         if test "x$external_path_file" = "x/etc/default/login"; then
4719                 AC_DEFINE([HAVE_ETC_DEFAULT_LOGIN], [1],
4720                         [Define if your system has /etc/default/login])
4721         fi
4722 fi
4723
4724 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
4725 if test $ac_cv_func_login_getcapbool = "yes" && \
4726         test $ac_cv_header_login_cap_h = "yes" ; then
4727         external_path_file=/etc/login.conf
4728 fi
4729
4730 # Whether to mess with the default path
4731 SERVER_PATH_MSG="(default)"
4732 AC_ARG_WITH([default-path],
4733         [  --with-default-path=    Specify default $PATH environment for server],
4734         [
4735                 if test "x$external_path_file" = "x/etc/login.conf" ; then
4736                         AC_MSG_WARN([
4737 --with-default-path=PATH has no effect on this system.
4738 Edit /etc/login.conf instead.])
4739                 elif test "x$withval" != "xno" ; then
4740                         if test ! -z "$external_path_file" ; then
4741                                 AC_MSG_WARN([
4742 --with-default-path=PATH will only be used if PATH is not defined in
4743 $external_path_file .])
4744                         fi
4745                         user_path="$withval"
4746                         SERVER_PATH_MSG="$withval"
4747                 fi
4748         ],
4749         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
4750                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
4751         else
4752                 if test ! -z "$external_path_file" ; then
4753                         AC_MSG_WARN([
4754 If PATH is defined in $external_path_file, ensure the path to scp is included,
4755 otherwise scp will not work.])
4756                 fi
4757                 AC_RUN_IFELSE(
4758                         [AC_LANG_PROGRAM([[
4759 /* find out what STDPATH is */
4760 #include <stdio.h>
4761 #ifdef HAVE_PATHS_H
4762 # include <paths.h>
4763 #endif
4764 #ifndef _PATH_STDPATH
4765 # ifdef _PATH_USERPATH  /* Irix */
4766 #  define _PATH_STDPATH _PATH_USERPATH
4767 # else
4768 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
4769 # endif
4770 #endif
4771 #include <sys/types.h>
4772 #include <sys/stat.h>
4773 #include <fcntl.h>
4774 #define DATA "conftest.stdpath"
4775                         ]], [[
4776         FILE *fd;
4777         int rc;
4778
4779         fd = fopen(DATA,"w");
4780         if(fd == NULL)
4781                 exit(1);
4782
4783         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
4784                 exit(1);
4785
4786         exit(0);
4787                 ]])],
4788                 [ user_path=`cat conftest.stdpath` ],
4789                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
4790                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
4791         )
4792 # make sure $bindir is in USER_PATH so scp will work
4793                 t_bindir="${bindir}"
4794                 while echo "${t_bindir}" | egrep '\$\{|NONE/' >/dev/null 2>&1; do
4795                         t_bindir=`eval echo ${t_bindir}`
4796                         case $t_bindir in
4797                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
4798                         esac
4799                         case $t_bindir in
4800                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
4801                         esac
4802                 done
4803                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
4804                 if test $? -ne 0  ; then
4805                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
4806                         if test $? -ne 0  ; then
4807                                 user_path=$user_path:$t_bindir
4808                                 AC_MSG_RESULT([Adding $t_bindir to USER_PATH so scp will work])
4809                         fi
4810                 fi
4811         fi ]
4812 )
4813 if test "x$external_path_file" != "x/etc/login.conf" ; then
4814         AC_DEFINE_UNQUOTED([USER_PATH], ["$user_path"], [Specify default $PATH])
4815         AC_SUBST([user_path])
4816 fi
4817
4818 # Set superuser path separately to user path
4819 AC_ARG_WITH([superuser-path],
4820         [  --with-superuser-path=  Specify different path for super-user],
4821         [
4822                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4823                     test "x${withval}" != "xyes"; then
4824                         AC_DEFINE_UNQUOTED([SUPERUSER_PATH], ["$withval"],
4825                                 [Define if you want a different $PATH
4826                                 for the superuser])
4827                         superuser_path=$withval
4828                 fi
4829         ]
4830 )
4831
4832
4833 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
4834 IPV4_IN6_HACK_MSG="no"
4835 AC_ARG_WITH(4in6,
4836         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
4837         [
4838                 if test "x$withval" != "xno" ; then
4839                         AC_MSG_RESULT([yes])
4840                         AC_DEFINE([IPV4_IN_IPV6], [1],
4841                                 [Detect IPv4 in IPv6 mapped addresses
4842                                 and treat as IPv4])
4843                         IPV4_IN6_HACK_MSG="yes"
4844                 else
4845                         AC_MSG_RESULT([no])
4846                 fi
4847         ], [
4848                 if test "x$inet6_default_4in6" = "xyes"; then
4849                         AC_MSG_RESULT([yes (default)])
4850                         AC_DEFINE([IPV4_IN_IPV6])
4851                         IPV4_IN6_HACK_MSG="yes"
4852                 else
4853                         AC_MSG_RESULT([no (default)])
4854                 fi
4855         ]
4856 )
4857
4858 # Whether to enable BSD auth support
4859 BSD_AUTH_MSG=no
4860 AC_ARG_WITH([bsd-auth],
4861         [  --with-bsd-auth         Enable BSD auth support],
4862         [
4863                 if test "x$withval" != "xno" ; then
4864                         AC_DEFINE([BSD_AUTH], [1],
4865                                 [Define if you have BSD auth support])
4866                         BSD_AUTH_MSG=yes
4867                 fi
4868         ]
4869 )
4870
4871 # Where to place sshd.pid
4872 piddir=/var/run
4873 # make sure the directory exists
4874 if test ! -d $piddir ; then
4875         piddir=`eval echo ${sysconfdir}`
4876         case $piddir in
4877                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
4878         esac
4879 fi
4880
4881 AC_ARG_WITH([pid-dir],
4882         [  --with-pid-dir=PATH     Specify location of sshd.pid file],
4883         [
4884                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4885                     test "x${withval}" != "xyes"; then
4886                         piddir=$withval
4887                         if test ! -d $piddir ; then
4888                         AC_MSG_WARN([** no $piddir directory on this system **])
4889                         fi
4890                 fi
4891         ]
4892 )
4893
4894 AC_DEFINE_UNQUOTED([_PATH_SSH_PIDDIR], ["$piddir"],
4895         [Specify location of ssh.pid])
4896 AC_SUBST([piddir])
4897
4898 dnl allow user to disable some login recording features
4899 AC_ARG_ENABLE([lastlog],
4900         [  --disable-lastlog       disable use of lastlog even if detected [no]],
4901         [
4902                 if test "x$enableval" = "xno" ; then
4903                         AC_DEFINE([DISABLE_LASTLOG])
4904                 fi
4905         ]
4906 )
4907 AC_ARG_ENABLE([utmp],
4908         [  --disable-utmp          disable use of utmp even if detected [no]],
4909         [
4910                 if test "x$enableval" = "xno" ; then
4911                         AC_DEFINE([DISABLE_UTMP])
4912                 fi
4913         ]
4914 )
4915 AC_ARG_ENABLE([utmpx],
4916         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4917         [
4918                 if test "x$enableval" = "xno" ; then
4919                         AC_DEFINE([DISABLE_UTMPX], [1],
4920                                 [Define if you don't want to use utmpx])
4921                 fi
4922         ]
4923 )
4924 AC_ARG_ENABLE([wtmp],
4925         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4926         [
4927                 if test "x$enableval" = "xno" ; then
4928                         AC_DEFINE([DISABLE_WTMP])
4929                 fi
4930         ]
4931 )
4932 AC_ARG_ENABLE([wtmpx],
4933         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4934         [
4935                 if test "x$enableval" = "xno" ; then
4936                         AC_DEFINE([DISABLE_WTMPX], [1],
4937                                 [Define if you don't want to use wtmpx])
4938                 fi
4939         ]
4940 )
4941 AC_ARG_ENABLE([libutil],
4942         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4943         [
4944                 if test "x$enableval" = "xno" ; then
4945                         AC_DEFINE([DISABLE_LOGIN])
4946                 fi
4947         ]
4948 )
4949 AC_ARG_ENABLE([pututline],
4950         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4951         [
4952                 if test "x$enableval" = "xno" ; then
4953                         AC_DEFINE([DISABLE_PUTUTLINE], [1],
4954                                 [Define if you don't want to use pututline()
4955                                 etc. to write [uw]tmp])
4956                 fi
4957         ]
4958 )
4959 AC_ARG_ENABLE([pututxline],
4960         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4961         [
4962                 if test "x$enableval" = "xno" ; then
4963                         AC_DEFINE([DISABLE_PUTUTXLINE], [1],
4964                                 [Define if you don't want to use pututxline()
4965                                 etc. to write [uw]tmpx])
4966                 fi
4967         ]
4968 )
4969 AC_ARG_WITH([lastlog],
4970   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4971         [
4972                 if test "x$withval" = "xno" ; then
4973                         AC_DEFINE([DISABLE_LASTLOG])
4974                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4975                         conf_lastlog_location=$withval
4976                 fi
4977         ]
4978 )
4979
4980 dnl lastlog, [uw]tmpx? detection
4981 dnl  NOTE: set the paths in the platform section to avoid the
4982 dnl   need for command-line parameters
4983 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4984
4985 dnl lastlog detection
4986 dnl  NOTE: the code itself will detect if lastlog is a directory
4987 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4988 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4989 #include <sys/types.h>
4990 #include <utmp.h>
4991 #ifdef HAVE_LASTLOG_H
4992 #  include <lastlog.h>
4993 #endif
4994 #ifdef HAVE_PATHS_H
4995 #  include <paths.h>
4996 #endif
4997 #ifdef HAVE_LOGIN_H
4998 # include <login.h>
4999 #endif
5000         ]], [[ char *lastlog = LASTLOG_FILE; ]])],
5001                 [ AC_MSG_RESULT([yes]) ],
5002                 [
5003                 AC_MSG_RESULT([no])
5004                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
5005                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5006 #include <sys/types.h>
5007 #include <utmp.h>
5008 #ifdef HAVE_LASTLOG_H
5009 #  include <lastlog.h>
5010 #endif
5011 #ifdef HAVE_PATHS_H
5012 #  include <paths.h>
5013 #endif
5014                 ]], [[ char *lastlog = _PATH_LASTLOG; ]])],
5015                 [ AC_MSG_RESULT([yes]) ],
5016                 [
5017                         AC_MSG_RESULT([no])
5018                         system_lastlog_path=no
5019                 ])
5020 ])
5021
5022 if test -z "$conf_lastlog_location"; then
5023         if test x"$system_lastlog_path" = x"no" ; then
5024                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
5025                                 if (test -d "$f" || test -f "$f") ; then
5026                                         conf_lastlog_location=$f
5027                                 fi
5028                 done
5029                 if test -z "$conf_lastlog_location"; then
5030                         AC_MSG_WARN([** Cannot find lastlog **])
5031                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
5032                 fi
5033         fi
5034 fi
5035
5036 if test -n "$conf_lastlog_location"; then
5037         AC_DEFINE_UNQUOTED([CONF_LASTLOG_FILE], ["$conf_lastlog_location"],
5038                 [Define if you want to specify the path to your lastlog file])
5039 fi
5040
5041 dnl utmp detection
5042 AC_MSG_CHECKING([if your system defines UTMP_FILE])
5043 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5044 #include <sys/types.h>
5045 #include <utmp.h>
5046 #ifdef HAVE_PATHS_H
5047 #  include <paths.h>
5048 #endif
5049         ]], [[ char *utmp = UTMP_FILE; ]])],
5050         [ AC_MSG_RESULT([yes]) ],
5051         [ AC_MSG_RESULT([no])
5052           system_utmp_path=no
5053 ])
5054 if test -z "$conf_utmp_location"; then
5055         if test x"$system_utmp_path" = x"no" ; then
5056                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
5057                         if test -f $f ; then
5058                                 conf_utmp_location=$f
5059                         fi
5060                 done
5061                 if test -z "$conf_utmp_location"; then
5062                         AC_DEFINE([DISABLE_UTMP])
5063                 fi
5064         fi
5065 fi
5066 if test -n "$conf_utmp_location"; then
5067         AC_DEFINE_UNQUOTED([CONF_UTMP_FILE], ["$conf_utmp_location"],
5068                 [Define if you want to specify the path to your utmp file])
5069 fi
5070
5071 dnl wtmp detection
5072 AC_MSG_CHECKING([if your system defines WTMP_FILE])
5073 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5074 #include <sys/types.h>
5075 #include <utmp.h>
5076 #ifdef HAVE_PATHS_H
5077 #  include <paths.h>
5078 #endif
5079         ]], [[ char *wtmp = WTMP_FILE; ]])],
5080         [ AC_MSG_RESULT([yes]) ],
5081         [ AC_MSG_RESULT([no])
5082           system_wtmp_path=no
5083 ])
5084 if test -z "$conf_wtmp_location"; then
5085         if test x"$system_wtmp_path" = x"no" ; then
5086                 for f in /usr/adm/wtmp /var/log/wtmp; do
5087                         if test -f $f ; then
5088                                 conf_wtmp_location=$f
5089                         fi
5090                 done
5091                 if test -z "$conf_wtmp_location"; then
5092                         AC_DEFINE([DISABLE_WTMP])
5093                 fi
5094         fi
5095 fi
5096 if test -n "$conf_wtmp_location"; then
5097         AC_DEFINE_UNQUOTED([CONF_WTMP_FILE], ["$conf_wtmp_location"],
5098                 [Define if you want to specify the path to your wtmp file])
5099 fi
5100
5101 dnl wtmpx detection
5102 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
5103 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5104 #include <sys/types.h>
5105 #include <utmp.h>
5106 #ifdef HAVE_UTMPX_H
5107 #include <utmpx.h>
5108 #endif
5109 #ifdef HAVE_PATHS_H
5110 #  include <paths.h>
5111 #endif
5112         ]], [[ char *wtmpx = WTMPX_FILE; ]])],
5113         [ AC_MSG_RESULT([yes]) ],
5114         [ AC_MSG_RESULT([no])
5115           system_wtmpx_path=no
5116 ])
5117 if test -z "$conf_wtmpx_location"; then
5118         if test x"$system_wtmpx_path" = x"no" ; then
5119                 AC_DEFINE([DISABLE_WTMPX])
5120         fi
5121 else
5122         AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"],
5123                 [Define if you want to specify the path to your wtmpx file])
5124 fi
5125
5126
5127 if test ! -z "$blibpath" ; then
5128         LDFLAGS="$LDFLAGS $blibflags$blibpath"
5129         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
5130 fi
5131
5132 AC_CHECK_MEMBER([struct lastlog.ll_line], [], [
5133     if test x$SKIP_DISABLE_LASTLOG_DEFINE != "xyes" ; then
5134         AC_DEFINE([DISABLE_LASTLOG])
5135     fi
5136         ], [
5137 #ifdef HAVE_SYS_TYPES_H
5138 #include <sys/types.h>
5139 #endif
5140 #ifdef HAVE_UTMP_H
5141 #include <utmp.h>
5142 #endif
5143 #ifdef HAVE_UTMPX_H
5144 #include <utmpx.h>
5145 #endif
5146 #ifdef HAVE_LASTLOG_H
5147 #include <lastlog.h>
5148 #endif
5149         ])
5150
5151 AC_CHECK_MEMBER([struct utmp.ut_line], [], [
5152         AC_DEFINE([DISABLE_UTMP])
5153         AC_DEFINE([DISABLE_WTMP])
5154         ], [
5155 #ifdef HAVE_SYS_TYPES_H
5156 #include <sys/types.h>
5157 #endif
5158 #ifdef HAVE_UTMP_H
5159 #include <utmp.h>
5160 #endif
5161 #ifdef HAVE_UTMPX_H
5162 #include <utmpx.h>
5163 #endif
5164 #ifdef HAVE_LASTLOG_H
5165 #include <lastlog.h>
5166 #endif
5167         ])
5168
5169 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
5170 dnl Add now.
5171 CFLAGS="$CFLAGS $werror_flags"
5172
5173 if test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
5174         TEST_SSH_IPV6=no
5175 else
5176         TEST_SSH_IPV6=yes
5177 fi
5178 AC_CHECK_DECL([BROKEN_GETADDRINFO],  [TEST_SSH_IPV6=no])
5179 AC_SUBST([TEST_SSH_IPV6], [$TEST_SSH_IPV6])
5180 AC_SUBST([TEST_SSH_UTF8], [$TEST_SSH_UTF8])
5181 AC_SUBST([TEST_MALLOC_OPTIONS], [$TEST_MALLOC_OPTIONS])
5182 AC_SUBST([UNSUPPORTED_ALGORITHMS], [$unsupported_algorithms])
5183 AC_SUBST([DEPEND], [$(cat $srcdir/.depend)])
5184
5185 CFLAGS="${CFLAGS} ${CFLAGS_AFTER}"
5186 LDFLAGS="${LDFLAGS} ${LDFLAGS_AFTER}"
5187
5188 AC_EXEEXT
5189 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
5190         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
5191         survey.sh])
5192 AC_OUTPUT
5193
5194 # Print summary of options
5195
5196 # Someone please show me a better way :)
5197 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
5198 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
5199 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
5200 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
5201 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
5202 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
5203 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
5204 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
5205 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
5206 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
5207
5208 echo ""
5209 echo "OpenSSH has been configured with the following options:"
5210 echo "                     User binaries: $B"
5211 echo "                   System binaries: $C"
5212 echo "               Configuration files: $D"
5213 echo "                   Askpass program: $E"
5214 echo "                      Manual pages: $F"
5215 echo "                          PID file: $G"
5216 echo "  Privilege separation chroot path: $H"
5217 if test "x$external_path_file" = "x/etc/login.conf" ; then
5218 echo "   At runtime, sshd will use the path defined in $external_path_file"
5219 echo "   Make sure the path to scp is present, otherwise scp will not work"
5220 else
5221 echo "            sshd default user PATH: $I"
5222         if test ! -z "$external_path_file"; then
5223 echo "   (If PATH is set in $external_path_file it will be used instead. If"
5224 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
5225         fi
5226 fi
5227 if test ! -z "$superuser_path" ; then
5228 echo "          sshd superuser user PATH: $J"
5229 fi
5230 echo "                    Manpage format: $MANTYPE"
5231 echo "                       PAM support: $PAM_MSG"
5232 echo "                   OSF SIA support: $SIA_MSG"
5233 echo "                 KerberosV support: $KRB5_MSG"
5234 echo "                   SELinux support: $SELINUX_MSG"
5235 echo "              TCP Wrappers support: $TCPW_MSG"
5236 echo "              MD5 password support: $MD5_MSG"
5237 echo "                   libedit support: $LIBEDIT_MSG"
5238 echo "                   libldns support: $LDNS_MSG"
5239 echo "  Solaris process contract support: $SPC_MSG"
5240 echo "           Solaris project support: $SP_MSG"
5241 echo "         Solaris privilege support: $SPP_MSG"
5242 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
5243 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
5244 echo "                  BSD Auth support: $BSD_AUTH_MSG"
5245 echo "              Random number source: $RAND_MSG"
5246 echo "             Privsep sandbox style: $SANDBOX_STYLE"
5247
5248 echo ""
5249
5250 echo "              Host: ${host}"
5251 echo "          Compiler: ${CC}"
5252 echo "    Compiler flags: ${CFLAGS}"
5253 echo "Preprocessor flags: ${CPPFLAGS}"
5254 echo "      Linker flags: ${LDFLAGS}"
5255 echo "         Libraries: ${LIBS}"
5256 if test ! -z "${SSHDLIBS}"; then
5257 echo "         +for sshd: ${SSHDLIBS}"
5258 fi
5259 if test ! -z "${SSHLIBS}"; then
5260 echo "          +for ssh: ${SSHLIBS}"
5261 fi
5262
5263 echo ""
5264
5265 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
5266         echo "SVR4 style packages are supported with \"make package\""
5267         echo ""
5268 fi
5269
5270 if test "x$PAM_MSG" = "xyes" ; then
5271         echo "PAM is enabled. You may need to install a PAM control file "
5272         echo "for sshd, otherwise password authentication may fail. "
5273         echo "Example PAM control files can be found in the contrib/ "
5274         echo "subdirectory"
5275         echo ""
5276 fi
5277
5278 if test ! -z "$NO_PEERCHECK" ; then
5279         echo "WARNING: the operating system that you are using does not"
5280         echo "appear to support getpeereid(), getpeerucred() or the"
5281         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
5282         echo "enforce security checks to prevent unauthorised connections to"
5283         echo "ssh-agent. Their absence increases the risk that a malicious"
5284         echo "user can connect to your agent."
5285         echo ""
5286 fi
5287
5288 if test "$AUDIT_MODULE" = "bsm" ; then
5289         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
5290         echo "See the Solaris section in README.platform for details."
5291 fi