crypto/openssh/configure.ac

   1 # $Id: configure.ac,v 1.583 2014/08/26 20:32:01 djm Exp $
   2 # $FreeBSD$
   3 #
   4 # Copyright (c) 1999-2004 Damien Miller
   5 #
   6 # Permission to use, copy, modify, and distribute this software for any
   7 # purpose with or without fee is hereby granted, provided that the above
   8 # copyright notice and this permission notice appear in all copies.
   9 #
  10 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18 AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
  19 AC_REVISION($Revision: 1.583 $)
  20 AC_CONFIG_SRCDIR([ssh.c])
  21 AC_LANG([C])
  22
  23 AC_CONFIG_HEADER([config.h])
  24 AC_PROG_CC
  25 AC_CANONICAL_HOST
  26 AC_C_BIGENDIAN
  27
  28 # Checks for programs.
  29 AC_PROG_AWK
  30 AC_PROG_CPP
  31 AC_PROG_RANLIB
  32 AC_PROG_INSTALL
  33 AC_PROG_EGREP
  34 AC_CHECK_TOOLS([AR], [ar])
  35 AC_PATH_PROG([CAT], [cat])
  36 AC_PATH_PROG([KILL], [kill])
  37 AC_PATH_PROGS([PERL], [perl5 perl])
  38 AC_PATH_PROG([SED], [sed])
  39 AC_SUBST([PERL])
  40 AC_PATH_PROG([ENT], [ent])
  41 AC_SUBST([ENT])
  42 AC_PATH_PROG([TEST_MINUS_S_SH], [bash])
  43 AC_PATH_PROG([TEST_MINUS_S_SH], [ksh])
  44 AC_PATH_PROG([TEST_MINUS_S_SH], [sh])
  45 AC_PATH_PROG([SH], [sh])
  46 AC_PATH_PROG([GROFF], [groff])
  47 AC_PATH_PROG([NROFF], [nroff])
  48 AC_PATH_PROG([MANDOC], [mandoc])
  49 AC_SUBST([TEST_SHELL], [sh])
  50
  51 dnl select manpage formatter
  52 if test "x$MANDOC" != "x" ; then
  53         MANFMT="$MANDOC"
  54 elif test "x$NROFF" != "x" ; then
  55         MANFMT="$NROFF -mandoc"
  56 elif test "x$GROFF" != "x" ; then
  57         MANFMT="$GROFF -mandoc -Tascii"
  58 else
  59         AC_MSG_WARN([no manpage formatted found])
  60         MANFMT="false"
  61 fi
  62 AC_SUBST([MANFMT])
  63
  64 dnl for buildpkg.sh
  65 AC_PATH_PROG([PATH_GROUPADD_PROG], [groupadd], [groupadd],
  66         [/usr/sbin${PATH_SEPARATOR}/etc])
  67 AC_PATH_PROG([PATH_USERADD_PROG], [useradd], [useradd],
  68         [/usr/sbin${PATH_SEPARATOR}/etc])
  69 AC_CHECK_PROG([MAKE_PACKAGE_SUPPORTED], [pkgmk], [yes], [no])
  70 if test -x /sbin/sh; then
  71         AC_SUBST([STARTUP_SCRIPT_SHELL], [/sbin/sh])
  72 else
  73         AC_SUBST([STARTUP_SCRIPT_SHELL], [/bin/sh])
  74 fi
  75
  76 # System features
  77 AC_SYS_LARGEFILE
  78
  79 if test -z "$AR" ; then
  80         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  81 fi
  82
  83 AC_PATH_PROG([PATH_PASSWD_PROG], [passwd])
  84 if test ! -z "$PATH_PASSWD_PROG" ; then
  85         AC_DEFINE_UNQUOTED([_PATH_PASSWD_PROG], ["$PATH_PASSWD_PROG"],
  86                 [Full path of your "passwd" program])
  87 fi
  88
  89 if test -z "$LD" ; then
  90         LD=$CC
  91 fi
  92 AC_SUBST([LD])
  93
  94 AC_C_INLINE
  95
  96 AC_CHECK_DECL([LLONG_MAX], [have_llong_max=1], , [#include <limits.h>])
  97 AC_CHECK_DECL([SYSTR_POLICY_KILL], [have_systr_policy_kill=1], , [
  98         #include <sys/types.h>
  99         #include <sys/param.h>
 100         #include <dev/systrace.h>
 101 ])
 102 AC_CHECK_DECL([RLIMIT_NPROC],
 103     [AC_DEFINE([HAVE_RLIMIT_NPROC], [], [sys/resource.h has RLIMIT_NPROC])], , [
 104         #include <sys/types.h>
 105         #include <sys/resource.h>
 106 ])
 107 AC_CHECK_DECL([PR_SET_NO_NEW_PRIVS], [have_linux_no_new_privs=1], , [
 108         #include <sys/types.h>
 109         #include <linux/prctl.h>
 110 ])
 111
 112 openssl=yes
 113 AC_ARG_WITH([openssl],
 114         [  --without-openssl       Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL** ],
 115         [  if test "x$withval" = "xno" ; then
 116                 openssl=no
 117            fi
 118         ]
 119 )
 120 AC_MSG_CHECKING([whether OpenSSL will be used for cryptography])
 121 if test "x$openssl" = "xyes" ; then
 122         AC_MSG_RESULT([yes])
 123         AC_DEFINE_UNQUOTED([WITH_OPENSSL], [1], [use libcrypto for cryptography])
 124 else
 125         AC_MSG_RESULT([no])
 126 fi
 127
 128 use_stack_protector=1
 129 use_toolchain_hardening=1
 130 AC_ARG_WITH([stackprotect],
 131     [  --without-stackprotect  Don't use compiler's stack protection], [
 132     if test "x$withval" = "xno"; then
 133         use_stack_protector=0
 134     fi ])
 135 AC_ARG_WITH([hardening],
 136     [  --without-hardening     Don't use toolchain hardening flags], [
 137     if test "x$withval" = "xno"; then
 138         use_toolchain_hardening=0
 139     fi ])
 140
 141 # We use -Werror for the tests only so that we catch warnings like "this is
 142 # on by default" for things like -fPIE.
 143 AC_MSG_CHECKING([if $CC supports -Werror])
 144 saved_CFLAGS="$CFLAGS"
 145 CFLAGS="$CFLAGS -Werror"
 146 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[int main(void) { return 0; }]])],
 147         [ AC_MSG_RESULT([yes])
 148           WERROR="-Werror"],
 149         [ AC_MSG_RESULT([no])
 150           WERROR="" ]
 151 )
 152 CFLAGS="$saved_CFLAGS"
 153
 154 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 155         OSSH_CHECK_CFLAG_COMPILE([-pipe])
 156         OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments])
 157         OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option])
 158         OSSH_CHECK_CFLAG_COMPILE([-Wall])
 159         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-arith])
 160         OSSH_CHECK_CFLAG_COMPILE([-Wuninitialized])
 161         OSSH_CHECK_CFLAG_COMPILE([-Wsign-compare])
 162         OSSH_CHECK_CFLAG_COMPILE([-Wformat-security])
 163         OSSH_CHECK_CFLAG_COMPILE([-Wsizeof-pointer-memaccess])
 164         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-sign], [-Wno-pointer-sign])
 165         OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
 166         OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
 167     if test "x$use_toolchain_hardening" = "x1"; then
 168         OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
 169         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
 170         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
 171         OSSH_CHECK_LDFLAG_LINK([-Wl,-z,noexecstack])
 172         # NB. -ftrapv expects certain support functions to be present in
 173         # the compiler library (libgcc or similar) to detect integer operations
 174         # that can overflow. We must check that the result of enabling it
 175         # actually links. The test program compiled/linked includes a number
 176         # of integer operations that should exercise this.
 177         OSSH_CHECK_CFLAG_LINK([-ftrapv])
 178     fi
 179         AC_MSG_CHECKING([gcc version])
 180         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 181         case $GCC_VER in
 182                 1.*) no_attrib_nonnull=1 ;;
 183                 2.8* | 2.9*)
 184                      no_attrib_nonnull=1
 185                      ;;
 186                 2.*) no_attrib_nonnull=1 ;;
 187                 *) ;;
 188         esac
 189         AC_MSG_RESULT([$GCC_VER])
 190
 191         AC_MSG_CHECKING([if $CC accepts -fno-builtin-memset])
 192         saved_CFLAGS="$CFLAGS"
 193         CFLAGS="$CFLAGS -fno-builtin-memset"
 194         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <string.h> ]],
 195                         [[ char b[10]; memset(b, 0, sizeof(b)); ]])],
 196                 [ AC_MSG_RESULT([yes]) ],
 197                 [ AC_MSG_RESULT([no])
 198                   CFLAGS="$saved_CFLAGS" ]
 199         )
 200
 201         # -fstack-protector-all doesn't always work for some GCC versions
 202         # and/or platforms, so we test if we can.  If it's not supported
 203         # on a given platform gcc will emit a warning so we use -Werror.
 204         if test "x$use_stack_protector" = "x1"; then
 205             for t in -fstack-protector-strong -fstack-protector-all \
 206                     -fstack-protector; do
 207                 AC_MSG_CHECKING([if $CC supports $t])
 208                 saved_CFLAGS="$CFLAGS"
 209                 saved_LDFLAGS="$LDFLAGS"
 210                 CFLAGS="$CFLAGS $t -Werror"
 211                 LDFLAGS="$LDFLAGS $t -Werror"
 212                 AC_LINK_IFELSE(
 213                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 214                         [[
 215         char x[256];
 216         snprintf(x, sizeof(x), "XXX");
 217                          ]])],
 218                     [ AC_MSG_RESULT([yes])
 219                       CFLAGS="$saved_CFLAGS $t"
 220                       LDFLAGS="$saved_LDFLAGS $t"
 221                       AC_MSG_CHECKING([if $t works])
 222                       AC_RUN_IFELSE(
 223                         [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
 224                         [[
 225         char x[256];
 226         snprintf(x, sizeof(x), "XXX");
 227                         ]])],
 228                         [ AC_MSG_RESULT([yes])
 229                           break ],
 230                         [ AC_MSG_RESULT([no]) ],
 231                         [ AC_MSG_WARN([cross compiling: cannot test])
 232                           break ]
 233                       )
 234                     ],
 235                     [ AC_MSG_RESULT([no]) ]
 236                 )
 237                 CFLAGS="$saved_CFLAGS"
 238                 LDFLAGS="$saved_LDFLAGS"
 239             done
 240         fi
 241
 242         if test -z "$have_llong_max"; then
 243                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 244                 unset ac_cv_have_decl_LLONG_MAX
 245                 saved_CFLAGS="$CFLAGS"
 246                 CFLAGS="$CFLAGS -std=gnu99"
 247                 AC_CHECK_DECL([LLONG_MAX],
 248                     [have_llong_max=1],
 249                     [CFLAGS="$saved_CFLAGS"],
 250                     [#include <limits.h>]
 251                 )
 252         fi
 253 fi
 254
 255 AC_MSG_CHECKING([if compiler allows __attribute__ on return types])
 256 AC_COMPILE_IFELSE(
 257     [AC_LANG_PROGRAM([[
 258 #include <stdlib.h>
 259 __attribute__((__unused__)) static void foo(void){return;}]],
 260     [[ exit(0); ]])],
 261     [ AC_MSG_RESULT([yes]) ],
 262     [ AC_MSG_RESULT([no])
 263       AC_DEFINE(NO_ATTRIBUTE_ON_RETURN_TYPE, 1,
 264          [compiler does not accept __attribute__ on return types]) ]
 265 )
 266
 267 if test "x$no_attrib_nonnull" != "x1" ; then
 268         AC_DEFINE([HAVE_ATTRIBUTE__NONNULL__], [1], [Have attribute nonnull])
 269 fi
 270
 271 AC_ARG_WITH([rpath],
 272         [  --without-rpath         Disable auto-added -R linker paths],
 273         [
 274                 if test "x$withval" = "xno" ; then
 275                         need_dash_r=""
 276                 fi
 277                 if test "x$withval" = "xyes" ; then
 278                         need_dash_r=1
 279                 fi
 280         ]
 281 )
 282
 283 # Allow user to specify flags
 284 AC_ARG_WITH([cflags],
 285         [  --with-cflags           Specify additional flags to pass to compiler],
 286         [
 287                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 288                     test "x${withval}" != "xyes"; then
 289                         CFLAGS="$CFLAGS $withval"
 290                 fi
 291         ]
 292 )
 293
 294 AC_ARG_WITH([cflags-after],
 295         [  --with-cflags-after     Specify additional flags to pass to compiler after configure],
 296         [
 297                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 298                     test "x${withval}" != "xyes"; then
 299                         CFLAGS_AFTER="$withval"
 300                 fi
 301         ]
 302 )
 303 AC_ARG_WITH([cppflags],
 304         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 305         [
 306                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 307                     test "x${withval}" != "xyes"; then
 308                         CPPFLAGS="$CPPFLAGS $withval"
 309                 fi
 310         ]
 311 )
 312 AC_ARG_WITH([ldflags],
 313         [  --with-ldflags          Specify additional flags to pass to linker],
 314         [
 315                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 316                     test "x${withval}" != "xyes"; then
 317                         LDFLAGS="$LDFLAGS $withval"
 318                 fi
 319         ]
 320 )
 321 AC_ARG_WITH([ldflags-after],
 322         [  --with-ldflags-after    Specify additional flags to pass to linker after configure],
 323         [
 324                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 325                     test "x${withval}" != "xyes"; then
 326                         LDFLAGS_AFTER="$withval"
 327                 fi
 328         ]
 329 )
 330 AC_ARG_WITH([libs],
 331         [  --with-libs             Specify additional libraries to link with],
 332         [
 333                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 334                     test "x${withval}" != "xyes"; then
 335                         LIBS="$LIBS $withval"
 336                 fi
 337         ]
 338 )
 339 AC_ARG_WITH([Werror],
 340         [  --with-Werror           Build main code with -Werror],
 341         [
 342                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 343                         werror_flags="-Werror"
 344                         if test "x${withval}" != "xyes"; then
 345                                 werror_flags="$withval"
 346                         fi
 347                 fi
 348         ]
 349 )
 350
 351 AC_CHECK_HEADERS([ \
 352         blf.h \
 353         bstring.h \
 354         crypt.h \
 355         crypto/sha2.h \
 356         dirent.h \
 357         endian.h \
 358         elf.h \
 359         err.h \
 360         features.h \
 361         fcntl.h \
 362         floatingpoint.h \
 363         getopt.h \
 364         glob.h \
 365         ia.h \
 366         iaf.h \
 367         inttypes.h \
 368         langinfo.h \
 369         limits.h \
 370         locale.h \
 371         login.h \
 372         maillock.h \
 373         ndir.h \
 374         net/if_tun.h \
 375         netdb.h \
 376         netgroup.h \
 377         pam/pam_appl.h \
 378         paths.h \
 379         poll.h \
 380         pty.h \
 381         readpassphrase.h \
 382         rpc/types.h \
 383         security/pam_appl.h \
 384         sha2.h \
 385         shadow.h \
 386         stddef.h \
 387         stdint.h \
 388         string.h \
 389         strings.h \
 390         sys/audit.h \
 391         sys/bitypes.h \
 392         sys/bsdtty.h \
 393         sys/cdefs.h \
 394         sys/dir.h \
 395         sys/mman.h \
 396         sys/ndir.h \
 397         sys/poll.h \
 398         sys/prctl.h \
 399         sys/pstat.h \
 400         sys/ptrace.h \
 401         sys/select.h \
 402         sys/stat.h \
 403         sys/stream.h \
 404         sys/stropts.h \
 405         sys/strtio.h \
 406         sys/statvfs.h \
 407         sys/sysmacros.h \
 408         sys/time.h \
 409         sys/timers.h \
 410         time.h \
 411         tmpdir.h \
 412         ttyent.h \
 413         ucred.h \
 414         unistd.h \
 415         usersec.h \
 416         util.h \
 417         utime.h \
 418         utmp.h \
 419         utmpx.h \
 420         vis.h \
 421         wchar.h \
 422 ])
 423
 424 # sys/capsicum.h requires sys/types.h
 425 AC_CHECK_HEADERS([sys/capsicum.h], [], [], [
 426 #ifdef HAVE_SYS_TYPES_H
 427 # include <sys/types.h>
 428 #endif
 429 ])
 430
 431 # lastlog.h requires sys/time.h to be included first on Solaris
 432 AC_CHECK_HEADERS([lastlog.h], [], [], [
 433 #ifdef HAVE_SYS_TIME_H
 434 # include <sys/time.h>
 435 #endif
 436 ])
 437
 438 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 439 AC_CHECK_HEADERS([sys/ptms.h], [], [], [
 440 #ifdef HAVE_SYS_STREAM_H
 441 # include <sys/stream.h>
 442 #endif
 443 ])
 444
 445 # login_cap.h requires sys/types.h on NetBSD
 446 AC_CHECK_HEADERS([login_cap.h], [], [], [
 447 #include <sys/types.h>
 448 ])
 449
 450 # older BSDs need sys/param.h before sys/mount.h
 451 AC_CHECK_HEADERS([sys/mount.h], [], [], [
 452 #include <sys/param.h>
 453 ])
 454
 455 # Android requires sys/socket.h to be included before sys/un.h
 456 AC_CHECK_HEADERS([sys/un.h], [], [], [
 457 #include <sys/types.h>
 458 #include <sys/socket.h>
 459 ])
 460
 461 # Messages for features tested for in target-specific section
 462 SIA_MSG="no"
 463 SPC_MSG="no"
 464 SP_MSG="no"
 465 SPP_MSG="no"
 466
 467 # Support for Solaris/Illumos privileges (this test is used by both
 468 # the --with-solaris-privs option and --with-sandbox=solaris).
 469 SOLARIS_PRIVS="no"
 470
 471 # Check for some target-specific stuff
 472 case "$host" in
 473 *-*-aix*)
 474         # Some versions of VAC won't allow macro redefinitions at
 475         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 476         # particularly with older versions of vac or xlc.
 477         # It also throws errors about null macro argments, but these are
 478         # not fatal.
 479         AC_MSG_CHECKING([if compiler allows macro redefinitions])
 480         AC_COMPILE_IFELSE(
 481             [AC_LANG_PROGRAM([[
 482 #define testmacro foo
 483 #define testmacro bar]],
 484             [[ exit(0); ]])],
 485             [ AC_MSG_RESULT([yes]) ],
 486             [ AC_MSG_RESULT([no])
 487               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 488               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 489               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 490               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 491             ]
 492         )
 493
 494         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 495         if (test -z "$blibpath"); then
 496                 blibpath="/usr/lib:/lib"
 497         fi
 498         saved_LDFLAGS="$LDFLAGS"
 499         if test "$GCC" = "yes"; then
 500                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 501         else
 502                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 503         fi
 504         for tryflags in $flags ;do
 505                 if (test -z "$blibflags"); then
 506                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 507                         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],
 508                         [blibflags=$tryflags], [])
 509                 fi
 510         done
 511         if (test -z "$blibflags"); then
 512                 AC_MSG_RESULT([not found])
 513                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 514         else
 515                 AC_MSG_RESULT([$blibflags])
 516         fi
 517         LDFLAGS="$saved_LDFLAGS"
 518         dnl Check for authenticate.  Might be in libs.a on older AIXes
 519         AC_CHECK_FUNC([authenticate], [AC_DEFINE([WITH_AIXAUTHENTICATE], [1],
 520                 [Define if you want to enable AIX4's authenticate function])],
 521                 [AC_CHECK_LIB([s], [authenticate],
 522                         [ AC_DEFINE([WITH_AIXAUTHENTICATE])
 523                                 LIBS="$LIBS -ls"
 524                         ])
 525                 ])
 526         dnl Check for various auth function declarations in headers.
 527         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 528             passwdexpired, setauthdb], , , [#include <usersec.h>])
 529         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 530         AC_CHECK_DECLS([loginfailed],
 531             [AC_MSG_CHECKING([if loginfailed takes 4 arguments])
 532             AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <usersec.h> ]],
 533                 [[ (void)loginfailed("user","host","tty",0); ]])],
 534                 [AC_MSG_RESULT([yes])
 535                 AC_DEFINE([AIX_LOGINFAILED_4ARG], [1],
 536                         [Define if your AIX loginfailed() function
 537                         takes 4 arguments (AIX >= 5.2)])], [AC_MSG_RESULT([no])
 538             ])],
 539             [],
 540             [#include <usersec.h>]
 541         )
 542         AC_CHECK_FUNCS([getgrset setauthdb])
 543         AC_CHECK_DECL([F_CLOSEM],
 544             AC_DEFINE([HAVE_FCNTL_CLOSEM], [1], [Use F_CLOSEM fcntl for closefrom]),
 545             [],
 546             [ #include <limits.h>
 547               #include <fcntl.h> ]
 548         )
 549         check_for_aix_broken_getaddrinfo=1
 550         AC_DEFINE([BROKEN_REALPATH], [1], [Define if you have a broken realpath.])
 551         AC_DEFINE([SETEUID_BREAKS_SETUID], [1],
 552             [Define if your platform breaks doing a seteuid before a setuid])
 553         AC_DEFINE([BROKEN_SETREUID], [1], [Define if your setreuid() is broken])
 554         AC_DEFINE([BROKEN_SETREGID], [1], [Define if your setregid() is broken])
 555         dnl AIX handles lastlog as part of its login message
 556         AC_DEFINE([DISABLE_LASTLOG], [1], [Define if you don't want to use lastlog])
 557         AC_DEFINE([LOGIN_NEEDS_UTMPX], [1],
 558                 [Some systems need a utmpx entry for /bin/login to work])
 559         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 560                 [Define to a Set Process Title type if your system is
 561                 supported by bsd-setproctitle.c])
 562         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 563             [AIX 5.2 and 5.3 (and presumably newer) require this])
 564         AC_DEFINE([PTY_ZEROREAD], [1], [read(1) can return 0 for a non-closed fd])
 565         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 566         ;;
 567 *-*-android*)
 568         AC_DEFINE([DISABLE_UTMP], [1], [Define if you don't want to use utmp])
 569         AC_DEFINE([DISABLE_WTMP], [1], [Define if you don't want to use wtmp])
 570         ;;
 571 *-*-cygwin*)
 572         check_for_libcrypt_later=1
 573         LIBS="$LIBS /usr/lib/textreadmode.o"
 574         AC_DEFINE([HAVE_CYGWIN], [1], [Define if you are on Cygwin])
 575         AC_DEFINE([USE_PIPES], [1], [Use PIPES instead of a socketpair()])
 576         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
 577                 [Define to disable UID restoration test])
 578         AC_DEFINE([DISABLE_SHADOW], [1],
 579                 [Define if you want to disable shadow passwords])
 580         AC_DEFINE([NO_X11_UNIX_SOCKETS], [1],
 581                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 582         AC_DEFINE([DISABLE_FD_PASSING], [1],
 583                 [Define if your platform needs to skip post auth
 584                 file descriptor passing])
 585         AC_DEFINE([SSH_IOBUFSZ], [65535], [Windows is sensitive to read buffer size])
 586         AC_DEFINE([FILESYSTEM_NO_BACKSLASH], [1], [File names may not contain backslash characters])
 587         # Cygwin defines optargs, optargs as declspec(dllimport) for historical
 588         # reasons which cause compile warnings, so we disable those warnings.
 589         OSSH_CHECK_CFLAG_COMPILE([-Wno-attributes])
 590         ;;
 591 *-*-dgux*)
 592         AC_DEFINE([IP_TOS_IS_BROKEN], [1],
 593                 [Define if your system choked on IP TOS setting])
 594         AC_DEFINE([SETEUID_BREAKS_SETUID])
 595         AC_DEFINE([BROKEN_SETREUID])
 596         AC_DEFINE([BROKEN_SETREGID])
 597         ;;
 598 *-*-darwin*)
 599         use_pie=auto
 600         AC_MSG_CHECKING([if we have working getaddrinfo])
 601         AC_RUN_IFELSE([AC_LANG_SOURCE([[ #include <mach-o/dyld.h>
 602 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 603                 exit(0);
 604         else
 605                 exit(1);
 606 }
 607                         ]])],
 608         [AC_MSG_RESULT([working])],
 609         [AC_MSG_RESULT([buggy])
 610         AC_DEFINE([BROKEN_GETADDRINFO], [1],
 611                 [getaddrinfo is broken (if present)])
 612         ],
 613         [AC_MSG_RESULT([assume it is working])])
 614         AC_DEFINE([SETEUID_BREAKS_SETUID])
 615         AC_DEFINE([BROKEN_SETREUID])
 616         AC_DEFINE([BROKEN_SETREGID])
 617         AC_DEFINE([BROKEN_GLOB], [1], [OS X glob does not do what we expect])
 618         AC_DEFINE_UNQUOTED([BIND_8_COMPAT], [1],
 619                 [Define if your resolver libs need this for getrrsetbyname])
 620         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 621         AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 622             [Use tunnel device compatibility to OpenBSD])
 623         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 624             [Prepend the address family to IP tunnel traffic])
 625         m4_pattern_allow([AU_IPv])
 626         AC_CHECK_DECL([AU_IPv4], [],
 627             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 628             [#include <bsm/audit.h>]
 629         AC_DEFINE([LASTLOG_WRITE_PUTUTXLINE], [1],
 630             [Define if pututxline updates lastlog too])
 631         )
 632         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
 633                 [Define to a Set Process Title type if your system is
 634                 supported by bsd-setproctitle.c])
 635         AC_CHECK_FUNCS([sandbox_init])
 636         AC_CHECK_HEADERS([sandbox.h])
 637         AC_CHECK_LIB([sandbox], [sandbox_apply], [
 638             SSHDLIBS="$SSHDLIBS -lsandbox"
 639         ])
 640         ;;
 641 *-*-dragonfly*)
 642         SSHDLIBS="$SSHDLIBS -lcrypt"
 643         TEST_MALLOC_OPTIONS="AFGJPRX"
 644         ;;
 645 *-*-haiku*)
 646         LIBS="$LIBS -lbsd "
 647         AC_CHECK_LIB([network], [socket])
 648         AC_DEFINE([HAVE_U_INT64_T])
 649         MANTYPE=man
 650         ;;
 651 *-*-hpux*)
 652         # first we define all of the options common to all HP-UX releases
 653         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 654         IPADDR_IN_DISPLAY=yes
 655         AC_DEFINE([USE_PIPES])
 656         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 657         AC_DEFINE([LOCKED_PASSWD_STRING], ["*"],
 658                 [String used in /etc/passwd to denote locked account])
 659         AC_DEFINE([SPT_TYPE], [SPT_PSTAT])
 660         AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
 661         maildir="/var/mail"
 662         LIBS="$LIBS -lsec"
 663         AC_CHECK_LIB([xnet], [t_error], ,
 664             [AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***])])
 665
 666         # next, we define all of the options specific to major releases
 667         case "$host" in
 668         *-*-hpux10*)
 669                 if test -z "$GCC"; then
 670                         CFLAGS="$CFLAGS -Ae"
 671                 fi
 672                 ;;
 673         *-*-hpux11*)
 674                 AC_DEFINE([PAM_SUN_CODEBASE], [1],
 675                         [Define if you are using Solaris-derived PAM which
 676                         passes pam_messages to the conversation function
 677                         with an extra level of indirection])
 678                 AC_DEFINE([DISABLE_UTMP], [1],
 679                         [Define if you don't want to use utmp])
 680                 AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 681                 check_for_hpux_broken_getaddrinfo=1
 682                 check_for_conflicting_getspnam=1
 683                 ;;
 684         esac
 685
 686         # lastly, we define options specific to minor releases
 687         case "$host" in
 688         *-*-hpux10.26)
 689                 AC_DEFINE([HAVE_SECUREWARE], [1],
 690                         [Define if you have SecureWare-based
 691                         protected password database])
 692                 disable_ptmx_check=yes
 693                 LIBS="$LIBS -lsecpw"
 694                 ;;
 695         esac
 696         ;;
 697 *-*-irix5*)
 698         PATH="$PATH:/usr/etc"
 699         AC_DEFINE([BROKEN_INET_NTOA], [1],
 700                 [Define if you system's inet_ntoa is busted
 701                 (e.g. Irix gcc issue)])
 702         AC_DEFINE([SETEUID_BREAKS_SETUID])
 703         AC_DEFINE([BROKEN_SETREUID])
 704         AC_DEFINE([BROKEN_SETREGID])
 705         AC_DEFINE([WITH_ABBREV_NO_TTY], [1],
 706                 [Define if you shouldn't strip 'tty' from your
 707                 ttyname in [uw]tmp])
 708         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 709         ;;
 710 *-*-irix6*)
 711         PATH="$PATH:/usr/etc"
 712         AC_DEFINE([WITH_IRIX_ARRAY], [1],
 713                 [Define if you have/want arrays
 714                 (cluster-wide session managment, not C arrays)])
 715         AC_DEFINE([WITH_IRIX_PROJECT], [1],
 716                 [Define if you want IRIX project management])
 717         AC_DEFINE([WITH_IRIX_AUDIT], [1],
 718                 [Define if you want IRIX audit trails])
 719         AC_CHECK_FUNC([jlimit_startjob], [AC_DEFINE([WITH_IRIX_JOBS], [1],
 720                 [Define if you want IRIX kernel jobs])])
 721         AC_DEFINE([BROKEN_INET_NTOA])
 722         AC_DEFINE([SETEUID_BREAKS_SETUID])
 723         AC_DEFINE([BROKEN_SETREUID])
 724         AC_DEFINE([BROKEN_SETREGID])
 725         AC_DEFINE([BROKEN_UPDWTMPX], [1], [updwtmpx is broken (if present)])
 726         AC_DEFINE([WITH_ABBREV_NO_TTY])
 727         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 728         ;;
 729 *-*-k*bsd*-gnu | *-*-kopensolaris*-gnu)
 730         check_for_libcrypt_later=1
 731         AC_DEFINE([PAM_TTY_KLUDGE])
 732         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"])
 733         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 734         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 735         AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
 736         ;;
 737 *-*-linux*)
 738         no_dev_ptmx=1
 739         use_pie=auto
 740         check_for_libcrypt_later=1
 741         check_for_openpty_ctty_bug=1
 742         dnl Target SUSv3/POSIX.1-2001 plus BSD specifics.
 743         dnl _DEFAULT_SOURCE is the new name for _BSD_SOURCE
 744         CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE"
 745         AC_DEFINE([PAM_TTY_KLUDGE], [1],
 746                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 747         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["!"],
 748                 [String used in /etc/passwd to denote locked account])
 749         AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
 750         AC_DEFINE([LINK_OPNOTSUPP_ERRNO], [EPERM],
 751                 [Define to whatever link() returns for "not supported"
 752                 if it doesn't return EOPNOTSUPP.])
 753         AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
 754         AC_DEFINE([USE_BTMP])
 755         AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])
 756         inet6_default_4in6=yes
 757         case `uname -r` in
 758         1.*|2.0.*)
 759                 AC_DEFINE([BROKEN_CMSG_TYPE], [1],
 760                         [Define if cmsg_type is not passed correctly])
 761                 ;;
 762         esac
 763         # tun(4) forwarding compat code
 764         AC_CHECK_HEADERS([linux/if_tun.h])
 765         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 766                 AC_DEFINE([SSH_TUN_LINUX], [1],
 767                     [Open tunnel devices the Linux tun/tap way])
 768                 AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
 769                     [Use tunnel device compatibility to OpenBSD])
 770                 AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 771                     [Prepend the address family to IP tunnel traffic])
 772         fi
 773         AC_CHECK_HEADERS([linux/seccomp.h linux/filter.h linux/audit.h], [],
 774             [], [#include <linux/types.h>])
 775         AC_MSG_CHECKING([for seccomp architecture])
 776         seccomp_audit_arch=
 777         case "$host" in
 778         x86_64-*)
 779                 seccomp_audit_arch=AUDIT_ARCH_X86_64
 780                 ;;
 781         i*86-*)
 782                 seccomp_audit_arch=AUDIT_ARCH_I386
 783                 ;;
 784         arm*-*)
 785                 seccomp_audit_arch=AUDIT_ARCH_ARM
 786                 ;;
 787         aarch64*-*)
 788                 seccomp_audit_arch=AUDIT_ARCH_AARCH64
 789                 ;;
 790         s390x-*)
 791                 seccomp_audit_arch=AUDIT_ARCH_S390X
 792                 ;;
 793         s390-*)
 794                 seccomp_audit_arch=AUDIT_ARCH_S390
 795                 ;;
 796         powerpc64-*)
 797                 seccomp_audit_arch=AUDIT_ARCH_PPC64
 798                 ;;
 799         powerpc64le-*)
 800                 seccomp_audit_arch=AUDIT_ARCH_PPC64LE
 801                 ;;
 802         mips-*)
 803                 seccomp_audit_arch=AUDIT_ARCH_MIPS
 804                 ;;
 805         mipsel-*)
 806                 seccomp_audit_arch=AUDIT_ARCH_MIPSEL
 807                 ;;
 808         mips64-*)
 809                 seccomp_audit_arch=AUDIT_ARCH_MIPS64
 810                 ;;
 811         mips64el-*)
 812                 seccomp_audit_arch=AUDIT_ARCH_MIPSEL64
 813                 ;;
 814         esac
 815         if test "x$seccomp_audit_arch" != "x" ; then
 816                 AC_MSG_RESULT(["$seccomp_audit_arch"])
 817                 AC_DEFINE_UNQUOTED([SECCOMP_AUDIT_ARCH], [$seccomp_audit_arch],
 818                     [Specify the system call convention in use])
 819         else
 820                 AC_MSG_RESULT([architecture not supported])
 821         fi
 822         ;;
 823 mips-sony-bsd|mips-sony-newsos4)
 824         AC_DEFINE([NEED_SETPGRP], [1], [Need setpgrp to acquire controlling tty])
 825         SONY=1
 826         ;;
 827 *-*-netbsd*)
 828         check_for_libcrypt_before=1
 829         if test "x$withval" != "xno" ; then
 830                 need_dash_r=1
 831         fi
 832         CPPFLAGS="$CPPFLAGS -D_OPENBSD_SOURCE"
 833         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 834         AC_CHECK_HEADER([net/if_tap.h], ,
 835             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 836         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 837             [Prepend the address family to IP tunnel traffic])
 838         TEST_MALLOC_OPTIONS="AJRX"
 839         AC_DEFINE([BROKEN_READ_COMPARISON], [1],
 840             [NetBSD read function is sometimes redirected, breaking atomicio comparisons against it])
 841         ;;
 842 *-*-freebsd*)
 843         check_for_libcrypt_later=1
 844         AC_DEFINE([LOCKED_PASSWD_PREFIX], ["*LOCKED*"], [Account locked with pw(1)])
 845         AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
 846         AC_CHECK_HEADER([net/if_tap.h], ,
 847             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
 848         AC_DEFINE([BROKEN_GLOB], [1], [FreeBSD glob does not do what we need])
 849         TEST_MALLOC_OPTIONS="AJRX"
 850         # Preauth crypto occasionally uses file descriptors for crypto offload
 851         # and will crash if they cannot be opened.
 852         AC_DEFINE([SANDBOX_SKIP_RLIMIT_NOFILE], [1],
 853             [define if setrlimit RLIMIT_NOFILE breaks things])
 854         ;;
 855 *-*-bsdi*)
 856         AC_DEFINE([SETEUID_BREAKS_SETUID])
 857         AC_DEFINE([BROKEN_SETREUID])
 858         AC_DEFINE([BROKEN_SETREGID])
 859         ;;
 860 *-next-*)
 861         conf_lastlog_location="/usr/adm/lastlog"
 862         conf_utmp_location=/etc/utmp
 863         conf_wtmp_location=/usr/adm/wtmp
 864         maildir=/usr/spool/mail
 865         AC_DEFINE([HAVE_NEXT], [1], [Define if you are on NeXT])
 866         AC_DEFINE([BROKEN_REALPATH])
 867         AC_DEFINE([USE_PIPES])
 868         AC_DEFINE([BROKEN_SAVED_UIDS], [1], [Needed for NeXT])
 869         ;;
 870 *-*-openbsd*)
 871         use_pie=auto
 872         AC_DEFINE([HAVE_ATTRIBUTE__SENTINEL__], [1], [OpenBSD's gcc has sentinel])
 873         AC_DEFINE([HAVE_ATTRIBUTE__BOUNDED__], [1], [OpenBSD's gcc has bounded])
 874         AC_DEFINE([SSH_TUN_OPENBSD], [1], [Open tunnel devices the OpenBSD way])
 875         AC_DEFINE([SYSLOG_R_SAFE_IN_SIGHAND], [1],
 876             [syslog_r function is safe to use in in a signal handler])
 877         TEST_MALLOC_OPTIONS="AFGJPRX"
 878         ;;
 879 *-*-solaris*)
 880         if test "x$withval" != "xno" ; then
 881                 need_dash_r=1
 882         fi
 883         AC_DEFINE([PAM_SUN_CODEBASE])
 884         AC_DEFINE([LOGIN_NEEDS_UTMPX])
 885         AC_DEFINE([PAM_TTY_KLUDGE])
 886         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
 887                 [Define if pam_chauthtok wants real uid set
 888                 to the unpriv'ed user])
 889         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 890         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 891         AC_DEFINE([SSHD_ACQUIRES_CTTY], [1],
 892                 [Define if sshd somehow reacquires a controlling TTY
 893                 after setsid()])
 894         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd
 895                 in case the name is longer than 8 chars])
 896         AC_DEFINE([BROKEN_TCGETATTR_ICANON], [1], [tcgetattr with ICANON may hang])
 897         external_path_file=/etc/default/login
 898         # hardwire lastlog location (can't detect it on some versions)
 899         conf_lastlog_location="/var/adm/lastlog"
 900         AC_MSG_CHECKING([for obsolete utmp and wtmp in solaris2.x])
 901         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 902         if test "$sol2ver" -ge 8; then
 903                 AC_MSG_RESULT([yes])
 904                 AC_DEFINE([DISABLE_UTMP])
 905                 AC_DEFINE([DISABLE_WTMP], [1],
 906                         [Define if you don't want to use wtmp])
 907         else
 908                 AC_MSG_RESULT([no])
 909         fi
 910         AC_CHECK_FUNCS([setpflags])
 911         AC_CHECK_FUNCS([setppriv])
 912         AC_CHECK_FUNCS([priv_basicset])
 913         AC_CHECK_HEADERS([priv.h])
 914         AC_ARG_WITH([solaris-contracts],
 915                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 916                 [
 917                 AC_CHECK_LIB([contract], [ct_tmpl_activate],
 918                         [ AC_DEFINE([USE_SOLARIS_PROCESS_CONTRACTS], [1],
 919                                 [Define if you have Solaris process contracts])
 920                           LIBS="$LIBS -lcontract"
 921                           SPC_MSG="yes" ], )
 922                 ],
 923         )
 924         AC_ARG_WITH([solaris-projects],
 925                 [  --with-solaris-projects Enable Solaris projects (experimental)],
 926                 [
 927                 AC_CHECK_LIB([project], [setproject],
 928                         [ AC_DEFINE([USE_SOLARIS_PROJECTS], [1],
 929                                 [Define if you have Solaris projects])
 930                         LIBS="$LIBS -lproject"
 931                         SP_MSG="yes" ], )
 932                 ],
 933         )
 934         AC_ARG_WITH([solaris-privs],
 935                 [  --with-solaris-privs    Enable Solaris/Illumos privileges (experimental)],
 936                 [
 937                 AC_MSG_CHECKING([for Solaris/Illumos privilege support])
 938                 if test "x$ac_cv_func_setppriv" = "xyes" -a \
 939                         "x$ac_cv_header_priv_h" = "xyes" ; then
 940                         SOLARIS_PRIVS=yes
 941                         AC_MSG_RESULT([found])
 942                         AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
 943                                 [Define to disable UID restoration test])
 944                         AC_DEFINE([USE_SOLARIS_PRIVS], [1],
 945                                 [Define if you have Solaris privileges])
 946                         SPP_MSG="yes"
 947                 else
 948                         AC_MSG_RESULT([not found])
 949                         AC_MSG_ERROR([*** must have support for Solaris privileges to use --with-solaris-privs])
 950                 fi
 951                 ],
 952         )
 953         TEST_SHELL=$SHELL       # let configure find us a capable shell
 954         ;;
 955 *-*-sunos4*)
 956         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 957         AC_CHECK_FUNCS([getpwanam])
 958         AC_DEFINE([PAM_SUN_CODEBASE])
 959         conf_utmp_location=/etc/utmp
 960         conf_wtmp_location=/var/adm/wtmp
 961         conf_lastlog_location=/var/adm/lastlog
 962         AC_DEFINE([USE_PIPES])
 963         ;;
 964 *-ncr-sysv*)
 965         LIBS="$LIBS -lc89"
 966         AC_DEFINE([USE_PIPES])
 967         AC_DEFINE([SSHD_ACQUIRES_CTTY])
 968         AC_DEFINE([SETEUID_BREAKS_SETUID])
 969         AC_DEFINE([BROKEN_SETREUID])
 970         AC_DEFINE([BROKEN_SETREGID])
 971         ;;
 972 *-sni-sysv*)
 973         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 974         AC_CHECK_LIB([dl], [dlsym], ,)
 975         # -lresolv needs to be at the end of LIBS or DNS lookups break
 976         AC_CHECK_LIB([resolv], [res_query], [ LIBS="$LIBS -lresolv" ])
 977         IPADDR_IN_DISPLAY=yes
 978         AC_DEFINE([USE_PIPES])
 979         AC_DEFINE([IP_TOS_IS_BROKEN])
 980         AC_DEFINE([SETEUID_BREAKS_SETUID])
 981         AC_DEFINE([BROKEN_SETREUID])
 982         AC_DEFINE([BROKEN_SETREGID])
 983         AC_DEFINE([SSHD_ACQUIRES_CTTY])
 984         external_path_file=/etc/default/login
 985         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 986         # Attention: always take care to bind libsocket and libnsl before libc,
 987         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 988         ;;
 989 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 990 *-*-sysv4.2*)
 991         AC_DEFINE([USE_PIPES])
 992         AC_DEFINE([SETEUID_BREAKS_SETUID])
 993         AC_DEFINE([BROKEN_SETREUID])
 994         AC_DEFINE([BROKEN_SETREGID])
 995         AC_DEFINE([PASSWD_NEEDS_USERNAME], [1], [must supply username to passwd])
 996         AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
 997         TEST_SHELL=$SHELL       # let configure find us a capable shell
 998         ;;
 999 # UnixWare 7.x, OpenUNIX 8
1000 *-*-sysv5*)
1001         CPPFLAGS="$CPPFLAGS -Dvsnprintf=_xvsnprintf -Dsnprintf=_xsnprintf"
1002         AC_DEFINE([UNIXWARE_LONG_PASSWORDS], [1], [Support passwords > 8 chars])
1003         AC_DEFINE([USE_PIPES])
1004         AC_DEFINE([SETEUID_BREAKS_SETUID])
1005         AC_DEFINE([BROKEN_GETADDRINFO])
1006         AC_DEFINE([BROKEN_SETREUID])
1007         AC_DEFINE([BROKEN_SETREGID])
1008         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1009         AC_DEFINE([BROKEN_TCGETATTR_ICANON])
1010         TEST_SHELL=$SHELL       # let configure find us a capable shell
1011         case "$host" in
1012         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
1013                 maildir=/var/spool/mail
1014                 AC_DEFINE([BROKEN_LIBIAF], [1],
1015                         [ia_uinfo routines not supported by OS yet])
1016                 AC_DEFINE([BROKEN_UPDWTMPX])
1017                 AC_CHECK_LIB([prot], [getluid], [ LIBS="$LIBS -lprot"
1018                         AC_CHECK_FUNCS([getluid setluid], , , [-lprot])
1019                         AC_DEFINE([HAVE_SECUREWARE])
1020                         AC_DEFINE([DISABLE_SHADOW])
1021                         ], , )
1022                 ;;
1023         *)      AC_DEFINE([LOCKED_PASSWD_STRING], ["*LK*"])
1024                 check_for_libcrypt_later=1
1025                 ;;
1026         esac
1027         ;;
1028 *-*-sysv*)
1029         ;;
1030 # SCO UNIX and OEM versions of SCO UNIX
1031 *-*-sco3.2v4*)
1032         AC_MSG_ERROR("This Platform is no longer supported.")
1033         ;;
1034 # SCO OpenServer 5.x
1035 *-*-sco3.2v5*)
1036         if test -z "$GCC"; then
1037                 CFLAGS="$CFLAGS -belf"
1038         fi
1039         LIBS="$LIBS -lprot -lx -ltinfo -lm"
1040         no_dev_ptmx=1
1041         AC_DEFINE([USE_PIPES])
1042         AC_DEFINE([HAVE_SECUREWARE])
1043         AC_DEFINE([DISABLE_SHADOW])
1044         AC_DEFINE([DISABLE_FD_PASSING])
1045         AC_DEFINE([SETEUID_BREAKS_SETUID])
1046         AC_DEFINE([BROKEN_GETADDRINFO])
1047         AC_DEFINE([BROKEN_SETREUID])
1048         AC_DEFINE([BROKEN_SETREGID])
1049         AC_DEFINE([WITH_ABBREV_NO_TTY])
1050         AC_DEFINE([BROKEN_UPDWTMPX])
1051         AC_DEFINE([PASSWD_NEEDS_USERNAME])
1052         AC_CHECK_FUNCS([getluid setluid])
1053         MANTYPE=man
1054         TEST_SHELL=$SHELL       # let configure find us a capable shell
1055         SKIP_DISABLE_LASTLOG_DEFINE=yes
1056         ;;
1057 *-*-unicosmk*)
1058         AC_DEFINE([NO_SSH_LASTLOG], [1],
1059                 [Define if you don't want to use lastlog in session.c])
1060         AC_DEFINE([SETEUID_BREAKS_SETUID])
1061         AC_DEFINE([BROKEN_SETREUID])
1062         AC_DEFINE([BROKEN_SETREGID])
1063         AC_DEFINE([USE_PIPES])
1064         AC_DEFINE([DISABLE_FD_PASSING])
1065         LDFLAGS="$LDFLAGS"
1066         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
1067         MANTYPE=cat
1068         ;;
1069 *-*-unicosmp*)
1070         AC_DEFINE([SETEUID_BREAKS_SETUID])
1071         AC_DEFINE([BROKEN_SETREUID])
1072         AC_DEFINE([BROKEN_SETREGID])
1073         AC_DEFINE([WITH_ABBREV_NO_TTY])
1074         AC_DEFINE([USE_PIPES])
1075         AC_DEFINE([DISABLE_FD_PASSING])
1076         LDFLAGS="$LDFLAGS"
1077         LIBS="$LIBS -lgen -lacid -ldb"
1078         MANTYPE=cat
1079         ;;
1080 *-*-unicos*)
1081         AC_DEFINE([SETEUID_BREAKS_SETUID])
1082         AC_DEFINE([BROKEN_SETREUID])
1083         AC_DEFINE([BROKEN_SETREGID])
1084         AC_DEFINE([USE_PIPES])
1085         AC_DEFINE([DISABLE_FD_PASSING])
1086         AC_DEFINE([NO_SSH_LASTLOG])
1087         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
1088         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
1089         MANTYPE=cat
1090         ;;
1091 *-dec-osf*)
1092         AC_MSG_CHECKING([for Digital Unix SIA])
1093         no_osfsia=""
1094         AC_ARG_WITH([osfsia],
1095                 [  --with-osfsia           Enable Digital Unix SIA],
1096                 [
1097                         if test "x$withval" = "xno" ; then
1098                                 AC_MSG_RESULT([disabled])
1099                                 no_osfsia=1
1100                         fi
1101                 ],
1102         )
1103         if test -z "$no_osfsia" ; then
1104                 if test -f /etc/sia/matrix.conf; then
1105                         AC_MSG_RESULT([yes])
1106                         AC_DEFINE([HAVE_OSF_SIA], [1],
1107                                 [Define if you have Digital Unix Security
1108                                 Integration Architecture])
1109                         AC_DEFINE([DISABLE_LOGIN], [1],
1110                                 [Define if you don't want to use your
1111                                 system's login() call])
1112                         AC_DEFINE([DISABLE_FD_PASSING])
1113                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
1114                         SIA_MSG="yes"
1115                 else
1116                         AC_MSG_RESULT([no])
1117                         AC_DEFINE([LOCKED_PASSWD_SUBSTR], ["Nologin"],
1118                           [String used in /etc/passwd to denote locked account])
1119                 fi
1120         fi
1121         AC_DEFINE([BROKEN_GETADDRINFO])
1122         AC_DEFINE([SETEUID_BREAKS_SETUID])
1123         AC_DEFINE([BROKEN_SETREUID])
1124         AC_DEFINE([BROKEN_SETREGID])
1125         AC_DEFINE([BROKEN_READV_COMPARISON], [1], [Can't do comparisons on readv])
1126         ;;
1127
1128 *-*-nto-qnx*)
1129         AC_DEFINE([USE_PIPES])
1130         AC_DEFINE([NO_X11_UNIX_SOCKETS])
1131         AC_DEFINE([DISABLE_LASTLOG])
1132         AC_DEFINE([SSHD_ACQUIRES_CTTY])
1133         AC_DEFINE([BROKEN_SHADOW_EXPIRE], [1], [QNX shadow support is broken])
1134         enable_etc_default_login=no     # has incompatible /etc/default/login
1135         case "$host" in
1136         *-*-nto-qnx6*)
1137                 AC_DEFINE([DISABLE_FD_PASSING])
1138                 ;;
1139         esac
1140         ;;
1141
1142 *-*-ultrix*)
1143         AC_DEFINE([BROKEN_GETGROUPS], [1], [getgroups(0,NULL) will return -1])
1144         AC_DEFINE([NEED_SETPGRP])
1145         AC_DEFINE([HAVE_SYS_SYSLOG_H], [1], [Force use of sys/syslog.h on Ultrix])
1146         ;;
1147
1148 *-*-lynxos)
1149         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
1150         AC_DEFINE([BROKEN_SETVBUF], [1],
1151             [LynxOS has broken setvbuf() implementation])
1152         ;;
1153 esac
1154
1155 AC_MSG_CHECKING([compiler and flags for sanity])
1156 AC_RUN_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]], [[ exit(0); ]])],
1157         [       AC_MSG_RESULT([yes]) ],
1158         [
1159                 AC_MSG_RESULT([no])
1160                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
1161         ],
1162         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
1163 )
1164
1165 dnl Checks for header files.
1166 # Checks for libraries.
1167 AC_CHECK_FUNC([setsockopt], , [AC_CHECK_LIB([socket], [setsockopt])])
1168
1169 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
1170 AC_CHECK_FUNCS([dirname], [AC_CHECK_HEADERS([libgen.h])] , [
1171         AC_CHECK_LIB([gen], [dirname], [
1172                 AC_CACHE_CHECK([for broken dirname],
1173                         ac_cv_have_broken_dirname, [
1174                         save_LIBS="$LIBS"
1175                         LIBS="$LIBS -lgen"
1176                         AC_RUN_IFELSE(
1177                                 [AC_LANG_SOURCE([[
1178 #include <libgen.h>
1179 #include <string.h>
1180
1181 int main(int argc, char **argv) {
1182     char *s, buf[32];
1183
1184     strncpy(buf,"/etc", 32);
1185     s = dirname(buf);
1186     if (!s || strncmp(s, "/", 32) != 0) {
1187         exit(1);
1188     } else {
1189         exit(0);
1190     }
1191 }
1192                                 ]])],
1193                                 [ ac_cv_have_broken_dirname="no" ],
1194                                 [ ac_cv_have_broken_dirname="yes" ],
1195                                 [ ac_cv_have_broken_dirname="no" ],
1196                         )
1197                         LIBS="$save_LIBS"
1198                 ])
1199                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
1200                         LIBS="$LIBS -lgen"
1201                         AC_DEFINE([HAVE_DIRNAME])
1202                         AC_CHECK_HEADERS([libgen.h])
1203                 fi
1204         ])
1205 ])
1206
1207 AC_CHECK_FUNC([getspnam], ,
1208         [AC_CHECK_LIB([gen], [getspnam], [LIBS="$LIBS -lgen"])])
1209 AC_SEARCH_LIBS([basename], [gen], [AC_DEFINE([HAVE_BASENAME], [1],
1210         [Define if you have the basename function.])])
1211
1212 dnl zlib is required
1213 AC_ARG_WITH([zlib],
1214         [  --with-zlib=PATH        Use zlib in PATH],
1215         [ if test "x$withval" = "xno" ; then
1216                 AC_MSG_ERROR([*** zlib is required ***])
1217           elif test "x$withval" != "xyes"; then
1218                 if test -d "$withval/lib"; then
1219                         if test -n "${need_dash_r}"; then
1220                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1221                         else
1222                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1223                         fi
1224                 else
1225                         if test -n "${need_dash_r}"; then
1226                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1227                         else
1228                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1229                         fi
1230                 fi
1231                 if test -d "$withval/include"; then
1232                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1233                 else
1234                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1235                 fi
1236         fi ]
1237 )
1238
1239 AC_CHECK_HEADER([zlib.h], ,[AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***])])
1240 AC_CHECK_LIB([z], [deflate], ,
1241         [
1242                 saved_CPPFLAGS="$CPPFLAGS"
1243                 saved_LDFLAGS="$LDFLAGS"
1244                 save_LIBS="$LIBS"
1245                 dnl Check default zlib install dir
1246                 if test -n "${need_dash_r}"; then
1247                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
1248                 else
1249                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
1250                 fi
1251                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
1252                 LIBS="$LIBS -lz"
1253                 AC_TRY_LINK_FUNC([deflate], [AC_DEFINE([HAVE_LIBZ])],
1254                         [
1255                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1256                         ]
1257                 )
1258         ]
1259 )
1260
1261 AC_ARG_WITH([zlib-version-check],
1262         [  --without-zlib-version-check Disable zlib version check],
1263         [  if test "x$withval" = "xno" ; then
1264                 zlib_check_nonfatal=1
1265            fi
1266         ]
1267 )
1268
1269 AC_MSG_CHECKING([for possibly buggy zlib])
1270 AC_RUN_IFELSE([AC_LANG_PROGRAM([[
1271 #include <stdio.h>
1272 #include <stdlib.h>
1273 #include <zlib.h>
1274         ]],
1275         [[
1276         int a=0, b=0, c=0, d=0, n, v;
1277         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1278         if (n != 3 && n != 4)
1279                 exit(1);
1280         v = a*1000000 + b*10000 + c*100 + d;
1281         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1282
1283         /* 1.1.4 is OK */
1284         if (a == 1 && b == 1 && c >= 4)
1285                 exit(0);
1286
1287         /* 1.2.3 and up are OK */
1288         if (v >= 1020300)
1289                 exit(0);
1290
1291         exit(2);
1292         ]])],
1293         AC_MSG_RESULT([no]),
1294         [ AC_MSG_RESULT([yes])
1295           if test -z "$zlib_check_nonfatal" ; then
1296                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1297 Your reported zlib version has known security problems.  It's possible your
1298 vendor has fixed these problems without changing the version number.  If you
1299 are sure this is the case, you can disable the check by running
1300 "./configure --without-zlib-version-check".
1301 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1302 See http://www.gzip.org/zlib/ for details.])
1303           else
1304                 AC_MSG_WARN([zlib version may have security problems])
1305           fi
1306         ],
1307         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1308 )
1309
1310 dnl UnixWare 2.x
1311 AC_CHECK_FUNC([strcasecmp],
1312         [], [ AC_CHECK_LIB([resolv], [strcasecmp], [LIBS="$LIBS -lresolv"]) ]
1313 )
1314 AC_CHECK_FUNCS([utimes],
1315         [], [ AC_CHECK_LIB([c89], [utimes], [AC_DEFINE([HAVE_UTIMES])
1316                                         LIBS="$LIBS -lc89"]) ]
1317 )
1318
1319 dnl    Checks for libutil functions
1320 AC_CHECK_HEADERS([bsd/libutil.h libutil.h])
1321 AC_SEARCH_LIBS([fmt_scaled], [util bsd])
1322 AC_SEARCH_LIBS([scan_scaled], [util bsd])
1323 AC_SEARCH_LIBS([login], [util bsd])
1324 AC_SEARCH_LIBS([logout], [util bsd])
1325 AC_SEARCH_LIBS([logwtmp], [util bsd])
1326 AC_SEARCH_LIBS([openpty], [util bsd])
1327 AC_SEARCH_LIBS([updwtmp], [util bsd])
1328 AC_CHECK_FUNCS([fmt_scaled scan_scaled login logout openpty updwtmp logwtmp])
1329
1330 # On some platforms, inet_ntop and gethostbyname may be found in libresolv
1331 # or libnsl.
1332 AC_SEARCH_LIBS([inet_ntop], [resolv nsl])
1333 AC_SEARCH_LIBS([gethostbyname], [resolv nsl])
1334
1335 # "Particular Function Checks"
1336 # see https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Particular-Functions.html
1337 AC_FUNC_STRFTIME
1338 AC_FUNC_MALLOC
1339 AC_FUNC_REALLOC
1340 # autoconf doesn't have AC_FUNC_CALLOC so fake it if malloc returns NULL;
1341 if test "x$ac_cv_func_malloc_0_nonnull" != "xyes"; then
1342         AC_DEFINE(HAVE_CALLOC, 0, [calloc(x, 0) returns NULL])
1343         AC_DEFINE(calloc, rpl_calloc,
1344             [Define to rpl_calloc if the replacement function should be used.])
1345 fi
1346
1347 # Check for ALTDIRFUNC glob() extension
1348 AC_MSG_CHECKING([for GLOB_ALTDIRFUNC support])
1349 AC_EGREP_CPP([FOUNDIT],
1350         [
1351                 #include <glob.h>
1352                 #ifdef GLOB_ALTDIRFUNC
1353                 FOUNDIT
1354                 #endif
1355         ],
1356         [
1357                 AC_DEFINE([GLOB_HAS_ALTDIRFUNC], [1],
1358                         [Define if your system glob() function has
1359                         the GLOB_ALTDIRFUNC extension])
1360                 AC_MSG_RESULT([yes])
1361         ],
1362         [
1363                 AC_MSG_RESULT([no])
1364         ]
1365 )
1366
1367 # Check for g.gl_matchc glob() extension
1368 AC_MSG_CHECKING([for gl_matchc field in glob_t])
1369 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]],
1370         [[ glob_t g; g.gl_matchc = 1; ]])],
1371         [
1372                 AC_DEFINE([GLOB_HAS_GL_MATCHC], [1],
1373                         [Define if your system glob() function has
1374                         gl_matchc options in glob_t])
1375                 AC_MSG_RESULT([yes])
1376         ], [
1377                 AC_MSG_RESULT([no])
1378 ])
1379
1380 # Check for g.gl_statv glob() extension
1381 AC_MSG_CHECKING([for gl_statv and GLOB_KEEPSTAT extensions for glob])
1382 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <glob.h> ]], [[
1383 #ifndef GLOB_KEEPSTAT
1384 #error "glob does not support GLOB_KEEPSTAT extension"
1385 #endif
1386 glob_t g;
1387 g.gl_statv = NULL;
1388 ]])],
1389         [
1390                 AC_DEFINE([GLOB_HAS_GL_STATV], [1],
1391                         [Define if your system glob() function has
1392                         gl_statv options in glob_t])
1393                 AC_MSG_RESULT([yes])
1394         ], [
1395                 AC_MSG_RESULT([no])
1396
1397 ])
1398
1399 AC_CHECK_DECLS([GLOB_NOMATCH], , , [#include <glob.h>])
1400
1401 AC_CHECK_DECL([VIS_ALL], ,
1402     AC_DEFINE(BROKEN_STRNVIS, 1, [missing VIS_ALL]), [#include <vis.h>])
1403
1404 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1405 AC_RUN_IFELSE(
1406         [AC_LANG_PROGRAM([[
1407 #include <sys/types.h>
1408 #include <dirent.h>]],
1409         [[
1410         struct dirent d;
1411         exit(sizeof(d.d_name)<=sizeof(char));
1412         ]])],
1413         [AC_MSG_RESULT([yes])],
1414         [
1415                 AC_MSG_RESULT([no])
1416                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME], [1],
1417                         [Define if your struct dirent expects you to
1418                         allocate extra space for d_name])
1419         ],
1420         [
1421                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1422                 AC_DEFINE([BROKEN_ONE_BYTE_DIRENT_D_NAME])
1423         ]
1424 )
1425
1426 AC_MSG_CHECKING([for /proc/pid/fd directory])
1427 if test -d "/proc/$$/fd" ; then
1428         AC_DEFINE([HAVE_PROC_PID], [1], [Define if you have /proc/$pid/fd])
1429         AC_MSG_RESULT([yes])
1430 else
1431         AC_MSG_RESULT([no])
1432 fi
1433
1434 # Check whether user wants S/Key support
1435 SKEY_MSG="no"
1436 AC_ARG_WITH([skey],
1437         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1438         [
1439                 if test "x$withval" != "xno" ; then
1440
1441                         if test "x$withval" != "xyes" ; then
1442                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1443                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1444                         fi
1445
1446                         AC_DEFINE([SKEY], [1], [Define if you want S/Key support])
1447                         LIBS="-lskey $LIBS"
1448                         SKEY_MSG="yes"
1449
1450                         AC_MSG_CHECKING([for s/key support])
1451                         AC_LINK_IFELSE(
1452                                 [AC_LANG_PROGRAM([[
1453 #include <stdio.h>
1454 #include <skey.h>
1455                                 ]], [[
1456         char *ff = skey_keyinfo(""); ff="";
1457         exit(0);
1458                                 ]])],
1459                                 [AC_MSG_RESULT([yes])],
1460                                 [
1461                                         AC_MSG_RESULT([no])
1462                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1463                                 ])
1464                         AC_MSG_CHECKING([if skeychallenge takes 4 arguments])
1465                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
1466 #include <stdio.h>
1467 #include <skey.h>
1468                                 ]], [[
1469         (void)skeychallenge(NULL,"name","",0);
1470                                 ]])],
1471                         [
1472                                 AC_MSG_RESULT([yes])
1473                                 AC_DEFINE([SKEYCHALLENGE_4ARG], [1],
1474                                         [Define if your skeychallenge()
1475                                         function takes 4 arguments (NetBSD)])],
1476                         [
1477                                 AC_MSG_RESULT([no])
1478                         ])
1479                 fi
1480         ]
1481 )
1482
1483 # Check whether user wants TCP wrappers support
1484 TCPW_MSG="no"
1485 AC_ARG_WITH([tcp-wrappers],
1486         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1487         [
1488                 if test "x$withval" != "xno" ; then
1489                         saved_LIBS="$LIBS"
1490                         saved_LDFLAGS="$LDFLAGS"
1491                         saved_CPPFLAGS="$CPPFLAGS"
1492                         if test -n "${withval}" && \
1493                             test "x${withval}" != "xyes"; then
1494                                 if test -d "${withval}/lib"; then
1495                                         if test -n "${need_dash_r}"; then
1496                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1497                                         else
1498                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1499                                         fi
1500                                 else
1501                                         if test -n "${need_dash_r}"; then
1502                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1503                                         else
1504                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1505                                         fi
1506                                 fi
1507                                 if test -d "${withval}/include"; then
1508                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1509                                 else
1510                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1511                                 fi
1512                         fi
1513                         LIBS="-lwrap $LIBS"
1514                         AC_MSG_CHECKING([for libwrap])
1515                         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
1516 #include <sys/types.h>
1517 #include <sys/socket.h>
1518 #include <netinet/in.h>
1519 #include <tcpd.h>
1520 int deny_severity = 0, allow_severity = 0;
1521                                 ]], [[
1522         hosts_access(0);
1523                                 ]])], [
1524                                         AC_MSG_RESULT([yes])
1525                                         AC_DEFINE([LIBWRAP], [1],
1526                                                 [Define if you want
1527                                                 TCP Wrappers support])
1528                                         SSHDLIBS="$SSHDLIBS -lwrap"
1529                                         TCPW_MSG="yes"
1530                                 ], [
1531                                         AC_MSG_ERROR([*** libwrap missing])
1532                         ])
1533                         LIBS="$saved_LIBS"
1534                 fi
1535         ]
1536 )
1537
1538 # Check whether user wants to use ldns
1539 LDNS_MSG="no"
1540 AC_ARG_WITH(ldns,
1541         [  --with-ldns[[=PATH]]      Use ldns for DNSSEC support (optionally in PATH)],
1542         [
1543         ldns=""
1544         if test "x$withval" = "xyes" ; then
1545                 AC_PATH_TOOL([LDNSCONFIG], [ldns-config], [no])
1546                 if test "x$PKGCONFIG" = "xno"; then
1547                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1548                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1549                         LIBS="-lldns $LIBS"
1550                         ldns=yes
1551                 else
1552                         LIBS="$LIBS `$LDNSCONFIG --libs`"
1553                         CPPFLAGS="$CPPFLAGS `$LDNSCONFIG --cflags`"
1554                         ldns=yes
1555                 fi
1556         elif test "x$withval" != "xno" ; then
1557                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1558                         LDFLAGS="$LDFLAGS -L${withval}/lib"
1559                         LIBS="-lldns $LIBS"
1560                         ldns=yes
1561         fi
1562
1563         # Verify that it works.
1564         if test "x$ldns" = "xyes" ; then
1565                 AC_DEFINE(HAVE_LDNS, 1, [Define if you want ldns support])
1566                 LDNS_MSG="yes"
1567                 AC_MSG_CHECKING([for ldns support])
1568                 AC_LINK_IFELSE(
1569                         [AC_LANG_SOURCE([[
1570 #include <stdio.h>
1571 #include <stdlib.h>
1572 #include <stdint.h>
1573 #include <ldns/ldns.h>
1574 int main() { ldns_status status = ldns_verify_trusted(NULL, NULL, NULL, NULL); status=LDNS_STATUS_OK; exit(0); }
1575                         ]])
1576                 ],
1577                         [AC_MSG_RESULT(yes)],
1578                                 [
1579                                         AC_MSG_RESULT(no)
1580                                         AC_MSG_ERROR([** Incomplete or missing ldns libraries.])
1581                                 ])
1582         fi
1583 ])
1584
1585 # Check whether user wants libedit support
1586 LIBEDIT_MSG="no"
1587 AC_ARG_WITH([libedit],
1588         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1589         [ if test "x$withval" != "xno" ; then
1590                 if test "x$withval" = "xyes" ; then
1591                         AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
1592                         if test "x$PKGCONFIG" != "xno"; then
1593                                 AC_MSG_CHECKING([if $PKGCONFIG knows about libedit])
1594                                 if "$PKGCONFIG" libedit; then
1595                                         AC_MSG_RESULT([yes])
1596                                         use_pkgconfig_for_libedit=yes
1597                                 else
1598                                         AC_MSG_RESULT([no])
1599                                 fi
1600                         fi
1601                 else
1602                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1603                         if test -n "${need_dash_r}"; then
1604                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1605                         else
1606                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1607                         fi
1608                 fi
1609                 if test "x$use_pkgconfig_for_libedit" = "xyes"; then
1610                         LIBEDIT=`$PKGCONFIG --libs libedit`
1611                         CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
1612                 else
1613                         LIBEDIT="-ledit -lcurses"
1614                 fi
1615                 OTHERLIBS=`echo $LIBEDIT | sed 's/-ledit//'`
1616                 AC_CHECK_LIB([edit], [el_init],
1617                         [ AC_DEFINE([USE_LIBEDIT], [1], [Use libedit for sftp])
1618                           LIBEDIT_MSG="yes"
1619                           AC_SUBST([LIBEDIT])
1620                         ],
1621                         [ AC_MSG_ERROR([libedit not found]) ],
1622                         [ $OTHERLIBS ]
1623                 )
1624                 AC_MSG_CHECKING([if libedit version is compatible])
1625                 AC_COMPILE_IFELSE(
1626                     [AC_LANG_PROGRAM([[ #include <histedit.h> ]],
1627                     [[
1628         int i = H_SETSIZE;
1629         el_init("", NULL, NULL, NULL);
1630         exit(0);
1631                     ]])],
1632                     [ AC_MSG_RESULT([yes]) ],
1633                     [ AC_MSG_RESULT([no])
1634                       AC_MSG_ERROR([libedit version is not compatible]) ]
1635                 )
1636         fi ]
1637 )
1638
1639 AUDIT_MODULE=none
1640 AC_ARG_WITH([audit],
1641         [  --with-audit=module     Enable audit support (modules=debug,bsm,linux)],
1642         [
1643           AC_MSG_CHECKING([for supported audit module])
1644           case "$withval" in
1645           bsm)
1646                 AC_MSG_RESULT([bsm])
1647                 AUDIT_MODULE=bsm
1648                 dnl    Checks for headers, libs and functions
1649                 AC_CHECK_HEADERS([bsm/audit.h], [],
1650                     [AC_MSG_ERROR([BSM enabled and bsm/audit.h not found])],
1651                     [
1652 #ifdef HAVE_TIME_H
1653 # include <time.h>
1654 #endif
1655                     ]
1656 )
1657                 AC_CHECK_LIB([bsm], [getaudit], [],
1658                     [AC_MSG_ERROR([BSM enabled and required library not found])])
1659                 AC_CHECK_FUNCS([getaudit], [],
1660                     [AC_MSG_ERROR([BSM enabled and required function not found])])
1661                 # These are optional
1662                 AC_CHECK_FUNCS([getaudit_addr aug_get_machine])
1663                 AC_DEFINE([USE_BSM_AUDIT], [1], [Use BSM audit module])
1664                 if test "$sol2ver" -ge 11; then
1665                         SSHDLIBS="$SSHDLIBS -lscf"
1666                         AC_DEFINE([BROKEN_BSM_API], [1],
1667                                 [The system has incomplete BSM API])
1668                 fi
1669                 ;;
1670           linux)
1671                 AC_MSG_RESULT([linux])
1672                 AUDIT_MODULE=linux
1673                 dnl    Checks for headers, libs and functions
1674                 AC_CHECK_HEADERS([libaudit.h])
1675                 SSHDLIBS="$SSHDLIBS -laudit"
1676                 AC_DEFINE([USE_LINUX_AUDIT], [1], [Use Linux audit module])
1677                 ;;
1678           debug)
1679                 AUDIT_MODULE=debug
1680                 AC_MSG_RESULT([debug])
1681                 AC_DEFINE([SSH_AUDIT_EVENTS], [1], [Use audit debugging module])
1682                 ;;
1683           no)
1684                 AC_MSG_RESULT([no])
1685                 ;;
1686           *)
1687                 AC_MSG_ERROR([Unknown audit module $withval])
1688                 ;;
1689         esac ]
1690 )
1691
1692 AC_ARG_WITH([pie],
1693     [  --with-pie              Build Position Independent Executables if possible], [
1694         if test "x$withval" = "xno"; then
1695                 use_pie=no
1696         fi
1697         if test "x$withval" = "xyes"; then
1698                 use_pie=yes
1699         fi
1700     ]
1701 )
1702 if test "x$use_pie" = "x"; then
1703         use_pie=no
1704 fi
1705 if test "x$use_toolchain_hardening" != "x1" && test "x$use_pie" = "xauto"; then
1706         # Turn off automatic PIE when toolchain hardening is off.
1707         use_pie=no
1708 fi
1709 if test "x$use_pie" = "xauto"; then
1710         # Automatic PIE requires gcc >= 4.x
1711         AC_MSG_CHECKING([for gcc >= 4.x])
1712         AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
1713 #if !defined(__GNUC__) || __GNUC__ < 4
1714 #error gcc is too old
1715 #endif
1716 ]])],
1717         [ AC_MSG_RESULT([yes]) ],
1718         [ AC_MSG_RESULT([no])
1719           use_pie=no ]
1720 )
1721 fi
1722 if test "x$use_pie" != "xno"; then
1723         SAVED_CFLAGS="$CFLAGS"
1724         SAVED_LDFLAGS="$LDFLAGS"
1725         OSSH_CHECK_CFLAG_COMPILE([-fPIE])
1726         OSSH_CHECK_LDFLAG_LINK([-pie])
1727         # We use both -fPIE and -pie or neither.
1728         AC_MSG_CHECKING([whether both -fPIE and -pie are supported])
1729         if echo "x $CFLAGS"  | grep ' -fPIE' >/dev/null 2>&1 && \
1730            echo "x $LDFLAGS" | grep ' -pie'  >/dev/null 2>&1 ; then
1731                 AC_MSG_RESULT([yes])
1732         else
1733                 AC_MSG_RESULT([no])
1734                 CFLAGS="$SAVED_CFLAGS"
1735                 LDFLAGS="$SAVED_LDFLAGS"
1736         fi
1737 fi
1738
1739 dnl    Checks for library functions. Please keep in alphabetical order
1740 AC_CHECK_FUNCS([ \
1741         Blowfish_initstate \
1742         Blowfish_expandstate \
1743         Blowfish_expand0state \
1744         Blowfish_stream2word \
1745         asprintf \
1746         b64_ntop \
1747         __b64_ntop \
1748         b64_pton \
1749         __b64_pton \
1750         bcopy \
1751         bcrypt_pbkdf \
1752         bindresvport_sa \
1753         blf_enc \
1754         cap_rights_limit \
1755         clock \
1756         closefrom \
1757         dirfd \
1758         endgrent \
1759         err \
1760         errx \
1761         explicit_bzero \
1762         fchmod \
1763         fchown \
1764         freeaddrinfo \
1765         freezero \
1766         fstatfs \
1767         fstatvfs \
1768         futimes \
1769         getaddrinfo \
1770         getcwd \
1771         getgrouplist \
1772         getnameinfo \
1773         getopt \
1774         getpagesize \
1775         getpeereid \
1776         getpeerucred \
1777         getpgid \
1778         getpgrp \
1779         _getpty \
1780         getrlimit \
1781         getttyent \
1782         glob \
1783         group_from_gid \
1784         inet_aton \
1785         inet_ntoa \
1786         inet_ntop \
1787         innetgr \
1788         llabs \
1789         login_getcapbool \
1790         md5_crypt \
1791         memmove \
1792         memset_s \
1793         mkdtemp \
1794         ngetaddrinfo \
1795         nsleep \
1796         ogetaddrinfo \
1797         openlog_r \
1798         pledge \
1799         poll \
1800         prctl \
1801         pstat \
1802         readpassphrase \
1803         reallocarray \
1804         recvmsg \
1805         recallocarray \
1806         rresvport_af \
1807         sendmsg \
1808         setdtablesize \
1809         setegid \
1810         setenv \
1811         seteuid \
1812         setgroupent \
1813         setgroups \
1814         setlinebuf \
1815         setlogin \
1816         setpassent\
1817         setpcred \
1818         setproctitle \
1819         setregid \
1820         setreuid \
1821         setrlimit \
1822         setsid \
1823         setvbuf \
1824         sigaction \
1825         sigvec \
1826         snprintf \
1827         socketpair \
1828         statfs \
1829         statvfs \
1830         strcasestr \
1831         strdup \
1832         strerror \
1833         strlcat \
1834         strlcpy \
1835         strmode \
1836         strnlen \
1837         strnvis \
1838         strptime \
1839         strsignal \
1840         strtonum \
1841         strtoll \
1842         strtoul \
1843         strtoull \
1844         swap32 \
1845         sysconf \
1846         tcgetpgrp \
1847         timingsafe_bcmp \
1848         truncate \
1849         unsetenv \
1850         updwtmpx \
1851         user_from_uid \
1852         usleep \
1853         vasprintf \
1854         vsnprintf \
1855         waitpid \
1856         warn \
1857 ])
1858
1859 dnl Wide character support.
1860 AC_CHECK_FUNCS([mblen mbtowc nl_langinfo wcwidth])
1861
1862 TEST_SSH_UTF8=${TEST_SSH_UTF8:=yes}
1863 AC_MSG_CHECKING([for utf8 locale support])
1864 AC_RUN_IFELSE(
1865         [AC_LANG_PROGRAM([[
1866 #include <locale.h>
1867 #include <stdlib.h>
1868         ]], [[
1869         char *loc = setlocale(LC_CTYPE, "en_US.UTF-8");
1870         if (loc != NULL)
1871                 exit(0);
1872         exit(1);
1873         ]])],
1874         AC_MSG_RESULT(yes),
1875         [AC_MSG_RESULT(no)
1876          TEST_SSH_UTF8=no],
1877         AC_MSG_WARN([cross compiling: assuming yes])
1878 )
1879
1880 AC_LINK_IFELSE(
1881         [AC_LANG_PROGRAM(
1882            [[ #include <ctype.h> ]],
1883            [[ return (isblank('a')); ]])],
1884         [AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])
1885 ])
1886
1887 disable_pkcs11=
1888 AC_ARG_ENABLE([pkcs11],
1889         [  --disable-pkcs11        disable PKCS#11 support code [no]],
1890         [
1891                 if test "x$enableval" = "xno" ; then
1892                         disable_pkcs11=1
1893                 fi
1894         ]
1895 )
1896
1897 # PKCS11 depends on OpenSSL.
1898 if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then
1899         # PKCS#11 support requires dlopen() and co
1900         AC_SEARCH_LIBS([dlopen], [dl],
1901             [AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support])]
1902         )
1903 fi
1904
1905 # IRIX has a const char return value for gai_strerror()
1906 AC_CHECK_FUNCS([gai_strerror], [
1907         AC_DEFINE([HAVE_GAI_STRERROR])
1908         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
1909 #include <sys/types.h>
1910 #include <sys/socket.h>
1911 #include <netdb.h>
1912
1913 const char *gai_strerror(int);
1914                         ]], [[
1915         char *str;
1916         str = gai_strerror(0);
1917                         ]])], [
1918                 AC_DEFINE([HAVE_CONST_GAI_STRERROR_PROTO], [1],
1919                 [Define if gai_strerror() returns const char *])], [])])
1920
1921 AC_SEARCH_LIBS([nanosleep], [rt posix4], [AC_DEFINE([HAVE_NANOSLEEP], [1],
1922         [Some systems put nanosleep outside of libc])])
1923
1924 AC_SEARCH_LIBS([clock_gettime], [rt],
1925         [AC_DEFINE([HAVE_CLOCK_GETTIME], [1], [Have clock_gettime])])
1926
1927 dnl Make sure prototypes are defined for these before using them.
1928 AC_CHECK_DECL([getrusage], [AC_CHECK_FUNCS([getrusage])])
1929 AC_CHECK_DECL([strsep],
1930         [AC_CHECK_FUNCS([strsep])],
1931         [],
1932         [
1933 #ifdef HAVE_STRING_H
1934 # include <string.h>
1935 #endif
1936         ])
1937
1938 dnl tcsendbreak might be a macro
1939 AC_CHECK_DECL([tcsendbreak],
1940         [AC_DEFINE([HAVE_TCSENDBREAK])],
1941         [AC_CHECK_FUNCS([tcsendbreak])],
1942         [#include <termios.h>]
1943 )
1944
1945 AC_CHECK_DECLS([h_errno], , ,[#include <netdb.h>])
1946
1947 AC_CHECK_DECLS([SHUT_RD], , ,
1948         [
1949 #include <sys/types.h>
1950 #include <sys/socket.h>
1951         ])
1952
1953 AC_CHECK_DECLS([O_NONBLOCK], , ,
1954         [
1955 #include <sys/types.h>
1956 #ifdef HAVE_SYS_STAT_H
1957 # include <sys/stat.h>
1958 #endif
1959 #ifdef HAVE_FCNTL_H
1960 # include <fcntl.h>
1961 #endif
1962         ])
1963
1964 AC_CHECK_DECLS([writev], , , [
1965 #include <sys/types.h>
1966 #include <sys/uio.h>
1967 #include <unistd.h>
1968         ])
1969
1970 AC_CHECK_DECLS([MAXSYMLINKS], , , [
1971 #include <sys/param.h>
1972         ])
1973
1974 AC_CHECK_DECLS([offsetof], , , [
1975 #include <stddef.h>
1976         ])
1977
1978 # extra bits for select(2)
1979 AC_CHECK_DECLS([howmany, NFDBITS], [], [], [[
1980 #include <sys/param.h>
1981 #include <sys/types.h>
1982 #ifdef HAVE_SYS_SYSMACROS_H
1983 #include <sys/sysmacros.h>
1984 #endif
1985 #ifdef HAVE_SYS_SELECT_H
1986 #include <sys/select.h>
1987 #endif
1988 #ifdef HAVE_SYS_TIME_H
1989 #include <sys/time.h>
1990 #endif
1991 #ifdef HAVE_UNISTD_H
1992 #include <unistd.h>
1993 #endif
1994         ]])
1995 AC_CHECK_TYPES([fd_mask], [], [], [[
1996 #include <sys/param.h>
1997 #include <sys/types.h>
1998 #ifdef HAVE_SYS_SELECT_H
1999 #include <sys/select.h>
2000 #endif
2001 #ifdef HAVE_SYS_TIME_H
2002 #include <sys/time.h>
2003 #endif
2004 #ifdef HAVE_UNISTD_H
2005 #include <unistd.h>
2006 #endif
2007         ]])
2008
2009 AC_CHECK_FUNCS([setresuid], [
2010         dnl Some platorms have setresuid that isn't implemented, test for this
2011         AC_MSG_CHECKING([if setresuid seems to work])
2012         AC_RUN_IFELSE(
2013                 [AC_LANG_PROGRAM([[
2014 #include <stdlib.h>
2015 #include <errno.h>
2016                 ]], [[
2017         errno=0;
2018         setresuid(0,0,0);
2019         if (errno==ENOSYS)
2020                 exit(1);
2021         else
2022                 exit(0);
2023                 ]])],
2024                 [AC_MSG_RESULT([yes])],
2025                 [AC_DEFINE([BROKEN_SETRESUID], [1],
2026                         [Define if your setresuid() is broken])
2027                  AC_MSG_RESULT([not implemented])],
2028                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2029         )
2030 ])
2031
2032 AC_CHECK_FUNCS([setresgid], [
2033         dnl Some platorms have setresgid that isn't implemented, test for this
2034         AC_MSG_CHECKING([if setresgid seems to work])
2035         AC_RUN_IFELSE(
2036                 [AC_LANG_PROGRAM([[
2037 #include <stdlib.h>
2038 #include <errno.h>
2039                 ]], [[
2040         errno=0;
2041         setresgid(0,0,0);
2042         if (errno==ENOSYS)
2043                 exit(1);
2044         else
2045                 exit(0);
2046                 ]])],
2047                 [AC_MSG_RESULT([yes])],
2048                 [AC_DEFINE([BROKEN_SETRESGID], [1],
2049                         [Define if your setresgid() is broken])
2050                  AC_MSG_RESULT([not implemented])],
2051                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
2052         )
2053 ])
2054
2055 AC_CHECK_FUNCS([realpath], [
2056         dnl the sftp v3 spec says SSH_FXP_REALPATH will "canonicalize any given
2057         dnl path name", however some implementations of realpath (and some
2058         dnl versions of the POSIX spec) do not work on non-existent files,
2059         dnl so we use the OpenBSD implementation on those platforms.
2060         AC_MSG_CHECKING([if realpath works with non-existent files])
2061         AC_RUN_IFELSE(
2062                 [AC_LANG_PROGRAM([[
2063 #include <limits.h>
2064 #include <stdlib.h>
2065 #include <errno.h>
2066                 ]], [[
2067                 char buf[PATH_MAX];
2068                 if (realpath("/opensshnonexistentfilename1234", buf) == NULL)
2069                         if (errno == ENOENT)
2070                                 exit(1);
2071                 exit(0);
2072                 ]])],
2073                 [AC_MSG_RESULT([yes])],
2074                 [AC_DEFINE([BROKEN_REALPATH], [1],
2075                         [realpath does not work with nonexistent files])
2076                  AC_MSG_RESULT([no])],
2077                 [AC_MSG_WARN([cross compiling: assuming working])]
2078         )
2079 ])
2080
2081 dnl    Checks for time functions
2082 AC_CHECK_FUNCS([gettimeofday time])
2083 dnl    Checks for utmp functions
2084 AC_CHECK_FUNCS([endutent getutent getutid getutline pututline setutent])
2085 AC_CHECK_FUNCS([utmpname])
2086 dnl    Checks for utmpx functions
2087 AC_CHECK_FUNCS([endutxent getutxent getutxid getutxline getutxuser pututxline])
2088 AC_CHECK_FUNCS([setutxdb setutxent utmpxname])
2089 dnl    Checks for lastlog functions
2090 AC_CHECK_FUNCS([getlastlogxbyname])
2091
2092 AC_CHECK_FUNC([daemon],
2093         [AC_DEFINE([HAVE_DAEMON], [1], [Define if your libraries define daemon()])],
2094         [AC_CHECK_LIB([bsd], [daemon],
2095                 [LIBS="$LIBS -lbsd"; AC_DEFINE([HAVE_DAEMON])])]
2096 )
2097
2098 AC_CHECK_FUNC([getpagesize],
2099         [AC_DEFINE([HAVE_GETPAGESIZE], [1],
2100                 [Define if your libraries define getpagesize()])],
2101         [AC_CHECK_LIB([ucb], [getpagesize],
2102                 [LIBS="$LIBS -lucb"; AC_DEFINE([HAVE_GETPAGESIZE])])]
2103 )
2104
2105 # Check for broken snprintf
2106 if test "x$ac_cv_func_snprintf" = "xyes" ; then
2107         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
2108         AC_RUN_IFELSE(
2109                 [AC_LANG_PROGRAM([[ #include <stdio.h> ]],
2110                 [[
2111         char b[5];
2112         snprintf(b,5,"123456789");
2113         exit(b[4]!='\0');
2114                 ]])],
2115                 [AC_MSG_RESULT([yes])],
2116                 [
2117                         AC_MSG_RESULT([no])
2118                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2119                                 [Define if your snprintf is busted])
2120                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
2121                 ],
2122                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
2123         )
2124 fi
2125
2126 # We depend on vsnprintf returning the right thing on overflow: the
2127 # number of characters it tried to create (as per SUSv3)
2128 if test "x$ac_cv_func_vsnprintf" = "xyes" ; then
2129         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
2130         AC_RUN_IFELSE(
2131                 [AC_LANG_PROGRAM([[
2132 #include <sys/types.h>
2133 #include <stdio.h>
2134 #include <stdarg.h>
2135
2136 int x_snprintf(char *str, size_t count, const char *fmt, ...)
2137 {
2138         size_t ret;
2139         va_list ap;
2140
2141         va_start(ap, fmt);
2142         ret = vsnprintf(str, count, fmt, ap);
2143         va_end(ap);
2144         return ret;
2145 }
2146                 ]], [[
2147 char x[1];
2148 if (x_snprintf(x, 1, "%s %d", "hello", 12345) != 11)
2149         return 1;
2150 if (x_snprintf(NULL, 0, "%s %d", "hello", 12345) != 11)
2151         return 1;
2152 return 0;
2153                 ]])],
2154                 [AC_MSG_RESULT([yes])],
2155                 [
2156                         AC_MSG_RESULT([no])
2157                         AC_DEFINE([BROKEN_SNPRINTF], [1],
2158                                 [Define if your snprintf is busted])
2159                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
2160                 ],
2161                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
2162         )
2163 fi
2164
2165 # On systems where [v]snprintf is broken, but is declared in stdio,
2166 # check that the fmt argument is const char * or just char *.
2167 # This is only useful for when BROKEN_SNPRINTF
2168 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
2169 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2170 #include <stdio.h>
2171 int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
2172                 ]], [[
2173         snprintf(0, 0, 0);
2174                 ]])],
2175    [AC_MSG_RESULT([yes])
2176     AC_DEFINE([SNPRINTF_CONST], [const],
2177               [Define as const if snprintf() can declare const char *fmt])],
2178    [AC_MSG_RESULT([no])
2179     AC_DEFINE([SNPRINTF_CONST], [/* not const */])])
2180
2181 # Check for missing getpeereid (or equiv) support
2182 NO_PEERCHECK=""
2183 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
2184         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
2185         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2186 #include <sys/types.h>
2187 #include <sys/socket.h>]], [[int i = SO_PEERCRED;]])],
2188                 [ AC_MSG_RESULT([yes])
2189                   AC_DEFINE([HAVE_SO_PEERCRED], [1], [Have PEERCRED socket option])
2190                 ], [AC_MSG_RESULT([no])
2191                 NO_PEERCHECK=1
2192         ])
2193 fi
2194
2195 dnl see whether mkstemp() requires XXXXXX
2196 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
2197 AC_MSG_CHECKING([for (overly) strict mkstemp])
2198 AC_RUN_IFELSE(
2199         [AC_LANG_PROGRAM([[
2200 #include <stdlib.h>
2201         ]], [[
2202         char template[]="conftest.mkstemp-test";
2203         if (mkstemp(template) == -1)
2204                 exit(1);
2205         unlink(template);
2206         exit(0);
2207         ]])],
2208         [
2209                 AC_MSG_RESULT([no])
2210         ],
2211         [
2212                 AC_MSG_RESULT([yes])
2213                 AC_DEFINE([HAVE_STRICT_MKSTEMP], [1], [Silly mkstemp()])
2214         ],
2215         [
2216                 AC_MSG_RESULT([yes])
2217                 AC_DEFINE([HAVE_STRICT_MKSTEMP])
2218         ]
2219 )
2220 fi
2221
2222 dnl make sure that openpty does not reacquire controlling terminal
2223 if test ! -z "$check_for_openpty_ctty_bug"; then
2224         AC_MSG_CHECKING([if openpty correctly handles controlling tty])
2225         AC_RUN_IFELSE(
2226                 [AC_LANG_PROGRAM([[
2227 #include <stdio.h>
2228 #include <sys/fcntl.h>
2229 #include <sys/types.h>
2230 #include <sys/wait.h>
2231                 ]], [[
2232         pid_t pid;
2233         int fd, ptyfd, ttyfd, status;
2234
2235         pid = fork();
2236         if (pid < 0) {          /* failed */
2237                 exit(1);
2238         } else if (pid > 0) {   /* parent */
2239                 waitpid(pid, &status, 0);
2240                 if (WIFEXITED(status))
2241                         exit(WEXITSTATUS(status));
2242                 else
2243                         exit(2);
2244         } else {                /* child */
2245                 close(0); close(1); close(2);
2246                 setsid();
2247                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
2248                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
2249                 if (fd >= 0)
2250                         exit(3);        /* Acquired ctty: broken */
2251                 else
2252                         exit(0);        /* Did not acquire ctty: OK */
2253         }
2254                 ]])],
2255                 [
2256                         AC_MSG_RESULT([yes])
2257                 ],
2258                 [
2259                         AC_MSG_RESULT([no])
2260                         AC_DEFINE([SSHD_ACQUIRES_CTTY])
2261                 ],
2262                 [
2263                         AC_MSG_RESULT([cross-compiling, assuming yes])
2264                 ]
2265         )
2266 fi
2267
2268 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2269     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
2270         AC_MSG_CHECKING([if getaddrinfo seems to work])
2271         AC_RUN_IFELSE(
2272                 [AC_LANG_PROGRAM([[
2273 #include <stdio.h>
2274 #include <sys/socket.h>
2275 #include <netdb.h>
2276 #include <errno.h>
2277 #include <netinet/in.h>
2278
2279 #define TEST_PORT "2222"
2280                 ]], [[
2281         int err, sock;
2282         struct addrinfo *gai_ai, *ai, hints;
2283         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2284
2285         memset(&hints, 0, sizeof(hints));
2286         hints.ai_family = PF_UNSPEC;
2287         hints.ai_socktype = SOCK_STREAM;
2288         hints.ai_flags = AI_PASSIVE;
2289
2290         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2291         if (err != 0) {
2292                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2293                 exit(1);
2294         }
2295
2296         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2297                 if (ai->ai_family != AF_INET6)
2298                         continue;
2299
2300                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2301                     sizeof(ntop), strport, sizeof(strport),
2302                     NI_NUMERICHOST|NI_NUMERICSERV);
2303
2304                 if (err != 0) {
2305                         if (err == EAI_SYSTEM)
2306                                 perror("getnameinfo EAI_SYSTEM");
2307                         else
2308                                 fprintf(stderr, "getnameinfo failed: %s\n",
2309                                     gai_strerror(err));
2310                         exit(2);
2311                 }
2312
2313                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
2314                 if (sock < 0)
2315                         perror("socket");
2316                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2317                         if (errno == EBADF)
2318                                 exit(3);
2319                 }
2320         }
2321         exit(0);
2322                 ]])],
2323                 [
2324                         AC_MSG_RESULT([yes])
2325                 ],
2326                 [
2327                         AC_MSG_RESULT([no])
2328                         AC_DEFINE([BROKEN_GETADDRINFO])
2329                 ],
2330                 [
2331                         AC_MSG_RESULT([cross-compiling, assuming yes])
2332                 ]
2333         )
2334 fi
2335
2336 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
2337     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
2338         AC_MSG_CHECKING([if getaddrinfo seems to work])
2339         AC_RUN_IFELSE(
2340                 [AC_LANG_PROGRAM([[
2341 #include <stdio.h>
2342 #include <sys/socket.h>
2343 #include <netdb.h>
2344 #include <errno.h>
2345 #include <netinet/in.h>
2346
2347 #define TEST_PORT "2222"
2348                 ]], [[
2349         int err, sock;
2350         struct addrinfo *gai_ai, *ai, hints;
2351         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
2352
2353         memset(&hints, 0, sizeof(hints));
2354         hints.ai_family = PF_UNSPEC;
2355         hints.ai_socktype = SOCK_STREAM;
2356         hints.ai_flags = AI_PASSIVE;
2357
2358         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
2359         if (err != 0) {
2360                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
2361                 exit(1);
2362         }
2363
2364         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
2365                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2366                         continue;
2367
2368                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
2369                     sizeof(ntop), strport, sizeof(strport),
2370                     NI_NUMERICHOST|NI_NUMERICSERV);
2371
2372                 if (ai->ai_family == AF_INET && err != 0) {
2373                         perror("getnameinfo");
2374                         exit(2);
2375                 }
2376         }
2377         exit(0);
2378                 ]])],
2379                 [
2380                         AC_MSG_RESULT([yes])
2381                         AC_DEFINE([AIX_GETNAMEINFO_HACK], [1],
2382                                 [Define if you have a getaddrinfo that fails
2383                                 for the all-zeros IPv6 address])
2384                 ],
2385                 [
2386                         AC_MSG_RESULT([no])
2387                         AC_DEFINE([BROKEN_GETADDRINFO])
2388                 ],
2389                 [
2390                         AC_MSG_RESULT([cross-compiling, assuming no])
2391                 ]
2392         )
2393 fi
2394
2395 if test "x$ac_cv_func_getaddrinfo" = "xyes"; then
2396         AC_CHECK_DECLS(AI_NUMERICSERV, , ,
2397             [#include <sys/types.h>
2398              #include <sys/socket.h>
2399              #include <netdb.h>])
2400 fi
2401
2402 if test "x$check_for_conflicting_getspnam" = "x1"; then
2403         AC_MSG_CHECKING([for conflicting getspnam in shadow.h])
2404         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <shadow.h> ]],
2405                 [[ exit(0); ]])],
2406                 [
2407                         AC_MSG_RESULT([no])
2408                 ],
2409                 [
2410                         AC_MSG_RESULT([yes])
2411                         AC_DEFINE([GETSPNAM_CONFLICTING_DEFS], [1],
2412                             [Conflicting defs for getspnam])
2413                 ]
2414         )
2415 fi
2416
2417 dnl NetBSD added an strnvis and unfortunately made it incompatible with the
2418 dnl existing one in OpenBSD and Linux's libbsd (the former having existed
2419 dnl for over ten years). Despite this incompatibility being reported during
2420 dnl development (see http://gnats.netbsd.org/44977) they still shipped it.
2421 dnl Even more unfortunately FreeBSD and later MacOS picked up this incompatible
2422 dnl implementation.  Try to detect this mess, and assume the only safe option
2423 dnl if we're cross compiling.
2424 dnl
2425 dnl OpenBSD, 2001: strnvis(char *dst, const char *src, size_t dlen, int flag);
2426 dnl NetBSD: 2012,  strnvis(char *dst, size_t dlen, const char *src, int flag);
2427 if test "x$ac_cv_func_strnvis" = "xyes"; then
2428         AC_MSG_CHECKING([for working strnvis])
2429         AC_RUN_IFELSE(
2430                 [AC_LANG_PROGRAM([[
2431 #include <signal.h>
2432 #include <stdlib.h>
2433 #include <string.h>
2434 #include <vis.h>
2435 static void sighandler(int sig) { _exit(1); }
2436                 ]], [[
2437         char dst[16];
2438
2439         signal(SIGSEGV, sighandler);
2440         if (strnvis(dst, "src", 4, 0) && strcmp(dst, "src") == 0)
2441                 exit(0);
2442         exit(1)
2443                 ]])],
2444                 [AC_MSG_RESULT([yes])],
2445                 [AC_MSG_RESULT([no])
2446                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis detected broken])],
2447                 [AC_MSG_WARN([cross compiling: assuming broken])
2448                  AC_DEFINE([BROKEN_STRNVIS], [1], [strnvis assumed broken])]
2449         )
2450 fi
2451
2452 AC_FUNC_GETPGRP
2453
2454 # Search for OpenSSL
2455 saved_CPPFLAGS="$CPPFLAGS"
2456 saved_LDFLAGS="$LDFLAGS"
2457 AC_ARG_WITH([ssl-dir],
2458         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
2459         [
2460                 if test "x$openssl" = "xno" ; then
2461                         AC_MSG_ERROR([cannot use --with-ssl-dir when OpenSSL disabled])
2462                 fi
2463                 if test "x$withval" != "xno" ; then
2464                         case "$withval" in
2465                                 # Relative paths
2466                                 ./*|../*)       withval="`pwd`/$withval"
2467                         esac
2468                         if test -d "$withval/lib"; then
2469                                 if test -n "${need_dash_r}"; then
2470                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
2471                                 else
2472                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
2473                                 fi
2474                         elif test -d "$withval/lib64"; then
2475                                 if test -n "${need_dash_r}"; then
2476                                         LDFLAGS="-L${withval}/lib64 -R${withval}/lib64 ${LDFLAGS}"
2477                                 else
2478                                         LDFLAGS="-L${withval}/lib64 ${LDFLAGS}"
2479                                 fi
2480                         else
2481                                 if test -n "${need_dash_r}"; then
2482                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
2483                                 else
2484                                         LDFLAGS="-L${withval} ${LDFLAGS}"
2485                                 fi
2486                         fi
2487                         if test -d "$withval/include"; then
2488                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
2489                         else
2490                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
2491                         fi
2492                 fi
2493         ]
2494 )
2495
2496 AC_ARG_WITH([openssl-header-check],
2497         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2498         [
2499                 if test "x$withval" = "xno" ; then
2500                         openssl_check_nonfatal=1
2501                 fi
2502         ]
2503 )
2504
2505 openssl_engine=no
2506 AC_ARG_WITH([ssl-engine],
2507         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2508         [
2509                 if test "x$withval" != "xno" ; then
2510                         if test "x$openssl" = "xno" ; then
2511                                 AC_MSG_ERROR([cannot use --with-ssl-engine when OpenSSL disabled])
2512                         fi
2513                         openssl_engine=yes
2514                 fi
2515         ]
2516 )
2517
2518 if test "x$openssl" = "xyes" ; then
2519         LIBS="-lcrypto $LIBS"
2520         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL], [1],
2521                 [Define if your ssl headers are included
2522                 with #include <openssl/header.h>])],
2523                 [
2524                         dnl Check default openssl install dir
2525                         if test -n "${need_dash_r}"; then
2526                                 LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
2527                         else
2528                                 LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
2529                         fi
2530                         CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
2531                         AC_CHECK_HEADER([openssl/opensslv.h], ,
2532                             [AC_MSG_ERROR([*** OpenSSL headers missing - please install first or check config.log ***])])
2533                         AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL])],
2534                                 [
2535                                         AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2536                                 ]
2537                         )
2538                 ]
2539         )
2540
2541         # Determine OpenSSL header version
2542         AC_MSG_CHECKING([OpenSSL header version])
2543         AC_RUN_IFELSE(
2544                 [AC_LANG_PROGRAM([[
2545         #include <stdlib.h>
2546         #include <stdio.h>
2547         #include <string.h>
2548         #include <openssl/opensslv.h>
2549         #define DATA "conftest.sslincver"
2550                 ]], [[
2551                 FILE *fd;
2552                 int rc;
2553
2554                 fd = fopen(DATA,"w");
2555                 if(fd == NULL)
2556                         exit(1);
2557
2558                 if ((rc = fprintf(fd, "%08lx (%s)\n",
2559                     (unsigned long)OPENSSL_VERSION_NUMBER,
2560                      OPENSSL_VERSION_TEXT)) < 0)
2561                         exit(1);
2562
2563                 exit(0);
2564                 ]])],
2565                 [
2566                         ssl_header_ver=`cat conftest.sslincver`
2567                         AC_MSG_RESULT([$ssl_header_ver])
2568                 ],
2569                 [
2570                         AC_MSG_RESULT([not found])
2571                         AC_MSG_ERROR([OpenSSL version header not found.])
2572                 ],
2573                 [
2574                         AC_MSG_WARN([cross compiling: not checking])
2575                 ]
2576         )
2577
2578         # Determine OpenSSL library version
2579         AC_MSG_CHECKING([OpenSSL library version])
2580         AC_RUN_IFELSE(
2581                 [AC_LANG_PROGRAM([[
2582         #include <stdio.h>
2583         #include <string.h>
2584         #include <openssl/opensslv.h>
2585         #include <openssl/crypto.h>
2586         #define DATA "conftest.ssllibver"
2587                 ]], [[
2588                 FILE *fd;
2589                 int rc;
2590
2591                 fd = fopen(DATA,"w");
2592                 if(fd == NULL)
2593                         exit(1);
2594
2595                 if ((rc = fprintf(fd, "%08lx (%s)\n", (unsigned long)SSLeay(),
2596                     SSLeay_version(SSLEAY_VERSION))) < 0)
2597                         exit(1);
2598
2599                 exit(0);
2600                 ]])],
2601                 [
2602                         ssl_library_ver=`cat conftest.ssllibver`
2603                         # Check version is supported.
2604                         case "$ssl_library_ver" in
2605                                 10000*|0*)
2606                                         AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")])
2607                                         ;;
2608                                 100*)   ;; # 1.0.x
2609                                 200*)   ;; # LibreSSL
2610                                 *)
2611                                         AC_MSG_ERROR([OpenSSL >= 1.1.0 is not yet supported (have "$ssl_library_ver")])
2612                                         ;;
2613                         esac
2614                         AC_MSG_RESULT([$ssl_library_ver])
2615                 ],
2616                 [
2617                         AC_MSG_RESULT([not found])
2618                         AC_MSG_ERROR([OpenSSL library not found.])
2619                 ],
2620                 [
2621                         AC_MSG_WARN([cross compiling: not checking])
2622                 ]
2623         )
2624
2625         # Sanity check OpenSSL headers
2626         AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2627         AC_RUN_IFELSE(
2628                 [AC_LANG_PROGRAM([[
2629         #include <string.h>
2630         #include <openssl/opensslv.h>
2631         #include <openssl/crypto.h>
2632                 ]], [[
2633                 exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
2634                 ]])],
2635                 [
2636                         AC_MSG_RESULT([yes])
2637                 ],
2638                 [
2639                         AC_MSG_RESULT([no])
2640                         if test "x$openssl_check_nonfatal" = "x"; then
2641                                 AC_MSG_ERROR([Your OpenSSL headers do not match your
2642         library. Check config.log for details.
2643         If you are sure your installation is consistent, you can disable the check
2644         by running "./configure --without-openssl-header-check".
2645         Also see contrib/findssl.sh for help identifying header/library mismatches.
2646         ])
2647                         else
2648                                 AC_MSG_WARN([Your OpenSSL headers do not match your
2649         library. Check config.log for details.
2650         Also see contrib/findssl.sh for help identifying header/library mismatches.])
2651                         fi
2652                 ],
2653                 [
2654                         AC_MSG_WARN([cross compiling: not checking])
2655                 ]
2656         )
2657
2658         AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2659         AC_LINK_IFELSE(
2660                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2661                 [[ SSLeay_add_all_algorithms(); ]])],
2662                 [
2663                         AC_MSG_RESULT([yes])
2664                 ],
2665                 [
2666                         AC_MSG_RESULT([no])
2667                         saved_LIBS="$LIBS"
2668                         LIBS="$LIBS -ldl"
2669                         AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2670                         AC_LINK_IFELSE(
2671                                 [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
2672                                 [[ SSLeay_add_all_algorithms(); ]])],
2673                                 [
2674                                         AC_MSG_RESULT([yes])
2675                                 ],
2676                                 [
2677                                         AC_MSG_RESULT([no])
2678                                         LIBS="$saved_LIBS"
2679                                 ]
2680                         )
2681                 ]
2682         )
2683
2684         AC_CHECK_FUNCS([ \
2685                 BN_is_prime_ex \
2686                 DSA_generate_parameters_ex \
2687                 EVP_DigestInit_ex \
2688                 EVP_DigestFinal_ex \
2689                 EVP_MD_CTX_init \
2690                 EVP_MD_CTX_cleanup \
2691                 EVP_MD_CTX_copy_ex \
2692                 HMAC_CTX_init \
2693                 RSA_generate_key_ex \
2694                 RSA_get_default_method \
2695         ])
2696
2697         if test "x$openssl_engine" = "xyes" ; then
2698                 AC_MSG_CHECKING([for OpenSSL ENGINE support])
2699                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
2700         #include <openssl/engine.h>
2701                         ]], [[
2702                                 ENGINE_load_builtin_engines();
2703                                 ENGINE_register_all_complete();
2704                         ]])],
2705                         [ AC_MSG_RESULT([yes])
2706                           AC_DEFINE([USE_OPENSSL_ENGINE], [1],
2707                              [Enable OpenSSL engine support])
2708                         ], [ AC_MSG_ERROR([OpenSSL ENGINE support not found])
2709                 ])
2710         fi
2711
2712         # Check for OpenSSL without EVP_aes_{192,256}_cbc
2713         AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2714         AC_LINK_IFELSE(
2715                 [AC_LANG_PROGRAM([[
2716         #include <string.h>
2717         #include <openssl/evp.h>
2718                 ]], [[
2719                 exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
2720                 ]])],
2721                 [
2722                         AC_MSG_RESULT([no])
2723                 ],
2724                 [
2725                         AC_MSG_RESULT([yes])
2726                         AC_DEFINE([OPENSSL_LOBOTOMISED_AES], [1],
2727                             [libcrypto is missing AES 192 and 256 bit functions])
2728                 ]
2729         )
2730
2731         # Check for OpenSSL with EVP_aes_*ctr
2732         AC_MSG_CHECKING([whether OpenSSL has AES CTR via EVP])
2733         AC_LINK_IFELSE(
2734                 [AC_LANG_PROGRAM([[
2735         #include <string.h>
2736         #include <openssl/evp.h>
2737                 ]], [[
2738                 exit(EVP_aes_128_ctr() == NULL ||
2739                     EVP_aes_192_cbc() == NULL ||
2740                     EVP_aes_256_cbc() == NULL);
2741                 ]])],
2742                 [
2743                         AC_MSG_RESULT([yes])
2744                         AC_DEFINE([OPENSSL_HAVE_EVPCTR], [1],
2745                             [libcrypto has EVP AES CTR])
2746                 ],
2747                 [
2748                         AC_MSG_RESULT([no])
2749                 ]
2750         )
2751
2752         # Check for OpenSSL with EVP_aes_*gcm
2753         AC_MSG_CHECKING([whether OpenSSL has AES GCM via EVP])
2754         AC_LINK_IFELSE(
2755                 [AC_LANG_PROGRAM([[
2756         #include <string.h>
2757         #include <openssl/evp.h>
2758                 ]], [[
2759                 exit(EVP_aes_128_gcm() == NULL ||
2760                     EVP_aes_256_gcm() == NULL ||
2761                     EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
2762                     EVP_CTRL_GCM_IV_GEN == 0 ||
2763                     EVP_CTRL_GCM_SET_TAG == 0 ||
2764                     EVP_CTRL_GCM_GET_TAG == 0 ||
2765                     EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
2766                 ]])],
2767                 [
2768                         AC_MSG_RESULT([yes])
2769                         AC_DEFINE([OPENSSL_HAVE_EVPGCM], [1],
2770                             [libcrypto has EVP AES GCM])
2771                 ],
2772                 [
2773                         AC_MSG_RESULT([no])
2774                         unsupported_algorithms="$unsupported_cipers \
2775                            aes128-gcm@openssh.com \
2776                            aes256-gcm@openssh.com"
2777                 ]
2778         )
2779
2780         AC_SEARCH_LIBS([EVP_CIPHER_CTX_ctrl], [crypto],
2781                 [AC_DEFINE([HAVE_EVP_CIPHER_CTX_CTRL], [1],
2782                     [Define if libcrypto has EVP_CIPHER_CTX_ctrl])])
2783
2784         AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
2785         AC_LINK_IFELSE(
2786                 [AC_LANG_PROGRAM([[
2787         #include <string.h>
2788         #include <openssl/evp.h>
2789                 ]], [[
2790                 if(EVP_DigestUpdate(NULL, NULL,0))
2791                         exit(0);
2792                 ]])],
2793                 [
2794                         AC_MSG_RESULT([yes])
2795                 ],
2796                 [
2797                         AC_MSG_RESULT([no])
2798                         AC_DEFINE([OPENSSL_EVP_DIGESTUPDATE_VOID], [1],
2799                             [Define if EVP_DigestUpdate returns void])
2800                 ]
2801         )
2802
2803         # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2804         # because the system crypt() is more featureful.
2805         if test "x$check_for_libcrypt_before" = "x1"; then
2806                 AC_CHECK_LIB([crypt], [crypt])
2807         fi
2808
2809         # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2810         # version in OpenSSL.
2811         if test "x$check_for_libcrypt_later" = "x1"; then
2812                 AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
2813         fi
2814         AC_CHECK_FUNCS([crypt DES_crypt])
2815
2816         # Search for SHA256 support in libc and/or OpenSSL
2817         AC_CHECK_FUNCS([SHA256_Update EVP_sha256], ,
2818             [unsupported_algorithms="$unsupported_algorithms \
2819                 hmac-sha2-256 \
2820                 hmac-sha2-512 \
2821                 diffie-hellman-group-exchange-sha256 \
2822                 hmac-sha2-256-etm@openssh.com \
2823                 hmac-sha2-512-etm@openssh.com"
2824              ]
2825         )
2826         # Search for RIPE-MD support in OpenSSL
2827         AC_CHECK_FUNCS([EVP_ripemd160], ,
2828             [unsupported_algorithms="$unsupported_algorithms \
2829                 hmac-ripemd160 \
2830                 hmac-ripemd160@openssh.com \
2831                 hmac-ripemd160-etm@openssh.com"
2832              ]
2833         )
2834
2835         # Check complete ECC support in OpenSSL
2836         AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1])
2837         AC_LINK_IFELSE(
2838                 [AC_LANG_PROGRAM([[
2839         #include <openssl/ec.h>
2840         #include <openssl/ecdh.h>
2841         #include <openssl/ecdsa.h>
2842         #include <openssl/evp.h>
2843         #include <openssl/objects.h>
2844         #include <openssl/opensslv.h>
2845                 ]], [[
2846                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
2847                 const EVP_MD *m = EVP_sha256(); /* We need this too */
2848                 ]])],
2849                 [ AC_MSG_RESULT([yes])
2850                   enable_nistp256=1 ],
2851                 [ AC_MSG_RESULT([no]) ]
2852         )
2853
2854         AC_MSG_CHECKING([whether OpenSSL has NID_secp384r1])
2855         AC_LINK_IFELSE(
2856                 [AC_LANG_PROGRAM([[
2857         #include <openssl/ec.h>
2858         #include <openssl/ecdh.h>
2859         #include <openssl/ecdsa.h>
2860         #include <openssl/evp.h>
2861         #include <openssl/objects.h>
2862         #include <openssl/opensslv.h>
2863                 ]], [[
2864                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
2865                 const EVP_MD *m = EVP_sha384(); /* We need this too */
2866                 ]])],
2867                 [ AC_MSG_RESULT([yes])
2868                   enable_nistp384=1 ],
2869                 [ AC_MSG_RESULT([no]) ]
2870         )
2871
2872         AC_MSG_CHECKING([whether OpenSSL has NID_secp521r1])
2873         AC_LINK_IFELSE(
2874                 [AC_LANG_PROGRAM([[
2875         #include <openssl/ec.h>
2876         #include <openssl/ecdh.h>
2877         #include <openssl/ecdsa.h>
2878         #include <openssl/evp.h>
2879         #include <openssl/objects.h>
2880         #include <openssl/opensslv.h>
2881                 ]], [[
2882                 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2883                 const EVP_MD *m = EVP_sha512(); /* We need this too */
2884                 ]])],
2885                 [ AC_MSG_RESULT([yes])
2886                   AC_MSG_CHECKING([if OpenSSL's NID_secp521r1 is functional])
2887                   AC_RUN_IFELSE(
2888                         [AC_LANG_PROGRAM([[
2889         #include <openssl/ec.h>
2890         #include <openssl/ecdh.h>
2891         #include <openssl/ecdsa.h>
2892         #include <openssl/evp.h>
2893         #include <openssl/objects.h>
2894         #include <openssl/opensslv.h>
2895                         ]],[[
2896                         EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2897                         const EVP_MD *m = EVP_sha512(); /* We need this too */
2898                         exit(e == NULL || m == NULL);
2899                         ]])],
2900                         [ AC_MSG_RESULT([yes])
2901                           enable_nistp521=1 ],
2902                         [ AC_MSG_RESULT([no]) ],
2903                         [ AC_MSG_WARN([cross-compiling: assuming yes])
2904                           enable_nistp521=1 ]
2905                   )],
2906                 AC_MSG_RESULT([no])
2907         )
2908
2909         COMMENT_OUT_ECC="#no ecc#"
2910         TEST_SSH_ECC=no
2911
2912         if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
2913             test x$enable_nistp521 = x1; then
2914                 AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC])
2915         fi
2916         if test x$enable_nistp256 = x1; then
2917                 AC_DEFINE([OPENSSL_HAS_NISTP256], [1],
2918                     [libcrypto has NID_X9_62_prime256v1])
2919                 TEST_SSH_ECC=yes
2920                 COMMENT_OUT_ECC=""
2921         else
2922                 unsupported_algorithms="$unsupported_algorithms \
2923                         ecdsa-sha2-nistp256 \
2924                         ecdh-sha2-nistp256 \
2925                         ecdsa-sha2-nistp256-cert-v01@openssh.com"
2926         fi
2927         if test x$enable_nistp384 = x1; then
2928                 AC_DEFINE([OPENSSL_HAS_NISTP384], [1], [libcrypto has NID_secp384r1])
2929                 TEST_SSH_ECC=yes
2930                 COMMENT_OUT_ECC=""
2931         else
2932                 unsupported_algorithms="$unsupported_algorithms \
2933                         ecdsa-sha2-nistp384 \
2934                         ecdh-sha2-nistp384 \
2935                         ecdsa-sha2-nistp384-cert-v01@openssh.com"
2936         fi
2937         if test x$enable_nistp521 = x1; then
2938                 AC_DEFINE([OPENSSL_HAS_NISTP521], [1], [libcrypto has NID_secp521r1])
2939                 TEST_SSH_ECC=yes
2940                 COMMENT_OUT_ECC=""
2941         else
2942                 unsupported_algorithms="$unsupported_algorithms \
2943                         ecdh-sha2-nistp521 \
2944                         ecdsa-sha2-nistp521 \
2945                         ecdsa-sha2-nistp521-cert-v01@openssh.com"
2946         fi
2947
2948         AC_SUBST([TEST_SSH_ECC])
2949         AC_SUBST([COMMENT_OUT_ECC])
2950 else
2951         AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
2952         AC_CHECK_FUNCS([crypt])
2953 fi
2954
2955 AC_CHECK_FUNCS([ \
2956         arc4random \
2957         arc4random_buf \
2958         arc4random_stir \
2959         arc4random_uniform \
2960 ])
2961
2962 saved_LIBS="$LIBS"
2963 AC_CHECK_LIB([iaf], [ia_openinfo], [
2964         LIBS="$LIBS -liaf"
2965         AC_CHECK_FUNCS([set_id], [SSHDLIBS="$SSHDLIBS -liaf"
2966                                 AC_DEFINE([HAVE_LIBIAF], [1],
2967                         [Define if system has libiaf that supports set_id])
2968                                 ])
2969 ])
2970 LIBS="$saved_LIBS"
2971
2972 ### Configure cryptographic random number support
2973
2974 # Check wheter OpenSSL seeds itself
2975 if test "x$openssl" = "xyes" ; then
2976         AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2977         AC_RUN_IFELSE(
2978                 [AC_LANG_PROGRAM([[
2979         #include <string.h>
2980         #include <openssl/rand.h>
2981                 ]], [[
2982                 exit(RAND_status() == 1 ? 0 : 1);
2983                 ]])],
2984                 [
2985                         OPENSSL_SEEDS_ITSELF=yes
2986                         AC_MSG_RESULT([yes])
2987                 ],
2988                 [
2989                         AC_MSG_RESULT([no])
2990                 ],
2991                 [
2992                         AC_MSG_WARN([cross compiling: assuming yes])
2993                         # This is safe, since we will fatal() at runtime if
2994                         # OpenSSL is not seeded correctly.
2995                         OPENSSL_SEEDS_ITSELF=yes
2996                 ]
2997         )
2998 fi
2999
3000 # PRNGD TCP socket
3001 AC_ARG_WITH([prngd-port],
3002         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
3003         [
3004                 case "$withval" in
3005                 no)
3006                         withval=""
3007                         ;;
3008                 [[0-9]]*)
3009                         ;;
3010                 *)
3011                         AC_MSG_ERROR([You must specify a numeric port number for --with-prngd-port])
3012                         ;;
3013                 esac
3014                 if test ! -z "$withval" ; then
3015                         PRNGD_PORT="$withval"
3016                         AC_DEFINE_UNQUOTED([PRNGD_PORT], [$PRNGD_PORT],
3017                                 [Port number of PRNGD/EGD random number socket])
3018                 fi
3019         ]
3020 )
3021
3022 # PRNGD Unix domain socket
3023 AC_ARG_WITH([prngd-socket],
3024         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
3025         [
3026                 case "$withval" in
3027                 yes)
3028                         withval="/var/run/egd-pool"
3029                         ;;
3030                 no)
3031                         withval=""
3032                         ;;
3033                 /*)
3034                         ;;
3035                 *)
3036                         AC_MSG_ERROR([You must specify an absolute path to the entropy socket])
3037                         ;;
3038                 esac
3039
3040                 if test ! -z "$withval" ; then
3041                         if test ! -z "$PRNGD_PORT" ; then
3042                                 AC_MSG_ERROR([You may not specify both a PRNGD/EGD port and socket])
3043                         fi
3044                         if test ! -r "$withval" ; then
3045                                 AC_MSG_WARN([Entropy socket is not readable])
3046                         fi
3047                         PRNGD_SOCKET="$withval"
3048                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"],
3049                                 [Location of PRNGD/EGD random number socket])
3050                 fi
3051         ],
3052         [
3053                 # Check for existing socket only if we don't have a random device already
3054                 if test "x$OPENSSL_SEEDS_ITSELF" != "xyes" ; then
3055                         AC_MSG_CHECKING([for PRNGD/EGD socket])
3056                         # Insert other locations here
3057                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
3058                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
3059                                         PRNGD_SOCKET="$sock"
3060                                         AC_DEFINE_UNQUOTED([PRNGD_SOCKET], ["$PRNGD_SOCKET"])
3061                                         break;
3062                                 fi
3063                         done
3064                         if test ! -z "$PRNGD_SOCKET" ; then
3065                                 AC_MSG_RESULT([$PRNGD_SOCKET])
3066                         else
3067                                 AC_MSG_RESULT([not found])
3068                         fi
3069                 fi
3070         ]
3071 )
3072
3073 # Which randomness source do we use?
3074 if test ! -z "$PRNGD_PORT" ; then
3075         RAND_MSG="PRNGd port $PRNGD_PORT"
3076 elif test ! -z "$PRNGD_SOCKET" ; then
3077         RAND_MSG="PRNGd socket $PRNGD_SOCKET"
3078 elif test ! -z "$OPENSSL_SEEDS_ITSELF" ; then
3079         AC_DEFINE([OPENSSL_PRNG_ONLY], [1],
3080                 [Define if you want the OpenSSL internally seeded PRNG only])
3081         RAND_MSG="OpenSSL internal ONLY"
3082 elif test "x$openssl" = "xno" ; then
3083         AC_MSG_WARN([OpenSSH will use /dev/urandom as a source of random numbers. It will fail if this device is not supported or accessible])
3084 else
3085         AC_MSG_ERROR([OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options])
3086 fi
3087
3088 # Check for PAM libs
3089 PAM_MSG="no"
3090 AC_ARG_WITH([pam],
3091         [  --with-pam              Enable PAM support ],
3092         [
3093                 if test "x$withval" != "xno" ; then
3094                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
3095                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
3096                                 AC_MSG_ERROR([PAM headers not found])
3097                         fi
3098
3099                         saved_LIBS="$LIBS"
3100                         AC_CHECK_LIB([dl], [dlopen], , )
3101                         AC_CHECK_LIB([pam], [pam_set_item], , [AC_MSG_ERROR([*** libpam missing])])
3102                         AC_CHECK_FUNCS([pam_getenvlist])
3103                         AC_CHECK_FUNCS([pam_putenv])
3104                         LIBS="$saved_LIBS"
3105
3106                         PAM_MSG="yes"
3107
3108                         SSHDLIBS="$SSHDLIBS -lpam"
3109                         AC_DEFINE([USE_PAM], [1],
3110                                 [Define if you want to enable PAM support])
3111
3112                         if test $ac_cv_lib_dl_dlopen = yes; then
3113                                 case "$LIBS" in
3114                                 *-ldl*)
3115                                         # libdl already in LIBS
3116                                         ;;
3117                                 *)
3118                                         SSHDLIBS="$SSHDLIBS -ldl"
3119                                         ;;
3120                                 esac
3121                         fi
3122                 fi
3123         ]
3124 )
3125
3126 AC_ARG_WITH([pam-service],
3127         [  --with-pam-service=name Specify PAM service name ],
3128         [
3129                 if test "x$withval" != "xno" && \
3130                    test "x$withval" != "xyes" ; then
3131                         AC_DEFINE_UNQUOTED([SSHD_PAM_SERVICE],
3132                                 ["$withval"], [sshd PAM service name])
3133                 fi
3134         ]
3135 )
3136
3137 # Check for older PAM
3138 if test "x$PAM_MSG" = "xyes" ; then
3139         # Check PAM strerror arguments (old PAM)
3140         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
3141         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3142 #include <stdlib.h>
3143 #if defined(HAVE_SECURITY_PAM_APPL_H)
3144 #include <security/pam_appl.h>
3145 #elif defined (HAVE_PAM_PAM_APPL_H)
3146 #include <pam/pam_appl.h>
3147 #endif
3148                 ]], [[
3149 (void)pam_strerror((pam_handle_t *)NULL, -1);
3150                 ]])], [AC_MSG_RESULT([no])], [
3151                         AC_DEFINE([HAVE_OLD_PAM], [1],
3152                                 [Define if you have an old version of PAM
3153                                 which takes only one argument to pam_strerror])
3154                         AC_MSG_RESULT([yes])
3155                         PAM_MSG="yes (old library)"
3156
3157         ])
3158 fi
3159
3160 case "$host" in
3161 *-*-cygwin*)
3162         SSH_PRIVSEP_USER=CYGWIN_SSH_PRIVSEP_USER
3163         ;;
3164 *)
3165         SSH_PRIVSEP_USER=sshd
3166         ;;
3167 esac
3168 AC_ARG_WITH([privsep-user],
3169         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
3170         [
3171                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3172                     test "x${withval}" != "xyes"; then
3173                         SSH_PRIVSEP_USER=$withval
3174                 fi
3175         ]
3176 )
3177 if test "x$SSH_PRIVSEP_USER" = "xCYGWIN_SSH_PRIVSEP_USER" ; then
3178         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], [CYGWIN_SSH_PRIVSEP_USER],
3179                 [Cygwin function to fetch non-privileged user for privilege separation])
3180 else
3181         AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], ["$SSH_PRIVSEP_USER"],
3182                 [non-privileged user for privilege separation])
3183 fi
3184 AC_SUBST([SSH_PRIVSEP_USER])
3185
3186 if test "x$have_linux_no_new_privs" = "x1" ; then
3187 AC_CHECK_DECL([SECCOMP_MODE_FILTER], [have_seccomp_filter=1], , [
3188         #include <sys/types.h>
3189         #include <linux/seccomp.h>
3190 ])
3191 fi
3192 if test "x$have_seccomp_filter" = "x1" ; then
3193 AC_MSG_CHECKING([kernel for seccomp_filter support])
3194 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
3195                 #include <errno.h>
3196                 #include <elf.h>
3197                 #include <linux/audit.h>
3198                 #include <linux/seccomp.h>
3199                 #include <stdlib.h>
3200                 #include <sys/prctl.h>
3201         ]],
3202         [[ int i = $seccomp_audit_arch;
3203            errno = 0;
3204            prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
3205            exit(errno == EFAULT ? 0 : 1); ]])],
3206         [ AC_MSG_RESULT([yes]) ], [
3207                 AC_MSG_RESULT([no])
3208                 # Disable seccomp filter as a target
3209                 have_seccomp_filter=0
3210         ]
3211 )
3212 fi
3213
3214 # Decide which sandbox style to use
3215 sandbox_arg=""
3216 AC_ARG_WITH([sandbox],
3217         [  --with-sandbox=style    Specify privilege separation sandbox (no, capsicum, darwin, rlimit, seccomp_filter, systrace, pledge)],
3218         [
3219                 if test "x$withval" = "xyes" ; then
3220                         sandbox_arg=""
3221                 else
3222                         sandbox_arg="$withval"
3223                 fi
3224         ]
3225 )
3226
3227 # Some platforms (seems to be the ones that have a kernel poll(2)-type
3228 # function with which they implement select(2)) use an extra file descriptor
3229 # when calling select(2), which means we can't use the rlimit sandbox.
3230 AC_MSG_CHECKING([if select works with descriptor rlimit])
3231 AC_RUN_IFELSE(
3232         [AC_LANG_PROGRAM([[
3233 #include <sys/types.h>
3234 #ifdef HAVE_SYS_TIME_H
3235 # include <sys/time.h>
3236 #endif
3237 #include <sys/resource.h>
3238 #ifdef HAVE_SYS_SELECT_H
3239 # include <sys/select.h>
3240 #endif
3241 #include <errno.h>
3242 #include <fcntl.h>
3243 #include <stdlib.h>
3244         ]],[[
3245         struct rlimit rl_zero;
3246         int fd, r;
3247         fd_set fds;
3248         struct timeval tv;
3249
3250         fd = open("/dev/null", O_RDONLY);
3251         FD_ZERO(&fds);
3252         FD_SET(fd, &fds);
3253         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3254         setrlimit(RLIMIT_FSIZE, &rl_zero);
3255         setrlimit(RLIMIT_NOFILE, &rl_zero);
3256         tv.tv_sec = 1;
3257         tv.tv_usec = 0;
3258         r = select(fd+1, &fds, NULL, NULL, &tv);
3259         exit (r == -1 ? 1 : 0);
3260         ]])],
3261         [AC_MSG_RESULT([yes])
3262          select_works_with_rlimit=yes],
3263         [AC_MSG_RESULT([no])
3264          select_works_with_rlimit=no],
3265         [AC_MSG_WARN([cross compiling: assuming yes])
3266          select_works_with_rlimit=yes]
3267 )
3268
3269 AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works])
3270 AC_RUN_IFELSE(
3271         [AC_LANG_PROGRAM([[
3272 #include <sys/types.h>
3273 #ifdef HAVE_SYS_TIME_H
3274 # include <sys/time.h>
3275 #endif
3276 #include <sys/resource.h>
3277 #include <errno.h>
3278 #include <stdlib.h>
3279         ]],[[
3280         struct rlimit rl_zero;
3281         int fd, r;
3282         fd_set fds;
3283
3284         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3285         r = setrlimit(RLIMIT_NOFILE, &rl_zero);
3286         exit (r == -1 ? 1 : 0);
3287         ]])],
3288         [AC_MSG_RESULT([yes])
3289          rlimit_nofile_zero_works=yes],
3290         [AC_MSG_RESULT([no])
3291          rlimit_nofile_zero_works=no],
3292         [AC_MSG_WARN([cross compiling: assuming yes])
3293          rlimit_nofile_zero_works=yes]
3294 )
3295
3296 AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
3297 AC_RUN_IFELSE(
3298         [AC_LANG_PROGRAM([[
3299 #include <sys/types.h>
3300 #include <sys/resource.h>
3301 #include <stdlib.h>
3302         ]],[[
3303                 struct rlimit rl_zero;
3304
3305                 rl_zero.rlim_cur = rl_zero.rlim_max = 0;
3306                 exit(setrlimit(RLIMIT_FSIZE, &rl_zero) != 0);
3307         ]])],
3308         [AC_MSG_RESULT([yes])],
3309         [AC_MSG_RESULT([no])
3310          AC_DEFINE(SANDBOX_SKIP_RLIMIT_FSIZE, 1,
3311             [setrlimit RLIMIT_FSIZE works])],
3312         [AC_MSG_WARN([cross compiling: assuming yes])]
3313 )
3314
3315 if test "x$sandbox_arg" = "xpledge" || \
3316    ( test -z "$sandbox_arg" && test "x$ac_cv_func_pledge" = "xyes" ) ; then
3317         test "x$ac_cv_func_pledge" != "xyes" && \
3318                 AC_MSG_ERROR([pledge sandbox requires pledge(2) support])
3319         SANDBOX_STYLE="pledge"
3320         AC_DEFINE([SANDBOX_PLEDGE], [1], [Sandbox using pledge(2)])
3321 elif test "x$sandbox_arg" = "xsystrace" || \
3322    ( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
3323         test "x$have_systr_policy_kill" != "x1" && \
3324                 AC_MSG_ERROR([systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support])
3325         SANDBOX_STYLE="systrace"
3326         AC_DEFINE([SANDBOX_SYSTRACE], [1], [Sandbox using systrace(4)])
3327 elif test "x$sandbox_arg" = "xdarwin" || \
3328      ( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \
3329        test "x$ac_cv_header_sandbox_h" = "xyes") ; then
3330         test "x$ac_cv_func_sandbox_init" != "xyes" -o \
3331              "x$ac_cv_header_sandbox_h" != "xyes" && \
3332                 AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h and sandbox_init function])
3333         SANDBOX_STYLE="darwin"
3334         AC_DEFINE([SANDBOX_DARWIN], [1], [Sandbox using Darwin sandbox_init(3)])
3335 elif test "x$sandbox_arg" = "xseccomp_filter" || \
3336      ( test -z "$sandbox_arg" && \
3337        test "x$have_seccomp_filter" = "x1" && \
3338        test "x$ac_cv_header_elf_h" = "xyes" && \
3339        test "x$ac_cv_header_linux_audit_h" = "xyes" && \
3340        test "x$ac_cv_header_linux_filter_h" = "xyes" && \
3341        test "x$seccomp_audit_arch" != "x" && \
3342        test "x$have_linux_no_new_privs" = "x1" && \
3343        test "x$ac_cv_func_prctl" = "xyes" ) ; then
3344         test "x$seccomp_audit_arch" = "x" && \
3345                 AC_MSG_ERROR([seccomp_filter sandbox not supported on $host])
3346         test "x$have_linux_no_new_privs" != "x1" && \
3347                 AC_MSG_ERROR([seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS])
3348         test "x$have_seccomp_filter" != "x1" && \
3349                 AC_MSG_ERROR([seccomp_filter sandbox requires seccomp headers])
3350         test "x$ac_cv_func_prctl" != "xyes" && \
3351                 AC_MSG_ERROR([seccomp_filter sandbox requires prctl function])
3352         SANDBOX_STYLE="seccomp_filter"
3353         AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
3354 elif test "x$sandbox_arg" = "xcapsicum" || \
3355      ( test -z "$sandbox_arg" && \
3356        test "x$ac_cv_header_sys_capsicum_h" = "xyes" && \
3357        test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
3358        test "x$ac_cv_header_sys_capsicum_h" != "xyes" && \
3359                 AC_MSG_ERROR([capsicum sandbox requires sys/capsicum.h header])
3360        test "x$ac_cv_func_cap_rights_limit" != "xyes" && \
3361                 AC_MSG_ERROR([capsicum sandbox requires cap_rights_limit function])
3362        SANDBOX_STYLE="capsicum"
3363        AC_DEFINE([SANDBOX_CAPSICUM], [1], [Sandbox using capsicum])
3364 elif test "x$sandbox_arg" = "xrlimit" || \
3365      ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
3366        test "x$select_works_with_rlimit" = "xyes" && \
3367        test "x$rlimit_nofile_zero_works" = "xyes" ) ; then
3368         test "x$ac_cv_func_setrlimit" != "xyes" && \
3369                 AC_MSG_ERROR([rlimit sandbox requires setrlimit function])
3370         test "x$select_works_with_rlimit" != "xyes" && \
3371                 AC_MSG_ERROR([rlimit sandbox requires select to work with rlimit])
3372         SANDBOX_STYLE="rlimit"
3373         AC_DEFINE([SANDBOX_RLIMIT], [1], [Sandbox using setrlimit(2)])
3374 elif test "x$sandbox_arg" = "xsolaris" || \
3375    ( test -z "$sandbox_arg" && test "x$SOLARIS_PRIVS" = "xyes" ) ; then
3376         SANDBOX_STYLE="solaris"
3377         AC_DEFINE([SANDBOX_SOLARIS], [1], [Sandbox using Solaris/Illumos privileges])
3378 elif test -z "$sandbox_arg" || test "x$sandbox_arg" = "xno" || \
3379      test "x$sandbox_arg" = "xnone" || test "x$sandbox_arg" = "xnull" ; then
3380         SANDBOX_STYLE="none"
3381         AC_DEFINE([SANDBOX_NULL], [1], [no privsep sandboxing])
3382 else
3383         AC_MSG_ERROR([unsupported --with-sandbox])
3384 fi
3385
3386 # Cheap hack to ensure NEWS-OS libraries are arranged right.
3387 if test ! -z "$SONY" ; then
3388   LIBS="$LIBS -liberty";
3389 fi
3390
3391 # Check for  long long datatypes
3392 AC_CHECK_TYPES([long long, unsigned long long, long double])
3393
3394 # Check datatype sizes
3395 AC_CHECK_SIZEOF([short int], [2])
3396 AC_CHECK_SIZEOF([int], [4])
3397 AC_CHECK_SIZEOF([long int], [4])
3398 AC_CHECK_SIZEOF([long long int], [8])
3399
3400 # Sanity check long long for some platforms (AIX)
3401 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
3402         ac_cv_sizeof_long_long_int=0
3403 fi
3404
3405 # compute LLONG_MIN and LLONG_MAX if we don't know them.
3406 if test -z "$have_llong_max"; then
3407         AC_MSG_CHECKING([for max value of long long])
3408         AC_RUN_IFELSE(
3409                 [AC_LANG_PROGRAM([[
3410 #include <stdio.h>
3411 /* Why is this so damn hard? */
3412 #ifdef __GNUC__
3413 # undef __GNUC__
3414 #endif
3415 #define __USE_ISOC99
3416 #include <limits.h>
3417 #define DATA "conftest.llminmax"
3418 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
3419
3420 /*
3421  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
3422  * we do this the hard way.
3423  */
3424 static int
3425 fprint_ll(FILE *f, long long n)
3426 {
3427         unsigned int i;
3428         int l[sizeof(long long) * 8];
3429
3430         if (n < 0)
3431                 if (fprintf(f, "-") < 0)
3432                         return -1;
3433         for (i = 0; n != 0; i++) {
3434                 l[i] = my_abs(n % 10);
3435                 n /= 10;
3436         }
3437         do {
3438                 if (fprintf(f, "%d", l[--i]) < 0)
3439                         return -1;
3440         } while (i != 0);
3441         if (fprintf(f, " ") < 0)
3442                 return -1;
3443         return 0;
3444 }
3445                 ]], [[
3446         FILE *f;
3447         long long i, llmin, llmax = 0;
3448
3449         if((f = fopen(DATA,"w")) == NULL)
3450                 exit(1);
3451
3452 #if defined(LLONG_MIN) && defined(LLONG_MAX)
3453         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
3454         llmin = LLONG_MIN;
3455         llmax = LLONG_MAX;
3456 #else
3457         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
3458         /* This will work on one's complement and two's complement */
3459         for (i = 1; i > llmax; i <<= 1, i++)
3460                 llmax = i;
3461         llmin = llmax + 1LL;    /* wrap */
3462 #endif
3463
3464         /* Sanity check */
3465         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
3466             || llmax - 1 > llmax || llmin == llmax || llmin == 0
3467             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
3468                 fprintf(f, "unknown unknown\n");
3469                 exit(2);
3470         }
3471
3472         if (fprint_ll(f, llmin) < 0)
3473                 exit(3);
3474         if (fprint_ll(f, llmax) < 0)
3475                 exit(4);
3476         if (fclose(f) < 0)
3477                 exit(5);
3478         exit(0);
3479                 ]])],
3480                 [
3481                         llong_min=`$AWK '{print $1}' conftest.llminmax`
3482                         llong_max=`$AWK '{print $2}' conftest.llminmax`
3483
3484                         AC_MSG_RESULT([$llong_max])
3485                         AC_DEFINE_UNQUOTED([LLONG_MAX], [${llong_max}LL],
3486                             [max value of long long calculated by configure])
3487                         AC_MSG_CHECKING([for min value of long long])
3488                         AC_MSG_RESULT([$llong_min])
3489                         AC_DEFINE_UNQUOTED([LLONG_MIN], [${llong_min}LL],
3490                             [min value of long long calculated by configure])
3491                 ],
3492                 [
3493                         AC_MSG_RESULT([not found])
3494                 ],
3495                 [
3496                         AC_MSG_WARN([cross compiling: not checking])
3497                 ]
3498         )
3499 fi
3500
3501
3502 # More checks for data types
3503 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
3504         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3505         [[ u_int a; a = 1;]])],
3506         [ ac_cv_have_u_int="yes" ], [ ac_cv_have_u_int="no"
3507         ])
3508 ])
3509 if test "x$ac_cv_have_u_int" = "xyes" ; then
3510         AC_DEFINE([HAVE_U_INT], [1], [define if you have u_int data type])
3511         have_u_int=1
3512 fi
3513
3514 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
3515         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3516         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3517         [ ac_cv_have_intxx_t="yes" ], [ ac_cv_have_intxx_t="no"
3518         ])
3519 ])
3520 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
3521         AC_DEFINE([HAVE_INTXX_T], [1], [define if you have intxx_t data type])
3522         have_intxx_t=1
3523 fi
3524
3525 if (test -z "$have_intxx_t" && \
3526            test "x$ac_cv_header_stdint_h" = "xyes")
3527 then
3528     AC_MSG_CHECKING([for intXX_t types in stdint.h])
3529         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3530         [[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
3531                 [
3532                         AC_DEFINE([HAVE_INTXX_T])
3533                         AC_MSG_RESULT([yes])
3534                 ], [ AC_MSG_RESULT([no])
3535         ])
3536 fi
3537
3538 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
3539         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3540 #include <sys/types.h>
3541 #ifdef HAVE_STDINT_H
3542 # include <stdint.h>
3543 #endif
3544 #include <sys/socket.h>
3545 #ifdef HAVE_SYS_BITYPES_H
3546 # include <sys/bitypes.h>
3547 #endif
3548                 ]], [[
3549 int64_t a; a = 1;
3550                 ]])],
3551         [ ac_cv_have_int64_t="yes" ], [ ac_cv_have_int64_t="no"
3552         ])
3553 ])
3554 if test "x$ac_cv_have_int64_t" = "xyes" ; then
3555         AC_DEFINE([HAVE_INT64_T], [1], [define if you have int64_t data type])
3556 fi
3557
3558 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
3559         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3560         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3561         [ ac_cv_have_u_intxx_t="yes" ], [ ac_cv_have_u_intxx_t="no"
3562         ])
3563 ])
3564 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
3565         AC_DEFINE([HAVE_U_INTXX_T], [1], [define if you have u_intxx_t data type])
3566         have_u_intxx_t=1
3567 fi
3568
3569 if test -z "$have_u_intxx_t" ; then
3570     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
3571         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/socket.h> ]],
3572         [[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
3573                 [
3574                         AC_DEFINE([HAVE_U_INTXX_T])
3575                         AC_MSG_RESULT([yes])
3576                 ], [ AC_MSG_RESULT([no])
3577         ])
3578 fi
3579
3580 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
3581         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3582         [[ u_int64_t a; a = 1;]])],
3583         [ ac_cv_have_u_int64_t="yes" ], [ ac_cv_have_u_int64_t="no"
3584         ])
3585 ])
3586 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
3587         AC_DEFINE([HAVE_U_INT64_T], [1], [define if you have u_int64_t data type])
3588         have_u_int64_t=1
3589 fi
3590
3591 if (test -z "$have_u_int64_t" && \
3592            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3593 then
3594     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
3595         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/bitypes.h> ]],
3596         [[ u_int64_t a; a = 1]])],
3597                 [
3598                         AC_DEFINE([HAVE_U_INT64_T])
3599                         AC_MSG_RESULT([yes])
3600                 ], [ AC_MSG_RESULT([no])
3601         ])
3602 fi
3603
3604 if test -z "$have_u_intxx_t" ; then
3605         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
3606                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3607 #include <sys/types.h>
3608                         ]], [[
3609         uint8_t a;
3610         uint16_t b;
3611         uint32_t c;
3612         a = b = c = 1;
3613                         ]])],
3614                 [ ac_cv_have_uintxx_t="yes" ], [ ac_cv_have_uintxx_t="no"
3615                 ])
3616         ])
3617         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
3618                 AC_DEFINE([HAVE_UINTXX_T], [1],
3619                         [define if you have uintxx_t data type])
3620         fi
3621 fi
3622
3623 if (test -z "$have_uintxx_t" && \
3624            test "x$ac_cv_header_stdint_h" = "xyes")
3625 then
3626     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
3627         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
3628         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3629                 [
3630                         AC_DEFINE([HAVE_UINTXX_T])
3631                         AC_MSG_RESULT([yes])
3632                 ], [ AC_MSG_RESULT([no])
3633         ])
3634 fi
3635
3636 if (test -z "$have_uintxx_t" && \
3637            test "x$ac_cv_header_inttypes_h" = "xyes")
3638 then
3639     AC_MSG_CHECKING([for uintXX_t types in inttypes.h])
3640         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <inttypes.h> ]],
3641         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
3642                 [
3643                         AC_DEFINE([HAVE_UINTXX_T])
3644                         AC_MSG_RESULT([yes])
3645                 ], [ AC_MSG_RESULT([no])
3646         ])
3647 fi
3648
3649 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
3650            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
3651 then
3652         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
3653         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3654 #include <sys/bitypes.h>
3655                 ]], [[
3656                         int8_t a; int16_t b; int32_t c;
3657                         u_int8_t e; u_int16_t f; u_int32_t g;
3658                         a = b = c = e = f = g = 1;
3659                 ]])],
3660                 [
3661                         AC_DEFINE([HAVE_U_INTXX_T])
3662                         AC_DEFINE([HAVE_INTXX_T])
3663                         AC_MSG_RESULT([yes])
3664                 ], [AC_MSG_RESULT([no])
3665         ])
3666 fi
3667
3668
3669 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
3670         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3671         [[ u_char foo; foo = 125; ]])],
3672         [ ac_cv_have_u_char="yes" ], [ ac_cv_have_u_char="no"
3673         ])
3674 ])
3675 if test "x$ac_cv_have_u_char" = "xyes" ; then
3676         AC_DEFINE([HAVE_U_CHAR], [1], [define if you have u_char data type])
3677 fi
3678
3679 AC_CHECK_TYPES([intmax_t, uintmax_t], , , [
3680 #include <sys/types.h>
3681 #include <stdint.h>
3682 ])
3683
3684 TYPE_SOCKLEN_T
3685
3686 AC_CHECK_TYPES([sig_atomic_t], , , [#include <signal.h>])
3687 AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t], , , [
3688 #include <sys/types.h>
3689 #ifdef HAVE_SYS_BITYPES_H
3690 #include <sys/bitypes.h>
3691 #endif
3692 #ifdef HAVE_SYS_STATFS_H
3693 #include <sys/statfs.h>
3694 #endif
3695 #ifdef HAVE_SYS_STATVFS_H
3696 #include <sys/statvfs.h>
3697 #endif
3698 ])
3699
3700 AC_CHECK_TYPES([in_addr_t, in_port_t], , ,
3701 [#include <sys/types.h>
3702 #include <netinet/in.h>])
3703
3704 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
3705         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3706         [[ size_t foo; foo = 1235; ]])],
3707         [ ac_cv_have_size_t="yes" ], [ ac_cv_have_size_t="no"
3708         ])
3709 ])
3710 if test "x$ac_cv_have_size_t" = "xyes" ; then
3711         AC_DEFINE([HAVE_SIZE_T], [1], [define if you have size_t data type])
3712 fi
3713
3714 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
3715         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3716         [[ ssize_t foo; foo = 1235; ]])],
3717         [ ac_cv_have_ssize_t="yes" ], [ ac_cv_have_ssize_t="no"
3718         ])
3719 ])
3720 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
3721         AC_DEFINE([HAVE_SSIZE_T], [1], [define if you have ssize_t data type])
3722 fi
3723
3724 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
3725         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <time.h> ]],
3726         [[ clock_t foo; foo = 1235; ]])],
3727         [ ac_cv_have_clock_t="yes" ], [ ac_cv_have_clock_t="no"
3728         ])
3729 ])
3730 if test "x$ac_cv_have_clock_t" = "xyes" ; then
3731         AC_DEFINE([HAVE_CLOCK_T], [1], [define if you have clock_t data type])
3732 fi
3733
3734 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
3735         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3736 #include <sys/types.h>
3737 #include <sys/socket.h>
3738                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3739         [ ac_cv_have_sa_family_t="yes" ],
3740         [ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3741 #include <sys/types.h>
3742 #include <sys/socket.h>
3743 #include <netinet/in.h>
3744                 ]], [[ sa_family_t foo; foo = 1235; ]])],
3745                 [ ac_cv_have_sa_family_t="yes" ],
3746                 [ ac_cv_have_sa_family_t="no" ]
3747         )
3748         ])
3749 ])
3750 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
3751         AC_DEFINE([HAVE_SA_FAMILY_T], [1],
3752                 [define if you have sa_family_t data type])
3753 fi
3754
3755 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
3756         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3757         [[ pid_t foo; foo = 1235; ]])],
3758         [ ac_cv_have_pid_t="yes" ], [ ac_cv_have_pid_t="no"
3759         ])
3760 ])
3761 if test "x$ac_cv_have_pid_t" = "xyes" ; then
3762         AC_DEFINE([HAVE_PID_T], [1], [define if you have pid_t data type])
3763 fi
3764
3765 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
3766         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
3767         [[ mode_t foo; foo = 1235; ]])],
3768         [ ac_cv_have_mode_t="yes" ], [ ac_cv_have_mode_t="no"
3769         ])
3770 ])
3771 if test "x$ac_cv_have_mode_t" = "xyes" ; then
3772         AC_DEFINE([HAVE_MODE_T], [1], [define if you have mode_t data type])
3773 fi
3774
3775
3776 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
3777         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3778 #include <sys/types.h>
3779 #include <sys/socket.h>
3780                 ]], [[ struct sockaddr_storage s; ]])],
3781         [ ac_cv_have_struct_sockaddr_storage="yes" ],
3782         [ ac_cv_have_struct_sockaddr_storage="no"
3783         ])
3784 ])
3785 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
3786         AC_DEFINE([HAVE_STRUCT_SOCKADDR_STORAGE], [1],
3787                 [define if you have struct sockaddr_storage data type])
3788 fi
3789
3790 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
3791         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3792 #include <sys/types.h>
3793 #include <netinet/in.h>
3794                 ]], [[ struct sockaddr_in6 s; s.sin6_family = 0; ]])],
3795         [ ac_cv_have_struct_sockaddr_in6="yes" ],
3796         [ ac_cv_have_struct_sockaddr_in6="no"
3797         ])
3798 ])
3799 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
3800         AC_DEFINE([HAVE_STRUCT_SOCKADDR_IN6], [1],
3801                 [define if you have struct sockaddr_in6 data type])
3802 fi
3803
3804 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
3805         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3806 #include <sys/types.h>
3807 #include <netinet/in.h>
3808                 ]], [[ struct in6_addr s; s.s6_addr[0] = 0; ]])],
3809         [ ac_cv_have_struct_in6_addr="yes" ],
3810         [ ac_cv_have_struct_in6_addr="no"
3811         ])
3812 ])
3813 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
3814         AC_DEFINE([HAVE_STRUCT_IN6_ADDR], [1],
3815                 [define if you have struct in6_addr data type])
3816
3817 dnl Now check for sin6_scope_id
3818         AC_CHECK_MEMBERS([struct sockaddr_in6.sin6_scope_id], , ,
3819                 [
3820 #ifdef HAVE_SYS_TYPES_H
3821 #include <sys/types.h>
3822 #endif
3823 #include <netinet/in.h>
3824                 ])
3825 fi
3826
3827 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
3828         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3829 #include <sys/types.h>
3830 #include <sys/socket.h>
3831 #include <netdb.h>
3832                 ]], [[ struct addrinfo s; s.ai_flags = AI_PASSIVE; ]])],
3833         [ ac_cv_have_struct_addrinfo="yes" ],
3834         [ ac_cv_have_struct_addrinfo="no"
3835         ])
3836 ])
3837 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
3838         AC_DEFINE([HAVE_STRUCT_ADDRINFO], [1],
3839                 [define if you have struct addrinfo data type])
3840 fi
3841
3842 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
3843         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/time.h> ]],
3844         [[ struct timeval tv; tv.tv_sec = 1;]])],
3845         [ ac_cv_have_struct_timeval="yes" ],
3846         [ ac_cv_have_struct_timeval="no"
3847         ])
3848 ])
3849 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
3850         AC_DEFINE([HAVE_STRUCT_TIMEVAL], [1], [define if you have struct timeval])
3851         have_struct_timeval=1
3852 fi
3853
3854 AC_CHECK_TYPES([struct timespec])
3855
3856 # We need int64_t or else certian parts of the compile will fail.
3857 if test "x$ac_cv_have_int64_t" = "xno" && \
3858         test "x$ac_cv_sizeof_long_int" != "x8" && \
3859         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
3860         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
3861         echo "an alternative compiler (I.E., GCC) before continuing."
3862         echo ""
3863         exit 1;
3864 else
3865 dnl test snprintf (broken on SCO w/gcc)
3866         AC_RUN_IFELSE(
3867                 [AC_LANG_SOURCE([[
3868 #include <stdio.h>
3869 #include <string.h>
3870 #ifdef HAVE_SNPRINTF
3871 main()
3872 {
3873         char buf[50];
3874         char expected_out[50];
3875         int mazsize = 50 ;
3876 #if (SIZEOF_LONG_INT == 8)
3877         long int num = 0x7fffffffffffffff;
3878 #else
3879         long long num = 0x7fffffffffffffffll;
3880 #endif
3881         strcpy(expected_out, "9223372036854775807");
3882         snprintf(buf, mazsize, "%lld", num);
3883         if(strcmp(buf, expected_out) != 0)
3884                 exit(1);
3885         exit(0);
3886 }
3887 #else
3888 main() { exit(0); }
3889 #endif
3890                 ]])], [ true ], [ AC_DEFINE([BROKEN_SNPRINTF]) ],
3891                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3892         )
3893 fi
3894
3895 dnl Checks for structure members
3896 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmp.h], [HAVE_HOST_IN_UTMP])
3897 OSSH_CHECK_HEADER_FOR_FIELD([ut_host], [utmpx.h], [HAVE_HOST_IN_UTMPX])
3898 OSSH_CHECK_HEADER_FOR_FIELD([syslen], [utmpx.h], [HAVE_SYSLEN_IN_UTMPX])
3899 OSSH_CHECK_HEADER_FOR_FIELD([ut_pid], [utmp.h], [HAVE_PID_IN_UTMP])
3900 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmp.h], [HAVE_TYPE_IN_UTMP])
3901 OSSH_CHECK_HEADER_FOR_FIELD([ut_type], [utmpx.h], [HAVE_TYPE_IN_UTMPX])
3902 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmp.h], [HAVE_TV_IN_UTMP])
3903 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmp.h], [HAVE_ID_IN_UTMP])
3904 OSSH_CHECK_HEADER_FOR_FIELD([ut_id], [utmpx.h], [HAVE_ID_IN_UTMPX])
3905 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmp.h], [HAVE_ADDR_IN_UTMP])
3906 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr], [utmpx.h], [HAVE_ADDR_IN_UTMPX])
3907 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmp.h], [HAVE_ADDR_V6_IN_UTMP])
3908 OSSH_CHECK_HEADER_FOR_FIELD([ut_addr_v6], [utmpx.h], [HAVE_ADDR_V6_IN_UTMPX])
3909 OSSH_CHECK_HEADER_FOR_FIELD([ut_exit], [utmp.h], [HAVE_EXIT_IN_UTMP])
3910 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmp.h], [HAVE_TIME_IN_UTMP])
3911 OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmpx.h], [HAVE_TIME_IN_UTMPX])
3912 OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmpx.h], [HAVE_TV_IN_UTMPX])
3913
3914 AC_CHECK_MEMBERS([struct stat.st_blksize])
3915 AC_CHECK_MEMBERS([struct stat.st_mtim])
3916 AC_CHECK_MEMBERS([struct stat.st_mtime])
3917 AC_CHECK_MEMBERS([struct passwd.pw_gecos, struct passwd.pw_class,
3918 struct passwd.pw_change, struct passwd.pw_expire],
3919 [], [], [[
3920 #include <sys/types.h>
3921 #include <pwd.h>
3922 ]])
3923
3924 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE([__res_state], [state],
3925         [Define if we don't have struct __res_state in resolv.h])],
3926 [[
3927 #include <stdio.h>
3928 #if HAVE_SYS_TYPES_H
3929 # include <sys/types.h>
3930 #endif
3931 #include <netinet/in.h>
3932 #include <arpa/nameser.h>
3933 #include <resolv.h>
3934 ]])
3935
3936 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
3937                 ac_cv_have_ss_family_in_struct_ss, [
3938         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3939 #include <sys/types.h>
3940 #include <sys/socket.h>
3941                 ]], [[ struct sockaddr_storage s; s.ss_family = 1; ]])],
3942         [ ac_cv_have_ss_family_in_struct_ss="yes" ],
3943         [ ac_cv_have_ss_family_in_struct_ss="no" ])
3944 ])
3945 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3946         AC_DEFINE([HAVE_SS_FAMILY_IN_SS], [1], [Fields in struct sockaddr_storage])
3947 fi
3948
3949 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
3950                 ac_cv_have___ss_family_in_struct_ss, [
3951         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3952 #include <sys/types.h>
3953 #include <sys/socket.h>
3954                 ]], [[ struct sockaddr_storage s; s.__ss_family = 1; ]])],
3955         [ ac_cv_have___ss_family_in_struct_ss="yes" ],
3956         [ ac_cv_have___ss_family_in_struct_ss="no"
3957         ])
3958 ])
3959 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
3960         AC_DEFINE([HAVE___SS_FAMILY_IN_SS], [1],
3961                 [Fields in struct sockaddr_storage])
3962 fi
3963
3964 dnl make sure we're using the real structure members and not defines
3965 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3966                 ac_cv_have_accrights_in_msghdr, [
3967         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3968 #include <sys/types.h>
3969 #include <sys/socket.h>
3970 #include <sys/uio.h>
3971                 ]], [[
3972 #ifdef msg_accrights
3973 #error "msg_accrights is a macro"
3974 exit(1);
3975 #endif
3976 struct msghdr m;
3977 m.msg_accrights = 0;
3978 exit(0);
3979                 ]])],
3980                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3981                 [ ac_cv_have_accrights_in_msghdr="no" ]
3982         )
3983 ])
3984 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3985         AC_DEFINE([HAVE_ACCRIGHTS_IN_MSGHDR], [1],
3986                 [Define if your system uses access rights style
3987                 file descriptor passing])
3988 fi
3989
3990 AC_MSG_CHECKING([if struct statvfs.f_fsid is integral type])
3991 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
3992 #include <sys/param.h>
3993 #include <sys/stat.h>
3994 #ifdef HAVE_SYS_TIME_H
3995 # include <sys/time.h>
3996 #endif
3997 #ifdef HAVE_SYS_MOUNT_H
3998 #include <sys/mount.h>
3999 #endif
4000 #ifdef HAVE_SYS_STATVFS_H
4001 #include <sys/statvfs.h>
4002 #endif
4003         ]], [[ struct statvfs s; s.f_fsid = 0; ]])],
4004         [ AC_MSG_RESULT([yes]) ],
4005         [ AC_MSG_RESULT([no])
4006
4007         AC_MSG_CHECKING([if fsid_t has member val])
4008         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4009 #include <sys/types.h>
4010 #include <sys/statvfs.h>
4011         ]], [[ fsid_t t; t.val[0] = 0; ]])],
4012         [ AC_MSG_RESULT([yes])
4013           AC_DEFINE([FSID_HAS_VAL], [1], [fsid_t has member val]) ],
4014         [ AC_MSG_RESULT([no]) ])
4015
4016         AC_MSG_CHECKING([if f_fsid has member __val])
4017         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4018 #include <sys/types.h>
4019 #include <sys/statvfs.h>
4020         ]], [[ fsid_t t; t.__val[0] = 0; ]])],
4021         [ AC_MSG_RESULT([yes])
4022           AC_DEFINE([FSID_HAS___VAL], [1], [fsid_t has member __val]) ],
4023         [ AC_MSG_RESULT([no]) ])
4024 ])
4025
4026 AC_CACHE_CHECK([for msg_control field in struct msghdr],
4027                 ac_cv_have_control_in_msghdr, [
4028         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4029 #include <sys/types.h>
4030 #include <sys/socket.h>
4031 #include <sys/uio.h>
4032                 ]], [[
4033 #ifdef msg_control
4034 #error "msg_control is a macro"
4035 exit(1);
4036 #endif
4037 struct msghdr m;
4038 m.msg_control = 0;
4039 exit(0);
4040                 ]])],
4041                 [ ac_cv_have_control_in_msghdr="yes" ],
4042                 [ ac_cv_have_control_in_msghdr="no" ]
4043         )
4044 ])
4045 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
4046         AC_DEFINE([HAVE_CONTROL_IN_MSGHDR], [1],
4047                 [Define if your system uses ancillary data style
4048                 file descriptor passing])
4049 fi
4050
4051 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
4052         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4053                 [[ extern char *__progname; printf("%s", __progname); ]])],
4054         [ ac_cv_libc_defines___progname="yes" ],
4055         [ ac_cv_libc_defines___progname="no"
4056         ])
4057 ])
4058 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
4059         AC_DEFINE([HAVE___PROGNAME], [1], [Define if libc defines __progname])
4060 fi
4061
4062 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
4063         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4064                 [[ printf("%s", __FUNCTION__); ]])],
4065         [ ac_cv_cc_implements___FUNCTION__="yes" ],
4066         [ ac_cv_cc_implements___FUNCTION__="no"
4067         ])
4068 ])
4069 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
4070         AC_DEFINE([HAVE___FUNCTION__], [1],
4071                 [Define if compiler implements __FUNCTION__])
4072 fi
4073
4074 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
4075         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
4076                 [[ printf("%s", __func__); ]])],
4077         [ ac_cv_cc_implements___func__="yes" ],
4078         [ ac_cv_cc_implements___func__="no"
4079         ])
4080 ])
4081 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
4082         AC_DEFINE([HAVE___func__], [1], [Define if compiler implements __func__])
4083 fi
4084
4085 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
4086         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4087 #include <stdarg.h>
4088 va_list x,y;
4089                 ]], [[ va_copy(x,y); ]])],
4090         [ ac_cv_have_va_copy="yes" ],
4091         [ ac_cv_have_va_copy="no"
4092         ])
4093 ])
4094 if test "x$ac_cv_have_va_copy" = "xyes" ; then
4095         AC_DEFINE([HAVE_VA_COPY], [1], [Define if va_copy exists])
4096 fi
4097
4098 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
4099         AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4100 #include <stdarg.h>
4101 va_list x,y;
4102                 ]], [[ __va_copy(x,y); ]])],
4103         [ ac_cv_have___va_copy="yes" ], [ ac_cv_have___va_copy="no"
4104         ])
4105 ])
4106 if test "x$ac_cv_have___va_copy" = "xyes" ; then
4107         AC_DEFINE([HAVE___VA_COPY], [1], [Define if __va_copy exists])
4108 fi
4109
4110 AC_CACHE_CHECK([whether getopt has optreset support],
4111                 ac_cv_have_getopt_optreset, [
4112         AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <getopt.h> ]],
4113                 [[ extern int optreset; optreset = 0; ]])],
4114         [ ac_cv_have_getopt_optreset="yes" ],
4115         [ ac_cv_have_getopt_optreset="no"
4116         ])
4117 ])
4118 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
4119         AC_DEFINE([HAVE_GETOPT_OPTRESET], [1],
4120                 [Define if your getopt(3) defines and uses optreset])
4121 fi
4122
4123 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
4124         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4125 [[ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);]])],
4126         [ ac_cv_libc_defines_sys_errlist="yes" ],
4127         [ ac_cv_libc_defines_sys_errlist="no"
4128         ])
4129 ])
4130 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
4131         AC_DEFINE([HAVE_SYS_ERRLIST], [1],
4132                 [Define if your system defines sys_errlist[]])
4133 fi
4134
4135
4136 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
4137         AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
4138 [[ extern int sys_nerr; printf("%i", sys_nerr);]])],
4139         [ ac_cv_libc_defines_sys_nerr="yes" ],
4140         [ ac_cv_libc_defines_sys_nerr="no"
4141         ])
4142 ])
4143 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
4144         AC_DEFINE([HAVE_SYS_NERR], [1], [Define if your system defines sys_nerr])
4145 fi
4146
4147 # Check libraries needed by DNS fingerprint support
4148 AC_SEARCH_LIBS([getrrsetbyname], [resolv],
4149         [AC_DEFINE([HAVE_GETRRSETBYNAME], [1],
4150                 [Define if getrrsetbyname() exists])],
4151         [
4152                 # Needed by our getrrsetbyname()
4153                 AC_SEARCH_LIBS([res_query], [resolv])
4154                 AC_SEARCH_LIBS([dn_expand], [resolv])
4155                 AC_MSG_CHECKING([if res_query will link])
4156                 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4157 #include <sys/types.h>
4158 #include <netinet/in.h>
4159 #include <arpa/nameser.h>
4160 #include <netdb.h>
4161 #include <resolv.h>
4162                                 ]], [[
4163         res_query (0, 0, 0, 0, 0);
4164                                 ]])],
4165                     AC_MSG_RESULT([yes]),
4166                    [AC_MSG_RESULT([no])
4167                     saved_LIBS="$LIBS"
4168                     LIBS="$LIBS -lresolv"
4169                     AC_MSG_CHECKING([for res_query in -lresolv])
4170                     AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4171 #include <sys/types.h>
4172 #include <netinet/in.h>
4173 #include <arpa/nameser.h>
4174 #include <netdb.h>
4175 #include <resolv.h>
4176                                 ]], [[
4177         res_query (0, 0, 0, 0, 0);
4178                                 ]])],
4179                         [AC_MSG_RESULT([yes])],
4180                         [LIBS="$saved_LIBS"
4181                          AC_MSG_RESULT([no])])
4182                     ])
4183                 AC_CHECK_FUNCS([_getshort _getlong])
4184                 AC_CHECK_DECLS([_getshort, _getlong], , ,
4185                     [#include <sys/types.h>
4186                     #include <arpa/nameser.h>])
4187                 AC_CHECK_MEMBER([HEADER.ad],
4188                         [AC_DEFINE([HAVE_HEADER_AD], [1],
4189                             [Define if HEADER.ad exists in arpa/nameser.h])], ,
4190                         [#include <arpa/nameser.h>])
4191         ])
4192
4193 AC_MSG_CHECKING([if struct __res_state _res is an extern])
4194 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
4195 #include <stdio.h>
4196 #if HAVE_SYS_TYPES_H
4197 # include <sys/types.h>
4198 #endif
4199 #include <netinet/in.h>
4200 #include <arpa/nameser.h>
4201 #include <resolv.h>
4202 extern struct __res_state _res;
4203                 ]], [[
4204 struct __res_state *volatile p = &_res;  /* force resolution of _res */
4205 return 0;
4206                 ]],)],
4207                 [AC_MSG_RESULT([yes])
4208                  AC_DEFINE([HAVE__RES_EXTERN], [1],
4209                     [Define if you have struct __res_state _res as an extern])
4210                 ],
4211                 [ AC_MSG_RESULT([no]) ]
4212 )
4213
4214 # Check whether user wants SELinux support
4215 SELINUX_MSG="no"
4216 LIBSELINUX=""
4217 AC_ARG_WITH([selinux],
4218         [  --with-selinux          Enable SELinux support],
4219         [ if test "x$withval" != "xno" ; then
4220                 save_LIBS="$LIBS"
4221                 AC_DEFINE([WITH_SELINUX], [1],
4222                         [Define if you want SELinux support.])
4223                 SELINUX_MSG="yes"
4224                 AC_CHECK_HEADER([selinux/selinux.h], ,
4225                         AC_MSG_ERROR([SELinux support requires selinux.h header]))
4226                 AC_CHECK_LIB([selinux], [setexeccon],
4227                         [ LIBSELINUX="-lselinux"
4228                           LIBS="$LIBS -lselinux"
4229                         ],
4230                         AC_MSG_ERROR([SELinux support requires libselinux library]))
4231                 SSHLIBS="$SSHLIBS $LIBSELINUX"
4232                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
4233                 AC_CHECK_FUNCS([getseuserbyname get_default_context_with_level])
4234                 LIBS="$save_LIBS"
4235         fi ]
4236 )
4237 AC_SUBST([SSHLIBS])
4238 AC_SUBST([SSHDLIBS])
4239
4240 # Check whether user wants Kerberos 5 support
4241 KRB5_MSG="no"
4242 AC_ARG_WITH([kerberos5],
4243         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
4244         [ if test "x$withval" != "xno" ; then
4245                 if test "x$withval" = "xyes" ; then
4246                         KRB5ROOT="/usr/local"
4247                 else
4248                         KRB5ROOT=${withval}
4249                 fi
4250
4251                 AC_DEFINE([KRB5], [1], [Define if you want Kerberos 5 support])
4252                 KRB5_MSG="yes"
4253
4254                 AC_PATH_TOOL([KRB5CONF], [krb5-config],
4255                              [$KRB5ROOT/bin/krb5-config],
4256                              [$KRB5ROOT/bin:$PATH])
4257                 if test -x $KRB5CONF ; then
4258                         K5CFLAGS="`$KRB5CONF --cflags`"
4259                         K5LIBS="`$KRB5CONF --libs`"
4260                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
4261
4262                         AC_MSG_CHECKING([for gssapi support])
4263                         if $KRB5CONF | grep gssapi >/dev/null ; then
4264                                 AC_MSG_RESULT([yes])
4265                                 AC_DEFINE([GSSAPI], [1],
4266                                         [Define this if you want GSSAPI
4267                                         support in the version 2 protocol])
4268                                 GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
4269                                 GSSLIBS="`$KRB5CONF --libs gssapi`"
4270                                 CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
4271                         else
4272                                 AC_MSG_RESULT([no])
4273                         fi
4274                         AC_MSG_CHECKING([whether we are using Heimdal])
4275                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4276                                 ]], [[ char *tmp = heimdal_version; ]])],
4277                                 [ AC_MSG_RESULT([yes])
4278                                 AC_DEFINE([HEIMDAL], [1],
4279                                 [Define this if you are using the Heimdal
4280                                 version of Kerberos V5]) ],
4281                                 [AC_MSG_RESULT([no])
4282                         ])
4283                 else
4284                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
4285                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
4286                         AC_MSG_CHECKING([whether we are using Heimdal])
4287                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
4288                                 ]], [[ char *tmp = heimdal_version; ]])],
4289                                         [ AC_MSG_RESULT([yes])
4290                                          AC_DEFINE([HEIMDAL])
4291                                          K5LIBS="-lkrb5"
4292                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
4293                                          AC_CHECK_LIB([roken], [net_write],
4294                                            [K5LIBS="$K5LIBS -lroken"])
4295                                          AC_CHECK_LIB([des], [des_cbc_encrypt],
4296                                            [K5LIBS="$K5LIBS -ldes"])
4297                                        ], [ AC_MSG_RESULT([no])
4298                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
4299                         ])
4300                         AC_SEARCH_LIBS([dn_expand], [resolv])
4301
4302                         AC_CHECK_LIB([gssapi_krb5], [gss_init_sec_context],
4303                                 [ AC_DEFINE([GSSAPI])
4304                                   GSSLIBS="-lgssapi_krb5" ],
4305                                 [ AC_CHECK_LIB([gssapi], [gss_init_sec_context],
4306                                         [ AC_DEFINE([GSSAPI])
4307                                           GSSLIBS="-lgssapi" ],
4308                                         [ AC_CHECK_LIB([gss], [gss_init_sec_context],
4309                                                 [ AC_DEFINE([GSSAPI])
4310                                                   GSSLIBS="-lgss" ],
4311                                                 AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]))
4312                                         ])
4313                                 ])
4314
4315                         AC_CHECK_HEADER([gssapi.h], ,
4316                                 [ unset ac_cv_header_gssapi_h
4317                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4318                                   AC_CHECK_HEADERS([gssapi.h], ,
4319                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
4320                                   )
4321                                 ]
4322                         )
4323
4324                         oldCPP="$CPPFLAGS"
4325                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
4326                         AC_CHECK_HEADER([gssapi_krb5.h], ,
4327                                         [ CPPFLAGS="$oldCPP" ])
4328
4329                 fi
4330                 if test ! -z "$need_dash_r" ; then
4331                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
4332                 fi
4333                 if test ! -z "$blibpath" ; then
4334                         blibpath="$blibpath:${KRB5ROOT}/lib"
4335                 fi
4336
4337                 AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
4338                 AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
4339                 AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
4340
4341                 AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
4342                         [Define this if you want to use libkafs' AFS support])])
4343
4344                 AC_CHECK_DECLS([GSS_C_NT_HOSTBASED_SERVICE], [], [], [[
4345 #ifdef HAVE_GSSAPI_H
4346 # include <gssapi.h>
4347 #elif defined(HAVE_GSSAPI_GSSAPI_H)
4348 # include <gssapi/gssapi.h>
4349 #endif
4350
4351 #ifdef HAVE_GSSAPI_GENERIC_H
4352 # include <gssapi_generic.h>
4353 #elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
4354 # include <gssapi/gssapi_generic.h>
4355 #endif
4356                 ]])
4357                 saved_LIBS="$LIBS"
4358                 LIBS="$LIBS $K5LIBS"
4359                 AC_CHECK_FUNCS([krb5_cc_new_unique krb5_get_error_message krb5_free_error_message])
4360                 LIBS="$saved_LIBS"
4361
4362         fi
4363         ]
4364 )
4365 AC_SUBST([GSSLIBS])
4366 AC_SUBST([K5LIBS])
4367
4368 # Looking for programs, paths and files
4369
4370 PRIVSEP_PATH=/var/empty
4371 AC_ARG_WITH([privsep-path],
4372         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
4373         [
4374                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4375                     test "x${withval}" != "xyes"; then
4376                         PRIVSEP_PATH=$withval
4377                 fi
4378         ]
4379 )
4380 AC_SUBST([PRIVSEP_PATH])
4381
4382 AC_ARG_WITH([xauth],
4383         [  --with-xauth=PATH       Specify path to xauth program ],
4384         [
4385                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4386                     test "x${withval}" != "xyes"; then
4387                         xauth_path=$withval
4388                 fi
4389         ],
4390         [
4391                 TestPath="$PATH"
4392                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
4393                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
4394                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
4395                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
4396                 AC_PATH_PROG([xauth_path], [xauth], , [$TestPath])
4397                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
4398                         xauth_path="/usr/openwin/bin/xauth"
4399                 fi
4400         ]
4401 )
4402
4403 STRIP_OPT=-s
4404 AC_ARG_ENABLE([strip],
4405         [  --disable-strip         Disable calling strip(1) on install],
4406         [
4407                 if test "x$enableval" = "xno" ; then
4408                         STRIP_OPT=
4409                 fi
4410         ]
4411 )
4412 AC_SUBST([STRIP_OPT])
4413
4414 if test -z "$xauth_path" ; then
4415         XAUTH_PATH="undefined"
4416         AC_SUBST([XAUTH_PATH])
4417 else
4418         AC_DEFINE_UNQUOTED([XAUTH_PATH], ["$xauth_path"],
4419                 [Define if xauth is found in your path])
4420         XAUTH_PATH=$xauth_path
4421         AC_SUBST([XAUTH_PATH])
4422 fi
4423
4424 dnl # --with-maildir=/path/to/mail gets top priority.
4425 dnl # if maildir is set in the platform case statement above we use that.
4426 dnl # Otherwise we run a program to get the dir from system headers.
4427 dnl # We first look for _PATH_MAILDIR then MAILDIR then _PATH_MAIL
4428 dnl # If we find _PATH_MAILDIR we do nothing because that is what
4429 dnl # session.c expects anyway. Otherwise we set to the value found
4430 dnl # stripping any trailing slash. If for some strage reason our program
4431 dnl # does not find what it needs, we default to /var/spool/mail.
4432 # Check for mail directory
4433 AC_ARG_WITH([maildir],
4434     [  --with-maildir=/path/to/mail    Specify your system mail directory],
4435     [
4436         if test "X$withval" != X  &&  test "x$withval" != xno  &&  \
4437             test "x${withval}" != xyes; then
4438                 AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$withval"],
4439             [Set this to your mail directory if you do not have _PATH_MAILDIR])
4440             fi
4441      ],[
4442         if test "X$maildir" != "X"; then
4443             AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4444         else
4445             AC_MSG_CHECKING([Discovering system mail directory])
4446             AC_RUN_IFELSE(
4447                 [AC_LANG_PROGRAM([[
4448 #include <stdio.h>
4449 #include <string.h>
4450 #ifdef HAVE_PATHS_H
4451 #include <paths.h>
4452 #endif
4453 #ifdef HAVE_MAILLOCK_H
4454 #include <maillock.h>
4455 #endif
4456 #define DATA "conftest.maildir"
4457         ]], [[
4458         FILE *fd;
4459         int rc;
4460
4461         fd = fopen(DATA,"w");
4462         if(fd == NULL)
4463                 exit(1);
4464
4465 #if defined (_PATH_MAILDIR)
4466         if ((rc = fprintf(fd ,"_PATH_MAILDIR:%s\n", _PATH_MAILDIR)) <0)
4467                 exit(1);
4468 #elif defined (MAILDIR)
4469         if ((rc = fprintf(fd ,"MAILDIR:%s\n", MAILDIR)) <0)
4470                 exit(1);
4471 #elif defined (_PATH_MAIL)
4472         if ((rc = fprintf(fd ,"_PATH_MAIL:%s\n", _PATH_MAIL)) <0)
4473                 exit(1);
4474 #else
4475         exit (2);
4476 #endif
4477
4478         exit(0);
4479                 ]])],
4480                 [
4481                     maildir_what=`awk -F: '{print $1}' conftest.maildir`
4482                     maildir=`awk -F: '{print $2}' conftest.maildir \
4483                         | sed 's|/$||'`
4484                     AC_MSG_RESULT([Using: $maildir from $maildir_what])
4485                     if test "x$maildir_what" != "x_PATH_MAILDIR"; then
4486                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["$maildir"])
4487                     fi
4488                 ],
4489                 [
4490                     if test "X$ac_status" = "X2";then
4491 # our test program didn't find it. Default to /var/spool/mail
4492                         AC_MSG_RESULT([Using: default value of /var/spool/mail])
4493                         AC_DEFINE_UNQUOTED([MAIL_DIRECTORY], ["/var/spool/mail"])
4494                      else
4495                         AC_MSG_RESULT([*** not found ***])
4496                      fi
4497                 ],
4498                 [
4499                         AC_MSG_WARN([cross compiling: use --with-maildir=/path/to/mail])
4500                 ]
4501             )
4502         fi
4503     ]
4504 ) # maildir
4505
4506 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
4507         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
4508         disable_ptmx_check=yes
4509 fi
4510 if test -z "$no_dev_ptmx" ; then
4511         if test "x$disable_ptmx_check" != "xyes" ; then
4512                 AC_CHECK_FILE(["/dev/ptmx"],
4513                         [
4514                                 AC_DEFINE_UNQUOTED([HAVE_DEV_PTMX], [1],
4515                                         [Define if you have /dev/ptmx])
4516                                 have_dev_ptmx=1
4517                         ]
4518                 )
4519         fi
4520 fi
4521
4522 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
4523         AC_CHECK_FILE(["/dev/ptc"],
4524                 [
4525                         AC_DEFINE_UNQUOTED([HAVE_DEV_PTS_AND_PTC], [1],
4526                                 [Define if you have /dev/ptc])
4527                         have_dev_ptc=1
4528                 ]
4529         )
4530 else
4531         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
4532 fi
4533
4534 # Options from here on. Some of these are preset by platform above
4535 AC_ARG_WITH([mantype],
4536         [  --with-mantype=man|cat|doc  Set man page type],
4537         [
4538                 case "$withval" in
4539                 man|cat|doc)
4540                         MANTYPE=$withval
4541                         ;;
4542                 *)
4543                         AC_MSG_ERROR([invalid man type: $withval])
4544                         ;;
4545                 esac
4546         ]
4547 )
4548 if test -z "$MANTYPE"; then
4549         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
4550         AC_PATH_PROGS([NROFF], [nroff awf], [/bin/false], [$TestPath])
4551         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
4552                 MANTYPE=doc
4553         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
4554                 MANTYPE=man
4555         else
4556                 MANTYPE=cat
4557         fi
4558 fi
4559 AC_SUBST([MANTYPE])
4560 if test "$MANTYPE" = "doc"; then
4561         mansubdir=man;
4562 else
4563         mansubdir=$MANTYPE;
4564 fi
4565 AC_SUBST([mansubdir])
4566
4567 # Check whether to enable MD5 passwords
4568 MD5_MSG="no"
4569 AC_ARG_WITH([md5-passwords],
4570         [  --with-md5-passwords    Enable use of MD5 passwords],
4571         [
4572                 if test "x$withval" != "xno" ; then
4573                         AC_DEFINE([HAVE_MD5_PASSWORDS], [1],
4574                                 [Define if you want to allow MD5 passwords])
4575                         MD5_MSG="yes"
4576                 fi
4577         ]
4578 )
4579
4580 # Whether to disable shadow password support
4581 AC_ARG_WITH([shadow],
4582         [  --without-shadow        Disable shadow password support],
4583         [
4584                 if test "x$withval" = "xno" ; then
4585                         AC_DEFINE([DISABLE_SHADOW])
4586                         disable_shadow=yes
4587                 fi
4588         ]
4589 )
4590
4591 if test -z "$disable_shadow" ; then
4592         AC_MSG_CHECKING([if the systems has expire shadow information])
4593         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4594 #include <sys/types.h>
4595 #include <shadow.h>
4596 struct spwd sp;
4597                 ]], [[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ]])],
4598                 [ sp_expire_available=yes ], [
4599         ])
4600
4601         if test "x$sp_expire_available" = "xyes" ; then
4602                 AC_MSG_RESULT([yes])
4603                 AC_DEFINE([HAS_SHADOW_EXPIRE], [1],
4604                     [Define if you want to use shadow password expire field])
4605         else
4606                 AC_MSG_RESULT([no])
4607         fi
4608 fi
4609
4610 # Use ip address instead of hostname in $DISPLAY
4611 if test ! -z "$IPADDR_IN_DISPLAY" ; then
4612         DISPLAY_HACK_MSG="yes"
4613         AC_DEFINE([IPADDR_IN_DISPLAY], [1],
4614                 [Define if you need to use IP address
4615                 instead of hostname in $DISPLAY])
4616 else
4617         DISPLAY_HACK_MSG="no"
4618         AC_ARG_WITH([ipaddr-display],
4619                 [  --with-ipaddr-display   Use ip address instead of hostname in $DISPLAY],
4620                 [
4621                         if test "x$withval" != "xno" ; then
4622                                 AC_DEFINE([IPADDR_IN_DISPLAY])
4623                                 DISPLAY_HACK_MSG="yes"
4624                         fi
4625                 ]
4626         )
4627 fi
4628
4629 # check for /etc/default/login and use it if present.
4630 AC_ARG_ENABLE([etc-default-login],
4631         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
4632         [ if test "x$enableval" = "xno"; then
4633                 AC_MSG_NOTICE([/etc/default/login handling disabled])
4634                 etc_default_login=no
4635           else
4636                 etc_default_login=yes
4637           fi ],
4638         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
4639           then
4640                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
4641                 etc_default_login=no
4642           else
4643                 etc_default_login=yes
4644           fi ]
4645 )
4646
4647 if test "x$etc_default_login" != "xno"; then
4648         AC_CHECK_FILE(["/etc/default/login"],
4649             [ external_path_file=/etc/default/login ])
4650         if test "x$external_path_file" = "x/etc/default/login"; then
4651                 AC_DEFINE([HAVE_ETC_DEFAULT_LOGIN], [1],
4652                         [Define if your system has /etc/default/login])
4653         fi
4654 fi
4655
4656 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
4657 if test $ac_cv_func_login_getcapbool = "yes" && \
4658         test $ac_cv_header_login_cap_h = "yes" ; then
4659         external_path_file=/etc/login.conf
4660 fi
4661
4662 # Whether to mess with the default path
4663 SERVER_PATH_MSG="(default)"
4664 AC_ARG_WITH([default-path],
4665         [  --with-default-path=    Specify default $PATH environment for server],
4666         [
4667                 if test "x$external_path_file" = "x/etc/login.conf" ; then
4668                         AC_MSG_WARN([
4669 --with-default-path=PATH has no effect on this system.
4670 Edit /etc/login.conf instead.])
4671                 elif test "x$withval" != "xno" ; then
4672                         if test ! -z "$external_path_file" ; then
4673                                 AC_MSG_WARN([
4674 --with-default-path=PATH will only be used if PATH is not defined in
4675 $external_path_file .])
4676                         fi
4677                         user_path="$withval"
4678                         SERVER_PATH_MSG="$withval"
4679                 fi
4680         ],
4681         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
4682                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
4683         else
4684                 if test ! -z "$external_path_file" ; then
4685                         AC_MSG_WARN([
4686 If PATH is defined in $external_path_file, ensure the path to scp is included,
4687 otherwise scp will not work.])
4688                 fi
4689                 AC_RUN_IFELSE(
4690                         [AC_LANG_PROGRAM([[
4691 /* find out what STDPATH is */
4692 #include <stdio.h>
4693 #ifdef HAVE_PATHS_H
4694 # include <paths.h>
4695 #endif
4696 #ifndef _PATH_STDPATH
4697 # ifdef _PATH_USERPATH  /* Irix */
4698 #  define _PATH_STDPATH _PATH_USERPATH
4699 # else
4700 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
4701 # endif
4702 #endif
4703 #include <sys/types.h>
4704 #include <sys/stat.h>
4705 #include <fcntl.h>
4706 #define DATA "conftest.stdpath"
4707                         ]], [[
4708         FILE *fd;
4709         int rc;
4710
4711         fd = fopen(DATA,"w");
4712         if(fd == NULL)
4713                 exit(1);
4714
4715         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
4716                 exit(1);
4717
4718         exit(0);
4719                 ]])],
4720                 [ user_path=`cat conftest.stdpath` ],
4721                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
4722                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
4723         )
4724 # make sure $bindir is in USER_PATH so scp will work
4725                 t_bindir="${bindir}"
4726                 while echo "${t_bindir}" | egrep '\$\{|NONE/' >/dev/null 2>&1; do
4727                         t_bindir=`eval echo ${t_bindir}`
4728                         case $t_bindir in
4729                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
4730                         esac
4731                         case $t_bindir in
4732                                 NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
4733                         esac
4734                 done
4735                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
4736                 if test $? -ne 0  ; then
4737                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
4738                         if test $? -ne 0  ; then
4739                                 user_path=$user_path:$t_bindir
4740                                 AC_MSG_RESULT([Adding $t_bindir to USER_PATH so scp will work])
4741                         fi
4742                 fi
4743         fi ]
4744 )
4745 if test "x$external_path_file" != "x/etc/login.conf" ; then
4746         AC_DEFINE_UNQUOTED([USER_PATH], ["$user_path"], [Specify default $PATH])
4747         AC_SUBST([user_path])
4748 fi
4749
4750 # Set superuser path separately to user path
4751 AC_ARG_WITH([superuser-path],
4752         [  --with-superuser-path=  Specify different path for super-user],
4753         [
4754                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4755                     test "x${withval}" != "xyes"; then
4756                         AC_DEFINE_UNQUOTED([SUPERUSER_PATH], ["$withval"],
4757                                 [Define if you want a different $PATH
4758                                 for the superuser])
4759                         superuser_path=$withval
4760                 fi
4761         ]
4762 )
4763
4764
4765 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
4766 IPV4_IN6_HACK_MSG="no"
4767 AC_ARG_WITH(4in6,
4768         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
4769         [
4770                 if test "x$withval" != "xno" ; then
4771                         AC_MSG_RESULT([yes])
4772                         AC_DEFINE([IPV4_IN_IPV6], [1],
4773                                 [Detect IPv4 in IPv6 mapped addresses
4774                                 and treat as IPv4])
4775                         IPV4_IN6_HACK_MSG="yes"
4776                 else
4777                         AC_MSG_RESULT([no])
4778                 fi
4779         ], [
4780                 if test "x$inet6_default_4in6" = "xyes"; then
4781                         AC_MSG_RESULT([yes (default)])
4782                         AC_DEFINE([IPV4_IN_IPV6])
4783                         IPV4_IN6_HACK_MSG="yes"
4784                 else
4785                         AC_MSG_RESULT([no (default)])
4786                 fi
4787         ]
4788 )
4789
4790 # Whether to enable BSD auth support
4791 BSD_AUTH_MSG=no
4792 AC_ARG_WITH([bsd-auth],
4793         [  --with-bsd-auth         Enable BSD auth support],
4794         [
4795                 if test "x$withval" != "xno" ; then
4796                         AC_DEFINE([BSD_AUTH], [1],
4797                                 [Define if you have BSD auth support])
4798                         BSD_AUTH_MSG=yes
4799                 fi
4800         ]
4801 )
4802
4803 # Where to place sshd.pid
4804 piddir=/var/run
4805 # make sure the directory exists
4806 if test ! -d $piddir ; then
4807         piddir=`eval echo ${sysconfdir}`
4808         case $piddir in
4809                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
4810         esac
4811 fi
4812
4813 AC_ARG_WITH([pid-dir],
4814         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
4815         [
4816                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4817                     test "x${withval}" != "xyes"; then
4818                         piddir=$withval
4819                         if test ! -d $piddir ; then
4820                         AC_MSG_WARN([** no $piddir directory on this system **])
4821                         fi
4822                 fi
4823         ]
4824 )
4825
4826 AC_DEFINE_UNQUOTED([_PATH_SSH_PIDDIR], ["$piddir"],
4827         [Specify location of ssh.pid])
4828 AC_SUBST([piddir])
4829
4830 dnl allow user to disable some login recording features
4831 AC_ARG_ENABLE([lastlog],
4832         [  --disable-lastlog       disable use of lastlog even if detected [no]],
4833         [
4834                 if test "x$enableval" = "xno" ; then
4835                         AC_DEFINE([DISABLE_LASTLOG])
4836                 fi
4837         ]
4838 )
4839 AC_ARG_ENABLE([utmp],
4840         [  --disable-utmp          disable use of utmp even if detected [no]],
4841         [
4842                 if test "x$enableval" = "xno" ; then
4843                         AC_DEFINE([DISABLE_UTMP])
4844                 fi
4845         ]
4846 )
4847 AC_ARG_ENABLE([utmpx],
4848         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4849         [
4850                 if test "x$enableval" = "xno" ; then
4851                         AC_DEFINE([DISABLE_UTMPX], [1],
4852                                 [Define if you don't want to use utmpx])
4853                 fi
4854         ]
4855 )
4856 AC_ARG_ENABLE([wtmp],
4857         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4858         [
4859                 if test "x$enableval" = "xno" ; then
4860                         AC_DEFINE([DISABLE_WTMP])
4861                 fi
4862         ]
4863 )
4864 AC_ARG_ENABLE([wtmpx],
4865         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4866         [
4867                 if test "x$enableval" = "xno" ; then
4868                         AC_DEFINE([DISABLE_WTMPX], [1],
4869                                 [Define if you don't want to use wtmpx])
4870                 fi
4871         ]
4872 )
4873 AC_ARG_ENABLE([libutil],
4874         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4875         [
4876                 if test "x$enableval" = "xno" ; then
4877                         AC_DEFINE([DISABLE_LOGIN])
4878                 fi
4879         ]
4880 )
4881 AC_ARG_ENABLE([pututline],
4882         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4883         [
4884                 if test "x$enableval" = "xno" ; then
4885                         AC_DEFINE([DISABLE_PUTUTLINE], [1],
4886                                 [Define if you don't want to use pututline()
4887                                 etc. to write [uw]tmp])
4888                 fi
4889         ]
4890 )
4891 AC_ARG_ENABLE([pututxline],
4892         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4893         [
4894                 if test "x$enableval" = "xno" ; then
4895                         AC_DEFINE([DISABLE_PUTUTXLINE], [1],
4896                                 [Define if you don't want to use pututxline()
4897                                 etc. to write [uw]tmpx])
4898                 fi
4899         ]
4900 )
4901 AC_ARG_WITH([lastlog],
4902   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4903         [
4904                 if test "x$withval" = "xno" ; then
4905                         AC_DEFINE([DISABLE_LASTLOG])
4906                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4907                         conf_lastlog_location=$withval
4908                 fi
4909         ]
4910 )
4911
4912 dnl lastlog, [uw]tmpx? detection
4913 dnl  NOTE: set the paths in the platform section to avoid the
4914 dnl   need for command-line parameters
4915 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4916
4917 dnl lastlog detection
4918 dnl  NOTE: the code itself will detect if lastlog is a directory
4919 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4920 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4921 #include <sys/types.h>
4922 #include <utmp.h>
4923 #ifdef HAVE_LASTLOG_H
4924 #  include <lastlog.h>
4925 #endif
4926 #ifdef HAVE_PATHS_H
4927 #  include <paths.h>
4928 #endif
4929 #ifdef HAVE_LOGIN_H
4930 # include <login.h>
4931 #endif
4932         ]], [[ char *lastlog = LASTLOG_FILE; ]])],
4933                 [ AC_MSG_RESULT([yes]) ],
4934                 [
4935                 AC_MSG_RESULT([no])
4936                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4937                 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4938 #include <sys/types.h>
4939 #include <utmp.h>
4940 #ifdef HAVE_LASTLOG_H
4941 #  include <lastlog.h>
4942 #endif
4943 #ifdef HAVE_PATHS_H
4944 #  include <paths.h>
4945 #endif
4946                 ]], [[ char *lastlog = _PATH_LASTLOG; ]])],
4947                 [ AC_MSG_RESULT([yes]) ],
4948                 [
4949                         AC_MSG_RESULT([no])
4950                         system_lastlog_path=no
4951                 ])
4952 ])
4953
4954 if test -z "$conf_lastlog_location"; then
4955         if test x"$system_lastlog_path" = x"no" ; then
4956                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
4957                                 if (test -d "$f" || test -f "$f") ; then
4958                                         conf_lastlog_location=$f
4959                                 fi
4960                 done
4961                 if test -z "$conf_lastlog_location"; then
4962                         AC_MSG_WARN([** Cannot find lastlog **])
4963                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4964                 fi
4965         fi
4966 fi
4967
4968 if test -n "$conf_lastlog_location"; then
4969         AC_DEFINE_UNQUOTED([CONF_LASTLOG_FILE], ["$conf_lastlog_location"],
4970                 [Define if you want to specify the path to your lastlog file])
4971 fi
4972
4973 dnl utmp detection
4974 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4975 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
4976 #include <sys/types.h>
4977 #include <utmp.h>
4978 #ifdef HAVE_PATHS_H
4979 #  include <paths.h>
4980 #endif
4981         ]], [[ char *utmp = UTMP_FILE; ]])],
4982         [ AC_MSG_RESULT([yes]) ],
4983         [ AC_MSG_RESULT([no])
4984           system_utmp_path=no
4985 ])
4986 if test -z "$conf_utmp_location"; then
4987         if test x"$system_utmp_path" = x"no" ; then
4988                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
4989                         if test -f $f ; then
4990                                 conf_utmp_location=$f
4991                         fi
4992                 done
4993                 if test -z "$conf_utmp_location"; then
4994                         AC_DEFINE([DISABLE_UTMP])
4995                 fi
4996         fi
4997 fi
4998 if test -n "$conf_utmp_location"; then
4999         AC_DEFINE_UNQUOTED([CONF_UTMP_FILE], ["$conf_utmp_location"],
5000                 [Define if you want to specify the path to your utmp file])
5001 fi
5002
5003 dnl wtmp detection
5004 AC_MSG_CHECKING([if your system defines WTMP_FILE])
5005 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5006 #include <sys/types.h>
5007 #include <utmp.h>
5008 #ifdef HAVE_PATHS_H
5009 #  include <paths.h>
5010 #endif
5011         ]], [[ char *wtmp = WTMP_FILE; ]])],
5012         [ AC_MSG_RESULT([yes]) ],
5013         [ AC_MSG_RESULT([no])
5014           system_wtmp_path=no
5015 ])
5016 if test -z "$conf_wtmp_location"; then
5017         if test x"$system_wtmp_path" = x"no" ; then
5018                 for f in /usr/adm/wtmp /var/log/wtmp; do
5019                         if test -f $f ; then
5020                                 conf_wtmp_location=$f
5021                         fi
5022                 done
5023                 if test -z "$conf_wtmp_location"; then
5024                         AC_DEFINE([DISABLE_WTMP])
5025                 fi
5026         fi
5027 fi
5028 if test -n "$conf_wtmp_location"; then
5029         AC_DEFINE_UNQUOTED([CONF_WTMP_FILE], ["$conf_wtmp_location"],
5030                 [Define if you want to specify the path to your wtmp file])
5031 fi
5032
5033 dnl wtmpx detection
5034 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
5035 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
5036 #include <sys/types.h>
5037 #include <utmp.h>
5038 #ifdef HAVE_UTMPX_H
5039 #include <utmpx.h>
5040 #endif
5041 #ifdef HAVE_PATHS_H
5042 #  include <paths.h>
5043 #endif
5044         ]], [[ char *wtmpx = WTMPX_FILE; ]])],
5045         [ AC_MSG_RESULT([yes]) ],
5046         [ AC_MSG_RESULT([no])
5047           system_wtmpx_path=no
5048 ])
5049 if test -z "$conf_wtmpx_location"; then
5050         if test x"$system_wtmpx_path" = x"no" ; then
5051                 AC_DEFINE([DISABLE_WTMPX])
5052         fi
5053 else
5054         AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"],
5055                 [Define if you want to specify the path to your wtmpx file])
5056 fi
5057
5058
5059 if test ! -z "$blibpath" ; then
5060         LDFLAGS="$LDFLAGS $blibflags$blibpath"
5061         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
5062 fi
5063
5064 AC_CHECK_MEMBER([struct lastlog.ll_line], [], [
5065     if test x$SKIP_DISABLE_LASTLOG_DEFINE != "xyes" ; then
5066         AC_DEFINE([DISABLE_LASTLOG])
5067     fi
5068         ], [
5069 #ifdef HAVE_SYS_TYPES_H
5070 #include <sys/types.h>
5071 #endif
5072 #ifdef HAVE_UTMP_H
5073 #include <utmp.h>
5074 #endif
5075 #ifdef HAVE_UTMPX_H
5076 #include <utmpx.h>
5077 #endif
5078 #ifdef HAVE_LASTLOG_H
5079 #include <lastlog.h>
5080 #endif
5081         ])
5082
5083 AC_CHECK_MEMBER([struct utmp.ut_line], [], [
5084         AC_DEFINE([DISABLE_UTMP])
5085         AC_DEFINE([DISABLE_WTMP])
5086         ], [
5087 #ifdef HAVE_SYS_TYPES_H
5088 #include <sys/types.h>
5089 #endif
5090 #ifdef HAVE_UTMP_H
5091 #include <utmp.h>
5092 #endif
5093 #ifdef HAVE_UTMPX_H
5094 #include <utmpx.h>
5095 #endif
5096 #ifdef HAVE_LASTLOG_H
5097 #include <lastlog.h>
5098 #endif
5099         ])
5100
5101 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
5102 dnl Add now.
5103 CFLAGS="$CFLAGS $werror_flags"
5104
5105 if test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
5106         TEST_SSH_IPV6=no
5107 else
5108         TEST_SSH_IPV6=yes
5109 fi
5110 AC_CHECK_DECL([BROKEN_GETADDRINFO],  [TEST_SSH_IPV6=no])
5111 AC_SUBST([TEST_SSH_IPV6], [$TEST_SSH_IPV6])
5112 AC_SUBST([TEST_SSH_UTF8], [$TEST_SSH_UTF8])
5113 AC_SUBST([TEST_MALLOC_OPTIONS], [$TEST_MALLOC_OPTIONS])
5114 AC_SUBST([UNSUPPORTED_ALGORITHMS], [$unsupported_algorithms])
5115
5116 CFLAGS="${CFLAGS} ${CFLAGS_AFTER}"
5117 LDFLAGS="${LDFLAGS} ${LDFLAGS_AFTER}"
5118
5119 AC_EXEEXT
5120 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
5121         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
5122         survey.sh])
5123 AC_OUTPUT
5124
5125 # Print summary of options
5126
5127 # Someone please show me a better way :)
5128 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
5129 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
5130 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
5131 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
5132 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
5133 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
5134 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
5135 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
5136 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
5137 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
5138
5139 echo ""
5140 echo "OpenSSH has been configured with the following options:"
5141 echo "                     User binaries: $B"
5142 echo "                   System binaries: $C"
5143 echo "               Configuration files: $D"
5144 echo "                   Askpass program: $E"
5145 echo "                      Manual pages: $F"
5146 echo "                          PID file: $G"
5147 echo "  Privilege separation chroot path: $H"
5148 if test "x$external_path_file" = "x/etc/login.conf" ; then
5149 echo "   At runtime, sshd will use the path defined in $external_path_file"
5150 echo "   Make sure the path to scp is present, otherwise scp will not work"
5151 else
5152 echo "            sshd default user PATH: $I"
5153         if test ! -z "$external_path_file"; then
5154 echo "   (If PATH is set in $external_path_file it will be used instead. If"
5155 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
5156         fi
5157 fi
5158 if test ! -z "$superuser_path" ; then
5159 echo "          sshd superuser user PATH: $J"
5160 fi
5161 echo "                    Manpage format: $MANTYPE"
5162 echo "                       PAM support: $PAM_MSG"
5163 echo "                   OSF SIA support: $SIA_MSG"
5164 echo "                 KerberosV support: $KRB5_MSG"
5165 echo "                   SELinux support: $SELINUX_MSG"
5166 echo "                 Smartcard support: $SCARD_MSG"
5167 echo "                     S/KEY support: $SKEY_MSG"
5168 echo "              TCP Wrappers support: $TCPW_MSG"
5169 echo "              MD5 password support: $MD5_MSG"
5170 echo "                   libedit support: $LIBEDIT_MSG"
5171 echo "                   libldns support: $LDNS_MSG"
5172 echo "  Solaris process contract support: $SPC_MSG"
5173 echo "           Solaris project support: $SP_MSG"
5174 echo "         Solaris privilege support: $SPP_MSG"
5175 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
5176 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
5177 echo "                  BSD Auth support: $BSD_AUTH_MSG"
5178 echo "              Random number source: $RAND_MSG"
5179 echo "             Privsep sandbox style: $SANDBOX_STYLE"
5180
5181 echo ""
5182
5183 echo "              Host: ${host}"
5184 echo "          Compiler: ${CC}"
5185 echo "    Compiler flags: ${CFLAGS}"
5186 echo "Preprocessor flags: ${CPPFLAGS}"
5187 echo "      Linker flags: ${LDFLAGS}"
5188 echo "         Libraries: ${LIBS}"
5189 if test ! -z "${SSHDLIBS}"; then
5190 echo "         +for sshd: ${SSHDLIBS}"
5191 fi
5192 if test ! -z "${SSHLIBS}"; then
5193 echo "          +for ssh: ${SSHLIBS}"
5194 fi
5195
5196 echo ""
5197
5198 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
5199         echo "SVR4 style packages are supported with \"make package\""
5200         echo ""
5201 fi
5202
5203 if test "x$PAM_MSG" = "xyes" ; then
5204         echo "PAM is enabled. You may need to install a PAM control file "
5205         echo "for sshd, otherwise password authentication may fail. "
5206         echo "Example PAM control files can be found in the contrib/ "
5207         echo "subdirectory"
5208         echo ""
5209 fi
5210
5211 if test ! -z "$NO_PEERCHECK" ; then
5212         echo "WARNING: the operating system that you are using does not"
5213         echo "appear to support getpeereid(), getpeerucred() or the"
5214         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
5215         echo "enforce security checks to prevent unauthorised connections to"
5216         echo "ssh-agent. Their absence increases the risk that a malicious"
5217         echo "user can connect to your agent."
5218         echo ""
5219 fi
5220
5221 if test "$AUDIT_MODULE" = "bsm" ; then
5222         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
5223         echo "See the Solaris section in README.platform for details."
5224 fi