openssh/configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22
  23 AC_PROG_CC
  24 AC_CANONICAL_HOST
  25 AC_C_BIGENDIAN
  26
  27 # Checks for programs.
  28 AC_PROG_AWK
  29 AC_PROG_CPP
  30 AC_PROG_RANLIB
  31 AC_PROG_INSTALL
  32 AC_PROG_EGREP
  33 AC_PATH_PROG(AR, ar)
  34 AC_PATH_PROG(CAT, cat)
  35 AC_PATH_PROG(KILL, kill)
  36 AC_PATH_PROGS(PERL, perl5 perl)
  37 AC_PATH_PROG(SED, sed)
  38 AC_SUBST(PERL)
  39 AC_PATH_PROG(ENT, ent)
  40 AC_SUBST(ENT)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  43 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  44 AC_PATH_PROG(SH, sh)
  45 AC_SUBST(TEST_SHELL,sh)
  46
  47 dnl for buildpkg.sh
  48 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  49         [/usr/sbin${PATH_SEPARATOR}/etc])
  50 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  51         [/usr/sbin${PATH_SEPARATOR}/etc])
  52 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  53 if test -x /sbin/sh; then
  54         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  55 else
  56         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  57 fi
  58
  59 # System features
  60 AC_SYS_LARGEFILE
  61
  62 if test -z "$AR" ; then
  63         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  64 fi
  65
  66 # Use LOGIN_PROGRAM from environment if possible
  67 if test ! -z "$LOGIN_PROGRAM" ; then
  68         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  69                 [If your header files don't define LOGIN_PROGRAM,
  70                 then use this (detected) from environment and PATH])
  71 else
  72         # Search for login
  73         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  74         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  75                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  76         fi
  77 fi
  78
  79 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  80 if test ! -z "$PATH_PASSWD_PROG" ; then
  81         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  82                 [Full path of your "passwd" program])
  83 fi
  84
  85 if test -z "$LD" ; then
  86         LD=$CC
  87 fi
  88 AC_SUBST(LD)
  89
  90 AC_C_INLINE
  91
  92 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  93
  94 use_stack_protector=1
  95 AC_ARG_WITH(stackprotect,
  96     [  --without-stackprotect  Don't use compiler's stack protection], [
  97     if test "x$withval" = "xno"; then
  98         use_stack_protector=0
  99     fi ])
 100
 101 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 102         CFLAGS="$CFLAGS -Wall -Wpointer-arith"
 103         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 104         case $GCC_VER in
 105                 1.*) no_attrib_nonnull=1 ;;
 106                 2.8* | 2.9*)
 107                      CFLAGS="$CFLAGS -Wsign-compare"
 108                      no_attrib_nonnull=1
 109                      ;;
 110                 2.*) no_attrib_nonnull=1 ;;
 111                 3.*) CFLAGS="$CFLAGS -Wsign-compare -Wformat-security" ;;
 112                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign -Wformat-security" ;;
 113                 *) ;;
 114         esac
 115
 116         AC_MSG_CHECKING(if $CC accepts -fno-builtin-memset)
 117         saved_CFLAGS="$CFLAGS"
 118         CFLAGS="$CFLAGS -fno-builtin-memset"
 119         AC_LINK_IFELSE( [AC_LANG_SOURCE([[
 120 #include <string.h>
 121 int main(void){char b[10]; memset(b, 0, sizeof(b));}
 122                 ]])],
 123                 [ AC_MSG_RESULT(yes) ],
 124                 [ AC_MSG_RESULT(no)
 125                   CFLAGS="$saved_CFLAGS" ]
 126 )
 127
 128         # -fstack-protector-all doesn't always work for some GCC versions
 129         # and/or platforms, so we test if we can.  If it's not supported
 130         # on a give platform gcc will emit a warning so we use -Werror.
 131         if test "x$use_stack_protector" = "x1"; then
 132             for t in -fstack-protector-all -fstack-protector; do
 133                 AC_MSG_CHECKING(if $CC supports $t)
 134                 saved_CFLAGS="$CFLAGS"
 135                 saved_LDFLAGS="$LDFLAGS"
 136                 CFLAGS="$CFLAGS $t -Werror"
 137                 LDFLAGS="$LDFLAGS $t -Werror"
 138                 AC_LINK_IFELSE(
 139                         [AC_LANG_SOURCE([
 140 #include <stdlib.h>
 141 int main(void){return 0;}
 142                          ])],
 143                     [ AC_MSG_RESULT(yes)
 144                       CFLAGS="$saved_CFLAGS $t"
 145                       LDFLAGS="$saved_LDFLAGS $t"
 146                       AC_MSG_CHECKING(if $t works)
 147                       AC_RUN_IFELSE(
 148                         [AC_LANG_SOURCE([
 149 #include <stdlib.h>
 150 int main(void){exit(0);}
 151                         ])],
 152                         [ AC_MSG_RESULT(yes)
 153                           break ],
 154                         [ AC_MSG_RESULT(no) ],
 155                         [ AC_MSG_WARN([cross compiling: cannot test])
 156                           break ]
 157                       )
 158                     ],
 159                     [ AC_MSG_RESULT(no) ]
 160                 )
 161                 CFLAGS="$saved_CFLAGS"
 162                 LDFLAGS="$saved_LDFLAGS"
 163             done
 164         fi
 165
 166         if test -z "$have_llong_max"; then
 167                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 168                 unset ac_cv_have_decl_LLONG_MAX
 169                 saved_CFLAGS="$CFLAGS"
 170                 CFLAGS="$CFLAGS -std=gnu99"
 171                 AC_CHECK_DECL(LLONG_MAX,
 172                     [have_llong_max=1],
 173                     [CFLAGS="$saved_CFLAGS"],
 174                     [#include <limits.h>]
 175                 )
 176         fi
 177 fi
 178
 179 if test "x$no_attrib_nonnull" != "x1" ; then
 180         AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
 181 fi
 182
 183 AC_ARG_WITH(rpath,
 184         [  --without-rpath         Disable auto-added -R linker paths],
 185         [
 186                 if test "x$withval" = "xno" ; then
 187                         need_dash_r=""
 188                 fi
 189                 if test "x$withval" = "xyes" ; then
 190                         need_dash_r=1
 191                 fi
 192         ]
 193 )
 194
 195 # Allow user to specify flags
 196 AC_ARG_WITH(cflags,
 197         [  --with-cflags           Specify additional flags to pass to compiler],
 198         [
 199                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 200                     test "x${withval}" != "xyes"; then
 201                         CFLAGS="$CFLAGS $withval"
 202                 fi
 203         ]
 204 )
 205 AC_ARG_WITH(cppflags,
 206         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 207         [
 208                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 209                     test "x${withval}" != "xyes"; then
 210                         CPPFLAGS="$CPPFLAGS $withval"
 211                 fi
 212         ]
 213 )
 214 AC_ARG_WITH(ldflags,
 215         [  --with-ldflags          Specify additional flags to pass to linker],
 216         [
 217                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 218                     test "x${withval}" != "xyes"; then
 219                         LDFLAGS="$LDFLAGS $withval"
 220                 fi
 221         ]
 222 )
 223 AC_ARG_WITH(libs,
 224         [  --with-libs             Specify additional libraries to link with],
 225         [
 226                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 227                     test "x${withval}" != "xyes"; then
 228                         LIBS="$LIBS $withval"
 229                 fi
 230         ]
 231 )
 232 AC_ARG_WITH(Werror,
 233         [  --with-Werror           Build main code with -Werror],
 234         [
 235                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 236                         werror_flags="-Werror"
 237                         if test "x${withval}" != "xyes"; then
 238                                 werror_flags="$withval"
 239                         fi
 240                 fi
 241         ]
 242 )
 243
 244 AC_CHECK_HEADERS( \
 245         bstring.h \
 246         crypt.h \
 247         crypto/sha2.h \
 248         dirent.h \
 249         endian.h \
 250         features.h \
 251         fcntl.h \
 252         floatingpoint.h \
 253         getopt.h \
 254         glob.h \
 255         ia.h \
 256         iaf.h \
 257         limits.h \
 258         login.h \
 259         maillock.h \
 260         ndir.h \
 261         net/if_tun.h \
 262         netdb.h \
 263         netgroup.h \
 264         pam/pam_appl.h \
 265         paths.h \
 266         poll.h \
 267         pty.h \
 268         readpassphrase.h \
 269         rpc/types.h \
 270         security/pam_appl.h \
 271         sha2.h \
 272         shadow.h \
 273         stddef.h \
 274         stdint.h \
 275         string.h \
 276         strings.h \
 277         sys/audit.h \
 278         sys/bitypes.h \
 279         sys/bsdtty.h \
 280         sys/cdefs.h \
 281         sys/dir.h \
 282         sys/mman.h \
 283         sys/mount.h \
 284         sys/ndir.h \
 285         sys/poll.h \
 286         sys/prctl.h \
 287         sys/pstat.h \
 288         sys/select.h \
 289         sys/stat.h \
 290         sys/stream.h \
 291         sys/stropts.h \
 292         sys/strtio.h \
 293         sys/statvfs.h \
 294         sys/sysmacros.h \
 295         sys/time.h \
 296         sys/timers.h \
 297         sys/un.h \
 298         time.h \
 299         tmpdir.h \
 300         ttyent.h \
 301         ucred.h \
 302         unistd.h \
 303         usersec.h \
 304         util.h \
 305         utime.h \
 306         utmp.h \
 307         utmpx.h \
 308         vis.h \
 309 )
 310
 311 # lastlog.h requires sys/time.h to be included first on Solaris
 312 AC_CHECK_HEADERS(lastlog.h, [], [], [
 313 #ifdef HAVE_SYS_TIME_H
 314 # include <sys/time.h>
 315 #endif
 316 ])
 317
 318 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 319 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 320 #ifdef HAVE_SYS_STREAM_H
 321 # include <sys/stream.h>
 322 #endif
 323 ])
 324
 325 # login_cap.h requires sys/types.h on NetBSD
 326 AC_CHECK_HEADERS(login_cap.h, [], [], [
 327 #include <sys/types.h>
 328 ])
 329
 330 # Messages for features tested for in target-specific section
 331 SIA_MSG="no"
 332 SPC_MSG="no"
 333
 334 # Check for some target-specific stuff
 335 case "$host" in
 336 *-*-aix*)
 337         # Some versions of VAC won't allow macro redefinitions at
 338         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 339         # particularly with older versions of vac or xlc.
 340         # It also throws errors about null macro argments, but these are
 341         # not fatal.
 342         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 343         AC_COMPILE_IFELSE(
 344             [AC_LANG_SOURCE([[
 345 #define testmacro foo
 346 #define testmacro bar
 347 int main(void) { exit(0); }
 348             ]])],
 349             [ AC_MSG_RESULT(yes) ],
 350             [ AC_MSG_RESULT(no)
 351               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 352               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 353               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 354               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 355             ]
 356         )
 357
 358         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 359         if (test -z "$blibpath"); then
 360                 blibpath="/usr/lib:/lib"
 361         fi
 362         saved_LDFLAGS="$LDFLAGS"
 363         if test "$GCC" = "yes"; then
 364                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 365         else
 366                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 367         fi
 368         for tryflags in $flags ;do
 369                 if (test -z "$blibflags"); then
 370                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 371                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 372                 fi
 373         done
 374         if (test -z "$blibflags"); then
 375                 AC_MSG_RESULT(not found)
 376                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 377         else
 378                 AC_MSG_RESULT($blibflags)
 379         fi
 380         LDFLAGS="$saved_LDFLAGS"
 381         dnl Check for authenticate.  Might be in libs.a on older AIXes
 382         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 383                 [Define if you want to enable AIX4's authenticate function])],
 384                 [AC_CHECK_LIB(s,authenticate,
 385                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 386                                 LIBS="$LIBS -ls"
 387                         ])
 388                 ])
 389         dnl Check for various auth function declarations in headers.
 390         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 391             passwdexpired, setauthdb], , , [#include <usersec.h>])
 392         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 393         AC_CHECK_DECLS(loginfailed,
 394                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 395                   AC_TRY_COMPILE(
 396                         [#include <usersec.h>],
 397                         [(void)loginfailed("user","host","tty",0);],
 398                         [AC_MSG_RESULT(yes)
 399                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 400                                 [Define if your AIX loginfailed() function
 401                                 takes 4 arguments (AIX >= 5.2)])],
 402                         [AC_MSG_RESULT(no)]
 403                 )],
 404                 [],
 405                 [#include <usersec.h>]
 406         )
 407         AC_CHECK_FUNCS(getgrset setauthdb)
 408         AC_CHECK_DECL(F_CLOSEM,
 409             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 410             [],
 411             [ #include <limits.h>
 412               #include <fcntl.h> ]
 413         )
 414         check_for_aix_broken_getaddrinfo=1
 415         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 416         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 417             [Define if your platform breaks doing a seteuid before a setuid])
 418         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 419         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 420         dnl AIX handles lastlog as part of its login message
 421         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 422         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 423                 [Some systems need a utmpx entry for /bin/login to work])
 424         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 425                 [Define to a Set Process Title type if your system is
 426                 supported by bsd-setproctitle.c])
 427         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 428             [AIX 5.2 and 5.3 (and presumably newer) require this])
 429         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 430         ;;
 431 *-*-cygwin*)
 432         check_for_libcrypt_later=1
 433         LIBS="$LIBS /usr/lib/textreadmode.o"
 434         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 435         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 436         AC_DEFINE(DISABLE_SHADOW, 1,
 437                 [Define if you want to disable shadow passwords])
 438         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 439                 [Define if your system choked on IP TOS setting])
 440         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 441                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 442         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 443                 [Define if the concept of ports only accessible to
 444                 superusers isn't known])
 445         AC_DEFINE(DISABLE_FD_PASSING, 1,
 446                 [Define if your platform needs to skip post auth
 447                 file descriptor passing])
 448         ;;
 449 *-*-dgux*)
 450         AC_DEFINE(IP_TOS_IS_BROKEN)
 451         AC_DEFINE(SETEUID_BREAKS_SETUID)
 452         AC_DEFINE(BROKEN_SETREUID)
 453         AC_DEFINE(BROKEN_SETREGID)
 454         ;;
 455 *-*-darwin*)
 456         AC_DEFINE(BROKEN_GETADDRINFO, 1, [Define if getaddrinfo is broken)])
 457         AC_DEFINE(BROKEN_GETADDRINFO)
 458         AC_DEFINE(SETEUID_BREAKS_SETUID)
 459         AC_DEFINE(BROKEN_SETREUID)
 460         AC_DEFINE(BROKEN_SETREGID)
 461         AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
 462         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 463                 [Define if your resolver libs need this for getrrsetbyname])
 464         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 465         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 466             [Use tunnel device compatibility to OpenBSD])
 467         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 468             [Prepend the address family to IP tunnel traffic])
 469         m4_pattern_allow(AU_IPv)
 470         AC_CHECK_DECL(AU_IPv4, [],
 471             AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
 472             [#include <bsm/audit.h>]
 473         )
 474         AC_MSG_CHECKING(if we have the Security Authorization Session API)
 475         AC_TRY_COMPILE([#include <Security/AuthSession.h>],
 476                 [SessionCreate(0, 0);],
 477                 [ac_cv_use_security_session_api="yes"
 478                  AC_DEFINE(USE_SECURITY_SESSION_API, 1,
 479                         [platform has the Security Authorization Session API])
 480                  LIBS="$LIBS -framework Security"
 481                  AC_MSG_RESULT(yes)],
 482                 [ac_cv_use_security_session_api="no"
 483                  AC_MSG_RESULT(no)])
 484         AC_MSG_CHECKING(if we have an in-memory credentials cache)
 485         AC_TRY_COMPILE(
 486                 [#include <Kerberos/Kerberos.h>],
 487                 [cc_context_t c;
 488                  (void) cc_initialize (&c, 0, NULL, NULL);],
 489                 [AC_DEFINE(USE_CCAPI, 1,
 490                         [platform uses an in-memory credentials cache])
 491                  LIBS="$LIBS -framework Security"
 492                  AC_MSG_RESULT(yes)
 493                  if test "x$ac_cv_use_security_session_api" = "xno"; then
 494                         AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
 495                 fi],
 496                 [AC_MSG_RESULT(no)]
 497         )
 498         ;;
 499 *-*-dragonfly*)
 500         SSHDLIBS="$SSHDLIBS -lcrypt"
 501         ;;
 502 *-*-hpux*)
 503         # first we define all of the options common to all HP-UX releases
 504         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 505         IPADDR_IN_DISPLAY=yes
 506         AC_DEFINE(USE_PIPES)
 507         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 508             [Define if your login program cannot handle end of options ("--")])
 509         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 510         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 511                 [String used in /etc/passwd to denote locked account])
 512         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 513         MAIL="/var/mail/username"
 514         LIBS="$LIBS -lsec"
 515         AC_CHECK_LIB(xnet, t_error, ,
 516             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 517
 518         # next, we define all of the options specific to major releases
 519         case "$host" in
 520         *-*-hpux10*)
 521                 if test -z "$GCC"; then
 522                         CFLAGS="$CFLAGS -Ae"
 523                 fi
 524                 ;;
 525         *-*-hpux11*)
 526                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 527                         [Define if you are using Solaris-derived PAM which
 528                         passes pam_messages to the conversation function
 529                         with an extra level of indirection])
 530                 AC_DEFINE(DISABLE_UTMP, 1,
 531                         [Define if you don't want to use utmp])
 532                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 533                 check_for_hpux_broken_getaddrinfo=1
 534                 check_for_conflicting_getspnam=1
 535                 ;;
 536         esac
 537
 538         # lastly, we define options specific to minor releases
 539         case "$host" in
 540         *-*-hpux10.26)
 541                 AC_DEFINE(HAVE_SECUREWARE, 1,
 542                         [Define if you have SecureWare-based
 543                         protected password database])
 544                 disable_ptmx_check=yes
 545                 LIBS="$LIBS -lsecpw"
 546                 ;;
 547         esac
 548         ;;
 549 *-*-irix5*)
 550         PATH="$PATH:/usr/etc"
 551         AC_DEFINE(BROKEN_INET_NTOA, 1,
 552                 [Define if you system's inet_ntoa is busted
 553                 (e.g. Irix gcc issue)])
 554         AC_DEFINE(SETEUID_BREAKS_SETUID)
 555         AC_DEFINE(BROKEN_SETREUID)
 556         AC_DEFINE(BROKEN_SETREGID)
 557         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 558                 [Define if you shouldn't strip 'tty' from your
 559                 ttyname in [uw]tmp])
 560         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 561         ;;
 562 *-*-irix6*)
 563         PATH="$PATH:/usr/etc"
 564         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 565                 [Define if you have/want arrays
 566                 (cluster-wide session managment, not C arrays)])
 567         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 568                 [Define if you want IRIX project management])
 569         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 570                 [Define if you want IRIX audit trails])
 571         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 572                 [Define if you want IRIX kernel jobs])])
 573         AC_DEFINE(BROKEN_INET_NTOA)
 574         AC_DEFINE(SETEUID_BREAKS_SETUID)
 575         AC_DEFINE(BROKEN_SETREUID)
 576         AC_DEFINE(BROKEN_SETREGID)
 577         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 578         AC_DEFINE(WITH_ABBREV_NO_TTY)
 579         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 580         ;;
 581 *-*-linux*)
 582         no_dev_ptmx=1
 583         check_for_libcrypt_later=1
 584         check_for_openpty_ctty_bug=1
 585         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 586                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 587         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 588                 [String used in /etc/passwd to denote locked account])
 589         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 590         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 591                 [Define to whatever link() returns for "not supported"
 592                 if it doesn't return EOPNOTSUPP.])
 593         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 594         AC_DEFINE(USE_BTMP)
 595         inet6_default_4in6=yes
 596         case `uname -r` in
 597         1.*|2.0.*)
 598                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 599                         [Define if cmsg_type is not passed correctly])
 600                 ;;
 601         esac
 602         # tun(4) forwarding compat code
 603         AC_CHECK_HEADERS(linux/if_tun.h)
 604         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 605                 AC_DEFINE(SSH_TUN_LINUX, 1,
 606                     [Open tunnel devices the Linux tun/tap way])
 607                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 608                     [Use tunnel device compatibility to OpenBSD])
 609                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 610                     [Prepend the address family to IP tunnel traffic])
 611         fi
 612         ;;
 613 mips-sony-bsd|mips-sony-newsos4)
 614         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 615         SONY=1
 616         ;;
 617 *-*-netbsd*)
 618         check_for_libcrypt_before=1
 619         if test "x$withval" != "xno" ; then
 620                 need_dash_r=1
 621         fi
 622         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 623         AC_CHECK_HEADER([net/if_tap.h], ,
 624             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 625         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 626             [Prepend the address family to IP tunnel traffic])
 627         ;;
 628 *-*-freebsd*)
 629         check_for_libcrypt_later=1
 630         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 631         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 632         AC_CHECK_HEADER([net/if_tap.h], ,
 633             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 634         AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need])
 635         ;;
 636 *-*-bsdi*)
 637         AC_DEFINE(SETEUID_BREAKS_SETUID)
 638         AC_DEFINE(BROKEN_SETREUID)
 639         AC_DEFINE(BROKEN_SETREGID)
 640         ;;
 641 *-next-*)
 642         conf_lastlog_location="/usr/adm/lastlog"
 643         conf_utmp_location=/etc/utmp
 644         conf_wtmp_location=/usr/adm/wtmp
 645         MAIL=/usr/spool/mail
 646         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 647         AC_DEFINE(BROKEN_REALPATH)
 648         AC_DEFINE(USE_PIPES)
 649         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 650         ;;
 651 *-*-openbsd*)
 652         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 653         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 654         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 655         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 656             [syslog_r function is safe to use in in a signal handler])
 657         ;;
 658 *-*-solaris*)
 659         if test "x$withval" != "xno" ; then
 660                 need_dash_r=1
 661         fi
 662         AC_DEFINE(PAM_SUN_CODEBASE)
 663         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 664         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 665                 [Some versions of /bin/login need the TERM supplied
 666                 on the commandline])
 667         AC_DEFINE(PAM_TTY_KLUDGE)
 668         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 669                 [Define if pam_chauthtok wants real uid set
 670                 to the unpriv'ed user])
 671         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 672         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 673         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 674                 [Define if sshd somehow reacquires a controlling TTY
 675                 after setsid()])
 676         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 677                 in case the name is longer than 8 chars])
 678         external_path_file=/etc/default/login
 679         # hardwire lastlog location (can't detect it on some versions)
 680         conf_lastlog_location="/var/adm/lastlog"
 681         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 682         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 683         if test "$sol2ver" -ge 8; then
 684                 AC_MSG_RESULT(yes)
 685                 AC_DEFINE(DISABLE_UTMP)
 686                 AC_DEFINE(DISABLE_WTMP, 1,
 687                         [Define if you don't want to use wtmp])
 688         else
 689                 AC_MSG_RESULT(no)
 690         fi
 691         AC_ARG_WITH(solaris-contracts,
 692                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 693                 [
 694                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 695                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 696                                 [Define if you have Solaris process contracts])
 697                           SSHDLIBS="$SSHDLIBS -lcontract"
 698                           AC_SUBST(SSHDLIBS)
 699                           SPC_MSG="yes" ], )
 700                 ],
 701         )
 702         ;;
 703 *-*-sunos4*)
 704         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 705         AC_CHECK_FUNCS(getpwanam)
 706         AC_DEFINE(PAM_SUN_CODEBASE)
 707         conf_utmp_location=/etc/utmp
 708         conf_wtmp_location=/var/adm/wtmp
 709         conf_lastlog_location=/var/adm/lastlog
 710         AC_DEFINE(USE_PIPES)
 711         ;;
 712 *-ncr-sysv*)
 713         LIBS="$LIBS -lc89"
 714         AC_DEFINE(USE_PIPES)
 715         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 716         AC_DEFINE(SETEUID_BREAKS_SETUID)
 717         AC_DEFINE(BROKEN_SETREUID)
 718         AC_DEFINE(BROKEN_SETREGID)
 719         ;;
 720 *-sni-sysv*)
 721         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 722         AC_CHECK_LIB(dl, dlsym, ,)
 723         # -lresolv needs to be at the end of LIBS or DNS lookups break
 724         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 725         IPADDR_IN_DISPLAY=yes
 726         AC_DEFINE(USE_PIPES)
 727         AC_DEFINE(IP_TOS_IS_BROKEN)
 728         AC_DEFINE(SETEUID_BREAKS_SETUID)
 729         AC_DEFINE(BROKEN_SETREUID)
 730         AC_DEFINE(BROKEN_SETREGID)
 731         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 732         external_path_file=/etc/default/login
 733         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 734         # Attention: always take care to bind libsocket and libnsl before libc,
 735         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 736         ;;
 737 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 738 *-*-sysv4.2*)
 739         AC_DEFINE(USE_PIPES)
 740         AC_DEFINE(SETEUID_BREAKS_SETUID)
 741         AC_DEFINE(BROKEN_SETREUID)
 742         AC_DEFINE(BROKEN_SETREGID)
 743         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 744         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 745         ;;
 746 # UnixWare 7.x, OpenUNIX 8
 747 *-*-sysv5*)
 748         check_for_libcrypt_later=1
 749         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 750         AC_DEFINE(USE_PIPES)
 751         AC_DEFINE(SETEUID_BREAKS_SETUID)
 752         AC_DEFINE(BROKEN_SETREUID)
 753         AC_DEFINE(BROKEN_SETREGID)
 754         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 755         case "$host" in
 756         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 757                 TEST_SHELL=/u95/bin/sh
 758                 AC_DEFINE(BROKEN_LIBIAF, 1,
 759                         [ia_uinfo routines not supported by OS yet])
 760                 AC_DEFINE(BROKEN_UPDWTMPX)
 761                 ;;
 762         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 763                 ;;
 764         esac
 765         ;;
 766 *-*-sysv*)
 767         ;;
 768 # SCO UNIX and OEM versions of SCO UNIX
 769 *-*-sco3.2v4*)
 770         AC_MSG_ERROR("This Platform is no longer supported.")
 771         ;;
 772 # SCO OpenServer 5.x
 773 *-*-sco3.2v5*)
 774         if test -z "$GCC"; then
 775                 CFLAGS="$CFLAGS -belf"
 776         fi
 777         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 778         no_dev_ptmx=1
 779         AC_DEFINE(USE_PIPES)
 780         AC_DEFINE(HAVE_SECUREWARE)
 781         AC_DEFINE(DISABLE_SHADOW)
 782         AC_DEFINE(DISABLE_FD_PASSING)
 783         AC_DEFINE(SETEUID_BREAKS_SETUID)
 784         AC_DEFINE(BROKEN_SETREUID)
 785         AC_DEFINE(BROKEN_SETREGID)
 786         AC_DEFINE(WITH_ABBREV_NO_TTY)
 787         AC_DEFINE(BROKEN_UPDWTMPX)
 788         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 789         AC_CHECK_FUNCS(getluid setluid)
 790         MANTYPE=man
 791         TEST_SHELL=ksh
 792         ;;
 793 *-*-unicosmk*)
 794         AC_DEFINE(NO_SSH_LASTLOG, 1,
 795                 [Define if you don't want to use lastlog in session.c])
 796         AC_DEFINE(SETEUID_BREAKS_SETUID)
 797         AC_DEFINE(BROKEN_SETREUID)
 798         AC_DEFINE(BROKEN_SETREGID)
 799         AC_DEFINE(USE_PIPES)
 800         AC_DEFINE(DISABLE_FD_PASSING)
 801         LDFLAGS="$LDFLAGS"
 802         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 803         MANTYPE=cat
 804         ;;
 805 *-*-unicosmp*)
 806         AC_DEFINE(SETEUID_BREAKS_SETUID)
 807         AC_DEFINE(BROKEN_SETREUID)
 808         AC_DEFINE(BROKEN_SETREGID)
 809         AC_DEFINE(WITH_ABBREV_NO_TTY)
 810         AC_DEFINE(USE_PIPES)
 811         AC_DEFINE(DISABLE_FD_PASSING)
 812         LDFLAGS="$LDFLAGS"
 813         LIBS="$LIBS -lgen -lacid -ldb"
 814         MANTYPE=cat
 815         ;;
 816 *-*-unicos*)
 817         AC_DEFINE(SETEUID_BREAKS_SETUID)
 818         AC_DEFINE(BROKEN_SETREUID)
 819         AC_DEFINE(BROKEN_SETREGID)
 820         AC_DEFINE(USE_PIPES)
 821         AC_DEFINE(DISABLE_FD_PASSING)
 822         AC_DEFINE(NO_SSH_LASTLOG)
 823         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 824         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 825         MANTYPE=cat
 826         ;;
 827 *-dec-osf*)
 828         AC_MSG_CHECKING(for Digital Unix SIA)
 829         no_osfsia=""
 830         AC_ARG_WITH(osfsia,
 831                 [  --with-osfsia           Enable Digital Unix SIA],
 832                 [
 833                         if test "x$withval" = "xno" ; then
 834                                 AC_MSG_RESULT(disabled)
 835                                 no_osfsia=1
 836                         fi
 837                 ],
 838         )
 839         if test -z "$no_osfsia" ; then
 840                 if test -f /etc/sia/matrix.conf; then
 841                         AC_MSG_RESULT(yes)
 842                         AC_DEFINE(HAVE_OSF_SIA, 1,
 843                                 [Define if you have Digital Unix Security
 844                                 Integration Architecture])
 845                         AC_DEFINE(DISABLE_LOGIN, 1,
 846                                 [Define if you don't want to use your
 847                                 system's login() call])
 848                         AC_DEFINE(DISABLE_FD_PASSING)
 849                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 850                         SIA_MSG="yes"
 851                 else
 852                         AC_MSG_RESULT(no)
 853                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 854                           [String used in /etc/passwd to denote locked account])
 855                 fi
 856         fi
 857         AC_DEFINE(BROKEN_GETADDRINFO)
 858         AC_DEFINE(SETEUID_BREAKS_SETUID)
 859         AC_DEFINE(BROKEN_SETREUID)
 860         AC_DEFINE(BROKEN_SETREGID)
 861         AC_DEFINE(BROKEN_READV_COMPARISON, 1, [Can't do comparisons on readv])
 862         ;;
 863
 864 *-*-nto-qnx*)
 865         AC_DEFINE(USE_PIPES)
 866         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 867         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 868         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 869         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 870         AC_DEFINE(DISABLE_LASTLOG)
 871         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 872         AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
 873         enable_etc_default_login=no     # has incompatible /etc/default/login
 874         case "$host" in
 875         *-*-nto-qnx6*)
 876                 AC_DEFINE(DISABLE_FD_PASSING)
 877                 ;;
 878         esac
 879         ;;
 880
 881 *-*-ultrix*)
 882         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 883         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 884         AC_DEFINE(NEED_SETPGRP)
 885         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 886         ;;
 887
 888 *-*-lynxos)
 889         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 890         AC_DEFINE(MISSING_HOWMANY)
 891         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 892         ;;
 893 esac
 894
 895 AC_MSG_CHECKING(compiler and flags for sanity)
 896 AC_RUN_IFELSE(
 897         [AC_LANG_SOURCE([
 898 #include <stdio.h>
 899 int main(){exit(0);}
 900         ])],
 901         [       AC_MSG_RESULT(yes) ],
 902         [
 903                 AC_MSG_RESULT(no)
 904                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 905         ],
 906         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 907 )
 908
 909 dnl Checks for header files.
 910 # Checks for libraries.
 911 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 912 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 913
 914 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 915 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 916         AC_CHECK_LIB(gen, dirname,[
 917                 AC_CACHE_CHECK([for broken dirname],
 918                         ac_cv_have_broken_dirname, [
 919                         save_LIBS="$LIBS"
 920                         LIBS="$LIBS -lgen"
 921                         AC_RUN_IFELSE(
 922                                 [AC_LANG_SOURCE([[
 923 #include <libgen.h>
 924 #include <string.h>
 925
 926 int main(int argc, char **argv) {
 927     char *s, buf[32];
 928
 929     strncpy(buf,"/etc", 32);
 930     s = dirname(buf);
 931     if (!s || strncmp(s, "/", 32) != 0) {
 932         exit(1);
 933     } else {
 934         exit(0);
 935     }
 936 }
 937                                 ]])],
 938                                 [ ac_cv_have_broken_dirname="no" ],
 939                                 [ ac_cv_have_broken_dirname="yes" ],
 940                                 [ ac_cv_have_broken_dirname="no" ],
 941                         )
 942                         LIBS="$save_LIBS"
 943                 ])
 944                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 945                         LIBS="$LIBS -lgen"
 946                         AC_DEFINE(HAVE_DIRNAME)
 947                         AC_CHECK_HEADERS(libgen.h)
 948                 fi
 949         ])
 950 ])
 951
 952 AC_CHECK_FUNC(getspnam, ,
 953         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 954 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 955         [Define if you have the basename function.]))
 956
 957 dnl zlib is required
 958 AC_ARG_WITH(zlib,
 959         [  --with-zlib=PATH        Use zlib in PATH],
 960         [ if test "x$withval" = "xno" ; then
 961                 AC_MSG_ERROR([*** zlib is required ***])
 962           elif test "x$withval" != "xyes"; then
 963                 if test -d "$withval/lib"; then
 964                         if test -n "${need_dash_r}"; then
 965                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 966                         else
 967                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 968                         fi
 969                 else
 970                         if test -n "${need_dash_r}"; then
 971                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 972                         else
 973                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 974                         fi
 975                 fi
 976                 if test -d "$withval/include"; then
 977                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 978                 else
 979                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 980                 fi
 981         fi ]
 982 )
 983
 984 AC_CHECK_LIB(z, deflate, ,
 985         [
 986                 saved_CPPFLAGS="$CPPFLAGS"
 987                 saved_LDFLAGS="$LDFLAGS"
 988                 save_LIBS="$LIBS"
 989                 dnl Check default zlib install dir
 990                 if test -n "${need_dash_r}"; then
 991                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 992                 else
 993                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 994                 fi
 995                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 996                 LIBS="$LIBS -lz"
 997                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 998                         [
 999                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1000                         ]
1001                 )
1002         ]
1003 )
1004 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
1005
1006 AC_ARG_WITH(zlib-version-check,
1007         [  --without-zlib-version-check Disable zlib version check],
1008         [  if test "x$withval" = "xno" ; then
1009                 zlib_check_nonfatal=1
1010            fi
1011         ]
1012 )
1013
1014 AC_MSG_CHECKING(for possibly buggy zlib)
1015 AC_RUN_IFELSE([AC_LANG_SOURCE([[
1016 #include <stdio.h>
1017 #include <zlib.h>
1018 int main()
1019 {
1020         int a=0, b=0, c=0, d=0, n, v;
1021         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1022         if (n != 3 && n != 4)
1023                 exit(1);
1024         v = a*1000000 + b*10000 + c*100 + d;
1025         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1026
1027         /* 1.1.4 is OK */
1028         if (a == 1 && b == 1 && c >= 4)
1029                 exit(0);
1030
1031         /* 1.2.3 and up are OK */
1032         if (v >= 1020300)
1033                 exit(0);
1034
1035         exit(2);
1036 }
1037         ]])],
1038         AC_MSG_RESULT(no),
1039         [ AC_MSG_RESULT(yes)
1040           if test -z "$zlib_check_nonfatal" ; then
1041                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1042 Your reported zlib version has known security problems.  It's possible your
1043 vendor has fixed these problems without changing the version number.  If you
1044 are sure this is the case, you can disable the check by running
1045 "./configure --without-zlib-version-check".
1046 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1047 See http://www.gzip.org/zlib/ for details.])
1048           else
1049                 AC_MSG_WARN([zlib version may have security problems])
1050           fi
1051         ],
1052         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1053 )
1054
1055 dnl UnixWare 2.x
1056 AC_CHECK_FUNC(strcasecmp,
1057         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
1058 )
1059 AC_CHECK_FUNCS(utimes,
1060         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
1061                                         LIBS="$LIBS -lc89"]) ]
1062 )
1063
1064 dnl    Checks for libutil functions
1065 AC_CHECK_HEADERS(libutil.h)
1066 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
1067         [Define if your libraries define login()])])
1068 AC_CHECK_FUNCS(fmt_scaled logout updwtmp logwtmp)
1069
1070 AC_FUNC_STRFTIME
1071
1072 # Check for ALTDIRFUNC glob() extension
1073 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
1074 AC_EGREP_CPP(FOUNDIT,
1075         [
1076                 #include <glob.h>
1077                 #ifdef GLOB_ALTDIRFUNC
1078                 FOUNDIT
1079                 #endif
1080         ],
1081         [
1082                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
1083                         [Define if your system glob() function has
1084                         the GLOB_ALTDIRFUNC extension])
1085                 AC_MSG_RESULT(yes)
1086         ],
1087         [
1088                 AC_MSG_RESULT(no)
1089         ]
1090 )
1091
1092 # Check for g.gl_matchc glob() extension
1093 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1094 AC_TRY_COMPILE(
1095         [ #include <glob.h> ],
1096         [glob_t g; g.gl_matchc = 1;],
1097         [
1098                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1099                         [Define if your system glob() function has
1100                         gl_matchc options in glob_t])
1101                 AC_MSG_RESULT(yes)
1102         ],
1103         [
1104                 AC_MSG_RESULT(no)
1105         ]
1106 )
1107
1108 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1109
1110 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1111 AC_RUN_IFELSE(
1112         [AC_LANG_SOURCE([[
1113 #include <sys/types.h>
1114 #include <dirent.h>
1115 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1116         ]])],
1117         [AC_MSG_RESULT(yes)],
1118         [
1119                 AC_MSG_RESULT(no)
1120                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1121                         [Define if your struct dirent expects you to
1122                         allocate extra space for d_name])
1123         ],
1124         [
1125                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1126                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1127         ]
1128 )
1129
1130 # Check whether the user wants GSSAPI mechglue support
1131 AC_ARG_WITH(mechglue,
1132         [  --with-mechglue=PATH    Build with GSSAPI mechglue library],
1133         [
1134                 AC_MSG_CHECKING(for mechglue library)
1135
1136                 if test -e ${withval}/libgssapi.a ; then
1137                     mechglue_lib=${withval}/libgssapi.a
1138                 elif test -e ${withval}/lib/libgssapi.a ; then
1139                     mechglue_lib=${withval}/lib/libgssapi.a
1140                 else
1141                     AC_MSG_ERROR("Can't find libgssapi in ${withval}");
1142                 fi
1143                 LIBS="$LIBS ${mechglue_lib}"
1144                 AC_MSG_RESULT(${mechglue_lib})
1145
1146                 AC_CHECK_LIB(dl, dlopen, , )
1147                 if test $ac_cv_lib_dl_dlopen = yes; then
1148                    LDFLAGS="$LDFLAGS -ldl -Wl,-Bsymbolic"
1149                 fi
1150
1151                 AC_DEFINE(GSSAPI)
1152                 AC_DEFINE(MECHGLUE, 1, [Define this if you're building with GSSAPI MechGlue.])
1153                 GSSAPI="mechglue"
1154
1155         ]
1156 )
1157
1158
1159 # Check whether the user wants GSI (Globus) support
1160 gsi_path="no"
1161 AC_ARG_WITH(gsi,
1162         [  --with-gsi              Enable Globus GSI authentication support],
1163         [
1164                 gsi_path="$withval"
1165         ]
1166 )
1167
1168 AC_ARG_WITH(globus,
1169         [  --with-globus           Enable Globus GSI authentication support],
1170         [
1171                 gsi_path="$withval"
1172         ]
1173 )
1174
1175 AC_ARG_WITH(globus-static,
1176         [  --with-globus-static    Link statically with Globus GSI libraries],
1177         [
1178                 gsi_static=1
1179                 if test "x$gsi_path" = "xno" ; then
1180                         gsi_path="$withval"
1181                 fi
1182         ]
1183 )
1184
1185 # Check whether the user has a Globus flavor type
1186 globus_flavor_type="no"
1187 AC_ARG_WITH(globus-flavor,
1188         [  --with-globus-flavor=TYPE  Specify Globus flavor type (ex: gcc32dbg)],
1189         [
1190                 globus_flavor_type="$withval"
1191                 if test "x$gsi_path" = "xno" ; then
1192                         gsi_path="yes"
1193                 fi
1194         ]
1195 )
1196
1197 if test "x$gsi_path" != "xno" ; then
1198         # Globus GSSAPI configuration
1199         AC_MSG_CHECKING(for Globus GSI)
1200         AC_DEFINE(GSI, 1, [Define if you want GSI/Globus authentication support.])
1201
1202         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
1203                 AC_MSG_ERROR([Previously configured GSSAPI library conflicts with Globus GSI.])
1204         fi
1205         if test -z "$GSSAPI"; then
1206                 AC_DEFINE(GSSAPI)
1207                 GSSAPI="GSI"
1208         fi
1209
1210         if test "x$gsi_path" = "xyes" ; then
1211                 if test -z "$GLOBUS_LOCATION" ; then
1212                         AC_MSG_ERROR(GLOBUS_LOCATION environment variable must be set.)
1213                 else
1214                         gsi_path="$GLOBUS_LOCATION"
1215                 fi
1216         fi
1217         GLOBUS_LOCATION="$gsi_path"
1218         export GLOBUS_LOCATION
1219         if test ! -d "$GLOBUS_LOCATION" ; then
1220                 AC_MSG_ERROR(Cannot find Globus installation.  Set GLOBUS_LOCATION environment variable.)
1221         fi
1222
1223         if test "x$globus_flavor_type" = "xno" ; then
1224                 AC_MSG_ERROR(--with-globus-flavor=TYPE must be specified)
1225         fi
1226         if test "x$globus_flavor_type" = "xyes" ; then
1227                 AC_MSG_ERROR(--with-globus-flavor=TYPE must specify a flavor type)
1228         fi
1229         AC_MSG_RESULT(yes)
1230
1231         AC_MSG_CHECKING(for Globus include path)
1232         GLOBUS_INCLUDE="${gsi_path}/include/${globus_flavor_type}"
1233         if test ! -d "$GLOBUS_INCLUDE" ; then
1234                 AC_MSG_ERROR(Cannot find Globus flavor-specific include directory: ${GLOBUS_INCLUDE})
1235         fi
1236         GSI_CPPFLAGS="-I${GLOBUS_INCLUDE}"
1237         AC_MSG_RESULT(yes)
1238
1239         #
1240         # Find GPT linkline helper
1241         #
1242
1243         AC_MSG_CHECKING(for GPT linkline helper)
1244         if test -x $GPT_LOCATION/sbin/gpt_build_config ; then
1245                 gpt_linkline_helper="$GPT_LOCATION/sbin/gpt_build_config"
1246         elif test -x ${gsi_path}/sbin/gpt_build_config ; then
1247                 gpt_linkline_helper="${gsi_path}/sbin/gpt_build_config"
1248         else
1249                 AC_MSG_ERROR(Cannot find gpt_build_config: GPT installation is incomplete)
1250         fi
1251         AC_MSG_RESULT(yes)
1252
1253         #
1254         # Build Globus linkline
1255         #
1256
1257         if test -n "${gsi_static}"; then
1258                 ${gpt_linkline_helper} -f ${globus_flavor_type} -link static -src pkg_data_src.gpt
1259         else
1260                 ${gpt_linkline_helper} -f ${globus_flavor_type} -link shared -src pkg_data_src.gpt
1261         fi
1262         . ./gpt_build_temp.sh
1263         if test -n "${need_dash_r}"; then
1264                 GSI_LDFLAGS="-L${gsi_path}/lib -R${gsi_path}/lib"
1265         else
1266                 GSI_LDFLAGS="-L${gsi_path}/lib"
1267         fi
1268         GSI_LIBS="$GPT_CONFIG_PGM_LINKS"
1269         LD_LIBRARY_PATH="${gsi_path}/lib:$LD_LIBRARY_PATH"; export LD_LIBRARY_PATH
1270
1271         #
1272         # Test Globus linkline
1273         #
1274
1275         AC_MSG_CHECKING(for Globus linkline)
1276         if test -z "$GSI_LIBS" ; then
1277                 AC_MSG_ERROR(gpt_build_config failed)
1278         fi
1279         AC_MSG_RESULT(yes)
1280
1281         AC_DEFINE(HAVE_GSSAPI_H)
1282
1283         LIBS="$LIBS $GSI_LIBS $GPT_CONFIG_LIBS"
1284         LDFLAGS="$LDFLAGS $GSI_LDFLAGS"
1285         CPPFLAGS="$CPPFLAGS $GSI_CPPFLAGS $GPT_CONFIG_INCLUDES"
1286     CFLAGS="$CFLAGS $GPT_CONFIG_CFLAGS"
1287
1288         AC_MSG_CHECKING(that Globus linkline works)
1289         # test that we got the libraries OK
1290         AC_TRY_LINK(
1291                 [],
1292                 [],
1293                 [
1294                         AC_MSG_RESULT(yes)
1295                 ],
1296                 [
1297                         AC_MSG_ERROR(link with Globus libraries failed)
1298                 ]
1299         )
1300     AC_CHECK_FUNCS(globus_gss_assist_map_and_authorize)
1301         INSTALL_GSISSH="yes"
1302 else
1303         INSTALL_GSISSH=""
1304 fi
1305 # End Globus/GSI section
1306
1307 AC_MSG_CHECKING([for /proc/pid/fd directory])
1308 if test -d "/proc/$$/fd" ; then
1309         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1310         AC_MSG_RESULT(yes)
1311 else
1312         AC_MSG_RESULT(no)
1313 fi
1314
1315 # Check whether user wants S/Key support
1316 SKEY_MSG="no"
1317 AC_ARG_WITH(skey,
1318         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1319         [
1320                 if test "x$withval" != "xno" ; then
1321
1322                         if test "x$withval" != "xyes" ; then
1323                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1324                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1325                         fi
1326
1327                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1328                         LIBS="-lskey $LIBS"
1329                         SKEY_MSG="yes"
1330
1331                         AC_MSG_CHECKING([for s/key support])
1332                         AC_LINK_IFELSE(
1333                                 [AC_LANG_SOURCE([[
1334 #include <stdio.h>
1335 #include <skey.h>
1336 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1337                                 ]])],
1338                                 [AC_MSG_RESULT(yes)],
1339                                 [
1340                                         AC_MSG_RESULT(no)
1341                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1342                                 ])
1343                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1344                         AC_TRY_COMPILE(
1345                                 [#include <stdio.h>
1346                                  #include <skey.h>],
1347                                 [(void)skeychallenge(NULL,"name","",0);],
1348                                 [AC_MSG_RESULT(yes)
1349                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1350                                         [Define if your skeychallenge()
1351                                         function takes 4 arguments (NetBSD)])],
1352                                 [AC_MSG_RESULT(no)]
1353                         )
1354                 fi
1355         ]
1356 )
1357
1358 # Check whether user wants TCP wrappers support
1359 TCPW_MSG="no"
1360 AC_ARG_WITH(tcp-wrappers,
1361         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1362         [
1363                 if test "x$withval" != "xno" ; then
1364                         saved_LIBS="$LIBS"
1365                         saved_LDFLAGS="$LDFLAGS"
1366                         saved_CPPFLAGS="$CPPFLAGS"
1367                         if test -n "${withval}" && \
1368                             test "x${withval}" != "xyes"; then
1369                                 if test -d "${withval}/lib"; then
1370                                         if test -n "${need_dash_r}"; then
1371                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1372                                         else
1373                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1374                                         fi
1375                                 else
1376                                         if test -n "${need_dash_r}"; then
1377                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1378                                         else
1379                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1380                                         fi
1381                                 fi
1382                                 if test -d "${withval}/include"; then
1383                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1384                                 else
1385                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1386                                 fi
1387                         fi
1388                         LIBS="-lwrap $LIBS"
1389                         AC_MSG_CHECKING(for libwrap)
1390                         AC_TRY_LINK(
1391                                 [
1392 #include <sys/types.h>
1393 #include <sys/socket.h>
1394 #include <netinet/in.h>
1395 #include <tcpd.h>
1396                                         int deny_severity = 0, allow_severity = 0;
1397                                 ],
1398                                 [hosts_access(0);],
1399                                 [
1400                                         AC_MSG_RESULT(yes)
1401                                         AC_DEFINE(LIBWRAP, 1,
1402                                                 [Define if you want
1403                                                 TCP Wrappers support])
1404                                         SSHDLIBS="$SSHDLIBS -lwrap"
1405                                         TCPW_MSG="yes"
1406                                 ],
1407                                 [
1408                                         AC_MSG_ERROR([*** libwrap missing])
1409                                 ]
1410                         )
1411                         LIBS="$saved_LIBS"
1412                 fi
1413         ]
1414 )
1415
1416 # Check whether user wants libedit support
1417 LIBEDIT_MSG="no"
1418 AC_ARG_WITH(libedit,
1419         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1420         [ if test "x$withval" != "xno" ; then
1421                 if test "x$withval" != "xyes"; then
1422                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1423                         if test -n "${need_dash_r}"; then
1424                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1425                         else
1426                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1427                         fi
1428                 fi
1429                 AC_CHECK_LIB(edit, el_init,
1430                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1431                           LIBEDIT="-ledit -lcurses"
1432                           LIBEDIT_MSG="yes"
1433                           AC_SUBST(LIBEDIT)
1434                         ],
1435                         [ AC_MSG_ERROR(libedit not found) ],
1436                         [ -lcurses ]
1437                 )
1438                 AC_MSG_CHECKING(if libedit version is compatible)
1439                 AC_COMPILE_IFELSE(
1440                     [AC_LANG_SOURCE([[
1441 #include <histedit.h>
1442 int main(void)
1443 {
1444         int i = H_SETSIZE;
1445         el_init("", NULL, NULL, NULL);
1446         exit(0);
1447 }
1448                     ]])],
1449                     [ AC_MSG_RESULT(yes) ],
1450                     [ AC_MSG_RESULT(no)
1451                       AC_MSG_ERROR(libedit version is not compatible) ]
1452                 )
1453         fi ]
1454 )
1455
1456 AUDIT_MODULE=none
1457 AC_ARG_WITH(audit,
1458         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1459         [
1460           AC_MSG_CHECKING(for supported audit module)
1461           case "$withval" in
1462           bsm)
1463                 AC_MSG_RESULT(bsm)
1464                 AUDIT_MODULE=bsm
1465                 dnl    Checks for headers, libs and functions
1466                 AC_CHECK_HEADERS(bsm/audit.h, [],
1467                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1468                     [
1469 #ifdef HAVE_TIME_H
1470 # include <time.h>
1471 #endif
1472                     ]
1473 )
1474                 AC_CHECK_LIB(bsm, getaudit, [],
1475                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1476                 AC_CHECK_FUNCS(getaudit, [],
1477                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1478                 # These are optional
1479                 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1480                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1481                 ;;
1482           debug)
1483                 AUDIT_MODULE=debug
1484                 AC_MSG_RESULT(debug)
1485                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1486                 ;;
1487           no)
1488                 AC_MSG_RESULT(no)
1489                 ;;
1490           *)
1491                 AC_MSG_ERROR([Unknown audit module $withval])
1492                 ;;
1493         esac ]
1494 )
1495
1496 dnl    Checks for library functions. Please keep in alphabetical order
1497 AC_CHECK_FUNCS( \
1498         arc4random \
1499         arc4random_buf \
1500         arc4random_uniform \
1501         asprintf \
1502         b64_ntop \
1503         __b64_ntop \
1504         b64_pton \
1505         __b64_pton \
1506         bcopy \
1507         bindresvport_sa \
1508         clock \
1509         closefrom \
1510         dirfd \
1511         fchmod \
1512         fchown \
1513         freeaddrinfo \
1514         fstatvfs \
1515         futimes \
1516         getaddrinfo \
1517         getcwd \
1518         getgrouplist \
1519         getnameinfo \
1520         getopt \
1521         getpeereid \
1522         getpeerucred \
1523         _getpty \
1524         getrlimit \
1525         getttyent \
1526         glob \
1527         inet_aton \
1528         inet_ntoa \
1529         inet_ntop \
1530         innetgr \
1531         login_getcapbool \
1532         md5_crypt \
1533         memmove \
1534         mkdtemp \
1535         mmap \
1536         ngetaddrinfo \
1537         nsleep \
1538         ogetaddrinfo \
1539         openlog_r \
1540         openpty \
1541         poll \
1542         prctl \
1543         pstat \
1544         readpassphrase \
1545         realpath \
1546         recvmsg \
1547         rresvport_af \
1548         sendmsg \
1549         setdtablesize \
1550         setegid \
1551         setenv \
1552         seteuid \
1553         setgroups \
1554         setlogin \
1555         setpcred \
1556         setproctitle \
1557         setregid \
1558         setreuid \
1559         setrlimit \
1560         setsid \
1561         setvbuf \
1562         sigaction \
1563         sigvec \
1564         snprintf \
1565         socketpair \
1566         statfs \
1567         statvfs \
1568         strdup \
1569         strerror \
1570         strlcat \
1571         strlcpy \
1572         strmode \
1573         strnvis \
1574         strtonum \
1575         strtoll \
1576         strtoul \
1577         swap32 \
1578         sysconf \
1579         tcgetpgrp \
1580         truncate \
1581         unsetenv \
1582         updwtmpx \
1583         vasprintf \
1584         vhangup \
1585         vsnprintf \
1586         waitpid \
1587 )
1588
1589 # IRIX has a const char return value for gai_strerror()
1590 AC_CHECK_FUNCS(gai_strerror,[
1591         AC_DEFINE(HAVE_GAI_STRERROR)
1592         AC_TRY_COMPILE([
1593 #include <sys/types.h>
1594 #include <sys/socket.h>
1595 #include <netdb.h>
1596
1597 const char *gai_strerror(int);],[
1598 char *str;
1599
1600 str = gai_strerror(0);],[
1601                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1602                 [Define if gai_strerror() returns const char *])])])
1603
1604 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1605         [Some systems put nanosleep outside of libc]))
1606
1607 dnl Make sure prototypes are defined for these before using them.
1608 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1609 AC_CHECK_DECL(strsep,
1610         [AC_CHECK_FUNCS(strsep)],
1611         [],
1612         [
1613 #ifdef HAVE_STRING_H
1614 # include <string.h>
1615 #endif
1616         ])
1617
1618 dnl tcsendbreak might be a macro
1619 AC_CHECK_DECL(tcsendbreak,
1620         [AC_DEFINE(HAVE_TCSENDBREAK)],
1621         [AC_CHECK_FUNCS(tcsendbreak)],
1622         [#include <termios.h>]
1623 )
1624
1625 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1626
1627 AC_CHECK_DECLS(SHUT_RD, , ,
1628         [
1629 #include <sys/types.h>
1630 #include <sys/socket.h>
1631         ])
1632
1633 AC_CHECK_DECLS(O_NONBLOCK, , ,
1634         [
1635 #include <sys/types.h>
1636 #ifdef HAVE_SYS_STAT_H
1637 # include <sys/stat.h>
1638 #endif
1639 #ifdef HAVE_FCNTL_H
1640 # include <fcntl.h>
1641 #endif
1642         ])
1643
1644 AC_CHECK_DECLS(writev, , , [
1645 #include <sys/types.h>
1646 #include <sys/uio.h>
1647 #include <unistd.h>
1648         ])
1649
1650 AC_CHECK_DECLS(MAXSYMLINKS, , , [
1651 #include <sys/param.h>
1652         ])
1653
1654 AC_CHECK_DECLS(offsetof, , , [
1655 #include <stddef.h>
1656         ])
1657
1658 AC_CHECK_FUNCS(setresuid, [
1659         dnl Some platorms have setresuid that isn't implemented, test for this
1660         AC_MSG_CHECKING(if setresuid seems to work)
1661         AC_RUN_IFELSE(
1662                 [AC_LANG_SOURCE([[
1663 #include <stdlib.h>
1664 #include <errno.h>
1665 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1666                 ]])],
1667                 [AC_MSG_RESULT(yes)],
1668                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1669                         [Define if your setresuid() is broken])
1670                  AC_MSG_RESULT(not implemented)],
1671                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1672         )
1673 ])
1674
1675 AC_CHECK_FUNCS(setresgid, [
1676         dnl Some platorms have setresgid that isn't implemented, test for this
1677         AC_MSG_CHECKING(if setresgid seems to work)
1678         AC_RUN_IFELSE(
1679                 [AC_LANG_SOURCE([[
1680 #include <stdlib.h>
1681 #include <errno.h>
1682 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1683                 ]])],
1684                 [AC_MSG_RESULT(yes)],
1685                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1686                         [Define if your setresgid() is broken])
1687                  AC_MSG_RESULT(not implemented)],
1688                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1689         )
1690 ])
1691
1692 dnl    Checks for time functions
1693 AC_CHECK_FUNCS(gettimeofday time)
1694 dnl    Checks for utmp functions
1695 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1696 AC_CHECK_FUNCS(utmpname)
1697 dnl    Checks for utmpx functions
1698 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1699 AC_CHECK_FUNCS(setutxent utmpxname)
1700
1701 AC_CHECK_FUNC(daemon,
1702         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1703         [AC_CHECK_LIB(bsd, daemon,
1704                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1705 )
1706
1707 AC_CHECK_FUNC(getpagesize,
1708         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1709                 [Define if your libraries define getpagesize()])],
1710         [AC_CHECK_LIB(ucb, getpagesize,
1711                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1712 )
1713
1714 # Check for broken snprintf
1715 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1716         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1717         AC_RUN_IFELSE(
1718                 [AC_LANG_SOURCE([[
1719 #include <stdio.h>
1720 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1721                 ]])],
1722                 [AC_MSG_RESULT(yes)],
1723                 [
1724                         AC_MSG_RESULT(no)
1725                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1726                                 [Define if your snprintf is busted])
1727                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1728                 ],
1729                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1730         )
1731 fi
1732
1733 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1734 # returning the right thing on overflow: the number of characters it tried to
1735 # create (as per SUSv3)
1736 if test "x$ac_cv_func_asprintf" != "xyes" && \
1737    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1738         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1739         AC_RUN_IFELSE(
1740                 [AC_LANG_SOURCE([[
1741 #include <sys/types.h>
1742 #include <stdio.h>
1743 #include <stdarg.h>
1744
1745 int x_snprintf(char *str,size_t count,const char *fmt,...)
1746 {
1747         size_t ret; va_list ap;
1748         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1749         return ret;
1750 }
1751 int main(void)
1752 {
1753         char x[1];
1754         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1755 } ]])],
1756                 [AC_MSG_RESULT(yes)],
1757                 [
1758                         AC_MSG_RESULT(no)
1759                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1760                                 [Define if your snprintf is busted])
1761                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1762                 ],
1763                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1764         )
1765 fi
1766
1767 # On systems where [v]snprintf is broken, but is declared in stdio,
1768 # check that the fmt argument is const char * or just char *.
1769 # This is only useful for when BROKEN_SNPRINTF
1770 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1771 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1772            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1773            int main(void) { snprintf(0, 0, 0); }
1774     ]])],
1775    [AC_MSG_RESULT(yes)
1776     AC_DEFINE(SNPRINTF_CONST, [const],
1777               [Define as const if snprintf() can declare const char *fmt])],
1778    [AC_MSG_RESULT(no)
1779     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1780
1781 # Check for missing getpeereid (or equiv) support
1782 NO_PEERCHECK=""
1783 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
1784         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1785         AC_TRY_COMPILE(
1786                 [#include <sys/types.h>
1787                  #include <sys/socket.h>],
1788                 [int i = SO_PEERCRED;],
1789                 [ AC_MSG_RESULT(yes)
1790                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1791                 ],
1792                 [AC_MSG_RESULT(no)
1793                 NO_PEERCHECK=1]
1794         )
1795 fi
1796
1797 dnl see whether mkstemp() requires XXXXXX
1798 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1799 AC_MSG_CHECKING([for (overly) strict mkstemp])
1800 AC_RUN_IFELSE(
1801         [AC_LANG_SOURCE([[
1802 #include <stdlib.h>
1803 main() { char template[]="conftest.mkstemp-test";
1804 if (mkstemp(template) == -1)
1805         exit(1);
1806 unlink(template); exit(0);
1807 }
1808         ]])],
1809         [
1810                 AC_MSG_RESULT(no)
1811         ],
1812         [
1813                 AC_MSG_RESULT(yes)
1814                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1815         ],
1816         [
1817                 AC_MSG_RESULT(yes)
1818                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1819         ]
1820 )
1821 fi
1822
1823 dnl make sure that openpty does not reacquire controlling terminal
1824 if test ! -z "$check_for_openpty_ctty_bug"; then
1825         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1826         AC_RUN_IFELSE(
1827                 [AC_LANG_SOURCE([[
1828 #include <stdio.h>
1829 #include <sys/fcntl.h>
1830 #include <sys/types.h>
1831 #include <sys/wait.h>
1832
1833 int
1834 main()
1835 {
1836         pid_t pid;
1837         int fd, ptyfd, ttyfd, status;
1838
1839         pid = fork();
1840         if (pid < 0) {          /* failed */
1841                 exit(1);
1842         } else if (pid > 0) {   /* parent */
1843                 waitpid(pid, &status, 0);
1844                 if (WIFEXITED(status))
1845                         exit(WEXITSTATUS(status));
1846                 else
1847                         exit(2);
1848         } else {                /* child */
1849                 close(0); close(1); close(2);
1850                 setsid();
1851                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1852                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1853                 if (fd >= 0)
1854                         exit(3);        /* Acquired ctty: broken */
1855                 else
1856                         exit(0);        /* Did not acquire ctty: OK */
1857         }
1858 }
1859                 ]])],
1860                 [
1861                         AC_MSG_RESULT(yes)
1862                 ],
1863                 [
1864                         AC_MSG_RESULT(no)
1865                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1866                 ],
1867                 [
1868                         AC_MSG_RESULT(cross-compiling, assuming yes)
1869                 ]
1870         )
1871 fi
1872
1873 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1874     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1875         AC_MSG_CHECKING(if getaddrinfo seems to work)
1876         AC_RUN_IFELSE(
1877                 [AC_LANG_SOURCE([[
1878 #include <stdio.h>
1879 #include <sys/socket.h>
1880 #include <netdb.h>
1881 #include <errno.h>
1882 #include <netinet/in.h>
1883
1884 #define TEST_PORT "2222"
1885
1886 int
1887 main(void)
1888 {
1889         int err, sock;
1890         struct addrinfo *gai_ai, *ai, hints;
1891         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1892
1893         memset(&hints, 0, sizeof(hints));
1894         hints.ai_family = PF_UNSPEC;
1895         hints.ai_socktype = SOCK_STREAM;
1896         hints.ai_flags = AI_PASSIVE;
1897
1898         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1899         if (err != 0) {
1900                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1901                 exit(1);
1902         }
1903
1904         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1905                 if (ai->ai_family != AF_INET6)
1906                         continue;
1907
1908                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1909                     sizeof(ntop), strport, sizeof(strport),
1910                     NI_NUMERICHOST|NI_NUMERICSERV);
1911
1912                 if (err != 0) {
1913                         if (err == EAI_SYSTEM)
1914                                 perror("getnameinfo EAI_SYSTEM");
1915                         else
1916                                 fprintf(stderr, "getnameinfo failed: %s\n",
1917                                     gai_strerror(err));
1918                         exit(2);
1919                 }
1920
1921                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1922                 if (sock < 0)
1923                         perror("socket");
1924                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1925                         if (errno == EBADF)
1926                                 exit(3);
1927                 }
1928         }
1929         exit(0);
1930 }
1931                 ]])],
1932                 [
1933                         AC_MSG_RESULT(yes)
1934                 ],
1935                 [
1936                         AC_MSG_RESULT(no)
1937                         AC_DEFINE(BROKEN_GETADDRINFO)
1938                 ],
1939                 [
1940                         AC_MSG_RESULT(cross-compiling, assuming yes)
1941                 ]
1942         )
1943 fi
1944
1945 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1946     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1947         AC_MSG_CHECKING(if getaddrinfo seems to work)
1948         AC_RUN_IFELSE(
1949                 [AC_LANG_SOURCE([[
1950 #include <stdio.h>
1951 #include <sys/socket.h>
1952 #include <netdb.h>
1953 #include <errno.h>
1954 #include <netinet/in.h>
1955
1956 #define TEST_PORT "2222"
1957
1958 int
1959 main(void)
1960 {
1961         int err, sock;
1962         struct addrinfo *gai_ai, *ai, hints;
1963         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1964
1965         memset(&hints, 0, sizeof(hints));
1966         hints.ai_family = PF_UNSPEC;
1967         hints.ai_socktype = SOCK_STREAM;
1968         hints.ai_flags = AI_PASSIVE;
1969
1970         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1971         if (err != 0) {
1972                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1973                 exit(1);
1974         }
1975
1976         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1977                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1978                         continue;
1979
1980                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1981                     sizeof(ntop), strport, sizeof(strport),
1982                     NI_NUMERICHOST|NI_NUMERICSERV);
1983
1984                 if (ai->ai_family == AF_INET && err != 0) {
1985                         perror("getnameinfo");
1986                         exit(2);
1987                 }
1988         }
1989         exit(0);
1990 }
1991                 ]])],
1992                 [
1993                         AC_MSG_RESULT(yes)
1994                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1995                                 [Define if you have a getaddrinfo that fails
1996                                 for the all-zeros IPv6 address])
1997                 ],
1998                 [
1999                         AC_MSG_RESULT(no)
2000                         AC_DEFINE(BROKEN_GETADDRINFO)
2001                 ],
2002                 [
2003                         AC_MSG_RESULT(cross-compiling, assuming no)
2004                 ]
2005         )
2006 fi
2007
2008 if test "x$check_for_conflicting_getspnam" = "x1"; then
2009         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
2010         AC_COMPILE_IFELSE(
2011                 [
2012 #include <shadow.h>
2013 int main(void) {exit(0);}
2014                 ],
2015                 [
2016                         AC_MSG_RESULT(no)
2017                 ],
2018                 [
2019                         AC_MSG_RESULT(yes)
2020                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
2021                             [Conflicting defs for getspnam])
2022                 ]
2023         )
2024 fi
2025
2026 AC_FUNC_GETPGRP
2027
2028 # Search for OpenSSL
2029 saved_CPPFLAGS="$CPPFLAGS"
2030 saved_LDFLAGS="$LDFLAGS"
2031 AC_ARG_WITH(ssl-dir,
2032         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
2033         [
2034                 if test "x$withval" != "xno" ; then
2035                         case "$withval" in
2036                                 # Relative paths
2037                                 ./*|../*)       withval="`pwd`/$withval"
2038                         esac
2039                         if test -d "$withval/lib"; then
2040                                 if test -n "${need_dash_r}"; then
2041                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
2042                                 else
2043                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
2044                                 fi
2045                         else
2046                                 if test -n "${need_dash_r}"; then
2047                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
2048                                 else
2049                                         LDFLAGS="-L${withval} ${LDFLAGS}"
2050                                 fi
2051                         fi
2052                         if test -d "$withval/include"; then
2053                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
2054                         else
2055                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
2056                         fi
2057                 fi
2058         ]
2059 )
2060
2061 if test -z "$GSI_LIBS" ; then
2062 LIBS="-lcrypto $LIBS"
2063 fi
2064 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
2065         [Define if your ssl headers are included
2066         with #include <openssl/header.h>]),
2067         [
2068                 dnl Check default openssl install dir
2069                 if test -n "${need_dash_r}"; then
2070                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
2071                 else
2072                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
2073                 fi
2074                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
2075                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
2076                         [
2077                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2078                         ]
2079                 )
2080         ]
2081 )
2082
2083 # Determine OpenSSL header version
2084 AC_MSG_CHECKING([OpenSSL header version])
2085 AC_RUN_IFELSE(
2086         [AC_LANG_SOURCE([[
2087 #include <stdio.h>
2088 #include <string.h>
2089 #include <openssl/opensslv.h>
2090 #define DATA "conftest.sslincver"
2091 int main(void) {
2092         FILE *fd;
2093         int rc;
2094
2095         fd = fopen(DATA,"w");
2096         if(fd == NULL)
2097                 exit(1);
2098
2099         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
2100                 exit(1);
2101
2102         exit(0);
2103 }
2104         ]])],
2105         [
2106                 ssl_header_ver=`cat conftest.sslincver`
2107                 AC_MSG_RESULT($ssl_header_ver)
2108         ],
2109         [
2110                 AC_MSG_RESULT(not found)
2111                 AC_MSG_ERROR(OpenSSL version header not found.)
2112         ],
2113         [
2114                 AC_MSG_WARN([cross compiling: not checking])
2115         ]
2116 )
2117
2118 # Determine OpenSSL library version
2119 AC_MSG_CHECKING([OpenSSL library version])
2120 AC_RUN_IFELSE(
2121         [AC_LANG_SOURCE([[
2122 #include <stdio.h>
2123 #include <string.h>
2124 #include <openssl/opensslv.h>
2125 #include <openssl/crypto.h>
2126 #define DATA "conftest.ssllibver"
2127 int main(void) {
2128         FILE *fd;
2129         int rc;
2130
2131         fd = fopen(DATA,"w");
2132         if(fd == NULL)
2133                 exit(1);
2134
2135         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
2136                 exit(1);
2137
2138         exit(0);
2139 }
2140         ]])],
2141         [
2142                 ssl_library_ver=`cat conftest.ssllibver`
2143                 AC_MSG_RESULT($ssl_library_ver)
2144         ],
2145         [
2146                 AC_MSG_RESULT(not found)
2147                 AC_MSG_ERROR(OpenSSL library not found.)
2148         ],
2149         [
2150                 AC_MSG_WARN([cross compiling: not checking])
2151         ]
2152 )
2153
2154 AC_ARG_WITH(openssl-header-check,
2155         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2156         [  if test "x$withval" = "xno" ; then
2157                 openssl_check_nonfatal=1
2158            fi
2159         ]
2160 )
2161
2162 # Sanity check OpenSSL headers
2163 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2164 AC_RUN_IFELSE(
2165         [AC_LANG_SOURCE([[
2166 #include <string.h>
2167 #include <openssl/opensslv.h>
2168 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
2169         ]])],
2170         [
2171                 AC_MSG_RESULT(yes)
2172         ],
2173         [
2174                 AC_MSG_RESULT(no)
2175                 if test "x$openssl_check_nonfatal" = "x"; then
2176                         AC_MSG_ERROR([Your OpenSSL headers do not match your
2177 library. Check config.log for details.
2178 If you are sure your installation is consistent, you can disable the check
2179 by running "./configure --without-openssl-header-check".
2180 Also see contrib/findssl.sh for help identifying header/library mismatches.
2181 ])
2182                 else
2183                         AC_MSG_WARN([Your OpenSSL headers do not match your
2184 library. Check config.log for details.
2185 Also see contrib/findssl.sh for help identifying header/library mismatches.])
2186                 fi
2187         ],
2188         [
2189                 AC_MSG_WARN([cross compiling: not checking])
2190         ]
2191 )
2192
2193 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2194 AC_LINK_IFELSE(
2195         [AC_LANG_SOURCE([[
2196 #include <openssl/evp.h>
2197 int main(void) { SSLeay_add_all_algorithms(); }
2198         ]])],
2199         [
2200                 AC_MSG_RESULT(yes)
2201         ],
2202         [
2203                 AC_MSG_RESULT(no)
2204                 saved_LIBS="$LIBS"
2205                 LIBS="$LIBS -ldl"
2206                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2207                 AC_LINK_IFELSE(
2208                         [AC_LANG_SOURCE([[
2209 #include <openssl/evp.h>
2210 int main(void) { SSLeay_add_all_algorithms(); }
2211                         ]])],
2212                         [
2213                                 AC_MSG_RESULT(yes)
2214                         ],
2215                         [
2216                                 AC_MSG_RESULT(no)
2217                                 LIBS="$saved_LIBS"
2218                         ]
2219                 )
2220         ]
2221 )
2222
2223 AC_ARG_WITH(ssl-engine,
2224         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2225         [ if test "x$withval" != "xno" ; then
2226                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
2227                 AC_TRY_COMPILE(
2228                         [ #include <openssl/engine.h>],
2229                         [
2230 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
2231                         ],
2232                         [ AC_MSG_RESULT(yes)
2233                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
2234                              [Enable OpenSSL engine support])
2235                         ],
2236                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
2237                 )
2238           fi ]
2239 )
2240
2241 # Check for OpenSSL without EVP_aes_{192,256}_cbc
2242 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2243 AC_LINK_IFELSE(
2244         [AC_LANG_SOURCE([[
2245 #include <string.h>
2246 #include <openssl/evp.h>
2247 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
2248         ]])],
2249         [
2250                 AC_MSG_RESULT(no)
2251         ],
2252         [
2253                 AC_MSG_RESULT(yes)
2254                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2255                     [libcrypto is missing AES 192 and 256 bit functions])
2256         ]
2257 )
2258
2259 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2260 # because the system crypt() is more featureful.
2261 if test "x$check_for_libcrypt_before" = "x1"; then
2262         AC_CHECK_LIB(crypt, crypt)
2263 fi
2264
2265 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2266 # version in OpenSSL.
2267 if test "x$check_for_libcrypt_later" = "x1"; then
2268         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2269 fi
2270
2271 # Search for SHA256 support in libc and/or OpenSSL
2272 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2273
2274 saved_LIBS="$LIBS"
2275 AC_CHECK_LIB(iaf, ia_openinfo, [
2276         LIBS="$LIBS -liaf"
2277         AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
2278                                 AC_DEFINE(HAVE_LIBIAF, 1,
2279                         [Define if system has libiaf that supports set_id])
2280                                 ])
2281 ])
2282 LIBS="$saved_LIBS"
2283
2284 ### Configure cryptographic random number support
2285
2286 # Check wheter OpenSSL seeds itself
2287 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2288 AC_RUN_IFELSE(
2289         [AC_LANG_SOURCE([[
2290 #include <string.h>
2291 #include <openssl/rand.h>
2292 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2293         ]])],
2294         [
2295                 OPENSSL_SEEDS_ITSELF=yes
2296                 AC_MSG_RESULT(yes)
2297         ],
2298         [
2299                 AC_MSG_RESULT(no)
2300                 # Default to use of the rand helper if OpenSSL doesn't
2301                 # seed itself
2302                 USE_RAND_HELPER=yes
2303         ],
2304         [
2305                 AC_MSG_WARN([cross compiling: assuming yes])
2306                 # This is safe, since all recent OpenSSL versions will
2307                 # complain at runtime if not seeded correctly.
2308                 OPENSSL_SEEDS_ITSELF=yes
2309         ]
2310 )
2311
2312 # Check for PAM libs
2313 PAM_MSG="no"
2314 AC_ARG_WITH(pam,
2315         [  --with-pam              Enable PAM support ],
2316         [
2317                 if test "x$withval" != "xno" ; then
2318                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2319                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2320                                 AC_MSG_ERROR([PAM headers not found])
2321                         fi
2322
2323                         saved_LIBS="$LIBS"
2324                         AC_CHECK_LIB(dl, dlopen, , )
2325                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2326                         AC_CHECK_FUNCS(pam_getenvlist)
2327                         AC_CHECK_FUNCS(pam_putenv)
2328                         LIBS="$saved_LIBS"
2329
2330                         PAM_MSG="yes"
2331
2332                         SSHDLIBS="$SSHDLIBS -lpam"
2333                         AC_DEFINE(USE_PAM, 1,
2334                                 [Define if you want to enable PAM support])
2335
2336                         if test $ac_cv_lib_dl_dlopen = yes; then
2337                                 case "$LIBS" in
2338                                 *-ldl*)
2339                                         # libdl already in LIBS
2340                                         ;;
2341                                 *)
2342                                         SSHDLIBS="$SSHDLIBS -ldl"
2343                                         ;;
2344                                 esac
2345                         fi
2346                 fi
2347         ],
2348         [
2349                 saved_LIBS="$LIBS"
2350                 AC_CHECK_LIB(dl, dlopen, , )
2351                 AC_CHECK_LIB(pam, pam_set_item, , )
2352                 AC_CHECK_FUNCS(pam_getenvlist)
2353                 AC_CHECK_FUNCS(pam_putenv)
2354                 LIBS="$saved_LIBS"
2355
2356                 if (test "x$ac_cv_header_security_pam_appl_h" = "xyes" || \
2357                    test "x$ac_cv_header_pam_pam_appl_h" = "xyes") &&
2358                    test "x$ac_cv_lib_pam_pam_set_item" = "xyes" ; then
2359
2360                         PAM_MSG="yes"
2361
2362                         LIBPAM="-lpam"
2363
2364                         if test $ac_cv_lib_dl_dlopen = yes; then
2365                                 case "$LIBS" in
2366                                 *-ldl*)
2367                                         # libdl already in LIBS
2368                                         ;;
2369                                 *)
2370                                         LIBPAM="$LIBPAM -ldl"
2371                                         ;;
2372                                 esac
2373                         fi
2374                         AC_SUBST(LIBPAM)
2375                 fi
2376         ]
2377 )
2378
2379 # Check for older PAM
2380 if test "x$PAM_MSG" = "xyes" ; then
2381         # Check PAM strerror arguments (old PAM)
2382         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2383         AC_TRY_COMPILE(
2384                 [
2385 #include <stdlib.h>
2386 #if defined(HAVE_SECURITY_PAM_APPL_H)
2387 #include <security/pam_appl.h>
2388 #elif defined (HAVE_PAM_PAM_APPL_H)
2389 #include <pam/pam_appl.h>
2390 #endif
2391                 ],
2392                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2393                 [AC_MSG_RESULT(no)],
2394                 [
2395                         AC_DEFINE(HAVE_OLD_PAM, 1,
2396                                 [Define if you have an old version of PAM
2397                                 which takes only one argument to pam_strerror])
2398                         AC_MSG_RESULT(yes)
2399                         PAM_MSG="yes (old library)"
2400                 ]
2401         )
2402 fi
2403
2404 # Do we want to force the use of the rand helper?
2405 AC_ARG_WITH(rand-helper,
2406         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2407         [
2408                 if test "x$withval" = "xno" ; then
2409                         # Force use of OpenSSL's internal RNG, even if
2410                         # the previous test showed it to be unseeded.
2411                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2412                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2413                                 OPENSSL_SEEDS_ITSELF=yes
2414                                 USE_RAND_HELPER=""
2415                         fi
2416                 else
2417                         USE_RAND_HELPER=yes
2418                 fi
2419         ],
2420 )
2421
2422 # Which randomness source do we use?
2423 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2424         # OpenSSL only
2425         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2426                 [Define if you want OpenSSL's internally seeded PRNG only])
2427         RAND_MSG="OpenSSL internal ONLY"
2428         INSTALL_SSH_RAND_HELPER=""
2429 elif test ! -z "$USE_RAND_HELPER" ; then
2430         # install rand helper
2431         RAND_MSG="ssh-rand-helper"
2432         INSTALL_SSH_RAND_HELPER="yes"
2433 fi
2434 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2435
2436 ### Configuration of ssh-rand-helper
2437
2438 # PRNGD TCP socket
2439 AC_ARG_WITH(prngd-port,
2440         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2441         [
2442                 case "$withval" in
2443                 no)
2444                         withval=""
2445                         ;;
2446                 [[0-9]]*)
2447                         ;;
2448                 *)
2449                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2450                         ;;
2451                 esac
2452                 if test ! -z "$withval" ; then
2453                         PRNGD_PORT="$withval"
2454                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2455                                 [Port number of PRNGD/EGD random number socket])
2456                 fi
2457         ]
2458 )
2459
2460 # PRNGD Unix domain socket
2461 AC_ARG_WITH(prngd-socket,
2462         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2463         [
2464                 case "$withval" in
2465                 yes)
2466                         withval="/var/run/egd-pool"
2467                         ;;
2468                 no)
2469                         withval=""
2470                         ;;
2471                 /*)
2472                         ;;
2473                 *)
2474                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2475                         ;;
2476                 esac
2477
2478                 if test ! -z "$withval" ; then
2479                         if test ! -z "$PRNGD_PORT" ; then
2480                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2481                         fi
2482                         if test ! -r "$withval" ; then
2483                                 AC_MSG_WARN(Entropy socket is not readable)
2484                         fi
2485                         PRNGD_SOCKET="$withval"
2486                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2487                                 [Location of PRNGD/EGD random number socket])
2488                 fi
2489         ],
2490         [
2491                 # Check for existing socket only if we don't have a random device already
2492                 if test "$USE_RAND_HELPER" = yes ; then
2493                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2494                         # Insert other locations here
2495                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2496                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2497                                         PRNGD_SOCKET="$sock"
2498                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2499                                         break;
2500                                 fi
2501                         done
2502                         if test ! -z "$PRNGD_SOCKET" ; then
2503                                 AC_MSG_RESULT($PRNGD_SOCKET)
2504                         else
2505                                 AC_MSG_RESULT(not found)
2506                         fi
2507                 fi
2508         ]
2509 )
2510
2511 # Change default command timeout for hashing entropy source
2512 entropy_timeout=200
2513 AC_ARG_WITH(entropy-timeout,
2514         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2515         [
2516                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2517                     test "x${withval}" != "xyes"; then
2518                         entropy_timeout=$withval
2519                 fi
2520         ]
2521 )
2522 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2523         [Builtin PRNG command timeout])
2524
2525 SSH_PRIVSEP_USER=sshd
2526 AC_ARG_WITH(privsep-user,
2527         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2528         [
2529                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2530                     test "x${withval}" != "xyes"; then
2531                         SSH_PRIVSEP_USER=$withval
2532                 fi
2533         ]
2534 )
2535 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2536         [non-privileged user for privilege separation])
2537 AC_SUBST(SSH_PRIVSEP_USER)
2538
2539 # We do this little dance with the search path to insure
2540 # that programs that we select for use by installed programs
2541 # (which may be run by the super-user) come from trusted
2542 # locations before they come from the user's private area.
2543 # This should help avoid accidentally configuring some
2544 # random version of a program in someone's personal bin.
2545
2546 OPATH=$PATH
2547 PATH=/bin:/usr/bin
2548 test -h /bin 2> /dev/null && PATH=/usr/bin
2549 test -d /sbin && PATH=$PATH:/sbin
2550 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2551 PATH=$PATH:/etc:$OPATH
2552
2553 # These programs are used by the command hashing source to gather entropy
2554 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2555 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2556 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2557 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2558 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2559 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2560 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2561 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2562 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2563 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2564 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2565 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2566 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2567 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2568 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2569 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2570 # restore PATH
2571 PATH=$OPATH
2572
2573 # Where does ssh-rand-helper get its randomness from?
2574 INSTALL_SSH_PRNG_CMDS=""
2575 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2576         if test ! -z "$PRNGD_PORT" ; then
2577                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2578         elif test ! -z "$PRNGD_SOCKET" ; then
2579                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2580         else
2581                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2582                 RAND_HELPER_CMDHASH=yes
2583                 INSTALL_SSH_PRNG_CMDS="yes"
2584         fi
2585 fi
2586 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2587
2588
2589 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2590 if test ! -z "$SONY" ; then
2591   LIBS="$LIBS -liberty";
2592 fi
2593
2594 # Check for  long long datatypes
2595 AC_CHECK_TYPES([long long, unsigned long long, long double])
2596
2597 # Check datatype sizes
2598 AC_CHECK_SIZEOF(char, 1)
2599 AC_CHECK_SIZEOF(short int, 2)
2600 AC_CHECK_SIZEOF(int, 4)
2601 AC_CHECK_SIZEOF(long int, 4)
2602 AC_CHECK_SIZEOF(long long int, 8)
2603
2604 # Sanity check long long for some platforms (AIX)
2605 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2606         ac_cv_sizeof_long_long_int=0
2607 fi
2608
2609 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2610 if test -z "$have_llong_max"; then
2611         AC_MSG_CHECKING([for max value of long long])
2612         AC_RUN_IFELSE(
2613                 [AC_LANG_SOURCE([[
2614 #include <stdio.h>
2615 /* Why is this so damn hard? */
2616 #ifdef __GNUC__
2617 # undef __GNUC__
2618 #endif
2619 #define __USE_ISOC99
2620 #include <limits.h>
2621 #define DATA "conftest.llminmax"
2622 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2623
2624 /*
2625  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2626  * we do this the hard way.
2627  */
2628 static int
2629 fprint_ll(FILE *f, long long n)
2630 {
2631         unsigned int i;
2632         int l[sizeof(long long) * 8];
2633
2634         if (n < 0)
2635                 if (fprintf(f, "-") < 0)
2636                         return -1;
2637         for (i = 0; n != 0; i++) {
2638                 l[i] = my_abs(n % 10);
2639                 n /= 10;
2640         }
2641         do {
2642                 if (fprintf(f, "%d", l[--i]) < 0)
2643                         return -1;
2644         } while (i != 0);
2645         if (fprintf(f, " ") < 0)
2646                 return -1;
2647         return 0;
2648 }
2649
2650 int main(void) {
2651         FILE *f;
2652         long long i, llmin, llmax = 0;
2653
2654         if((f = fopen(DATA,"w")) == NULL)
2655                 exit(1);
2656
2657 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2658         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2659         llmin = LLONG_MIN;
2660         llmax = LLONG_MAX;
2661 #else
2662         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2663         /* This will work on one's complement and two's complement */
2664         for (i = 1; i > llmax; i <<= 1, i++)
2665                 llmax = i;
2666         llmin = llmax + 1LL;    /* wrap */
2667 #endif
2668
2669         /* Sanity check */
2670         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2671             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2672             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2673                 fprintf(f, "unknown unknown\n");
2674                 exit(2);
2675         }
2676
2677         if (fprint_ll(f, llmin) < 0)
2678                 exit(3);
2679         if (fprint_ll(f, llmax) < 0)
2680                 exit(4);
2681         if (fclose(f) < 0)
2682                 exit(5);
2683         exit(0);
2684 }
2685                 ]])],
2686                 [
2687                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2688                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2689
2690                         AC_MSG_RESULT($llong_max)
2691                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2692                             [max value of long long calculated by configure])
2693                         AC_MSG_CHECKING([for min value of long long])
2694                         AC_MSG_RESULT($llong_min)
2695                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2696                             [min value of long long calculated by configure])
2697                 ],
2698                 [
2699                         AC_MSG_RESULT(not found)
2700                 ],
2701                 [
2702                         AC_MSG_WARN([cross compiling: not checking])
2703                 ]
2704         )
2705 fi
2706
2707
2708 # More checks for data types
2709 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2710         AC_TRY_COMPILE(
2711                 [ #include <sys/types.h> ],
2712                 [ u_int a; a = 1;],
2713                 [ ac_cv_have_u_int="yes" ],
2714                 [ ac_cv_have_u_int="no" ]
2715         )
2716 ])
2717 if test "x$ac_cv_have_u_int" = "xyes" ; then
2718         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2719         have_u_int=1
2720 fi
2721
2722 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2723         AC_TRY_COMPILE(
2724                 [ #include <sys/types.h> ],
2725                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2726                 [ ac_cv_have_intxx_t="yes" ],
2727                 [ ac_cv_have_intxx_t="no" ]
2728         )
2729 ])
2730 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2731         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2732         have_intxx_t=1
2733 fi
2734
2735 if (test -z "$have_intxx_t" && \
2736            test "x$ac_cv_header_stdint_h" = "xyes")
2737 then
2738     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2739         AC_TRY_COMPILE(
2740                 [ #include <stdint.h> ],
2741                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2742                 [
2743                         AC_DEFINE(HAVE_INTXX_T)
2744                         AC_MSG_RESULT(yes)
2745                 ],
2746                 [ AC_MSG_RESULT(no) ]
2747         )
2748 fi
2749
2750 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2751         AC_TRY_COMPILE(
2752                 [
2753 #include <sys/types.h>
2754 #ifdef HAVE_STDINT_H
2755 # include <stdint.h>
2756 #endif
2757 #include <sys/socket.h>
2758 #ifdef HAVE_SYS_BITYPES_H
2759 # include <sys/bitypes.h>
2760 #endif
2761                 ],
2762                 [ int64_t a; a = 1;],
2763                 [ ac_cv_have_int64_t="yes" ],
2764                 [ ac_cv_have_int64_t="no" ]
2765         )
2766 ])
2767 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2768         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2769 fi
2770
2771 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2772         AC_TRY_COMPILE(
2773                 [ #include <sys/types.h> ],
2774                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2775                 [ ac_cv_have_u_intxx_t="yes" ],
2776                 [ ac_cv_have_u_intxx_t="no" ]
2777         )
2778 ])
2779 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2780         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2781         have_u_intxx_t=1
2782 fi
2783
2784 if test -z "$have_u_intxx_t" ; then
2785     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2786         AC_TRY_COMPILE(
2787                 [ #include <sys/socket.h> ],
2788                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2789                 [
2790                         AC_DEFINE(HAVE_U_INTXX_T)
2791                         AC_MSG_RESULT(yes)
2792                 ],
2793                 [ AC_MSG_RESULT(no) ]
2794         )
2795 fi
2796
2797 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2798         AC_TRY_COMPILE(
2799                 [ #include <sys/types.h> ],
2800                 [ u_int64_t a; a = 1;],
2801                 [ ac_cv_have_u_int64_t="yes" ],
2802                 [ ac_cv_have_u_int64_t="no" ]
2803         )
2804 ])
2805 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2806         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2807         have_u_int64_t=1
2808 fi
2809
2810 if test -z "$have_u_int64_t" ; then
2811     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2812         AC_TRY_COMPILE(
2813                 [ #include <sys/bitypes.h> ],
2814                 [ u_int64_t a; a = 1],
2815                 [
2816                         AC_DEFINE(HAVE_U_INT64_T)
2817                         AC_MSG_RESULT(yes)
2818                 ],
2819                 [ AC_MSG_RESULT(no) ]
2820         )
2821 fi
2822
2823 if test -z "$have_u_intxx_t" ; then
2824         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2825                 AC_TRY_COMPILE(
2826                         [
2827 #include <sys/types.h>
2828                         ],
2829                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2830                         [ ac_cv_have_uintxx_t="yes" ],
2831                         [ ac_cv_have_uintxx_t="no" ]
2832                 )
2833         ])
2834         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2835                 AC_DEFINE(HAVE_UINTXX_T, 1,
2836                         [define if you have uintxx_t data type])
2837         fi
2838 fi
2839
2840 if test -z "$have_uintxx_t" ; then
2841     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2842         AC_TRY_COMPILE(
2843                 [ #include <stdint.h> ],
2844                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2845                 [
2846                         AC_DEFINE(HAVE_UINTXX_T)
2847                         AC_MSG_RESULT(yes)
2848                 ],
2849                 [ AC_MSG_RESULT(no) ]
2850         )
2851 fi
2852
2853 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2854            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2855 then
2856         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2857         AC_TRY_COMPILE(
2858                 [
2859 #include <sys/bitypes.h>
2860                 ],
2861                 [
2862                         int8_t a; int16_t b; int32_t c;
2863                         u_int8_t e; u_int16_t f; u_int32_t g;
2864                         a = b = c = e = f = g = 1;
2865                 ],
2866                 [
2867                         AC_DEFINE(HAVE_U_INTXX_T)
2868                         AC_DEFINE(HAVE_INTXX_T)
2869                         AC_MSG_RESULT(yes)
2870                 ],
2871                 [AC_MSG_RESULT(no)]
2872         )
2873 fi
2874
2875
2876 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2877         AC_TRY_COMPILE(
2878                 [
2879 #include <sys/types.h>
2880                 ],
2881                 [ u_char foo; foo = 125; ],
2882                 [ ac_cv_have_u_char="yes" ],
2883                 [ ac_cv_have_u_char="no" ]
2884         )
2885 ])
2886 if test "x$ac_cv_have_u_char" = "xyes" ; then
2887         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2888 fi
2889
2890 TYPE_SOCKLEN_T
2891
2892 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2893 AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t],,,[
2894 #include <sys/types.h>
2895 #ifdef HAVE_SYS_BITYPES_H
2896 #include <sys/bitypes.h>
2897 #endif
2898 #ifdef HAVE_SYS_STATFS_H
2899 #include <sys/statfs.h>
2900 #endif
2901 #ifdef HAVE_SYS_STATVFS_H
2902 #include <sys/statvfs.h>
2903 #endif
2904 ])
2905
2906 AC_CHECK_TYPES(in_addr_t,,,
2907 [#include <sys/types.h>
2908 #include <netinet/in.h>])
2909
2910 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2911         AC_TRY_COMPILE(
2912                 [
2913 #include <sys/types.h>
2914                 ],
2915                 [ size_t foo; foo = 1235; ],
2916                 [ ac_cv_have_size_t="yes" ],
2917                 [ ac_cv_have_size_t="no" ]
2918         )
2919 ])
2920 if test "x$ac_cv_have_size_t" = "xyes" ; then
2921         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2922 fi
2923
2924 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2925         AC_TRY_COMPILE(
2926                 [
2927 #include <sys/types.h>
2928                 ],
2929                 [ ssize_t foo; foo = 1235; ],
2930                 [ ac_cv_have_ssize_t="yes" ],
2931                 [ ac_cv_have_ssize_t="no" ]
2932         )
2933 ])
2934 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2935         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2936 fi
2937
2938 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2939         AC_TRY_COMPILE(
2940                 [
2941 #include <time.h>
2942                 ],
2943                 [ clock_t foo; foo = 1235; ],
2944                 [ ac_cv_have_clock_t="yes" ],
2945                 [ ac_cv_have_clock_t="no" ]
2946         )
2947 ])
2948 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2949         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2950 fi
2951
2952 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2953         AC_TRY_COMPILE(
2954                 [
2955 #include <sys/types.h>
2956 #include <sys/socket.h>
2957                 ],
2958                 [ sa_family_t foo; foo = 1235; ],
2959                 [ ac_cv_have_sa_family_t="yes" ],
2960                 [ AC_TRY_COMPILE(
2961                   [
2962 #include <sys/types.h>
2963 #include <sys/socket.h>
2964 #include <netinet/in.h>
2965                 ],
2966                 [ sa_family_t foo; foo = 1235; ],
2967                 [ ac_cv_have_sa_family_t="yes" ],
2968
2969                 [ ac_cv_have_sa_family_t="no" ]
2970         )]
2971         )
2972 ])
2973 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2974         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2975                 [define if you have sa_family_t data type])
2976 fi
2977
2978 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2979         AC_TRY_COMPILE(
2980                 [
2981 #include <sys/types.h>
2982                 ],
2983                 [ pid_t foo; foo = 1235; ],
2984                 [ ac_cv_have_pid_t="yes" ],
2985                 [ ac_cv_have_pid_t="no" ]
2986         )
2987 ])
2988 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2989         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2990 fi
2991
2992 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2993         AC_TRY_COMPILE(
2994                 [
2995 #include <sys/types.h>
2996                 ],
2997                 [ mode_t foo; foo = 1235; ],
2998                 [ ac_cv_have_mode_t="yes" ],
2999                 [ ac_cv_have_mode_t="no" ]
3000         )
3001 ])
3002 if test "x$ac_cv_have_mode_t" = "xyes" ; then
3003         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
3004 fi
3005
3006
3007 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
3008         AC_TRY_COMPILE(
3009                 [
3010 #include <sys/types.h>
3011 #include <sys/socket.h>
3012                 ],
3013                 [ struct sockaddr_storage s; ],
3014                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
3015                 [ ac_cv_have_struct_sockaddr_storage="no" ]
3016         )
3017 ])
3018 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
3019         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
3020                 [define if you have struct sockaddr_storage data type])
3021 fi
3022
3023 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
3024         AC_TRY_COMPILE(
3025                 [
3026 #include <sys/types.h>
3027 #include <netinet/in.h>
3028                 ],
3029                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
3030                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
3031                 [ ac_cv_have_struct_sockaddr_in6="no" ]
3032         )
3033 ])
3034 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
3035         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
3036                 [define if you have struct sockaddr_in6 data type])
3037 fi
3038
3039 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
3040         AC_TRY_COMPILE(
3041                 [
3042 #include <sys/types.h>
3043 #include <netinet/in.h>
3044                 ],
3045                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
3046                 [ ac_cv_have_struct_in6_addr="yes" ],
3047                 [ ac_cv_have_struct_in6_addr="no" ]
3048         )
3049 ])
3050 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
3051         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
3052                 [define if you have struct in6_addr data type])
3053 fi
3054
3055 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
3056         AC_TRY_COMPILE(
3057                 [
3058 #include <sys/types.h>
3059 #include <sys/socket.h>
3060 #include <netdb.h>
3061                 ],
3062                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
3063                 [ ac_cv_have_struct_addrinfo="yes" ],
3064                 [ ac_cv_have_struct_addrinfo="no" ]
3065         )
3066 ])
3067 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
3068         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
3069                 [define if you have struct addrinfo data type])
3070 fi
3071
3072 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
3073         AC_TRY_COMPILE(
3074                 [ #include <sys/time.h> ],
3075                 [ struct timeval tv; tv.tv_sec = 1;],
3076                 [ ac_cv_have_struct_timeval="yes" ],
3077                 [ ac_cv_have_struct_timeval="no" ]
3078         )
3079 ])
3080 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
3081         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
3082         have_struct_timeval=1
3083 fi
3084
3085 AC_CHECK_TYPES(struct timespec)
3086
3087 # We need int64_t or else certian parts of the compile will fail.
3088 if test "x$ac_cv_have_int64_t" = "xno" && \
3089         test "x$ac_cv_sizeof_long_int" != "x8" && \
3090         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
3091         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
3092         echo "an alternative compiler (I.E., GCC) before continuing."
3093         echo ""
3094         exit 1;
3095 else
3096 dnl test snprintf (broken on SCO w/gcc)
3097         AC_RUN_IFELSE(
3098                 [AC_LANG_SOURCE([[
3099 #include <stdio.h>
3100 #include <string.h>
3101 #ifdef HAVE_SNPRINTF
3102 main()
3103 {
3104         char buf[50];
3105         char expected_out[50];
3106         int mazsize = 50 ;
3107 #if (SIZEOF_LONG_INT == 8)
3108         long int num = 0x7fffffffffffffff;
3109 #else
3110         long long num = 0x7fffffffffffffffll;
3111 #endif
3112         strcpy(expected_out, "9223372036854775807");
3113         snprintf(buf, mazsize, "%lld", num);
3114         if(strcmp(buf, expected_out) != 0)
3115                 exit(1);
3116         exit(0);
3117 }
3118 #else
3119 main() { exit(0); }
3120 #endif
3121                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
3122                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3123         )
3124 fi
3125
3126 dnl Checks for structure members
3127 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
3128 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
3129 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
3130 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
3131 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
3132 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
3133 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
3134 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
3135 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
3136 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
3137 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
3138 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
3139 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
3140 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
3141 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
3142 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
3143 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
3144
3145 AC_CHECK_MEMBERS([struct stat.st_blksize])
3146 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
3147         [Define if we don't have struct __res_state in resolv.h])],
3148 [
3149 #include <stdio.h>
3150 #if HAVE_SYS_TYPES_H
3151 # include <sys/types.h>
3152 #endif
3153 #include <netinet/in.h>
3154 #include <arpa/nameser.h>
3155 #include <resolv.h>
3156 ])
3157
3158 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
3159                 ac_cv_have_ss_family_in_struct_ss, [
3160         AC_TRY_COMPILE(
3161                 [
3162 #include <sys/types.h>
3163 #include <sys/socket.h>
3164                 ],
3165                 [ struct sockaddr_storage s; s.ss_family = 1; ],
3166                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
3167                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
3168         )
3169 ])
3170 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3171         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
3172 fi
3173
3174 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
3175                 ac_cv_have___ss_family_in_struct_ss, [
3176         AC_TRY_COMPILE(
3177                 [
3178 #include <sys/types.h>
3179 #include <sys/socket.h>
3180                 ],
3181                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
3182                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
3183                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
3184         )
3185 ])
3186 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
3187         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
3188                 [Fields in struct sockaddr_storage])
3189 fi
3190
3191 AC_CACHE_CHECK([for pw_class field in struct passwd],
3192                 ac_cv_have_pw_class_in_struct_passwd, [
3193         AC_TRY_COMPILE(
3194                 [
3195 #include <pwd.h>
3196                 ],
3197                 [ struct passwd p; p.pw_class = 0; ],
3198                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
3199                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
3200         )
3201 ])
3202 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
3203         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
3204                 [Define if your password has a pw_class field])
3205 fi
3206
3207 AC_CACHE_CHECK([for pw_expire field in struct passwd],
3208                 ac_cv_have_pw_expire_in_struct_passwd, [
3209         AC_TRY_COMPILE(
3210                 [
3211 #include <pwd.h>
3212                 ],
3213                 [ struct passwd p; p.pw_expire = 0; ],
3214                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
3215                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
3216         )
3217 ])
3218 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
3219         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
3220                 [Define if your password has a pw_expire field])
3221 fi
3222
3223 AC_CACHE_CHECK([for pw_change field in struct passwd],
3224                 ac_cv_have_pw_change_in_struct_passwd, [
3225         AC_TRY_COMPILE(
3226                 [
3227 #include <pwd.h>
3228                 ],
3229                 [ struct passwd p; p.pw_change = 0; ],
3230                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
3231                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
3232         )
3233 ])
3234 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
3235         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
3236                 [Define if your password has a pw_change field])
3237 fi
3238
3239 dnl make sure we're using the real structure members and not defines
3240 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3241                 ac_cv_have_accrights_in_msghdr, [
3242         AC_COMPILE_IFELSE(
3243                 [
3244 #include <sys/types.h>
3245 #include <sys/socket.h>
3246 #include <sys/uio.h>
3247 int main() {
3248 #ifdef msg_accrights
3249 #error "msg_accrights is a macro"
3250 exit(1);
3251 #endif
3252 struct msghdr m;
3253 m.msg_accrights = 0;
3254 exit(0);
3255 }
3256                 ],
3257                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3258                 [ ac_cv_have_accrights_in_msghdr="no" ]
3259         )
3260 ])
3261 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3262         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
3263                 [Define if your system uses access rights style
3264                 file descriptor passing])
3265 fi
3266
3267 AC_MSG_CHECKING(if f_fsid has val members)
3268 AC_TRY_COMPILE([
3269 #include <sys/types.h>
3270 #include <sys/statvfs.h>],
3271 [struct fsid_t t; t.val[0] = 0;],
3272         [ AC_MSG_RESULT(yes)
3273           AC_DEFINE(FSID_HAS_VAL, 1, f_fsid has members) ],
3274         [ AC_MSG_RESULT(no) ]
3275 )
3276
3277 AC_CACHE_CHECK([for msg_control field in struct msghdr],
3278                 ac_cv_have_control_in_msghdr, [
3279         AC_COMPILE_IFELSE(
3280                 [
3281 #include <sys/types.h>
3282 #include <sys/socket.h>
3283 #include <sys/uio.h>
3284 int main() {
3285 #ifdef msg_control
3286 #error "msg_control is a macro"
3287 exit(1);
3288 #endif
3289 struct msghdr m;
3290 m.msg_control = 0;
3291 exit(0);
3292 }
3293                 ],
3294                 [ ac_cv_have_control_in_msghdr="yes" ],
3295                 [ ac_cv_have_control_in_msghdr="no" ]
3296         )
3297 ])
3298 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
3299         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3300                 [Define if your system uses ancillary data style
3301                 file descriptor passing])
3302 fi
3303
3304 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3305         AC_TRY_LINK([],
3306                 [ extern char *__progname; printf("%s", __progname); ],
3307                 [ ac_cv_libc_defines___progname="yes" ],
3308                 [ ac_cv_libc_defines___progname="no" ]
3309         )
3310 ])
3311 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3312         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3313 fi
3314
3315 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3316         AC_TRY_LINK([
3317 #include <stdio.h>
3318 ],
3319                 [ printf("%s", __FUNCTION__); ],
3320                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3321                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3322         )
3323 ])
3324 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3325         AC_DEFINE(HAVE___FUNCTION__, 1,
3326                 [Define if compiler implements __FUNCTION__])
3327 fi
3328
3329 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3330         AC_TRY_LINK([
3331 #include <stdio.h>
3332 ],
3333                 [ printf("%s", __func__); ],
3334                 [ ac_cv_cc_implements___func__="yes" ],
3335                 [ ac_cv_cc_implements___func__="no" ]
3336         )
3337 ])
3338 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3339         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3340 fi
3341
3342 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3343         AC_TRY_LINK(
3344                 [#include <stdarg.h>
3345                  va_list x,y;],
3346                 [va_copy(x,y);],
3347                 [ ac_cv_have_va_copy="yes" ],
3348                 [ ac_cv_have_va_copy="no" ]
3349         )
3350 ])
3351 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3352         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3353 fi
3354
3355 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3356         AC_TRY_LINK(
3357                 [#include <stdarg.h>
3358                  va_list x,y;],
3359                 [__va_copy(x,y);],
3360                 [ ac_cv_have___va_copy="yes" ],
3361                 [ ac_cv_have___va_copy="no" ]
3362         )
3363 ])
3364 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3365         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3366 fi
3367
3368 AC_CACHE_CHECK([whether getopt has optreset support],
3369                 ac_cv_have_getopt_optreset, [
3370         AC_TRY_LINK(
3371                 [
3372 #include <getopt.h>
3373                 ],
3374                 [ extern int optreset; optreset = 0; ],
3375                 [ ac_cv_have_getopt_optreset="yes" ],
3376                 [ ac_cv_have_getopt_optreset="no" ]
3377         )
3378 ])
3379 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3380         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3381                 [Define if your getopt(3) defines and uses optreset])
3382 fi
3383
3384 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3385         AC_TRY_LINK([],
3386                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3387                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3388                 [ ac_cv_libc_defines_sys_errlist="no" ]
3389         )
3390 ])
3391 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3392         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3393                 [Define if your system defines sys_errlist[]])
3394 fi
3395
3396
3397 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3398         AC_TRY_LINK([],
3399                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3400                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3401                 [ ac_cv_libc_defines_sys_nerr="no" ]
3402         )
3403 ])
3404 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3405         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3406 fi
3407
3408 SCARD_MSG="no"
3409 # Check whether user wants sectok support
3410 AC_ARG_WITH(sectok,
3411         [  --with-sectok           Enable smartcard support using libsectok],
3412         [
3413                 if test "x$withval" != "xno" ; then
3414                         if test "x$withval" != "xyes" ; then
3415                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3416                                 LDFLAGS="$LDFLAGS -L${withval}"
3417                                 if test ! -z "$need_dash_r" ; then
3418                                         LDFLAGS="$LDFLAGS -R${withval}"
3419                                 fi
3420                                 if test ! -z "$blibpath" ; then
3421                                         blibpath="$blibpath:${withval}"
3422                                 fi
3423                         fi
3424                         AC_CHECK_HEADERS(sectok.h)
3425                         if test "$ac_cv_header_sectok_h" != yes; then
3426                                 AC_MSG_ERROR(Can't find sectok.h)
3427                         fi
3428                         AC_CHECK_LIB(sectok, sectok_open)
3429                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3430                                 AC_MSG_ERROR(Can't find libsectok)
3431                         fi
3432                         AC_DEFINE(SMARTCARD, 1,
3433                                 [Define if you want smartcard support])
3434                         AC_DEFINE(USE_SECTOK, 1,
3435                                 [Define if you want smartcard support
3436                                 using sectok])
3437                         SCARD_MSG="yes, using sectok"
3438                 fi
3439         ]
3440 )
3441
3442 # Check whether user wants OpenSC support
3443 OPENSC_CONFIG="no"
3444 AC_ARG_WITH(opensc,
3445         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3446         [
3447             if test "x$withval" != "xno" ; then
3448                 if test "x$withval" != "xyes" ; then
3449                         OPENSC_CONFIG=$withval/bin/opensc-config
3450                 else
3451                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3452                 fi
3453                 if test "$OPENSC_CONFIG" != "no"; then
3454                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3455                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3456                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3457                         LIBS="$LIBS $LIBOPENSC_LIBS"
3458                         AC_DEFINE(SMARTCARD)
3459                         AC_DEFINE(USE_OPENSC, 1,
3460                                 [Define if you want smartcard support
3461                                 using OpenSC])
3462                         SCARD_MSG="yes, using OpenSC"
3463                 fi
3464             fi
3465         ]
3466 )
3467
3468 # Check libraries needed by DNS fingerprint support
3469 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3470         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3471                 [Define if getrrsetbyname() exists])],
3472         [
3473                 # Needed by our getrrsetbyname()
3474                 AC_SEARCH_LIBS(res_query, resolv)
3475                 AC_SEARCH_LIBS(dn_expand, resolv)
3476                 AC_MSG_CHECKING(if res_query will link)
3477                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
3478                    [AC_MSG_RESULT(no)
3479                     saved_LIBS="$LIBS"
3480                     LIBS="$LIBS -lresolv"
3481                     AC_MSG_CHECKING(for res_query in -lresolv)
3482                     AC_LINK_IFELSE([
3483 #include <resolv.h>
3484 int main()
3485 {
3486         res_query (0, 0, 0, 0, 0);
3487         return 0;
3488 }
3489                         ],
3490                         [LIBS="$LIBS -lresolv"
3491                          AC_MSG_RESULT(yes)],
3492                         [LIBS="$saved_LIBS"
3493                          AC_MSG_RESULT(no)])
3494                     ])
3495                 AC_CHECK_FUNCS(_getshort _getlong)
3496                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3497                     [#include <sys/types.h>
3498                     #include <arpa/nameser.h>])
3499                 AC_CHECK_MEMBER(HEADER.ad,
3500                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3501                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3502                         [#include <arpa/nameser.h>])
3503         ])
3504
3505 AC_MSG_CHECKING(if struct __res_state _res is an extern)
3506 AC_LINK_IFELSE([
3507 #include <stdio.h>
3508 #if HAVE_SYS_TYPES_H
3509 # include <sys/types.h>
3510 #endif
3511 #include <netinet/in.h>
3512 #include <arpa/nameser.h>
3513 #include <resolv.h>
3514 extern struct __res_state _res;
3515 int main() { return 0; }
3516                 ],
3517                 [AC_MSG_RESULT(yes)
3518                  AC_DEFINE(HAVE__RES_EXTERN, 1,
3519                     [Define if you have struct __res_state _res as an extern])
3520                 ],
3521                 [ AC_MSG_RESULT(no) ]
3522 )
3523
3524 # Check whether user wants SELinux support
3525 SELINUX_MSG="no"
3526 LIBSELINUX=""
3527 AC_ARG_WITH(selinux,
3528         [  --with-selinux          Enable SELinux support],
3529         [ if test "x$withval" != "xno" ; then
3530                 save_LIBS="$LIBS"
3531                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3532                 SELINUX_MSG="yes"
3533                 AC_CHECK_HEADER([selinux/selinux.h], ,
3534                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3535                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3536                     AC_MSG_ERROR(SELinux support requires libselinux library))
3537                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
3538                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3539                 LIBS="$save_LIBS"
3540         fi ]
3541 )
3542
3543 # Check whether user wants Kerberos 5 support
3544 KRB5_MSG="no"
3545 AC_ARG_WITH(kerberos5,
3546         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3547         [ if test "x$withval" != "xno" ; then
3548                 if test "x$withval" = "xyes" ; then
3549                         KRB5ROOT="/usr/local"
3550                 else
3551                         KRB5ROOT=${withval}
3552                 fi
3553
3554                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3555                 KRB5_MSG="yes"
3556
3557                 AC_MSG_CHECKING(for krb5-config)
3558                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3559                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3560                         AC_MSG_RESULT($KRB5CONF)
3561
3562                         AC_MSG_CHECKING(for gssapi support)
3563                         if $KRB5CONF | grep gssapi >/dev/null ; then
3564                                 AC_MSG_RESULT(yes)
3565                                 AC_DEFINE(GSSAPI, 1,
3566                                         [Define this if you want GSSAPI
3567                                         support in the version 2 protocol])
3568                                 k5confopts=gssapi
3569                         else
3570                                 AC_MSG_RESULT(no)
3571                                 k5confopts=""
3572                         fi
3573                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3574                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3575                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3576                         AC_MSG_CHECKING(whether we are using Heimdal)
3577                         AC_TRY_COMPILE([ #include <krb5.h> ],
3578                                        [ char *tmp = heimdal_version; ],
3579                                        [ AC_MSG_RESULT(yes)
3580                                          AC_DEFINE(HEIMDAL, 1,
3581                                         [Define this if you are using the
3582                                         Heimdal version of Kerberos V5]) ],
3583                                          AC_MSG_RESULT(no)
3584                         )
3585                 else
3586                         AC_MSG_RESULT(no)
3587                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3588                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3589                         AC_MSG_CHECKING(whether we are using Heimdal)
3590                         AC_TRY_COMPILE([ #include <krb5.h> ],
3591                                        [ char *tmp = heimdal_version; ],
3592                                        [ AC_MSG_RESULT(yes)
3593                                          AC_DEFINE(HEIMDAL)
3594                                          K5LIBS="-lkrb5 -ldes"
3595                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3596                                          AC_CHECK_LIB(roken, net_write,
3597                                            [K5LIBS="$K5LIBS -lroken"])
3598                                        ],
3599                                        [ AC_MSG_RESULT(no)
3600                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3601                                        ]
3602                         )
3603                         AC_SEARCH_LIBS(dn_expand, resolv)
3604
3605                         AC_CHECK_LIB(gssapi_krb5, gss_init_sec_context,
3606                                 [ AC_DEFINE(GSSAPI)
3607                                   K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3608                                 [ AC_CHECK_LIB(gssapi, gss_init_sec_context,
3609                                         [ AC_DEFINE(GSSAPI)
3610                                           K5LIBS="-lgssapi $K5LIBS" ],
3611                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3612                                         $K5LIBS)
3613                                 ],
3614                                 $K5LIBS)
3615
3616                         AC_CHECK_HEADER(gssapi.h, ,
3617                                 [ unset ac_cv_header_gssapi_h
3618                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3619                                   AC_CHECK_HEADERS(gssapi.h, ,
3620                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3621                                   )
3622                                 ]
3623                         )
3624
3625                         oldCPP="$CPPFLAGS"
3626                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3627                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3628                                         [ CPPFLAGS="$oldCPP" ])
3629
3630                         # If we're using some other GSSAPI
3631                         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
3632                                 AC_MSG_ERROR([$GSSAPI GSSAPI library conflicts with Kerberos support.  Use mechglue instead.])
3633                         fi
3634
3635                         if test -z "$GSSAPI"; then
3636                                 GSSAPI="KRB5";
3637                         fi
3638
3639                         oldCPP="$CPPFLAGS"
3640                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3641                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3642                                         [ CPPFLAGS="$oldCPP" ])
3643
3644                 fi
3645                 if test ! -z "$need_dash_r" ; then
3646                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3647                 fi
3648                 if test ! -z "$blibpath" ; then
3649                         blibpath="$blibpath:${KRB5ROOT}/lib"
3650                 fi
3651
3652                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3653                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3654                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3655
3656                 LIBS="$LIBS $K5LIBS"
3657                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3658                         [Define this if you want to use libkafs' AFS support]))
3659         fi
3660         ]
3661 )
3662
3663 # Check whether user wants AFS_KRB5 support
3664 AFS_KRB5_MSG="no"
3665 AC_ARG_WITH(afs-krb5,
3666         [  --with-afs-krb5[[=AKLOG_PATH]]  Enable aklog to get token (default=/usr/bin/aklog).],
3667         [
3668                 if test "x$withval" != "xno" ; then
3669
3670                         if test "x$withval" != "xyes" ; then
3671                                 AC_DEFINE_UNQUOTED(AKLOG_PATH, "$withval",
3672                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3673                         else
3674                                 AC_DEFINE_UNQUOTED(AKLOG_PATH,
3675                                         "/usr/bin/aklog",
3676                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3677                         fi
3678
3679                         if test -z "$KRB5ROOT" ; then
3680                                 AC_MSG_WARN([AFS_KRB5 requires Kerberos 5 support, build may fail])
3681                         fi
3682
3683                         LIBS="-lkrbafs -lkrb4 $LIBS"
3684                         if test ! -z "$AFS_LIBS" ; then
3685                                 LIBS="$LIBS $AFS_LIBS"
3686                         fi
3687                         AC_DEFINE(AFS_KRB5, 1,
3688                                 [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3689                         AFS_KRB5_MSG="yes"
3690                 fi
3691         ]
3692 )
3693
3694 AC_ARG_WITH(session-hooks,
3695         [  --with-session-hooks    Enable hooks for executing external commands                                       before/after a session],
3696         [ AC_DEFINE(SESSION_HOOKS, 1, [Define this if you want support for startup/shutdown hooks]) ]
3697 )
3698
3699 # Looking for programs, paths and files
3700
3701 PRIVSEP_PATH=/var/empty
3702 AC_ARG_WITH(privsep-path,
3703         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3704         [
3705                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3706                     test "x${withval}" != "xyes"; then
3707                         PRIVSEP_PATH=$withval
3708                 fi
3709         ]
3710 )
3711 AC_SUBST(PRIVSEP_PATH)
3712
3713 AC_ARG_WITH(xauth,
3714         [  --with-xauth=PATH       Specify path to xauth program ],
3715         [
3716                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3717                     test "x${withval}" != "xyes"; then
3718                         xauth_path=$withval
3719                 fi
3720         ],
3721         [
3722                 TestPath="$PATH"
3723                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3724                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3725                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3726                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3727                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3728                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3729                         xauth_path="/usr/openwin/bin/xauth"
3730                 fi
3731         ]
3732 )
3733
3734 # strip causes problems with GSI libraries...
3735 if test -z "$GSI_LIBS" ; then
3736 STRIP_OPT=-s
3737 fi
3738 AC_ARG_ENABLE(strip,
3739         [  --disable-strip         Disable calling strip(1) on install],
3740         [
3741                 if test "x$enableval" = "xno" ; then
3742                         STRIP_OPT=
3743                 fi
3744         ]
3745 )
3746 AC_SUBST(STRIP_OPT)
3747
3748 if test -z "$xauth_path" ; then
3749         XAUTH_PATH="undefined"
3750         AC_SUBST(XAUTH_PATH)
3751 else
3752         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3753                 [Define if xauth is found in your path])
3754         XAUTH_PATH=$xauth_path
3755         AC_SUBST(XAUTH_PATH)
3756 fi
3757
3758 # Check for mail directory (last resort if we cannot get it from headers)
3759 if test ! -z "$MAIL" ; then
3760         maildir=`dirname $MAIL`
3761         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3762                 [Set this to your mail directory if you don't have maillock.h])
3763 fi
3764
3765 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3766         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3767         disable_ptmx_check=yes
3768 fi
3769 if test -z "$no_dev_ptmx" ; then
3770         if test "x$disable_ptmx_check" != "xyes" ; then
3771                 AC_CHECK_FILE("/dev/ptmx",
3772                         [
3773                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3774                                         [Define if you have /dev/ptmx])
3775                                 have_dev_ptmx=1
3776                         ]
3777                 )
3778         fi
3779 fi
3780
3781 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3782         AC_CHECK_FILE("/dev/ptc",
3783                 [
3784                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3785                                 [Define if you have /dev/ptc])
3786                         have_dev_ptc=1
3787                 ]
3788         )
3789 else
3790         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3791 fi
3792
3793 # Options from here on. Some of these are preset by platform above
3794 AC_ARG_WITH(mantype,
3795         [  --with-mantype=man|cat|doc  Set man page type],
3796         [
3797                 case "$withval" in
3798                 man|cat|doc)
3799                         MANTYPE=$withval
3800                         ;;
3801                 *)
3802                         AC_MSG_ERROR(invalid man type: $withval)
3803                         ;;
3804                 esac
3805         ]
3806 )
3807 if test -z "$MANTYPE"; then
3808         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3809         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3810         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3811                 MANTYPE=doc
3812         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3813                 MANTYPE=man
3814         else
3815                 MANTYPE=cat
3816         fi
3817 fi
3818 AC_SUBST(MANTYPE)
3819 if test "$MANTYPE" = "doc"; then
3820         mansubdir=man;
3821 else
3822         mansubdir=$MANTYPE;
3823 fi
3824 AC_SUBST(mansubdir)
3825
3826 # Check whether to enable MD5 passwords
3827 MD5_MSG="no"
3828 AC_ARG_WITH(md5-passwords,
3829         [  --with-md5-passwords    Enable use of MD5 passwords],
3830         [
3831                 if test "x$withval" != "xno" ; then
3832                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3833                                 [Define if you want to allow MD5 passwords])
3834                         MD5_MSG="yes"
3835                 fi
3836         ]
3837 )
3838
3839 # Whether to disable shadow password support
3840 AC_ARG_WITH(shadow,
3841         [  --without-shadow        Disable shadow password support],
3842         [
3843                 if test "x$withval" = "xno" ; then
3844                         AC_DEFINE(DISABLE_SHADOW)
3845                         disable_shadow=yes
3846                 fi
3847         ]
3848 )
3849
3850 if test -z "$disable_shadow" ; then
3851         AC_MSG_CHECKING([if the systems has expire shadow information])
3852         AC_TRY_COMPILE(
3853         [
3854 #include <sys/types.h>
3855 #include <shadow.h>
3856         struct spwd sp;
3857         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3858         [ sp_expire_available=yes ], []
3859         )
3860
3861         if test "x$sp_expire_available" = "xyes" ; then
3862                 AC_MSG_RESULT(yes)
3863                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3864                     [Define if you want to use shadow password expire field])
3865         else
3866                 AC_MSG_RESULT(no)
3867         fi
3868 fi
3869
3870 # Use ip address instead of hostname in $DISPLAY
3871 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3872         DISPLAY_HACK_MSG="yes"
3873         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3874                 [Define if you need to use IP address
3875                 instead of hostname in $DISPLAY])
3876 else
3877         DISPLAY_HACK_MSG="no"
3878         AC_ARG_WITH(ipaddr-display,
3879                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3880                 [
3881                         if test "x$withval" != "xno" ; then
3882                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3883                                 DISPLAY_HACK_MSG="yes"
3884                         fi
3885                 ]
3886         )
3887 fi
3888
3889 # check for /etc/default/login and use it if present.
3890 AC_ARG_ENABLE(etc-default-login,
3891         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3892         [ if test "x$enableval" = "xno"; then
3893                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3894                 etc_default_login=no
3895           else
3896                 etc_default_login=yes
3897           fi ],
3898         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3899           then
3900                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3901                 etc_default_login=no
3902           else
3903                 etc_default_login=yes
3904           fi ]
3905 )
3906
3907 if test "x$etc_default_login" != "xno"; then
3908         AC_CHECK_FILE("/etc/default/login",
3909             [ external_path_file=/etc/default/login ])
3910         if test "x$external_path_file" = "x/etc/default/login"; then
3911                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3912                         [Define if your system has /etc/default/login])
3913         fi
3914 fi
3915
3916 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3917 if test $ac_cv_func_login_getcapbool = "yes" && \
3918         test $ac_cv_header_login_cap_h = "yes" ; then
3919         external_path_file=/etc/login.conf
3920 fi
3921
3922 # Whether to mess with the default path
3923 SERVER_PATH_MSG="(default)"
3924 AC_ARG_WITH(default-path,
3925         [  --with-default-path=    Specify default \$PATH environment for server],
3926         [
3927                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3928                         AC_MSG_WARN([
3929 --with-default-path=PATH has no effect on this system.
3930 Edit /etc/login.conf instead.])
3931                 elif test "x$withval" != "xno" ; then
3932                         if test ! -z "$external_path_file" ; then
3933                                 AC_MSG_WARN([
3934 --with-default-path=PATH will only be used if PATH is not defined in
3935 $external_path_file .])
3936                         fi
3937                         user_path="$withval"
3938                         SERVER_PATH_MSG="$withval"
3939                 fi
3940         ],
3941         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3942                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3943         else
3944                 if test ! -z "$external_path_file" ; then
3945                         AC_MSG_WARN([
3946 If PATH is defined in $external_path_file, ensure the path to scp is included,
3947 otherwise scp will not work.])
3948                 fi
3949                 AC_RUN_IFELSE(
3950                         [AC_LANG_SOURCE([[
3951 /* find out what STDPATH is */
3952 #include <stdio.h>
3953 #ifdef HAVE_PATHS_H
3954 # include <paths.h>
3955 #endif
3956 #ifndef _PATH_STDPATH
3957 # ifdef _PATH_USERPATH  /* Irix */
3958 #  define _PATH_STDPATH _PATH_USERPATH
3959 # else
3960 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3961 # endif
3962 #endif
3963 #include <sys/types.h>
3964 #include <sys/stat.h>
3965 #include <fcntl.h>
3966 #define DATA "conftest.stdpath"
3967
3968 main()
3969 {
3970         FILE *fd;
3971         int rc;
3972
3973         fd = fopen(DATA,"w");
3974         if(fd == NULL)
3975                 exit(1);
3976
3977         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3978                 exit(1);
3979
3980         exit(0);
3981 }
3982                 ]])],
3983                 [ user_path=`cat conftest.stdpath` ],
3984                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3985                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3986         )
3987         fi ]
3988 )
3989 if test "x$external_path_file" != "x/etc/login.conf" ; then
3990         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3991         AC_SUBST(user_path)
3992 fi
3993
3994 # Set superuser path separately to user path
3995 AC_ARG_WITH(superuser-path,
3996         [  --with-superuser-path=  Specify different path for super-user],
3997         [
3998                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3999                     test "x${withval}" != "xyes"; then
4000                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
4001                                 [Define if you want a different $PATH
4002                                 for the superuser])
4003                         superuser_path=$withval
4004                 fi
4005         ]
4006 )
4007
4008
4009 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
4010 IPV4_IN6_HACK_MSG="no"
4011 AC_ARG_WITH(4in6,
4012         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
4013         [
4014                 if test "x$withval" != "xno" ; then
4015                         AC_MSG_RESULT(yes)
4016                         AC_DEFINE(IPV4_IN_IPV6, 1,
4017                                 [Detect IPv4 in IPv6 mapped addresses
4018                                 and treat as IPv4])
4019                         IPV4_IN6_HACK_MSG="yes"
4020                 else
4021                         AC_MSG_RESULT(no)
4022                 fi
4023         ],[
4024                 if test "x$inet6_default_4in6" = "xyes"; then
4025                         AC_MSG_RESULT([yes (default)])
4026                         AC_DEFINE(IPV4_IN_IPV6)
4027                         IPV4_IN6_HACK_MSG="yes"
4028                 else
4029                         AC_MSG_RESULT([no (default)])
4030                 fi
4031         ]
4032 )
4033
4034 # Whether to enable BSD auth support
4035 BSD_AUTH_MSG=no
4036 AC_ARG_WITH(bsd-auth,
4037         [  --with-bsd-auth         Enable BSD auth support],
4038         [
4039                 if test "x$withval" != "xno" ; then
4040                         AC_DEFINE(BSD_AUTH, 1,
4041                                 [Define if you have BSD auth support])
4042                         BSD_AUTH_MSG=yes
4043                 fi
4044         ]
4045 )
4046
4047 # Where to place sshd.pid
4048 piddir=/var/run
4049 # make sure the directory exists
4050 if test ! -d $piddir ; then
4051         piddir=`eval echo ${sysconfdir}`
4052         case $piddir in
4053                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
4054         esac
4055 fi
4056
4057 AC_ARG_WITH(pid-dir,
4058         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
4059         [
4060                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
4061                     test "x${withval}" != "xyes"; then
4062                         piddir=$withval
4063                         if test ! -d $piddir ; then
4064                         AC_MSG_WARN([** no $piddir directory on this system **])
4065                         fi
4066                 fi
4067         ]
4068 )
4069
4070 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
4071 AC_SUBST(piddir)
4072
4073 dnl allow user to disable some login recording features
4074 AC_ARG_ENABLE(lastlog,
4075         [  --disable-lastlog       disable use of lastlog even if detected [no]],
4076         [
4077                 if test "x$enableval" = "xno" ; then
4078                         AC_DEFINE(DISABLE_LASTLOG)
4079                 fi
4080         ]
4081 )
4082 AC_ARG_ENABLE(utmp,
4083         [  --disable-utmp          disable use of utmp even if detected [no]],
4084         [
4085                 if test "x$enableval" = "xno" ; then
4086                         AC_DEFINE(DISABLE_UTMP)
4087                 fi
4088         ]
4089 )
4090 AC_ARG_ENABLE(utmpx,
4091         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4092         [
4093                 if test "x$enableval" = "xno" ; then
4094                         AC_DEFINE(DISABLE_UTMPX, 1,
4095                                 [Define if you don't want to use utmpx])
4096                 fi
4097         ]
4098 )
4099 AC_ARG_ENABLE(wtmp,
4100         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4101         [
4102                 if test "x$enableval" = "xno" ; then
4103                         AC_DEFINE(DISABLE_WTMP)
4104                 fi
4105         ]
4106 )
4107 AC_ARG_ENABLE(wtmpx,
4108         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4109         [
4110                 if test "x$enableval" = "xno" ; then
4111                         AC_DEFINE(DISABLE_WTMPX, 1,
4112                                 [Define if you don't want to use wtmpx])
4113                 fi
4114         ]
4115 )
4116 AC_ARG_ENABLE(libutil,
4117         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4118         [
4119                 if test "x$enableval" = "xno" ; then
4120                         AC_DEFINE(DISABLE_LOGIN)
4121                 fi
4122         ]
4123 )
4124 AC_ARG_ENABLE(pututline,
4125         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4126         [
4127                 if test "x$enableval" = "xno" ; then
4128                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
4129                                 [Define if you don't want to use pututline()
4130                                 etc. to write [uw]tmp])
4131                 fi
4132         ]
4133 )
4134 AC_ARG_ENABLE(pututxline,
4135         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4136         [
4137                 if test "x$enableval" = "xno" ; then
4138                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
4139                                 [Define if you don't want to use pututxline()
4140                                 etc. to write [uw]tmpx])
4141                 fi
4142         ]
4143 )
4144 AC_ARG_WITH(lastlog,
4145   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4146         [
4147                 if test "x$withval" = "xno" ; then
4148                         AC_DEFINE(DISABLE_LASTLOG)
4149                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4150                         conf_lastlog_location=$withval
4151                 fi
4152         ]
4153 )
4154
4155 dnl lastlog, [uw]tmpx? detection
4156 dnl  NOTE: set the paths in the platform section to avoid the
4157 dnl   need for command-line parameters
4158 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4159
4160 dnl lastlog detection
4161 dnl  NOTE: the code itself will detect if lastlog is a directory
4162 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4163 AC_TRY_COMPILE([
4164 #include <sys/types.h>
4165 #include <utmp.h>
4166 #ifdef HAVE_LASTLOG_H
4167 #  include <lastlog.h>
4168 #endif
4169 #ifdef HAVE_PATHS_H
4170 #  include <paths.h>
4171 #endif
4172 #ifdef HAVE_LOGIN_H
4173 # include <login.h>
4174 #endif
4175         ],
4176         [ char *lastlog = LASTLOG_FILE; ],
4177         [ AC_MSG_RESULT(yes) ],
4178         [
4179                 AC_MSG_RESULT(no)
4180                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4181                 AC_TRY_COMPILE([
4182 #include <sys/types.h>
4183 #include <utmp.h>
4184 #ifdef HAVE_LASTLOG_H
4185 #  include <lastlog.h>
4186 #endif
4187 #ifdef HAVE_PATHS_H
4188 #  include <paths.h>
4189 #endif
4190                 ],
4191                 [ char *lastlog = _PATH_LASTLOG; ],
4192                 [ AC_MSG_RESULT(yes) ],
4193                 [
4194                         AC_MSG_RESULT(no)
4195                         system_lastlog_path=no
4196                 ])
4197         ]
4198 )
4199
4200 if test -z "$conf_lastlog_location"; then
4201         if test x"$system_lastlog_path" = x"no" ; then
4202                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
4203                                 if (test -d "$f" || test -f "$f") ; then
4204                                         conf_lastlog_location=$f
4205                                 fi
4206                 done
4207                 if test -z "$conf_lastlog_location"; then
4208                         AC_MSG_WARN([** Cannot find lastlog **])
4209                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4210                 fi
4211         fi
4212 fi
4213
4214 if test -n "$conf_lastlog_location"; then
4215         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
4216                 [Define if you want to specify the path to your lastlog file])
4217 fi
4218
4219 dnl utmp detection
4220 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4221 AC_TRY_COMPILE([
4222 #include <sys/types.h>
4223 #include <utmp.h>
4224 #ifdef HAVE_PATHS_H
4225 #  include <paths.h>
4226 #endif
4227         ],
4228         [ char *utmp = UTMP_FILE; ],
4229         [ AC_MSG_RESULT(yes) ],
4230         [ AC_MSG_RESULT(no)
4231           system_utmp_path=no ]
4232 )
4233 if test -z "$conf_utmp_location"; then
4234         if test x"$system_utmp_path" = x"no" ; then
4235                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
4236                         if test -f $f ; then
4237                                 conf_utmp_location=$f
4238                         fi
4239                 done
4240                 if test -z "$conf_utmp_location"; then
4241                         AC_DEFINE(DISABLE_UTMP)
4242                 fi
4243         fi
4244 fi
4245 if test -n "$conf_utmp_location"; then
4246         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
4247                 [Define if you want to specify the path to your utmp file])
4248 fi
4249
4250 dnl wtmp detection
4251 AC_MSG_CHECKING([if your system defines WTMP_FILE])
4252 AC_TRY_COMPILE([
4253 #include <sys/types.h>
4254 #include <utmp.h>
4255 #ifdef HAVE_PATHS_H
4256 #  include <paths.h>
4257 #endif
4258         ],
4259         [ char *wtmp = WTMP_FILE; ],
4260         [ AC_MSG_RESULT(yes) ],
4261         [ AC_MSG_RESULT(no)
4262           system_wtmp_path=no ]
4263 )
4264 if test -z "$conf_wtmp_location"; then
4265         if test x"$system_wtmp_path" = x"no" ; then
4266                 for f in /usr/adm/wtmp /var/log/wtmp; do
4267                         if test -f $f ; then
4268                                 conf_wtmp_location=$f
4269                         fi
4270                 done
4271                 if test -z "$conf_wtmp_location"; then
4272                         AC_DEFINE(DISABLE_WTMP)
4273                 fi
4274         fi
4275 fi
4276 if test -n "$conf_wtmp_location"; then
4277         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
4278                 [Define if you want to specify the path to your wtmp file])
4279 fi
4280
4281
4282 dnl utmpx detection - I don't know any system so perverse as to require
4283 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
4284 dnl  there, though.
4285 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
4286 AC_TRY_COMPILE([
4287 #include <sys/types.h>
4288 #include <utmp.h>
4289 #ifdef HAVE_UTMPX_H
4290 #include <utmpx.h>
4291 #endif
4292 #ifdef HAVE_PATHS_H
4293 #  include <paths.h>
4294 #endif
4295         ],
4296         [ char *utmpx = UTMPX_FILE; ],
4297         [ AC_MSG_RESULT(yes) ],
4298         [ AC_MSG_RESULT(no)
4299           system_utmpx_path=no ]
4300 )
4301 if test -z "$conf_utmpx_location"; then
4302         if test x"$system_utmpx_path" = x"no" ; then
4303                 AC_DEFINE(DISABLE_UTMPX)
4304         fi
4305 else
4306         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
4307                 [Define if you want to specify the path to your utmpx file])
4308 fi
4309
4310 dnl wtmpx detection
4311 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
4312 AC_TRY_COMPILE([
4313 #include <sys/types.h>
4314 #include <utmp.h>
4315 #ifdef HAVE_UTMPX_H
4316 #include <utmpx.h>
4317 #endif
4318 #ifdef HAVE_PATHS_H
4319 #  include <paths.h>
4320 #endif
4321         ],
4322         [ char *wtmpx = WTMPX_FILE; ],
4323         [ AC_MSG_RESULT(yes) ],
4324         [ AC_MSG_RESULT(no)
4325           system_wtmpx_path=no ]
4326 )
4327 if test -z "$conf_wtmpx_location"; then
4328         if test x"$system_wtmpx_path" = x"no" ; then
4329                 AC_DEFINE(DISABLE_WTMPX)
4330         fi
4331 else
4332         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
4333                 [Define if you want to specify the path to your wtmpx file])
4334 fi
4335
4336
4337 if test ! -z "$blibpath" ; then
4338         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4339         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4340 fi
4341
4342 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4343 dnl Add now.
4344 CFLAGS="$CFLAGS $werror_flags"
4345
4346 if grep "#define BROKEN_GETADDRINFO 1" confdefs.h >/dev/null || \
4347     test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
4348         AC_SUBST(TEST_SSH_IPV6, no)
4349 else
4350         AC_SUBST(TEST_SSH_IPV6, yes)
4351 fi
4352
4353 AC_EXEEXT
4354 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4355         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4356         scard/Makefile ssh_prng_cmds survey.sh])
4357 AC_OUTPUT
4358
4359 # Print summary of options
4360
4361 # Someone please show me a better way :)
4362 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4363 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4364 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4365 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4366 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4367 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4368 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4369 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4370 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4371
4372 echo ""
4373 echo "OpenSSH has been configured with the following options:"
4374 echo "                     User binaries: $B"
4375 echo "                   System binaries: $C"
4376 echo "               Configuration files: $D"
4377 echo "                   Askpass program: $E"
4378 echo "                      Manual pages: $F"
4379 echo "  Privilege separation chroot path: $H"
4380 if test "x$external_path_file" = "x/etc/login.conf" ; then
4381 echo "   At runtime, sshd will use the path defined in $external_path_file"
4382 echo "   Make sure the path to scp is present, otherwise scp will not work"
4383 else
4384 echo "            sshd default user PATH: $I"
4385         if test ! -z "$external_path_file"; then
4386 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4387 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4388         fi
4389 fi
4390 if test ! -z "$superuser_path" ; then
4391 echo "          sshd superuser user PATH: $J"
4392 fi
4393 echo "                    Manpage format: $MANTYPE"
4394 echo "                       PAM support: $PAM_MSG"
4395 echo "                   OSF SIA support: $SIA_MSG"
4396 echo "                 KerberosV support: $KRB5_MSG"
4397 echo "                   SELinux support: $SELINUX_MSG"
4398 echo "                 Smartcard support: $SCARD_MSG"
4399 echo "                     S/KEY support: $SKEY_MSG"
4400 echo "              TCP Wrappers support: $TCPW_MSG"
4401 echo "              MD5 password support: $MD5_MSG"
4402 echo "                   libedit support: $LIBEDIT_MSG"
4403 echo "  Solaris process contract support: $SPC_MSG"
4404 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4405 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4406 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4407 echo "              Random number source: $RAND_MSG"
4408 if test ! -z "$USE_RAND_HELPER" ; then
4409 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4410 fi
4411
4412 echo ""
4413
4414 echo "              Host: ${host}"
4415 echo "          Compiler: ${CC}"
4416 echo "    Compiler flags: ${CFLAGS}"
4417 echo "Preprocessor flags: ${CPPFLAGS}"
4418 echo "      Linker flags: ${LDFLAGS}"
4419 echo "         Libraries: ${LIBS}"
4420 if test ! -z "${SSHDLIBS}"; then
4421 echo "         +for sshd: ${SSHDLIBS}"
4422 fi
4423
4424 echo ""
4425
4426 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4427         echo "SVR4 style packages are supported with \"make package\""
4428         echo ""
4429 fi
4430
4431 if test "x$PAM_MSG" = "xyes" ; then
4432         echo "PAM is enabled. You may need to install a PAM control file "
4433         echo "for sshd, otherwise password authentication may fail. "
4434         echo "Example PAM control files can be found in the contrib/ "
4435         echo "subdirectory"
4436         echo ""
4437 fi
4438
4439 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4440         echo "WARNING: you are using the builtin random number collection "
4441         echo "service. Please read WARNING.RNG and request that your OS "
4442         echo "vendor includes kernel-based random number collection in "
4443         echo "future versions of your OS."
4444         echo ""
4445 fi
4446
4447 if test ! -z "$NO_PEERCHECK" ; then
4448         echo "WARNING: the operating system that you are using does not"
4449         echo "appear to support getpeereid(), getpeerucred() or the"
4450         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
4451         echo "enforce security checks to prevent unauthorised connections to"
4452         echo "ssh-agent. Their absence increases the risk that a malicious"
4453         echo "user can connect to your agent."
4454         echo ""
4455 fi
4456
4457 if test "$AUDIT_MODULE" = "bsm" ; then
4458         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4459         echo "See the Solaris section in README.platform for details."
4460 fi