openssh/configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22
  23 # Handle Globus configuration right away, because the Globus flavor
  24 # determines our compiler options.
  25
  26 # Check whether the user wants GSI (Globus) support
  27 gsi_path="no"
  28 AC_ARG_WITH(gsi,
  29         [  --with-gsi              Enable Globus GSI authentication support],
  30         [
  31                 gsi_path="$withval"
  32         ]
  33 )
  34
  35 AC_ARG_WITH(globus,
  36         [  --with-globus           Enable Globus GSI authentication support],
  37         [
  38                 gsi_path="$withval"
  39         ]
  40 )
  41
  42 AC_ARG_WITH(globus-static,
  43         [  --with-globus-static    Link statically with Globus GSI libraries],
  44         [
  45                 gsi_static="-static"
  46                 if test "x$gsi_path" = "xno" ; then
  47                         gsi_path="$withval"
  48                 fi
  49         ]
  50 )
  51
  52 # Check whether the user has a Globus flavor type
  53 globus_flavor_type="no"
  54 AC_ARG_WITH(globus-flavor,
  55         [  --with-globus-flavor=TYPE  Specify Globus flavor type (ex: gcc32dbg)],
  56         [
  57                 globus_flavor_type="$withval"
  58                 if test "x$gsi_path" = "xno" ; then
  59                         gsi_path="yes"
  60                 fi
  61         ]
  62 )
  63
  64 if test "x$gsi_path" != "xno" ; then
  65         # Globus GSSAPI configuration
  66         AC_MSG_CHECKING(for Globus GSI)
  67         AC_DEFINE(GSI, 1, [Define if you want GSI/Globus authentication support.])
  68
  69         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
  70                 AC_MSG_ERROR([Previously configured GSSAPI library conflicts with Globus GSI.])
  71         fi
  72         if test -z "$GSSAPI"; then
  73                 AC_DEFINE(GSSAPI)
  74                 GSSAPI="GSI"
  75         fi
  76
  77         if test "x$gsi_path" = "xyes" ; then
  78                 if test -z "$GLOBUS_LOCATION" ; then
  79                         AC_MSG_ERROR(GLOBUS_LOCATION environment variable must be set.)
  80                 else
  81                         gsi_path="$GLOBUS_LOCATION"
  82                 fi
  83         fi
  84         GLOBUS_LOCATION="$gsi_path"
  85         export GLOBUS_LOCATION
  86         if test ! -d "$GLOBUS_LOCATION" ; then
  87                 AC_MSG_ERROR(Cannot find Globus installation.  Set GLOBUS_LOCATION environment variable.)
  88         fi
  89
  90         if test "x$globus_flavor_type" = "xno" ; then
  91                 AC_MSG_ERROR(--with-globus-flavor=TYPE must be specified)
  92         fi
  93         if test "x$globus_flavor_type" = "xyes" ; then
  94                 AC_MSG_ERROR(--with-globus-flavor=TYPE must specify a flavor type)
  95         fi
  96
  97         GLOBUS_INCLUDE="${gsi_path}/include/${globus_flavor_type}"
  98         if test ! -d "$GLOBUS_INCLUDE" ; then
  99                 AC_MSG_ERROR(Cannot find Globus flavor-specific include directory: ${GLOBUS_INCLUDE})
 100         fi
 101         GSI_CPPFLAGS="-I${GLOBUS_INCLUDE}"
 102
 103         if test -x ${gsi_path}/bin/globus-makefile-header ; then
 104                 ${gsi_path}/bin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | sed 's/ = \(.*\)/="\1"/' > ./gpt_build_tmp.sh
 105         elif test -x ${gsi_path}/sbin/globus-makefile-header ; then
 106                 ${gsi_path}/sbin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | sed 's/ = \(.*\)/="\1"/' > ./gpt_build_tmp.sh
 107         else
 108                 AC_MSG_ERROR(Cannot find globus-makefile-header: Globus installation is incomplete)
 109         fi
 110         . ./gpt_build_tmp.sh
 111         if test -n "${need_dash_r}"; then
 112                 GSI_LDFLAGS="-L${gsi_path}/lib -R${gsi_path}/lib"
 113         else
 114                 GSI_LDFLAGS="-L${gsi_path}/lib"
 115         fi
 116         if test -z "$GLOBUS_PKG_LIBS" ; then
 117                 AC_MSG_ERROR(globus-makefile-header failed)
 118         fi
 119
 120         if (test -n "$LIBPATH"); then
 121                 blibpath="$LIBPATH"
 122         fi
 123
 124         AC_DEFINE(HAVE_GSSAPI_H)
 125
 126     CC="$GLOBUS_CC"
 127     CFLAGS="$GLOBUS_CFLAGS"
 128     CPP="$GLOBUS_CPP"
 129         CPPFLAGS="$GLOBUS_CPPFLAGS $GLOBUS_INCLUDES"
 130         LIBS="$LIBS $GLOBUS_LIBS $GLOBUS_PKG_LIBS"
 131     LD="$GLOBUS_LD"
 132         LDFLAGS="$LDFLAGS $GLOBUS_LDFLAGS"
 133
 134         # test that we got the libraries OK
 135         AC_TRY_LINK(
 136                 [],
 137                 [],
 138                 [
 139                         AC_MSG_RESULT(yes)
 140                 ],
 141                 [
 142                         AC_MSG_ERROR(link with Globus libraries failed)
 143                 ]
 144         )
 145     AC_CHECK_FUNCS(globus_gss_assist_map_and_authorize)
 146         INSTALL_GSISSH="yes"
 147 else
 148         INSTALL_GSISSH=""
 149 fi
 150 AC_SUBST(INSTALL_GSISSH)
 151 # End Globus/GSI section
 152
 153 AC_PROG_CC
 154 AC_CANONICAL_HOST
 155 AC_C_BIGENDIAN
 156
 157 # Checks for programs.
 158 AC_PROG_AWK
 159 AC_PROG_CPP
 160 AC_PROG_RANLIB
 161 AC_PROG_INSTALL
 162 AC_PROG_EGREP
 163 AC_PATH_PROG(AR, ar)
 164 AC_PATH_PROG(CAT, cat)
 165 AC_PATH_PROG(KILL, kill)
 166 AC_PATH_PROGS(PERL, perl5 perl)
 167 AC_PATH_PROG(SED, sed)
 168 AC_SUBST(PERL)
 169 AC_PATH_PROG(ENT, ent)
 170 AC_SUBST(ENT)
 171 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
 172 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
 173 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
 174 AC_PATH_PROG(SH, sh)
 175 AC_SUBST(TEST_SHELL,sh)
 176
 177 dnl for buildpkg.sh
 178 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
 179         [/usr/sbin${PATH_SEPARATOR}/etc])
 180 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
 181         [/usr/sbin${PATH_SEPARATOR}/etc])
 182 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
 183 if test -x /sbin/sh; then
 184         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
 185 else
 186         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
 187 fi
 188
 189 # System features
 190 AC_SYS_LARGEFILE
 191
 192 if test -z "$AR" ; then
 193         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
 194 fi
 195
 196 # Use LOGIN_PROGRAM from environment if possible
 197 if test ! -z "$LOGIN_PROGRAM" ; then
 198         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
 199                 [If your header files don't define LOGIN_PROGRAM,
 200                 then use this (detected) from environment and PATH])
 201 else
 202         # Search for login
 203         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
 204         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
 205                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
 206         fi
 207 fi
 208
 209 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
 210 if test ! -z "$PATH_PASSWD_PROG" ; then
 211         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
 212                 [Full path of your "passwd" program])
 213 fi
 214
 215 if test -z "$LD" ; then
 216         LD=$CC
 217 fi
 218 AC_SUBST(LD)
 219
 220 AC_C_INLINE
 221
 222 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
 223
 224 use_stack_protector=1
 225 AC_ARG_WITH(stackprotect,
 226     [  --without-stackprotect  Don't use compiler's stack protection], [
 227     if test "x$withval" = "xno"; then
 228         use_stack_protector=0
 229     fi ])
 230
 231 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 232         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
 233         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 234         case $GCC_VER in
 235                 1.*) no_attrib_nonnull=1 ;;
 236                 2.8* | 2.9*)
 237                      CFLAGS="$CFLAGS -Wsign-compare"
 238                      no_attrib_nonnull=1
 239                      ;;
 240                 2.*) no_attrib_nonnull=1 ;;
 241                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 242                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 243                 *) ;;
 244         esac
 245
 246         # -fstack-protector-all doesn't always work for some GCC versions
 247         # and/or platforms, so we test if we can.  If it's not supported
 248         # on a give platform gcc will emit a warning so we use -Werror.
 249         if test "x$use_stack_protector" = "x1"; then
 250             for t in -fstack-protector-all -fstack-protector; do
 251                 AC_MSG_CHECKING(if $CC supports $t)
 252                 saved_CFLAGS="$CFLAGS"
 253                 saved_LDFLAGS="$LDFLAGS"
 254                 CFLAGS="$CFLAGS $t -Werror"
 255                 LDFLAGS="$LDFLAGS $t -Werror"
 256                 AC_LINK_IFELSE(
 257                         [AC_LANG_SOURCE([
 258 #include <stdlib.h>
 259 int main(void){return 0;}
 260                          ])],
 261                     [ AC_MSG_RESULT(yes)
 262                       CFLAGS="$saved_CFLAGS $t"
 263                       LDFLAGS="$saved_LDFLAGS $t"
 264                       AC_MSG_CHECKING(if $t works)
 265                       AC_RUN_IFELSE(
 266                         [AC_LANG_SOURCE([
 267 #include <stdlib.h>
 268 int main(void){exit(0);}
 269                         ])],
 270                         [ AC_MSG_RESULT(yes)
 271                           break ],
 272                         [ AC_MSG_RESULT(no) ],
 273                         [ AC_MSG_WARN([cross compiling: cannot test])
 274                           break ]
 275                       )
 276                     ],
 277                     [ AC_MSG_RESULT(no) ]
 278                 )
 279                 CFLAGS="$saved_CFLAGS"
 280                 LDFLAGS="$saved_LDFLAGS"
 281             done
 282         fi
 283
 284         if test -z "$have_llong_max"; then
 285                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 286                 unset ac_cv_have_decl_LLONG_MAX
 287                 saved_CFLAGS="$CFLAGS"
 288                 CFLAGS="$CFLAGS -std=gnu99"
 289                 AC_CHECK_DECL(LLONG_MAX,
 290                     [have_llong_max=1],
 291                     [CFLAGS="$saved_CFLAGS"],
 292                     [#include <limits.h>]
 293                 )
 294         fi
 295 fi
 296
 297 if test "x$no_attrib_nonnull" != "x1" ; then
 298         AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
 299 fi
 300
 301 AC_ARG_WITH(rpath,
 302         [  --without-rpath         Disable auto-added -R linker paths],
 303         [
 304                 if test "x$withval" = "xno" ; then
 305                         need_dash_r=""
 306                 fi
 307                 if test "x$withval" = "xyes" ; then
 308                         need_dash_r=1
 309                 fi
 310         ]
 311 )
 312
 313 # Allow user to specify flags
 314 AC_ARG_WITH(cflags,
 315         [  --with-cflags           Specify additional flags to pass to compiler],
 316         [
 317                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 318                     test "x${withval}" != "xyes"; then
 319                         CFLAGS="$CFLAGS $withval"
 320                 fi
 321         ]
 322 )
 323 AC_ARG_WITH(cppflags,
 324         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 325         [
 326                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 327                     test "x${withval}" != "xyes"; then
 328                         CPPFLAGS="$CPPFLAGS $withval"
 329                 fi
 330         ]
 331 )
 332 AC_ARG_WITH(ldflags,
 333         [  --with-ldflags          Specify additional flags to pass to linker],
 334         [
 335                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 336                     test "x${withval}" != "xyes"; then
 337                         LDFLAGS="$LDFLAGS $withval"
 338                 fi
 339         ]
 340 )
 341 AC_ARG_WITH(libs,
 342         [  --with-libs             Specify additional libraries to link with],
 343         [
 344                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 345                     test "x${withval}" != "xyes"; then
 346                         LIBS="$LIBS $withval"
 347                 fi
 348         ]
 349 )
 350 AC_ARG_WITH(Werror,
 351         [  --with-Werror           Build main code with -Werror],
 352         [
 353                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 354                         werror_flags="-Werror"
 355                         if test "x${withval}" != "xyes"; then
 356                                 werror_flags="$withval"
 357                         fi
 358                 fi
 359         ]
 360 )
 361
 362 AC_CHECK_HEADERS( \
 363         bstring.h \
 364         crypt.h \
 365         crypto/sha2.h \
 366         dirent.h \
 367         endian.h \
 368         features.h \
 369         fcntl.h \
 370         floatingpoint.h \
 371         getopt.h \
 372         glob.h \
 373         ia.h \
 374         iaf.h \
 375         limits.h \
 376         login.h \
 377         maillock.h \
 378         ndir.h \
 379         net/if_tun.h \
 380         netdb.h \
 381         netgroup.h \
 382         pam/pam_appl.h \
 383         paths.h \
 384         poll.h \
 385         pty.h \
 386         readpassphrase.h \
 387         rpc/types.h \
 388         security/pam_appl.h \
 389         sha2.h \
 390         shadow.h \
 391         stddef.h \
 392         stdint.h \
 393         string.h \
 394         strings.h \
 395         sys/audit.h \
 396         sys/bitypes.h \
 397         sys/bsdtty.h \
 398         sys/cdefs.h \
 399         sys/dir.h \
 400         sys/mman.h \
 401         sys/ndir.h \
 402         sys/poll.h \
 403         sys/prctl.h \
 404         sys/pstat.h \
 405         sys/select.h \
 406         sys/stat.h \
 407         sys/stream.h \
 408         sys/stropts.h \
 409         sys/strtio.h \
 410         sys/sysmacros.h \
 411         sys/time.h \
 412         sys/timers.h \
 413         sys/un.h \
 414         time.h \
 415         tmpdir.h \
 416         ttyent.h \
 417         ucred.h \
 418         unistd.h \
 419         usersec.h \
 420         util.h \
 421         utime.h \
 422         utmp.h \
 423         utmpx.h \
 424         vis.h \
 425 )
 426
 427 # lastlog.h requires sys/time.h to be included first on Solaris
 428 AC_CHECK_HEADERS(lastlog.h, [], [], [
 429 #ifdef HAVE_SYS_TIME_H
 430 # include <sys/time.h>
 431 #endif
 432 ])
 433
 434 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 435 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 436 #ifdef HAVE_SYS_STREAM_H
 437 # include <sys/stream.h>
 438 #endif
 439 ])
 440
 441 # login_cap.h requires sys/types.h on NetBSD
 442 AC_CHECK_HEADERS(login_cap.h, [], [], [
 443 #include <sys/types.h>
 444 ])
 445
 446 # Messages for features tested for in target-specific section
 447 SIA_MSG="no"
 448 SPC_MSG="no"
 449
 450 # Check for some target-specific stuff
 451 case "$host" in
 452 *-*-aix*)
 453         # Some versions of VAC won't allow macro redefinitions at
 454         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 455         # particularly with older versions of vac or xlc.
 456         # It also throws errors about null macro argments, but these are
 457         # not fatal.
 458         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 459         AC_COMPILE_IFELSE(
 460             [AC_LANG_SOURCE([[
 461 #define testmacro foo
 462 #define testmacro bar
 463 int main(void) { exit(0); }
 464             ]])],
 465             [ AC_MSG_RESULT(yes) ],
 466             [ AC_MSG_RESULT(no)
 467               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 468               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 469               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 470               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 471             ]
 472         )
 473
 474         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 475         if (test -z "$blibpath"); then
 476                 blibpath="/usr/lib:/lib"
 477         fi
 478         saved_LDFLAGS="$LDFLAGS"
 479         if test "$GCC" = "yes"; then
 480                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 481         else
 482                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 483         fi
 484         for tryflags in $flags ;do
 485                 if (test -z "$blibflags"); then
 486                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 487                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 488                 fi
 489         done
 490         if (test -z "$blibflags"); then
 491                 AC_MSG_RESULT(not found)
 492                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 493         else
 494                 AC_MSG_RESULT($blibflags)
 495         fi
 496         LDFLAGS="$saved_LDFLAGS"
 497         dnl Check for authenticate.  Might be in libs.a on older AIXes
 498         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 499                 [Define if you want to enable AIX4's authenticate function])],
 500                 [AC_CHECK_LIB(s,authenticate,
 501                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 502                                 LIBS="$LIBS -ls"
 503                         ])
 504                 ])
 505         dnl Check for various auth function declarations in headers.
 506         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 507             passwdexpired, setauthdb], , , [#include <usersec.h>])
 508         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 509         AC_CHECK_DECLS(loginfailed,
 510                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 511                   AC_TRY_COMPILE(
 512                         [#include <usersec.h>],
 513                         [(void)loginfailed("user","host","tty",0);],
 514                         [AC_MSG_RESULT(yes)
 515                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 516                                 [Define if your AIX loginfailed() function
 517                                 takes 4 arguments (AIX >= 5.2)])],
 518                         [AC_MSG_RESULT(no)]
 519                 )],
 520                 [],
 521                 [#include <usersec.h>]
 522         )
 523         AC_CHECK_FUNCS(getgrset setauthdb)
 524         AC_CHECK_DECL(F_CLOSEM,
 525             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 526             [],
 527             [ #include <limits.h>
 528               #include <fcntl.h> ]
 529         )
 530         check_for_aix_broken_getaddrinfo=1
 531         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 532         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 533             [Define if your platform breaks doing a seteuid before a setuid])
 534         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 535         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 536         dnl AIX handles lastlog as part of its login message
 537         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 538         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 539                 [Some systems need a utmpx entry for /bin/login to work])
 540         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 541                 [Define to a Set Process Title type if your system is
 542                 supported by bsd-setproctitle.c])
 543         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 544             [AIX 5.2 and 5.3 (and presumably newer) require this])
 545         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 546         ;;
 547 *-*-cygwin*)
 548         check_for_libcrypt_later=1
 549         LIBS="$LIBS /usr/lib/textreadmode.o"
 550         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 551         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 552         AC_DEFINE(DISABLE_SHADOW, 1,
 553                 [Define if you want to disable shadow passwords])
 554         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 555                 [Define if your system choked on IP TOS setting])
 556         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 557                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 558         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 559                 [Define if the concept of ports only accessible to
 560                 superusers isn't known])
 561         AC_DEFINE(DISABLE_FD_PASSING, 1,
 562                 [Define if your platform needs to skip post auth
 563                 file descriptor passing])
 564         ;;
 565 *-*-dgux*)
 566         AC_DEFINE(IP_TOS_IS_BROKEN)
 567         AC_DEFINE(SETEUID_BREAKS_SETUID)
 568         AC_DEFINE(BROKEN_SETREUID)
 569         AC_DEFINE(BROKEN_SETREGID)
 570         ;;
 571 *-*-darwin*)
 572         AC_DEFINE(BROKEN_GETADDRINFO, 1, [Define if getaddrinfo is broken)])
 573         AC_DEFINE(BROKEN_GETADDRINFO)
 574         AC_DEFINE(SETEUID_BREAKS_SETUID)
 575         AC_DEFINE(BROKEN_SETREUID)
 576         AC_DEFINE(BROKEN_SETREGID)
 577         AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
 578         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 579                 [Define if your resolver libs need this for getrrsetbyname])
 580         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 581         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 582             [Use tunnel device compatibility to OpenBSD])
 583         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 584             [Prepend the address family to IP tunnel traffic])
 585         m4_pattern_allow(AU_IPv)
 586         AC_CHECK_DECL(AU_IPv4, [],
 587             AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
 588             [#include <bsm/audit.h>]
 589         )
 590         AC_MSG_CHECKING(if we have the Security Authorization Session API)
 591         AC_TRY_COMPILE([#include <Security/AuthSession.h>],
 592                 [SessionCreate(0, 0);],
 593                 [ac_cv_use_security_session_api="yes"
 594                  AC_DEFINE(USE_SECURITY_SESSION_API, 1,
 595                         [platform has the Security Authorization Session API])
 596                  LIBS="$LIBS -framework Security"
 597                  AC_MSG_RESULT(yes)],
 598                 [ac_cv_use_security_session_api="no"
 599                  AC_MSG_RESULT(no)])
 600         AC_MSG_CHECKING(if we have an in-memory credentials cache)
 601         AC_TRY_COMPILE(
 602                 [#include <Kerberos/Kerberos.h>],
 603                 [cc_context_t c;
 604                  (void) cc_initialize (&c, 0, NULL, NULL);],
 605                 [AC_DEFINE(USE_CCAPI, 1,
 606                         [platform uses an in-memory credentials cache])
 607                  LIBS="$LIBS -framework Security"
 608                  AC_MSG_RESULT(yes)
 609                  if test "x$ac_cv_use_security_session_api" = "xno"; then
 610                         AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
 611                 fi],
 612                 [AC_MSG_RESULT(no)]
 613         )
 614         ;;
 615 *-*-dragonfly*)
 616         SSHDLIBS="$SSHDLIBS -lcrypt"
 617         ;;
 618 *-*-hpux*)
 619         # first we define all of the options common to all HP-UX releases
 620         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 621         IPADDR_IN_DISPLAY=yes
 622         AC_DEFINE(USE_PIPES)
 623         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 624             [Define if your login program cannot handle end of options ("--")])
 625         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 626         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 627                 [String used in /etc/passwd to denote locked account])
 628         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 629         MAIL="/var/mail/username"
 630         LIBS="$LIBS -lsec"
 631         AC_CHECK_LIB(xnet, t_error, ,
 632             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 633
 634         # next, we define all of the options specific to major releases
 635         case "$host" in
 636         *-*-hpux10*)
 637                 if test -z "$GCC"; then
 638                         CFLAGS="$CFLAGS -Ae"
 639                 fi
 640                 ;;
 641         *-*-hpux11*)
 642                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 643                         [Define if you are using Solaris-derived PAM which
 644                         passes pam_messages to the conversation function
 645                         with an extra level of indirection])
 646                 AC_DEFINE(DISABLE_UTMP, 1,
 647                         [Define if you don't want to use utmp])
 648                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 649                 check_for_hpux_broken_getaddrinfo=1
 650                 check_for_conflicting_getspnam=1
 651                 ;;
 652         esac
 653
 654         # lastly, we define options specific to minor releases
 655         case "$host" in
 656         *-*-hpux10.26)
 657                 AC_DEFINE(HAVE_SECUREWARE, 1,
 658                         [Define if you have SecureWare-based
 659                         protected password database])
 660                 disable_ptmx_check=yes
 661                 LIBS="$LIBS -lsecpw"
 662                 ;;
 663         esac
 664         ;;
 665 *-*-irix5*)
 666         PATH="$PATH:/usr/etc"
 667         AC_DEFINE(BROKEN_INET_NTOA, 1,
 668                 [Define if you system's inet_ntoa is busted
 669                 (e.g. Irix gcc issue)])
 670         AC_DEFINE(SETEUID_BREAKS_SETUID)
 671         AC_DEFINE(BROKEN_SETREUID)
 672         AC_DEFINE(BROKEN_SETREGID)
 673         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 674                 [Define if you shouldn't strip 'tty' from your
 675                 ttyname in [uw]tmp])
 676         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 677         ;;
 678 *-*-irix6*)
 679         PATH="$PATH:/usr/etc"
 680         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 681                 [Define if you have/want arrays
 682                 (cluster-wide session managment, not C arrays)])
 683         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 684                 [Define if you want IRIX project management])
 685         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 686                 [Define if you want IRIX audit trails])
 687         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 688                 [Define if you want IRIX kernel jobs])])
 689         AC_DEFINE(BROKEN_INET_NTOA)
 690         AC_DEFINE(SETEUID_BREAKS_SETUID)
 691         AC_DEFINE(BROKEN_SETREUID)
 692         AC_DEFINE(BROKEN_SETREGID)
 693         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 694         AC_DEFINE(WITH_ABBREV_NO_TTY)
 695         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 696         ;;
 697 *-*-linux*)
 698         no_dev_ptmx=1
 699         check_for_libcrypt_later=1
 700         check_for_openpty_ctty_bug=1
 701         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 702         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 703                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 704         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 705                 [String used in /etc/passwd to denote locked account])
 706         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 707         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 708                 [Define to whatever link() returns for "not supported"
 709                 if it doesn't return EOPNOTSUPP.])
 710         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 711         AC_DEFINE(USE_BTMP)
 712         inet6_default_4in6=yes
 713         case `uname -r` in
 714         1.*|2.0.*)
 715                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 716                         [Define if cmsg_type is not passed correctly])
 717                 ;;
 718         esac
 719         # tun(4) forwarding compat code
 720         AC_CHECK_HEADERS(linux/if_tun.h)
 721         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 722                 AC_DEFINE(SSH_TUN_LINUX, 1,
 723                     [Open tunnel devices the Linux tun/tap way])
 724                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 725                     [Use tunnel device compatibility to OpenBSD])
 726                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 727                     [Prepend the address family to IP tunnel traffic])
 728         fi
 729         ;;
 730 mips-sony-bsd|mips-sony-newsos4)
 731         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 732         SONY=1
 733         ;;
 734 *-*-netbsd*)
 735         check_for_libcrypt_before=1
 736         if test "x$withval" != "xno" ; then
 737                 need_dash_r=1
 738         fi
 739         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 740         AC_CHECK_HEADER([net/if_tap.h], ,
 741             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 742         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 743             [Prepend the address family to IP tunnel traffic])
 744         ;;
 745 *-*-freebsd*)
 746         check_for_libcrypt_later=1
 747         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 748         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 749         AC_CHECK_HEADER([net/if_tap.h], ,
 750             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 751         AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need])
 752         ;;
 753 *-*-bsdi*)
 754         AC_DEFINE(SETEUID_BREAKS_SETUID)
 755         AC_DEFINE(BROKEN_SETREUID)
 756         AC_DEFINE(BROKEN_SETREGID)
 757         ;;
 758 *-next-*)
 759         conf_lastlog_location="/usr/adm/lastlog"
 760         conf_utmp_location=/etc/utmp
 761         conf_wtmp_location=/usr/adm/wtmp
 762         MAIL=/usr/spool/mail
 763         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 764         AC_DEFINE(BROKEN_REALPATH)
 765         AC_DEFINE(USE_PIPES)
 766         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 767         ;;
 768 *-*-openbsd*)
 769         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 770         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 771         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 772         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 773             [syslog_r function is safe to use in in a signal handler])
 774         ;;
 775 *-*-solaris*)
 776         if test "x$withval" != "xno" ; then
 777                 need_dash_r=1
 778         fi
 779         AC_DEFINE(PAM_SUN_CODEBASE)
 780         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 781         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 782                 [Some versions of /bin/login need the TERM supplied
 783                 on the commandline])
 784         AC_DEFINE(PAM_TTY_KLUDGE)
 785         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 786                 [Define if pam_chauthtok wants real uid set
 787                 to the unpriv'ed user])
 788         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 789         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 790         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 791                 [Define if sshd somehow reacquires a controlling TTY
 792                 after setsid()])
 793         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 794                 in case the name is longer than 8 chars])
 795         external_path_file=/etc/default/login
 796         # hardwire lastlog location (can't detect it on some versions)
 797         conf_lastlog_location="/var/adm/lastlog"
 798         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 799         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 800         if test "$sol2ver" -ge 8; then
 801                 AC_MSG_RESULT(yes)
 802                 AC_DEFINE(DISABLE_UTMP)
 803                 AC_DEFINE(DISABLE_WTMP, 1,
 804                         [Define if you don't want to use wtmp])
 805         else
 806                 AC_MSG_RESULT(no)
 807         fi
 808         AC_ARG_WITH(solaris-contracts,
 809                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 810                 [
 811                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 812                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 813                                 [Define if you have Solaris process contracts])
 814                           SSHDLIBS="$SSHDLIBS -lcontract"
 815                           AC_SUBST(SSHDLIBS)
 816                           SPC_MSG="yes" ], )
 817                 ],
 818         )
 819         ;;
 820 *-*-sunos4*)
 821         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 822         AC_CHECK_FUNCS(getpwanam)
 823         AC_DEFINE(PAM_SUN_CODEBASE)
 824         conf_utmp_location=/etc/utmp
 825         conf_wtmp_location=/var/adm/wtmp
 826         conf_lastlog_location=/var/adm/lastlog
 827         AC_DEFINE(USE_PIPES)
 828         ;;
 829 *-ncr-sysv*)
 830         LIBS="$LIBS -lc89"
 831         AC_DEFINE(USE_PIPES)
 832         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 833         AC_DEFINE(SETEUID_BREAKS_SETUID)
 834         AC_DEFINE(BROKEN_SETREUID)
 835         AC_DEFINE(BROKEN_SETREGID)
 836         ;;
 837 *-sni-sysv*)
 838         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 839         AC_CHECK_LIB(dl, dlsym, ,)
 840         # -lresolv needs to be at the end of LIBS or DNS lookups break
 841         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 842         IPADDR_IN_DISPLAY=yes
 843         AC_DEFINE(USE_PIPES)
 844         AC_DEFINE(IP_TOS_IS_BROKEN)
 845         AC_DEFINE(SETEUID_BREAKS_SETUID)
 846         AC_DEFINE(BROKEN_SETREUID)
 847         AC_DEFINE(BROKEN_SETREGID)
 848         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 849         external_path_file=/etc/default/login
 850         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 851         # Attention: always take care to bind libsocket and libnsl before libc,
 852         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 853         ;;
 854 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 855 *-*-sysv4.2*)
 856         AC_DEFINE(USE_PIPES)
 857         AC_DEFINE(SETEUID_BREAKS_SETUID)
 858         AC_DEFINE(BROKEN_SETREUID)
 859         AC_DEFINE(BROKEN_SETREGID)
 860         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 861         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 862         ;;
 863 # UnixWare 7.x, OpenUNIX 8
 864 *-*-sysv5*)
 865         check_for_libcrypt_later=1
 866         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 867         AC_DEFINE(USE_PIPES)
 868         AC_DEFINE(SETEUID_BREAKS_SETUID)
 869         AC_DEFINE(BROKEN_SETREUID)
 870         AC_DEFINE(BROKEN_SETREGID)
 871         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 872         case "$host" in
 873         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 874                 TEST_SHELL=/u95/bin/sh
 875                 AC_DEFINE(BROKEN_LIBIAF, 1,
 876                         [ia_uinfo routines not supported by OS yet])
 877                 AC_DEFINE(BROKEN_UPDWTMPX)
 878                 ;;
 879         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 880                 ;;
 881         esac
 882         ;;
 883 *-*-sysv*)
 884         ;;
 885 # SCO UNIX and OEM versions of SCO UNIX
 886 *-*-sco3.2v4*)
 887         AC_MSG_ERROR("This Platform is no longer supported.")
 888         ;;
 889 # SCO OpenServer 5.x
 890 *-*-sco3.2v5*)
 891         if test -z "$GCC"; then
 892                 CFLAGS="$CFLAGS -belf"
 893         fi
 894         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 895         no_dev_ptmx=1
 896         AC_DEFINE(USE_PIPES)
 897         AC_DEFINE(HAVE_SECUREWARE)
 898         AC_DEFINE(DISABLE_SHADOW)
 899         AC_DEFINE(DISABLE_FD_PASSING)
 900         AC_DEFINE(SETEUID_BREAKS_SETUID)
 901         AC_DEFINE(BROKEN_SETREUID)
 902         AC_DEFINE(BROKEN_SETREGID)
 903         AC_DEFINE(WITH_ABBREV_NO_TTY)
 904         AC_DEFINE(BROKEN_UPDWTMPX)
 905         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 906         AC_CHECK_FUNCS(getluid setluid)
 907         MANTYPE=man
 908         TEST_SHELL=ksh
 909         ;;
 910 *-*-unicosmk*)
 911         AC_DEFINE(NO_SSH_LASTLOG, 1,
 912                 [Define if you don't want to use lastlog in session.c])
 913         AC_DEFINE(SETEUID_BREAKS_SETUID)
 914         AC_DEFINE(BROKEN_SETREUID)
 915         AC_DEFINE(BROKEN_SETREGID)
 916         AC_DEFINE(USE_PIPES)
 917         AC_DEFINE(DISABLE_FD_PASSING)
 918         LDFLAGS="$LDFLAGS"
 919         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 920         MANTYPE=cat
 921         ;;
 922 *-*-unicosmp*)
 923         AC_DEFINE(SETEUID_BREAKS_SETUID)
 924         AC_DEFINE(BROKEN_SETREUID)
 925         AC_DEFINE(BROKEN_SETREGID)
 926         AC_DEFINE(WITH_ABBREV_NO_TTY)
 927         AC_DEFINE(USE_PIPES)
 928         AC_DEFINE(DISABLE_FD_PASSING)
 929         LDFLAGS="$LDFLAGS"
 930         LIBS="$LIBS -lgen -lacid -ldb"
 931         MANTYPE=cat
 932         ;;
 933 *-*-unicos*)
 934         AC_DEFINE(SETEUID_BREAKS_SETUID)
 935         AC_DEFINE(BROKEN_SETREUID)
 936         AC_DEFINE(BROKEN_SETREGID)
 937         AC_DEFINE(USE_PIPES)
 938         AC_DEFINE(DISABLE_FD_PASSING)
 939         AC_DEFINE(NO_SSH_LASTLOG)
 940         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 941         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 942         MANTYPE=cat
 943         ;;
 944 *-dec-osf*)
 945         AC_MSG_CHECKING(for Digital Unix SIA)
 946         no_osfsia=""
 947         AC_ARG_WITH(osfsia,
 948                 [  --with-osfsia           Enable Digital Unix SIA],
 949                 [
 950                         if test "x$withval" = "xno" ; then
 951                                 AC_MSG_RESULT(disabled)
 952                                 no_osfsia=1
 953                         fi
 954                 ],
 955         )
 956         if test -z "$no_osfsia" ; then
 957                 if test -f /etc/sia/matrix.conf; then
 958                         AC_MSG_RESULT(yes)
 959                         AC_DEFINE(HAVE_OSF_SIA, 1,
 960                                 [Define if you have Digital Unix Security
 961                                 Integration Architecture])
 962                         AC_DEFINE(DISABLE_LOGIN, 1,
 963                                 [Define if you don't want to use your
 964                                 system's login() call])
 965                         AC_DEFINE(DISABLE_FD_PASSING)
 966                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 967                         SIA_MSG="yes"
 968                 else
 969                         AC_MSG_RESULT(no)
 970                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 971                           [String used in /etc/passwd to denote locked account])
 972                 fi
 973         fi
 974         AC_DEFINE(BROKEN_GETADDRINFO)
 975         AC_DEFINE(SETEUID_BREAKS_SETUID)
 976         AC_DEFINE(BROKEN_SETREUID)
 977         AC_DEFINE(BROKEN_SETREGID)
 978         ;;
 979
 980 *-*-nto-qnx*)
 981         AC_DEFINE(USE_PIPES)
 982         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 983         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 984         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 985         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 986         AC_DEFINE(DISABLE_LASTLOG)
 987         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 988         AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
 989         enable_etc_default_login=no     # has incompatible /etc/default/login
 990         case "$host" in
 991         *-*-nto-qnx6*)
 992                 AC_DEFINE(DISABLE_FD_PASSING)
 993                 ;;
 994         esac
 995         ;;
 996
 997 *-*-ultrix*)
 998         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 999         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
1000         AC_DEFINE(NEED_SETPGRP)
1001         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
1002         ;;
1003
1004 *-*-lynxos)
1005         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
1006         AC_DEFINE(MISSING_HOWMANY)
1007         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
1008         ;;
1009 esac
1010
1011 AC_MSG_CHECKING(compiler and flags for sanity)
1012 AC_RUN_IFELSE(
1013         [AC_LANG_SOURCE([
1014 #include <stdio.h>
1015 int main(){exit(0);}
1016         ])],
1017         [       AC_MSG_RESULT(yes) ],
1018         [
1019                 AC_MSG_RESULT(no)
1020                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
1021         ],
1022         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
1023 )
1024
1025 dnl Checks for header files.
1026 # Checks for libraries.
1027 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
1028 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
1029
1030 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
1031 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
1032         AC_CHECK_LIB(gen, dirname,[
1033                 AC_CACHE_CHECK([for broken dirname],
1034                         ac_cv_have_broken_dirname, [
1035                         save_LIBS="$LIBS"
1036                         LIBS="$LIBS -lgen"
1037                         AC_RUN_IFELSE(
1038                                 [AC_LANG_SOURCE([[
1039 #include <libgen.h>
1040 #include <string.h>
1041
1042 int main(int argc, char **argv) {
1043     char *s, buf[32];
1044
1045     strncpy(buf,"/etc", 32);
1046     s = dirname(buf);
1047     if (!s || strncmp(s, "/", 32) != 0) {
1048         exit(1);
1049     } else {
1050         exit(0);
1051     }
1052 }
1053                                 ]])],
1054                                 [ ac_cv_have_broken_dirname="no" ],
1055                                 [ ac_cv_have_broken_dirname="yes" ],
1056                                 [ ac_cv_have_broken_dirname="no" ],
1057                         )
1058                         LIBS="$save_LIBS"
1059                 ])
1060                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
1061                         LIBS="$LIBS -lgen"
1062                         AC_DEFINE(HAVE_DIRNAME)
1063                         AC_CHECK_HEADERS(libgen.h)
1064                 fi
1065         ])
1066 ])
1067
1068 AC_CHECK_FUNC(getspnam, ,
1069         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
1070 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
1071         [Define if you have the basename function.]))
1072
1073 dnl zlib is required
1074 AC_ARG_WITH(zlib,
1075         [  --with-zlib=PATH        Use zlib in PATH],
1076         [ if test "x$withval" = "xno" ; then
1077                 AC_MSG_ERROR([*** zlib is required ***])
1078           elif test "x$withval" != "xyes"; then
1079                 if test -d "$withval/lib"; then
1080                         if test -n "${need_dash_r}"; then
1081                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1082                         else
1083                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1084                         fi
1085                 else
1086                         if test -n "${need_dash_r}"; then
1087                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1088                         else
1089                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1090                         fi
1091                 fi
1092                 if test -d "$withval/include"; then
1093                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1094                 else
1095                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1096                 fi
1097         fi ]
1098 )
1099
1100 AC_CHECK_LIB(z, deflate, ,
1101         [
1102                 saved_CPPFLAGS="$CPPFLAGS"
1103                 saved_LDFLAGS="$LDFLAGS"
1104                 save_LIBS="$LIBS"
1105                 dnl Check default zlib install dir
1106                 if test -n "${need_dash_r}"; then
1107                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
1108                 else
1109                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
1110                 fi
1111                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
1112                 LIBS="$LIBS -lz"
1113                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
1114                         [
1115                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1116                         ]
1117                 )
1118         ]
1119 )
1120 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
1121
1122 AC_ARG_WITH(zlib-version-check,
1123         [  --without-zlib-version-check Disable zlib version check],
1124         [  if test "x$withval" = "xno" ; then
1125                 zlib_check_nonfatal=1
1126            fi
1127         ]
1128 )
1129
1130 AC_MSG_CHECKING(for possibly buggy zlib)
1131 AC_RUN_IFELSE([AC_LANG_SOURCE([[
1132 #include <stdio.h>
1133 #include <zlib.h>
1134 int main()
1135 {
1136         int a=0, b=0, c=0, d=0, n, v;
1137         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1138         if (n != 3 && n != 4)
1139                 exit(1);
1140         v = a*1000000 + b*10000 + c*100 + d;
1141         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1142
1143         /* 1.1.4 is OK */
1144         if (a == 1 && b == 1 && c >= 4)
1145                 exit(0);
1146
1147         /* 1.2.3 and up are OK */
1148         if (v >= 1020300)
1149                 exit(0);
1150
1151         exit(2);
1152 }
1153         ]])],
1154         AC_MSG_RESULT(no),
1155         [ AC_MSG_RESULT(yes)
1156           if test -z "$zlib_check_nonfatal" ; then
1157                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1158 Your reported zlib version has known security problems.  It's possible your
1159 vendor has fixed these problems without changing the version number.  If you
1160 are sure this is the case, you can disable the check by running
1161 "./configure --without-zlib-version-check".
1162 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1163 See http://www.gzip.org/zlib/ for details.])
1164           else
1165                 AC_MSG_WARN([zlib version may have security problems])
1166           fi
1167         ],
1168         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1169 )
1170
1171 dnl UnixWare 2.x
1172 AC_CHECK_FUNC(strcasecmp,
1173         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
1174 )
1175 AC_CHECK_FUNCS(utimes,
1176         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
1177                                         LIBS="$LIBS -lc89"]) ]
1178 )
1179
1180 dnl    Checks for libutil functions
1181 AC_CHECK_HEADERS(libutil.h)
1182 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
1183         [Define if your libraries define login()])])
1184 AC_CHECK_FUNCS(logout updwtmp logwtmp)
1185
1186 AC_FUNC_STRFTIME
1187
1188 # Check for ALTDIRFUNC glob() extension
1189 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
1190 AC_EGREP_CPP(FOUNDIT,
1191         [
1192                 #include <glob.h>
1193                 #ifdef GLOB_ALTDIRFUNC
1194                 FOUNDIT
1195                 #endif
1196         ],
1197         [
1198                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
1199                         [Define if your system glob() function has
1200                         the GLOB_ALTDIRFUNC extension])
1201                 AC_MSG_RESULT(yes)
1202         ],
1203         [
1204                 AC_MSG_RESULT(no)
1205         ]
1206 )
1207
1208 # Check for g.gl_matchc glob() extension
1209 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1210 AC_TRY_COMPILE(
1211         [ #include <glob.h> ],
1212         [glob_t g; g.gl_matchc = 1;],
1213         [
1214                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1215                         [Define if your system glob() function has
1216                         gl_matchc options in glob_t])
1217                 AC_MSG_RESULT(yes)
1218         ],
1219         [
1220                 AC_MSG_RESULT(no)
1221         ]
1222 )
1223
1224 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1225
1226 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1227 AC_RUN_IFELSE(
1228         [AC_LANG_SOURCE([[
1229 #include <sys/types.h>
1230 #include <dirent.h>
1231 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1232         ]])],
1233         [AC_MSG_RESULT(yes)],
1234         [
1235                 AC_MSG_RESULT(no)
1236                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1237                         [Define if your struct dirent expects you to
1238                         allocate extra space for d_name])
1239         ],
1240         [
1241                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1242                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1243         ]
1244 )
1245
1246 AC_MSG_CHECKING([for /proc/pid/fd directory])
1247 if test -d "/proc/$$/fd" ; then
1248         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1249         AC_MSG_RESULT(yes)
1250 else
1251         AC_MSG_RESULT(no)
1252 fi
1253
1254 # Check whether user wants S/Key support
1255 SKEY_MSG="no"
1256 AC_ARG_WITH(skey,
1257         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1258         [
1259                 if test "x$withval" != "xno" ; then
1260
1261                         if test "x$withval" != "xyes" ; then
1262                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1263                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1264                         fi
1265
1266                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1267                         LIBS="-lskey $LIBS"
1268                         SKEY_MSG="yes"
1269
1270                         AC_MSG_CHECKING([for s/key support])
1271                         AC_LINK_IFELSE(
1272                                 [AC_LANG_SOURCE([[
1273 #include <stdio.h>
1274 #include <skey.h>
1275 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1276                                 ]])],
1277                                 [AC_MSG_RESULT(yes)],
1278                                 [
1279                                         AC_MSG_RESULT(no)
1280                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1281                                 ])
1282                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1283                         AC_TRY_COMPILE(
1284                                 [#include <stdio.h>
1285                                  #include <skey.h>],
1286                                 [(void)skeychallenge(NULL,"name","",0);],
1287                                 [AC_MSG_RESULT(yes)
1288                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1289                                         [Define if your skeychallenge()
1290                                         function takes 4 arguments (NetBSD)])],
1291                                 [AC_MSG_RESULT(no)]
1292                         )
1293                 fi
1294         ]
1295 )
1296
1297 # Check whether user wants TCP wrappers support
1298 TCPW_MSG="no"
1299 AC_ARG_WITH(tcp-wrappers,
1300         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1301         [
1302                 if test "x$withval" != "xno" ; then
1303                         saved_LIBS="$LIBS"
1304                         saved_LDFLAGS="$LDFLAGS"
1305                         saved_CPPFLAGS="$CPPFLAGS"
1306                         if test -n "${withval}" && \
1307                             test "x${withval}" != "xyes"; then
1308                                 if test -d "${withval}/lib"; then
1309                                         if test -n "${need_dash_r}"; then
1310                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1311                                         else
1312                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1313                                         fi
1314                                 else
1315                                         if test -n "${need_dash_r}"; then
1316                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1317                                         else
1318                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1319                                         fi
1320                                 fi
1321                                 if test -d "${withval}/include"; then
1322                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1323                                 else
1324                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1325                                 fi
1326                         fi
1327                         LIBS="-lwrap $LIBS"
1328                         AC_MSG_CHECKING(for libwrap)
1329                         AC_TRY_LINK(
1330                                 [
1331 #include <sys/types.h>
1332 #include <sys/socket.h>
1333 #include <netinet/in.h>
1334 #include <tcpd.h>
1335                                         int deny_severity = 0, allow_severity = 0;
1336                                 ],
1337                                 [hosts_access(0);],
1338                                 [
1339                                         AC_MSG_RESULT(yes)
1340                                         AC_DEFINE(LIBWRAP, 1,
1341                                                 [Define if you want
1342                                                 TCP Wrappers support])
1343                                         SSHDLIBS="$SSHDLIBS -lwrap"
1344                                         TCPW_MSG="yes"
1345                                 ],
1346                                 [
1347                                         AC_MSG_ERROR([*** libwrap missing])
1348                                 ]
1349                         )
1350                         LIBS="$saved_LIBS"
1351                 fi
1352         ]
1353 )
1354
1355 # Check whether user wants libedit support
1356 LIBEDIT_MSG="no"
1357 AC_ARG_WITH(libedit,
1358         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1359         [ if test "x$withval" != "xno" ; then
1360                 if test "x$withval" != "xyes"; then
1361                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1362                         if test -n "${need_dash_r}"; then
1363                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1364                         else
1365                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1366                         fi
1367                 fi
1368                 AC_CHECK_LIB(edit, el_init,
1369                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1370                           LIBEDIT="-ledit -lcurses"
1371                           LIBEDIT_MSG="yes"
1372                           AC_SUBST(LIBEDIT)
1373                         ],
1374                         [ AC_MSG_ERROR(libedit not found) ],
1375                         [ -lcurses ]
1376                 )
1377                 AC_MSG_CHECKING(if libedit version is compatible)
1378                 AC_COMPILE_IFELSE(
1379                     [AC_LANG_SOURCE([[
1380 #include <histedit.h>
1381 int main(void)
1382 {
1383         int i = H_SETSIZE;
1384         el_init("", NULL, NULL, NULL);
1385         exit(0);
1386 }
1387                     ]])],
1388                     [ AC_MSG_RESULT(yes) ],
1389                     [ AC_MSG_RESULT(no)
1390                       AC_MSG_ERROR(libedit version is not compatible) ]
1391                 )
1392         fi ]
1393 )
1394
1395 AUDIT_MODULE=none
1396 AC_ARG_WITH(audit,
1397         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1398         [
1399           AC_MSG_CHECKING(for supported audit module)
1400           case "$withval" in
1401           bsm)
1402                 AC_MSG_RESULT(bsm)
1403                 AUDIT_MODULE=bsm
1404                 dnl    Checks for headers, libs and functions
1405                 AC_CHECK_HEADERS(bsm/audit.h, [],
1406                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1407                     [
1408 #ifdef HAVE_TIME_H
1409 # include <time.h>
1410 #endif
1411                     ]
1412 )
1413                 AC_CHECK_LIB(bsm, getaudit, [],
1414                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1415                 AC_CHECK_FUNCS(getaudit, [],
1416                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1417                 # These are optional
1418                 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1419                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1420                 ;;
1421           debug)
1422                 AUDIT_MODULE=debug
1423                 AC_MSG_RESULT(debug)
1424                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1425                 ;;
1426           no)
1427                 AC_MSG_RESULT(no)
1428                 ;;
1429           *)
1430                 AC_MSG_ERROR([Unknown audit module $withval])
1431                 ;;
1432         esac ]
1433 )
1434
1435 dnl    Checks for library functions. Please keep in alphabetical order
1436 AC_CHECK_FUNCS( \
1437         arc4random \
1438         asprintf \
1439         b64_ntop \
1440         __b64_ntop \
1441         b64_pton \
1442         __b64_pton \
1443         bcopy \
1444         bindresvport_sa \
1445         clock \
1446         closefrom \
1447         dirfd \
1448         fchmod \
1449         fchown \
1450         freeaddrinfo \
1451         futimes \
1452         getaddrinfo \
1453         getcwd \
1454         getgrouplist \
1455         getnameinfo \
1456         getopt \
1457         getpeereid \
1458         getpeerucred \
1459         _getpty \
1460         getrlimit \
1461         getttyent \
1462         glob \
1463         inet_aton \
1464         inet_ntoa \
1465         inet_ntop \
1466         innetgr \
1467         login_getcapbool \
1468         md5_crypt \
1469         memmove \
1470         mkdtemp \
1471         mmap \
1472         ngetaddrinfo \
1473         nsleep \
1474         ogetaddrinfo \
1475         openlog_r \
1476         openpty \
1477         poll \
1478         prctl \
1479         pstat \
1480         readpassphrase \
1481         realpath \
1482         recvmsg \
1483         rresvport_af \
1484         sendmsg \
1485         setdtablesize \
1486         setegid \
1487         setenv \
1488         seteuid \
1489         setgroups \
1490         setlogin \
1491         setpcred \
1492         setproctitle \
1493         setregid \
1494         setreuid \
1495         setrlimit \
1496         setsid \
1497         setvbuf \
1498         sigaction \
1499         sigvec \
1500         snprintf \
1501         socketpair \
1502         strdup \
1503         strerror \
1504         strlcat \
1505         strlcpy \
1506         strmode \
1507         strnvis \
1508         strtonum \
1509         strtoll \
1510         strtoul \
1511         swap32 \
1512         sysconf \
1513         tcgetpgrp \
1514         truncate \
1515         unsetenv \
1516         updwtmpx \
1517         vasprintf \
1518         vhangup \
1519         vsnprintf \
1520         waitpid \
1521 )
1522
1523 # IRIX has a const char return value for gai_strerror()
1524 AC_CHECK_FUNCS(gai_strerror,[
1525         AC_DEFINE(HAVE_GAI_STRERROR)
1526         AC_TRY_COMPILE([
1527 #include <sys/types.h>
1528 #include <sys/socket.h>
1529 #include <netdb.h>
1530
1531 const char *gai_strerror(int);],[
1532 char *str;
1533
1534 str = gai_strerror(0);],[
1535                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1536                 [Define if gai_strerror() returns const char *])])])
1537
1538 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1539         [Some systems put nanosleep outside of libc]))
1540
1541 dnl Make sure prototypes are defined for these before using them.
1542 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1543 AC_CHECK_DECL(strsep,
1544         [AC_CHECK_FUNCS(strsep)],
1545         [],
1546         [
1547 #ifdef HAVE_STRING_H
1548 # include <string.h>
1549 #endif
1550         ])
1551
1552 dnl tcsendbreak might be a macro
1553 AC_CHECK_DECL(tcsendbreak,
1554         [AC_DEFINE(HAVE_TCSENDBREAK)],
1555         [AC_CHECK_FUNCS(tcsendbreak)],
1556         [#include <termios.h>]
1557 )
1558
1559 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1560
1561 AC_CHECK_DECLS(SHUT_RD, , ,
1562         [
1563 #include <sys/types.h>
1564 #include <sys/socket.h>
1565         ])
1566
1567 AC_CHECK_DECLS(O_NONBLOCK, , ,
1568         [
1569 #include <sys/types.h>
1570 #ifdef HAVE_SYS_STAT_H
1571 # include <sys/stat.h>
1572 #endif
1573 #ifdef HAVE_FCNTL_H
1574 # include <fcntl.h>
1575 #endif
1576         ])
1577
1578 AC_CHECK_DECLS(writev, , , [
1579 #include <sys/types.h>
1580 #include <sys/uio.h>
1581 #include <unistd.h>
1582         ])
1583
1584 AC_CHECK_DECLS(MAXSYMLINKS, , , [
1585 #include <sys/param.h>
1586         ])
1587
1588 AC_CHECK_DECLS(offsetof, , , [
1589 #include <stddef.h>
1590         ])
1591
1592 AC_CHECK_FUNCS(setresuid, [
1593         dnl Some platorms have setresuid that isn't implemented, test for this
1594         AC_MSG_CHECKING(if setresuid seems to work)
1595         AC_RUN_IFELSE(
1596                 [AC_LANG_SOURCE([[
1597 #include <stdlib.h>
1598 #include <errno.h>
1599 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1600                 ]])],
1601                 [AC_MSG_RESULT(yes)],
1602                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1603                         [Define if your setresuid() is broken])
1604                  AC_MSG_RESULT(not implemented)],
1605                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1606         )
1607 ])
1608
1609 AC_CHECK_FUNCS(setresgid, [
1610         dnl Some platorms have setresgid that isn't implemented, test for this
1611         AC_MSG_CHECKING(if setresgid seems to work)
1612         AC_RUN_IFELSE(
1613                 [AC_LANG_SOURCE([[
1614 #include <stdlib.h>
1615 #include <errno.h>
1616 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1617                 ]])],
1618                 [AC_MSG_RESULT(yes)],
1619                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1620                         [Define if your setresgid() is broken])
1621                  AC_MSG_RESULT(not implemented)],
1622                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1623         )
1624 ])
1625
1626 dnl    Checks for time functions
1627 AC_CHECK_FUNCS(gettimeofday time)
1628 dnl    Checks for utmp functions
1629 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1630 AC_CHECK_FUNCS(utmpname)
1631 dnl    Checks for utmpx functions
1632 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1633 AC_CHECK_FUNCS(setutxent utmpxname)
1634
1635 AC_CHECK_FUNC(daemon,
1636         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1637         [AC_CHECK_LIB(bsd, daemon,
1638                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1639 )
1640
1641 AC_CHECK_FUNC(getpagesize,
1642         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1643                 [Define if your libraries define getpagesize()])],
1644         [AC_CHECK_LIB(ucb, getpagesize,
1645                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1646 )
1647
1648 # Check for broken snprintf
1649 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1650         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1651         AC_RUN_IFELSE(
1652                 [AC_LANG_SOURCE([[
1653 #include <stdio.h>
1654 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1655                 ]])],
1656                 [AC_MSG_RESULT(yes)],
1657                 [
1658                         AC_MSG_RESULT(no)
1659                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1660                                 [Define if your snprintf is busted])
1661                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1662                 ],
1663                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1664         )
1665 fi
1666
1667 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1668 # returning the right thing on overflow: the number of characters it tried to
1669 # create (as per SUSv3)
1670 if test "x$ac_cv_func_asprintf" != "xyes" && \
1671    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1672         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1673         AC_RUN_IFELSE(
1674                 [AC_LANG_SOURCE([[
1675 #include <sys/types.h>
1676 #include <stdio.h>
1677 #include <stdarg.h>
1678
1679 int x_snprintf(char *str,size_t count,const char *fmt,...)
1680 {
1681         size_t ret; va_list ap;
1682         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1683         return ret;
1684 }
1685 int main(void)
1686 {
1687         char x[1];
1688         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1689 } ]])],
1690                 [AC_MSG_RESULT(yes)],
1691                 [
1692                         AC_MSG_RESULT(no)
1693                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1694                                 [Define if your snprintf is busted])
1695                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1696                 ],
1697                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1698         )
1699 fi
1700
1701 # On systems where [v]snprintf is broken, but is declared in stdio,
1702 # check that the fmt argument is const char * or just char *.
1703 # This is only useful for when BROKEN_SNPRINTF
1704 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1705 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1706            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1707            int main(void) { snprintf(0, 0, 0); }
1708     ]])],
1709    [AC_MSG_RESULT(yes)
1710     AC_DEFINE(SNPRINTF_CONST, [const],
1711               [Define as const if snprintf() can declare const char *fmt])],
1712    [AC_MSG_RESULT(no)
1713     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1714
1715 # Check for missing getpeereid (or equiv) support
1716 NO_PEERCHECK=""
1717 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
1718         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1719         AC_TRY_COMPILE(
1720                 [#include <sys/types.h>
1721                  #include <sys/socket.h>],
1722                 [int i = SO_PEERCRED;],
1723                 [ AC_MSG_RESULT(yes)
1724                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1725                 ],
1726                 [AC_MSG_RESULT(no)
1727                 NO_PEERCHECK=1]
1728         )
1729 fi
1730
1731 dnl see whether mkstemp() requires XXXXXX
1732 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1733 AC_MSG_CHECKING([for (overly) strict mkstemp])
1734 AC_RUN_IFELSE(
1735         [AC_LANG_SOURCE([[
1736 #include <stdlib.h>
1737 main() { char template[]="conftest.mkstemp-test";
1738 if (mkstemp(template) == -1)
1739         exit(1);
1740 unlink(template); exit(0);
1741 }
1742         ]])],
1743         [
1744                 AC_MSG_RESULT(no)
1745         ],
1746         [
1747                 AC_MSG_RESULT(yes)
1748                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1749         ],
1750         [
1751                 AC_MSG_RESULT(yes)
1752                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1753         ]
1754 )
1755 fi
1756
1757 dnl make sure that openpty does not reacquire controlling terminal
1758 if test ! -z "$check_for_openpty_ctty_bug"; then
1759         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1760         AC_RUN_IFELSE(
1761                 [AC_LANG_SOURCE([[
1762 #include <stdio.h>
1763 #include <sys/fcntl.h>
1764 #include <sys/types.h>
1765 #include <sys/wait.h>
1766
1767 int
1768 main()
1769 {
1770         pid_t pid;
1771         int fd, ptyfd, ttyfd, status;
1772
1773         pid = fork();
1774         if (pid < 0) {          /* failed */
1775                 exit(1);
1776         } else if (pid > 0) {   /* parent */
1777                 waitpid(pid, &status, 0);
1778                 if (WIFEXITED(status))
1779                         exit(WEXITSTATUS(status));
1780                 else
1781                         exit(2);
1782         } else {                /* child */
1783                 close(0); close(1); close(2);
1784                 setsid();
1785                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1786                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1787                 if (fd >= 0)
1788                         exit(3);        /* Acquired ctty: broken */
1789                 else
1790                         exit(0);        /* Did not acquire ctty: OK */
1791         }
1792 }
1793                 ]])],
1794                 [
1795                         AC_MSG_RESULT(yes)
1796                 ],
1797                 [
1798                         AC_MSG_RESULT(no)
1799                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1800                 ],
1801                 [
1802                         AC_MSG_RESULT(cross-compiling, assuming yes)
1803                 ]
1804         )
1805 fi
1806
1807 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1808     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1809         AC_MSG_CHECKING(if getaddrinfo seems to work)
1810         AC_RUN_IFELSE(
1811                 [AC_LANG_SOURCE([[
1812 #include <stdio.h>
1813 #include <sys/socket.h>
1814 #include <netdb.h>
1815 #include <errno.h>
1816 #include <netinet/in.h>
1817
1818 #define TEST_PORT "2222"
1819
1820 int
1821 main(void)
1822 {
1823         int err, sock;
1824         struct addrinfo *gai_ai, *ai, hints;
1825         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1826
1827         memset(&hints, 0, sizeof(hints));
1828         hints.ai_family = PF_UNSPEC;
1829         hints.ai_socktype = SOCK_STREAM;
1830         hints.ai_flags = AI_PASSIVE;
1831
1832         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1833         if (err != 0) {
1834                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1835                 exit(1);
1836         }
1837
1838         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1839                 if (ai->ai_family != AF_INET6)
1840                         continue;
1841
1842                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1843                     sizeof(ntop), strport, sizeof(strport),
1844                     NI_NUMERICHOST|NI_NUMERICSERV);
1845
1846                 if (err != 0) {
1847                         if (err == EAI_SYSTEM)
1848                                 perror("getnameinfo EAI_SYSTEM");
1849                         else
1850                                 fprintf(stderr, "getnameinfo failed: %s\n",
1851                                     gai_strerror(err));
1852                         exit(2);
1853                 }
1854
1855                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1856                 if (sock < 0)
1857                         perror("socket");
1858                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1859                         if (errno == EBADF)
1860                                 exit(3);
1861                 }
1862         }
1863         exit(0);
1864 }
1865                 ]])],
1866                 [
1867                         AC_MSG_RESULT(yes)
1868                 ],
1869                 [
1870                         AC_MSG_RESULT(no)
1871                         AC_DEFINE(BROKEN_GETADDRINFO)
1872                 ],
1873                 [
1874                         AC_MSG_RESULT(cross-compiling, assuming yes)
1875                 ]
1876         )
1877 fi
1878
1879 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1880     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1881         AC_MSG_CHECKING(if getaddrinfo seems to work)
1882         AC_RUN_IFELSE(
1883                 [AC_LANG_SOURCE([[
1884 #include <stdio.h>
1885 #include <sys/socket.h>
1886 #include <netdb.h>
1887 #include <errno.h>
1888 #include <netinet/in.h>
1889
1890 #define TEST_PORT "2222"
1891
1892 int
1893 main(void)
1894 {
1895         int err, sock;
1896         struct addrinfo *gai_ai, *ai, hints;
1897         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1898
1899         memset(&hints, 0, sizeof(hints));
1900         hints.ai_family = PF_UNSPEC;
1901         hints.ai_socktype = SOCK_STREAM;
1902         hints.ai_flags = AI_PASSIVE;
1903
1904         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1905         if (err != 0) {
1906                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1907                 exit(1);
1908         }
1909
1910         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1911                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1912                         continue;
1913
1914                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1915                     sizeof(ntop), strport, sizeof(strport),
1916                     NI_NUMERICHOST|NI_NUMERICSERV);
1917
1918                 if (ai->ai_family == AF_INET && err != 0) {
1919                         perror("getnameinfo");
1920                         exit(2);
1921                 }
1922         }
1923         exit(0);
1924 }
1925                 ]])],
1926                 [
1927                         AC_MSG_RESULT(yes)
1928                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1929                                 [Define if you have a getaddrinfo that fails
1930                                 for the all-zeros IPv6 address])
1931                 ],
1932                 [
1933                         AC_MSG_RESULT(no)
1934                         AC_DEFINE(BROKEN_GETADDRINFO)
1935                 ],
1936                 [
1937                         AC_MSG_RESULT(cross-compiling, assuming no)
1938                 ]
1939         )
1940 fi
1941
1942 if test "x$check_for_conflicting_getspnam" = "x1"; then
1943         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1944         AC_COMPILE_IFELSE(
1945                 [
1946 #include <shadow.h>
1947 int main(void) {exit(0);}
1948                 ],
1949                 [
1950                         AC_MSG_RESULT(no)
1951                 ],
1952                 [
1953                         AC_MSG_RESULT(yes)
1954                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1955                             [Conflicting defs for getspnam])
1956                 ]
1957         )
1958 fi
1959
1960 AC_FUNC_GETPGRP
1961
1962 # Search for OpenSSL
1963 saved_CPPFLAGS="$CPPFLAGS"
1964 saved_LDFLAGS="$LDFLAGS"
1965 AC_ARG_WITH(ssl-dir,
1966         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1967         [
1968                 if test "x$withval" != "xno" ; then
1969                         case "$withval" in
1970                                 # Relative paths
1971                                 ./*|../*)       withval="`pwd`/$withval"
1972                         esac
1973                         if test -d "$withval/lib"; then
1974                                 if test -n "${need_dash_r}"; then
1975                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1976                                 else
1977                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1978                                 fi
1979                         else
1980                                 if test -n "${need_dash_r}"; then
1981                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1982                                 else
1983                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1984                                 fi
1985                         fi
1986                         if test -d "$withval/include"; then
1987                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1988                         else
1989                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1990                         fi
1991                 fi
1992         ]
1993 )
1994 if test -z "$GSI_LDFLAGS" ; then
1995 LIBS="-lcrypto $LIBS"
1996 fi
1997 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1998         [Define if your ssl headers are included
1999         with #include <openssl/header.h>]),
2000         [
2001                 dnl Check default openssl install dir
2002                 if test -n "${need_dash_r}"; then
2003                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
2004                 else
2005                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
2006                 fi
2007                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
2008                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
2009                         [
2010                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2011                         ]
2012                 )
2013         ]
2014 )
2015
2016 # Determine OpenSSL header version
2017 AC_MSG_CHECKING([OpenSSL header version])
2018 AC_RUN_IFELSE(
2019         [AC_LANG_SOURCE([[
2020 #include <stdio.h>
2021 #include <string.h>
2022 #include <openssl/opensslv.h>
2023 #define DATA "conftest.sslincver"
2024 int main(void) {
2025         FILE *fd;
2026         int rc;
2027
2028         fd = fopen(DATA,"w");
2029         if(fd == NULL)
2030                 exit(1);
2031
2032         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
2033                 exit(1);
2034
2035         exit(0);
2036 }
2037         ]])],
2038         [
2039                 ssl_header_ver=`cat conftest.sslincver`
2040                 AC_MSG_RESULT($ssl_header_ver)
2041         ],
2042         [
2043                 AC_MSG_RESULT(not found)
2044                 AC_MSG_ERROR(OpenSSL version header not found.)
2045         ],
2046         [
2047                 AC_MSG_WARN([cross compiling: not checking])
2048         ]
2049 )
2050
2051 # Determine OpenSSL library version
2052 AC_MSG_CHECKING([OpenSSL library version])
2053 AC_RUN_IFELSE(
2054         [AC_LANG_SOURCE([[
2055 #include <stdio.h>
2056 #include <string.h>
2057 #include <openssl/opensslv.h>
2058 #include <openssl/crypto.h>
2059 #define DATA "conftest.ssllibver"
2060 int main(void) {
2061         FILE *fd;
2062         int rc;
2063
2064         fd = fopen(DATA,"w");
2065         if(fd == NULL)
2066                 exit(1);
2067
2068         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
2069                 exit(1);
2070
2071         exit(0);
2072 }
2073         ]])],
2074         [
2075                 ssl_library_ver=`cat conftest.ssllibver`
2076                 AC_MSG_RESULT($ssl_library_ver)
2077         ],
2078         [
2079                 AC_MSG_RESULT(not found)
2080                 AC_MSG_ERROR(OpenSSL library not found.)
2081         ],
2082         [
2083                 AC_MSG_WARN([cross compiling: not checking])
2084         ]
2085 )
2086
2087 AC_ARG_WITH(openssl-header-check,
2088         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2089         [  if test "x$withval" = "xno" ; then
2090                 openssl_check_nonfatal=1
2091            fi
2092         ]
2093 )
2094
2095 # Sanity check OpenSSL headers
2096 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2097 AC_RUN_IFELSE(
2098         [AC_LANG_SOURCE([[
2099 #include <string.h>
2100 #include <openssl/opensslv.h>
2101 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
2102         ]])],
2103         [
2104                 AC_MSG_RESULT(yes)
2105         ],
2106         [
2107                 AC_MSG_RESULT(no)
2108                 if test "x$openssl_check_nonfatal" = "x"; then
2109                         AC_MSG_ERROR([Your OpenSSL headers do not match your
2110 library. Check config.log for details.
2111 If you are sure your installation is consistent, you can disable the check
2112 by running "./configure --without-openssl-header-check".
2113 Also see contrib/findssl.sh for help identifying header/library mismatches.
2114 ])
2115                 else
2116                         AC_MSG_WARN([Your OpenSSL headers do not match your
2117 library. Check config.log for details.
2118 Also see contrib/findssl.sh for help identifying header/library mismatches.])
2119                 fi
2120         ],
2121         [
2122                 AC_MSG_WARN([cross compiling: not checking])
2123         ]
2124 )
2125
2126 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2127 AC_LINK_IFELSE(
2128         [AC_LANG_SOURCE([[
2129 #include <openssl/evp.h>
2130 int main(void) { SSLeay_add_all_algorithms(); }
2131         ]])],
2132         [
2133                 AC_MSG_RESULT(yes)
2134         ],
2135         [
2136                 AC_MSG_RESULT(no)
2137                 saved_LIBS="$LIBS"
2138                 LIBS="$LIBS -ldl"
2139                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2140                 AC_LINK_IFELSE(
2141                         [AC_LANG_SOURCE([[
2142 #include <openssl/evp.h>
2143 int main(void) { SSLeay_add_all_algorithms(); }
2144                         ]])],
2145                         [
2146                                 AC_MSG_RESULT(yes)
2147                         ],
2148                         [
2149                                 AC_MSG_RESULT(no)
2150                                 LIBS="$saved_LIBS"
2151                         ]
2152                 )
2153         ]
2154 )
2155
2156 AC_ARG_WITH(ssl-engine,
2157         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2158         [ if test "x$withval" != "xno" ; then
2159                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
2160                 AC_TRY_COMPILE(
2161                         [ #include <openssl/engine.h>],
2162                         [
2163 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
2164                         ],
2165                         [ AC_MSG_RESULT(yes)
2166                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
2167                              [Enable OpenSSL engine support])
2168                         ],
2169                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
2170                 )
2171           fi ]
2172 )
2173
2174 # Check for OpenSSL without EVP_aes_{192,256}_cbc
2175 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2176 AC_LINK_IFELSE(
2177         [AC_LANG_SOURCE([[
2178 #include <string.h>
2179 #include <openssl/evp.h>
2180 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
2181         ]])],
2182         [
2183                 AC_MSG_RESULT(no)
2184         ],
2185         [
2186                 AC_MSG_RESULT(yes)
2187                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2188                     [libcrypto is missing AES 192 and 256 bit functions])
2189         ]
2190 )
2191
2192 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2193 # because the system crypt() is more featureful.
2194 if test "x$check_for_libcrypt_before" = "x1"; then
2195         AC_CHECK_LIB(crypt, crypt)
2196 fi
2197
2198 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2199 # version in OpenSSL.
2200 if test "x$check_for_libcrypt_later" = "x1"; then
2201         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2202 fi
2203
2204 # Search for SHA256 support in libc and/or OpenSSL
2205 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2206
2207 saved_LIBS="$LIBS"
2208 AC_CHECK_LIB(iaf, ia_openinfo, [
2209         LIBS="$LIBS -liaf"
2210         AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
2211                                 AC_DEFINE(HAVE_LIBIAF, 1,
2212                         [Define if system has libiaf that supports set_id])
2213                                 ])
2214 ])
2215 LIBS="$saved_LIBS"
2216
2217 ### Configure cryptographic random number support
2218
2219 # Check wheter OpenSSL seeds itself
2220 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2221 AC_RUN_IFELSE(
2222         [AC_LANG_SOURCE([[
2223 #include <string.h>
2224 #include <openssl/rand.h>
2225 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2226         ]])],
2227         [
2228                 OPENSSL_SEEDS_ITSELF=yes
2229                 AC_MSG_RESULT(yes)
2230         ],
2231         [
2232                 AC_MSG_RESULT(no)
2233                 # Default to use of the rand helper if OpenSSL doesn't
2234                 # seed itself
2235                 USE_RAND_HELPER=yes
2236         ],
2237         [
2238                 AC_MSG_WARN([cross compiling: assuming yes])
2239                 # This is safe, since all recent OpenSSL versions will
2240                 # complain at runtime if not seeded correctly.
2241                 OPENSSL_SEEDS_ITSELF=yes
2242         ]
2243 )
2244
2245 # Check for PAM libs
2246 PAM_MSG="no"
2247 AC_ARG_WITH(pam,
2248         [  --with-pam              Enable PAM support ],
2249         [
2250                 if test "x$withval" != "xno" ; then
2251                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2252                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2253                                 AC_MSG_ERROR([PAM headers not found])
2254                         fi
2255
2256                         saved_LIBS="$LIBS"
2257                         AC_CHECK_LIB(dl, dlopen, , )
2258                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2259                         AC_CHECK_FUNCS(pam_getenvlist)
2260                         AC_CHECK_FUNCS(pam_putenv)
2261                         LIBS="$saved_LIBS"
2262
2263                         PAM_MSG="yes"
2264
2265                         SSHDLIBS="$SSHDLIBS -lpam"
2266                         AC_DEFINE(USE_PAM, 1,
2267                                 [Define if you want to enable PAM support])
2268
2269                         if test $ac_cv_lib_dl_dlopen = yes; then
2270                                 case "$LIBS" in
2271                                 *-ldl*)
2272                                         # libdl already in LIBS
2273                                         ;;
2274                                 *)
2275                                         SSHDLIBS="$SSHDLIBS -ldl"
2276                                         ;;
2277                                 esac
2278                         fi
2279                 fi
2280         ]
2281 )
2282
2283 # Check for older PAM
2284 if test "x$PAM_MSG" = "xyes" ; then
2285         # Check PAM strerror arguments (old PAM)
2286         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2287         AC_TRY_COMPILE(
2288                 [
2289 #include <stdlib.h>
2290 #if defined(HAVE_SECURITY_PAM_APPL_H)
2291 #include <security/pam_appl.h>
2292 #elif defined (HAVE_PAM_PAM_APPL_H)
2293 #include <pam/pam_appl.h>
2294 #endif
2295                 ],
2296                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2297                 [AC_MSG_RESULT(no)],
2298                 [
2299                         AC_DEFINE(HAVE_OLD_PAM, 1,
2300                                 [Define if you have an old version of PAM
2301                                 which takes only one argument to pam_strerror])
2302                         AC_MSG_RESULT(yes)
2303                         PAM_MSG="yes (old library)"
2304                 ]
2305         )
2306 fi
2307
2308 # Do we want to force the use of the rand helper?
2309 AC_ARG_WITH(rand-helper,
2310         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2311         [
2312                 if test "x$withval" = "xno" ; then
2313                         # Force use of OpenSSL's internal RNG, even if
2314                         # the previous test showed it to be unseeded.
2315                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2316                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2317                                 OPENSSL_SEEDS_ITSELF=yes
2318                                 USE_RAND_HELPER=""
2319                         fi
2320                 else
2321                         USE_RAND_HELPER=yes
2322                 fi
2323         ],
2324 )
2325
2326 # Which randomness source do we use?
2327 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2328         # OpenSSL only
2329         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2330                 [Define if you want OpenSSL's internally seeded PRNG only])
2331         RAND_MSG="OpenSSL internal ONLY"
2332         INSTALL_SSH_RAND_HELPER=""
2333 elif test ! -z "$USE_RAND_HELPER" ; then
2334         # install rand helper
2335         RAND_MSG="ssh-rand-helper"
2336         INSTALL_SSH_RAND_HELPER="yes"
2337 fi
2338 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2339
2340 ### Configuration of ssh-rand-helper
2341
2342 # PRNGD TCP socket
2343 AC_ARG_WITH(prngd-port,
2344         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2345         [
2346                 case "$withval" in
2347                 no)
2348                         withval=""
2349                         ;;
2350                 [[0-9]]*)
2351                         ;;
2352                 *)
2353                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2354                         ;;
2355                 esac
2356                 if test ! -z "$withval" ; then
2357                         PRNGD_PORT="$withval"
2358                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2359                                 [Port number of PRNGD/EGD random number socket])
2360                 fi
2361         ]
2362 )
2363
2364 # PRNGD Unix domain socket
2365 AC_ARG_WITH(prngd-socket,
2366         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2367         [
2368                 case "$withval" in
2369                 yes)
2370                         withval="/var/run/egd-pool"
2371                         ;;
2372                 no)
2373                         withval=""
2374                         ;;
2375                 /*)
2376                         ;;
2377                 *)
2378                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2379                         ;;
2380                 esac
2381
2382                 if test ! -z "$withval" ; then
2383                         if test ! -z "$PRNGD_PORT" ; then
2384                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2385                         fi
2386                         if test ! -r "$withval" ; then
2387                                 AC_MSG_WARN(Entropy socket is not readable)
2388                         fi
2389                         PRNGD_SOCKET="$withval"
2390                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2391                                 [Location of PRNGD/EGD random number socket])
2392                 fi
2393         ],
2394         [
2395                 # Check for existing socket only if we don't have a random device already
2396                 if test "$USE_RAND_HELPER" = yes ; then
2397                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2398                         # Insert other locations here
2399                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2400                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2401                                         PRNGD_SOCKET="$sock"
2402                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2403                                         break;
2404                                 fi
2405                         done
2406                         if test ! -z "$PRNGD_SOCKET" ; then
2407                                 AC_MSG_RESULT($PRNGD_SOCKET)
2408                         else
2409                                 AC_MSG_RESULT(not found)
2410                         fi
2411                 fi
2412         ]
2413 )
2414
2415 # Change default command timeout for hashing entropy source
2416 entropy_timeout=200
2417 AC_ARG_WITH(entropy-timeout,
2418         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2419         [
2420                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2421                     test "x${withval}" != "xyes"; then
2422                         entropy_timeout=$withval
2423                 fi
2424         ]
2425 )
2426 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2427         [Builtin PRNG command timeout])
2428
2429 SSH_PRIVSEP_USER=sshd
2430 AC_ARG_WITH(privsep-user,
2431         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2432         [
2433                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2434                     test "x${withval}" != "xyes"; then
2435                         SSH_PRIVSEP_USER=$withval
2436                 fi
2437         ]
2438 )
2439 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2440         [non-privileged user for privilege separation])
2441 AC_SUBST(SSH_PRIVSEP_USER)
2442
2443 # We do this little dance with the search path to insure
2444 # that programs that we select for use by installed programs
2445 # (which may be run by the super-user) come from trusted
2446 # locations before they come from the user's private area.
2447 # This should help avoid accidentally configuring some
2448 # random version of a program in someone's personal bin.
2449
2450 OPATH=$PATH
2451 PATH=/bin:/usr/bin
2452 test -h /bin 2> /dev/null && PATH=/usr/bin
2453 test -d /sbin && PATH=$PATH:/sbin
2454 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2455 PATH=$PATH:/etc:$OPATH
2456
2457 # These programs are used by the command hashing source to gather entropy
2458 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2459 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2460 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2461 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2462 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2463 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2464 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2465 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2466 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2467 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2468 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2469 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2470 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2471 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2472 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2473 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2474 # restore PATH
2475 PATH=$OPATH
2476
2477 # Where does ssh-rand-helper get its randomness from?
2478 INSTALL_SSH_PRNG_CMDS=""
2479 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2480         if test ! -z "$PRNGD_PORT" ; then
2481                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2482         elif test ! -z "$PRNGD_SOCKET" ; then
2483                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2484         else
2485                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2486                 RAND_HELPER_CMDHASH=yes
2487                 INSTALL_SSH_PRNG_CMDS="yes"
2488         fi
2489 fi
2490 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2491
2492
2493 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2494 if test ! -z "$SONY" ; then
2495   LIBS="$LIBS -liberty";
2496 fi
2497
2498 # Check for  long long datatypes
2499 AC_CHECK_TYPES([long long, unsigned long long, long double])
2500
2501 # Check datatype sizes
2502 AC_CHECK_SIZEOF(char, 1)
2503 AC_CHECK_SIZEOF(short int, 2)
2504 AC_CHECK_SIZEOF(int, 4)
2505 AC_CHECK_SIZEOF(long int, 4)
2506 AC_CHECK_SIZEOF(long long int, 8)
2507
2508 # Sanity check long long for some platforms (AIX)
2509 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2510         ac_cv_sizeof_long_long_int=0
2511 fi
2512
2513 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2514 if test -z "$have_llong_max"; then
2515         AC_MSG_CHECKING([for max value of long long])
2516         AC_RUN_IFELSE(
2517                 [AC_LANG_SOURCE([[
2518 #include <stdio.h>
2519 /* Why is this so damn hard? */
2520 #ifdef __GNUC__
2521 # undef __GNUC__
2522 #endif
2523 #define __USE_ISOC99
2524 #include <limits.h>
2525 #define DATA "conftest.llminmax"
2526 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2527
2528 /*
2529  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2530  * we do this the hard way.
2531  */
2532 static int
2533 fprint_ll(FILE *f, long long n)
2534 {
2535         unsigned int i;
2536         int l[sizeof(long long) * 8];
2537
2538         if (n < 0)
2539                 if (fprintf(f, "-") < 0)
2540                         return -1;
2541         for (i = 0; n != 0; i++) {
2542                 l[i] = my_abs(n % 10);
2543                 n /= 10;
2544         }
2545         do {
2546                 if (fprintf(f, "%d", l[--i]) < 0)
2547                         return -1;
2548         } while (i != 0);
2549         if (fprintf(f, " ") < 0)
2550                 return -1;
2551         return 0;
2552 }
2553
2554 int main(void) {
2555         FILE *f;
2556         long long i, llmin, llmax = 0;
2557
2558         if((f = fopen(DATA,"w")) == NULL)
2559                 exit(1);
2560
2561 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2562         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2563         llmin = LLONG_MIN;
2564         llmax = LLONG_MAX;
2565 #else
2566         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2567         /* This will work on one's complement and two's complement */
2568         for (i = 1; i > llmax; i <<= 1, i++)
2569                 llmax = i;
2570         llmin = llmax + 1LL;    /* wrap */
2571 #endif
2572
2573         /* Sanity check */
2574         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2575             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2576             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2577                 fprintf(f, "unknown unknown\n");
2578                 exit(2);
2579         }
2580
2581         if (fprint_ll(f, llmin) < 0)
2582                 exit(3);
2583         if (fprint_ll(f, llmax) < 0)
2584                 exit(4);
2585         if (fclose(f) < 0)
2586                 exit(5);
2587         exit(0);
2588 }
2589                 ]])],
2590                 [
2591                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2592                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2593
2594                         AC_MSG_RESULT($llong_max)
2595                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2596                             [max value of long long calculated by configure])
2597                         AC_MSG_CHECKING([for min value of long long])
2598                         AC_MSG_RESULT($llong_min)
2599                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2600                             [min value of long long calculated by configure])
2601                 ],
2602                 [
2603                         AC_MSG_RESULT(not found)
2604                 ],
2605                 [
2606                         AC_MSG_WARN([cross compiling: not checking])
2607                 ]
2608         )
2609 fi
2610
2611
2612 # More checks for data types
2613 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2614         AC_TRY_COMPILE(
2615                 [ #include <sys/types.h> ],
2616                 [ u_int a; a = 1;],
2617                 [ ac_cv_have_u_int="yes" ],
2618                 [ ac_cv_have_u_int="no" ]
2619         )
2620 ])
2621 if test "x$ac_cv_have_u_int" = "xyes" ; then
2622         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2623         have_u_int=1
2624 fi
2625
2626 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2627         AC_TRY_COMPILE(
2628                 [ #include <sys/types.h> ],
2629                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2630                 [ ac_cv_have_intxx_t="yes" ],
2631                 [ ac_cv_have_intxx_t="no" ]
2632         )
2633 ])
2634 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2635         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2636         have_intxx_t=1
2637 fi
2638
2639 if (test -z "$have_intxx_t" && \
2640            test "x$ac_cv_header_stdint_h" = "xyes")
2641 then
2642     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2643         AC_TRY_COMPILE(
2644                 [ #include <stdint.h> ],
2645                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2646                 [
2647                         AC_DEFINE(HAVE_INTXX_T)
2648                         AC_MSG_RESULT(yes)
2649                 ],
2650                 [ AC_MSG_RESULT(no) ]
2651         )
2652 fi
2653
2654 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2655         AC_TRY_COMPILE(
2656                 [
2657 #include <sys/types.h>
2658 #ifdef HAVE_STDINT_H
2659 # include <stdint.h>
2660 #endif
2661 #include <sys/socket.h>
2662 #ifdef HAVE_SYS_BITYPES_H
2663 # include <sys/bitypes.h>
2664 #endif
2665                 ],
2666                 [ int64_t a; a = 1;],
2667                 [ ac_cv_have_int64_t="yes" ],
2668                 [ ac_cv_have_int64_t="no" ]
2669         )
2670 ])
2671 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2672         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2673 fi
2674
2675 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2676         AC_TRY_COMPILE(
2677                 [ #include <sys/types.h> ],
2678                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2679                 [ ac_cv_have_u_intxx_t="yes" ],
2680                 [ ac_cv_have_u_intxx_t="no" ]
2681         )
2682 ])
2683 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2684         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2685         have_u_intxx_t=1
2686 fi
2687
2688 if test -z "$have_u_intxx_t" ; then
2689     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2690         AC_TRY_COMPILE(
2691                 [ #include <sys/socket.h> ],
2692                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2693                 [
2694                         AC_DEFINE(HAVE_U_INTXX_T)
2695                         AC_MSG_RESULT(yes)
2696                 ],
2697                 [ AC_MSG_RESULT(no) ]
2698         )
2699 fi
2700
2701 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2702         AC_TRY_COMPILE(
2703                 [ #include <sys/types.h> ],
2704                 [ u_int64_t a; a = 1;],
2705                 [ ac_cv_have_u_int64_t="yes" ],
2706                 [ ac_cv_have_u_int64_t="no" ]
2707         )
2708 ])
2709 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2710         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2711         have_u_int64_t=1
2712 fi
2713
2714 if test -z "$have_u_int64_t" ; then
2715     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2716         AC_TRY_COMPILE(
2717                 [ #include <sys/bitypes.h> ],
2718                 [ u_int64_t a; a = 1],
2719                 [
2720                         AC_DEFINE(HAVE_U_INT64_T)
2721                         AC_MSG_RESULT(yes)
2722                 ],
2723                 [ AC_MSG_RESULT(no) ]
2724         )
2725 fi
2726
2727 if test -z "$have_u_intxx_t" ; then
2728         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2729                 AC_TRY_COMPILE(
2730                         [
2731 #include <sys/types.h>
2732                         ],
2733                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2734                         [ ac_cv_have_uintxx_t="yes" ],
2735                         [ ac_cv_have_uintxx_t="no" ]
2736                 )
2737         ])
2738         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2739                 AC_DEFINE(HAVE_UINTXX_T, 1,
2740                         [define if you have uintxx_t data type])
2741         fi
2742 fi
2743
2744 if test -z "$have_uintxx_t" ; then
2745     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2746         AC_TRY_COMPILE(
2747                 [ #include <stdint.h> ],
2748                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2749                 [
2750                         AC_DEFINE(HAVE_UINTXX_T)
2751                         AC_MSG_RESULT(yes)
2752                 ],
2753                 [ AC_MSG_RESULT(no) ]
2754         )
2755 fi
2756
2757 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2758            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2759 then
2760         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2761         AC_TRY_COMPILE(
2762                 [
2763 #include <sys/bitypes.h>
2764                 ],
2765                 [
2766                         int8_t a; int16_t b; int32_t c;
2767                         u_int8_t e; u_int16_t f; u_int32_t g;
2768                         a = b = c = e = f = g = 1;
2769                 ],
2770                 [
2771                         AC_DEFINE(HAVE_U_INTXX_T)
2772                         AC_DEFINE(HAVE_INTXX_T)
2773                         AC_MSG_RESULT(yes)
2774                 ],
2775                 [AC_MSG_RESULT(no)]
2776         )
2777 fi
2778
2779
2780 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2781         AC_TRY_COMPILE(
2782                 [
2783 #include <sys/types.h>
2784                 ],
2785                 [ u_char foo; foo = 125; ],
2786                 [ ac_cv_have_u_char="yes" ],
2787                 [ ac_cv_have_u_char="no" ]
2788         )
2789 ])
2790 if test "x$ac_cv_have_u_char" = "xyes" ; then
2791         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2792 fi
2793
2794 TYPE_SOCKLEN_T
2795
2796 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2797
2798 AC_CHECK_TYPES(in_addr_t,,,
2799 [#include <sys/types.h>
2800 #include <netinet/in.h>])
2801
2802 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2803         AC_TRY_COMPILE(
2804                 [
2805 #include <sys/types.h>
2806                 ],
2807                 [ size_t foo; foo = 1235; ],
2808                 [ ac_cv_have_size_t="yes" ],
2809                 [ ac_cv_have_size_t="no" ]
2810         )
2811 ])
2812 if test "x$ac_cv_have_size_t" = "xyes" ; then
2813         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2814 fi
2815
2816 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2817         AC_TRY_COMPILE(
2818                 [
2819 #include <sys/types.h>
2820                 ],
2821                 [ ssize_t foo; foo = 1235; ],
2822                 [ ac_cv_have_ssize_t="yes" ],
2823                 [ ac_cv_have_ssize_t="no" ]
2824         )
2825 ])
2826 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2827         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2828 fi
2829
2830 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2831         AC_TRY_COMPILE(
2832                 [
2833 #include <time.h>
2834                 ],
2835                 [ clock_t foo; foo = 1235; ],
2836                 [ ac_cv_have_clock_t="yes" ],
2837                 [ ac_cv_have_clock_t="no" ]
2838         )
2839 ])
2840 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2841         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2842 fi
2843
2844 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2845         AC_TRY_COMPILE(
2846                 [
2847 #include <sys/types.h>
2848 #include <sys/socket.h>
2849                 ],
2850                 [ sa_family_t foo; foo = 1235; ],
2851                 [ ac_cv_have_sa_family_t="yes" ],
2852                 [ AC_TRY_COMPILE(
2853                   [
2854 #include <sys/types.h>
2855 #include <sys/socket.h>
2856 #include <netinet/in.h>
2857                 ],
2858                 [ sa_family_t foo; foo = 1235; ],
2859                 [ ac_cv_have_sa_family_t="yes" ],
2860
2861                 [ ac_cv_have_sa_family_t="no" ]
2862         )]
2863         )
2864 ])
2865 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2866         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2867                 [define if you have sa_family_t data type])
2868 fi
2869
2870 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2871         AC_TRY_COMPILE(
2872                 [
2873 #include <sys/types.h>
2874                 ],
2875                 [ pid_t foo; foo = 1235; ],
2876                 [ ac_cv_have_pid_t="yes" ],
2877                 [ ac_cv_have_pid_t="no" ]
2878         )
2879 ])
2880 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2881         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2882 fi
2883
2884 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2885         AC_TRY_COMPILE(
2886                 [
2887 #include <sys/types.h>
2888                 ],
2889                 [ mode_t foo; foo = 1235; ],
2890                 [ ac_cv_have_mode_t="yes" ],
2891                 [ ac_cv_have_mode_t="no" ]
2892         )
2893 ])
2894 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2895         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2896 fi
2897
2898
2899 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2900         AC_TRY_COMPILE(
2901                 [
2902 #include <sys/types.h>
2903 #include <sys/socket.h>
2904                 ],
2905                 [ struct sockaddr_storage s; ],
2906                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2907                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2908         )
2909 ])
2910 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2911         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2912                 [define if you have struct sockaddr_storage data type])
2913 fi
2914
2915 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2916         AC_TRY_COMPILE(
2917                 [
2918 #include <sys/types.h>
2919 #include <netinet/in.h>
2920                 ],
2921                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2922                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2923                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2924         )
2925 ])
2926 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2927         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2928                 [define if you have struct sockaddr_in6 data type])
2929 fi
2930
2931 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2932         AC_TRY_COMPILE(
2933                 [
2934 #include <sys/types.h>
2935 #include <netinet/in.h>
2936                 ],
2937                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2938                 [ ac_cv_have_struct_in6_addr="yes" ],
2939                 [ ac_cv_have_struct_in6_addr="no" ]
2940         )
2941 ])
2942 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2943         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2944                 [define if you have struct in6_addr data type])
2945 fi
2946
2947 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2948         AC_TRY_COMPILE(
2949                 [
2950 #include <sys/types.h>
2951 #include <sys/socket.h>
2952 #include <netdb.h>
2953                 ],
2954                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2955                 [ ac_cv_have_struct_addrinfo="yes" ],
2956                 [ ac_cv_have_struct_addrinfo="no" ]
2957         )
2958 ])
2959 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2960         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2961                 [define if you have struct addrinfo data type])
2962 fi
2963
2964 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2965         AC_TRY_COMPILE(
2966                 [ #include <sys/time.h> ],
2967                 [ struct timeval tv; tv.tv_sec = 1;],
2968                 [ ac_cv_have_struct_timeval="yes" ],
2969                 [ ac_cv_have_struct_timeval="no" ]
2970         )
2971 ])
2972 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2973         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2974         have_struct_timeval=1
2975 fi
2976
2977 AC_CHECK_TYPES(struct timespec)
2978
2979 # We need int64_t or else certian parts of the compile will fail.
2980 if test "x$ac_cv_have_int64_t" = "xno" && \
2981         test "x$ac_cv_sizeof_long_int" != "x8" && \
2982         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2983         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2984         echo "an alternative compiler (I.E., GCC) before continuing."
2985         echo ""
2986         exit 1;
2987 else
2988 dnl test snprintf (broken on SCO w/gcc)
2989         AC_RUN_IFELSE(
2990                 [AC_LANG_SOURCE([[
2991 #include <stdio.h>
2992 #include <string.h>
2993 #ifdef HAVE_SNPRINTF
2994 main()
2995 {
2996         char buf[50];
2997         char expected_out[50];
2998         int mazsize = 50 ;
2999 #if (SIZEOF_LONG_INT == 8)
3000         long int num = 0x7fffffffffffffff;
3001 #else
3002         long long num = 0x7fffffffffffffffll;
3003 #endif
3004         strcpy(expected_out, "9223372036854775807");
3005         snprintf(buf, mazsize, "%lld", num);
3006         if(strcmp(buf, expected_out) != 0)
3007                 exit(1);
3008         exit(0);
3009 }
3010 #else
3011 main() { exit(0); }
3012 #endif
3013                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
3014                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3015         )
3016 fi
3017
3018 dnl Checks for structure members
3019 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
3020 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
3021 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
3022 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
3023 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
3024 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
3025 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
3026 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
3027 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
3028 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
3029 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
3030 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
3031 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
3032 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
3033 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
3034 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
3035 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
3036
3037 AC_CHECK_MEMBERS([struct stat.st_blksize])
3038 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
3039         [Define if we don't have struct __res_state in resolv.h])],
3040 [
3041 #include <stdio.h>
3042 #if HAVE_SYS_TYPES_H
3043 # include <sys/types.h>
3044 #endif
3045 #include <netinet/in.h>
3046 #include <arpa/nameser.h>
3047 #include <resolv.h>
3048 ])
3049
3050 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
3051                 ac_cv_have_ss_family_in_struct_ss, [
3052         AC_TRY_COMPILE(
3053                 [
3054 #include <sys/types.h>
3055 #include <sys/socket.h>
3056                 ],
3057                 [ struct sockaddr_storage s; s.ss_family = 1; ],
3058                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
3059                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
3060         )
3061 ])
3062 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3063         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
3064 fi
3065
3066 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
3067                 ac_cv_have___ss_family_in_struct_ss, [
3068         AC_TRY_COMPILE(
3069                 [
3070 #include <sys/types.h>
3071 #include <sys/socket.h>
3072                 ],
3073                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
3074                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
3075                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
3076         )
3077 ])
3078 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
3079         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
3080                 [Fields in struct sockaddr_storage])
3081 fi
3082
3083 AC_CACHE_CHECK([for pw_class field in struct passwd],
3084                 ac_cv_have_pw_class_in_struct_passwd, [
3085         AC_TRY_COMPILE(
3086                 [
3087 #include <pwd.h>
3088                 ],
3089                 [ struct passwd p; p.pw_class = 0; ],
3090                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
3091                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
3092         )
3093 ])
3094 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
3095         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
3096                 [Define if your password has a pw_class field])
3097 fi
3098
3099 AC_CACHE_CHECK([for pw_expire field in struct passwd],
3100                 ac_cv_have_pw_expire_in_struct_passwd, [
3101         AC_TRY_COMPILE(
3102                 [
3103 #include <pwd.h>
3104                 ],
3105                 [ struct passwd p; p.pw_expire = 0; ],
3106                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
3107                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
3108         )
3109 ])
3110 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
3111         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
3112                 [Define if your password has a pw_expire field])
3113 fi
3114
3115 AC_CACHE_CHECK([for pw_change field in struct passwd],
3116                 ac_cv_have_pw_change_in_struct_passwd, [
3117         AC_TRY_COMPILE(
3118                 [
3119 #include <pwd.h>
3120                 ],
3121                 [ struct passwd p; p.pw_change = 0; ],
3122                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
3123                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
3124         )
3125 ])
3126 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
3127         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
3128                 [Define if your password has a pw_change field])
3129 fi
3130
3131 dnl make sure we're using the real structure members and not defines
3132 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3133                 ac_cv_have_accrights_in_msghdr, [
3134         AC_COMPILE_IFELSE(
3135                 [
3136 #include <sys/types.h>
3137 #include <sys/socket.h>
3138 #include <sys/uio.h>
3139 int main() {
3140 #ifdef msg_accrights
3141 #error "msg_accrights is a macro"
3142 exit(1);
3143 #endif
3144 struct msghdr m;
3145 m.msg_accrights = 0;
3146 exit(0);
3147 }
3148                 ],
3149                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3150                 [ ac_cv_have_accrights_in_msghdr="no" ]
3151         )
3152 ])
3153 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3154         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
3155                 [Define if your system uses access rights style
3156                 file descriptor passing])
3157 fi
3158
3159 AC_CACHE_CHECK([for msg_control field in struct msghdr],
3160                 ac_cv_have_control_in_msghdr, [
3161         AC_COMPILE_IFELSE(
3162                 [
3163 #include <sys/types.h>
3164 #include <sys/socket.h>
3165 #include <sys/uio.h>
3166 int main() {
3167 #ifdef msg_control
3168 #error "msg_control is a macro"
3169 exit(1);
3170 #endif
3171 struct msghdr m;
3172 m.msg_control = 0;
3173 exit(0);
3174 }
3175                 ],
3176                 [ ac_cv_have_control_in_msghdr="yes" ],
3177                 [ ac_cv_have_control_in_msghdr="no" ]
3178         )
3179 ])
3180 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
3181         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3182                 [Define if your system uses ancillary data style
3183                 file descriptor passing])
3184 fi
3185
3186 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3187         AC_TRY_LINK([],
3188                 [ extern char *__progname; printf("%s", __progname); ],
3189                 [ ac_cv_libc_defines___progname="yes" ],
3190                 [ ac_cv_libc_defines___progname="no" ]
3191         )
3192 ])
3193 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3194         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3195 fi
3196
3197 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3198         AC_TRY_LINK([
3199 #include <stdio.h>
3200 ],
3201                 [ printf("%s", __FUNCTION__); ],
3202                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3203                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3204         )
3205 ])
3206 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3207         AC_DEFINE(HAVE___FUNCTION__, 1,
3208                 [Define if compiler implements __FUNCTION__])
3209 fi
3210
3211 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3212         AC_TRY_LINK([
3213 #include <stdio.h>
3214 ],
3215                 [ printf("%s", __func__); ],
3216                 [ ac_cv_cc_implements___func__="yes" ],
3217                 [ ac_cv_cc_implements___func__="no" ]
3218         )
3219 ])
3220 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3221         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3222 fi
3223
3224 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3225         AC_TRY_LINK(
3226                 [#include <stdarg.h>
3227                  va_list x,y;],
3228                 [va_copy(x,y);],
3229                 [ ac_cv_have_va_copy="yes" ],
3230                 [ ac_cv_have_va_copy="no" ]
3231         )
3232 ])
3233 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3234         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3235 fi
3236
3237 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3238         AC_TRY_LINK(
3239                 [#include <stdarg.h>
3240                  va_list x,y;],
3241                 [__va_copy(x,y);],
3242                 [ ac_cv_have___va_copy="yes" ],
3243                 [ ac_cv_have___va_copy="no" ]
3244         )
3245 ])
3246 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3247         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3248 fi
3249
3250 AC_CACHE_CHECK([whether getopt has optreset support],
3251                 ac_cv_have_getopt_optreset, [
3252         AC_TRY_LINK(
3253                 [
3254 #include <getopt.h>
3255                 ],
3256                 [ extern int optreset; optreset = 0; ],
3257                 [ ac_cv_have_getopt_optreset="yes" ],
3258                 [ ac_cv_have_getopt_optreset="no" ]
3259         )
3260 ])
3261 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3262         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3263                 [Define if your getopt(3) defines and uses optreset])
3264 fi
3265
3266 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3267         AC_TRY_LINK([],
3268                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3269                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3270                 [ ac_cv_libc_defines_sys_errlist="no" ]
3271         )
3272 ])
3273 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3274         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3275                 [Define if your system defines sys_errlist[]])
3276 fi
3277
3278
3279 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3280         AC_TRY_LINK([],
3281                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3282                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3283                 [ ac_cv_libc_defines_sys_nerr="no" ]
3284         )
3285 ])
3286 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3287         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3288 fi
3289
3290 SCARD_MSG="no"
3291 # Check whether user wants sectok support
3292 AC_ARG_WITH(sectok,
3293         [  --with-sectok           Enable smartcard support using libsectok],
3294         [
3295                 if test "x$withval" != "xno" ; then
3296                         if test "x$withval" != "xyes" ; then
3297                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3298                                 LDFLAGS="$LDFLAGS -L${withval}"
3299                                 if test ! -z "$need_dash_r" ; then
3300                                         LDFLAGS="$LDFLAGS -R${withval}"
3301                                 fi
3302                                 if test ! -z "$blibpath" ; then
3303                                         blibpath="$blibpath:${withval}"
3304                                 fi
3305                         fi
3306                         AC_CHECK_HEADERS(sectok.h)
3307                         if test "$ac_cv_header_sectok_h" != yes; then
3308                                 AC_MSG_ERROR(Can't find sectok.h)
3309                         fi
3310                         AC_CHECK_LIB(sectok, sectok_open)
3311                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3312                                 AC_MSG_ERROR(Can't find libsectok)
3313                         fi
3314                         AC_DEFINE(SMARTCARD, 1,
3315                                 [Define if you want smartcard support])
3316                         AC_DEFINE(USE_SECTOK, 1,
3317                                 [Define if you want smartcard support
3318                                 using sectok])
3319                         SCARD_MSG="yes, using sectok"
3320                 fi
3321         ]
3322 )
3323
3324 # Check whether user wants OpenSC support
3325 OPENSC_CONFIG="no"
3326 AC_ARG_WITH(opensc,
3327         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3328         [
3329             if test "x$withval" != "xno" ; then
3330                 if test "x$withval" != "xyes" ; then
3331                         OPENSC_CONFIG=$withval/bin/opensc-config
3332                 else
3333                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3334                 fi
3335                 if test "$OPENSC_CONFIG" != "no"; then
3336                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3337                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3338                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3339                         LIBS="$LIBS $LIBOPENSC_LIBS"
3340                         AC_DEFINE(SMARTCARD)
3341                         AC_DEFINE(USE_OPENSC, 1,
3342                                 [Define if you want smartcard support
3343                                 using OpenSC])
3344                         SCARD_MSG="yes, using OpenSC"
3345                 fi
3346             fi
3347         ]
3348 )
3349
3350 # Check libraries needed by DNS fingerprint support
3351 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3352         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3353                 [Define if getrrsetbyname() exists])],
3354         [
3355                 # Needed by our getrrsetbyname()
3356                 AC_SEARCH_LIBS(res_query, resolv)
3357                 AC_SEARCH_LIBS(dn_expand, resolv)
3358                 AC_MSG_CHECKING(if res_query will link)
3359                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
3360                    [AC_MSG_RESULT(no)
3361                     saved_LIBS="$LIBS"
3362                     LIBS="$LIBS -lresolv"
3363                     AC_MSG_CHECKING(for res_query in -lresolv)
3364                     AC_LINK_IFELSE([
3365 #include <resolv.h>
3366 int main()
3367 {
3368         res_query (0, 0, 0, 0, 0);
3369         return 0;
3370 }
3371                         ],
3372                         [LIBS="$LIBS -lresolv"
3373                          AC_MSG_RESULT(yes)],
3374                         [LIBS="$saved_LIBS"
3375                          AC_MSG_RESULT(no)])
3376                     ])
3377                 AC_CHECK_FUNCS(_getshort _getlong)
3378                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3379                     [#include <sys/types.h>
3380                     #include <arpa/nameser.h>])
3381                 AC_CHECK_MEMBER(HEADER.ad,
3382                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3383                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3384                         [#include <arpa/nameser.h>])
3385         ])
3386
3387 AC_MSG_CHECKING(if struct __res_state _res is an extern)
3388 AC_LINK_IFELSE([
3389 #include <stdio.h>
3390 #if HAVE_SYS_TYPES_H
3391 # include <sys/types.h>
3392 #endif
3393 #include <netinet/in.h>
3394 #include <arpa/nameser.h>
3395 #include <resolv.h>
3396 extern struct __res_state _res;
3397 int main() { return 0; }
3398                 ],
3399                 [AC_MSG_RESULT(yes)
3400                  AC_DEFINE(HAVE__RES_EXTERN, 1,
3401                     [Define if you have struct __res_state _res as an extern])
3402                 ],
3403                 [ AC_MSG_RESULT(no) ]
3404 )
3405
3406 # Check whether user wants SELinux support
3407 SELINUX_MSG="no"
3408 LIBSELINUX=""
3409 AC_ARG_WITH(selinux,
3410         [  --with-selinux          Enable SELinux support],
3411         [ if test "x$withval" != "xno" ; then
3412                 save_LIBS="$LIBS"
3413                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3414                 SELINUX_MSG="yes"
3415                 AC_CHECK_HEADER([selinux/selinux.h], ,
3416                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3417                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3418                     AC_MSG_ERROR(SELinux support requires libselinux library))
3419                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
3420                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3421                 LIBS="$save_LIBS"
3422         fi ]
3423 )
3424
3425 # Check whether the user wants GSSAPI mechglue support
3426 AC_ARG_WITH(mechglue,
3427         [  --with-mechglue=PATH    Build with GSSAPI mechglue library],
3428         [
3429                 AC_MSG_CHECKING(for mechglue library)
3430
3431                 if test -e ${withval}/libgssapi.a ; then
3432                     mechglue_lib=${withval}/libgssapi.a
3433                 elif test -e ${withval}/lib/libgssapi.a ; then
3434                     mechglue_lib=${withval}/lib/libgssapi.a
3435                 else
3436                     AC_MSG_ERROR("Can't find libgssapi in ${withval}");
3437                 fi
3438                 LIBS="${mechglue_lib} $LIBS"
3439                 AC_MSG_RESULT(${mechglue_lib})
3440
3441                 AC_CHECK_LIB(dl, dlopen, , )
3442                 if test $ac_cv_lib_dl_dlopen = yes; then
3443                    LDFLAGS="$LDFLAGS -ldl -Wl,-Bsymbolic"
3444                 fi
3445
3446                 AC_DEFINE(GSSAPI)
3447                 AC_DEFINE(MECHGLUE, 1, [Define this if you're building with GSSAPI MechGlue.])
3448                 GSSAPI="mechglue"
3449         ]
3450 )
3451
3452
3453 # Check whether user wants Kerberos 5 support
3454 KRB5_MSG="no"
3455 AC_ARG_WITH(kerberos5,
3456         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3457         [ if test "x$withval" != "xno" ; then
3458                 if test "x$withval" = "xyes" ; then
3459                         KRB5ROOT="/usr/local"
3460                 else
3461                         KRB5ROOT=${withval}
3462                 fi
3463
3464                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3465                 KRB5_MSG="yes"
3466
3467                 AC_MSG_CHECKING(for krb5-config)
3468                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3469                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3470                         AC_MSG_RESULT($KRB5CONF)
3471
3472                         AC_MSG_CHECKING(for gssapi support)
3473                         if $KRB5CONF | grep gssapi >/dev/null ; then
3474                                 AC_MSG_RESULT(yes)
3475                                 AC_DEFINE(GSSAPI, 1,
3476                                         [Define this if you want GSSAPI
3477                                         support in the version 2 protocol])
3478                                 k5confopts=gssapi
3479                         else
3480                                 AC_MSG_RESULT(no)
3481                                 k5confopts=""
3482                         fi
3483                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3484                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3485                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3486                         AC_MSG_CHECKING(whether we are using Heimdal)
3487                         AC_TRY_COMPILE([ #include <krb5.h> ],
3488                                        [ char *tmp = heimdal_version; ],
3489                                        [ AC_MSG_RESULT(yes)
3490                                          AC_DEFINE(HEIMDAL, 1,
3491                                         [Define this if you are using the
3492                                         Heimdal version of Kerberos V5]) ],
3493                                          AC_MSG_RESULT(no)
3494                         )
3495                 else
3496                         AC_MSG_RESULT(no)
3497                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3498                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3499                         AC_MSG_CHECKING(whether we are using Heimdal)
3500                         AC_TRY_COMPILE([ #include <krb5.h> ],
3501                                        [ char *tmp = heimdal_version; ],
3502                                        [ AC_MSG_RESULT(yes)
3503                                          AC_DEFINE(HEIMDAL)
3504                                          K5LIBS="-lkrb5 -ldes"
3505                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3506                                          AC_CHECK_LIB(roken, net_write,
3507                                            [K5LIBS="$K5LIBS -lroken"])
3508                                        ],
3509                                        [ AC_MSG_RESULT(no)
3510                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3511                                        ]
3512                         )
3513                         AC_SEARCH_LIBS(dn_expand, resolv)
3514
3515                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
3516                                 [ AC_DEFINE(GSSAPI)
3517                                   K5LIBS="-lgssapi $K5LIBS" ],
3518                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
3519                                         [ AC_DEFINE(GSSAPI)
3520                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3521                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3522                                         $K5LIBS)
3523                                 ],
3524                                 $K5LIBS)
3525
3526                         AC_CHECK_HEADER(gssapi.h, ,
3527                                 [ unset ac_cv_header_gssapi_h
3528                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3529                                   AC_CHECK_HEADERS(gssapi.h, ,
3530                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3531                                   )
3532                                 ]
3533                         )
3534
3535                         oldCPP="$CPPFLAGS"
3536                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3537                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3538                                         [ CPPFLAGS="$oldCPP" ])
3539
3540                         # If we're using some other GSSAPI
3541                         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
3542                                 AC_MSG_ERROR([$GSSAPI GSSAPI library conflicts with Kerberos support.  Use mechglue instead.])
3543                         fi
3544
3545                         if test -z "$GSSAPI"; then
3546                                 GSSAPI="KRB5";
3547                         fi
3548
3549                         oldCPP="$CPPFLAGS"
3550                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3551                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3552                                         [ CPPFLAGS="$oldCPP" ])
3553
3554                 fi
3555                 if test ! -z "$need_dash_r" ; then
3556                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3557                 fi
3558                 if test ! -z "$blibpath" ; then
3559                         blibpath="$blibpath:${KRB5ROOT}/lib"
3560                 fi
3561
3562                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3563                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3564                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3565
3566                 LIBS="$LIBS $K5LIBS"
3567                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3568                         [Define this if you want to use libkafs' AFS support]))
3569         fi
3570         ]
3571 )
3572
3573 # Check whether user wants AFS_KRB5 support
3574 AFS_KRB5_MSG="no"
3575 AC_ARG_WITH(afs-krb5,
3576         [  --with-afs-krb5[[=AKLOG_PATH]]  Enable aklog to get token (default=/usr/bin/aklog).],
3577         [
3578                 if test "x$withval" != "xno" ; then
3579
3580                         if test "x$withval" != "xyes" ; then
3581                                 AC_DEFINE_UNQUOTED(AKLOG_PATH, "$withval",
3582                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3583                         else
3584                                 AC_DEFINE_UNQUOTED(AKLOG_PATH,
3585                                         "/usr/bin/aklog",
3586                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3587                         fi
3588
3589                         if test -z "$KRB5ROOT" ; then
3590                                 AC_MSG_WARN([AFS_KRB5 requires Kerberos 5 support, build may fail])
3591                         fi
3592
3593                         LIBS="-lkrbafs -lkrb4 $LIBS"
3594                         if test ! -z "$AFS_LIBS" ; then
3595                                 LIBS="$LIBS $AFS_LIBS"
3596                         fi
3597                         AC_DEFINE(AFS_KRB5, 1,
3598                                 [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3599                         AFS_KRB5_MSG="yes"
3600                 fi
3601         ]
3602 )
3603
3604 AC_ARG_WITH(session-hooks,
3605         [  --with-session-hooks    Enable hooks for executing external commands                                       before/after a session],
3606         [ AC_DEFINE(SESSION_HOOKS, 1, [Define this if you want support for startup/shutdown hooks]) ]
3607 )
3608
3609 # Looking for programs, paths and files
3610
3611 PRIVSEP_PATH=/var/empty
3612 AC_ARG_WITH(privsep-path,
3613         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3614         [
3615                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3616                     test "x${withval}" != "xyes"; then
3617                         PRIVSEP_PATH=$withval
3618                 fi
3619         ]
3620 )
3621 AC_SUBST(PRIVSEP_PATH)
3622
3623 AC_ARG_WITH(xauth,
3624         [  --with-xauth=PATH       Specify path to xauth program ],
3625         [
3626                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3627                     test "x${withval}" != "xyes"; then
3628                         xauth_path=$withval
3629                 fi
3630         ],
3631         [
3632                 TestPath="$PATH"
3633                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3634                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3635                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3636                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3637                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3638                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3639                         xauth_path="/usr/openwin/bin/xauth"
3640                 fi
3641         ]
3642 )
3643
3644 STRIP_OPT=-s
3645 AC_ARG_ENABLE(strip,
3646         [  --disable-strip         Disable calling strip(1) on install],
3647         [
3648                 if test "x$enableval" = "xno" ; then
3649                         STRIP_OPT=
3650                 fi
3651         ]
3652 )
3653 AC_SUBST(STRIP_OPT)
3654
3655 if test -z "$xauth_path" ; then
3656         XAUTH_PATH="undefined"
3657         AC_SUBST(XAUTH_PATH)
3658 else
3659         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3660                 [Define if xauth is found in your path])
3661         XAUTH_PATH=$xauth_path
3662         AC_SUBST(XAUTH_PATH)
3663 fi
3664
3665 # Check for mail directory (last resort if we cannot get it from headers)
3666 if test ! -z "$MAIL" ; then
3667         maildir=`dirname $MAIL`
3668         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3669                 [Set this to your mail directory if you don't have maillock.h])
3670 fi
3671
3672 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3673         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3674         disable_ptmx_check=yes
3675 fi
3676 if test -z "$no_dev_ptmx" ; then
3677         if test "x$disable_ptmx_check" != "xyes" ; then
3678                 AC_CHECK_FILE("/dev/ptmx",
3679                         [
3680                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3681                                         [Define if you have /dev/ptmx])
3682                                 have_dev_ptmx=1
3683                         ]
3684                 )
3685         fi
3686 fi
3687
3688 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3689         AC_CHECK_FILE("/dev/ptc",
3690                 [
3691                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3692                                 [Define if you have /dev/ptc])
3693                         have_dev_ptc=1
3694                 ]
3695         )
3696 else
3697         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3698 fi
3699
3700 # Options from here on. Some of these are preset by platform above
3701 AC_ARG_WITH(mantype,
3702         [  --with-mantype=man|cat|doc  Set man page type],
3703         [
3704                 case "$withval" in
3705                 man|cat|doc)
3706                         MANTYPE=$withval
3707                         ;;
3708                 *)
3709                         AC_MSG_ERROR(invalid man type: $withval)
3710                         ;;
3711                 esac
3712         ]
3713 )
3714 if test -z "$MANTYPE"; then
3715         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3716         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3717         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3718                 MANTYPE=doc
3719         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3720                 MANTYPE=man
3721         else
3722                 MANTYPE=cat
3723         fi
3724 fi
3725 AC_SUBST(MANTYPE)
3726 if test "$MANTYPE" = "doc"; then
3727         mansubdir=man;
3728 else
3729         mansubdir=$MANTYPE;
3730 fi
3731 AC_SUBST(mansubdir)
3732
3733 # Check whether to enable MD5 passwords
3734 MD5_MSG="no"
3735 AC_ARG_WITH(md5-passwords,
3736         [  --with-md5-passwords    Enable use of MD5 passwords],
3737         [
3738                 if test "x$withval" != "xno" ; then
3739                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3740                                 [Define if you want to allow MD5 passwords])
3741                         MD5_MSG="yes"
3742                 fi
3743         ]
3744 )
3745
3746 # Whether to disable shadow password support
3747 AC_ARG_WITH(shadow,
3748         [  --without-shadow        Disable shadow password support],
3749         [
3750                 if test "x$withval" = "xno" ; then
3751                         AC_DEFINE(DISABLE_SHADOW)
3752                         disable_shadow=yes
3753                 fi
3754         ]
3755 )
3756
3757 if test -z "$disable_shadow" ; then
3758         AC_MSG_CHECKING([if the systems has expire shadow information])
3759         AC_TRY_COMPILE(
3760         [
3761 #include <sys/types.h>
3762 #include <shadow.h>
3763         struct spwd sp;
3764         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3765         [ sp_expire_available=yes ], []
3766         )
3767
3768         if test "x$sp_expire_available" = "xyes" ; then
3769                 AC_MSG_RESULT(yes)
3770                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3771                     [Define if you want to use shadow password expire field])
3772         else
3773                 AC_MSG_RESULT(no)
3774         fi
3775 fi
3776
3777 # Use ip address instead of hostname in $DISPLAY
3778 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3779         DISPLAY_HACK_MSG="yes"
3780         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3781                 [Define if you need to use IP address
3782                 instead of hostname in $DISPLAY])
3783 else
3784         DISPLAY_HACK_MSG="no"
3785         AC_ARG_WITH(ipaddr-display,
3786                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3787                 [
3788                         if test "x$withval" != "xno" ; then
3789                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3790                                 DISPLAY_HACK_MSG="yes"
3791                         fi
3792                 ]
3793         )
3794 fi
3795
3796 # check for /etc/default/login and use it if present.
3797 AC_ARG_ENABLE(etc-default-login,
3798         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3799         [ if test "x$enableval" = "xno"; then
3800                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3801                 etc_default_login=no
3802           else
3803                 etc_default_login=yes
3804           fi ],
3805         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3806           then
3807                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3808                 etc_default_login=no
3809           else
3810                 etc_default_login=yes
3811           fi ]
3812 )
3813
3814 if test "x$etc_default_login" != "xno"; then
3815         AC_CHECK_FILE("/etc/default/login",
3816             [ external_path_file=/etc/default/login ])
3817         if test "x$external_path_file" = "x/etc/default/login"; then
3818                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3819                         [Define if your system has /etc/default/login])
3820         fi
3821 fi
3822
3823 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3824 if test $ac_cv_func_login_getcapbool = "yes" && \
3825         test $ac_cv_header_login_cap_h = "yes" ; then
3826         external_path_file=/etc/login.conf
3827 fi
3828
3829 # Whether to mess with the default path
3830 SERVER_PATH_MSG="(default)"
3831 AC_ARG_WITH(default-path,
3832         [  --with-default-path=    Specify default \$PATH environment for server],
3833         [
3834                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3835                         AC_MSG_WARN([
3836 --with-default-path=PATH has no effect on this system.
3837 Edit /etc/login.conf instead.])
3838                 elif test "x$withval" != "xno" ; then
3839                         if test ! -z "$external_path_file" ; then
3840                                 AC_MSG_WARN([
3841 --with-default-path=PATH will only be used if PATH is not defined in
3842 $external_path_file .])
3843                         fi
3844                         user_path="$withval"
3845                         SERVER_PATH_MSG="$withval"
3846                 fi
3847         ],
3848         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3849                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3850         else
3851                 if test ! -z "$external_path_file" ; then
3852                         AC_MSG_WARN([
3853 If PATH is defined in $external_path_file, ensure the path to scp is included,
3854 otherwise scp will not work.])
3855                 fi
3856                 AC_RUN_IFELSE(
3857                         [AC_LANG_SOURCE([[
3858 /* find out what STDPATH is */
3859 #include <stdio.h>
3860 #ifdef HAVE_PATHS_H
3861 # include <paths.h>
3862 #endif
3863 #ifndef _PATH_STDPATH
3864 # ifdef _PATH_USERPATH  /* Irix */
3865 #  define _PATH_STDPATH _PATH_USERPATH
3866 # else
3867 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3868 # endif
3869 #endif
3870 #include <sys/types.h>
3871 #include <sys/stat.h>
3872 #include <fcntl.h>
3873 #define DATA "conftest.stdpath"
3874
3875 main()
3876 {
3877         FILE *fd;
3878         int rc;
3879
3880         fd = fopen(DATA,"w");
3881         if(fd == NULL)
3882                 exit(1);
3883
3884         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3885                 exit(1);
3886
3887         exit(0);
3888 }
3889                 ]])],
3890                 [ user_path=`cat conftest.stdpath` ],
3891                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3892                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3893         )
3894 # make sure $bindir is in USER_PATH so scp will work
3895                 t_bindir=`eval echo ${bindir}`
3896                 case $t_bindir in
3897                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3898                 esac
3899                 case $t_bindir in
3900                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3901                 esac
3902                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3903                 if test $? -ne 0  ; then
3904                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3905                         if test $? -ne 0  ; then
3906                                 user_path=$user_path:$t_bindir
3907                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3908                         fi
3909                 fi
3910         fi ]
3911 )
3912 if test "x$external_path_file" != "x/etc/login.conf" ; then
3913         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3914         AC_SUBST(user_path)
3915 fi
3916
3917 # Set superuser path separately to user path
3918 AC_ARG_WITH(superuser-path,
3919         [  --with-superuser-path=  Specify different path for super-user],
3920         [
3921                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3922                     test "x${withval}" != "xyes"; then
3923                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3924                                 [Define if you want a different $PATH
3925                                 for the superuser])
3926                         superuser_path=$withval
3927                 fi
3928         ]
3929 )
3930
3931
3932 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3933 IPV4_IN6_HACK_MSG="no"
3934 AC_ARG_WITH(4in6,
3935         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3936         [
3937                 if test "x$withval" != "xno" ; then
3938                         AC_MSG_RESULT(yes)
3939                         AC_DEFINE(IPV4_IN_IPV6, 1,
3940                                 [Detect IPv4 in IPv6 mapped addresses
3941                                 and treat as IPv4])
3942                         IPV4_IN6_HACK_MSG="yes"
3943                 else
3944                         AC_MSG_RESULT(no)
3945                 fi
3946         ],[
3947                 if test "x$inet6_default_4in6" = "xyes"; then
3948                         AC_MSG_RESULT([yes (default)])
3949                         AC_DEFINE(IPV4_IN_IPV6)
3950                         IPV4_IN6_HACK_MSG="yes"
3951                 else
3952                         AC_MSG_RESULT([no (default)])
3953                 fi
3954         ]
3955 )
3956
3957 # Whether to enable BSD auth support
3958 BSD_AUTH_MSG=no
3959 AC_ARG_WITH(bsd-auth,
3960         [  --with-bsd-auth         Enable BSD auth support],
3961         [
3962                 if test "x$withval" != "xno" ; then
3963                         AC_DEFINE(BSD_AUTH, 1,
3964                                 [Define if you have BSD auth support])
3965                         BSD_AUTH_MSG=yes
3966                 fi
3967         ]
3968 )
3969
3970 # Where to place sshd.pid
3971 piddir=/var/run
3972 # make sure the directory exists
3973 if test ! -d $piddir ; then
3974         piddir=`eval echo ${sysconfdir}`
3975         case $piddir in
3976                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3977         esac
3978 fi
3979
3980 AC_ARG_WITH(pid-dir,
3981         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3982         [
3983                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3984                     test "x${withval}" != "xyes"; then
3985                         piddir=$withval
3986                         if test ! -d $piddir ; then
3987                         AC_MSG_WARN([** no $piddir directory on this system **])
3988                         fi
3989                 fi
3990         ]
3991 )
3992
3993 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3994 AC_SUBST(piddir)
3995
3996 dnl allow user to disable some login recording features
3997 AC_ARG_ENABLE(lastlog,
3998         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3999         [
4000                 if test "x$enableval" = "xno" ; then
4001                         AC_DEFINE(DISABLE_LASTLOG)
4002                 fi
4003         ]
4004 )
4005 AC_ARG_ENABLE(utmp,
4006         [  --disable-utmp          disable use of utmp even if detected [no]],
4007         [
4008                 if test "x$enableval" = "xno" ; then
4009                         AC_DEFINE(DISABLE_UTMP)
4010                 fi
4011         ]
4012 )
4013 AC_ARG_ENABLE(utmpx,
4014         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4015         [
4016                 if test "x$enableval" = "xno" ; then
4017                         AC_DEFINE(DISABLE_UTMPX, 1,
4018                                 [Define if you don't want to use utmpx])
4019                 fi
4020         ]
4021 )
4022 AC_ARG_ENABLE(wtmp,
4023         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4024         [
4025                 if test "x$enableval" = "xno" ; then
4026                         AC_DEFINE(DISABLE_WTMP)
4027                 fi
4028         ]
4029 )
4030 AC_ARG_ENABLE(wtmpx,
4031         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4032         [
4033                 if test "x$enableval" = "xno" ; then
4034                         AC_DEFINE(DISABLE_WTMPX, 1,
4035                                 [Define if you don't want to use wtmpx])
4036                 fi
4037         ]
4038 )
4039 AC_ARG_ENABLE(libutil,
4040         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4041         [
4042                 if test "x$enableval" = "xno" ; then
4043                         AC_DEFINE(DISABLE_LOGIN)
4044                 fi
4045         ]
4046 )
4047 AC_ARG_ENABLE(pututline,
4048         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4049         [
4050                 if test "x$enableval" = "xno" ; then
4051                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
4052                                 [Define if you don't want to use pututline()
4053                                 etc. to write [uw]tmp])
4054                 fi
4055         ]
4056 )
4057 AC_ARG_ENABLE(pututxline,
4058         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4059         [
4060                 if test "x$enableval" = "xno" ; then
4061                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
4062                                 [Define if you don't want to use pututxline()
4063                                 etc. to write [uw]tmpx])
4064                 fi
4065         ]
4066 )
4067 AC_ARG_WITH(lastlog,
4068   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4069         [
4070                 if test "x$withval" = "xno" ; then
4071                         AC_DEFINE(DISABLE_LASTLOG)
4072                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4073                         conf_lastlog_location=$withval
4074                 fi
4075         ]
4076 )
4077
4078 dnl lastlog, [uw]tmpx? detection
4079 dnl  NOTE: set the paths in the platform section to avoid the
4080 dnl   need for command-line parameters
4081 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4082
4083 dnl lastlog detection
4084 dnl  NOTE: the code itself will detect if lastlog is a directory
4085 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4086 AC_TRY_COMPILE([
4087 #include <sys/types.h>
4088 #include <utmp.h>
4089 #ifdef HAVE_LASTLOG_H
4090 #  include <lastlog.h>
4091 #endif
4092 #ifdef HAVE_PATHS_H
4093 #  include <paths.h>
4094 #endif
4095 #ifdef HAVE_LOGIN_H
4096 # include <login.h>
4097 #endif
4098         ],
4099         [ char *lastlog = LASTLOG_FILE; ],
4100         [ AC_MSG_RESULT(yes) ],
4101         [
4102                 AC_MSG_RESULT(no)
4103                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4104                 AC_TRY_COMPILE([
4105 #include <sys/types.h>
4106 #include <utmp.h>
4107 #ifdef HAVE_LASTLOG_H
4108 #  include <lastlog.h>
4109 #endif
4110 #ifdef HAVE_PATHS_H
4111 #  include <paths.h>
4112 #endif
4113                 ],
4114                 [ char *lastlog = _PATH_LASTLOG; ],
4115                 [ AC_MSG_RESULT(yes) ],
4116                 [
4117                         AC_MSG_RESULT(no)
4118                         system_lastlog_path=no
4119                 ])
4120         ]
4121 )
4122
4123 if test -z "$conf_lastlog_location"; then
4124         if test x"$system_lastlog_path" = x"no" ; then
4125                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
4126                                 if (test -d "$f" || test -f "$f") ; then
4127                                         conf_lastlog_location=$f
4128                                 fi
4129                 done
4130                 if test -z "$conf_lastlog_location"; then
4131                         AC_MSG_WARN([** Cannot find lastlog **])
4132                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4133                 fi
4134         fi
4135 fi
4136
4137 if test -n "$conf_lastlog_location"; then
4138         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
4139                 [Define if you want to specify the path to your lastlog file])
4140 fi
4141
4142 dnl utmp detection
4143 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4144 AC_TRY_COMPILE([
4145 #include <sys/types.h>
4146 #include <utmp.h>
4147 #ifdef HAVE_PATHS_H
4148 #  include <paths.h>
4149 #endif
4150         ],
4151         [ char *utmp = UTMP_FILE; ],
4152         [ AC_MSG_RESULT(yes) ],
4153         [ AC_MSG_RESULT(no)
4154           system_utmp_path=no ]
4155 )
4156 if test -z "$conf_utmp_location"; then
4157         if test x"$system_utmp_path" = x"no" ; then
4158                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
4159                         if test -f $f ; then
4160                                 conf_utmp_location=$f
4161                         fi
4162                 done
4163                 if test -z "$conf_utmp_location"; then
4164                         AC_DEFINE(DISABLE_UTMP)
4165                 fi
4166         fi
4167 fi
4168 if test -n "$conf_utmp_location"; then
4169         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
4170                 [Define if you want to specify the path to your utmp file])
4171 fi
4172
4173 dnl wtmp detection
4174 AC_MSG_CHECKING([if your system defines WTMP_FILE])
4175 AC_TRY_COMPILE([
4176 #include <sys/types.h>
4177 #include <utmp.h>
4178 #ifdef HAVE_PATHS_H
4179 #  include <paths.h>
4180 #endif
4181         ],
4182         [ char *wtmp = WTMP_FILE; ],
4183         [ AC_MSG_RESULT(yes) ],
4184         [ AC_MSG_RESULT(no)
4185           system_wtmp_path=no ]
4186 )
4187 if test -z "$conf_wtmp_location"; then
4188         if test x"$system_wtmp_path" = x"no" ; then
4189                 for f in /usr/adm/wtmp /var/log/wtmp; do
4190                         if test -f $f ; then
4191                                 conf_wtmp_location=$f
4192                         fi
4193                 done
4194                 if test -z "$conf_wtmp_location"; then
4195                         AC_DEFINE(DISABLE_WTMP)
4196                 fi
4197         fi
4198 fi
4199 if test -n "$conf_wtmp_location"; then
4200         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
4201                 [Define if you want to specify the path to your wtmp file])
4202 fi
4203
4204
4205 dnl utmpx detection - I don't know any system so perverse as to require
4206 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
4207 dnl  there, though.
4208 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
4209 AC_TRY_COMPILE([
4210 #include <sys/types.h>
4211 #include <utmp.h>
4212 #ifdef HAVE_UTMPX_H
4213 #include <utmpx.h>
4214 #endif
4215 #ifdef HAVE_PATHS_H
4216 #  include <paths.h>
4217 #endif
4218         ],
4219         [ char *utmpx = UTMPX_FILE; ],
4220         [ AC_MSG_RESULT(yes) ],
4221         [ AC_MSG_RESULT(no)
4222           system_utmpx_path=no ]
4223 )
4224 if test -z "$conf_utmpx_location"; then
4225         if test x"$system_utmpx_path" = x"no" ; then
4226                 AC_DEFINE(DISABLE_UTMPX)
4227         fi
4228 else
4229         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
4230                 [Define if you want to specify the path to your utmpx file])
4231 fi
4232
4233 dnl wtmpx detection
4234 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
4235 AC_TRY_COMPILE([
4236 #include <sys/types.h>
4237 #include <utmp.h>
4238 #ifdef HAVE_UTMPX_H
4239 #include <utmpx.h>
4240 #endif
4241 #ifdef HAVE_PATHS_H
4242 #  include <paths.h>
4243 #endif
4244         ],
4245         [ char *wtmpx = WTMPX_FILE; ],
4246         [ AC_MSG_RESULT(yes) ],
4247         [ AC_MSG_RESULT(no)
4248           system_wtmpx_path=no ]
4249 )
4250 if test -z "$conf_wtmpx_location"; then
4251         if test x"$system_wtmpx_path" = x"no" ; then
4252                 AC_DEFINE(DISABLE_WTMPX)
4253         fi
4254 else
4255         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
4256                 [Define if you want to specify the path to your wtmpx file])
4257 fi
4258
4259
4260 if test ! -z "$blibpath" ; then
4261         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4262         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4263 fi
4264
4265 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4266 dnl Add now.
4267 CFLAGS="$CFLAGS $werror_flags"
4268
4269 AC_EXEEXT
4270 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4271         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4272         scard/Makefile ssh_prng_cmds survey.sh])
4273 AC_OUTPUT
4274
4275 # Print summary of options
4276
4277 # Someone please show me a better way :)
4278 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4279 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4280 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4281 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4282 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4283 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4284 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
4285 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4286 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4287 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4288
4289 echo ""
4290 echo "OpenSSH has been configured with the following options:"
4291 echo "                     User binaries: $B"
4292 echo "                   System binaries: $C"
4293 echo "               Configuration files: $D"
4294 echo "                   Askpass program: $E"
4295 echo "                      Manual pages: $F"
4296 echo "                          PID file: $G"
4297 echo "  Privilege separation chroot path: $H"
4298 if test "x$external_path_file" = "x/etc/login.conf" ; then
4299 echo "   At runtime, sshd will use the path defined in $external_path_file"
4300 echo "   Make sure the path to scp is present, otherwise scp will not work"
4301 else
4302 echo "            sshd default user PATH: $I"
4303         if test ! -z "$external_path_file"; then
4304 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4305 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4306         fi
4307 fi
4308 if test ! -z "$superuser_path" ; then
4309 echo "          sshd superuser user PATH: $J"
4310 fi
4311 echo "                    Manpage format: $MANTYPE"
4312 echo "                       PAM support: $PAM_MSG"
4313 echo "                   OSF SIA support: $SIA_MSG"
4314 echo "                 KerberosV support: $KRB5_MSG"
4315 echo "                   SELinux support: $SELINUX_MSG"
4316 echo "                 Smartcard support: $SCARD_MSG"
4317 echo "                     S/KEY support: $SKEY_MSG"
4318 echo "              TCP Wrappers support: $TCPW_MSG"
4319 echo "              MD5 password support: $MD5_MSG"
4320 echo "                   libedit support: $LIBEDIT_MSG"
4321 echo "  Solaris process contract support: $SPC_MSG"
4322 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4323 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4324 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4325 echo "              Random number source: $RAND_MSG"
4326 if test ! -z "$USE_RAND_HELPER" ; then
4327 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4328 fi
4329
4330 echo ""
4331
4332 echo "              Host: ${host}"
4333 echo "          Compiler: ${CC}"
4334 echo "    Compiler flags: ${CFLAGS}"
4335 echo "Preprocessor flags: ${CPPFLAGS}"
4336 echo "      Linker flags: ${LDFLAGS}"
4337 echo "         Libraries: ${LIBS}"
4338 if test ! -z "${SSHDLIBS}"; then
4339 echo "         +for sshd: ${SSHDLIBS}"
4340 fi
4341
4342 echo ""
4343
4344 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4345         echo "SVR4 style packages are supported with \"make package\""
4346         echo ""
4347 fi
4348
4349 if test "x$PAM_MSG" = "xyes" ; then
4350         echo "PAM is enabled. You may need to install a PAM control file "
4351         echo "for sshd, otherwise password authentication may fail. "
4352         echo "Example PAM control files can be found in the contrib/ "
4353         echo "subdirectory"
4354         echo ""
4355 fi
4356
4357 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4358         echo "WARNING: you are using the builtin random number collection "
4359         echo "service. Please read WARNING.RNG and request that your OS "
4360         echo "vendor includes kernel-based random number collection in "
4361         echo "future versions of your OS."
4362         echo ""
4363 fi
4364
4365 if test ! -z "$NO_PEERCHECK" ; then
4366         echo "WARNING: the operating system that you are using does not"
4367         echo "appear to support getpeereid(), getpeerucred() or the"
4368         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
4369         echo "enforce security checks to prevent unauthorised connections to"
4370         echo "ssh-agent. Their absence increases the risk that a malicious"
4371         echo "user can connect to your agent."
4372         echo ""
4373 fi
4374
4375 if test "$AUDIT_MODULE" = "bsm" ; then
4376         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4377         echo "See the Solaris section in README.platform for details."
4378 fi