openssh/configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22
  23 # Handle Globus configuration right away, because the Globus flavor
  24 # determines our compiler options.
  25
  26 # Check whether the user wants GSI (Globus) support
  27 gsi_path="no"
  28 AC_ARG_WITH(gsi,
  29         [  --with-gsi              Enable Globus GSI authentication support],
  30         [
  31                 gsi_path="$withval"
  32         ]
  33 )
  34
  35 AC_ARG_WITH(globus,
  36         [  --with-globus           Enable Globus GSI authentication support],
  37         [
  38                 gsi_path="$withval"
  39         ]
  40 )
  41
  42 AC_ARG_WITH(globus-static,
  43         [  --with-globus-static    Link statically with Globus GSI libraries],
  44         [
  45                 gsi_static="-static"
  46                 if test "x$gsi_path" = "xno" ; then
  47                         gsi_path="$withval"
  48                 fi
  49         ]
  50 )
  51
  52 # Check whether the user has a Globus flavor type
  53 globus_flavor_type="no"
  54 AC_ARG_WITH(globus-flavor,
  55         [  --with-globus-flavor=TYPE  Specify Globus flavor type (ex: gcc32dbg)],
  56         [
  57                 globus_flavor_type="$withval"
  58                 if test "x$gsi_path" = "xno" ; then
  59                         gsi_path="yes"
  60                 fi
  61         ]
  62 )
  63
  64 if test "x$gsi_path" != "xno" ; then
  65         # Globus GSSAPI configuration
  66         AC_MSG_CHECKING(for Globus GSI)
  67         AC_DEFINE(GSI, 1, [Define if you want GSI/Globus authentication support.])
  68
  69         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
  70                 AC_MSG_ERROR([Previously configured GSSAPI library conflicts with Globus GSI.])
  71         fi
  72         if test -z "$GSSAPI"; then
  73                 AC_DEFINE(GSSAPI)
  74                 GSSAPI="GSI"
  75         fi
  76
  77         if test "x$gsi_path" = "xyes" ; then
  78                 if test -z "$GLOBUS_LOCATION" ; then
  79                         AC_MSG_ERROR(GLOBUS_LOCATION environment variable must be set.)
  80                 else
  81                         gsi_path="$GLOBUS_LOCATION"
  82                 fi
  83         fi
  84         GLOBUS_LOCATION="$gsi_path"
  85         export GLOBUS_LOCATION
  86         if test ! -d "$GLOBUS_LOCATION" ; then
  87                 AC_MSG_ERROR(Cannot find Globus installation.  Set GLOBUS_LOCATION environment variable.)
  88         fi
  89
  90         if test "x$globus_flavor_type" = "xno" ; then
  91                 AC_MSG_ERROR(--with-globus-flavor=TYPE must be specified)
  92         fi
  93         if test "x$globus_flavor_type" = "xyes" ; then
  94                 AC_MSG_ERROR(--with-globus-flavor=TYPE must specify a flavor type)
  95         fi
  96
  97         GLOBUS_INCLUDE="${gsi_path}/include/${globus_flavor_type}"
  98         if test ! -d "$GLOBUS_INCLUDE" ; then
  99                 AC_MSG_ERROR(Cannot find Globus flavor-specific include directory: ${GLOBUS_INCLUDE})
 100         fi
 101
 102         if test -x ${gsi_path}/bin/globus-makefile-header ; then
 103                 ${gsi_path}/bin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | sed 's/ = \(.*\)/="\1"/' > ./gpt_build_tmp.sh
 104         elif test -x ${gsi_path}/sbin/globus-makefile-header ; then
 105                 ${gsi_path}/sbin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | sed 's/ = \(.*\)/="\1"/' > ./gpt_build_tmp.sh
 106         else
 107                 AC_MSG_ERROR(Cannot find globus-makefile-header: Globus installation is incomplete)
 108         fi
 109         . ./gpt_build_tmp.sh
 110         if test -z "$GLOBUS_PKG_LIBS" ; then
 111                 AC_MSG_ERROR(globus-makefile-header failed)
 112         fi
 113
 114         AC_DEFINE(HAVE_GSSAPI_H)
 115
 116     CC="$GLOBUS_CC"
 117     CFLAGS="$GLOBUS_CFLAGS"
 118     CPP="$GLOBUS_CPP"
 119         CPPFLAGS="$GLOBUS_CPPFLAGS $GLOBUS_INCLUDES"
 120         LIBS="$LIBS $GLOBUS_LIBS $GLOBUS_PKG_LIBS"
 121     LD="$GLOBUS_LD"
 122         LDFLAGS="$LDFLAGS $GLOBUS_LDFLAGS"
 123
 124         # test that we got the libraries OK
 125         AC_TRY_LINK(
 126                 [],
 127                 [],
 128                 [
 129                         AC_MSG_RESULT(yes)
 130                 ],
 131                 [
 132                         AC_MSG_ERROR(link with Globus libraries failed)
 133                 ]
 134         )
 135     AC_CHECK_FUNCS(globus_gss_assist_map_and_authorize)
 136         INSTALL_GSISSH="yes"
 137 else
 138         INSTALL_GSISSH=""
 139 fi
 140 AC_SUBST(INSTALL_GSISSH)
 141 # End Globus/GSI section
 142
 143 AC_PROG_CC
 144 AC_CANONICAL_HOST
 145 AC_C_BIGENDIAN
 146
 147 # Checks for programs.
 148 AC_PROG_AWK
 149 AC_PROG_CPP
 150 AC_PROG_RANLIB
 151 AC_PROG_INSTALL
 152 AC_PROG_EGREP
 153 AC_PATH_PROG(AR, ar)
 154 AC_PATH_PROG(CAT, cat)
 155 AC_PATH_PROG(KILL, kill)
 156 AC_PATH_PROGS(PERL, perl5 perl)
 157 AC_PATH_PROG(SED, sed)
 158 AC_SUBST(PERL)
 159 AC_PATH_PROG(ENT, ent)
 160 AC_SUBST(ENT)
 161 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
 162 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
 163 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
 164 AC_PATH_PROG(SH, sh)
 165 AC_SUBST(TEST_SHELL,sh)
 166
 167 dnl for buildpkg.sh
 168 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
 169         [/usr/sbin${PATH_SEPARATOR}/etc])
 170 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
 171         [/usr/sbin${PATH_SEPARATOR}/etc])
 172 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
 173 if test -x /sbin/sh; then
 174         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
 175 else
 176         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
 177 fi
 178
 179 # System features
 180 AC_SYS_LARGEFILE
 181
 182 if test -z "$AR" ; then
 183         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
 184 fi
 185
 186 # Use LOGIN_PROGRAM from environment if possible
 187 if test ! -z "$LOGIN_PROGRAM" ; then
 188         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
 189                 [If your header files don't define LOGIN_PROGRAM,
 190                 then use this (detected) from environment and PATH])
 191 else
 192         # Search for login
 193         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
 194         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
 195                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
 196         fi
 197 fi
 198
 199 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
 200 if test ! -z "$PATH_PASSWD_PROG" ; then
 201         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
 202                 [Full path of your "passwd" program])
 203 fi
 204
 205 if test -z "$LD" ; then
 206         LD=$CC
 207 fi
 208 AC_SUBST(LD)
 209
 210 AC_C_INLINE
 211
 212 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
 213
 214 use_stack_protector=1
 215 AC_ARG_WITH(stackprotect,
 216     [  --without-stackprotect  Don't use compiler's stack protection], [
 217     if test "x$withval" = "xno"; then
 218         use_stack_protector=0
 219     fi ])
 220
 221 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 222         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
 223         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 224         case $GCC_VER in
 225                 1.*) no_attrib_nonnull=1 ;;
 226                 2.8* | 2.9*)
 227                      CFLAGS="$CFLAGS -Wsign-compare"
 228                      no_attrib_nonnull=1
 229                      ;;
 230                 2.*) no_attrib_nonnull=1 ;;
 231                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 232                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 233                 *) ;;
 234         esac
 235
 236         # -fstack-protector-all doesn't always work for some GCC versions
 237         # and/or platforms, so we test if we can.  If it's not supported
 238         # on a give platform gcc will emit a warning so we use -Werror.
 239         if test "x$use_stack_protector" = "x1"; then
 240             for t in -fstack-protector-all -fstack-protector; do
 241                 AC_MSG_CHECKING(if $CC supports $t)
 242                 saved_CFLAGS="$CFLAGS"
 243                 saved_LDFLAGS="$LDFLAGS"
 244                 CFLAGS="$CFLAGS $t -Werror"
 245                 LDFLAGS="$LDFLAGS $t -Werror"
 246                 AC_LINK_IFELSE(
 247                         [AC_LANG_SOURCE([
 248 #include <stdlib.h>
 249 int main(void){return 0;}
 250                          ])],
 251                     [ AC_MSG_RESULT(yes)
 252                       CFLAGS="$saved_CFLAGS $t"
 253                       LDFLAGS="$saved_LDFLAGS $t"
 254                       AC_MSG_CHECKING(if $t works)
 255                       AC_RUN_IFELSE(
 256                         [AC_LANG_SOURCE([
 257 #include <stdlib.h>
 258 int main(void){exit(0);}
 259                         ])],
 260                         [ AC_MSG_RESULT(yes)
 261                           break ],
 262                         [ AC_MSG_RESULT(no) ],
 263                         [ AC_MSG_WARN([cross compiling: cannot test])
 264                           break ]
 265                       )
 266                     ],
 267                     [ AC_MSG_RESULT(no) ]
 268                 )
 269                 CFLAGS="$saved_CFLAGS"
 270                 LDFLAGS="$saved_LDFLAGS"
 271             done
 272         fi
 273
 274         if test -z "$have_llong_max"; then
 275                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 276                 unset ac_cv_have_decl_LLONG_MAX
 277                 saved_CFLAGS="$CFLAGS"
 278                 CFLAGS="$CFLAGS -std=gnu99"
 279                 AC_CHECK_DECL(LLONG_MAX,
 280                     [have_llong_max=1],
 281                     [CFLAGS="$saved_CFLAGS"],
 282                     [#include <limits.h>]
 283                 )
 284         fi
 285 fi
 286
 287 if test "x$no_attrib_nonnull" != "x1" ; then
 288         AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
 289 fi
 290
 291 AC_ARG_WITH(rpath,
 292         [  --without-rpath         Disable auto-added -R linker paths],
 293         [
 294                 if test "x$withval" = "xno" ; then
 295                         need_dash_r=""
 296                 fi
 297                 if test "x$withval" = "xyes" ; then
 298                         need_dash_r=1
 299                 fi
 300         ]
 301 )
 302
 303 # Allow user to specify flags
 304 AC_ARG_WITH(cflags,
 305         [  --with-cflags           Specify additional flags to pass to compiler],
 306         [
 307                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 308                     test "x${withval}" != "xyes"; then
 309                         CFLAGS="$CFLAGS $withval"
 310                 fi
 311         ]
 312 )
 313 AC_ARG_WITH(cppflags,
 314         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 315         [
 316                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 317                     test "x${withval}" != "xyes"; then
 318                         CPPFLAGS="$CPPFLAGS $withval"
 319                 fi
 320         ]
 321 )
 322 AC_ARG_WITH(ldflags,
 323         [  --with-ldflags          Specify additional flags to pass to linker],
 324         [
 325                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 326                     test "x${withval}" != "xyes"; then
 327                         LDFLAGS="$LDFLAGS $withval"
 328                 fi
 329         ]
 330 )
 331 AC_ARG_WITH(libs,
 332         [  --with-libs             Specify additional libraries to link with],
 333         [
 334                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 335                     test "x${withval}" != "xyes"; then
 336                         LIBS="$LIBS $withval"
 337                 fi
 338         ]
 339 )
 340 AC_ARG_WITH(Werror,
 341         [  --with-Werror           Build main code with -Werror],
 342         [
 343                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 344                         werror_flags="-Werror"
 345                         if test "x${withval}" != "xyes"; then
 346                                 werror_flags="$withval"
 347                         fi
 348                 fi
 349         ]
 350 )
 351
 352 AC_CHECK_HEADERS( \
 353         bstring.h \
 354         crypt.h \
 355         crypto/sha2.h \
 356         dirent.h \
 357         endian.h \
 358         features.h \
 359         fcntl.h \
 360         floatingpoint.h \
 361         getopt.h \
 362         glob.h \
 363         ia.h \
 364         iaf.h \
 365         limits.h \
 366         login.h \
 367         maillock.h \
 368         ndir.h \
 369         net/if_tun.h \
 370         netdb.h \
 371         netgroup.h \
 372         pam/pam_appl.h \
 373         paths.h \
 374         poll.h \
 375         pty.h \
 376         readpassphrase.h \
 377         rpc/types.h \
 378         security/pam_appl.h \
 379         sha2.h \
 380         shadow.h \
 381         stddef.h \
 382         stdint.h \
 383         string.h \
 384         strings.h \
 385         sys/audit.h \
 386         sys/bitypes.h \
 387         sys/bsdtty.h \
 388         sys/cdefs.h \
 389         sys/dir.h \
 390         sys/mman.h \
 391         sys/ndir.h \
 392         sys/poll.h \
 393         sys/prctl.h \
 394         sys/pstat.h \
 395         sys/select.h \
 396         sys/stat.h \
 397         sys/stream.h \
 398         sys/stropts.h \
 399         sys/strtio.h \
 400         sys/sysmacros.h \
 401         sys/time.h \
 402         sys/timers.h \
 403         sys/un.h \
 404         time.h \
 405         tmpdir.h \
 406         ttyent.h \
 407         ucred.h \
 408         unistd.h \
 409         usersec.h \
 410         util.h \
 411         utime.h \
 412         utmp.h \
 413         utmpx.h \
 414         vis.h \
 415 )
 416
 417 # lastlog.h requires sys/time.h to be included first on Solaris
 418 AC_CHECK_HEADERS(lastlog.h, [], [], [
 419 #ifdef HAVE_SYS_TIME_H
 420 # include <sys/time.h>
 421 #endif
 422 ])
 423
 424 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 425 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 426 #ifdef HAVE_SYS_STREAM_H
 427 # include <sys/stream.h>
 428 #endif
 429 ])
 430
 431 # login_cap.h requires sys/types.h on NetBSD
 432 AC_CHECK_HEADERS(login_cap.h, [], [], [
 433 #include <sys/types.h>
 434 ])
 435
 436 # Messages for features tested for in target-specific section
 437 SIA_MSG="no"
 438 SPC_MSG="no"
 439
 440 # Check for some target-specific stuff
 441 case "$host" in
 442 *-*-aix*)
 443         # Some versions of VAC won't allow macro redefinitions at
 444         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 445         # particularly with older versions of vac or xlc.
 446         # It also throws errors about null macro argments, but these are
 447         # not fatal.
 448         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 449         AC_COMPILE_IFELSE(
 450             [AC_LANG_SOURCE([[
 451 #define testmacro foo
 452 #define testmacro bar
 453 int main(void) { exit(0); }
 454             ]])],
 455             [ AC_MSG_RESULT(yes) ],
 456             [ AC_MSG_RESULT(no)
 457               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 458               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 459               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 460               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 461             ]
 462         )
 463
 464         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 465         if (test -z "$blibpath"); then
 466                 blibpath="/usr/lib:/lib"
 467         fi
 468         saved_LDFLAGS="$LDFLAGS"
 469         if test "$GCC" = "yes"; then
 470                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 471         else
 472                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 473         fi
 474         for tryflags in $flags ;do
 475                 if (test -z "$blibflags"); then
 476                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 477                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 478                 fi
 479         done
 480         if (test -z "$blibflags"); then
 481                 AC_MSG_RESULT(not found)
 482                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 483         else
 484                 AC_MSG_RESULT($blibflags)
 485         fi
 486         LDFLAGS="$saved_LDFLAGS"
 487         dnl Check for authenticate.  Might be in libs.a on older AIXes
 488         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 489                 [Define if you want to enable AIX4's authenticate function])],
 490                 [AC_CHECK_LIB(s,authenticate,
 491                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 492                                 LIBS="$LIBS -ls"
 493                         ])
 494                 ])
 495         dnl Check for various auth function declarations in headers.
 496         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 497             passwdexpired, setauthdb], , , [#include <usersec.h>])
 498         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 499         AC_CHECK_DECLS(loginfailed,
 500                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 501                   AC_TRY_COMPILE(
 502                         [#include <usersec.h>],
 503                         [(void)loginfailed("user","host","tty",0);],
 504                         [AC_MSG_RESULT(yes)
 505                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 506                                 [Define if your AIX loginfailed() function
 507                                 takes 4 arguments (AIX >= 5.2)])],
 508                         [AC_MSG_RESULT(no)]
 509                 )],
 510                 [],
 511                 [#include <usersec.h>]
 512         )
 513         AC_CHECK_FUNCS(getgrset setauthdb)
 514         AC_CHECK_DECL(F_CLOSEM,
 515             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 516             [],
 517             [ #include <limits.h>
 518               #include <fcntl.h> ]
 519         )
 520         check_for_aix_broken_getaddrinfo=1
 521         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 522         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 523             [Define if your platform breaks doing a seteuid before a setuid])
 524         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 525         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 526         dnl AIX handles lastlog as part of its login message
 527         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 528         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 529                 [Some systems need a utmpx entry for /bin/login to work])
 530         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 531                 [Define to a Set Process Title type if your system is
 532                 supported by bsd-setproctitle.c])
 533         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 534             [AIX 5.2 and 5.3 (and presumably newer) require this])
 535         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 536         ;;
 537 *-*-cygwin*)
 538         check_for_libcrypt_later=1
 539         LIBS="$LIBS /usr/lib/textreadmode.o"
 540         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 541         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 542         AC_DEFINE(DISABLE_SHADOW, 1,
 543                 [Define if you want to disable shadow passwords])
 544         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 545                 [Define if your system choked on IP TOS setting])
 546         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 547                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 548         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 549                 [Define if the concept of ports only accessible to
 550                 superusers isn't known])
 551         AC_DEFINE(DISABLE_FD_PASSING, 1,
 552                 [Define if your platform needs to skip post auth
 553                 file descriptor passing])
 554         ;;
 555 *-*-dgux*)
 556         AC_DEFINE(IP_TOS_IS_BROKEN)
 557         AC_DEFINE(SETEUID_BREAKS_SETUID)
 558         AC_DEFINE(BROKEN_SETREUID)
 559         AC_DEFINE(BROKEN_SETREGID)
 560         ;;
 561 *-*-darwin*)
 562         AC_DEFINE(BROKEN_GETADDRINFO, 1, [Define if getaddrinfo is broken)])
 563         AC_DEFINE(BROKEN_GETADDRINFO)
 564         AC_DEFINE(SETEUID_BREAKS_SETUID)
 565         AC_DEFINE(BROKEN_SETREUID)
 566         AC_DEFINE(BROKEN_SETREGID)
 567         AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
 568         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 569                 [Define if your resolver libs need this for getrrsetbyname])
 570         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 571         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 572             [Use tunnel device compatibility to OpenBSD])
 573         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 574             [Prepend the address family to IP tunnel traffic])
 575         m4_pattern_allow(AU_IPv)
 576         AC_CHECK_DECL(AU_IPv4, [],
 577             AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
 578             [#include <bsm/audit.h>]
 579         )
 580         AC_MSG_CHECKING(if we have the Security Authorization Session API)
 581         AC_TRY_COMPILE([#include <Security/AuthSession.h>],
 582                 [SessionCreate(0, 0);],
 583                 [ac_cv_use_security_session_api="yes"
 584                  AC_DEFINE(USE_SECURITY_SESSION_API, 1,
 585                         [platform has the Security Authorization Session API])
 586                  LIBS="$LIBS -framework Security"
 587                  AC_MSG_RESULT(yes)],
 588                 [ac_cv_use_security_session_api="no"
 589                  AC_MSG_RESULT(no)])
 590         AC_MSG_CHECKING(if we have an in-memory credentials cache)
 591         AC_TRY_COMPILE(
 592                 [#include <Kerberos/Kerberos.h>],
 593                 [cc_context_t c;
 594                  (void) cc_initialize (&c, 0, NULL, NULL);],
 595                 [AC_DEFINE(USE_CCAPI, 1,
 596                         [platform uses an in-memory credentials cache])
 597                  LIBS="$LIBS -framework Security"
 598                  AC_MSG_RESULT(yes)
 599                  if test "x$ac_cv_use_security_session_api" = "xno"; then
 600                         AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
 601                 fi],
 602                 [AC_MSG_RESULT(no)]
 603         )
 604         ;;
 605 *-*-dragonfly*)
 606         SSHDLIBS="$SSHDLIBS -lcrypt"
 607         ;;
 608 *-*-hpux*)
 609         # first we define all of the options common to all HP-UX releases
 610         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 611         IPADDR_IN_DISPLAY=yes
 612         AC_DEFINE(USE_PIPES)
 613         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 614             [Define if your login program cannot handle end of options ("--")])
 615         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 616         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 617                 [String used in /etc/passwd to denote locked account])
 618         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 619         MAIL="/var/mail/username"
 620         LIBS="$LIBS -lsec"
 621         AC_CHECK_LIB(xnet, t_error, ,
 622             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 623
 624         # next, we define all of the options specific to major releases
 625         case "$host" in
 626         *-*-hpux10*)
 627                 if test -z "$GCC"; then
 628                         CFLAGS="$CFLAGS -Ae"
 629                 fi
 630                 ;;
 631         *-*-hpux11*)
 632                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 633                         [Define if you are using Solaris-derived PAM which
 634                         passes pam_messages to the conversation function
 635                         with an extra level of indirection])
 636                 AC_DEFINE(DISABLE_UTMP, 1,
 637                         [Define if you don't want to use utmp])
 638                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 639                 check_for_hpux_broken_getaddrinfo=1
 640                 check_for_conflicting_getspnam=1
 641                 ;;
 642         esac
 643
 644         # lastly, we define options specific to minor releases
 645         case "$host" in
 646         *-*-hpux10.26)
 647                 AC_DEFINE(HAVE_SECUREWARE, 1,
 648                         [Define if you have SecureWare-based
 649                         protected password database])
 650                 disable_ptmx_check=yes
 651                 LIBS="$LIBS -lsecpw"
 652                 ;;
 653         esac
 654         ;;
 655 *-*-irix5*)
 656         PATH="$PATH:/usr/etc"
 657         AC_DEFINE(BROKEN_INET_NTOA, 1,
 658                 [Define if you system's inet_ntoa is busted
 659                 (e.g. Irix gcc issue)])
 660         AC_DEFINE(SETEUID_BREAKS_SETUID)
 661         AC_DEFINE(BROKEN_SETREUID)
 662         AC_DEFINE(BROKEN_SETREGID)
 663         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 664                 [Define if you shouldn't strip 'tty' from your
 665                 ttyname in [uw]tmp])
 666         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 667         ;;
 668 *-*-irix6*)
 669         PATH="$PATH:/usr/etc"
 670         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 671                 [Define if you have/want arrays
 672                 (cluster-wide session managment, not C arrays)])
 673         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 674                 [Define if you want IRIX project management])
 675         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 676                 [Define if you want IRIX audit trails])
 677         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 678                 [Define if you want IRIX kernel jobs])])
 679         AC_DEFINE(BROKEN_INET_NTOA)
 680         AC_DEFINE(SETEUID_BREAKS_SETUID)
 681         AC_DEFINE(BROKEN_SETREUID)
 682         AC_DEFINE(BROKEN_SETREGID)
 683         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 684         AC_DEFINE(WITH_ABBREV_NO_TTY)
 685         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 686         ;;
 687 *-*-linux*)
 688         no_dev_ptmx=1
 689         check_for_libcrypt_later=1
 690         check_for_openpty_ctty_bug=1
 691         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 692         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 693                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 694         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 695                 [String used in /etc/passwd to denote locked account])
 696         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 697         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 698                 [Define to whatever link() returns for "not supported"
 699                 if it doesn't return EOPNOTSUPP.])
 700         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 701         AC_DEFINE(USE_BTMP)
 702         inet6_default_4in6=yes
 703         case `uname -r` in
 704         1.*|2.0.*)
 705                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 706                         [Define if cmsg_type is not passed correctly])
 707                 ;;
 708         esac
 709         # tun(4) forwarding compat code
 710         AC_CHECK_HEADERS(linux/if_tun.h)
 711         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 712                 AC_DEFINE(SSH_TUN_LINUX, 1,
 713                     [Open tunnel devices the Linux tun/tap way])
 714                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 715                     [Use tunnel device compatibility to OpenBSD])
 716                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 717                     [Prepend the address family to IP tunnel traffic])
 718         fi
 719         ;;
 720 mips-sony-bsd|mips-sony-newsos4)
 721         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 722         SONY=1
 723         ;;
 724 *-*-netbsd*)
 725         check_for_libcrypt_before=1
 726         if test "x$withval" != "xno" ; then
 727                 need_dash_r=1
 728         fi
 729         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 730         AC_CHECK_HEADER([net/if_tap.h], ,
 731             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 732         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 733             [Prepend the address family to IP tunnel traffic])
 734         ;;
 735 *-*-freebsd*)
 736         check_for_libcrypt_later=1
 737         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 738         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 739         AC_CHECK_HEADER([net/if_tap.h], ,
 740             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 741         AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need])
 742         ;;
 743 *-*-bsdi*)
 744         AC_DEFINE(SETEUID_BREAKS_SETUID)
 745         AC_DEFINE(BROKEN_SETREUID)
 746         AC_DEFINE(BROKEN_SETREGID)
 747         ;;
 748 *-next-*)
 749         conf_lastlog_location="/usr/adm/lastlog"
 750         conf_utmp_location=/etc/utmp
 751         conf_wtmp_location=/usr/adm/wtmp
 752         MAIL=/usr/spool/mail
 753         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 754         AC_DEFINE(BROKEN_REALPATH)
 755         AC_DEFINE(USE_PIPES)
 756         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 757         ;;
 758 *-*-openbsd*)
 759         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 760         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 761         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 762         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 763             [syslog_r function is safe to use in in a signal handler])
 764         ;;
 765 *-*-solaris*)
 766         if test "x$withval" != "xno" ; then
 767                 need_dash_r=1
 768         fi
 769         AC_DEFINE(PAM_SUN_CODEBASE)
 770         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 771         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 772                 [Some versions of /bin/login need the TERM supplied
 773                 on the commandline])
 774         AC_DEFINE(PAM_TTY_KLUDGE)
 775         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 776                 [Define if pam_chauthtok wants real uid set
 777                 to the unpriv'ed user])
 778         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 779         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 780         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 781                 [Define if sshd somehow reacquires a controlling TTY
 782                 after setsid()])
 783         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 784                 in case the name is longer than 8 chars])
 785         external_path_file=/etc/default/login
 786         # hardwire lastlog location (can't detect it on some versions)
 787         conf_lastlog_location="/var/adm/lastlog"
 788         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 789         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 790         if test "$sol2ver" -ge 8; then
 791                 AC_MSG_RESULT(yes)
 792                 AC_DEFINE(DISABLE_UTMP)
 793                 AC_DEFINE(DISABLE_WTMP, 1,
 794                         [Define if you don't want to use wtmp])
 795         else
 796                 AC_MSG_RESULT(no)
 797         fi
 798         AC_ARG_WITH(solaris-contracts,
 799                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 800                 [
 801                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 802                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 803                                 [Define if you have Solaris process contracts])
 804                           SSHDLIBS="$SSHDLIBS -lcontract"
 805                           AC_SUBST(SSHDLIBS)
 806                           SPC_MSG="yes" ], )
 807                 ],
 808         )
 809         ;;
 810 *-*-sunos4*)
 811         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 812         AC_CHECK_FUNCS(getpwanam)
 813         AC_DEFINE(PAM_SUN_CODEBASE)
 814         conf_utmp_location=/etc/utmp
 815         conf_wtmp_location=/var/adm/wtmp
 816         conf_lastlog_location=/var/adm/lastlog
 817         AC_DEFINE(USE_PIPES)
 818         ;;
 819 *-ncr-sysv*)
 820         LIBS="$LIBS -lc89"
 821         AC_DEFINE(USE_PIPES)
 822         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 823         AC_DEFINE(SETEUID_BREAKS_SETUID)
 824         AC_DEFINE(BROKEN_SETREUID)
 825         AC_DEFINE(BROKEN_SETREGID)
 826         ;;
 827 *-sni-sysv*)
 828         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 829         AC_CHECK_LIB(dl, dlsym, ,)
 830         # -lresolv needs to be at the end of LIBS or DNS lookups break
 831         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 832         IPADDR_IN_DISPLAY=yes
 833         AC_DEFINE(USE_PIPES)
 834         AC_DEFINE(IP_TOS_IS_BROKEN)
 835         AC_DEFINE(SETEUID_BREAKS_SETUID)
 836         AC_DEFINE(BROKEN_SETREUID)
 837         AC_DEFINE(BROKEN_SETREGID)
 838         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 839         external_path_file=/etc/default/login
 840         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 841         # Attention: always take care to bind libsocket and libnsl before libc,
 842         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 843         ;;
 844 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 845 *-*-sysv4.2*)
 846         AC_DEFINE(USE_PIPES)
 847         AC_DEFINE(SETEUID_BREAKS_SETUID)
 848         AC_DEFINE(BROKEN_SETREUID)
 849         AC_DEFINE(BROKEN_SETREGID)
 850         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 851         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 852         ;;
 853 # UnixWare 7.x, OpenUNIX 8
 854 *-*-sysv5*)
 855         check_for_libcrypt_later=1
 856         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 857         AC_DEFINE(USE_PIPES)
 858         AC_DEFINE(SETEUID_BREAKS_SETUID)
 859         AC_DEFINE(BROKEN_SETREUID)
 860         AC_DEFINE(BROKEN_SETREGID)
 861         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 862         case "$host" in
 863         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 864                 TEST_SHELL=/u95/bin/sh
 865                 AC_DEFINE(BROKEN_LIBIAF, 1,
 866                         [ia_uinfo routines not supported by OS yet])
 867                 AC_DEFINE(BROKEN_UPDWTMPX)
 868                 ;;
 869         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 870                 ;;
 871         esac
 872         ;;
 873 *-*-sysv*)
 874         ;;
 875 # SCO UNIX and OEM versions of SCO UNIX
 876 *-*-sco3.2v4*)
 877         AC_MSG_ERROR("This Platform is no longer supported.")
 878         ;;
 879 # SCO OpenServer 5.x
 880 *-*-sco3.2v5*)
 881         if test -z "$GCC"; then
 882                 CFLAGS="$CFLAGS -belf"
 883         fi
 884         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 885         no_dev_ptmx=1
 886         AC_DEFINE(USE_PIPES)
 887         AC_DEFINE(HAVE_SECUREWARE)
 888         AC_DEFINE(DISABLE_SHADOW)
 889         AC_DEFINE(DISABLE_FD_PASSING)
 890         AC_DEFINE(SETEUID_BREAKS_SETUID)
 891         AC_DEFINE(BROKEN_SETREUID)
 892         AC_DEFINE(BROKEN_SETREGID)
 893         AC_DEFINE(WITH_ABBREV_NO_TTY)
 894         AC_DEFINE(BROKEN_UPDWTMPX)
 895         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 896         AC_CHECK_FUNCS(getluid setluid)
 897         MANTYPE=man
 898         TEST_SHELL=ksh
 899         ;;
 900 *-*-unicosmk*)
 901         AC_DEFINE(NO_SSH_LASTLOG, 1,
 902                 [Define if you don't want to use lastlog in session.c])
 903         AC_DEFINE(SETEUID_BREAKS_SETUID)
 904         AC_DEFINE(BROKEN_SETREUID)
 905         AC_DEFINE(BROKEN_SETREGID)
 906         AC_DEFINE(USE_PIPES)
 907         AC_DEFINE(DISABLE_FD_PASSING)
 908         LDFLAGS="$LDFLAGS"
 909         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 910         MANTYPE=cat
 911         ;;
 912 *-*-unicosmp*)
 913         AC_DEFINE(SETEUID_BREAKS_SETUID)
 914         AC_DEFINE(BROKEN_SETREUID)
 915         AC_DEFINE(BROKEN_SETREGID)
 916         AC_DEFINE(WITH_ABBREV_NO_TTY)
 917         AC_DEFINE(USE_PIPES)
 918         AC_DEFINE(DISABLE_FD_PASSING)
 919         LDFLAGS="$LDFLAGS"
 920         LIBS="$LIBS -lgen -lacid -ldb"
 921         MANTYPE=cat
 922         ;;
 923 *-*-unicos*)
 924         AC_DEFINE(SETEUID_BREAKS_SETUID)
 925         AC_DEFINE(BROKEN_SETREUID)
 926         AC_DEFINE(BROKEN_SETREGID)
 927         AC_DEFINE(USE_PIPES)
 928         AC_DEFINE(DISABLE_FD_PASSING)
 929         AC_DEFINE(NO_SSH_LASTLOG)
 930         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 931         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 932         MANTYPE=cat
 933         ;;
 934 *-dec-osf*)
 935         AC_MSG_CHECKING(for Digital Unix SIA)
 936         no_osfsia=""
 937         AC_ARG_WITH(osfsia,
 938                 [  --with-osfsia           Enable Digital Unix SIA],
 939                 [
 940                         if test "x$withval" = "xno" ; then
 941                                 AC_MSG_RESULT(disabled)
 942                                 no_osfsia=1
 943                         fi
 944                 ],
 945         )
 946         if test -z "$no_osfsia" ; then
 947                 if test -f /etc/sia/matrix.conf; then
 948                         AC_MSG_RESULT(yes)
 949                         AC_DEFINE(HAVE_OSF_SIA, 1,
 950                                 [Define if you have Digital Unix Security
 951                                 Integration Architecture])
 952                         AC_DEFINE(DISABLE_LOGIN, 1,
 953                                 [Define if you don't want to use your
 954                                 system's login() call])
 955                         AC_DEFINE(DISABLE_FD_PASSING)
 956                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 957                         SIA_MSG="yes"
 958                 else
 959                         AC_MSG_RESULT(no)
 960                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 961                           [String used in /etc/passwd to denote locked account])
 962                 fi
 963         fi
 964         AC_DEFINE(BROKEN_GETADDRINFO)
 965         AC_DEFINE(SETEUID_BREAKS_SETUID)
 966         AC_DEFINE(BROKEN_SETREUID)
 967         AC_DEFINE(BROKEN_SETREGID)
 968         ;;
 969
 970 *-*-nto-qnx*)
 971         AC_DEFINE(USE_PIPES)
 972         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 973         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 974         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 975         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 976         AC_DEFINE(DISABLE_LASTLOG)
 977         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 978         AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
 979         enable_etc_default_login=no     # has incompatible /etc/default/login
 980         case "$host" in
 981         *-*-nto-qnx6*)
 982                 AC_DEFINE(DISABLE_FD_PASSING)
 983                 ;;
 984         esac
 985         ;;
 986
 987 *-*-ultrix*)
 988         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 989         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 990         AC_DEFINE(NEED_SETPGRP)
 991         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 992         ;;
 993
 994 *-*-lynxos)
 995         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 996         AC_DEFINE(MISSING_HOWMANY)
 997         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 998         ;;
 999 esac
1000
1001 AC_MSG_CHECKING(compiler and flags for sanity)
1002 AC_RUN_IFELSE(
1003         [AC_LANG_SOURCE([
1004 #include <stdio.h>
1005 int main(){exit(0);}
1006         ])],
1007         [       AC_MSG_RESULT(yes) ],
1008         [
1009                 AC_MSG_RESULT(no)
1010                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
1011         ],
1012         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
1013 )
1014
1015 dnl Checks for header files.
1016 # Checks for libraries.
1017 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
1018 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
1019
1020 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
1021 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
1022         AC_CHECK_LIB(gen, dirname,[
1023                 AC_CACHE_CHECK([for broken dirname],
1024                         ac_cv_have_broken_dirname, [
1025                         save_LIBS="$LIBS"
1026                         LIBS="$LIBS -lgen"
1027                         AC_RUN_IFELSE(
1028                                 [AC_LANG_SOURCE([[
1029 #include <libgen.h>
1030 #include <string.h>
1031
1032 int main(int argc, char **argv) {
1033     char *s, buf[32];
1034
1035     strncpy(buf,"/etc", 32);
1036     s = dirname(buf);
1037     if (!s || strncmp(s, "/", 32) != 0) {
1038         exit(1);
1039     } else {
1040         exit(0);
1041     }
1042 }
1043                                 ]])],
1044                                 [ ac_cv_have_broken_dirname="no" ],
1045                                 [ ac_cv_have_broken_dirname="yes" ],
1046                                 [ ac_cv_have_broken_dirname="no" ],
1047                         )
1048                         LIBS="$save_LIBS"
1049                 ])
1050                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
1051                         LIBS="$LIBS -lgen"
1052                         AC_DEFINE(HAVE_DIRNAME)
1053                         AC_CHECK_HEADERS(libgen.h)
1054                 fi
1055         ])
1056 ])
1057
1058 AC_CHECK_FUNC(getspnam, ,
1059         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
1060 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
1061         [Define if you have the basename function.]))
1062
1063 dnl zlib is required
1064 AC_ARG_WITH(zlib,
1065         [  --with-zlib=PATH        Use zlib in PATH],
1066         [ if test "x$withval" = "xno" ; then
1067                 AC_MSG_ERROR([*** zlib is required ***])
1068           elif test "x$withval" != "xyes"; then
1069                 if test -d "$withval/lib"; then
1070                         if test -n "${need_dash_r}"; then
1071                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1072                         else
1073                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1074                         fi
1075                 else
1076                         if test -n "${need_dash_r}"; then
1077                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1078                         else
1079                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1080                         fi
1081                 fi
1082                 if test -d "$withval/include"; then
1083                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1084                 else
1085                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1086                 fi
1087         fi ]
1088 )
1089
1090 AC_CHECK_LIB(z, deflate, ,
1091         [
1092                 saved_CPPFLAGS="$CPPFLAGS"
1093                 saved_LDFLAGS="$LDFLAGS"
1094                 save_LIBS="$LIBS"
1095                 dnl Check default zlib install dir
1096                 if test -n "${need_dash_r}"; then
1097                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
1098                 else
1099                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
1100                 fi
1101                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
1102                 LIBS="$LIBS -lz"
1103                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
1104                         [
1105                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1106                         ]
1107                 )
1108         ]
1109 )
1110 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
1111
1112 AC_ARG_WITH(zlib-version-check,
1113         [  --without-zlib-version-check Disable zlib version check],
1114         [  if test "x$withval" = "xno" ; then
1115                 zlib_check_nonfatal=1
1116            fi
1117         ]
1118 )
1119
1120 AC_MSG_CHECKING(for possibly buggy zlib)
1121 AC_RUN_IFELSE([AC_LANG_SOURCE([[
1122 #include <stdio.h>
1123 #include <zlib.h>
1124 int main()
1125 {
1126         int a=0, b=0, c=0, d=0, n, v;
1127         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1128         if (n != 3 && n != 4)
1129                 exit(1);
1130         v = a*1000000 + b*10000 + c*100 + d;
1131         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1132
1133         /* 1.1.4 is OK */
1134         if (a == 1 && b == 1 && c >= 4)
1135                 exit(0);
1136
1137         /* 1.2.3 and up are OK */
1138         if (v >= 1020300)
1139                 exit(0);
1140
1141         exit(2);
1142 }
1143         ]])],
1144         AC_MSG_RESULT(no),
1145         [ AC_MSG_RESULT(yes)
1146           if test -z "$zlib_check_nonfatal" ; then
1147                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1148 Your reported zlib version has known security problems.  It's possible your
1149 vendor has fixed these problems without changing the version number.  If you
1150 are sure this is the case, you can disable the check by running
1151 "./configure --without-zlib-version-check".
1152 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1153 See http://www.gzip.org/zlib/ for details.])
1154           else
1155                 AC_MSG_WARN([zlib version may have security problems])
1156           fi
1157         ],
1158         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1159 )
1160
1161 dnl UnixWare 2.x
1162 AC_CHECK_FUNC(strcasecmp,
1163         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
1164 )
1165 AC_CHECK_FUNCS(utimes,
1166         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
1167                                         LIBS="$LIBS -lc89"]) ]
1168 )
1169
1170 dnl    Checks for libutil functions
1171 AC_CHECK_HEADERS(libutil.h)
1172 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
1173         [Define if your libraries define login()])])
1174 AC_CHECK_FUNCS(logout updwtmp logwtmp)
1175
1176 AC_FUNC_STRFTIME
1177
1178 # Check for ALTDIRFUNC glob() extension
1179 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
1180 AC_EGREP_CPP(FOUNDIT,
1181         [
1182                 #include <glob.h>
1183                 #ifdef GLOB_ALTDIRFUNC
1184                 FOUNDIT
1185                 #endif
1186         ],
1187         [
1188                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
1189                         [Define if your system glob() function has
1190                         the GLOB_ALTDIRFUNC extension])
1191                 AC_MSG_RESULT(yes)
1192         ],
1193         [
1194                 AC_MSG_RESULT(no)
1195         ]
1196 )
1197
1198 # Check for g.gl_matchc glob() extension
1199 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1200 AC_TRY_COMPILE(
1201         [ #include <glob.h> ],
1202         [glob_t g; g.gl_matchc = 1;],
1203         [
1204                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1205                         [Define if your system glob() function has
1206                         gl_matchc options in glob_t])
1207                 AC_MSG_RESULT(yes)
1208         ],
1209         [
1210                 AC_MSG_RESULT(no)
1211         ]
1212 )
1213
1214 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1215
1216 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1217 AC_RUN_IFELSE(
1218         [AC_LANG_SOURCE([[
1219 #include <sys/types.h>
1220 #include <dirent.h>
1221 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1222         ]])],
1223         [AC_MSG_RESULT(yes)],
1224         [
1225                 AC_MSG_RESULT(no)
1226                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1227                         [Define if your struct dirent expects you to
1228                         allocate extra space for d_name])
1229         ],
1230         [
1231                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1232                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1233         ]
1234 )
1235
1236 AC_MSG_CHECKING([for /proc/pid/fd directory])
1237 if test -d "/proc/$$/fd" ; then
1238         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1239         AC_MSG_RESULT(yes)
1240 else
1241         AC_MSG_RESULT(no)
1242 fi
1243
1244 # Check whether user wants S/Key support
1245 SKEY_MSG="no"
1246 AC_ARG_WITH(skey,
1247         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1248         [
1249                 if test "x$withval" != "xno" ; then
1250
1251                         if test "x$withval" != "xyes" ; then
1252                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1253                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1254                         fi
1255
1256                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1257                         LIBS="-lskey $LIBS"
1258                         SKEY_MSG="yes"
1259
1260                         AC_MSG_CHECKING([for s/key support])
1261                         AC_LINK_IFELSE(
1262                                 [AC_LANG_SOURCE([[
1263 #include <stdio.h>
1264 #include <skey.h>
1265 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1266                                 ]])],
1267                                 [AC_MSG_RESULT(yes)],
1268                                 [
1269                                         AC_MSG_RESULT(no)
1270                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1271                                 ])
1272                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1273                         AC_TRY_COMPILE(
1274                                 [#include <stdio.h>
1275                                  #include <skey.h>],
1276                                 [(void)skeychallenge(NULL,"name","",0);],
1277                                 [AC_MSG_RESULT(yes)
1278                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1279                                         [Define if your skeychallenge()
1280                                         function takes 4 arguments (NetBSD)])],
1281                                 [AC_MSG_RESULT(no)]
1282                         )
1283                 fi
1284         ]
1285 )
1286
1287 # Check whether user wants TCP wrappers support
1288 TCPW_MSG="no"
1289 AC_ARG_WITH(tcp-wrappers,
1290         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1291         [
1292                 if test "x$withval" != "xno" ; then
1293                         saved_LIBS="$LIBS"
1294                         saved_LDFLAGS="$LDFLAGS"
1295                         saved_CPPFLAGS="$CPPFLAGS"
1296                         if test -n "${withval}" && \
1297                             test "x${withval}" != "xyes"; then
1298                                 if test -d "${withval}/lib"; then
1299                                         if test -n "${need_dash_r}"; then
1300                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1301                                         else
1302                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1303                                         fi
1304                                 else
1305                                         if test -n "${need_dash_r}"; then
1306                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1307                                         else
1308                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1309                                         fi
1310                                 fi
1311                                 if test -d "${withval}/include"; then
1312                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1313                                 else
1314                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1315                                 fi
1316                         fi
1317                         LIBS="-lwrap $LIBS"
1318                         AC_MSG_CHECKING(for libwrap)
1319                         AC_TRY_LINK(
1320                                 [
1321 #include <sys/types.h>
1322 #include <sys/socket.h>
1323 #include <netinet/in.h>
1324 #include <tcpd.h>
1325                                         int deny_severity = 0, allow_severity = 0;
1326                                 ],
1327                                 [hosts_access(0);],
1328                                 [
1329                                         AC_MSG_RESULT(yes)
1330                                         AC_DEFINE(LIBWRAP, 1,
1331                                                 [Define if you want
1332                                                 TCP Wrappers support])
1333                                         SSHDLIBS="$SSHDLIBS -lwrap"
1334                                         TCPW_MSG="yes"
1335                                 ],
1336                                 [
1337                                         AC_MSG_ERROR([*** libwrap missing])
1338                                 ]
1339                         )
1340                         LIBS="$saved_LIBS"
1341                 fi
1342         ]
1343 )
1344
1345 # Check whether user wants libedit support
1346 LIBEDIT_MSG="no"
1347 AC_ARG_WITH(libedit,
1348         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1349         [ if test "x$withval" != "xno" ; then
1350                 if test "x$withval" != "xyes"; then
1351                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1352                         if test -n "${need_dash_r}"; then
1353                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1354                         else
1355                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1356                         fi
1357                 fi
1358                 AC_CHECK_LIB(edit, el_init,
1359                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1360                           LIBEDIT="-ledit -lcurses"
1361                           LIBEDIT_MSG="yes"
1362                           AC_SUBST(LIBEDIT)
1363                         ],
1364                         [ AC_MSG_ERROR(libedit not found) ],
1365                         [ -lcurses ]
1366                 )
1367                 AC_MSG_CHECKING(if libedit version is compatible)
1368                 AC_COMPILE_IFELSE(
1369                     [AC_LANG_SOURCE([[
1370 #include <histedit.h>
1371 int main(void)
1372 {
1373         int i = H_SETSIZE;
1374         el_init("", NULL, NULL, NULL);
1375         exit(0);
1376 }
1377                     ]])],
1378                     [ AC_MSG_RESULT(yes) ],
1379                     [ AC_MSG_RESULT(no)
1380                       AC_MSG_ERROR(libedit version is not compatible) ]
1381                 )
1382         fi ]
1383 )
1384
1385 AUDIT_MODULE=none
1386 AC_ARG_WITH(audit,
1387         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1388         [
1389           AC_MSG_CHECKING(for supported audit module)
1390           case "$withval" in
1391           bsm)
1392                 AC_MSG_RESULT(bsm)
1393                 AUDIT_MODULE=bsm
1394                 dnl    Checks for headers, libs and functions
1395                 AC_CHECK_HEADERS(bsm/audit.h, [],
1396                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1397                     [
1398 #ifdef HAVE_TIME_H
1399 # include <time.h>
1400 #endif
1401                     ]
1402 )
1403                 AC_CHECK_LIB(bsm, getaudit, [],
1404                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1405                 AC_CHECK_FUNCS(getaudit, [],
1406                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1407                 # These are optional
1408                 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1409                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1410                 ;;
1411           debug)
1412                 AUDIT_MODULE=debug
1413                 AC_MSG_RESULT(debug)
1414                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1415                 ;;
1416           no)
1417                 AC_MSG_RESULT(no)
1418                 ;;
1419           *)
1420                 AC_MSG_ERROR([Unknown audit module $withval])
1421                 ;;
1422         esac ]
1423 )
1424
1425 dnl    Checks for library functions. Please keep in alphabetical order
1426 AC_CHECK_FUNCS( \
1427         arc4random \
1428         asprintf \
1429         b64_ntop \
1430         __b64_ntop \
1431         b64_pton \
1432         __b64_pton \
1433         bcopy \
1434         bindresvport_sa \
1435         clock \
1436         closefrom \
1437         dirfd \
1438         fchmod \
1439         fchown \
1440         freeaddrinfo \
1441         futimes \
1442         getaddrinfo \
1443         getcwd \
1444         getgrouplist \
1445         getnameinfo \
1446         getopt \
1447         getpeereid \
1448         getpeerucred \
1449         _getpty \
1450         getrlimit \
1451         getttyent \
1452         glob \
1453         inet_aton \
1454         inet_ntoa \
1455         inet_ntop \
1456         innetgr \
1457         login_getcapbool \
1458         md5_crypt \
1459         memmove \
1460         mkdtemp \
1461         mmap \
1462         ngetaddrinfo \
1463         nsleep \
1464         ogetaddrinfo \
1465         openlog_r \
1466         openpty \
1467         poll \
1468         prctl \
1469         pstat \
1470         readpassphrase \
1471         realpath \
1472         recvmsg \
1473         rresvport_af \
1474         sendmsg \
1475         setdtablesize \
1476         setegid \
1477         setenv \
1478         seteuid \
1479         setgroups \
1480         setlogin \
1481         setpcred \
1482         setproctitle \
1483         setregid \
1484         setreuid \
1485         setrlimit \
1486         setsid \
1487         setvbuf \
1488         sigaction \
1489         sigvec \
1490         snprintf \
1491         socketpair \
1492         strdup \
1493         strerror \
1494         strlcat \
1495         strlcpy \
1496         strmode \
1497         strnvis \
1498         strtonum \
1499         strtoll \
1500         strtoul \
1501         swap32 \
1502         sysconf \
1503         tcgetpgrp \
1504         truncate \
1505         unsetenv \
1506         updwtmpx \
1507         vasprintf \
1508         vhangup \
1509         vsnprintf \
1510         waitpid \
1511 )
1512
1513 # IRIX has a const char return value for gai_strerror()
1514 AC_CHECK_FUNCS(gai_strerror,[
1515         AC_DEFINE(HAVE_GAI_STRERROR)
1516         AC_TRY_COMPILE([
1517 #include <sys/types.h>
1518 #include <sys/socket.h>
1519 #include <netdb.h>
1520
1521 const char *gai_strerror(int);],[
1522 char *str;
1523
1524 str = gai_strerror(0);],[
1525                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1526                 [Define if gai_strerror() returns const char *])])])
1527
1528 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1529         [Some systems put nanosleep outside of libc]))
1530
1531 dnl Make sure prototypes are defined for these before using them.
1532 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1533 AC_CHECK_DECL(strsep,
1534         [AC_CHECK_FUNCS(strsep)],
1535         [],
1536         [
1537 #ifdef HAVE_STRING_H
1538 # include <string.h>
1539 #endif
1540         ])
1541
1542 dnl tcsendbreak might be a macro
1543 AC_CHECK_DECL(tcsendbreak,
1544         [AC_DEFINE(HAVE_TCSENDBREAK)],
1545         [AC_CHECK_FUNCS(tcsendbreak)],
1546         [#include <termios.h>]
1547 )
1548
1549 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1550
1551 AC_CHECK_DECLS(SHUT_RD, , ,
1552         [
1553 #include <sys/types.h>
1554 #include <sys/socket.h>
1555         ])
1556
1557 AC_CHECK_DECLS(O_NONBLOCK, , ,
1558         [
1559 #include <sys/types.h>
1560 #ifdef HAVE_SYS_STAT_H
1561 # include <sys/stat.h>
1562 #endif
1563 #ifdef HAVE_FCNTL_H
1564 # include <fcntl.h>
1565 #endif
1566         ])
1567
1568 AC_CHECK_DECLS(writev, , , [
1569 #include <sys/types.h>
1570 #include <sys/uio.h>
1571 #include <unistd.h>
1572         ])
1573
1574 AC_CHECK_DECLS(MAXSYMLINKS, , , [
1575 #include <sys/param.h>
1576         ])
1577
1578 AC_CHECK_DECLS(offsetof, , , [
1579 #include <stddef.h>
1580         ])
1581
1582 AC_CHECK_FUNCS(setresuid, [
1583         dnl Some platorms have setresuid that isn't implemented, test for this
1584         AC_MSG_CHECKING(if setresuid seems to work)
1585         AC_RUN_IFELSE(
1586                 [AC_LANG_SOURCE([[
1587 #include <stdlib.h>
1588 #include <errno.h>
1589 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1590                 ]])],
1591                 [AC_MSG_RESULT(yes)],
1592                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1593                         [Define if your setresuid() is broken])
1594                  AC_MSG_RESULT(not implemented)],
1595                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1596         )
1597 ])
1598
1599 AC_CHECK_FUNCS(setresgid, [
1600         dnl Some platorms have setresgid that isn't implemented, test for this
1601         AC_MSG_CHECKING(if setresgid seems to work)
1602         AC_RUN_IFELSE(
1603                 [AC_LANG_SOURCE([[
1604 #include <stdlib.h>
1605 #include <errno.h>
1606 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1607                 ]])],
1608                 [AC_MSG_RESULT(yes)],
1609                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1610                         [Define if your setresgid() is broken])
1611                  AC_MSG_RESULT(not implemented)],
1612                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1613         )
1614 ])
1615
1616 dnl    Checks for time functions
1617 AC_CHECK_FUNCS(gettimeofday time)
1618 dnl    Checks for utmp functions
1619 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1620 AC_CHECK_FUNCS(utmpname)
1621 dnl    Checks for utmpx functions
1622 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1623 AC_CHECK_FUNCS(setutxent utmpxname)
1624
1625 AC_CHECK_FUNC(daemon,
1626         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1627         [AC_CHECK_LIB(bsd, daemon,
1628                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1629 )
1630
1631 AC_CHECK_FUNC(getpagesize,
1632         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1633                 [Define if your libraries define getpagesize()])],
1634         [AC_CHECK_LIB(ucb, getpagesize,
1635                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1636 )
1637
1638 # Check for broken snprintf
1639 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1640         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1641         AC_RUN_IFELSE(
1642                 [AC_LANG_SOURCE([[
1643 #include <stdio.h>
1644 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1645                 ]])],
1646                 [AC_MSG_RESULT(yes)],
1647                 [
1648                         AC_MSG_RESULT(no)
1649                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1650                                 [Define if your snprintf is busted])
1651                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1652                 ],
1653                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1654         )
1655 fi
1656
1657 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1658 # returning the right thing on overflow: the number of characters it tried to
1659 # create (as per SUSv3)
1660 if test "x$ac_cv_func_asprintf" != "xyes" && \
1661    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1662         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1663         AC_RUN_IFELSE(
1664                 [AC_LANG_SOURCE([[
1665 #include <sys/types.h>
1666 #include <stdio.h>
1667 #include <stdarg.h>
1668
1669 int x_snprintf(char *str,size_t count,const char *fmt,...)
1670 {
1671         size_t ret; va_list ap;
1672         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1673         return ret;
1674 }
1675 int main(void)
1676 {
1677         char x[1];
1678         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1679 } ]])],
1680                 [AC_MSG_RESULT(yes)],
1681                 [
1682                         AC_MSG_RESULT(no)
1683                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1684                                 [Define if your snprintf is busted])
1685                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1686                 ],
1687                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1688         )
1689 fi
1690
1691 # On systems where [v]snprintf is broken, but is declared in stdio,
1692 # check that the fmt argument is const char * or just char *.
1693 # This is only useful for when BROKEN_SNPRINTF
1694 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1695 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1696            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1697            int main(void) { snprintf(0, 0, 0); }
1698     ]])],
1699    [AC_MSG_RESULT(yes)
1700     AC_DEFINE(SNPRINTF_CONST, [const],
1701               [Define as const if snprintf() can declare const char *fmt])],
1702    [AC_MSG_RESULT(no)
1703     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1704
1705 # Check for missing getpeereid (or equiv) support
1706 NO_PEERCHECK=""
1707 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
1708         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1709         AC_TRY_COMPILE(
1710                 [#include <sys/types.h>
1711                  #include <sys/socket.h>],
1712                 [int i = SO_PEERCRED;],
1713                 [ AC_MSG_RESULT(yes)
1714                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1715                 ],
1716                 [AC_MSG_RESULT(no)
1717                 NO_PEERCHECK=1]
1718         )
1719 fi
1720
1721 dnl see whether mkstemp() requires XXXXXX
1722 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1723 AC_MSG_CHECKING([for (overly) strict mkstemp])
1724 AC_RUN_IFELSE(
1725         [AC_LANG_SOURCE([[
1726 #include <stdlib.h>
1727 main() { char template[]="conftest.mkstemp-test";
1728 if (mkstemp(template) == -1)
1729         exit(1);
1730 unlink(template); exit(0);
1731 }
1732         ]])],
1733         [
1734                 AC_MSG_RESULT(no)
1735         ],
1736         [
1737                 AC_MSG_RESULT(yes)
1738                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1739         ],
1740         [
1741                 AC_MSG_RESULT(yes)
1742                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1743         ]
1744 )
1745 fi
1746
1747 dnl make sure that openpty does not reacquire controlling terminal
1748 if test ! -z "$check_for_openpty_ctty_bug"; then
1749         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1750         AC_RUN_IFELSE(
1751                 [AC_LANG_SOURCE([[
1752 #include <stdio.h>
1753 #include <sys/fcntl.h>
1754 #include <sys/types.h>
1755 #include <sys/wait.h>
1756
1757 int
1758 main()
1759 {
1760         pid_t pid;
1761         int fd, ptyfd, ttyfd, status;
1762
1763         pid = fork();
1764         if (pid < 0) {          /* failed */
1765                 exit(1);
1766         } else if (pid > 0) {   /* parent */
1767                 waitpid(pid, &status, 0);
1768                 if (WIFEXITED(status))
1769                         exit(WEXITSTATUS(status));
1770                 else
1771                         exit(2);
1772         } else {                /* child */
1773                 close(0); close(1); close(2);
1774                 setsid();
1775                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1776                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1777                 if (fd >= 0)
1778                         exit(3);        /* Acquired ctty: broken */
1779                 else
1780                         exit(0);        /* Did not acquire ctty: OK */
1781         }
1782 }
1783                 ]])],
1784                 [
1785                         AC_MSG_RESULT(yes)
1786                 ],
1787                 [
1788                         AC_MSG_RESULT(no)
1789                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1790                 ],
1791                 [
1792                         AC_MSG_RESULT(cross-compiling, assuming yes)
1793                 ]
1794         )
1795 fi
1796
1797 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1798     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1799         AC_MSG_CHECKING(if getaddrinfo seems to work)
1800         AC_RUN_IFELSE(
1801                 [AC_LANG_SOURCE([[
1802 #include <stdio.h>
1803 #include <sys/socket.h>
1804 #include <netdb.h>
1805 #include <errno.h>
1806 #include <netinet/in.h>
1807
1808 #define TEST_PORT "2222"
1809
1810 int
1811 main(void)
1812 {
1813         int err, sock;
1814         struct addrinfo *gai_ai, *ai, hints;
1815         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1816
1817         memset(&hints, 0, sizeof(hints));
1818         hints.ai_family = PF_UNSPEC;
1819         hints.ai_socktype = SOCK_STREAM;
1820         hints.ai_flags = AI_PASSIVE;
1821
1822         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1823         if (err != 0) {
1824                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1825                 exit(1);
1826         }
1827
1828         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1829                 if (ai->ai_family != AF_INET6)
1830                         continue;
1831
1832                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1833                     sizeof(ntop), strport, sizeof(strport),
1834                     NI_NUMERICHOST|NI_NUMERICSERV);
1835
1836                 if (err != 0) {
1837                         if (err == EAI_SYSTEM)
1838                                 perror("getnameinfo EAI_SYSTEM");
1839                         else
1840                                 fprintf(stderr, "getnameinfo failed: %s\n",
1841                                     gai_strerror(err));
1842                         exit(2);
1843                 }
1844
1845                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1846                 if (sock < 0)
1847                         perror("socket");
1848                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1849                         if (errno == EBADF)
1850                                 exit(3);
1851                 }
1852         }
1853         exit(0);
1854 }
1855                 ]])],
1856                 [
1857                         AC_MSG_RESULT(yes)
1858                 ],
1859                 [
1860                         AC_MSG_RESULT(no)
1861                         AC_DEFINE(BROKEN_GETADDRINFO)
1862                 ],
1863                 [
1864                         AC_MSG_RESULT(cross-compiling, assuming yes)
1865                 ]
1866         )
1867 fi
1868
1869 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1870     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1871         AC_MSG_CHECKING(if getaddrinfo seems to work)
1872         AC_RUN_IFELSE(
1873                 [AC_LANG_SOURCE([[
1874 #include <stdio.h>
1875 #include <sys/socket.h>
1876 #include <netdb.h>
1877 #include <errno.h>
1878 #include <netinet/in.h>
1879
1880 #define TEST_PORT "2222"
1881
1882 int
1883 main(void)
1884 {
1885         int err, sock;
1886         struct addrinfo *gai_ai, *ai, hints;
1887         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1888
1889         memset(&hints, 0, sizeof(hints));
1890         hints.ai_family = PF_UNSPEC;
1891         hints.ai_socktype = SOCK_STREAM;
1892         hints.ai_flags = AI_PASSIVE;
1893
1894         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1895         if (err != 0) {
1896                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1897                 exit(1);
1898         }
1899
1900         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1901                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1902                         continue;
1903
1904                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1905                     sizeof(ntop), strport, sizeof(strport),
1906                     NI_NUMERICHOST|NI_NUMERICSERV);
1907
1908                 if (ai->ai_family == AF_INET && err != 0) {
1909                         perror("getnameinfo");
1910                         exit(2);
1911                 }
1912         }
1913         exit(0);
1914 }
1915                 ]])],
1916                 [
1917                         AC_MSG_RESULT(yes)
1918                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1919                                 [Define if you have a getaddrinfo that fails
1920                                 for the all-zeros IPv6 address])
1921                 ],
1922                 [
1923                         AC_MSG_RESULT(no)
1924                         AC_DEFINE(BROKEN_GETADDRINFO)
1925                 ],
1926                 [
1927                         AC_MSG_RESULT(cross-compiling, assuming no)
1928                 ]
1929         )
1930 fi
1931
1932 if test "x$check_for_conflicting_getspnam" = "x1"; then
1933         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1934         AC_COMPILE_IFELSE(
1935                 [
1936 #include <shadow.h>
1937 int main(void) {exit(0);}
1938                 ],
1939                 [
1940                         AC_MSG_RESULT(no)
1941                 ],
1942                 [
1943                         AC_MSG_RESULT(yes)
1944                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1945                             [Conflicting defs for getspnam])
1946                 ]
1947         )
1948 fi
1949
1950 AC_FUNC_GETPGRP
1951
1952 # Search for OpenSSL
1953 saved_CPPFLAGS="$CPPFLAGS"
1954 saved_LDFLAGS="$LDFLAGS"
1955 AC_ARG_WITH(ssl-dir,
1956         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1957         [
1958                 if test "x$withval" != "xno" ; then
1959                         case "$withval" in
1960                                 # Relative paths
1961                                 ./*|../*)       withval="`pwd`/$withval"
1962                         esac
1963                         if test -d "$withval/lib"; then
1964                                 if test -n "${need_dash_r}"; then
1965                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1966                                 else
1967                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1968                                 fi
1969                         else
1970                                 if test -n "${need_dash_r}"; then
1971                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1972                                 else
1973                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1974                                 fi
1975                         fi
1976                         if test -d "$withval/include"; then
1977                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1978                         else
1979                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1980                         fi
1981                 fi
1982         ]
1983 )
1984 if test -z "$GLOBUS_LDFLAGS" ; then
1985 LIBS="-lcrypto $LIBS"
1986 fi
1987 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1988         [Define if your ssl headers are included
1989         with #include <openssl/header.h>]),
1990         [
1991                 dnl Check default openssl install dir
1992                 if test -n "${need_dash_r}"; then
1993                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1994                 else
1995                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1996                 fi
1997                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1998                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1999                         [
2000                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2001                         ]
2002                 )
2003         ]
2004 )
2005
2006 # Determine OpenSSL header version
2007 AC_MSG_CHECKING([OpenSSL header version])
2008 AC_RUN_IFELSE(
2009         [AC_LANG_SOURCE([[
2010 #include <stdio.h>
2011 #include <string.h>
2012 #include <openssl/opensslv.h>
2013 #define DATA "conftest.sslincver"
2014 int main(void) {
2015         FILE *fd;
2016         int rc;
2017
2018         fd = fopen(DATA,"w");
2019         if(fd == NULL)
2020                 exit(1);
2021
2022         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
2023                 exit(1);
2024
2025         exit(0);
2026 }
2027         ]])],
2028         [
2029                 ssl_header_ver=`cat conftest.sslincver`
2030                 AC_MSG_RESULT($ssl_header_ver)
2031         ],
2032         [
2033                 AC_MSG_RESULT(not found)
2034                 AC_MSG_ERROR(OpenSSL version header not found.)
2035         ],
2036         [
2037                 AC_MSG_WARN([cross compiling: not checking])
2038         ]
2039 )
2040
2041 # Determine OpenSSL library version
2042 AC_MSG_CHECKING([OpenSSL library version])
2043 AC_RUN_IFELSE(
2044         [AC_LANG_SOURCE([[
2045 #include <stdio.h>
2046 #include <string.h>
2047 #include <openssl/opensslv.h>
2048 #include <openssl/crypto.h>
2049 #define DATA "conftest.ssllibver"
2050 int main(void) {
2051         FILE *fd;
2052         int rc;
2053
2054         fd = fopen(DATA,"w");
2055         if(fd == NULL)
2056                 exit(1);
2057
2058         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
2059                 exit(1);
2060
2061         exit(0);
2062 }
2063         ]])],
2064         [
2065                 ssl_library_ver=`cat conftest.ssllibver`
2066                 AC_MSG_RESULT($ssl_library_ver)
2067         ],
2068         [
2069                 AC_MSG_RESULT(not found)
2070                 AC_MSG_ERROR(OpenSSL library not found.)
2071         ],
2072         [
2073                 AC_MSG_WARN([cross compiling: not checking])
2074         ]
2075 )
2076
2077 AC_ARG_WITH(openssl-header-check,
2078         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2079         [  if test "x$withval" = "xno" ; then
2080                 openssl_check_nonfatal=1
2081            fi
2082         ]
2083 )
2084
2085 # Sanity check OpenSSL headers
2086 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2087 AC_RUN_IFELSE(
2088         [AC_LANG_SOURCE([[
2089 #include <string.h>
2090 #include <openssl/opensslv.h>
2091 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
2092         ]])],
2093         [
2094                 AC_MSG_RESULT(yes)
2095         ],
2096         [
2097                 AC_MSG_RESULT(no)
2098                 if test "x$openssl_check_nonfatal" = "x"; then
2099                         AC_MSG_ERROR([Your OpenSSL headers do not match your
2100 library. Check config.log for details.
2101 If you are sure your installation is consistent, you can disable the check
2102 by running "./configure --without-openssl-header-check".
2103 Also see contrib/findssl.sh for help identifying header/library mismatches.
2104 ])
2105                 else
2106                         AC_MSG_WARN([Your OpenSSL headers do not match your
2107 library. Check config.log for details.
2108 Also see contrib/findssl.sh for help identifying header/library mismatches.])
2109                 fi
2110         ],
2111         [
2112                 AC_MSG_WARN([cross compiling: not checking])
2113         ]
2114 )
2115
2116 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2117 AC_LINK_IFELSE(
2118         [AC_LANG_SOURCE([[
2119 #include <openssl/evp.h>
2120 int main(void) { SSLeay_add_all_algorithms(); }
2121         ]])],
2122         [
2123                 AC_MSG_RESULT(yes)
2124         ],
2125         [
2126                 AC_MSG_RESULT(no)
2127                 saved_LIBS="$LIBS"
2128                 LIBS="$LIBS -ldl"
2129                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2130                 AC_LINK_IFELSE(
2131                         [AC_LANG_SOURCE([[
2132 #include <openssl/evp.h>
2133 int main(void) { SSLeay_add_all_algorithms(); }
2134                         ]])],
2135                         [
2136                                 AC_MSG_RESULT(yes)
2137                         ],
2138                         [
2139                                 AC_MSG_RESULT(no)
2140                                 LIBS="$saved_LIBS"
2141                         ]
2142                 )
2143         ]
2144 )
2145
2146 AC_ARG_WITH(ssl-engine,
2147         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2148         [ if test "x$withval" != "xno" ; then
2149                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
2150                 AC_TRY_COMPILE(
2151                         [ #include <openssl/engine.h>],
2152                         [
2153 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
2154                         ],
2155                         [ AC_MSG_RESULT(yes)
2156                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
2157                              [Enable OpenSSL engine support])
2158                         ],
2159                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
2160                 )
2161           fi ]
2162 )
2163
2164 # Check for OpenSSL without EVP_aes_{192,256}_cbc
2165 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2166 AC_LINK_IFELSE(
2167         [AC_LANG_SOURCE([[
2168 #include <string.h>
2169 #include <openssl/evp.h>
2170 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
2171         ]])],
2172         [
2173                 AC_MSG_RESULT(no)
2174         ],
2175         [
2176                 AC_MSG_RESULT(yes)
2177                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2178                     [libcrypto is missing AES 192 and 256 bit functions])
2179         ]
2180 )
2181
2182 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2183 # because the system crypt() is more featureful.
2184 if test "x$check_for_libcrypt_before" = "x1"; then
2185         AC_CHECK_LIB(crypt, crypt)
2186 fi
2187
2188 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2189 # version in OpenSSL.
2190 if test "x$check_for_libcrypt_later" = "x1"; then
2191         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2192 fi
2193
2194 # Search for SHA256 support in libc and/or OpenSSL
2195 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2196
2197 saved_LIBS="$LIBS"
2198 AC_CHECK_LIB(iaf, ia_openinfo, [
2199         LIBS="$LIBS -liaf"
2200         AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
2201                                 AC_DEFINE(HAVE_LIBIAF, 1,
2202                         [Define if system has libiaf that supports set_id])
2203                                 ])
2204 ])
2205 LIBS="$saved_LIBS"
2206
2207 ### Configure cryptographic random number support
2208
2209 # Check wheter OpenSSL seeds itself
2210 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2211 AC_RUN_IFELSE(
2212         [AC_LANG_SOURCE([[
2213 #include <string.h>
2214 #include <openssl/rand.h>
2215 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2216         ]])],
2217         [
2218                 OPENSSL_SEEDS_ITSELF=yes
2219                 AC_MSG_RESULT(yes)
2220         ],
2221         [
2222                 AC_MSG_RESULT(no)
2223                 # Default to use of the rand helper if OpenSSL doesn't
2224                 # seed itself
2225                 USE_RAND_HELPER=yes
2226         ],
2227         [
2228                 AC_MSG_WARN([cross compiling: assuming yes])
2229                 # This is safe, since all recent OpenSSL versions will
2230                 # complain at runtime if not seeded correctly.
2231                 OPENSSL_SEEDS_ITSELF=yes
2232         ]
2233 )
2234
2235 # Check for PAM libs
2236 PAM_MSG="no"
2237 AC_ARG_WITH(pam,
2238         [  --with-pam              Enable PAM support ],
2239         [
2240                 if test "x$withval" != "xno" ; then
2241                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2242                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2243                                 AC_MSG_ERROR([PAM headers not found])
2244                         fi
2245
2246                         saved_LIBS="$LIBS"
2247                         AC_CHECK_LIB(dl, dlopen, , )
2248                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2249                         AC_CHECK_FUNCS(pam_getenvlist)
2250                         AC_CHECK_FUNCS(pam_putenv)
2251                         LIBS="$saved_LIBS"
2252
2253                         PAM_MSG="yes"
2254
2255                         SSHDLIBS="$SSHDLIBS -lpam"
2256                         AC_DEFINE(USE_PAM, 1,
2257                                 [Define if you want to enable PAM support])
2258
2259                         if test $ac_cv_lib_dl_dlopen = yes; then
2260                                 case "$LIBS" in
2261                                 *-ldl*)
2262                                         # libdl already in LIBS
2263                                         ;;
2264                                 *)
2265                                         SSHDLIBS="$SSHDLIBS -ldl"
2266                                         ;;
2267                                 esac
2268                         fi
2269                 fi
2270         ]
2271 )
2272
2273 # Check for older PAM
2274 if test "x$PAM_MSG" = "xyes" ; then
2275         # Check PAM strerror arguments (old PAM)
2276         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2277         AC_TRY_COMPILE(
2278                 [
2279 #include <stdlib.h>
2280 #if defined(HAVE_SECURITY_PAM_APPL_H)
2281 #include <security/pam_appl.h>
2282 #elif defined (HAVE_PAM_PAM_APPL_H)
2283 #include <pam/pam_appl.h>
2284 #endif
2285                 ],
2286                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2287                 [AC_MSG_RESULT(no)],
2288                 [
2289                         AC_DEFINE(HAVE_OLD_PAM, 1,
2290                                 [Define if you have an old version of PAM
2291                                 which takes only one argument to pam_strerror])
2292                         AC_MSG_RESULT(yes)
2293                         PAM_MSG="yes (old library)"
2294                 ]
2295         )
2296 fi
2297
2298 # Do we want to force the use of the rand helper?
2299 AC_ARG_WITH(rand-helper,
2300         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2301         [
2302                 if test "x$withval" = "xno" ; then
2303                         # Force use of OpenSSL's internal RNG, even if
2304                         # the previous test showed it to be unseeded.
2305                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2306                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2307                                 OPENSSL_SEEDS_ITSELF=yes
2308                                 USE_RAND_HELPER=""
2309                         fi
2310                 else
2311                         USE_RAND_HELPER=yes
2312                 fi
2313         ],
2314 )
2315
2316 # Which randomness source do we use?
2317 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2318         # OpenSSL only
2319         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2320                 [Define if you want OpenSSL's internally seeded PRNG only])
2321         RAND_MSG="OpenSSL internal ONLY"
2322         INSTALL_SSH_RAND_HELPER=""
2323 elif test ! -z "$USE_RAND_HELPER" ; then
2324         # install rand helper
2325         RAND_MSG="ssh-rand-helper"
2326         INSTALL_SSH_RAND_HELPER="yes"
2327 fi
2328 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2329
2330 ### Configuration of ssh-rand-helper
2331
2332 # PRNGD TCP socket
2333 AC_ARG_WITH(prngd-port,
2334         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2335         [
2336                 case "$withval" in
2337                 no)
2338                         withval=""
2339                         ;;
2340                 [[0-9]]*)
2341                         ;;
2342                 *)
2343                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2344                         ;;
2345                 esac
2346                 if test ! -z "$withval" ; then
2347                         PRNGD_PORT="$withval"
2348                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2349                                 [Port number of PRNGD/EGD random number socket])
2350                 fi
2351         ]
2352 )
2353
2354 # PRNGD Unix domain socket
2355 AC_ARG_WITH(prngd-socket,
2356         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2357         [
2358                 case "$withval" in
2359                 yes)
2360                         withval="/var/run/egd-pool"
2361                         ;;
2362                 no)
2363                         withval=""
2364                         ;;
2365                 /*)
2366                         ;;
2367                 *)
2368                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2369                         ;;
2370                 esac
2371
2372                 if test ! -z "$withval" ; then
2373                         if test ! -z "$PRNGD_PORT" ; then
2374                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2375                         fi
2376                         if test ! -r "$withval" ; then
2377                                 AC_MSG_WARN(Entropy socket is not readable)
2378                         fi
2379                         PRNGD_SOCKET="$withval"
2380                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2381                                 [Location of PRNGD/EGD random number socket])
2382                 fi
2383         ],
2384         [
2385                 # Check for existing socket only if we don't have a random device already
2386                 if test "$USE_RAND_HELPER" = yes ; then
2387                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2388                         # Insert other locations here
2389                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2390                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2391                                         PRNGD_SOCKET="$sock"
2392                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2393                                         break;
2394                                 fi
2395                         done
2396                         if test ! -z "$PRNGD_SOCKET" ; then
2397                                 AC_MSG_RESULT($PRNGD_SOCKET)
2398                         else
2399                                 AC_MSG_RESULT(not found)
2400                         fi
2401                 fi
2402         ]
2403 )
2404
2405 # Change default command timeout for hashing entropy source
2406 entropy_timeout=200
2407 AC_ARG_WITH(entropy-timeout,
2408         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2409         [
2410                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2411                     test "x${withval}" != "xyes"; then
2412                         entropy_timeout=$withval
2413                 fi
2414         ]
2415 )
2416 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2417         [Builtin PRNG command timeout])
2418
2419 SSH_PRIVSEP_USER=sshd
2420 AC_ARG_WITH(privsep-user,
2421         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2422         [
2423                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2424                     test "x${withval}" != "xyes"; then
2425                         SSH_PRIVSEP_USER=$withval
2426                 fi
2427         ]
2428 )
2429 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2430         [non-privileged user for privilege separation])
2431 AC_SUBST(SSH_PRIVSEP_USER)
2432
2433 # We do this little dance with the search path to insure
2434 # that programs that we select for use by installed programs
2435 # (which may be run by the super-user) come from trusted
2436 # locations before they come from the user's private area.
2437 # This should help avoid accidentally configuring some
2438 # random version of a program in someone's personal bin.
2439
2440 OPATH=$PATH
2441 PATH=/bin:/usr/bin
2442 test -h /bin 2> /dev/null && PATH=/usr/bin
2443 test -d /sbin && PATH=$PATH:/sbin
2444 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2445 PATH=$PATH:/etc:$OPATH
2446
2447 # These programs are used by the command hashing source to gather entropy
2448 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2449 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2450 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2451 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2452 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2453 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2454 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2455 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2456 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2457 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2458 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2459 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2460 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2461 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2462 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2463 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2464 # restore PATH
2465 PATH=$OPATH
2466
2467 # Where does ssh-rand-helper get its randomness from?
2468 INSTALL_SSH_PRNG_CMDS=""
2469 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2470         if test ! -z "$PRNGD_PORT" ; then
2471                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2472         elif test ! -z "$PRNGD_SOCKET" ; then
2473                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2474         else
2475                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2476                 RAND_HELPER_CMDHASH=yes
2477                 INSTALL_SSH_PRNG_CMDS="yes"
2478         fi
2479 fi
2480 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2481
2482
2483 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2484 if test ! -z "$SONY" ; then
2485   LIBS="$LIBS -liberty";
2486 fi
2487
2488 # Check for  long long datatypes
2489 AC_CHECK_TYPES([long long, unsigned long long, long double])
2490
2491 # Check datatype sizes
2492 AC_CHECK_SIZEOF(char, 1)
2493 AC_CHECK_SIZEOF(short int, 2)
2494 AC_CHECK_SIZEOF(int, 4)
2495 AC_CHECK_SIZEOF(long int, 4)
2496 AC_CHECK_SIZEOF(long long int, 8)
2497
2498 # Sanity check long long for some platforms (AIX)
2499 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2500         ac_cv_sizeof_long_long_int=0
2501 fi
2502
2503 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2504 if test -z "$have_llong_max"; then
2505         AC_MSG_CHECKING([for max value of long long])
2506         AC_RUN_IFELSE(
2507                 [AC_LANG_SOURCE([[
2508 #include <stdio.h>
2509 /* Why is this so damn hard? */
2510 #ifdef __GNUC__
2511 # undef __GNUC__
2512 #endif
2513 #define __USE_ISOC99
2514 #include <limits.h>
2515 #define DATA "conftest.llminmax"
2516 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2517
2518 /*
2519  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2520  * we do this the hard way.
2521  */
2522 static int
2523 fprint_ll(FILE *f, long long n)
2524 {
2525         unsigned int i;
2526         int l[sizeof(long long) * 8];
2527
2528         if (n < 0)
2529                 if (fprintf(f, "-") < 0)
2530                         return -1;
2531         for (i = 0; n != 0; i++) {
2532                 l[i] = my_abs(n % 10);
2533                 n /= 10;
2534         }
2535         do {
2536                 if (fprintf(f, "%d", l[--i]) < 0)
2537                         return -1;
2538         } while (i != 0);
2539         if (fprintf(f, " ") < 0)
2540                 return -1;
2541         return 0;
2542 }
2543
2544 int main(void) {
2545         FILE *f;
2546         long long i, llmin, llmax = 0;
2547
2548         if((f = fopen(DATA,"w")) == NULL)
2549                 exit(1);
2550
2551 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2552         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2553         llmin = LLONG_MIN;
2554         llmax = LLONG_MAX;
2555 #else
2556         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2557         /* This will work on one's complement and two's complement */
2558         for (i = 1; i > llmax; i <<= 1, i++)
2559                 llmax = i;
2560         llmin = llmax + 1LL;    /* wrap */
2561 #endif
2562
2563         /* Sanity check */
2564         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2565             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2566             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2567                 fprintf(f, "unknown unknown\n");
2568                 exit(2);
2569         }
2570
2571         if (fprint_ll(f, llmin) < 0)
2572                 exit(3);
2573         if (fprint_ll(f, llmax) < 0)
2574                 exit(4);
2575         if (fclose(f) < 0)
2576                 exit(5);
2577         exit(0);
2578 }
2579                 ]])],
2580                 [
2581                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2582                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2583
2584                         AC_MSG_RESULT($llong_max)
2585                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2586                             [max value of long long calculated by configure])
2587                         AC_MSG_CHECKING([for min value of long long])
2588                         AC_MSG_RESULT($llong_min)
2589                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2590                             [min value of long long calculated by configure])
2591                 ],
2592                 [
2593                         AC_MSG_RESULT(not found)
2594                 ],
2595                 [
2596                         AC_MSG_WARN([cross compiling: not checking])
2597                 ]
2598         )
2599 fi
2600
2601
2602 # More checks for data types
2603 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2604         AC_TRY_COMPILE(
2605                 [ #include <sys/types.h> ],
2606                 [ u_int a; a = 1;],
2607                 [ ac_cv_have_u_int="yes" ],
2608                 [ ac_cv_have_u_int="no" ]
2609         )
2610 ])
2611 if test "x$ac_cv_have_u_int" = "xyes" ; then
2612         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2613         have_u_int=1
2614 fi
2615
2616 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2617         AC_TRY_COMPILE(
2618                 [ #include <sys/types.h> ],
2619                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2620                 [ ac_cv_have_intxx_t="yes" ],
2621                 [ ac_cv_have_intxx_t="no" ]
2622         )
2623 ])
2624 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2625         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2626         have_intxx_t=1
2627 fi
2628
2629 if (test -z "$have_intxx_t" && \
2630            test "x$ac_cv_header_stdint_h" = "xyes")
2631 then
2632     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2633         AC_TRY_COMPILE(
2634                 [ #include <stdint.h> ],
2635                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2636                 [
2637                         AC_DEFINE(HAVE_INTXX_T)
2638                         AC_MSG_RESULT(yes)
2639                 ],
2640                 [ AC_MSG_RESULT(no) ]
2641         )
2642 fi
2643
2644 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2645         AC_TRY_COMPILE(
2646                 [
2647 #include <sys/types.h>
2648 #ifdef HAVE_STDINT_H
2649 # include <stdint.h>
2650 #endif
2651 #include <sys/socket.h>
2652 #ifdef HAVE_SYS_BITYPES_H
2653 # include <sys/bitypes.h>
2654 #endif
2655                 ],
2656                 [ int64_t a; a = 1;],
2657                 [ ac_cv_have_int64_t="yes" ],
2658                 [ ac_cv_have_int64_t="no" ]
2659         )
2660 ])
2661 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2662         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2663 fi
2664
2665 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2666         AC_TRY_COMPILE(
2667                 [ #include <sys/types.h> ],
2668                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2669                 [ ac_cv_have_u_intxx_t="yes" ],
2670                 [ ac_cv_have_u_intxx_t="no" ]
2671         )
2672 ])
2673 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2674         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2675         have_u_intxx_t=1
2676 fi
2677
2678 if test -z "$have_u_intxx_t" ; then
2679     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2680         AC_TRY_COMPILE(
2681                 [ #include <sys/socket.h> ],
2682                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2683                 [
2684                         AC_DEFINE(HAVE_U_INTXX_T)
2685                         AC_MSG_RESULT(yes)
2686                 ],
2687                 [ AC_MSG_RESULT(no) ]
2688         )
2689 fi
2690
2691 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2692         AC_TRY_COMPILE(
2693                 [ #include <sys/types.h> ],
2694                 [ u_int64_t a; a = 1;],
2695                 [ ac_cv_have_u_int64_t="yes" ],
2696                 [ ac_cv_have_u_int64_t="no" ]
2697         )
2698 ])
2699 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2700         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2701         have_u_int64_t=1
2702 fi
2703
2704 if test -z "$have_u_int64_t" ; then
2705     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2706         AC_TRY_COMPILE(
2707                 [ #include <sys/bitypes.h> ],
2708                 [ u_int64_t a; a = 1],
2709                 [
2710                         AC_DEFINE(HAVE_U_INT64_T)
2711                         AC_MSG_RESULT(yes)
2712                 ],
2713                 [ AC_MSG_RESULT(no) ]
2714         )
2715 fi
2716
2717 if test -z "$have_u_intxx_t" ; then
2718         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2719                 AC_TRY_COMPILE(
2720                         [
2721 #include <sys/types.h>
2722                         ],
2723                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2724                         [ ac_cv_have_uintxx_t="yes" ],
2725                         [ ac_cv_have_uintxx_t="no" ]
2726                 )
2727         ])
2728         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2729                 AC_DEFINE(HAVE_UINTXX_T, 1,
2730                         [define if you have uintxx_t data type])
2731         fi
2732 fi
2733
2734 if test -z "$have_uintxx_t" ; then
2735     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2736         AC_TRY_COMPILE(
2737                 [ #include <stdint.h> ],
2738                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2739                 [
2740                         AC_DEFINE(HAVE_UINTXX_T)
2741                         AC_MSG_RESULT(yes)
2742                 ],
2743                 [ AC_MSG_RESULT(no) ]
2744         )
2745 fi
2746
2747 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2748            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2749 then
2750         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2751         AC_TRY_COMPILE(
2752                 [
2753 #include <sys/bitypes.h>
2754                 ],
2755                 [
2756                         int8_t a; int16_t b; int32_t c;
2757                         u_int8_t e; u_int16_t f; u_int32_t g;
2758                         a = b = c = e = f = g = 1;
2759                 ],
2760                 [
2761                         AC_DEFINE(HAVE_U_INTXX_T)
2762                         AC_DEFINE(HAVE_INTXX_T)
2763                         AC_MSG_RESULT(yes)
2764                 ],
2765                 [AC_MSG_RESULT(no)]
2766         )
2767 fi
2768
2769
2770 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2771         AC_TRY_COMPILE(
2772                 [
2773 #include <sys/types.h>
2774                 ],
2775                 [ u_char foo; foo = 125; ],
2776                 [ ac_cv_have_u_char="yes" ],
2777                 [ ac_cv_have_u_char="no" ]
2778         )
2779 ])
2780 if test "x$ac_cv_have_u_char" = "xyes" ; then
2781         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2782 fi
2783
2784 TYPE_SOCKLEN_T
2785
2786 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2787
2788 AC_CHECK_TYPES(in_addr_t,,,
2789 [#include <sys/types.h>
2790 #include <netinet/in.h>])
2791
2792 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2793         AC_TRY_COMPILE(
2794                 [
2795 #include <sys/types.h>
2796                 ],
2797                 [ size_t foo; foo = 1235; ],
2798                 [ ac_cv_have_size_t="yes" ],
2799                 [ ac_cv_have_size_t="no" ]
2800         )
2801 ])
2802 if test "x$ac_cv_have_size_t" = "xyes" ; then
2803         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2804 fi
2805
2806 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2807         AC_TRY_COMPILE(
2808                 [
2809 #include <sys/types.h>
2810                 ],
2811                 [ ssize_t foo; foo = 1235; ],
2812                 [ ac_cv_have_ssize_t="yes" ],
2813                 [ ac_cv_have_ssize_t="no" ]
2814         )
2815 ])
2816 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2817         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2818 fi
2819
2820 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2821         AC_TRY_COMPILE(
2822                 [
2823 #include <time.h>
2824                 ],
2825                 [ clock_t foo; foo = 1235; ],
2826                 [ ac_cv_have_clock_t="yes" ],
2827                 [ ac_cv_have_clock_t="no" ]
2828         )
2829 ])
2830 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2831         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2832 fi
2833
2834 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2835         AC_TRY_COMPILE(
2836                 [
2837 #include <sys/types.h>
2838 #include <sys/socket.h>
2839                 ],
2840                 [ sa_family_t foo; foo = 1235; ],
2841                 [ ac_cv_have_sa_family_t="yes" ],
2842                 [ AC_TRY_COMPILE(
2843                   [
2844 #include <sys/types.h>
2845 #include <sys/socket.h>
2846 #include <netinet/in.h>
2847                 ],
2848                 [ sa_family_t foo; foo = 1235; ],
2849                 [ ac_cv_have_sa_family_t="yes" ],
2850
2851                 [ ac_cv_have_sa_family_t="no" ]
2852         )]
2853         )
2854 ])
2855 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2856         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2857                 [define if you have sa_family_t data type])
2858 fi
2859
2860 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2861         AC_TRY_COMPILE(
2862                 [
2863 #include <sys/types.h>
2864                 ],
2865                 [ pid_t foo; foo = 1235; ],
2866                 [ ac_cv_have_pid_t="yes" ],
2867                 [ ac_cv_have_pid_t="no" ]
2868         )
2869 ])
2870 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2871         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2872 fi
2873
2874 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2875         AC_TRY_COMPILE(
2876                 [
2877 #include <sys/types.h>
2878                 ],
2879                 [ mode_t foo; foo = 1235; ],
2880                 [ ac_cv_have_mode_t="yes" ],
2881                 [ ac_cv_have_mode_t="no" ]
2882         )
2883 ])
2884 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2885         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2886 fi
2887
2888
2889 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2890         AC_TRY_COMPILE(
2891                 [
2892 #include <sys/types.h>
2893 #include <sys/socket.h>
2894                 ],
2895                 [ struct sockaddr_storage s; ],
2896                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2897                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2898         )
2899 ])
2900 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2901         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2902                 [define if you have struct sockaddr_storage data type])
2903 fi
2904
2905 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2906         AC_TRY_COMPILE(
2907                 [
2908 #include <sys/types.h>
2909 #include <netinet/in.h>
2910                 ],
2911                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2912                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2913                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2914         )
2915 ])
2916 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2917         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2918                 [define if you have struct sockaddr_in6 data type])
2919 fi
2920
2921 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2922         AC_TRY_COMPILE(
2923                 [
2924 #include <sys/types.h>
2925 #include <netinet/in.h>
2926                 ],
2927                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2928                 [ ac_cv_have_struct_in6_addr="yes" ],
2929                 [ ac_cv_have_struct_in6_addr="no" ]
2930         )
2931 ])
2932 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2933         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2934                 [define if you have struct in6_addr data type])
2935 fi
2936
2937 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2938         AC_TRY_COMPILE(
2939                 [
2940 #include <sys/types.h>
2941 #include <sys/socket.h>
2942 #include <netdb.h>
2943                 ],
2944                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2945                 [ ac_cv_have_struct_addrinfo="yes" ],
2946                 [ ac_cv_have_struct_addrinfo="no" ]
2947         )
2948 ])
2949 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2950         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2951                 [define if you have struct addrinfo data type])
2952 fi
2953
2954 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2955         AC_TRY_COMPILE(
2956                 [ #include <sys/time.h> ],
2957                 [ struct timeval tv; tv.tv_sec = 1;],
2958                 [ ac_cv_have_struct_timeval="yes" ],
2959                 [ ac_cv_have_struct_timeval="no" ]
2960         )
2961 ])
2962 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2963         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2964         have_struct_timeval=1
2965 fi
2966
2967 AC_CHECK_TYPES(struct timespec)
2968
2969 # We need int64_t or else certian parts of the compile will fail.
2970 if test "x$ac_cv_have_int64_t" = "xno" && \
2971         test "x$ac_cv_sizeof_long_int" != "x8" && \
2972         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2973         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2974         echo "an alternative compiler (I.E., GCC) before continuing."
2975         echo ""
2976         exit 1;
2977 else
2978 dnl test snprintf (broken on SCO w/gcc)
2979         AC_RUN_IFELSE(
2980                 [AC_LANG_SOURCE([[
2981 #include <stdio.h>
2982 #include <string.h>
2983 #ifdef HAVE_SNPRINTF
2984 main()
2985 {
2986         char buf[50];
2987         char expected_out[50];
2988         int mazsize = 50 ;
2989 #if (SIZEOF_LONG_INT == 8)
2990         long int num = 0x7fffffffffffffff;
2991 #else
2992         long long num = 0x7fffffffffffffffll;
2993 #endif
2994         strcpy(expected_out, "9223372036854775807");
2995         snprintf(buf, mazsize, "%lld", num);
2996         if(strcmp(buf, expected_out) != 0)
2997                 exit(1);
2998         exit(0);
2999 }
3000 #else
3001 main() { exit(0); }
3002 #endif
3003                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
3004                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3005         )
3006 fi
3007
3008 dnl Checks for structure members
3009 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
3010 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
3011 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
3012 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
3013 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
3014 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
3015 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
3016 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
3017 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
3018 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
3019 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
3020 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
3021 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
3022 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
3023 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
3024 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
3025 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
3026
3027 AC_CHECK_MEMBERS([struct stat.st_blksize])
3028 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
3029         [Define if we don't have struct __res_state in resolv.h])],
3030 [
3031 #include <stdio.h>
3032 #if HAVE_SYS_TYPES_H
3033 # include <sys/types.h>
3034 #endif
3035 #include <netinet/in.h>
3036 #include <arpa/nameser.h>
3037 #include <resolv.h>
3038 ])
3039
3040 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
3041                 ac_cv_have_ss_family_in_struct_ss, [
3042         AC_TRY_COMPILE(
3043                 [
3044 #include <sys/types.h>
3045 #include <sys/socket.h>
3046                 ],
3047                 [ struct sockaddr_storage s; s.ss_family = 1; ],
3048                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
3049                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
3050         )
3051 ])
3052 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3053         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
3054 fi
3055
3056 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
3057                 ac_cv_have___ss_family_in_struct_ss, [
3058         AC_TRY_COMPILE(
3059                 [
3060 #include <sys/types.h>
3061 #include <sys/socket.h>
3062                 ],
3063                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
3064                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
3065                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
3066         )
3067 ])
3068 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
3069         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
3070                 [Fields in struct sockaddr_storage])
3071 fi
3072
3073 AC_CACHE_CHECK([for pw_class field in struct passwd],
3074                 ac_cv_have_pw_class_in_struct_passwd, [
3075         AC_TRY_COMPILE(
3076                 [
3077 #include <pwd.h>
3078                 ],
3079                 [ struct passwd p; p.pw_class = 0; ],
3080                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
3081                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
3082         )
3083 ])
3084 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
3085         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
3086                 [Define if your password has a pw_class field])
3087 fi
3088
3089 AC_CACHE_CHECK([for pw_expire field in struct passwd],
3090                 ac_cv_have_pw_expire_in_struct_passwd, [
3091         AC_TRY_COMPILE(
3092                 [
3093 #include <pwd.h>
3094                 ],
3095                 [ struct passwd p; p.pw_expire = 0; ],
3096                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
3097                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
3098         )
3099 ])
3100 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
3101         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
3102                 [Define if your password has a pw_expire field])
3103 fi
3104
3105 AC_CACHE_CHECK([for pw_change field in struct passwd],
3106                 ac_cv_have_pw_change_in_struct_passwd, [
3107         AC_TRY_COMPILE(
3108                 [
3109 #include <pwd.h>
3110                 ],
3111                 [ struct passwd p; p.pw_change = 0; ],
3112                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
3113                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
3114         )
3115 ])
3116 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
3117         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
3118                 [Define if your password has a pw_change field])
3119 fi
3120
3121 dnl make sure we're using the real structure members and not defines
3122 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3123                 ac_cv_have_accrights_in_msghdr, [
3124         AC_COMPILE_IFELSE(
3125                 [
3126 #include <sys/types.h>
3127 #include <sys/socket.h>
3128 #include <sys/uio.h>
3129 int main() {
3130 #ifdef msg_accrights
3131 #error "msg_accrights is a macro"
3132 exit(1);
3133 #endif
3134 struct msghdr m;
3135 m.msg_accrights = 0;
3136 exit(0);
3137 }
3138                 ],
3139                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3140                 [ ac_cv_have_accrights_in_msghdr="no" ]
3141         )
3142 ])
3143 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3144         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
3145                 [Define if your system uses access rights style
3146                 file descriptor passing])
3147 fi
3148
3149 AC_CACHE_CHECK([for msg_control field in struct msghdr],
3150                 ac_cv_have_control_in_msghdr, [
3151         AC_COMPILE_IFELSE(
3152                 [
3153 #include <sys/types.h>
3154 #include <sys/socket.h>
3155 #include <sys/uio.h>
3156 int main() {
3157 #ifdef msg_control
3158 #error "msg_control is a macro"
3159 exit(1);
3160 #endif
3161 struct msghdr m;
3162 m.msg_control = 0;
3163 exit(0);
3164 }
3165                 ],
3166                 [ ac_cv_have_control_in_msghdr="yes" ],
3167                 [ ac_cv_have_control_in_msghdr="no" ]
3168         )
3169 ])
3170 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
3171         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3172                 [Define if your system uses ancillary data style
3173                 file descriptor passing])
3174 fi
3175
3176 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3177         AC_TRY_LINK([],
3178                 [ extern char *__progname; printf("%s", __progname); ],
3179                 [ ac_cv_libc_defines___progname="yes" ],
3180                 [ ac_cv_libc_defines___progname="no" ]
3181         )
3182 ])
3183 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3184         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3185 fi
3186
3187 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3188         AC_TRY_LINK([
3189 #include <stdio.h>
3190 ],
3191                 [ printf("%s", __FUNCTION__); ],
3192                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3193                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3194         )
3195 ])
3196 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3197         AC_DEFINE(HAVE___FUNCTION__, 1,
3198                 [Define if compiler implements __FUNCTION__])
3199 fi
3200
3201 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3202         AC_TRY_LINK([
3203 #include <stdio.h>
3204 ],
3205                 [ printf("%s", __func__); ],
3206                 [ ac_cv_cc_implements___func__="yes" ],
3207                 [ ac_cv_cc_implements___func__="no" ]
3208         )
3209 ])
3210 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3211         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3212 fi
3213
3214 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3215         AC_TRY_LINK(
3216                 [#include <stdarg.h>
3217                  va_list x,y;],
3218                 [va_copy(x,y);],
3219                 [ ac_cv_have_va_copy="yes" ],
3220                 [ ac_cv_have_va_copy="no" ]
3221         )
3222 ])
3223 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3224         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3225 fi
3226
3227 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3228         AC_TRY_LINK(
3229                 [#include <stdarg.h>
3230                  va_list x,y;],
3231                 [__va_copy(x,y);],
3232                 [ ac_cv_have___va_copy="yes" ],
3233                 [ ac_cv_have___va_copy="no" ]
3234         )
3235 ])
3236 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3237         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3238 fi
3239
3240 AC_CACHE_CHECK([whether getopt has optreset support],
3241                 ac_cv_have_getopt_optreset, [
3242         AC_TRY_LINK(
3243                 [
3244 #include <getopt.h>
3245                 ],
3246                 [ extern int optreset; optreset = 0; ],
3247                 [ ac_cv_have_getopt_optreset="yes" ],
3248                 [ ac_cv_have_getopt_optreset="no" ]
3249         )
3250 ])
3251 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3252         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3253                 [Define if your getopt(3) defines and uses optreset])
3254 fi
3255
3256 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3257         AC_TRY_LINK([],
3258                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3259                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3260                 [ ac_cv_libc_defines_sys_errlist="no" ]
3261         )
3262 ])
3263 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3264         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3265                 [Define if your system defines sys_errlist[]])
3266 fi
3267
3268
3269 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3270         AC_TRY_LINK([],
3271                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3272                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3273                 [ ac_cv_libc_defines_sys_nerr="no" ]
3274         )
3275 ])
3276 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3277         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3278 fi
3279
3280 SCARD_MSG="no"
3281 # Check whether user wants sectok support
3282 AC_ARG_WITH(sectok,
3283         [  --with-sectok           Enable smartcard support using libsectok],
3284         [
3285                 if test "x$withval" != "xno" ; then
3286                         if test "x$withval" != "xyes" ; then
3287                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3288                                 LDFLAGS="$LDFLAGS -L${withval}"
3289                                 if test ! -z "$need_dash_r" ; then
3290                                         LDFLAGS="$LDFLAGS -R${withval}"
3291                                 fi
3292                                 if test ! -z "$blibpath" ; then
3293                                         blibpath="$blibpath:${withval}"
3294                                 fi
3295                         fi
3296                         AC_CHECK_HEADERS(sectok.h)
3297                         if test "$ac_cv_header_sectok_h" != yes; then
3298                                 AC_MSG_ERROR(Can't find sectok.h)
3299                         fi
3300                         AC_CHECK_LIB(sectok, sectok_open)
3301                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3302                                 AC_MSG_ERROR(Can't find libsectok)
3303                         fi
3304                         AC_DEFINE(SMARTCARD, 1,
3305                                 [Define if you want smartcard support])
3306                         AC_DEFINE(USE_SECTOK, 1,
3307                                 [Define if you want smartcard support
3308                                 using sectok])
3309                         SCARD_MSG="yes, using sectok"
3310                 fi
3311         ]
3312 )
3313
3314 # Check whether user wants OpenSC support
3315 OPENSC_CONFIG="no"
3316 AC_ARG_WITH(opensc,
3317         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3318         [
3319             if test "x$withval" != "xno" ; then
3320                 if test "x$withval" != "xyes" ; then
3321                         OPENSC_CONFIG=$withval/bin/opensc-config
3322                 else
3323                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3324                 fi
3325                 if test "$OPENSC_CONFIG" != "no"; then
3326                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3327                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3328                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3329                         LIBS="$LIBS $LIBOPENSC_LIBS"
3330                         AC_DEFINE(SMARTCARD)
3331                         AC_DEFINE(USE_OPENSC, 1,
3332                                 [Define if you want smartcard support
3333                                 using OpenSC])
3334                         SCARD_MSG="yes, using OpenSC"
3335                 fi
3336             fi
3337         ]
3338 )
3339
3340 # Check libraries needed by DNS fingerprint support
3341 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3342         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3343                 [Define if getrrsetbyname() exists])],
3344         [
3345                 # Needed by our getrrsetbyname()
3346                 AC_SEARCH_LIBS(res_query, resolv)
3347                 AC_SEARCH_LIBS(dn_expand, resolv)
3348                 AC_MSG_CHECKING(if res_query will link)
3349                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
3350                    [AC_MSG_RESULT(no)
3351                     saved_LIBS="$LIBS"
3352                     LIBS="$LIBS -lresolv"
3353                     AC_MSG_CHECKING(for res_query in -lresolv)
3354                     AC_LINK_IFELSE([
3355 #include <resolv.h>
3356 int main()
3357 {
3358         res_query (0, 0, 0, 0, 0);
3359         return 0;
3360 }
3361                         ],
3362                         [LIBS="$LIBS -lresolv"
3363                          AC_MSG_RESULT(yes)],
3364                         [LIBS="$saved_LIBS"
3365                          AC_MSG_RESULT(no)])
3366                     ])
3367                 AC_CHECK_FUNCS(_getshort _getlong)
3368                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3369                     [#include <sys/types.h>
3370                     #include <arpa/nameser.h>])
3371                 AC_CHECK_MEMBER(HEADER.ad,
3372                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3373                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3374                         [#include <arpa/nameser.h>])
3375         ])
3376
3377 AC_MSG_CHECKING(if struct __res_state _res is an extern)
3378 AC_LINK_IFELSE([
3379 #include <stdio.h>
3380 #if HAVE_SYS_TYPES_H
3381 # include <sys/types.h>
3382 #endif
3383 #include <netinet/in.h>
3384 #include <arpa/nameser.h>
3385 #include <resolv.h>
3386 extern struct __res_state _res;
3387 int main() { return 0; }
3388                 ],
3389                 [AC_MSG_RESULT(yes)
3390                  AC_DEFINE(HAVE__RES_EXTERN, 1,
3391                     [Define if you have struct __res_state _res as an extern])
3392                 ],
3393                 [ AC_MSG_RESULT(no) ]
3394 )
3395
3396 # Check whether user wants SELinux support
3397 SELINUX_MSG="no"
3398 LIBSELINUX=""
3399 AC_ARG_WITH(selinux,
3400         [  --with-selinux          Enable SELinux support],
3401         [ if test "x$withval" != "xno" ; then
3402                 save_LIBS="$LIBS"
3403                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3404                 SELINUX_MSG="yes"
3405                 AC_CHECK_HEADER([selinux/selinux.h], ,
3406                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3407                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3408                     AC_MSG_ERROR(SELinux support requires libselinux library))
3409                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
3410                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3411                 LIBS="$save_LIBS"
3412         fi ]
3413 )
3414
3415 # Finish configuring Globus GSSAPI
3416 if test "x$gsi_path" != "xno" ; then
3417         if test ! -z "$need_dash_r" ; then
3418                 LDFLAGS="$LDFLAGS -R${gsi_path}/lib"
3419         fi
3420         if test ! -z "$blibpath" ; then
3421                 blibpath="$blibpath:${gsi_path}/lib"
3422         fi
3423 fi
3424
3425 # Check whether the user wants GSSAPI mechglue support
3426 AC_ARG_WITH(mechglue,
3427         [  --with-mechglue=PATH    Build with GSSAPI mechglue library],
3428         [
3429                 AC_MSG_CHECKING(for mechglue library)
3430
3431                 if test -e ${withval}/libgssapi.a ; then
3432                     mechglue_lib=${withval}/libgssapi.a
3433                 elif test -e ${withval}/lib/libgssapi.a ; then
3434                     mechglue_lib=${withval}/lib/libgssapi.a
3435                 else
3436                     AC_MSG_ERROR("Can't find libgssapi in ${withval}");
3437                 fi
3438                 LIBS="${mechglue_lib} $LIBS"
3439                 AC_MSG_RESULT(${mechglue_lib})
3440
3441                 AC_CHECK_LIB(dl, dlopen, , )
3442                 if test $ac_cv_lib_dl_dlopen = yes; then
3443                    LDFLAGS="$LDFLAGS -ldl -Wl,-Bsymbolic"
3444                 fi
3445
3446                 AC_DEFINE(GSSAPI)
3447                 AC_DEFINE(MECHGLUE, 1, [Define this if you're building with GSSAPI MechGlue.])
3448                 GSSAPI="mechglue"
3449         ]
3450 )
3451
3452
3453 # Check whether user wants Kerberos 5 support
3454 KRB5_MSG="no"
3455 AC_ARG_WITH(kerberos5,
3456         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3457         [ if test "x$withval" != "xno" ; then
3458                 if test "x$withval" = "xyes" ; then
3459                         KRB5ROOT="/usr/local"
3460                 else
3461                         KRB5ROOT=${withval}
3462                 fi
3463
3464                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3465                 KRB5_MSG="yes"
3466
3467                 AC_MSG_CHECKING(for krb5-config)
3468                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3469                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3470                         AC_MSG_RESULT($KRB5CONF)
3471
3472                         AC_MSG_CHECKING(for gssapi support)
3473                         if $KRB5CONF | grep gssapi >/dev/null ; then
3474                                 AC_MSG_RESULT(yes)
3475                                 AC_DEFINE(GSSAPI, 1,
3476                                         [Define this if you want GSSAPI
3477                                         support in the version 2 protocol])
3478                                 k5confopts=gssapi
3479                         else
3480                                 AC_MSG_RESULT(no)
3481                                 k5confopts=""
3482                         fi
3483                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3484                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3485                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3486                         AC_MSG_CHECKING(whether we are using Heimdal)
3487                         AC_TRY_COMPILE([ #include <krb5.h> ],
3488                                        [ char *tmp = heimdal_version; ],
3489                                        [ AC_MSG_RESULT(yes)
3490                                          AC_DEFINE(HEIMDAL, 1,
3491                                         [Define this if you are using the
3492                                         Heimdal version of Kerberos V5]) ],
3493                                          AC_MSG_RESULT(no)
3494                         )
3495                 else
3496                         AC_MSG_RESULT(no)
3497                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3498                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3499                         AC_MSG_CHECKING(whether we are using Heimdal)
3500                         AC_TRY_COMPILE([ #include <krb5.h> ],
3501                                        [ char *tmp = heimdal_version; ],
3502                                        [ AC_MSG_RESULT(yes)
3503                                          AC_DEFINE(HEIMDAL)
3504                                          K5LIBS="-lkrb5 -ldes"
3505                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3506                                          AC_CHECK_LIB(roken, net_write,
3507                                            [K5LIBS="$K5LIBS -lroken"])
3508                                        ],
3509                                        [ AC_MSG_RESULT(no)
3510                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3511                                        ]
3512                         )
3513                         AC_SEARCH_LIBS(dn_expand, resolv)
3514
3515                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
3516                                 [ AC_DEFINE(GSSAPI)
3517                                   K5LIBS="-lgssapi $K5LIBS" ],
3518                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
3519                                         [ AC_DEFINE(GSSAPI)
3520                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3521                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3522                                         $K5LIBS)
3523                                 ],
3524                                 $K5LIBS)
3525
3526                         AC_CHECK_HEADER(gssapi.h, ,
3527                                 [ unset ac_cv_header_gssapi_h
3528                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3529                                   AC_CHECK_HEADERS(gssapi.h, ,
3530                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3531                                   )
3532                                 ]
3533                         )
3534
3535                         oldCPP="$CPPFLAGS"
3536                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3537                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3538                                         [ CPPFLAGS="$oldCPP" ])
3539
3540                         # If we're using some other GSSAPI
3541                         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
3542                                 AC_MSG_ERROR([$GSSAPI GSSAPI library conflicts with Kerberos support.  Use mechglue instead.])
3543                         fi
3544
3545                         if test -z "$GSSAPI"; then
3546                                 GSSAPI="KRB5";
3547                         fi
3548
3549                         oldCPP="$CPPFLAGS"
3550                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3551                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3552                                         [ CPPFLAGS="$oldCPP" ])
3553
3554                 fi
3555                 if test ! -z "$need_dash_r" ; then
3556                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3557                 fi
3558                 if test ! -z "$blibpath" ; then
3559                         blibpath="$blibpath:${KRB5ROOT}/lib"
3560                 fi
3561
3562                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3563                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3564                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3565
3566                 LIBS="$LIBS $K5LIBS"
3567                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3568                         [Define this if you want to use libkafs' AFS support]))
3569         fi
3570         ]
3571 )
3572
3573 # Check whether user wants AFS_KRB5 support
3574 AFS_KRB5_MSG="no"
3575 AC_ARG_WITH(afs-krb5,
3576         [  --with-afs-krb5[[=AKLOG_PATH]]  Enable aklog to get token (default=/usr/bin/aklog).],
3577         [
3578                 if test "x$withval" != "xno" ; then
3579
3580                         if test "x$withval" != "xyes" ; then
3581                                 AC_DEFINE_UNQUOTED(AKLOG_PATH, "$withval",
3582                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3583                         else
3584                                 AC_DEFINE_UNQUOTED(AKLOG_PATH,
3585                                         "/usr/bin/aklog",
3586                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3587                         fi
3588
3589                         if test -z "$KRB5ROOT" ; then
3590                                 AC_MSG_WARN([AFS_KRB5 requires Kerberos 5 support, build may fail])
3591                         fi
3592
3593                         LIBS="-lkrbafs -lkrb4 $LIBS"
3594                         if test ! -z "$AFS_LIBS" ; then
3595                                 LIBS="$LIBS $AFS_LIBS"
3596                         fi
3597                         AC_DEFINE(AFS_KRB5, 1,
3598                                 [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3599                         AFS_KRB5_MSG="yes"
3600                 fi
3601         ]
3602 )
3603
3604 AC_ARG_WITH(session-hooks,
3605         [  --with-session-hooks    Enable hooks for executing external commands                                       before/after a session],
3606         [ AC_DEFINE(SESSION_HOOKS, 1, [Define this if you want support for startup/shutdown hooks]) ]
3607 )
3608
3609 # Looking for programs, paths and files
3610
3611 PRIVSEP_PATH=/var/empty
3612 AC_ARG_WITH(privsep-path,
3613         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3614         [
3615                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3616                     test "x${withval}" != "xyes"; then
3617                         PRIVSEP_PATH=$withval
3618                 fi
3619         ]
3620 )
3621 AC_SUBST(PRIVSEP_PATH)
3622
3623 AC_ARG_WITH(xauth,
3624         [  --with-xauth=PATH       Specify path to xauth program ],
3625         [
3626                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3627                     test "x${withval}" != "xyes"; then
3628                         xauth_path=$withval
3629                 fi
3630         ],
3631         [
3632                 TestPath="$PATH"
3633                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3634                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3635                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3636                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3637                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3638                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3639                         xauth_path="/usr/openwin/bin/xauth"
3640                 fi
3641         ]
3642 )
3643
3644 STRIP_OPT=-s
3645 AC_ARG_ENABLE(strip,
3646         [  --disable-strip         Disable calling strip(1) on install],
3647         [
3648                 if test "x$enableval" = "xno" ; then
3649                         STRIP_OPT=
3650                 fi
3651         ]
3652 )
3653 AC_SUBST(STRIP_OPT)
3654
3655 if test -z "$xauth_path" ; then
3656         XAUTH_PATH="undefined"
3657         AC_SUBST(XAUTH_PATH)
3658 else
3659         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3660                 [Define if xauth is found in your path])
3661         XAUTH_PATH=$xauth_path
3662         AC_SUBST(XAUTH_PATH)
3663 fi
3664
3665 # Check for mail directory (last resort if we cannot get it from headers)
3666 if test ! -z "$MAIL" ; then
3667         maildir=`dirname $MAIL`
3668         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3669                 [Set this to your mail directory if you don't have maillock.h])
3670 fi
3671
3672 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3673         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3674         disable_ptmx_check=yes
3675 fi
3676 if test -z "$no_dev_ptmx" ; then
3677         if test "x$disable_ptmx_check" != "xyes" ; then
3678                 AC_CHECK_FILE("/dev/ptmx",
3679                         [
3680                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3681                                         [Define if you have /dev/ptmx])
3682                                 have_dev_ptmx=1
3683                         ]
3684                 )
3685         fi
3686 fi
3687
3688 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3689         AC_CHECK_FILE("/dev/ptc",
3690                 [
3691                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3692                                 [Define if you have /dev/ptc])
3693                         have_dev_ptc=1
3694                 ]
3695         )
3696 else
3697         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3698 fi
3699
3700 # Options from here on. Some of these are preset by platform above
3701 AC_ARG_WITH(mantype,
3702         [  --with-mantype=man|cat|doc  Set man page type],
3703         [
3704                 case "$withval" in
3705                 man|cat|doc)
3706                         MANTYPE=$withval
3707                         ;;
3708                 *)
3709                         AC_MSG_ERROR(invalid man type: $withval)
3710                         ;;
3711                 esac
3712         ]
3713 )
3714 if test -z "$MANTYPE"; then
3715         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3716         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3717         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3718                 MANTYPE=doc
3719         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3720                 MANTYPE=man
3721         else
3722                 MANTYPE=cat
3723         fi
3724 fi
3725 AC_SUBST(MANTYPE)
3726 if test "$MANTYPE" = "doc"; then
3727         mansubdir=man;
3728 else
3729         mansubdir=$MANTYPE;
3730 fi
3731 AC_SUBST(mansubdir)
3732
3733 # Check whether to enable MD5 passwords
3734 MD5_MSG="no"
3735 AC_ARG_WITH(md5-passwords,
3736         [  --with-md5-passwords    Enable use of MD5 passwords],
3737         [
3738                 if test "x$withval" != "xno" ; then
3739                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3740                                 [Define if you want to allow MD5 passwords])
3741                         MD5_MSG="yes"
3742                 fi
3743         ]
3744 )
3745
3746 # Whether to disable shadow password support
3747 AC_ARG_WITH(shadow,
3748         [  --without-shadow        Disable shadow password support],
3749         [
3750                 if test "x$withval" = "xno" ; then
3751                         AC_DEFINE(DISABLE_SHADOW)
3752                         disable_shadow=yes
3753                 fi
3754         ]
3755 )
3756
3757 if test -z "$disable_shadow" ; then
3758         AC_MSG_CHECKING([if the systems has expire shadow information])
3759         AC_TRY_COMPILE(
3760         [
3761 #include <sys/types.h>
3762 #include <shadow.h>
3763         struct spwd sp;
3764         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3765         [ sp_expire_available=yes ], []
3766         )
3767
3768         if test "x$sp_expire_available" = "xyes" ; then
3769                 AC_MSG_RESULT(yes)
3770                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3771                     [Define if you want to use shadow password expire field])
3772         else
3773                 AC_MSG_RESULT(no)
3774         fi
3775 fi
3776
3777 # Use ip address instead of hostname in $DISPLAY
3778 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3779         DISPLAY_HACK_MSG="yes"
3780         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3781                 [Define if you need to use IP address
3782                 instead of hostname in $DISPLAY])
3783 else
3784         DISPLAY_HACK_MSG="no"
3785         AC_ARG_WITH(ipaddr-display,
3786                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3787                 [
3788                         if test "x$withval" != "xno" ; then
3789                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3790                                 DISPLAY_HACK_MSG="yes"
3791                         fi
3792                 ]
3793         )
3794 fi
3795
3796 # check for /etc/default/login and use it if present.
3797 AC_ARG_ENABLE(etc-default-login,
3798         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3799         [ if test "x$enableval" = "xno"; then
3800                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3801                 etc_default_login=no
3802           else
3803                 etc_default_login=yes
3804           fi ],
3805         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3806           then
3807                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3808                 etc_default_login=no
3809           else
3810                 etc_default_login=yes
3811           fi ]
3812 )
3813
3814 if test "x$etc_default_login" != "xno"; then
3815         AC_CHECK_FILE("/etc/default/login",
3816             [ external_path_file=/etc/default/login ])
3817         if test "x$external_path_file" = "x/etc/default/login"; then
3818                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3819                         [Define if your system has /etc/default/login])
3820         fi
3821 fi
3822
3823 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3824 if test $ac_cv_func_login_getcapbool = "yes" && \
3825         test $ac_cv_header_login_cap_h = "yes" ; then
3826         external_path_file=/etc/login.conf
3827 fi
3828
3829 # Whether to mess with the default path
3830 SERVER_PATH_MSG="(default)"
3831 AC_ARG_WITH(default-path,
3832         [  --with-default-path=    Specify default \$PATH environment for server],
3833         [
3834                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3835                         AC_MSG_WARN([
3836 --with-default-path=PATH has no effect on this system.
3837 Edit /etc/login.conf instead.])
3838                 elif test "x$withval" != "xno" ; then
3839                         if test ! -z "$external_path_file" ; then
3840                                 AC_MSG_WARN([
3841 --with-default-path=PATH will only be used if PATH is not defined in
3842 $external_path_file .])
3843                         fi
3844                         user_path="$withval"
3845                         SERVER_PATH_MSG="$withval"
3846                 fi
3847         ],
3848         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3849                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3850         else
3851                 if test ! -z "$external_path_file" ; then
3852                         AC_MSG_WARN([
3853 If PATH is defined in $external_path_file, ensure the path to scp is included,
3854 otherwise scp will not work.])
3855                 fi
3856                 AC_RUN_IFELSE(
3857                         [AC_LANG_SOURCE([[
3858 /* find out what STDPATH is */
3859 #include <stdio.h>
3860 #ifdef HAVE_PATHS_H
3861 # include <paths.h>
3862 #endif
3863 #ifndef _PATH_STDPATH
3864 # ifdef _PATH_USERPATH  /* Irix */
3865 #  define _PATH_STDPATH _PATH_USERPATH
3866 # else
3867 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3868 # endif
3869 #endif
3870 #include <sys/types.h>
3871 #include <sys/stat.h>
3872 #include <fcntl.h>
3873 #define DATA "conftest.stdpath"
3874
3875 main()
3876 {
3877         FILE *fd;
3878         int rc;
3879
3880         fd = fopen(DATA,"w");
3881         if(fd == NULL)
3882                 exit(1);
3883
3884         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3885                 exit(1);
3886
3887         exit(0);
3888 }
3889                 ]])],
3890                 [ user_path=`cat conftest.stdpath` ],
3891                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3892                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3893         )
3894 # make sure $bindir is in USER_PATH so scp will work
3895                 t_bindir=`eval echo ${bindir}`
3896                 case $t_bindir in
3897                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3898                 esac
3899                 case $t_bindir in
3900                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3901                 esac
3902                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3903                 if test $? -ne 0  ; then
3904                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3905                         if test $? -ne 0  ; then
3906                                 user_path=$user_path:$t_bindir
3907                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3908                         fi
3909                 fi
3910         fi ]
3911 )
3912 if test "x$external_path_file" != "x/etc/login.conf" ; then
3913         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3914         AC_SUBST(user_path)
3915 fi
3916
3917 # Set superuser path separately to user path
3918 AC_ARG_WITH(superuser-path,
3919         [  --with-superuser-path=  Specify different path for super-user],
3920         [
3921                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3922                     test "x${withval}" != "xyes"; then
3923                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3924                                 [Define if you want a different $PATH
3925                                 for the superuser])
3926                         superuser_path=$withval
3927                 fi
3928         ]
3929 )
3930
3931
3932 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3933 IPV4_IN6_HACK_MSG="no"
3934 AC_ARG_WITH(4in6,
3935         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3936         [
3937                 if test "x$withval" != "xno" ; then
3938                         AC_MSG_RESULT(yes)
3939                         AC_DEFINE(IPV4_IN_IPV6, 1,
3940                                 [Detect IPv4 in IPv6 mapped addresses
3941                                 and treat as IPv4])
3942                         IPV4_IN6_HACK_MSG="yes"
3943                 else
3944                         AC_MSG_RESULT(no)
3945                 fi
3946         ],[
3947                 if test "x$inet6_default_4in6" = "xyes"; then
3948                         AC_MSG_RESULT([yes (default)])
3949                         AC_DEFINE(IPV4_IN_IPV6)
3950                         IPV4_IN6_HACK_MSG="yes"
3951                 else
3952                         AC_MSG_RESULT([no (default)])
3953                 fi
3954         ]
3955 )
3956
3957 # Whether to enable BSD auth support
3958 BSD_AUTH_MSG=no
3959 AC_ARG_WITH(bsd-auth,
3960         [  --with-bsd-auth         Enable BSD auth support],
3961         [
3962                 if test "x$withval" != "xno" ; then
3963                         AC_DEFINE(BSD_AUTH, 1,
3964                                 [Define if you have BSD auth support])
3965                         BSD_AUTH_MSG=yes
3966                 fi
3967         ]
3968 )
3969
3970 # Where to place sshd.pid
3971 piddir=/var/run
3972 # make sure the directory exists
3973 if test ! -d $piddir ; then
3974         piddir=`eval echo ${sysconfdir}`
3975         case $piddir in
3976                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3977         esac
3978 fi
3979
3980 AC_ARG_WITH(pid-dir,
3981         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3982         [
3983                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3984                     test "x${withval}" != "xyes"; then
3985                         piddir=$withval
3986                         if test ! -d $piddir ; then
3987                         AC_MSG_WARN([** no $piddir directory on this system **])
3988                         fi
3989                 fi
3990         ]
3991 )
3992
3993 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3994 AC_SUBST(piddir)
3995
3996 dnl allow user to disable some login recording features
3997 AC_ARG_ENABLE(lastlog,
3998         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3999         [
4000                 if test "x$enableval" = "xno" ; then
4001                         AC_DEFINE(DISABLE_LASTLOG)
4002                 fi
4003         ]
4004 )
4005 AC_ARG_ENABLE(utmp,
4006         [  --disable-utmp          disable use of utmp even if detected [no]],
4007         [
4008                 if test "x$enableval" = "xno" ; then
4009                         AC_DEFINE(DISABLE_UTMP)
4010                 fi
4011         ]
4012 )
4013 AC_ARG_ENABLE(utmpx,
4014         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4015         [
4016                 if test "x$enableval" = "xno" ; then
4017                         AC_DEFINE(DISABLE_UTMPX, 1,
4018                                 [Define if you don't want to use utmpx])
4019                 fi
4020         ]
4021 )
4022 AC_ARG_ENABLE(wtmp,
4023         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4024         [
4025                 if test "x$enableval" = "xno" ; then
4026                         AC_DEFINE(DISABLE_WTMP)
4027                 fi
4028         ]
4029 )
4030 AC_ARG_ENABLE(wtmpx,
4031         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4032         [
4033                 if test "x$enableval" = "xno" ; then
4034                         AC_DEFINE(DISABLE_WTMPX, 1,
4035                                 [Define if you don't want to use wtmpx])
4036                 fi
4037         ]
4038 )
4039 AC_ARG_ENABLE(libutil,
4040         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4041         [
4042                 if test "x$enableval" = "xno" ; then
4043                         AC_DEFINE(DISABLE_LOGIN)
4044                 fi
4045         ]
4046 )
4047 AC_ARG_ENABLE(pututline,
4048         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4049         [
4050                 if test "x$enableval" = "xno" ; then
4051                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
4052                                 [Define if you don't want to use pututline()
4053                                 etc. to write [uw]tmp])
4054                 fi
4055         ]
4056 )
4057 AC_ARG_ENABLE(pututxline,
4058         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4059         [
4060                 if test "x$enableval" = "xno" ; then
4061                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
4062                                 [Define if you don't want to use pututxline()
4063                                 etc. to write [uw]tmpx])
4064                 fi
4065         ]
4066 )
4067 AC_ARG_WITH(lastlog,
4068   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4069         [
4070                 if test "x$withval" = "xno" ; then
4071                         AC_DEFINE(DISABLE_LASTLOG)
4072                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4073                         conf_lastlog_location=$withval
4074                 fi
4075         ]
4076 )
4077
4078 dnl lastlog, [uw]tmpx? detection
4079 dnl  NOTE: set the paths in the platform section to avoid the
4080 dnl   need for command-line parameters
4081 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4082
4083 dnl lastlog detection
4084 dnl  NOTE: the code itself will detect if lastlog is a directory
4085 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4086 AC_TRY_COMPILE([
4087 #include <sys/types.h>
4088 #include <utmp.h>
4089 #ifdef HAVE_LASTLOG_H
4090 #  include <lastlog.h>
4091 #endif
4092 #ifdef HAVE_PATHS_H
4093 #  include <paths.h>
4094 #endif
4095 #ifdef HAVE_LOGIN_H
4096 # include <login.h>
4097 #endif
4098         ],
4099         [ char *lastlog = LASTLOG_FILE; ],
4100         [ AC_MSG_RESULT(yes) ],
4101         [
4102                 AC_MSG_RESULT(no)
4103                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4104                 AC_TRY_COMPILE([
4105 #include <sys/types.h>
4106 #include <utmp.h>
4107 #ifdef HAVE_LASTLOG_H
4108 #  include <lastlog.h>
4109 #endif
4110 #ifdef HAVE_PATHS_H
4111 #  include <paths.h>
4112 #endif
4113                 ],
4114                 [ char *lastlog = _PATH_LASTLOG; ],
4115                 [ AC_MSG_RESULT(yes) ],
4116                 [
4117                         AC_MSG_RESULT(no)
4118                         system_lastlog_path=no
4119                 ])
4120         ]
4121 )
4122
4123 if test -z "$conf_lastlog_location"; then
4124         if test x"$system_lastlog_path" = x"no" ; then
4125                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
4126                                 if (test -d "$f" || test -f "$f") ; then
4127                                         conf_lastlog_location=$f
4128                                 fi
4129                 done
4130                 if test -z "$conf_lastlog_location"; then
4131                         AC_MSG_WARN([** Cannot find lastlog **])
4132                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4133                 fi
4134         fi
4135 fi
4136
4137 if test -n "$conf_lastlog_location"; then
4138         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
4139                 [Define if you want to specify the path to your lastlog file])
4140 fi
4141
4142 dnl utmp detection
4143 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4144 AC_TRY_COMPILE([
4145 #include <sys/types.h>
4146 #include <utmp.h>
4147 #ifdef HAVE_PATHS_H
4148 #  include <paths.h>
4149 #endif
4150         ],
4151         [ char *utmp = UTMP_FILE; ],
4152         [ AC_MSG_RESULT(yes) ],
4153         [ AC_MSG_RESULT(no)
4154           system_utmp_path=no ]
4155 )
4156 if test -z "$conf_utmp_location"; then
4157         if test x"$system_utmp_path" = x"no" ; then
4158                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
4159                         if test -f $f ; then
4160                                 conf_utmp_location=$f
4161                         fi
4162                 done
4163                 if test -z "$conf_utmp_location"; then
4164                         AC_DEFINE(DISABLE_UTMP)
4165                 fi
4166         fi
4167 fi
4168 if test -n "$conf_utmp_location"; then
4169         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
4170                 [Define if you want to specify the path to your utmp file])
4171 fi
4172
4173 dnl wtmp detection
4174 AC_MSG_CHECKING([if your system defines WTMP_FILE])
4175 AC_TRY_COMPILE([
4176 #include <sys/types.h>
4177 #include <utmp.h>
4178 #ifdef HAVE_PATHS_H
4179 #  include <paths.h>
4180 #endif
4181         ],
4182         [ char *wtmp = WTMP_FILE; ],
4183         [ AC_MSG_RESULT(yes) ],
4184         [ AC_MSG_RESULT(no)
4185           system_wtmp_path=no ]
4186 )
4187 if test -z "$conf_wtmp_location"; then
4188         if test x"$system_wtmp_path" = x"no" ; then
4189                 for f in /usr/adm/wtmp /var/log/wtmp; do
4190                         if test -f $f ; then
4191                                 conf_wtmp_location=$f
4192                         fi
4193                 done
4194                 if test -z "$conf_wtmp_location"; then
4195                         AC_DEFINE(DISABLE_WTMP)
4196                 fi
4197         fi
4198 fi
4199 if test -n "$conf_wtmp_location"; then
4200         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
4201                 [Define if you want to specify the path to your wtmp file])
4202 fi
4203
4204
4205 dnl utmpx detection - I don't know any system so perverse as to require
4206 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
4207 dnl  there, though.
4208 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
4209 AC_TRY_COMPILE([
4210 #include <sys/types.h>
4211 #include <utmp.h>
4212 #ifdef HAVE_UTMPX_H
4213 #include <utmpx.h>
4214 #endif
4215 #ifdef HAVE_PATHS_H
4216 #  include <paths.h>
4217 #endif
4218         ],
4219         [ char *utmpx = UTMPX_FILE; ],
4220         [ AC_MSG_RESULT(yes) ],
4221         [ AC_MSG_RESULT(no)
4222           system_utmpx_path=no ]
4223 )
4224 if test -z "$conf_utmpx_location"; then
4225         if test x"$system_utmpx_path" = x"no" ; then
4226                 AC_DEFINE(DISABLE_UTMPX)
4227         fi
4228 else
4229         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
4230                 [Define if you want to specify the path to your utmpx file])
4231 fi
4232
4233 dnl wtmpx detection
4234 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
4235 AC_TRY_COMPILE([
4236 #include <sys/types.h>
4237 #include <utmp.h>
4238 #ifdef HAVE_UTMPX_H
4239 #include <utmpx.h>
4240 #endif
4241 #ifdef HAVE_PATHS_H
4242 #  include <paths.h>
4243 #endif
4244         ],
4245         [ char *wtmpx = WTMPX_FILE; ],
4246         [ AC_MSG_RESULT(yes) ],
4247         [ AC_MSG_RESULT(no)
4248           system_wtmpx_path=no ]
4249 )
4250 if test -z "$conf_wtmpx_location"; then
4251         if test x"$system_wtmpx_path" = x"no" ; then
4252                 AC_DEFINE(DISABLE_WTMPX)
4253         fi
4254 else
4255         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
4256                 [Define if you want to specify the path to your wtmpx file])
4257 fi
4258
4259
4260 if test ! -z "$blibpath" ; then
4261         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4262         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4263 fi
4264
4265 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4266 dnl Add now.
4267 CFLAGS="$CFLAGS $werror_flags"
4268
4269 AC_EXEEXT
4270 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4271         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4272         scard/Makefile ssh_prng_cmds survey.sh])
4273 AC_OUTPUT
4274
4275 # Print summary of options
4276
4277 # Someone please show me a better way :)
4278 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4279 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4280 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4281 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4282 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4283 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4284 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
4285 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4286 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4287 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4288
4289 echo ""
4290 echo "OpenSSH has been configured with the following options:"
4291 echo "                     User binaries: $B"
4292 echo "                   System binaries: $C"
4293 echo "               Configuration files: $D"
4294 echo "                   Askpass program: $E"
4295 echo "                      Manual pages: $F"
4296 echo "                          PID file: $G"
4297 echo "  Privilege separation chroot path: $H"
4298 if test "x$external_path_file" = "x/etc/login.conf" ; then
4299 echo "   At runtime, sshd will use the path defined in $external_path_file"
4300 echo "   Make sure the path to scp is present, otherwise scp will not work"
4301 else
4302 echo "            sshd default user PATH: $I"
4303         if test ! -z "$external_path_file"; then
4304 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4305 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4306         fi
4307 fi
4308 if test ! -z "$superuser_path" ; then
4309 echo "          sshd superuser user PATH: $J"
4310 fi
4311 echo "                    Manpage format: $MANTYPE"
4312 echo "                       PAM support: $PAM_MSG"
4313 echo "                   OSF SIA support: $SIA_MSG"
4314 echo "                 KerberosV support: $KRB5_MSG"
4315 echo "                   SELinux support: $SELINUX_MSG"
4316 echo "                 Smartcard support: $SCARD_MSG"
4317 echo "                     S/KEY support: $SKEY_MSG"
4318 echo "              TCP Wrappers support: $TCPW_MSG"
4319 echo "              MD5 password support: $MD5_MSG"
4320 echo "                   libedit support: $LIBEDIT_MSG"
4321 echo "  Solaris process contract support: $SPC_MSG"
4322 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4323 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4324 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4325 echo "              Random number source: $RAND_MSG"
4326 if test ! -z "$USE_RAND_HELPER" ; then
4327 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4328 fi
4329
4330 echo ""
4331
4332 echo "              Host: ${host}"
4333 echo "          Compiler: ${CC}"
4334 echo "    Compiler flags: ${CFLAGS}"
4335 echo "Preprocessor flags: ${CPPFLAGS}"
4336 echo "      Linker flags: ${LDFLAGS}"
4337 echo "         Libraries: ${LIBS}"
4338 if test ! -z "${SSHDLIBS}"; then
4339 echo "         +for sshd: ${SSHDLIBS}"
4340 fi
4341
4342 echo ""
4343
4344 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4345         echo "SVR4 style packages are supported with \"make package\""
4346         echo ""
4347 fi
4348
4349 if test "x$PAM_MSG" = "xyes" ; then
4350         echo "PAM is enabled. You may need to install a PAM control file "
4351         echo "for sshd, otherwise password authentication may fail. "
4352         echo "Example PAM control files can be found in the contrib/ "
4353         echo "subdirectory"
4354         echo ""
4355 fi
4356
4357 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4358         echo "WARNING: you are using the builtin random number collection "
4359         echo "service. Please read WARNING.RNG and request that your OS "
4360         echo "vendor includes kernel-based random number collection in "
4361         echo "future versions of your OS."
4362         echo ""
4363 fi
4364
4365 if test ! -z "$NO_PEERCHECK" ; then
4366         echo "WARNING: the operating system that you are using does not"
4367         echo "appear to support getpeereid(), getpeerucred() or the"
4368         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
4369         echo "enforce security checks to prevent unauthorised connections to"
4370         echo "ssh-agent. Their absence increases the risk that a malicious"
4371         echo "user can connect to your agent."
4372         echo ""
4373 fi
4374
4375 if test "$AUDIT_MODULE" = "bsm" ; then
4376         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4377         echo "See the Solaris section in README.platform for details."
4378 fi