openssh/configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PATH_PROG(AR, ar)
  33 AC_PATH_PROG(CAT, cat)
  34 AC_PATH_PROG(KILL, kill)
  35 AC_PATH_PROGS(PERL, perl5 perl)
  36 AC_PATH_PROG(SED, sed)
  37 AC_SUBST(PERL)
  38 AC_PATH_PROG(ENT, ent)
  39 AC_SUBST(ENT)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  43 AC_PATH_PROG(SH, sh)
  44 AC_SUBST(TEST_SHELL,sh)
  45
  46 dnl for buildpkg.sh
  47 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  50         [/usr/sbin${PATH_SEPARATOR}/etc])
  51 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  52 if test -x /sbin/sh; then
  53         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  54 else
  55         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  56 fi
  57
  58 # System features
  59 AC_SYS_LARGEFILE
  60
  61 if test -z "$AR" ; then
  62         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  63 fi
  64
  65 # Use LOGIN_PROGRAM from environment if possible
  66 if test ! -z "$LOGIN_PROGRAM" ; then
  67         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  68                 [If your header files don't define LOGIN_PROGRAM,
  69                 then use this (detected) from environment and PATH])
  70 else
  71         # Search for login
  72         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  73         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  74                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  75         fi
  76 fi
  77
  78 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  79 if test ! -z "$PATH_PASSWD_PROG" ; then
  80         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  81                 [Full path of your "passwd" program])
  82 fi
  83
  84 if test -z "$LD" ; then
  85         LD=$CC
  86 fi
  87 AC_SUBST(LD)
  88
  89 AC_C_INLINE
  90
  91 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  92
  93 use_stack_protector=1
  94 AC_ARG_WITH(stackprotect,
  95     [  --without-stackprotect  Don't use compiler's stack protection], [
  96     if test "x$withval" = "xno"; then
  97         use_stack_protector=0
  98     fi ])
  99
 100 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 101         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
 102         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 103         case $GCC_VER in
 104                 1.*) no_attrib_nonnull=1 ;;
 105                 2.8* | 2.9*)
 106                      CFLAGS="$CFLAGS -Wsign-compare"
 107                      no_attrib_nonnull=1
 108                      ;;
 109                 2.*) no_attrib_nonnull=1 ;;
 110                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 111                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 112                 *) ;;
 113         esac
 114
 115         # -fstack-protector-all doesn't always work for some GCC versions
 116         # and/or platforms, so we test if we can.  If it's not supported
 117         # on a give platform gcc will emit a warning so we use -Werror.
 118         if test "x$use_stack_protector" = "x1"; then
 119             for t in -fstack-protector-all -fstack-protector; do
 120                 AC_MSG_CHECKING(if $CC supports $t)
 121                 saved_CFLAGS="$CFLAGS"
 122                 saved_LDFLAGS="$LDFLAGS"
 123                 CFLAGS="$CFLAGS $t -Werror"
 124                 LDFLAGS="$LDFLAGS $t -Werror"
 125                 AC_LINK_IFELSE(
 126                         [AC_LANG_SOURCE([
 127 #include <stdlib.h>
 128 int main(void){return 0;}
 129                          ])],
 130                     [ AC_MSG_RESULT(yes)
 131                       CFLAGS="$saved_CFLAGS $t"
 132                       LDFLAGS="$saved_LDFLAGS $t"
 133                       AC_MSG_CHECKING(if $t works)
 134                       AC_RUN_IFELSE(
 135                         [AC_LANG_SOURCE([
 136 #include <stdlib.h>
 137 int main(void){exit(0);}
 138                         ])],
 139                         [ AC_MSG_RESULT(yes)
 140                           break ],
 141                         [ AC_MSG_RESULT(no) ],
 142                         [ AC_MSG_WARN([cross compiling: cannot test])
 143                           break ]
 144                       )
 145                     ],
 146                     [ AC_MSG_RESULT(no) ]
 147                 )
 148                 CFLAGS="$saved_CFLAGS"
 149                 LDFLAGS="$saved_LDFLAGS"
 150             done
 151         fi
 152
 153         if test -z "$have_llong_max"; then
 154                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 155                 unset ac_cv_have_decl_LLONG_MAX
 156                 saved_CFLAGS="$CFLAGS"
 157                 CFLAGS="$CFLAGS -std=gnu99"
 158                 AC_CHECK_DECL(LLONG_MAX,
 159                     [have_llong_max=1],
 160                     [CFLAGS="$saved_CFLAGS"],
 161                     [#include <limits.h>]
 162                 )
 163         fi
 164 fi
 165
 166 if test "x$no_attrib_nonnull" != "x1" ; then
 167         AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
 168 fi
 169
 170 AC_ARG_WITH(rpath,
 171         [  --without-rpath         Disable auto-added -R linker paths],
 172         [
 173                 if test "x$withval" = "xno" ; then
 174                         need_dash_r=""
 175                 fi
 176                 if test "x$withval" = "xyes" ; then
 177                         need_dash_r=1
 178                 fi
 179         ]
 180 )
 181
 182 # Allow user to specify flags
 183 AC_ARG_WITH(cflags,
 184         [  --with-cflags           Specify additional flags to pass to compiler],
 185         [
 186                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 187                     test "x${withval}" != "xyes"; then
 188                         CFLAGS="$CFLAGS $withval"
 189                 fi
 190         ]
 191 )
 192 AC_ARG_WITH(cppflags,
 193         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 194         [
 195                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 196                     test "x${withval}" != "xyes"; then
 197                         CPPFLAGS="$CPPFLAGS $withval"
 198                 fi
 199         ]
 200 )
 201 AC_ARG_WITH(ldflags,
 202         [  --with-ldflags          Specify additional flags to pass to linker],
 203         [
 204                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 205                     test "x${withval}" != "xyes"; then
 206                         LDFLAGS="$LDFLAGS $withval"
 207                 fi
 208         ]
 209 )
 210 AC_ARG_WITH(libs,
 211         [  --with-libs             Specify additional libraries to link with],
 212         [
 213                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 214                     test "x${withval}" != "xyes"; then
 215                         LIBS="$LIBS $withval"
 216                 fi
 217         ]
 218 )
 219 AC_ARG_WITH(Werror,
 220         [  --with-Werror           Build main code with -Werror],
 221         [
 222                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 223                         werror_flags="-Werror"
 224                         if test "x${withval}" != "xyes"; then
 225                                 werror_flags="$withval"
 226                         fi
 227                 fi
 228         ]
 229 )
 230
 231 AC_CHECK_HEADERS( \
 232         bstring.h \
 233         crypt.h \
 234         crypto/sha2.h \
 235         dirent.h \
 236         endian.h \
 237         features.h \
 238         fcntl.h \
 239         floatingpoint.h \
 240         getopt.h \
 241         glob.h \
 242         ia.h \
 243         iaf.h \
 244         limits.h \
 245         login.h \
 246         maillock.h \
 247         ndir.h \
 248         net/if_tun.h \
 249         netdb.h \
 250         netgroup.h \
 251         pam/pam_appl.h \
 252         paths.h \
 253         poll.h \
 254         pty.h \
 255         readpassphrase.h \
 256         rpc/types.h \
 257         security/pam_appl.h \
 258         sha2.h \
 259         shadow.h \
 260         stddef.h \
 261         stdint.h \
 262         string.h \
 263         strings.h \
 264         sys/audit.h \
 265         sys/bitypes.h \
 266         sys/bsdtty.h \
 267         sys/cdefs.h \
 268         sys/dir.h \
 269         sys/mman.h \
 270         sys/ndir.h \
 271         sys/poll.h \
 272         sys/prctl.h \
 273         sys/pstat.h \
 274         sys/select.h \
 275         sys/stat.h \
 276         sys/stream.h \
 277         sys/stropts.h \
 278         sys/strtio.h \
 279         sys/sysmacros.h \
 280         sys/time.h \
 281         sys/timers.h \
 282         sys/un.h \
 283         time.h \
 284         tmpdir.h \
 285         ttyent.h \
 286         ucred.h \
 287         unistd.h \
 288         usersec.h \
 289         util.h \
 290         utime.h \
 291         utmp.h \
 292         utmpx.h \
 293         vis.h \
 294 )
 295
 296 # lastlog.h requires sys/time.h to be included first on Solaris
 297 AC_CHECK_HEADERS(lastlog.h, [], [], [
 298 #ifdef HAVE_SYS_TIME_H
 299 # include <sys/time.h>
 300 #endif
 301 ])
 302
 303 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 304 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 305 #ifdef HAVE_SYS_STREAM_H
 306 # include <sys/stream.h>
 307 #endif
 308 ])
 309
 310 # login_cap.h requires sys/types.h on NetBSD
 311 AC_CHECK_HEADERS(login_cap.h, [], [], [
 312 #include <sys/types.h>
 313 ])
 314
 315 # Messages for features tested for in target-specific section
 316 SIA_MSG="no"
 317 SPC_MSG="no"
 318
 319 # Check for some target-specific stuff
 320 case "$host" in
 321 *-*-aix*)
 322         # Some versions of VAC won't allow macro redefinitions at
 323         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 324         # particularly with older versions of vac or xlc.
 325         # It also throws errors about null macro argments, but these are
 326         # not fatal.
 327         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 328         AC_COMPILE_IFELSE(
 329             [AC_LANG_SOURCE([[
 330 #define testmacro foo
 331 #define testmacro bar
 332 int main(void) { exit(0); }
 333             ]])],
 334             [ AC_MSG_RESULT(yes) ],
 335             [ AC_MSG_RESULT(no)
 336               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 337               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 338               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 339               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 340             ]
 341         )
 342
 343         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 344         if (test -z "$blibpath"); then
 345                 blibpath="/usr/lib:/lib"
 346         fi
 347         saved_LDFLAGS="$LDFLAGS"
 348         if test "$GCC" = "yes"; then
 349                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 350         else
 351                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 352         fi
 353         for tryflags in $flags ;do
 354                 if (test -z "$blibflags"); then
 355                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 356                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 357                 fi
 358         done
 359         if (test -z "$blibflags"); then
 360                 AC_MSG_RESULT(not found)
 361                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 362         else
 363                 AC_MSG_RESULT($blibflags)
 364         fi
 365         LDFLAGS="$saved_LDFLAGS"
 366         dnl Check for authenticate.  Might be in libs.a on older AIXes
 367         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 368                 [Define if you want to enable AIX4's authenticate function])],
 369                 [AC_CHECK_LIB(s,authenticate,
 370                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 371                                 LIBS="$LIBS -ls"
 372                         ])
 373                 ])
 374         dnl Check for various auth function declarations in headers.
 375         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 376             passwdexpired, setauthdb], , , [#include <usersec.h>])
 377         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 378         AC_CHECK_DECLS(loginfailed,
 379                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 380                   AC_TRY_COMPILE(
 381                         [#include <usersec.h>],
 382                         [(void)loginfailed("user","host","tty",0);],
 383                         [AC_MSG_RESULT(yes)
 384                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 385                                 [Define if your AIX loginfailed() function
 386                                 takes 4 arguments (AIX >= 5.2)])],
 387                         [AC_MSG_RESULT(no)]
 388                 )],
 389                 [],
 390                 [#include <usersec.h>]
 391         )
 392         AC_CHECK_FUNCS(getgrset setauthdb)
 393         AC_CHECK_DECL(F_CLOSEM,
 394             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 395             [],
 396             [ #include <limits.h>
 397               #include <fcntl.h> ]
 398         )
 399         check_for_aix_broken_getaddrinfo=1
 400         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 401         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 402             [Define if your platform breaks doing a seteuid before a setuid])
 403         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 404         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 405         dnl AIX handles lastlog as part of its login message
 406         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 407         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 408                 [Some systems need a utmpx entry for /bin/login to work])
 409         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 410                 [Define to a Set Process Title type if your system is
 411                 supported by bsd-setproctitle.c])
 412         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 413             [AIX 5.2 and 5.3 (and presumably newer) require this])
 414         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 415         ;;
 416 *-*-cygwin*)
 417         check_for_libcrypt_later=1
 418         LIBS="$LIBS /usr/lib/textreadmode.o"
 419         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 420         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 421         AC_DEFINE(DISABLE_SHADOW, 1,
 422                 [Define if you want to disable shadow passwords])
 423         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 424                 [Define if your system choked on IP TOS setting])
 425         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 426                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 427         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 428                 [Define if the concept of ports only accessible to
 429                 superusers isn't known])
 430         AC_DEFINE(DISABLE_FD_PASSING, 1,
 431                 [Define if your platform needs to skip post auth
 432                 file descriptor passing])
 433         ;;
 434 *-*-dgux*)
 435         AC_DEFINE(IP_TOS_IS_BROKEN)
 436         AC_DEFINE(SETEUID_BREAKS_SETUID)
 437         AC_DEFINE(BROKEN_SETREUID)
 438         AC_DEFINE(BROKEN_SETREGID)
 439         ;;
 440 *-*-darwin*)
 441         AC_DEFINE(BROKEN_GETADDRINFO, 1, [Define if getaddrinfo is broken)])
 442         AC_DEFINE(BROKEN_GETADDRINFO)
 443         AC_DEFINE(SETEUID_BREAKS_SETUID)
 444         AC_DEFINE(BROKEN_SETREUID)
 445         AC_DEFINE(BROKEN_SETREGID)
 446         AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
 447         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 448                 [Define if your resolver libs need this for getrrsetbyname])
 449         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 450         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 451             [Use tunnel device compatibility to OpenBSD])
 452         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 453             [Prepend the address family to IP tunnel traffic])
 454         m4_pattern_allow(AU_IPv)
 455         AC_CHECK_DECL(AU_IPv4, [],
 456             AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
 457             [#include <bsm/audit.h>]
 458         )
 459         AC_MSG_CHECKING(if we have the Security Authorization Session API)
 460         AC_TRY_COMPILE([#include <Security/AuthSession.h>],
 461                 [SessionCreate(0, 0);],
 462                 [ac_cv_use_security_session_api="yes"
 463                  AC_DEFINE(USE_SECURITY_SESSION_API, 1,
 464                         [platform has the Security Authorization Session API])
 465                  LIBS="$LIBS -framework Security"
 466                  AC_MSG_RESULT(yes)],
 467                 [ac_cv_use_security_session_api="no"
 468                  AC_MSG_RESULT(no)])
 469         AC_MSG_CHECKING(if we have an in-memory credentials cache)
 470         AC_TRY_COMPILE(
 471                 [#include <Kerberos/Kerberos.h>],
 472                 [cc_context_t c;
 473                  (void) cc_initialize (&c, 0, NULL, NULL);],
 474                 [AC_DEFINE(USE_CCAPI, 1,
 475                         [platform uses an in-memory credentials cache])
 476                  LIBS="$LIBS -framework Security"
 477                  AC_MSG_RESULT(yes)
 478                  if test "x$ac_cv_use_security_session_api" = "xno"; then
 479                         AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
 480                 fi],
 481                 [AC_MSG_RESULT(no)]
 482         )
 483         ;;
 484 *-*-dragonfly*)
 485         SSHDLIBS="$SSHDLIBS -lcrypt"
 486         ;;
 487 *-*-hpux*)
 488         # first we define all of the options common to all HP-UX releases
 489         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 490         IPADDR_IN_DISPLAY=yes
 491         AC_DEFINE(USE_PIPES)
 492         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 493             [Define if your login program cannot handle end of options ("--")])
 494         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 495         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 496                 [String used in /etc/passwd to denote locked account])
 497         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 498         MAIL="/var/mail/username"
 499         LIBS="$LIBS -lsec"
 500         AC_CHECK_LIB(xnet, t_error, ,
 501             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 502
 503         # next, we define all of the options specific to major releases
 504         case "$host" in
 505         *-*-hpux10*)
 506                 if test -z "$GCC"; then
 507                         CFLAGS="$CFLAGS -Ae"
 508                 fi
 509                 ;;
 510         *-*-hpux11*)
 511                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 512                         [Define if you are using Solaris-derived PAM which
 513                         passes pam_messages to the conversation function
 514                         with an extra level of indirection])
 515                 AC_DEFINE(DISABLE_UTMP, 1,
 516                         [Define if you don't want to use utmp])
 517                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 518                 check_for_hpux_broken_getaddrinfo=1
 519                 check_for_conflicting_getspnam=1
 520                 ;;
 521         esac
 522
 523         # lastly, we define options specific to minor releases
 524         case "$host" in
 525         *-*-hpux10.26)
 526                 AC_DEFINE(HAVE_SECUREWARE, 1,
 527                         [Define if you have SecureWare-based
 528                         protected password database])
 529                 disable_ptmx_check=yes
 530                 LIBS="$LIBS -lsecpw"
 531                 ;;
 532         esac
 533         ;;
 534 *-*-irix5*)
 535         PATH="$PATH:/usr/etc"
 536         AC_DEFINE(BROKEN_INET_NTOA, 1,
 537                 [Define if you system's inet_ntoa is busted
 538                 (e.g. Irix gcc issue)])
 539         AC_DEFINE(SETEUID_BREAKS_SETUID)
 540         AC_DEFINE(BROKEN_SETREUID)
 541         AC_DEFINE(BROKEN_SETREGID)
 542         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 543                 [Define if you shouldn't strip 'tty' from your
 544                 ttyname in [uw]tmp])
 545         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 546         ;;
 547 *-*-irix6*)
 548         PATH="$PATH:/usr/etc"
 549         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 550                 [Define if you have/want arrays
 551                 (cluster-wide session managment, not C arrays)])
 552         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 553                 [Define if you want IRIX project management])
 554         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 555                 [Define if you want IRIX audit trails])
 556         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 557                 [Define if you want IRIX kernel jobs])])
 558         AC_DEFINE(BROKEN_INET_NTOA)
 559         AC_DEFINE(SETEUID_BREAKS_SETUID)
 560         AC_DEFINE(BROKEN_SETREUID)
 561         AC_DEFINE(BROKEN_SETREGID)
 562         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 563         AC_DEFINE(WITH_ABBREV_NO_TTY)
 564         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 565         ;;
 566 *-*-linux*)
 567         no_dev_ptmx=1
 568         check_for_libcrypt_later=1
 569         check_for_openpty_ctty_bug=1
 570         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 571         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 572                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 573         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 574                 [String used in /etc/passwd to denote locked account])
 575         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 576         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 577                 [Define to whatever link() returns for "not supported"
 578                 if it doesn't return EOPNOTSUPP.])
 579         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 580         AC_DEFINE(USE_BTMP)
 581         inet6_default_4in6=yes
 582         case `uname -r` in
 583         1.*|2.0.*)
 584                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 585                         [Define if cmsg_type is not passed correctly])
 586                 ;;
 587         esac
 588         # tun(4) forwarding compat code
 589         AC_CHECK_HEADERS(linux/if_tun.h)
 590         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 591                 AC_DEFINE(SSH_TUN_LINUX, 1,
 592                     [Open tunnel devices the Linux tun/tap way])
 593                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 594                     [Use tunnel device compatibility to OpenBSD])
 595                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 596                     [Prepend the address family to IP tunnel traffic])
 597         fi
 598         ;;
 599 mips-sony-bsd|mips-sony-newsos4)
 600         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 601         SONY=1
 602         ;;
 603 *-*-netbsd*)
 604         check_for_libcrypt_before=1
 605         if test "x$withval" != "xno" ; then
 606                 need_dash_r=1
 607         fi
 608         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 609         AC_CHECK_HEADER([net/if_tap.h], ,
 610             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 611         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 612             [Prepend the address family to IP tunnel traffic])
 613         ;;
 614 *-*-freebsd*)
 615         check_for_libcrypt_later=1
 616         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 617         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 618         AC_CHECK_HEADER([net/if_tap.h], ,
 619             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 620         AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need])
 621         ;;
 622 *-*-bsdi*)
 623         AC_DEFINE(SETEUID_BREAKS_SETUID)
 624         AC_DEFINE(BROKEN_SETREUID)
 625         AC_DEFINE(BROKEN_SETREGID)
 626         ;;
 627 *-next-*)
 628         conf_lastlog_location="/usr/adm/lastlog"
 629         conf_utmp_location=/etc/utmp
 630         conf_wtmp_location=/usr/adm/wtmp
 631         MAIL=/usr/spool/mail
 632         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 633         AC_DEFINE(BROKEN_REALPATH)
 634         AC_DEFINE(USE_PIPES)
 635         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 636         ;;
 637 *-*-openbsd*)
 638         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 639         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 640         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 641         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 642             [syslog_r function is safe to use in in a signal handler])
 643         ;;
 644 *-*-solaris*)
 645         if test "x$withval" != "xno" ; then
 646                 need_dash_r=1
 647         fi
 648         AC_DEFINE(PAM_SUN_CODEBASE)
 649         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 650         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 651                 [Some versions of /bin/login need the TERM supplied
 652                 on the commandline])
 653         AC_DEFINE(PAM_TTY_KLUDGE)
 654         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 655                 [Define if pam_chauthtok wants real uid set
 656                 to the unpriv'ed user])
 657         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 658         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 659         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 660                 [Define if sshd somehow reacquires a controlling TTY
 661                 after setsid()])
 662         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 663                 in case the name is longer than 8 chars])
 664         external_path_file=/etc/default/login
 665         # hardwire lastlog location (can't detect it on some versions)
 666         conf_lastlog_location="/var/adm/lastlog"
 667         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 668         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 669         if test "$sol2ver" -ge 8; then
 670                 AC_MSG_RESULT(yes)
 671                 AC_DEFINE(DISABLE_UTMP)
 672                 AC_DEFINE(DISABLE_WTMP, 1,
 673                         [Define if you don't want to use wtmp])
 674         else
 675                 AC_MSG_RESULT(no)
 676         fi
 677         AC_ARG_WITH(solaris-contracts,
 678                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 679                 [
 680                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 681                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 682                                 [Define if you have Solaris process contracts])
 683                           SSHDLIBS="$SSHDLIBS -lcontract"
 684                           AC_SUBST(SSHDLIBS)
 685                           SPC_MSG="yes" ], )
 686                 ],
 687         )
 688         ;;
 689 *-*-sunos4*)
 690         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 691         AC_CHECK_FUNCS(getpwanam)
 692         AC_DEFINE(PAM_SUN_CODEBASE)
 693         conf_utmp_location=/etc/utmp
 694         conf_wtmp_location=/var/adm/wtmp
 695         conf_lastlog_location=/var/adm/lastlog
 696         AC_DEFINE(USE_PIPES)
 697         ;;
 698 *-ncr-sysv*)
 699         LIBS="$LIBS -lc89"
 700         AC_DEFINE(USE_PIPES)
 701         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 702         AC_DEFINE(SETEUID_BREAKS_SETUID)
 703         AC_DEFINE(BROKEN_SETREUID)
 704         AC_DEFINE(BROKEN_SETREGID)
 705         ;;
 706 *-sni-sysv*)
 707         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 708         AC_CHECK_LIB(dl, dlsym, ,)
 709         # -lresolv needs to be at the end of LIBS or DNS lookups break
 710         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 711         IPADDR_IN_DISPLAY=yes
 712         AC_DEFINE(USE_PIPES)
 713         AC_DEFINE(IP_TOS_IS_BROKEN)
 714         AC_DEFINE(SETEUID_BREAKS_SETUID)
 715         AC_DEFINE(BROKEN_SETREUID)
 716         AC_DEFINE(BROKEN_SETREGID)
 717         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 718         external_path_file=/etc/default/login
 719         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 720         # Attention: always take care to bind libsocket and libnsl before libc,
 721         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 722         ;;
 723 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 724 *-*-sysv4.2*)
 725         AC_DEFINE(USE_PIPES)
 726         AC_DEFINE(SETEUID_BREAKS_SETUID)
 727         AC_DEFINE(BROKEN_SETREUID)
 728         AC_DEFINE(BROKEN_SETREGID)
 729         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 730         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 731         ;;
 732 # UnixWare 7.x, OpenUNIX 8
 733 *-*-sysv5*)
 734         check_for_libcrypt_later=1
 735         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 736         AC_DEFINE(USE_PIPES)
 737         AC_DEFINE(SETEUID_BREAKS_SETUID)
 738         AC_DEFINE(BROKEN_SETREUID)
 739         AC_DEFINE(BROKEN_SETREGID)
 740         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 741         case "$host" in
 742         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 743                 TEST_SHELL=/u95/bin/sh
 744                 AC_DEFINE(BROKEN_LIBIAF, 1,
 745                         [ia_uinfo routines not supported by OS yet])
 746                 AC_DEFINE(BROKEN_UPDWTMPX)
 747                 ;;
 748         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 749                 ;;
 750         esac
 751         ;;
 752 *-*-sysv*)
 753         ;;
 754 # SCO UNIX and OEM versions of SCO UNIX
 755 *-*-sco3.2v4*)
 756         AC_MSG_ERROR("This Platform is no longer supported.")
 757         ;;
 758 # SCO OpenServer 5.x
 759 *-*-sco3.2v5*)
 760         if test -z "$GCC"; then
 761                 CFLAGS="$CFLAGS -belf"
 762         fi
 763         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 764         no_dev_ptmx=1
 765         AC_DEFINE(USE_PIPES)
 766         AC_DEFINE(HAVE_SECUREWARE)
 767         AC_DEFINE(DISABLE_SHADOW)
 768         AC_DEFINE(DISABLE_FD_PASSING)
 769         AC_DEFINE(SETEUID_BREAKS_SETUID)
 770         AC_DEFINE(BROKEN_SETREUID)
 771         AC_DEFINE(BROKEN_SETREGID)
 772         AC_DEFINE(WITH_ABBREV_NO_TTY)
 773         AC_DEFINE(BROKEN_UPDWTMPX)
 774         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 775         AC_CHECK_FUNCS(getluid setluid)
 776         MANTYPE=man
 777         TEST_SHELL=ksh
 778         ;;
 779 *-*-unicosmk*)
 780         AC_DEFINE(NO_SSH_LASTLOG, 1,
 781                 [Define if you don't want to use lastlog in session.c])
 782         AC_DEFINE(SETEUID_BREAKS_SETUID)
 783         AC_DEFINE(BROKEN_SETREUID)
 784         AC_DEFINE(BROKEN_SETREGID)
 785         AC_DEFINE(USE_PIPES)
 786         AC_DEFINE(DISABLE_FD_PASSING)
 787         LDFLAGS="$LDFLAGS"
 788         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 789         MANTYPE=cat
 790         ;;
 791 *-*-unicosmp*)
 792         AC_DEFINE(SETEUID_BREAKS_SETUID)
 793         AC_DEFINE(BROKEN_SETREUID)
 794         AC_DEFINE(BROKEN_SETREGID)
 795         AC_DEFINE(WITH_ABBREV_NO_TTY)
 796         AC_DEFINE(USE_PIPES)
 797         AC_DEFINE(DISABLE_FD_PASSING)
 798         LDFLAGS="$LDFLAGS"
 799         LIBS="$LIBS -lgen -lacid -ldb"
 800         MANTYPE=cat
 801         ;;
 802 *-*-unicos*)
 803         AC_DEFINE(SETEUID_BREAKS_SETUID)
 804         AC_DEFINE(BROKEN_SETREUID)
 805         AC_DEFINE(BROKEN_SETREGID)
 806         AC_DEFINE(USE_PIPES)
 807         AC_DEFINE(DISABLE_FD_PASSING)
 808         AC_DEFINE(NO_SSH_LASTLOG)
 809         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 810         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 811         MANTYPE=cat
 812         ;;
 813 *-dec-osf*)
 814         AC_MSG_CHECKING(for Digital Unix SIA)
 815         no_osfsia=""
 816         AC_ARG_WITH(osfsia,
 817                 [  --with-osfsia           Enable Digital Unix SIA],
 818                 [
 819                         if test "x$withval" = "xno" ; then
 820                                 AC_MSG_RESULT(disabled)
 821                                 no_osfsia=1
 822                         fi
 823                 ],
 824         )
 825         if test -z "$no_osfsia" ; then
 826                 if test -f /etc/sia/matrix.conf; then
 827                         AC_MSG_RESULT(yes)
 828                         AC_DEFINE(HAVE_OSF_SIA, 1,
 829                                 [Define if you have Digital Unix Security
 830                                 Integration Architecture])
 831                         AC_DEFINE(DISABLE_LOGIN, 1,
 832                                 [Define if you don't want to use your
 833                                 system's login() call])
 834                         AC_DEFINE(DISABLE_FD_PASSING)
 835                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 836                         SIA_MSG="yes"
 837                 else
 838                         AC_MSG_RESULT(no)
 839                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 840                           [String used in /etc/passwd to denote locked account])
 841                 fi
 842         fi
 843         AC_DEFINE(BROKEN_GETADDRINFO)
 844         AC_DEFINE(SETEUID_BREAKS_SETUID)
 845         AC_DEFINE(BROKEN_SETREUID)
 846         AC_DEFINE(BROKEN_SETREGID)
 847         ;;
 848
 849 *-*-nto-qnx*)
 850         AC_DEFINE(USE_PIPES)
 851         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 852         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 853         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 854         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 855         AC_DEFINE(DISABLE_LASTLOG)
 856         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 857         AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
 858         enable_etc_default_login=no     # has incompatible /etc/default/login
 859         case "$host" in
 860         *-*-nto-qnx6*)
 861                 AC_DEFINE(DISABLE_FD_PASSING)
 862                 ;;
 863         esac
 864         ;;
 865
 866 *-*-ultrix*)
 867         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 868         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 869         AC_DEFINE(NEED_SETPGRP)
 870         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 871         ;;
 872
 873 *-*-lynxos)
 874         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 875         AC_DEFINE(MISSING_HOWMANY)
 876         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 877         ;;
 878 esac
 879
 880 AC_MSG_CHECKING(compiler and flags for sanity)
 881 AC_RUN_IFELSE(
 882         [AC_LANG_SOURCE([
 883 #include <stdio.h>
 884 int main(){exit(0);}
 885         ])],
 886         [       AC_MSG_RESULT(yes) ],
 887         [
 888                 AC_MSG_RESULT(no)
 889                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 890         ],
 891         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 892 )
 893
 894 dnl Checks for header files.
 895 # Checks for libraries.
 896 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 897 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 898
 899 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 900 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 901         AC_CHECK_LIB(gen, dirname,[
 902                 AC_CACHE_CHECK([for broken dirname],
 903                         ac_cv_have_broken_dirname, [
 904                         save_LIBS="$LIBS"
 905                         LIBS="$LIBS -lgen"
 906                         AC_RUN_IFELSE(
 907                                 [AC_LANG_SOURCE([[
 908 #include <libgen.h>
 909 #include <string.h>
 910
 911 int main(int argc, char **argv) {
 912     char *s, buf[32];
 913
 914     strncpy(buf,"/etc", 32);
 915     s = dirname(buf);
 916     if (!s || strncmp(s, "/", 32) != 0) {
 917         exit(1);
 918     } else {
 919         exit(0);
 920     }
 921 }
 922                                 ]])],
 923                                 [ ac_cv_have_broken_dirname="no" ],
 924                                 [ ac_cv_have_broken_dirname="yes" ],
 925                                 [ ac_cv_have_broken_dirname="no" ],
 926                         )
 927                         LIBS="$save_LIBS"
 928                 ])
 929                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 930                         LIBS="$LIBS -lgen"
 931                         AC_DEFINE(HAVE_DIRNAME)
 932                         AC_CHECK_HEADERS(libgen.h)
 933                 fi
 934         ])
 935 ])
 936
 937 AC_CHECK_FUNC(getspnam, ,
 938         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 939 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 940         [Define if you have the basename function.]))
 941
 942 dnl zlib is required
 943 AC_ARG_WITH(zlib,
 944         [  --with-zlib=PATH        Use zlib in PATH],
 945         [ if test "x$withval" = "xno" ; then
 946                 AC_MSG_ERROR([*** zlib is required ***])
 947           elif test "x$withval" != "xyes"; then
 948                 if test -d "$withval/lib"; then
 949                         if test -n "${need_dash_r}"; then
 950                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 951                         else
 952                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 953                         fi
 954                 else
 955                         if test -n "${need_dash_r}"; then
 956                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 957                         else
 958                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 959                         fi
 960                 fi
 961                 if test -d "$withval/include"; then
 962                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 963                 else
 964                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 965                 fi
 966         fi ]
 967 )
 968
 969 AC_CHECK_LIB(z, deflate, ,
 970         [
 971                 saved_CPPFLAGS="$CPPFLAGS"
 972                 saved_LDFLAGS="$LDFLAGS"
 973                 save_LIBS="$LIBS"
 974                 dnl Check default zlib install dir
 975                 if test -n "${need_dash_r}"; then
 976                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 977                 else
 978                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 979                 fi
 980                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 981                 LIBS="$LIBS -lz"
 982                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 983                         [
 984                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
 985                         ]
 986                 )
 987         ]
 988 )
 989 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 990
 991 AC_ARG_WITH(zlib-version-check,
 992         [  --without-zlib-version-check Disable zlib version check],
 993         [  if test "x$withval" = "xno" ; then
 994                 zlib_check_nonfatal=1
 995            fi
 996         ]
 997 )
 998
 999 AC_MSG_CHECKING(for possibly buggy zlib)
1000 AC_RUN_IFELSE([AC_LANG_SOURCE([[
1001 #include <stdio.h>
1002 #include <zlib.h>
1003 int main()
1004 {
1005         int a=0, b=0, c=0, d=0, n, v;
1006         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1007         if (n != 3 && n != 4)
1008                 exit(1);
1009         v = a*1000000 + b*10000 + c*100 + d;
1010         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1011
1012         /* 1.1.4 is OK */
1013         if (a == 1 && b == 1 && c >= 4)
1014                 exit(0);
1015
1016         /* 1.2.3 and up are OK */
1017         if (v >= 1020300)
1018                 exit(0);
1019
1020         exit(2);
1021 }
1022         ]])],
1023         AC_MSG_RESULT(no),
1024         [ AC_MSG_RESULT(yes)
1025           if test -z "$zlib_check_nonfatal" ; then
1026                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1027 Your reported zlib version has known security problems.  It's possible your
1028 vendor has fixed these problems without changing the version number.  If you
1029 are sure this is the case, you can disable the check by running
1030 "./configure --without-zlib-version-check".
1031 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1032 See http://www.gzip.org/zlib/ for details.])
1033           else
1034                 AC_MSG_WARN([zlib version may have security problems])
1035           fi
1036         ],
1037         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1038 )
1039
1040 dnl UnixWare 2.x
1041 AC_CHECK_FUNC(strcasecmp,
1042         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
1043 )
1044 AC_CHECK_FUNCS(utimes,
1045         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
1046                                         LIBS="$LIBS -lc89"]) ]
1047 )
1048
1049 dnl    Checks for libutil functions
1050 AC_CHECK_HEADERS(libutil.h)
1051 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
1052         [Define if your libraries define login()])])
1053 AC_CHECK_FUNCS(logout updwtmp logwtmp)
1054
1055 AC_FUNC_STRFTIME
1056
1057 # Check for ALTDIRFUNC glob() extension
1058 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
1059 AC_EGREP_CPP(FOUNDIT,
1060         [
1061                 #include <glob.h>
1062                 #ifdef GLOB_ALTDIRFUNC
1063                 FOUNDIT
1064                 #endif
1065         ],
1066         [
1067                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
1068                         [Define if your system glob() function has
1069                         the GLOB_ALTDIRFUNC extension])
1070                 AC_MSG_RESULT(yes)
1071         ],
1072         [
1073                 AC_MSG_RESULT(no)
1074         ]
1075 )
1076
1077 # Check for g.gl_matchc glob() extension
1078 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1079 AC_TRY_COMPILE(
1080         [ #include <glob.h> ],
1081         [glob_t g; g.gl_matchc = 1;],
1082         [
1083                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1084                         [Define if your system glob() function has
1085                         gl_matchc options in glob_t])
1086                 AC_MSG_RESULT(yes)
1087         ],
1088         [
1089                 AC_MSG_RESULT(no)
1090         ]
1091 )
1092
1093 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1094
1095 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1096 AC_RUN_IFELSE(
1097         [AC_LANG_SOURCE([[
1098 #include <sys/types.h>
1099 #include <dirent.h>
1100 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1101         ]])],
1102         [AC_MSG_RESULT(yes)],
1103         [
1104                 AC_MSG_RESULT(no)
1105                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1106                         [Define if your struct dirent expects you to
1107                         allocate extra space for d_name])
1108         ],
1109         [
1110                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1111                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1112         ]
1113 )
1114
1115 # Check whether the user wants GSSAPI mechglue support
1116 AC_ARG_WITH(mechglue,
1117         [  --with-mechglue=PATH    Build with GSSAPI mechglue library],
1118         [
1119                 AC_MSG_CHECKING(for mechglue library)
1120
1121                 if test -e ${withval}/libgssapi.a ; then
1122                     mechglue_lib=${withval}/libgssapi.a
1123                 elif test -e ${withval}/lib/libgssapi.a ; then
1124                     mechglue_lib=${withval}/lib/libgssapi.a
1125                 else
1126                     AC_MSG_ERROR("Can't find libgssapi in ${withval}");
1127                 fi
1128                 LIBS="$LIBS ${mechglue_lib}"
1129                 AC_MSG_RESULT(${mechglue_lib})
1130
1131                 AC_CHECK_LIB(dl, dlopen, , )
1132                 if test $ac_cv_lib_dl_dlopen = yes; then
1133                    LDFLAGS="$LDFLAGS -ldl -Wl,-Bsymbolic"
1134                 fi
1135
1136                 AC_DEFINE(GSSAPI)
1137                 AC_DEFINE(MECHGLUE, 1, [Define this if you're building with GSSAPI MechGlue.])
1138                 GSSAPI="mechglue"
1139
1140         ]
1141 )
1142
1143
1144 # Check whether the user wants GSI (Globus) support
1145 gsi_path="no"
1146 AC_ARG_WITH(gsi,
1147         [  --with-gsi              Enable Globus GSI authentication support],
1148         [
1149                 gsi_path="$withval"
1150         ]
1151 )
1152
1153 AC_ARG_WITH(globus,
1154         [  --with-globus           Enable Globus GSI authentication support],
1155         [
1156                 gsi_path="$withval"
1157         ]
1158 )
1159
1160 AC_ARG_WITH(globus-static,
1161         [  --with-globus-static    Link statically with Globus GSI libraries],
1162         [
1163                 gsi_static="-static"
1164                 if test "x$gsi_path" = "xno" ; then
1165                         gsi_path="$withval"
1166                 fi
1167         ]
1168 )
1169
1170 # Check whether the user has a Globus flavor type
1171 globus_flavor_type="no"
1172 AC_ARG_WITH(globus-flavor,
1173         [  --with-globus-flavor=TYPE  Specify Globus flavor type (ex: gcc32dbg)],
1174         [
1175                 globus_flavor_type="$withval"
1176                 if test "x$gsi_path" = "xno" ; then
1177                         gsi_path="yes"
1178                 fi
1179         ]
1180 )
1181
1182 if test "x$gsi_path" != "xno" ; then
1183         # Globus GSSAPI configuration
1184         AC_MSG_CHECKING(for Globus GSI)
1185         AC_DEFINE(GSI, 1, [Define if you want GSI/Globus authentication support.])
1186
1187         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
1188                 AC_MSG_ERROR([Previously configured GSSAPI library conflicts with Globus GSI.])
1189         fi
1190         if test -z "$GSSAPI"; then
1191                 AC_DEFINE(GSSAPI)
1192                 GSSAPI="GSI"
1193         fi
1194
1195         if test "x$gsi_path" = "xyes" ; then
1196                 if test -z "$GLOBUS_LOCATION" ; then
1197                         AC_MSG_ERROR(GLOBUS_LOCATION environment variable must be set.)
1198                 else
1199                         gsi_path="$GLOBUS_LOCATION"
1200                 fi
1201         fi
1202         GLOBUS_LOCATION="$gsi_path"
1203         export GLOBUS_LOCATION
1204         if test ! -d "$GLOBUS_LOCATION" ; then
1205                 AC_MSG_ERROR(Cannot find Globus installation.  Set GLOBUS_LOCATION environment variable.)
1206         fi
1207
1208         if test "x$globus_flavor_type" = "xno" ; then
1209                 AC_MSG_ERROR(--with-globus-flavor=TYPE must be specified)
1210         fi
1211         if test "x$globus_flavor_type" = "xyes" ; then
1212                 AC_MSG_ERROR(--with-globus-flavor=TYPE must specify a flavor type)
1213         fi
1214
1215         GLOBUS_INCLUDE="${gsi_path}/include/${globus_flavor_type}"
1216         if test ! -d "$GLOBUS_INCLUDE" ; then
1217                 AC_MSG_ERROR(Cannot find Globus flavor-specific include directory: ${GLOBUS_INCLUDE})
1218         fi
1219         GSI_CPPFLAGS="-I${GLOBUS_INCLUDE}"
1220
1221         if test -x ${gsi_path}/bin/globus-makefile-header ; then
1222                 ${gsi_path}/bin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | sed 's/ = \(.*\)/="\1"/' > ./gpt_build_tmp.sh
1223         elif test -x ${gsi_path}/sbin/globus-makefile-header ; then
1224                 ${gsi_path}/sbin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | sed 's/ = \(.*\)/="\1"/' > ./gpt_build_tmp.sh
1225         else
1226                 AC_MSG_ERROR(Cannot find globus-makefile-header: Globus installation is incomplete)
1227         fi
1228         . ./gpt_build_tmp.sh
1229         if test -n "${need_dash_r}"; then
1230                 GSI_LDFLAGS="-L${gsi_path}/lib -R${gsi_path}/lib"
1231         else
1232                 GSI_LDFLAGS="-L${gsi_path}/lib"
1233         fi
1234         if test -z "$GLOBUS_PKG_LIBS" ; then
1235                 AC_MSG_ERROR(globus-makefile-header failed)
1236         fi
1237
1238         AC_DEFINE(HAVE_GSSAPI_H)
1239
1240         LIBS="$LIBS $GLOBUS_LIBS $GLOBUS_PKG_LIBS"
1241         LDFLAGS="$LDFLAGS $GSI_LDFLAGS"
1242         CPPFLAGS="$CPPFLAGS $GSI_CPPFLAGS"
1243
1244         # test that we got the libraries OK
1245         AC_TRY_LINK(
1246                 [],
1247                 [],
1248                 [
1249                         AC_MSG_RESULT(yes)
1250                 ],
1251                 [
1252                         AC_MSG_ERROR(link with Globus libraries failed)
1253                 ]
1254         )
1255     AC_CHECK_FUNCS(globus_gss_assist_map_and_authorize)
1256         INSTALL_GSISSH="yes"
1257 else
1258         INSTALL_GSISSH=""
1259 fi
1260 AC_SUBST(INSTALL_GSISSH)
1261 # End Globus/GSI section
1262
1263 AC_MSG_CHECKING([for /proc/pid/fd directory])
1264 if test -d "/proc/$$/fd" ; then
1265         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1266         AC_MSG_RESULT(yes)
1267 else
1268         AC_MSG_RESULT(no)
1269 fi
1270
1271 # Check whether user wants S/Key support
1272 SKEY_MSG="no"
1273 AC_ARG_WITH(skey,
1274         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1275         [
1276                 if test "x$withval" != "xno" ; then
1277
1278                         if test "x$withval" != "xyes" ; then
1279                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1280                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1281                         fi
1282
1283                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1284                         LIBS="-lskey $LIBS"
1285                         SKEY_MSG="yes"
1286
1287                         AC_MSG_CHECKING([for s/key support])
1288                         AC_LINK_IFELSE(
1289                                 [AC_LANG_SOURCE([[
1290 #include <stdio.h>
1291 #include <skey.h>
1292 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1293                                 ]])],
1294                                 [AC_MSG_RESULT(yes)],
1295                                 [
1296                                         AC_MSG_RESULT(no)
1297                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1298                                 ])
1299                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1300                         AC_TRY_COMPILE(
1301                                 [#include <stdio.h>
1302                                  #include <skey.h>],
1303                                 [(void)skeychallenge(NULL,"name","",0);],
1304                                 [AC_MSG_RESULT(yes)
1305                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1306                                         [Define if your skeychallenge()
1307                                         function takes 4 arguments (NetBSD)])],
1308                                 [AC_MSG_RESULT(no)]
1309                         )
1310                 fi
1311         ]
1312 )
1313
1314 # Check whether user wants TCP wrappers support
1315 TCPW_MSG="no"
1316 AC_ARG_WITH(tcp-wrappers,
1317         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1318         [
1319                 if test "x$withval" != "xno" ; then
1320                         saved_LIBS="$LIBS"
1321                         saved_LDFLAGS="$LDFLAGS"
1322                         saved_CPPFLAGS="$CPPFLAGS"
1323                         if test -n "${withval}" && \
1324                             test "x${withval}" != "xyes"; then
1325                                 if test -d "${withval}/lib"; then
1326                                         if test -n "${need_dash_r}"; then
1327                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1328                                         else
1329                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1330                                         fi
1331                                 else
1332                                         if test -n "${need_dash_r}"; then
1333                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1334                                         else
1335                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1336                                         fi
1337                                 fi
1338                                 if test -d "${withval}/include"; then
1339                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1340                                 else
1341                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1342                                 fi
1343                         fi
1344                         LIBS="-lwrap $LIBS"
1345                         AC_MSG_CHECKING(for libwrap)
1346                         AC_TRY_LINK(
1347                                 [
1348 #include <sys/types.h>
1349 #include <sys/socket.h>
1350 #include <netinet/in.h>
1351 #include <tcpd.h>
1352                                         int deny_severity = 0, allow_severity = 0;
1353                                 ],
1354                                 [hosts_access(0);],
1355                                 [
1356                                         AC_MSG_RESULT(yes)
1357                                         AC_DEFINE(LIBWRAP, 1,
1358                                                 [Define if you want
1359                                                 TCP Wrappers support])
1360                                         SSHDLIBS="$SSHDLIBS -lwrap"
1361                                         TCPW_MSG="yes"
1362                                 ],
1363                                 [
1364                                         AC_MSG_ERROR([*** libwrap missing])
1365                                 ]
1366                         )
1367                         LIBS="$saved_LIBS"
1368                 fi
1369         ]
1370 )
1371
1372 # Check whether user wants libedit support
1373 LIBEDIT_MSG="no"
1374 AC_ARG_WITH(libedit,
1375         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1376         [ if test "x$withval" != "xno" ; then
1377                 if test "x$withval" != "xyes"; then
1378                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1379                         if test -n "${need_dash_r}"; then
1380                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1381                         else
1382                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1383                         fi
1384                 fi
1385                 AC_CHECK_LIB(edit, el_init,
1386                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1387                           LIBEDIT="-ledit -lcurses"
1388                           LIBEDIT_MSG="yes"
1389                           AC_SUBST(LIBEDIT)
1390                         ],
1391                         [ AC_MSG_ERROR(libedit not found) ],
1392                         [ -lcurses ]
1393                 )
1394                 AC_MSG_CHECKING(if libedit version is compatible)
1395                 AC_COMPILE_IFELSE(
1396                     [AC_LANG_SOURCE([[
1397 #include <histedit.h>
1398 int main(void)
1399 {
1400         int i = H_SETSIZE;
1401         el_init("", NULL, NULL, NULL);
1402         exit(0);
1403 }
1404                     ]])],
1405                     [ AC_MSG_RESULT(yes) ],
1406                     [ AC_MSG_RESULT(no)
1407                       AC_MSG_ERROR(libedit version is not compatible) ]
1408                 )
1409         fi ]
1410 )
1411
1412 AUDIT_MODULE=none
1413 AC_ARG_WITH(audit,
1414         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1415         [
1416           AC_MSG_CHECKING(for supported audit module)
1417           case "$withval" in
1418           bsm)
1419                 AC_MSG_RESULT(bsm)
1420                 AUDIT_MODULE=bsm
1421                 dnl    Checks for headers, libs and functions
1422                 AC_CHECK_HEADERS(bsm/audit.h, [],
1423                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1424                     [
1425 #ifdef HAVE_TIME_H
1426 # include <time.h>
1427 #endif
1428                     ]
1429 )
1430                 AC_CHECK_LIB(bsm, getaudit, [],
1431                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1432                 AC_CHECK_FUNCS(getaudit, [],
1433                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1434                 # These are optional
1435                 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1436                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1437                 ;;
1438           debug)
1439                 AUDIT_MODULE=debug
1440                 AC_MSG_RESULT(debug)
1441                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1442                 ;;
1443           no)
1444                 AC_MSG_RESULT(no)
1445                 ;;
1446           *)
1447                 AC_MSG_ERROR([Unknown audit module $withval])
1448                 ;;
1449         esac ]
1450 )
1451
1452 dnl    Checks for library functions. Please keep in alphabetical order
1453 AC_CHECK_FUNCS( \
1454         arc4random \
1455         asprintf \
1456         b64_ntop \
1457         __b64_ntop \
1458         b64_pton \
1459         __b64_pton \
1460         bcopy \
1461         bindresvport_sa \
1462         clock \
1463         closefrom \
1464         dirfd \
1465         fchmod \
1466         fchown \
1467         freeaddrinfo \
1468         futimes \
1469         getaddrinfo \
1470         getcwd \
1471         getgrouplist \
1472         getnameinfo \
1473         getopt \
1474         getpeereid \
1475         getpeerucred \
1476         _getpty \
1477         getrlimit \
1478         getttyent \
1479         glob \
1480         inet_aton \
1481         inet_ntoa \
1482         inet_ntop \
1483         innetgr \
1484         login_getcapbool \
1485         md5_crypt \
1486         memmove \
1487         mkdtemp \
1488         mmap \
1489         ngetaddrinfo \
1490         nsleep \
1491         ogetaddrinfo \
1492         openlog_r \
1493         openpty \
1494         poll \
1495         prctl \
1496         pstat \
1497         readpassphrase \
1498         realpath \
1499         recvmsg \
1500         rresvport_af \
1501         sendmsg \
1502         setdtablesize \
1503         setegid \
1504         setenv \
1505         seteuid \
1506         setgroups \
1507         setlogin \
1508         setpcred \
1509         setproctitle \
1510         setregid \
1511         setreuid \
1512         setrlimit \
1513         setsid \
1514         setvbuf \
1515         sigaction \
1516         sigvec \
1517         snprintf \
1518         socketpair \
1519         strdup \
1520         strerror \
1521         strlcat \
1522         strlcpy \
1523         strmode \
1524         strnvis \
1525         strtonum \
1526         strtoll \
1527         strtoul \
1528         swap32 \
1529         sysconf \
1530         tcgetpgrp \
1531         truncate \
1532         unsetenv \
1533         updwtmpx \
1534         vasprintf \
1535         vhangup \
1536         vsnprintf \
1537         waitpid \
1538 )
1539
1540 # IRIX has a const char return value for gai_strerror()
1541 AC_CHECK_FUNCS(gai_strerror,[
1542         AC_DEFINE(HAVE_GAI_STRERROR)
1543         AC_TRY_COMPILE([
1544 #include <sys/types.h>
1545 #include <sys/socket.h>
1546 #include <netdb.h>
1547
1548 const char *gai_strerror(int);],[
1549 char *str;
1550
1551 str = gai_strerror(0);],[
1552                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1553                 [Define if gai_strerror() returns const char *])])])
1554
1555 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1556         [Some systems put nanosleep outside of libc]))
1557
1558 dnl Make sure prototypes are defined for these before using them.
1559 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1560 AC_CHECK_DECL(strsep,
1561         [AC_CHECK_FUNCS(strsep)],
1562         [],
1563         [
1564 #ifdef HAVE_STRING_H
1565 # include <string.h>
1566 #endif
1567         ])
1568
1569 dnl tcsendbreak might be a macro
1570 AC_CHECK_DECL(tcsendbreak,
1571         [AC_DEFINE(HAVE_TCSENDBREAK)],
1572         [AC_CHECK_FUNCS(tcsendbreak)],
1573         [#include <termios.h>]
1574 )
1575
1576 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1577
1578 AC_CHECK_DECLS(SHUT_RD, , ,
1579         [
1580 #include <sys/types.h>
1581 #include <sys/socket.h>
1582         ])
1583
1584 AC_CHECK_DECLS(O_NONBLOCK, , ,
1585         [
1586 #include <sys/types.h>
1587 #ifdef HAVE_SYS_STAT_H
1588 # include <sys/stat.h>
1589 #endif
1590 #ifdef HAVE_FCNTL_H
1591 # include <fcntl.h>
1592 #endif
1593         ])
1594
1595 AC_CHECK_DECLS(writev, , , [
1596 #include <sys/types.h>
1597 #include <sys/uio.h>
1598 #include <unistd.h>
1599         ])
1600
1601 AC_CHECK_DECLS(MAXSYMLINKS, , , [
1602 #include <sys/param.h>
1603         ])
1604
1605 AC_CHECK_DECLS(offsetof, , , [
1606 #include <stddef.h>
1607         ])
1608
1609 AC_CHECK_FUNCS(setresuid, [
1610         dnl Some platorms have setresuid that isn't implemented, test for this
1611         AC_MSG_CHECKING(if setresuid seems to work)
1612         AC_RUN_IFELSE(
1613                 [AC_LANG_SOURCE([[
1614 #include <stdlib.h>
1615 #include <errno.h>
1616 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1617                 ]])],
1618                 [AC_MSG_RESULT(yes)],
1619                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1620                         [Define if your setresuid() is broken])
1621                  AC_MSG_RESULT(not implemented)],
1622                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1623         )
1624 ])
1625
1626 AC_CHECK_FUNCS(setresgid, [
1627         dnl Some platorms have setresgid that isn't implemented, test for this
1628         AC_MSG_CHECKING(if setresgid seems to work)
1629         AC_RUN_IFELSE(
1630                 [AC_LANG_SOURCE([[
1631 #include <stdlib.h>
1632 #include <errno.h>
1633 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1634                 ]])],
1635                 [AC_MSG_RESULT(yes)],
1636                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1637                         [Define if your setresgid() is broken])
1638                  AC_MSG_RESULT(not implemented)],
1639                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1640         )
1641 ])
1642
1643 dnl    Checks for time functions
1644 AC_CHECK_FUNCS(gettimeofday time)
1645 dnl    Checks for utmp functions
1646 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1647 AC_CHECK_FUNCS(utmpname)
1648 dnl    Checks for utmpx functions
1649 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1650 AC_CHECK_FUNCS(setutxent utmpxname)
1651
1652 AC_CHECK_FUNC(daemon,
1653         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1654         [AC_CHECK_LIB(bsd, daemon,
1655                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1656 )
1657
1658 AC_CHECK_FUNC(getpagesize,
1659         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1660                 [Define if your libraries define getpagesize()])],
1661         [AC_CHECK_LIB(ucb, getpagesize,
1662                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1663 )
1664
1665 # Check for broken snprintf
1666 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1667         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1668         AC_RUN_IFELSE(
1669                 [AC_LANG_SOURCE([[
1670 #include <stdio.h>
1671 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1672                 ]])],
1673                 [AC_MSG_RESULT(yes)],
1674                 [
1675                         AC_MSG_RESULT(no)
1676                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1677                                 [Define if your snprintf is busted])
1678                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1679                 ],
1680                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1681         )
1682 fi
1683
1684 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1685 # returning the right thing on overflow: the number of characters it tried to
1686 # create (as per SUSv3)
1687 if test "x$ac_cv_func_asprintf" != "xyes" && \
1688    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1689         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1690         AC_RUN_IFELSE(
1691                 [AC_LANG_SOURCE([[
1692 #include <sys/types.h>
1693 #include <stdio.h>
1694 #include <stdarg.h>
1695
1696 int x_snprintf(char *str,size_t count,const char *fmt,...)
1697 {
1698         size_t ret; va_list ap;
1699         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1700         return ret;
1701 }
1702 int main(void)
1703 {
1704         char x[1];
1705         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1706 } ]])],
1707                 [AC_MSG_RESULT(yes)],
1708                 [
1709                         AC_MSG_RESULT(no)
1710                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1711                                 [Define if your snprintf is busted])
1712                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1713                 ],
1714                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1715         )
1716 fi
1717
1718 # On systems where [v]snprintf is broken, but is declared in stdio,
1719 # check that the fmt argument is const char * or just char *.
1720 # This is only useful for when BROKEN_SNPRINTF
1721 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1722 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1723            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1724            int main(void) { snprintf(0, 0, 0); }
1725     ]])],
1726    [AC_MSG_RESULT(yes)
1727     AC_DEFINE(SNPRINTF_CONST, [const],
1728               [Define as const if snprintf() can declare const char *fmt])],
1729    [AC_MSG_RESULT(no)
1730     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1731
1732 # Check for missing getpeereid (or equiv) support
1733 NO_PEERCHECK=""
1734 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
1735         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1736         AC_TRY_COMPILE(
1737                 [#include <sys/types.h>
1738                  #include <sys/socket.h>],
1739                 [int i = SO_PEERCRED;],
1740                 [ AC_MSG_RESULT(yes)
1741                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1742                 ],
1743                 [AC_MSG_RESULT(no)
1744                 NO_PEERCHECK=1]
1745         )
1746 fi
1747
1748 dnl see whether mkstemp() requires XXXXXX
1749 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1750 AC_MSG_CHECKING([for (overly) strict mkstemp])
1751 AC_RUN_IFELSE(
1752         [AC_LANG_SOURCE([[
1753 #include <stdlib.h>
1754 main() { char template[]="conftest.mkstemp-test";
1755 if (mkstemp(template) == -1)
1756         exit(1);
1757 unlink(template); exit(0);
1758 }
1759         ]])],
1760         [
1761                 AC_MSG_RESULT(no)
1762         ],
1763         [
1764                 AC_MSG_RESULT(yes)
1765                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1766         ],
1767         [
1768                 AC_MSG_RESULT(yes)
1769                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1770         ]
1771 )
1772 fi
1773
1774 dnl make sure that openpty does not reacquire controlling terminal
1775 if test ! -z "$check_for_openpty_ctty_bug"; then
1776         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1777         AC_RUN_IFELSE(
1778                 [AC_LANG_SOURCE([[
1779 #include <stdio.h>
1780 #include <sys/fcntl.h>
1781 #include <sys/types.h>
1782 #include <sys/wait.h>
1783
1784 int
1785 main()
1786 {
1787         pid_t pid;
1788         int fd, ptyfd, ttyfd, status;
1789
1790         pid = fork();
1791         if (pid < 0) {          /* failed */
1792                 exit(1);
1793         } else if (pid > 0) {   /* parent */
1794                 waitpid(pid, &status, 0);
1795                 if (WIFEXITED(status))
1796                         exit(WEXITSTATUS(status));
1797                 else
1798                         exit(2);
1799         } else {                /* child */
1800                 close(0); close(1); close(2);
1801                 setsid();
1802                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1803                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1804                 if (fd >= 0)
1805                         exit(3);        /* Acquired ctty: broken */
1806                 else
1807                         exit(0);        /* Did not acquire ctty: OK */
1808         }
1809 }
1810                 ]])],
1811                 [
1812                         AC_MSG_RESULT(yes)
1813                 ],
1814                 [
1815                         AC_MSG_RESULT(no)
1816                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1817                 ],
1818                 [
1819                         AC_MSG_RESULT(cross-compiling, assuming yes)
1820                 ]
1821         )
1822 fi
1823
1824 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1825     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1826         AC_MSG_CHECKING(if getaddrinfo seems to work)
1827         AC_RUN_IFELSE(
1828                 [AC_LANG_SOURCE([[
1829 #include <stdio.h>
1830 #include <sys/socket.h>
1831 #include <netdb.h>
1832 #include <errno.h>
1833 #include <netinet/in.h>
1834
1835 #define TEST_PORT "2222"
1836
1837 int
1838 main(void)
1839 {
1840         int err, sock;
1841         struct addrinfo *gai_ai, *ai, hints;
1842         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1843
1844         memset(&hints, 0, sizeof(hints));
1845         hints.ai_family = PF_UNSPEC;
1846         hints.ai_socktype = SOCK_STREAM;
1847         hints.ai_flags = AI_PASSIVE;
1848
1849         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1850         if (err != 0) {
1851                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1852                 exit(1);
1853         }
1854
1855         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1856                 if (ai->ai_family != AF_INET6)
1857                         continue;
1858
1859                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1860                     sizeof(ntop), strport, sizeof(strport),
1861                     NI_NUMERICHOST|NI_NUMERICSERV);
1862
1863                 if (err != 0) {
1864                         if (err == EAI_SYSTEM)
1865                                 perror("getnameinfo EAI_SYSTEM");
1866                         else
1867                                 fprintf(stderr, "getnameinfo failed: %s\n",
1868                                     gai_strerror(err));
1869                         exit(2);
1870                 }
1871
1872                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1873                 if (sock < 0)
1874                         perror("socket");
1875                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1876                         if (errno == EBADF)
1877                                 exit(3);
1878                 }
1879         }
1880         exit(0);
1881 }
1882                 ]])],
1883                 [
1884                         AC_MSG_RESULT(yes)
1885                 ],
1886                 [
1887                         AC_MSG_RESULT(no)
1888                         AC_DEFINE(BROKEN_GETADDRINFO)
1889                 ],
1890                 [
1891                         AC_MSG_RESULT(cross-compiling, assuming yes)
1892                 ]
1893         )
1894 fi
1895
1896 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1897     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1898         AC_MSG_CHECKING(if getaddrinfo seems to work)
1899         AC_RUN_IFELSE(
1900                 [AC_LANG_SOURCE([[
1901 #include <stdio.h>
1902 #include <sys/socket.h>
1903 #include <netdb.h>
1904 #include <errno.h>
1905 #include <netinet/in.h>
1906
1907 #define TEST_PORT "2222"
1908
1909 int
1910 main(void)
1911 {
1912         int err, sock;
1913         struct addrinfo *gai_ai, *ai, hints;
1914         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1915
1916         memset(&hints, 0, sizeof(hints));
1917         hints.ai_family = PF_UNSPEC;
1918         hints.ai_socktype = SOCK_STREAM;
1919         hints.ai_flags = AI_PASSIVE;
1920
1921         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1922         if (err != 0) {
1923                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1924                 exit(1);
1925         }
1926
1927         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1928                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1929                         continue;
1930
1931                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1932                     sizeof(ntop), strport, sizeof(strport),
1933                     NI_NUMERICHOST|NI_NUMERICSERV);
1934
1935                 if (ai->ai_family == AF_INET && err != 0) {
1936                         perror("getnameinfo");
1937                         exit(2);
1938                 }
1939         }
1940         exit(0);
1941 }
1942                 ]])],
1943                 [
1944                         AC_MSG_RESULT(yes)
1945                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1946                                 [Define if you have a getaddrinfo that fails
1947                                 for the all-zeros IPv6 address])
1948                 ],
1949                 [
1950                         AC_MSG_RESULT(no)
1951                         AC_DEFINE(BROKEN_GETADDRINFO)
1952                 ],
1953                 [
1954                         AC_MSG_RESULT(cross-compiling, assuming no)
1955                 ]
1956         )
1957 fi
1958
1959 if test "x$check_for_conflicting_getspnam" = "x1"; then
1960         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1961         AC_COMPILE_IFELSE(
1962                 [
1963 #include <shadow.h>
1964 int main(void) {exit(0);}
1965                 ],
1966                 [
1967                         AC_MSG_RESULT(no)
1968                 ],
1969                 [
1970                         AC_MSG_RESULT(yes)
1971                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1972                             [Conflicting defs for getspnam])
1973                 ]
1974         )
1975 fi
1976
1977 AC_FUNC_GETPGRP
1978
1979 # Search for OpenSSL
1980 saved_CPPFLAGS="$CPPFLAGS"
1981 saved_LDFLAGS="$LDFLAGS"
1982 AC_ARG_WITH(ssl-dir,
1983         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1984         [
1985                 if test "x$withval" != "xno" ; then
1986                         case "$withval" in
1987                                 # Relative paths
1988                                 ./*|../*)       withval="`pwd`/$withval"
1989                         esac
1990                         if test -d "$withval/lib"; then
1991                                 if test -n "${need_dash_r}"; then
1992                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1993                                 else
1994                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1995                                 fi
1996                         else
1997                                 if test -n "${need_dash_r}"; then
1998                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1999                                 else
2000                                         LDFLAGS="-L${withval} ${LDFLAGS}"
2001                                 fi
2002                         fi
2003                         if test -d "$withval/include"; then
2004                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
2005                         else
2006                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
2007                         fi
2008                 fi
2009         ]
2010 )
2011 if test -z "$GSI_LDFLAGS" ; then
2012 LIBS="-lcrypto $LIBS"
2013 fi
2014 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
2015         [Define if your ssl headers are included
2016         with #include <openssl/header.h>]),
2017         [
2018                 dnl Check default openssl install dir
2019                 if test -n "${need_dash_r}"; then
2020                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
2021                 else
2022                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
2023                 fi
2024                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
2025                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
2026                         [
2027                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
2028                         ]
2029                 )
2030         ]
2031 )
2032
2033 # Determine OpenSSL header version
2034 AC_MSG_CHECKING([OpenSSL header version])
2035 AC_RUN_IFELSE(
2036         [AC_LANG_SOURCE([[
2037 #include <stdio.h>
2038 #include <string.h>
2039 #include <openssl/opensslv.h>
2040 #define DATA "conftest.sslincver"
2041 int main(void) {
2042         FILE *fd;
2043         int rc;
2044
2045         fd = fopen(DATA,"w");
2046         if(fd == NULL)
2047                 exit(1);
2048
2049         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
2050                 exit(1);
2051
2052         exit(0);
2053 }
2054         ]])],
2055         [
2056                 ssl_header_ver=`cat conftest.sslincver`
2057                 AC_MSG_RESULT($ssl_header_ver)
2058         ],
2059         [
2060                 AC_MSG_RESULT(not found)
2061                 AC_MSG_ERROR(OpenSSL version header not found.)
2062         ],
2063         [
2064                 AC_MSG_WARN([cross compiling: not checking])
2065         ]
2066 )
2067
2068 # Determine OpenSSL library version
2069 AC_MSG_CHECKING([OpenSSL library version])
2070 AC_RUN_IFELSE(
2071         [AC_LANG_SOURCE([[
2072 #include <stdio.h>
2073 #include <string.h>
2074 #include <openssl/opensslv.h>
2075 #include <openssl/crypto.h>
2076 #define DATA "conftest.ssllibver"
2077 int main(void) {
2078         FILE *fd;
2079         int rc;
2080
2081         fd = fopen(DATA,"w");
2082         if(fd == NULL)
2083                 exit(1);
2084
2085         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
2086                 exit(1);
2087
2088         exit(0);
2089 }
2090         ]])],
2091         [
2092                 ssl_library_ver=`cat conftest.ssllibver`
2093                 AC_MSG_RESULT($ssl_library_ver)
2094         ],
2095         [
2096                 AC_MSG_RESULT(not found)
2097                 AC_MSG_ERROR(OpenSSL library not found.)
2098         ],
2099         [
2100                 AC_MSG_WARN([cross compiling: not checking])
2101         ]
2102 )
2103
2104 AC_ARG_WITH(openssl-header-check,
2105         [  --without-openssl-header-check Disable OpenSSL version consistency check],
2106         [  if test "x$withval" = "xno" ; then
2107                 openssl_check_nonfatal=1
2108            fi
2109         ]
2110 )
2111
2112 # Sanity check OpenSSL headers
2113 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2114 AC_RUN_IFELSE(
2115         [AC_LANG_SOURCE([[
2116 #include <string.h>
2117 #include <openssl/opensslv.h>
2118 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
2119         ]])],
2120         [
2121                 AC_MSG_RESULT(yes)
2122         ],
2123         [
2124                 AC_MSG_RESULT(no)
2125                 if test "x$openssl_check_nonfatal" = "x"; then
2126                         AC_MSG_ERROR([Your OpenSSL headers do not match your
2127 library. Check config.log for details.
2128 If you are sure your installation is consistent, you can disable the check
2129 by running "./configure --without-openssl-header-check".
2130 Also see contrib/findssl.sh for help identifying header/library mismatches.
2131 ])
2132                 else
2133                         AC_MSG_WARN([Your OpenSSL headers do not match your
2134 library. Check config.log for details.
2135 Also see contrib/findssl.sh for help identifying header/library mismatches.])
2136                 fi
2137         ],
2138         [
2139                 AC_MSG_WARN([cross compiling: not checking])
2140         ]
2141 )
2142
2143 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2144 AC_LINK_IFELSE(
2145         [AC_LANG_SOURCE([[
2146 #include <openssl/evp.h>
2147 int main(void) { SSLeay_add_all_algorithms(); }
2148         ]])],
2149         [
2150                 AC_MSG_RESULT(yes)
2151         ],
2152         [
2153                 AC_MSG_RESULT(no)
2154                 saved_LIBS="$LIBS"
2155                 LIBS="$LIBS -ldl"
2156                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2157                 AC_LINK_IFELSE(
2158                         [AC_LANG_SOURCE([[
2159 #include <openssl/evp.h>
2160 int main(void) { SSLeay_add_all_algorithms(); }
2161                         ]])],
2162                         [
2163                                 AC_MSG_RESULT(yes)
2164                         ],
2165                         [
2166                                 AC_MSG_RESULT(no)
2167                                 LIBS="$saved_LIBS"
2168                         ]
2169                 )
2170         ]
2171 )
2172
2173 AC_ARG_WITH(ssl-engine,
2174         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2175         [ if test "x$withval" != "xno" ; then
2176                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
2177                 AC_TRY_COMPILE(
2178                         [ #include <openssl/engine.h>],
2179                         [
2180 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
2181                         ],
2182                         [ AC_MSG_RESULT(yes)
2183                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
2184                              [Enable OpenSSL engine support])
2185                         ],
2186                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
2187                 )
2188           fi ]
2189 )
2190
2191 # Check for OpenSSL without EVP_aes_{192,256}_cbc
2192 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2193 AC_LINK_IFELSE(
2194         [AC_LANG_SOURCE([[
2195 #include <string.h>
2196 #include <openssl/evp.h>
2197 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
2198         ]])],
2199         [
2200                 AC_MSG_RESULT(no)
2201         ],
2202         [
2203                 AC_MSG_RESULT(yes)
2204                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2205                     [libcrypto is missing AES 192 and 256 bit functions])
2206         ]
2207 )
2208
2209 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2210 # because the system crypt() is more featureful.
2211 if test "x$check_for_libcrypt_before" = "x1"; then
2212         AC_CHECK_LIB(crypt, crypt)
2213 fi
2214
2215 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2216 # version in OpenSSL.
2217 if test "x$check_for_libcrypt_later" = "x1"; then
2218         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2219 fi
2220
2221 # Search for SHA256 support in libc and/or OpenSSL
2222 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2223
2224 saved_LIBS="$LIBS"
2225 AC_CHECK_LIB(iaf, ia_openinfo, [
2226         LIBS="$LIBS -liaf"
2227         AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
2228                                 AC_DEFINE(HAVE_LIBIAF, 1,
2229                         [Define if system has libiaf that supports set_id])
2230                                 ])
2231 ])
2232 LIBS="$saved_LIBS"
2233
2234 ### Configure cryptographic random number support
2235
2236 # Check wheter OpenSSL seeds itself
2237 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2238 AC_RUN_IFELSE(
2239         [AC_LANG_SOURCE([[
2240 #include <string.h>
2241 #include <openssl/rand.h>
2242 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2243         ]])],
2244         [
2245                 OPENSSL_SEEDS_ITSELF=yes
2246                 AC_MSG_RESULT(yes)
2247         ],
2248         [
2249                 AC_MSG_RESULT(no)
2250                 # Default to use of the rand helper if OpenSSL doesn't
2251                 # seed itself
2252                 USE_RAND_HELPER=yes
2253         ],
2254         [
2255                 AC_MSG_WARN([cross compiling: assuming yes])
2256                 # This is safe, since all recent OpenSSL versions will
2257                 # complain at runtime if not seeded correctly.
2258                 OPENSSL_SEEDS_ITSELF=yes
2259         ]
2260 )
2261
2262 # Check for PAM libs
2263 PAM_MSG="no"
2264 AC_ARG_WITH(pam,
2265         [  --with-pam              Enable PAM support ],
2266         [
2267                 if test "x$withval" != "xno" ; then
2268                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2269                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2270                                 AC_MSG_ERROR([PAM headers not found])
2271                         fi
2272
2273                         saved_LIBS="$LIBS"
2274                         AC_CHECK_LIB(dl, dlopen, , )
2275                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2276                         AC_CHECK_FUNCS(pam_getenvlist)
2277                         AC_CHECK_FUNCS(pam_putenv)
2278                         LIBS="$saved_LIBS"
2279
2280                         PAM_MSG="yes"
2281
2282                         SSHDLIBS="$SSHDLIBS -lpam"
2283                         AC_DEFINE(USE_PAM, 1,
2284                                 [Define if you want to enable PAM support])
2285
2286                         if test $ac_cv_lib_dl_dlopen = yes; then
2287                                 case "$LIBS" in
2288                                 *-ldl*)
2289                                         # libdl already in LIBS
2290                                         ;;
2291                                 *)
2292                                         SSHDLIBS="$SSHDLIBS -ldl"
2293                                         ;;
2294                                 esac
2295                         fi
2296                 fi
2297         ]
2298 )
2299
2300 # Check for older PAM
2301 if test "x$PAM_MSG" = "xyes" ; then
2302         # Check PAM strerror arguments (old PAM)
2303         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2304         AC_TRY_COMPILE(
2305                 [
2306 #include <stdlib.h>
2307 #if defined(HAVE_SECURITY_PAM_APPL_H)
2308 #include <security/pam_appl.h>
2309 #elif defined (HAVE_PAM_PAM_APPL_H)
2310 #include <pam/pam_appl.h>
2311 #endif
2312                 ],
2313                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2314                 [AC_MSG_RESULT(no)],
2315                 [
2316                         AC_DEFINE(HAVE_OLD_PAM, 1,
2317                                 [Define if you have an old version of PAM
2318                                 which takes only one argument to pam_strerror])
2319                         AC_MSG_RESULT(yes)
2320                         PAM_MSG="yes (old library)"
2321                 ]
2322         )
2323 fi
2324
2325 # Do we want to force the use of the rand helper?
2326 AC_ARG_WITH(rand-helper,
2327         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2328         [
2329                 if test "x$withval" = "xno" ; then
2330                         # Force use of OpenSSL's internal RNG, even if
2331                         # the previous test showed it to be unseeded.
2332                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2333                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2334                                 OPENSSL_SEEDS_ITSELF=yes
2335                                 USE_RAND_HELPER=""
2336                         fi
2337                 else
2338                         USE_RAND_HELPER=yes
2339                 fi
2340         ],
2341 )
2342
2343 # Which randomness source do we use?
2344 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2345         # OpenSSL only
2346         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2347                 [Define if you want OpenSSL's internally seeded PRNG only])
2348         RAND_MSG="OpenSSL internal ONLY"
2349         INSTALL_SSH_RAND_HELPER=""
2350 elif test ! -z "$USE_RAND_HELPER" ; then
2351         # install rand helper
2352         RAND_MSG="ssh-rand-helper"
2353         INSTALL_SSH_RAND_HELPER="yes"
2354 fi
2355 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2356
2357 ### Configuration of ssh-rand-helper
2358
2359 # PRNGD TCP socket
2360 AC_ARG_WITH(prngd-port,
2361         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2362         [
2363                 case "$withval" in
2364                 no)
2365                         withval=""
2366                         ;;
2367                 [[0-9]]*)
2368                         ;;
2369                 *)
2370                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2371                         ;;
2372                 esac
2373                 if test ! -z "$withval" ; then
2374                         PRNGD_PORT="$withval"
2375                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2376                                 [Port number of PRNGD/EGD random number socket])
2377                 fi
2378         ]
2379 )
2380
2381 # PRNGD Unix domain socket
2382 AC_ARG_WITH(prngd-socket,
2383         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2384         [
2385                 case "$withval" in
2386                 yes)
2387                         withval="/var/run/egd-pool"
2388                         ;;
2389                 no)
2390                         withval=""
2391                         ;;
2392                 /*)
2393                         ;;
2394                 *)
2395                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2396                         ;;
2397                 esac
2398
2399                 if test ! -z "$withval" ; then
2400                         if test ! -z "$PRNGD_PORT" ; then
2401                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2402                         fi
2403                         if test ! -r "$withval" ; then
2404                                 AC_MSG_WARN(Entropy socket is not readable)
2405                         fi
2406                         PRNGD_SOCKET="$withval"
2407                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2408                                 [Location of PRNGD/EGD random number socket])
2409                 fi
2410         ],
2411         [
2412                 # Check for existing socket only if we don't have a random device already
2413                 if test "$USE_RAND_HELPER" = yes ; then
2414                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2415                         # Insert other locations here
2416                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2417                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2418                                         PRNGD_SOCKET="$sock"
2419                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2420                                         break;
2421                                 fi
2422                         done
2423                         if test ! -z "$PRNGD_SOCKET" ; then
2424                                 AC_MSG_RESULT($PRNGD_SOCKET)
2425                         else
2426                                 AC_MSG_RESULT(not found)
2427                         fi
2428                 fi
2429         ]
2430 )
2431
2432 # Change default command timeout for hashing entropy source
2433 entropy_timeout=200
2434 AC_ARG_WITH(entropy-timeout,
2435         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2436         [
2437                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2438                     test "x${withval}" != "xyes"; then
2439                         entropy_timeout=$withval
2440                 fi
2441         ]
2442 )
2443 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2444         [Builtin PRNG command timeout])
2445
2446 SSH_PRIVSEP_USER=sshd
2447 AC_ARG_WITH(privsep-user,
2448         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2449         [
2450                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2451                     test "x${withval}" != "xyes"; then
2452                         SSH_PRIVSEP_USER=$withval
2453                 fi
2454         ]
2455 )
2456 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2457         [non-privileged user for privilege separation])
2458 AC_SUBST(SSH_PRIVSEP_USER)
2459
2460 # We do this little dance with the search path to insure
2461 # that programs that we select for use by installed programs
2462 # (which may be run by the super-user) come from trusted
2463 # locations before they come from the user's private area.
2464 # This should help avoid accidentally configuring some
2465 # random version of a program in someone's personal bin.
2466
2467 OPATH=$PATH
2468 PATH=/bin:/usr/bin
2469 test -h /bin 2> /dev/null && PATH=/usr/bin
2470 test -d /sbin && PATH=$PATH:/sbin
2471 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2472 PATH=$PATH:/etc:$OPATH
2473
2474 # These programs are used by the command hashing source to gather entropy
2475 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2476 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2477 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2478 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2479 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2480 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2481 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2482 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2483 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2484 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2485 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2486 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2487 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2488 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2489 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2490 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2491 # restore PATH
2492 PATH=$OPATH
2493
2494 # Where does ssh-rand-helper get its randomness from?
2495 INSTALL_SSH_PRNG_CMDS=""
2496 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2497         if test ! -z "$PRNGD_PORT" ; then
2498                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2499         elif test ! -z "$PRNGD_SOCKET" ; then
2500                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2501         else
2502                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2503                 RAND_HELPER_CMDHASH=yes
2504                 INSTALL_SSH_PRNG_CMDS="yes"
2505         fi
2506 fi
2507 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2508
2509
2510 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2511 if test ! -z "$SONY" ; then
2512   LIBS="$LIBS -liberty";
2513 fi
2514
2515 # Check for  long long datatypes
2516 AC_CHECK_TYPES([long long, unsigned long long, long double])
2517
2518 # Check datatype sizes
2519 AC_CHECK_SIZEOF(char, 1)
2520 AC_CHECK_SIZEOF(short int, 2)
2521 AC_CHECK_SIZEOF(int, 4)
2522 AC_CHECK_SIZEOF(long int, 4)
2523 AC_CHECK_SIZEOF(long long int, 8)
2524
2525 # Sanity check long long for some platforms (AIX)
2526 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2527         ac_cv_sizeof_long_long_int=0
2528 fi
2529
2530 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2531 if test -z "$have_llong_max"; then
2532         AC_MSG_CHECKING([for max value of long long])
2533         AC_RUN_IFELSE(
2534                 [AC_LANG_SOURCE([[
2535 #include <stdio.h>
2536 /* Why is this so damn hard? */
2537 #ifdef __GNUC__
2538 # undef __GNUC__
2539 #endif
2540 #define __USE_ISOC99
2541 #include <limits.h>
2542 #define DATA "conftest.llminmax"
2543 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2544
2545 /*
2546  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2547  * we do this the hard way.
2548  */
2549 static int
2550 fprint_ll(FILE *f, long long n)
2551 {
2552         unsigned int i;
2553         int l[sizeof(long long) * 8];
2554
2555         if (n < 0)
2556                 if (fprintf(f, "-") < 0)
2557                         return -1;
2558         for (i = 0; n != 0; i++) {
2559                 l[i] = my_abs(n % 10);
2560                 n /= 10;
2561         }
2562         do {
2563                 if (fprintf(f, "%d", l[--i]) < 0)
2564                         return -1;
2565         } while (i != 0);
2566         if (fprintf(f, " ") < 0)
2567                 return -1;
2568         return 0;
2569 }
2570
2571 int main(void) {
2572         FILE *f;
2573         long long i, llmin, llmax = 0;
2574
2575         if((f = fopen(DATA,"w")) == NULL)
2576                 exit(1);
2577
2578 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2579         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2580         llmin = LLONG_MIN;
2581         llmax = LLONG_MAX;
2582 #else
2583         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2584         /* This will work on one's complement and two's complement */
2585         for (i = 1; i > llmax; i <<= 1, i++)
2586                 llmax = i;
2587         llmin = llmax + 1LL;    /* wrap */
2588 #endif
2589
2590         /* Sanity check */
2591         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2592             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2593             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2594                 fprintf(f, "unknown unknown\n");
2595                 exit(2);
2596         }
2597
2598         if (fprint_ll(f, llmin) < 0)
2599                 exit(3);
2600         if (fprint_ll(f, llmax) < 0)
2601                 exit(4);
2602         if (fclose(f) < 0)
2603                 exit(5);
2604         exit(0);
2605 }
2606                 ]])],
2607                 [
2608                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2609                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2610
2611                         AC_MSG_RESULT($llong_max)
2612                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2613                             [max value of long long calculated by configure])
2614                         AC_MSG_CHECKING([for min value of long long])
2615                         AC_MSG_RESULT($llong_min)
2616                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2617                             [min value of long long calculated by configure])
2618                 ],
2619                 [
2620                         AC_MSG_RESULT(not found)
2621                 ],
2622                 [
2623                         AC_MSG_WARN([cross compiling: not checking])
2624                 ]
2625         )
2626 fi
2627
2628
2629 # More checks for data types
2630 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2631         AC_TRY_COMPILE(
2632                 [ #include <sys/types.h> ],
2633                 [ u_int a; a = 1;],
2634                 [ ac_cv_have_u_int="yes" ],
2635                 [ ac_cv_have_u_int="no" ]
2636         )
2637 ])
2638 if test "x$ac_cv_have_u_int" = "xyes" ; then
2639         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2640         have_u_int=1
2641 fi
2642
2643 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2644         AC_TRY_COMPILE(
2645                 [ #include <sys/types.h> ],
2646                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2647                 [ ac_cv_have_intxx_t="yes" ],
2648                 [ ac_cv_have_intxx_t="no" ]
2649         )
2650 ])
2651 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2652         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2653         have_intxx_t=1
2654 fi
2655
2656 if (test -z "$have_intxx_t" && \
2657            test "x$ac_cv_header_stdint_h" = "xyes")
2658 then
2659     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2660         AC_TRY_COMPILE(
2661                 [ #include <stdint.h> ],
2662                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2663                 [
2664                         AC_DEFINE(HAVE_INTXX_T)
2665                         AC_MSG_RESULT(yes)
2666                 ],
2667                 [ AC_MSG_RESULT(no) ]
2668         )
2669 fi
2670
2671 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2672         AC_TRY_COMPILE(
2673                 [
2674 #include <sys/types.h>
2675 #ifdef HAVE_STDINT_H
2676 # include <stdint.h>
2677 #endif
2678 #include <sys/socket.h>
2679 #ifdef HAVE_SYS_BITYPES_H
2680 # include <sys/bitypes.h>
2681 #endif
2682                 ],
2683                 [ int64_t a; a = 1;],
2684                 [ ac_cv_have_int64_t="yes" ],
2685                 [ ac_cv_have_int64_t="no" ]
2686         )
2687 ])
2688 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2689         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2690 fi
2691
2692 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2693         AC_TRY_COMPILE(
2694                 [ #include <sys/types.h> ],
2695                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2696                 [ ac_cv_have_u_intxx_t="yes" ],
2697                 [ ac_cv_have_u_intxx_t="no" ]
2698         )
2699 ])
2700 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2701         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2702         have_u_intxx_t=1
2703 fi
2704
2705 if test -z "$have_u_intxx_t" ; then
2706     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2707         AC_TRY_COMPILE(
2708                 [ #include <sys/socket.h> ],
2709                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2710                 [
2711                         AC_DEFINE(HAVE_U_INTXX_T)
2712                         AC_MSG_RESULT(yes)
2713                 ],
2714                 [ AC_MSG_RESULT(no) ]
2715         )
2716 fi
2717
2718 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2719         AC_TRY_COMPILE(
2720                 [ #include <sys/types.h> ],
2721                 [ u_int64_t a; a = 1;],
2722                 [ ac_cv_have_u_int64_t="yes" ],
2723                 [ ac_cv_have_u_int64_t="no" ]
2724         )
2725 ])
2726 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2727         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2728         have_u_int64_t=1
2729 fi
2730
2731 if test -z "$have_u_int64_t" ; then
2732     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2733         AC_TRY_COMPILE(
2734                 [ #include <sys/bitypes.h> ],
2735                 [ u_int64_t a; a = 1],
2736                 [
2737                         AC_DEFINE(HAVE_U_INT64_T)
2738                         AC_MSG_RESULT(yes)
2739                 ],
2740                 [ AC_MSG_RESULT(no) ]
2741         )
2742 fi
2743
2744 if test -z "$have_u_intxx_t" ; then
2745         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2746                 AC_TRY_COMPILE(
2747                         [
2748 #include <sys/types.h>
2749                         ],
2750                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2751                         [ ac_cv_have_uintxx_t="yes" ],
2752                         [ ac_cv_have_uintxx_t="no" ]
2753                 )
2754         ])
2755         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2756                 AC_DEFINE(HAVE_UINTXX_T, 1,
2757                         [define if you have uintxx_t data type])
2758         fi
2759 fi
2760
2761 if test -z "$have_uintxx_t" ; then
2762     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2763         AC_TRY_COMPILE(
2764                 [ #include <stdint.h> ],
2765                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2766                 [
2767                         AC_DEFINE(HAVE_UINTXX_T)
2768                         AC_MSG_RESULT(yes)
2769                 ],
2770                 [ AC_MSG_RESULT(no) ]
2771         )
2772 fi
2773
2774 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2775            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2776 then
2777         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2778         AC_TRY_COMPILE(
2779                 [
2780 #include <sys/bitypes.h>
2781                 ],
2782                 [
2783                         int8_t a; int16_t b; int32_t c;
2784                         u_int8_t e; u_int16_t f; u_int32_t g;
2785                         a = b = c = e = f = g = 1;
2786                 ],
2787                 [
2788                         AC_DEFINE(HAVE_U_INTXX_T)
2789                         AC_DEFINE(HAVE_INTXX_T)
2790                         AC_MSG_RESULT(yes)
2791                 ],
2792                 [AC_MSG_RESULT(no)]
2793         )
2794 fi
2795
2796
2797 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2798         AC_TRY_COMPILE(
2799                 [
2800 #include <sys/types.h>
2801                 ],
2802                 [ u_char foo; foo = 125; ],
2803                 [ ac_cv_have_u_char="yes" ],
2804                 [ ac_cv_have_u_char="no" ]
2805         )
2806 ])
2807 if test "x$ac_cv_have_u_char" = "xyes" ; then
2808         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2809 fi
2810
2811 TYPE_SOCKLEN_T
2812
2813 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2814
2815 AC_CHECK_TYPES(in_addr_t,,,
2816 [#include <sys/types.h>
2817 #include <netinet/in.h>])
2818
2819 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2820         AC_TRY_COMPILE(
2821                 [
2822 #include <sys/types.h>
2823                 ],
2824                 [ size_t foo; foo = 1235; ],
2825                 [ ac_cv_have_size_t="yes" ],
2826                 [ ac_cv_have_size_t="no" ]
2827         )
2828 ])
2829 if test "x$ac_cv_have_size_t" = "xyes" ; then
2830         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2831 fi
2832
2833 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2834         AC_TRY_COMPILE(
2835                 [
2836 #include <sys/types.h>
2837                 ],
2838                 [ ssize_t foo; foo = 1235; ],
2839                 [ ac_cv_have_ssize_t="yes" ],
2840                 [ ac_cv_have_ssize_t="no" ]
2841         )
2842 ])
2843 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2844         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2845 fi
2846
2847 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2848         AC_TRY_COMPILE(
2849                 [
2850 #include <time.h>
2851                 ],
2852                 [ clock_t foo; foo = 1235; ],
2853                 [ ac_cv_have_clock_t="yes" ],
2854                 [ ac_cv_have_clock_t="no" ]
2855         )
2856 ])
2857 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2858         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2859 fi
2860
2861 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2862         AC_TRY_COMPILE(
2863                 [
2864 #include <sys/types.h>
2865 #include <sys/socket.h>
2866                 ],
2867                 [ sa_family_t foo; foo = 1235; ],
2868                 [ ac_cv_have_sa_family_t="yes" ],
2869                 [ AC_TRY_COMPILE(
2870                   [
2871 #include <sys/types.h>
2872 #include <sys/socket.h>
2873 #include <netinet/in.h>
2874                 ],
2875                 [ sa_family_t foo; foo = 1235; ],
2876                 [ ac_cv_have_sa_family_t="yes" ],
2877
2878                 [ ac_cv_have_sa_family_t="no" ]
2879         )]
2880         )
2881 ])
2882 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2883         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2884                 [define if you have sa_family_t data type])
2885 fi
2886
2887 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2888         AC_TRY_COMPILE(
2889                 [
2890 #include <sys/types.h>
2891                 ],
2892                 [ pid_t foo; foo = 1235; ],
2893                 [ ac_cv_have_pid_t="yes" ],
2894                 [ ac_cv_have_pid_t="no" ]
2895         )
2896 ])
2897 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2898         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2899 fi
2900
2901 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2902         AC_TRY_COMPILE(
2903                 [
2904 #include <sys/types.h>
2905                 ],
2906                 [ mode_t foo; foo = 1235; ],
2907                 [ ac_cv_have_mode_t="yes" ],
2908                 [ ac_cv_have_mode_t="no" ]
2909         )
2910 ])
2911 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2912         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2913 fi
2914
2915
2916 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2917         AC_TRY_COMPILE(
2918                 [
2919 #include <sys/types.h>
2920 #include <sys/socket.h>
2921                 ],
2922                 [ struct sockaddr_storage s; ],
2923                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2924                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2925         )
2926 ])
2927 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2928         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2929                 [define if you have struct sockaddr_storage data type])
2930 fi
2931
2932 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2933         AC_TRY_COMPILE(
2934                 [
2935 #include <sys/types.h>
2936 #include <netinet/in.h>
2937                 ],
2938                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2939                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2940                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2941         )
2942 ])
2943 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2944         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2945                 [define if you have struct sockaddr_in6 data type])
2946 fi
2947
2948 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2949         AC_TRY_COMPILE(
2950                 [
2951 #include <sys/types.h>
2952 #include <netinet/in.h>
2953                 ],
2954                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2955                 [ ac_cv_have_struct_in6_addr="yes" ],
2956                 [ ac_cv_have_struct_in6_addr="no" ]
2957         )
2958 ])
2959 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2960         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2961                 [define if you have struct in6_addr data type])
2962 fi
2963
2964 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2965         AC_TRY_COMPILE(
2966                 [
2967 #include <sys/types.h>
2968 #include <sys/socket.h>
2969 #include <netdb.h>
2970                 ],
2971                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2972                 [ ac_cv_have_struct_addrinfo="yes" ],
2973                 [ ac_cv_have_struct_addrinfo="no" ]
2974         )
2975 ])
2976 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2977         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2978                 [define if you have struct addrinfo data type])
2979 fi
2980
2981 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2982         AC_TRY_COMPILE(
2983                 [ #include <sys/time.h> ],
2984                 [ struct timeval tv; tv.tv_sec = 1;],
2985                 [ ac_cv_have_struct_timeval="yes" ],
2986                 [ ac_cv_have_struct_timeval="no" ]
2987         )
2988 ])
2989 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2990         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2991         have_struct_timeval=1
2992 fi
2993
2994 AC_CHECK_TYPES(struct timespec)
2995
2996 # We need int64_t or else certian parts of the compile will fail.
2997 if test "x$ac_cv_have_int64_t" = "xno" && \
2998         test "x$ac_cv_sizeof_long_int" != "x8" && \
2999         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
3000         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
3001         echo "an alternative compiler (I.E., GCC) before continuing."
3002         echo ""
3003         exit 1;
3004 else
3005 dnl test snprintf (broken on SCO w/gcc)
3006         AC_RUN_IFELSE(
3007                 [AC_LANG_SOURCE([[
3008 #include <stdio.h>
3009 #include <string.h>
3010 #ifdef HAVE_SNPRINTF
3011 main()
3012 {
3013         char buf[50];
3014         char expected_out[50];
3015         int mazsize = 50 ;
3016 #if (SIZEOF_LONG_INT == 8)
3017         long int num = 0x7fffffffffffffff;
3018 #else
3019         long long num = 0x7fffffffffffffffll;
3020 #endif
3021         strcpy(expected_out, "9223372036854775807");
3022         snprintf(buf, mazsize, "%lld", num);
3023         if(strcmp(buf, expected_out) != 0)
3024                 exit(1);
3025         exit(0);
3026 }
3027 #else
3028 main() { exit(0); }
3029 #endif
3030                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
3031                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
3032         )
3033 fi
3034
3035 dnl Checks for structure members
3036 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
3037 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
3038 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
3039 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
3040 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
3041 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
3042 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
3043 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
3044 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
3045 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
3046 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
3047 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
3048 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
3049 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
3050 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
3051 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
3052 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
3053
3054 AC_CHECK_MEMBERS([struct stat.st_blksize])
3055 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
3056         [Define if we don't have struct __res_state in resolv.h])],
3057 [
3058 #include <stdio.h>
3059 #if HAVE_SYS_TYPES_H
3060 # include <sys/types.h>
3061 #endif
3062 #include <netinet/in.h>
3063 #include <arpa/nameser.h>
3064 #include <resolv.h>
3065 ])
3066
3067 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
3068                 ac_cv_have_ss_family_in_struct_ss, [
3069         AC_TRY_COMPILE(
3070                 [
3071 #include <sys/types.h>
3072 #include <sys/socket.h>
3073                 ],
3074                 [ struct sockaddr_storage s; s.ss_family = 1; ],
3075                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
3076                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
3077         )
3078 ])
3079 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3080         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
3081 fi
3082
3083 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
3084                 ac_cv_have___ss_family_in_struct_ss, [
3085         AC_TRY_COMPILE(
3086                 [
3087 #include <sys/types.h>
3088 #include <sys/socket.h>
3089                 ],
3090                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
3091                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
3092                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
3093         )
3094 ])
3095 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
3096         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
3097                 [Fields in struct sockaddr_storage])
3098 fi
3099
3100 AC_CACHE_CHECK([for pw_class field in struct passwd],
3101                 ac_cv_have_pw_class_in_struct_passwd, [
3102         AC_TRY_COMPILE(
3103                 [
3104 #include <pwd.h>
3105                 ],
3106                 [ struct passwd p; p.pw_class = 0; ],
3107                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
3108                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
3109         )
3110 ])
3111 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
3112         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
3113                 [Define if your password has a pw_class field])
3114 fi
3115
3116 AC_CACHE_CHECK([for pw_expire field in struct passwd],
3117                 ac_cv_have_pw_expire_in_struct_passwd, [
3118         AC_TRY_COMPILE(
3119                 [
3120 #include <pwd.h>
3121                 ],
3122                 [ struct passwd p; p.pw_expire = 0; ],
3123                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
3124                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
3125         )
3126 ])
3127 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
3128         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
3129                 [Define if your password has a pw_expire field])
3130 fi
3131
3132 AC_CACHE_CHECK([for pw_change field in struct passwd],
3133                 ac_cv_have_pw_change_in_struct_passwd, [
3134         AC_TRY_COMPILE(
3135                 [
3136 #include <pwd.h>
3137                 ],
3138                 [ struct passwd p; p.pw_change = 0; ],
3139                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
3140                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
3141         )
3142 ])
3143 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
3144         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
3145                 [Define if your password has a pw_change field])
3146 fi
3147
3148 dnl make sure we're using the real structure members and not defines
3149 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3150                 ac_cv_have_accrights_in_msghdr, [
3151         AC_COMPILE_IFELSE(
3152                 [
3153 #include <sys/types.h>
3154 #include <sys/socket.h>
3155 #include <sys/uio.h>
3156 int main() {
3157 #ifdef msg_accrights
3158 #error "msg_accrights is a macro"
3159 exit(1);
3160 #endif
3161 struct msghdr m;
3162 m.msg_accrights = 0;
3163 exit(0);
3164 }
3165                 ],
3166                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3167                 [ ac_cv_have_accrights_in_msghdr="no" ]
3168         )
3169 ])
3170 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3171         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
3172                 [Define if your system uses access rights style
3173                 file descriptor passing])
3174 fi
3175
3176 AC_CACHE_CHECK([for msg_control field in struct msghdr],
3177                 ac_cv_have_control_in_msghdr, [
3178         AC_COMPILE_IFELSE(
3179                 [
3180 #include <sys/types.h>
3181 #include <sys/socket.h>
3182 #include <sys/uio.h>
3183 int main() {
3184 #ifdef msg_control
3185 #error "msg_control is a macro"
3186 exit(1);
3187 #endif
3188 struct msghdr m;
3189 m.msg_control = 0;
3190 exit(0);
3191 }
3192                 ],
3193                 [ ac_cv_have_control_in_msghdr="yes" ],
3194                 [ ac_cv_have_control_in_msghdr="no" ]
3195         )
3196 ])
3197 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
3198         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3199                 [Define if your system uses ancillary data style
3200                 file descriptor passing])
3201 fi
3202
3203 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3204         AC_TRY_LINK([],
3205                 [ extern char *__progname; printf("%s", __progname); ],
3206                 [ ac_cv_libc_defines___progname="yes" ],
3207                 [ ac_cv_libc_defines___progname="no" ]
3208         )
3209 ])
3210 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3211         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3212 fi
3213
3214 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3215         AC_TRY_LINK([
3216 #include <stdio.h>
3217 ],
3218                 [ printf("%s", __FUNCTION__); ],
3219                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3220                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3221         )
3222 ])
3223 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3224         AC_DEFINE(HAVE___FUNCTION__, 1,
3225                 [Define if compiler implements __FUNCTION__])
3226 fi
3227
3228 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3229         AC_TRY_LINK([
3230 #include <stdio.h>
3231 ],
3232                 [ printf("%s", __func__); ],
3233                 [ ac_cv_cc_implements___func__="yes" ],
3234                 [ ac_cv_cc_implements___func__="no" ]
3235         )
3236 ])
3237 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3238         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3239 fi
3240
3241 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3242         AC_TRY_LINK(
3243                 [#include <stdarg.h>
3244                  va_list x,y;],
3245                 [va_copy(x,y);],
3246                 [ ac_cv_have_va_copy="yes" ],
3247                 [ ac_cv_have_va_copy="no" ]
3248         )
3249 ])
3250 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3251         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3252 fi
3253
3254 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3255         AC_TRY_LINK(
3256                 [#include <stdarg.h>
3257                  va_list x,y;],
3258                 [__va_copy(x,y);],
3259                 [ ac_cv_have___va_copy="yes" ],
3260                 [ ac_cv_have___va_copy="no" ]
3261         )
3262 ])
3263 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3264         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3265 fi
3266
3267 AC_CACHE_CHECK([whether getopt has optreset support],
3268                 ac_cv_have_getopt_optreset, [
3269         AC_TRY_LINK(
3270                 [
3271 #include <getopt.h>
3272                 ],
3273                 [ extern int optreset; optreset = 0; ],
3274                 [ ac_cv_have_getopt_optreset="yes" ],
3275                 [ ac_cv_have_getopt_optreset="no" ]
3276         )
3277 ])
3278 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3279         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3280                 [Define if your getopt(3) defines and uses optreset])
3281 fi
3282
3283 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3284         AC_TRY_LINK([],
3285                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3286                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3287                 [ ac_cv_libc_defines_sys_errlist="no" ]
3288         )
3289 ])
3290 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3291         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3292                 [Define if your system defines sys_errlist[]])
3293 fi
3294
3295
3296 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3297         AC_TRY_LINK([],
3298                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3299                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3300                 [ ac_cv_libc_defines_sys_nerr="no" ]
3301         )
3302 ])
3303 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3304         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3305 fi
3306
3307 SCARD_MSG="no"
3308 # Check whether user wants sectok support
3309 AC_ARG_WITH(sectok,
3310         [  --with-sectok           Enable smartcard support using libsectok],
3311         [
3312                 if test "x$withval" != "xno" ; then
3313                         if test "x$withval" != "xyes" ; then
3314                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3315                                 LDFLAGS="$LDFLAGS -L${withval}"
3316                                 if test ! -z "$need_dash_r" ; then
3317                                         LDFLAGS="$LDFLAGS -R${withval}"
3318                                 fi
3319                                 if test ! -z "$blibpath" ; then
3320                                         blibpath="$blibpath:${withval}"
3321                                 fi
3322                         fi
3323                         AC_CHECK_HEADERS(sectok.h)
3324                         if test "$ac_cv_header_sectok_h" != yes; then
3325                                 AC_MSG_ERROR(Can't find sectok.h)
3326                         fi
3327                         AC_CHECK_LIB(sectok, sectok_open)
3328                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3329                                 AC_MSG_ERROR(Can't find libsectok)
3330                         fi
3331                         AC_DEFINE(SMARTCARD, 1,
3332                                 [Define if you want smartcard support])
3333                         AC_DEFINE(USE_SECTOK, 1,
3334                                 [Define if you want smartcard support
3335                                 using sectok])
3336                         SCARD_MSG="yes, using sectok"
3337                 fi
3338         ]
3339 )
3340
3341 # Check whether user wants OpenSC support
3342 OPENSC_CONFIG="no"
3343 AC_ARG_WITH(opensc,
3344         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3345         [
3346             if test "x$withval" != "xno" ; then
3347                 if test "x$withval" != "xyes" ; then
3348                         OPENSC_CONFIG=$withval/bin/opensc-config
3349                 else
3350                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3351                 fi
3352                 if test "$OPENSC_CONFIG" != "no"; then
3353                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3354                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3355                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3356                         LIBS="$LIBS $LIBOPENSC_LIBS"
3357                         AC_DEFINE(SMARTCARD)
3358                         AC_DEFINE(USE_OPENSC, 1,
3359                                 [Define if you want smartcard support
3360                                 using OpenSC])
3361                         SCARD_MSG="yes, using OpenSC"
3362                 fi
3363             fi
3364         ]
3365 )
3366
3367 # Check libraries needed by DNS fingerprint support
3368 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3369         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3370                 [Define if getrrsetbyname() exists])],
3371         [
3372                 # Needed by our getrrsetbyname()
3373                 AC_SEARCH_LIBS(res_query, resolv)
3374                 AC_SEARCH_LIBS(dn_expand, resolv)
3375                 AC_MSG_CHECKING(if res_query will link)
3376                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
3377                    [AC_MSG_RESULT(no)
3378                     saved_LIBS="$LIBS"
3379                     LIBS="$LIBS -lresolv"
3380                     AC_MSG_CHECKING(for res_query in -lresolv)
3381                     AC_LINK_IFELSE([
3382 #include <resolv.h>
3383 int main()
3384 {
3385         res_query (0, 0, 0, 0, 0);
3386         return 0;
3387 }
3388                         ],
3389                         [LIBS="$LIBS -lresolv"
3390                          AC_MSG_RESULT(yes)],
3391                         [LIBS="$saved_LIBS"
3392                          AC_MSG_RESULT(no)])
3393                     ])
3394                 AC_CHECK_FUNCS(_getshort _getlong)
3395                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3396                     [#include <sys/types.h>
3397                     #include <arpa/nameser.h>])
3398                 AC_CHECK_MEMBER(HEADER.ad,
3399                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3400                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3401                         [#include <arpa/nameser.h>])
3402         ])
3403
3404 AC_MSG_CHECKING(if struct __res_state _res is an extern)
3405 AC_LINK_IFELSE([
3406 #include <stdio.h>
3407 #if HAVE_SYS_TYPES_H
3408 # include <sys/types.h>
3409 #endif
3410 #include <netinet/in.h>
3411 #include <arpa/nameser.h>
3412 #include <resolv.h>
3413 extern struct __res_state _res;
3414 int main() { return 0; }
3415                 ],
3416                 [AC_MSG_RESULT(yes)
3417                  AC_DEFINE(HAVE__RES_EXTERN, 1,
3418                     [Define if you have struct __res_state _res as an extern])
3419                 ],
3420                 [ AC_MSG_RESULT(no) ]
3421 )
3422
3423 # Check whether user wants SELinux support
3424 SELINUX_MSG="no"
3425 LIBSELINUX=""
3426 AC_ARG_WITH(selinux,
3427         [  --with-selinux          Enable SELinux support],
3428         [ if test "x$withval" != "xno" ; then
3429                 save_LIBS="$LIBS"
3430                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3431                 SELINUX_MSG="yes"
3432                 AC_CHECK_HEADER([selinux/selinux.h], ,
3433                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3434                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3435                     AC_MSG_ERROR(SELinux support requires libselinux library))
3436                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
3437                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3438                 LIBS="$save_LIBS"
3439         fi ]
3440 )
3441
3442 # Check whether user wants Kerberos 5 support
3443 KRB5_MSG="no"
3444 AC_ARG_WITH(kerberos5,
3445         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3446         [ if test "x$withval" != "xno" ; then
3447                 if test "x$withval" = "xyes" ; then
3448                         KRB5ROOT="/usr/local"
3449                 else
3450                         KRB5ROOT=${withval}
3451                 fi
3452
3453                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3454                 KRB5_MSG="yes"
3455
3456                 AC_MSG_CHECKING(for krb5-config)
3457                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3458                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3459                         AC_MSG_RESULT($KRB5CONF)
3460
3461                         AC_MSG_CHECKING(for gssapi support)
3462                         if $KRB5CONF | grep gssapi >/dev/null ; then
3463                                 AC_MSG_RESULT(yes)
3464                                 AC_DEFINE(GSSAPI, 1,
3465                                         [Define this if you want GSSAPI
3466                                         support in the version 2 protocol])
3467                                 k5confopts=gssapi
3468                         else
3469                                 AC_MSG_RESULT(no)
3470                                 k5confopts=""
3471                         fi
3472                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3473                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3474                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3475                         AC_MSG_CHECKING(whether we are using Heimdal)
3476                         AC_TRY_COMPILE([ #include <krb5.h> ],
3477                                        [ char *tmp = heimdal_version; ],
3478                                        [ AC_MSG_RESULT(yes)
3479                                          AC_DEFINE(HEIMDAL, 1,
3480                                         [Define this if you are using the
3481                                         Heimdal version of Kerberos V5]) ],
3482                                          AC_MSG_RESULT(no)
3483                         )
3484                 else
3485                         AC_MSG_RESULT(no)
3486                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3487                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3488                         AC_MSG_CHECKING(whether we are using Heimdal)
3489                         AC_TRY_COMPILE([ #include <krb5.h> ],
3490                                        [ char *tmp = heimdal_version; ],
3491                                        [ AC_MSG_RESULT(yes)
3492                                          AC_DEFINE(HEIMDAL)
3493                                          K5LIBS="-lkrb5 -ldes"
3494                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3495                                          AC_CHECK_LIB(roken, net_write,
3496                                            [K5LIBS="$K5LIBS -lroken"])
3497                                        ],
3498                                        [ AC_MSG_RESULT(no)
3499                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3500                                        ]
3501                         )
3502                         AC_SEARCH_LIBS(dn_expand, resolv)
3503
3504                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
3505                                 [ AC_DEFINE(GSSAPI)
3506                                   K5LIBS="-lgssapi $K5LIBS" ],
3507                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
3508                                         [ AC_DEFINE(GSSAPI)
3509                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3510                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3511                                         $K5LIBS)
3512                                 ],
3513                                 $K5LIBS)
3514
3515                         AC_CHECK_HEADER(gssapi.h, ,
3516                                 [ unset ac_cv_header_gssapi_h
3517                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3518                                   AC_CHECK_HEADERS(gssapi.h, ,
3519                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3520                                   )
3521                                 ]
3522                         )
3523
3524                         oldCPP="$CPPFLAGS"
3525                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3526                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3527                                         [ CPPFLAGS="$oldCPP" ])
3528
3529                         # If we're using some other GSSAPI
3530                         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
3531                                 AC_MSG_ERROR([$GSSAPI GSSAPI library conflicts with Kerberos support.  Use mechglue instead.])
3532                         fi
3533
3534                         if test -z "$GSSAPI"; then
3535                                 GSSAPI="KRB5";
3536                         fi
3537
3538                         oldCPP="$CPPFLAGS"
3539                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3540                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3541                                         [ CPPFLAGS="$oldCPP" ])
3542
3543                 fi
3544                 if test ! -z "$need_dash_r" ; then
3545                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3546                 fi
3547                 if test ! -z "$blibpath" ; then
3548                         blibpath="$blibpath:${KRB5ROOT}/lib"
3549                 fi
3550
3551                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3552                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3553                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3554
3555                 LIBS="$LIBS $K5LIBS"
3556                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3557                         [Define this if you want to use libkafs' AFS support]))
3558         fi
3559         ]
3560 )
3561
3562 # Check whether user wants AFS_KRB5 support
3563 AFS_KRB5_MSG="no"
3564 AC_ARG_WITH(afs-krb5,
3565         [  --with-afs-krb5[[=AKLOG_PATH]]  Enable aklog to get token (default=/usr/bin/aklog).],
3566         [
3567                 if test "x$withval" != "xno" ; then
3568
3569                         if test "x$withval" != "xyes" ; then
3570                                 AC_DEFINE_UNQUOTED(AKLOG_PATH, "$withval",
3571                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3572                         else
3573                                 AC_DEFINE_UNQUOTED(AKLOG_PATH,
3574                                         "/usr/bin/aklog",
3575                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3576                         fi
3577
3578                         if test -z "$KRB5ROOT" ; then
3579                                 AC_MSG_WARN([AFS_KRB5 requires Kerberos 5 support, build may fail])
3580                         fi
3581
3582                         LIBS="-lkrbafs -lkrb4 $LIBS"
3583                         if test ! -z "$AFS_LIBS" ; then
3584                                 LIBS="$LIBS $AFS_LIBS"
3585                         fi
3586                         AC_DEFINE(AFS_KRB5, 1,
3587                                 [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3588                         AFS_KRB5_MSG="yes"
3589                 fi
3590         ]
3591 )
3592
3593 AC_ARG_WITH(session-hooks,
3594         [  --with-session-hooks    Enable hooks for executing external commands                                       before/after a session],
3595         [ AC_DEFINE(SESSION_HOOKS, 1, [Define this if you want support for startup/shutdown hooks]) ]
3596 )
3597
3598 # Looking for programs, paths and files
3599
3600 PRIVSEP_PATH=/var/empty
3601 AC_ARG_WITH(privsep-path,
3602         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3603         [
3604                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3605                     test "x${withval}" != "xyes"; then
3606                         PRIVSEP_PATH=$withval
3607                 fi
3608         ]
3609 )
3610 AC_SUBST(PRIVSEP_PATH)
3611
3612 AC_ARG_WITH(xauth,
3613         [  --with-xauth=PATH       Specify path to xauth program ],
3614         [
3615                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3616                     test "x${withval}" != "xyes"; then
3617                         xauth_path=$withval
3618                 fi
3619         ],
3620         [
3621                 TestPath="$PATH"
3622                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3623                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3624                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3625                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3626                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3627                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3628                         xauth_path="/usr/openwin/bin/xauth"
3629                 fi
3630         ]
3631 )
3632
3633 STRIP_OPT=-s
3634 AC_ARG_ENABLE(strip,
3635         [  --disable-strip         Disable calling strip(1) on install],
3636         [
3637                 if test "x$enableval" = "xno" ; then
3638                         STRIP_OPT=
3639                 fi
3640         ]
3641 )
3642 AC_SUBST(STRIP_OPT)
3643
3644 if test -z "$xauth_path" ; then
3645         XAUTH_PATH="undefined"
3646         AC_SUBST(XAUTH_PATH)
3647 else
3648         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3649                 [Define if xauth is found in your path])
3650         XAUTH_PATH=$xauth_path
3651         AC_SUBST(XAUTH_PATH)
3652 fi
3653
3654 # Check for mail directory (last resort if we cannot get it from headers)
3655 if test ! -z "$MAIL" ; then
3656         maildir=`dirname $MAIL`
3657         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3658                 [Set this to your mail directory if you don't have maillock.h])
3659 fi
3660
3661 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3662         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3663         disable_ptmx_check=yes
3664 fi
3665 if test -z "$no_dev_ptmx" ; then
3666         if test "x$disable_ptmx_check" != "xyes" ; then
3667                 AC_CHECK_FILE("/dev/ptmx",
3668                         [
3669                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3670                                         [Define if you have /dev/ptmx])
3671                                 have_dev_ptmx=1
3672                         ]
3673                 )
3674         fi
3675 fi
3676
3677 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3678         AC_CHECK_FILE("/dev/ptc",
3679                 [
3680                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3681                                 [Define if you have /dev/ptc])
3682                         have_dev_ptc=1
3683                 ]
3684         )
3685 else
3686         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3687 fi
3688
3689 # Options from here on. Some of these are preset by platform above
3690 AC_ARG_WITH(mantype,
3691         [  --with-mantype=man|cat|doc  Set man page type],
3692         [
3693                 case "$withval" in
3694                 man|cat|doc)
3695                         MANTYPE=$withval
3696                         ;;
3697                 *)
3698                         AC_MSG_ERROR(invalid man type: $withval)
3699                         ;;
3700                 esac
3701         ]
3702 )
3703 if test -z "$MANTYPE"; then
3704         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3705         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3706         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3707                 MANTYPE=doc
3708         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3709                 MANTYPE=man
3710         else
3711                 MANTYPE=cat
3712         fi
3713 fi
3714 AC_SUBST(MANTYPE)
3715 if test "$MANTYPE" = "doc"; then
3716         mansubdir=man;
3717 else
3718         mansubdir=$MANTYPE;
3719 fi
3720 AC_SUBST(mansubdir)
3721
3722 # Check whether to enable MD5 passwords
3723 MD5_MSG="no"
3724 AC_ARG_WITH(md5-passwords,
3725         [  --with-md5-passwords    Enable use of MD5 passwords],
3726         [
3727                 if test "x$withval" != "xno" ; then
3728                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3729                                 [Define if you want to allow MD5 passwords])
3730                         MD5_MSG="yes"
3731                 fi
3732         ]
3733 )
3734
3735 # Whether to disable shadow password support
3736 AC_ARG_WITH(shadow,
3737         [  --without-shadow        Disable shadow password support],
3738         [
3739                 if test "x$withval" = "xno" ; then
3740                         AC_DEFINE(DISABLE_SHADOW)
3741                         disable_shadow=yes
3742                 fi
3743         ]
3744 )
3745
3746 if test -z "$disable_shadow" ; then
3747         AC_MSG_CHECKING([if the systems has expire shadow information])
3748         AC_TRY_COMPILE(
3749         [
3750 #include <sys/types.h>
3751 #include <shadow.h>
3752         struct spwd sp;
3753         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3754         [ sp_expire_available=yes ], []
3755         )
3756
3757         if test "x$sp_expire_available" = "xyes" ; then
3758                 AC_MSG_RESULT(yes)
3759                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3760                     [Define if you want to use shadow password expire field])
3761         else
3762                 AC_MSG_RESULT(no)
3763         fi
3764 fi
3765
3766 # Use ip address instead of hostname in $DISPLAY
3767 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3768         DISPLAY_HACK_MSG="yes"
3769         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3770                 [Define if you need to use IP address
3771                 instead of hostname in $DISPLAY])
3772 else
3773         DISPLAY_HACK_MSG="no"
3774         AC_ARG_WITH(ipaddr-display,
3775                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3776                 [
3777                         if test "x$withval" != "xno" ; then
3778                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3779                                 DISPLAY_HACK_MSG="yes"
3780                         fi
3781                 ]
3782         )
3783 fi
3784
3785 # check for /etc/default/login and use it if present.
3786 AC_ARG_ENABLE(etc-default-login,
3787         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3788         [ if test "x$enableval" = "xno"; then
3789                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3790                 etc_default_login=no
3791           else
3792                 etc_default_login=yes
3793           fi ],
3794         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3795           then
3796                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3797                 etc_default_login=no
3798           else
3799                 etc_default_login=yes
3800           fi ]
3801 )
3802
3803 if test "x$etc_default_login" != "xno"; then
3804         AC_CHECK_FILE("/etc/default/login",
3805             [ external_path_file=/etc/default/login ])
3806         if test "x$external_path_file" = "x/etc/default/login"; then
3807                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3808                         [Define if your system has /etc/default/login])
3809         fi
3810 fi
3811
3812 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3813 if test $ac_cv_func_login_getcapbool = "yes" && \
3814         test $ac_cv_header_login_cap_h = "yes" ; then
3815         external_path_file=/etc/login.conf
3816 fi
3817
3818 # Whether to mess with the default path
3819 SERVER_PATH_MSG="(default)"
3820 AC_ARG_WITH(default-path,
3821         [  --with-default-path=    Specify default \$PATH environment for server],
3822         [
3823                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3824                         AC_MSG_WARN([
3825 --with-default-path=PATH has no effect on this system.
3826 Edit /etc/login.conf instead.])
3827                 elif test "x$withval" != "xno" ; then
3828                         if test ! -z "$external_path_file" ; then
3829                                 AC_MSG_WARN([
3830 --with-default-path=PATH will only be used if PATH is not defined in
3831 $external_path_file .])
3832                         fi
3833                         user_path="$withval"
3834                         SERVER_PATH_MSG="$withval"
3835                 fi
3836         ],
3837         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3838                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3839         else
3840                 if test ! -z "$external_path_file" ; then
3841                         AC_MSG_WARN([
3842 If PATH is defined in $external_path_file, ensure the path to scp is included,
3843 otherwise scp will not work.])
3844                 fi
3845                 AC_RUN_IFELSE(
3846                         [AC_LANG_SOURCE([[
3847 /* find out what STDPATH is */
3848 #include <stdio.h>
3849 #ifdef HAVE_PATHS_H
3850 # include <paths.h>
3851 #endif
3852 #ifndef _PATH_STDPATH
3853 # ifdef _PATH_USERPATH  /* Irix */
3854 #  define _PATH_STDPATH _PATH_USERPATH
3855 # else
3856 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3857 # endif
3858 #endif
3859 #include <sys/types.h>
3860 #include <sys/stat.h>
3861 #include <fcntl.h>
3862 #define DATA "conftest.stdpath"
3863
3864 main()
3865 {
3866         FILE *fd;
3867         int rc;
3868
3869         fd = fopen(DATA,"w");
3870         if(fd == NULL)
3871                 exit(1);
3872
3873         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3874                 exit(1);
3875
3876         exit(0);
3877 }
3878                 ]])],
3879                 [ user_path=`cat conftest.stdpath` ],
3880                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3881                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3882         )
3883 # make sure $bindir is in USER_PATH so scp will work
3884                 t_bindir=`eval echo ${bindir}`
3885                 case $t_bindir in
3886                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3887                 esac
3888                 case $t_bindir in
3889                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3890                 esac
3891                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3892                 if test $? -ne 0  ; then
3893                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3894                         if test $? -ne 0  ; then
3895                                 user_path=$user_path:$t_bindir
3896                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3897                         fi
3898                 fi
3899         fi ]
3900 )
3901 if test "x$external_path_file" != "x/etc/login.conf" ; then
3902         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3903         AC_SUBST(user_path)
3904 fi
3905
3906 # Set superuser path separately to user path
3907 AC_ARG_WITH(superuser-path,
3908         [  --with-superuser-path=  Specify different path for super-user],
3909         [
3910                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3911                     test "x${withval}" != "xyes"; then
3912                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3913                                 [Define if you want a different $PATH
3914                                 for the superuser])
3915                         superuser_path=$withval
3916                 fi
3917         ]
3918 )
3919
3920
3921 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3922 IPV4_IN6_HACK_MSG="no"
3923 AC_ARG_WITH(4in6,
3924         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3925         [
3926                 if test "x$withval" != "xno" ; then
3927                         AC_MSG_RESULT(yes)
3928                         AC_DEFINE(IPV4_IN_IPV6, 1,
3929                                 [Detect IPv4 in IPv6 mapped addresses
3930                                 and treat as IPv4])
3931                         IPV4_IN6_HACK_MSG="yes"
3932                 else
3933                         AC_MSG_RESULT(no)
3934                 fi
3935         ],[
3936                 if test "x$inet6_default_4in6" = "xyes"; then
3937                         AC_MSG_RESULT([yes (default)])
3938                         AC_DEFINE(IPV4_IN_IPV6)
3939                         IPV4_IN6_HACK_MSG="yes"
3940                 else
3941                         AC_MSG_RESULT([no (default)])
3942                 fi
3943         ]
3944 )
3945
3946 # Whether to enable BSD auth support
3947 BSD_AUTH_MSG=no
3948 AC_ARG_WITH(bsd-auth,
3949         [  --with-bsd-auth         Enable BSD auth support],
3950         [
3951                 if test "x$withval" != "xno" ; then
3952                         AC_DEFINE(BSD_AUTH, 1,
3953                                 [Define if you have BSD auth support])
3954                         BSD_AUTH_MSG=yes
3955                 fi
3956         ]
3957 )
3958
3959 # Where to place sshd.pid
3960 piddir=/var/run
3961 # make sure the directory exists
3962 if test ! -d $piddir ; then
3963         piddir=`eval echo ${sysconfdir}`
3964         case $piddir in
3965                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3966         esac
3967 fi
3968
3969 AC_ARG_WITH(pid-dir,
3970         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3971         [
3972                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3973                     test "x${withval}" != "xyes"; then
3974                         piddir=$withval
3975                         if test ! -d $piddir ; then
3976                         AC_MSG_WARN([** no $piddir directory on this system **])
3977                         fi
3978                 fi
3979         ]
3980 )
3981
3982 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3983 AC_SUBST(piddir)
3984
3985 dnl allow user to disable some login recording features
3986 AC_ARG_ENABLE(lastlog,
3987         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3988         [
3989                 if test "x$enableval" = "xno" ; then
3990                         AC_DEFINE(DISABLE_LASTLOG)
3991                 fi
3992         ]
3993 )
3994 AC_ARG_ENABLE(utmp,
3995         [  --disable-utmp          disable use of utmp even if detected [no]],
3996         [
3997                 if test "x$enableval" = "xno" ; then
3998                         AC_DEFINE(DISABLE_UTMP)
3999                 fi
4000         ]
4001 )
4002 AC_ARG_ENABLE(utmpx,
4003         [  --disable-utmpx         disable use of utmpx even if detected [no]],
4004         [
4005                 if test "x$enableval" = "xno" ; then
4006                         AC_DEFINE(DISABLE_UTMPX, 1,
4007                                 [Define if you don't want to use utmpx])
4008                 fi
4009         ]
4010 )
4011 AC_ARG_ENABLE(wtmp,
4012         [  --disable-wtmp          disable use of wtmp even if detected [no]],
4013         [
4014                 if test "x$enableval" = "xno" ; then
4015                         AC_DEFINE(DISABLE_WTMP)
4016                 fi
4017         ]
4018 )
4019 AC_ARG_ENABLE(wtmpx,
4020         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
4021         [
4022                 if test "x$enableval" = "xno" ; then
4023                         AC_DEFINE(DISABLE_WTMPX, 1,
4024                                 [Define if you don't want to use wtmpx])
4025                 fi
4026         ]
4027 )
4028 AC_ARG_ENABLE(libutil,
4029         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
4030         [
4031                 if test "x$enableval" = "xno" ; then
4032                         AC_DEFINE(DISABLE_LOGIN)
4033                 fi
4034         ]
4035 )
4036 AC_ARG_ENABLE(pututline,
4037         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
4038         [
4039                 if test "x$enableval" = "xno" ; then
4040                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
4041                                 [Define if you don't want to use pututline()
4042                                 etc. to write [uw]tmp])
4043                 fi
4044         ]
4045 )
4046 AC_ARG_ENABLE(pututxline,
4047         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
4048         [
4049                 if test "x$enableval" = "xno" ; then
4050                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
4051                                 [Define if you don't want to use pututxline()
4052                                 etc. to write [uw]tmpx])
4053                 fi
4054         ]
4055 )
4056 AC_ARG_WITH(lastlog,
4057   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
4058         [
4059                 if test "x$withval" = "xno" ; then
4060                         AC_DEFINE(DISABLE_LASTLOG)
4061                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
4062                         conf_lastlog_location=$withval
4063                 fi
4064         ]
4065 )
4066
4067 dnl lastlog, [uw]tmpx? detection
4068 dnl  NOTE: set the paths in the platform section to avoid the
4069 dnl   need for command-line parameters
4070 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4071
4072 dnl lastlog detection
4073 dnl  NOTE: the code itself will detect if lastlog is a directory
4074 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4075 AC_TRY_COMPILE([
4076 #include <sys/types.h>
4077 #include <utmp.h>
4078 #ifdef HAVE_LASTLOG_H
4079 #  include <lastlog.h>
4080 #endif
4081 #ifdef HAVE_PATHS_H
4082 #  include <paths.h>
4083 #endif
4084 #ifdef HAVE_LOGIN_H
4085 # include <login.h>
4086 #endif
4087         ],
4088         [ char *lastlog = LASTLOG_FILE; ],
4089         [ AC_MSG_RESULT(yes) ],
4090         [
4091                 AC_MSG_RESULT(no)
4092                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4093                 AC_TRY_COMPILE([
4094 #include <sys/types.h>
4095 #include <utmp.h>
4096 #ifdef HAVE_LASTLOG_H
4097 #  include <lastlog.h>
4098 #endif
4099 #ifdef HAVE_PATHS_H
4100 #  include <paths.h>
4101 #endif
4102                 ],
4103                 [ char *lastlog = _PATH_LASTLOG; ],
4104                 [ AC_MSG_RESULT(yes) ],
4105                 [
4106                         AC_MSG_RESULT(no)
4107                         system_lastlog_path=no
4108                 ])
4109         ]
4110 )
4111
4112 if test -z "$conf_lastlog_location"; then
4113         if test x"$system_lastlog_path" = x"no" ; then
4114                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
4115                                 if (test -d "$f" || test -f "$f") ; then
4116                                         conf_lastlog_location=$f
4117                                 fi
4118                 done
4119                 if test -z "$conf_lastlog_location"; then
4120                         AC_MSG_WARN([** Cannot find lastlog **])
4121                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4122                 fi
4123         fi
4124 fi
4125
4126 if test -n "$conf_lastlog_location"; then
4127         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
4128                 [Define if you want to specify the path to your lastlog file])
4129 fi
4130
4131 dnl utmp detection
4132 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4133 AC_TRY_COMPILE([
4134 #include <sys/types.h>
4135 #include <utmp.h>
4136 #ifdef HAVE_PATHS_H
4137 #  include <paths.h>
4138 #endif
4139         ],
4140         [ char *utmp = UTMP_FILE; ],
4141         [ AC_MSG_RESULT(yes) ],
4142         [ AC_MSG_RESULT(no)
4143           system_utmp_path=no ]
4144 )
4145 if test -z "$conf_utmp_location"; then
4146         if test x"$system_utmp_path" = x"no" ; then
4147                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
4148                         if test -f $f ; then
4149                                 conf_utmp_location=$f
4150                         fi
4151                 done
4152                 if test -z "$conf_utmp_location"; then
4153                         AC_DEFINE(DISABLE_UTMP)
4154                 fi
4155         fi
4156 fi
4157 if test -n "$conf_utmp_location"; then
4158         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
4159                 [Define if you want to specify the path to your utmp file])
4160 fi
4161
4162 dnl wtmp detection
4163 AC_MSG_CHECKING([if your system defines WTMP_FILE])
4164 AC_TRY_COMPILE([
4165 #include <sys/types.h>
4166 #include <utmp.h>
4167 #ifdef HAVE_PATHS_H
4168 #  include <paths.h>
4169 #endif
4170         ],
4171         [ char *wtmp = WTMP_FILE; ],
4172         [ AC_MSG_RESULT(yes) ],
4173         [ AC_MSG_RESULT(no)
4174           system_wtmp_path=no ]
4175 )
4176 if test -z "$conf_wtmp_location"; then
4177         if test x"$system_wtmp_path" = x"no" ; then
4178                 for f in /usr/adm/wtmp /var/log/wtmp; do
4179                         if test -f $f ; then
4180                                 conf_wtmp_location=$f
4181                         fi
4182                 done
4183                 if test -z "$conf_wtmp_location"; then
4184                         AC_DEFINE(DISABLE_WTMP)
4185                 fi
4186         fi
4187 fi
4188 if test -n "$conf_wtmp_location"; then
4189         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
4190                 [Define if you want to specify the path to your wtmp file])
4191 fi
4192
4193
4194 dnl utmpx detection - I don't know any system so perverse as to require
4195 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
4196 dnl  there, though.
4197 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
4198 AC_TRY_COMPILE([
4199 #include <sys/types.h>
4200 #include <utmp.h>
4201 #ifdef HAVE_UTMPX_H
4202 #include <utmpx.h>
4203 #endif
4204 #ifdef HAVE_PATHS_H
4205 #  include <paths.h>
4206 #endif
4207         ],
4208         [ char *utmpx = UTMPX_FILE; ],
4209         [ AC_MSG_RESULT(yes) ],
4210         [ AC_MSG_RESULT(no)
4211           system_utmpx_path=no ]
4212 )
4213 if test -z "$conf_utmpx_location"; then
4214         if test x"$system_utmpx_path" = x"no" ; then
4215                 AC_DEFINE(DISABLE_UTMPX)
4216         fi
4217 else
4218         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
4219                 [Define if you want to specify the path to your utmpx file])
4220 fi
4221
4222 dnl wtmpx detection
4223 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
4224 AC_TRY_COMPILE([
4225 #include <sys/types.h>
4226 #include <utmp.h>
4227 #ifdef HAVE_UTMPX_H
4228 #include <utmpx.h>
4229 #endif
4230 #ifdef HAVE_PATHS_H
4231 #  include <paths.h>
4232 #endif
4233         ],
4234         [ char *wtmpx = WTMPX_FILE; ],
4235         [ AC_MSG_RESULT(yes) ],
4236         [ AC_MSG_RESULT(no)
4237           system_wtmpx_path=no ]
4238 )
4239 if test -z "$conf_wtmpx_location"; then
4240         if test x"$system_wtmpx_path" = x"no" ; then
4241                 AC_DEFINE(DISABLE_WTMPX)
4242         fi
4243 else
4244         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
4245                 [Define if you want to specify the path to your wtmpx file])
4246 fi
4247
4248
4249 if test ! -z "$blibpath" ; then
4250         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4251         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4252 fi
4253
4254 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4255 dnl Add now.
4256 CFLAGS="$CFLAGS $werror_flags"
4257
4258 AC_EXEEXT
4259 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4260         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4261         scard/Makefile ssh_prng_cmds survey.sh])
4262 AC_OUTPUT
4263
4264 # Print summary of options
4265
4266 # Someone please show me a better way :)
4267 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4268 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4269 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4270 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4271 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4272 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4273 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
4274 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4275 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4276 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4277
4278 echo ""
4279 echo "OpenSSH has been configured with the following options:"
4280 echo "                     User binaries: $B"
4281 echo "                   System binaries: $C"
4282 echo "               Configuration files: $D"
4283 echo "                   Askpass program: $E"
4284 echo "                      Manual pages: $F"
4285 echo "                          PID file: $G"
4286 echo "  Privilege separation chroot path: $H"
4287 if test "x$external_path_file" = "x/etc/login.conf" ; then
4288 echo "   At runtime, sshd will use the path defined in $external_path_file"
4289 echo "   Make sure the path to scp is present, otherwise scp will not work"
4290 else
4291 echo "            sshd default user PATH: $I"
4292         if test ! -z "$external_path_file"; then
4293 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4294 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4295         fi
4296 fi
4297 if test ! -z "$superuser_path" ; then
4298 echo "          sshd superuser user PATH: $J"
4299 fi
4300 echo "                    Manpage format: $MANTYPE"
4301 echo "                       PAM support: $PAM_MSG"
4302 echo "                   OSF SIA support: $SIA_MSG"
4303 echo "                 KerberosV support: $KRB5_MSG"
4304 echo "                   SELinux support: $SELINUX_MSG"
4305 echo "                 Smartcard support: $SCARD_MSG"
4306 echo "                     S/KEY support: $SKEY_MSG"
4307 echo "              TCP Wrappers support: $TCPW_MSG"
4308 echo "              MD5 password support: $MD5_MSG"
4309 echo "                   libedit support: $LIBEDIT_MSG"
4310 echo "  Solaris process contract support: $SPC_MSG"
4311 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4312 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4313 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4314 echo "              Random number source: $RAND_MSG"
4315 if test ! -z "$USE_RAND_HELPER" ; then
4316 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4317 fi
4318
4319 echo ""
4320
4321 echo "              Host: ${host}"
4322 echo "          Compiler: ${CC}"
4323 echo "    Compiler flags: ${CFLAGS}"
4324 echo "Preprocessor flags: ${CPPFLAGS}"
4325 echo "      Linker flags: ${LDFLAGS}"
4326 echo "         Libraries: ${LIBS}"
4327 if test ! -z "${SSHDLIBS}"; then
4328 echo "         +for sshd: ${SSHDLIBS}"
4329 fi
4330
4331 echo ""
4332
4333 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4334         echo "SVR4 style packages are supported with \"make package\""
4335         echo ""
4336 fi
4337
4338 if test "x$PAM_MSG" = "xyes" ; then
4339         echo "PAM is enabled. You may need to install a PAM control file "
4340         echo "for sshd, otherwise password authentication may fail. "
4341         echo "Example PAM control files can be found in the contrib/ "
4342         echo "subdirectory"
4343         echo ""
4344 fi
4345
4346 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4347         echo "WARNING: you are using the builtin random number collection "
4348         echo "service. Please read WARNING.RNG and request that your OS "
4349         echo "vendor includes kernel-based random number collection in "
4350         echo "future versions of your OS."
4351         echo ""
4352 fi
4353
4354 if test ! -z "$NO_PEERCHECK" ; then
4355         echo "WARNING: the operating system that you are using does not"
4356         echo "appear to support getpeereid(), getpeerucred() or the"
4357         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
4358         echo "enforce security checks to prevent unauthorised connections to"
4359         echo "ssh-agent. Their absence increases the risk that a malicious"
4360         echo "user can connect to your agent."
4361         echo ""
4362 fi
4363
4364 if test "$AUDIT_MODULE" = "bsm" ; then
4365         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4366         echo "See the Solaris section in README.platform for details."
4367 fi