openssh/configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PATH_PROG(AR, ar)
  33 AC_PATH_PROG(CAT, cat)
  34 AC_PATH_PROG(KILL, kill)
  35 AC_PATH_PROGS(PERL, perl5 perl)
  36 AC_PATH_PROG(SED, sed)
  37 AC_SUBST(PERL)
  38 AC_PATH_PROG(ENT, ent)
  39 AC_SUBST(ENT)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  43 AC_PATH_PROG(SH, sh)
  44 AC_SUBST(TEST_SHELL,sh)
  45
  46 dnl for buildpkg.sh
  47 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  50         [/usr/sbin${PATH_SEPARATOR}/etc])
  51 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  52 if test -x /sbin/sh; then
  53         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  54 else
  55         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  56 fi
  57
  58 # System features
  59 AC_SYS_LARGEFILE
  60
  61 if test -z "$AR" ; then
  62         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  63 fi
  64
  65 # Use LOGIN_PROGRAM from environment if possible
  66 if test ! -z "$LOGIN_PROGRAM" ; then
  67         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  68                 [If your header files don't define LOGIN_PROGRAM,
  69                 then use this (detected) from environment and PATH])
  70 else
  71         # Search for login
  72         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  73         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  74                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  75         fi
  76 fi
  77
  78 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  79 if test ! -z "$PATH_PASSWD_PROG" ; then
  80         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  81                 [Full path of your "passwd" program])
  82 fi
  83
  84 if test -z "$LD" ; then
  85         LD=$CC
  86 fi
  87 AC_SUBST(LD)
  88
  89 AC_C_INLINE
  90
  91 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  92
  93 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
  94         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
  95         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
  96         case $GCC_VER in
  97                 1.*) ;;
  98                 2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
  99                 2.*) ;;
 100                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 101                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 102                 *) ;;
 103         esac
 104
 105         if test -z "$have_llong_max"; then
 106                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 107                 unset ac_cv_have_decl_LLONG_MAX
 108                 saved_CFLAGS="$CFLAGS"
 109                 CFLAGS="$CFLAGS -std=gnu99"
 110                 AC_CHECK_DECL(LLONG_MAX,
 111                     [have_llong_max=1],
 112                     [CFLAGS="$saved_CFLAGS"],
 113                     [#include <limits.h>]
 114                 )
 115         fi
 116 fi
 117
 118 AC_ARG_WITH(rpath,
 119         [  --without-rpath         Disable auto-added -R linker paths],
 120         [
 121                 if test "x$withval" = "xno" ; then
 122                         need_dash_r=""
 123                 fi
 124                 if test "x$withval" = "xyes" ; then
 125                         need_dash_r=1
 126                 fi
 127         ]
 128 )
 129
 130 # Allow user to specify flags
 131 AC_ARG_WITH(cflags,
 132         [  --with-cflags           Specify additional flags to pass to compiler],
 133         [
 134                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 135                     test "x${withval}" != "xyes"; then
 136                         CFLAGS="$CFLAGS $withval"
 137                 fi
 138         ]
 139 )
 140 AC_ARG_WITH(cppflags,
 141         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 142         [
 143                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 144                     test "x${withval}" != "xyes"; then
 145                         CPPFLAGS="$CPPFLAGS $withval"
 146                 fi
 147         ]
 148 )
 149 AC_ARG_WITH(ldflags,
 150         [  --with-ldflags          Specify additional flags to pass to linker],
 151         [
 152                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 153                     test "x${withval}" != "xyes"; then
 154                         LDFLAGS="$LDFLAGS $withval"
 155                 fi
 156         ]
 157 )
 158 AC_ARG_WITH(libs,
 159         [  --with-libs             Specify additional libraries to link with],
 160         [
 161                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 162                     test "x${withval}" != "xyes"; then
 163                         LIBS="$LIBS $withval"
 164                 fi
 165         ]
 166 )
 167 AC_ARG_WITH(Werror,
 168         [  --with-Werror           Build main code with -Werror],
 169         [
 170                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 171                         werror_flags="-Werror"
 172                         if test "x${withval}" != "xyes"; then
 173                                 werror_flags="$withval"
 174                         fi
 175                 fi
 176         ]
 177 )
 178
 179 AC_CHECK_HEADERS( \
 180         bstring.h \
 181         crypt.h \
 182         crypto/sha2.h \
 183         dirent.h \
 184         endian.h \
 185         features.h \
 186         fcntl.h \
 187         floatingpoint.h \
 188         getopt.h \
 189         glob.h \
 190         ia.h \
 191         iaf.h \
 192         limits.h \
 193         login.h \
 194         maillock.h \
 195         ndir.h \
 196         net/if_tun.h \
 197         netdb.h \
 198         netgroup.h \
 199         pam/pam_appl.h \
 200         paths.h \
 201         pty.h \
 202         readpassphrase.h \
 203         rpc/types.h \
 204         security/pam_appl.h \
 205         sha2.h \
 206         shadow.h \
 207         stddef.h \
 208         stdint.h \
 209         string.h \
 210         strings.h \
 211         sys/audit.h \
 212         sys/bitypes.h \
 213         sys/bsdtty.h \
 214         sys/cdefs.h \
 215         sys/dir.h \
 216         sys/mman.h \
 217         sys/ndir.h \
 218         sys/prctl.h \
 219         sys/pstat.h \
 220         sys/select.h \
 221         sys/stat.h \
 222         sys/stream.h \
 223         sys/stropts.h \
 224         sys/strtio.h \
 225         sys/sysmacros.h \
 226         sys/time.h \
 227         sys/timers.h \
 228         sys/un.h \
 229         time.h \
 230         tmpdir.h \
 231         ttyent.h \
 232         unistd.h \
 233         usersec.h \
 234         util.h \
 235         utime.h \
 236         utmp.h \
 237         utmpx.h \
 238         vis.h \
 239 )
 240
 241 # lastlog.h requires sys/time.h to be included first on Solaris
 242 AC_CHECK_HEADERS(lastlog.h, [], [], [
 243 #ifdef HAVE_SYS_TIME_H
 244 # include <sys/time.h>
 245 #endif
 246 ])
 247
 248 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 249 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 250 #ifdef HAVE_SYS_STREAM_H
 251 # include <sys/stream.h>
 252 #endif
 253 ])
 254
 255 # login_cap.h requires sys/types.h on NetBSD
 256 AC_CHECK_HEADERS(login_cap.h, [], [], [
 257 #include <sys/types.h>
 258 ])
 259
 260 # Messages for features tested for in target-specific section
 261 SIA_MSG="no"
 262 SPC_MSG="no"
 263
 264 # Check for some target-specific stuff
 265 case "$host" in
 266 *-*-aix*)
 267         # Some versions of VAC won't allow macro redefinitions at
 268         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 269         # particularly with older versions of vac or xlc.
 270         # It also throws errors about null macro argments, but these are
 271         # not fatal.
 272         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 273         AC_COMPILE_IFELSE(
 274             [AC_LANG_SOURCE([[
 275 #define testmacro foo
 276 #define testmacro bar
 277 int main(void) { exit(0); }
 278             ]])],
 279             [ AC_MSG_RESULT(yes) ],
 280             [ AC_MSG_RESULT(no)
 281               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 282               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 283               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 284               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 285             ]
 286         )
 287
 288         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 289         if (test -z "$blibpath"); then
 290                 blibpath="/usr/lib:/lib"
 291         fi
 292         saved_LDFLAGS="$LDFLAGS"
 293         if test "$GCC" = "yes"; then
 294                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 295         else
 296                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 297         fi
 298         for tryflags in $flags ;do
 299                 if (test -z "$blibflags"); then
 300                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 301                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 302                 fi
 303         done
 304         if (test -z "$blibflags"); then
 305                 AC_MSG_RESULT(not found)
 306                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 307         else
 308                 AC_MSG_RESULT($blibflags)
 309         fi
 310         LDFLAGS="$saved_LDFLAGS"
 311         dnl Check for authenticate.  Might be in libs.a on older AIXes
 312         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 313                 [Define if you want to enable AIX4's authenticate function])],
 314                 [AC_CHECK_LIB(s,authenticate,
 315                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 316                                 LIBS="$LIBS -ls"
 317                         ])
 318                 ])
 319         dnl Check for various auth function declarations in headers.
 320         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 321             passwdexpired, setauthdb], , , [#include <usersec.h>])
 322         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 323         AC_CHECK_DECLS(loginfailed,
 324                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 325                   AC_TRY_COMPILE(
 326                         [#include <usersec.h>],
 327                         [(void)loginfailed("user","host","tty",0);],
 328                         [AC_MSG_RESULT(yes)
 329                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 330                                 [Define if your AIX loginfailed() function
 331                                 takes 4 arguments (AIX >= 5.2)])],
 332                         [AC_MSG_RESULT(no)]
 333                 )],
 334                 [],
 335                 [#include <usersec.h>]
 336         )
 337         AC_CHECK_FUNCS(setauthdb)
 338         AC_CHECK_DECL(F_CLOSEM,
 339             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 340             [],
 341             [ #include <limits.h>
 342               #include <fcntl.h> ]
 343         )
 344         check_for_aix_broken_getaddrinfo=1
 345         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 346         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 347             [Define if your platform breaks doing a seteuid before a setuid])
 348         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 349         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 350         dnl AIX handles lastlog as part of its login message
 351         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 352         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 353                 [Some systems need a utmpx entry for /bin/login to work])
 354         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 355                 [Define to a Set Process Title type if your system is
 356                 supported by bsd-setproctitle.c])
 357         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 358             [AIX 5.2 and 5.3 (and presumably newer) require this])
 359         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 360         ;;
 361 *-*-cygwin*)
 362         check_for_libcrypt_later=1
 363         LIBS="$LIBS /usr/lib/textmode.o"
 364         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 365         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 366         AC_DEFINE(DISABLE_SHADOW, 1,
 367                 [Define if you want to disable shadow passwords])
 368         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 369                 [Define if your system choked on IP TOS setting])
 370         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 371                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 372         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 373                 [Define if the concept of ports only accessible to
 374                 superusers isn't known])
 375         AC_DEFINE(DISABLE_FD_PASSING, 1,
 376                 [Define if your platform needs to skip post auth
 377                 file descriptor passing])
 378         ;;
 379 *-*-dgux*)
 380         AC_DEFINE(IP_TOS_IS_BROKEN)
 381         AC_DEFINE(SETEUID_BREAKS_SETUID)
 382         AC_DEFINE(BROKEN_SETREUID)
 383         AC_DEFINE(BROKEN_SETREGID)
 384         ;;
 385 *-*-darwin*)
 386         AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
 387         AC_DEFINE(SETEUID_BREAKS_SETUID)
 388         AC_DEFINE(BROKEN_SETREUID)
 389         AC_DEFINE(BROKEN_SETREGID)
 390         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 391                 [Define if your resolver libs need this for getrrsetbyname])
 392         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 393         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 394             [Use tunnel device compatibility to OpenBSD])
 395         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 396             [Prepend the address family to IP tunnel traffic])
 397         AC_MSG_CHECKING(if we have the Security Authorization Session API)
 398         AC_TRY_COMPILE([#include <Security/AuthSession.h>],
 399                 [SessionCreate(0, 0);],
 400                 [ac_cv_use_security_session_api="yes"
 401                  AC_DEFINE(USE_SECURITY_SESSION_API, 1,
 402                         [platform has the Security Authorization Session API])
 403                  LIBS="$LIBS -framework Security"
 404                  AC_MSG_RESULT(yes)],
 405                 [ac_cv_use_security_session_api="no"
 406                  AC_MSG_RESULT(no)])
 407         AC_MSG_CHECKING(if we have an in-memory credentials cache)
 408         AC_TRY_COMPILE(
 409                 [#include <Kerberos/Kerberos.h>],
 410                 [cc_context_t c;
 411                  (void) cc_initialize (&c, 0, NULL, NULL);],
 412                 [AC_DEFINE(USE_CCAPI, 1,
 413                         [platform uses an in-memory credentials cache])
 414                  LIBS="$LIBS -framework Security"
 415                  AC_MSG_RESULT(yes)
 416                  if test "x$ac_cv_use_security_session_api" = "xno"; then
 417                         AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
 418                 fi],
 419                 [AC_MSG_RESULT(no)]
 420         )
 421         ;;
 422 *-*-dragonfly*)
 423         SSHDLIBS="$SSHDLIBS -lcrypt"
 424         ;;
 425 *-*-hpux*)
 426         # first we define all of the options common to all HP-UX releases
 427         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 428         IPADDR_IN_DISPLAY=yes
 429         AC_DEFINE(USE_PIPES)
 430         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 431             [Define if your login program cannot handle end of options ("--")])
 432         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 433         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 434                 [String used in /etc/passwd to denote locked account])
 435         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 436         MAIL="/var/mail/username"
 437         LIBS="$LIBS -lsec"
 438         AC_CHECK_LIB(xnet, t_error, ,
 439             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 440
 441         # next, we define all of the options specific to major releases
 442         case "$host" in
 443         *-*-hpux10*)
 444                 if test -z "$GCC"; then
 445                         CFLAGS="$CFLAGS -Ae"
 446                 fi
 447                 ;;
 448         *-*-hpux11*)
 449                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 450                         [Define if you are using Solaris-derived PAM which
 451                         passes pam_messages to the conversation function
 452                         with an extra level of indirection])
 453                 AC_DEFINE(DISABLE_UTMP, 1,
 454                         [Define if you don't want to use utmp])
 455                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 456                 check_for_hpux_broken_getaddrinfo=1
 457                 check_for_conflicting_getspnam=1
 458                 ;;
 459         esac
 460
 461         # lastly, we define options specific to minor releases
 462         case "$host" in
 463         *-*-hpux10.26)
 464                 AC_DEFINE(HAVE_SECUREWARE, 1,
 465                         [Define if you have SecureWare-based
 466                         protected password database])
 467                 disable_ptmx_check=yes
 468                 LIBS="$LIBS -lsecpw"
 469                 ;;
 470         esac
 471         ;;
 472 *-*-irix5*)
 473         PATH="$PATH:/usr/etc"
 474         AC_DEFINE(BROKEN_INET_NTOA, 1,
 475                 [Define if you system's inet_ntoa is busted
 476                 (e.g. Irix gcc issue)])
 477         AC_DEFINE(SETEUID_BREAKS_SETUID)
 478         AC_DEFINE(BROKEN_SETREUID)
 479         AC_DEFINE(BROKEN_SETREGID)
 480         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 481                 [Define if you shouldn't strip 'tty' from your
 482                 ttyname in [uw]tmp])
 483         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 484         ;;
 485 *-*-irix6*)
 486         PATH="$PATH:/usr/etc"
 487         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 488                 [Define if you have/want arrays
 489                 (cluster-wide session managment, not C arrays)])
 490         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 491                 [Define if you want IRIX project management])
 492         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 493                 [Define if you want IRIX audit trails])
 494         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 495                 [Define if you want IRIX kernel jobs])])
 496         AC_DEFINE(BROKEN_INET_NTOA)
 497         AC_DEFINE(SETEUID_BREAKS_SETUID)
 498         AC_DEFINE(BROKEN_SETREUID)
 499         AC_DEFINE(BROKEN_SETREGID)
 500         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 501         AC_DEFINE(WITH_ABBREV_NO_TTY)
 502         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 503         ;;
 504 *-*-linux*)
 505         no_dev_ptmx=1
 506         check_for_libcrypt_later=1
 507         check_for_openpty_ctty_bug=1
 508         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 509         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 510                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 511         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 512                 [String used in /etc/passwd to denote locked account])
 513         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 514         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 515                 [Define to whatever link() returns for "not supported"
 516                 if it doesn't return EOPNOTSUPP.])
 517         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 518         AC_DEFINE(USE_BTMP)
 519         inet6_default_4in6=yes
 520         case `uname -r` in
 521         1.*|2.0.*)
 522                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 523                         [Define if cmsg_type is not passed correctly])
 524                 ;;
 525         esac
 526         # tun(4) forwarding compat code
 527         AC_CHECK_HEADERS(linux/if_tun.h)
 528         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 529                 AC_DEFINE(SSH_TUN_LINUX, 1,
 530                     [Open tunnel devices the Linux tun/tap way])
 531                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 532                     [Use tunnel device compatibility to OpenBSD])
 533                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 534                     [Prepend the address family to IP tunnel traffic])
 535         fi
 536         ;;
 537 mips-sony-bsd|mips-sony-newsos4)
 538         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 539         SONY=1
 540         ;;
 541 *-*-netbsd*)
 542         check_for_libcrypt_before=1
 543         if test "x$withval" != "xno" ; then
 544                 need_dash_r=1
 545         fi
 546         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 547         AC_CHECK_HEADER([net/if_tap.h], ,
 548             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 549         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 550             [Prepend the address family to IP tunnel traffic])
 551         ;;
 552 *-*-freebsd*)
 553         check_for_libcrypt_later=1
 554         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 555         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 556         AC_CHECK_HEADER([net/if_tap.h], ,
 557             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 558         ;;
 559 *-*-bsdi*)
 560         AC_DEFINE(SETEUID_BREAKS_SETUID)
 561         AC_DEFINE(BROKEN_SETREUID)
 562         AC_DEFINE(BROKEN_SETREGID)
 563         ;;
 564 *-next-*)
 565         conf_lastlog_location="/usr/adm/lastlog"
 566         conf_utmp_location=/etc/utmp
 567         conf_wtmp_location=/usr/adm/wtmp
 568         MAIL=/usr/spool/mail
 569         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 570         AC_DEFINE(BROKEN_REALPATH)
 571         AC_DEFINE(USE_PIPES)
 572         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 573         ;;
 574 *-*-openbsd*)
 575         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 576         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 577         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 578         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 579             [syslog_r function is safe to use in in a signal handler])
 580         ;;
 581 *-*-solaris*)
 582         if test "x$withval" != "xno" ; then
 583                 need_dash_r=1
 584         fi
 585         AC_DEFINE(PAM_SUN_CODEBASE)
 586         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 587         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 588                 [Some versions of /bin/login need the TERM supplied
 589                 on the commandline])
 590         AC_DEFINE(PAM_TTY_KLUDGE)
 591         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 592                 [Define if pam_chauthtok wants real uid set
 593                 to the unpriv'ed user])
 594         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 595         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 596         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 597                 [Define if sshd somehow reacquires a controlling TTY
 598                 after setsid()])
 599         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 600                 in case the name is longer than 8 chars])
 601         external_path_file=/etc/default/login
 602         # hardwire lastlog location (can't detect it on some versions)
 603         conf_lastlog_location="/var/adm/lastlog"
 604         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 605         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 606         if test "$sol2ver" -ge 8; then
 607                 AC_MSG_RESULT(yes)
 608                 AC_DEFINE(DISABLE_UTMP)
 609                 AC_DEFINE(DISABLE_WTMP, 1,
 610                         [Define if you don't want to use wtmp])
 611         else
 612                 AC_MSG_RESULT(no)
 613         fi
 614         AC_ARG_WITH(solaris-contracts,
 615                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 616                 [
 617                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 618                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 619                                 [Define if you have Solaris process contracts])
 620                           SSHDLIBS="$SSHDLIBS -lcontract"
 621                           AC_SUBST(SSHDLIBS)
 622                           SPC_MSG="yes" ], )
 623                 ],
 624         )
 625         ;;
 626 *-*-sunos4*)
 627         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 628         AC_CHECK_FUNCS(getpwanam)
 629         AC_DEFINE(PAM_SUN_CODEBASE)
 630         conf_utmp_location=/etc/utmp
 631         conf_wtmp_location=/var/adm/wtmp
 632         conf_lastlog_location=/var/adm/lastlog
 633         AC_DEFINE(USE_PIPES)
 634         ;;
 635 *-ncr-sysv*)
 636         LIBS="$LIBS -lc89"
 637         AC_DEFINE(USE_PIPES)
 638         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 639         AC_DEFINE(SETEUID_BREAKS_SETUID)
 640         AC_DEFINE(BROKEN_SETREUID)
 641         AC_DEFINE(BROKEN_SETREGID)
 642         ;;
 643 *-sni-sysv*)
 644         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 645         AC_CHECK_LIB(dl, dlsym, ,)
 646         # -lresolv needs to be at the end of LIBS or DNS lookups break
 647         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 648         IPADDR_IN_DISPLAY=yes
 649         AC_DEFINE(USE_PIPES)
 650         AC_DEFINE(IP_TOS_IS_BROKEN)
 651         AC_DEFINE(SETEUID_BREAKS_SETUID)
 652         AC_DEFINE(BROKEN_SETREUID)
 653         AC_DEFINE(BROKEN_SETREGID)
 654         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 655         external_path_file=/etc/default/login
 656         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 657         # Attention: always take care to bind libsocket and libnsl before libc,
 658         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 659         ;;
 660 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 661 *-*-sysv4.2*)
 662         AC_DEFINE(USE_PIPES)
 663         AC_DEFINE(SETEUID_BREAKS_SETUID)
 664         AC_DEFINE(BROKEN_SETREUID)
 665         AC_DEFINE(BROKEN_SETREGID)
 666         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 667         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 668         ;;
 669 # UnixWare 7.x, OpenUNIX 8
 670 *-*-sysv5*)
 671         check_for_libcrypt_later=1
 672         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 673         AC_DEFINE(USE_PIPES)
 674         AC_DEFINE(SETEUID_BREAKS_SETUID)
 675         AC_DEFINE(BROKEN_SETREUID)
 676         AC_DEFINE(BROKEN_SETREGID)
 677         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 678         case "$host" in
 679         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 680                 TEST_SHELL=/u95/bin/sh
 681                 AC_DEFINE(BROKEN_LIBIAF, 1,
 682                         [ia_uinfo routines not supported by OS yet])
 683                 AC_DEFINE(BROKEN_UPDWTMPX)
 684                 ;;
 685         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 686                 ;;
 687         esac
 688         ;;
 689 *-*-sysv*)
 690         ;;
 691 # SCO UNIX and OEM versions of SCO UNIX
 692 *-*-sco3.2v4*)
 693         AC_MSG_ERROR("This Platform is no longer supported.")
 694         ;;
 695 # SCO OpenServer 5.x
 696 *-*-sco3.2v5*)
 697         if test -z "$GCC"; then
 698                 CFLAGS="$CFLAGS -belf"
 699         fi
 700         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 701         no_dev_ptmx=1
 702         AC_DEFINE(USE_PIPES)
 703         AC_DEFINE(HAVE_SECUREWARE)
 704         AC_DEFINE(DISABLE_SHADOW)
 705         AC_DEFINE(DISABLE_FD_PASSING)
 706         AC_DEFINE(SETEUID_BREAKS_SETUID)
 707         AC_DEFINE(BROKEN_SETREUID)
 708         AC_DEFINE(BROKEN_SETREGID)
 709         AC_DEFINE(WITH_ABBREV_NO_TTY)
 710         AC_DEFINE(BROKEN_UPDWTMPX)
 711         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 712         AC_CHECK_FUNCS(getluid setluid)
 713         MANTYPE=man
 714         TEST_SHELL=ksh
 715         ;;
 716 *-*-unicosmk*)
 717         AC_DEFINE(NO_SSH_LASTLOG, 1,
 718                 [Define if you don't want to use lastlog in session.c])
 719         AC_DEFINE(SETEUID_BREAKS_SETUID)
 720         AC_DEFINE(BROKEN_SETREUID)
 721         AC_DEFINE(BROKEN_SETREGID)
 722         AC_DEFINE(USE_PIPES)
 723         AC_DEFINE(DISABLE_FD_PASSING)
 724         LDFLAGS="$LDFLAGS"
 725         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 726         MANTYPE=cat
 727         ;;
 728 *-*-unicosmp*)
 729         AC_DEFINE(SETEUID_BREAKS_SETUID)
 730         AC_DEFINE(BROKEN_SETREUID)
 731         AC_DEFINE(BROKEN_SETREGID)
 732         AC_DEFINE(WITH_ABBREV_NO_TTY)
 733         AC_DEFINE(USE_PIPES)
 734         AC_DEFINE(DISABLE_FD_PASSING)
 735         LDFLAGS="$LDFLAGS"
 736         LIBS="$LIBS -lgen -lacid -ldb"
 737         MANTYPE=cat
 738         ;;
 739 *-*-unicos*)
 740         AC_DEFINE(SETEUID_BREAKS_SETUID)
 741         AC_DEFINE(BROKEN_SETREUID)
 742         AC_DEFINE(BROKEN_SETREGID)
 743         AC_DEFINE(USE_PIPES)
 744         AC_DEFINE(DISABLE_FD_PASSING)
 745         AC_DEFINE(NO_SSH_LASTLOG)
 746         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 747         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 748         MANTYPE=cat
 749         ;;
 750 *-dec-osf*)
 751         AC_MSG_CHECKING(for Digital Unix SIA)
 752         no_osfsia=""
 753         AC_ARG_WITH(osfsia,
 754                 [  --with-osfsia           Enable Digital Unix SIA],
 755                 [
 756                         if test "x$withval" = "xno" ; then
 757                                 AC_MSG_RESULT(disabled)
 758                                 no_osfsia=1
 759                         fi
 760                 ],
 761         )
 762         if test -z "$no_osfsia" ; then
 763                 if test -f /etc/sia/matrix.conf; then
 764                         AC_MSG_RESULT(yes)
 765                         AC_DEFINE(HAVE_OSF_SIA, 1,
 766                                 [Define if you have Digital Unix Security
 767                                 Integration Architecture])
 768                         AC_DEFINE(DISABLE_LOGIN, 1,
 769                                 [Define if you don't want to use your
 770                                 system's login() call])
 771                         AC_DEFINE(DISABLE_FD_PASSING)
 772                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 773                         SIA_MSG="yes"
 774                 else
 775                         AC_MSG_RESULT(no)
 776                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 777                           [String used in /etc/passwd to denote locked account])
 778                 fi
 779         fi
 780         AC_DEFINE(BROKEN_GETADDRINFO)
 781         AC_DEFINE(SETEUID_BREAKS_SETUID)
 782         AC_DEFINE(BROKEN_SETREUID)
 783         AC_DEFINE(BROKEN_SETREGID)
 784         ;;
 785
 786 *-*-nto-qnx*)
 787         AC_DEFINE(USE_PIPES)
 788         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 789         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 790         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 791         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 792         AC_DEFINE(DISABLE_LASTLOG)
 793         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 794         enable_etc_default_login=no     # has incompatible /etc/default/login
 795         ;;
 796
 797 *-*-ultrix*)
 798         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 799         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 800         AC_DEFINE(NEED_SETPGRP)
 801         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 802         ;;
 803
 804 *-*-lynxos)
 805         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 806         AC_DEFINE(MISSING_HOWMANY)
 807         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 808         ;;
 809 esac
 810
 811 AC_MSG_CHECKING(compiler and flags for sanity)
 812 AC_RUN_IFELSE(
 813         [AC_LANG_SOURCE([
 814 #include <stdio.h>
 815 int main(){exit(0);}
 816         ])],
 817         [       AC_MSG_RESULT(yes) ],
 818         [
 819                 AC_MSG_RESULT(no)
 820                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 821         ],
 822         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 823 )
 824
 825 dnl Checks for header files.
 826 # Checks for libraries.
 827 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 828 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 829
 830 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 831 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 832         AC_CHECK_LIB(gen, dirname,[
 833                 AC_CACHE_CHECK([for broken dirname],
 834                         ac_cv_have_broken_dirname, [
 835                         save_LIBS="$LIBS"
 836                         LIBS="$LIBS -lgen"
 837                         AC_RUN_IFELSE(
 838                                 [AC_LANG_SOURCE([[
 839 #include <libgen.h>
 840 #include <string.h>
 841
 842 int main(int argc, char **argv) {
 843     char *s, buf[32];
 844
 845     strncpy(buf,"/etc", 32);
 846     s = dirname(buf);
 847     if (!s || strncmp(s, "/", 32) != 0) {
 848         exit(1);
 849     } else {
 850         exit(0);
 851     }
 852 }
 853                                 ]])],
 854                                 [ ac_cv_have_broken_dirname="no" ],
 855                                 [ ac_cv_have_broken_dirname="yes" ],
 856                                 [ ac_cv_have_broken_dirname="no" ],
 857                         )
 858                         LIBS="$save_LIBS"
 859                 ])
 860                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 861                         LIBS="$LIBS -lgen"
 862                         AC_DEFINE(HAVE_DIRNAME)
 863                         AC_CHECK_HEADERS(libgen.h)
 864                 fi
 865         ])
 866 ])
 867
 868 AC_CHECK_FUNC(getspnam, ,
 869         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 870 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 871         [Define if you have the basename function.]))
 872
 873 dnl zlib is required
 874 AC_ARG_WITH(zlib,
 875         [  --with-zlib=PATH        Use zlib in PATH],
 876         [ if test "x$withval" = "xno" ; then
 877                 AC_MSG_ERROR([*** zlib is required ***])
 878           elif test "x$withval" != "xyes"; then
 879                 if test -d "$withval/lib"; then
 880                         if test -n "${need_dash_r}"; then
 881                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 882                         else
 883                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 884                         fi
 885                 else
 886                         if test -n "${need_dash_r}"; then
 887                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 888                         else
 889                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 890                         fi
 891                 fi
 892                 if test -d "$withval/include"; then
 893                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 894                 else
 895                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 896                 fi
 897         fi ]
 898 )
 899
 900 AC_CHECK_LIB(z, deflate, ,
 901         [
 902                 saved_CPPFLAGS="$CPPFLAGS"
 903                 saved_LDFLAGS="$LDFLAGS"
 904                 save_LIBS="$LIBS"
 905                 dnl Check default zlib install dir
 906                 if test -n "${need_dash_r}"; then
 907                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 908                 else
 909                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 910                 fi
 911                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 912                 LIBS="$LIBS -lz"
 913                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 914                         [
 915                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
 916                         ]
 917                 )
 918         ]
 919 )
 920 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 921
 922 AC_ARG_WITH(zlib-version-check,
 923         [  --without-zlib-version-check Disable zlib version check],
 924         [  if test "x$withval" = "xno" ; then
 925                 zlib_check_nonfatal=1
 926            fi
 927         ]
 928 )
 929
 930 AC_MSG_CHECKING(for possibly buggy zlib)
 931 AC_RUN_IFELSE([AC_LANG_SOURCE([[
 932 #include <stdio.h>
 933 #include <zlib.h>
 934 int main()
 935 {
 936         int a=0, b=0, c=0, d=0, n, v;
 937         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
 938         if (n != 3 && n != 4)
 939                 exit(1);
 940         v = a*1000000 + b*10000 + c*100 + d;
 941         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
 942
 943         /* 1.1.4 is OK */
 944         if (a == 1 && b == 1 && c >= 4)
 945                 exit(0);
 946
 947         /* 1.2.3 and up are OK */
 948         if (v >= 1020300)
 949                 exit(0);
 950
 951         exit(2);
 952 }
 953         ]])],
 954         AC_MSG_RESULT(no),
 955         [ AC_MSG_RESULT(yes)
 956           if test -z "$zlib_check_nonfatal" ; then
 957                 AC_MSG_ERROR([*** zlib too old - check config.log ***
 958 Your reported zlib version has known security problems.  It's possible your
 959 vendor has fixed these problems without changing the version number.  If you
 960 are sure this is the case, you can disable the check by running
 961 "./configure --without-zlib-version-check".
 962 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
 963 See http://www.gzip.org/zlib/ for details.])
 964           else
 965                 AC_MSG_WARN([zlib version may have security problems])
 966           fi
 967         ],
 968         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
 969 )
 970
 971 dnl UnixWare 2.x
 972 AC_CHECK_FUNC(strcasecmp,
 973         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
 974 )
 975 AC_CHECK_FUNCS(utimes,
 976         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
 977                                         LIBS="$LIBS -lc89"]) ]
 978 )
 979
 980 dnl    Checks for libutil functions
 981 AC_CHECK_HEADERS(libutil.h)
 982 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
 983         [Define if your libraries define login()])])
 984 AC_CHECK_FUNCS(logout updwtmp logwtmp)
 985
 986 AC_FUNC_STRFTIME
 987
 988 # Check for ALTDIRFUNC glob() extension
 989 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
 990 AC_EGREP_CPP(FOUNDIT,
 991         [
 992                 #include <glob.h>
 993                 #ifdef GLOB_ALTDIRFUNC
 994                 FOUNDIT
 995                 #endif
 996         ],
 997         [
 998                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
 999                         [Define if your system glob() function has
1000                         the GLOB_ALTDIRFUNC extension])
1001                 AC_MSG_RESULT(yes)
1002         ],
1003         [
1004                 AC_MSG_RESULT(no)
1005         ]
1006 )
1007
1008 # Check for g.gl_matchc glob() extension
1009 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1010 AC_TRY_COMPILE(
1011         [ #include <glob.h> ],
1012         [glob_t g; g.gl_matchc = 1;],
1013         [
1014                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1015                         [Define if your system glob() function has
1016                         gl_matchc options in glob_t])
1017                 AC_MSG_RESULT(yes)
1018         ],
1019         [
1020                 AC_MSG_RESULT(no)
1021         ]
1022 )
1023
1024 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1025
1026 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1027 AC_RUN_IFELSE(
1028         [AC_LANG_SOURCE([[
1029 #include <sys/types.h>
1030 #include <dirent.h>
1031 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1032         ]])],
1033         [AC_MSG_RESULT(yes)],
1034         [
1035                 AC_MSG_RESULT(no)
1036                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1037                         [Define if your struct dirent expects you to
1038                         allocate extra space for d_name])
1039         ],
1040         [
1041                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1042                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1043         ]
1044 )
1045
1046 # Check whether the user wants GSSAPI mechglue support
1047 AC_ARG_WITH(mechglue,
1048         [  --with-mechglue=PATH    Build with GSSAPI mechglue library],
1049         [
1050                 AC_MSG_CHECKING(for mechglue library)
1051
1052                 if test -e ${withval}/libgssapi.a ; then
1053                     mechglue_lib=${withval}/libgssapi.a
1054                 elif test -e ${withval}/lib/libgssapi.a ; then
1055                     mechglue_lib=${withval}/lib/libgssapi.a
1056                 else
1057                     AC_MSG_ERROR("Can't find libgssapi in ${withval}");
1058                 fi
1059                 LIBS="$LIBS ${mechglue_lib}"
1060                 AC_MSG_RESULT(${mechglue_lib})
1061
1062                 AC_CHECK_LIB(dl, dlopen, , )
1063                 if test $ac_cv_lib_dl_dlopen = yes; then
1064                    LDFLAGS="$LDFLAGS -ldl -Wl,-Bsymbolic"
1065                 fi
1066
1067                 AC_DEFINE(GSSAPI)
1068                 AC_DEFINE(MECHGLUE, 1, [Define this if you're building with GSSAPI MechGlue.])
1069                 GSSAPI="mechglue"
1070
1071         ]
1072 )
1073
1074
1075 # Check whether the user wants GSI (Globus) support
1076 gsi_path="no"
1077 AC_ARG_WITH(gsi,
1078         [  --with-gsi              Enable Globus GSI authentication support],
1079         [
1080                 gsi_path="$withval"
1081         ]
1082 )
1083
1084 AC_ARG_WITH(globus,
1085         [  --with-globus           Enable Globus GSI authentication support],
1086         [
1087                 gsi_path="$withval"
1088         ]
1089 )
1090
1091 AC_ARG_WITH(globus-static,
1092         [  --with-globus-static    Link statically with Globus GSI libraries],
1093         [
1094                 gsi_static="-static"
1095                 if test "x$gsi_path" = "xno" ; then
1096                         gsi_path="$withval"
1097                 fi
1098         ]
1099 )
1100
1101 # Check whether the user has a Globus flavor type
1102 globus_flavor_type="no"
1103 AC_ARG_WITH(globus-flavor,
1104         [  --with-globus-flavor=TYPE  Specify Globus flavor type (ex: gcc32dbg)],
1105         [
1106                 globus_flavor_type="$withval"
1107                 if test "x$gsi_path" = "xno" ; then
1108                         gsi_path="yes"
1109                 fi
1110         ]
1111 )
1112
1113 if test "x$gsi_path" != "xno" ; then
1114         # Globus GSSAPI configuration
1115         AC_MSG_CHECKING(for Globus GSI)
1116         AC_DEFINE(GSI, 1, [Define if you want GSI/Globus authentication support.])
1117
1118         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
1119                 AC_MSG_ERROR([Previously configured GSSAPI library conflicts with Globus GSI.])
1120         fi
1121         if test -z "$GSSAPI"; then
1122                 AC_DEFINE(GSSAPI)
1123                 GSSAPI="GSI"
1124         fi
1125
1126         if test "x$gsi_path" = "xyes" ; then
1127                 if test -z "$GLOBUS_LOCATION" ; then
1128                         AC_MSG_ERROR(GLOBUS_LOCATION environment variable must be set.)
1129                 else
1130                         gsi_path="$GLOBUS_LOCATION"
1131                 fi
1132         fi
1133         GLOBUS_LOCATION="$gsi_path"
1134         export GLOBUS_LOCATION
1135         if test ! -d "$GLOBUS_LOCATION" ; then
1136                 AC_MSG_ERROR(Cannot find Globus installation.  Set GLOBUS_LOCATION environment variable.)
1137         fi
1138
1139         if test "x$globus_flavor_type" = "xno" ; then
1140                 AC_MSG_ERROR(--with-globus-flavor=TYPE must be specified)
1141         fi
1142         if test "x$globus_flavor_type" = "xyes" ; then
1143                 AC_MSG_ERROR(--with-globus-flavor=TYPE must specify a flavor type)
1144         fi
1145
1146         GLOBUS_INCLUDE="${gsi_path}/include/${globus_flavor_type}"
1147         if test ! -d "$GLOBUS_INCLUDE" ; then
1148                 AC_MSG_ERROR(Cannot find Globus flavor-specific include directory: ${GLOBUS_INCLUDE})
1149         fi
1150         GSI_CPPFLAGS="-I${GLOBUS_INCLUDE}"
1151
1152         if test -x ${gsi_path}/bin/globus-makefile-header ; then
1153                 GSI_LIBS=`${gsi_path}/bin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | perl -n -e 'if (/GLOBUS_PKG_LIBS = (.*)/){print $1;}'`
1154         elif test -x ${gsi_path}/sbin/globus-makefile-header ; then
1155                 GSI_LIBS=`${gsi_path}/sbin/globus-makefile-header --flavor=${globus_flavor_type} ${gsi_static} globus_gss_assist | perl -n -e 'if (/GLOBUS_PKG_LIBS = (.*)/){print $1;}'`
1156         else
1157                 AC_MSG_ERROR(Cannot find globus-makefile-header: Globus installation is incomplete)
1158         fi
1159         if test -n "${need_dash_r}"; then
1160                 GSI_LDFLAGS="-L${gsi_path}/lib -R{gsi_path}/lib"
1161         else
1162                 GSI_LDFLAGS="-L${gsi_path}/lib"
1163         fi
1164         if test -z "$GSI_LIBS" ; then
1165                 AC_MSG_ERROR(globus-makefile-header failed)
1166         fi
1167
1168         AC_DEFINE(HAVE_GSSAPI_H)
1169
1170         LIBS="$LIBS $GSI_LIBS"
1171         LDFLAGS="$LDFLAGS $GSI_LDFLAGS"
1172         CPPFLAGS="$CPPFLAGS $GSI_CPPFLAGS"
1173
1174         # test that we got the libraries OK
1175         AC_TRY_LINK(
1176                 [],
1177                 [],
1178                 [
1179                         AC_MSG_RESULT(yes)
1180                 ],
1181                 [
1182                         AC_MSG_ERROR(link with Globus libraries failed)
1183                 ]
1184         )
1185     AC_CHECK_FUNCS(globus_gss_assist_map_and_authorize)
1186         INSTALL_GSISSH="yes"
1187 else
1188         INSTALL_GSISSH=""
1189 fi
1190 AC_SUBST(INSTALL_GSISSH)
1191 # End Globus/GSI section
1192
1193 AC_MSG_CHECKING([for /proc/pid/fd directory])
1194 if test -d "/proc/$$/fd" ; then
1195         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1196         AC_MSG_RESULT(yes)
1197 else
1198         AC_MSG_RESULT(no)
1199 fi
1200
1201 # Check whether user wants S/Key support
1202 SKEY_MSG="no"
1203 AC_ARG_WITH(skey,
1204         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1205         [
1206                 if test "x$withval" != "xno" ; then
1207
1208                         if test "x$withval" != "xyes" ; then
1209                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1210                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1211                         fi
1212
1213                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1214                         LIBS="-lskey $LIBS"
1215                         SKEY_MSG="yes"
1216
1217                         AC_MSG_CHECKING([for s/key support])
1218                         AC_LINK_IFELSE(
1219                                 [AC_LANG_SOURCE([[
1220 #include <stdio.h>
1221 #include <skey.h>
1222 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1223                                 ]])],
1224                                 [AC_MSG_RESULT(yes)],
1225                                 [
1226                                         AC_MSG_RESULT(no)
1227                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1228                                 ])
1229                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1230                         AC_TRY_COMPILE(
1231                                 [#include <stdio.h>
1232                                  #include <skey.h>],
1233                                 [(void)skeychallenge(NULL,"name","",0);],
1234                                 [AC_MSG_RESULT(yes)
1235                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1236                                         [Define if your skeychallenge()
1237                                         function takes 4 arguments (NetBSD)])],
1238                                 [AC_MSG_RESULT(no)]
1239                         )
1240                 fi
1241         ]
1242 )
1243
1244 # Check whether user wants TCP wrappers support
1245 TCPW_MSG="no"
1246 AC_ARG_WITH(tcp-wrappers,
1247         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1248         [
1249                 if test "x$withval" != "xno" ; then
1250                         saved_LIBS="$LIBS"
1251                         saved_LDFLAGS="$LDFLAGS"
1252                         saved_CPPFLAGS="$CPPFLAGS"
1253                         if test -n "${withval}" && \
1254                             test "x${withval}" != "xyes"; then
1255                                 if test -d "${withval}/lib"; then
1256                                         if test -n "${need_dash_r}"; then
1257                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1258                                         else
1259                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1260                                         fi
1261                                 else
1262                                         if test -n "${need_dash_r}"; then
1263                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1264                                         else
1265                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1266                                         fi
1267                                 fi
1268                                 if test -d "${withval}/include"; then
1269                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1270                                 else
1271                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1272                                 fi
1273                         fi
1274                         LIBWRAP="-lwrap"
1275                         LIBS="$LIBWRAP $LIBS"
1276                         AC_MSG_CHECKING(for libwrap)
1277                         AC_TRY_LINK(
1278                                 [
1279 #include <sys/types.h>
1280 #include <sys/socket.h>
1281 #include <netinet/in.h>
1282 #include <tcpd.h>
1283                                         int deny_severity = 0, allow_severity = 0;
1284                                 ],
1285                                 [hosts_access(0);],
1286                                 [
1287                                         AC_MSG_RESULT(yes)
1288                                         AC_DEFINE(LIBWRAP, 1,
1289                                                 [Define if you want
1290                                                 TCP Wrappers support])
1291                                         AC_SUBST(LIBWRAP)
1292                                         TCPW_MSG="yes"
1293                                 ],
1294                                 [
1295                                         AC_MSG_ERROR([*** libwrap missing])
1296                                 ]
1297                         )
1298                         LIBS="$saved_LIBS"
1299                 fi
1300         ]
1301 )
1302
1303 # Check whether user wants libedit support
1304 LIBEDIT_MSG="no"
1305 AC_ARG_WITH(libedit,
1306         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1307         [ if test "x$withval" != "xno" ; then
1308                 if test "x$withval" != "xyes"; then
1309                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1310                         if test -n "${need_dash_r}"; then
1311                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1312                         else
1313                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1314                         fi
1315                 fi
1316                 AC_CHECK_LIB(edit, el_init,
1317                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1318                           LIBEDIT="-ledit -lcurses"
1319                           LIBEDIT_MSG="yes"
1320                           AC_SUBST(LIBEDIT)
1321                         ],
1322                         [ AC_MSG_ERROR(libedit not found) ],
1323                         [ -lcurses ]
1324                 )
1325                 AC_MSG_CHECKING(if libedit version is compatible)
1326                 AC_COMPILE_IFELSE(
1327                     [AC_LANG_SOURCE([[
1328 #include <histedit.h>
1329 int main(void)
1330 {
1331         int i = H_SETSIZE;
1332         el_init("", NULL, NULL, NULL);
1333         exit(0);
1334 }
1335                     ]])],
1336                     [ AC_MSG_RESULT(yes) ],
1337                     [ AC_MSG_RESULT(no)
1338                       AC_MSG_ERROR(libedit version is not compatible) ]
1339                 )
1340         fi ]
1341 )
1342
1343 AUDIT_MODULE=none
1344 AC_ARG_WITH(audit,
1345         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1346         [
1347           AC_MSG_CHECKING(for supported audit module)
1348           case "$withval" in
1349           bsm)
1350                 AC_MSG_RESULT(bsm)
1351                 AUDIT_MODULE=bsm
1352                 dnl    Checks for headers, libs and functions
1353                 AC_CHECK_HEADERS(bsm/audit.h, [],
1354                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1355                     [
1356 #ifdef HAVE_TIME_H
1357 # include <time.h>
1358 #endif
1359                     ]
1360 )
1361                 AC_CHECK_LIB(bsm, getaudit, [],
1362                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1363                 AC_CHECK_FUNCS(getaudit, [],
1364                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1365                 # These are optional
1366                 AC_CHECK_FUNCS(getaudit_addr)
1367                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1368                 ;;
1369           debug)
1370                 AUDIT_MODULE=debug
1371                 AC_MSG_RESULT(debug)
1372                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1373                 ;;
1374           no)
1375                 AC_MSG_RESULT(no)
1376                 ;;
1377           *)
1378                 AC_MSG_ERROR([Unknown audit module $withval])
1379                 ;;
1380         esac ]
1381 )
1382
1383 dnl    Checks for library functions. Please keep in alphabetical order
1384 AC_CHECK_FUNCS( \
1385         arc4random \
1386         asprintf \
1387         b64_ntop \
1388         __b64_ntop \
1389         b64_pton \
1390         __b64_pton \
1391         bcopy \
1392         bindresvport_sa \
1393         clock \
1394         closefrom \
1395         dirfd \
1396         fchmod \
1397         fchown \
1398         freeaddrinfo \
1399         futimes \
1400         getaddrinfo \
1401         getcwd \
1402         getgrouplist \
1403         getnameinfo \
1404         getopt \
1405         getpeereid \
1406         _getpty \
1407         getrlimit \
1408         getttyent \
1409         glob \
1410         inet_aton \
1411         inet_ntoa \
1412         inet_ntop \
1413         innetgr \
1414         login_getcapbool \
1415         md5_crypt \
1416         memmove \
1417         mkdtemp \
1418         mmap \
1419         ngetaddrinfo \
1420         nsleep \
1421         ogetaddrinfo \
1422         openlog_r \
1423         openpty \
1424         prctl \
1425         pstat \
1426         readpassphrase \
1427         realpath \
1428         recvmsg \
1429         rresvport_af \
1430         sendmsg \
1431         setdtablesize \
1432         setegid \
1433         setenv \
1434         seteuid \
1435         setgroups \
1436         setlogin \
1437         setpcred \
1438         setproctitle \
1439         setregid \
1440         setreuid \
1441         setrlimit \
1442         setsid \
1443         setvbuf \
1444         sigaction \
1445         sigvec \
1446         snprintf \
1447         socketpair \
1448         strdup \
1449         strerror \
1450         strlcat \
1451         strlcpy \
1452         strmode \
1453         strnvis \
1454         strtonum \
1455         strtoll \
1456         strtoul \
1457         sysconf \
1458         tcgetpgrp \
1459         truncate \
1460         unsetenv \
1461         updwtmpx \
1462         vasprintf \
1463         vhangup \
1464         vsnprintf \
1465         waitpid \
1466 )
1467
1468 # IRIX has a const char return value for gai_strerror()
1469 AC_CHECK_FUNCS(gai_strerror,[
1470         AC_DEFINE(HAVE_GAI_STRERROR)
1471         AC_TRY_COMPILE([
1472 #include <sys/types.h>
1473 #include <sys/socket.h>
1474 #include <netdb.h>
1475
1476 const char *gai_strerror(int);],[
1477 char *str;
1478
1479 str = gai_strerror(0);],[
1480                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1481                 [Define if gai_strerror() returns const char *])])])
1482
1483 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1484         [Some systems put nanosleep outside of libc]))
1485
1486 dnl Make sure prototypes are defined for these before using them.
1487 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1488 AC_CHECK_DECL(strsep,
1489         [AC_CHECK_FUNCS(strsep)],
1490         [],
1491         [
1492 #ifdef HAVE_STRING_H
1493 # include <string.h>
1494 #endif
1495         ])
1496
1497 dnl tcsendbreak might be a macro
1498 AC_CHECK_DECL(tcsendbreak,
1499         [AC_DEFINE(HAVE_TCSENDBREAK)],
1500         [AC_CHECK_FUNCS(tcsendbreak)],
1501         [#include <termios.h>]
1502 )
1503
1504 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1505
1506 AC_CHECK_DECLS(SHUT_RD, , ,
1507         [
1508 #include <sys/types.h>
1509 #include <sys/socket.h>
1510         ])
1511
1512 AC_CHECK_DECLS(O_NONBLOCK, , ,
1513         [
1514 #include <sys/types.h>
1515 #ifdef HAVE_SYS_STAT_H
1516 # include <sys/stat.h>
1517 #endif
1518 #ifdef HAVE_FCNTL_H
1519 # include <fcntl.h>
1520 #endif
1521         ])
1522
1523 AC_CHECK_DECLS(writev, , , [
1524 #include <sys/types.h>
1525 #include <sys/uio.h>
1526 #include <unistd.h>
1527         ])
1528
1529 AC_CHECK_FUNCS(setresuid, [
1530         dnl Some platorms have setresuid that isn't implemented, test for this
1531         AC_MSG_CHECKING(if setresuid seems to work)
1532         AC_RUN_IFELSE(
1533                 [AC_LANG_SOURCE([[
1534 #include <stdlib.h>
1535 #include <errno.h>
1536 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1537                 ]])],
1538                 [AC_MSG_RESULT(yes)],
1539                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1540                         [Define if your setresuid() is broken])
1541                  AC_MSG_RESULT(not implemented)],
1542                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1543         )
1544 ])
1545
1546 AC_CHECK_FUNCS(setresgid, [
1547         dnl Some platorms have setresgid that isn't implemented, test for this
1548         AC_MSG_CHECKING(if setresgid seems to work)
1549         AC_RUN_IFELSE(
1550                 [AC_LANG_SOURCE([[
1551 #include <stdlib.h>
1552 #include <errno.h>
1553 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1554                 ]])],
1555                 [AC_MSG_RESULT(yes)],
1556                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1557                         [Define if your setresgid() is broken])
1558                  AC_MSG_RESULT(not implemented)],
1559                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1560         )
1561 ])
1562
1563 dnl    Checks for time functions
1564 AC_CHECK_FUNCS(gettimeofday time)
1565 dnl    Checks for utmp functions
1566 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1567 AC_CHECK_FUNCS(utmpname)
1568 dnl    Checks for utmpx functions
1569 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1570 AC_CHECK_FUNCS(setutxent utmpxname)
1571
1572 AC_CHECK_FUNC(daemon,
1573         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1574         [AC_CHECK_LIB(bsd, daemon,
1575                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1576 )
1577
1578 AC_CHECK_FUNC(getpagesize,
1579         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1580                 [Define if your libraries define getpagesize()])],
1581         [AC_CHECK_LIB(ucb, getpagesize,
1582                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1583 )
1584
1585 # Check for broken snprintf
1586 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1587         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1588         AC_RUN_IFELSE(
1589                 [AC_LANG_SOURCE([[
1590 #include <stdio.h>
1591 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1592                 ]])],
1593                 [AC_MSG_RESULT(yes)],
1594                 [
1595                         AC_MSG_RESULT(no)
1596                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1597                                 [Define if your snprintf is busted])
1598                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1599                 ],
1600                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1601         )
1602 fi
1603
1604 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1605 # returning the right thing on overflow: the number of characters it tried to
1606 # create (as per SUSv3)
1607 if test "x$ac_cv_func_asprintf" != "xyes" && \
1608    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1609         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1610         AC_RUN_IFELSE(
1611                 [AC_LANG_SOURCE([[
1612 #include <sys/types.h>
1613 #include <stdio.h>
1614 #include <stdarg.h>
1615
1616 int x_snprintf(char *str,size_t count,const char *fmt,...)
1617 {
1618         size_t ret; va_list ap;
1619         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1620         return ret;
1621 }
1622 int main(void)
1623 {
1624         char x[1];
1625         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1626 } ]])],
1627                 [AC_MSG_RESULT(yes)],
1628                 [
1629                         AC_MSG_RESULT(no)
1630                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1631                                 [Define if your snprintf is busted])
1632                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1633                 ],
1634                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1635         )
1636 fi
1637
1638 # On systems where [v]snprintf is broken, but is declared in stdio,
1639 # check that the fmt argument is const char * or just char *.
1640 # This is only useful for when BROKEN_SNPRINTF
1641 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1642 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1643            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1644            int main(void) { snprintf(0, 0, 0); }
1645     ]])],
1646    [AC_MSG_RESULT(yes)
1647     AC_DEFINE(SNPRINTF_CONST, [const],
1648               [Define as const if snprintf() can declare const char *fmt])],
1649    [AC_MSG_RESULT(no)
1650     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1651
1652 # Check for missing getpeereid (or equiv) support
1653 NO_PEERCHECK=""
1654 if test "x$ac_cv_func_getpeereid" != "xyes" ; then
1655         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1656         AC_TRY_COMPILE(
1657                 [#include <sys/types.h>
1658                  #include <sys/socket.h>],
1659                 [int i = SO_PEERCRED;],
1660                 [ AC_MSG_RESULT(yes)
1661                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1662                 ],
1663                 [AC_MSG_RESULT(no)
1664                 NO_PEERCHECK=1]
1665         )
1666 fi
1667
1668 dnl see whether mkstemp() requires XXXXXX
1669 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1670 AC_MSG_CHECKING([for (overly) strict mkstemp])
1671 AC_RUN_IFELSE(
1672         [AC_LANG_SOURCE([[
1673 #include <stdlib.h>
1674 main() { char template[]="conftest.mkstemp-test";
1675 if (mkstemp(template) == -1)
1676         exit(1);
1677 unlink(template); exit(0);
1678 }
1679         ]])],
1680         [
1681                 AC_MSG_RESULT(no)
1682         ],
1683         [
1684                 AC_MSG_RESULT(yes)
1685                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1686         ],
1687         [
1688                 AC_MSG_RESULT(yes)
1689                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1690         ]
1691 )
1692 fi
1693
1694 dnl make sure that openpty does not reacquire controlling terminal
1695 if test ! -z "$check_for_openpty_ctty_bug"; then
1696         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1697         AC_RUN_IFELSE(
1698                 [AC_LANG_SOURCE([[
1699 #include <stdio.h>
1700 #include <sys/fcntl.h>
1701 #include <sys/types.h>
1702 #include <sys/wait.h>
1703
1704 int
1705 main()
1706 {
1707         pid_t pid;
1708         int fd, ptyfd, ttyfd, status;
1709
1710         pid = fork();
1711         if (pid < 0) {          /* failed */
1712                 exit(1);
1713         } else if (pid > 0) {   /* parent */
1714                 waitpid(pid, &status, 0);
1715                 if (WIFEXITED(status))
1716                         exit(WEXITSTATUS(status));
1717                 else
1718                         exit(2);
1719         } else {                /* child */
1720                 close(0); close(1); close(2);
1721                 setsid();
1722                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1723                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1724                 if (fd >= 0)
1725                         exit(3);        /* Acquired ctty: broken */
1726                 else
1727                         exit(0);        /* Did not acquire ctty: OK */
1728         }
1729 }
1730                 ]])],
1731                 [
1732                         AC_MSG_RESULT(yes)
1733                 ],
1734                 [
1735                         AC_MSG_RESULT(no)
1736                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1737                 ],
1738                 [
1739                         AC_MSG_RESULT(cross-compiling, assuming yes)
1740                 ]
1741         )
1742 fi
1743
1744 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1745     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1746         AC_MSG_CHECKING(if getaddrinfo seems to work)
1747         AC_RUN_IFELSE(
1748                 [AC_LANG_SOURCE([[
1749 #include <stdio.h>
1750 #include <sys/socket.h>
1751 #include <netdb.h>
1752 #include <errno.h>
1753 #include <netinet/in.h>
1754
1755 #define TEST_PORT "2222"
1756
1757 int
1758 main(void)
1759 {
1760         int err, sock;
1761         struct addrinfo *gai_ai, *ai, hints;
1762         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1763
1764         memset(&hints, 0, sizeof(hints));
1765         hints.ai_family = PF_UNSPEC;
1766         hints.ai_socktype = SOCK_STREAM;
1767         hints.ai_flags = AI_PASSIVE;
1768
1769         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1770         if (err != 0) {
1771                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1772                 exit(1);
1773         }
1774
1775         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1776                 if (ai->ai_family != AF_INET6)
1777                         continue;
1778
1779                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1780                     sizeof(ntop), strport, sizeof(strport),
1781                     NI_NUMERICHOST|NI_NUMERICSERV);
1782
1783                 if (err != 0) {
1784                         if (err == EAI_SYSTEM)
1785                                 perror("getnameinfo EAI_SYSTEM");
1786                         else
1787                                 fprintf(stderr, "getnameinfo failed: %s\n",
1788                                     gai_strerror(err));
1789                         exit(2);
1790                 }
1791
1792                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1793                 if (sock < 0)
1794                         perror("socket");
1795                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1796                         if (errno == EBADF)
1797                                 exit(3);
1798                 }
1799         }
1800         exit(0);
1801 }
1802                 ]])],
1803                 [
1804                         AC_MSG_RESULT(yes)
1805                 ],
1806                 [
1807                         AC_MSG_RESULT(no)
1808                         AC_DEFINE(BROKEN_GETADDRINFO)
1809                 ],
1810                 [
1811                         AC_MSG_RESULT(cross-compiling, assuming yes)
1812                 ]
1813         )
1814 fi
1815
1816 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1817     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1818         AC_MSG_CHECKING(if getaddrinfo seems to work)
1819         AC_RUN_IFELSE(
1820                 [AC_LANG_SOURCE([[
1821 #include <stdio.h>
1822 #include <sys/socket.h>
1823 #include <netdb.h>
1824 #include <errno.h>
1825 #include <netinet/in.h>
1826
1827 #define TEST_PORT "2222"
1828
1829 int
1830 main(void)
1831 {
1832         int err, sock;
1833         struct addrinfo *gai_ai, *ai, hints;
1834         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1835
1836         memset(&hints, 0, sizeof(hints));
1837         hints.ai_family = PF_UNSPEC;
1838         hints.ai_socktype = SOCK_STREAM;
1839         hints.ai_flags = AI_PASSIVE;
1840
1841         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1842         if (err != 0) {
1843                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1844                 exit(1);
1845         }
1846
1847         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1848                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1849                         continue;
1850
1851                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1852                     sizeof(ntop), strport, sizeof(strport),
1853                     NI_NUMERICHOST|NI_NUMERICSERV);
1854
1855                 if (ai->ai_family == AF_INET && err != 0) {
1856                         perror("getnameinfo");
1857                         exit(2);
1858                 }
1859         }
1860         exit(0);
1861 }
1862                 ]])],
1863                 [
1864                         AC_MSG_RESULT(yes)
1865                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1866                                 [Define if you have a getaddrinfo that fails
1867                                 for the all-zeros IPv6 address])
1868                 ],
1869                 [
1870                         AC_MSG_RESULT(no)
1871                         AC_DEFINE(BROKEN_GETADDRINFO)
1872                 ],
1873                 [
1874                         AC_MSG_RESULT(cross-compiling, assuming no)
1875                 ]
1876         )
1877 fi
1878
1879 if test "x$check_for_conflicting_getspnam" = "x1"; then
1880         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1881         AC_COMPILE_IFELSE(
1882                 [
1883 #include <shadow.h>
1884 int main(void) {exit(0);}
1885                 ],
1886                 [
1887                         AC_MSG_RESULT(no)
1888                 ],
1889                 [
1890                         AC_MSG_RESULT(yes)
1891                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1892                             [Conflicting defs for getspnam])
1893                 ]
1894         )
1895 fi
1896
1897 AC_FUNC_GETPGRP
1898
1899 # Search for OpenSSL
1900 saved_CPPFLAGS="$CPPFLAGS"
1901 saved_LDFLAGS="$LDFLAGS"
1902 AC_ARG_WITH(ssl-dir,
1903         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1904         [
1905                 if test "x$withval" != "xno" ; then
1906                         case "$withval" in
1907                                 # Relative paths
1908                                 ./*|../*)       withval="`pwd`/$withval"
1909                         esac
1910                         if test -d "$withval/lib"; then
1911                                 if test -n "${need_dash_r}"; then
1912                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1913                                 else
1914                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1915                                 fi
1916                         else
1917                                 if test -n "${need_dash_r}"; then
1918                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1919                                 else
1920                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1921                                 fi
1922                         fi
1923                         if test -d "$withval/include"; then
1924                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1925                         else
1926                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1927                         fi
1928                 fi
1929         ]
1930 )
1931 if test -z "$GSI_LIBS" ; then
1932 LIBS="-lcrypto $LIBS"
1933 fi
1934 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1935         [Define if your ssl headers are included
1936         with #include <openssl/header.h>]),
1937         [
1938                 dnl Check default openssl install dir
1939                 if test -n "${need_dash_r}"; then
1940                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1941                 else
1942                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1943                 fi
1944                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1945                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1946                         [
1947                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
1948                         ]
1949                 )
1950         ]
1951 )
1952
1953 # Determine OpenSSL header version
1954 AC_MSG_CHECKING([OpenSSL header version])
1955 AC_RUN_IFELSE(
1956         [AC_LANG_SOURCE([[
1957 #include <stdio.h>
1958 #include <string.h>
1959 #include <openssl/opensslv.h>
1960 #define DATA "conftest.sslincver"
1961 int main(void) {
1962         FILE *fd;
1963         int rc;
1964
1965         fd = fopen(DATA,"w");
1966         if(fd == NULL)
1967                 exit(1);
1968
1969         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
1970                 exit(1);
1971
1972         exit(0);
1973 }
1974         ]])],
1975         [
1976                 ssl_header_ver=`cat conftest.sslincver`
1977                 AC_MSG_RESULT($ssl_header_ver)
1978         ],
1979         [
1980                 AC_MSG_RESULT(not found)
1981                 AC_MSG_ERROR(OpenSSL version header not found.)
1982         ],
1983         [
1984                 AC_MSG_WARN([cross compiling: not checking])
1985         ]
1986 )
1987
1988 # Determine OpenSSL library version
1989 AC_MSG_CHECKING([OpenSSL library version])
1990 AC_RUN_IFELSE(
1991         [AC_LANG_SOURCE([[
1992 #include <stdio.h>
1993 #include <string.h>
1994 #include <openssl/opensslv.h>
1995 #include <openssl/crypto.h>
1996 #define DATA "conftest.ssllibver"
1997 int main(void) {
1998         FILE *fd;
1999         int rc;
2000
2001         fd = fopen(DATA,"w");
2002         if(fd == NULL)
2003                 exit(1);
2004
2005         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
2006                 exit(1);
2007
2008         exit(0);
2009 }
2010         ]])],
2011         [
2012                 ssl_library_ver=`cat conftest.ssllibver`
2013                 AC_MSG_RESULT($ssl_library_ver)
2014         ],
2015         [
2016                 AC_MSG_RESULT(not found)
2017                 AC_MSG_ERROR(OpenSSL library not found.)
2018         ],
2019         [
2020                 AC_MSG_WARN([cross compiling: not checking])
2021         ]
2022 )
2023
2024 # Sanity check OpenSSL headers
2025 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
2026 AC_RUN_IFELSE(
2027         [AC_LANG_SOURCE([[
2028 #include <string.h>
2029 #include <openssl/opensslv.h>
2030 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
2031         ]])],
2032         [
2033                 AC_MSG_RESULT(yes)
2034         ],
2035         [
2036                 AC_MSG_RESULT(no)
2037                 AC_MSG_ERROR([Your OpenSSL headers do not match your library.
2038 Check config.log for details.
2039 Also see contrib/findssl.sh for help identifying header/library mismatches.])
2040         ],
2041         [
2042                 AC_MSG_WARN([cross compiling: not checking])
2043         ]
2044 )
2045
2046 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2047 AC_LINK_IFELSE(
2048         [AC_LANG_SOURCE([[
2049 #include <openssl/evp.h>
2050 int main(void) { SSLeay_add_all_algorithms(); }
2051         ]])],
2052         [
2053                 AC_MSG_RESULT(yes)
2054         ],
2055         [
2056                 AC_MSG_RESULT(no)
2057                 saved_LIBS="$LIBS"
2058                 LIBS="$LIBS -ldl"
2059                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2060                 AC_LINK_IFELSE(
2061                         [AC_LANG_SOURCE([[
2062 #include <openssl/evp.h>
2063 int main(void) { SSLeay_add_all_algorithms(); }
2064                         ]])],
2065                         [
2066                                 AC_MSG_RESULT(yes)
2067                         ],
2068                         [
2069                                 AC_MSG_RESULT(no)
2070                                 LIBS="$saved_LIBS"
2071                         ]
2072                 )
2073         ]
2074 )
2075
2076 AC_ARG_WITH(ssl-engine,
2077         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2078         [ if test "x$withval" != "xno" ; then
2079                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
2080                 AC_TRY_COMPILE(
2081                         [ #include <openssl/engine.h>],
2082                         [
2083 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
2084                         ],
2085                         [ AC_MSG_RESULT(yes)
2086                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
2087                              [Enable OpenSSL engine support])
2088                         ],
2089                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
2090                 )
2091           fi ]
2092 )
2093
2094 # Check for OpenSSL without EVP_aes_{192,256}_cbc
2095 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2096 AC_LINK_IFELSE(
2097         [AC_LANG_SOURCE([[
2098 #include <string.h>
2099 #include <openssl/evp.h>
2100 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
2101         ]])],
2102         [
2103                 AC_MSG_RESULT(no)
2104         ],
2105         [
2106                 AC_MSG_RESULT(yes)
2107                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2108                     [libcrypto is missing AES 192 and 256 bit functions])
2109         ]
2110 )
2111
2112 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2113 # because the system crypt() is more featureful.
2114 if test "x$check_for_libcrypt_before" = "x1"; then
2115         AC_CHECK_LIB(crypt, crypt)
2116 fi
2117
2118 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2119 # version in OpenSSL.
2120 if test "x$check_for_libcrypt_later" = "x1"; then
2121         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2122 fi
2123
2124 # Search for SHA256 support in libc and/or OpenSSL
2125 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2126
2127 AC_CHECK_LIB(iaf, ia_openinfo)
2128
2129 ### Configure cryptographic random number support
2130
2131 # Check wheter OpenSSL seeds itself
2132 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2133 AC_RUN_IFELSE(
2134         [AC_LANG_SOURCE([[
2135 #include <string.h>
2136 #include <openssl/rand.h>
2137 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2138         ]])],
2139         [
2140                 OPENSSL_SEEDS_ITSELF=yes
2141                 AC_MSG_RESULT(yes)
2142         ],
2143         [
2144                 AC_MSG_RESULT(no)
2145                 # Default to use of the rand helper if OpenSSL doesn't
2146                 # seed itself
2147                 USE_RAND_HELPER=yes
2148         ],
2149         [
2150                 AC_MSG_WARN([cross compiling: assuming yes])
2151                 # This is safe, since all recent OpenSSL versions will
2152                 # complain at runtime if not seeded correctly.
2153                 OPENSSL_SEEDS_ITSELF=yes
2154         ]
2155 )
2156
2157 # Check for PAM libs
2158 PAM_MSG="no"
2159 AC_ARG_WITH(pam,
2160         [  --with-pam              Enable PAM support ],
2161         [
2162                 if test "x$withval" != "xno" ; then
2163                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2164                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2165                                 AC_MSG_ERROR([PAM headers not found])
2166                         fi
2167
2168                         saved_LIBS="$LIBS"
2169                         AC_CHECK_LIB(dl, dlopen, , )
2170                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2171                         AC_CHECK_FUNCS(pam_getenvlist)
2172                         AC_CHECK_FUNCS(pam_putenv)
2173                         LIBS="$saved_LIBS"
2174
2175                         PAM_MSG="yes"
2176
2177                         LIBPAM="-lpam"
2178                         AC_DEFINE(USE_PAM, 1,
2179                                 [Define if you want to enable PAM support])
2180
2181                         if test $ac_cv_lib_dl_dlopen = yes; then
2182                                 case "$LIBS" in
2183                                 *-ldl*)
2184                                         # libdl already in LIBS
2185                                         ;;
2186                                 *)
2187                                         LIBPAM="$LIBPAM -ldl"
2188                                         ;;
2189                                 esac
2190                         fi
2191                         AC_SUBST(LIBPAM)
2192                 fi
2193         ]
2194 )
2195
2196 # Check for older PAM
2197 if test "x$PAM_MSG" = "xyes" ; then
2198         # Check PAM strerror arguments (old PAM)
2199         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2200         AC_TRY_COMPILE(
2201                 [
2202 #include <stdlib.h>
2203 #if defined(HAVE_SECURITY_PAM_APPL_H)
2204 #include <security/pam_appl.h>
2205 #elif defined (HAVE_PAM_PAM_APPL_H)
2206 #include <pam/pam_appl.h>
2207 #endif
2208                 ],
2209                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2210                 [AC_MSG_RESULT(no)],
2211                 [
2212                         AC_DEFINE(HAVE_OLD_PAM, 1,
2213                                 [Define if you have an old version of PAM
2214                                 which takes only one argument to pam_strerror])
2215                         AC_MSG_RESULT(yes)
2216                         PAM_MSG="yes (old library)"
2217                 ]
2218         )
2219 fi
2220
2221 # Do we want to force the use of the rand helper?
2222 AC_ARG_WITH(rand-helper,
2223         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2224         [
2225                 if test "x$withval" = "xno" ; then
2226                         # Force use of OpenSSL's internal RNG, even if
2227                         # the previous test showed it to be unseeded.
2228                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2229                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2230                                 OPENSSL_SEEDS_ITSELF=yes
2231                                 USE_RAND_HELPER=""
2232                         fi
2233                 else
2234                         USE_RAND_HELPER=yes
2235                 fi
2236         ],
2237 )
2238
2239 # Which randomness source do we use?
2240 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2241         # OpenSSL only
2242         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2243                 [Define if you want OpenSSL's internally seeded PRNG only])
2244         RAND_MSG="OpenSSL internal ONLY"
2245         INSTALL_SSH_RAND_HELPER=""
2246 elif test ! -z "$USE_RAND_HELPER" ; then
2247         # install rand helper
2248         RAND_MSG="ssh-rand-helper"
2249         INSTALL_SSH_RAND_HELPER="yes"
2250 fi
2251 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2252
2253 ### Configuration of ssh-rand-helper
2254
2255 # PRNGD TCP socket
2256 AC_ARG_WITH(prngd-port,
2257         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2258         [
2259                 case "$withval" in
2260                 no)
2261                         withval=""
2262                         ;;
2263                 [[0-9]]*)
2264                         ;;
2265                 *)
2266                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2267                         ;;
2268                 esac
2269                 if test ! -z "$withval" ; then
2270                         PRNGD_PORT="$withval"
2271                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2272                                 [Port number of PRNGD/EGD random number socket])
2273                 fi
2274         ]
2275 )
2276
2277 # PRNGD Unix domain socket
2278 AC_ARG_WITH(prngd-socket,
2279         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2280         [
2281                 case "$withval" in
2282                 yes)
2283                         withval="/var/run/egd-pool"
2284                         ;;
2285                 no)
2286                         withval=""
2287                         ;;
2288                 /*)
2289                         ;;
2290                 *)
2291                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2292                         ;;
2293                 esac
2294
2295                 if test ! -z "$withval" ; then
2296                         if test ! -z "$PRNGD_PORT" ; then
2297                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2298                         fi
2299                         if test ! -r "$withval" ; then
2300                                 AC_MSG_WARN(Entropy socket is not readable)
2301                         fi
2302                         PRNGD_SOCKET="$withval"
2303                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2304                                 [Location of PRNGD/EGD random number socket])
2305                 fi
2306         ],
2307         [
2308                 # Check for existing socket only if we don't have a random device already
2309                 if test "$USE_RAND_HELPER" = yes ; then
2310                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2311                         # Insert other locations here
2312                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2313                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2314                                         PRNGD_SOCKET="$sock"
2315                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2316                                         break;
2317                                 fi
2318                         done
2319                         if test ! -z "$PRNGD_SOCKET" ; then
2320                                 AC_MSG_RESULT($PRNGD_SOCKET)
2321                         else
2322                                 AC_MSG_RESULT(not found)
2323                         fi
2324                 fi
2325         ]
2326 )
2327
2328 # Change default command timeout for hashing entropy source
2329 entropy_timeout=200
2330 AC_ARG_WITH(entropy-timeout,
2331         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2332         [
2333                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2334                     test "x${withval}" != "xyes"; then
2335                         entropy_timeout=$withval
2336                 fi
2337         ]
2338 )
2339 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2340         [Builtin PRNG command timeout])
2341
2342 SSH_PRIVSEP_USER=sshd
2343 AC_ARG_WITH(privsep-user,
2344         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2345         [
2346                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2347                     test "x${withval}" != "xyes"; then
2348                         SSH_PRIVSEP_USER=$withval
2349                 fi
2350         ]
2351 )
2352 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2353         [non-privileged user for privilege separation])
2354 AC_SUBST(SSH_PRIVSEP_USER)
2355
2356 # We do this little dance with the search path to insure
2357 # that programs that we select for use by installed programs
2358 # (which may be run by the super-user) come from trusted
2359 # locations before they come from the user's private area.
2360 # This should help avoid accidentally configuring some
2361 # random version of a program in someone's personal bin.
2362
2363 OPATH=$PATH
2364 PATH=/bin:/usr/bin
2365 test -h /bin 2> /dev/null && PATH=/usr/bin
2366 test -d /sbin && PATH=$PATH:/sbin
2367 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2368 PATH=$PATH:/etc:$OPATH
2369
2370 # These programs are used by the command hashing source to gather entropy
2371 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2372 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2373 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2374 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2375 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2376 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2377 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2378 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2379 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2380 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2381 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2382 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2383 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2384 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2385 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2386 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2387 # restore PATH
2388 PATH=$OPATH
2389
2390 # Where does ssh-rand-helper get its randomness from?
2391 INSTALL_SSH_PRNG_CMDS=""
2392 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2393         if test ! -z "$PRNGD_PORT" ; then
2394                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2395         elif test ! -z "$PRNGD_SOCKET" ; then
2396                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2397         else
2398                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2399                 RAND_HELPER_CMDHASH=yes
2400                 INSTALL_SSH_PRNG_CMDS="yes"
2401         fi
2402 fi
2403 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2404
2405
2406 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2407 if test ! -z "$SONY" ; then
2408   LIBS="$LIBS -liberty";
2409 fi
2410
2411 # Check for  long long datatypes
2412 AC_CHECK_TYPES([long long, unsigned long long, long double])
2413
2414 # Check datatype sizes
2415 AC_CHECK_SIZEOF(char, 1)
2416 AC_CHECK_SIZEOF(short int, 2)
2417 AC_CHECK_SIZEOF(int, 4)
2418 AC_CHECK_SIZEOF(long int, 4)
2419 AC_CHECK_SIZEOF(long long int, 8)
2420
2421 # Sanity check long long for some platforms (AIX)
2422 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2423         ac_cv_sizeof_long_long_int=0
2424 fi
2425
2426 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2427 if test -z "$have_llong_max"; then
2428         AC_MSG_CHECKING([for max value of long long])
2429         AC_RUN_IFELSE(
2430                 [AC_LANG_SOURCE([[
2431 #include <stdio.h>
2432 /* Why is this so damn hard? */
2433 #ifdef __GNUC__
2434 # undef __GNUC__
2435 #endif
2436 #define __USE_ISOC99
2437 #include <limits.h>
2438 #define DATA "conftest.llminmax"
2439 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2440
2441 /*
2442  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2443  * we do this the hard way.
2444  */
2445 static int
2446 fprint_ll(FILE *f, long long n)
2447 {
2448         unsigned int i;
2449         int l[sizeof(long long) * 8];
2450
2451         if (n < 0)
2452                 if (fprintf(f, "-") < 0)
2453                         return -1;
2454         for (i = 0; n != 0; i++) {
2455                 l[i] = my_abs(n % 10);
2456                 n /= 10;
2457         }
2458         do {
2459                 if (fprintf(f, "%d", l[--i]) < 0)
2460                         return -1;
2461         } while (i != 0);
2462         if (fprintf(f, " ") < 0)
2463                 return -1;
2464         return 0;
2465 }
2466
2467 int main(void) {
2468         FILE *f;
2469         long long i, llmin, llmax = 0;
2470
2471         if((f = fopen(DATA,"w")) == NULL)
2472                 exit(1);
2473
2474 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2475         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2476         llmin = LLONG_MIN;
2477         llmax = LLONG_MAX;
2478 #else
2479         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2480         /* This will work on one's complement and two's complement */
2481         for (i = 1; i > llmax; i <<= 1, i++)
2482                 llmax = i;
2483         llmin = llmax + 1LL;    /* wrap */
2484 #endif
2485
2486         /* Sanity check */
2487         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2488             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2489             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2490                 fprintf(f, "unknown unknown\n");
2491                 exit(2);
2492         }
2493
2494         if (fprint_ll(f, llmin) < 0)
2495                 exit(3);
2496         if (fprint_ll(f, llmax) < 0)
2497                 exit(4);
2498         if (fclose(f) < 0)
2499                 exit(5);
2500         exit(0);
2501 }
2502                 ]])],
2503                 [
2504                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2505                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2506
2507                         AC_MSG_RESULT($llong_max)
2508                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2509                             [max value of long long calculated by configure])
2510                         AC_MSG_CHECKING([for min value of long long])
2511                         AC_MSG_RESULT($llong_min)
2512                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2513                             [min value of long long calculated by configure])
2514                 ],
2515                 [
2516                         AC_MSG_RESULT(not found)
2517                 ],
2518                 [
2519                         AC_MSG_WARN([cross compiling: not checking])
2520                 ]
2521         )
2522 fi
2523
2524
2525 # More checks for data types
2526 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2527         AC_TRY_COMPILE(
2528                 [ #include <sys/types.h> ],
2529                 [ u_int a; a = 1;],
2530                 [ ac_cv_have_u_int="yes" ],
2531                 [ ac_cv_have_u_int="no" ]
2532         )
2533 ])
2534 if test "x$ac_cv_have_u_int" = "xyes" ; then
2535         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2536         have_u_int=1
2537 fi
2538
2539 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2540         AC_TRY_COMPILE(
2541                 [ #include <sys/types.h> ],
2542                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2543                 [ ac_cv_have_intxx_t="yes" ],
2544                 [ ac_cv_have_intxx_t="no" ]
2545         )
2546 ])
2547 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2548         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2549         have_intxx_t=1
2550 fi
2551
2552 if (test -z "$have_intxx_t" && \
2553            test "x$ac_cv_header_stdint_h" = "xyes")
2554 then
2555     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2556         AC_TRY_COMPILE(
2557                 [ #include <stdint.h> ],
2558                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2559                 [
2560                         AC_DEFINE(HAVE_INTXX_T)
2561                         AC_MSG_RESULT(yes)
2562                 ],
2563                 [ AC_MSG_RESULT(no) ]
2564         )
2565 fi
2566
2567 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2568         AC_TRY_COMPILE(
2569                 [
2570 #include <sys/types.h>
2571 #ifdef HAVE_STDINT_H
2572 # include <stdint.h>
2573 #endif
2574 #include <sys/socket.h>
2575 #ifdef HAVE_SYS_BITYPES_H
2576 # include <sys/bitypes.h>
2577 #endif
2578                 ],
2579                 [ int64_t a; a = 1;],
2580                 [ ac_cv_have_int64_t="yes" ],
2581                 [ ac_cv_have_int64_t="no" ]
2582         )
2583 ])
2584 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2585         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2586 fi
2587
2588 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2589         AC_TRY_COMPILE(
2590                 [ #include <sys/types.h> ],
2591                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2592                 [ ac_cv_have_u_intxx_t="yes" ],
2593                 [ ac_cv_have_u_intxx_t="no" ]
2594         )
2595 ])
2596 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2597         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2598         have_u_intxx_t=1
2599 fi
2600
2601 if test -z "$have_u_intxx_t" ; then
2602     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2603         AC_TRY_COMPILE(
2604                 [ #include <sys/socket.h> ],
2605                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2606                 [
2607                         AC_DEFINE(HAVE_U_INTXX_T)
2608                         AC_MSG_RESULT(yes)
2609                 ],
2610                 [ AC_MSG_RESULT(no) ]
2611         )
2612 fi
2613
2614 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2615         AC_TRY_COMPILE(
2616                 [ #include <sys/types.h> ],
2617                 [ u_int64_t a; a = 1;],
2618                 [ ac_cv_have_u_int64_t="yes" ],
2619                 [ ac_cv_have_u_int64_t="no" ]
2620         )
2621 ])
2622 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2623         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2624         have_u_int64_t=1
2625 fi
2626
2627 if test -z "$have_u_int64_t" ; then
2628     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2629         AC_TRY_COMPILE(
2630                 [ #include <sys/bitypes.h> ],
2631                 [ u_int64_t a; a = 1],
2632                 [
2633                         AC_DEFINE(HAVE_U_INT64_T)
2634                         AC_MSG_RESULT(yes)
2635                 ],
2636                 [ AC_MSG_RESULT(no) ]
2637         )
2638 fi
2639
2640 if test -z "$have_u_intxx_t" ; then
2641         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2642                 AC_TRY_COMPILE(
2643                         [
2644 #include <sys/types.h>
2645                         ],
2646                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2647                         [ ac_cv_have_uintxx_t="yes" ],
2648                         [ ac_cv_have_uintxx_t="no" ]
2649                 )
2650         ])
2651         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2652                 AC_DEFINE(HAVE_UINTXX_T, 1,
2653                         [define if you have uintxx_t data type])
2654         fi
2655 fi
2656
2657 if test -z "$have_uintxx_t" ; then
2658     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2659         AC_TRY_COMPILE(
2660                 [ #include <stdint.h> ],
2661                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2662                 [
2663                         AC_DEFINE(HAVE_UINTXX_T)
2664                         AC_MSG_RESULT(yes)
2665                 ],
2666                 [ AC_MSG_RESULT(no) ]
2667         )
2668 fi
2669
2670 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2671            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2672 then
2673         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2674         AC_TRY_COMPILE(
2675                 [
2676 #include <sys/bitypes.h>
2677                 ],
2678                 [
2679                         int8_t a; int16_t b; int32_t c;
2680                         u_int8_t e; u_int16_t f; u_int32_t g;
2681                         a = b = c = e = f = g = 1;
2682                 ],
2683                 [
2684                         AC_DEFINE(HAVE_U_INTXX_T)
2685                         AC_DEFINE(HAVE_INTXX_T)
2686                         AC_MSG_RESULT(yes)
2687                 ],
2688                 [AC_MSG_RESULT(no)]
2689         )
2690 fi
2691
2692
2693 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2694         AC_TRY_COMPILE(
2695                 [
2696 #include <sys/types.h>
2697                 ],
2698                 [ u_char foo; foo = 125; ],
2699                 [ ac_cv_have_u_char="yes" ],
2700                 [ ac_cv_have_u_char="no" ]
2701         )
2702 ])
2703 if test "x$ac_cv_have_u_char" = "xyes" ; then
2704         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2705 fi
2706
2707 TYPE_SOCKLEN_T
2708
2709 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2710
2711 AC_CHECK_TYPES(in_addr_t,,,
2712 [#include <sys/types.h>
2713 #include <netinet/in.h>])
2714
2715 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2716         AC_TRY_COMPILE(
2717                 [
2718 #include <sys/types.h>
2719                 ],
2720                 [ size_t foo; foo = 1235; ],
2721                 [ ac_cv_have_size_t="yes" ],
2722                 [ ac_cv_have_size_t="no" ]
2723         )
2724 ])
2725 if test "x$ac_cv_have_size_t" = "xyes" ; then
2726         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2727 fi
2728
2729 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2730         AC_TRY_COMPILE(
2731                 [
2732 #include <sys/types.h>
2733                 ],
2734                 [ ssize_t foo; foo = 1235; ],
2735                 [ ac_cv_have_ssize_t="yes" ],
2736                 [ ac_cv_have_ssize_t="no" ]
2737         )
2738 ])
2739 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2740         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2741 fi
2742
2743 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2744         AC_TRY_COMPILE(
2745                 [
2746 #include <time.h>
2747                 ],
2748                 [ clock_t foo; foo = 1235; ],
2749                 [ ac_cv_have_clock_t="yes" ],
2750                 [ ac_cv_have_clock_t="no" ]
2751         )
2752 ])
2753 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2754         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2755 fi
2756
2757 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2758         AC_TRY_COMPILE(
2759                 [
2760 #include <sys/types.h>
2761 #include <sys/socket.h>
2762                 ],
2763                 [ sa_family_t foo; foo = 1235; ],
2764                 [ ac_cv_have_sa_family_t="yes" ],
2765                 [ AC_TRY_COMPILE(
2766                   [
2767 #include <sys/types.h>
2768 #include <sys/socket.h>
2769 #include <netinet/in.h>
2770                 ],
2771                 [ sa_family_t foo; foo = 1235; ],
2772                 [ ac_cv_have_sa_family_t="yes" ],
2773
2774                 [ ac_cv_have_sa_family_t="no" ]
2775         )]
2776         )
2777 ])
2778 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2779         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2780                 [define if you have sa_family_t data type])
2781 fi
2782
2783 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2784         AC_TRY_COMPILE(
2785                 [
2786 #include <sys/types.h>
2787                 ],
2788                 [ pid_t foo; foo = 1235; ],
2789                 [ ac_cv_have_pid_t="yes" ],
2790                 [ ac_cv_have_pid_t="no" ]
2791         )
2792 ])
2793 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2794         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2795 fi
2796
2797 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2798         AC_TRY_COMPILE(
2799                 [
2800 #include <sys/types.h>
2801                 ],
2802                 [ mode_t foo; foo = 1235; ],
2803                 [ ac_cv_have_mode_t="yes" ],
2804                 [ ac_cv_have_mode_t="no" ]
2805         )
2806 ])
2807 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2808         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2809 fi
2810
2811
2812 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2813         AC_TRY_COMPILE(
2814                 [
2815 #include <sys/types.h>
2816 #include <sys/socket.h>
2817                 ],
2818                 [ struct sockaddr_storage s; ],
2819                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2820                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2821         )
2822 ])
2823 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2824         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2825                 [define if you have struct sockaddr_storage data type])
2826 fi
2827
2828 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2829         AC_TRY_COMPILE(
2830                 [
2831 #include <sys/types.h>
2832 #include <netinet/in.h>
2833                 ],
2834                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2835                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2836                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2837         )
2838 ])
2839 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2840         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2841                 [define if you have struct sockaddr_in6 data type])
2842 fi
2843
2844 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2845         AC_TRY_COMPILE(
2846                 [
2847 #include <sys/types.h>
2848 #include <netinet/in.h>
2849                 ],
2850                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2851                 [ ac_cv_have_struct_in6_addr="yes" ],
2852                 [ ac_cv_have_struct_in6_addr="no" ]
2853         )
2854 ])
2855 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2856         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2857                 [define if you have struct in6_addr data type])
2858 fi
2859
2860 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2861         AC_TRY_COMPILE(
2862                 [
2863 #include <sys/types.h>
2864 #include <sys/socket.h>
2865 #include <netdb.h>
2866                 ],
2867                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2868                 [ ac_cv_have_struct_addrinfo="yes" ],
2869                 [ ac_cv_have_struct_addrinfo="no" ]
2870         )
2871 ])
2872 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2873         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2874                 [define if you have struct addrinfo data type])
2875 fi
2876
2877 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2878         AC_TRY_COMPILE(
2879                 [ #include <sys/time.h> ],
2880                 [ struct timeval tv; tv.tv_sec = 1;],
2881                 [ ac_cv_have_struct_timeval="yes" ],
2882                 [ ac_cv_have_struct_timeval="no" ]
2883         )
2884 ])
2885 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2886         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2887         have_struct_timeval=1
2888 fi
2889
2890 AC_CHECK_TYPES(struct timespec)
2891
2892 # We need int64_t or else certian parts of the compile will fail.
2893 if test "x$ac_cv_have_int64_t" = "xno" && \
2894         test "x$ac_cv_sizeof_long_int" != "x8" && \
2895         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2896         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2897         echo "an alternative compiler (I.E., GCC) before continuing."
2898         echo ""
2899         exit 1;
2900 else
2901 dnl test snprintf (broken on SCO w/gcc)
2902         AC_RUN_IFELSE(
2903                 [AC_LANG_SOURCE([[
2904 #include <stdio.h>
2905 #include <string.h>
2906 #ifdef HAVE_SNPRINTF
2907 main()
2908 {
2909         char buf[50];
2910         char expected_out[50];
2911         int mazsize = 50 ;
2912 #if (SIZEOF_LONG_INT == 8)
2913         long int num = 0x7fffffffffffffff;
2914 #else
2915         long long num = 0x7fffffffffffffffll;
2916 #endif
2917         strcpy(expected_out, "9223372036854775807");
2918         snprintf(buf, mazsize, "%lld", num);
2919         if(strcmp(buf, expected_out) != 0)
2920                 exit(1);
2921         exit(0);
2922 }
2923 #else
2924 main() { exit(0); }
2925 #endif
2926                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
2927                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
2928         )
2929 fi
2930
2931 dnl Checks for structure members
2932 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
2933 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
2934 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
2935 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
2936 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
2937 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
2938 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
2939 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
2940 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
2941 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
2942 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
2943 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
2944 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
2945 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
2946 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
2947 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
2948 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
2949
2950 AC_CHECK_MEMBERS([struct stat.st_blksize])
2951 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
2952         [Define if we don't have struct __res_state in resolv.h])],
2953 [
2954 #include <stdio.h>
2955 #if HAVE_SYS_TYPES_H
2956 # include <sys/types.h>
2957 #endif
2958 #include <netinet/in.h>
2959 #include <arpa/nameser.h>
2960 #include <resolv.h>
2961 ])
2962
2963 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
2964                 ac_cv_have_ss_family_in_struct_ss, [
2965         AC_TRY_COMPILE(
2966                 [
2967 #include <sys/types.h>
2968 #include <sys/socket.h>
2969                 ],
2970                 [ struct sockaddr_storage s; s.ss_family = 1; ],
2971                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
2972                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
2973         )
2974 ])
2975 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
2976         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
2977 fi
2978
2979 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
2980                 ac_cv_have___ss_family_in_struct_ss, [
2981         AC_TRY_COMPILE(
2982                 [
2983 #include <sys/types.h>
2984 #include <sys/socket.h>
2985                 ],
2986                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
2987                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
2988                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
2989         )
2990 ])
2991 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
2992         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
2993                 [Fields in struct sockaddr_storage])
2994 fi
2995
2996 AC_CACHE_CHECK([for pw_class field in struct passwd],
2997                 ac_cv_have_pw_class_in_struct_passwd, [
2998         AC_TRY_COMPILE(
2999                 [
3000 #include <pwd.h>
3001                 ],
3002                 [ struct passwd p; p.pw_class = 0; ],
3003                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
3004                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
3005         )
3006 ])
3007 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
3008         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
3009                 [Define if your password has a pw_class field])
3010 fi
3011
3012 AC_CACHE_CHECK([for pw_expire field in struct passwd],
3013                 ac_cv_have_pw_expire_in_struct_passwd, [
3014         AC_TRY_COMPILE(
3015                 [
3016 #include <pwd.h>
3017                 ],
3018                 [ struct passwd p; p.pw_expire = 0; ],
3019                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
3020                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
3021         )
3022 ])
3023 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
3024         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
3025                 [Define if your password has a pw_expire field])
3026 fi
3027
3028 AC_CACHE_CHECK([for pw_change field in struct passwd],
3029                 ac_cv_have_pw_change_in_struct_passwd, [
3030         AC_TRY_COMPILE(
3031                 [
3032 #include <pwd.h>
3033                 ],
3034                 [ struct passwd p; p.pw_change = 0; ],
3035                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
3036                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
3037         )
3038 ])
3039 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
3040         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
3041                 [Define if your password has a pw_change field])
3042 fi
3043
3044 dnl make sure we're using the real structure members and not defines
3045 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3046                 ac_cv_have_accrights_in_msghdr, [
3047         AC_COMPILE_IFELSE(
3048                 [
3049 #include <sys/types.h>
3050 #include <sys/socket.h>
3051 #include <sys/uio.h>
3052 int main() {
3053 #ifdef msg_accrights
3054 #error "msg_accrights is a macro"
3055 exit(1);
3056 #endif
3057 struct msghdr m;
3058 m.msg_accrights = 0;
3059 exit(0);
3060 }
3061                 ],
3062                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3063                 [ ac_cv_have_accrights_in_msghdr="no" ]
3064         )
3065 ])
3066 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3067         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
3068                 [Define if your system uses access rights style
3069                 file descriptor passing])
3070 fi
3071
3072 AC_CACHE_CHECK([for msg_control field in struct msghdr],
3073                 ac_cv_have_control_in_msghdr, [
3074         AC_COMPILE_IFELSE(
3075                 [
3076 #include <sys/types.h>
3077 #include <sys/socket.h>
3078 #include <sys/uio.h>
3079 int main() {
3080 #ifdef msg_control
3081 #error "msg_control is a macro"
3082 exit(1);
3083 #endif
3084 struct msghdr m;
3085 m.msg_control = 0;
3086 exit(0);
3087 }
3088                 ],
3089                 [ ac_cv_have_control_in_msghdr="yes" ],
3090                 [ ac_cv_have_control_in_msghdr="no" ]
3091         )
3092 ])
3093 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
3094         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3095                 [Define if your system uses ancillary data style
3096                 file descriptor passing])
3097 fi
3098
3099 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3100         AC_TRY_LINK([],
3101                 [ extern char *__progname; printf("%s", __progname); ],
3102                 [ ac_cv_libc_defines___progname="yes" ],
3103                 [ ac_cv_libc_defines___progname="no" ]
3104         )
3105 ])
3106 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3107         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3108 fi
3109
3110 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3111         AC_TRY_LINK([
3112 #include <stdio.h>
3113 ],
3114                 [ printf("%s", __FUNCTION__); ],
3115                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3116                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3117         )
3118 ])
3119 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3120         AC_DEFINE(HAVE___FUNCTION__, 1,
3121                 [Define if compiler implements __FUNCTION__])
3122 fi
3123
3124 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3125         AC_TRY_LINK([
3126 #include <stdio.h>
3127 ],
3128                 [ printf("%s", __func__); ],
3129                 [ ac_cv_cc_implements___func__="yes" ],
3130                 [ ac_cv_cc_implements___func__="no" ]
3131         )
3132 ])
3133 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3134         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3135 fi
3136
3137 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3138         AC_TRY_LINK(
3139                 [#include <stdarg.h>
3140                  va_list x,y;],
3141                 [va_copy(x,y);],
3142                 [ ac_cv_have_va_copy="yes" ],
3143                 [ ac_cv_have_va_copy="no" ]
3144         )
3145 ])
3146 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3147         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3148 fi
3149
3150 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3151         AC_TRY_LINK(
3152                 [#include <stdarg.h>
3153                  va_list x,y;],
3154                 [__va_copy(x,y);],
3155                 [ ac_cv_have___va_copy="yes" ],
3156                 [ ac_cv_have___va_copy="no" ]
3157         )
3158 ])
3159 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3160         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3161 fi
3162
3163 AC_CACHE_CHECK([whether getopt has optreset support],
3164                 ac_cv_have_getopt_optreset, [
3165         AC_TRY_LINK(
3166                 [
3167 #include <getopt.h>
3168                 ],
3169                 [ extern int optreset; optreset = 0; ],
3170                 [ ac_cv_have_getopt_optreset="yes" ],
3171                 [ ac_cv_have_getopt_optreset="no" ]
3172         )
3173 ])
3174 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3175         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3176                 [Define if your getopt(3) defines and uses optreset])
3177 fi
3178
3179 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3180         AC_TRY_LINK([],
3181                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3182                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3183                 [ ac_cv_libc_defines_sys_errlist="no" ]
3184         )
3185 ])
3186 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3187         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3188                 [Define if your system defines sys_errlist[]])
3189 fi
3190
3191
3192 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3193         AC_TRY_LINK([],
3194                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3195                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3196                 [ ac_cv_libc_defines_sys_nerr="no" ]
3197         )
3198 ])
3199 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3200         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3201 fi
3202
3203 SCARD_MSG="no"
3204 # Check whether user wants sectok support
3205 AC_ARG_WITH(sectok,
3206         [  --with-sectok           Enable smartcard support using libsectok],
3207         [
3208                 if test "x$withval" != "xno" ; then
3209                         if test "x$withval" != "xyes" ; then
3210                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3211                                 LDFLAGS="$LDFLAGS -L${withval}"
3212                                 if test ! -z "$need_dash_r" ; then
3213                                         LDFLAGS="$LDFLAGS -R${withval}"
3214                                 fi
3215                                 if test ! -z "$blibpath" ; then
3216                                         blibpath="$blibpath:${withval}"
3217                                 fi
3218                         fi
3219                         AC_CHECK_HEADERS(sectok.h)
3220                         if test "$ac_cv_header_sectok_h" != yes; then
3221                                 AC_MSG_ERROR(Can't find sectok.h)
3222                         fi
3223                         AC_CHECK_LIB(sectok, sectok_open)
3224                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3225                                 AC_MSG_ERROR(Can't find libsectok)
3226                         fi
3227                         AC_DEFINE(SMARTCARD, 1,
3228                                 [Define if you want smartcard support])
3229                         AC_DEFINE(USE_SECTOK, 1,
3230                                 [Define if you want smartcard support
3231                                 using sectok])
3232                         SCARD_MSG="yes, using sectok"
3233                 fi
3234         ]
3235 )
3236
3237 # Check whether user wants OpenSC support
3238 OPENSC_CONFIG="no"
3239 AC_ARG_WITH(opensc,
3240         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3241         [
3242             if test "x$withval" != "xno" ; then
3243                 if test "x$withval" != "xyes" ; then
3244                         OPENSC_CONFIG=$withval/bin/opensc-config
3245                 else
3246                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3247                 fi
3248                 if test "$OPENSC_CONFIG" != "no"; then
3249                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3250                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3251                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3252                         LIBS="$LIBS $LIBOPENSC_LIBS"
3253                         AC_DEFINE(SMARTCARD)
3254                         AC_DEFINE(USE_OPENSC, 1,
3255                                 [Define if you want smartcard support
3256                                 using OpenSC])
3257                         SCARD_MSG="yes, using OpenSC"
3258                 fi
3259             fi
3260         ]
3261 )
3262
3263 # Check libraries needed by DNS fingerprint support
3264 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3265         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3266                 [Define if getrrsetbyname() exists])],
3267         [
3268                 # Needed by our getrrsetbyname()
3269                 AC_SEARCH_LIBS(res_query, resolv)
3270                 AC_SEARCH_LIBS(dn_expand, resolv)
3271                 AC_MSG_CHECKING(if res_query will link)
3272                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
3273                    [AC_MSG_RESULT(no)
3274                     saved_LIBS="$LIBS"
3275                     LIBS="$LIBS -lresolv"
3276                     AC_MSG_CHECKING(for res_query in -lresolv)
3277                     AC_LINK_IFELSE([
3278 #include <resolv.h>
3279 int main()
3280 {
3281         res_query (0, 0, 0, 0, 0);
3282         return 0;
3283 }
3284                         ],
3285                         [LIBS="$LIBS -lresolv"
3286                          AC_MSG_RESULT(yes)],
3287                         [LIBS="$saved_LIBS"
3288                          AC_MSG_RESULT(no)])
3289                     ])
3290                 AC_CHECK_FUNCS(_getshort _getlong)
3291                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3292                     [#include <sys/types.h>
3293                     #include <arpa/nameser.h>])
3294                 AC_CHECK_MEMBER(HEADER.ad,
3295                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3296                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3297                         [#include <arpa/nameser.h>])
3298         ])
3299
3300 # Check whether user wants SELinux support
3301 SELINUX_MSG="no"
3302 LIBSELINUX=""
3303 AC_ARG_WITH(selinux,
3304         [  --with-selinux   Enable SELinux support],
3305         [ if test "x$withval" != "xno" ; then
3306                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3307                 SELINUX_MSG="yes"
3308                 AC_CHECK_HEADER([selinux/selinux.h], ,
3309                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3310                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3311                     AC_MSG_ERROR(SELinux support requires libselinux library))
3312                 save_LIBS="$LIBS"
3313                 LIBS="$LIBS $LIBSELINUX"
3314                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3315                 LIBS="$save_LIBS"
3316         fi ]
3317 )
3318 AC_SUBST(LIBSELINUX)
3319
3320 # Check whether user wants Kerberos 5 support
3321 KRB5_MSG="no"
3322 AC_ARG_WITH(kerberos5,
3323         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3324         [ if test "x$withval" != "xno" ; then
3325                 if test "x$withval" = "xyes" ; then
3326                         KRB5ROOT="/usr/local"
3327                 else
3328                         KRB5ROOT=${withval}
3329                 fi
3330
3331                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3332                 KRB5_MSG="yes"
3333
3334                 AC_MSG_CHECKING(for krb5-config)
3335                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3336                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3337                         AC_MSG_RESULT($KRB5CONF)
3338
3339                         AC_MSG_CHECKING(for gssapi support)
3340                         if $KRB5CONF | grep gssapi >/dev/null ; then
3341                                 AC_MSG_RESULT(yes)
3342                                 AC_DEFINE(GSSAPI, 1,
3343                                         [Define this if you want GSSAPI
3344                                         support in the version 2 protocol])
3345                                 k5confopts=gssapi
3346                         else
3347                                 AC_MSG_RESULT(no)
3348                                 k5confopts=""
3349                         fi
3350                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3351                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3352                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3353                         AC_MSG_CHECKING(whether we are using Heimdal)
3354                         AC_TRY_COMPILE([ #include <krb5.h> ],
3355                                        [ char *tmp = heimdal_version; ],
3356                                        [ AC_MSG_RESULT(yes)
3357                                          AC_DEFINE(HEIMDAL, 1,
3358                                         [Define this if you are using the
3359                                         Heimdal version of Kerberos V5]) ],
3360                                          AC_MSG_RESULT(no)
3361                         )
3362                 else
3363                         AC_MSG_RESULT(no)
3364                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3365                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3366                         AC_MSG_CHECKING(whether we are using Heimdal)
3367                         AC_TRY_COMPILE([ #include <krb5.h> ],
3368                                        [ char *tmp = heimdal_version; ],
3369                                        [ AC_MSG_RESULT(yes)
3370                                          AC_DEFINE(HEIMDAL)
3371                                          K5LIBS="-lkrb5 -ldes"
3372                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3373                                          AC_CHECK_LIB(roken, net_write,
3374                                            [K5LIBS="$K5LIBS -lroken"])
3375                                        ],
3376                                        [ AC_MSG_RESULT(no)
3377                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3378                                        ]
3379                         )
3380                         AC_SEARCH_LIBS(dn_expand, resolv)
3381
3382                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
3383                                 [ AC_DEFINE(GSSAPI)
3384                                   K5LIBS="-lgssapi $K5LIBS" ],
3385                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
3386                                         [ AC_DEFINE(GSSAPI)
3387                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3388                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3389                                         $K5LIBS)
3390                                 ],
3391                                 $K5LIBS)
3392
3393                         AC_CHECK_HEADER(gssapi.h, ,
3394                                 [ unset ac_cv_header_gssapi_h
3395                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3396                                   AC_CHECK_HEADERS(gssapi.h, ,
3397                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3398                                   )
3399                                 ]
3400                         )
3401
3402                         oldCPP="$CPPFLAGS"
3403                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3404                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3405                                         [ CPPFLAGS="$oldCPP" ])
3406
3407                         # If we're using some other GSSAPI
3408                         if test "$GSSAPI" -a "$GSSAPI" != "mechglue"; then
3409                                 AC_MSG_ERROR([$GSSAPI GSSAPI library conflicts with Kerberos support.  Use mechglue instead.])
3410                         fi
3411
3412                         if test -z "$GSSAPI"; then
3413                                 GSSAPI="KRB5";
3414                         fi
3415
3416                         oldCPP="$CPPFLAGS"
3417                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3418                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3419                                         [ CPPFLAGS="$oldCPP" ])
3420
3421                 fi
3422                 if test ! -z "$need_dash_r" ; then
3423                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3424                 fi
3425                 if test ! -z "$blibpath" ; then
3426                         blibpath="$blibpath:${KRB5ROOT}/lib"
3427                 fi
3428
3429                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3430                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3431                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3432
3433                 LIBS="$LIBS $K5LIBS"
3434                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3435                         [Define this if you want to use libkafs' AFS support]))
3436         fi
3437         ]
3438 )
3439
3440 # Check whether user wants AFS_KRB5 support
3441 AFS_KRB5_MSG="no"
3442 AC_ARG_WITH(afs-krb5,
3443         [  --with-afs-krb5[[=AKLOG_PATH]]  Enable aklog to get token (default=/usr/bin/aklog).],
3444         [
3445                 if test "x$withval" != "xno" ; then
3446
3447                         if test "x$withval" != "xyes" ; then
3448                                 AC_DEFINE_UNQUOTED(AKLOG_PATH, "$withval",
3449                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3450                         else
3451                                 AC_DEFINE_UNQUOTED(AKLOG_PATH,
3452                                         "/usr/bin/aklog",
3453                                         [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3454                         fi
3455
3456                         if test -z "$KRB5ROOT" ; then
3457                                 AC_MSG_WARN([AFS_KRB5 requires Kerberos 5 support, build may fail])
3458                         fi
3459
3460                         LIBS="-lkrbafs -lkrb4 $LIBS"
3461                         if test ! -z "$AFS_LIBS" ; then
3462                                 LIBS="$LIBS $AFS_LIBS"
3463                         fi
3464                         AC_DEFINE(AFS_KRB5, 1,
3465                                 [Define this if you want to use AFS/Kerberos 5 option, which runs aklog.])
3466                         AFS_KRB5_MSG="yes"
3467                 fi
3468         ]
3469 )
3470
3471 AC_ARG_WITH(session-hooks,
3472         [  --with-session-hooks    Enable hooks for executing external commands                                       before/after a session],
3473         [ AC_DEFINE(SESSION_HOOKS, 1, [Define this if you want support for startup/shutdown hooks]) ]
3474 )
3475
3476 # Looking for programs, paths and files
3477
3478 PRIVSEP_PATH=/var/empty
3479 AC_ARG_WITH(privsep-path,
3480         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3481         [
3482                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3483                     test "x${withval}" != "xyes"; then
3484                         PRIVSEP_PATH=$withval
3485                 fi
3486         ]
3487 )
3488 AC_SUBST(PRIVSEP_PATH)
3489
3490 AC_ARG_WITH(xauth,
3491         [  --with-xauth=PATH       Specify path to xauth program ],
3492         [
3493                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3494                     test "x${withval}" != "xyes"; then
3495                         xauth_path=$withval
3496                 fi
3497         ],
3498         [
3499                 TestPath="$PATH"
3500                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3501                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3502                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3503                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3504                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3505                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3506                         xauth_path="/usr/openwin/bin/xauth"
3507                 fi
3508         ]
3509 )
3510
3511 STRIP_OPT=-s
3512 AC_ARG_ENABLE(strip,
3513         [  --disable-strip         Disable calling strip(1) on install],
3514         [
3515                 if test "x$enableval" = "xno" ; then
3516                         STRIP_OPT=
3517                 fi
3518         ]
3519 )
3520 AC_SUBST(STRIP_OPT)
3521
3522 if test -z "$xauth_path" ; then
3523         XAUTH_PATH="undefined"
3524         AC_SUBST(XAUTH_PATH)
3525 else
3526         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3527                 [Define if xauth is found in your path])
3528         XAUTH_PATH=$xauth_path
3529         AC_SUBST(XAUTH_PATH)
3530 fi
3531
3532 # Check for mail directory (last resort if we cannot get it from headers)
3533 if test ! -z "$MAIL" ; then
3534         maildir=`dirname $MAIL`
3535         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3536                 [Set this to your mail directory if you don't have maillock.h])
3537 fi
3538
3539 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3540         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3541         disable_ptmx_check=yes
3542 fi
3543 if test -z "$no_dev_ptmx" ; then
3544         if test "x$disable_ptmx_check" != "xyes" ; then
3545                 AC_CHECK_FILE("/dev/ptmx",
3546                         [
3547                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3548                                         [Define if you have /dev/ptmx])
3549                                 have_dev_ptmx=1
3550                         ]
3551                 )
3552         fi
3553 fi
3554
3555 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3556         AC_CHECK_FILE("/dev/ptc",
3557                 [
3558                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3559                                 [Define if you have /dev/ptc])
3560                         have_dev_ptc=1
3561                 ]
3562         )
3563 else
3564         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3565 fi
3566
3567 # Options from here on. Some of these are preset by platform above
3568 AC_ARG_WITH(mantype,
3569         [  --with-mantype=man|cat|doc  Set man page type],
3570         [
3571                 case "$withval" in
3572                 man|cat|doc)
3573                         MANTYPE=$withval
3574                         ;;
3575                 *)
3576                         AC_MSG_ERROR(invalid man type: $withval)
3577                         ;;
3578                 esac
3579         ]
3580 )
3581 if test -z "$MANTYPE"; then
3582         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3583         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3584         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3585                 MANTYPE=doc
3586         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3587                 MANTYPE=man
3588         else
3589                 MANTYPE=cat
3590         fi
3591 fi
3592 AC_SUBST(MANTYPE)
3593 if test "$MANTYPE" = "doc"; then
3594         mansubdir=man;
3595 else
3596         mansubdir=$MANTYPE;
3597 fi
3598 AC_SUBST(mansubdir)
3599
3600 # Check whether to enable MD5 passwords
3601 MD5_MSG="no"
3602 AC_ARG_WITH(md5-passwords,
3603         [  --with-md5-passwords    Enable use of MD5 passwords],
3604         [
3605                 if test "x$withval" != "xno" ; then
3606                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3607                                 [Define if you want to allow MD5 passwords])
3608                         MD5_MSG="yes"
3609                 fi
3610         ]
3611 )
3612
3613 # Whether to disable shadow password support
3614 AC_ARG_WITH(shadow,
3615         [  --without-shadow        Disable shadow password support],
3616         [
3617                 if test "x$withval" = "xno" ; then
3618                         AC_DEFINE(DISABLE_SHADOW)
3619                         disable_shadow=yes
3620                 fi
3621         ]
3622 )
3623
3624 if test -z "$disable_shadow" ; then
3625         AC_MSG_CHECKING([if the systems has expire shadow information])
3626         AC_TRY_COMPILE(
3627         [
3628 #include <sys/types.h>
3629 #include <shadow.h>
3630         struct spwd sp;
3631         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3632         [ sp_expire_available=yes ], []
3633         )
3634
3635         if test "x$sp_expire_available" = "xyes" ; then
3636                 AC_MSG_RESULT(yes)
3637                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3638                     [Define if you want to use shadow password expire field])
3639         else
3640                 AC_MSG_RESULT(no)
3641         fi
3642 fi
3643
3644 # Use ip address instead of hostname in $DISPLAY
3645 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3646         DISPLAY_HACK_MSG="yes"
3647         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3648                 [Define if you need to use IP address
3649                 instead of hostname in $DISPLAY])
3650 else
3651         DISPLAY_HACK_MSG="no"
3652         AC_ARG_WITH(ipaddr-display,
3653                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3654                 [
3655                         if test "x$withval" != "xno" ; then
3656                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3657                                 DISPLAY_HACK_MSG="yes"
3658                         fi
3659                 ]
3660         )
3661 fi
3662
3663 # check for /etc/default/login and use it if present.
3664 AC_ARG_ENABLE(etc-default-login,
3665         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3666         [ if test "x$enableval" = "xno"; then
3667                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3668                 etc_default_login=no
3669           else
3670                 etc_default_login=yes
3671           fi ],
3672         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3673           then
3674                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3675                 etc_default_login=no
3676           else
3677                 etc_default_login=yes
3678           fi ]
3679 )
3680
3681 if test "x$etc_default_login" != "xno"; then
3682         AC_CHECK_FILE("/etc/default/login",
3683             [ external_path_file=/etc/default/login ])
3684         if test "x$external_path_file" = "x/etc/default/login"; then
3685                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3686                         [Define if your system has /etc/default/login])
3687         fi
3688 fi
3689
3690 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3691 if test $ac_cv_func_login_getcapbool = "yes" && \
3692         test $ac_cv_header_login_cap_h = "yes" ; then
3693         external_path_file=/etc/login.conf
3694 fi
3695
3696 # Whether to mess with the default path
3697 SERVER_PATH_MSG="(default)"
3698 AC_ARG_WITH(default-path,
3699         [  --with-default-path=    Specify default \$PATH environment for server],
3700         [
3701                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3702                         AC_MSG_WARN([
3703 --with-default-path=PATH has no effect on this system.
3704 Edit /etc/login.conf instead.])
3705                 elif test "x$withval" != "xno" ; then
3706                         if test ! -z "$external_path_file" ; then
3707                                 AC_MSG_WARN([
3708 --with-default-path=PATH will only be used if PATH is not defined in
3709 $external_path_file .])
3710                         fi
3711                         user_path="$withval"
3712                         SERVER_PATH_MSG="$withval"
3713                 fi
3714         ],
3715         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3716                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3717         else
3718                 if test ! -z "$external_path_file" ; then
3719                         AC_MSG_WARN([
3720 If PATH is defined in $external_path_file, ensure the path to scp is included,
3721 otherwise scp will not work.])
3722                 fi
3723                 AC_RUN_IFELSE(
3724                         [AC_LANG_SOURCE([[
3725 /* find out what STDPATH is */
3726 #include <stdio.h>
3727 #ifdef HAVE_PATHS_H
3728 # include <paths.h>
3729 #endif
3730 #ifndef _PATH_STDPATH
3731 # ifdef _PATH_USERPATH  /* Irix */
3732 #  define _PATH_STDPATH _PATH_USERPATH
3733 # else
3734 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3735 # endif
3736 #endif
3737 #include <sys/types.h>
3738 #include <sys/stat.h>
3739 #include <fcntl.h>
3740 #define DATA "conftest.stdpath"
3741
3742 main()
3743 {
3744         FILE *fd;
3745         int rc;
3746
3747         fd = fopen(DATA,"w");
3748         if(fd == NULL)
3749                 exit(1);
3750
3751         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3752                 exit(1);
3753
3754         exit(0);
3755 }
3756                 ]])],
3757                 [ user_path=`cat conftest.stdpath` ],
3758                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3759                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3760         )
3761 # make sure $bindir is in USER_PATH so scp will work
3762                 t_bindir=`eval echo ${bindir}`
3763                 case $t_bindir in
3764                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3765                 esac
3766                 case $t_bindir in
3767                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3768                 esac
3769                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3770                 if test $? -ne 0  ; then
3771                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3772                         if test $? -ne 0  ; then
3773                                 user_path=$user_path:$t_bindir
3774                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3775                         fi
3776                 fi
3777         fi ]
3778 )
3779 if test "x$external_path_file" != "x/etc/login.conf" ; then
3780         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3781         AC_SUBST(user_path)
3782 fi
3783
3784 # Set superuser path separately to user path
3785 AC_ARG_WITH(superuser-path,
3786         [  --with-superuser-path=  Specify different path for super-user],
3787         [
3788                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3789                     test "x${withval}" != "xyes"; then
3790                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3791                                 [Define if you want a different $PATH
3792                                 for the superuser])
3793                         superuser_path=$withval
3794                 fi
3795         ]
3796 )
3797
3798
3799 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3800 IPV4_IN6_HACK_MSG="no"
3801 AC_ARG_WITH(4in6,
3802         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3803         [
3804                 if test "x$withval" != "xno" ; then
3805                         AC_MSG_RESULT(yes)
3806                         AC_DEFINE(IPV4_IN_IPV6, 1,
3807                                 [Detect IPv4 in IPv6 mapped addresses
3808                                 and treat as IPv4])
3809                         IPV4_IN6_HACK_MSG="yes"
3810                 else
3811                         AC_MSG_RESULT(no)
3812                 fi
3813         ],[
3814                 if test "x$inet6_default_4in6" = "xyes"; then
3815                         AC_MSG_RESULT([yes (default)])
3816                         AC_DEFINE(IPV4_IN_IPV6)
3817                         IPV4_IN6_HACK_MSG="yes"
3818                 else
3819                         AC_MSG_RESULT([no (default)])
3820                 fi
3821         ]
3822 )
3823
3824 # Whether to enable BSD auth support
3825 BSD_AUTH_MSG=no
3826 AC_ARG_WITH(bsd-auth,
3827         [  --with-bsd-auth         Enable BSD auth support],
3828         [
3829                 if test "x$withval" != "xno" ; then
3830                         AC_DEFINE(BSD_AUTH, 1,
3831                                 [Define if you have BSD auth support])
3832                         BSD_AUTH_MSG=yes
3833                 fi
3834         ]
3835 )
3836
3837 # Where to place sshd.pid
3838 piddir=/var/run
3839 # make sure the directory exists
3840 if test ! -d $piddir ; then
3841         piddir=`eval echo ${sysconfdir}`
3842         case $piddir in
3843                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3844         esac
3845 fi
3846
3847 AC_ARG_WITH(pid-dir,
3848         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3849         [
3850                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3851                     test "x${withval}" != "xyes"; then
3852                         piddir=$withval
3853                         if test ! -d $piddir ; then
3854                         AC_MSG_WARN([** no $piddir directory on this system **])
3855                         fi
3856                 fi
3857         ]
3858 )
3859
3860 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3861 AC_SUBST(piddir)
3862
3863 dnl allow user to disable some login recording features
3864 AC_ARG_ENABLE(lastlog,
3865         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3866         [
3867                 if test "x$enableval" = "xno" ; then
3868                         AC_DEFINE(DISABLE_LASTLOG)
3869                 fi
3870         ]
3871 )
3872 AC_ARG_ENABLE(utmp,
3873         [  --disable-utmp          disable use of utmp even if detected [no]],
3874         [
3875                 if test "x$enableval" = "xno" ; then
3876                         AC_DEFINE(DISABLE_UTMP)
3877                 fi
3878         ]
3879 )
3880 AC_ARG_ENABLE(utmpx,
3881         [  --disable-utmpx         disable use of utmpx even if detected [no]],
3882         [
3883                 if test "x$enableval" = "xno" ; then
3884                         AC_DEFINE(DISABLE_UTMPX, 1,
3885                                 [Define if you don't want to use utmpx])
3886                 fi
3887         ]
3888 )
3889 AC_ARG_ENABLE(wtmp,
3890         [  --disable-wtmp          disable use of wtmp even if detected [no]],
3891         [
3892                 if test "x$enableval" = "xno" ; then
3893                         AC_DEFINE(DISABLE_WTMP)
3894                 fi
3895         ]
3896 )
3897 AC_ARG_ENABLE(wtmpx,
3898         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
3899         [
3900                 if test "x$enableval" = "xno" ; then
3901                         AC_DEFINE(DISABLE_WTMPX, 1,
3902                                 [Define if you don't want to use wtmpx])
3903                 fi
3904         ]
3905 )
3906 AC_ARG_ENABLE(libutil,
3907         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
3908         [
3909                 if test "x$enableval" = "xno" ; then
3910                         AC_DEFINE(DISABLE_LOGIN)
3911                 fi
3912         ]
3913 )
3914 AC_ARG_ENABLE(pututline,
3915         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
3916         [
3917                 if test "x$enableval" = "xno" ; then
3918                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
3919                                 [Define if you don't want to use pututline()
3920                                 etc. to write [uw]tmp])
3921                 fi
3922         ]
3923 )
3924 AC_ARG_ENABLE(pututxline,
3925         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
3926         [
3927                 if test "x$enableval" = "xno" ; then
3928                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
3929                                 [Define if you don't want to use pututxline()
3930                                 etc. to write [uw]tmpx])
3931                 fi
3932         ]
3933 )
3934 AC_ARG_WITH(lastlog,
3935   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
3936         [
3937                 if test "x$withval" = "xno" ; then
3938                         AC_DEFINE(DISABLE_LASTLOG)
3939                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
3940                         conf_lastlog_location=$withval
3941                 fi
3942         ]
3943 )
3944
3945 dnl lastlog, [uw]tmpx? detection
3946 dnl  NOTE: set the paths in the platform section to avoid the
3947 dnl   need for command-line parameters
3948 dnl lastlog and [uw]tmp are subject to a file search if all else fails
3949
3950 dnl lastlog detection
3951 dnl  NOTE: the code itself will detect if lastlog is a directory
3952 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
3953 AC_TRY_COMPILE([
3954 #include <sys/types.h>
3955 #include <utmp.h>
3956 #ifdef HAVE_LASTLOG_H
3957 #  include <lastlog.h>
3958 #endif
3959 #ifdef HAVE_PATHS_H
3960 #  include <paths.h>
3961 #endif
3962 #ifdef HAVE_LOGIN_H
3963 # include <login.h>
3964 #endif
3965         ],
3966         [ char *lastlog = LASTLOG_FILE; ],
3967         [ AC_MSG_RESULT(yes) ],
3968         [
3969                 AC_MSG_RESULT(no)
3970                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
3971                 AC_TRY_COMPILE([
3972 #include <sys/types.h>
3973 #include <utmp.h>
3974 #ifdef HAVE_LASTLOG_H
3975 #  include <lastlog.h>
3976 #endif
3977 #ifdef HAVE_PATHS_H
3978 #  include <paths.h>
3979 #endif
3980                 ],
3981                 [ char *lastlog = _PATH_LASTLOG; ],
3982                 [ AC_MSG_RESULT(yes) ],
3983                 [
3984                         AC_MSG_RESULT(no)
3985                         system_lastlog_path=no
3986                 ])
3987         ]
3988 )
3989
3990 if test -z "$conf_lastlog_location"; then
3991         if test x"$system_lastlog_path" = x"no" ; then
3992                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
3993                                 if (test -d "$f" || test -f "$f") ; then
3994                                         conf_lastlog_location=$f
3995                                 fi
3996                 done
3997                 if test -z "$conf_lastlog_location"; then
3998                         AC_MSG_WARN([** Cannot find lastlog **])
3999                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4000                 fi
4001         fi
4002 fi
4003
4004 if test -n "$conf_lastlog_location"; then
4005         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
4006                 [Define if you want to specify the path to your lastlog file])
4007 fi
4008
4009 dnl utmp detection
4010 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4011 AC_TRY_COMPILE([
4012 #include <sys/types.h>
4013 #include <utmp.h>
4014 #ifdef HAVE_PATHS_H
4015 #  include <paths.h>
4016 #endif
4017         ],
4018         [ char *utmp = UTMP_FILE; ],
4019         [ AC_MSG_RESULT(yes) ],
4020         [ AC_MSG_RESULT(no)
4021           system_utmp_path=no ]
4022 )
4023 if test -z "$conf_utmp_location"; then
4024         if test x"$system_utmp_path" = x"no" ; then
4025                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
4026                         if test -f $f ; then
4027                                 conf_utmp_location=$f
4028                         fi
4029                 done
4030                 if test -z "$conf_utmp_location"; then
4031                         AC_DEFINE(DISABLE_UTMP)
4032                 fi
4033         fi
4034 fi
4035 if test -n "$conf_utmp_location"; then
4036         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
4037                 [Define if you want to specify the path to your utmp file])
4038 fi
4039
4040 dnl wtmp detection
4041 AC_MSG_CHECKING([if your system defines WTMP_FILE])
4042 AC_TRY_COMPILE([
4043 #include <sys/types.h>
4044 #include <utmp.h>
4045 #ifdef HAVE_PATHS_H
4046 #  include <paths.h>
4047 #endif
4048         ],
4049         [ char *wtmp = WTMP_FILE; ],
4050         [ AC_MSG_RESULT(yes) ],
4051         [ AC_MSG_RESULT(no)
4052           system_wtmp_path=no ]
4053 )
4054 if test -z "$conf_wtmp_location"; then
4055         if test x"$system_wtmp_path" = x"no" ; then
4056                 for f in /usr/adm/wtmp /var/log/wtmp; do
4057                         if test -f $f ; then
4058                                 conf_wtmp_location=$f
4059                         fi
4060                 done
4061                 if test -z "$conf_wtmp_location"; then
4062                         AC_DEFINE(DISABLE_WTMP)
4063                 fi
4064         fi
4065 fi
4066 if test -n "$conf_wtmp_location"; then
4067         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
4068                 [Define if you want to specify the path to your wtmp file])
4069 fi
4070
4071
4072 dnl utmpx detection - I don't know any system so perverse as to require
4073 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
4074 dnl  there, though.
4075 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
4076 AC_TRY_COMPILE([
4077 #include <sys/types.h>
4078 #include <utmp.h>
4079 #ifdef HAVE_UTMPX_H
4080 #include <utmpx.h>
4081 #endif
4082 #ifdef HAVE_PATHS_H
4083 #  include <paths.h>
4084 #endif
4085         ],
4086         [ char *utmpx = UTMPX_FILE; ],
4087         [ AC_MSG_RESULT(yes) ],
4088         [ AC_MSG_RESULT(no)
4089           system_utmpx_path=no ]
4090 )
4091 if test -z "$conf_utmpx_location"; then
4092         if test x"$system_utmpx_path" = x"no" ; then
4093                 AC_DEFINE(DISABLE_UTMPX)
4094         fi
4095 else
4096         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
4097                 [Define if you want to specify the path to your utmpx file])
4098 fi
4099
4100 dnl wtmpx detection
4101 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
4102 AC_TRY_COMPILE([
4103 #include <sys/types.h>
4104 #include <utmp.h>
4105 #ifdef HAVE_UTMPX_H
4106 #include <utmpx.h>
4107 #endif
4108 #ifdef HAVE_PATHS_H
4109 #  include <paths.h>
4110 #endif
4111         ],
4112         [ char *wtmpx = WTMPX_FILE; ],
4113         [ AC_MSG_RESULT(yes) ],
4114         [ AC_MSG_RESULT(no)
4115           system_wtmpx_path=no ]
4116 )
4117 if test -z "$conf_wtmpx_location"; then
4118         if test x"$system_wtmpx_path" = x"no" ; then
4119                 AC_DEFINE(DISABLE_WTMPX)
4120         fi
4121 else
4122         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
4123                 [Define if you want to specify the path to your wtmpx file])
4124 fi
4125
4126
4127 if test ! -z "$blibpath" ; then
4128         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4129         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4130 fi
4131
4132 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4133 dnl Add now.
4134 CFLAGS="$CFLAGS $werror_flags"
4135
4136 AC_EXEEXT
4137 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4138         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4139         scard/Makefile ssh_prng_cmds survey.sh])
4140 AC_OUTPUT
4141
4142 # Print summary of options
4143
4144 # Someone please show me a better way :)
4145 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4146 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4147 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4148 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4149 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4150 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4151 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
4152 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4153 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4154 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4155
4156 echo ""
4157 echo "OpenSSH has been configured with the following options:"
4158 echo "                     User binaries: $B"
4159 echo "                   System binaries: $C"
4160 echo "               Configuration files: $D"
4161 echo "                   Askpass program: $E"
4162 echo "                      Manual pages: $F"
4163 echo "                          PID file: $G"
4164 echo "  Privilege separation chroot path: $H"
4165 if test "x$external_path_file" = "x/etc/login.conf" ; then
4166 echo "   At runtime, sshd will use the path defined in $external_path_file"
4167 echo "   Make sure the path to scp is present, otherwise scp will not work"
4168 else
4169 echo "            sshd default user PATH: $I"
4170         if test ! -z "$external_path_file"; then
4171 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4172 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4173         fi
4174 fi
4175 if test ! -z "$superuser_path" ; then
4176 echo "          sshd superuser user PATH: $J"
4177 fi
4178 echo "                    Manpage format: $MANTYPE"
4179 echo "                       PAM support: $PAM_MSG"
4180 echo "                   OSF SIA support: $SIA_MSG"
4181 echo "                 KerberosV support: $KRB5_MSG"
4182 echo "                   SELinux support: $SELINUX_MSG"
4183 echo "                 Smartcard support: $SCARD_MSG"
4184 echo "                     S/KEY support: $SKEY_MSG"
4185 echo "              TCP Wrappers support: $TCPW_MSG"
4186 echo "              MD5 password support: $MD5_MSG"
4187 echo "                   libedit support: $LIBEDIT_MSG"
4188 echo "  Solaris process contract support: $SPC_MSG"
4189 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4190 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4191 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4192 echo "              Random number source: $RAND_MSG"
4193 if test ! -z "$USE_RAND_HELPER" ; then
4194 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4195 fi
4196
4197 echo ""
4198
4199 echo "              Host: ${host}"
4200 echo "          Compiler: ${CC}"
4201 echo "    Compiler flags: ${CFLAGS}"
4202 echo "Preprocessor flags: ${CPPFLAGS}"
4203 echo "      Linker flags: ${LDFLAGS}"
4204 echo "         Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}"
4205
4206 echo ""
4207
4208 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4209         echo "SVR4 style packages are supported with \"make package\""
4210         echo ""
4211 fi
4212
4213 if test "x$PAM_MSG" = "xyes" ; then
4214         echo "PAM is enabled. You may need to install a PAM control file "
4215         echo "for sshd, otherwise password authentication may fail. "
4216         echo "Example PAM control files can be found in the contrib/ "
4217         echo "subdirectory"
4218         echo ""
4219 fi
4220
4221 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4222         echo "WARNING: you are using the builtin random number collection "
4223         echo "service. Please read WARNING.RNG and request that your OS "
4224         echo "vendor includes kernel-based random number collection in "
4225         echo "future versions of your OS."
4226         echo ""
4227 fi
4228
4229 if test ! -z "$NO_PEERCHECK" ; then
4230         echo "WARNING: the operating system that you are using does not "
4231         echo "appear to support either the getpeereid() API nor the "
4232         echo "SO_PEERCRED getsockopt() option. These facilities are used to "
4233         echo "enforce security checks to prevent unauthorised connections to "
4234         echo "ssh-agent. Their absence increases the risk that a malicious "
4235         echo "user can connect to your agent. "
4236         echo ""
4237 fi
4238
4239 if test "$AUDIT_MODULE" = "bsm" ; then
4240         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4241         echo "See the Solaris section in README.platform for details."
4242 fi