configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PATH_PROG(AR, ar)
  33 AC_PATH_PROG(CAT, cat)
  34 AC_PATH_PROG(KILL, kill)
  35 AC_PATH_PROGS(PERL, perl5 perl)
  36 AC_PATH_PROG(SED, sed)
  37 AC_SUBST(PERL)
  38 AC_PATH_PROG(ENT, ent)
  39 AC_SUBST(ENT)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  43 AC_PATH_PROG(SH, sh)
  44 AC_SUBST(TEST_SHELL,sh)
  45
  46 dnl for buildpkg.sh
  47 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  50         [/usr/sbin${PATH_SEPARATOR}/etc])
  51 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  52 if test -x /sbin/sh; then
  53         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  54 else
  55         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  56 fi
  57
  58 # System features
  59 AC_SYS_LARGEFILE
  60
  61 if test -z "$AR" ; then
  62         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  63 fi
  64
  65 # Use LOGIN_PROGRAM from environment if possible
  66 if test ! -z "$LOGIN_PROGRAM" ; then
  67         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  68                 [If your header files don't define LOGIN_PROGRAM,
  69                 then use this (detected) from environment and PATH])
  70 else
  71         # Search for login
  72         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  73         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  74                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  75         fi
  76 fi
  77
  78 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  79 if test ! -z "$PATH_PASSWD_PROG" ; then
  80         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  81                 [Full path of your "passwd" program])
  82 fi
  83
  84 if test -z "$LD" ; then
  85         LD=$CC
  86 fi
  87 AC_SUBST(LD)
  88
  89 AC_C_INLINE
  90
  91 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  92
  93 use_stack_protector=1
  94 AC_ARG_WITH(stackprotect,
  95     [  --without-stackprotect  Don't use compiler's stack protection], [
  96     if test "x$withval" = "xno"; then
  97         use_stack_protector=0
  98     fi ])
  99
 100 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 101         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
 102         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 103         case $GCC_VER in
 104                 1.*) no_attrib_nonnull=1 ;;
 105                 2.8* | 2.9*)
 106                      CFLAGS="$CFLAGS -Wsign-compare"
 107                      no_attrib_nonnull=1
 108                      ;;
 109                 2.*) no_attrib_nonnull=1 ;;
 110                 3.*) CFLAGS="$CFLAGS -Wsign-compare -Wformat-security" ;;
 111                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign -Wformat-security" ;;
 112                 *) ;;
 113         esac
 114
 115         AC_MSG_CHECKING(if $CC accepts -fno-builtin-memset)
 116         saved_CFLAGS="$CFLAGS"
 117         CFLAGS="$CFLAGS -fno-builtin-memset"
 118         AC_LINK_IFELSE( [AC_LANG_SOURCE([[
 119 #include <string.h>
 120 int main(void){char b[10]; memset(b, 0, sizeof(b));}
 121                 ]])],
 122                 [ AC_MSG_RESULT(yes) ],
 123                 [ AC_MSG_RESULT(no)
 124                   CFLAGS="$saved_CFLAGS" ]
 125 )
 126
 127         # -fstack-protector-all doesn't always work for some GCC versions
 128         # and/or platforms, so we test if we can.  If it's not supported
 129         # on a given platform gcc will emit a warning so we use -Werror.
 130         if test "x$use_stack_protector" = "x1"; then
 131             for t in -fstack-protector-all -fstack-protector; do
 132                 AC_MSG_CHECKING(if $CC supports $t)
 133                 saved_CFLAGS="$CFLAGS"
 134                 saved_LDFLAGS="$LDFLAGS"
 135                 CFLAGS="$CFLAGS $t -Werror"
 136                 LDFLAGS="$LDFLAGS $t -Werror"
 137                 AC_LINK_IFELSE(
 138                         [AC_LANG_SOURCE([
 139 #include <stdio.h>
 140 int main(void){char x[[256]]; snprintf(x, sizeof(x), "XXX"); return 0;}
 141                          ])],
 142                     [ AC_MSG_RESULT(yes)
 143                       CFLAGS="$saved_CFLAGS $t"
 144                       LDFLAGS="$saved_LDFLAGS $t"
 145                       AC_MSG_CHECKING(if $t works)
 146                       AC_RUN_IFELSE(
 147                         [AC_LANG_SOURCE([
 148 #include <stdio.h>
 149 int main(void){char x[[256]]; snprintf(x, sizeof(x), "XXX"); return 0;}
 150                         ])],
 151                         [ AC_MSG_RESULT(yes)
 152                           break ],
 153                         [ AC_MSG_RESULT(no) ],
 154                         [ AC_MSG_WARN([cross compiling: cannot test])
 155                           break ]
 156                       )
 157                     ],
 158                     [ AC_MSG_RESULT(no) ]
 159                 )
 160                 CFLAGS="$saved_CFLAGS"
 161                 LDFLAGS="$saved_LDFLAGS"
 162             done
 163         fi
 164
 165         if test -z "$have_llong_max"; then
 166                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 167                 unset ac_cv_have_decl_LLONG_MAX
 168                 saved_CFLAGS="$CFLAGS"
 169                 CFLAGS="$CFLAGS -std=gnu99"
 170                 AC_CHECK_DECL(LLONG_MAX,
 171                     [have_llong_max=1],
 172                     [CFLAGS="$saved_CFLAGS"],
 173                     [#include <limits.h>]
 174                 )
 175         fi
 176 fi
 177
 178 if test "x$no_attrib_nonnull" != "x1" ; then
 179         AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
 180 fi
 181
 182 AC_ARG_WITH(rpath,
 183         [  --without-rpath         Disable auto-added -R linker paths],
 184         [
 185                 if test "x$withval" = "xno" ; then
 186                         need_dash_r=""
 187                 fi
 188                 if test "x$withval" = "xyes" ; then
 189                         need_dash_r=1
 190                 fi
 191         ]
 192 )
 193
 194 # Allow user to specify flags
 195 AC_ARG_WITH(cflags,
 196         [  --with-cflags           Specify additional flags to pass to compiler],
 197         [
 198                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 199                     test "x${withval}" != "xyes"; then
 200                         CFLAGS="$CFLAGS $withval"
 201                 fi
 202         ]
 203 )
 204 AC_ARG_WITH(cppflags,
 205         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 206         [
 207                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 208                     test "x${withval}" != "xyes"; then
 209                         CPPFLAGS="$CPPFLAGS $withval"
 210                 fi
 211         ]
 212 )
 213 AC_ARG_WITH(ldflags,
 214         [  --with-ldflags          Specify additional flags to pass to linker],
 215         [
 216                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 217                     test "x${withval}" != "xyes"; then
 218                         LDFLAGS="$LDFLAGS $withval"
 219                 fi
 220         ]
 221 )
 222 AC_ARG_WITH(libs,
 223         [  --with-libs             Specify additional libraries to link with],
 224         [
 225                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 226                     test "x${withval}" != "xyes"; then
 227                         LIBS="$LIBS $withval"
 228                 fi
 229         ]
 230 )
 231 AC_ARG_WITH(Werror,
 232         [  --with-Werror           Build main code with -Werror],
 233         [
 234                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 235                         werror_flags="-Werror"
 236                         if test "x${withval}" != "xyes"; then
 237                                 werror_flags="$withval"
 238                         fi
 239                 fi
 240         ]
 241 )
 242
 243 AC_CHECK_HEADERS( \
 244         bstring.h \
 245         crypt.h \
 246         crypto/sha2.h \
 247         dirent.h \
 248         endian.h \
 249         features.h \
 250         fcntl.h \
 251         floatingpoint.h \
 252         getopt.h \
 253         glob.h \
 254         ia.h \
 255         iaf.h \
 256         limits.h \
 257         login.h \
 258         maillock.h \
 259         ndir.h \
 260         net/if_tun.h \
 261         netdb.h \
 262         netgroup.h \
 263         pam/pam_appl.h \
 264         paths.h \
 265         poll.h \
 266         pty.h \
 267         readpassphrase.h \
 268         rpc/types.h \
 269         security/pam_appl.h \
 270         sha2.h \
 271         shadow.h \
 272         stddef.h \
 273         stdint.h \
 274         string.h \
 275         strings.h \
 276         sys/audit.h \
 277         sys/bitypes.h \
 278         sys/bsdtty.h \
 279         sys/cdefs.h \
 280         sys/dir.h \
 281         sys/mman.h \
 282         sys/mount.h \
 283         sys/ndir.h \
 284         sys/poll.h \
 285         sys/prctl.h \
 286         sys/pstat.h \
 287         sys/select.h \
 288         sys/stat.h \
 289         sys/stream.h \
 290         sys/stropts.h \
 291         sys/strtio.h \
 292         sys/statvfs.h \
 293         sys/sysmacros.h \
 294         sys/time.h \
 295         sys/timers.h \
 296         sys/un.h \
 297         time.h \
 298         tmpdir.h \
 299         ttyent.h \
 300         ucred.h \
 301         unistd.h \
 302         usersec.h \
 303         util.h \
 304         utime.h \
 305         utmp.h \
 306         utmpx.h \
 307         vis.h \
 308 )
 309
 310 # lastlog.h requires sys/time.h to be included first on Solaris
 311 AC_CHECK_HEADERS(lastlog.h, [], [], [
 312 #ifdef HAVE_SYS_TIME_H
 313 # include <sys/time.h>
 314 #endif
 315 ])
 316
 317 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 318 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 319 #ifdef HAVE_SYS_STREAM_H
 320 # include <sys/stream.h>
 321 #endif
 322 ])
 323
 324 # login_cap.h requires sys/types.h on NetBSD
 325 AC_CHECK_HEADERS(login_cap.h, [], [], [
 326 #include <sys/types.h>
 327 ])
 328
 329 # Messages for features tested for in target-specific section
 330 SIA_MSG="no"
 331 SPC_MSG="no"
 332
 333 # Check for some target-specific stuff
 334 case "$host" in
 335 *-*-aix*)
 336         # Some versions of VAC won't allow macro redefinitions at
 337         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 338         # particularly with older versions of vac or xlc.
 339         # It also throws errors about null macro argments, but these are
 340         # not fatal.
 341         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 342         AC_COMPILE_IFELSE(
 343             [AC_LANG_SOURCE([[
 344 #define testmacro foo
 345 #define testmacro bar
 346 int main(void) { exit(0); }
 347             ]])],
 348             [ AC_MSG_RESULT(yes) ],
 349             [ AC_MSG_RESULT(no)
 350               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 351               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 352               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 353               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 354             ]
 355         )
 356
 357         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 358         if (test -z "$blibpath"); then
 359                 blibpath="/usr/lib:/lib"
 360         fi
 361         saved_LDFLAGS="$LDFLAGS"
 362         if test "$GCC" = "yes"; then
 363                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 364         else
 365                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 366         fi
 367         for tryflags in $flags ;do
 368                 if (test -z "$blibflags"); then
 369                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 370                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 371                 fi
 372         done
 373         if (test -z "$blibflags"); then
 374                 AC_MSG_RESULT(not found)
 375                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 376         else
 377                 AC_MSG_RESULT($blibflags)
 378         fi
 379         LDFLAGS="$saved_LDFLAGS"
 380         dnl Check for authenticate.  Might be in libs.a on older AIXes
 381         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 382                 [Define if you want to enable AIX4's authenticate function])],
 383                 [AC_CHECK_LIB(s,authenticate,
 384                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 385                                 LIBS="$LIBS -ls"
 386                         ])
 387                 ])
 388         dnl Check for various auth function declarations in headers.
 389         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 390             passwdexpired, setauthdb], , , [#include <usersec.h>])
 391         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 392         AC_CHECK_DECLS(loginfailed,
 393                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 394                   AC_TRY_COMPILE(
 395                         [#include <usersec.h>],
 396                         [(void)loginfailed("user","host","tty",0);],
 397                         [AC_MSG_RESULT(yes)
 398                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 399                                 [Define if your AIX loginfailed() function
 400                                 takes 4 arguments (AIX >= 5.2)])],
 401                         [AC_MSG_RESULT(no)]
 402                 )],
 403                 [],
 404                 [#include <usersec.h>]
 405         )
 406         AC_CHECK_FUNCS(getgrset setauthdb)
 407         AC_CHECK_DECL(F_CLOSEM,
 408             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 409             [],
 410             [ #include <limits.h>
 411               #include <fcntl.h> ]
 412         )
 413         check_for_aix_broken_getaddrinfo=1
 414         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 415         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 416             [Define if your platform breaks doing a seteuid before a setuid])
 417         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 418         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 419         dnl AIX handles lastlog as part of its login message
 420         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 421         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 422                 [Some systems need a utmpx entry for /bin/login to work])
 423         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 424                 [Define to a Set Process Title type if your system is
 425                 supported by bsd-setproctitle.c])
 426         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 427             [AIX 5.2 and 5.3 (and presumably newer) require this])
 428         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 429         ;;
 430 *-*-cygwin*)
 431         check_for_libcrypt_later=1
 432         LIBS="$LIBS /usr/lib/textreadmode.o"
 433         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 434         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 435         AC_DEFINE(DISABLE_SHADOW, 1,
 436                 [Define if you want to disable shadow passwords])
 437         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 438                 [Define if your system choked on IP TOS setting])
 439         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 440                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 441         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 442                 [Define if the concept of ports only accessible to
 443                 superusers isn't known])
 444         AC_DEFINE(DISABLE_FD_PASSING, 1,
 445                 [Define if your platform needs to skip post auth
 446                 file descriptor passing])
 447         ;;
 448 *-*-dgux*)
 449         AC_DEFINE(IP_TOS_IS_BROKEN)
 450         AC_DEFINE(SETEUID_BREAKS_SETUID)
 451         AC_DEFINE(BROKEN_SETREUID)
 452         AC_DEFINE(BROKEN_SETREGID)
 453         ;;
 454 *-*-darwin*)
 455         AC_MSG_CHECKING(if we have working getaddrinfo)
 456         AC_TRY_RUN([#include <mach-o/dyld.h>
 457 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 458                 exit(0);
 459         else
 460                 exit(1);
 461 }], [AC_MSG_RESULT(working)],
 462         [AC_MSG_RESULT(buggy)
 463         AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
 464         [AC_MSG_RESULT(assume it is working)])
 465         AC_DEFINE(SETEUID_BREAKS_SETUID)
 466         AC_DEFINE(BROKEN_SETREUID)
 467         AC_DEFINE(BROKEN_SETREGID)
 468         AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
 469         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 470                 [Define if your resolver libs need this for getrrsetbyname])
 471         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 472         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 473             [Use tunnel device compatibility to OpenBSD])
 474         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 475             [Prepend the address family to IP tunnel traffic])
 476         m4_pattern_allow(AU_IPv)
 477         AC_CHECK_DECL(AU_IPv4, [],
 478             AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
 479             [#include <bsm/audit.h>]
 480         )
 481         ;;
 482 *-*-dragonfly*)
 483         SSHDLIBS="$SSHDLIBS -lcrypt"
 484         ;;
 485 *-*-hpux*)
 486         # first we define all of the options common to all HP-UX releases
 487         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 488         IPADDR_IN_DISPLAY=yes
 489         AC_DEFINE(USE_PIPES)
 490         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 491             [Define if your login program cannot handle end of options ("--")])
 492         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 493         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 494                 [String used in /etc/passwd to denote locked account])
 495         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 496         MAIL="/var/mail/username"
 497         LIBS="$LIBS -lsec"
 498         AC_CHECK_LIB(xnet, t_error, ,
 499             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 500
 501         # next, we define all of the options specific to major releases
 502         case "$host" in
 503         *-*-hpux10*)
 504                 if test -z "$GCC"; then
 505                         CFLAGS="$CFLAGS -Ae"
 506                 fi
 507                 ;;
 508         *-*-hpux11*)
 509                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 510                         [Define if you are using Solaris-derived PAM which
 511                         passes pam_messages to the conversation function
 512                         with an extra level of indirection])
 513                 AC_DEFINE(DISABLE_UTMP, 1,
 514                         [Define if you don't want to use utmp])
 515                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 516                 check_for_hpux_broken_getaddrinfo=1
 517                 check_for_conflicting_getspnam=1
 518                 ;;
 519         esac
 520
 521         # lastly, we define options specific to minor releases
 522         case "$host" in
 523         *-*-hpux10.26)
 524                 AC_DEFINE(HAVE_SECUREWARE, 1,
 525                         [Define if you have SecureWare-based
 526                         protected password database])
 527                 disable_ptmx_check=yes
 528                 LIBS="$LIBS -lsecpw"
 529                 ;;
 530         esac
 531         ;;
 532 *-*-irix5*)
 533         PATH="$PATH:/usr/etc"
 534         AC_DEFINE(BROKEN_INET_NTOA, 1,
 535                 [Define if you system's inet_ntoa is busted
 536                 (e.g. Irix gcc issue)])
 537         AC_DEFINE(SETEUID_BREAKS_SETUID)
 538         AC_DEFINE(BROKEN_SETREUID)
 539         AC_DEFINE(BROKEN_SETREGID)
 540         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 541                 [Define if you shouldn't strip 'tty' from your
 542                 ttyname in [uw]tmp])
 543         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 544         ;;
 545 *-*-irix6*)
 546         PATH="$PATH:/usr/etc"
 547         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 548                 [Define if you have/want arrays
 549                 (cluster-wide session managment, not C arrays)])
 550         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 551                 [Define if you want IRIX project management])
 552         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 553                 [Define if you want IRIX audit trails])
 554         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 555                 [Define if you want IRIX kernel jobs])])
 556         AC_DEFINE(BROKEN_INET_NTOA)
 557         AC_DEFINE(SETEUID_BREAKS_SETUID)
 558         AC_DEFINE(BROKEN_SETREUID)
 559         AC_DEFINE(BROKEN_SETREGID)
 560         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 561         AC_DEFINE(WITH_ABBREV_NO_TTY)
 562         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 563         ;;
 564 *-*-linux*)
 565         no_dev_ptmx=1
 566         check_for_libcrypt_later=1
 567         check_for_openpty_ctty_bug=1
 568         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 569                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 570         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 571                 [String used in /etc/passwd to denote locked account])
 572         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 573         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 574                 [Define to whatever link() returns for "not supported"
 575                 if it doesn't return EOPNOTSUPP.])
 576         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 577         AC_DEFINE(USE_BTMP)
 578         inet6_default_4in6=yes
 579         case `uname -r` in
 580         1.*|2.0.*)
 581                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 582                         [Define if cmsg_type is not passed correctly])
 583                 ;;
 584         esac
 585         # tun(4) forwarding compat code
 586         AC_CHECK_HEADERS(linux/if_tun.h)
 587         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 588                 AC_DEFINE(SSH_TUN_LINUX, 1,
 589                     [Open tunnel devices the Linux tun/tap way])
 590                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 591                     [Use tunnel device compatibility to OpenBSD])
 592                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 593                     [Prepend the address family to IP tunnel traffic])
 594         fi
 595         ;;
 596 mips-sony-bsd|mips-sony-newsos4)
 597         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 598         SONY=1
 599         ;;
 600 *-*-netbsd*)
 601         check_for_libcrypt_before=1
 602         if test "x$withval" != "xno" ; then
 603                 need_dash_r=1
 604         fi
 605         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 606         AC_CHECK_HEADER([net/if_tap.h], ,
 607             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 608         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 609             [Prepend the address family to IP tunnel traffic])
 610         ;;
 611 *-*-freebsd*)
 612         check_for_libcrypt_later=1
 613         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 614         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 615         AC_CHECK_HEADER([net/if_tap.h], ,
 616             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 617         AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need])
 618         ;;
 619 *-*-bsdi*)
 620         AC_DEFINE(SETEUID_BREAKS_SETUID)
 621         AC_DEFINE(BROKEN_SETREUID)
 622         AC_DEFINE(BROKEN_SETREGID)
 623         ;;
 624 *-next-*)
 625         conf_lastlog_location="/usr/adm/lastlog"
 626         conf_utmp_location=/etc/utmp
 627         conf_wtmp_location=/usr/adm/wtmp
 628         MAIL=/usr/spool/mail
 629         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 630         AC_DEFINE(BROKEN_REALPATH)
 631         AC_DEFINE(USE_PIPES)
 632         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 633         ;;
 634 *-*-openbsd*)
 635         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 636         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 637         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 638         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 639             [syslog_r function is safe to use in in a signal handler])
 640         ;;
 641 *-*-solaris*)
 642         if test "x$withval" != "xno" ; then
 643                 need_dash_r=1
 644         fi
 645         AC_DEFINE(PAM_SUN_CODEBASE)
 646         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 647         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 648                 [Some versions of /bin/login need the TERM supplied
 649                 on the commandline])
 650         AC_DEFINE(PAM_TTY_KLUDGE)
 651         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 652                 [Define if pam_chauthtok wants real uid set
 653                 to the unpriv'ed user])
 654         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 655         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 656         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 657                 [Define if sshd somehow reacquires a controlling TTY
 658                 after setsid()])
 659         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 660                 in case the name is longer than 8 chars])
 661         external_path_file=/etc/default/login
 662         # hardwire lastlog location (can't detect it on some versions)
 663         conf_lastlog_location="/var/adm/lastlog"
 664         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 665         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 666         if test "$sol2ver" -ge 8; then
 667                 AC_MSG_RESULT(yes)
 668                 AC_DEFINE(DISABLE_UTMP)
 669                 AC_DEFINE(DISABLE_WTMP, 1,
 670                         [Define if you don't want to use wtmp])
 671         else
 672                 AC_MSG_RESULT(no)
 673         fi
 674         AC_ARG_WITH(solaris-contracts,
 675                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 676                 [
 677                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 678                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 679                                 [Define if you have Solaris process contracts])
 680                           SSHDLIBS="$SSHDLIBS -lcontract"
 681                           AC_SUBST(SSHDLIBS)
 682                           SPC_MSG="yes" ], )
 683                 ],
 684         )
 685         ;;
 686 *-*-sunos4*)
 687         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 688         AC_CHECK_FUNCS(getpwanam)
 689         AC_DEFINE(PAM_SUN_CODEBASE)
 690         conf_utmp_location=/etc/utmp
 691         conf_wtmp_location=/var/adm/wtmp
 692         conf_lastlog_location=/var/adm/lastlog
 693         AC_DEFINE(USE_PIPES)
 694         ;;
 695 *-ncr-sysv*)
 696         LIBS="$LIBS -lc89"
 697         AC_DEFINE(USE_PIPES)
 698         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 699         AC_DEFINE(SETEUID_BREAKS_SETUID)
 700         AC_DEFINE(BROKEN_SETREUID)
 701         AC_DEFINE(BROKEN_SETREGID)
 702         ;;
 703 *-sni-sysv*)
 704         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 705         AC_CHECK_LIB(dl, dlsym, ,)
 706         # -lresolv needs to be at the end of LIBS or DNS lookups break
 707         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 708         IPADDR_IN_DISPLAY=yes
 709         AC_DEFINE(USE_PIPES)
 710         AC_DEFINE(IP_TOS_IS_BROKEN)
 711         AC_DEFINE(SETEUID_BREAKS_SETUID)
 712         AC_DEFINE(BROKEN_SETREUID)
 713         AC_DEFINE(BROKEN_SETREGID)
 714         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 715         external_path_file=/etc/default/login
 716         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 717         # Attention: always take care to bind libsocket and libnsl before libc,
 718         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 719         ;;
 720 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 721 *-*-sysv4.2*)
 722         AC_DEFINE(USE_PIPES)
 723         AC_DEFINE(SETEUID_BREAKS_SETUID)
 724         AC_DEFINE(BROKEN_SETREUID)
 725         AC_DEFINE(BROKEN_SETREGID)
 726         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 727         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 728         ;;
 729 # UnixWare 7.x, OpenUNIX 8
 730 *-*-sysv5*)
 731         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 732         AC_DEFINE(USE_PIPES)
 733         AC_DEFINE(SETEUID_BREAKS_SETUID)
 734         AC_DEFINE(BROKEN_SETREUID)
 735         AC_DEFINE(BROKEN_SETREGID)
 736         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 737         case "$host" in
 738         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 739                 TEST_SHELL=/u95/bin/sh
 740                 AC_DEFINE(BROKEN_LIBIAF, 1,
 741                         [ia_uinfo routines not supported by OS yet])
 742                 AC_DEFINE(BROKEN_UPDWTMPX)
 743                 AC_CHECK_LIB(prot, getluid,[ LIBS="$LIBS -lprot"
 744                         AC_CHECK_FUNCS(getluid setluid,,,-lprot)
 745                         AC_DEFINE(HAVE_SECUREWARE)
 746                         AC_DEFINE(DISABLE_SHADOW)
 747                         ],,)
 748                 ;;
 749         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 750                 check_for_libcrypt_later=1
 751                 ;;
 752         esac
 753         ;;
 754 *-*-sysv*)
 755         ;;
 756 # SCO UNIX and OEM versions of SCO UNIX
 757 *-*-sco3.2v4*)
 758         AC_MSG_ERROR("This Platform is no longer supported.")
 759         ;;
 760 # SCO OpenServer 5.x
 761 *-*-sco3.2v5*)
 762         if test -z "$GCC"; then
 763                 CFLAGS="$CFLAGS -belf"
 764         fi
 765         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 766         no_dev_ptmx=1
 767         AC_DEFINE(USE_PIPES)
 768         AC_DEFINE(HAVE_SECUREWARE)
 769         AC_DEFINE(DISABLE_SHADOW)
 770         AC_DEFINE(DISABLE_FD_PASSING)
 771         AC_DEFINE(SETEUID_BREAKS_SETUID)
 772         AC_DEFINE(BROKEN_SETREUID)
 773         AC_DEFINE(BROKEN_SETREGID)
 774         AC_DEFINE(WITH_ABBREV_NO_TTY)
 775         AC_DEFINE(BROKEN_UPDWTMPX)
 776         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 777         AC_CHECK_FUNCS(getluid setluid)
 778         MANTYPE=man
 779         TEST_SHELL=ksh
 780         ;;
 781 *-*-unicosmk*)
 782         AC_DEFINE(NO_SSH_LASTLOG, 1,
 783                 [Define if you don't want to use lastlog in session.c])
 784         AC_DEFINE(SETEUID_BREAKS_SETUID)
 785         AC_DEFINE(BROKEN_SETREUID)
 786         AC_DEFINE(BROKEN_SETREGID)
 787         AC_DEFINE(USE_PIPES)
 788         AC_DEFINE(DISABLE_FD_PASSING)
 789         LDFLAGS="$LDFLAGS"
 790         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 791         MANTYPE=cat
 792         ;;
 793 *-*-unicosmp*)
 794         AC_DEFINE(SETEUID_BREAKS_SETUID)
 795         AC_DEFINE(BROKEN_SETREUID)
 796         AC_DEFINE(BROKEN_SETREGID)
 797         AC_DEFINE(WITH_ABBREV_NO_TTY)
 798         AC_DEFINE(USE_PIPES)
 799         AC_DEFINE(DISABLE_FD_PASSING)
 800         LDFLAGS="$LDFLAGS"
 801         LIBS="$LIBS -lgen -lacid -ldb"
 802         MANTYPE=cat
 803         ;;
 804 *-*-unicos*)
 805         AC_DEFINE(SETEUID_BREAKS_SETUID)
 806         AC_DEFINE(BROKEN_SETREUID)
 807         AC_DEFINE(BROKEN_SETREGID)
 808         AC_DEFINE(USE_PIPES)
 809         AC_DEFINE(DISABLE_FD_PASSING)
 810         AC_DEFINE(NO_SSH_LASTLOG)
 811         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 812         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 813         MANTYPE=cat
 814         ;;
 815 *-dec-osf*)
 816         AC_MSG_CHECKING(for Digital Unix SIA)
 817         no_osfsia=""
 818         AC_ARG_WITH(osfsia,
 819                 [  --with-osfsia           Enable Digital Unix SIA],
 820                 [
 821                         if test "x$withval" = "xno" ; then
 822                                 AC_MSG_RESULT(disabled)
 823                                 no_osfsia=1
 824                         fi
 825                 ],
 826         )
 827         if test -z "$no_osfsia" ; then
 828                 if test -f /etc/sia/matrix.conf; then
 829                         AC_MSG_RESULT(yes)
 830                         AC_DEFINE(HAVE_OSF_SIA, 1,
 831                                 [Define if you have Digital Unix Security
 832                                 Integration Architecture])
 833                         AC_DEFINE(DISABLE_LOGIN, 1,
 834                                 [Define if you don't want to use your
 835                                 system's login() call])
 836                         AC_DEFINE(DISABLE_FD_PASSING)
 837                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 838                         SIA_MSG="yes"
 839                 else
 840                         AC_MSG_RESULT(no)
 841                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 842                           [String used in /etc/passwd to denote locked account])
 843                 fi
 844         fi
 845         AC_DEFINE(BROKEN_GETADDRINFO)
 846         AC_DEFINE(SETEUID_BREAKS_SETUID)
 847         AC_DEFINE(BROKEN_SETREUID)
 848         AC_DEFINE(BROKEN_SETREGID)
 849         AC_DEFINE(BROKEN_READV_COMPARISON, 1, [Can't do comparisons on readv])
 850         ;;
 851
 852 *-*-nto-qnx*)
 853         AC_DEFINE(USE_PIPES)
 854         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 855         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 856         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 857         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 858         AC_DEFINE(DISABLE_LASTLOG)
 859         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 860         AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
 861         enable_etc_default_login=no     # has incompatible /etc/default/login
 862         case "$host" in
 863         *-*-nto-qnx6*)
 864                 AC_DEFINE(DISABLE_FD_PASSING)
 865                 ;;
 866         esac
 867         ;;
 868
 869 *-*-ultrix*)
 870         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 871         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 872         AC_DEFINE(NEED_SETPGRP)
 873         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 874         ;;
 875
 876 *-*-lynxos)
 877         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 878         AC_DEFINE(MISSING_HOWMANY)
 879         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 880         ;;
 881 esac
 882
 883 AC_MSG_CHECKING(compiler and flags for sanity)
 884 AC_RUN_IFELSE(
 885         [AC_LANG_SOURCE([
 886 #include <stdio.h>
 887 int main(){exit(0);}
 888         ])],
 889         [       AC_MSG_RESULT(yes) ],
 890         [
 891                 AC_MSG_RESULT(no)
 892                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 893         ],
 894         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 895 )
 896
 897 dnl Checks for header files.
 898 # Checks for libraries.
 899 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 900 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 901
 902 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 903 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 904         AC_CHECK_LIB(gen, dirname,[
 905                 AC_CACHE_CHECK([for broken dirname],
 906                         ac_cv_have_broken_dirname, [
 907                         save_LIBS="$LIBS"
 908                         LIBS="$LIBS -lgen"
 909                         AC_RUN_IFELSE(
 910                                 [AC_LANG_SOURCE([[
 911 #include <libgen.h>
 912 #include <string.h>
 913
 914 int main(int argc, char **argv) {
 915     char *s, buf[32];
 916
 917     strncpy(buf,"/etc", 32);
 918     s = dirname(buf);
 919     if (!s || strncmp(s, "/", 32) != 0) {
 920         exit(1);
 921     } else {
 922         exit(0);
 923     }
 924 }
 925                                 ]])],
 926                                 [ ac_cv_have_broken_dirname="no" ],
 927                                 [ ac_cv_have_broken_dirname="yes" ],
 928                                 [ ac_cv_have_broken_dirname="no" ],
 929                         )
 930                         LIBS="$save_LIBS"
 931                 ])
 932                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 933                         LIBS="$LIBS -lgen"
 934                         AC_DEFINE(HAVE_DIRNAME)
 935                         AC_CHECK_HEADERS(libgen.h)
 936                 fi
 937         ])
 938 ])
 939
 940 AC_CHECK_FUNC(getspnam, ,
 941         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 942 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 943         [Define if you have the basename function.]))
 944
 945 dnl zlib is required
 946 AC_ARG_WITH(zlib,
 947         [  --with-zlib=PATH        Use zlib in PATH],
 948         [ if test "x$withval" = "xno" ; then
 949                 AC_MSG_ERROR([*** zlib is required ***])
 950           elif test "x$withval" != "xyes"; then
 951                 if test -d "$withval/lib"; then
 952                         if test -n "${need_dash_r}"; then
 953                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 954                         else
 955                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 956                         fi
 957                 else
 958                         if test -n "${need_dash_r}"; then
 959                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 960                         else
 961                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 962                         fi
 963                 fi
 964                 if test -d "$withval/include"; then
 965                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 966                 else
 967                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 968                 fi
 969         fi ]
 970 )
 971
 972 AC_CHECK_LIB(z, deflate, ,
 973         [
 974                 saved_CPPFLAGS="$CPPFLAGS"
 975                 saved_LDFLAGS="$LDFLAGS"
 976                 save_LIBS="$LIBS"
 977                 dnl Check default zlib install dir
 978                 if test -n "${need_dash_r}"; then
 979                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 980                 else
 981                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 982                 fi
 983                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 984                 LIBS="$LIBS -lz"
 985                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 986                         [
 987                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
 988                         ]
 989                 )
 990         ]
 991 )
 992 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 993
 994 AC_ARG_WITH(zlib-version-check,
 995         [  --without-zlib-version-check Disable zlib version check],
 996         [  if test "x$withval" = "xno" ; then
 997                 zlib_check_nonfatal=1
 998            fi
 999         ]
1000 )
1001
1002 AC_MSG_CHECKING(for possibly buggy zlib)
1003 AC_RUN_IFELSE([AC_LANG_SOURCE([[
1004 #include <stdio.h>
1005 #include <zlib.h>
1006 int main()
1007 {
1008         int a=0, b=0, c=0, d=0, n, v;
1009         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1010         if (n != 3 && n != 4)
1011                 exit(1);
1012         v = a*1000000 + b*10000 + c*100 + d;
1013         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1014
1015         /* 1.1.4 is OK */
1016         if (a == 1 && b == 1 && c >= 4)
1017                 exit(0);
1018
1019         /* 1.2.3 and up are OK */
1020         if (v >= 1020300)
1021                 exit(0);
1022
1023         exit(2);
1024 }
1025         ]])],
1026         AC_MSG_RESULT(no),
1027         [ AC_MSG_RESULT(yes)
1028           if test -z "$zlib_check_nonfatal" ; then
1029                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1030 Your reported zlib version has known security problems.  It's possible your
1031 vendor has fixed these problems without changing the version number.  If you
1032 are sure this is the case, you can disable the check by running
1033 "./configure --without-zlib-version-check".
1034 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1035 See http://www.gzip.org/zlib/ for details.])
1036           else
1037                 AC_MSG_WARN([zlib version may have security problems])
1038           fi
1039         ],
1040         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1041 )
1042
1043 dnl UnixWare 2.x
1044 AC_CHECK_FUNC(strcasecmp,
1045         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
1046 )
1047 AC_CHECK_FUNCS(utimes,
1048         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
1049                                         LIBS="$LIBS -lc89"]) ]
1050 )
1051
1052 dnl    Checks for libutil functions
1053 AC_CHECK_HEADERS(libutil.h)
1054 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
1055         [Define if your libraries define login()])])
1056 AC_CHECK_FUNCS(fmt_scaled logout updwtmp logwtmp)
1057
1058 AC_FUNC_STRFTIME
1059
1060 # Check for ALTDIRFUNC glob() extension
1061 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
1062 AC_EGREP_CPP(FOUNDIT,
1063         [
1064                 #include <glob.h>
1065                 #ifdef GLOB_ALTDIRFUNC
1066                 FOUNDIT
1067                 #endif
1068         ],
1069         [
1070                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
1071                         [Define if your system glob() function has
1072                         the GLOB_ALTDIRFUNC extension])
1073                 AC_MSG_RESULT(yes)
1074         ],
1075         [
1076                 AC_MSG_RESULT(no)
1077         ]
1078 )
1079
1080 # Check for g.gl_matchc glob() extension
1081 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1082 AC_TRY_COMPILE(
1083         [ #include <glob.h> ],
1084         [glob_t g; g.gl_matchc = 1;],
1085         [
1086                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1087                         [Define if your system glob() function has
1088                         gl_matchc options in glob_t])
1089                 AC_MSG_RESULT(yes)
1090         ],
1091         [
1092                 AC_MSG_RESULT(no)
1093         ]
1094 )
1095
1096 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1097
1098 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1099 AC_RUN_IFELSE(
1100         [AC_LANG_SOURCE([[
1101 #include <sys/types.h>
1102 #include <dirent.h>
1103 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1104         ]])],
1105         [AC_MSG_RESULT(yes)],
1106         [
1107                 AC_MSG_RESULT(no)
1108                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1109                         [Define if your struct dirent expects you to
1110                         allocate extra space for d_name])
1111         ],
1112         [
1113                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1114                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1115         ]
1116 )
1117
1118 AC_MSG_CHECKING([for /proc/pid/fd directory])
1119 if test -d "/proc/$$/fd" ; then
1120         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1121         AC_MSG_RESULT(yes)
1122 else
1123         AC_MSG_RESULT(no)
1124 fi
1125
1126 # Check whether user wants S/Key support
1127 SKEY_MSG="no"
1128 AC_ARG_WITH(skey,
1129         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1130         [
1131                 if test "x$withval" != "xno" ; then
1132
1133                         if test "x$withval" != "xyes" ; then
1134                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1135                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1136                         fi
1137
1138                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1139                         LIBS="-lskey $LIBS"
1140                         SKEY_MSG="yes"
1141
1142                         AC_MSG_CHECKING([for s/key support])
1143                         AC_LINK_IFELSE(
1144                                 [AC_LANG_SOURCE([[
1145 #include <stdio.h>
1146 #include <skey.h>
1147 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1148                                 ]])],
1149                                 [AC_MSG_RESULT(yes)],
1150                                 [
1151                                         AC_MSG_RESULT(no)
1152                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1153                                 ])
1154                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1155                         AC_TRY_COMPILE(
1156                                 [#include <stdio.h>
1157                                  #include <skey.h>],
1158                                 [(void)skeychallenge(NULL,"name","",0);],
1159                                 [AC_MSG_RESULT(yes)
1160                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1161                                         [Define if your skeychallenge()
1162                                         function takes 4 arguments (NetBSD)])],
1163                                 [AC_MSG_RESULT(no)]
1164                         )
1165                 fi
1166         ]
1167 )
1168
1169 # Check whether user wants TCP wrappers support
1170 TCPW_MSG="no"
1171 AC_ARG_WITH(tcp-wrappers,
1172         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1173         [
1174                 if test "x$withval" != "xno" ; then
1175                         saved_LIBS="$LIBS"
1176                         saved_LDFLAGS="$LDFLAGS"
1177                         saved_CPPFLAGS="$CPPFLAGS"
1178                         if test -n "${withval}" && \
1179                             test "x${withval}" != "xyes"; then
1180                                 if test -d "${withval}/lib"; then
1181                                         if test -n "${need_dash_r}"; then
1182                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1183                                         else
1184                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1185                                         fi
1186                                 else
1187                                         if test -n "${need_dash_r}"; then
1188                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1189                                         else
1190                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1191                                         fi
1192                                 fi
1193                                 if test -d "${withval}/include"; then
1194                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1195                                 else
1196                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1197                                 fi
1198                         fi
1199                         LIBS="-lwrap $LIBS"
1200                         AC_MSG_CHECKING(for libwrap)
1201                         AC_TRY_LINK(
1202                                 [
1203 #include <sys/types.h>
1204 #include <sys/socket.h>
1205 #include <netinet/in.h>
1206 #include <tcpd.h>
1207                                         int deny_severity = 0, allow_severity = 0;
1208                                 ],
1209                                 [hosts_access(0);],
1210                                 [
1211                                         AC_MSG_RESULT(yes)
1212                                         AC_DEFINE(LIBWRAP, 1,
1213                                                 [Define if you want
1214                                                 TCP Wrappers support])
1215                                         SSHDLIBS="$SSHDLIBS -lwrap"
1216                                         TCPW_MSG="yes"
1217                                 ],
1218                                 [
1219                                         AC_MSG_ERROR([*** libwrap missing])
1220                                 ]
1221                         )
1222                         LIBS="$saved_LIBS"
1223                 fi
1224         ]
1225 )
1226
1227 # Check whether user wants libedit support
1228 LIBEDIT_MSG="no"
1229 AC_ARG_WITH(libedit,
1230         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1231         [ if test "x$withval" != "xno" ; then
1232                 if test "x$withval" != "xyes"; then
1233                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1234                         if test -n "${need_dash_r}"; then
1235                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1236                         else
1237                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1238                         fi
1239                 fi
1240                 AC_CHECK_LIB(edit, el_init,
1241                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1242                           LIBEDIT="-ledit -lcurses"
1243                           LIBEDIT_MSG="yes"
1244                           AC_SUBST(LIBEDIT)
1245                         ],
1246                         [ AC_MSG_ERROR(libedit not found) ],
1247                         [ -lcurses ]
1248                 )
1249                 AC_MSG_CHECKING(if libedit version is compatible)
1250                 AC_COMPILE_IFELSE(
1251                     [AC_LANG_SOURCE([[
1252 #include <histedit.h>
1253 int main(void)
1254 {
1255         int i = H_SETSIZE;
1256         el_init("", NULL, NULL, NULL);
1257         exit(0);
1258 }
1259                     ]])],
1260                     [ AC_MSG_RESULT(yes) ],
1261                     [ AC_MSG_RESULT(no)
1262                       AC_MSG_ERROR(libedit version is not compatible) ]
1263                 )
1264         fi ]
1265 )
1266
1267 AUDIT_MODULE=none
1268 AC_ARG_WITH(audit,
1269         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1270         [
1271           AC_MSG_CHECKING(for supported audit module)
1272           case "$withval" in
1273           bsm)
1274                 AC_MSG_RESULT(bsm)
1275                 AUDIT_MODULE=bsm
1276                 dnl    Checks for headers, libs and functions
1277                 AC_CHECK_HEADERS(bsm/audit.h, [],
1278                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1279                     [
1280 #ifdef HAVE_TIME_H
1281 # include <time.h>
1282 #endif
1283                     ]
1284 )
1285                 AC_CHECK_LIB(bsm, getaudit, [],
1286                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1287                 AC_CHECK_FUNCS(getaudit, [],
1288                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1289                 # These are optional
1290                 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1291                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1292                 ;;
1293           debug)
1294                 AUDIT_MODULE=debug
1295                 AC_MSG_RESULT(debug)
1296                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1297                 ;;
1298           no)
1299                 AC_MSG_RESULT(no)
1300                 ;;
1301           *)
1302                 AC_MSG_ERROR([Unknown audit module $withval])
1303                 ;;
1304         esac ]
1305 )
1306
1307 dnl    Checks for library functions. Please keep in alphabetical order
1308 AC_CHECK_FUNCS( \
1309         arc4random \
1310         arc4random_buf \
1311         arc4random_uniform \
1312         asprintf \
1313         b64_ntop \
1314         __b64_ntop \
1315         b64_pton \
1316         __b64_pton \
1317         bcopy \
1318         bindresvport_sa \
1319         clock \
1320         closefrom \
1321         dirfd \
1322         fchmod \
1323         fchown \
1324         freeaddrinfo \
1325         fstatvfs \
1326         futimes \
1327         getaddrinfo \
1328         getcwd \
1329         getgrouplist \
1330         getnameinfo \
1331         getopt \
1332         getpeereid \
1333         getpeerucred \
1334         _getpty \
1335         getrlimit \
1336         getttyent \
1337         glob \
1338         inet_aton \
1339         inet_ntoa \
1340         inet_ntop \
1341         innetgr \
1342         login_getcapbool \
1343         md5_crypt \
1344         memmove \
1345         mkdtemp \
1346         mmap \
1347         ngetaddrinfo \
1348         nsleep \
1349         ogetaddrinfo \
1350         openlog_r \
1351         openpty \
1352         poll \
1353         prctl \
1354         pstat \
1355         readpassphrase \
1356         realpath \
1357         recvmsg \
1358         rresvport_af \
1359         sendmsg \
1360         setdtablesize \
1361         setegid \
1362         setenv \
1363         seteuid \
1364         setgroups \
1365         setlogin \
1366         setpcred \
1367         setproctitle \
1368         setregid \
1369         setreuid \
1370         setrlimit \
1371         setsid \
1372         setvbuf \
1373         sigaction \
1374         sigvec \
1375         snprintf \
1376         socketpair \
1377         statfs \
1378         statvfs \
1379         strdup \
1380         strerror \
1381         strlcat \
1382         strlcpy \
1383         strmode \
1384         strnvis \
1385         strtonum \
1386         strtoll \
1387         strtoul \
1388         swap32 \
1389         sysconf \
1390         tcgetpgrp \
1391         truncate \
1392         unsetenv \
1393         updwtmpx \
1394         vasprintf \
1395         vhangup \
1396         vsnprintf \
1397         waitpid \
1398 )
1399
1400 # IRIX has a const char return value for gai_strerror()
1401 AC_CHECK_FUNCS(gai_strerror,[
1402         AC_DEFINE(HAVE_GAI_STRERROR)
1403         AC_TRY_COMPILE([
1404 #include <sys/types.h>
1405 #include <sys/socket.h>
1406 #include <netdb.h>
1407
1408 const char *gai_strerror(int);],[
1409 char *str;
1410
1411 str = gai_strerror(0);],[
1412                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1413                 [Define if gai_strerror() returns const char *])])])
1414
1415 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1416         [Some systems put nanosleep outside of libc]))
1417
1418 dnl Make sure prototypes are defined for these before using them.
1419 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1420 AC_CHECK_DECL(strsep,
1421         [AC_CHECK_FUNCS(strsep)],
1422         [],
1423         [
1424 #ifdef HAVE_STRING_H
1425 # include <string.h>
1426 #endif
1427         ])
1428
1429 dnl tcsendbreak might be a macro
1430 AC_CHECK_DECL(tcsendbreak,
1431         [AC_DEFINE(HAVE_TCSENDBREAK)],
1432         [AC_CHECK_FUNCS(tcsendbreak)],
1433         [#include <termios.h>]
1434 )
1435
1436 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1437
1438 AC_CHECK_DECLS(SHUT_RD, , ,
1439         [
1440 #include <sys/types.h>
1441 #include <sys/socket.h>
1442         ])
1443
1444 AC_CHECK_DECLS(O_NONBLOCK, , ,
1445         [
1446 #include <sys/types.h>
1447 #ifdef HAVE_SYS_STAT_H
1448 # include <sys/stat.h>
1449 #endif
1450 #ifdef HAVE_FCNTL_H
1451 # include <fcntl.h>
1452 #endif
1453         ])
1454
1455 AC_CHECK_DECLS(writev, , , [
1456 #include <sys/types.h>
1457 #include <sys/uio.h>
1458 #include <unistd.h>
1459         ])
1460
1461 AC_CHECK_DECLS(MAXSYMLINKS, , , [
1462 #include <sys/param.h>
1463         ])
1464
1465 AC_CHECK_DECLS(offsetof, , , [
1466 #include <stddef.h>
1467         ])
1468
1469 AC_CHECK_FUNCS(setresuid, [
1470         dnl Some platorms have setresuid that isn't implemented, test for this
1471         AC_MSG_CHECKING(if setresuid seems to work)
1472         AC_RUN_IFELSE(
1473                 [AC_LANG_SOURCE([[
1474 #include <stdlib.h>
1475 #include <errno.h>
1476 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1477                 ]])],
1478                 [AC_MSG_RESULT(yes)],
1479                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1480                         [Define if your setresuid() is broken])
1481                  AC_MSG_RESULT(not implemented)],
1482                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1483         )
1484 ])
1485
1486 AC_CHECK_FUNCS(setresgid, [
1487         dnl Some platorms have setresgid that isn't implemented, test for this
1488         AC_MSG_CHECKING(if setresgid seems to work)
1489         AC_RUN_IFELSE(
1490                 [AC_LANG_SOURCE([[
1491 #include <stdlib.h>
1492 #include <errno.h>
1493 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1494                 ]])],
1495                 [AC_MSG_RESULT(yes)],
1496                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1497                         [Define if your setresgid() is broken])
1498                  AC_MSG_RESULT(not implemented)],
1499                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1500         )
1501 ])
1502
1503 dnl    Checks for time functions
1504 AC_CHECK_FUNCS(gettimeofday time)
1505 dnl    Checks for utmp functions
1506 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1507 AC_CHECK_FUNCS(utmpname)
1508 dnl    Checks for utmpx functions
1509 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1510 AC_CHECK_FUNCS(setutxent utmpxname)
1511
1512 AC_CHECK_FUNC(daemon,
1513         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1514         [AC_CHECK_LIB(bsd, daemon,
1515                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1516 )
1517
1518 AC_CHECK_FUNC(getpagesize,
1519         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1520                 [Define if your libraries define getpagesize()])],
1521         [AC_CHECK_LIB(ucb, getpagesize,
1522                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1523 )
1524
1525 # Check for broken snprintf
1526 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1527         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1528         AC_RUN_IFELSE(
1529                 [AC_LANG_SOURCE([[
1530 #include <stdio.h>
1531 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1532                 ]])],
1533                 [AC_MSG_RESULT(yes)],
1534                 [
1535                         AC_MSG_RESULT(no)
1536                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1537                                 [Define if your snprintf is busted])
1538                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1539                 ],
1540                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1541         )
1542 fi
1543
1544 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1545 # returning the right thing on overflow: the number of characters it tried to
1546 # create (as per SUSv3)
1547 if test "x$ac_cv_func_asprintf" != "xyes" && \
1548    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1549         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1550         AC_RUN_IFELSE(
1551                 [AC_LANG_SOURCE([[
1552 #include <sys/types.h>
1553 #include <stdio.h>
1554 #include <stdarg.h>
1555
1556 int x_snprintf(char *str,size_t count,const char *fmt,...)
1557 {
1558         size_t ret; va_list ap;
1559         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1560         return ret;
1561 }
1562 int main(void)
1563 {
1564         char x[1];
1565         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1566 } ]])],
1567                 [AC_MSG_RESULT(yes)],
1568                 [
1569                         AC_MSG_RESULT(no)
1570                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1571                                 [Define if your snprintf is busted])
1572                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1573                 ],
1574                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1575         )
1576 fi
1577
1578 # On systems where [v]snprintf is broken, but is declared in stdio,
1579 # check that the fmt argument is const char * or just char *.
1580 # This is only useful for when BROKEN_SNPRINTF
1581 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1582 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1583            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1584            int main(void) { snprintf(0, 0, 0); }
1585     ]])],
1586    [AC_MSG_RESULT(yes)
1587     AC_DEFINE(SNPRINTF_CONST, [const],
1588               [Define as const if snprintf() can declare const char *fmt])],
1589    [AC_MSG_RESULT(no)
1590     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1591
1592 # Check for missing getpeereid (or equiv) support
1593 NO_PEERCHECK=""
1594 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
1595         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1596         AC_TRY_COMPILE(
1597                 [#include <sys/types.h>
1598                  #include <sys/socket.h>],
1599                 [int i = SO_PEERCRED;],
1600                 [ AC_MSG_RESULT(yes)
1601                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1602                 ],
1603                 [AC_MSG_RESULT(no)
1604                 NO_PEERCHECK=1]
1605         )
1606 fi
1607
1608 dnl see whether mkstemp() requires XXXXXX
1609 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1610 AC_MSG_CHECKING([for (overly) strict mkstemp])
1611 AC_RUN_IFELSE(
1612         [AC_LANG_SOURCE([[
1613 #include <stdlib.h>
1614 main() { char template[]="conftest.mkstemp-test";
1615 if (mkstemp(template) == -1)
1616         exit(1);
1617 unlink(template); exit(0);
1618 }
1619         ]])],
1620         [
1621                 AC_MSG_RESULT(no)
1622         ],
1623         [
1624                 AC_MSG_RESULT(yes)
1625                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1626         ],
1627         [
1628                 AC_MSG_RESULT(yes)
1629                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1630         ]
1631 )
1632 fi
1633
1634 dnl make sure that openpty does not reacquire controlling terminal
1635 if test ! -z "$check_for_openpty_ctty_bug"; then
1636         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1637         AC_RUN_IFELSE(
1638                 [AC_LANG_SOURCE([[
1639 #include <stdio.h>
1640 #include <sys/fcntl.h>
1641 #include <sys/types.h>
1642 #include <sys/wait.h>
1643
1644 int
1645 main()
1646 {
1647         pid_t pid;
1648         int fd, ptyfd, ttyfd, status;
1649
1650         pid = fork();
1651         if (pid < 0) {          /* failed */
1652                 exit(1);
1653         } else if (pid > 0) {   /* parent */
1654                 waitpid(pid, &status, 0);
1655                 if (WIFEXITED(status))
1656                         exit(WEXITSTATUS(status));
1657                 else
1658                         exit(2);
1659         } else {                /* child */
1660                 close(0); close(1); close(2);
1661                 setsid();
1662                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1663                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1664                 if (fd >= 0)
1665                         exit(3);        /* Acquired ctty: broken */
1666                 else
1667                         exit(0);        /* Did not acquire ctty: OK */
1668         }
1669 }
1670                 ]])],
1671                 [
1672                         AC_MSG_RESULT(yes)
1673                 ],
1674                 [
1675                         AC_MSG_RESULT(no)
1676                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1677                 ],
1678                 [
1679                         AC_MSG_RESULT(cross-compiling, assuming yes)
1680                 ]
1681         )
1682 fi
1683
1684 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1685     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1686         AC_MSG_CHECKING(if getaddrinfo seems to work)
1687         AC_RUN_IFELSE(
1688                 [AC_LANG_SOURCE([[
1689 #include <stdio.h>
1690 #include <sys/socket.h>
1691 #include <netdb.h>
1692 #include <errno.h>
1693 #include <netinet/in.h>
1694
1695 #define TEST_PORT "2222"
1696
1697 int
1698 main(void)
1699 {
1700         int err, sock;
1701         struct addrinfo *gai_ai, *ai, hints;
1702         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1703
1704         memset(&hints, 0, sizeof(hints));
1705         hints.ai_family = PF_UNSPEC;
1706         hints.ai_socktype = SOCK_STREAM;
1707         hints.ai_flags = AI_PASSIVE;
1708
1709         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1710         if (err != 0) {
1711                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1712                 exit(1);
1713         }
1714
1715         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1716                 if (ai->ai_family != AF_INET6)
1717                         continue;
1718
1719                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1720                     sizeof(ntop), strport, sizeof(strport),
1721                     NI_NUMERICHOST|NI_NUMERICSERV);
1722
1723                 if (err != 0) {
1724                         if (err == EAI_SYSTEM)
1725                                 perror("getnameinfo EAI_SYSTEM");
1726                         else
1727                                 fprintf(stderr, "getnameinfo failed: %s\n",
1728                                     gai_strerror(err));
1729                         exit(2);
1730                 }
1731
1732                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1733                 if (sock < 0)
1734                         perror("socket");
1735                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1736                         if (errno == EBADF)
1737                                 exit(3);
1738                 }
1739         }
1740         exit(0);
1741 }
1742                 ]])],
1743                 [
1744                         AC_MSG_RESULT(yes)
1745                 ],
1746                 [
1747                         AC_MSG_RESULT(no)
1748                         AC_DEFINE(BROKEN_GETADDRINFO)
1749                 ],
1750                 [
1751                         AC_MSG_RESULT(cross-compiling, assuming yes)
1752                 ]
1753         )
1754 fi
1755
1756 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1757     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1758         AC_MSG_CHECKING(if getaddrinfo seems to work)
1759         AC_RUN_IFELSE(
1760                 [AC_LANG_SOURCE([[
1761 #include <stdio.h>
1762 #include <sys/socket.h>
1763 #include <netdb.h>
1764 #include <errno.h>
1765 #include <netinet/in.h>
1766
1767 #define TEST_PORT "2222"
1768
1769 int
1770 main(void)
1771 {
1772         int err, sock;
1773         struct addrinfo *gai_ai, *ai, hints;
1774         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1775
1776         memset(&hints, 0, sizeof(hints));
1777         hints.ai_family = PF_UNSPEC;
1778         hints.ai_socktype = SOCK_STREAM;
1779         hints.ai_flags = AI_PASSIVE;
1780
1781         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1782         if (err != 0) {
1783                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1784                 exit(1);
1785         }
1786
1787         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1788                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1789                         continue;
1790
1791                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1792                     sizeof(ntop), strport, sizeof(strport),
1793                     NI_NUMERICHOST|NI_NUMERICSERV);
1794
1795                 if (ai->ai_family == AF_INET && err != 0) {
1796                         perror("getnameinfo");
1797                         exit(2);
1798                 }
1799         }
1800         exit(0);
1801 }
1802                 ]])],
1803                 [
1804                         AC_MSG_RESULT(yes)
1805                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1806                                 [Define if you have a getaddrinfo that fails
1807                                 for the all-zeros IPv6 address])
1808                 ],
1809                 [
1810                         AC_MSG_RESULT(no)
1811                         AC_DEFINE(BROKEN_GETADDRINFO)
1812                 ],
1813                 [
1814                         AC_MSG_RESULT(cross-compiling, assuming no)
1815                 ]
1816         )
1817 fi
1818
1819 if test "x$check_for_conflicting_getspnam" = "x1"; then
1820         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1821         AC_COMPILE_IFELSE(
1822                 [
1823 #include <shadow.h>
1824 int main(void) {exit(0);}
1825                 ],
1826                 [
1827                         AC_MSG_RESULT(no)
1828                 ],
1829                 [
1830                         AC_MSG_RESULT(yes)
1831                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1832                             [Conflicting defs for getspnam])
1833                 ]
1834         )
1835 fi
1836
1837 AC_FUNC_GETPGRP
1838
1839 # Search for OpenSSL
1840 saved_CPPFLAGS="$CPPFLAGS"
1841 saved_LDFLAGS="$LDFLAGS"
1842 AC_ARG_WITH(ssl-dir,
1843         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1844         [
1845                 if test "x$withval" != "xno" ; then
1846                         case "$withval" in
1847                                 # Relative paths
1848                                 ./*|../*)       withval="`pwd`/$withval"
1849                         esac
1850                         if test -d "$withval/lib"; then
1851                                 if test -n "${need_dash_r}"; then
1852                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1853                                 else
1854                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1855                                 fi
1856                         else
1857                                 if test -n "${need_dash_r}"; then
1858                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1859                                 else
1860                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1861                                 fi
1862                         fi
1863                         if test -d "$withval/include"; then
1864                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1865                         else
1866                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1867                         fi
1868                 fi
1869         ]
1870 )
1871 LIBS="-lcrypto $LIBS"
1872 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1873         [Define if your ssl headers are included
1874         with #include <openssl/header.h>]),
1875         [
1876                 dnl Check default openssl install dir
1877                 if test -n "${need_dash_r}"; then
1878                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1879                 else
1880                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1881                 fi
1882                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1883                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1884                         [
1885                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
1886                         ]
1887                 )
1888         ]
1889 )
1890
1891 # Determine OpenSSL header version
1892 AC_MSG_CHECKING([OpenSSL header version])
1893 AC_RUN_IFELSE(
1894         [AC_LANG_SOURCE([[
1895 #include <stdio.h>
1896 #include <string.h>
1897 #include <openssl/opensslv.h>
1898 #define DATA "conftest.sslincver"
1899 int main(void) {
1900         FILE *fd;
1901         int rc;
1902
1903         fd = fopen(DATA,"w");
1904         if(fd == NULL)
1905                 exit(1);
1906
1907         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
1908                 exit(1);
1909
1910         exit(0);
1911 }
1912         ]])],
1913         [
1914                 ssl_header_ver=`cat conftest.sslincver`
1915                 AC_MSG_RESULT($ssl_header_ver)
1916         ],
1917         [
1918                 AC_MSG_RESULT(not found)
1919                 AC_MSG_ERROR(OpenSSL version header not found.)
1920         ],
1921         [
1922                 AC_MSG_WARN([cross compiling: not checking])
1923         ]
1924 )
1925
1926 # Determine OpenSSL library version
1927 AC_MSG_CHECKING([OpenSSL library version])
1928 AC_RUN_IFELSE(
1929         [AC_LANG_SOURCE([[
1930 #include <stdio.h>
1931 #include <string.h>
1932 #include <openssl/opensslv.h>
1933 #include <openssl/crypto.h>
1934 #define DATA "conftest.ssllibver"
1935 int main(void) {
1936         FILE *fd;
1937         int rc;
1938
1939         fd = fopen(DATA,"w");
1940         if(fd == NULL)
1941                 exit(1);
1942
1943         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
1944                 exit(1);
1945
1946         exit(0);
1947 }
1948         ]])],
1949         [
1950                 ssl_library_ver=`cat conftest.ssllibver`
1951                 AC_MSG_RESULT($ssl_library_ver)
1952         ],
1953         [
1954                 AC_MSG_RESULT(not found)
1955                 AC_MSG_ERROR(OpenSSL library not found.)
1956         ],
1957         [
1958                 AC_MSG_WARN([cross compiling: not checking])
1959         ]
1960 )
1961
1962 AC_ARG_WITH(openssl-header-check,
1963         [  --without-openssl-header-check Disable OpenSSL version consistency check],
1964         [  if test "x$withval" = "xno" ; then
1965                 openssl_check_nonfatal=1
1966            fi
1967         ]
1968 )
1969
1970 # Sanity check OpenSSL headers
1971 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
1972 AC_RUN_IFELSE(
1973         [AC_LANG_SOURCE([[
1974 #include <string.h>
1975 #include <openssl/opensslv.h>
1976 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
1977         ]])],
1978         [
1979                 AC_MSG_RESULT(yes)
1980         ],
1981         [
1982                 AC_MSG_RESULT(no)
1983                 if test "x$openssl_check_nonfatal" = "x"; then
1984                         AC_MSG_ERROR([Your OpenSSL headers do not match your
1985 library. Check config.log for details.
1986 If you are sure your installation is consistent, you can disable the check
1987 by running "./configure --without-openssl-header-check".
1988 Also see contrib/findssl.sh for help identifying header/library mismatches.
1989 ])
1990                 else
1991                         AC_MSG_WARN([Your OpenSSL headers do not match your
1992 library. Check config.log for details.
1993 Also see contrib/findssl.sh for help identifying header/library mismatches.])
1994                 fi
1995         ],
1996         [
1997                 AC_MSG_WARN([cross compiling: not checking])
1998         ]
1999 )
2000
2001 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2002 AC_LINK_IFELSE(
2003         [AC_LANG_SOURCE([[
2004 #include <openssl/evp.h>
2005 int main(void) { SSLeay_add_all_algorithms(); }
2006         ]])],
2007         [
2008                 AC_MSG_RESULT(yes)
2009         ],
2010         [
2011                 AC_MSG_RESULT(no)
2012                 saved_LIBS="$LIBS"
2013                 LIBS="$LIBS -ldl"
2014                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2015                 AC_LINK_IFELSE(
2016                         [AC_LANG_SOURCE([[
2017 #include <openssl/evp.h>
2018 int main(void) { SSLeay_add_all_algorithms(); }
2019                         ]])],
2020                         [
2021                                 AC_MSG_RESULT(yes)
2022                         ],
2023                         [
2024                                 AC_MSG_RESULT(no)
2025                                 LIBS="$saved_LIBS"
2026                         ]
2027                 )
2028         ]
2029 )
2030
2031 AC_ARG_WITH(ssl-engine,
2032         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2033         [ if test "x$withval" != "xno" ; then
2034                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
2035                 AC_TRY_COMPILE(
2036                         [ #include <openssl/engine.h>],
2037                         [
2038 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
2039                         ],
2040                         [ AC_MSG_RESULT(yes)
2041                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
2042                              [Enable OpenSSL engine support])
2043                         ],
2044                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
2045                 )
2046           fi ]
2047 )
2048
2049 # Check for OpenSSL without EVP_aes_{192,256}_cbc
2050 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2051 AC_LINK_IFELSE(
2052         [AC_LANG_SOURCE([[
2053 #include <string.h>
2054 #include <openssl/evp.h>
2055 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
2056         ]])],
2057         [
2058                 AC_MSG_RESULT(no)
2059         ],
2060         [
2061                 AC_MSG_RESULT(yes)
2062                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2063                     [libcrypto is missing AES 192 and 256 bit functions])
2064         ]
2065 )
2066
2067 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2068 # because the system crypt() is more featureful.
2069 if test "x$check_for_libcrypt_before" = "x1"; then
2070         AC_CHECK_LIB(crypt, crypt)
2071 fi
2072
2073 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2074 # version in OpenSSL.
2075 if test "x$check_for_libcrypt_later" = "x1"; then
2076         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2077 fi
2078
2079 # Search for SHA256 support in libc and/or OpenSSL
2080 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2081
2082 saved_LIBS="$LIBS"
2083 AC_CHECK_LIB(iaf, ia_openinfo, [
2084         LIBS="$LIBS -liaf"
2085         AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
2086                                 AC_DEFINE(HAVE_LIBIAF, 1,
2087                         [Define if system has libiaf that supports set_id])
2088                                 ])
2089 ])
2090 LIBS="$saved_LIBS"
2091
2092 ### Configure cryptographic random number support
2093
2094 # Check wheter OpenSSL seeds itself
2095 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2096 AC_RUN_IFELSE(
2097         [AC_LANG_SOURCE([[
2098 #include <string.h>
2099 #include <openssl/rand.h>
2100 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2101         ]])],
2102         [
2103                 OPENSSL_SEEDS_ITSELF=yes
2104                 AC_MSG_RESULT(yes)
2105         ],
2106         [
2107                 AC_MSG_RESULT(no)
2108                 # Default to use of the rand helper if OpenSSL doesn't
2109                 # seed itself
2110                 USE_RAND_HELPER=yes
2111         ],
2112         [
2113                 AC_MSG_WARN([cross compiling: assuming yes])
2114                 # This is safe, since all recent OpenSSL versions will
2115                 # complain at runtime if not seeded correctly.
2116                 OPENSSL_SEEDS_ITSELF=yes
2117         ]
2118 )
2119
2120 # Check for PAM libs
2121 PAM_MSG="no"
2122 AC_ARG_WITH(pam,
2123         [  --with-pam              Enable PAM support ],
2124         [
2125                 if test "x$withval" != "xno" ; then
2126                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2127                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2128                                 AC_MSG_ERROR([PAM headers not found])
2129                         fi
2130
2131                         saved_LIBS="$LIBS"
2132                         AC_CHECK_LIB(dl, dlopen, , )
2133                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2134                         AC_CHECK_FUNCS(pam_getenvlist)
2135                         AC_CHECK_FUNCS(pam_putenv)
2136                         LIBS="$saved_LIBS"
2137
2138                         PAM_MSG="yes"
2139
2140                         SSHDLIBS="$SSHDLIBS -lpam"
2141                         AC_DEFINE(USE_PAM, 1,
2142                                 [Define if you want to enable PAM support])
2143
2144                         if test $ac_cv_lib_dl_dlopen = yes; then
2145                                 case "$LIBS" in
2146                                 *-ldl*)
2147                                         # libdl already in LIBS
2148                                         ;;
2149                                 *)
2150                                         SSHDLIBS="$SSHDLIBS -ldl"
2151                                         ;;
2152                                 esac
2153                         fi
2154                 fi
2155         ]
2156 )
2157
2158 # Check for older PAM
2159 if test "x$PAM_MSG" = "xyes" ; then
2160         # Check PAM strerror arguments (old PAM)
2161         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2162         AC_TRY_COMPILE(
2163                 [
2164 #include <stdlib.h>
2165 #if defined(HAVE_SECURITY_PAM_APPL_H)
2166 #include <security/pam_appl.h>
2167 #elif defined (HAVE_PAM_PAM_APPL_H)
2168 #include <pam/pam_appl.h>
2169 #endif
2170                 ],
2171                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2172                 [AC_MSG_RESULT(no)],
2173                 [
2174                         AC_DEFINE(HAVE_OLD_PAM, 1,
2175                                 [Define if you have an old version of PAM
2176                                 which takes only one argument to pam_strerror])
2177                         AC_MSG_RESULT(yes)
2178                         PAM_MSG="yes (old library)"
2179                 ]
2180         )
2181 fi
2182
2183 # Do we want to force the use of the rand helper?
2184 AC_ARG_WITH(rand-helper,
2185         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2186         [
2187                 if test "x$withval" = "xno" ; then
2188                         # Force use of OpenSSL's internal RNG, even if
2189                         # the previous test showed it to be unseeded.
2190                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2191                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2192                                 OPENSSL_SEEDS_ITSELF=yes
2193                                 USE_RAND_HELPER=""
2194                         fi
2195                 else
2196                         USE_RAND_HELPER=yes
2197                 fi
2198         ],
2199 )
2200
2201 # Which randomness source do we use?
2202 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2203         # OpenSSL only
2204         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2205                 [Define if you want OpenSSL's internally seeded PRNG only])
2206         RAND_MSG="OpenSSL internal ONLY"
2207         INSTALL_SSH_RAND_HELPER=""
2208 elif test ! -z "$USE_RAND_HELPER" ; then
2209         # install rand helper
2210         RAND_MSG="ssh-rand-helper"
2211         INSTALL_SSH_RAND_HELPER="yes"
2212 fi
2213 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2214
2215 ### Configuration of ssh-rand-helper
2216
2217 # PRNGD TCP socket
2218 AC_ARG_WITH(prngd-port,
2219         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2220         [
2221                 case "$withval" in
2222                 no)
2223                         withval=""
2224                         ;;
2225                 [[0-9]]*)
2226                         ;;
2227                 *)
2228                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2229                         ;;
2230                 esac
2231                 if test ! -z "$withval" ; then
2232                         PRNGD_PORT="$withval"
2233                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2234                                 [Port number of PRNGD/EGD random number socket])
2235                 fi
2236         ]
2237 )
2238
2239 # PRNGD Unix domain socket
2240 AC_ARG_WITH(prngd-socket,
2241         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2242         [
2243                 case "$withval" in
2244                 yes)
2245                         withval="/var/run/egd-pool"
2246                         ;;
2247                 no)
2248                         withval=""
2249                         ;;
2250                 /*)
2251                         ;;
2252                 *)
2253                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2254                         ;;
2255                 esac
2256
2257                 if test ! -z "$withval" ; then
2258                         if test ! -z "$PRNGD_PORT" ; then
2259                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2260                         fi
2261                         if test ! -r "$withval" ; then
2262                                 AC_MSG_WARN(Entropy socket is not readable)
2263                         fi
2264                         PRNGD_SOCKET="$withval"
2265                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2266                                 [Location of PRNGD/EGD random number socket])
2267                 fi
2268         ],
2269         [
2270                 # Check for existing socket only if we don't have a random device already
2271                 if test "$USE_RAND_HELPER" = yes ; then
2272                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2273                         # Insert other locations here
2274                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2275                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2276                                         PRNGD_SOCKET="$sock"
2277                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2278                                         break;
2279                                 fi
2280                         done
2281                         if test ! -z "$PRNGD_SOCKET" ; then
2282                                 AC_MSG_RESULT($PRNGD_SOCKET)
2283                         else
2284                                 AC_MSG_RESULT(not found)
2285                         fi
2286                 fi
2287         ]
2288 )
2289
2290 # Change default command timeout for hashing entropy source
2291 entropy_timeout=200
2292 AC_ARG_WITH(entropy-timeout,
2293         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2294         [
2295                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2296                     test "x${withval}" != "xyes"; then
2297                         entropy_timeout=$withval
2298                 fi
2299         ]
2300 )
2301 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2302         [Builtin PRNG command timeout])
2303
2304 SSH_PRIVSEP_USER=sshd
2305 AC_ARG_WITH(privsep-user,
2306         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2307         [
2308                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2309                     test "x${withval}" != "xyes"; then
2310                         SSH_PRIVSEP_USER=$withval
2311                 fi
2312         ]
2313 )
2314 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2315         [non-privileged user for privilege separation])
2316 AC_SUBST(SSH_PRIVSEP_USER)
2317
2318 # We do this little dance with the search path to insure
2319 # that programs that we select for use by installed programs
2320 # (which may be run by the super-user) come from trusted
2321 # locations before they come from the user's private area.
2322 # This should help avoid accidentally configuring some
2323 # random version of a program in someone's personal bin.
2324
2325 OPATH=$PATH
2326 PATH=/bin:/usr/bin
2327 test -h /bin 2> /dev/null && PATH=/usr/bin
2328 test -d /sbin && PATH=$PATH:/sbin
2329 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2330 PATH=$PATH:/etc:$OPATH
2331
2332 # These programs are used by the command hashing source to gather entropy
2333 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2334 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2335 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2336 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2337 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2338 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2339 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2340 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2341 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2342 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2343 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2344 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2345 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2346 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2347 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2348 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2349 # restore PATH
2350 PATH=$OPATH
2351
2352 # Where does ssh-rand-helper get its randomness from?
2353 INSTALL_SSH_PRNG_CMDS=""
2354 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2355         if test ! -z "$PRNGD_PORT" ; then
2356                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2357         elif test ! -z "$PRNGD_SOCKET" ; then
2358                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2359         else
2360                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2361                 RAND_HELPER_CMDHASH=yes
2362                 INSTALL_SSH_PRNG_CMDS="yes"
2363         fi
2364 fi
2365 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2366
2367
2368 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2369 if test ! -z "$SONY" ; then
2370   LIBS="$LIBS -liberty";
2371 fi
2372
2373 # Check for  long long datatypes
2374 AC_CHECK_TYPES([long long, unsigned long long, long double])
2375
2376 # Check datatype sizes
2377 AC_CHECK_SIZEOF(char, 1)
2378 AC_CHECK_SIZEOF(short int, 2)
2379 AC_CHECK_SIZEOF(int, 4)
2380 AC_CHECK_SIZEOF(long int, 4)
2381 AC_CHECK_SIZEOF(long long int, 8)
2382
2383 # Sanity check long long for some platforms (AIX)
2384 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2385         ac_cv_sizeof_long_long_int=0
2386 fi
2387
2388 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2389 if test -z "$have_llong_max"; then
2390         AC_MSG_CHECKING([for max value of long long])
2391         AC_RUN_IFELSE(
2392                 [AC_LANG_SOURCE([[
2393 #include <stdio.h>
2394 /* Why is this so damn hard? */
2395 #ifdef __GNUC__
2396 # undef __GNUC__
2397 #endif
2398 #define __USE_ISOC99
2399 #include <limits.h>
2400 #define DATA "conftest.llminmax"
2401 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2402
2403 /*
2404  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2405  * we do this the hard way.
2406  */
2407 static int
2408 fprint_ll(FILE *f, long long n)
2409 {
2410         unsigned int i;
2411         int l[sizeof(long long) * 8];
2412
2413         if (n < 0)
2414                 if (fprintf(f, "-") < 0)
2415                         return -1;
2416         for (i = 0; n != 0; i++) {
2417                 l[i] = my_abs(n % 10);
2418                 n /= 10;
2419         }
2420         do {
2421                 if (fprintf(f, "%d", l[--i]) < 0)
2422                         return -1;
2423         } while (i != 0);
2424         if (fprintf(f, " ") < 0)
2425                 return -1;
2426         return 0;
2427 }
2428
2429 int main(void) {
2430         FILE *f;
2431         long long i, llmin, llmax = 0;
2432
2433         if((f = fopen(DATA,"w")) == NULL)
2434                 exit(1);
2435
2436 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2437         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2438         llmin = LLONG_MIN;
2439         llmax = LLONG_MAX;
2440 #else
2441         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2442         /* This will work on one's complement and two's complement */
2443         for (i = 1; i > llmax; i <<= 1, i++)
2444                 llmax = i;
2445         llmin = llmax + 1LL;    /* wrap */
2446 #endif
2447
2448         /* Sanity check */
2449         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2450             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2451             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2452                 fprintf(f, "unknown unknown\n");
2453                 exit(2);
2454         }
2455
2456         if (fprint_ll(f, llmin) < 0)
2457                 exit(3);
2458         if (fprint_ll(f, llmax) < 0)
2459                 exit(4);
2460         if (fclose(f) < 0)
2461                 exit(5);
2462         exit(0);
2463 }
2464                 ]])],
2465                 [
2466                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2467                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2468
2469                         AC_MSG_RESULT($llong_max)
2470                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2471                             [max value of long long calculated by configure])
2472                         AC_MSG_CHECKING([for min value of long long])
2473                         AC_MSG_RESULT($llong_min)
2474                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2475                             [min value of long long calculated by configure])
2476                 ],
2477                 [
2478                         AC_MSG_RESULT(not found)
2479                 ],
2480                 [
2481                         AC_MSG_WARN([cross compiling: not checking])
2482                 ]
2483         )
2484 fi
2485
2486
2487 # More checks for data types
2488 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2489         AC_TRY_COMPILE(
2490                 [ #include <sys/types.h> ],
2491                 [ u_int a; a = 1;],
2492                 [ ac_cv_have_u_int="yes" ],
2493                 [ ac_cv_have_u_int="no" ]
2494         )
2495 ])
2496 if test "x$ac_cv_have_u_int" = "xyes" ; then
2497         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2498         have_u_int=1
2499 fi
2500
2501 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2502         AC_TRY_COMPILE(
2503                 [ #include <sys/types.h> ],
2504                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2505                 [ ac_cv_have_intxx_t="yes" ],
2506                 [ ac_cv_have_intxx_t="no" ]
2507         )
2508 ])
2509 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2510         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2511         have_intxx_t=1
2512 fi
2513
2514 if (test -z "$have_intxx_t" && \
2515            test "x$ac_cv_header_stdint_h" = "xyes")
2516 then
2517     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2518         AC_TRY_COMPILE(
2519                 [ #include <stdint.h> ],
2520                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2521                 [
2522                         AC_DEFINE(HAVE_INTXX_T)
2523                         AC_MSG_RESULT(yes)
2524                 ],
2525                 [ AC_MSG_RESULT(no) ]
2526         )
2527 fi
2528
2529 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2530         AC_TRY_COMPILE(
2531                 [
2532 #include <sys/types.h>
2533 #ifdef HAVE_STDINT_H
2534 # include <stdint.h>
2535 #endif
2536 #include <sys/socket.h>
2537 #ifdef HAVE_SYS_BITYPES_H
2538 # include <sys/bitypes.h>
2539 #endif
2540                 ],
2541                 [ int64_t a; a = 1;],
2542                 [ ac_cv_have_int64_t="yes" ],
2543                 [ ac_cv_have_int64_t="no" ]
2544         )
2545 ])
2546 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2547         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2548 fi
2549
2550 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2551         AC_TRY_COMPILE(
2552                 [ #include <sys/types.h> ],
2553                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2554                 [ ac_cv_have_u_intxx_t="yes" ],
2555                 [ ac_cv_have_u_intxx_t="no" ]
2556         )
2557 ])
2558 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2559         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2560         have_u_intxx_t=1
2561 fi
2562
2563 if test -z "$have_u_intxx_t" ; then
2564     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2565         AC_TRY_COMPILE(
2566                 [ #include <sys/socket.h> ],
2567                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2568                 [
2569                         AC_DEFINE(HAVE_U_INTXX_T)
2570                         AC_MSG_RESULT(yes)
2571                 ],
2572                 [ AC_MSG_RESULT(no) ]
2573         )
2574 fi
2575
2576 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2577         AC_TRY_COMPILE(
2578                 [ #include <sys/types.h> ],
2579                 [ u_int64_t a; a = 1;],
2580                 [ ac_cv_have_u_int64_t="yes" ],
2581                 [ ac_cv_have_u_int64_t="no" ]
2582         )
2583 ])
2584 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2585         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2586         have_u_int64_t=1
2587 fi
2588
2589 if test -z "$have_u_int64_t" ; then
2590     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2591         AC_TRY_COMPILE(
2592                 [ #include <sys/bitypes.h> ],
2593                 [ u_int64_t a; a = 1],
2594                 [
2595                         AC_DEFINE(HAVE_U_INT64_T)
2596                         AC_MSG_RESULT(yes)
2597                 ],
2598                 [ AC_MSG_RESULT(no) ]
2599         )
2600 fi
2601
2602 if test -z "$have_u_intxx_t" ; then
2603         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2604                 AC_TRY_COMPILE(
2605                         [
2606 #include <sys/types.h>
2607                         ],
2608                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2609                         [ ac_cv_have_uintxx_t="yes" ],
2610                         [ ac_cv_have_uintxx_t="no" ]
2611                 )
2612         ])
2613         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2614                 AC_DEFINE(HAVE_UINTXX_T, 1,
2615                         [define if you have uintxx_t data type])
2616         fi
2617 fi
2618
2619 if test -z "$have_uintxx_t" ; then
2620     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2621         AC_TRY_COMPILE(
2622                 [ #include <stdint.h> ],
2623                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2624                 [
2625                         AC_DEFINE(HAVE_UINTXX_T)
2626                         AC_MSG_RESULT(yes)
2627                 ],
2628                 [ AC_MSG_RESULT(no) ]
2629         )
2630 fi
2631
2632 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2633            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2634 then
2635         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2636         AC_TRY_COMPILE(
2637                 [
2638 #include <sys/bitypes.h>
2639                 ],
2640                 [
2641                         int8_t a; int16_t b; int32_t c;
2642                         u_int8_t e; u_int16_t f; u_int32_t g;
2643                         a = b = c = e = f = g = 1;
2644                 ],
2645                 [
2646                         AC_DEFINE(HAVE_U_INTXX_T)
2647                         AC_DEFINE(HAVE_INTXX_T)
2648                         AC_MSG_RESULT(yes)
2649                 ],
2650                 [AC_MSG_RESULT(no)]
2651         )
2652 fi
2653
2654
2655 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2656         AC_TRY_COMPILE(
2657                 [
2658 #include <sys/types.h>
2659                 ],
2660                 [ u_char foo; foo = 125; ],
2661                 [ ac_cv_have_u_char="yes" ],
2662                 [ ac_cv_have_u_char="no" ]
2663         )
2664 ])
2665 if test "x$ac_cv_have_u_char" = "xyes" ; then
2666         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2667 fi
2668
2669 TYPE_SOCKLEN_T
2670
2671 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2672 AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t],,,[
2673 #include <sys/types.h>
2674 #ifdef HAVE_SYS_BITYPES_H
2675 #include <sys/bitypes.h>
2676 #endif
2677 #ifdef HAVE_SYS_STATFS_H
2678 #include <sys/statfs.h>
2679 #endif
2680 #ifdef HAVE_SYS_STATVFS_H
2681 #include <sys/statvfs.h>
2682 #endif
2683 ])
2684
2685 AC_CHECK_TYPES(in_addr_t,,,
2686 [#include <sys/types.h>
2687 #include <netinet/in.h>])
2688
2689 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2690         AC_TRY_COMPILE(
2691                 [
2692 #include <sys/types.h>
2693                 ],
2694                 [ size_t foo; foo = 1235; ],
2695                 [ ac_cv_have_size_t="yes" ],
2696                 [ ac_cv_have_size_t="no" ]
2697         )
2698 ])
2699 if test "x$ac_cv_have_size_t" = "xyes" ; then
2700         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2701 fi
2702
2703 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2704         AC_TRY_COMPILE(
2705                 [
2706 #include <sys/types.h>
2707                 ],
2708                 [ ssize_t foo; foo = 1235; ],
2709                 [ ac_cv_have_ssize_t="yes" ],
2710                 [ ac_cv_have_ssize_t="no" ]
2711         )
2712 ])
2713 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2714         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2715 fi
2716
2717 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2718         AC_TRY_COMPILE(
2719                 [
2720 #include <time.h>
2721                 ],
2722                 [ clock_t foo; foo = 1235; ],
2723                 [ ac_cv_have_clock_t="yes" ],
2724                 [ ac_cv_have_clock_t="no" ]
2725         )
2726 ])
2727 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2728         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2729 fi
2730
2731 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2732         AC_TRY_COMPILE(
2733                 [
2734 #include <sys/types.h>
2735 #include <sys/socket.h>
2736                 ],
2737                 [ sa_family_t foo; foo = 1235; ],
2738                 [ ac_cv_have_sa_family_t="yes" ],
2739                 [ AC_TRY_COMPILE(
2740                   [
2741 #include <sys/types.h>
2742 #include <sys/socket.h>
2743 #include <netinet/in.h>
2744                 ],
2745                 [ sa_family_t foo; foo = 1235; ],
2746                 [ ac_cv_have_sa_family_t="yes" ],
2747
2748                 [ ac_cv_have_sa_family_t="no" ]
2749         )]
2750         )
2751 ])
2752 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2753         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2754                 [define if you have sa_family_t data type])
2755 fi
2756
2757 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2758         AC_TRY_COMPILE(
2759                 [
2760 #include <sys/types.h>
2761                 ],
2762                 [ pid_t foo; foo = 1235; ],
2763                 [ ac_cv_have_pid_t="yes" ],
2764                 [ ac_cv_have_pid_t="no" ]
2765         )
2766 ])
2767 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2768         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2769 fi
2770
2771 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2772         AC_TRY_COMPILE(
2773                 [
2774 #include <sys/types.h>
2775                 ],
2776                 [ mode_t foo; foo = 1235; ],
2777                 [ ac_cv_have_mode_t="yes" ],
2778                 [ ac_cv_have_mode_t="no" ]
2779         )
2780 ])
2781 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2782         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2783 fi
2784
2785
2786 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2787         AC_TRY_COMPILE(
2788                 [
2789 #include <sys/types.h>
2790 #include <sys/socket.h>
2791                 ],
2792                 [ struct sockaddr_storage s; ],
2793                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2794                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2795         )
2796 ])
2797 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2798         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2799                 [define if you have struct sockaddr_storage data type])
2800 fi
2801
2802 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2803         AC_TRY_COMPILE(
2804                 [
2805 #include <sys/types.h>
2806 #include <netinet/in.h>
2807                 ],
2808                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2809                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2810                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2811         )
2812 ])
2813 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2814         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2815                 [define if you have struct sockaddr_in6 data type])
2816 fi
2817
2818 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2819         AC_TRY_COMPILE(
2820                 [
2821 #include <sys/types.h>
2822 #include <netinet/in.h>
2823                 ],
2824                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2825                 [ ac_cv_have_struct_in6_addr="yes" ],
2826                 [ ac_cv_have_struct_in6_addr="no" ]
2827         )
2828 ])
2829 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2830         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2831                 [define if you have struct in6_addr data type])
2832
2833 dnl Now check for sin6_scope_id
2834         AC_CHECK_MEMBERS([struct sockaddr_in6.sin6_scope_id],,,
2835                 [
2836 #ifdef HAVE_SYS_TYPES_H
2837 #include <sys/types.h>
2838 #endif
2839 #include <netinet/in.h>
2840                 ])
2841 fi
2842
2843 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2844         AC_TRY_COMPILE(
2845                 [
2846 #include <sys/types.h>
2847 #include <sys/socket.h>
2848 #include <netdb.h>
2849                 ],
2850                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2851                 [ ac_cv_have_struct_addrinfo="yes" ],
2852                 [ ac_cv_have_struct_addrinfo="no" ]
2853         )
2854 ])
2855 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2856         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2857                 [define if you have struct addrinfo data type])
2858 fi
2859
2860 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2861         AC_TRY_COMPILE(
2862                 [ #include <sys/time.h> ],
2863                 [ struct timeval tv; tv.tv_sec = 1;],
2864                 [ ac_cv_have_struct_timeval="yes" ],
2865                 [ ac_cv_have_struct_timeval="no" ]
2866         )
2867 ])
2868 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2869         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2870         have_struct_timeval=1
2871 fi
2872
2873 AC_CHECK_TYPES(struct timespec)
2874
2875 # We need int64_t or else certian parts of the compile will fail.
2876 if test "x$ac_cv_have_int64_t" = "xno" && \
2877         test "x$ac_cv_sizeof_long_int" != "x8" && \
2878         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2879         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2880         echo "an alternative compiler (I.E., GCC) before continuing."
2881         echo ""
2882         exit 1;
2883 else
2884 dnl test snprintf (broken on SCO w/gcc)
2885         AC_RUN_IFELSE(
2886                 [AC_LANG_SOURCE([[
2887 #include <stdio.h>
2888 #include <string.h>
2889 #ifdef HAVE_SNPRINTF
2890 main()
2891 {
2892         char buf[50];
2893         char expected_out[50];
2894         int mazsize = 50 ;
2895 #if (SIZEOF_LONG_INT == 8)
2896         long int num = 0x7fffffffffffffff;
2897 #else
2898         long long num = 0x7fffffffffffffffll;
2899 #endif
2900         strcpy(expected_out, "9223372036854775807");
2901         snprintf(buf, mazsize, "%lld", num);
2902         if(strcmp(buf, expected_out) != 0)
2903                 exit(1);
2904         exit(0);
2905 }
2906 #else
2907 main() { exit(0); }
2908 #endif
2909                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
2910                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
2911         )
2912 fi
2913
2914 dnl Checks for structure members
2915 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
2916 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
2917 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
2918 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
2919 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
2920 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
2921 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
2922 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
2923 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
2924 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
2925 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
2926 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
2927 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
2928 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
2929 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
2930 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
2931 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
2932
2933 AC_CHECK_MEMBERS([struct stat.st_blksize])
2934 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
2935         [Define if we don't have struct __res_state in resolv.h])],
2936 [
2937 #include <stdio.h>
2938 #if HAVE_SYS_TYPES_H
2939 # include <sys/types.h>
2940 #endif
2941 #include <netinet/in.h>
2942 #include <arpa/nameser.h>
2943 #include <resolv.h>
2944 ])
2945
2946 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
2947                 ac_cv_have_ss_family_in_struct_ss, [
2948         AC_TRY_COMPILE(
2949                 [
2950 #include <sys/types.h>
2951 #include <sys/socket.h>
2952                 ],
2953                 [ struct sockaddr_storage s; s.ss_family = 1; ],
2954                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
2955                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
2956         )
2957 ])
2958 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
2959         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
2960 fi
2961
2962 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
2963                 ac_cv_have___ss_family_in_struct_ss, [
2964         AC_TRY_COMPILE(
2965                 [
2966 #include <sys/types.h>
2967 #include <sys/socket.h>
2968                 ],
2969                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
2970                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
2971                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
2972         )
2973 ])
2974 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
2975         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
2976                 [Fields in struct sockaddr_storage])
2977 fi
2978
2979 AC_CACHE_CHECK([for pw_class field in struct passwd],
2980                 ac_cv_have_pw_class_in_struct_passwd, [
2981         AC_TRY_COMPILE(
2982                 [
2983 #include <pwd.h>
2984                 ],
2985                 [ struct passwd p; p.pw_class = 0; ],
2986                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
2987                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
2988         )
2989 ])
2990 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
2991         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
2992                 [Define if your password has a pw_class field])
2993 fi
2994
2995 AC_CACHE_CHECK([for pw_expire field in struct passwd],
2996                 ac_cv_have_pw_expire_in_struct_passwd, [
2997         AC_TRY_COMPILE(
2998                 [
2999 #include <pwd.h>
3000                 ],
3001                 [ struct passwd p; p.pw_expire = 0; ],
3002                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
3003                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
3004         )
3005 ])
3006 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
3007         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
3008                 [Define if your password has a pw_expire field])
3009 fi
3010
3011 AC_CACHE_CHECK([for pw_change field in struct passwd],
3012                 ac_cv_have_pw_change_in_struct_passwd, [
3013         AC_TRY_COMPILE(
3014                 [
3015 #include <pwd.h>
3016                 ],
3017                 [ struct passwd p; p.pw_change = 0; ],
3018                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
3019                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
3020         )
3021 ])
3022 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
3023         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
3024                 [Define if your password has a pw_change field])
3025 fi
3026
3027 dnl make sure we're using the real structure members and not defines
3028 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3029                 ac_cv_have_accrights_in_msghdr, [
3030         AC_COMPILE_IFELSE(
3031                 [
3032 #include <sys/types.h>
3033 #include <sys/socket.h>
3034 #include <sys/uio.h>
3035 int main() {
3036 #ifdef msg_accrights
3037 #error "msg_accrights is a macro"
3038 exit(1);
3039 #endif
3040 struct msghdr m;
3041 m.msg_accrights = 0;
3042 exit(0);
3043 }
3044                 ],
3045                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3046                 [ ac_cv_have_accrights_in_msghdr="no" ]
3047         )
3048 ])
3049 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3050         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
3051                 [Define if your system uses access rights style
3052                 file descriptor passing])
3053 fi
3054
3055 AC_MSG_CHECKING(if f_fsid has val members)
3056 AC_TRY_COMPILE([
3057 #include <sys/types.h>
3058 #include <sys/statvfs.h>],
3059 [struct fsid_t t; t.val[0] = 0;],
3060         [ AC_MSG_RESULT(yes)
3061           AC_DEFINE(FSID_HAS_VAL, 1, f_fsid has members) ],
3062         [ AC_MSG_RESULT(no) ]
3063 )
3064
3065 AC_CACHE_CHECK([for msg_control field in struct msghdr],
3066                 ac_cv_have_control_in_msghdr, [
3067         AC_COMPILE_IFELSE(
3068                 [
3069 #include <sys/types.h>
3070 #include <sys/socket.h>
3071 #include <sys/uio.h>
3072 int main() {
3073 #ifdef msg_control
3074 #error "msg_control is a macro"
3075 exit(1);
3076 #endif
3077 struct msghdr m;
3078 m.msg_control = 0;
3079 exit(0);
3080 }
3081                 ],
3082                 [ ac_cv_have_control_in_msghdr="yes" ],
3083                 [ ac_cv_have_control_in_msghdr="no" ]
3084         )
3085 ])
3086 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
3087         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3088                 [Define if your system uses ancillary data style
3089                 file descriptor passing])
3090 fi
3091
3092 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3093         AC_TRY_LINK([],
3094                 [ extern char *__progname; printf("%s", __progname); ],
3095                 [ ac_cv_libc_defines___progname="yes" ],
3096                 [ ac_cv_libc_defines___progname="no" ]
3097         )
3098 ])
3099 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3100         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3101 fi
3102
3103 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3104         AC_TRY_LINK([
3105 #include <stdio.h>
3106 ],
3107                 [ printf("%s", __FUNCTION__); ],
3108                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3109                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3110         )
3111 ])
3112 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3113         AC_DEFINE(HAVE___FUNCTION__, 1,
3114                 [Define if compiler implements __FUNCTION__])
3115 fi
3116
3117 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3118         AC_TRY_LINK([
3119 #include <stdio.h>
3120 ],
3121                 [ printf("%s", __func__); ],
3122                 [ ac_cv_cc_implements___func__="yes" ],
3123                 [ ac_cv_cc_implements___func__="no" ]
3124         )
3125 ])
3126 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3127         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3128 fi
3129
3130 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3131         AC_TRY_LINK(
3132                 [#include <stdarg.h>
3133                  va_list x,y;],
3134                 [va_copy(x,y);],
3135                 [ ac_cv_have_va_copy="yes" ],
3136                 [ ac_cv_have_va_copy="no" ]
3137         )
3138 ])
3139 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3140         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3141 fi
3142
3143 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3144         AC_TRY_LINK(
3145                 [#include <stdarg.h>
3146                  va_list x,y;],
3147                 [__va_copy(x,y);],
3148                 [ ac_cv_have___va_copy="yes" ],
3149                 [ ac_cv_have___va_copy="no" ]
3150         )
3151 ])
3152 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3153         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3154 fi
3155
3156 AC_CACHE_CHECK([whether getopt has optreset support],
3157                 ac_cv_have_getopt_optreset, [
3158         AC_TRY_LINK(
3159                 [
3160 #include <getopt.h>
3161                 ],
3162                 [ extern int optreset; optreset = 0; ],
3163                 [ ac_cv_have_getopt_optreset="yes" ],
3164                 [ ac_cv_have_getopt_optreset="no" ]
3165         )
3166 ])
3167 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3168         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3169                 [Define if your getopt(3) defines and uses optreset])
3170 fi
3171
3172 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3173         AC_TRY_LINK([],
3174                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3175                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3176                 [ ac_cv_libc_defines_sys_errlist="no" ]
3177         )
3178 ])
3179 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3180         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3181                 [Define if your system defines sys_errlist[]])
3182 fi
3183
3184
3185 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3186         AC_TRY_LINK([],
3187                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3188                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3189                 [ ac_cv_libc_defines_sys_nerr="no" ]
3190         )
3191 ])
3192 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3193         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3194 fi
3195
3196 SCARD_MSG="no"
3197 # Check whether user wants sectok support
3198 AC_ARG_WITH(sectok,
3199         [  --with-sectok           Enable smartcard support using libsectok],
3200         [
3201                 if test "x$withval" != "xno" ; then
3202                         if test "x$withval" != "xyes" ; then
3203                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3204                                 LDFLAGS="$LDFLAGS -L${withval}"
3205                                 if test ! -z "$need_dash_r" ; then
3206                                         LDFLAGS="$LDFLAGS -R${withval}"
3207                                 fi
3208                                 if test ! -z "$blibpath" ; then
3209                                         blibpath="$blibpath:${withval}"
3210                                 fi
3211                         fi
3212                         AC_CHECK_HEADERS(sectok.h)
3213                         if test "$ac_cv_header_sectok_h" != yes; then
3214                                 AC_MSG_ERROR(Can't find sectok.h)
3215                         fi
3216                         AC_CHECK_LIB(sectok, sectok_open)
3217                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3218                                 AC_MSG_ERROR(Can't find libsectok)
3219                         fi
3220                         AC_DEFINE(SMARTCARD, 1,
3221                                 [Define if you want smartcard support])
3222                         AC_DEFINE(USE_SECTOK, 1,
3223                                 [Define if you want smartcard support
3224                                 using sectok])
3225                         SCARD_MSG="yes, using sectok"
3226                 fi
3227         ]
3228 )
3229
3230 # Check whether user wants OpenSC support
3231 OPENSC_CONFIG="no"
3232 AC_ARG_WITH(opensc,
3233         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3234         [
3235             if test "x$withval" != "xno" ; then
3236                 if test "x$withval" != "xyes" ; then
3237                         OPENSC_CONFIG=$withval/bin/opensc-config
3238                 else
3239                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3240                 fi
3241                 if test "$OPENSC_CONFIG" != "no"; then
3242                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3243                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3244                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3245                         LIBS="$LIBS $LIBOPENSC_LIBS"
3246                         AC_DEFINE(SMARTCARD)
3247                         AC_DEFINE(USE_OPENSC, 1,
3248                                 [Define if you want smartcard support
3249                                 using OpenSC])
3250                         SCARD_MSG="yes, using OpenSC"
3251                 fi
3252             fi
3253         ]
3254 )
3255
3256 # Check libraries needed by DNS fingerprint support
3257 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3258         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3259                 [Define if getrrsetbyname() exists])],
3260         [
3261                 # Needed by our getrrsetbyname()
3262                 AC_SEARCH_LIBS(res_query, resolv)
3263                 AC_SEARCH_LIBS(dn_expand, resolv)
3264                 AC_MSG_CHECKING(if res_query will link)
3265                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
3266                    [AC_MSG_RESULT(no)
3267                     saved_LIBS="$LIBS"
3268                     LIBS="$LIBS -lresolv"
3269                     AC_MSG_CHECKING(for res_query in -lresolv)
3270                     AC_LINK_IFELSE([
3271 #include <resolv.h>
3272 int main()
3273 {
3274         res_query (0, 0, 0, 0, 0);
3275         return 0;
3276 }
3277                         ],
3278                         [LIBS="$LIBS -lresolv"
3279                          AC_MSG_RESULT(yes)],
3280                         [LIBS="$saved_LIBS"
3281                          AC_MSG_RESULT(no)])
3282                     ])
3283                 AC_CHECK_FUNCS(_getshort _getlong)
3284                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3285                     [#include <sys/types.h>
3286                     #include <arpa/nameser.h>])
3287                 AC_CHECK_MEMBER(HEADER.ad,
3288                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3289                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3290                         [#include <arpa/nameser.h>])
3291         ])
3292
3293 AC_MSG_CHECKING(if struct __res_state _res is an extern)
3294 AC_LINK_IFELSE([
3295 #include <stdio.h>
3296 #if HAVE_SYS_TYPES_H
3297 # include <sys/types.h>
3298 #endif
3299 #include <netinet/in.h>
3300 #include <arpa/nameser.h>
3301 #include <resolv.h>
3302 extern struct __res_state _res;
3303 int main() { return 0; }
3304                 ],
3305                 [AC_MSG_RESULT(yes)
3306                  AC_DEFINE(HAVE__RES_EXTERN, 1,
3307                     [Define if you have struct __res_state _res as an extern])
3308                 ],
3309                 [ AC_MSG_RESULT(no) ]
3310 )
3311
3312 # Check whether user wants SELinux support
3313 SELINUX_MSG="no"
3314 LIBSELINUX=""
3315 AC_ARG_WITH(selinux,
3316         [  --with-selinux          Enable SELinux support],
3317         [ if test "x$withval" != "xno" ; then
3318                 save_LIBS="$LIBS"
3319                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3320                 SELINUX_MSG="yes"
3321                 AC_CHECK_HEADER([selinux/selinux.h], ,
3322                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3323                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3324                     AC_MSG_ERROR(SELinux support requires libselinux library))
3325                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
3326                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3327                 LIBS="$save_LIBS"
3328         fi ]
3329 )
3330
3331 # Check whether user wants Kerberos 5 support
3332 KRB5_MSG="no"
3333 AC_ARG_WITH(kerberos5,
3334         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3335         [ if test "x$withval" != "xno" ; then
3336                 if test "x$withval" = "xyes" ; then
3337                         KRB5ROOT="/usr/local"
3338                 else
3339                         KRB5ROOT=${withval}
3340                 fi
3341
3342                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3343                 KRB5_MSG="yes"
3344
3345                 AC_MSG_CHECKING(for krb5-config)
3346                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3347                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3348                         AC_MSG_RESULT($KRB5CONF)
3349
3350                         AC_MSG_CHECKING(for gssapi support)
3351                         if $KRB5CONF | grep gssapi >/dev/null ; then
3352                                 AC_MSG_RESULT(yes)
3353                                 AC_DEFINE(GSSAPI, 1,
3354                                         [Define this if you want GSSAPI
3355                                         support in the version 2 protocol])
3356                                 k5confopts=gssapi
3357                         else
3358                                 AC_MSG_RESULT(no)
3359                                 k5confopts=""
3360                         fi
3361                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3362                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3363                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3364                         AC_MSG_CHECKING(whether we are using Heimdal)
3365                         AC_TRY_COMPILE([ #include <krb5.h> ],
3366                                        [ char *tmp = heimdal_version; ],
3367                                        [ AC_MSG_RESULT(yes)
3368                                          AC_DEFINE(HEIMDAL, 1,
3369                                         [Define this if you are using the
3370                                         Heimdal version of Kerberos V5]) ],
3371                                          AC_MSG_RESULT(no)
3372                         )
3373                 else
3374                         AC_MSG_RESULT(no)
3375                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3376                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3377                         AC_MSG_CHECKING(whether we are using Heimdal)
3378                         AC_TRY_COMPILE([ #include <krb5.h> ],
3379                                        [ char *tmp = heimdal_version; ],
3380                                        [ AC_MSG_RESULT(yes)
3381                                          AC_DEFINE(HEIMDAL)
3382                                          K5LIBS="-lkrb5 -ldes"
3383                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3384                                          AC_CHECK_LIB(roken, net_write,
3385                                            [K5LIBS="$K5LIBS -lroken"])
3386                                        ],
3387                                        [ AC_MSG_RESULT(no)
3388                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3389                                        ]
3390                         )
3391                         AC_SEARCH_LIBS(dn_expand, resolv)
3392
3393                         AC_CHECK_LIB(gssapi_krb5, gss_init_sec_context,
3394                                 [ AC_DEFINE(GSSAPI)
3395                                   K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3396                                 [ AC_CHECK_LIB(gssapi, gss_init_sec_context,
3397                                         [ AC_DEFINE(GSSAPI)
3398                                           K5LIBS="-lgssapi $K5LIBS" ],
3399                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3400                                         $K5LIBS)
3401                                 ],
3402                                 $K5LIBS)
3403
3404                         AC_CHECK_HEADER(gssapi.h, ,
3405                                 [ unset ac_cv_header_gssapi_h
3406                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3407                                   AC_CHECK_HEADERS(gssapi.h, ,
3408                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3409                                   )
3410                                 ]
3411                         )
3412
3413                         oldCPP="$CPPFLAGS"
3414                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3415                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3416                                         [ CPPFLAGS="$oldCPP" ])
3417
3418                 fi
3419                 if test ! -z "$need_dash_r" ; then
3420                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3421                 fi
3422                 if test ! -z "$blibpath" ; then
3423                         blibpath="$blibpath:${KRB5ROOT}/lib"
3424                 fi
3425
3426                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3427                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3428                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3429
3430                 LIBS="$LIBS $K5LIBS"
3431                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3432                         [Define this if you want to use libkafs' AFS support]))
3433         fi
3434         ]
3435 )
3436
3437 # Looking for programs, paths and files
3438
3439 PRIVSEP_PATH=/var/empty
3440 AC_ARG_WITH(privsep-path,
3441         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3442         [
3443                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3444                     test "x${withval}" != "xyes"; then
3445                         PRIVSEP_PATH=$withval
3446                 fi
3447         ]
3448 )
3449 AC_SUBST(PRIVSEP_PATH)
3450
3451 AC_ARG_WITH(xauth,
3452         [  --with-xauth=PATH       Specify path to xauth program ],
3453         [
3454                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3455                     test "x${withval}" != "xyes"; then
3456                         xauth_path=$withval
3457                 fi
3458         ],
3459         [
3460                 TestPath="$PATH"
3461                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3462                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3463                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3464                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3465                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3466                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3467                         xauth_path="/usr/openwin/bin/xauth"
3468                 fi
3469         ]
3470 )
3471
3472 STRIP_OPT=-s
3473 AC_ARG_ENABLE(strip,
3474         [  --disable-strip         Disable calling strip(1) on install],
3475         [
3476                 if test "x$enableval" = "xno" ; then
3477                         STRIP_OPT=
3478                 fi
3479         ]
3480 )
3481 AC_SUBST(STRIP_OPT)
3482
3483 if test -z "$xauth_path" ; then
3484         XAUTH_PATH="undefined"
3485         AC_SUBST(XAUTH_PATH)
3486 else
3487         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3488                 [Define if xauth is found in your path])
3489         XAUTH_PATH=$xauth_path
3490         AC_SUBST(XAUTH_PATH)
3491 fi
3492
3493 # Check for mail directory (last resort if we cannot get it from headers)
3494 if test ! -z "$MAIL" ; then
3495         maildir=`dirname $MAIL`
3496         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3497                 [Set this to your mail directory if you don't have maillock.h])
3498 fi
3499
3500 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3501         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3502         disable_ptmx_check=yes
3503 fi
3504 if test -z "$no_dev_ptmx" ; then
3505         if test "x$disable_ptmx_check" != "xyes" ; then
3506                 AC_CHECK_FILE("/dev/ptmx",
3507                         [
3508                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3509                                         [Define if you have /dev/ptmx])
3510                                 have_dev_ptmx=1
3511                         ]
3512                 )
3513         fi
3514 fi
3515
3516 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3517         AC_CHECK_FILE("/dev/ptc",
3518                 [
3519                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3520                                 [Define if you have /dev/ptc])
3521                         have_dev_ptc=1
3522                 ]
3523         )
3524 else
3525         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3526 fi
3527
3528 # Options from here on. Some of these are preset by platform above
3529 AC_ARG_WITH(mantype,
3530         [  --with-mantype=man|cat|doc  Set man page type],
3531         [
3532                 case "$withval" in
3533                 man|cat|doc)
3534                         MANTYPE=$withval
3535                         ;;
3536                 *)
3537                         AC_MSG_ERROR(invalid man type: $withval)
3538                         ;;
3539                 esac
3540         ]
3541 )
3542 if test -z "$MANTYPE"; then
3543         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3544         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3545         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3546                 MANTYPE=doc
3547         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3548                 MANTYPE=man
3549         else
3550                 MANTYPE=cat
3551         fi
3552 fi
3553 AC_SUBST(MANTYPE)
3554 if test "$MANTYPE" = "doc"; then
3555         mansubdir=man;
3556 else
3557         mansubdir=$MANTYPE;
3558 fi
3559 AC_SUBST(mansubdir)
3560
3561 # Check whether to enable MD5 passwords
3562 MD5_MSG="no"
3563 AC_ARG_WITH(md5-passwords,
3564         [  --with-md5-passwords    Enable use of MD5 passwords],
3565         [
3566                 if test "x$withval" != "xno" ; then
3567                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3568                                 [Define if you want to allow MD5 passwords])
3569                         MD5_MSG="yes"
3570                 fi
3571         ]
3572 )
3573
3574 # Whether to disable shadow password support
3575 AC_ARG_WITH(shadow,
3576         [  --without-shadow        Disable shadow password support],
3577         [
3578                 if test "x$withval" = "xno" ; then
3579                         AC_DEFINE(DISABLE_SHADOW)
3580                         disable_shadow=yes
3581                 fi
3582         ]
3583 )
3584
3585 if test -z "$disable_shadow" ; then
3586         AC_MSG_CHECKING([if the systems has expire shadow information])
3587         AC_TRY_COMPILE(
3588         [
3589 #include <sys/types.h>
3590 #include <shadow.h>
3591         struct spwd sp;
3592         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3593         [ sp_expire_available=yes ], []
3594         )
3595
3596         if test "x$sp_expire_available" = "xyes" ; then
3597                 AC_MSG_RESULT(yes)
3598                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3599                     [Define if you want to use shadow password expire field])
3600         else
3601                 AC_MSG_RESULT(no)
3602         fi
3603 fi
3604
3605 # Use ip address instead of hostname in $DISPLAY
3606 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3607         DISPLAY_HACK_MSG="yes"
3608         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3609                 [Define if you need to use IP address
3610                 instead of hostname in $DISPLAY])
3611 else
3612         DISPLAY_HACK_MSG="no"
3613         AC_ARG_WITH(ipaddr-display,
3614                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3615                 [
3616                         if test "x$withval" != "xno" ; then
3617                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3618                                 DISPLAY_HACK_MSG="yes"
3619                         fi
3620                 ]
3621         )
3622 fi
3623
3624 # check for /etc/default/login and use it if present.
3625 AC_ARG_ENABLE(etc-default-login,
3626         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3627         [ if test "x$enableval" = "xno"; then
3628                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3629                 etc_default_login=no
3630           else
3631                 etc_default_login=yes
3632           fi ],
3633         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3634           then
3635                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3636                 etc_default_login=no
3637           else
3638                 etc_default_login=yes
3639           fi ]
3640 )
3641
3642 if test "x$etc_default_login" != "xno"; then
3643         AC_CHECK_FILE("/etc/default/login",
3644             [ external_path_file=/etc/default/login ])
3645         if test "x$external_path_file" = "x/etc/default/login"; then
3646                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3647                         [Define if your system has /etc/default/login])
3648         fi
3649 fi
3650
3651 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3652 if test $ac_cv_func_login_getcapbool = "yes" && \
3653         test $ac_cv_header_login_cap_h = "yes" ; then
3654         external_path_file=/etc/login.conf
3655 fi
3656
3657 # Whether to mess with the default path
3658 SERVER_PATH_MSG="(default)"
3659 AC_ARG_WITH(default-path,
3660         [  --with-default-path=    Specify default \$PATH environment for server],
3661         [
3662                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3663                         AC_MSG_WARN([
3664 --with-default-path=PATH has no effect on this system.
3665 Edit /etc/login.conf instead.])
3666                 elif test "x$withval" != "xno" ; then
3667                         if test ! -z "$external_path_file" ; then
3668                                 AC_MSG_WARN([
3669 --with-default-path=PATH will only be used if PATH is not defined in
3670 $external_path_file .])
3671                         fi
3672                         user_path="$withval"
3673                         SERVER_PATH_MSG="$withval"
3674                 fi
3675         ],
3676         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3677                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3678         else
3679                 if test ! -z "$external_path_file" ; then
3680                         AC_MSG_WARN([
3681 If PATH is defined in $external_path_file, ensure the path to scp is included,
3682 otherwise scp will not work.])
3683                 fi
3684                 AC_RUN_IFELSE(
3685                         [AC_LANG_SOURCE([[
3686 /* find out what STDPATH is */
3687 #include <stdio.h>
3688 #ifdef HAVE_PATHS_H
3689 # include <paths.h>
3690 #endif
3691 #ifndef _PATH_STDPATH
3692 # ifdef _PATH_USERPATH  /* Irix */
3693 #  define _PATH_STDPATH _PATH_USERPATH
3694 # else
3695 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3696 # endif
3697 #endif
3698 #include <sys/types.h>
3699 #include <sys/stat.h>
3700 #include <fcntl.h>
3701 #define DATA "conftest.stdpath"
3702
3703 main()
3704 {
3705         FILE *fd;
3706         int rc;
3707
3708         fd = fopen(DATA,"w");
3709         if(fd == NULL)
3710                 exit(1);
3711
3712         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3713                 exit(1);
3714
3715         exit(0);
3716 }
3717                 ]])],
3718                 [ user_path=`cat conftest.stdpath` ],
3719                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3720                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3721         )
3722 # make sure $bindir is in USER_PATH so scp will work
3723                 t_bindir=`eval echo ${bindir}`
3724                 case $t_bindir in
3725                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3726                 esac
3727                 case $t_bindir in
3728                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3729                 esac
3730                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3731                 if test $? -ne 0  ; then
3732                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3733                         if test $? -ne 0  ; then
3734                                 user_path=$user_path:$t_bindir
3735                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3736                         fi
3737                 fi
3738         fi ]
3739 )
3740 if test "x$external_path_file" != "x/etc/login.conf" ; then
3741         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3742         AC_SUBST(user_path)
3743 fi
3744
3745 # Set superuser path separately to user path
3746 AC_ARG_WITH(superuser-path,
3747         [  --with-superuser-path=  Specify different path for super-user],
3748         [
3749                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3750                     test "x${withval}" != "xyes"; then
3751                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3752                                 [Define if you want a different $PATH
3753                                 for the superuser])
3754                         superuser_path=$withval
3755                 fi
3756         ]
3757 )
3758
3759
3760 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3761 IPV4_IN6_HACK_MSG="no"
3762 AC_ARG_WITH(4in6,
3763         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3764         [
3765                 if test "x$withval" != "xno" ; then
3766                         AC_MSG_RESULT(yes)
3767                         AC_DEFINE(IPV4_IN_IPV6, 1,
3768                                 [Detect IPv4 in IPv6 mapped addresses
3769                                 and treat as IPv4])
3770                         IPV4_IN6_HACK_MSG="yes"
3771                 else
3772                         AC_MSG_RESULT(no)
3773                 fi
3774         ],[
3775                 if test "x$inet6_default_4in6" = "xyes"; then
3776                         AC_MSG_RESULT([yes (default)])
3777                         AC_DEFINE(IPV4_IN_IPV6)
3778                         IPV4_IN6_HACK_MSG="yes"
3779                 else
3780                         AC_MSG_RESULT([no (default)])
3781                 fi
3782         ]
3783 )
3784
3785 # Whether to enable BSD auth support
3786 BSD_AUTH_MSG=no
3787 AC_ARG_WITH(bsd-auth,
3788         [  --with-bsd-auth         Enable BSD auth support],
3789         [
3790                 if test "x$withval" != "xno" ; then
3791                         AC_DEFINE(BSD_AUTH, 1,
3792                                 [Define if you have BSD auth support])
3793                         BSD_AUTH_MSG=yes
3794                 fi
3795         ]
3796 )
3797
3798 # Where to place sshd.pid
3799 piddir=/var/run
3800 # make sure the directory exists
3801 if test ! -d $piddir ; then
3802         piddir=`eval echo ${sysconfdir}`
3803         case $piddir in
3804                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3805         esac
3806 fi
3807
3808 AC_ARG_WITH(pid-dir,
3809         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3810         [
3811                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3812                     test "x${withval}" != "xyes"; then
3813                         piddir=$withval
3814                         if test ! -d $piddir ; then
3815                         AC_MSG_WARN([** no $piddir directory on this system **])
3816                         fi
3817                 fi
3818         ]
3819 )
3820
3821 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3822 AC_SUBST(piddir)
3823
3824 dnl allow user to disable some login recording features
3825 AC_ARG_ENABLE(lastlog,
3826         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3827         [
3828                 if test "x$enableval" = "xno" ; then
3829                         AC_DEFINE(DISABLE_LASTLOG)
3830                 fi
3831         ]
3832 )
3833 AC_ARG_ENABLE(utmp,
3834         [  --disable-utmp          disable use of utmp even if detected [no]],
3835         [
3836                 if test "x$enableval" = "xno" ; then
3837                         AC_DEFINE(DISABLE_UTMP)
3838                 fi
3839         ]
3840 )
3841 AC_ARG_ENABLE(utmpx,
3842         [  --disable-utmpx         disable use of utmpx even if detected [no]],
3843         [
3844                 if test "x$enableval" = "xno" ; then
3845                         AC_DEFINE(DISABLE_UTMPX, 1,
3846                                 [Define if you don't want to use utmpx])
3847                 fi
3848         ]
3849 )
3850 AC_ARG_ENABLE(wtmp,
3851         [  --disable-wtmp          disable use of wtmp even if detected [no]],
3852         [
3853                 if test "x$enableval" = "xno" ; then
3854                         AC_DEFINE(DISABLE_WTMP)
3855                 fi
3856         ]
3857 )
3858 AC_ARG_ENABLE(wtmpx,
3859         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
3860         [
3861                 if test "x$enableval" = "xno" ; then
3862                         AC_DEFINE(DISABLE_WTMPX, 1,
3863                                 [Define if you don't want to use wtmpx])
3864                 fi
3865         ]
3866 )
3867 AC_ARG_ENABLE(libutil,
3868         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
3869         [
3870                 if test "x$enableval" = "xno" ; then
3871                         AC_DEFINE(DISABLE_LOGIN)
3872                 fi
3873         ]
3874 )
3875 AC_ARG_ENABLE(pututline,
3876         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
3877         [
3878                 if test "x$enableval" = "xno" ; then
3879                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
3880                                 [Define if you don't want to use pututline()
3881                                 etc. to write [uw]tmp])
3882                 fi
3883         ]
3884 )
3885 AC_ARG_ENABLE(pututxline,
3886         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
3887         [
3888                 if test "x$enableval" = "xno" ; then
3889                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
3890                                 [Define if you don't want to use pututxline()
3891                                 etc. to write [uw]tmpx])
3892                 fi
3893         ]
3894 )
3895 AC_ARG_WITH(lastlog,
3896   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
3897         [
3898                 if test "x$withval" = "xno" ; then
3899                         AC_DEFINE(DISABLE_LASTLOG)
3900                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
3901                         conf_lastlog_location=$withval
3902                 fi
3903         ]
3904 )
3905
3906 dnl lastlog, [uw]tmpx? detection
3907 dnl  NOTE: set the paths in the platform section to avoid the
3908 dnl   need for command-line parameters
3909 dnl lastlog and [uw]tmp are subject to a file search if all else fails
3910
3911 dnl lastlog detection
3912 dnl  NOTE: the code itself will detect if lastlog is a directory
3913 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
3914 AC_TRY_COMPILE([
3915 #include <sys/types.h>
3916 #include <utmp.h>
3917 #ifdef HAVE_LASTLOG_H
3918 #  include <lastlog.h>
3919 #endif
3920 #ifdef HAVE_PATHS_H
3921 #  include <paths.h>
3922 #endif
3923 #ifdef HAVE_LOGIN_H
3924 # include <login.h>
3925 #endif
3926         ],
3927         [ char *lastlog = LASTLOG_FILE; ],
3928         [ AC_MSG_RESULT(yes) ],
3929         [
3930                 AC_MSG_RESULT(no)
3931                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
3932                 AC_TRY_COMPILE([
3933 #include <sys/types.h>
3934 #include <utmp.h>
3935 #ifdef HAVE_LASTLOG_H
3936 #  include <lastlog.h>
3937 #endif
3938 #ifdef HAVE_PATHS_H
3939 #  include <paths.h>
3940 #endif
3941                 ],
3942                 [ char *lastlog = _PATH_LASTLOG; ],
3943                 [ AC_MSG_RESULT(yes) ],
3944                 [
3945                         AC_MSG_RESULT(no)
3946                         system_lastlog_path=no
3947                 ])
3948         ]
3949 )
3950
3951 if test -z "$conf_lastlog_location"; then
3952         if test x"$system_lastlog_path" = x"no" ; then
3953                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
3954                                 if (test -d "$f" || test -f "$f") ; then
3955                                         conf_lastlog_location=$f
3956                                 fi
3957                 done
3958                 if test -z "$conf_lastlog_location"; then
3959                         AC_MSG_WARN([** Cannot find lastlog **])
3960                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
3961                 fi
3962         fi
3963 fi
3964
3965 if test -n "$conf_lastlog_location"; then
3966         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
3967                 [Define if you want to specify the path to your lastlog file])
3968 fi
3969
3970 dnl utmp detection
3971 AC_MSG_CHECKING([if your system defines UTMP_FILE])
3972 AC_TRY_COMPILE([
3973 #include <sys/types.h>
3974 #include <utmp.h>
3975 #ifdef HAVE_PATHS_H
3976 #  include <paths.h>
3977 #endif
3978         ],
3979         [ char *utmp = UTMP_FILE; ],
3980         [ AC_MSG_RESULT(yes) ],
3981         [ AC_MSG_RESULT(no)
3982           system_utmp_path=no ]
3983 )
3984 if test -z "$conf_utmp_location"; then
3985         if test x"$system_utmp_path" = x"no" ; then
3986                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
3987                         if test -f $f ; then
3988                                 conf_utmp_location=$f
3989                         fi
3990                 done
3991                 if test -z "$conf_utmp_location"; then
3992                         AC_DEFINE(DISABLE_UTMP)
3993                 fi
3994         fi
3995 fi
3996 if test -n "$conf_utmp_location"; then
3997         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
3998                 [Define if you want to specify the path to your utmp file])
3999 fi
4000
4001 dnl wtmp detection
4002 AC_MSG_CHECKING([if your system defines WTMP_FILE])
4003 AC_TRY_COMPILE([
4004 #include <sys/types.h>
4005 #include <utmp.h>
4006 #ifdef HAVE_PATHS_H
4007 #  include <paths.h>
4008 #endif
4009         ],
4010         [ char *wtmp = WTMP_FILE; ],
4011         [ AC_MSG_RESULT(yes) ],
4012         [ AC_MSG_RESULT(no)
4013           system_wtmp_path=no ]
4014 )
4015 if test -z "$conf_wtmp_location"; then
4016         if test x"$system_wtmp_path" = x"no" ; then
4017                 for f in /usr/adm/wtmp /var/log/wtmp; do
4018                         if test -f $f ; then
4019                                 conf_wtmp_location=$f
4020                         fi
4021                 done
4022                 if test -z "$conf_wtmp_location"; then
4023                         AC_DEFINE(DISABLE_WTMP)
4024                 fi
4025         fi
4026 fi
4027 if test -n "$conf_wtmp_location"; then
4028         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
4029                 [Define if you want to specify the path to your wtmp file])
4030 fi
4031
4032
4033 dnl utmpx detection - I don't know any system so perverse as to require
4034 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
4035 dnl  there, though.
4036 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
4037 AC_TRY_COMPILE([
4038 #include <sys/types.h>
4039 #include <utmp.h>
4040 #ifdef HAVE_UTMPX_H
4041 #include <utmpx.h>
4042 #endif
4043 #ifdef HAVE_PATHS_H
4044 #  include <paths.h>
4045 #endif
4046         ],
4047         [ char *utmpx = UTMPX_FILE; ],
4048         [ AC_MSG_RESULT(yes) ],
4049         [ AC_MSG_RESULT(no)
4050           system_utmpx_path=no ]
4051 )
4052 if test -z "$conf_utmpx_location"; then
4053         if test x"$system_utmpx_path" = x"no" ; then
4054                 AC_DEFINE(DISABLE_UTMPX)
4055         fi
4056 else
4057         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
4058                 [Define if you want to specify the path to your utmpx file])
4059 fi
4060
4061 dnl wtmpx detection
4062 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
4063 AC_TRY_COMPILE([
4064 #include <sys/types.h>
4065 #include <utmp.h>
4066 #ifdef HAVE_UTMPX_H
4067 #include <utmpx.h>
4068 #endif
4069 #ifdef HAVE_PATHS_H
4070 #  include <paths.h>
4071 #endif
4072         ],
4073         [ char *wtmpx = WTMPX_FILE; ],
4074         [ AC_MSG_RESULT(yes) ],
4075         [ AC_MSG_RESULT(no)
4076           system_wtmpx_path=no ]
4077 )
4078 if test -z "$conf_wtmpx_location"; then
4079         if test x"$system_wtmpx_path" = x"no" ; then
4080                 AC_DEFINE(DISABLE_WTMPX)
4081         fi
4082 else
4083         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
4084                 [Define if you want to specify the path to your wtmpx file])
4085 fi
4086
4087
4088 if test ! -z "$blibpath" ; then
4089         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4090         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4091 fi
4092
4093 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4094 dnl Add now.
4095 CFLAGS="$CFLAGS $werror_flags"
4096
4097 if grep "#define BROKEN_GETADDRINFO 1" confdefs.h >/dev/null || \
4098     test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
4099         AC_SUBST(TEST_SSH_IPV6, no)
4100 else
4101         AC_SUBST(TEST_SSH_IPV6, yes)
4102 fi
4103
4104 AC_EXEEXT
4105 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4106         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4107         scard/Makefile ssh_prng_cmds survey.sh])
4108 AC_OUTPUT
4109
4110 # Print summary of options
4111
4112 # Someone please show me a better way :)
4113 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4114 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4115 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4116 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4117 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4118 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4119 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
4120 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4121 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4122 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4123
4124 echo ""
4125 echo "OpenSSH has been configured with the following options:"
4126 echo "                     User binaries: $B"
4127 echo "                   System binaries: $C"
4128 echo "               Configuration files: $D"
4129 echo "                   Askpass program: $E"
4130 echo "                      Manual pages: $F"
4131 echo "                          PID file: $G"
4132 echo "  Privilege separation chroot path: $H"
4133 if test "x$external_path_file" = "x/etc/login.conf" ; then
4134 echo "   At runtime, sshd will use the path defined in $external_path_file"
4135 echo "   Make sure the path to scp is present, otherwise scp will not work"
4136 else
4137 echo "            sshd default user PATH: $I"
4138         if test ! -z "$external_path_file"; then
4139 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4140 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4141         fi
4142 fi
4143 if test ! -z "$superuser_path" ; then
4144 echo "          sshd superuser user PATH: $J"
4145 fi
4146 echo "                    Manpage format: $MANTYPE"
4147 echo "                       PAM support: $PAM_MSG"
4148 echo "                   OSF SIA support: $SIA_MSG"
4149 echo "                 KerberosV support: $KRB5_MSG"
4150 echo "                   SELinux support: $SELINUX_MSG"
4151 echo "                 Smartcard support: $SCARD_MSG"
4152 echo "                     S/KEY support: $SKEY_MSG"
4153 echo "              TCP Wrappers support: $TCPW_MSG"
4154 echo "              MD5 password support: $MD5_MSG"
4155 echo "                   libedit support: $LIBEDIT_MSG"
4156 echo "  Solaris process contract support: $SPC_MSG"
4157 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4158 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4159 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4160 echo "              Random number source: $RAND_MSG"
4161 if test ! -z "$USE_RAND_HELPER" ; then
4162 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4163 fi
4164
4165 echo ""
4166
4167 echo "              Host: ${host}"
4168 echo "          Compiler: ${CC}"
4169 echo "    Compiler flags: ${CFLAGS}"
4170 echo "Preprocessor flags: ${CPPFLAGS}"
4171 echo "      Linker flags: ${LDFLAGS}"
4172 echo "         Libraries: ${LIBS}"
4173 if test ! -z "${SSHDLIBS}"; then
4174 echo "         +for sshd: ${SSHDLIBS}"
4175 fi
4176
4177 echo ""
4178
4179 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4180         echo "SVR4 style packages are supported with \"make package\""
4181         echo ""
4182 fi
4183
4184 if test "x$PAM_MSG" = "xyes" ; then
4185         echo "PAM is enabled. You may need to install a PAM control file "
4186         echo "for sshd, otherwise password authentication may fail. "
4187         echo "Example PAM control files can be found in the contrib/ "
4188         echo "subdirectory"
4189         echo ""
4190 fi
4191
4192 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4193         echo "WARNING: you are using the builtin random number collection "
4194         echo "service. Please read WARNING.RNG and request that your OS "
4195         echo "vendor includes kernel-based random number collection in "
4196         echo "future versions of your OS."
4197         echo ""
4198 fi
4199
4200 if test ! -z "$NO_PEERCHECK" ; then
4201         echo "WARNING: the operating system that you are using does not"
4202         echo "appear to support getpeereid(), getpeerucred() or the"
4203         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
4204         echo "enforce security checks to prevent unauthorised connections to"
4205         echo "ssh-agent. Their absence increases the risk that a malicious"
4206         echo "user can connect to your agent."
4207         echo ""
4208 fi
4209
4210 if test "$AUDIT_MODULE" = "bsm" ; then
4211         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4212         echo "See the Solaris section in README.platform for details."
4213 fi