configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PATH_PROG(AR, ar)
  33 AC_PATH_PROG(CAT, cat)
  34 AC_PATH_PROG(KILL, kill)
  35 AC_PATH_PROGS(PERL, perl5 perl)
  36 AC_PATH_PROG(SED, sed)
  37 AC_SUBST(PERL)
  38 AC_PATH_PROG(ENT, ent)
  39 AC_SUBST(ENT)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  43 AC_PATH_PROG(SH, sh)
  44 AC_SUBST(TEST_SHELL,sh)
  45
  46 dnl for buildpkg.sh
  47 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  50         [/usr/sbin${PATH_SEPARATOR}/etc])
  51 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  52 if test -x /sbin/sh; then
  53         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  54 else
  55         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  56 fi
  57
  58 # System features
  59 AC_SYS_LARGEFILE
  60
  61 if test -z "$AR" ; then
  62         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  63 fi
  64
  65 # Use LOGIN_PROGRAM from environment if possible
  66 if test ! -z "$LOGIN_PROGRAM" ; then
  67         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  68                 [If your header files don't define LOGIN_PROGRAM,
  69                 then use this (detected) from environment and PATH])
  70 else
  71         # Search for login
  72         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  73         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  74                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  75         fi
  76 fi
  77
  78 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  79 if test ! -z "$PATH_PASSWD_PROG" ; then
  80         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  81                 [Full path of your "passwd" program])
  82 fi
  83
  84 if test -z "$LD" ; then
  85         LD=$CC
  86 fi
  87 AC_SUBST(LD)
  88
  89 AC_C_INLINE
  90
  91 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  92
  93 use_stack_protector=1
  94 AC_ARG_WITH(stackprotect,
  95     [  --without-stackprotect  Don't use compiler's stack protection], [
  96     if test "x$withval" = "xno"; then
  97         use_stack_protector=0
  98     fi ])
  99
 100 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 101         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
 102         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 103         case $GCC_VER in
 104                 1.*) no_attrib_nonnull=1 ;;
 105                 2.8* | 2.9*)
 106                      CFLAGS="$CFLAGS -Wsign-compare"
 107                      no_attrib_nonnull=1
 108                      ;;
 109                 2.*) no_attrib_nonnull=1 ;;
 110                 3.*) CFLAGS="$CFLAGS -Wsign-compare -Wformat-security" ;;
 111                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign -Wformat-security" ;;
 112                 *) ;;
 113         esac
 114
 115         AC_MSG_CHECKING(if $CC accepts -fno-builtin-memset)
 116         saved_CFLAGS="$CFLAGS"
 117         CFLAGS="$CFLAGS -fno-builtin-memset"
 118         AC_LINK_IFELSE( [AC_LANG_SOURCE([[
 119 #include <string.h>
 120 int main(void){char b[10]; memset(b, 0, sizeof(b));}
 121                 ]])],
 122                 [ AC_MSG_RESULT(yes) ],
 123                 [ AC_MSG_RESULT(no)
 124                   CFLAGS="$saved_CFLAGS" ]
 125 )
 126
 127         # -fstack-protector-all doesn't always work for some GCC versions
 128         # and/or platforms, so we test if we can.  If it's not supported
 129         # on a given platform gcc will emit a warning so we use -Werror.
 130         if test "x$use_stack_protector" = "x1"; then
 131             for t in -fstack-protector-all -fstack-protector; do
 132                 AC_MSG_CHECKING(if $CC supports $t)
 133                 saved_CFLAGS="$CFLAGS"
 134                 saved_LDFLAGS="$LDFLAGS"
 135                 CFLAGS="$CFLAGS $t -Werror"
 136                 LDFLAGS="$LDFLAGS $t -Werror"
 137                 AC_LINK_IFELSE(
 138                         [AC_LANG_SOURCE([
 139 #include <stdio.h>
 140 int main(void){char x[[256]]; snprintf(x, sizeof(x), "XXX"); return 0;}
 141                          ])],
 142                     [ AC_MSG_RESULT(yes)
 143                       CFLAGS="$saved_CFLAGS $t"
 144                       LDFLAGS="$saved_LDFLAGS $t"
 145                       AC_MSG_CHECKING(if $t works)
 146                       AC_RUN_IFELSE(
 147                         [AC_LANG_SOURCE([
 148 #include <stdio.h>
 149 int main(void){char x[[256]]; snprintf(x, sizeof(x), "XXX"); return 0;}
 150                         ])],
 151                         [ AC_MSG_RESULT(yes)
 152                           break ],
 153                         [ AC_MSG_RESULT(no) ],
 154                         [ AC_MSG_WARN([cross compiling: cannot test])
 155                           break ]
 156                       )
 157                     ],
 158                     [ AC_MSG_RESULT(no) ]
 159                 )
 160                 CFLAGS="$saved_CFLAGS"
 161                 LDFLAGS="$saved_LDFLAGS"
 162             done
 163         fi
 164
 165         if test -z "$have_llong_max"; then
 166                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 167                 unset ac_cv_have_decl_LLONG_MAX
 168                 saved_CFLAGS="$CFLAGS"
 169                 CFLAGS="$CFLAGS -std=gnu99"
 170                 AC_CHECK_DECL(LLONG_MAX,
 171                     [have_llong_max=1],
 172                     [CFLAGS="$saved_CFLAGS"],
 173                     [#include <limits.h>]
 174                 )
 175         fi
 176 fi
 177
 178 if test "x$no_attrib_nonnull" != "x1" ; then
 179         AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
 180 fi
 181
 182 AC_ARG_WITH(rpath,
 183         [  --without-rpath         Disable auto-added -R linker paths],
 184         [
 185                 if test "x$withval" = "xno" ; then
 186                         need_dash_r=""
 187                 fi
 188                 if test "x$withval" = "xyes" ; then
 189                         need_dash_r=1
 190                 fi
 191         ]
 192 )
 193
 194 # Allow user to specify flags
 195 AC_ARG_WITH(cflags,
 196         [  --with-cflags           Specify additional flags to pass to compiler],
 197         [
 198                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 199                     test "x${withval}" != "xyes"; then
 200                         CFLAGS="$CFLAGS $withval"
 201                 fi
 202         ]
 203 )
 204 AC_ARG_WITH(cppflags,
 205         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 206         [
 207                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 208                     test "x${withval}" != "xyes"; then
 209                         CPPFLAGS="$CPPFLAGS $withval"
 210                 fi
 211         ]
 212 )
 213 AC_ARG_WITH(ldflags,
 214         [  --with-ldflags          Specify additional flags to pass to linker],
 215         [
 216                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 217                     test "x${withval}" != "xyes"; then
 218                         LDFLAGS="$LDFLAGS $withval"
 219                 fi
 220         ]
 221 )
 222 AC_ARG_WITH(libs,
 223         [  --with-libs             Specify additional libraries to link with],
 224         [
 225                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 226                     test "x${withval}" != "xyes"; then
 227                         LIBS="$LIBS $withval"
 228                 fi
 229         ]
 230 )
 231 AC_ARG_WITH(Werror,
 232         [  --with-Werror           Build main code with -Werror],
 233         [
 234                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 235                         werror_flags="-Werror"
 236                         if test "x${withval}" != "xyes"; then
 237                                 werror_flags="$withval"
 238                         fi
 239                 fi
 240         ]
 241 )
 242
 243 AC_CHECK_HEADERS( \
 244         bstring.h \
 245         crypt.h \
 246         crypto/sha2.h \
 247         dirent.h \
 248         endian.h \
 249         features.h \
 250         fcntl.h \
 251         floatingpoint.h \
 252         getopt.h \
 253         glob.h \
 254         ia.h \
 255         iaf.h \
 256         limits.h \
 257         login.h \
 258         maillock.h \
 259         ndir.h \
 260         net/if_tun.h \
 261         netdb.h \
 262         netgroup.h \
 263         pam/pam_appl.h \
 264         paths.h \
 265         poll.h \
 266         pty.h \
 267         readpassphrase.h \
 268         rpc/types.h \
 269         security/pam_appl.h \
 270         sha2.h \
 271         shadow.h \
 272         stddef.h \
 273         stdint.h \
 274         string.h \
 275         strings.h \
 276         sys/audit.h \
 277         sys/bitypes.h \
 278         sys/bsdtty.h \
 279         sys/cdefs.h \
 280         sys/dir.h \
 281         sys/mman.h \
 282         sys/ndir.h \
 283         sys/poll.h \
 284         sys/prctl.h \
 285         sys/pstat.h \
 286         sys/select.h \
 287         sys/stat.h \
 288         sys/stream.h \
 289         sys/stropts.h \
 290         sys/strtio.h \
 291         sys/statvfs.h \
 292         sys/sysmacros.h \
 293         sys/time.h \
 294         sys/timers.h \
 295         sys/un.h \
 296         time.h \
 297         tmpdir.h \
 298         ttyent.h \
 299         ucred.h \
 300         unistd.h \
 301         usersec.h \
 302         util.h \
 303         utime.h \
 304         utmp.h \
 305         utmpx.h \
 306         vis.h \
 307 )
 308
 309 # lastlog.h requires sys/time.h to be included first on Solaris
 310 AC_CHECK_HEADERS(lastlog.h, [], [], [
 311 #ifdef HAVE_SYS_TIME_H
 312 # include <sys/time.h>
 313 #endif
 314 ])
 315
 316 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 317 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 318 #ifdef HAVE_SYS_STREAM_H
 319 # include <sys/stream.h>
 320 #endif
 321 ])
 322
 323 # login_cap.h requires sys/types.h on NetBSD
 324 AC_CHECK_HEADERS(login_cap.h, [], [], [
 325 #include <sys/types.h>
 326 ])
 327
 328 # older BSDs need sys/param.h before sys/mount.h
 329 AC_CHECK_HEADERS(sys/mount.h, [], [], [
 330 #include <sys/param.h>
 331 ])
 332
 333 # Messages for features tested for in target-specific section
 334 SIA_MSG="no"
 335 SPC_MSG="no"
 336
 337 # Check for some target-specific stuff
 338 case "$host" in
 339 *-*-aix*)
 340         # Some versions of VAC won't allow macro redefinitions at
 341         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 342         # particularly with older versions of vac or xlc.
 343         # It also throws errors about null macro argments, but these are
 344         # not fatal.
 345         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 346         AC_COMPILE_IFELSE(
 347             [AC_LANG_SOURCE([[
 348 #define testmacro foo
 349 #define testmacro bar
 350 int main(void) { exit(0); }
 351             ]])],
 352             [ AC_MSG_RESULT(yes) ],
 353             [ AC_MSG_RESULT(no)
 354               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 355               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 356               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 357               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 358             ]
 359         )
 360
 361         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 362         if (test -z "$blibpath"); then
 363                 blibpath="/usr/lib:/lib"
 364         fi
 365         saved_LDFLAGS="$LDFLAGS"
 366         if test "$GCC" = "yes"; then
 367                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 368         else
 369                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 370         fi
 371         for tryflags in $flags ;do
 372                 if (test -z "$blibflags"); then
 373                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 374                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 375                 fi
 376         done
 377         if (test -z "$blibflags"); then
 378                 AC_MSG_RESULT(not found)
 379                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 380         else
 381                 AC_MSG_RESULT($blibflags)
 382         fi
 383         LDFLAGS="$saved_LDFLAGS"
 384         dnl Check for authenticate.  Might be in libs.a on older AIXes
 385         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 386                 [Define if you want to enable AIX4's authenticate function])],
 387                 [AC_CHECK_LIB(s,authenticate,
 388                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 389                                 LIBS="$LIBS -ls"
 390                         ])
 391                 ])
 392         dnl Check for various auth function declarations in headers.
 393         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 394             passwdexpired, setauthdb], , , [#include <usersec.h>])
 395         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 396         AC_CHECK_DECLS(loginfailed,
 397                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 398                   AC_TRY_COMPILE(
 399                         [#include <usersec.h>],
 400                         [(void)loginfailed("user","host","tty",0);],
 401                         [AC_MSG_RESULT(yes)
 402                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 403                                 [Define if your AIX loginfailed() function
 404                                 takes 4 arguments (AIX >= 5.2)])],
 405                         [AC_MSG_RESULT(no)]
 406                 )],
 407                 [],
 408                 [#include <usersec.h>]
 409         )
 410         AC_CHECK_FUNCS(getgrset setauthdb)
 411         AC_CHECK_DECL(F_CLOSEM,
 412             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 413             [],
 414             [ #include <limits.h>
 415               #include <fcntl.h> ]
 416         )
 417         check_for_aix_broken_getaddrinfo=1
 418         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 419         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 420             [Define if your platform breaks doing a seteuid before a setuid])
 421         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 422         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 423         dnl AIX handles lastlog as part of its login message
 424         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 425         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 426                 [Some systems need a utmpx entry for /bin/login to work])
 427         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 428                 [Define to a Set Process Title type if your system is
 429                 supported by bsd-setproctitle.c])
 430         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 431             [AIX 5.2 and 5.3 (and presumably newer) require this])
 432         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 433         ;;
 434 *-*-cygwin*)
 435         check_for_libcrypt_later=1
 436         LIBS="$LIBS /usr/lib/textreadmode.o"
 437         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 438         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 439         AC_DEFINE(DISABLE_SHADOW, 1,
 440                 [Define if you want to disable shadow passwords])
 441         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 442                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 443         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 444                 [Define if the concept of ports only accessible to
 445                 superusers isn't known])
 446         AC_DEFINE(DISABLE_FD_PASSING, 1,
 447                 [Define if your platform needs to skip post auth
 448                 file descriptor passing])
 449         AC_DEFINE(SSH_IOBUFSZ, 65535, [Windows is sensitive to read buffer size])
 450         ;;
 451 *-*-dgux*)
 452         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 453                 [Define if your system choked on IP TOS setting])
 454         AC_DEFINE(SETEUID_BREAKS_SETUID)
 455         AC_DEFINE(BROKEN_SETREUID)
 456         AC_DEFINE(BROKEN_SETREGID)
 457         ;;
 458 *-*-darwin*)
 459         AC_MSG_CHECKING(if we have working getaddrinfo)
 460         AC_TRY_RUN([#include <mach-o/dyld.h>
 461 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 462                 exit(0);
 463         else
 464                 exit(1);
 465 }], [AC_MSG_RESULT(working)],
 466         [AC_MSG_RESULT(buggy)
 467         AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
 468         [AC_MSG_RESULT(assume it is working)])
 469         AC_DEFINE(SETEUID_BREAKS_SETUID)
 470         AC_DEFINE(BROKEN_SETREUID)
 471         AC_DEFINE(BROKEN_SETREGID)
 472         AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
 473         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 474                 [Define if your resolver libs need this for getrrsetbyname])
 475         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 476         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 477             [Use tunnel device compatibility to OpenBSD])
 478         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 479             [Prepend the address family to IP tunnel traffic])
 480         m4_pattern_allow(AU_IPv)
 481         AC_CHECK_DECL(AU_IPv4, [],
 482             AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
 483             [#include <bsm/audit.h>]
 484         AC_DEFINE(LASTLOG_WRITE_PUTUTXLINE, 1,
 485             [Define if pututxline updates lastlog too])
 486         )
 487         ;;
 488 *-*-dragonfly*)
 489         SSHDLIBS="$SSHDLIBS -lcrypt"
 490         ;;
 491 *-*-hpux*)
 492         # first we define all of the options common to all HP-UX releases
 493         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 494         IPADDR_IN_DISPLAY=yes
 495         AC_DEFINE(USE_PIPES)
 496         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 497             [Define if your login program cannot handle end of options ("--")])
 498         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 499         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 500                 [String used in /etc/passwd to denote locked account])
 501         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 502         MAIL="/var/mail/username"
 503         LIBS="$LIBS -lsec"
 504         AC_CHECK_LIB(xnet, t_error, ,
 505             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 506
 507         # next, we define all of the options specific to major releases
 508         case "$host" in
 509         *-*-hpux10*)
 510                 if test -z "$GCC"; then
 511                         CFLAGS="$CFLAGS -Ae"
 512                 fi
 513                 ;;
 514         *-*-hpux11*)
 515                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 516                         [Define if you are using Solaris-derived PAM which
 517                         passes pam_messages to the conversation function
 518                         with an extra level of indirection])
 519                 AC_DEFINE(DISABLE_UTMP, 1,
 520                         [Define if you don't want to use utmp])
 521                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 522                 check_for_hpux_broken_getaddrinfo=1
 523                 check_for_conflicting_getspnam=1
 524                 ;;
 525         esac
 526
 527         # lastly, we define options specific to minor releases
 528         case "$host" in
 529         *-*-hpux10.26)
 530                 AC_DEFINE(HAVE_SECUREWARE, 1,
 531                         [Define if you have SecureWare-based
 532                         protected password database])
 533                 disable_ptmx_check=yes
 534                 LIBS="$LIBS -lsecpw"
 535                 ;;
 536         esac
 537         ;;
 538 *-*-irix5*)
 539         PATH="$PATH:/usr/etc"
 540         AC_DEFINE(BROKEN_INET_NTOA, 1,
 541                 [Define if you system's inet_ntoa is busted
 542                 (e.g. Irix gcc issue)])
 543         AC_DEFINE(SETEUID_BREAKS_SETUID)
 544         AC_DEFINE(BROKEN_SETREUID)
 545         AC_DEFINE(BROKEN_SETREGID)
 546         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 547                 [Define if you shouldn't strip 'tty' from your
 548                 ttyname in [uw]tmp])
 549         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 550         ;;
 551 *-*-irix6*)
 552         PATH="$PATH:/usr/etc"
 553         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 554                 [Define if you have/want arrays
 555                 (cluster-wide session managment, not C arrays)])
 556         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 557                 [Define if you want IRIX project management])
 558         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 559                 [Define if you want IRIX audit trails])
 560         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 561                 [Define if you want IRIX kernel jobs])])
 562         AC_DEFINE(BROKEN_INET_NTOA)
 563         AC_DEFINE(SETEUID_BREAKS_SETUID)
 564         AC_DEFINE(BROKEN_SETREUID)
 565         AC_DEFINE(BROKEN_SETREGID)
 566         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 567         AC_DEFINE(WITH_ABBREV_NO_TTY)
 568         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 569         ;;
 570 *-*-k*bsd*-gnu | *-*-kopensolaris*-gnu)
 571         check_for_libcrypt_later=1
 572         AC_DEFINE(PAM_TTY_KLUDGE)
 573         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!")
 574         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 575         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 576         AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 577         ;;
 578 *-*-linux*)
 579         no_dev_ptmx=1
 580         check_for_libcrypt_later=1
 581         check_for_openpty_ctty_bug=1
 582         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 583                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 584         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 585                 [String used in /etc/passwd to denote locked account])
 586         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 587         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 588                 [Define to whatever link() returns for "not supported"
 589                 if it doesn't return EOPNOTSUPP.])
 590         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 591         AC_DEFINE(USE_BTMP)
 592         AC_DEFINE(LINUX_OOM_ADJUST, 1, [Adjust Linux out-of-memory killer])
 593         inet6_default_4in6=yes
 594         case `uname -r` in
 595         1.*|2.0.*)
 596                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 597                         [Define if cmsg_type is not passed correctly])
 598                 ;;
 599         esac
 600         # tun(4) forwarding compat code
 601         AC_CHECK_HEADERS(linux/if_tun.h)
 602         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 603                 AC_DEFINE(SSH_TUN_LINUX, 1,
 604                     [Open tunnel devices the Linux tun/tap way])
 605                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 606                     [Use tunnel device compatibility to OpenBSD])
 607                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 608                     [Prepend the address family to IP tunnel traffic])
 609         fi
 610         ;;
 611 mips-sony-bsd|mips-sony-newsos4)
 612         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 613         SONY=1
 614         ;;
 615 *-*-netbsd*)
 616         check_for_libcrypt_before=1
 617         if test "x$withval" != "xno" ; then
 618                 need_dash_r=1
 619         fi
 620         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 621         AC_CHECK_HEADER([net/if_tap.h], ,
 622             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 623         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 624             [Prepend the address family to IP tunnel traffic])
 625         ;;
 626 *-*-freebsd*)
 627         check_for_libcrypt_later=1
 628         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 629         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 630         AC_CHECK_HEADER([net/if_tap.h], ,
 631             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 632         AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need])
 633         ;;
 634 *-*-bsdi*)
 635         AC_DEFINE(SETEUID_BREAKS_SETUID)
 636         AC_DEFINE(BROKEN_SETREUID)
 637         AC_DEFINE(BROKEN_SETREGID)
 638         ;;
 639 *-next-*)
 640         conf_lastlog_location="/usr/adm/lastlog"
 641         conf_utmp_location=/etc/utmp
 642         conf_wtmp_location=/usr/adm/wtmp
 643         MAIL=/usr/spool/mail
 644         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 645         AC_DEFINE(BROKEN_REALPATH)
 646         AC_DEFINE(USE_PIPES)
 647         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 648         ;;
 649 *-*-openbsd*)
 650         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 651         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 652         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 653         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 654             [syslog_r function is safe to use in in a signal handler])
 655         ;;
 656 *-*-solaris*)
 657         if test "x$withval" != "xno" ; then
 658                 need_dash_r=1
 659         fi
 660         AC_DEFINE(PAM_SUN_CODEBASE)
 661         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 662         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 663                 [Some versions of /bin/login need the TERM supplied
 664                 on the commandline])
 665         AC_DEFINE(PAM_TTY_KLUDGE)
 666         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 667                 [Define if pam_chauthtok wants real uid set
 668                 to the unpriv'ed user])
 669         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 670         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 671         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 672                 [Define if sshd somehow reacquires a controlling TTY
 673                 after setsid()])
 674         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 675                 in case the name is longer than 8 chars])
 676         AC_DEFINE(BROKEN_TCGETATTR_ICANON, 1, [tcgetattr with ICANON may hang])
 677         external_path_file=/etc/default/login
 678         # hardwire lastlog location (can't detect it on some versions)
 679         conf_lastlog_location="/var/adm/lastlog"
 680         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 681         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 682         if test "$sol2ver" -ge 8; then
 683                 AC_MSG_RESULT(yes)
 684                 AC_DEFINE(DISABLE_UTMP)
 685                 AC_DEFINE(DISABLE_WTMP, 1,
 686                         [Define if you don't want to use wtmp])
 687         else
 688                 AC_MSG_RESULT(no)
 689         fi
 690         AC_ARG_WITH(solaris-contracts,
 691                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 692                 [
 693                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 694                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 695                                 [Define if you have Solaris process contracts])
 696                           SSHDLIBS="$SSHDLIBS -lcontract"
 697                           AC_SUBST(SSHDLIBS)
 698                           SPC_MSG="yes" ], )
 699                 ],
 700         )
 701         ;;
 702 *-*-sunos4*)
 703         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 704         AC_CHECK_FUNCS(getpwanam)
 705         AC_DEFINE(PAM_SUN_CODEBASE)
 706         conf_utmp_location=/etc/utmp
 707         conf_wtmp_location=/var/adm/wtmp
 708         conf_lastlog_location=/var/adm/lastlog
 709         AC_DEFINE(USE_PIPES)
 710         ;;
 711 *-ncr-sysv*)
 712         LIBS="$LIBS -lc89"
 713         AC_DEFINE(USE_PIPES)
 714         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 715         AC_DEFINE(SETEUID_BREAKS_SETUID)
 716         AC_DEFINE(BROKEN_SETREUID)
 717         AC_DEFINE(BROKEN_SETREGID)
 718         ;;
 719 *-sni-sysv*)
 720         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 721         AC_CHECK_LIB(dl, dlsym, ,)
 722         # -lresolv needs to be at the end of LIBS or DNS lookups break
 723         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 724         IPADDR_IN_DISPLAY=yes
 725         AC_DEFINE(USE_PIPES)
 726         AC_DEFINE(IP_TOS_IS_BROKEN)
 727         AC_DEFINE(SETEUID_BREAKS_SETUID)
 728         AC_DEFINE(BROKEN_SETREUID)
 729         AC_DEFINE(BROKEN_SETREGID)
 730         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 731         external_path_file=/etc/default/login
 732         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 733         # Attention: always take care to bind libsocket and libnsl before libc,
 734         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 735         ;;
 736 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 737 *-*-sysv4.2*)
 738         AC_DEFINE(USE_PIPES)
 739         AC_DEFINE(SETEUID_BREAKS_SETUID)
 740         AC_DEFINE(BROKEN_SETREUID)
 741         AC_DEFINE(BROKEN_SETREGID)
 742         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 743         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 744         ;;
 745 # UnixWare 7.x, OpenUNIX 8
 746 *-*-sysv5*)
 747         CPPFLAGS="$CPPFLAGS -Dvsnprintf=_xvsnprintf -Dsnprintf=_xsnprintf"
 748         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 749         AC_DEFINE(USE_PIPES)
 750         AC_DEFINE(SETEUID_BREAKS_SETUID)
 751         AC_DEFINE(BROKEN_GETADDRINFO)
 752         AC_DEFINE(BROKEN_SETREUID)
 753         AC_DEFINE(BROKEN_SETREGID)
 754         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 755         case "$host" in
 756         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 757                 TEST_SHELL=/u95/bin/sh
 758                 AC_DEFINE(BROKEN_LIBIAF, 1,
 759                         [ia_uinfo routines not supported by OS yet])
 760                 AC_DEFINE(BROKEN_UPDWTMPX)
 761                 AC_CHECK_LIB(prot, getluid,[ LIBS="$LIBS -lprot"
 762                         AC_CHECK_FUNCS(getluid setluid,,,-lprot)
 763                         AC_DEFINE(HAVE_SECUREWARE)
 764                         AC_DEFINE(DISABLE_SHADOW)
 765                         ],,)
 766                 ;;
 767         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 768                 check_for_libcrypt_later=1
 769                 ;;
 770         esac
 771         ;;
 772 *-*-sysv*)
 773         ;;
 774 # SCO UNIX and OEM versions of SCO UNIX
 775 *-*-sco3.2v4*)
 776         AC_MSG_ERROR("This Platform is no longer supported.")
 777         ;;
 778 # SCO OpenServer 5.x
 779 *-*-sco3.2v5*)
 780         if test -z "$GCC"; then
 781                 CFLAGS="$CFLAGS -belf"
 782         fi
 783         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 784         no_dev_ptmx=1
 785         AC_DEFINE(USE_PIPES)
 786         AC_DEFINE(HAVE_SECUREWARE)
 787         AC_DEFINE(DISABLE_SHADOW)
 788         AC_DEFINE(DISABLE_FD_PASSING)
 789         AC_DEFINE(SETEUID_BREAKS_SETUID)
 790         AC_DEFINE(BROKEN_GETADDRINFO)
 791         AC_DEFINE(BROKEN_SETREUID)
 792         AC_DEFINE(BROKEN_SETREGID)
 793         AC_DEFINE(WITH_ABBREV_NO_TTY)
 794         AC_DEFINE(BROKEN_UPDWTMPX)
 795         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 796         AC_CHECK_FUNCS(getluid setluid)
 797         MANTYPE=man
 798         TEST_SHELL=ksh
 799         ;;
 800 *-*-unicosmk*)
 801         AC_DEFINE(NO_SSH_LASTLOG, 1,
 802                 [Define if you don't want to use lastlog in session.c])
 803         AC_DEFINE(SETEUID_BREAKS_SETUID)
 804         AC_DEFINE(BROKEN_SETREUID)
 805         AC_DEFINE(BROKEN_SETREGID)
 806         AC_DEFINE(USE_PIPES)
 807         AC_DEFINE(DISABLE_FD_PASSING)
 808         LDFLAGS="$LDFLAGS"
 809         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 810         MANTYPE=cat
 811         ;;
 812 *-*-unicosmp*)
 813         AC_DEFINE(SETEUID_BREAKS_SETUID)
 814         AC_DEFINE(BROKEN_SETREUID)
 815         AC_DEFINE(BROKEN_SETREGID)
 816         AC_DEFINE(WITH_ABBREV_NO_TTY)
 817         AC_DEFINE(USE_PIPES)
 818         AC_DEFINE(DISABLE_FD_PASSING)
 819         LDFLAGS="$LDFLAGS"
 820         LIBS="$LIBS -lgen -lacid -ldb"
 821         MANTYPE=cat
 822         ;;
 823 *-*-unicos*)
 824         AC_DEFINE(SETEUID_BREAKS_SETUID)
 825         AC_DEFINE(BROKEN_SETREUID)
 826         AC_DEFINE(BROKEN_SETREGID)
 827         AC_DEFINE(USE_PIPES)
 828         AC_DEFINE(DISABLE_FD_PASSING)
 829         AC_DEFINE(NO_SSH_LASTLOG)
 830         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 831         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 832         MANTYPE=cat
 833         ;;
 834 *-dec-osf*)
 835         AC_MSG_CHECKING(for Digital Unix SIA)
 836         no_osfsia=""
 837         AC_ARG_WITH(osfsia,
 838                 [  --with-osfsia           Enable Digital Unix SIA],
 839                 [
 840                         if test "x$withval" = "xno" ; then
 841                                 AC_MSG_RESULT(disabled)
 842                                 no_osfsia=1
 843                         fi
 844                 ],
 845         )
 846         if test -z "$no_osfsia" ; then
 847                 if test -f /etc/sia/matrix.conf; then
 848                         AC_MSG_RESULT(yes)
 849                         AC_DEFINE(HAVE_OSF_SIA, 1,
 850                                 [Define if you have Digital Unix Security
 851                                 Integration Architecture])
 852                         AC_DEFINE(DISABLE_LOGIN, 1,
 853                                 [Define if you don't want to use your
 854                                 system's login() call])
 855                         AC_DEFINE(DISABLE_FD_PASSING)
 856                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 857                         SIA_MSG="yes"
 858                 else
 859                         AC_MSG_RESULT(no)
 860                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 861                           [String used in /etc/passwd to denote locked account])
 862                 fi
 863         fi
 864         AC_DEFINE(BROKEN_GETADDRINFO)
 865         AC_DEFINE(SETEUID_BREAKS_SETUID)
 866         AC_DEFINE(BROKEN_SETREUID)
 867         AC_DEFINE(BROKEN_SETREGID)
 868         AC_DEFINE(BROKEN_READV_COMPARISON, 1, [Can't do comparisons on readv])
 869         ;;
 870
 871 *-*-nto-qnx*)
 872         AC_DEFINE(USE_PIPES)
 873         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 874         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 875         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 876         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 877         AC_DEFINE(DISABLE_LASTLOG)
 878         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 879         AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
 880         enable_etc_default_login=no     # has incompatible /etc/default/login
 881         case "$host" in
 882         *-*-nto-qnx6*)
 883                 AC_DEFINE(DISABLE_FD_PASSING)
 884                 ;;
 885         esac
 886         ;;
 887
 888 *-*-ultrix*)
 889         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 890         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 891         AC_DEFINE(NEED_SETPGRP)
 892         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 893         ;;
 894
 895 *-*-lynxos)
 896         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 897         AC_DEFINE(MISSING_HOWMANY)
 898         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 899         ;;
 900 esac
 901
 902 AC_MSG_CHECKING(compiler and flags for sanity)
 903 AC_RUN_IFELSE(
 904         [AC_LANG_SOURCE([
 905 #include <stdio.h>
 906 int main(){exit(0);}
 907         ])],
 908         [       AC_MSG_RESULT(yes) ],
 909         [
 910                 AC_MSG_RESULT(no)
 911                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 912         ],
 913         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 914 )
 915
 916 dnl Checks for header files.
 917 # Checks for libraries.
 918 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 919 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 920
 921 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 922 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 923         AC_CHECK_LIB(gen, dirname,[
 924                 AC_CACHE_CHECK([for broken dirname],
 925                         ac_cv_have_broken_dirname, [
 926                         save_LIBS="$LIBS"
 927                         LIBS="$LIBS -lgen"
 928                         AC_RUN_IFELSE(
 929                                 [AC_LANG_SOURCE([[
 930 #include <libgen.h>
 931 #include <string.h>
 932
 933 int main(int argc, char **argv) {
 934     char *s, buf[32];
 935
 936     strncpy(buf,"/etc", 32);
 937     s = dirname(buf);
 938     if (!s || strncmp(s, "/", 32) != 0) {
 939         exit(1);
 940     } else {
 941         exit(0);
 942     }
 943 }
 944                                 ]])],
 945                                 [ ac_cv_have_broken_dirname="no" ],
 946                                 [ ac_cv_have_broken_dirname="yes" ],
 947                                 [ ac_cv_have_broken_dirname="no" ],
 948                         )
 949                         LIBS="$save_LIBS"
 950                 ])
 951                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 952                         LIBS="$LIBS -lgen"
 953                         AC_DEFINE(HAVE_DIRNAME)
 954                         AC_CHECK_HEADERS(libgen.h)
 955                 fi
 956         ])
 957 ])
 958
 959 AC_CHECK_FUNC(getspnam, ,
 960         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 961 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 962         [Define if you have the basename function.]))
 963
 964 dnl zlib is required
 965 AC_ARG_WITH(zlib,
 966         [  --with-zlib=PATH        Use zlib in PATH],
 967         [ if test "x$withval" = "xno" ; then
 968                 AC_MSG_ERROR([*** zlib is required ***])
 969           elif test "x$withval" != "xyes"; then
 970                 if test -d "$withval/lib"; then
 971                         if test -n "${need_dash_r}"; then
 972                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 973                         else
 974                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 975                         fi
 976                 else
 977                         if test -n "${need_dash_r}"; then
 978                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 979                         else
 980                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 981                         fi
 982                 fi
 983                 if test -d "$withval/include"; then
 984                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 985                 else
 986                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 987                 fi
 988         fi ]
 989 )
 990
 991 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 992 AC_CHECK_LIB(z, deflate, ,
 993         [
 994                 saved_CPPFLAGS="$CPPFLAGS"
 995                 saved_LDFLAGS="$LDFLAGS"
 996                 save_LIBS="$LIBS"
 997                 dnl Check default zlib install dir
 998                 if test -n "${need_dash_r}"; then
 999                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
1000                 else
1001                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
1002                 fi
1003                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
1004                 LIBS="$LIBS -lz"
1005                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
1006                         [
1007                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
1008                         ]
1009                 )
1010         ]
1011 )
1012
1013 AC_ARG_WITH(zlib-version-check,
1014         [  --without-zlib-version-check Disable zlib version check],
1015         [  if test "x$withval" = "xno" ; then
1016                 zlib_check_nonfatal=1
1017            fi
1018         ]
1019 )
1020
1021 AC_MSG_CHECKING(for possibly buggy zlib)
1022 AC_RUN_IFELSE([AC_LANG_SOURCE([[
1023 #include <stdio.h>
1024 #include <zlib.h>
1025 int main()
1026 {
1027         int a=0, b=0, c=0, d=0, n, v;
1028         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
1029         if (n != 3 && n != 4)
1030                 exit(1);
1031         v = a*1000000 + b*10000 + c*100 + d;
1032         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
1033
1034         /* 1.1.4 is OK */
1035         if (a == 1 && b == 1 && c >= 4)
1036                 exit(0);
1037
1038         /* 1.2.3 and up are OK */
1039         if (v >= 1020300)
1040                 exit(0);
1041
1042         exit(2);
1043 }
1044         ]])],
1045         AC_MSG_RESULT(no),
1046         [ AC_MSG_RESULT(yes)
1047           if test -z "$zlib_check_nonfatal" ; then
1048                 AC_MSG_ERROR([*** zlib too old - check config.log ***
1049 Your reported zlib version has known security problems.  It's possible your
1050 vendor has fixed these problems without changing the version number.  If you
1051 are sure this is the case, you can disable the check by running
1052 "./configure --without-zlib-version-check".
1053 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
1054 See http://www.gzip.org/zlib/ for details.])
1055           else
1056                 AC_MSG_WARN([zlib version may have security problems])
1057           fi
1058         ],
1059         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
1060 )
1061
1062 dnl UnixWare 2.x
1063 AC_CHECK_FUNC(strcasecmp,
1064         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
1065 )
1066 AC_CHECK_FUNCS(utimes,
1067         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
1068                                         LIBS="$LIBS -lc89"]) ]
1069 )
1070
1071 dnl    Checks for libutil functions
1072 AC_CHECK_HEADERS(libutil.h)
1073 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
1074         [Define if your libraries define login()])])
1075 AC_CHECK_FUNCS(fmt_scaled logout updwtmp logwtmp)
1076
1077 AC_FUNC_STRFTIME
1078
1079 # Check for ALTDIRFUNC glob() extension
1080 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
1081 AC_EGREP_CPP(FOUNDIT,
1082         [
1083                 #include <glob.h>
1084                 #ifdef GLOB_ALTDIRFUNC
1085                 FOUNDIT
1086                 #endif
1087         ],
1088         [
1089                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
1090                         [Define if your system glob() function has
1091                         the GLOB_ALTDIRFUNC extension])
1092                 AC_MSG_RESULT(yes)
1093         ],
1094         [
1095                 AC_MSG_RESULT(no)
1096         ]
1097 )
1098
1099 # Check for g.gl_matchc glob() extension
1100 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1101 AC_TRY_COMPILE(
1102         [ #include <glob.h> ],
1103         [glob_t g; g.gl_matchc = 1;],
1104         [
1105                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1106                         [Define if your system glob() function has
1107                         gl_matchc options in glob_t])
1108                 AC_MSG_RESULT(yes)
1109         ],
1110         [
1111                 AC_MSG_RESULT(no)
1112         ]
1113 )
1114
1115 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1116
1117 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1118 AC_RUN_IFELSE(
1119         [AC_LANG_SOURCE([[
1120 #include <sys/types.h>
1121 #include <dirent.h>
1122 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1123         ]])],
1124         [AC_MSG_RESULT(yes)],
1125         [
1126                 AC_MSG_RESULT(no)
1127                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1128                         [Define if your struct dirent expects you to
1129                         allocate extra space for d_name])
1130         ],
1131         [
1132                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1133                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1134         ]
1135 )
1136
1137 AC_MSG_CHECKING([for /proc/pid/fd directory])
1138 if test -d "/proc/$$/fd" ; then
1139         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1140         AC_MSG_RESULT(yes)
1141 else
1142         AC_MSG_RESULT(no)
1143 fi
1144
1145 # Check whether user wants S/Key support
1146 SKEY_MSG="no"
1147 AC_ARG_WITH(skey,
1148         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1149         [
1150                 if test "x$withval" != "xno" ; then
1151
1152                         if test "x$withval" != "xyes" ; then
1153                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1154                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1155                         fi
1156
1157                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1158                         LIBS="-lskey $LIBS"
1159                         SKEY_MSG="yes"
1160
1161                         AC_MSG_CHECKING([for s/key support])
1162                         AC_LINK_IFELSE(
1163                                 [AC_LANG_SOURCE([[
1164 #include <stdio.h>
1165 #include <skey.h>
1166 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1167                                 ]])],
1168                                 [AC_MSG_RESULT(yes)],
1169                                 [
1170                                         AC_MSG_RESULT(no)
1171                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1172                                 ])
1173                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1174                         AC_TRY_COMPILE(
1175                                 [#include <stdio.h>
1176                                  #include <skey.h>],
1177                                 [(void)skeychallenge(NULL,"name","",0);],
1178                                 [AC_MSG_RESULT(yes)
1179                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1180                                         [Define if your skeychallenge()
1181                                         function takes 4 arguments (NetBSD)])],
1182                                 [AC_MSG_RESULT(no)]
1183                         )
1184                 fi
1185         ]
1186 )
1187
1188 # Check whether user wants TCP wrappers support
1189 TCPW_MSG="no"
1190 AC_ARG_WITH(tcp-wrappers,
1191         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1192         [
1193                 if test "x$withval" != "xno" ; then
1194                         saved_LIBS="$LIBS"
1195                         saved_LDFLAGS="$LDFLAGS"
1196                         saved_CPPFLAGS="$CPPFLAGS"
1197                         if test -n "${withval}" && \
1198                             test "x${withval}" != "xyes"; then
1199                                 if test -d "${withval}/lib"; then
1200                                         if test -n "${need_dash_r}"; then
1201                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1202                                         else
1203                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1204                                         fi
1205                                 else
1206                                         if test -n "${need_dash_r}"; then
1207                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1208                                         else
1209                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1210                                         fi
1211                                 fi
1212                                 if test -d "${withval}/include"; then
1213                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1214                                 else
1215                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1216                                 fi
1217                         fi
1218                         LIBS="-lwrap $LIBS"
1219                         AC_MSG_CHECKING(for libwrap)
1220                         AC_TRY_LINK(
1221                                 [
1222 #include <sys/types.h>
1223 #include <sys/socket.h>
1224 #include <netinet/in.h>
1225 #include <tcpd.h>
1226                                         int deny_severity = 0, allow_severity = 0;
1227                                 ],
1228                                 [hosts_access(0);],
1229                                 [
1230                                         AC_MSG_RESULT(yes)
1231                                         AC_DEFINE(LIBWRAP, 1,
1232                                                 [Define if you want
1233                                                 TCP Wrappers support])
1234                                         SSHDLIBS="$SSHDLIBS -lwrap"
1235                                         TCPW_MSG="yes"
1236                                 ],
1237                                 [
1238                                         AC_MSG_ERROR([*** libwrap missing])
1239                                 ]
1240                         )
1241                         LIBS="$saved_LIBS"
1242                 fi
1243         ]
1244 )
1245
1246 # Check whether user wants libedit support
1247 LIBEDIT_MSG="no"
1248 AC_ARG_WITH(libedit,
1249         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1250         [ if test "x$withval" != "xno" ; then
1251                 if test "x$withval" != "xyes"; then
1252                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1253                         if test -n "${need_dash_r}"; then
1254                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1255                         else
1256                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1257                         fi
1258                 fi
1259                 AC_CHECK_LIB(edit, el_init,
1260                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1261                           LIBEDIT="-ledit -lcurses"
1262                           LIBEDIT_MSG="yes"
1263                           AC_SUBST(LIBEDIT)
1264                         ],
1265                         [ AC_MSG_ERROR(libedit not found) ],
1266                         [ -lcurses ]
1267                 )
1268                 AC_MSG_CHECKING(if libedit version is compatible)
1269                 AC_COMPILE_IFELSE(
1270                     [AC_LANG_SOURCE([[
1271 #include <histedit.h>
1272 int main(void)
1273 {
1274         int i = H_SETSIZE;
1275         el_init("", NULL, NULL, NULL);
1276         exit(0);
1277 }
1278                     ]])],
1279                     [ AC_MSG_RESULT(yes) ],
1280                     [ AC_MSG_RESULT(no)
1281                       AC_MSG_ERROR(libedit version is not compatible) ]
1282                 )
1283         fi ]
1284 )
1285
1286 AUDIT_MODULE=none
1287 AC_ARG_WITH(audit,
1288         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1289         [
1290           AC_MSG_CHECKING(for supported audit module)
1291           case "$withval" in
1292           bsm)
1293                 AC_MSG_RESULT(bsm)
1294                 AUDIT_MODULE=bsm
1295                 dnl    Checks for headers, libs and functions
1296                 AC_CHECK_HEADERS(bsm/audit.h, [],
1297                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1298                     [
1299 #ifdef HAVE_TIME_H
1300 # include <time.h>
1301 #endif
1302                     ]
1303 )
1304                 AC_CHECK_LIB(bsm, getaudit, [],
1305                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1306                 AC_CHECK_FUNCS(getaudit, [],
1307                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1308                 # These are optional
1309                 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1310                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1311                 ;;
1312           debug)
1313                 AUDIT_MODULE=debug
1314                 AC_MSG_RESULT(debug)
1315                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1316                 ;;
1317           no)
1318                 AC_MSG_RESULT(no)
1319                 ;;
1320           *)
1321                 AC_MSG_ERROR([Unknown audit module $withval])
1322                 ;;
1323         esac ]
1324 )
1325
1326 dnl    Checks for library functions. Please keep in alphabetical order
1327 AC_CHECK_FUNCS( \
1328         arc4random \
1329         arc4random_buf \
1330         arc4random_uniform \
1331         asprintf \
1332         b64_ntop \
1333         __b64_ntop \
1334         b64_pton \
1335         __b64_pton \
1336         bcopy \
1337         bindresvport_sa \
1338         clock \
1339         closefrom \
1340         dirfd \
1341         fchmod \
1342         fchown \
1343         freeaddrinfo \
1344         fstatvfs \
1345         futimes \
1346         getaddrinfo \
1347         getcwd \
1348         getgrouplist \
1349         getnameinfo \
1350         getopt \
1351         getpeereid \
1352         getpeerucred \
1353         _getpty \
1354         getrlimit \
1355         getttyent \
1356         glob \
1357         group_from_gid \
1358         inet_aton \
1359         inet_ntoa \
1360         inet_ntop \
1361         innetgr \
1362         login_getcapbool \
1363         md5_crypt \
1364         memmove \
1365         mkdtemp \
1366         mmap \
1367         ngetaddrinfo \
1368         nsleep \
1369         ogetaddrinfo \
1370         openlog_r \
1371         openpty \
1372         poll \
1373         prctl \
1374         pstat \
1375         readpassphrase \
1376         realpath \
1377         recvmsg \
1378         rresvport_af \
1379         sendmsg \
1380         setdtablesize \
1381         setegid \
1382         setenv \
1383         seteuid \
1384         setgroupent \
1385         setgroups \
1386         setlogin \
1387         setpassent\
1388         setpcred \
1389         setproctitle \
1390         setregid \
1391         setreuid \
1392         setrlimit \
1393         setsid \
1394         setvbuf \
1395         sigaction \
1396         sigvec \
1397         snprintf \
1398         socketpair \
1399         statfs \
1400         statvfs \
1401         strdup \
1402         strerror \
1403         strlcat \
1404         strlcpy \
1405         strmode \
1406         strnvis \
1407         strtonum \
1408         strtoll \
1409         strtoul \
1410         swap32 \
1411         sysconf \
1412         tcgetpgrp \
1413         truncate \
1414         unsetenv \
1415         updwtmpx \
1416         user_from_uid \
1417         vasprintf \
1418         vhangup \
1419         vsnprintf \
1420         waitpid \
1421 )
1422
1423 # IRIX has a const char return value for gai_strerror()
1424 AC_CHECK_FUNCS(gai_strerror,[
1425         AC_DEFINE(HAVE_GAI_STRERROR)
1426         AC_TRY_COMPILE([
1427 #include <sys/types.h>
1428 #include <sys/socket.h>
1429 #include <netdb.h>
1430
1431 const char *gai_strerror(int);],[
1432 char *str;
1433
1434 str = gai_strerror(0);],[
1435                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1436                 [Define if gai_strerror() returns const char *])])])
1437
1438 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1439         [Some systems put nanosleep outside of libc]))
1440
1441 dnl Make sure prototypes are defined for these before using them.
1442 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1443 AC_CHECK_DECL(strsep,
1444         [AC_CHECK_FUNCS(strsep)],
1445         [],
1446         [
1447 #ifdef HAVE_STRING_H
1448 # include <string.h>
1449 #endif
1450         ])
1451
1452 dnl tcsendbreak might be a macro
1453 AC_CHECK_DECL(tcsendbreak,
1454         [AC_DEFINE(HAVE_TCSENDBREAK)],
1455         [AC_CHECK_FUNCS(tcsendbreak)],
1456         [#include <termios.h>]
1457 )
1458
1459 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1460
1461 AC_CHECK_DECLS(SHUT_RD, , ,
1462         [
1463 #include <sys/types.h>
1464 #include <sys/socket.h>
1465         ])
1466
1467 AC_CHECK_DECLS(O_NONBLOCK, , ,
1468         [
1469 #include <sys/types.h>
1470 #ifdef HAVE_SYS_STAT_H
1471 # include <sys/stat.h>
1472 #endif
1473 #ifdef HAVE_FCNTL_H
1474 # include <fcntl.h>
1475 #endif
1476         ])
1477
1478 AC_CHECK_DECLS(writev, , , [
1479 #include <sys/types.h>
1480 #include <sys/uio.h>
1481 #include <unistd.h>
1482         ])
1483
1484 AC_CHECK_DECLS(MAXSYMLINKS, , , [
1485 #include <sys/param.h>
1486         ])
1487
1488 AC_CHECK_DECLS(offsetof, , , [
1489 #include <stddef.h>
1490         ])
1491
1492 AC_CHECK_FUNCS(setresuid, [
1493         dnl Some platorms have setresuid that isn't implemented, test for this
1494         AC_MSG_CHECKING(if setresuid seems to work)
1495         AC_RUN_IFELSE(
1496                 [AC_LANG_SOURCE([[
1497 #include <stdlib.h>
1498 #include <errno.h>
1499 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1500                 ]])],
1501                 [AC_MSG_RESULT(yes)],
1502                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1503                         [Define if your setresuid() is broken])
1504                  AC_MSG_RESULT(not implemented)],
1505                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1506         )
1507 ])
1508
1509 AC_CHECK_FUNCS(setresgid, [
1510         dnl Some platorms have setresgid that isn't implemented, test for this
1511         AC_MSG_CHECKING(if setresgid seems to work)
1512         AC_RUN_IFELSE(
1513                 [AC_LANG_SOURCE([[
1514 #include <stdlib.h>
1515 #include <errno.h>
1516 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1517                 ]])],
1518                 [AC_MSG_RESULT(yes)],
1519                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1520                         [Define if your setresgid() is broken])
1521                  AC_MSG_RESULT(not implemented)],
1522                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1523         )
1524 ])
1525
1526 dnl    Checks for time functions
1527 AC_CHECK_FUNCS(gettimeofday time)
1528 dnl    Checks for utmp functions
1529 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1530 AC_CHECK_FUNCS(utmpname)
1531 dnl    Checks for utmpx functions
1532 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1533 AC_CHECK_FUNCS(setutxent utmpxname)
1534 dnl    Checks for lastlog functions
1535 AC_CHECK_FUNCS(getlastlogxbyname)
1536
1537 AC_CHECK_FUNC(daemon,
1538         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1539         [AC_CHECK_LIB(bsd, daemon,
1540                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1541 )
1542
1543 AC_CHECK_FUNC(getpagesize,
1544         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1545                 [Define if your libraries define getpagesize()])],
1546         [AC_CHECK_LIB(ucb, getpagesize,
1547                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1548 )
1549
1550 # Check for broken snprintf
1551 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1552         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1553         AC_RUN_IFELSE(
1554                 [AC_LANG_SOURCE([[
1555 #include <stdio.h>
1556 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1557                 ]])],
1558                 [AC_MSG_RESULT(yes)],
1559                 [
1560                         AC_MSG_RESULT(no)
1561                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1562                                 [Define if your snprintf is busted])
1563                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1564                 ],
1565                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1566         )
1567 fi
1568
1569 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1570 # returning the right thing on overflow: the number of characters it tried to
1571 # create (as per SUSv3)
1572 if test "x$ac_cv_func_asprintf" != "xyes" && \
1573    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1574         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1575         AC_RUN_IFELSE(
1576                 [AC_LANG_SOURCE([[
1577 #include <sys/types.h>
1578 #include <stdio.h>
1579 #include <stdarg.h>
1580
1581 int x_snprintf(char *str,size_t count,const char *fmt,...)
1582 {
1583         size_t ret; va_list ap;
1584         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1585         return ret;
1586 }
1587 int main(void)
1588 {
1589         char x[1];
1590         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1591 } ]])],
1592                 [AC_MSG_RESULT(yes)],
1593                 [
1594                         AC_MSG_RESULT(no)
1595                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1596                                 [Define if your snprintf is busted])
1597                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1598                 ],
1599                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1600         )
1601 fi
1602
1603 # On systems where [v]snprintf is broken, but is declared in stdio,
1604 # check that the fmt argument is const char * or just char *.
1605 # This is only useful for when BROKEN_SNPRINTF
1606 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1607 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1608            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1609            int main(void) { snprintf(0, 0, 0); }
1610     ]])],
1611    [AC_MSG_RESULT(yes)
1612     AC_DEFINE(SNPRINTF_CONST, [const],
1613               [Define as const if snprintf() can declare const char *fmt])],
1614    [AC_MSG_RESULT(no)
1615     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1616
1617 # Check for missing getpeereid (or equiv) support
1618 NO_PEERCHECK=""
1619 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
1620         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1621         AC_TRY_COMPILE(
1622                 [#include <sys/types.h>
1623                  #include <sys/socket.h>],
1624                 [int i = SO_PEERCRED;],
1625                 [ AC_MSG_RESULT(yes)
1626                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1627                 ],
1628                 [AC_MSG_RESULT(no)
1629                 NO_PEERCHECK=1]
1630         )
1631 fi
1632
1633 dnl see whether mkstemp() requires XXXXXX
1634 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1635 AC_MSG_CHECKING([for (overly) strict mkstemp])
1636 AC_RUN_IFELSE(
1637         [AC_LANG_SOURCE([[
1638 #include <stdlib.h>
1639 main() { char template[]="conftest.mkstemp-test";
1640 if (mkstemp(template) == -1)
1641         exit(1);
1642 unlink(template); exit(0);
1643 }
1644         ]])],
1645         [
1646                 AC_MSG_RESULT(no)
1647         ],
1648         [
1649                 AC_MSG_RESULT(yes)
1650                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1651         ],
1652         [
1653                 AC_MSG_RESULT(yes)
1654                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1655         ]
1656 )
1657 fi
1658
1659 dnl make sure that openpty does not reacquire controlling terminal
1660 if test ! -z "$check_for_openpty_ctty_bug"; then
1661         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1662         AC_RUN_IFELSE(
1663                 [AC_LANG_SOURCE([[
1664 #include <stdio.h>
1665 #include <sys/fcntl.h>
1666 #include <sys/types.h>
1667 #include <sys/wait.h>
1668
1669 int
1670 main()
1671 {
1672         pid_t pid;
1673         int fd, ptyfd, ttyfd, status;
1674
1675         pid = fork();
1676         if (pid < 0) {          /* failed */
1677                 exit(1);
1678         } else if (pid > 0) {   /* parent */
1679                 waitpid(pid, &status, 0);
1680                 if (WIFEXITED(status))
1681                         exit(WEXITSTATUS(status));
1682                 else
1683                         exit(2);
1684         } else {                /* child */
1685                 close(0); close(1); close(2);
1686                 setsid();
1687                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1688                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1689                 if (fd >= 0)
1690                         exit(3);        /* Acquired ctty: broken */
1691                 else
1692                         exit(0);        /* Did not acquire ctty: OK */
1693         }
1694 }
1695                 ]])],
1696                 [
1697                         AC_MSG_RESULT(yes)
1698                 ],
1699                 [
1700                         AC_MSG_RESULT(no)
1701                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1702                 ],
1703                 [
1704                         AC_MSG_RESULT(cross-compiling, assuming yes)
1705                 ]
1706         )
1707 fi
1708
1709 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1710     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1711         AC_MSG_CHECKING(if getaddrinfo seems to work)
1712         AC_RUN_IFELSE(
1713                 [AC_LANG_SOURCE([[
1714 #include <stdio.h>
1715 #include <sys/socket.h>
1716 #include <netdb.h>
1717 #include <errno.h>
1718 #include <netinet/in.h>
1719
1720 #define TEST_PORT "2222"
1721
1722 int
1723 main(void)
1724 {
1725         int err, sock;
1726         struct addrinfo *gai_ai, *ai, hints;
1727         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1728
1729         memset(&hints, 0, sizeof(hints));
1730         hints.ai_family = PF_UNSPEC;
1731         hints.ai_socktype = SOCK_STREAM;
1732         hints.ai_flags = AI_PASSIVE;
1733
1734         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1735         if (err != 0) {
1736                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1737                 exit(1);
1738         }
1739
1740         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1741                 if (ai->ai_family != AF_INET6)
1742                         continue;
1743
1744                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1745                     sizeof(ntop), strport, sizeof(strport),
1746                     NI_NUMERICHOST|NI_NUMERICSERV);
1747
1748                 if (err != 0) {
1749                         if (err == EAI_SYSTEM)
1750                                 perror("getnameinfo EAI_SYSTEM");
1751                         else
1752                                 fprintf(stderr, "getnameinfo failed: %s\n",
1753                                     gai_strerror(err));
1754                         exit(2);
1755                 }
1756
1757                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1758                 if (sock < 0)
1759                         perror("socket");
1760                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1761                         if (errno == EBADF)
1762                                 exit(3);
1763                 }
1764         }
1765         exit(0);
1766 }
1767                 ]])],
1768                 [
1769                         AC_MSG_RESULT(yes)
1770                 ],
1771                 [
1772                         AC_MSG_RESULT(no)
1773                         AC_DEFINE(BROKEN_GETADDRINFO)
1774                 ],
1775                 [
1776                         AC_MSG_RESULT(cross-compiling, assuming yes)
1777                 ]
1778         )
1779 fi
1780
1781 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1782     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1783         AC_MSG_CHECKING(if getaddrinfo seems to work)
1784         AC_RUN_IFELSE(
1785                 [AC_LANG_SOURCE([[
1786 #include <stdio.h>
1787 #include <sys/socket.h>
1788 #include <netdb.h>
1789 #include <errno.h>
1790 #include <netinet/in.h>
1791
1792 #define TEST_PORT "2222"
1793
1794 int
1795 main(void)
1796 {
1797         int err, sock;
1798         struct addrinfo *gai_ai, *ai, hints;
1799         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1800
1801         memset(&hints, 0, sizeof(hints));
1802         hints.ai_family = PF_UNSPEC;
1803         hints.ai_socktype = SOCK_STREAM;
1804         hints.ai_flags = AI_PASSIVE;
1805
1806         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1807         if (err != 0) {
1808                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1809                 exit(1);
1810         }
1811
1812         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1813                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1814                         continue;
1815
1816                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1817                     sizeof(ntop), strport, sizeof(strport),
1818                     NI_NUMERICHOST|NI_NUMERICSERV);
1819
1820                 if (ai->ai_family == AF_INET && err != 0) {
1821                         perror("getnameinfo");
1822                         exit(2);
1823                 }
1824         }
1825         exit(0);
1826 }
1827                 ]])],
1828                 [
1829                         AC_MSG_RESULT(yes)
1830                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1831                                 [Define if you have a getaddrinfo that fails
1832                                 for the all-zeros IPv6 address])
1833                 ],
1834                 [
1835                         AC_MSG_RESULT(no)
1836                         AC_DEFINE(BROKEN_GETADDRINFO)
1837                 ],
1838                 [
1839                         AC_MSG_RESULT(cross-compiling, assuming no)
1840                 ]
1841         )
1842 fi
1843
1844 if test "x$check_for_conflicting_getspnam" = "x1"; then
1845         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1846         AC_COMPILE_IFELSE(
1847                 [
1848 #include <shadow.h>
1849 int main(void) {exit(0);}
1850                 ],
1851                 [
1852                         AC_MSG_RESULT(no)
1853                 ],
1854                 [
1855                         AC_MSG_RESULT(yes)
1856                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1857                             [Conflicting defs for getspnam])
1858                 ]
1859         )
1860 fi
1861
1862 AC_FUNC_GETPGRP
1863
1864 # Search for OpenSSL
1865 saved_CPPFLAGS="$CPPFLAGS"
1866 saved_LDFLAGS="$LDFLAGS"
1867 AC_ARG_WITH(ssl-dir,
1868         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1869         [
1870                 if test "x$withval" != "xno" ; then
1871                         case "$withval" in
1872                                 # Relative paths
1873                                 ./*|../*)       withval="`pwd`/$withval"
1874                         esac
1875                         if test -d "$withval/lib"; then
1876                                 if test -n "${need_dash_r}"; then
1877                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1878                                 else
1879                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1880                                 fi
1881                         else
1882                                 if test -n "${need_dash_r}"; then
1883                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1884                                 else
1885                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1886                                 fi
1887                         fi
1888                         if test -d "$withval/include"; then
1889                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1890                         else
1891                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1892                         fi
1893                 fi
1894         ]
1895 )
1896 LIBS="-lcrypto $LIBS"
1897 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1898         [Define if your ssl headers are included
1899         with #include <openssl/header.h>]),
1900         [
1901                 dnl Check default openssl install dir
1902                 if test -n "${need_dash_r}"; then
1903                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1904                 else
1905                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1906                 fi
1907                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1908                 AC_CHECK_HEADER([openssl/opensslv.h], ,
1909                     AC_MSG_ERROR([*** OpenSSL headers missing - please install first or check config.log ***]))
1910                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1911                         [
1912                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
1913                         ]
1914                 )
1915         ]
1916 )
1917
1918 # Determine OpenSSL header version
1919 AC_MSG_CHECKING([OpenSSL header version])
1920 AC_RUN_IFELSE(
1921         [AC_LANG_SOURCE([[
1922 #include <stdio.h>
1923 #include <string.h>
1924 #include <openssl/opensslv.h>
1925 #define DATA "conftest.sslincver"
1926 int main(void) {
1927         FILE *fd;
1928         int rc;
1929
1930         fd = fopen(DATA,"w");
1931         if(fd == NULL)
1932                 exit(1);
1933
1934         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
1935                 exit(1);
1936
1937         exit(0);
1938 }
1939         ]])],
1940         [
1941                 ssl_header_ver=`cat conftest.sslincver`
1942                 AC_MSG_RESULT($ssl_header_ver)
1943         ],
1944         [
1945                 AC_MSG_RESULT(not found)
1946                 AC_MSG_ERROR(OpenSSL version header not found.)
1947         ],
1948         [
1949                 AC_MSG_WARN([cross compiling: not checking])
1950         ]
1951 )
1952
1953 # Determine OpenSSL library version
1954 AC_MSG_CHECKING([OpenSSL library version])
1955 AC_RUN_IFELSE(
1956         [AC_LANG_SOURCE([[
1957 #include <stdio.h>
1958 #include <string.h>
1959 #include <openssl/opensslv.h>
1960 #include <openssl/crypto.h>
1961 #define DATA "conftest.ssllibver"
1962 int main(void) {
1963         FILE *fd;
1964         int rc;
1965
1966         fd = fopen(DATA,"w");
1967         if(fd == NULL)
1968                 exit(1);
1969
1970         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
1971                 exit(1);
1972
1973         exit(0);
1974 }
1975         ]])],
1976         [
1977                 ssl_library_ver=`cat conftest.ssllibver`
1978                 AC_MSG_RESULT($ssl_library_ver)
1979         ],
1980         [
1981                 AC_MSG_RESULT(not found)
1982                 AC_MSG_ERROR(OpenSSL library not found.)
1983         ],
1984         [
1985                 AC_MSG_WARN([cross compiling: not checking])
1986         ]
1987 )
1988
1989 AC_ARG_WITH(openssl-header-check,
1990         [  --without-openssl-header-check Disable OpenSSL version consistency check],
1991         [  if test "x$withval" = "xno" ; then
1992                 openssl_check_nonfatal=1
1993            fi
1994         ]
1995 )
1996
1997 # Sanity check OpenSSL headers
1998 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
1999 AC_RUN_IFELSE(
2000         [AC_LANG_SOURCE([[
2001 #include <string.h>
2002 #include <openssl/opensslv.h>
2003 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
2004         ]])],
2005         [
2006                 AC_MSG_RESULT(yes)
2007         ],
2008         [
2009                 AC_MSG_RESULT(no)
2010                 if test "x$openssl_check_nonfatal" = "x"; then
2011                         AC_MSG_ERROR([Your OpenSSL headers do not match your
2012 library. Check config.log for details.
2013 If you are sure your installation is consistent, you can disable the check
2014 by running "./configure --without-openssl-header-check".
2015 Also see contrib/findssl.sh for help identifying header/library mismatches.
2016 ])
2017                 else
2018                         AC_MSG_WARN([Your OpenSSL headers do not match your
2019 library. Check config.log for details.
2020 Also see contrib/findssl.sh for help identifying header/library mismatches.])
2021                 fi
2022         ],
2023         [
2024                 AC_MSG_WARN([cross compiling: not checking])
2025         ]
2026 )
2027
2028 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
2029 AC_LINK_IFELSE(
2030         [AC_LANG_SOURCE([[
2031 #include <openssl/evp.h>
2032 int main(void) { SSLeay_add_all_algorithms(); }
2033         ]])],
2034         [
2035                 AC_MSG_RESULT(yes)
2036         ],
2037         [
2038                 AC_MSG_RESULT(no)
2039                 saved_LIBS="$LIBS"
2040                 LIBS="$LIBS -ldl"
2041                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
2042                 AC_LINK_IFELSE(
2043                         [AC_LANG_SOURCE([[
2044 #include <openssl/evp.h>
2045 int main(void) { SSLeay_add_all_algorithms(); }
2046                         ]])],
2047                         [
2048                                 AC_MSG_RESULT(yes)
2049                         ],
2050                         [
2051                                 AC_MSG_RESULT(no)
2052                                 LIBS="$saved_LIBS"
2053                         ]
2054                 )
2055         ]
2056 )
2057
2058 AC_ARG_WITH(ssl-engine,
2059         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
2060         [ if test "x$withval" != "xno" ; then
2061                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
2062                 AC_TRY_COMPILE(
2063                         [ #include <openssl/engine.h>],
2064                         [
2065 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
2066                         ],
2067                         [ AC_MSG_RESULT(yes)
2068                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
2069                              [Enable OpenSSL engine support])
2070                         ],
2071                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
2072                 )
2073           fi ]
2074 )
2075
2076 # Check for OpenSSL without EVP_aes_{192,256}_cbc
2077 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
2078 AC_LINK_IFELSE(
2079         [AC_LANG_SOURCE([[
2080 #include <string.h>
2081 #include <openssl/evp.h>
2082 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
2083         ]])],
2084         [
2085                 AC_MSG_RESULT(no)
2086         ],
2087         [
2088                 AC_MSG_RESULT(yes)
2089                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2090                     [libcrypto is missing AES 192 and 256 bit functions])
2091         ]
2092 )
2093
2094 AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
2095 AC_LINK_IFELSE(
2096         [AC_LANG_SOURCE([[
2097 #include <string.h>
2098 #include <openssl/evp.h>
2099 int main(void) { if(EVP_DigestUpdate(NULL, NULL,0)) exit(0); }
2100         ]])],
2101         [
2102                 AC_MSG_RESULT(yes)
2103         ],
2104         [
2105                 AC_MSG_RESULT(no)
2106                 AC_DEFINE(OPENSSL_EVP_DIGESTUPDATE_VOID, 1,
2107                     [Define if EVP_DigestUpdate returns void])
2108         ]
2109 )
2110
2111 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2112 # because the system crypt() is more featureful.
2113 if test "x$check_for_libcrypt_before" = "x1"; then
2114         AC_CHECK_LIB(crypt, crypt)
2115 fi
2116
2117 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2118 # version in OpenSSL.
2119 if test "x$check_for_libcrypt_later" = "x1"; then
2120         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2121 fi
2122
2123 # Search for SHA256 support in libc and/or OpenSSL
2124 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2125
2126 saved_LIBS="$LIBS"
2127 AC_CHECK_LIB(iaf, ia_openinfo, [
2128         LIBS="$LIBS -liaf"
2129         AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
2130                                 AC_DEFINE(HAVE_LIBIAF, 1,
2131                         [Define if system has libiaf that supports set_id])
2132                                 ])
2133 ])
2134 LIBS="$saved_LIBS"
2135
2136 ### Configure cryptographic random number support
2137
2138 # Check wheter OpenSSL seeds itself
2139 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2140 AC_RUN_IFELSE(
2141         [AC_LANG_SOURCE([[
2142 #include <string.h>
2143 #include <openssl/rand.h>
2144 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2145         ]])],
2146         [
2147                 OPENSSL_SEEDS_ITSELF=yes
2148                 AC_MSG_RESULT(yes)
2149         ],
2150         [
2151                 AC_MSG_RESULT(no)
2152                 # Default to use of the rand helper if OpenSSL doesn't
2153                 # seed itself
2154                 USE_RAND_HELPER=yes
2155         ],
2156         [
2157                 AC_MSG_WARN([cross compiling: assuming yes])
2158                 # This is safe, since all recent OpenSSL versions will
2159                 # complain at runtime if not seeded correctly.
2160                 OPENSSL_SEEDS_ITSELF=yes
2161         ]
2162 )
2163
2164 # Check for PAM libs
2165 PAM_MSG="no"
2166 AC_ARG_WITH(pam,
2167         [  --with-pam              Enable PAM support ],
2168         [
2169                 if test "x$withval" != "xno" ; then
2170                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2171                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2172                                 AC_MSG_ERROR([PAM headers not found])
2173                         fi
2174
2175                         saved_LIBS="$LIBS"
2176                         AC_CHECK_LIB(dl, dlopen, , )
2177                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2178                         AC_CHECK_FUNCS(pam_getenvlist)
2179                         AC_CHECK_FUNCS(pam_putenv)
2180                         LIBS="$saved_LIBS"
2181
2182                         PAM_MSG="yes"
2183
2184                         SSHDLIBS="$SSHDLIBS -lpam"
2185                         AC_DEFINE(USE_PAM, 1,
2186                                 [Define if you want to enable PAM support])
2187
2188                         if test $ac_cv_lib_dl_dlopen = yes; then
2189                                 case "$LIBS" in
2190                                 *-ldl*)
2191                                         # libdl already in LIBS
2192                                         ;;
2193                                 *)
2194                                         SSHDLIBS="$SSHDLIBS -ldl"
2195                                         ;;
2196                                 esac
2197                         fi
2198                 fi
2199         ]
2200 )
2201
2202 # Check for older PAM
2203 if test "x$PAM_MSG" = "xyes" ; then
2204         # Check PAM strerror arguments (old PAM)
2205         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2206         AC_TRY_COMPILE(
2207                 [
2208 #include <stdlib.h>
2209 #if defined(HAVE_SECURITY_PAM_APPL_H)
2210 #include <security/pam_appl.h>
2211 #elif defined (HAVE_PAM_PAM_APPL_H)
2212 #include <pam/pam_appl.h>
2213 #endif
2214                 ],
2215                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2216                 [AC_MSG_RESULT(no)],
2217                 [
2218                         AC_DEFINE(HAVE_OLD_PAM, 1,
2219                                 [Define if you have an old version of PAM
2220                                 which takes only one argument to pam_strerror])
2221                         AC_MSG_RESULT(yes)
2222                         PAM_MSG="yes (old library)"
2223                 ]
2224         )
2225 fi
2226
2227 # Do we want to force the use of the rand helper?
2228 AC_ARG_WITH(rand-helper,
2229         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2230         [
2231                 if test "x$withval" = "xno" ; then
2232                         # Force use of OpenSSL's internal RNG, even if
2233                         # the previous test showed it to be unseeded.
2234                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2235                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2236                                 OPENSSL_SEEDS_ITSELF=yes
2237                                 USE_RAND_HELPER=""
2238                         fi
2239                 else
2240                         USE_RAND_HELPER=yes
2241                 fi
2242         ],
2243 )
2244
2245 # Which randomness source do we use?
2246 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2247         # OpenSSL only
2248         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2249                 [Define if you want OpenSSL's internally seeded PRNG only])
2250         RAND_MSG="OpenSSL internal ONLY"
2251         INSTALL_SSH_RAND_HELPER=""
2252 elif test ! -z "$USE_RAND_HELPER" ; then
2253         # install rand helper
2254         RAND_MSG="ssh-rand-helper"
2255         INSTALL_SSH_RAND_HELPER="yes"
2256 fi
2257 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2258
2259 ### Configuration of ssh-rand-helper
2260
2261 # PRNGD TCP socket
2262 AC_ARG_WITH(prngd-port,
2263         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2264         [
2265                 case "$withval" in
2266                 no)
2267                         withval=""
2268                         ;;
2269                 [[0-9]]*)
2270                         ;;
2271                 *)
2272                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2273                         ;;
2274                 esac
2275                 if test ! -z "$withval" ; then
2276                         PRNGD_PORT="$withval"
2277                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2278                                 [Port number of PRNGD/EGD random number socket])
2279                 fi
2280         ]
2281 )
2282
2283 # PRNGD Unix domain socket
2284 AC_ARG_WITH(prngd-socket,
2285         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2286         [
2287                 case "$withval" in
2288                 yes)
2289                         withval="/var/run/egd-pool"
2290                         ;;
2291                 no)
2292                         withval=""
2293                         ;;
2294                 /*)
2295                         ;;
2296                 *)
2297                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2298                         ;;
2299                 esac
2300
2301                 if test ! -z "$withval" ; then
2302                         if test ! -z "$PRNGD_PORT" ; then
2303                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2304                         fi
2305                         if test ! -r "$withval" ; then
2306                                 AC_MSG_WARN(Entropy socket is not readable)
2307                         fi
2308                         PRNGD_SOCKET="$withval"
2309                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2310                                 [Location of PRNGD/EGD random number socket])
2311                 fi
2312         ],
2313         [
2314                 # Check for existing socket only if we don't have a random device already
2315                 if test "$USE_RAND_HELPER" = yes ; then
2316                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2317                         # Insert other locations here
2318                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2319                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2320                                         PRNGD_SOCKET="$sock"
2321                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2322                                         break;
2323                                 fi
2324                         done
2325                         if test ! -z "$PRNGD_SOCKET" ; then
2326                                 AC_MSG_RESULT($PRNGD_SOCKET)
2327                         else
2328                                 AC_MSG_RESULT(not found)
2329                         fi
2330                 fi
2331         ]
2332 )
2333
2334 # Change default command timeout for hashing entropy source
2335 entropy_timeout=200
2336 AC_ARG_WITH(entropy-timeout,
2337         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2338         [
2339                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2340                     test "x${withval}" != "xyes"; then
2341                         entropy_timeout=$withval
2342                 fi
2343         ]
2344 )
2345 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2346         [Builtin PRNG command timeout])
2347
2348 SSH_PRIVSEP_USER=sshd
2349 AC_ARG_WITH(privsep-user,
2350         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2351         [
2352                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2353                     test "x${withval}" != "xyes"; then
2354                         SSH_PRIVSEP_USER=$withval
2355                 fi
2356         ]
2357 )
2358 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2359         [non-privileged user for privilege separation])
2360 AC_SUBST(SSH_PRIVSEP_USER)
2361
2362 # We do this little dance with the search path to insure
2363 # that programs that we select for use by installed programs
2364 # (which may be run by the super-user) come from trusted
2365 # locations before they come from the user's private area.
2366 # This should help avoid accidentally configuring some
2367 # random version of a program in someone's personal bin.
2368
2369 OPATH=$PATH
2370 PATH=/bin:/usr/bin
2371 test -h /bin 2> /dev/null && PATH=/usr/bin
2372 test -d /sbin && PATH=$PATH:/sbin
2373 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2374 PATH=$PATH:/etc:$OPATH
2375
2376 # These programs are used by the command hashing source to gather entropy
2377 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2378 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2379 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2380 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2381 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2382 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2383 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2384 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2385 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2386 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2387 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2388 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2389 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2390 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2391 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2392 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2393 # restore PATH
2394 PATH=$OPATH
2395
2396 # Where does ssh-rand-helper get its randomness from?
2397 INSTALL_SSH_PRNG_CMDS=""
2398 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2399         if test ! -z "$PRNGD_PORT" ; then
2400                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2401         elif test ! -z "$PRNGD_SOCKET" ; then
2402                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2403         else
2404                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2405                 RAND_HELPER_CMDHASH=yes
2406                 INSTALL_SSH_PRNG_CMDS="yes"
2407         fi
2408 fi
2409 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2410
2411
2412 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2413 if test ! -z "$SONY" ; then
2414   LIBS="$LIBS -liberty";
2415 fi
2416
2417 # Check for  long long datatypes
2418 AC_CHECK_TYPES([long long, unsigned long long, long double])
2419
2420 # Check datatype sizes
2421 AC_CHECK_SIZEOF(char, 1)
2422 AC_CHECK_SIZEOF(short int, 2)
2423 AC_CHECK_SIZEOF(int, 4)
2424 AC_CHECK_SIZEOF(long int, 4)
2425 AC_CHECK_SIZEOF(long long int, 8)
2426
2427 # Sanity check long long for some platforms (AIX)
2428 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2429         ac_cv_sizeof_long_long_int=0
2430 fi
2431
2432 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2433 if test -z "$have_llong_max"; then
2434         AC_MSG_CHECKING([for max value of long long])
2435         AC_RUN_IFELSE(
2436                 [AC_LANG_SOURCE([[
2437 #include <stdio.h>
2438 /* Why is this so damn hard? */
2439 #ifdef __GNUC__
2440 # undef __GNUC__
2441 #endif
2442 #define __USE_ISOC99
2443 #include <limits.h>
2444 #define DATA "conftest.llminmax"
2445 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2446
2447 /*
2448  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2449  * we do this the hard way.
2450  */
2451 static int
2452 fprint_ll(FILE *f, long long n)
2453 {
2454         unsigned int i;
2455         int l[sizeof(long long) * 8];
2456
2457         if (n < 0)
2458                 if (fprintf(f, "-") < 0)
2459                         return -1;
2460         for (i = 0; n != 0; i++) {
2461                 l[i] = my_abs(n % 10);
2462                 n /= 10;
2463         }
2464         do {
2465                 if (fprintf(f, "%d", l[--i]) < 0)
2466                         return -1;
2467         } while (i != 0);
2468         if (fprintf(f, " ") < 0)
2469                 return -1;
2470         return 0;
2471 }
2472
2473 int main(void) {
2474         FILE *f;
2475         long long i, llmin, llmax = 0;
2476
2477         if((f = fopen(DATA,"w")) == NULL)
2478                 exit(1);
2479
2480 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2481         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2482         llmin = LLONG_MIN;
2483         llmax = LLONG_MAX;
2484 #else
2485         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2486         /* This will work on one's complement and two's complement */
2487         for (i = 1; i > llmax; i <<= 1, i++)
2488                 llmax = i;
2489         llmin = llmax + 1LL;    /* wrap */
2490 #endif
2491
2492         /* Sanity check */
2493         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2494             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2495             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2496                 fprintf(f, "unknown unknown\n");
2497                 exit(2);
2498         }
2499
2500         if (fprint_ll(f, llmin) < 0)
2501                 exit(3);
2502         if (fprint_ll(f, llmax) < 0)
2503                 exit(4);
2504         if (fclose(f) < 0)
2505                 exit(5);
2506         exit(0);
2507 }
2508                 ]])],
2509                 [
2510                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2511                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2512
2513                         AC_MSG_RESULT($llong_max)
2514                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2515                             [max value of long long calculated by configure])
2516                         AC_MSG_CHECKING([for min value of long long])
2517                         AC_MSG_RESULT($llong_min)
2518                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2519                             [min value of long long calculated by configure])
2520                 ],
2521                 [
2522                         AC_MSG_RESULT(not found)
2523                 ],
2524                 [
2525                         AC_MSG_WARN([cross compiling: not checking])
2526                 ]
2527         )
2528 fi
2529
2530
2531 # More checks for data types
2532 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2533         AC_TRY_COMPILE(
2534                 [ #include <sys/types.h> ],
2535                 [ u_int a; a = 1;],
2536                 [ ac_cv_have_u_int="yes" ],
2537                 [ ac_cv_have_u_int="no" ]
2538         )
2539 ])
2540 if test "x$ac_cv_have_u_int" = "xyes" ; then
2541         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2542         have_u_int=1
2543 fi
2544
2545 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2546         AC_TRY_COMPILE(
2547                 [ #include <sys/types.h> ],
2548                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2549                 [ ac_cv_have_intxx_t="yes" ],
2550                 [ ac_cv_have_intxx_t="no" ]
2551         )
2552 ])
2553 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2554         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2555         have_intxx_t=1
2556 fi
2557
2558 if (test -z "$have_intxx_t" && \
2559            test "x$ac_cv_header_stdint_h" = "xyes")
2560 then
2561     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2562         AC_TRY_COMPILE(
2563                 [ #include <stdint.h> ],
2564                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2565                 [
2566                         AC_DEFINE(HAVE_INTXX_T)
2567                         AC_MSG_RESULT(yes)
2568                 ],
2569                 [ AC_MSG_RESULT(no) ]
2570         )
2571 fi
2572
2573 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2574         AC_TRY_COMPILE(
2575                 [
2576 #include <sys/types.h>
2577 #ifdef HAVE_STDINT_H
2578 # include <stdint.h>
2579 #endif
2580 #include <sys/socket.h>
2581 #ifdef HAVE_SYS_BITYPES_H
2582 # include <sys/bitypes.h>
2583 #endif
2584                 ],
2585                 [ int64_t a; a = 1;],
2586                 [ ac_cv_have_int64_t="yes" ],
2587                 [ ac_cv_have_int64_t="no" ]
2588         )
2589 ])
2590 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2591         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2592 fi
2593
2594 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2595         AC_TRY_COMPILE(
2596                 [ #include <sys/types.h> ],
2597                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2598                 [ ac_cv_have_u_intxx_t="yes" ],
2599                 [ ac_cv_have_u_intxx_t="no" ]
2600         )
2601 ])
2602 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2603         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2604         have_u_intxx_t=1
2605 fi
2606
2607 if test -z "$have_u_intxx_t" ; then
2608     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2609         AC_TRY_COMPILE(
2610                 [ #include <sys/socket.h> ],
2611                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2612                 [
2613                         AC_DEFINE(HAVE_U_INTXX_T)
2614                         AC_MSG_RESULT(yes)
2615                 ],
2616                 [ AC_MSG_RESULT(no) ]
2617         )
2618 fi
2619
2620 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2621         AC_TRY_COMPILE(
2622                 [ #include <sys/types.h> ],
2623                 [ u_int64_t a; a = 1;],
2624                 [ ac_cv_have_u_int64_t="yes" ],
2625                 [ ac_cv_have_u_int64_t="no" ]
2626         )
2627 ])
2628 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2629         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2630         have_u_int64_t=1
2631 fi
2632
2633 if test -z "$have_u_int64_t" ; then
2634     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2635         AC_TRY_COMPILE(
2636                 [ #include <sys/bitypes.h> ],
2637                 [ u_int64_t a; a = 1],
2638                 [
2639                         AC_DEFINE(HAVE_U_INT64_T)
2640                         AC_MSG_RESULT(yes)
2641                 ],
2642                 [ AC_MSG_RESULT(no) ]
2643         )
2644 fi
2645
2646 if test -z "$have_u_intxx_t" ; then
2647         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2648                 AC_TRY_COMPILE(
2649                         [
2650 #include <sys/types.h>
2651                         ],
2652                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2653                         [ ac_cv_have_uintxx_t="yes" ],
2654                         [ ac_cv_have_uintxx_t="no" ]
2655                 )
2656         ])
2657         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2658                 AC_DEFINE(HAVE_UINTXX_T, 1,
2659                         [define if you have uintxx_t data type])
2660         fi
2661 fi
2662
2663 if test -z "$have_uintxx_t" ; then
2664     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2665         AC_TRY_COMPILE(
2666                 [ #include <stdint.h> ],
2667                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2668                 [
2669                         AC_DEFINE(HAVE_UINTXX_T)
2670                         AC_MSG_RESULT(yes)
2671                 ],
2672                 [ AC_MSG_RESULT(no) ]
2673         )
2674 fi
2675
2676 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2677            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2678 then
2679         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2680         AC_TRY_COMPILE(
2681                 [
2682 #include <sys/bitypes.h>
2683                 ],
2684                 [
2685                         int8_t a; int16_t b; int32_t c;
2686                         u_int8_t e; u_int16_t f; u_int32_t g;
2687                         a = b = c = e = f = g = 1;
2688                 ],
2689                 [
2690                         AC_DEFINE(HAVE_U_INTXX_T)
2691                         AC_DEFINE(HAVE_INTXX_T)
2692                         AC_MSG_RESULT(yes)
2693                 ],
2694                 [AC_MSG_RESULT(no)]
2695         )
2696 fi
2697
2698
2699 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2700         AC_TRY_COMPILE(
2701                 [
2702 #include <sys/types.h>
2703                 ],
2704                 [ u_char foo; foo = 125; ],
2705                 [ ac_cv_have_u_char="yes" ],
2706                 [ ac_cv_have_u_char="no" ]
2707         )
2708 ])
2709 if test "x$ac_cv_have_u_char" = "xyes" ; then
2710         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2711 fi
2712
2713 TYPE_SOCKLEN_T
2714
2715 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2716 AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t],,,[
2717 #include <sys/types.h>
2718 #ifdef HAVE_SYS_BITYPES_H
2719 #include <sys/bitypes.h>
2720 #endif
2721 #ifdef HAVE_SYS_STATFS_H
2722 #include <sys/statfs.h>
2723 #endif
2724 #ifdef HAVE_SYS_STATVFS_H
2725 #include <sys/statvfs.h>
2726 #endif
2727 ])
2728
2729 AC_CHECK_TYPES([in_addr_t, in_port_t],,,
2730 [#include <sys/types.h>
2731 #include <netinet/in.h>])
2732
2733 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2734         AC_TRY_COMPILE(
2735                 [
2736 #include <sys/types.h>
2737                 ],
2738                 [ size_t foo; foo = 1235; ],
2739                 [ ac_cv_have_size_t="yes" ],
2740                 [ ac_cv_have_size_t="no" ]
2741         )
2742 ])
2743 if test "x$ac_cv_have_size_t" = "xyes" ; then
2744         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2745 fi
2746
2747 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2748         AC_TRY_COMPILE(
2749                 [
2750 #include <sys/types.h>
2751                 ],
2752                 [ ssize_t foo; foo = 1235; ],
2753                 [ ac_cv_have_ssize_t="yes" ],
2754                 [ ac_cv_have_ssize_t="no" ]
2755         )
2756 ])
2757 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2758         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2759 fi
2760
2761 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2762         AC_TRY_COMPILE(
2763                 [
2764 #include <time.h>
2765                 ],
2766                 [ clock_t foo; foo = 1235; ],
2767                 [ ac_cv_have_clock_t="yes" ],
2768                 [ ac_cv_have_clock_t="no" ]
2769         )
2770 ])
2771 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2772         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2773 fi
2774
2775 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2776         AC_TRY_COMPILE(
2777                 [
2778 #include <sys/types.h>
2779 #include <sys/socket.h>
2780                 ],
2781                 [ sa_family_t foo; foo = 1235; ],
2782                 [ ac_cv_have_sa_family_t="yes" ],
2783                 [ AC_TRY_COMPILE(
2784                   [
2785 #include <sys/types.h>
2786 #include <sys/socket.h>
2787 #include <netinet/in.h>
2788                 ],
2789                 [ sa_family_t foo; foo = 1235; ],
2790                 [ ac_cv_have_sa_family_t="yes" ],
2791
2792                 [ ac_cv_have_sa_family_t="no" ]
2793         )]
2794         )
2795 ])
2796 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2797         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2798                 [define if you have sa_family_t data type])
2799 fi
2800
2801 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2802         AC_TRY_COMPILE(
2803                 [
2804 #include <sys/types.h>
2805                 ],
2806                 [ pid_t foo; foo = 1235; ],
2807                 [ ac_cv_have_pid_t="yes" ],
2808                 [ ac_cv_have_pid_t="no" ]
2809         )
2810 ])
2811 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2812         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2813 fi
2814
2815 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2816         AC_TRY_COMPILE(
2817                 [
2818 #include <sys/types.h>
2819                 ],
2820                 [ mode_t foo; foo = 1235; ],
2821                 [ ac_cv_have_mode_t="yes" ],
2822                 [ ac_cv_have_mode_t="no" ]
2823         )
2824 ])
2825 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2826         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2827 fi
2828
2829
2830 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2831         AC_TRY_COMPILE(
2832                 [
2833 #include <sys/types.h>
2834 #include <sys/socket.h>
2835                 ],
2836                 [ struct sockaddr_storage s; ],
2837                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2838                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2839         )
2840 ])
2841 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2842         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2843                 [define if you have struct sockaddr_storage data type])
2844 fi
2845
2846 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2847         AC_TRY_COMPILE(
2848                 [
2849 #include <sys/types.h>
2850 #include <netinet/in.h>
2851                 ],
2852                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2853                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2854                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2855         )
2856 ])
2857 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2858         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2859                 [define if you have struct sockaddr_in6 data type])
2860 fi
2861
2862 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2863         AC_TRY_COMPILE(
2864                 [
2865 #include <sys/types.h>
2866 #include <netinet/in.h>
2867                 ],
2868                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2869                 [ ac_cv_have_struct_in6_addr="yes" ],
2870                 [ ac_cv_have_struct_in6_addr="no" ]
2871         )
2872 ])
2873 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2874         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2875                 [define if you have struct in6_addr data type])
2876
2877 dnl Now check for sin6_scope_id
2878         AC_CHECK_MEMBERS([struct sockaddr_in6.sin6_scope_id],,,
2879                 [
2880 #ifdef HAVE_SYS_TYPES_H
2881 #include <sys/types.h>
2882 #endif
2883 #include <netinet/in.h>
2884                 ])
2885 fi
2886
2887 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2888         AC_TRY_COMPILE(
2889                 [
2890 #include <sys/types.h>
2891 #include <sys/socket.h>
2892 #include <netdb.h>
2893                 ],
2894                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2895                 [ ac_cv_have_struct_addrinfo="yes" ],
2896                 [ ac_cv_have_struct_addrinfo="no" ]
2897         )
2898 ])
2899 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2900         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2901                 [define if you have struct addrinfo data type])
2902 fi
2903
2904 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2905         AC_TRY_COMPILE(
2906                 [ #include <sys/time.h> ],
2907                 [ struct timeval tv; tv.tv_sec = 1;],
2908                 [ ac_cv_have_struct_timeval="yes" ],
2909                 [ ac_cv_have_struct_timeval="no" ]
2910         )
2911 ])
2912 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2913         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2914         have_struct_timeval=1
2915 fi
2916
2917 AC_CHECK_TYPES(struct timespec)
2918
2919 # We need int64_t or else certian parts of the compile will fail.
2920 if test "x$ac_cv_have_int64_t" = "xno" && \
2921         test "x$ac_cv_sizeof_long_int" != "x8" && \
2922         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2923         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2924         echo "an alternative compiler (I.E., GCC) before continuing."
2925         echo ""
2926         exit 1;
2927 else
2928 dnl test snprintf (broken on SCO w/gcc)
2929         AC_RUN_IFELSE(
2930                 [AC_LANG_SOURCE([[
2931 #include <stdio.h>
2932 #include <string.h>
2933 #ifdef HAVE_SNPRINTF
2934 main()
2935 {
2936         char buf[50];
2937         char expected_out[50];
2938         int mazsize = 50 ;
2939 #if (SIZEOF_LONG_INT == 8)
2940         long int num = 0x7fffffffffffffff;
2941 #else
2942         long long num = 0x7fffffffffffffffll;
2943 #endif
2944         strcpy(expected_out, "9223372036854775807");
2945         snprintf(buf, mazsize, "%lld", num);
2946         if(strcmp(buf, expected_out) != 0)
2947                 exit(1);
2948         exit(0);
2949 }
2950 #else
2951 main() { exit(0); }
2952 #endif
2953                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
2954                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
2955         )
2956 fi
2957
2958 dnl Checks for structure members
2959 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
2960 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
2961 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
2962 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
2963 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
2964 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
2965 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
2966 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
2967 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
2968 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
2969 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
2970 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
2971 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
2972 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
2973 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
2974 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
2975 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
2976
2977 AC_CHECK_MEMBERS([struct stat.st_blksize])
2978 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
2979         [Define if we don't have struct __res_state in resolv.h])],
2980 [
2981 #include <stdio.h>
2982 #if HAVE_SYS_TYPES_H
2983 # include <sys/types.h>
2984 #endif
2985 #include <netinet/in.h>
2986 #include <arpa/nameser.h>
2987 #include <resolv.h>
2988 ])
2989
2990 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
2991                 ac_cv_have_ss_family_in_struct_ss, [
2992         AC_TRY_COMPILE(
2993                 [
2994 #include <sys/types.h>
2995 #include <sys/socket.h>
2996                 ],
2997                 [ struct sockaddr_storage s; s.ss_family = 1; ],
2998                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
2999                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
3000         )
3001 ])
3002 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
3003         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
3004 fi
3005
3006 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
3007                 ac_cv_have___ss_family_in_struct_ss, [
3008         AC_TRY_COMPILE(
3009                 [
3010 #include <sys/types.h>
3011 #include <sys/socket.h>
3012                 ],
3013                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
3014                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
3015                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
3016         )
3017 ])
3018 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
3019         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
3020                 [Fields in struct sockaddr_storage])
3021 fi
3022
3023 AC_CACHE_CHECK([for pw_class field in struct passwd],
3024                 ac_cv_have_pw_class_in_struct_passwd, [
3025         AC_TRY_COMPILE(
3026                 [
3027 #include <pwd.h>
3028                 ],
3029                 [ struct passwd p; p.pw_class = 0; ],
3030                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
3031                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
3032         )
3033 ])
3034 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
3035         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
3036                 [Define if your password has a pw_class field])
3037 fi
3038
3039 AC_CACHE_CHECK([for pw_expire field in struct passwd],
3040                 ac_cv_have_pw_expire_in_struct_passwd, [
3041         AC_TRY_COMPILE(
3042                 [
3043 #include <pwd.h>
3044                 ],
3045                 [ struct passwd p; p.pw_expire = 0; ],
3046                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
3047                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
3048         )
3049 ])
3050 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
3051         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
3052                 [Define if your password has a pw_expire field])
3053 fi
3054
3055 AC_CACHE_CHECK([for pw_change field in struct passwd],
3056                 ac_cv_have_pw_change_in_struct_passwd, [
3057         AC_TRY_COMPILE(
3058                 [
3059 #include <pwd.h>
3060                 ],
3061                 [ struct passwd p; p.pw_change = 0; ],
3062                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
3063                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
3064         )
3065 ])
3066 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
3067         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
3068                 [Define if your password has a pw_change field])
3069 fi
3070
3071 dnl make sure we're using the real structure members and not defines
3072 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
3073                 ac_cv_have_accrights_in_msghdr, [
3074         AC_COMPILE_IFELSE(
3075                 [
3076 #include <sys/types.h>
3077 #include <sys/socket.h>
3078 #include <sys/uio.h>
3079 int main() {
3080 #ifdef msg_accrights
3081 #error "msg_accrights is a macro"
3082 exit(1);
3083 #endif
3084 struct msghdr m;
3085 m.msg_accrights = 0;
3086 exit(0);
3087 }
3088                 ],
3089                 [ ac_cv_have_accrights_in_msghdr="yes" ],
3090                 [ ac_cv_have_accrights_in_msghdr="no" ]
3091         )
3092 ])
3093 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
3094         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
3095                 [Define if your system uses access rights style
3096                 file descriptor passing])
3097 fi
3098
3099 AC_MSG_CHECKING(if struct statvfs.f_fsid is integral type)
3100 AC_TRY_COMPILE([
3101 #include <sys/types.h>
3102 #include <sys/stat.h>
3103 #ifdef HAVE_SYS_TIME_H
3104 # include <sys/time.h>
3105 #endif
3106 #ifdef HAVE_SYS_MOUNT_H
3107 #include <sys/mount.h>
3108 #endif
3109 #ifdef HAVE_SYS_STATVFS_H
3110 #include <sys/statvfs.h>
3111 #endif
3112 ], [struct statvfs s; s.f_fsid = 0;],
3113 [ AC_MSG_RESULT(yes) ],
3114 [ AC_MSG_RESULT(no)
3115
3116         AC_MSG_CHECKING(if fsid_t has member val)
3117         AC_TRY_COMPILE([
3118 #include <sys/types.h>
3119 #include <sys/statvfs.h>],
3120         [fsid_t t; t.val[0] = 0;],
3121         [ AC_MSG_RESULT(yes)
3122           AC_DEFINE(FSID_HAS_VAL, 1, fsid_t has member val) ],
3123         [ AC_MSG_RESULT(no) ])
3124
3125         AC_MSG_CHECKING(if f_fsid has member __val)
3126         AC_TRY_COMPILE([
3127 #include <sys/types.h>
3128 #include <sys/statvfs.h>],
3129         [fsid_t t; t.__val[0] = 0;],
3130         [ AC_MSG_RESULT(yes)
3131           AC_DEFINE(FSID_HAS___VAL, 1, fsid_t has member __val) ],
3132         [ AC_MSG_RESULT(no) ])
3133 ])
3134
3135 AC_CACHE_CHECK([for msg_control field in struct msghdr],
3136                 ac_cv_have_control_in_msghdr, [
3137         AC_COMPILE_IFELSE(
3138                 [
3139 #include <sys/types.h>
3140 #include <sys/socket.h>
3141 #include <sys/uio.h>
3142 int main() {
3143 #ifdef msg_control
3144 #error "msg_control is a macro"
3145 exit(1);
3146 #endif
3147 struct msghdr m;
3148 m.msg_control = 0;
3149 exit(0);
3150 }
3151                 ],
3152                 [ ac_cv_have_control_in_msghdr="yes" ],
3153                 [ ac_cv_have_control_in_msghdr="no" ]
3154         )
3155 ])
3156 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
3157         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3158                 [Define if your system uses ancillary data style
3159                 file descriptor passing])
3160 fi
3161
3162 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3163         AC_TRY_LINK([],
3164                 [ extern char *__progname; printf("%s", __progname); ],
3165                 [ ac_cv_libc_defines___progname="yes" ],
3166                 [ ac_cv_libc_defines___progname="no" ]
3167         )
3168 ])
3169 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3170         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3171 fi
3172
3173 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3174         AC_TRY_LINK([
3175 #include <stdio.h>
3176 ],
3177                 [ printf("%s", __FUNCTION__); ],
3178                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3179                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3180         )
3181 ])
3182 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3183         AC_DEFINE(HAVE___FUNCTION__, 1,
3184                 [Define if compiler implements __FUNCTION__])
3185 fi
3186
3187 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3188         AC_TRY_LINK([
3189 #include <stdio.h>
3190 ],
3191                 [ printf("%s", __func__); ],
3192                 [ ac_cv_cc_implements___func__="yes" ],
3193                 [ ac_cv_cc_implements___func__="no" ]
3194         )
3195 ])
3196 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3197         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3198 fi
3199
3200 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3201         AC_TRY_LINK(
3202                 [#include <stdarg.h>
3203                  va_list x,y;],
3204                 [va_copy(x,y);],
3205                 [ ac_cv_have_va_copy="yes" ],
3206                 [ ac_cv_have_va_copy="no" ]
3207         )
3208 ])
3209 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3210         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3211 fi
3212
3213 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3214         AC_TRY_LINK(
3215                 [#include <stdarg.h>
3216                  va_list x,y;],
3217                 [__va_copy(x,y);],
3218                 [ ac_cv_have___va_copy="yes" ],
3219                 [ ac_cv_have___va_copy="no" ]
3220         )
3221 ])
3222 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3223         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3224 fi
3225
3226 AC_CACHE_CHECK([whether getopt has optreset support],
3227                 ac_cv_have_getopt_optreset, [
3228         AC_TRY_LINK(
3229                 [
3230 #include <getopt.h>
3231                 ],
3232                 [ extern int optreset; optreset = 0; ],
3233                 [ ac_cv_have_getopt_optreset="yes" ],
3234                 [ ac_cv_have_getopt_optreset="no" ]
3235         )
3236 ])
3237 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3238         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3239                 [Define if your getopt(3) defines and uses optreset])
3240 fi
3241
3242 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3243         AC_TRY_LINK([],
3244                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3245                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3246                 [ ac_cv_libc_defines_sys_errlist="no" ]
3247         )
3248 ])
3249 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3250         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3251                 [Define if your system defines sys_errlist[]])
3252 fi
3253
3254
3255 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3256         AC_TRY_LINK([],
3257                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3258                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3259                 [ ac_cv_libc_defines_sys_nerr="no" ]
3260         )
3261 ])
3262 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3263         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3264 fi
3265
3266 SCARD_MSG="no"
3267 # Check whether user wants sectok support
3268 AC_ARG_WITH(sectok,
3269         [  --with-sectok           Enable smartcard support using libsectok],
3270         [
3271                 if test "x$withval" != "xno" ; then
3272                         if test "x$withval" != "xyes" ; then
3273                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3274                                 LDFLAGS="$LDFLAGS -L${withval}"
3275                                 if test ! -z "$need_dash_r" ; then
3276                                         LDFLAGS="$LDFLAGS -R${withval}"
3277                                 fi
3278                                 if test ! -z "$blibpath" ; then
3279                                         blibpath="$blibpath:${withval}"
3280                                 fi
3281                         fi
3282                         AC_CHECK_HEADERS(sectok.h)
3283                         if test "$ac_cv_header_sectok_h" != yes; then
3284                                 AC_MSG_ERROR(Can't find sectok.h)
3285                         fi
3286                         AC_CHECK_LIB(sectok, sectok_open)
3287                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3288                                 AC_MSG_ERROR(Can't find libsectok)
3289                         fi
3290                         AC_DEFINE(SMARTCARD, 1,
3291                                 [Define if you want smartcard support])
3292                         AC_DEFINE(USE_SECTOK, 1,
3293                                 [Define if you want smartcard support
3294                                 using sectok])
3295                         SCARD_MSG="yes, using sectok"
3296                 fi
3297         ]
3298 )
3299
3300 # Check whether user wants OpenSC support
3301 OPENSC_CONFIG="no"
3302 AC_ARG_WITH(opensc,
3303         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3304         [
3305             if test "x$withval" != "xno" ; then
3306                 AC_PATH_PROG(PKGCONFIG, pkg-config, no)
3307                 AC_MSG_CHECKING(how to get opensc config)
3308                 if test "x$withval" != "xyes" -a "x$PKGCONFIG" = "xno"; then
3309                         OPENSC_CONFIG="$withval/bin/opensc-config"
3310                 elif test -f "$withval/src/libopensc/libopensc.pc"; then
3311                         OPENSC_CONFIG="$PKGCONFIG $withval/src/libopensc/libopensc.pc"
3312                 elif test "x$PKGCONFIG" != "xno"; then
3313                         OPENSC_CONFIG="$PKGCONFIG libopensc"
3314                 else
3315                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3316                 fi
3317                 AC_MSG_RESULT($OPENSC_CONFIG)
3318                 if test "$OPENSC_CONFIG" != "no"; then
3319                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3320                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3321                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3322                         LIBS="$LIBS $LIBOPENSC_LIBS"
3323                         AC_DEFINE(SMARTCARD)
3324                         AC_DEFINE(USE_OPENSC, 1,
3325                                 [Define if you want smartcard support
3326                                 using OpenSC])
3327                         SCARD_MSG="yes, using OpenSC"
3328                 fi
3329             fi
3330         ]
3331 )
3332
3333 # Check libraries needed by DNS fingerprint support
3334 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3335         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3336                 [Define if getrrsetbyname() exists])],
3337         [
3338                 # Needed by our getrrsetbyname()
3339                 AC_SEARCH_LIBS(res_query, resolv)
3340                 AC_SEARCH_LIBS(dn_expand, resolv)
3341                 AC_MSG_CHECKING(if res_query will link)
3342                 AC_LINK_IFELSE([
3343 #include "confdefs.h"
3344 #include <sys/types.h>
3345 #include <netinet/in.h>
3346 #include <arpa/nameser.h>
3347 #include <netdb.h>
3348 #include <resolv.h>
3349 int main()
3350 {
3351         res_query (0, 0, 0, 0, 0);
3352         return 0;
3353 }
3354                    ],
3355                     AC_MSG_RESULT(yes),
3356                    [AC_MSG_RESULT(no)
3357                     saved_LIBS="$LIBS"
3358                     LIBS="$LIBS -lresolv"
3359                     AC_MSG_CHECKING(for res_query in -lresolv)
3360                     AC_LINK_IFELSE([
3361 #include "confdefs.h"
3362 #include <sys/types.h>
3363 #include <netinet/in.h>
3364 #include <arpa/nameser.h>
3365 #include <netdb.h>
3366 #include <resolv.h>
3367 int main()
3368 {
3369         res_query (0, 0, 0, 0, 0);
3370         return 0;
3371 }
3372                         ],
3373                         [AC_MSG_RESULT(yes)],
3374                         [LIBS="$saved_LIBS"
3375                          AC_MSG_RESULT(no)])
3376                     ])
3377                 AC_CHECK_FUNCS(_getshort _getlong)
3378                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3379                     [#include <sys/types.h>
3380                     #include <arpa/nameser.h>])
3381                 AC_CHECK_MEMBER(HEADER.ad,
3382                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3383                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3384                         [#include <arpa/nameser.h>])
3385         ])
3386
3387 AC_MSG_CHECKING(if struct __res_state _res is an extern)
3388 AC_LINK_IFELSE([
3389 #include <stdio.h>
3390 #if HAVE_SYS_TYPES_H
3391 # include <sys/types.h>
3392 #endif
3393 #include <netinet/in.h>
3394 #include <arpa/nameser.h>
3395 #include <resolv.h>
3396 extern struct __res_state _res;
3397 int main() { return 0; }
3398                 ],
3399                 [AC_MSG_RESULT(yes)
3400                  AC_DEFINE(HAVE__RES_EXTERN, 1,
3401                     [Define if you have struct __res_state _res as an extern])
3402                 ],
3403                 [ AC_MSG_RESULT(no) ]
3404 )
3405
3406 # Check whether user wants SELinux support
3407 SELINUX_MSG="no"
3408 LIBSELINUX=""
3409 AC_ARG_WITH(selinux,
3410         [  --with-selinux          Enable SELinux support],
3411         [ if test "x$withval" != "xno" ; then
3412                 save_LIBS="$LIBS"
3413                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3414                 SELINUX_MSG="yes"
3415                 AC_CHECK_HEADER([selinux/selinux.h], ,
3416                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3417                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3418                     AC_MSG_ERROR(SELinux support requires libselinux library))
3419                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
3420                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3421                 LIBS="$save_LIBS"
3422         fi ]
3423 )
3424
3425 # Check whether user wants Kerberos 5 support
3426 KRB5_MSG="no"
3427 AC_ARG_WITH(kerberos5,
3428         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3429         [ if test "x$withval" != "xno" ; then
3430                 if test "x$withval" = "xyes" ; then
3431                         KRB5ROOT="/usr/local"
3432                 else
3433                         KRB5ROOT=${withval}
3434                 fi
3435
3436                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3437                 KRB5_MSG="yes"
3438
3439                 AC_PATH_PROG([KRB5CONF],[krb5-config],
3440                              [$KRB5ROOT/bin/krb5-config],
3441                              [$KRB5ROOT/bin:$PATH])
3442                 if test -x $KRB5CONF ; then
3443
3444                         AC_MSG_CHECKING(for gssapi support)
3445                         if $KRB5CONF | grep gssapi >/dev/null ; then
3446                                 AC_MSG_RESULT(yes)
3447                                 AC_DEFINE(GSSAPI, 1,
3448                                         [Define this if you want GSSAPI
3449                                         support in the version 2 protocol])
3450                                 k5confopts=gssapi
3451                         else
3452                                 AC_MSG_RESULT(no)
3453                                 k5confopts=""
3454                         fi
3455                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3456                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3457                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3458                         AC_MSG_CHECKING(whether we are using Heimdal)
3459                         AC_TRY_COMPILE([ #include <krb5.h> ],
3460                                        [ char *tmp = heimdal_version; ],
3461                                        [ AC_MSG_RESULT(yes)
3462                                          AC_DEFINE(HEIMDAL, 1,
3463                                         [Define this if you are using the
3464                                         Heimdal version of Kerberos V5]) ],
3465                                          AC_MSG_RESULT(no)
3466                         )
3467                 else
3468                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3469                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3470                         AC_MSG_CHECKING(whether we are using Heimdal)
3471                         AC_TRY_COMPILE([ #include <krb5.h> ],
3472                                        [ char *tmp = heimdal_version; ],
3473                                        [ AC_MSG_RESULT(yes)
3474                                          AC_DEFINE(HEIMDAL)
3475                                          K5LIBS="-lkrb5 -ldes"
3476                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3477                                          AC_CHECK_LIB(roken, net_write,
3478                                            [K5LIBS="$K5LIBS -lroken"])
3479                                        ],
3480                                        [ AC_MSG_RESULT(no)
3481                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3482                                        ]
3483                         )
3484                         AC_SEARCH_LIBS(dn_expand, resolv)
3485
3486                         AC_CHECK_LIB(gssapi_krb5, gss_init_sec_context,
3487                                 [ AC_DEFINE(GSSAPI)
3488                                   K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3489                                 [ AC_CHECK_LIB(gssapi, gss_init_sec_context,
3490                                         [ AC_DEFINE(GSSAPI)
3491                                           K5LIBS="-lgssapi $K5LIBS" ],
3492                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3493                                         $K5LIBS)
3494                                 ],
3495                                 $K5LIBS)
3496
3497                         AC_CHECK_HEADER(gssapi.h, ,
3498                                 [ unset ac_cv_header_gssapi_h
3499                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3500                                   AC_CHECK_HEADERS(gssapi.h, ,
3501                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3502                                   )
3503                                 ]
3504                         )
3505
3506                         oldCPP="$CPPFLAGS"
3507                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3508                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3509                                         [ CPPFLAGS="$oldCPP" ])
3510
3511                 fi
3512                 if test ! -z "$need_dash_r" ; then
3513                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3514                 fi
3515                 if test ! -z "$blibpath" ; then
3516                         blibpath="$blibpath:${KRB5ROOT}/lib"
3517                 fi
3518
3519                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3520                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3521                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3522
3523                 LIBS="$LIBS $K5LIBS"
3524                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3525                         [Define this if you want to use libkafs' AFS support]))
3526         fi
3527         ]
3528 )
3529
3530 # Looking for programs, paths and files
3531
3532 PRIVSEP_PATH=/var/empty
3533 AC_ARG_WITH(privsep-path,
3534         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3535         [
3536                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3537                     test "x${withval}" != "xyes"; then
3538                         PRIVSEP_PATH=$withval
3539                 fi
3540         ]
3541 )
3542 AC_SUBST(PRIVSEP_PATH)
3543
3544 AC_ARG_WITH(xauth,
3545         [  --with-xauth=PATH       Specify path to xauth program ],
3546         [
3547                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3548                     test "x${withval}" != "xyes"; then
3549                         xauth_path=$withval
3550                 fi
3551         ],
3552         [
3553                 TestPath="$PATH"
3554                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3555                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3556                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3557                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3558                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3559                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3560                         xauth_path="/usr/openwin/bin/xauth"
3561                 fi
3562         ]
3563 )
3564
3565 STRIP_OPT=-s
3566 AC_ARG_ENABLE(strip,
3567         [  --disable-strip         Disable calling strip(1) on install],
3568         [
3569                 if test "x$enableval" = "xno" ; then
3570                         STRIP_OPT=
3571                 fi
3572         ]
3573 )
3574 AC_SUBST(STRIP_OPT)
3575
3576 if test -z "$xauth_path" ; then
3577         XAUTH_PATH="undefined"
3578         AC_SUBST(XAUTH_PATH)
3579 else
3580         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3581                 [Define if xauth is found in your path])
3582         XAUTH_PATH=$xauth_path
3583         AC_SUBST(XAUTH_PATH)
3584 fi
3585
3586 # Check for mail directory (last resort if we cannot get it from headers)
3587 if test ! -z "$MAIL" ; then
3588         maildir=`dirname $MAIL`
3589         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3590                 [Set this to your mail directory if you don't have maillock.h])
3591 fi
3592
3593 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3594         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3595         disable_ptmx_check=yes
3596 fi
3597 if test -z "$no_dev_ptmx" ; then
3598         if test "x$disable_ptmx_check" != "xyes" ; then
3599                 AC_CHECK_FILE("/dev/ptmx",
3600                         [
3601                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3602                                         [Define if you have /dev/ptmx])
3603                                 have_dev_ptmx=1
3604                         ]
3605                 )
3606         fi
3607 fi
3608
3609 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3610         AC_CHECK_FILE("/dev/ptc",
3611                 [
3612                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3613                                 [Define if you have /dev/ptc])
3614                         have_dev_ptc=1
3615                 ]
3616         )
3617 else
3618         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3619 fi
3620
3621 # Options from here on. Some of these are preset by platform above
3622 AC_ARG_WITH(mantype,
3623         [  --with-mantype=man|cat|doc  Set man page type],
3624         [
3625                 case "$withval" in
3626                 man|cat|doc)
3627                         MANTYPE=$withval
3628                         ;;
3629                 *)
3630                         AC_MSG_ERROR(invalid man type: $withval)
3631                         ;;
3632                 esac
3633         ]
3634 )
3635 if test -z "$MANTYPE"; then
3636         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3637         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3638         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3639                 MANTYPE=doc
3640         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3641                 MANTYPE=man
3642         else
3643                 MANTYPE=cat
3644         fi
3645 fi
3646 AC_SUBST(MANTYPE)
3647 if test "$MANTYPE" = "doc"; then
3648         mansubdir=man;
3649 else
3650         mansubdir=$MANTYPE;
3651 fi
3652 AC_SUBST(mansubdir)
3653
3654 # Check whether to enable MD5 passwords
3655 MD5_MSG="no"
3656 AC_ARG_WITH(md5-passwords,
3657         [  --with-md5-passwords    Enable use of MD5 passwords],
3658         [
3659                 if test "x$withval" != "xno" ; then
3660                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3661                                 [Define if you want to allow MD5 passwords])
3662                         MD5_MSG="yes"
3663                 fi
3664         ]
3665 )
3666
3667 # Whether to disable shadow password support
3668 AC_ARG_WITH(shadow,
3669         [  --without-shadow        Disable shadow password support],
3670         [
3671                 if test "x$withval" = "xno" ; then
3672                         AC_DEFINE(DISABLE_SHADOW)
3673                         disable_shadow=yes
3674                 fi
3675         ]
3676 )
3677
3678 if test -z "$disable_shadow" ; then
3679         AC_MSG_CHECKING([if the systems has expire shadow information])
3680         AC_TRY_COMPILE(
3681         [
3682 #include <sys/types.h>
3683 #include <shadow.h>
3684         struct spwd sp;
3685         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3686         [ sp_expire_available=yes ], []
3687         )
3688
3689         if test "x$sp_expire_available" = "xyes" ; then
3690                 AC_MSG_RESULT(yes)
3691                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3692                     [Define if you want to use shadow password expire field])
3693         else
3694                 AC_MSG_RESULT(no)
3695         fi
3696 fi
3697
3698 # Use ip address instead of hostname in $DISPLAY
3699 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3700         DISPLAY_HACK_MSG="yes"
3701         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3702                 [Define if you need to use IP address
3703                 instead of hostname in $DISPLAY])
3704 else
3705         DISPLAY_HACK_MSG="no"
3706         AC_ARG_WITH(ipaddr-display,
3707                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3708                 [
3709                         if test "x$withval" != "xno" ; then
3710                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3711                                 DISPLAY_HACK_MSG="yes"
3712                         fi
3713                 ]
3714         )
3715 fi
3716
3717 # check for /etc/default/login and use it if present.
3718 AC_ARG_ENABLE(etc-default-login,
3719         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3720         [ if test "x$enableval" = "xno"; then
3721                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3722                 etc_default_login=no
3723           else
3724                 etc_default_login=yes
3725           fi ],
3726         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3727           then
3728                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3729                 etc_default_login=no
3730           else
3731                 etc_default_login=yes
3732           fi ]
3733 )
3734
3735 if test "x$etc_default_login" != "xno"; then
3736         AC_CHECK_FILE("/etc/default/login",
3737             [ external_path_file=/etc/default/login ])
3738         if test "x$external_path_file" = "x/etc/default/login"; then
3739                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3740                         [Define if your system has /etc/default/login])
3741         fi
3742 fi
3743
3744 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3745 if test $ac_cv_func_login_getcapbool = "yes" && \
3746         test $ac_cv_header_login_cap_h = "yes" ; then
3747         external_path_file=/etc/login.conf
3748 fi
3749
3750 # Whether to mess with the default path
3751 SERVER_PATH_MSG="(default)"
3752 AC_ARG_WITH(default-path,
3753         [  --with-default-path=    Specify default \$PATH environment for server],
3754         [
3755                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3756                         AC_MSG_WARN([
3757 --with-default-path=PATH has no effect on this system.
3758 Edit /etc/login.conf instead.])
3759                 elif test "x$withval" != "xno" ; then
3760                         if test ! -z "$external_path_file" ; then
3761                                 AC_MSG_WARN([
3762 --with-default-path=PATH will only be used if PATH is not defined in
3763 $external_path_file .])
3764                         fi
3765                         user_path="$withval"
3766                         SERVER_PATH_MSG="$withval"
3767                 fi
3768         ],
3769         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3770                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3771         else
3772                 if test ! -z "$external_path_file" ; then
3773                         AC_MSG_WARN([
3774 If PATH is defined in $external_path_file, ensure the path to scp is included,
3775 otherwise scp will not work.])
3776                 fi
3777                 AC_RUN_IFELSE(
3778                         [AC_LANG_SOURCE([[
3779 /* find out what STDPATH is */
3780 #include <stdio.h>
3781 #ifdef HAVE_PATHS_H
3782 # include <paths.h>
3783 #endif
3784 #ifndef _PATH_STDPATH
3785 # ifdef _PATH_USERPATH  /* Irix */
3786 #  define _PATH_STDPATH _PATH_USERPATH
3787 # else
3788 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3789 # endif
3790 #endif
3791 #include <sys/types.h>
3792 #include <sys/stat.h>
3793 #include <fcntl.h>
3794 #define DATA "conftest.stdpath"
3795
3796 main()
3797 {
3798         FILE *fd;
3799         int rc;
3800
3801         fd = fopen(DATA,"w");
3802         if(fd == NULL)
3803                 exit(1);
3804
3805         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3806                 exit(1);
3807
3808         exit(0);
3809 }
3810                 ]])],
3811                 [ user_path=`cat conftest.stdpath` ],
3812                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3813                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3814         )
3815 # make sure $bindir is in USER_PATH so scp will work
3816                 t_bindir=`eval echo ${bindir}`
3817                 case $t_bindir in
3818                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3819                 esac
3820                 case $t_bindir in
3821                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3822                 esac
3823                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3824                 if test $? -ne 0  ; then
3825                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3826                         if test $? -ne 0  ; then
3827                                 user_path=$user_path:$t_bindir
3828                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3829                         fi
3830                 fi
3831         fi ]
3832 )
3833 if test "x$external_path_file" != "x/etc/login.conf" ; then
3834         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3835         AC_SUBST(user_path)
3836 fi
3837
3838 # Set superuser path separately to user path
3839 AC_ARG_WITH(superuser-path,
3840         [  --with-superuser-path=  Specify different path for super-user],
3841         [
3842                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3843                     test "x${withval}" != "xyes"; then
3844                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3845                                 [Define if you want a different $PATH
3846                                 for the superuser])
3847                         superuser_path=$withval
3848                 fi
3849         ]
3850 )
3851
3852
3853 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3854 IPV4_IN6_HACK_MSG="no"
3855 AC_ARG_WITH(4in6,
3856         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3857         [
3858                 if test "x$withval" != "xno" ; then
3859                         AC_MSG_RESULT(yes)
3860                         AC_DEFINE(IPV4_IN_IPV6, 1,
3861                                 [Detect IPv4 in IPv6 mapped addresses
3862                                 and treat as IPv4])
3863                         IPV4_IN6_HACK_MSG="yes"
3864                 else
3865                         AC_MSG_RESULT(no)
3866                 fi
3867         ],[
3868                 if test "x$inet6_default_4in6" = "xyes"; then
3869                         AC_MSG_RESULT([yes (default)])
3870                         AC_DEFINE(IPV4_IN_IPV6)
3871                         IPV4_IN6_HACK_MSG="yes"
3872                 else
3873                         AC_MSG_RESULT([no (default)])
3874                 fi
3875         ]
3876 )
3877
3878 # Whether to enable BSD auth support
3879 BSD_AUTH_MSG=no
3880 AC_ARG_WITH(bsd-auth,
3881         [  --with-bsd-auth         Enable BSD auth support],
3882         [
3883                 if test "x$withval" != "xno" ; then
3884                         AC_DEFINE(BSD_AUTH, 1,
3885                                 [Define if you have BSD auth support])
3886                         BSD_AUTH_MSG=yes
3887                 fi
3888         ]
3889 )
3890
3891 # Where to place sshd.pid
3892 piddir=/var/run
3893 # make sure the directory exists
3894 if test ! -d $piddir ; then
3895         piddir=`eval echo ${sysconfdir}`
3896         case $piddir in
3897                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3898         esac
3899 fi
3900
3901 AC_ARG_WITH(pid-dir,
3902         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3903         [
3904                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3905                     test "x${withval}" != "xyes"; then
3906                         piddir=$withval
3907                         if test ! -d $piddir ; then
3908                         AC_MSG_WARN([** no $piddir directory on this system **])
3909                         fi
3910                 fi
3911         ]
3912 )
3913
3914 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3915 AC_SUBST(piddir)
3916
3917 dnl allow user to disable some login recording features
3918 AC_ARG_ENABLE(lastlog,
3919         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3920         [
3921                 if test "x$enableval" = "xno" ; then
3922                         AC_DEFINE(DISABLE_LASTLOG)
3923                 fi
3924         ]
3925 )
3926 AC_ARG_ENABLE(utmp,
3927         [  --disable-utmp          disable use of utmp even if detected [no]],
3928         [
3929                 if test "x$enableval" = "xno" ; then
3930                         AC_DEFINE(DISABLE_UTMP)
3931                 fi
3932         ]
3933 )
3934 AC_ARG_ENABLE(utmpx,
3935         [  --disable-utmpx         disable use of utmpx even if detected [no]],
3936         [
3937                 if test "x$enableval" = "xno" ; then
3938                         AC_DEFINE(DISABLE_UTMPX, 1,
3939                                 [Define if you don't want to use utmpx])
3940                 fi
3941         ]
3942 )
3943 AC_ARG_ENABLE(wtmp,
3944         [  --disable-wtmp          disable use of wtmp even if detected [no]],
3945         [
3946                 if test "x$enableval" = "xno" ; then
3947                         AC_DEFINE(DISABLE_WTMP)
3948                 fi
3949         ]
3950 )
3951 AC_ARG_ENABLE(wtmpx,
3952         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
3953         [
3954                 if test "x$enableval" = "xno" ; then
3955                         AC_DEFINE(DISABLE_WTMPX, 1,
3956                                 [Define if you don't want to use wtmpx])
3957                 fi
3958         ]
3959 )
3960 AC_ARG_ENABLE(libutil,
3961         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
3962         [
3963                 if test "x$enableval" = "xno" ; then
3964                         AC_DEFINE(DISABLE_LOGIN)
3965                 fi
3966         ]
3967 )
3968 AC_ARG_ENABLE(pututline,
3969         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
3970         [
3971                 if test "x$enableval" = "xno" ; then
3972                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
3973                                 [Define if you don't want to use pututline()
3974                                 etc. to write [uw]tmp])
3975                 fi
3976         ]
3977 )
3978 AC_ARG_ENABLE(pututxline,
3979         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
3980         [
3981                 if test "x$enableval" = "xno" ; then
3982                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
3983                                 [Define if you don't want to use pututxline()
3984                                 etc. to write [uw]tmpx])
3985                 fi
3986         ]
3987 )
3988 AC_ARG_WITH(lastlog,
3989   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
3990         [
3991                 if test "x$withval" = "xno" ; then
3992                         AC_DEFINE(DISABLE_LASTLOG)
3993                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
3994                         conf_lastlog_location=$withval
3995                 fi
3996         ]
3997 )
3998
3999 dnl lastlog, [uw]tmpx? detection
4000 dnl  NOTE: set the paths in the platform section to avoid the
4001 dnl   need for command-line parameters
4002 dnl lastlog and [uw]tmp are subject to a file search if all else fails
4003
4004 dnl lastlog detection
4005 dnl  NOTE: the code itself will detect if lastlog is a directory
4006 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
4007 AC_TRY_COMPILE([
4008 #include <sys/types.h>
4009 #include <utmp.h>
4010 #ifdef HAVE_LASTLOG_H
4011 #  include <lastlog.h>
4012 #endif
4013 #ifdef HAVE_PATHS_H
4014 #  include <paths.h>
4015 #endif
4016 #ifdef HAVE_LOGIN_H
4017 # include <login.h>
4018 #endif
4019         ],
4020         [ char *lastlog = LASTLOG_FILE; ],
4021         [ AC_MSG_RESULT(yes) ],
4022         [
4023                 AC_MSG_RESULT(no)
4024                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
4025                 AC_TRY_COMPILE([
4026 #include <sys/types.h>
4027 #include <utmp.h>
4028 #ifdef HAVE_LASTLOG_H
4029 #  include <lastlog.h>
4030 #endif
4031 #ifdef HAVE_PATHS_H
4032 #  include <paths.h>
4033 #endif
4034                 ],
4035                 [ char *lastlog = _PATH_LASTLOG; ],
4036                 [ AC_MSG_RESULT(yes) ],
4037                 [
4038                         AC_MSG_RESULT(no)
4039                         system_lastlog_path=no
4040                 ])
4041         ]
4042 )
4043
4044 if test -z "$conf_lastlog_location"; then
4045         if test x"$system_lastlog_path" = x"no" ; then
4046                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
4047                                 if (test -d "$f" || test -f "$f") ; then
4048                                         conf_lastlog_location=$f
4049                                 fi
4050                 done
4051                 if test -z "$conf_lastlog_location"; then
4052                         AC_MSG_WARN([** Cannot find lastlog **])
4053                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
4054                 fi
4055         fi
4056 fi
4057
4058 if test -n "$conf_lastlog_location"; then
4059         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
4060                 [Define if you want to specify the path to your lastlog file])
4061 fi
4062
4063 dnl utmp detection
4064 AC_MSG_CHECKING([if your system defines UTMP_FILE])
4065 AC_TRY_COMPILE([
4066 #include <sys/types.h>
4067 #include <utmp.h>
4068 #ifdef HAVE_PATHS_H
4069 #  include <paths.h>
4070 #endif
4071         ],
4072         [ char *utmp = UTMP_FILE; ],
4073         [ AC_MSG_RESULT(yes) ],
4074         [ AC_MSG_RESULT(no)
4075           system_utmp_path=no ]
4076 )
4077 if test -z "$conf_utmp_location"; then
4078         if test x"$system_utmp_path" = x"no" ; then
4079                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
4080                         if test -f $f ; then
4081                                 conf_utmp_location=$f
4082                         fi
4083                 done
4084                 if test -z "$conf_utmp_location"; then
4085                         AC_DEFINE(DISABLE_UTMP)
4086                 fi
4087         fi
4088 fi
4089 if test -n "$conf_utmp_location"; then
4090         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
4091                 [Define if you want to specify the path to your utmp file])
4092 fi
4093
4094 dnl wtmp detection
4095 AC_MSG_CHECKING([if your system defines WTMP_FILE])
4096 AC_TRY_COMPILE([
4097 #include <sys/types.h>
4098 #include <utmp.h>
4099 #ifdef HAVE_PATHS_H
4100 #  include <paths.h>
4101 #endif
4102         ],
4103         [ char *wtmp = WTMP_FILE; ],
4104         [ AC_MSG_RESULT(yes) ],
4105         [ AC_MSG_RESULT(no)
4106           system_wtmp_path=no ]
4107 )
4108 if test -z "$conf_wtmp_location"; then
4109         if test x"$system_wtmp_path" = x"no" ; then
4110                 for f in /usr/adm/wtmp /var/log/wtmp; do
4111                         if test -f $f ; then
4112                                 conf_wtmp_location=$f
4113                         fi
4114                 done
4115                 if test -z "$conf_wtmp_location"; then
4116                         AC_DEFINE(DISABLE_WTMP)
4117                 fi
4118         fi
4119 fi
4120 if test -n "$conf_wtmp_location"; then
4121         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
4122                 [Define if you want to specify the path to your wtmp file])
4123 fi
4124
4125
4126 dnl utmpx detection - I don't know any system so perverse as to require
4127 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
4128 dnl  there, though.
4129 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
4130 AC_TRY_COMPILE([
4131 #include <sys/types.h>
4132 #include <utmp.h>
4133 #ifdef HAVE_UTMPX_H
4134 #include <utmpx.h>
4135 #endif
4136 #ifdef HAVE_PATHS_H
4137 #  include <paths.h>
4138 #endif
4139         ],
4140         [ char *utmpx = UTMPX_FILE; ],
4141         [ AC_MSG_RESULT(yes) ],
4142         [ AC_MSG_RESULT(no)
4143           system_utmpx_path=no ]
4144 )
4145 if test -z "$conf_utmpx_location"; then
4146         if test x"$system_utmpx_path" = x"no" ; then
4147                 AC_DEFINE(DISABLE_UTMPX)
4148         fi
4149 else
4150         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
4151                 [Define if you want to specify the path to your utmpx file])
4152 fi
4153
4154 dnl wtmpx detection
4155 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
4156 AC_TRY_COMPILE([
4157 #include <sys/types.h>
4158 #include <utmp.h>
4159 #ifdef HAVE_UTMPX_H
4160 #include <utmpx.h>
4161 #endif
4162 #ifdef HAVE_PATHS_H
4163 #  include <paths.h>
4164 #endif
4165         ],
4166         [ char *wtmpx = WTMPX_FILE; ],
4167         [ AC_MSG_RESULT(yes) ],
4168         [ AC_MSG_RESULT(no)
4169           system_wtmpx_path=no ]
4170 )
4171 if test -z "$conf_wtmpx_location"; then
4172         if test x"$system_wtmpx_path" = x"no" ; then
4173                 AC_DEFINE(DISABLE_WTMPX)
4174         fi
4175 else
4176         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
4177                 [Define if you want to specify the path to your wtmpx file])
4178 fi
4179
4180
4181 if test ! -z "$blibpath" ; then
4182         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4183         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4184 fi
4185
4186 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4187 dnl Add now.
4188 CFLAGS="$CFLAGS $werror_flags"
4189
4190 if grep "#define BROKEN_GETADDRINFO 1" confdefs.h >/dev/null || \
4191     test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
4192         AC_SUBST(TEST_SSH_IPV6, no)
4193 else
4194         AC_SUBST(TEST_SSH_IPV6, yes)
4195 fi
4196
4197 AC_EXEEXT
4198 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4199         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4200         scard/Makefile ssh_prng_cmds survey.sh])
4201 AC_OUTPUT
4202
4203 # Print summary of options
4204
4205 # Someone please show me a better way :)
4206 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4207 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4208 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4209 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4210 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4211 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4212 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
4213 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4214 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4215 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4216
4217 echo ""
4218 echo "OpenSSH has been configured with the following options:"
4219 echo "                     User binaries: $B"
4220 echo "                   System binaries: $C"
4221 echo "               Configuration files: $D"
4222 echo "                   Askpass program: $E"
4223 echo "                      Manual pages: $F"
4224 echo "                          PID file: $G"
4225 echo "  Privilege separation chroot path: $H"
4226 if test "x$external_path_file" = "x/etc/login.conf" ; then
4227 echo "   At runtime, sshd will use the path defined in $external_path_file"
4228 echo "   Make sure the path to scp is present, otherwise scp will not work"
4229 else
4230 echo "            sshd default user PATH: $I"
4231         if test ! -z "$external_path_file"; then
4232 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4233 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4234         fi
4235 fi
4236 if test ! -z "$superuser_path" ; then
4237 echo "          sshd superuser user PATH: $J"
4238 fi
4239 echo "                    Manpage format: $MANTYPE"
4240 echo "                       PAM support: $PAM_MSG"
4241 echo "                   OSF SIA support: $SIA_MSG"
4242 echo "                 KerberosV support: $KRB5_MSG"
4243 echo "                   SELinux support: $SELINUX_MSG"
4244 echo "                 Smartcard support: $SCARD_MSG"
4245 echo "                     S/KEY support: $SKEY_MSG"
4246 echo "              TCP Wrappers support: $TCPW_MSG"
4247 echo "              MD5 password support: $MD5_MSG"
4248 echo "                   libedit support: $LIBEDIT_MSG"
4249 echo "  Solaris process contract support: $SPC_MSG"
4250 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4251 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4252 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4253 echo "              Random number source: $RAND_MSG"
4254 if test ! -z "$USE_RAND_HELPER" ; then
4255 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4256 fi
4257
4258 echo ""
4259
4260 echo "              Host: ${host}"
4261 echo "          Compiler: ${CC}"
4262 echo "    Compiler flags: ${CFLAGS}"
4263 echo "Preprocessor flags: ${CPPFLAGS}"
4264 echo "      Linker flags: ${LDFLAGS}"
4265 echo "         Libraries: ${LIBS}"
4266 if test ! -z "${SSHDLIBS}"; then
4267 echo "         +for sshd: ${SSHDLIBS}"
4268 fi
4269
4270 echo ""
4271
4272 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4273         echo "SVR4 style packages are supported with \"make package\""
4274         echo ""
4275 fi
4276
4277 if test "x$PAM_MSG" = "xyes" ; then
4278         echo "PAM is enabled. You may need to install a PAM control file "
4279         echo "for sshd, otherwise password authentication may fail. "
4280         echo "Example PAM control files can be found in the contrib/ "
4281         echo "subdirectory"
4282         echo ""
4283 fi
4284
4285 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4286         echo "WARNING: you are using the builtin random number collection "
4287         echo "service. Please read WARNING.RNG and request that your OS "
4288         echo "vendor includes kernel-based random number collection in "
4289         echo "future versions of your OS."
4290         echo ""
4291 fi
4292
4293 if test ! -z "$NO_PEERCHECK" ; then
4294         echo "WARNING: the operating system that you are using does not"
4295         echo "appear to support getpeereid(), getpeerucred() or the"
4296         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
4297         echo "enforce security checks to prevent unauthorised connections to"
4298         echo "ssh-agent. Their absence increases the risk that a malicious"
4299         echo "user can connect to your agent."
4300         echo ""
4301 fi
4302
4303 if test "$AUDIT_MODULE" = "bsm" ; then
4304         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4305         echo "See the Solaris section in README.platform for details."
4306 fi