configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_CONFIG_SRCDIR([ssh.c])
  19
  20 AC_CONFIG_HEADER(config.h)
  21 AC_PROG_CC
  22 AC_CANONICAL_HOST
  23 AC_C_BIGENDIAN
  24
  25 # Checks for programs.
  26 AC_PROG_AWK
  27 AC_PROG_CPP
  28 AC_PROG_RANLIB
  29 AC_PROG_INSTALL
  30 AC_PATH_PROG(AR, ar)
  31 AC_PATH_PROG(CAT, cat)
  32 AC_PATH_PROG(KILL, kill)
  33 AC_PATH_PROGS(PERL, perl5 perl)
  34 AC_PATH_PROG(SED, sed)
  35 AC_SUBST(PERL)
  36 AC_PATH_PROG(ENT, ent)
  37 AC_SUBST(ENT)
  38 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  39 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  41 AC_PATH_PROG(SH, sh)
  42 AC_SUBST(TEST_SHELL,sh)
  43
  44 dnl for buildpkg.sh
  45 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  46         [/usr/sbin${PATH_SEPARATOR}/etc])
  47 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  50
  51 # System features
  52 AC_SYS_LARGEFILE
  53
  54 if test -z "$AR" ; then
  55         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  56 fi
  57
  58 # Use LOGIN_PROGRAM from environment if possible
  59 if test ! -z "$LOGIN_PROGRAM" ; then
  60         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  61                 [If your header files don't define LOGIN_PROGRAM,
  62                 then use this (detected) from environment and PATH])
  63 else
  64         # Search for login
  65         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  66         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  67                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  68         fi
  69 fi
  70
  71 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  72 if test ! -z "$PATH_PASSWD_PROG" ; then
  73         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  74                 [Full path of your "passwd" program])
  75 fi
  76
  77 if test -z "$LD" ; then
  78         LD=$CC
  79 fi
  80 AC_SUBST(LD)
  81
  82 AC_C_INLINE
  83
  84 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  85
  86 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
  87         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
  88         GCC_VER=`$CC -v 2>&1 | awk '/gcc version /{print $3}'`
  89         case $GCC_VER in
  90                 1.*) ;;
  91                 2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
  92                 2.*) ;;
  93                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
  94                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
  95                 *) ;;
  96         esac
  97
  98         if test -z "$have_llong_max"; then
  99                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 100                 unset ac_cv_have_decl_LLONG_MAX
 101                 saved_CFLAGS="$CFLAGS"
 102                 CFLAGS="$CFLAGS -std=gnu99"
 103                 AC_CHECK_DECL(LLONG_MAX,
 104                     [have_llong_max=1],
 105                     [CFLAGS="$saved_CFLAGS"],
 106                     [#include <limits.h>]
 107                 )
 108         fi
 109 fi
 110
 111 AC_ARG_WITH(rpath,
 112         [  --without-rpath         Disable auto-added -R linker paths],
 113         [
 114                 if test "x$withval" = "xno" ; then
 115                         need_dash_r=""
 116                 fi
 117                 if test "x$withval" = "xyes" ; then
 118                         need_dash_r=1
 119                 fi
 120         ]
 121 )
 122
 123 # Check for some target-specific stuff
 124 case "$host" in
 125 *-*-aix*)
 126         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 127         if (test -z "$blibpath"); then
 128                 blibpath="/usr/lib:/lib"
 129         fi
 130         saved_LDFLAGS="$LDFLAGS"
 131         for tryflags in -blibpath: -Wl,-blibpath: -Wl,-rpath, ;do
 132                 if (test -z "$blibflags"); then
 133                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 134                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 135                 fi
 136         done
 137         if (test -z "$blibflags"); then
 138                 AC_MSG_RESULT(not found)
 139                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 140         else
 141                 AC_MSG_RESULT($blibflags)
 142         fi
 143         LDFLAGS="$saved_LDFLAGS"
 144         dnl Check for authenticate.  Might be in libs.a on older AIXes
 145         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 146                 [Define if you want to enable AIX4's authenticate function])],
 147                 [AC_CHECK_LIB(s,authenticate,
 148                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 149                                 LIBS="$LIBS -ls"
 150                         ])
 151                 ])
 152         dnl Check for various auth function declarations in headers.
 153         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 154             passwdexpired, setauthdb], , , [#include <usersec.h>])
 155         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 156         AC_CHECK_DECLS(loginfailed,
 157                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 158                   AC_TRY_COMPILE(
 159                         [#include <usersec.h>],
 160                         [(void)loginfailed("user","host","tty",0);],
 161                         [AC_MSG_RESULT(yes)
 162                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 163                                 [Define if your AIX loginfailed() function
 164                                 takes 4 arguments (AIX >= 5.2)])],
 165                         [AC_MSG_RESULT(no)]
 166                 )],
 167                 [],
 168                 [#include <usersec.h>]
 169         )
 170         AC_CHECK_FUNCS(setauthdb)
 171         check_for_aix_broken_getaddrinfo=1
 172         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 173         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 174             [Define if your platform breaks doing a seteuid before a setuid])
 175         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 176         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 177         dnl AIX handles lastlog as part of its login message
 178         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 179         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 180                 [Some systems need a utmpx entry for /bin/login to work])
 181         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 182                 [Define to a Set Process Title type if your system is
 183                 supported by bsd-setproctitle.c])
 184         ;;
 185 *-*-cygwin*)
 186         check_for_libcrypt_later=1
 187         LIBS="$LIBS /usr/lib/textmode.o"
 188         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 189         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 190         AC_DEFINE(DISABLE_SHADOW, 1,
 191                 [Define if you want to disable shadow passwords])
 192         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 193                 [Define if your system choked on IP TOS setting])
 194         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 195                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 196         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 197                 [Define if the concept of ports only accessible to
 198                 superusers isn't known])
 199         AC_DEFINE(DISABLE_FD_PASSING, 1,
 200                 [Define if your platform needs to skip post auth
 201                 file descriptor passing])
 202         ;;
 203 *-*-dgux*)
 204         AC_DEFINE(IP_TOS_IS_BROKEN)
 205         AC_DEFINE(SETEUID_BREAKS_SETUID)
 206         AC_DEFINE(BROKEN_SETREUID)
 207         AC_DEFINE(BROKEN_SETREGID)
 208         ;;
 209 *-*-darwin*)
 210         AC_MSG_CHECKING(if we have working getaddrinfo)
 211         AC_TRY_RUN([#include <mach-o/dyld.h>
 212 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 213                 exit(0);
 214         else
 215                 exit(1);
 216 }], [AC_MSG_RESULT(working)],
 217         [AC_MSG_RESULT(buggy)
 218         AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
 219         [AC_MSG_RESULT(assume it is working)])
 220         AC_DEFINE(SETEUID_BREAKS_SETUID)
 221         AC_DEFINE(BROKEN_SETREUID)
 222         AC_DEFINE(BROKEN_SETREGID)
 223         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 224                 [Define if your resolver libs need this for getrrsetbyname])
 225         ;;
 226 *-*-hpux*)
 227         # first we define all of the options common to all HP-UX releases
 228         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 229         IPADDR_IN_DISPLAY=yes
 230         AC_DEFINE(USE_PIPES)
 231         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 232             [Define if your login program cannot handle end of options ("--")])
 233         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 234         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 235                 [String used in /etc/passwd to denote locked account])
 236         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 237         MAIL="/var/mail/username"
 238         LIBS="$LIBS -lsec"
 239         AC_CHECK_LIB(xnet, t_error, ,
 240             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 241
 242         # next, we define all of the options specific to major releases
 243         case "$host" in
 244         *-*-hpux10*)
 245                 if test -z "$GCC"; then
 246                         CFLAGS="$CFLAGS -Ae"
 247                 fi
 248                 ;;
 249         *-*-hpux11*)
 250                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 251                         [Define if you are using Solaris-derived PAM which
 252                         passes pam_messages to the conversation function
 253                         with an extra level of indirection])
 254                 AC_DEFINE(DISABLE_UTMP, 1,
 255                         [Define if you don't want to use utmp])
 256                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 257                 check_for_hpux_broken_getaddrinfo=1
 258                 check_for_conflicting_getspnam=1
 259                 ;;
 260         esac
 261
 262         # lastly, we define options specific to minor releases
 263         case "$host" in
 264         *-*-hpux10.26)
 265                 AC_DEFINE(HAVE_SECUREWARE, 1,
 266                         [Define if you have SecureWare-based
 267                         protected password database])
 268                 disable_ptmx_check=yes
 269                 LIBS="$LIBS -lsecpw"
 270                 ;;
 271         esac
 272         ;;
 273 *-*-irix5*)
 274         PATH="$PATH:/usr/etc"
 275         AC_DEFINE(BROKEN_INET_NTOA, 1,
 276                 [Define if you system's inet_ntoa is busted
 277                 (e.g. Irix gcc issue)])
 278         AC_DEFINE(SETEUID_BREAKS_SETUID)
 279         AC_DEFINE(BROKEN_SETREUID)
 280         AC_DEFINE(BROKEN_SETREGID)
 281         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 282                 [Define if you shouldn't strip 'tty' from your
 283                 ttyname in [uw]tmp])
 284         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 285         ;;
 286 *-*-irix6*)
 287         PATH="$PATH:/usr/etc"
 288         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 289                 [Define if you have/want arrays
 290                 (cluster-wide session managment, not C arrays)])
 291         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 292                 [Define if you want IRIX project management])
 293         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 294                 [Define if you want IRIX audit trails])
 295         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 296                 [Define if you want IRIX kernel jobs])])
 297         AC_DEFINE(BROKEN_INET_NTOA)
 298         AC_DEFINE(SETEUID_BREAKS_SETUID)
 299         AC_DEFINE(BROKEN_SETREUID)
 300         AC_DEFINE(BROKEN_SETREGID)
 301         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 302         AC_DEFINE(WITH_ABBREV_NO_TTY)
 303         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 304         ;;
 305 *-*-linux*)
 306         no_dev_ptmx=1
 307         check_for_libcrypt_later=1
 308         check_for_openpty_ctty_bug=1
 309         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 310         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 311                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 312         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 313                 [String used in /etc/passwd to denote locked account])
 314         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 315         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 316                 [Define to whatever link() returns for "not supported"
 317                 if it doesn't return EOPNOTSUPP.])
 318         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 319         AC_DEFINE(USE_BTMP)
 320         inet6_default_4in6=yes
 321         case `uname -r` in
 322         1.*|2.0.*)
 323                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 324                         [Define if cmsg_type is not passed correctly])
 325                 ;;
 326         esac
 327         ;;
 328 mips-sony-bsd|mips-sony-newsos4)
 329         AC_DEFINE(NEED_SETPRGP, 1, [Need setpgrp to acquire controlling tty])
 330         SONY=1
 331         ;;
 332 *-*-netbsd*)
 333         check_for_libcrypt_before=1
 334         if test "x$withval" != "xno" ; then
 335                 need_dash_r=1
 336         fi
 337         ;;
 338 *-*-freebsd*)
 339         check_for_libcrypt_later=1
 340         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 341         ;;
 342 *-*-bsdi*)
 343         AC_DEFINE(SETEUID_BREAKS_SETUID)
 344         AC_DEFINE(BROKEN_SETREUID)
 345         AC_DEFINE(BROKEN_SETREGID)
 346         ;;
 347 *-next-*)
 348         conf_lastlog_location="/usr/adm/lastlog"
 349         conf_utmp_location=/etc/utmp
 350         conf_wtmp_location=/usr/adm/wtmp
 351         MAIL=/usr/spool/mail
 352         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 353         AC_DEFINE(BROKEN_REALPATH)
 354         AC_DEFINE(USE_PIPES)
 355         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 356         ;;
 357 *-*-openbsd*)
 358         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 359         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 360         ;;
 361 *-*-solaris*)
 362         if test "x$withval" != "xno" ; then
 363                 need_dash_r=1
 364         fi
 365         AC_DEFINE(PAM_SUN_CODEBASE)
 366         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 367         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 368                 [Some versions of /bin/login need the TERM supplied
 369                 on the commandline])
 370         AC_DEFINE(PAM_TTY_KLUDGE)
 371         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 372                 [Define if pam_chauthtok wants real uid set
 373                 to the unpriv'ed user])
 374         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 375         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 376         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 377                 [Define if sshd somehow reacquires a controlling TTY
 378                 after setsid()])
 379         external_path_file=/etc/default/login
 380         # hardwire lastlog location (can't detect it on some versions)
 381         conf_lastlog_location="/var/adm/lastlog"
 382         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 383         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 384         if test "$sol2ver" -ge 8; then
 385                 AC_MSG_RESULT(yes)
 386                 AC_DEFINE(DISABLE_UTMP)
 387                 AC_DEFINE(DISABLE_WTMP, 1,
 388                         [Define if you don't want to use wtmp])
 389         else
 390                 AC_MSG_RESULT(no)
 391         fi
 392         ;;
 393 *-*-sunos4*)
 394         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 395         AC_CHECK_FUNCS(getpwanam)
 396         AC_DEFINE(PAM_SUN_CODEBASE)
 397         conf_utmp_location=/etc/utmp
 398         conf_wtmp_location=/var/adm/wtmp
 399         conf_lastlog_location=/var/adm/lastlog
 400         AC_DEFINE(USE_PIPES)
 401         ;;
 402 *-ncr-sysv*)
 403         LIBS="$LIBS -lc89"
 404         AC_DEFINE(USE_PIPES)
 405         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 406         AC_DEFINE(SETEUID_BREAKS_SETUID)
 407         AC_DEFINE(BROKEN_SETREUID)
 408         AC_DEFINE(BROKEN_SETREGID)
 409         ;;
 410 *-sni-sysv*)
 411         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 412         AC_CHECK_LIB(dl, dlsym, ,)
 413         # -lresolv needs to be at then end of LIBS or DNS lookups break
 414         AC_CHECK_LIB(res_query, resolv, [ LIBS="$LIBS -lresolv" ])
 415         IPADDR_IN_DISPLAY=yes
 416         AC_DEFINE(USE_PIPES)
 417         AC_DEFINE(IP_TOS_IS_BROKEN)
 418         AC_DEFINE(SETEUID_BREAKS_SETUID)
 419         AC_DEFINE(BROKEN_SETREUID)
 420         AC_DEFINE(BROKEN_SETREGID)
 421         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 422         external_path_file=/etc/default/login
 423         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 424         # Attention: always take care to bind libsocket and libnsl before libc,
 425         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 426         ;;
 427 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 428 *-*-sysv4.2*)
 429         AC_DEFINE(USE_PIPES)
 430         AC_DEFINE(SETEUID_BREAKS_SETUID)
 431         AC_DEFINE(BROKEN_SETREUID)
 432         AC_DEFINE(BROKEN_SETREGID)
 433         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 434         ;;
 435 # UnixWare 7.x, OpenUNIX 8
 436 *-*-sysv5*)
 437         check_for_libcrypt_later=1
 438         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 439         AC_DEFINE(USE_PIPES)
 440         AC_DEFINE(SETEUID_BREAKS_SETUID)
 441         AC_DEFINE(BROKEN_SETREUID)
 442         AC_DEFINE(BROKEN_SETREGID)
 443         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 444         case "$host" in
 445         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 446                 TEST_SHELL=/u95/bin/sh
 447                 AC_DEFINE(BROKEN_LIBIAF, 1,
 448                         [ia_uinfo routines not supported by OS yet])
 449                 ;;
 450         esac
 451         ;;
 452 *-*-sysv*)
 453         ;;
 454 # SCO UNIX and OEM versions of SCO UNIX
 455 *-*-sco3.2v4*)
 456         AC_MSG_ERROR("This Platform is no longer supported.")
 457         ;;
 458 # SCO OpenServer 5.x
 459 *-*-sco3.2v5*)
 460         if test -z "$GCC"; then
 461                 CFLAGS="$CFLAGS -belf"
 462         fi
 463         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 464         no_dev_ptmx=1
 465         AC_DEFINE(USE_PIPES)
 466         AC_DEFINE(HAVE_SECUREWARE)
 467         AC_DEFINE(DISABLE_SHADOW)
 468         AC_DEFINE(DISABLE_FD_PASSING)
 469         AC_DEFINE(SETEUID_BREAKS_SETUID)
 470         AC_DEFINE(BROKEN_SETREUID)
 471         AC_DEFINE(BROKEN_SETREGID)
 472         AC_DEFINE(WITH_ABBREV_NO_TTY)
 473         AC_DEFINE(BROKEN_UPDWTMPX)
 474         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 475         AC_CHECK_FUNCS(getluid setluid)
 476         MANTYPE=man
 477         TEST_SHELL=ksh
 478         ;;
 479 *-*-unicosmk*)
 480         AC_DEFINE(NO_SSH_LASTLOG, 1,
 481                 [Define if you don't want to use lastlog in session.c])
 482         AC_DEFINE(SETEUID_BREAKS_SETUID)
 483         AC_DEFINE(BROKEN_SETREUID)
 484         AC_DEFINE(BROKEN_SETREGID)
 485         AC_DEFINE(USE_PIPES)
 486         AC_DEFINE(DISABLE_FD_PASSING)
 487         LDFLAGS="$LDFLAGS"
 488         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 489         MANTYPE=cat
 490         ;;
 491 *-*-unicosmp*)
 492         AC_DEFINE(SETEUID_BREAKS_SETUID)
 493         AC_DEFINE(BROKEN_SETREUID)
 494         AC_DEFINE(BROKEN_SETREGID)
 495         AC_DEFINE(WITH_ABBREV_NO_TTY)
 496         AC_DEFINE(USE_PIPES)
 497         AC_DEFINE(DISABLE_FD_PASSING)
 498         LDFLAGS="$LDFLAGS"
 499         LIBS="$LIBS -lgen -lacid -ldb"
 500         MANTYPE=cat
 501         ;;
 502 *-*-unicos*)
 503         AC_DEFINE(SETEUID_BREAKS_SETUID)
 504         AC_DEFINE(BROKEN_SETREUID)
 505         AC_DEFINE(BROKEN_SETREGID)
 506         AC_DEFINE(USE_PIPES)
 507         AC_DEFINE(DISABLE_FD_PASSING)
 508         AC_DEFINE(NO_SSH_LASTLOG)
 509         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 510         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 511         MANTYPE=cat
 512         ;;
 513 *-dec-osf*)
 514         AC_MSG_CHECKING(for Digital Unix SIA)
 515         no_osfsia=""
 516         AC_ARG_WITH(osfsia,
 517                 [  --with-osfsia           Enable Digital Unix SIA],
 518                 [
 519                         if test "x$withval" = "xno" ; then
 520                                 AC_MSG_RESULT(disabled)
 521                                 no_osfsia=1
 522                         fi
 523                 ],
 524         )
 525         if test -z "$no_osfsia" ; then
 526                 if test -f /etc/sia/matrix.conf; then
 527                         AC_MSG_RESULT(yes)
 528                         AC_DEFINE(HAVE_OSF_SIA, 1,
 529                                 [Define if you have Digital Unix Security
 530                                 Integration Architecture])
 531                         AC_DEFINE(DISABLE_LOGIN, 1,
 532                                 [Define if you don't want to use your
 533                                 system's login() call])
 534                         AC_DEFINE(DISABLE_FD_PASSING)
 535                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 536                 else
 537                         AC_MSG_RESULT(no)
 538                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 539                           [String used in /etc/passwd to denote locked account])
 540                 fi
 541         fi
 542         AC_DEFINE(BROKEN_GETADDRINFO)
 543         AC_DEFINE(SETEUID_BREAKS_SETUID)
 544         AC_DEFINE(BROKEN_SETREUID)
 545         AC_DEFINE(BROKEN_SETREGID)
 546         ;;
 547
 548 *-*-nto-qnx)
 549         AC_DEFINE(USE_PIPES)
 550         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 551         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 552         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 553         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 554         ;;
 555
 556 *-*-ultrix*)
 557         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 558         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 559         AC_DEFINE(NEED_SETPRGP)
 560         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 561         ;;
 562
 563 *-*-lynxos)
 564         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 565         AC_DEFINE(MISSING_HOWMANY)
 566         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 567         ;;
 568 esac
 569
 570 # Allow user to specify flags
 571 AC_ARG_WITH(cflags,
 572         [  --with-cflags           Specify additional flags to pass to compiler],
 573         [
 574                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 575                     test "x${withval}" != "xyes"; then
 576                         CFLAGS="$CFLAGS $withval"
 577                 fi
 578         ]
 579 )
 580 AC_ARG_WITH(cppflags,
 581         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 582         [
 583                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 584                     test "x${withval}" != "xyes"; then
 585                         CPPFLAGS="$CPPFLAGS $withval"
 586                 fi
 587         ]
 588 )
 589 AC_ARG_WITH(ldflags,
 590         [  --with-ldflags          Specify additional flags to pass to linker],
 591         [
 592                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 593                     test "x${withval}" != "xyes"; then
 594                         LDFLAGS="$LDFLAGS $withval"
 595                 fi
 596         ]
 597 )
 598 AC_ARG_WITH(libs,
 599         [  --with-libs             Specify additional libraries to link with],
 600         [
 601                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 602                     test "x${withval}" != "xyes"; then
 603                         LIBS="$LIBS $withval"
 604                 fi
 605         ]
 606 )
 607 AC_ARG_WITH(Werror,
 608         [  --with-Werror           Build main code with -Werror],
 609         [
 610                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 611                         werror_flags="-Werror"
 612                         if test "x${withval}" != "xyes"; then
 613                                 werror_flags="$withval"
 614                         fi
 615                 fi
 616         ]
 617 )
 618
 619 AC_MSG_CHECKING(compiler and flags for sanity)
 620 AC_RUN_IFELSE(
 621         [AC_LANG_SOURCE([
 622 #include <stdio.h>
 623 int main(){exit(0);}
 624         ])],
 625         [       AC_MSG_RESULT(yes) ],
 626         [
 627                 AC_MSG_RESULT(no)
 628                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 629         ],
 630         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 631 )
 632
 633 dnl Checks for header files.
 634 AC_CHECK_HEADERS( \
 635         bstring.h \
 636         crypt.h \
 637         dirent.h \
 638         endian.h \
 639         features.h \
 640         floatingpoint.h \
 641         getopt.h \
 642         glob.h \
 643         ia.h \
 644         iaf.h \
 645         lastlog.h \
 646         limits.h \
 647         login.h \
 648         login_cap.h \
 649         maillock.h \
 650         ndir.h \
 651         netdb.h \
 652         netgroup.h \
 653         netinet/in_systm.h \
 654         pam/pam_appl.h \
 655         paths.h \
 656         pty.h \
 657         readpassphrase.h \
 658         rpc/types.h \
 659         security/pam_appl.h \
 660         shadow.h \
 661         stddef.h \
 662         stdint.h \
 663         string.h \
 664         strings.h \
 665         sys/audit.h \
 666         sys/bitypes.h \
 667         sys/bsdtty.h \
 668         sys/cdefs.h \
 669         sys/dir.h \
 670         sys/mman.h \
 671         sys/ndir.h \
 672         sys/prctl.h \
 673         sys/pstat.h \
 674         sys/select.h \
 675         sys/stat.h \
 676         sys/stream.h \
 677         sys/stropts.h \
 678         sys/strtio.h \
 679         sys/sysmacros.h \
 680         sys/time.h \
 681         sys/timers.h \
 682         sys/un.h \
 683         time.h \
 684         tmpdir.h \
 685         ttyent.h \
 686         unistd.h \
 687         usersec.h \
 688         util.h \
 689         utime.h \
 690         utmp.h \
 691         utmpx.h \
 692         vis.h \
 693 )
 694
 695 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 696 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 697 #ifdef HAVE_SYS_STREAM_H
 698 # include <sys/stream.h>
 699 #endif
 700 ])
 701
 702 # Checks for libraries.
 703 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 704 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 705
 706 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 707 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 708         AC_CHECK_LIB(gen, dirname,[
 709                 AC_CACHE_CHECK([for broken dirname],
 710                         ac_cv_have_broken_dirname, [
 711                         save_LIBS="$LIBS"
 712                         LIBS="$LIBS -lgen"
 713                         AC_RUN_IFELSE(
 714                                 [AC_LANG_SOURCE([[
 715 #include <libgen.h>
 716 #include <string.h>
 717
 718 int main(int argc, char **argv) {
 719     char *s, buf[32];
 720
 721     strncpy(buf,"/etc", 32);
 722     s = dirname(buf);
 723     if (!s || strncmp(s, "/", 32) != 0) {
 724         exit(1);
 725     } else {
 726         exit(0);
 727     }
 728 }
 729                                 ]])],
 730                                 [ ac_cv_have_broken_dirname="no" ],
 731                                 [ ac_cv_have_broken_dirname="yes" ],
 732                                 [ ac_cv_have_broken_dirname="no" ],
 733                         )
 734                         LIBS="$save_LIBS"
 735                 ])
 736                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 737                         LIBS="$LIBS -lgen"
 738                         AC_DEFINE(HAVE_DIRNAME)
 739                         AC_CHECK_HEADERS(libgen.h)
 740                 fi
 741         ])
 742 ])
 743
 744 AC_CHECK_FUNC(getspnam, ,
 745         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 746 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 747         [Define if you have the basename function.]))
 748
 749 dnl zlib is required
 750 AC_ARG_WITH(zlib,
 751         [  --with-zlib=PATH        Use zlib in PATH],
 752         [ if test "x$withval" = "xno" ; then
 753                 AC_MSG_ERROR([*** zlib is required ***])
 754           elif test "x$withval" != "xyes"; then
 755                 if test -d "$withval/lib"; then
 756                         if test -n "${need_dash_r}"; then
 757                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 758                         else
 759                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 760                         fi
 761                 else
 762                         if test -n "${need_dash_r}"; then
 763                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 764                         else
 765                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 766                         fi
 767                 fi
 768                 if test -d "$withval/include"; then
 769                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 770                 else
 771                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 772                 fi
 773         fi ]
 774 )
 775
 776 AC_CHECK_LIB(z, deflate, ,
 777         [
 778                 saved_CPPFLAGS="$CPPFLAGS"
 779                 saved_LDFLAGS="$LDFLAGS"
 780                 save_LIBS="$LIBS"
 781                 dnl Check default zlib install dir
 782                 if test -n "${need_dash_r}"; then
 783                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 784                 else
 785                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 786                 fi
 787                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 788                 LIBS="$LIBS -lz"
 789                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 790                         [
 791                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
 792                         ]
 793                 )
 794         ]
 795 )
 796 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 797
 798 AC_ARG_WITH(zlib-version-check,
 799         [  --without-zlib-version-check Disable zlib version check],
 800         [  if test "x$withval" = "xno" ; then
 801                 zlib_check_nonfatal=1
 802            fi
 803         ]
 804 )
 805
 806 AC_MSG_CHECKING(for possibly buggy zlib)
 807 AC_RUN_IFELSE([AC_LANG_SOURCE([[
 808 #include <stdio.h>
 809 #include <zlib.h>
 810 int main()
 811 {
 812         int a=0, b=0, c=0, d=0, n, v;
 813         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
 814         if (n != 3 && n != 4)
 815                 exit(1);
 816         v = a*1000000 + b*10000 + c*100 + d;
 817         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
 818
 819         /* 1.1.4 is OK */
 820         if (a == 1 && b == 1 && c >= 4)
 821                 exit(0);
 822
 823         /* 1.2.3 and up are OK */
 824         if (v >= 1020300)
 825                 exit(0);
 826
 827         exit(2);
 828 }
 829         ]])],
 830         AC_MSG_RESULT(no),
 831         [ AC_MSG_RESULT(yes)
 832           if test -z "$zlib_check_nonfatal" ; then
 833                 AC_MSG_ERROR([*** zlib too old - check config.log ***
 834 Your reported zlib version has known security problems.  It's possible your
 835 vendor has fixed these problems without changing the version number.  If you
 836 are sure this is the case, you can disable the check by running
 837 "./configure --without-zlib-version-check".
 838 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
 839 See http://www.gzip.org/zlib/ for details.])
 840           else
 841                 AC_MSG_WARN([zlib version may have security problems])
 842           fi
 843         ],
 844         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
 845 )
 846
 847 dnl UnixWare 2.x
 848 AC_CHECK_FUNC(strcasecmp,
 849         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
 850 )
 851 AC_CHECK_FUNC(utimes,
 852         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
 853                                         LIBS="$LIBS -lc89"]) ]
 854 )
 855
 856 dnl    Checks for libutil functions
 857 AC_CHECK_HEADERS(libutil.h)
 858 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
 859         [Define if your libraries define login()])])
 860 AC_CHECK_FUNCS(logout updwtmp logwtmp)
 861
 862 AC_FUNC_STRFTIME
 863
 864 # Check for ALTDIRFUNC glob() extension
 865 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
 866 AC_EGREP_CPP(FOUNDIT,
 867         [
 868                 #include <glob.h>
 869                 #ifdef GLOB_ALTDIRFUNC
 870                 FOUNDIT
 871                 #endif
 872         ],
 873         [
 874                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
 875                         [Define if your system glob() function has
 876                         the GLOB_ALTDIRFUNC extension])
 877                 AC_MSG_RESULT(yes)
 878         ],
 879         [
 880                 AC_MSG_RESULT(no)
 881         ]
 882 )
 883
 884 # Check for g.gl_matchc glob() extension
 885 AC_MSG_CHECKING(for gl_matchc field in glob_t)
 886 AC_EGREP_CPP(FOUNDIT,
 887         [
 888                 #include <glob.h>
 889                 int main(void){glob_t g; g.gl_matchc = 1;}
 890         ],
 891         [
 892                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
 893                         [Define if your system glob() function has
 894                         gl_matchc options in glob_t])
 895                 AC_MSG_RESULT(yes)
 896         ],
 897         [
 898                 AC_MSG_RESULT(no)
 899         ]
 900 )
 901
 902 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
 903 AC_RUN_IFELSE(
 904         [AC_LANG_SOURCE([[
 905 #include <sys/types.h>
 906 #include <dirent.h>
 907 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
 908         ]])],
 909         [AC_MSG_RESULT(yes)],
 910         [
 911                 AC_MSG_RESULT(no)
 912                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
 913                         [Define in your struct dirent expects you to
 914                         allocate extra space for d_name])
 915         ],
 916         [
 917                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
 918                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
 919         ]
 920 )
 921
 922 AC_MSG_CHECKING([for /proc/pid/fd directory])
 923 if test -d "/proc/$$/fd" ; then
 924         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
 925         AC_MSG_RESULT(yes)
 926 else
 927         AC_MSG_RESULT(no)
 928 fi
 929
 930 # Check whether user wants S/Key support
 931 SKEY_MSG="no"
 932 AC_ARG_WITH(skey,
 933         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
 934         [
 935                 if test "x$withval" != "xno" ; then
 936
 937                         if test "x$withval" != "xyes" ; then
 938                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
 939                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
 940                         fi
 941
 942                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
 943                         LIBS="-lskey $LIBS"
 944                         SKEY_MSG="yes"
 945
 946                         AC_MSG_CHECKING([for s/key support])
 947                         AC_LINK_IFELSE(
 948                                 [AC_LANG_SOURCE([[
 949 #include <stdio.h>
 950 #include <skey.h>
 951 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
 952                                 ]])],
 953                                 [AC_MSG_RESULT(yes)],
 954                                 [
 955                                         AC_MSG_RESULT(no)
 956                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
 957                                 ])
 958                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
 959                         AC_TRY_COMPILE(
 960                                 [#include <stdio.h>
 961                                  #include <skey.h>],
 962                                 [(void)skeychallenge(NULL,"name","",0);],
 963                                 [AC_MSG_RESULT(yes)
 964                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
 965                                         [Define if your skeychallenge()
 966                                         function takes 4 arguments (NetBSD)])],
 967                                 [AC_MSG_RESULT(no)]
 968                         )
 969                 fi
 970         ]
 971 )
 972
 973 # Check whether user wants TCP wrappers support
 974 TCPW_MSG="no"
 975 AC_ARG_WITH(tcp-wrappers,
 976         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
 977         [
 978                 if test "x$withval" != "xno" ; then
 979                         saved_LIBS="$LIBS"
 980                         saved_LDFLAGS="$LDFLAGS"
 981                         saved_CPPFLAGS="$CPPFLAGS"
 982                         if test -n "${withval}" && \
 983                             test "x${withval}" != "xyes"; then
 984                                 if test -d "${withval}/lib"; then
 985                                         if test -n "${need_dash_r}"; then
 986                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 987                                         else
 988                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 989                                         fi
 990                                 else
 991                                         if test -n "${need_dash_r}"; then
 992                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 993                                         else
 994                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 995                                         fi
 996                                 fi
 997                                 if test -d "${withval}/include"; then
 998                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 999                                 else
1000                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1001                                 fi
1002                         fi
1003                         LIBWRAP="-lwrap"
1004                         LIBS="$LIBWRAP $LIBS"
1005                         AC_MSG_CHECKING(for libwrap)
1006                         AC_TRY_LINK(
1007                                 [
1008 #include <sys/types.h>
1009 #include <sys/socket.h>
1010 #include <netinet/in.h>
1011 #include <tcpd.h>
1012                                         int deny_severity = 0, allow_severity = 0;
1013                                 ],
1014                                 [hosts_access(0);],
1015                                 [
1016                                         AC_MSG_RESULT(yes)
1017                                         AC_DEFINE(LIBWRAP, 1,
1018                                                 [Define if you want
1019                                                 TCP Wrappers support])
1020                                         AC_SUBST(LIBWRAP)
1021                                         TCPW_MSG="yes"
1022                                 ],
1023                                 [
1024                                         AC_MSG_ERROR([*** libwrap missing])
1025                                 ]
1026                         )
1027                         LIBS="$saved_LIBS"
1028                 fi
1029         ]
1030 )
1031
1032 # Check whether user wants libedit support
1033 LIBEDIT_MSG="no"
1034 AC_ARG_WITH(libedit,
1035         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1036         [ if test "x$withval" != "xno" ; then
1037                 if test "x$withval" != "xyes"; then
1038                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1039                         if test -n "${need_dash_r}"; then
1040                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1041                         else
1042                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1043                         fi
1044                 fi
1045                 AC_CHECK_LIB(edit, el_init,
1046                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1047                           LIBEDIT="-ledit -lcurses"
1048                           LIBEDIT_MSG="yes"
1049                           AC_SUBST(LIBEDIT)
1050                         ],
1051                         [ AC_MSG_ERROR(libedit not found) ],
1052                         [ -lcurses ]
1053                 )
1054                 AC_MSG_CHECKING(if libedit version is compatible)
1055                 AC_COMPILE_IFELSE(
1056                     [AC_LANG_SOURCE([[
1057 #include <histedit.h>
1058 int main(void)
1059 {
1060         int i = H_SETSIZE;
1061         el_init("", NULL, NULL, NULL);
1062         exit(0);
1063 }
1064                     ]])],
1065                     [ AC_MSG_RESULT(yes) ],
1066                     [ AC_MSG_RESULT(no)
1067                       AC_MSG_ERROR(libedit version is not compatible) ]
1068                 )
1069         fi ]
1070 )
1071
1072 AUDIT_MODULE=none
1073 AC_ARG_WITH(audit,
1074         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1075         [
1076           AC_MSG_CHECKING(for supported audit module)
1077           case "$withval" in
1078           bsm)
1079                 AC_MSG_RESULT(bsm)
1080                 AUDIT_MODULE=bsm
1081                 dnl    Checks for headers, libs and functions
1082                 AC_CHECK_HEADERS(bsm/audit.h, [],
1083                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)])
1084                 AC_CHECK_LIB(bsm, getaudit, [],
1085                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1086                 AC_CHECK_FUNCS(getaudit, [],
1087                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1088                 # These are optional
1089                 AC_CHECK_FUNCS(getaudit_addr)
1090                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1091                 ;;
1092           debug)
1093                 AUDIT_MODULE=debug
1094                 AC_MSG_RESULT(debug)
1095                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1096                 ;;
1097           no)
1098                 AC_MSG_RESULT(no)
1099                 ;;
1100           *)
1101                 AC_MSG_ERROR([Unknown audit module $withval])
1102                 ;;
1103         esac ]
1104 )
1105
1106 dnl    Checks for library functions. Please keep in alphabetical order
1107 AC_CHECK_FUNCS( \
1108         arc4random \
1109         b64_ntop \
1110         __b64_ntop \
1111         b64_pton \
1112         __b64_pton \
1113         bcopy \
1114         bindresvport_sa \
1115         clock \
1116         closefrom \
1117         dirfd \
1118         fchmod \
1119         fchown \
1120         freeaddrinfo \
1121         futimes \
1122         getaddrinfo \
1123         getcwd \
1124         getgrouplist \
1125         getnameinfo \
1126         getopt \
1127         getpeereid \
1128         _getpty \
1129         getrlimit \
1130         getttyent \
1131         glob \
1132         inet_aton \
1133         inet_ntoa \
1134         inet_ntop \
1135         innetgr \
1136         login_getcapbool \
1137         md5_crypt \
1138         memmove \
1139         mkdtemp \
1140         mmap \
1141         ngetaddrinfo \
1142         nsleep \
1143         ogetaddrinfo \
1144         openlog_r \
1145         openpty \
1146         prctl \
1147         pstat \
1148         readpassphrase \
1149         realpath \
1150         recvmsg \
1151         rresvport_af \
1152         sendmsg \
1153         setdtablesize \
1154         setegid \
1155         setenv \
1156         seteuid \
1157         setgroups \
1158         setlogin \
1159         setpcred \
1160         setproctitle \
1161         setregid \
1162         setreuid \
1163         setrlimit \
1164         setsid \
1165         setvbuf \
1166         sigaction \
1167         sigvec \
1168         snprintf \
1169         socketpair \
1170         strdup \
1171         strerror \
1172         strlcat \
1173         strlcpy \
1174         strmode \
1175         strnvis \
1176         strtonum \
1177         strtoll \
1178         strtoul \
1179         sysconf \
1180         tcgetpgrp \
1181         truncate \
1182         unsetenv \
1183         updwtmpx \
1184         utimes \
1185         vhangup \
1186         vsnprintf \
1187         waitpid \
1188 )
1189
1190 # IRIX has a const char return value for gai_strerror()
1191 AC_CHECK_FUNCS(gai_strerror,[
1192         AC_DEFINE(HAVE_GAI_STRERROR)
1193         AC_TRY_COMPILE([
1194 #include <sys/types.h>
1195 #include <sys/socket.h>
1196 #include <netdb.h>
1197
1198 const char *gai_strerror(int);],[
1199 char *str;
1200
1201 str = gai_strerror(0);],[
1202                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1203                 [Define if gai_strerror() returns const char *])])])
1204
1205 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1206         [Some systems put nanosleep outside of libc]))
1207
1208 dnl Make sure prototypes are defined for these before using them.
1209 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1210 AC_CHECK_DECL(strsep,
1211         [AC_CHECK_FUNCS(strsep)],
1212         [],
1213         [
1214 #ifdef HAVE_STRING_H
1215 # include <string.h>
1216 #endif
1217         ])
1218
1219 dnl tcsendbreak might be a macro
1220 AC_CHECK_DECL(tcsendbreak,
1221         [AC_DEFINE(HAVE_TCSENDBREAK)],
1222         [AC_CHECK_FUNCS(tcsendbreak)],
1223         [#include <termios.h>]
1224 )
1225
1226 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1227
1228 AC_CHECK_FUNCS(setresuid, [
1229         dnl Some platorms have setresuid that isn't implemented, test for this
1230         AC_MSG_CHECKING(if setresuid seems to work)
1231         AC_RUN_IFELSE(
1232                 [AC_LANG_SOURCE([[
1233 #include <stdlib.h>
1234 #include <errno.h>
1235 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1236                 ]])],
1237                 [AC_MSG_RESULT(yes)],
1238                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1239                         [Define if your setresuid() is broken])
1240                  AC_MSG_RESULT(not implemented)],
1241                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1242         )
1243 ])
1244
1245 AC_CHECK_FUNCS(setresgid, [
1246         dnl Some platorms have setresgid that isn't implemented, test for this
1247         AC_MSG_CHECKING(if setresgid seems to work)
1248         AC_RUN_IFELSE(
1249                 [AC_LANG_SOURCE([[
1250 #include <stdlib.h>
1251 #include <errno.h>
1252 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1253                 ]])],
1254                 [AC_MSG_RESULT(yes)],
1255                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1256                         [Define if your setresgid() is broken])
1257                  AC_MSG_RESULT(not implemented)],
1258                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1259         )
1260 ])
1261
1262 dnl    Checks for time functions
1263 AC_CHECK_FUNCS(gettimeofday time)
1264 dnl    Checks for utmp functions
1265 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1266 AC_CHECK_FUNCS(utmpname)
1267 dnl    Checks for utmpx functions
1268 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1269 AC_CHECK_FUNCS(setutxent utmpxname)
1270
1271 AC_CHECK_FUNC(daemon,
1272         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1273         [AC_CHECK_LIB(bsd, daemon,
1274                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1275 )
1276
1277 AC_CHECK_FUNC(getpagesize,
1278         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1279                 [Define if your libraries define getpagesize()])],
1280         [AC_CHECK_LIB(ucb, getpagesize,
1281                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1282 )
1283
1284 # Check for broken snprintf
1285 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1286         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1287         AC_RUN_IFELSE(
1288                 [AC_LANG_SOURCE([[
1289 #include <stdio.h>
1290 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1291                 ]])],
1292                 [AC_MSG_RESULT(yes)],
1293                 [
1294                         AC_MSG_RESULT(no)
1295                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1296                                 [Define if your snprintf is busted])
1297                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1298                 ],
1299                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1300         )
1301 fi
1302
1303 # Check for missing getpeereid (or equiv) support
1304 NO_PEERCHECK=""
1305 if test "x$ac_cv_func_getpeereid" != "xyes" ; then
1306         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1307         AC_TRY_COMPILE(
1308                 [#include <sys/types.h>
1309                  #include <sys/socket.h>],
1310                 [int i = SO_PEERCRED;],
1311                 [ AC_MSG_RESULT(yes)
1312                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1313                 ],
1314                 [AC_MSG_RESULT(no)
1315                 NO_PEERCHECK=1]
1316         )
1317 fi
1318
1319 dnl see whether mkstemp() requires XXXXXX
1320 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1321 AC_MSG_CHECKING([for (overly) strict mkstemp])
1322 AC_RUN_IFELSE(
1323         [AC_LANG_SOURCE([[
1324 #include <stdlib.h>
1325 main() { char template[]="conftest.mkstemp-test";
1326 if (mkstemp(template) == -1)
1327         exit(1);
1328 unlink(template); exit(0);
1329 }
1330         ]])],
1331         [
1332                 AC_MSG_RESULT(no)
1333         ],
1334         [
1335                 AC_MSG_RESULT(yes)
1336                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1337         ],
1338         [
1339                 AC_MSG_RESULT(yes)
1340                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1341         ]
1342 )
1343 fi
1344
1345 dnl make sure that openpty does not reacquire controlling terminal
1346 if test ! -z "$check_for_openpty_ctty_bug"; then
1347         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1348         AC_RUN_IFELSE(
1349                 [AC_LANG_SOURCE([[
1350 #include <stdio.h>
1351 #include <sys/fcntl.h>
1352 #include <sys/types.h>
1353 #include <sys/wait.h>
1354
1355 int
1356 main()
1357 {
1358         pid_t pid;
1359         int fd, ptyfd, ttyfd, status;
1360
1361         pid = fork();
1362         if (pid < 0) {          /* failed */
1363                 exit(1);
1364         } else if (pid > 0) {   /* parent */
1365                 waitpid(pid, &status, 0);
1366                 if (WIFEXITED(status))
1367                         exit(WEXITSTATUS(status));
1368                 else
1369                         exit(2);
1370         } else {                /* child */
1371                 close(0); close(1); close(2);
1372                 setsid();
1373                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1374                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1375                 if (fd >= 0)
1376                         exit(3);        /* Acquired ctty: broken */
1377                 else
1378                         exit(0);        /* Did not acquire ctty: OK */
1379         }
1380 }
1381                 ]])],
1382                 [
1383                         AC_MSG_RESULT(yes)
1384                 ],
1385                 [
1386                         AC_MSG_RESULT(no)
1387                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1388                 ],
1389                 [
1390                         AC_MSG_RESULT(cross-compiling, assuming yes)
1391                 ]
1392         )
1393 fi
1394
1395 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1396     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1397         AC_MSG_CHECKING(if getaddrinfo seems to work)
1398         AC_RUN_IFELSE(
1399                 [AC_LANG_SOURCE([[
1400 #include <stdio.h>
1401 #include <sys/socket.h>
1402 #include <netdb.h>
1403 #include <errno.h>
1404 #include <netinet/in.h>
1405
1406 #define TEST_PORT "2222"
1407
1408 int
1409 main(void)
1410 {
1411         int err, sock;
1412         struct addrinfo *gai_ai, *ai, hints;
1413         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1414
1415         memset(&hints, 0, sizeof(hints));
1416         hints.ai_family = PF_UNSPEC;
1417         hints.ai_socktype = SOCK_STREAM;
1418         hints.ai_flags = AI_PASSIVE;
1419
1420         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1421         if (err != 0) {
1422                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1423                 exit(1);
1424         }
1425
1426         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1427                 if (ai->ai_family != AF_INET6)
1428                         continue;
1429
1430                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1431                     sizeof(ntop), strport, sizeof(strport),
1432                     NI_NUMERICHOST|NI_NUMERICSERV);
1433
1434                 if (err != 0) {
1435                         if (err == EAI_SYSTEM)
1436                                 perror("getnameinfo EAI_SYSTEM");
1437                         else
1438                                 fprintf(stderr, "getnameinfo failed: %s\n",
1439                                     gai_strerror(err));
1440                         exit(2);
1441                 }
1442
1443                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1444                 if (sock < 0)
1445                         perror("socket");
1446                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1447                         if (errno == EBADF)
1448                                 exit(3);
1449                 }
1450         }
1451         exit(0);
1452 }
1453                 ]])],
1454                 [
1455                         AC_MSG_RESULT(yes)
1456                 ],
1457                 [
1458                         AC_MSG_RESULT(no)
1459                         AC_DEFINE(BROKEN_GETADDRINFO)
1460                 ],
1461                 [
1462                         AC_MSG_RESULT(cross-compiling, assuming yes)
1463                 ]
1464         )
1465 fi
1466
1467 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1468     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1469         AC_MSG_CHECKING(if getaddrinfo seems to work)
1470         AC_RUN_IFELSE(
1471                 [AC_LANG_SOURCE([[
1472 #include <stdio.h>
1473 #include <sys/socket.h>
1474 #include <netdb.h>
1475 #include <errno.h>
1476 #include <netinet/in.h>
1477
1478 #define TEST_PORT "2222"
1479
1480 int
1481 main(void)
1482 {
1483         int err, sock;
1484         struct addrinfo *gai_ai, *ai, hints;
1485         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1486
1487         memset(&hints, 0, sizeof(hints));
1488         hints.ai_family = PF_UNSPEC;
1489         hints.ai_socktype = SOCK_STREAM;
1490         hints.ai_flags = AI_PASSIVE;
1491
1492         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1493         if (err != 0) {
1494                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1495                 exit(1);
1496         }
1497
1498         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1499                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1500                         continue;
1501
1502                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1503                     sizeof(ntop), strport, sizeof(strport),
1504                     NI_NUMERICHOST|NI_NUMERICSERV);
1505
1506                 if (ai->ai_family == AF_INET && err != 0) {
1507                         perror("getnameinfo");
1508                         exit(2);
1509                 }
1510         }
1511         exit(0);
1512 }
1513                 ]])],
1514                 [
1515                         AC_MSG_RESULT(yes)
1516                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1517                                 [Define if you have a getaddrinfo that fails
1518                                 for the all-zeros IPv6 address])
1519                 ],
1520                 [
1521                         AC_MSG_RESULT(no)
1522                         AC_DEFINE(BROKEN_GETADDRINFO)
1523                 ],
1524                         AC_MSG_RESULT(cross-compiling, assuming no)
1525                 ]
1526         )
1527 fi
1528
1529 if test "x$check_for_conflicting_getspnam" = "x1"; then
1530         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1531         AC_COMPILE_IFELSE(
1532                 [
1533 #include <shadow.h>
1534 int main(void) {exit(0);}
1535                 ],
1536                 [
1537                         AC_MSG_RESULT(no)
1538                 ],
1539                 [
1540                         AC_MSG_RESULT(yes)
1541                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1542                             [Conflicting defs for getspnam])
1543                 ]
1544         )
1545 fi
1546
1547 AC_FUNC_GETPGRP
1548
1549 # Check for PAM libs
1550 PAM_MSG="no"
1551 AC_ARG_WITH(pam,
1552         [  --with-pam              Enable PAM support ],
1553         [
1554                 if test "x$withval" != "xno" ; then
1555                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
1556                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
1557                                 AC_MSG_ERROR([PAM headers not found])
1558                         fi
1559
1560                         AC_CHECK_LIB(dl, dlopen, , )
1561                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
1562                         AC_CHECK_FUNCS(pam_getenvlist)
1563                         AC_CHECK_FUNCS(pam_putenv)
1564
1565                         PAM_MSG="yes"
1566
1567                         AC_DEFINE(USE_PAM, 1,
1568                                 [Define if you want to enable PAM support])
1569                         if test $ac_cv_lib_dl_dlopen = yes; then
1570                                 LIBPAM="-lpam -ldl"
1571                         else
1572                                 LIBPAM="-lpam"
1573                         fi
1574                         AC_SUBST(LIBPAM)
1575                 fi
1576         ]
1577 )
1578
1579 # Check for older PAM
1580 if test "x$PAM_MSG" = "xyes" ; then
1581         # Check PAM strerror arguments (old PAM)
1582         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
1583         AC_TRY_COMPILE(
1584                 [
1585 #include <stdlib.h>
1586 #if defined(HAVE_SECURITY_PAM_APPL_H)
1587 #include <security/pam_appl.h>
1588 #elif defined (HAVE_PAM_PAM_APPL_H)
1589 #include <pam/pam_appl.h>
1590 #endif
1591                 ],
1592                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
1593                 [AC_MSG_RESULT(no)],
1594                 [
1595                         AC_DEFINE(HAVE_OLD_PAM, 1,
1596                                 [Define if you have an old version of PAM
1597                                 which takes only one argument to pam_strerror])
1598                         AC_MSG_RESULT(yes)
1599                         PAM_MSG="yes (old library)"
1600                 ]
1601         )
1602 fi
1603
1604 # Search for OpenSSL
1605 saved_CPPFLAGS="$CPPFLAGS"
1606 saved_LDFLAGS="$LDFLAGS"
1607 AC_ARG_WITH(ssl-dir,
1608         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1609         [
1610                 if test "x$withval" != "xno" ; then
1611                         case "$withval" in
1612                                 # Relative paths
1613                                 ./*|../*)       withval="`pwd`/$withval"
1614                         esac
1615                         if test -d "$withval/lib"; then
1616                                 if test -n "${need_dash_r}"; then
1617                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1618                                 else
1619                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1620                                 fi
1621                         else
1622                                 if test -n "${need_dash_r}"; then
1623                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1624                                 else
1625                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1626                                 fi
1627                         fi
1628                         if test -d "$withval/include"; then
1629                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1630                         else
1631                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1632                         fi
1633                 fi
1634         ]
1635 )
1636 LIBS="-lcrypto $LIBS"
1637 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1638         [Define if your ssl headers are included
1639         with #include <openssl/header.h>]),
1640         [
1641                 dnl Check default openssl install dir
1642                 if test -n "${need_dash_r}"; then
1643                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1644                 else
1645                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1646                 fi
1647                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1648                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1649                         [
1650                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
1651                         ]
1652                 )
1653         ]
1654 )
1655
1656 # Determine OpenSSL header version
1657 AC_MSG_CHECKING([OpenSSL header version])
1658 AC_RUN_IFELSE(
1659         [AC_LANG_SOURCE([[
1660 #include <stdio.h>
1661 #include <string.h>
1662 #include <openssl/opensslv.h>
1663 #define DATA "conftest.sslincver"
1664 int main(void) {
1665         FILE *fd;
1666         int rc;
1667
1668         fd = fopen(DATA,"w");
1669         if(fd == NULL)
1670                 exit(1);
1671
1672         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
1673                 exit(1);
1674
1675         exit(0);
1676 }
1677         ]])],
1678         [
1679                 ssl_header_ver=`cat conftest.sslincver`
1680                 AC_MSG_RESULT($ssl_header_ver)
1681         ],
1682         [
1683                 AC_MSG_RESULT(not found)
1684                 AC_MSG_ERROR(OpenSSL version header not found.)
1685         ],
1686         [
1687                 AC_MSG_WARN([cross compiling: not checking])
1688         ]
1689 )
1690
1691 # Determine OpenSSL library version
1692 AC_MSG_CHECKING([OpenSSL library version])
1693 AC_RUN_IFELSE(
1694         [AC_LANG_SOURCE([[
1695 #include <stdio.h>
1696 #include <string.h>
1697 #include <openssl/opensslv.h>
1698 #include <openssl/crypto.h>
1699 #define DATA "conftest.ssllibver"
1700 int main(void) {
1701         FILE *fd;
1702         int rc;
1703
1704         fd = fopen(DATA,"w");
1705         if(fd == NULL)
1706                 exit(1);
1707
1708         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
1709                 exit(1);
1710
1711         exit(0);
1712 }
1713         ]])],
1714         [
1715                 ssl_library_ver=`cat conftest.ssllibver`
1716                 AC_MSG_RESULT($ssl_library_ver)
1717         ],
1718         [
1719                 AC_MSG_RESULT(not found)
1720                 AC_MSG_ERROR(OpenSSL library not found.)
1721         ],
1722         [
1723                 AC_MSG_WARN([cross compiling: not checking])
1724         ]
1725 )
1726
1727 # Sanity check OpenSSL headers
1728 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
1729 AC_RUN_IFELSE(
1730         [AC_LANG_SOURCE([[
1731 #include <string.h>
1732 #include <openssl/opensslv.h>
1733 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
1734         ]])],
1735         [
1736                 AC_MSG_RESULT(yes)
1737         ],
1738         [
1739                 AC_MSG_RESULT(no)
1740                 AC_MSG_ERROR([Your OpenSSL headers do not match your library.
1741 Check config.log for details.
1742 Also see contrib/findssl.sh for help identifying header/library mismatches.])
1743         ],
1744         [
1745                 AC_MSG_WARN([cross compiling: not checking])
1746         ]
1747 )
1748
1749 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
1750 # because the system crypt() is more featureful.
1751 if test "x$check_for_libcrypt_before" = "x1"; then
1752         AC_CHECK_LIB(crypt, crypt)
1753 fi
1754
1755 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
1756 # version in OpenSSL.
1757 if test "x$check_for_libcrypt_later" = "x1"; then
1758         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
1759 fi
1760
1761 AC_CHECK_LIB(iaf, ia_openinfo)
1762
1763 ### Configure cryptographic random number support
1764
1765 # Check wheter OpenSSL seeds itself
1766 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
1767 AC_RUN_IFELSE(
1768         [AC_LANG_SOURCE([[
1769 #include <string.h>
1770 #include <openssl/rand.h>
1771 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
1772         ]])],
1773         [
1774                 OPENSSL_SEEDS_ITSELF=yes
1775                 AC_MSG_RESULT(yes)
1776         ],
1777         [
1778                 AC_MSG_RESULT(no)
1779                 # Default to use of the rand helper if OpenSSL doesn't
1780                 # seed itself
1781                 USE_RAND_HELPER=yes
1782         ],
1783         [
1784                 AC_MSG_WARN([cross compiling: assuming yes])
1785                 # This is safe, since all recent OpenSSL versions will
1786                 # complain at runtime if not seeded correctly.
1787                 OPENSSL_SEEDS_ITSELF=yes
1788         ]
1789 )
1790
1791
1792 # Do we want to force the use of the rand helper?
1793 AC_ARG_WITH(rand-helper,
1794         [  --with-rand-helper      Use subprocess to gather strong randomness ],
1795         [
1796                 if test "x$withval" = "xno" ; then
1797                         # Force use of OpenSSL's internal RNG, even if
1798                         # the previous test showed it to be unseeded.
1799                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
1800                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
1801                                 OPENSSL_SEEDS_ITSELF=yes
1802                                 USE_RAND_HELPER=""
1803                         fi
1804                 else
1805                         USE_RAND_HELPER=yes
1806                 fi
1807         ],
1808 )
1809
1810 # Which randomness source do we use?
1811 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
1812         # OpenSSL only
1813         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
1814                 [Define if you want OpenSSL's internally seeded PRNG only])
1815         RAND_MSG="OpenSSL internal ONLY"
1816         INSTALL_SSH_RAND_HELPER=""
1817 elif test ! -z "$USE_RAND_HELPER" ; then
1818         # install rand helper
1819         RAND_MSG="ssh-rand-helper"
1820         INSTALL_SSH_RAND_HELPER="yes"
1821 fi
1822 AC_SUBST(INSTALL_SSH_RAND_HELPER)
1823
1824 ### Configuration of ssh-rand-helper
1825
1826 # PRNGD TCP socket
1827 AC_ARG_WITH(prngd-port,
1828         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
1829         [
1830                 case "$withval" in
1831                 no)
1832                         withval=""
1833                         ;;
1834                 [[0-9]]*)
1835                         ;;
1836                 *)
1837                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
1838                         ;;
1839                 esac
1840                 if test ! -z "$withval" ; then
1841                         PRNGD_PORT="$withval"
1842                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
1843                                 [Port number of PRNGD/EGD random number socket])
1844                 fi
1845         ]
1846 )
1847
1848 # PRNGD Unix domain socket
1849 AC_ARG_WITH(prngd-socket,
1850         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
1851         [
1852                 case "$withval" in
1853                 yes)
1854                         withval="/var/run/egd-pool"
1855                         ;;
1856                 no)
1857                         withval=""
1858                         ;;
1859                 /*)
1860                         ;;
1861                 *)
1862                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
1863                         ;;
1864                 esac
1865
1866                 if test ! -z "$withval" ; then
1867                         if test ! -z "$PRNGD_PORT" ; then
1868                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
1869                         fi
1870                         if test ! -r "$withval" ; then
1871                                 AC_MSG_WARN(Entropy socket is not readable)
1872                         fi
1873                         PRNGD_SOCKET="$withval"
1874                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
1875                                 [Location of PRNGD/EGD random number socket])
1876                 fi
1877         ],
1878         [
1879                 # Check for existing socket only if we don't have a random device already
1880                 if test "$USE_RAND_HELPER" = yes ; then
1881                         AC_MSG_CHECKING(for PRNGD/EGD socket)
1882                         # Insert other locations here
1883                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
1884                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
1885                                         PRNGD_SOCKET="$sock"
1886                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
1887                                         break;
1888                                 fi
1889                         done
1890                         if test ! -z "$PRNGD_SOCKET" ; then
1891                                 AC_MSG_RESULT($PRNGD_SOCKET)
1892                         else
1893                                 AC_MSG_RESULT(not found)
1894                         fi
1895                 fi
1896         ]
1897 )
1898
1899 # Change default command timeout for hashing entropy source
1900 entropy_timeout=200
1901 AC_ARG_WITH(entropy-timeout,
1902         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
1903         [
1904                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
1905                     test "x${withval}" != "xyes"; then
1906                         entropy_timeout=$withval
1907                 fi
1908         ]
1909 )
1910 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
1911         [Builtin PRNG command timeout])
1912
1913 SSH_PRIVSEP_USER=sshd
1914 AC_ARG_WITH(privsep-user,
1915         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
1916         [
1917                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
1918                     test "x${withval}" != "xyes"; then
1919                         SSH_PRIVSEP_USER=$withval
1920                 fi
1921         ]
1922 )
1923 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
1924         [non-privileged user for privilege separation])
1925 AC_SUBST(SSH_PRIVSEP_USER)
1926
1927 # We do this little dance with the search path to insure
1928 # that programs that we select for use by installed programs
1929 # (which may be run by the super-user) come from trusted
1930 # locations before they come from the user's private area.
1931 # This should help avoid accidentally configuring some
1932 # random version of a program in someone's personal bin.
1933
1934 OPATH=$PATH
1935 PATH=/bin:/usr/bin
1936 test -h /bin 2> /dev/null && PATH=/usr/bin
1937 test -d /sbin && PATH=$PATH:/sbin
1938 test -d /usr/sbin && PATH=$PATH:/usr/sbin
1939 PATH=$PATH:/etc:$OPATH
1940
1941 # These programs are used by the command hashing source to gather entropy
1942 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
1943 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
1944 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
1945 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
1946 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
1947 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
1948 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
1949 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
1950 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
1951 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
1952 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
1953 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
1954 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
1955 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
1956 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
1957 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
1958 # restore PATH
1959 PATH=$OPATH
1960
1961 # Where does ssh-rand-helper get its randomness from?
1962 INSTALL_SSH_PRNG_CMDS=""
1963 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
1964         if test ! -z "$PRNGD_PORT" ; then
1965                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
1966         elif test ! -z "$PRNGD_SOCKET" ; then
1967                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
1968         else
1969                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
1970                 RAND_HELPER_CMDHASH=yes
1971                 INSTALL_SSH_PRNG_CMDS="yes"
1972         fi
1973 fi
1974 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
1975
1976
1977 # Cheap hack to ensure NEWS-OS libraries are arranged right.
1978 if test ! -z "$SONY" ; then
1979   LIBS="$LIBS -liberty";
1980 fi
1981
1982 # Checks for data types
1983 AC_CHECK_SIZEOF(char, 1)
1984 AC_CHECK_SIZEOF(short int, 2)
1985 AC_CHECK_SIZEOF(int, 4)
1986 AC_CHECK_SIZEOF(long int, 4)
1987 AC_CHECK_SIZEOF(long long int, 8)
1988
1989 # Sanity check long long for some platforms (AIX)
1990 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
1991         ac_cv_sizeof_long_long_int=0
1992 fi
1993
1994 # compute LLONG_MIN and LLONG_MAX if we don't know them.
1995 if test -z "$have_llong_max"; then
1996         AC_MSG_CHECKING([for max value of long long])
1997         AC_RUN_IFELSE(
1998                 [AC_LANG_SOURCE([[
1999 #include <stdio.h>
2000 /* Why is this so damn hard? */
2001 #ifdef __GNUC__
2002 # undef __GNUC__
2003 #endif
2004 #define __USE_ISOC99
2005 #include <limits.h>
2006 #define DATA "conftest.llminmax"
2007 int main(void) {
2008         FILE *f;
2009         long long i, llmin, llmax = 0;
2010
2011         if((f = fopen(DATA,"w")) == NULL)
2012                 exit(1);
2013
2014 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2015         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2016         llmin = LLONG_MIN;
2017         llmax = LLONG_MAX;
2018 #else
2019         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2020         /* This will work on one's complement and two's complement */
2021         for (i = 1; i > llmax; i <<= 1, i++)
2022                 llmax = i;
2023         llmin = llmax + 1LL;    /* wrap */
2024 #endif
2025
2026         /* Sanity check */
2027         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2028             || llmax - 1 > llmax) {
2029                 fprintf(f, "unknown unknown\n");
2030                 exit(2);
2031         }
2032
2033         if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
2034                 exit(3);
2035
2036         exit(0);
2037 }
2038                 ]])],
2039                 [
2040                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2041                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2042
2043                         # snprintf on some Tru64s doesn't understand "%lld"
2044                         case "$host" in
2045                         alpha-dec-osf*)
2046                                 if test "x$ac_cv_sizeof_long_long_int" = "x8" &&
2047                                   test "x$llong_max" = "xld"; then
2048                                         llong_min="-9223372036854775808"
2049                                         llong_max="9223372036854775807"
2050                                 fi
2051                                 ;;
2052                         esac
2053
2054                         AC_MSG_RESULT($llong_max)
2055                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2056                             [max value of long long calculated by configure])
2057                         AC_MSG_CHECKING([for min value of long long])
2058                         AC_MSG_RESULT($llong_min)
2059                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2060                             [min value of long long calculated by configure])
2061                 ],
2062                 [
2063                         AC_MSG_RESULT(not found)
2064                 ],
2065                 [
2066                         AC_MSG_WARN([cross compiling: not checking])
2067                 ]
2068         )
2069 fi
2070
2071
2072 # More checks for data types
2073 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2074         AC_TRY_COMPILE(
2075                 [ #include <sys/types.h> ],
2076                 [ u_int a; a = 1;],
2077                 [ ac_cv_have_u_int="yes" ],
2078                 [ ac_cv_have_u_int="no" ]
2079         )
2080 ])
2081 if test "x$ac_cv_have_u_int" = "xyes" ; then
2082         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2083         have_u_int=1
2084 fi
2085
2086 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2087         AC_TRY_COMPILE(
2088                 [ #include <sys/types.h> ],
2089                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2090                 [ ac_cv_have_intxx_t="yes" ],
2091                 [ ac_cv_have_intxx_t="no" ]
2092         )
2093 ])
2094 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2095         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2096         have_intxx_t=1
2097 fi
2098
2099 if (test -z "$have_intxx_t" && \
2100            test "x$ac_cv_header_stdint_h" = "xyes")
2101 then
2102     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2103         AC_TRY_COMPILE(
2104                 [ #include <stdint.h> ],
2105                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2106                 [
2107                         AC_DEFINE(HAVE_INTXX_T)
2108                         AC_MSG_RESULT(yes)
2109                 ],
2110                 [ AC_MSG_RESULT(no) ]
2111         )
2112 fi
2113
2114 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2115         AC_TRY_COMPILE(
2116                 [
2117 #include <sys/types.h>
2118 #ifdef HAVE_STDINT_H
2119 # include <stdint.h>
2120 #endif
2121 #include <sys/socket.h>
2122 #ifdef HAVE_SYS_BITYPES_H
2123 # include <sys/bitypes.h>
2124 #endif
2125                 ],
2126                 [ int64_t a; a = 1;],
2127                 [ ac_cv_have_int64_t="yes" ],
2128                 [ ac_cv_have_int64_t="no" ]
2129         )
2130 ])
2131 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2132         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2133 fi
2134
2135 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2136         AC_TRY_COMPILE(
2137                 [ #include <sys/types.h> ],
2138                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2139                 [ ac_cv_have_u_intxx_t="yes" ],
2140                 [ ac_cv_have_u_intxx_t="no" ]
2141         )
2142 ])
2143 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2144         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2145         have_u_intxx_t=1
2146 fi
2147
2148 if test -z "$have_u_intxx_t" ; then
2149     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2150         AC_TRY_COMPILE(
2151                 [ #include <sys/socket.h> ],
2152                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2153                 [
2154                         AC_DEFINE(HAVE_U_INTXX_T)
2155                         AC_MSG_RESULT(yes)
2156                 ],
2157                 [ AC_MSG_RESULT(no) ]
2158         )
2159 fi
2160
2161 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2162         AC_TRY_COMPILE(
2163                 [ #include <sys/types.h> ],
2164                 [ u_int64_t a; a = 1;],
2165                 [ ac_cv_have_u_int64_t="yes" ],
2166                 [ ac_cv_have_u_int64_t="no" ]
2167         )
2168 ])
2169 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2170         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2171         have_u_int64_t=1
2172 fi
2173
2174 if test -z "$have_u_int64_t" ; then
2175     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2176         AC_TRY_COMPILE(
2177                 [ #include <sys/bitypes.h> ],
2178                 [ u_int64_t a; a = 1],
2179                 [
2180                         AC_DEFINE(HAVE_U_INT64_T)
2181                         AC_MSG_RESULT(yes)
2182                 ],
2183                 [ AC_MSG_RESULT(no) ]
2184         )
2185 fi
2186
2187 if test -z "$have_u_intxx_t" ; then
2188         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2189                 AC_TRY_COMPILE(
2190                         [
2191 #include <sys/types.h>
2192                         ],
2193                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2194                         [ ac_cv_have_uintxx_t="yes" ],
2195                         [ ac_cv_have_uintxx_t="no" ]
2196                 )
2197         ])
2198         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2199                 AC_DEFINE(HAVE_UINTXX_T, 1,
2200                         [define if you have uintxx_t data type])
2201         fi
2202 fi
2203
2204 if test -z "$have_uintxx_t" ; then
2205     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2206         AC_TRY_COMPILE(
2207                 [ #include <stdint.h> ],
2208                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2209                 [
2210                         AC_DEFINE(HAVE_UINTXX_T)
2211                         AC_MSG_RESULT(yes)
2212                 ],
2213                 [ AC_MSG_RESULT(no) ]
2214         )
2215 fi
2216
2217 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2218            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2219 then
2220         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2221         AC_TRY_COMPILE(
2222                 [
2223 #include <sys/bitypes.h>
2224                 ],
2225                 [
2226                         int8_t a; int16_t b; int32_t c;
2227                         u_int8_t e; u_int16_t f; u_int32_t g;
2228                         a = b = c = e = f = g = 1;
2229                 ],
2230                 [
2231                         AC_DEFINE(HAVE_U_INTXX_T)
2232                         AC_DEFINE(HAVE_INTXX_T)
2233                         AC_MSG_RESULT(yes)
2234                 ],
2235                 [AC_MSG_RESULT(no)]
2236         )
2237 fi
2238
2239
2240 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2241         AC_TRY_COMPILE(
2242                 [
2243 #include <sys/types.h>
2244                 ],
2245                 [ u_char foo; foo = 125; ],
2246                 [ ac_cv_have_u_char="yes" ],
2247                 [ ac_cv_have_u_char="no" ]
2248         )
2249 ])
2250 if test "x$ac_cv_have_u_char" = "xyes" ; then
2251         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2252 fi
2253
2254 TYPE_SOCKLEN_T
2255
2256 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2257
2258 AC_CHECK_TYPES(in_addr_t,,,
2259 [#include <sys/types.h>
2260 #include <netinet/in.h>])
2261
2262 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2263         AC_TRY_COMPILE(
2264                 [
2265 #include <sys/types.h>
2266                 ],
2267                 [ size_t foo; foo = 1235; ],
2268                 [ ac_cv_have_size_t="yes" ],
2269                 [ ac_cv_have_size_t="no" ]
2270         )
2271 ])
2272 if test "x$ac_cv_have_size_t" = "xyes" ; then
2273         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2274 fi
2275
2276 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2277         AC_TRY_COMPILE(
2278                 [
2279 #include <sys/types.h>
2280                 ],
2281                 [ ssize_t foo; foo = 1235; ],
2282                 [ ac_cv_have_ssize_t="yes" ],
2283                 [ ac_cv_have_ssize_t="no" ]
2284         )
2285 ])
2286 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2287         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2288 fi
2289
2290 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2291         AC_TRY_COMPILE(
2292                 [
2293 #include <time.h>
2294                 ],
2295                 [ clock_t foo; foo = 1235; ],
2296                 [ ac_cv_have_clock_t="yes" ],
2297                 [ ac_cv_have_clock_t="no" ]
2298         )
2299 ])
2300 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2301         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2302 fi
2303
2304 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2305         AC_TRY_COMPILE(
2306                 [
2307 #include <sys/types.h>
2308 #include <sys/socket.h>
2309                 ],
2310                 [ sa_family_t foo; foo = 1235; ],
2311                 [ ac_cv_have_sa_family_t="yes" ],
2312                 [ AC_TRY_COMPILE(
2313                   [
2314 #include <sys/types.h>
2315 #include <sys/socket.h>
2316 #include <netinet/in.h>
2317                 ],
2318                 [ sa_family_t foo; foo = 1235; ],
2319                 [ ac_cv_have_sa_family_t="yes" ],
2320
2321                 [ ac_cv_have_sa_family_t="no" ]
2322         )]
2323         )
2324 ])
2325 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2326         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2327                 [define if you have sa_family_t data type])
2328 fi
2329
2330 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2331         AC_TRY_COMPILE(
2332                 [
2333 #include <sys/types.h>
2334                 ],
2335                 [ pid_t foo; foo = 1235; ],
2336                 [ ac_cv_have_pid_t="yes" ],
2337                 [ ac_cv_have_pid_t="no" ]
2338         )
2339 ])
2340 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2341         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2342 fi
2343
2344 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2345         AC_TRY_COMPILE(
2346                 [
2347 #include <sys/types.h>
2348                 ],
2349                 [ mode_t foo; foo = 1235; ],
2350                 [ ac_cv_have_mode_t="yes" ],
2351                 [ ac_cv_have_mode_t="no" ]
2352         )
2353 ])
2354 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2355         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2356 fi
2357
2358
2359 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2360         AC_TRY_COMPILE(
2361                 [
2362 #include <sys/types.h>
2363 #include <sys/socket.h>
2364                 ],
2365                 [ struct sockaddr_storage s; ],
2366                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2367                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2368         )
2369 ])
2370 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2371         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2372                 [define if you have struct sockaddr_storage data type])
2373 fi
2374
2375 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2376         AC_TRY_COMPILE(
2377                 [
2378 #include <sys/types.h>
2379 #include <netinet/in.h>
2380                 ],
2381                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2382                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2383                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2384         )
2385 ])
2386 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2387         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2388                 [define if you have struct sockaddr_in6 data type])
2389 fi
2390
2391 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2392         AC_TRY_COMPILE(
2393                 [
2394 #include <sys/types.h>
2395 #include <netinet/in.h>
2396                 ],
2397                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2398                 [ ac_cv_have_struct_in6_addr="yes" ],
2399                 [ ac_cv_have_struct_in6_addr="no" ]
2400         )
2401 ])
2402 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2403         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2404                 [define if you have struct in6_addr data type])
2405 fi
2406
2407 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2408         AC_TRY_COMPILE(
2409                 [
2410 #include <sys/types.h>
2411 #include <sys/socket.h>
2412 #include <netdb.h>
2413                 ],
2414                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2415                 [ ac_cv_have_struct_addrinfo="yes" ],
2416                 [ ac_cv_have_struct_addrinfo="no" ]
2417         )
2418 ])
2419 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2420         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2421                 [define if you have struct addrinfo data type])
2422 fi
2423
2424 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2425         AC_TRY_COMPILE(
2426                 [ #include <sys/time.h> ],
2427                 [ struct timeval tv; tv.tv_sec = 1;],
2428                 [ ac_cv_have_struct_timeval="yes" ],
2429                 [ ac_cv_have_struct_timeval="no" ]
2430         )
2431 ])
2432 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2433         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2434         have_struct_timeval=1
2435 fi
2436
2437 AC_CHECK_TYPES(struct timespec)
2438
2439 # We need int64_t or else certian parts of the compile will fail.
2440 if test "x$ac_cv_have_int64_t" = "xno" && \
2441         test "x$ac_cv_sizeof_long_int" != "x8" && \
2442         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2443         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2444         echo "an alternative compiler (I.E., GCC) before continuing."
2445         echo ""
2446         exit 1;
2447 else
2448 dnl test snprintf (broken on SCO w/gcc)
2449         AC_RUN_IFELSE(
2450                 [AC_LANG_SOURCE([[
2451 #include <stdio.h>
2452 #include <string.h>
2453 #ifdef HAVE_SNPRINTF
2454 main()
2455 {
2456         char buf[50];
2457         char expected_out[50];
2458         int mazsize = 50 ;
2459 #if (SIZEOF_LONG_INT == 8)
2460         long int num = 0x7fffffffffffffff;
2461 #else
2462         long long num = 0x7fffffffffffffffll;
2463 #endif
2464         strcpy(expected_out, "9223372036854775807");
2465         snprintf(buf, mazsize, "%lld", num);
2466         if(strcmp(buf, expected_out) != 0)
2467                 exit(1);
2468         exit(0);
2469 }
2470 #else
2471 main() { exit(0); }
2472 #endif
2473                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
2474                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
2475         )
2476 fi
2477
2478 dnl Checks for structure members
2479 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
2480 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
2481 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
2482 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
2483 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
2484 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
2485 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
2486 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
2487 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
2488 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
2489 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
2490 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
2491 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
2492 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
2493 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
2494 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
2495 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
2496
2497 AC_CHECK_MEMBERS([struct stat.st_blksize])
2498
2499 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
2500                 ac_cv_have_ss_family_in_struct_ss, [
2501         AC_TRY_COMPILE(
2502                 [
2503 #include <sys/types.h>
2504 #include <sys/socket.h>
2505                 ],
2506                 [ struct sockaddr_storage s; s.ss_family = 1; ],
2507                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
2508                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
2509         )
2510 ])
2511 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
2512         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
2513 fi
2514
2515 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
2516                 ac_cv_have___ss_family_in_struct_ss, [
2517         AC_TRY_COMPILE(
2518                 [
2519 #include <sys/types.h>
2520 #include <sys/socket.h>
2521                 ],
2522                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
2523                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
2524                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
2525         )
2526 ])
2527 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
2528         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
2529                 [Fields in struct sockaddr_storage])
2530 fi
2531
2532 AC_CACHE_CHECK([for pw_class field in struct passwd],
2533                 ac_cv_have_pw_class_in_struct_passwd, [
2534         AC_TRY_COMPILE(
2535                 [
2536 #include <pwd.h>
2537                 ],
2538                 [ struct passwd p; p.pw_class = 0; ],
2539                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
2540                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
2541         )
2542 ])
2543 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
2544         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
2545                 [Define if your password has a pw_class field])
2546 fi
2547
2548 AC_CACHE_CHECK([for pw_expire field in struct passwd],
2549                 ac_cv_have_pw_expire_in_struct_passwd, [
2550         AC_TRY_COMPILE(
2551                 [
2552 #include <pwd.h>
2553                 ],
2554                 [ struct passwd p; p.pw_expire = 0; ],
2555                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
2556                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
2557         )
2558 ])
2559 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
2560         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
2561                 [Define if your password has a pw_expire field])
2562 fi
2563
2564 AC_CACHE_CHECK([for pw_change field in struct passwd],
2565                 ac_cv_have_pw_change_in_struct_passwd, [
2566         AC_TRY_COMPILE(
2567                 [
2568 #include <pwd.h>
2569                 ],
2570                 [ struct passwd p; p.pw_change = 0; ],
2571                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
2572                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
2573         )
2574 ])
2575 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
2576         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
2577                 [Define if your password has a pw_change field])
2578 fi
2579
2580 dnl make sure we're using the real structure members and not defines
2581 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
2582                 ac_cv_have_accrights_in_msghdr, [
2583         AC_COMPILE_IFELSE(
2584                 [
2585 #include <sys/types.h>
2586 #include <sys/socket.h>
2587 #include <sys/uio.h>
2588 int main() {
2589 #ifdef msg_accrights
2590 #error "msg_accrights is a macro"
2591 exit(1);
2592 #endif
2593 struct msghdr m;
2594 m.msg_accrights = 0;
2595 exit(0);
2596 }
2597                 ],
2598                 [ ac_cv_have_accrights_in_msghdr="yes" ],
2599                 [ ac_cv_have_accrights_in_msghdr="no" ]
2600         )
2601 ])
2602 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
2603         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
2604                 [Define if your system uses access rights style
2605                 file descriptor passing])
2606 fi
2607
2608 AC_CACHE_CHECK([for msg_control field in struct msghdr],
2609                 ac_cv_have_control_in_msghdr, [
2610         AC_COMPILE_IFELSE(
2611                 [
2612 #include <sys/types.h>
2613 #include <sys/socket.h>
2614 #include <sys/uio.h>
2615 int main() {
2616 #ifdef msg_control
2617 #error "msg_control is a macro"
2618 exit(1);
2619 #endif
2620 struct msghdr m;
2621 m.msg_control = 0;
2622 exit(0);
2623 }
2624                 ],
2625                 [ ac_cv_have_control_in_msghdr="yes" ],
2626                 [ ac_cv_have_control_in_msghdr="no" ]
2627         )
2628 ])
2629 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
2630         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
2631                 [Define if your system uses ancillary data style
2632                 file descriptor passing])
2633 fi
2634
2635 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
2636         AC_TRY_LINK([],
2637                 [ extern char *__progname; printf("%s", __progname); ],
2638                 [ ac_cv_libc_defines___progname="yes" ],
2639                 [ ac_cv_libc_defines___progname="no" ]
2640         )
2641 ])
2642 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
2643         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
2644 fi
2645
2646 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
2647         AC_TRY_LINK([
2648 #include <stdio.h>
2649 ],
2650                 [ printf("%s", __FUNCTION__); ],
2651                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
2652                 [ ac_cv_cc_implements___FUNCTION__="no" ]
2653         )
2654 ])
2655 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
2656         AC_DEFINE(HAVE___FUNCTION__, 1,
2657                 [Define if compiler implements __FUNCTION__])
2658 fi
2659
2660 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
2661         AC_TRY_LINK([
2662 #include <stdio.h>
2663 ],
2664                 [ printf("%s", __func__); ],
2665                 [ ac_cv_cc_implements___func__="yes" ],
2666                 [ ac_cv_cc_implements___func__="no" ]
2667         )
2668 ])
2669 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
2670         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
2671 fi
2672
2673 AC_CACHE_CHECK([whether getopt has optreset support],
2674                 ac_cv_have_getopt_optreset, [
2675         AC_TRY_LINK(
2676                 [
2677 #include <getopt.h>
2678                 ],
2679                 [ extern int optreset; optreset = 0; ],
2680                 [ ac_cv_have_getopt_optreset="yes" ],
2681                 [ ac_cv_have_getopt_optreset="no" ]
2682         )
2683 ])
2684 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
2685         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
2686                 [Define if your getopt(3) defines and uses optreset])
2687 fi
2688
2689 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
2690         AC_TRY_LINK([],
2691                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
2692                 [ ac_cv_libc_defines_sys_errlist="yes" ],
2693                 [ ac_cv_libc_defines_sys_errlist="no" ]
2694         )
2695 ])
2696 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
2697         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
2698                 [Define if your system defines sys_errlist[]])
2699 fi
2700
2701
2702 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
2703         AC_TRY_LINK([],
2704                 [ extern int sys_nerr; printf("%i", sys_nerr);],
2705                 [ ac_cv_libc_defines_sys_nerr="yes" ],
2706                 [ ac_cv_libc_defines_sys_nerr="no" ]
2707         )
2708 ])
2709 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
2710         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
2711 fi
2712
2713 SCARD_MSG="no"
2714 # Check whether user wants sectok support
2715 AC_ARG_WITH(sectok,
2716         [  --with-sectok           Enable smartcard support using libsectok],
2717         [
2718                 if test "x$withval" != "xno" ; then
2719                         if test "x$withval" != "xyes" ; then
2720                                 CPPFLAGS="$CPPFLAGS -I${withval}"
2721                                 LDFLAGS="$LDFLAGS -L${withval}"
2722                                 if test ! -z "$need_dash_r" ; then
2723                                         LDFLAGS="$LDFLAGS -R${withval}"
2724                                 fi
2725                                 if test ! -z "$blibpath" ; then
2726                                         blibpath="$blibpath:${withval}"
2727                                 fi
2728                         fi
2729                         AC_CHECK_HEADERS(sectok.h)
2730                         if test "$ac_cv_header_sectok_h" != yes; then
2731                                 AC_MSG_ERROR(Can't find sectok.h)
2732                         fi
2733                         AC_CHECK_LIB(sectok, sectok_open)
2734                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
2735                                 AC_MSG_ERROR(Can't find libsectok)
2736                         fi
2737                         AC_DEFINE(SMARTCARD, 1,
2738                                 [Define if you want smartcard support])
2739                         AC_DEFINE(USE_SECTOK, 1,
2740                                 [Define if you want smartcard support
2741                                 using sectok])
2742                         SCARD_MSG="yes, using sectok"
2743                 fi
2744         ]
2745 )
2746
2747 # Check whether user wants OpenSC support
2748 OPENSC_CONFIG="no"
2749 AC_ARG_WITH(opensc,
2750         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
2751         [
2752             if test "x$withval" != "xno" ; then
2753                 if test "x$withval" != "xyes" ; then
2754                         OPENSC_CONFIG=$withval/bin/opensc-config
2755                 else
2756                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
2757                 fi
2758                 if test "$OPENSC_CONFIG" != "no"; then
2759                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
2760                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
2761                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
2762                         LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
2763                         AC_DEFINE(SMARTCARD)
2764                         AC_DEFINE(USE_OPENSC, 1,
2765                                 [Define if you want smartcard support
2766                                 using OpenSC])
2767                         SCARD_MSG="yes, using OpenSC"
2768                 fi
2769             fi
2770         ]
2771 )
2772
2773 # Check libraries needed by DNS fingerprint support
2774 AC_SEARCH_LIBS(getrrsetbyname, resolv,
2775         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
2776                 [Define if getrrsetbyname() exists])],
2777         [
2778                 # Needed by our getrrsetbyname()
2779                 AC_SEARCH_LIBS(res_query, resolv)
2780                 AC_SEARCH_LIBS(dn_expand, resolv)
2781                 AC_MSG_CHECKING(if res_query will link)
2782                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
2783                    [AC_MSG_RESULT(no)
2784                     saved_LIBS="$LIBS"
2785                     LIBS="$LIBS -lresolv"
2786                     AC_MSG_CHECKING(for res_query in -lresolv)
2787                     AC_LINK_IFELSE([
2788 #include <resolv.h>
2789 int main()
2790 {
2791         res_query (0, 0, 0, 0, 0);
2792         return 0;
2793 }
2794                         ],
2795                         [LIBS="$LIBS -lresolv"
2796                          AC_MSG_RESULT(yes)],
2797                         [LIBS="$saved_LIBS"
2798                          AC_MSG_RESULT(no)])
2799                     ])
2800                 AC_CHECK_FUNCS(_getshort _getlong)
2801                 AC_CHECK_DECLS([_getshort, _getlong], , ,
2802                     [#include <sys/types.h>
2803                     #include <arpa/nameser.h>])
2804                 AC_CHECK_MEMBER(HEADER.ad,
2805                         [AC_DEFINE(HAVE_HEADER_AD, 1,
2806                             [Define if HEADER.ad exists in arpa/nameser.h])],,
2807                         [#include <arpa/nameser.h>])
2808         ])
2809
2810 # Check whether user wants Kerberos 5 support
2811 KRB5_MSG="no"
2812 AC_ARG_WITH(kerberos5,
2813         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
2814         [ if test "x$withval" != "xno" ; then
2815                 if test "x$withval" = "xyes" ; then
2816                         KRB5ROOT="/usr/local"
2817                 else
2818                         KRB5ROOT=${withval}
2819                 fi
2820
2821                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
2822                 KRB5_MSG="yes"
2823
2824                 AC_MSG_CHECKING(for krb5-config)
2825                 if test -x  $KRB5ROOT/bin/krb5-config ; then
2826                         KRB5CONF=$KRB5ROOT/bin/krb5-config
2827                         AC_MSG_RESULT($KRB5CONF)
2828
2829                         AC_MSG_CHECKING(for gssapi support)
2830                         if $KRB5CONF | grep gssapi >/dev/null ; then
2831                                 AC_MSG_RESULT(yes)
2832                                 AC_DEFINE(GSSAPI, 1,
2833                                         [Define this if you want GSSAPI
2834                                         support in the version 2 protocol])
2835                                 k5confopts=gssapi
2836                         else
2837                                 AC_MSG_RESULT(no)
2838                                 k5confopts=""
2839                         fi
2840                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
2841                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
2842                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
2843                         AC_MSG_CHECKING(whether we are using Heimdal)
2844                         AC_TRY_COMPILE([ #include <krb5.h> ],
2845                                        [ char *tmp = heimdal_version; ],
2846                                        [ AC_MSG_RESULT(yes)
2847                                          AC_DEFINE(HEIMDAL, 1,
2848                                         [Define this if you are using the
2849                                         Heimdal version of Kerberos V5]) ],
2850                                          AC_MSG_RESULT(no)
2851                         )
2852                 else
2853                         AC_MSG_RESULT(no)
2854                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
2855                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
2856                         AC_MSG_CHECKING(whether we are using Heimdal)
2857                         AC_TRY_COMPILE([ #include <krb5.h> ],
2858                                        [ char *tmp = heimdal_version; ],
2859                                        [ AC_MSG_RESULT(yes)
2860                                          AC_DEFINE(HEIMDAL)
2861                                          K5LIBS="-lkrb5 -ldes"
2862                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
2863                                          AC_CHECK_LIB(roken, net_write,
2864                                            [K5LIBS="$K5LIBS -lroken"])
2865                                        ],
2866                                        [ AC_MSG_RESULT(no)
2867                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
2868                                        ]
2869                         )
2870                         AC_SEARCH_LIBS(dn_expand, resolv)
2871
2872                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
2873                                 [ AC_DEFINE(GSSAPI)
2874                                   K5LIBS="-lgssapi $K5LIBS" ],
2875                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
2876                                         [ AC_DEFINE(GSSAPI)
2877                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
2878                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
2879                                         $K5LIBS)
2880                                 ],
2881                                 $K5LIBS)
2882
2883                         AC_CHECK_HEADER(gssapi.h, ,
2884                                 [ unset ac_cv_header_gssapi_h
2885                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
2886                                   AC_CHECK_HEADERS(gssapi.h, ,
2887                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
2888                                   )
2889                                 ]
2890                         )
2891
2892                         oldCPP="$CPPFLAGS"
2893                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
2894                         AC_CHECK_HEADER(gssapi_krb5.h, ,
2895                                         [ CPPFLAGS="$oldCPP" ])
2896
2897                 fi
2898                 if test ! -z "$need_dash_r" ; then
2899                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
2900                 fi
2901                 if test ! -z "$blibpath" ; then
2902                         blibpath="$blibpath:${KRB5ROOT}/lib"
2903                 fi
2904
2905                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
2906                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
2907                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
2908
2909                 LIBS="$LIBS $K5LIBS"
2910                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
2911                         [Define this if you want to use libkafs' AFS support]))
2912         fi
2913         ]
2914 )
2915
2916 # Looking for programs, paths and files
2917
2918 PRIVSEP_PATH=/var/empty
2919 AC_ARG_WITH(privsep-path,
2920         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
2921         [
2922                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2923                     test "x${withval}" != "xyes"; then
2924                         PRIVSEP_PATH=$withval
2925                 fi
2926         ]
2927 )
2928 AC_SUBST(PRIVSEP_PATH)
2929
2930 AC_ARG_WITH(xauth,
2931         [  --with-xauth=PATH       Specify path to xauth program ],
2932         [
2933                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2934                     test "x${withval}" != "xyes"; then
2935                         xauth_path=$withval
2936                 fi
2937         ],
2938         [
2939                 TestPath="$PATH"
2940                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
2941                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
2942                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
2943                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
2944                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
2945                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
2946                         xauth_path="/usr/openwin/bin/xauth"
2947                 fi
2948         ]
2949 )
2950
2951 STRIP_OPT=-s
2952 AC_ARG_ENABLE(strip,
2953         [  --disable-strip         Disable calling strip(1) on install],
2954         [
2955                 if test "x$enableval" = "xno" ; then
2956                         STRIP_OPT=
2957                 fi
2958         ]
2959 )
2960 AC_SUBST(STRIP_OPT)
2961
2962 if test -z "$xauth_path" ; then
2963         XAUTH_PATH="undefined"
2964         AC_SUBST(XAUTH_PATH)
2965 else
2966         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
2967                 [Define if xauth is found in your path])
2968         XAUTH_PATH=$xauth_path
2969         AC_SUBST(XAUTH_PATH)
2970 fi
2971
2972 # Check for mail directory (last resort if we cannot get it from headers)
2973 if test ! -z "$MAIL" ; then
2974         maildir=`dirname $MAIL`
2975         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
2976                 [Set this to your mail directory if you don't have maillock.h])
2977 fi
2978
2979 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
2980         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
2981         disable_ptmx_check=yes
2982 fi
2983 if test -z "$no_dev_ptmx" ; then
2984         if test "x$disable_ptmx_check" != "xyes" ; then
2985                 AC_CHECK_FILE("/dev/ptmx",
2986                         [
2987                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
2988                                         [Define if you have /dev/ptmx])
2989                                 have_dev_ptmx=1
2990                         ]
2991                 )
2992         fi
2993 fi
2994
2995 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
2996         AC_CHECK_FILE("/dev/ptc",
2997                 [
2998                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
2999                                 [Define if you have /dev/ptc])
3000                         have_dev_ptc=1
3001                 ]
3002         )
3003 else
3004         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3005 fi
3006
3007 # Options from here on. Some of these are preset by platform above
3008 AC_ARG_WITH(mantype,
3009         [  --with-mantype=man|cat|doc  Set man page type],
3010         [
3011                 case "$withval" in
3012                 man|cat|doc)
3013                         MANTYPE=$withval
3014                         ;;
3015                 *)
3016                         AC_MSG_ERROR(invalid man type: $withval)
3017                         ;;
3018                 esac
3019         ]
3020 )
3021 if test -z "$MANTYPE"; then
3022         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3023         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3024         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3025                 MANTYPE=doc
3026         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3027                 MANTYPE=man
3028         else
3029                 MANTYPE=cat
3030         fi
3031 fi
3032 AC_SUBST(MANTYPE)
3033 if test "$MANTYPE" = "doc"; then
3034         mansubdir=man;
3035 else
3036         mansubdir=$MANTYPE;
3037 fi
3038 AC_SUBST(mansubdir)
3039
3040 # Check whether to enable MD5 passwords
3041 MD5_MSG="no"
3042 AC_ARG_WITH(md5-passwords,
3043         [  --with-md5-passwords    Enable use of MD5 passwords],
3044         [
3045                 if test "x$withval" != "xno" ; then
3046                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3047                                 [Define if you want to allow MD5 passwords])
3048                         MD5_MSG="yes"
3049                 fi
3050         ]
3051 )
3052
3053 # Whether to disable shadow password support
3054 AC_ARG_WITH(shadow,
3055         [  --without-shadow        Disable shadow password support],
3056         [
3057                 if test "x$withval" = "xno" ; then
3058                         AC_DEFINE(DISABLE_SHADOW)
3059                         disable_shadow=yes
3060                 fi
3061         ]
3062 )
3063
3064 if test -z "$disable_shadow" ; then
3065         AC_MSG_CHECKING([if the systems has expire shadow information])
3066         AC_TRY_COMPILE(
3067         [
3068 #include <sys/types.h>
3069 #include <shadow.h>
3070         struct spwd sp;
3071         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3072         [ sp_expire_available=yes ], []
3073         )
3074
3075         if test "x$sp_expire_available" = "xyes" ; then
3076                 AC_MSG_RESULT(yes)
3077                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3078                     [Define if you want to use shadow password expire field])
3079         else
3080                 AC_MSG_RESULT(no)
3081         fi
3082 fi
3083
3084 # Use ip address instead of hostname in $DISPLAY
3085 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3086         DISPLAY_HACK_MSG="yes"
3087         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3088                 [Define if you need to use IP address
3089                 instead of hostname in $DISPLAY])
3090 else
3091         DISPLAY_HACK_MSG="no"
3092         AC_ARG_WITH(ipaddr-display,
3093                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3094                 [
3095                         if test "x$withval" != "xno" ; then
3096                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3097                                 DISPLAY_HACK_MSG="yes"
3098                         fi
3099                 ]
3100         )
3101 fi
3102
3103 # check for /etc/default/login and use it if present.
3104 AC_ARG_ENABLE(etc-default-login,
3105         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3106         [ if test "x$enableval" = "xno"; then
3107                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3108                 etc_default_login=no
3109           else
3110                 etc_default_login=yes
3111           fi ],
3112         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3113           then
3114                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3115                 etc_default_login=no
3116           else
3117                 etc_default_login=yes
3118           fi ]
3119 )
3120
3121 if test "x$etc_default_login" != "xno"; then
3122         AC_CHECK_FILE("/etc/default/login",
3123             [ external_path_file=/etc/default/login ])
3124         if test "x$external_path_file" = "x/etc/default/login"; then
3125                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3126                         [Define if your system has /etc/default/login])
3127         fi
3128 fi
3129
3130 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3131 if test $ac_cv_func_login_getcapbool = "yes" && \
3132         test $ac_cv_header_login_cap_h = "yes" ; then
3133         external_path_file=/etc/login.conf
3134 fi
3135
3136 # Whether to mess with the default path
3137 SERVER_PATH_MSG="(default)"
3138 AC_ARG_WITH(default-path,
3139         [  --with-default-path=    Specify default \$PATH environment for server],
3140         [
3141                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3142                         AC_MSG_WARN([
3143 --with-default-path=PATH has no effect on this system.
3144 Edit /etc/login.conf instead.])
3145                 elif test "x$withval" != "xno" ; then
3146                         if test ! -z "$external_path_file" ; then
3147                                 AC_MSG_WARN([
3148 --with-default-path=PATH will only be used if PATH is not defined in
3149 $external_path_file .])
3150                         fi
3151                         user_path="$withval"
3152                         SERVER_PATH_MSG="$withval"
3153                 fi
3154         ],
3155         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3156                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3157         else
3158                 if test ! -z "$external_path_file" ; then
3159                         AC_MSG_WARN([
3160 If PATH is defined in $external_path_file, ensure the path to scp is included,
3161 otherwise scp will not work.])
3162                 fi
3163                 AC_RUN_IFELSE(
3164                         [AC_LANG_SOURCE([[
3165 /* find out what STDPATH is */
3166 #include <stdio.h>
3167 #ifdef HAVE_PATHS_H
3168 # include <paths.h>
3169 #endif
3170 #ifndef _PATH_STDPATH
3171 # ifdef _PATH_USERPATH  /* Irix */
3172 #  define _PATH_STDPATH _PATH_USERPATH
3173 # else
3174 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3175 # endif
3176 #endif
3177 #include <sys/types.h>
3178 #include <sys/stat.h>
3179 #include <fcntl.h>
3180 #define DATA "conftest.stdpath"
3181
3182 main()
3183 {
3184         FILE *fd;
3185         int rc;
3186
3187         fd = fopen(DATA,"w");
3188         if(fd == NULL)
3189                 exit(1);
3190
3191         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3192                 exit(1);
3193
3194         exit(0);
3195 }
3196                 ]])],
3197                 [ user_path=`cat conftest.stdpath` ],
3198                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3199                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3200         )
3201 # make sure $bindir is in USER_PATH so scp will work
3202                 t_bindir=`eval echo ${bindir}`
3203                 case $t_bindir in
3204                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3205                 esac
3206                 case $t_bindir in
3207                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3208                 esac
3209                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3210                 if test $? -ne 0  ; then
3211                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3212                         if test $? -ne 0  ; then
3213                                 user_path=$user_path:$t_bindir
3214                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3215                         fi
3216                 fi
3217         fi ]
3218 )
3219 if test "x$external_path_file" != "x/etc/login.conf" ; then
3220         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3221         AC_SUBST(user_path)
3222 fi
3223
3224 # Set superuser path separately to user path
3225 AC_ARG_WITH(superuser-path,
3226         [  --with-superuser-path=  Specify different path for super-user],
3227         [
3228                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3229                     test "x${withval}" != "xyes"; then
3230                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3231                                 [Define if you want a different $PATH
3232                                 for the superuser])
3233                         superuser_path=$withval
3234                 fi
3235         ]
3236 )
3237
3238
3239 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3240 IPV4_IN6_HACK_MSG="no"
3241 AC_ARG_WITH(4in6,
3242         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3243         [
3244                 if test "x$withval" != "xno" ; then
3245                         AC_MSG_RESULT(yes)
3246                         AC_DEFINE(IPV4_IN_IPV6, 1,
3247                                 [Detect IPv4 in IPv6 mapped addresses
3248                                 and treat as IPv4])
3249                         IPV4_IN6_HACK_MSG="yes"
3250                 else
3251                         AC_MSG_RESULT(no)
3252                 fi
3253         ],[
3254                 if test "x$inet6_default_4in6" = "xyes"; then
3255                         AC_MSG_RESULT([yes (default)])
3256                         AC_DEFINE(IPV4_IN_IPV6)
3257                         IPV4_IN6_HACK_MSG="yes"
3258                 else
3259                         AC_MSG_RESULT([no (default)])
3260                 fi
3261         ]
3262 )
3263
3264 # Whether to enable BSD auth support
3265 BSD_AUTH_MSG=no
3266 AC_ARG_WITH(bsd-auth,
3267         [  --with-bsd-auth         Enable BSD auth support],
3268         [
3269                 if test "x$withval" != "xno" ; then
3270                         AC_DEFINE(BSD_AUTH, 1,
3271                                 [Define if you have BSD auth support])
3272                         BSD_AUTH_MSG=yes
3273                 fi
3274         ]
3275 )
3276
3277 # Where to place sshd.pid
3278 piddir=/var/run
3279 # make sure the directory exists
3280 if test ! -d $piddir ; then
3281         piddir=`eval echo ${sysconfdir}`
3282         case $piddir in
3283                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3284         esac
3285 fi
3286
3287 AC_ARG_WITH(pid-dir,
3288         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3289         [
3290                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3291                     test "x${withval}" != "xyes"; then
3292                         piddir=$withval
3293                         if test ! -d $piddir ; then
3294                         AC_MSG_WARN([** no $piddir directory on this system **])
3295                         fi
3296                 fi
3297         ]
3298 )
3299
3300 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3301 AC_SUBST(piddir)
3302
3303 dnl allow user to disable some login recording features
3304 AC_ARG_ENABLE(lastlog,
3305         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3306         [
3307                 if test "x$enableval" = "xno" ; then
3308                         AC_DEFINE(DISABLE_LASTLOG)
3309                 fi
3310         ]
3311 )
3312 AC_ARG_ENABLE(utmp,
3313         [  --disable-utmp          disable use of utmp even if detected [no]],
3314         [
3315                 if test "x$enableval" = "xno" ; then
3316                         AC_DEFINE(DISABLE_UTMP)
3317                 fi
3318         ]
3319 )
3320 AC_ARG_ENABLE(utmpx,
3321         [  --disable-utmpx         disable use of utmpx even if detected [no]],
3322         [
3323                 if test "x$enableval" = "xno" ; then
3324                         AC_DEFINE(DISABLE_UTMPX, 1,
3325                                 [Define if you don't want to use utmpx])
3326                 fi
3327         ]
3328 )
3329 AC_ARG_ENABLE(wtmp,
3330         [  --disable-wtmp          disable use of wtmp even if detected [no]],
3331         [
3332                 if test "x$enableval" = "xno" ; then
3333                         AC_DEFINE(DISABLE_WTMP)
3334                 fi
3335         ]
3336 )
3337 AC_ARG_ENABLE(wtmpx,
3338         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
3339         [
3340                 if test "x$enableval" = "xno" ; then
3341                         AC_DEFINE(DISABLE_WTMPX, 1,
3342                                 [Define if you don't want to use wtmpx])
3343                 fi
3344         ]
3345 )
3346 AC_ARG_ENABLE(libutil,
3347         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
3348         [
3349                 if test "x$enableval" = "xno" ; then
3350                         AC_DEFINE(DISABLE_LOGIN)
3351                 fi
3352         ]
3353 )
3354 AC_ARG_ENABLE(pututline,
3355         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
3356         [
3357                 if test "x$enableval" = "xno" ; then
3358                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
3359                                 [Define if you don't want to use pututline()
3360                                 etc. to write [uw]tmp])
3361                 fi
3362         ]
3363 )
3364 AC_ARG_ENABLE(pututxline,
3365         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
3366         [
3367                 if test "x$enableval" = "xno" ; then
3368                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
3369                                 [Define if you don't want to use pututxline()
3370                                 etc. to write [uw]tmpx])
3371                 fi
3372         ]
3373 )
3374 AC_ARG_WITH(lastlog,
3375   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
3376         [
3377                 if test "x$withval" = "xno" ; then
3378                         AC_DEFINE(DISABLE_LASTLOG)
3379                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
3380                         conf_lastlog_location=$withval
3381                 fi
3382         ]
3383 )
3384
3385 dnl lastlog, [uw]tmpx? detection
3386 dnl  NOTE: set the paths in the platform section to avoid the
3387 dnl   need for command-line parameters
3388 dnl lastlog and [uw]tmp are subject to a file search if all else fails
3389
3390 dnl lastlog detection
3391 dnl  NOTE: the code itself will detect if lastlog is a directory
3392 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
3393 AC_TRY_COMPILE([
3394 #include <sys/types.h>
3395 #include <utmp.h>
3396 #ifdef HAVE_LASTLOG_H
3397 #  include <lastlog.h>
3398 #endif
3399 #ifdef HAVE_PATHS_H
3400 #  include <paths.h>
3401 #endif
3402 #ifdef HAVE_LOGIN_H
3403 # include <login.h>
3404 #endif
3405         ],
3406         [ char *lastlog = LASTLOG_FILE; ],
3407         [ AC_MSG_RESULT(yes) ],
3408         [
3409                 AC_MSG_RESULT(no)
3410                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
3411                 AC_TRY_COMPILE([
3412 #include <sys/types.h>
3413 #include <utmp.h>
3414 #ifdef HAVE_LASTLOG_H
3415 #  include <lastlog.h>
3416 #endif
3417 #ifdef HAVE_PATHS_H
3418 #  include <paths.h>
3419 #endif
3420                 ],
3421                 [ char *lastlog = _PATH_LASTLOG; ],
3422                 [ AC_MSG_RESULT(yes) ],
3423                 [
3424                         AC_MSG_RESULT(no)
3425                         system_lastlog_path=no
3426                 ])
3427         ]
3428 )
3429
3430 if test -z "$conf_lastlog_location"; then
3431         if test x"$system_lastlog_path" = x"no" ; then
3432                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
3433                                 if (test -d "$f" || test -f "$f") ; then
3434                                         conf_lastlog_location=$f
3435                                 fi
3436                 done
3437                 if test -z "$conf_lastlog_location"; then
3438                         AC_MSG_WARN([** Cannot find lastlog **])
3439                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
3440                 fi
3441         fi
3442 fi
3443
3444 if test -n "$conf_lastlog_location"; then
3445         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
3446                 [Define if you want to specify the path to your lastlog file])
3447 fi
3448
3449 dnl utmp detection
3450 AC_MSG_CHECKING([if your system defines UTMP_FILE])
3451 AC_TRY_COMPILE([
3452 #include <sys/types.h>
3453 #include <utmp.h>
3454 #ifdef HAVE_PATHS_H
3455 #  include <paths.h>
3456 #endif
3457         ],
3458         [ char *utmp = UTMP_FILE; ],
3459         [ AC_MSG_RESULT(yes) ],
3460         [ AC_MSG_RESULT(no)
3461           system_utmp_path=no ]
3462 )
3463 if test -z "$conf_utmp_location"; then
3464         if test x"$system_utmp_path" = x"no" ; then
3465                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
3466                         if test -f $f ; then
3467                                 conf_utmp_location=$f
3468                         fi
3469                 done
3470                 if test -z "$conf_utmp_location"; then
3471                         AC_DEFINE(DISABLE_UTMP)
3472                 fi
3473         fi
3474 fi
3475 if test -n "$conf_utmp_location"; then
3476         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
3477                 [Define if you want to specify the path to your utmp file])
3478 fi
3479
3480 dnl wtmp detection
3481 AC_MSG_CHECKING([if your system defines WTMP_FILE])
3482 AC_TRY_COMPILE([
3483 #include <sys/types.h>
3484 #include <utmp.h>
3485 #ifdef HAVE_PATHS_H
3486 #  include <paths.h>
3487 #endif
3488         ],
3489         [ char *wtmp = WTMP_FILE; ],
3490         [ AC_MSG_RESULT(yes) ],
3491         [ AC_MSG_RESULT(no)
3492           system_wtmp_path=no ]
3493 )
3494 if test -z "$conf_wtmp_location"; then
3495         if test x"$system_wtmp_path" = x"no" ; then
3496                 for f in /usr/adm/wtmp /var/log/wtmp; do
3497                         if test -f $f ; then
3498                                 conf_wtmp_location=$f
3499                         fi
3500                 done
3501                 if test -z "$conf_wtmp_location"; then
3502                         AC_DEFINE(DISABLE_WTMP)
3503                 fi
3504         fi
3505 fi
3506 if test -n "$conf_wtmp_location"; then
3507         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
3508                 [Define if you want to specify the path to your wtmp file])
3509 fi
3510
3511
3512 dnl utmpx detection - I don't know any system so perverse as to require
3513 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
3514 dnl  there, though.
3515 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
3516 AC_TRY_COMPILE([
3517 #include <sys/types.h>
3518 #include <utmp.h>
3519 #ifdef HAVE_UTMPX_H
3520 #include <utmpx.h>
3521 #endif
3522 #ifdef HAVE_PATHS_H
3523 #  include <paths.h>
3524 #endif
3525         ],
3526         [ char *utmpx = UTMPX_FILE; ],
3527         [ AC_MSG_RESULT(yes) ],
3528         [ AC_MSG_RESULT(no)
3529           system_utmpx_path=no ]
3530 )
3531 if test -z "$conf_utmpx_location"; then
3532         if test x"$system_utmpx_path" = x"no" ; then
3533                 AC_DEFINE(DISABLE_UTMPX)
3534         fi
3535 else
3536         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
3537                 [Define if you want to specify the path to your utmpx file])
3538 fi
3539
3540 dnl wtmpx detection
3541 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
3542 AC_TRY_COMPILE([
3543 #include <sys/types.h>
3544 #include <utmp.h>
3545 #ifdef HAVE_UTMPX_H
3546 #include <utmpx.h>
3547 #endif
3548 #ifdef HAVE_PATHS_H
3549 #  include <paths.h>
3550 #endif
3551         ],
3552         [ char *wtmpx = WTMPX_FILE; ],
3553         [ AC_MSG_RESULT(yes) ],
3554         [ AC_MSG_RESULT(no)
3555           system_wtmpx_path=no ]
3556 )
3557 if test -z "$conf_wtmpx_location"; then
3558         if test x"$system_wtmpx_path" = x"no" ; then
3559                 AC_DEFINE(DISABLE_WTMPX)
3560         fi
3561 else
3562         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
3563                 [Define if you want to specify the path to your wtmpx file])
3564 fi
3565
3566
3567 if test ! -z "$blibpath" ; then
3568         LDFLAGS="$LDFLAGS $blibflags$blibpath"
3569         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
3570 fi
3571
3572 dnl remove pam and dl because they are in $LIBPAM
3573 if test "$PAM_MSG" = yes ; then
3574         LIBS=`echo $LIBS | sed 's/-lpam //'`
3575 fi
3576 if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
3577         LIBS=`echo $LIBS | sed 's/-ldl //'`
3578 fi
3579
3580 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
3581 dnl Add now.
3582 CFLAGS="$CFLAGS $werror_flags"
3583
3584 AC_EXEEXT
3585 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openbsd-compat/Makefile \
3586         scard/Makefile ssh_prng_cmds survey.sh])
3587 AC_OUTPUT
3588
3589 # Print summary of options
3590
3591 # Someone please show me a better way :)
3592 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
3593 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
3594 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
3595 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
3596 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
3597 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
3598 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
3599 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
3600 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
3601 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
3602
3603 echo ""
3604 echo "OpenSSH has been configured with the following options:"
3605 echo "                     User binaries: $B"
3606 echo "                   System binaries: $C"
3607 echo "               Configuration files: $D"
3608 echo "                   Askpass program: $E"
3609 echo "                      Manual pages: $F"
3610 echo "                          PID file: $G"
3611 echo "  Privilege separation chroot path: $H"
3612 if test "x$external_path_file" = "x/etc/login.conf" ; then
3613 echo "   At runtime, sshd will use the path defined in $external_path_file"
3614 echo "   Make sure the path to scp is present, otherwise scp will not work"
3615 else
3616 echo "            sshd default user PATH: $I"
3617         if test ! -z "$external_path_file"; then
3618 echo "   (If PATH is set in $external_path_file it will be used instead. If"
3619 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
3620         fi
3621 fi
3622 if test ! -z "$superuser_path" ; then
3623 echo "          sshd superuser user PATH: $J"
3624 fi
3625 echo "                    Manpage format: $MANTYPE"
3626 echo "                       PAM support: $PAM_MSG"
3627 echo "                 KerberosV support: $KRB5_MSG"
3628 echo "                 Smartcard support: $SCARD_MSG"
3629 echo "                     S/KEY support: $SKEY_MSG"
3630 echo "              TCP Wrappers support: $TCPW_MSG"
3631 echo "              MD5 password support: $MD5_MSG"
3632 echo "                   libedit support: $LIBEDIT_MSG"
3633 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
3634 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
3635 echo "                  BSD Auth support: $BSD_AUTH_MSG"
3636 echo "              Random number source: $RAND_MSG"
3637 if test ! -z "$USE_RAND_HELPER" ; then
3638 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
3639 fi
3640
3641 echo ""
3642
3643 echo "              Host: ${host}"
3644 echo "          Compiler: ${CC}"
3645 echo "    Compiler flags: ${CFLAGS}"
3646 echo "Preprocessor flags: ${CPPFLAGS}"
3647 echo "      Linker flags: ${LDFLAGS}"
3648 echo "         Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}"
3649
3650 echo ""
3651
3652 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
3653         echo "SVR4 style packages are supported with \"make package\""
3654         echo ""
3655 fi
3656
3657 if test "x$PAM_MSG" = "xyes" ; then
3658         echo "PAM is enabled. You may need to install a PAM control file "
3659         echo "for sshd, otherwise password authentication may fail. "
3660         echo "Example PAM control files can be found in the contrib/ "
3661         echo "subdirectory"
3662         echo ""
3663 fi
3664
3665 if test ! -z "$RAND_HELPER_CMDHASH" ; then
3666         echo "WARNING: you are using the builtin random number collection "
3667         echo "service. Please read WARNING.RNG and request that your OS "
3668         echo "vendor includes kernel-based random number collection in "
3669         echo "future versions of your OS."
3670         echo ""
3671 fi
3672
3673 if test ! -z "$NO_PEERCHECK" ; then
3674         echo "WARNING: the operating system that you are using does not "
3675         echo "appear to support either the getpeereid() API nor the "
3676         echo "SO_PEERCRED getsockopt() option. These facilities are used to "
3677         echo "enforce security checks to prevent unauthorised connections to "
3678         echo "ssh-agent. Their absence increases the risk that a malicious "
3679         echo "user can connect to your agent. "
3680         echo ""
3681 fi
3682
3683 if test "$AUDIT_MODULE" = "bsm" ; then
3684         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
3685         echo "See the Solaris section in README.platform for details."
3686 fi